1041 files changed, 56768 insertions, 16930 deletions

diff --git a/CREDITS b/CREDITS
index 0bf31eac6dc2..787564bc248b 100644
--- a/CREDITS
+++ b/CREDITS
@@ -3382,7 +3382,7 @@ S: Germany
 
 N: Geert Uytterhoeven
 E: geert@linux-m68k.org
-W: http://home.tvd.be/cr26864/
+W: http://users.telenet.be/geertu/
 P: 1024/862678A6 C51D 361C 0BD1 4C90 B275  C553 6EEA 11BA 8626 78A6
 D: m68k/Amiga and PPC/CHRP Longtrail coordinator
 D: Frame buffer device and XF68_FBDev maintainer
@@ -3392,8 +3392,8 @@ D: Amiga Buddha and Catweasel chipset IDE
 D: Atari Falcon chipset IDE
 D: Amiga Gayle chipset IDE
 D: mipsel NEC DDB Vrc-5074
-S: Emiel Vlieberghlaan 2A/21
-S: B-3010 Kessel-Lo
+S: Haterbeekstraat 55B
+S: B-3200 Aarschot
 S: Belgium
 
 N: Chris Vance
diff --git a/Documentation/DMA-mapping.txt b/Documentation/DMA-mapping.txt
index ee4bb73683cd..10bf4deb96aa 100644
--- a/Documentation/DMA-mapping.txt
+++ b/Documentation/DMA-mapping.txt
@@ -194,7 +194,7 @@ document for how to handle this case.
 Finally, if your device can only drive the low 24-bits of
 address during PCI bus mastering you might do something like:
 
-        if (pci_set_dma_mask(pdev, 0x00ffffff)) {
+        if (pci_set_dma_mask(pdev, DMA_24BIT_MASK)) {
                 printk(KERN_WARNING
                        "mydev: 24-bit DMA addressing not available.\n");
                 goto ignore_this_device;
@@ -212,7 +212,7 @@ functions (for example a sound card provides playback and record
 functions) and the various different functions have _different_
 DMA addressing limitations, you may wish to probe each mask and
 only provide the functionality which the machine can handle.  It
-is important that the last call to pci_set_dma_mask() be for the 
+is important that the last call to pci_set_dma_mask() be for the
 most specific mask.
 
 Here is pseudo-code showing how this might be done:
diff --git a/Documentation/DocBook/Makefile b/Documentation/DocBook/Makefile
index 7d87dd73cbe4..5a2882d275ba 100644
--- a/Documentation/DocBook/Makefile
+++ b/Documentation/DocBook/Makefile
@@ -2,7 +2,7 @@
 # This makefile is used to generate the kernel documentation,
 # primarily based on in-line comments in various source files.
 # See Documentation/kernel-doc-nano-HOWTO.txt for instruction in how
-# to ducument the SRC - and how to read it.
+# to document the SRC - and how to read it.
 # To add a new book the only step required is to add the book to the
 # list of DOCBOOKS.
 
diff --git a/Documentation/DocBook/kernel-api.tmpl b/Documentation/DocBook/kernel-api.tmpl
index 8c9c6704e85b..ca02e04a906c 100644
--- a/Documentation/DocBook/kernel-api.tmpl
+++ b/Documentation/DocBook/kernel-api.tmpl
@@ -322,7 +322,6 @@ X!Earch/i386/kernel/mca.c
   <chapter id="sysfs">
      <title>The Filesystem for Exporting Kernel Objects</title>
 !Efs/sysfs/file.c
-!Efs/sysfs/dir.c
 !Efs/sysfs/symlink.c
 !Efs/sysfs/bin.c
   </chapter>
diff --git a/Documentation/DocBook/libata.tmpl b/Documentation/DocBook/libata.tmpl
index 5bcbb6ee3bc0..f869b03929db 100644
--- a/Documentation/DocBook/libata.tmpl
+++ b/Documentation/DocBook/libata.tmpl
@@ -705,7 +705,7 @@ and other resources, etc.
 
         <sect1><title>ata_scsi_error()</title>
         <para>
-        ata_scsi_error() is the current hostt->eh_strategy_handler()
+        ata_scsi_error() is the current transportt->eh_strategy_handler()
         for libata.  As discussed above, this will be entered in two
         cases - timeout and ATAPI error completion.  This function
         calls low level libata driver's eng_timeout() callback, the
diff --git a/Documentation/acpi-hotkey.txt b/Documentation/acpi-hotkey.txt
index 744f1aec6553..38040fa37649 100644
--- a/Documentation/acpi-hotkey.txt
+++ b/Documentation/acpi-hotkey.txt
@@ -30,7 +30,7 @@ specific hotkey(event))
 echo "event_num:event_type:event_argument" > 
         /proc/acpi/hotkey/action.
 The result of the execution of this aml method is 
-attached to /proc/acpi/hotkey/poll_method, which is dnyamically
+attached to /proc/acpi/hotkey/poll_method, which is dynamically
 created.  Please use command "cat /proc/acpi/hotkey/polling_method" 
 to retrieve it.
 
diff --git a/Documentation/feature-removal-schedule.txt b/Documentation/feature-removal-schedule.txt
index 59d0c74c79c9..293fed113dff 100644
--- a/Documentation/feature-removal-schedule.txt
+++ b/Documentation/feature-removal-schedule.txt
@@ -71,14 +71,6 @@ Who:	Mauro Carvalho Chehab <mchehab@brturbo.com.br>
 
 ---------------------------
 
-What:   remove EXPORT_SYMBOL(panic_timeout)
-When:   April 2006
-Files:  kernel/panic.c
-Why:    No modular usage in the kernel.
-Who:    Adrian Bunk <bunk@stusta.de>
-
----------------------------
-
 What:   remove EXPORT_SYMBOL(insert_resource)
 When:   April 2006
 Files:  kernel/resource.c
diff --git a/Documentation/filesystems/vfs.txt b/Documentation/filesystems/vfs.txt
index adaa899e5c90..3a2e5520c1e3 100644
--- a/Documentation/filesystems/vfs.txt
+++ b/Documentation/filesystems/vfs.txt
@@ -694,7 +694,7 @@ struct file_operations
 ----------------------
 
 This describes how the VFS can manipulate an open file. As of kernel
-2.6.13, the following members are defined:
+2.6.17, the following members are defined:
 
 struct file_operations {
         loff_t (*llseek) (struct file *, loff_t, int);
@@ -723,6 +723,10 @@ struct file_operations {
         int (*check_flags)(int);
         int (*dir_notify)(struct file *filp, unsigned long arg);
         int (*flock) (struct file *, int, struct file_lock *);
+        ssize_t (*splice_write)(struct pipe_inode_info *, struct file *, size_t, unsigned 
+int);
+        ssize_t (*splice_read)(struct file *, struct pipe_inode_info *, size_t, unsigned  
+int);
 };
 
 Again, all methods are called without any locks being held, unless
@@ -790,6 +794,12 @@ otherwise noted.
 
   flock: called by the flock(2) system call
 
+  splice_write: called by the VFS to splice data from a pipe to a file. This
+                method is used by the splice(2) system call
+
+  splice_read: called by the VFS to splice data from file to a pipe. This
+               method is used by the splice(2) system call
+
 Note that the file operations are implemented by the specific
 filesystem in which the inode resides. When opening a device node
 (character or block special) most filesystems will call special
diff --git a/Documentation/fujitsu/frv/kernel-ABI.txt b/Documentation/fujitsu/frv/kernel-ABI.txt
index 0ed9b0a779bc..8b0a5fc8bfd9 100644
--- a/Documentation/fujitsu/frv/kernel-ABI.txt
+++ b/Documentation/fujitsu/frv/kernel-ABI.txt
@@ -1,17 +1,19 @@
-                                 =================================
-                                 INTERNAL KERNEL ABI FOR FR-V ARCH
-                                 =================================
-
-The internal FRV kernel ABI is not quite the same as the userspace ABI. A number of the registers
-are used for special purposed, and the ABI is not consistent between modules vs core, and MMU vs
-no-MMU.
-
-This partly stems from the fact that FRV CPUs do not have a separate supervisor stack pointer, and
-most of them do not have any scratch registers, thus requiring at least one general purpose
-register to be clobbered in such an event. Also, within the kernel core, it is possible to simply
-jump or call directly between functions using a relative offset. This cannot be extended to modules
-for the displacement is likely to be too far. Thus in modules the address of a function to call
-must be calculated in a register and then used, requiring two extra instructions.
+                        =================================
+                        INTERNAL KERNEL ABI FOR FR-V ARCH
+                        =================================
+
+The internal FRV kernel ABI is not quite the same as the userspace ABI. A
+number of the registers are used for special purposed, and the ABI is not
+consistent between modules vs core, and MMU vs no-MMU.
+
+This partly stems from the fact that FRV CPUs do not have a separate
+supervisor stack pointer, and most of them do not have any scratch
+registers, thus requiring at least one general purpose register to be
+clobbered in such an event. Also, within the kernel core, it is possible to
+simply jump or call directly between functions using a relative offset.
+This cannot be extended to modules for the displacement is likely to be too
+far. Thus in modules the address of a function to call must be calculated
+in a register and then used, requiring two extra instructions.
 
 This document has the following sections:
 
@@ -39,7 +41,8 @@ When a system call is made, the following registers are effective:
 CPU OPERATING MODES
 ===================
 
-The FR-V CPU has three basic operating modes. In order of increasing capability:
+The FR-V CPU has three basic operating modes. In order of increasing
+capability:
 
   (1) User mode.
 
@@ -47,42 +50,46 @@ The FR-V CPU has three basic operating modes. In order of increasing capability:
 
   (2) Kernel mode.
 
-      Normal kernel mode. There are many additional control registers available that may be
-      accessed in this mode, in addition to all the stuff available to user mode. This has two
-      submodes:
+      Normal kernel mode. There are many additional control registers
+      available that may be accessed in this mode, in addition to all the
+      stuff available to user mode. This has two submodes:
 
       (a) Exceptions enabled (PSR.T == 1).
 
-          Exceptions will invoke the appropriate normal kernel mode handler. On entry to the
-          handler, the PSR.T bit will be cleared.
+          Exceptions will invoke the appropriate normal kernel mode
+          handler. On entry to the handler, the PSR.T bit will be cleared.
 
       (b) Exceptions disabled (PSR.T == 0).
 
-          No exceptions or interrupts may happen. Any mandatory exceptions will cause the CPU to
-          halt unless the CPU is told to jump into debug mode instead.
+          No exceptions or interrupts may happen. Any mandatory exceptions
+          will cause the CPU to halt unless the CPU is told to jump into
+          debug mode instead.
 
   (3) Debug mode.
 
-      No exceptions may happen in this mode. Memory protection and management exceptions will be
-      flagged for later consideration, but the exception handler won't be invoked. Debugging traps
-      such as hardware breakpoints and watchpoints will be ignored. This mode is entered only by
-      debugging events obtained from the other two modes.
+      No exceptions may happen in this mode. Memory protection and
+      management exceptions will be flagged for later consideration, but
+      the exception handler won't be invoked. Debugging traps such as
+      hardware breakpoints and watchpoints will be ignored. This mode is
+      entered only by debugging events obtained from the other two modes.
 
-      All kernel mode registers may be accessed, plus a few extra debugging specific registers.
+      All kernel mode registers may be accessed, plus a few extra debugging
+      specific registers.
 
 
 =================================
 INTERNAL KERNEL-MODE REGISTER ABI
 =================================
 
-There are a number of permanent register assignments that are set up by entry.S in the exception
-prologue. Note that there is a complete set of exception prologues for each of user->kernel
-transition and kernel->kernel transition. There are also user->debug and kernel->debug mode
-transition prologues.
+There are a number of permanent register assignments that are set up by
+entry.S in the exception prologue. Note that there is a complete set of
+exception prologues for each of user->kernel transition and kernel->kernel
+transition. There are also user->debug and kernel->debug mode transition
+prologues.
 
 
         REGISTER        FLAVOUR USE
-        =============== ======= ====================================================
+        =============== ======= ==============================================
         GR1                     Supervisor stack pointer
         GR15                    Current thread info pointer
         GR16                    GP-Rel base register for small data
@@ -92,10 +99,12 @@ transition prologues.
         GR31            NOMMU   Destroyed by debug mode entry
         GR31            MMU     Destroyed by TLB miss kernel mode entry
         CCR.ICC2                Virtual interrupt disablement tracking
-        CCCR.CC3                Cleared by exception prologue (atomic op emulation)
+        CCCR.CC3                Cleared by exception prologue 
+                                (atomic op emulation)
         SCR0            MMU     See mmu-layout.txt.
         SCR1            MMU     See mmu-layout.txt.
-        SCR2            MMU     Save for EAR0 (destroyed by icache insns in debug mode)
+        SCR2            MMU     Save for EAR0 (destroyed by icache insns 
+                                               in debug mode)
         SCR3            MMU     Save for GR31 during debug exceptions
         DAMR/IAMR       NOMMU   Fixed memory protection layout.
         DAMR/IAMR       MMU     See mmu-layout.txt.
@@ -104,18 +113,21 @@ transition prologues.
 Certain registers are also used or modified across function calls:
 
         REGISTER        CALL                            RETURN
-        =============== =============================== ===============================
+        =============== =============================== ======================
         GR0             Fixed Zero                      -
         GR2             Function call frame pointer
         GR3             Special                         Preserved
         GR3-GR7         -                               Clobbered
-        GR8             Function call arg #1            Return value (or clobbered)
-        GR9             Function call arg #2            Return value MSW (or clobbered)
+        GR8             Function call arg #1            Return value 
+                                                        (or clobbered)
+        GR9             Function call arg #2            Return value MSW 
+                                                        (or clobbered)
         GR10-GR13       Function call arg #3-#6         Clobbered
         GR14            -                               Clobbered
         GR15-GR16       Special                         Preserved
         GR17-GR27       -                               Preserved
-        GR28-GR31       Special                         Only accessed explicitly
+        GR28-GR31       Special                         Only accessed 
+                                                        explicitly
         LR              Return address after CALL       Clobbered
         CCR/CCCR        -                               Mostly Clobbered
 
@@ -124,46 +136,53 @@ Certain registers are also used or modified across function calls:
 INTERNAL DEBUG-MODE REGISTER ABI
 ================================
 
-This is the same as the kernel-mode register ABI for functions calls. The difference is that in
-debug-mode there's a different stack and a different exception frame. Almost all the global
-registers from kernel-mode (including the stack pointer) may be changed.
+This is the same as the kernel-mode register ABI for functions calls. The
+difference is that in debug-mode there's a different stack and a different
+exception frame. Almost all the global registers from kernel-mode
+(including the stack pointer) may be changed.
 
         REGISTER        FLAVOUR USE
-        =============== ======= ====================================================
+        =============== ======= ==============================================
         GR1                     Debug stack pointer
         GR16                    GP-Rel base register for small data
-        GR31                    Current debug exception frame pointer (__debug_frame)
+        GR31                    Current debug exception frame pointer 
+                                (__debug_frame)
         SCR3            MMU     Saved value of GR31
 
 
-Note that debug mode is able to interfere with the kernel's emulated atomic ops, so it must be
-exceedingly careful not to do any that would interact with the main kernel in this regard. Hence
-the debug mode code (gdbstub) is almost completely self-contained. The only external code used is
-the sprintf family of functions.
+Note that debug mode is able to interfere with the kernel's emulated atomic
+ops, so it must be exceedingly careful not to do any that would interact
+with the main kernel in this regard. Hence the debug mode code (gdbstub) is
+almost completely self-contained. The only external code used is the
+sprintf family of functions.
 
-Futhermore, break.S is so complicated because single-step mode does not switch off on entry to an
-exception. That means unless manually disabled, single-stepping will blithely go on stepping into
-things like interrupts. See gdbstub.txt for more information.
+Futhermore, break.S is so complicated because single-step mode does not
+switch off on entry to an exception. That means unless manually disabled,
+single-stepping will blithely go on stepping into things like interrupts.
+See gdbstub.txt for more information.
 
 
 ==========================
 VIRTUAL INTERRUPT HANDLING
 ==========================
 
-Because accesses to the PSR is so slow, and to disable interrupts we have to access it twice (once
-to read and once to write), we don't actually disable interrupts at all if we don't have to. What
-we do instead is use the ICC2 condition code flags to note virtual disablement, such that if we
-then do take an interrupt, we note the flag, really disable interrupts, set another flag and resume
-execution at the point the interrupt happened. Setting condition flags as a side effect of an
-arithmetic or logical instruction is really fast. This use of the ICC2 only occurs within the
+Because accesses to the PSR is so slow, and to disable interrupts we have
+to access it twice (once to read and once to write), we don't actually
+disable interrupts at all if we don't have to. What we do instead is use
+the ICC2 condition code flags to note virtual disablement, such that if we
+then do take an interrupt, we note the flag, really disable interrupts, set
+another flag and resume execution at the point the interrupt happened.
+Setting condition flags as a side effect of an arithmetic or logical
+instruction is really fast. This use of the ICC2 only occurs within the
 kernel - it does not affect userspace.
 
 The flags we use are:
 
  (*) CCR.ICC2.Z [Zero flag]
 
-     Set to virtually disable interrupts, clear when interrupts are virtually enabled. Can be
-     modified by logical instructions without affecting the Carry flag.
+     Set to virtually disable interrupts, clear when interrupts are
+     virtually enabled. Can be modified by logical instructions without
+     affecting the Carry flag.
 
  (*) CCR.ICC2.C [Carry flag]
 
@@ -176,8 +195,9 @@ What happens is this:
 
         ICC2.Z is 0, ICC2.C is 1.
 
- (2) An interrupt occurs. The exception prologue examines ICC2.Z and determines that nothing needs
-     doing. This is done simply with an unlikely BEQ instruction.
+ (2) An interrupt occurs. The exception prologue examines ICC2.Z and
+     determines that nothing needs doing. This is done simply with an
+     unlikely BEQ instruction.
 
  (3) The interrupts are disabled (local_irq_disable)
 
@@ -187,48 +207,56 @@ What happens is this:
 
         ICC2.Z would be set to 0.
 
-     A TIHI #2 instruction (trap #2 if condition HI - Z==0 && C==0) would be used to trap if
-     interrupts were now virtually enabled, but physically disabled - which they're not, so the
-     trap isn't taken. The kernel would then be back to state (1).
+     A TIHI #2 instruction (trap #2 if condition HI - Z==0 && C==0) would
+     be used to trap if interrupts were now virtually enabled, but
+     physically disabled - which they're not, so the trap isn't taken. The
+     kernel would then be back to state (1).
 
- (5) An interrupt occurs. The exception prologue examines ICC2.Z and determines that the interrupt
-     shouldn't actually have happened. It jumps aside, and there disabled interrupts by setting
-     PSR.PIL to 14 and then it clears ICC2.C.
+ (5) An interrupt occurs. The exception prologue examines ICC2.Z and
+     determines that the interrupt shouldn't actually have happened. It
+     jumps aside, and there disabled interrupts by setting PSR.PIL to 14
+     and then it clears ICC2.C.
 
  (6) If interrupts were then saved and disabled again (local_irq_save):
 
-        ICC2.Z would be shifted into the save variable and masked off (giving a 1).
+        ICC2.Z would be shifted into the save variable and masked off 
+        (giving a 1).
 
-        ICC2.Z would then be set to 1 (thus unchanged), and ICC2.C would be unaffected (ie: 0).
+        ICC2.Z would then be set to 1 (thus unchanged), and ICC2.C would be
+        unaffected (ie: 0).
 
  (7) If interrupts were then restored from state (6) (local_irq_restore):
 
-        ICC2.Z would be set to indicate the result of XOR'ing the saved value (ie: 1) with 1, which
-        gives a result of 0 - thus leaving ICC2.Z set.
+        ICC2.Z would be set to indicate the result of XOR'ing the saved
+        value (ie: 1) with 1, which gives a result of 0 - thus leaving
+        ICC2.Z set.
 
         ICC2.C would remain unaffected (ie: 0).
 
-     A TIHI #2 instruction would be used to again assay the current state, but this would do
-     nothing as Z==1.
+     A TIHI #2 instruction would be used to again assay the current state,
+     but this would do nothing as Z==1.
 
  (8) If interrupts were then enabled (local_irq_enable):
 
-        ICC2.Z would be cleared. ICC2.C would be left unaffected. Both flags would now be 0.
+        ICC2.Z would be cleared. ICC2.C would be left unaffected. Both
+        flags would now be 0.
 
-     A TIHI #2 instruction again issued to assay the current state would then trap as both Z==0
-     [interrupts virtually enabled] and C==0 [interrupts really disabled] would then be true.
+     A TIHI #2 instruction again issued to assay the current state would
+     then trap as both Z==0 [interrupts virtually enabled] and C==0
+     [interrupts really disabled] would then be true.
 
- (9) The trap #2 handler would simply enable hardware interrupts (set PSR.PIL to 0), set ICC2.C to
-     1 and return.
+ (9) The trap #2 handler would simply enable hardware interrupts 
+     (set PSR.PIL to 0), set ICC2.C to 1 and return.
 
 (10) Immediately upon returning, the pending interrupt would be taken.
 
-(11) The interrupt handler would take the path of actually processing the interrupt (ICC2.Z is
-     clear, BEQ fails as per step (2)).
+(11) The interrupt handler would take the path of actually processing the
+     interrupt (ICC2.Z is clear, BEQ fails as per step (2)).
 
-(12) The interrupt handler would then set ICC2.C to 1 since hardware interrupts are definitely
-     enabled - or else the kernel wouldn't be here.
+(12) The interrupt handler would then set ICC2.C to 1 since hardware
+     interrupts are definitely enabled - or else the kernel wouldn't be here.
 
 (13) On return from the interrupt handler, things would be back to state (1).
 
-This trap (#2) is only available in kernel mode. In user mode it will result in SIGILL.
+This trap (#2) is only available in kernel mode. In user mode it will
+result in SIGILL.
diff --git a/Documentation/input/joystick-parport.txt b/Documentation/input/joystick-parport.txt
index 88a011c9f985..d537c48cc6d0 100644
--- a/Documentation/input/joystick-parport.txt
+++ b/Documentation/input/joystick-parport.txt
@@ -36,12 +36,12 @@ with them.
 
   All NES and SNES use the same synchronous serial protocol, clocked from
 the computer's side (and thus timing insensitive). To allow up to 5 NES
-and/or SNES gamepads connected to the parallel port at once, the output
-lines of the parallel port are shared, while one of 5 available input lines
-is assigned to each gamepad.
+and/or SNES gamepads and/or SNES mice connected to the parallel port at once,
+the output lines of the parallel port are shared, while one of 5 available
+input lines is assigned to each gamepad.
 
   This protocol is handled by the gamecon.c driver, so that's the one
-you'll use for NES and SNES gamepads.
+you'll use for NES, SNES gamepads and SNES mice.
 
   The main problem with PC parallel ports is that they don't have +5V power
 source on any of their pins. So, if you want a reliable source of power
@@ -106,7 +106,7 @@ A, Turbo B, Select and Start, and is connected through 5 wires, then it is
 either a NES or NES clone and will work with this connection. SNES gamepads
 also use 5 wires, but have more buttons. They will work as well, of course.
 
-Pinout for NES gamepads                 Pinout for SNES gamepads
+Pinout for NES gamepads                 Pinout for SNES gamepads and mice
 
            +----> Power                   +-----------------------\
            |                            7 | o  o  o  o |  x  x  o  | 1
@@ -454,6 +454,7 @@ uses the following kernel/module command line:
           6  | N64 pad
           7  | Sony PSX controller
           8  | Sony PSX DDR controller
+          9  | SNES mouse
 
   The exact type of the PSX controller type is autoprobed when used so
 hot swapping should work (but is not recomended).
diff --git a/Documentation/isdn/README.gigaset b/Documentation/isdn/README.gigaset
new file mode 100644
index 000000000000..85a64defd385
--- /dev/null
+++ b/Documentation/isdn/README.gigaset
@@ -0,0 +1,286 @@
+GigaSet 307x Device Driver
+==========================
+
+1.   Requirements
+     ------------
+1.1. Hardware
+     --------
+     This release supports the connection of the Gigaset 307x/417x family of
+     ISDN DECT bases via Gigaset M101 Data, Gigaset M105 Data or direct USB
+     connection. The following devices are reported to be compatible:
+     307x/417x:
+        Gigaset SX255isdn
+        Gigaset SX353isdn
+        Sinus 45 [AB] isdn (Deutsche Telekom)
+        Sinus 721X/XA
+        Vox Chicago 390 ISDN (KPN Telecom)
+     M101:
+        Sinus 45 Data 1 (Telekom)
+     M105:
+        Gigaset USB Adapter DECT
+        Sinus 45 Data 2 (Telekom)
+        Sinus 721 data
+        Chicago 390 USB (KPN)
+     See also http://www.erbze.info/sinus_gigaset.htm and
+              http://gigaset307x.sourceforge.net/
+
+     We had also reports from users of Gigaset M105 who could use the drivers
+     with SX 100 and CX 100 ISDN bases (only in unimodem mode, see section 2.4.)
+     If you have another device that works with our driver, please let us know.
+     For example, Gigaset SX205isdn/Sinus 721 X SE and Gigaset SX303isdn bases
+     are just versions without answering machine of models known to work, so
+     they should work just as well; but so far we are lacking positive reports
+     on these.
+
+     Chances of getting an USB device to work are good if the output of
+        lsusb
+     at the command line contains one of the following:
+        ID 0681:0001
+        ID 0681:0002
+        ID 0681:0009
+        ID 0681:0021
+        ID 0681:0022
+
+1.2. Software
+     --------
+     The driver works with ISDN4linux and so can be used with any software
+     which is able to use ISDN4linux for ISDN connections (voice or data).
+     CAPI4Linux support is planned but not yet available.
+
+     There are some user space tools available at
+     http://sourceforge.net/projects/gigaset307x/
+     which provide access to additional device specific functions like SMS,
+     phonebook or call journal.
+
+
+2.   How to use the driver
+     ---------------------
+2.1. Modules
+     -------
+     To get the device working, you have to load the proper kernel module. You
+     can do this using
+         modprobe modulename
+     where modulename is usb_gigaset (M105) or bas_gigaset (direct USB
+     connection to the base).
+
+2.2. Device nodes for user space programs
+     ------------------------------------
+     The device can be accessed from user space (eg. by the user space tools
+     mentioned in 1.2.) through the device nodes:
+
+     - /dev/ttyGU0 for M105 (USB data boxes)
+     - /dev/ttyGB0 for the base driver (direct USB connection)
+
+     You can also select a "default device" which is used by the frontends when
+     no device node is given as parameter, by creating a symlink /dev/ttyG to
+     one of them, eg.:
+
+        ln -s /dev/ttyGB0 /dev/ttyG
+
+2.3. ISDN4linux
+     ----------
+     This is the "normal" mode of operation. After loading the module you can
+     set up the ISDN system just as you'd do with any ISDN card.
+     Your distribution should provide some configuration utility.
+     If not, you can use some HOWTOs like
+         http://www.linuxhaven.de/dlhp/HOWTO/DE-ISDN-HOWTO-5.html
+     If this doesn't work, because you have some recent device like SX100 where
+     debug output (see section 3.2.) shows something like this when dialing
+         CMD Received: ERROR
+         Available Params: 0
+         Connection State: 0, Response: -1
+         gigaset_process_response: resp_code -1 in ConState 0 !
+         Timeout occurred
+     you might need to use unimodem mode:
+
+2.4. Unimodem mode
+     -------------
+     This is needed for some devices [e.g. SX100] as they have problems with
+     the "normal" commands.
+
+     If you have installed the command line tool gigacontr, you can enter
+     unimodem mode using
+         gigacontr --mode unimodem
+     You can switch back using
+         gigacontr --mode isdn
+
+     You can also load the driver using e.g.
+         modprobe usb_gigaset startmode=0
+     to prevent the driver from starting in "isdn4linux mode".
+
+     In this mode the device works like a modem connected to a serial port
+     (the /dev/ttyGU0, ... mentioned above) which understands the commands
+         ATZ                 init, reset
+             => OK or ERROR
+         ATD
+         ATDT                dial
+             => OK, CONNECT,
+                BUSY,
+                NO DIAL TONE,
+                NO CARRIER,
+                NO ANSWER
+         <pause>+++<pause>   change to command mode when connected
+         ATH                 hangup
+
+     You can use some configuration tool of your distribution to configure this
+     "modem" or configure pppd/wvdial manually. There are some example ppp
+     configuration files and chat scripts in the gigaset-VERSION/ppp directory.
+     Please note that the USB drivers are not able to change the state of the
+     control lines (the M105 driver can be configured to use some undocumented
+     control requests, if you really need the control lines, though). This means
+     you must use "Stupid Mode" if you are using wvdial or you should use the
+     nocrtscts option of pppd.
+     You must also assure that the ppp_async module is loaded with the parameter
+     flag_time=0. You can do this e.g. by adding a line like
+
+        options ppp_async flag_time=0
+
+     to /etc/modprobe.conf. If your distribution has some local module
+     configuration file like /etc/modprobe.conf.local,
+     using that should be preferred.
+
+2.5. Call-ID (CID) mode
+     ------------------
+     Call-IDs are numbers used to tag commands to, and responses from, the
+     Gigaset base in order to support the simultaneous handling of multiple
+     ISDN calls. Their use can be enabled ("CID mode") or disabled ("Unimodem
+     mode"). Without Call-IDs (in Unimodem mode), only a very limited set of
+     functions is available. It allows outgoing data connections only, but
+     does not signal incoming calls or other base events.
+
+     DECT cordless data devices (M10x) permanently occupy the cordless
+     connection to the base while Call-IDs are activated. As the Gigaset
+     bases only support one DECT data connection at a time, this prevents
+     other DECT cordless data devices from accessing the base.
+
+     During active operation, the driver switches to the necessary mode
+     automatically. However, for the reasons above, the mode chosen when
+     the device is not in use (idle) can be selected by the user.
+     - If you want to receive incoming calls, you can use the default
+       settings (CID mode).
+     - If you have several DECT data devices (M10x) which you want to use
+       in turn, select Unimodem mode by passing the parameter "cidmode=0" to
+       the driver ("modprobe usb_gigaset cidmode=0" or modprobe.conf).
+
+     If you want both of these at once, you are out of luck.
+
+     You can also use /sys/module/<name>/parameters/cidmode for changing
+     the CID mode setting (<name> is usb_gigaset or bas_gigaset).
+
+
+3.   Troubleshooting
+     ---------------
+3.1. Solutions to frequently reported problems
+     -----------------------------------------
+     Problem:
+        You have a slow provider and isdn4linux gives up dialing too early.
+     Solution:
+        Load the isdn module using the dialtimeout option. You can do this e.g.
+        by adding a line like
+
+           options isdn dialtimeout=15
+
+        to /etc/modprobe.conf. If your distribution has some local module
+        configuration file like /etc/modprobe.conf.local,
+        using that should be preferred.
+
+     Problem:
+        Your isdn script aborts with a message about isdnlog.
+     Solution:
+        Try deactivating (or commenting out) isdnlog. This driver does not
+        support it.
+
+     Problem:
+        You have two or more DECT data adapters (M101/M105) and only the
+        first one you turn on works.
+     Solution:
+        Select Unimodem mode for all DECT data adapters. (see section 2.4.)
+
+3.2. Telling the driver to provide more information
+     ----------------------------------------------
+     Building the driver with the "Gigaset debugging" kernel configuration
+     option (CONFIG_GIGASET_DEBUG) gives it the ability to produce additional
+     information useful for debugging.
+
+     You can control the amount of debugging information the driver produces by
+     writing an appropriate value to /sys/module/gigaset/parameters/debug, e.g.
+        echo 0 > /sys/module/gigaset/parameters/debug
+     switches off debugging output completely,
+        echo 0x10a020 > /sys/module/gigaset/parameters/debug
+     enables the standard set of debugging output messages. These values are
+     bit patterns where every bit controls a certain type of debugging output.
+     See the constants DEBUG_* in the source file gigaset.h for details.
+
+     The initial value can be set using the debug parameter when loading the
+     module "gigaset", e.g. by adding a line
+        options gigaset debug=0
+     to /etc/modprobe.conf, ...
+
+     Generated debugging information can be found
+     - as output of the command
+         dmesg
+     - in system log files written by your syslog daemon, usually
+       in /var/log/, e.g. /var/log/messages.
+
+3.3. Reporting problems and bugs
+     ---------------------------
+     If you can't solve problems with the driver on your own, feel free to
+     use one of the forums, bug trackers, or mailing lists on
+         http://sourceforge.net/projects/gigaset307x
+     or write an electronic mail to the maintainers.
+
+     Try to provide as much information as possible, such as
+     - distribution
+     - kernel version (uname -r)
+     - gcc version (gcc --version)
+     - hardware architecture (uname -m, ...)
+     - type and firmware version of your device (base and wireless module,
+       if any)
+     - output of "lsusb -v" (if using an USB device)
+     - error messages
+     - relevant system log messages (it would help if you activate debug
+       output as described in 3.2.)
+
+     For help with general configuration problems not specific to our driver,
+     such as isdn4linux and network configuration issues, please refer to the
+     appropriate forums and newsgroups.
+
+3.4. Reporting problem solutions
+     ---------------------------
+     If you solved a problem with our drivers, wrote startup scripts for your
+     distribution, ... feel free to contact us (using one of the places
+     mentioned in 3.3.). We'd like to add scripts, hints, documentation
+     to the driver and/or the project web page.
+
+
+4.   Links, other software
+     ---------------------
+     - Sourceforge project developing this driver and associated tools
+         http://sourceforge.net/projects/gigaset307x
+     - Yahoo! Group on the Siemens Gigaset family of devices
+         http://de.groups.yahoo.com/group/Siemens-Gigaset
+     - Siemens Gigaset/T-Sinus compatibility table
+         http://www.erbze.info/sinus_gigaset.htm
+
+
+5.   Credits
+     -------
+     Thanks to
+
+     Karsten Keil
+        for his help with isdn4linux
+     Deti Fliegl
+        for his base driver code
+     Dennis Dietrich
+        for his kernel 2.6 patches
+     Andreas Rummel
+        for his work and logs to get unimodem mode working
+     Andreas Degert
+        for his logs and patches to get cx 100 working
+     Dietrich Feist
+        for his generous donation of one M105 and two M101 cordless adapters
+     Christoph Schweers
+        for his generous donation of a M34 device
+
+     and all the other people who sent logs and other information.
+
diff --git a/Documentation/kbuild/modules.txt b/Documentation/kbuild/modules.txt
index fcccf2432f98..61fc079eb966 100644
--- a/Documentation/kbuild/modules.txt
+++ b/Documentation/kbuild/modules.txt
@@ -44,7 +44,7 @@ What is covered within this file is mainly information to authors
 of modules. The author of an external modules should supply
 a makefile that hides most of the complexity so one only has to type
 'make' to build the module. A complete example will be present in
-chapter ¤. Creating a kbuild file for an external module".
+chapter 4, "Creating a kbuild file for an external module".
 
 
 === 2. How to build external modules
diff --git a/Documentation/kernel-parameters.txt b/Documentation/kernel-parameters.txt
index f8cb55c30b0f..b3a6187e5305 100644
--- a/Documentation/kernel-parameters.txt
+++ b/Documentation/kernel-parameters.txt
@@ -1,4 +1,4 @@
-February 2003             Kernel Parameters                     v2.5.59
+                          Kernel Parameters
                           ~~~~~~~~~~~~~~~~~
 
 The following is a consolidated list of the kernel parameters as implemented
@@ -17,9 +17,17 @@ are specified on the kernel command line with the module name plus
 
         usbcore.blinkenlights=1
 
-The text in square brackets at the beginning of the description states the
-restrictions on the kernel for the said kernel parameter to be valid. The
-restrictions referred to are that the relevant option is valid if:
+This document may not be entirely up to date and comprehensive. The command
+"modinfo -p ${modulename}" shows a current list of all parameters of a loadable
+module. Loadable modules, after being loaded into the running kernel, also
+reveal their parameters in /sys/module/${modulename}/parameters/. Some of these
+parameters may be changed at runtime by the command
+"echo -n ${value} > /sys/module/${modulename}/parameters/${parm}".
+
+The parameters listed below are only valid if certain kernel build options were
+enabled and if respective hardware is present. The text in square brackets at
+the beginning of each description states the restrictions within which a
+parameter is applicable:
 
         ACPI    ACPI support is enabled.
         ALSA    ALSA sound support is enabled.
@@ -1046,10 +1054,10 @@ running once the system is up.
         noltlbs         [PPC] Do not use large page/tlb entries for kernel
                         lowmem mapping on PPC40x.
 
-        nomce           [IA-32] Machine Check Exception
-
         nomca           [IA-64] Disable machine check abort handling
 
+        nomce           [IA-32] Machine Check Exception
+
         noresidual      [PPC] Don't use residual data on PReP machines.
 
         noresume        [SWSUSP] Disables resume and restores original swap
@@ -1682,20 +1690,6 @@ running once the system is up.
 
 
 ______________________________________________________________________
-Changelog:
-
-2000-06-??      Mr. Unknown
-        The last known update (for 2.4.0) - the changelog was not kept before.
-
-2002-11-24      Petr Baudis <pasky@ucw.cz>
-                Randy Dunlap <randy.dunlap@verizon.net>
-        Update for 2.5.49, description for most of the options introduced,
-        references to other documentation (C files, READMEs, ..), added S390,
-        PPC, SPARC, MTD, ALSA and OSS category. Minor corrections and
-        reformatting.
-
-2005-10-19      Randy Dunlap <rdunlap@xenotime.net>
-        Lots of typos, whitespace, some reformatting.
 
 TODO:
 
diff --git a/Documentation/laptop-mode.txt b/Documentation/laptop-mode.txt
index b18e21675906..5696e879449b 100644
--- a/Documentation/laptop-mode.txt
+++ b/Documentation/laptop-mode.txt
@@ -919,11 +919,11 @@ int main(int argc, char **argv)
     int settle_time = 60;
 
     /* Parse the simple command-line */
-    if (ac == 2)
-        disk = av[1];
-    else if (ac == 4) {
-        settle_time = atoi(av[2]);
-        disk = av[3];
+    if (argc == 2)
+        disk = argv[1];
+    else if (argc == 4) {
+        settle_time = atoi(argv[2]);
+        disk = argv[3];
     } else
         usage();
 
diff --git a/Documentation/memory-barriers.txt b/Documentation/memory-barriers.txt
index f8550310a6d5..92f0056d928c 100644
--- a/Documentation/memory-barriers.txt
+++ b/Documentation/memory-barriers.txt
@@ -610,6 +610,7 @@ loads.  Consider the following sequence of events:
 
         CPU 1                   CPU 2
         ======================= =======================
+                { B = 7; X = 9; Y = 8; C = &Y }
         STORE A = 1
         STORE B = 2
         <write barrier>
@@ -651,7 +652,20 @@ In the above example, CPU 2 perceives that B is 7, despite the load of *C
 (which would be B) coming after the the LOAD of C.
 
 If, however, a data dependency barrier were to be placed between the load of C
-and the load of *C (ie: B) on CPU 2, then the following will occur:
+and the load of *C (ie: B) on CPU 2:
+
+        CPU 1                   CPU 2
+        ======================= =======================
+                { B = 7; X = 9; Y = 8; C = &Y }
+        STORE A = 1
+        STORE B = 2
+        <write barrier>
+        STORE C = &B            LOAD X
+        STORE D = 4             LOAD C (gets &B)
+                                <data dependency barrier>
+                                LOAD *C (reads B)
+
+then the following will occur:
 
         +-------+       :      :                :       :
         |       |       +------+                +-------+
@@ -829,8 +843,8 @@ There are some more advanced barrier functions:
  (*) smp_mb__after_atomic_inc();
 
      These are for use with atomic add, subtract, increment and decrement
-     functions, especially when used for reference counting.  These functions
-     do not imply memory barriers.
+     functions that don't return a value, especially when used for reference
+     counting.  These functions do not imply memory barriers.
 
      As an example, consider a piece of code that marks an object as being dead
      and then decrements the object's reference count:
@@ -1263,15 +1277,17 @@ else.
 ATOMIC OPERATIONS
 -----------------
 
-Though they are technically interprocessor interaction considerations, atomic
-operations are noted specially as they do _not_ generally imply memory
-barriers.  The possible offenders include:
+Whilst they are technically interprocessor interaction considerations, atomic
+operations are noted specially as some of them imply full memory barriers and
+some don't, but they're very heavily relied on as a group throughout the
+kernel.
+
+Any atomic operation that modifies some state in memory and returns information
+about the state (old or new) implies an SMP-conditional general memory barrier
+(smp_mb()) on each side of the actual operation.  These include:
 
         xchg();
         cmpxchg();
-        test_and_set_bit();
-        test_and_clear_bit();
-        test_and_change_bit();
         atomic_cmpxchg();
         atomic_inc_return();
         atomic_dec_return();
@@ -1282,21 +1298,31 @@ barriers.  The possible offenders include:
         atomic_sub_and_test();
         atomic_add_negative();
         atomic_add_unless();
+        test_and_set_bit();
+        test_and_clear_bit();
+        test_and_change_bit();
 
-These may be used for such things as implementing LOCK operations or controlling
-the lifetime of objects by decreasing their reference counts.  In such cases
-they need preceding memory barriers.
+These are used for such things as implementing LOCK-class and UNLOCK-class
+operations and adjusting reference counters towards object destruction, and as
+such the implicit memory barrier effects are necessary.
 
-The following may also be possible offenders as they may be used as UNLOCK
-operations.
 
+The following operation are potential problems as they do _not_ imply memory
+barriers, but might be used for implementing such things as UNLOCK-class
+operations:
+
+        atomic_set();
         set_bit();
         clear_bit();
         change_bit();
-        atomic_set();
 
+With these the appropriate explicit memory barrier should be used if necessary
+(smp_mb__before_clear_bit() for instance).
 
-The following are a little tricky:
+
+The following also do _not_ imply memory barriers, and so may require explicit
+memory barriers under some circumstances (smp_mb__before_atomic_dec() for
+instance)):
 
         atomic_add();
         atomic_sub();
@@ -1317,10 +1343,12 @@ specific order.
 
 
 Basically, each usage case has to be carefully considered as to whether memory
-barriers are needed or not.  The simplest rule is probably: if the atomic
-operation is protected by a lock, then it does not require a barrier unless
-there's another operation within the critical section with respect to which an
-ordering must be maintained.
+barriers are needed or not.
+
+[!] Note that special memory barrier primitives are available for these
+situations because on some CPUs the atomic instructions used imply full memory
+barriers, and so barrier instructions are superfluous in conjunction with them,
+and in such cases the special barrier primitives will be no-ops.
 
 See Documentation/atomic_ops.txt for more information.
 
diff --git a/Documentation/mtrr.txt b/Documentation/mtrr.txt
index b78af1c32996..c39ac395970e 100644
--- a/Documentation/mtrr.txt
+++ b/Documentation/mtrr.txt
@@ -138,19 +138,29 @@ Reading MTRRs from a C program using ioctl()'s:
 
 */
 #include <stdio.h>
+#include <stdlib.h>
 #include <string.h>
 #include <sys/types.h>
 #include <sys/stat.h>
 #include <fcntl.h>
 #include <sys/ioctl.h>
 #include <errno.h>
-#define MTRR_NEED_STRINGS
 #include <asm/mtrr.h>
 
 #define TRUE 1
 #define FALSE 0
 #define ERRSTRING strerror (errno)
 
+static char *mtrr_strings[MTRR_NUM_TYPES] =
+{
+    "uncachable",               /* 0 */
+    "write-combining",          /* 1 */
+    "?",                        /* 2 */
+    "?",                        /* 3 */
+    "write-through",            /* 4 */
+    "write-protect",            /* 5 */
+    "write-back",               /* 6 */
+};
 
 int main ()
 {
@@ -232,13 +242,22 @@ Creating MTRRs from a C programme using ioctl()'s:
 #include <fcntl.h>
 #include <sys/ioctl.h>
 #include <errno.h>
-#define MTRR_NEED_STRINGS
 #include <asm/mtrr.h>
 
 #define TRUE 1
 #define FALSE 0
 #define ERRSTRING strerror (errno)
 
+static char *mtrr_strings[MTRR_NUM_TYPES] =
+{
+    "uncachable",               /* 0 */
+    "write-combining",          /* 1 */
+    "?",                        /* 2 */
+    "?",                        /* 3 */
+    "write-through",            /* 4 */
+    "write-protect",            /* 5 */
+    "write-back",               /* 6 */
+};
 
 int main (int argc, char **argv)
 {
diff --git a/Documentation/networking/packet_mmap.txt b/Documentation/networking/packet_mmap.txt
index 4fc8e9874320..aaf99d5f0dad 100644
--- a/Documentation/networking/packet_mmap.txt
+++ b/Documentation/networking/packet_mmap.txt
@@ -254,7 +254,7 @@ and, the number of frames be
 
         <block number> * <block size> / <frame size>
 
-Suposse the following parameters, which apply for 2.6 kernel and an
+Suppose the following parameters, which apply for 2.6 kernel and an
 i386 architecture:
 
         <size-max> = 131072 bytes
diff --git a/Documentation/networking/tuntap.txt b/Documentation/networking/tuntap.txt
index ec3d109d787a..76750fb9151a 100644
--- a/Documentation/networking/tuntap.txt
+++ b/Documentation/networking/tuntap.txt
@@ -138,7 +138,7 @@ This means that you have to read/write IP packets when you are using tun and
 ethernet frames when using tap.
 
 5. What is the difference between BPF and TUN/TAP driver?
-BFP is an advanced packet filter. It can be attached to existing
+BPF is an advanced packet filter. It can be attached to existing
 network interface. It does not provide a virtual network interface.
 A TUN/TAP driver does provide a virtual network interface and it is possible
 to attach BPF to this interface.
diff --git a/Documentation/pcmcia/driver-changes.txt b/Documentation/pcmcia/driver-changes.txt
index 97420f08c786..4739c5c3face 100644
--- a/Documentation/pcmcia/driver-changes.txt
+++ b/Documentation/pcmcia/driver-changes.txt
@@ -1,5 +1,11 @@
 This file details changes in 2.6 which affect PCMCIA card driver authors:
 
+* New release helper (as of 2.6.17)
+   Instead of calling pcmcia_release_{configuration,io,irq,win}, all that's
+   necessary now is calling pcmcia_disable_device. As there is no valid
+   reason left to call pcmcia_release_io and pcmcia_release_irq, the
+   exports for them were removed.
+
 * Unify detach and REMOVAL event code, as well as attach and INSERTION
   code (as of 2.6.16)
        void (*remove)          (struct pcmcia_device *dev);
diff --git a/Documentation/scsi/scsi_eh.txt b/Documentation/scsi/scsi_eh.txt
index 331afd791cbb..ce767b90bb0d 100644
--- a/Documentation/scsi/scsi_eh.txt
+++ b/Documentation/scsi/scsi_eh.txt
@@ -19,9 +19,9 @@ TABLE OF CONTENTS
         [2-1-1] Overview
         [2-1-2] Flow of scmds through EH
         [2-1-3] Flow of control
-    [2-2] EH through hostt->eh_strategy_handler()
-        [2-2-1] Pre hostt->eh_strategy_handler() SCSI midlayer conditions
-        [2-2-2] Post hostt->eh_strategy_handler() SCSI midlayer conditions
+    [2-2] EH through transportt->eh_strategy_handler()
+        [2-2-1] Pre transportt->eh_strategy_handler() SCSI midlayer conditions
+        [2-2-2] Post transportt->eh_strategy_handler() SCSI midlayer conditions
         [2-2-3] Things to consider
 
 
@@ -413,9 +413,9 @@ scmd->allowed.
             layer of failure of the scmds.
 
 
-[2-2] EH through hostt->eh_strategy_handler()
+[2-2] EH through transportt->eh_strategy_handler()
 
- hostt->eh_strategy_handler() is invoked in the place of
+ transportt->eh_strategy_handler() is invoked in the place of
 scsi_unjam_host() and it is responsible for whole recovery process.
 On completion, the handler should have made lower layers forget about
 all failed scmds and either ready for new commands or offline.  Also,
@@ -424,7 +424,7 @@ SCSI midlayer.  IOW, of the steps described in [2-1-2], all steps
 except for #1 must be implemented by eh_strategy_handler().
 
 
-[2-2-1] Pre hostt->eh_strategy_handler() SCSI midlayer conditions
+[2-2-1] Pre transportt->eh_strategy_handler() SCSI midlayer conditions
 
  The following conditions are true on entry to the handler.
 
@@ -437,7 +437,7 @@ except for #1 must be implemented by eh_strategy_handler().
  - shost->host_failed == shost->host_busy
 
 
-[2-2-2] Post hostt->eh_strategy_handler() SCSI midlayer conditions
+[2-2-2] Post transportt->eh_strategy_handler() SCSI midlayer conditions
 
  The following conditions must be true on exit from the handler.
 
diff --git a/Documentation/scsi/scsi_mid_low_api.txt b/Documentation/scsi/scsi_mid_low_api.txt
index 8bbae3e1abdf..75a535a975c3 100644
--- a/Documentation/scsi/scsi_mid_low_api.txt
+++ b/Documentation/scsi/scsi_mid_low_api.txt
@@ -804,7 +804,6 @@ Summary:
    eh_bus_reset_handler - issue SCSI bus reset
    eh_device_reset_handler - issue SCSI device reset
    eh_host_reset_handler - reset host (host bus adapter)
-   eh_strategy_handler - driver supplied alternate to scsi_unjam_host()
    info - supply information about given host
    ioctl - driver can respond to ioctls
    proc_info - supports /proc/scsi/{driver_name}/{host_no}
@@ -970,24 +969,6 @@ Details:
 
 
 /**
- *      eh_strategy_handler - driver supplied alternate to scsi_unjam_host()
- *      @shp: host on which error has occurred
- *
- *      Returns TRUE if host unjammed, else FALSE.
- *
- *      Locks: none
- *
- *      Calling context: kernel thread
- *
- *      Notes: Invoked from scsi_eh thread. LLD supplied alternate to 
- *      scsi_unjam_host() found in scsi_error.c
- *
- *      Optionally defined in: LLD
- **/
-     int eh_strategy_handler(struct Scsi_Host * shp)
-
-
-/**
  *      info - supply information about given host: driver name plus data
  *             to distinguish given host
  *      @shp: host to supply information about
diff --git a/Documentation/sound/alsa/ALSA-Configuration.txt b/Documentation/sound/alsa/ALSA-Configuration.txt
index 1def6049784c..0ee2c7dfc482 100644
--- a/Documentation/sound/alsa/ALSA-Configuration.txt
+++ b/Documentation/sound/alsa/ALSA-Configuration.txt
@@ -120,6 +120,34 @@ Prior to version 0.9.0rc4 options had a 'snd_' prefix. This was removed.
     enable      - enable card
                 - Default: enabled, for PCI and ISA PnP cards
 
+  Module snd-adlib
+  ----------------
+
+    Module for AdLib FM cards.
+
+    port        - port # for OPL chip
+
+    This module supports multiple cards. It does not support autoprobe, so
+    the port must be specified. For actual AdLib FM cards it will be 0x388.
+    Note that this card does not have PCM support and no mixer; only FM
+    synthesis.
+
+    Make sure you have "sbiload" from the alsa-tools package available and,
+    after loading the module, find out the assigned ALSA sequencer port
+    number through "sbiload -l". Example output:
+
+      Port     Client name                       Port name
+      64:0     OPL2 FM synth                     OPL2 FM Port
+
+    Load the std.sb and drums.sb patches also supplied by sbiload:
+
+      sbiload -p 64:0 std.sb drums.sb
+
+    If you use this driver to drive an OPL3, you can use std.o3 and drums.o3
+    instead. To have the card produce sound, use aplaymidi from alsa-utils:
+
+      aplaymidi -p 64:0 foo.mid
+
   Module snd-ad1816a
   ------------------
 
@@ -190,6 +218,15 @@ Prior to version 0.9.0rc4 options had a 'snd_' prefix. This was removed.
 
     The power-management is supported.
 
+  Module snd-als300
+  -----------------
+
+    Module for  Avance Logic ALS300 and ALS300+
+
+    This module supports multiple cards.
+
+    The power-management is supported.
+
   Module snd-als4000
   ------------------
 
@@ -701,6 +738,7 @@ Prior to version 0.9.0rc4 options had a 'snd_' prefix. This was removed.
           uniwill       3-jack
           F1734         2-jack
           lg            LG laptop (m1 express dual)
+          lg-lw         LG LW20 laptop
           test          for testing/debugging purpose, almost all controls can be
                         adjusted.  Appearing only when compiled with
                         $CONFIG_SND_DEBUG=y
@@ -1013,6 +1051,23 @@ Prior to version 0.9.0rc4 options had a 'snd_' prefix. This was removed.
 
     The power-management is supported.
 
+  Module snd-miro
+  ---------------
+
+    Module for Miro soundcards: miroSOUND PCM 1 pro, 
+                                miroSOUND PCM 12,
+                                miroSOUND PCM 20 Radio.
+
+    port        - Port # (0x530,0x604,0xe80,0xf40)
+    irq         - IRQ # (5,7,9,10,11)
+    dma1        - 1st dma # (0,1,3)
+    dma2        - 2nd dma # (0,1)
+    mpu_port    - MPU-401 port # (0x300,0x310,0x320,0x330)
+    mpu_irq     - MPU-401 irq # (5,7,9,10)
+    fm_port     - FM Port # (0x388)
+    wss         - enable WSS mode
+    ide         - enable onboard ide support
+
   Module snd-mixart
   -----------------
 
@@ -1202,6 +1257,20 @@ Prior to version 0.9.0rc4 options had a 'snd_' prefix. This was removed.
 
     The power-management is supported.
 
+  Module snd-riptide
+  ------------------
+
+    Module for Conexant Riptide chip
+
+      joystick_port     - Joystick port # (default: 0x200)
+      mpu_port          - MPU401 port # (default: 0x330)
+      opl3_port         - OPL3 port # (default: 0x388)
+
+    This module supports multiple cards.
+    The driver requires the firmware loader support on kernel.
+    You need to install the firmware file "riptide.hex" to the standard
+    firmware path (e.g. /lib/firmware).
+
   Module snd-rme32
   ----------------
 
diff --git a/Documentation/sound/alsa/DocBook/writing-an-alsa-driver.tmpl b/Documentation/sound/alsa/DocBook/writing-an-alsa-driver.tmpl
index 6feef9e82b63..68eeebc17ff4 100644
--- a/Documentation/sound/alsa/DocBook/writing-an-alsa-driver.tmpl
+++ b/Documentation/sound/alsa/DocBook/writing-an-alsa-driver.tmpl
@@ -1123,8 +1123,8 @@
           if ((err = pci_enable_device(pci)) < 0)
                   return err;
           /* check PCI availability (28bit DMA) */
-          if (pci_set_dma_mask(pci, 0x0fffffff) < 0 ||
-              pci_set_consistent_dma_mask(pci, 0x0fffffff) < 0) {
+          if (pci_set_dma_mask(pci, DMA_28BIT_MASK) < 0 ||
+              pci_set_consistent_dma_mask(pci, DMA_28BIT_MASK) < 0) {
                   printk(KERN_ERR "error to set 28bit mask DMA\n");
                   pci_disable_device(pci);
                   return -ENXIO;
@@ -1216,7 +1216,7 @@
         The allocation of PCI resources is done in the
       <function>probe()</function> function, and usually an extra
       <function>xxx_create()</function> function is written for this
-      purpose. 
+      purpose.
       </para>
 
       <para>
@@ -1225,7 +1225,7 @@
       allocating resources. Also, you need to set the proper PCI DMA
       mask to limit the accessed i/o range. In some cases, you might
       need to call <function>pci_set_master()</function> function,
-      too. 
+      too.
       </para>
 
       <para>
@@ -1236,8 +1236,8 @@
 <![CDATA[
   if ((err = pci_enable_device(pci)) < 0)
           return err;
-  if (pci_set_dma_mask(pci, 0x0fffffff) < 0 ||
-      pci_set_consistent_dma_mask(pci, 0x0fffffff) < 0) {
+  if (pci_set_dma_mask(pci, DMA_28BIT_MASK) < 0 ||
+      pci_set_consistent_dma_mask(pci, DMA_28BIT_MASK) < 0) {
           printk(KERN_ERR "error to set 28bit mask DMA\n");
           pci_disable_device(pci);
           return -ENXIO;
@@ -1256,13 +1256,13 @@
       functions. Unlike ALSA ver.0.5.x., there are no helpers for
       that. And these resources must be released in the destructor
       function (see below). Also, on ALSA 0.9.x, you don't need to
-      allocate (pseudo-)DMA for PCI like ALSA 0.5.x. 
+      allocate (pseudo-)DMA for PCI like ALSA 0.5.x.
       </para>
 
       <para>
         Now assume that this PCI device has an I/O port with 8 bytes
         and an interrupt. Then struct <structname>mychip</structname> will have the
-        following fields: 
+        following fields:
 
         <informalexample>
           <programlisting>
diff --git a/Documentation/video4linux/CARDLIST.saa7134 b/Documentation/video4linux/CARDLIST.saa7134
index 8c7195455963..bca50903233f 100644
--- a/Documentation/video4linux/CARDLIST.saa7134
+++ b/Documentation/video4linux/CARDLIST.saa7134
@@ -52,7 +52,7 @@
  51 -> ProVideo PV952                           [1540:9524]
  52 -> AverMedia AverTV/305                     [1461:2108]
  53 -> ASUS TV-FM 7135                          [1043:4845]
- 54 -> LifeView FlyTV Platinum FM               [5168:0214,1489:0214]
+ 54 -> LifeView FlyTV Platinum FM / Gold        [5168:0214,1489:0214,5168:0304]
  55 -> LifeView FlyDVB-T DUO                    [5168:0306]
  56 -> Avermedia AVerTV 307                     [1461:a70a]
  57 -> Avermedia AVerTV GO 007 FM               [1461:f31f]
@@ -84,7 +84,7 @@
  83 -> Terratec Cinergy 250 PCI TV              [153b:1160]
  84 -> LifeView FlyDVB Trio                     [5168:0319]
  85 -> AverTV DVB-T 777                         [1461:2c05]
- 86 -> LifeView FlyDVB-T                        [5168:0301]
+ 86 -> LifeView FlyDVB-T / Genius VideoWonder DVB-T [5168:0301,1489:0301]
  87 -> ADS Instant TV Duo Cardbus PTV331        [0331:1421]
  88 -> Tevion/KWorld DVB-T 220RF                [17de:7201]
  89 -> ELSA EX-VISION 700TV                     [1048:226c]
@@ -92,3 +92,4 @@
  91 -> AVerMedia A169 B                         [1461:7360]
  92 -> AVerMedia A169 B1                        [1461:6360]
  93 -> Medion 7134 Bridge #2                    [16be:0005]
+ 94 -> LifeView FlyDVB-T Hybrid Cardbus         [5168:3306,5168:3502]
diff --git a/Documentation/usb/et61x251.txt b/Documentation/video4linux/et61x251.txt
index 29340282ab5f..29340282ab5f 100644
--- a/Documentation/usb/et61x251.txt
+++ b/Documentation/video4linux/et61x251.txt
diff --git a/Documentation/usb/ibmcam.txt b/Documentation/video4linux/ibmcam.txt
index c25003644131..4a40a2e99451 100644
--- a/Documentation/usb/ibmcam.txt
+++ b/Documentation/video4linux/ibmcam.txt
@@ -122,7 +122,7 @@ WHAT YOU NEED:
 - A Linux box with USB support (2.3/2.4; 2.2 w/backport may work)
 
 - A Video4Linux compatible frame grabber program such as xawtv.
-  
+
 HOW TO COMPILE THE DRIVER:
 
 You need to compile the driver only if you are a developer
diff --git a/Documentation/usb/ov511.txt b/Documentation/video4linux/ov511.txt
index a7fc0432bff1..142741e3c578 100644
--- a/Documentation/usb/ov511.txt
+++ b/Documentation/video4linux/ov511.txt
@@ -9,7 +9,7 @@ INTRODUCTION:
 
 This is a driver for the OV511, a USB-only chip used in many "webcam" devices.
 Any camera using the OV511/OV511+ and the OV6620/OV7610/20/20AE should work.
-Video capture devices that use the Philips SAA7111A decoder also work. It 
+Video capture devices that use the Philips SAA7111A decoder also work. It
 supports streaming and capture of color or monochrome video via the Video4Linux
 API. Most V4L apps are compatible with it. Most resolutions with a width and
 height that are a multiple of 8 are supported.
@@ -52,15 +52,15 @@ from it:
 
         chmod 666 /dev/video
         chmod 666 /dev/video0 (if necessary)
-        
+
 Now you are ready to run a video app! Both vidcat and xawtv work well for me
 at 640x480.
-        
+
 [Using vidcat:]
 
         vidcat -s 640x480 -p c > test.jpg
         xview test.jpg
-        
+
 [Using xawtv:]
 
 From the main xawtv directory:
@@ -70,7 +70,7 @@ From the main xawtv directory:
         make
         make install
 
-Now you should be able to run xawtv. Right click for the options dialog. 
+Now you should be able to run xawtv. Right click for the options dialog.
 
 MODULE PARAMETERS:
 
@@ -286,4 +286,3 @@ Randy Dunlap, and others. Big thanks to them for their pioneering work on that
 and the USB stack. Thanks to Bret Wallach for getting camera reg IO, ISOC, and
 image capture working. Thanks to Orion Sky Lawlor, Kevin Moore, and Claudio
 Matsuoka for their work as well.
-
diff --git a/Documentation/usb/se401.txt b/Documentation/video4linux/se401.txt
index 7b9d1c960a10..7b9d1c960a10 100644
--- a/Documentation/usb/se401.txt
+++ b/Documentation/video4linux/se401.txt
diff --git a/Documentation/usb/sn9c102.txt b/Documentation/video4linux/sn9c102.txt
index b957beae5607..142920bc011f 100644
--- a/Documentation/usb/sn9c102.txt
+++ b/Documentation/video4linux/sn9c102.txt
@@ -174,7 +174,7 @@ Module parameters are listed below:
 -------------------------------------------------------------------------------
 Name:           video_nr
 Type:           short array (min = 0, max = 64)
-Syntax:         <-1|n[,...]> 
+Syntax:         <-1|n[,...]>
 Description:    Specify V4L2 minor mode number:
                 -1 = use next available
                  n = use minor number n
@@ -187,7 +187,7 @@ Default:        -1
 -------------------------------------------------------------------------------
 Name:           force_munmap
 Type:           bool array (min = 0, max = 64)
-Syntax:         <0|1[,...]> 
+Syntax:         <0|1[,...]>
 Description:    Force the application to unmap previously mapped buffer memory
                 before calling any VIDIOC_S_CROP or VIDIOC_S_FMT ioctl's. Not
                 all the applications support this feature. This parameter is
@@ -206,7 +206,7 @@ Default:        2
 -------------------------------------------------------------------------------
 Name:           debug
 Type:           ushort
-Syntax:         <n> 
+Syntax:         <n>
 Description:    Debugging information level, from 0 to 3:
                 0 = none (use carefully)
                 1 = critical errors
@@ -267,7 +267,7 @@ The sysfs interface also provides the "frame_header" entry, which exports the
 frame header of the most recent requested and captured video frame. The header
 is always 18-bytes long and is appended to every video frame by the SN9C10x
 controllers. As an example, this additional information can be used by the user
-application for implementing auto-exposure features via software. 
+application for implementing auto-exposure features via software.
 
 The following table describes the frame header:
 
@@ -441,7 +441,7 @@ blue pixels in one video frame. Each pixel is associated with a 8-bit long
 value and is disposed in memory according to the pattern shown below:
 
 B[0]   G[1]    B[2]    G[3]    ...   B[m-2]         G[m-1]
-G[m]   R[m+1]  G[m+2]  R[m+2]  ...   G[2m-2]        R[2m-1] 
+G[m]   R[m+1]  G[m+2]  R[m+2]  ...   G[2m-2]        R[2m-1]
 ...
 ...                                  B[(n-1)(m-2)]  G[(n-1)(m-1)]
 ...                                  G[n(m-2)]      R[n(m-1)]
@@ -472,12 +472,12 @@ The pixel reference value is calculated as follows:
 The algorithm purely describes the conversion from compressed Bayer code used
 in the SN9C10x chips to uncompressed Bayer. Additional steps are required to
 convert this to a color image (i.e. a color interpolation algorithm).
- 
+
 The following Huffman codes have been found:
-0: +0 (relative to reference pixel value) 
+0: +0 (relative to reference pixel value)
 100: +4
 101: -4?
-1110xxxx: set absolute value to xxxx.0000 
+1110xxxx: set absolute value to xxxx.0000
 1101: +11
 1111: -11
 11001: +20
diff --git a/Documentation/usb/stv680.txt b/Documentation/video4linux/stv680.txt
index 6448041e7a37..4f8946f32f51 100644
--- a/Documentation/usb/stv680.txt
+++ b/Documentation/video4linux/stv680.txt
@@ -5,15 +5,15 @@ Copyright, 2001, Kevin Sisson
 
 INTRODUCTION:
 
-STMicroelectronics produces the STV0680B chip, which comes in two 
-types, -001 and -003. The -003 version allows the recording and downloading 
-of sound clips from the camera, and allows a flash attachment. Otherwise, 
-it uses the same commands as the -001 version. Both versions support a 
-variety of SDRAM sizes and sensors, allowing for a maximum of 26 VGA or 20 
-CIF pictures. The STV0680 supports either a serial or a usb interface, and 
+STMicroelectronics produces the STV0680B chip, which comes in two
+types, -001 and -003. The -003 version allows the recording and downloading
+of sound clips from the camera, and allows a flash attachment. Otherwise,
+it uses the same commands as the -001 version. Both versions support a
+variety of SDRAM sizes and sensors, allowing for a maximum of 26 VGA or 20
+CIF pictures. The STV0680 supports either a serial or a usb interface, and
 video is possible through the usb interface.
 
-The following cameras are known to work with this driver, although any 
+The following cameras are known to work with this driver, although any
 camera with Vendor/Product codes of 0553/0202 should work:
 
 Aiptek Pencam (various models)
@@ -34,15 +34,15 @@ http://www.linux-usb.org
 MODULE OPTIONS:
 
 When the driver is compiled as a module, you can set a "swapRGB=1"
-option, if necessary, for those applications that require it 
-(such as xawtv). However, the driver should detect and set this 
+option, if necessary, for those applications that require it
+(such as xawtv). However, the driver should detect and set this
 automatically, so this option should not normally be used.
 
 
 KNOWN PROBLEMS:
 
-The driver seems to work better with the usb-ohci than the usb-uhci host 
-controller driver. 
+The driver seems to work better with the usb-ohci than the usb-uhci host
+controller driver.
 
 HELP:
 
@@ -50,6 +50,4 @@ The latest info on this driver can be found at:
 http://personal.clt.bellsouth.net/~kjsisson or at
 http://stv0680-usb.sourceforge.net
 
-Any questions to me can be send to:  kjsisson@bellsouth.net
-
-
+Any questions to me can be send to:  kjsisson@bellsouth.net
\ No newline at end of file
diff --git a/Documentation/usb/w9968cf.txt b/Documentation/video4linux/w9968cf.txt
index 9d46cd0b19e3..3b704f2aae6d 100644
--- a/Documentation/usb/w9968cf.txt
+++ b/Documentation/video4linux/w9968cf.txt
@@ -1,5 +1,5 @@
 
-                   W996[87]CF JPEG USB Dual Mode Camera Chip 
+                   W996[87]CF JPEG USB Dual Mode Camera Chip
                      Driver for Linux 2.6 (basic version)
                    =========================================
 
@@ -115,7 +115,7 @@ additional testing and full support, would be much appreciated.
 ======================
 For it to work properly, the driver needs kernel support for Video4Linux, USB
 and I2C, and the "ovcamchip" module for the image sensor. Make sure you are not
-actually using any external "ovcamchip" module, given that the W996[87]CF 
+actually using any external "ovcamchip" module, given that the W996[87]CF
 driver depends on the version of the module present in the official kernels.
 
 The following options of the kernel configuration file must be enabled and
@@ -197,16 +197,16 @@ Note:            The kernel must be compiled with the CONFIG_KMOD option
                  enabled for the 'ovcamchip' module to be loaded and for
                  this parameter to be present.
 -------------------------------------------------------------------------------
-Name:           simcams 
-Type:           int 
-Syntax:         <n> 
+Name:           simcams
+Type:           int
+Syntax:         <n>
 Description:    Number of cameras allowed to stream simultaneously.
                 n may vary from 0 to 32.
 Default:        32
 -------------------------------------------------------------------------------
 Name:           video_nr
 Type:           int array (min = 0, max = 32)
-Syntax:         <-1|n[,...]> 
+Syntax:         <-1|n[,...]>
 Description:    Specify V4L minor mode number.
                 -1 = use next available
                  n = use minor number n
@@ -219,7 +219,7 @@ Default:        -1
 -------------------------------------------------------------------------------
 Name:           packet_size
 Type:           int array (min = 0, max = 32)
-Syntax:         <n[,...]> 
+Syntax:         <n[,...]>
 Description:    Specify the maximum data payload size in bytes for alternate
                 settings, for each device. n is scaled between 63 and 1023.
 Default:        1023
@@ -234,7 +234,7 @@ Default:        2
 -------------------------------------------------------------------------------
 Name:           double_buffer
 Type:           bool array (min = 0, max = 32)
-Syntax:         <0|1[,...]> 
+Syntax:         <0|1[,...]>
 Description:    Hardware double buffering: 0 disabled, 1 enabled.
                 It should be enabled if you want smooth video output: if you
                 obtain out of sync. video, disable it, or try to
@@ -243,13 +243,13 @@ Default:        1 for every device.
 -------------------------------------------------------------------------------
 Name:           clamping
 Type:           bool array (min = 0, max = 32)
-Syntax:         <0|1[,...]> 
+Syntax:         <0|1[,...]>
 Description:    Video data clamping: 0 disabled, 1 enabled.
 Default:        0 for every device.
 -------------------------------------------------------------------------------
 Name:           filter_type
 Type:           int array (min = 0, max = 32)
-Syntax:         <0|1|2[,...]> 
+Syntax:         <0|1|2[,...]>
 Description:    Video filter type.
                 0 none, 1 (1-2-1) 3-tap filter, 2 (2-3-6-3-2) 5-tap filter.
                 The filter is used to reduce noise and aliasing artifacts
@@ -258,13 +258,13 @@ Default:        0 for every device.
 -------------------------------------------------------------------------------
 Name:           largeview
 Type:           bool array (min = 0, max = 32)
-Syntax:         <0|1[,...]> 
+Syntax:         <0|1[,...]>
 Description:    Large view: 0 disabled, 1 enabled.
 Default:        1 for every device.
 -------------------------------------------------------------------------------
 Name:           upscaling
 Type:           bool array (min = 0, max = 32)
-Syntax:         <0|1[,...]> 
+Syntax:         <0|1[,...]>
 Description:    Software scaling (for non-compressed video only):
                 0 disabled, 1 enabled.
                 Disable it if you have a slow CPU or you don't have enough
@@ -341,8 +341,8 @@ Default:        50 for every device.
 -------------------------------------------------------------------------------
 Name:           bandingfilter
 Type:           bool array (min = 0, max = 32)
-Syntax:         <0|1[,...]> 
-Description:    Banding filter to reduce effects of fluorescent 
+Syntax:         <0|1[,...]>
+Description:    Banding filter to reduce effects of fluorescent
                 lighting:
                 0 disabled, 1 enabled.
                 This filter tries to reduce the pattern of horizontal
@@ -374,7 +374,7 @@ Default:        0 for every device.
 -------------------------------------------------------------------------------
 Name:           monochrome
 Type:           bool array (min = 0, max = 32)
-Syntax:         <0|1[,...]> 
+Syntax:         <0|1[,...]>
 Description:    The image sensor is monochrome:
                 0 = no, 1 = yes
 Default:        0 for every device.
@@ -400,19 +400,19 @@ Default:        32768 for every device.
 -------------------------------------------------------------------------------
 Name:           contrast
 Type:           long array (min = 0, max = 32)
-Syntax:         <n[,...]> 
+Syntax:         <n[,...]>
 Description:    Set picture contrast (0-65535).
 Default:        50000 for every device.
 -------------------------------------------------------------------------------
 Name:           whiteness
 Type:           long array (min = 0, max = 32)
-Syntax:         <n[,...]> 
+Syntax:         <n[,...]>
 Description:    Set picture whiteness (0-65535).
 Default:        32768 for every device.
 -------------------------------------------------------------------------------
 Name:           debug
 Type:           int
-Syntax:         <n> 
+Syntax:         <n>
 Description:    Debugging information level, from 0 to 6:
                 0 = none (use carefully)
                 1 = critical errors
diff --git a/Documentation/usb/zc0301.txt b/Documentation/video4linux/zc0301.txt
index f55262c6733b..f55262c6733b 100644
--- a/Documentation/usb/zc0301.txt
+++ b/Documentation/video4linux/zc0301.txt
diff --git a/Documentation/vm/hugetlbpage.txt b/Documentation/vm/hugetlbpage.txt
index 1ad9af1ca4d0..2803f63c1a27 100644
--- a/Documentation/vm/hugetlbpage.txt
+++ b/Documentation/vm/hugetlbpage.txt
@@ -27,7 +27,7 @@ number of free hugetlb pages at any time.  It also displays information about
 the configured hugepage size - this is needed for generating the proper
 alignment and size of the arguments to the above system calls.
 
-The output of "cat /proc/meminfo" will have output like:
+The output of "cat /proc/meminfo" will have lines like:
 
 .....
 HugePages_Total: xxx
@@ -42,11 +42,11 @@ pages in the kernel.  Super user can dynamically request more (or free some
 pre-configured) hugepages.
 The allocation (or deallocation) of hugetlb pages is possible only if there are
 enough physically contiguous free pages in system (freeing of hugepages is
-possible only if there are enough hugetlb pages free that can be transfered
+possible only if there are enough hugetlb pages free that can be transferred
 back to regular memory pool).
 
-Pages that are used as hugetlb pages are reserved inside the kernel and can
-not be used for other purposes.
+Pages that are used as hugetlb pages are reserved inside the kernel and cannot
+be used for other purposes.
 
 Once the kernel with Hugetlb page support is built and running, a user can
 use either the mmap system call or shared memory system calls to start using
@@ -60,7 +60,7 @@ Use the following command to dynamically allocate/deallocate hugepages:
 This command will try to configure 20 hugepages in the system.  The success
 or failure of allocation depends on the amount of physically contiguous
 memory that is preset in system at this time.  System administrators may want
-to put this command in one of the local rc init file.  This will enable the
+to put this command in one of the local rc init files.  This will enable the
 kernel to request huge pages early in the boot process (when the possibility
 of getting physical contiguous pages is still very high).
 
@@ -78,8 +78,8 @@ the uid and gid of the current process are taken.  The mode option sets the
 mode of root of file system to value & 0777.  This value is given in octal.
 By default the value 0755 is picked. The size option sets the maximum value of
 memory (huge pages) allowed for that filesystem (/mnt/huge). The size is
-rounded down to HPAGE_SIZE.  The option nr_inode sets the maximum number of
-inodes that /mnt/huge can use.  If the size or nr_inode options are not
+rounded down to HPAGE_SIZE.  The option nr_inodes sets the maximum number of
+inodes that /mnt/huge can use.  If the size or nr_inodes options are not
 provided on command line then no limits are set.  For size and nr_inodes
 options, you can use [G|g]/[M|m]/[K|k] to represent giga/mega/kilo. For
 example, size=2K has the same meaning as size=2048. An example is given at
@@ -88,7 +88,7 @@ the end of this document.
 read and write system calls are not supported on files that reside on hugetlb
 file systems.
 
-A regular chown, chgrp and chmod commands (with right permissions) could be
+Regular chown, chgrp, and chmod commands (with right permissions) could be
 used to change the file attributes on hugetlbfs.
 
 Also, it is important to note that no such mount command is required if the
@@ -96,8 +96,8 @@ applications are going to use only shmat/shmget system calls.  Users who
 wish to use hugetlb page via shared memory segment should be a member of
 a supplementary group and system admin needs to configure that gid into
 /proc/sys/vm/hugetlb_shm_group.  It is possible for same or different
-applications to use any combination of mmaps and shm* calls.  Though the
-mount of filesystem will be required for using mmaps.
+applications to use any combination of mmaps and shm* calls, though the
+mount of filesystem will be required for using mmap calls.
 
 *******************************************************************
 
diff --git a/Documentation/x86_64/boot-options.txt b/Documentation/x86_64/boot-options.txt
index 1921353259ae..f2cd6ef53ff3 100644
--- a/Documentation/x86_64/boot-options.txt
+++ b/Documentation/x86_64/boot-options.txt
@@ -151,6 +151,11 @@ NUMA
 
   numa=fake=X   Fake X nodes and ignore NUMA setup of the actual machine.
 
+  numa=hotadd=percent
+                Only allow hotadd memory to preallocate page structures upto
+                percent of already available memory.
+                numa=hotadd=0 will disable hotadd memory.
+
 ACPI
 
   acpi=off      Don't enable ACPI
diff --git a/Kbuild b/Kbuild
index 95d6a00bace0..2d4f95e4b89f 100644
--- a/Kbuild
+++ b/Kbuild
@@ -18,7 +18,7 @@ define sed-y
         "/^->/{s:^->\([^ ]*\) [\$$#]*\([^ ]*\) \(.*\):#define \1 \2 /* \3 */:; s:->::; p;}"
 endef
 # Override default regexp for specific architectures
-sed-$(CONFIG_MIPS) := "/^@@@/s///p"
+sed-$(CONFIG_MIPS) := "/^@@@/{s/^@@@//; s/ \#.*\$$//; p;}"
 
 quiet_cmd_offsets = GEN     $@
 define cmd_offsets
diff --git a/MAINTAINERS b/MAINTAINERS
index c9465811addc..d00dea52123f 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -1451,6 +1451,12 @@ P:	Juanjo Ciarlante
 M:      jjciarla@raiz.uncu.edu.ar
 S:      Maintained
 
+IPATH DRIVER:
+P:      Bryan O'Sullivan
+M:      support@pathscale.com
+L:      openib-general@openib.org
+S:      Supported
+
 IPX NETWORK LAYER
 P:      Arnaldo Carvalho de Melo
 M:      acme@conectiva.com.br
@@ -1550,9 +1556,7 @@ S:	Maintained
 
 KEXEC
 P:      Eric Biederman
-P:      Randy Dunlap
 M:      ebiederm@xmission.com
-M:      rdunlap@xenotime.net
 W:      http://www.xmission.com/~ebiederm/files/kexec/
 L:      linux-kernel@vger.kernel.org
 L:      fastboot@osdl.org
diff --git a/Makefile b/Makefile
index af6210d48836..fc8e08c419f0 100644
--- a/Makefile
+++ b/Makefile
@@ -1,7 +1,7 @@
 VERSION = 2
 PATCHLEVEL = 6
-SUBLEVEL = 16
-EXTRAVERSION =
+SUBLEVEL = 17
+EXTRAVERSION =-rc1
 NAME=Sliding Snow Leopard
 
 # *DOCUMENTATION*
@@ -1112,7 +1112,6 @@ modules_install: _emodinst_ _emodinst_post
 install-dir := $(if $(INSTALL_MOD_DIR),$(INSTALL_MOD_DIR),extra)
 PHONY += _emodinst_
 _emodinst_:
-        $(Q)rm -rf $(MODLIB)/$(install-dir)
         $(Q)mkdir -p $(MODLIB)/$(install-dir)
         $(Q)$(MAKE) -rR -f $(srctree)/scripts/Makefile.modinst
 
@@ -1275,40 +1274,43 @@ kernelversion:
 
 # Single targets
 # ---------------------------------------------------------------------------
-# The directory part is taken from first prerequisite, so this
-# works even with external modules
+# Single targets are compatible with:
+# - build whith mixed source and output
+# - build with separate output dir 'make O=...'
+# - external modules
+#
+#  target-dir => where to store outputfile
+#  build-dir  => directory in kernel source tree to use
+
+ifeq ($(KBUILD_EXTMOD),)
+        build-dir  = $(patsubst %/,%,$(dir $@))
+        target-dir = $(dir $@)
+else
+        zap-slash=$(filter-out .,$(patsubst %/,%,$(dir $@)))
+        build-dir  = $(KBUILD_EXTMOD)$(if $(zap-slash),/$(zap-slash))
+        target-dir = $(if $(KBUILD_EXTMOD),$(dir $<),$(dir $@))
+endif
+
 %.s: %.c prepare scripts FORCE
-        $(Q)$(MAKE) $(build)=$(dir $<) $(dir $<)$(notdir $@)
+        $(Q)$(MAKE) $(build)=$(build-dir) $(target-dir)$(notdir $@)
 %.i: %.c prepare scripts FORCE
-        $(Q)$(MAKE) $(build)=$(dir $<) $(dir $<)$(notdir $@)
+        $(Q)$(MAKE) $(build)=$(build-dir) $(target-dir)$(notdir $@)
 %.o: %.c prepare scripts FORCE
-        $(Q)$(MAKE) $(build)=$(dir $<) $(dir $<)$(notdir $@)
+        $(Q)$(MAKE) $(build)=$(build-dir) $(target-dir)$(notdir $@)
 %.lst: %.c prepare scripts FORCE
-        $(Q)$(MAKE) $(build)=$(dir $<) $(dir $<)$(notdir $@)
+        $(Q)$(MAKE) $(build)=$(build-dir) $(target-dir)$(notdir $@)
 %.s: %.S prepare scripts FORCE
-        $(Q)$(MAKE) $(build)=$(dir $<) $(dir $<)$(notdir $@)
+        $(Q)$(MAKE) $(build)=$(build-dir) $(target-dir)$(notdir $@)
 %.o: %.S prepare scripts FORCE
-        $(Q)$(MAKE) $(build)=$(dir $<) $(dir $<)$(notdir $@)
-
-# For external modules we shall include any directory of the target,
-# but usual case there is no directory part.
-# make M=`pwd` module.o     => $(dir $@)=./
-# make M=`pwd` foo/module.o => $(dir $@)=foo/
-# make M=`pwd` /            => $(dir $@)=/
- 
-ifeq ($(KBUILD_EXTMOD),)
-        target-dir = $(@D)
-else
-        zap-slash=$(filter-out .,$(patsubst %/,%,$(dir $@)))
-        target-dir = $(KBUILD_EXTMOD)$(if $(zap-slash),/$(zap-slash))
-endif
+        $(Q)$(MAKE) $(build)=$(build-dir) $(target-dir)$(notdir $@)
 
-/ %/:      scripts prepare FORCE
+# Modules
+/ %/: prepare scripts FORCE
         $(Q)$(MAKE) KBUILD_MODULES=$(if $(CONFIG_MODULES),1) \
-        $(build)=$(target-dir)
-%.ko: scripts FORCE
+        $(build)=$(build-dir)
+%.ko: prepare scripts FORCE
         $(Q)$(MAKE) KBUILD_MODULES=$(if $(CONFIG_MODULES),1)   \
-        $(build)=$(target-dir) $(@:.ko=.o)
+        $(build)=$(build-dir) $(@:.ko=.o)
         $(Q)$(MAKE) -rR -f $(srctree)/scripts/Makefile.modpost
 
 # FIXME Should go into a make.lib or something 
diff --git a/arch/alpha/Kconfig b/arch/alpha/Kconfig
index 9bef61b30367..8290b69da202 100644
--- a/arch/alpha/Kconfig
+++ b/arch/alpha/Kconfig
@@ -549,6 +549,11 @@ config NUMA
           Access).  This option is for configuring high-end multiprocessor
           server machines.  If in doubt, say N.
 
+config NODES_SHIFT
+        int
+        default "7"
+        depends on NEED_MULTIPLE_NODES
+
 # LARGE_VMALLOC is racy, if you *really* need it then fix it first
 config ALPHA_LARGE_VMALLOC
         bool
diff --git a/arch/alpha/kernel/alpha_ksyms.c b/arch/alpha/kernel/alpha_ksyms.c
index 9d6186d50245..c645c5e14786 100644
--- a/arch/alpha/kernel/alpha_ksyms.c
+++ b/arch/alpha/kernel/alpha_ksyms.c
@@ -76,7 +76,6 @@ EXPORT_SYMBOL(strncpy);
 EXPORT_SYMBOL(strnlen);
 EXPORT_SYMBOL(strncat);
 EXPORT_SYMBOL(strstr);
-EXPORT_SYMBOL(strpbrk);
 EXPORT_SYMBOL(strchr);
 EXPORT_SYMBOL(strrchr);
 EXPORT_SYMBOL(memcmp);
diff --git a/arch/alpha/kernel/setup.c b/arch/alpha/kernel/setup.c
index dd8769670596..558b83368559 100644
--- a/arch/alpha/kernel/setup.c
+++ b/arch/alpha/kernel/setup.c
@@ -24,10 +24,12 @@
 #include <linux/config.h>       /* CONFIG_ALPHA_LCA etc */
 #include <linux/mc146818rtc.h>
 #include <linux/console.h>
+#include <linux/cpu.h>
 #include <linux/errno.h>
 #include <linux/init.h>
 #include <linux/string.h>
 #include <linux/ioport.h>
+#include <linux/platform_device.h>
 #include <linux/bootmem.h>
 #include <linux/pci.h>
 #include <linux/seq_file.h>
@@ -470,6 +472,22 @@ page_is_ram(unsigned long pfn)
         return 0;
 }
 
+static int __init
+register_cpus(void)
+{
+        int i;
+
+        for_each_possible_cpu(i) {
+                struct cpu *p = kzalloc(sizeof(*p), GFP_KERNEL);
+                if (!p)
+                        return -ENOMEM;
+                register_cpu(p, i, NULL);
+        }
+        return 0;
+}
+
+arch_initcall(register_cpus);
+
 void __init
 setup_arch(char **cmdline_p)
 {
@@ -1478,3 +1496,20 @@ alpha_panic_event(struct notifier_block *this, unsigned long event, void *ptr)
 #endif
         return NOTIFY_DONE;
 }
+
+static __init int add_pcspkr(void)
+{
+        struct platform_device *pd;
+        int ret;
+
+        pd = platform_device_alloc("pcspkr", -1);
+        if (!pd)
+                return -ENOMEM;
+
+        ret = platform_device_add(pd);
+        if (ret)
+                platform_device_put(pd);
+
+        return ret;
+}
+device_initcall(add_pcspkr);
diff --git a/arch/alpha/kernel/smp.c b/arch/alpha/kernel/smp.c
index 02c2db08114a..185255416e85 100644
--- a/arch/alpha/kernel/smp.c
+++ b/arch/alpha/kernel/smp.c
@@ -439,7 +439,7 @@ setup_smp(void)
                         if ((cpu->flags & 0x1cc) == 0x1cc) {
                                 smp_num_probed++;
                                 /* Assume here that "whami" == index */
-                                cpu_set(i, cpu_possible_map);
+                                cpu_set(i, cpu_present_mask);
                                 cpu->pal_revision = boot_cpu_palrev;
                         }
 
@@ -450,9 +450,8 @@ setup_smp(void)
                 }
         } else {
                 smp_num_probed = 1;
-                cpu_set(boot_cpuid, cpu_possible_map);
+                cpu_set(boot_cpuid, cpu_present_mask);
         }
-        cpu_present_mask = cpumask_of_cpu(boot_cpuid);
 
         printk(KERN_INFO "SMP: %d CPUs probed -- cpu_present_mask = %lx\n",
                smp_num_probed, cpu_possible_map.bits[0]);
@@ -488,9 +487,8 @@ void __devinit
 smp_prepare_boot_cpu(void)
 {
         /*
-         * Mark the boot cpu (current cpu) as both present and online
+         * Mark the boot cpu (current cpu) as online
          */ 
-        cpu_set(smp_processor_id(), cpu_present_mask);
         cpu_set(smp_processor_id(), cpu_online_map);
 }
 
diff --git a/arch/arm/Kconfig b/arch/arm/Kconfig
index dc5a9332c915..1dbf6ddb300d 100644
--- a/arch/arm/Kconfig
+++ b/arch/arm/Kconfig
@@ -512,6 +512,12 @@ config ARCH_DISCONTIGMEM_ENABLE
           or have huge holes in the physical address space for other reasons.
           See <file:Documentation/vm/numa> for more.
 
+config NODES_SHIFT
+        int
+        default "4" if ARCH_LH7A40X
+        default "2"
+        depends on NEED_MULTIPLE_NODES
+
 source "mm/Kconfig"
 
 config LEDS
diff --git a/arch/arm/boot/compressed/vmlinux.lds.in b/arch/arm/boot/compressed/vmlinux.lds.in
index eed616113e47..153a07e7222b 100644
--- a/arch/arm/boot/compressed/vmlinux.lds.in
+++ b/arch/arm/boot/compressed/vmlinux.lds.in
@@ -18,6 +18,7 @@ SECTIONS
     _start = .;
     *(.start)
     *(.text)
+    *(.text.*)
     *(.fixup)
     *(.gnu.warning)
     *(.rodata)
diff --git a/arch/arm/configs/at91rm9200dk_defconfig b/arch/arm/configs/at91rm9200dk_defconfig
index 1fe73d198888..9e1c1cceb735 100644
--- a/arch/arm/configs/at91rm9200dk_defconfig
+++ b/arch/arm/configs/at91rm9200dk_defconfig
@@ -379,7 +379,7 @@ CONFIG_MTD_PHYSMAP_BANKWIDTH=2
 # CONFIG_MTD_DOC2001 is not set
 # CONFIG_MTD_DOC2001PLUS is not set
 CONFIG_MTD_AT91_DATAFLASH=y
-CONFIG_MTD_AT91_DATAFLASH_CARD=y
+# CONFIG_MTD_AT91_DATAFLASH_CARD is not set
 
 #
 # NAND Flash Device Drivers
diff --git a/arch/arm/configs/at91rm9200ek_defconfig b/arch/arm/configs/at91rm9200ek_defconfig
index b7d934cdb1b7..6e0805a971d7 100644
--- a/arch/arm/configs/at91rm9200ek_defconfig
+++ b/arch/arm/configs/at91rm9200ek_defconfig
@@ -370,7 +370,7 @@ CONFIG_MTD_PHYSMAP_BANKWIDTH=2
 # CONFIG_MTD_DOC2001 is not set
 # CONFIG_MTD_DOC2001PLUS is not set
 CONFIG_MTD_AT91_DATAFLASH=y
-CONFIG_MTD_AT91_DATAFLASH_CARD=y
+# CONFIG_MTD_AT91_DATAFLASH_CARD is not set
 
 #
 # NAND Flash Device Drivers
diff --git a/arch/arm/kernel/armksyms.c b/arch/arm/kernel/armksyms.c
index 1574941ebfe1..c49b5d4d7fca 100644
--- a/arch/arm/kernel/armksyms.c
+++ b/arch/arm/kernel/armksyms.c
@@ -100,23 +100,11 @@ EXPORT_SYMBOL(__raw_writesl);
 #endif
 
         /* string / mem functions */
-EXPORT_SYMBOL(strcpy);
-EXPORT_SYMBOL(strncpy);
-EXPORT_SYMBOL(strcat);
-EXPORT_SYMBOL(strncat);
-EXPORT_SYMBOL(strcmp);
-EXPORT_SYMBOL(strncmp);
 EXPORT_SYMBOL(strchr);
-EXPORT_SYMBOL(strlen);
-EXPORT_SYMBOL(strnlen);
-EXPORT_SYMBOL(strpbrk);
 EXPORT_SYMBOL(strrchr);
-EXPORT_SYMBOL(strstr);
 EXPORT_SYMBOL(memset);
 EXPORT_SYMBOL(memcpy);
 EXPORT_SYMBOL(memmove);
-EXPORT_SYMBOL(memcmp);
-EXPORT_SYMBOL(memscan);
 EXPORT_SYMBOL(memchr);
 EXPORT_SYMBOL(__memzero);
 
@@ -190,8 +178,6 @@ EXPORT_SYMBOL(_find_next_bit_be);
 
         /* syscalls */
 EXPORT_SYMBOL(sys_write);
-EXPORT_SYMBOL(sys_read);
 EXPORT_SYMBOL(sys_lseek);
-EXPORT_SYMBOL(sys_open);
 EXPORT_SYMBOL(sys_exit);
 EXPORT_SYMBOL(sys_wait4);
diff --git a/arch/arm/kernel/setup.c b/arch/arm/kernel/setup.c
index b7cd280bfd63..8cff73e668b3 100644
--- a/arch/arm/kernel/setup.c
+++ b/arch/arm/kernel/setup.c
@@ -252,6 +252,9 @@ static void __init dump_cpu_info(int cpu)
                         dump_cache("cache", cpu, CACHE_ISIZE(info));
                 }
         }
+
+        if (arch_is_coherent())
+                printk("Cache coherency enabled\n");
 }
 
 int cpu_architecture(void)
@@ -319,6 +322,12 @@ static void __init setup_processor(void)
         sprintf(system_utsname.machine, "%s%c", list->arch_name, ENDIANNESS);
         sprintf(elf_platform, "%s%c", list->elf_name, ENDIANNESS);
         elf_hwcap = list->elf_hwcap;
+#ifndef CONFIG_ARM_THUMB
+        elf_hwcap &= ~HWCAP_THUMB;
+#endif
+#ifndef CONFIG_VFP
+        elf_hwcap &= ~HWCAP_VFP;
+#endif
 
         cpu_proc_init();
 }
diff --git a/arch/arm/mach-at91rm9200/Makefile b/arch/arm/mach-at91rm9200/Makefile
index 75e6ee318ded..ef88c4128edc 100644
--- a/arch/arm/mach-at91rm9200/Makefile
+++ b/arch/arm/mach-at91rm9200/Makefile
@@ -16,11 +16,12 @@ obj-$(CONFIG_MACH_CSB637)	+= board-csb637.o
 #obj-$(CONFIG_MACH_KB9200)      += board-kb9202.o
 
 # LEDs support
-#led-$(CONFIG_ARCH_AT91RM9200DK)        += leds.o
-#led-$(CONFIG_MACH_AT91RM9200EK)        += leds.o
-#led-$(CONFIG_MACH_CSB337)      += leds.o
-#led-$(CONFIG_MACH_CSB637)      += leds.o
+led-$(CONFIG_ARCH_AT91RM9200DK) += leds.o
+led-$(CONFIG_MACH_AT91RM9200EK) += leds.o
+led-$(CONFIG_MACH_CSB337)       += leds.o
+led-$(CONFIG_MACH_CSB637)       += leds.o
 #led-$(CONFIG_MACH_KB9200)      += leds.o
+#led-$(CONFIG_MACH_KAFA)        += leds.o
 obj-$(CONFIG_LEDS) += $(led-y)
 
 # VGA support
diff --git a/arch/arm/mach-at91rm9200/board-csb337.c b/arch/arm/mach-at91rm9200/board-csb337.c
index 54022e58d50d..f45104ceea8f 100644
--- a/arch/arm/mach-at91rm9200/board-csb337.c
+++ b/arch/arm/mach-at91rm9200/board-csb337.c
@@ -67,6 +67,9 @@ static void __init csb337_map_io(void)
         /* Initialize clocks: 3.6864 MHz crystal */
         at91_clock_init(3686400);
 
+        /* Setup the LEDs */
+        at91_init_leds(AT91_PIN_PB2, AT91_PIN_PB2);
+
 #ifdef CONFIG_SERIAL_AT91
         at91_console_port = CSB337_SERIAL_CONSOLE;
         memcpy(at91_serial_map, serial, sizeof(serial));
diff --git a/arch/arm/mach-at91rm9200/board-csb637.c b/arch/arm/mach-at91rm9200/board-csb637.c
index 8195f9d919ea..f2c2d6e79bc6 100644
--- a/arch/arm/mach-at91rm9200/board-csb637.c
+++ b/arch/arm/mach-at91rm9200/board-csb637.c
@@ -67,6 +67,9 @@ static void __init csb637_map_io(void)
         /* Initialize clocks: 3.6864 MHz crystal */
         at91_clock_init(3686400);
 
+        /* Setup the LEDs */
+        at91_init_leds(AT91_PIN_PB2, AT91_PIN_PB2);
+
 #ifdef CONFIG_SERIAL_AT91
         at91_console_port = CSB637_SERIAL_CONSOLE;
         memcpy(at91_serial_map, serial, sizeof(serial));
diff --git a/arch/arm/mach-at91rm9200/board-dk.c b/arch/arm/mach-at91rm9200/board-dk.c
index 8a783368366e..2d7200ed66ed 100644
--- a/arch/arm/mach-at91rm9200/board-dk.c
+++ b/arch/arm/mach-at91rm9200/board-dk.c
@@ -70,6 +70,9 @@ static void __init dk_map_io(void)
         /* Initialize clocks: 18.432 MHz crystal */
         at91_clock_init(18432000);
 
+        /* Setup the LEDs */
+        at91_init_leds(AT91_PIN_PB2, AT91_PIN_PB2);
+
 #ifdef CONFIG_SERIAL_AT91
         at91_console_port = DK_SERIAL_CONSOLE;
         memcpy(at91_serial_map, serial, sizeof(serial));
@@ -118,9 +121,14 @@ static void __init dk_board_init(void)
         at91_add_device_udc(&dk_udc_data);
         /* Compact Flash */
         at91_add_device_cf(&dk_cf_data);
+#ifdef CONFIG_MTD_AT91_DATAFLASH_CARD
+        /* DataFlash card */
+        at91_set_gpio_output(AT91_PIN_PB7, 0);
+#else
         /* MMC */
-        at91_set_gpio_output(AT91_PIN_PB7, 1);  /* this MMC card slot can optionally use SPI signaling (CS3). default: MMC */
+        at91_set_gpio_output(AT91_PIN_PB7, 1);  /* this MMC card slot can optionally use SPI signaling (CS3). */
         at91_add_device_mmc(&dk_mmc_data);
+#endif
         /* VGA */
 //      dk_add_device_video();
 }
diff --git a/arch/arm/mach-at91rm9200/board-ek.c b/arch/arm/mach-at91rm9200/board-ek.c
index fd0752eba897..80d90f5135a1 100644
--- a/arch/arm/mach-at91rm9200/board-ek.c
+++ b/arch/arm/mach-at91rm9200/board-ek.c
@@ -70,6 +70,9 @@ static void __init ek_map_io(void)
         /* Initialize clocks: 18.432 MHz crystal */
         at91_clock_init(18432000);
 
+        /* Setup the LEDs */
+        at91_init_leds(AT91_PIN_PB1, AT91_PIN_PB2);
+
 #ifdef CONFIG_SERIAL_AT91
         at91_console_port = EK_SERIAL_CONSOLE;
         memcpy(at91_serial_map, serial, sizeof(serial));
@@ -111,9 +114,14 @@ static void __init ek_board_init(void)
         at91_add_device_usbh(&ek_usbh_data);
         /* USB Device */
         at91_add_device_udc(&ek_udc_data);
+#ifdef CONFIG_MTD_AT91_DATAFLASH_CARD
+        /* DataFlash card */
+        at91_set_gpio_output(AT91_PIN_PB22, 0);
+#else
         /* MMC */
-        at91_set_gpio_output(AT91_PIN_PB22, 1); /* this MMC card slot can optionally use SPI signaling (CS3). default: MMC */
+        at91_set_gpio_output(AT91_PIN_PB22, 1); /* this MMC card slot can optionally use SPI signaling (CS3). */
         at91_add_device_mmc(&ek_mmc_data);
+#endif
         /* VGA */
 //      ek_add_device_video();
 }
diff --git a/arch/arm/mach-at91rm9200/devices.c b/arch/arm/mach-at91rm9200/devices.c
index 57eedd5beaf6..1781b8f342c4 100644
--- a/arch/arm/mach-at91rm9200/devices.c
+++ b/arch/arm/mach-at91rm9200/devices.c
@@ -28,10 +28,10 @@
 static u64 ohci_dmamask = 0xffffffffUL;
 static struct at91_usbh_data usbh_data;
 
-static struct resource at91rm9200_usbh_resource[] = {
+static struct resource at91_usbh_resource[] = {
         [0] = {
                 .start  = AT91_UHP_BASE,
-                .end    = AT91_UHP_BASE + SZ_1M -1,
+                .end    = AT91_UHP_BASE + SZ_1M - 1,
                 .flags  = IORESOURCE_MEM,
         },
         [1] = {
@@ -49,8 +49,8 @@ static struct platform_device at91rm9200_usbh_device = {
                                 .coherent_dma_mask      = 0xffffffff,
                                 .platform_data          = &usbh_data,
         },
-        .resource       = at91rm9200_usbh_resource,
-        .num_resources  = ARRAY_SIZE(at91rm9200_usbh_resource),
+        .resource       = at91_usbh_resource,
+        .num_resources  = ARRAY_SIZE(at91_usbh_resource),
 };
 
 void __init at91_add_device_usbh(struct at91_usbh_data *data)
@@ -121,6 +121,19 @@ void __init at91_add_device_udc(struct at91_udc_data *data) {}
 static u64 eth_dmamask = 0xffffffffUL;
 static struct at91_eth_data eth_data;
 
+static struct resource at91_eth_resources[] = {
+        [0] = {
+                .start  = AT91_BASE_EMAC,
+                .end    = AT91_BASE_EMAC + SZ_16K - 1,
+                .flags  = IORESOURCE_MEM,
+        },
+        [1] = {
+                .start  = AT91_ID_EMAC,
+                .end    = AT91_ID_EMAC,
+                .flags  = IORESOURCE_IRQ,
+        },
+};
+
 static struct platform_device at91rm9200_eth_device = {
         .name           = "at91_ether",
         .id             = -1,
@@ -129,7 +142,8 @@ static struct platform_device at91rm9200_eth_device = {
                                 .coherent_dma_mask      = 0xffffffff,
                                 .platform_data          = &eth_data,
         },
-        .num_resources  = 0,
+        .resource       = at91_eth_resources,
+        .num_resources  = ARRAY_SIZE(at91_eth_resources),
 };
 
 void __init at91_add_device_eth(struct at91_eth_data *data)
@@ -224,15 +238,20 @@ static u64 mmc_dmamask = 0xffffffffUL;
 static struct at91_mmc_data mmc_data;
 
 static struct resource at91_mmc_resources[] = {
-        {
+        [0] = {
                 .start  = AT91_BASE_MCI,
                 .end    = AT91_BASE_MCI + SZ_16K - 1,
                 .flags  = IORESOURCE_MEM,
-        }
+        },
+        [1] = {
+                .start  = AT91_ID_MCI,
+                .end    = AT91_ID_MCI,
+                .flags  = IORESOURCE_IRQ,
+        },
 };
 
 static struct platform_device at91rm9200_mmc_device = {
-        .name           = "at91rm9200_mci",
+        .name           = "at91_mci",
         .id             = -1,
         .dev            = {
                                 .dma_mask               = &mmc_dmamask,
@@ -290,4 +309,123 @@ void __init at91_add_device_mmc(struct at91_mmc_data *data)
 void __init at91_add_device_mmc(struct at91_mmc_data *data) {}
 #endif
 
+/* --------------------------------------------------------------------
+ *  NAND / SmartMedia
+ * -------------------------------------------------------------------- */
+
+#if defined(CONFIG_MTD_NAND_AT91) || defined(CONFIG_MTD_NAND_AT91_MODULE)
+static struct at91_nand_data nand_data;
+
+static struct resource at91_nand_resources[] = {
+        {
+                .start  = AT91_SMARTMEDIA_BASE,
+                .end    = AT91_SMARTMEDIA_BASE + SZ_8M - 1,
+                .flags  = IORESOURCE_MEM,
+        }
+};
+
+static struct platform_device at91_nand_device = {
+        .name           = "at91_nand",
+        .id             = -1,
+        .dev            = {
+                                .platform_data  = &nand_data,
+        },
+        .resource       = at91_nand_resources,
+        .num_resources  = ARRAY_SIZE(at91_nand_resources),
+};
+
+void __init at91_add_device_nand(struct at91_nand_data *data)
+{
+        if (!data)
+                return;
+
+        /* enable pin */
+        if (data->enable_pin)
+                at91_set_gpio_output(data->enable_pin, 1);
+
+        /* ready/busy pin */
+        if (data->rdy_pin)
+                at91_set_gpio_input(data->rdy_pin, 1);
+
+        /* card detect pin */
+        if (data->det_pin)
+                at91_set_gpio_input(data->det_pin, 1);
+
+        at91_set_A_periph(AT91_PIN_PC1, 0);             /* SMOE */
+        at91_set_A_periph(AT91_PIN_PC3, 0);             /* SMWE */
+
+        nand_data = *data;
+        platform_device_register(&at91_nand_device);
+}
+#else
+void __init at91_add_device_nand(struct at91_nand_data *data) {}
+#endif
+
+
+/* --------------------------------------------------------------------
+ *  TWI (i2c)
+ * -------------------------------------------------------------------- */
+
+#if defined(CONFIG_I2C_AT91) || defined(CONFIG_I2C_AT91_MODULE)
+static struct platform_device at91rm9200_twi_device = {
+        .name           = "at91_i2c",
+        .id             = -1,
+        .num_resources  = 0,
+};
+
+void __init at91_add_device_i2c(void)
+{
+        /* pins used for TWI interface */
+        at91_set_A_periph(AT91_PIN_PA25, 0);            /* TWD */
+        at91_set_multi_drive(AT91_PIN_PA25, 1);
+
+        at91_set_A_periph(AT91_PIN_PA26, 0);            /* TWCK */
+        at91_set_multi_drive(AT91_PIN_PA26, 1);
+
+        platform_device_register(&at91rm9200_twi_device);
+}
+#else
+void __init at91_add_device_i2c(void) {}
+#endif
+
+
+/* --------------------------------------------------------------------
+ *  RTC
+ * -------------------------------------------------------------------- */
+
+#if defined(CONFIG_AT91_RTC) || defined(CONFIG_AT91_RTC_MODULE)
+static struct platform_device at91rm9200_rtc_device = {
+        .name           = "at91_rtc",
+        .id             = -1,
+        .num_resources  = 0,
+};
+
+void __init at91_add_device_rtc(void)
+{
+        platform_device_register(&at91rm9200_rtc_device);
+}
+#else
+void __init at91_add_device_rtc(void) {}
+#endif
+
+
+/* --------------------------------------------------------------------
+ *  LEDs
+ * -------------------------------------------------------------------- */
+
+#if defined(CONFIG_LEDS)
+u8 at91_leds_cpu;
+u8 at91_leds_timer;
+
+void __init at91_init_leds(u8 cpu_led, u8 timer_led)
+{
+        at91_leds_cpu   = cpu_led;
+        at91_leds_timer = timer_led;
+}
+
+#else
+void __init at91_init_leds(u8 cpu_led, u8 timer_led) {}
+#endif
+
+
 /* -------------------------------------------------------------------- */
diff --git a/arch/arm/mach-at91rm9200/leds.c b/arch/arm/mach-at91rm9200/leds.c
new file mode 100644
index 000000000000..28150e8905ba
--- /dev/null
+++ b/arch/arm/mach-at91rm9200/leds.c
@@ -0,0 +1,100 @@
+/*
+ * LED driver for Atmel AT91-based boards.
+ *
+ *  Copyright (C) SAN People (Pty) Ltd
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * as published by the Free Software Foundation; either version
+ * 2 of the License, or (at your option) any later version.
+*/
+
+#include <linux/config.h>
+#include <linux/kernel.h>
+#include <linux/module.h>
+#include <linux/init.h>
+
+#include <asm/mach-types.h>
+#include <asm/leds.h>
+#include <asm/arch/board.h>
+#include <asm/arch/gpio.h>
+
+
+static inline void at91_led_on(unsigned int led)
+{
+        at91_set_gpio_value(led, 0);
+}
+
+static inline void at91_led_off(unsigned int led)
+{
+        at91_set_gpio_value(led, 1);
+}
+
+static inline void at91_led_toggle(unsigned int led)
+{
+        unsigned long is_off = at91_get_gpio_value(led);
+        if (is_off)
+                at91_led_on(led);
+        else
+                at91_led_off(led);
+}
+
+
+/*
+ * Handle LED events.
+ */
+static void at91_leds_event(led_event_t evt)
+{
+        unsigned long flags;
+
+        local_irq_save(flags);
+
+        switch(evt) {
+        case led_start:         /* System startup */
+                at91_led_on(at91_leds_cpu);
+                break;
+
+        case led_stop:          /* System stop / suspend */
+                at91_led_off(at91_leds_cpu);
+                break;
+
+#ifdef CONFIG_LEDS_TIMER
+        case led_timer:         /* Every 50 timer ticks */
+                at91_led_toggle(at91_leds_timer);
+                break;
+#endif
+
+#ifdef CONFIG_LEDS_CPU
+        case led_idle_start:    /* Entering idle state */
+                at91_led_off(at91_leds_cpu);
+                break;
+
+        case led_idle_end:      /* Exit idle state */
+                at91_led_on(at91_leds_cpu);
+                break;
+#endif
+
+        default:
+                break;
+        }
+
+        local_irq_restore(flags);
+}
+
+
+static int __init leds_init(void)
+{
+        if (!at91_leds_timer || !at91_leds_cpu)
+                return -ENODEV;
+
+        /* Enable PIO to access the LEDs */
+        at91_set_gpio_output(at91_leds_timer, 1);
+        at91_set_gpio_output(at91_leds_cpu, 1);
+
+        leds_event = at91_leds_event;
+
+        leds_event(led_start);
+        return 0;
+}
+
+__initcall(leds_init);
diff --git a/arch/arm/mach-ep93xx/core.c b/arch/arm/mach-ep93xx/core.c
index 2d892e4daa07..dcd417625389 100644
--- a/arch/arm/mach-ep93xx/core.c
+++ b/arch/arm/mach-ep93xx/core.c
@@ -424,6 +424,14 @@ static struct amba_device uart3_device = {
         .periphid       = 0x00041010,
 };
 
+
+static struct platform_device ep93xx_rtc_device = {
+       .name           = "ep93xx-rtc",
+       .id             = -1,
+       .num_resources  = 0,
+};
+
+
 void __init ep93xx_init_devices(void)
 {
         unsigned int v;
@@ -439,4 +447,6 @@ void __init ep93xx_init_devices(void)
         amba_device_register(&uart1_device, &iomem_resource);
         amba_device_register(&uart2_device, &iomem_resource);
         amba_device_register(&uart3_device, &iomem_resource);
+
+        platform_device_register(&ep93xx_rtc_device);
 }
diff --git a/arch/arm/mach-ep93xx/ts72xx.c b/arch/arm/mach-ep93xx/ts72xx.c
index 777e75daa8a5..9be01b0c3f48 100644
--- a/arch/arm/mach-ep93xx/ts72xx.c
+++ b/arch/arm/mach-ep93xx/ts72xx.c
@@ -17,6 +17,8 @@
 #include <linux/sched.h>
 #include <linux/interrupt.h>
 #include <linux/mtd/physmap.h>
+#include <linux/platform_device.h>
+#include <linux/m48t86.h>
 #include <asm/io.h>
 #include <asm/hardware.h>
 #include <asm/mach-types.h>
@@ -39,6 +41,16 @@ static struct map_desc ts72xx_io_desc[] __initdata = {
                 .pfn            = __phys_to_pfn(TS72XX_OPTIONS2_PHYS_BASE),
                 .length         = TS72XX_OPTIONS2_SIZE,
                 .type           = MT_DEVICE,
+        }, {
+                .virtual        = TS72XX_RTC_INDEX_VIRT_BASE,
+                .pfn            = __phys_to_pfn(TS72XX_RTC_INDEX_PHYS_BASE),
+                .length         = TS72XX_RTC_INDEX_SIZE,
+                .type           = MT_DEVICE,
+        }, {
+                .virtual        = TS72XX_RTC_DATA_VIRT_BASE,
+                .pfn            = __phys_to_pfn(TS72XX_RTC_DATA_PHYS_BASE),
+                .length         = TS72XX_RTC_DATA_SIZE,
+                .type           = MT_DEVICE,
         }
 };
 
@@ -99,11 +111,38 @@ static void __init ts72xx_map_io(void)
         }
 }
 
+static unsigned char ts72xx_rtc_readb(unsigned long addr)
+{
+        __raw_writeb(addr, TS72XX_RTC_INDEX_VIRT_BASE);
+        return __raw_readb(TS72XX_RTC_DATA_VIRT_BASE);
+}
+
+static void ts72xx_rtc_writeb(unsigned char value, unsigned long addr)
+{
+        __raw_writeb(addr, TS72XX_RTC_INDEX_VIRT_BASE);
+        __raw_writeb(value, TS72XX_RTC_DATA_VIRT_BASE);
+}
+
+static struct m48t86_ops ts72xx_rtc_ops = {
+        .readb                  = ts72xx_rtc_readb,
+        .writeb                 = ts72xx_rtc_writeb,
+};
+
+static struct platform_device ts72xx_rtc_device = {
+        .name                   = "rtc-m48t86",
+        .id                     = -1,
+        .dev                    = {
+                .platform_data          = &ts72xx_rtc_ops,
+        },
+        .num_resources          = 0,
+};
+
 static void __init ts72xx_init_machine(void)
 {
         ep93xx_init_devices();
         if (board_is_ts7200())
                 physmap_configure(TS72XX_NOR_PHYS_BASE, 0x01000000, 1, NULL);
+        platform_device_register(&ts72xx_rtc_device);
 }
 
 MACHINE_START(TS72XX, "Technologic Systems TS-72xx SBC")
diff --git a/arch/arm/mach-imx/dma.c b/arch/arm/mach-imx/dma.c
index 71a59e196166..4ca51dcf13ac 100644
--- a/arch/arm/mach-imx/dma.c
+++ b/arch/arm/mach-imx/dma.c
@@ -7,11 +7,18 @@
  *  it under the terms of the GNU General Public License version 2 as
  *  published by the Free Software Foundation.
  *
- *  03/03/2004 Sascha Hauer <sascha@saschahauer.de>
+ *  2004-03-03 Sascha Hauer <sascha@saschahauer.de>
  *             initial version heavily inspired by
  *             linux/arch/arm/mach-pxa/dma.c
+ *
+ *  2005-04-17 Pavel Pisa <pisa@cmp.felk.cvut.cz>
+ *             Changed to support scatter gather DMA
+ *             by taking Russell's code from RiscPC
+ *
  */
 
+#undef DEBUG
+
 #include <linux/module.h>
 #include <linux/init.h>
 #include <linux/kernel.h>
@@ -22,69 +29,368 @@
 #include <asm/irq.h>
 #include <asm/hardware.h>
 #include <asm/dma.h>
+#include <asm/arch/imx-dma.h>
+
+struct imx_dma_channel imx_dma_channels[IMX_DMA_CHANNELS];
+
+/*
+ * imx_dma_sg_next - prepare next chunk for scatter-gather DMA emulation
+ * @dma_ch: i.MX DMA channel number
+ * @lastcount: number of bytes transferred during last transfer
+ *
+ * Functions prepares DMA controller for next sg data chunk transfer.
+ * The @lastcount argument informs function about number of bytes transferred
+ * during last block. Zero value can be used for @lastcount to setup DMA
+ * for the first chunk.
+ */
+static inline int imx_dma_sg_next(imx_dmach_t dma_ch, unsigned int lastcount)
+{
+        struct imx_dma_channel *imxdma = &imx_dma_channels[dma_ch];
+        unsigned int nextcount;
+        unsigned int nextaddr;
+
+        if (!imxdma->name) {
+                printk(KERN_CRIT "%s: called for  not allocated channel %d\n",
+                       __FUNCTION__, dma_ch);
+                return 0;
+        }
+
+        imxdma->resbytes -= lastcount;
+
+        if (!imxdma->sg) {
+                pr_debug("imxdma%d: no sg data\n", dma_ch);
+                return 0;
+        }
+
+        imxdma->sgbc += lastcount;
+        if ((imxdma->sgbc >= imxdma->sg->length) || !imxdma->resbytes) {
+                if ((imxdma->sgcount <= 1) || !imxdma->resbytes) {
+                        pr_debug("imxdma%d: sg transfer limit reached\n",
+                                 dma_ch);
+                        imxdma->sgcount=0;
+                        imxdma->sg = NULL;
+                        return 0;
+                } else {
+                        imxdma->sgcount--;
+                        imxdma->sg++;
+                        imxdma->sgbc = 0;
+                }
+        }
+        nextcount = imxdma->sg->length - imxdma->sgbc;
+        nextaddr = imxdma->sg->dma_address + imxdma->sgbc;
 
-static struct dma_channel {
-        char *name;
-        void (*irq_handler) (int, void *, struct pt_regs *);
-        void (*err_handler) (int, void *, struct pt_regs *);
-        void *data;
-} dma_channels[11];
+        if(imxdma->resbytes < nextcount)
+                nextcount = imxdma->resbytes;
 
-/* set err_handler to NULL to have the standard info-only error handler */
+        if ((imxdma->dma_mode & DMA_MODE_MASK) == DMA_MODE_READ)
+                DAR(dma_ch) = nextaddr;
+        else
+                SAR(dma_ch) = nextaddr;
+
+        CNTR(dma_ch) = nextcount;
+        pr_debug("imxdma%d: next sg chunk dst 0x%08x, src 0x%08x, size 0x%08x\n",
+                 dma_ch, DAR(dma_ch), SAR(dma_ch), CNTR(dma_ch));
+
+        return nextcount;
+}
+
+/*
+ * imx_dma_setup_sg_base - scatter-gather DMA emulation
+ * @dma_ch: i.MX DMA channel number
+ * @sg: pointer to the scatter-gather list/vector
+ * @sgcount: scatter-gather list hungs count
+ *
+ * Functions sets up i.MX DMA state for emulated scatter-gather transfer
+ * and sets up channel registers to be ready for the first chunk
+ */
+static int
+imx_dma_setup_sg_base(imx_dmach_t dma_ch,
+                      struct scatterlist *sg, unsigned int sgcount)
+{
+        struct imx_dma_channel *imxdma = &imx_dma_channels[dma_ch];
+
+        imxdma->sg = sg;
+        imxdma->sgcount = sgcount;
+        imxdma->sgbc = 0;
+        return imx_dma_sg_next(dma_ch, 0);
+}
+
+/**
+ * imx_dma_setup_single - setup i.MX DMA channel for linear memory to/from device transfer
+ * @dma_ch: i.MX DMA channel number
+ * @dma_address: the DMA/physical memory address of the linear data block
+ *              to transfer
+ * @dma_length: length of the data block in bytes
+ * @dev_addr: physical device port address
+ * @dmamode: DMA transfer mode, %DMA_MODE_READ from the device to the memory
+ *           or %DMA_MODE_WRITE from memory to the device
+ *
+ * The function setups DMA channel source and destination addresses for transfer
+ * specified by provided parameters. The scatter-gather emulation is disabled,
+ * because linear data block
+ * form the physical address range is transfered.
+ * Return value: if incorrect parameters are provided -%EINVAL.
+ *              Zero indicates success.
+ */
 int
-imx_request_dma(char *name, imx_dma_prio prio,
-                void (*irq_handler) (int, void *, struct pt_regs *),
-                void (*err_handler) (int, void *, struct pt_regs *), void *data)
+imx_dma_setup_single(imx_dmach_t dma_ch, dma_addr_t dma_address,
+                     unsigned int dma_length, unsigned int dev_addr,
+                     dmamode_t dmamode)
 {
-        unsigned long flags;
-        int i, found = 0;
+        struct imx_dma_channel *imxdma = &imx_dma_channels[dma_ch];
 
-        /* basic sanity checks */
-        if (!name || !irq_handler)
+        imxdma->sg = NULL;
+        imxdma->sgcount = 0;
+        imxdma->dma_mode = dmamode;
+        imxdma->resbytes = dma_length;
+
+        if (!dma_address) {
+                printk(KERN_ERR "imxdma%d: imx_dma_setup_single null address\n",
+                       dma_ch);
                 return -EINVAL;
+        }
 
-        local_irq_save(flags);
+        if (!dma_length) {
+                printk(KERN_ERR "imxdma%d: imx_dma_setup_single zero length\n",
+                       dma_ch);
+                return -EINVAL;
+        }
 
-        /* try grabbing a DMA channel with the requested priority */
-        for (i = prio; i < prio + (prio == DMA_PRIO_LOW) ? 8 : 4; i++) {
-                if (!dma_channels[i].name) {
-                        found = 1;
-                        break;
-                }
+        if ((dmamode & DMA_MODE_MASK) == DMA_MODE_READ) {
+                pr_debug("imxdma%d: mx_dma_setup_single2dev dma_addressg=0x%08x dma_length=%d dev_addr=0x%08x for read\n",
+                        dma_ch, (unsigned int)dma_address, dma_length,
+                        dev_addr);
+                SAR(dma_ch) = dev_addr;
+                DAR(dma_ch) = (unsigned int)dma_address;
+        } else if ((dmamode & DMA_MODE_MASK) == DMA_MODE_WRITE) {
+                pr_debug("imxdma%d: mx_dma_setup_single2dev dma_addressg=0x%08x dma_length=%d dev_addr=0x%08x for write\n",
+                        dma_ch, (unsigned int)dma_address, dma_length,
+                        dev_addr);
+                SAR(dma_ch) = (unsigned int)dma_address;
+                DAR(dma_ch) = dev_addr;
+        } else {
+                printk(KERN_ERR "imxdma%d: imx_dma_setup_single bad dmamode\n",
+                       dma_ch);
+                return -EINVAL;
         }
 
-        if (!found) {
-                /* requested prio group is full, try hier priorities */
-                for (i = prio - 1; i >= 0; i--) {
-                        if (!dma_channels[i].name) {
-                                found = 1;
-                                break;
-                        }
-                }
+        CNTR(dma_ch) = dma_length;
+
+        return 0;
+}
+
+/**
+ * imx_dma_setup_sg - setup i.MX DMA channel SG list to/from device transfer
+ * @dma_ch: i.MX DMA channel number
+ * @sg: pointer to the scatter-gather list/vector
+ * @sgcount: scatter-gather list hungs count
+ * @dma_length: total length of the transfer request in bytes
+ * @dev_addr: physical device port address
+ * @dmamode: DMA transfer mode, %DMA_MODE_READ from the device to the memory
+ *           or %DMA_MODE_WRITE from memory to the device
+ *
+ * The function setups DMA channel state and registers to be ready for transfer
+ * specified by provided parameters. The scatter-gather emulation is set up
+ * according to the parameters.
+ *
+ * The full preparation of the transfer requires setup of more register
+ * by the caller before imx_dma_enable() can be called.
+ *
+ * %BLR(dma_ch) holds transfer burst length in bytes, 0 means 64 bytes
+ *
+ * %RSSR(dma_ch) has to be set to the DMA request line source %DMA_REQ_xxx
+ *
+ * %CCR(dma_ch) has to specify transfer parameters, the next settings is typical
+ * for linear or simple scatter-gather transfers if %DMA_MODE_READ is specified
+ *
+ * %CCR_DMOD_LINEAR | %CCR_DSIZ_32 | %CCR_SMOD_FIFO | %CCR_SSIZ_x
+ *
+ * The typical setup for %DMA_MODE_WRITE is specified by next options combination
+ *
+ * %CCR_SMOD_LINEAR | %CCR_SSIZ_32 | %CCR_DMOD_FIFO | %CCR_DSIZ_x
+ *
+ * Be carefull there and do not mistakenly mix source and target device
+ * port sizes constants, they are really different:
+ * %CCR_SSIZ_8, %CCR_SSIZ_16, %CCR_SSIZ_32,
+ * %CCR_DSIZ_8, %CCR_DSIZ_16, %CCR_DSIZ_32
+ *
+ * Return value: if incorrect parameters are provided -%EINVAL.
+ * Zero indicates success.
+ */
+int
+imx_dma_setup_sg(imx_dmach_t dma_ch,
+                 struct scatterlist *sg, unsigned int sgcount, unsigned int dma_length,
+                 unsigned int dev_addr, dmamode_t dmamode)
+{
+        int res;
+        struct imx_dma_channel *imxdma = &imx_dma_channels[dma_ch];
+
+        imxdma->sg = NULL;
+        imxdma->sgcount = 0;
+        imxdma->dma_mode = dmamode;
+        imxdma->resbytes = dma_length;
+
+        if (!sg || !sgcount) {
+                printk(KERN_ERR "imxdma%d: imx_dma_setup_sg epty sg list\n",
+                       dma_ch);
+                return -EINVAL;
+        }
+
+        if (!sg->length) {
+                printk(KERN_ERR "imxdma%d: imx_dma_setup_sg zero length\n",
+                       dma_ch);
+                return -EINVAL;
         }
 
-        if (found) {
-                DIMR &= ~(1 << i);
-                dma_channels[i].name = name;
-                dma_channels[i].irq_handler = irq_handler;
-                dma_channels[i].err_handler = err_handler;
-                dma_channels[i].data = data;
+        if ((dmamode & DMA_MODE_MASK) == DMA_MODE_READ) {
+                pr_debug("imxdma%d: mx_dma_setup_sg2dev sg=%p sgcount=%d total length=%d dev_addr=0x%08x for read\n",
+                        dma_ch, sg, sgcount, dma_length, dev_addr);
+                SAR(dma_ch) = dev_addr;
+        } else if ((dmamode & DMA_MODE_MASK) == DMA_MODE_WRITE) {
+                pr_debug("imxdma%d: mx_dma_setup_sg2dev sg=%p sgcount=%d total length=%d dev_addr=0x%08x for write\n",
+                        dma_ch, sg, sgcount, dma_length, dev_addr);
+                DAR(dma_ch) = dev_addr;
         } else {
-                printk(KERN_WARNING "No more available DMA channels for %s\n",
-                       name);
-                i = -ENODEV;
+                printk(KERN_ERR "imxdma%d: imx_dma_setup_sg bad dmamode\n",
+                       dma_ch);
+                return -EINVAL;
+        }
+
+        res = imx_dma_setup_sg_base(dma_ch, sg, sgcount);
+        if (res <= 0) {
+                printk(KERN_ERR "imxdma%d: no sg chunk ready\n", dma_ch);
+                return -EINVAL;
+        }
+
+        return 0;
+}
+
+/**
+ * imx_dma_setup_handlers - setup i.MX DMA channel end and error notification handlers
+ * @dma_ch: i.MX DMA channel number
+ * @irq_handler: the pointer to the function called if the transfer
+ *              ends successfully
+ * @err_handler: the pointer to the function called if the premature
+ *              end caused by error occurs
+ * @data: user specified value to be passed to the handlers
+ */
+int
+imx_dma_setup_handlers(imx_dmach_t dma_ch,
+                       void (*irq_handler) (int, void *, struct pt_regs *),
+                       void (*err_handler) (int, void *, struct pt_regs *),
+                       void *data)
+{
+        struct imx_dma_channel *imxdma = &imx_dma_channels[dma_ch];
+        unsigned long flags;
+
+        if (!imxdma->name) {
+                printk(KERN_CRIT "%s: called for  not allocated channel %d\n",
+                       __FUNCTION__, dma_ch);
+                return -ENODEV;
+        }
+
+        local_irq_save(flags);
+        DISR = (1 << dma_ch);
+        imxdma->irq_handler = irq_handler;
+        imxdma->err_handler = err_handler;
+        imxdma->data = data;
+        local_irq_restore(flags);
+        return 0;
+}
+
+/**
+ * imx_dma_enable - function to start i.MX DMA channel operation
+ * @dma_ch: i.MX DMA channel number
+ *
+ * The channel has to be allocated by driver through imx_dma_request()
+ * or imx_dma_request_by_prio() function.
+ * The transfer parameters has to be set to the channel registers through
+ * call of the imx_dma_setup_single() or imx_dma_setup_sg() function
+ * and registers %BLR(dma_ch), %RSSR(dma_ch) and %CCR(dma_ch) has to
+ * be set prior this function call by the channel user.
+ */
+void imx_dma_enable(imx_dmach_t dma_ch)
+{
+        struct imx_dma_channel *imxdma = &imx_dma_channels[dma_ch];
+        unsigned long flags;
+
+        pr_debug("imxdma%d: imx_dma_enable\n", dma_ch);
+
+        if (!imxdma->name) {
+                printk(KERN_CRIT "%s: called for  not allocated channel %d\n",
+                       __FUNCTION__, dma_ch);
+                return;
+        }
+
+        local_irq_save(flags);
+        DISR = (1 << dma_ch);
+        DIMR &= ~(1 << dma_ch);
+        CCR(dma_ch) |= CCR_CEN;
+        local_irq_restore(flags);
+}
+
+/**
+ * imx_dma_disable - stop, finish i.MX DMA channel operatin
+ * @dma_ch: i.MX DMA channel number
+ */
+void imx_dma_disable(imx_dmach_t dma_ch)
+{
+        unsigned long flags;
+
+        pr_debug("imxdma%d: imx_dma_disable\n", dma_ch);
+
+        local_irq_save(flags);
+        DIMR |= (1 << dma_ch);
+        CCR(dma_ch) &= ~CCR_CEN;
+        DISR = (1 << dma_ch);
+        local_irq_restore(flags);
+}
+
+/**
+ * imx_dma_request - request/allocate specified channel number
+ * @dma_ch: i.MX DMA channel number
+ * @name: the driver/caller own non-%NULL identification
+ */
+int imx_dma_request(imx_dmach_t dma_ch, const char *name)
+{
+        struct imx_dma_channel *imxdma = &imx_dma_channels[dma_ch];
+        unsigned long flags;
+
+        /* basic sanity checks */
+        if (!name)
+                return -EINVAL;
+
+        if (dma_ch >= IMX_DMA_CHANNELS) {
+                printk(KERN_CRIT "%s: called for  non-existed channel %d\n",
+                       __FUNCTION__, dma_ch);
+                return -EINVAL;
         }
 
+        local_irq_save(flags);
+        if (imxdma->name) {
+                local_irq_restore(flags);
+                return -ENODEV;
+        }
+
+        imxdma->name = name;
+        imxdma->irq_handler = NULL;
+        imxdma->err_handler = NULL;
+        imxdma->data = NULL;
+        imxdma->sg = NULL;
         local_irq_restore(flags);
-        return i;
+        return 0;
 }
 
-void
-imx_free_dma(int dma_ch)
+/**
+ * imx_dma_free - release previously acquired channel
+ * @dma_ch: i.MX DMA channel number
+ */
+void imx_dma_free(imx_dmach_t dma_ch)
 {
         unsigned long flags;
+        struct imx_dma_channel *imxdma = &imx_dma_channels[dma_ch];
 
-        if (!dma_channels[dma_ch].name) {
+        if (!imxdma->name) {
                 printk(KERN_CRIT
                        "%s: trying to free channel %d which is already freed\n",
                        __FUNCTION__, dma_ch);
@@ -92,27 +398,84 @@ imx_free_dma(int dma_ch)
         }
 
         local_irq_save(flags);
-        DIMR &= ~(1 << dma_ch);
-        dma_channels[dma_ch].name = NULL;
+        /* Disable interrupts */
+        DIMR |= (1 << dma_ch);
+        CCR(dma_ch) &= ~CCR_CEN;
+        imxdma->name = NULL;
         local_irq_restore(flags);
 }
 
-static irqreturn_t
-dma_err_handler(int irq, void *dev_id, struct pt_regs *regs)
+/**
+ * imx_dma_request_by_prio - find and request some of free channels best suiting requested priority
+ * @dma_ch: i.MX DMA channel number
+ * @name: the driver/caller own non-%NULL identification
+ * @prio: one of the hardware distinguished priority level:
+ *        %DMA_PRIO_HIGH, %DMA_PRIO_MEDIUM, %DMA_PRIO_LOW
+ *
+ * This function tries to find free channel in the specified priority group
+ * if the priority cannot be achieved it tries to look for free channel
+ * in the higher and then even lower priority groups.
+ *
+ * Return value: If there is no free channel to allocate, -%ENODEV is returned.
+ *               Zero value indicates successful channel allocation.
+ */
+int
+imx_dma_request_by_prio(imx_dmach_t * pdma_ch, const char *name,
+                        imx_dma_prio prio)
+{
+        int i;
+        int best;
+
+        switch (prio) {
+        case (DMA_PRIO_HIGH):
+                best = 8;
+                break;
+        case (DMA_PRIO_MEDIUM):
+                best = 4;
+                break;
+        case (DMA_PRIO_LOW):
+        default:
+                best = 0;
+                break;
+        }
+
+        for (i = best; i < IMX_DMA_CHANNELS; i++) {
+                if (!imx_dma_request(i, name)) {
+                        *pdma_ch = i;
+                        return 0;
+                }
+        }
+
+        for (i = best - 1; i >= 0; i--) {
+                if (!imx_dma_request(i, name)) {
+                        *pdma_ch = i;
+                        return 0;
+                }
+        }
+
+        printk(KERN_ERR "%s: no free DMA channel found\n", __FUNCTION__);
+
+        return -ENODEV;
+}
+
+static irqreturn_t dma_err_handler(int irq, void *dev_id, struct pt_regs *regs)
 {
         int i, disr = DISR;
-        struct dma_channel *channel;
+        struct imx_dma_channel *channel;
         unsigned int err_mask = DBTOSR | DRTOSR | DSESR | DBOSR;
 
         DISR = disr;
-        for (i = 0; i < 11; i++) {
-                channel = &dma_channels[i];
+        for (i = 0; i < IMX_DMA_CHANNELS; i++) {
+                channel = &imx_dma_channels[i];
 
-                if ( (err_mask & 1<<i) && channel->name && channel->err_handler) {
+                if ((err_mask & 1 << i) && channel->name
+                    && channel->err_handler) {
                         channel->err_handler(i, channel->data, regs);
                         continue;
                 }
 
+                imx_dma_channels[i].sg = NULL;
+
                 if (DBTOSR & (1 << i)) {
                         printk(KERN_WARNING
                                "Burst timeout on channel %d (%s)\n",
@@ -141,17 +504,27 @@ dma_err_handler(int irq, void *dev_id, struct pt_regs *regs)
         return IRQ_HANDLED;
 }
 
-static irqreturn_t
-dma_irq_handler(int irq, void *dev_id, struct pt_regs *regs)
+static irqreturn_t dma_irq_handler(int irq, void *dev_id, struct pt_regs *regs)
 {
         int i, disr = DISR;
 
+        pr_debug("imxdma: dma_irq_handler called, disr=0x%08x\n",
+                     disr);
+
         DISR = disr;
-        for (i = 0; i < 11; i++) {
+        for (i = 0; i < IMX_DMA_CHANNELS; i++) {
                 if (disr & (1 << i)) {
-                        struct dma_channel *channel = &dma_channels[i];
-                        if (channel->name && channel->irq_handler) {
-                                channel->irq_handler(i, channel->data, regs);
+                        struct imx_dma_channel *channel = &imx_dma_channels[i];
+                        if (channel->name) {
+                                if (imx_dma_sg_next(i, CNTR(i))) {
+                                        CCR(i) &= ~CCR_CEN;
+                                        mb();
+                                        CCR(i) |= CCR_CEN;
+                                } else {
+                                        if (channel->irq_handler)
+                                                channel->irq_handler(i,
+                                                        channel->data, regs);
+                                }
                         } else {
                                 /*
                                  * IRQ for an unregistered DMA channel:
@@ -165,10 +538,10 @@ dma_irq_handler(int irq, void *dev_id, struct pt_regs *regs)
         return IRQ_HANDLED;
 }
 
-static int __init
-imx_dma_init(void)
+static int __init imx_dma_init(void)
 {
         int ret;
+        int i;
 
         /* reset DMA module */
         DCR = DCR_DRST;
@@ -189,15 +562,27 @@ imx_dma_init(void)
         DCR = DCR_DEN;
 
         /* clear all interrupts */
-        DISR = 0x3ff;
+        DISR = (1 << IMX_DMA_CHANNELS) - 1;
 
         /* enable interrupts */
-        DIMR = 0;
+        DIMR = (1 << IMX_DMA_CHANNELS) - 1;
+
+        for (i = 0; i < IMX_DMA_CHANNELS; i++) {
+                imx_dma_channels[i].sg = NULL;
+                imx_dma_channels[i].dma_num = i;
+        }
 
         return ret;
 }
 
 arch_initcall(imx_dma_init);
 
-EXPORT_SYMBOL(imx_request_dma);
-EXPORT_SYMBOL(imx_free_dma);
+EXPORT_SYMBOL(imx_dma_setup_single);
+EXPORT_SYMBOL(imx_dma_setup_sg);
+EXPORT_SYMBOL(imx_dma_setup_handlers);
+EXPORT_SYMBOL(imx_dma_enable);
+EXPORT_SYMBOL(imx_dma_disable);
+EXPORT_SYMBOL(imx_dma_request);
+EXPORT_SYMBOL(imx_dma_free);
+EXPORT_SYMBOL(imx_dma_request_by_prio);
+EXPORT_SYMBOL(imx_dma_channels);
diff --git a/arch/arm/mach-imx/generic.c b/arch/arm/mach-imx/generic.c
index 37613ad68366..9d8331be2b58 100644
--- a/arch/arm/mach-imx/generic.c
+++ b/arch/arm/mach-imx/generic.c
@@ -33,6 +33,7 @@
 #include <asm/arch/imx-regs.h>
 
 #include <asm/mach/map.h>
+#include <asm/arch/mmc.h>
 
 void imx_gpio_mode(int gpio_mode)
 {
@@ -175,13 +176,25 @@ static struct resource imx_mmc_resources[] = {
         },
 };
 
+static u64 imxmmmc_dmamask = 0xffffffffUL;
+
 static struct platform_device imx_mmc_device = {
         .name           = "imx-mmc",
         .id             = 0,
+        .dev            = {
+                .dma_mask = &imxmmmc_dmamask,
+                .coherent_dma_mask = 0xffffffff,
+        },
         .num_resources  = ARRAY_SIZE(imx_mmc_resources),
         .resource       = imx_mmc_resources,
 };
 
+void __init imx_set_mmc_info(struct imxmmc_platform_data *info)
+{
+        imx_mmc_device.dev.platform_data = info;
+}
+EXPORT_SYMBOL(imx_set_mmc_info);
+
 static struct resource imx_uart1_resources[] = {
         [0] = {
                 .start  = 0x00206000,
diff --git a/arch/arm/mach-imx/mx1ads.c b/arch/arm/mach-imx/mx1ads.c
index 8ab1b040288c..e34d0df90aed 100644
--- a/arch/arm/mach-imx/mx1ads.c
+++ b/arch/arm/mach-imx/mx1ads.c
@@ -25,6 +25,7 @@
 #include <asm/mach-types.h>
 
 #include <asm/mach/arch.h>
+#include <asm/arch/mmc.h>
 #include <linux/interrupt.h>
 #include "generic.h"
 
@@ -51,12 +52,29 @@ static struct platform_device *devices[] __initdata = {
         &cs89x0_device,
 };
 
+#ifdef CONFIG_MMC_IMX
+static int mx1ads_mmc_card_present(void)
+{
+        /* MMC/SD Card Detect is PB 20 on MX1ADS V1.0.7 */
+        return (SSR(1) & (1 << 20) ? 0 : 1);
+}
+
+static struct imxmmc_platform_data mx1ads_mmc_info = {
+       .card_present = mx1ads_mmc_card_present,
+};
+#endif
+
 static void __init
 mx1ads_init(void)
 {
 #ifdef CONFIG_LEDS
         imx_gpio_mode(GPIO_PORTA | GPIO_OUT | 2);
 #endif
+#ifdef CONFIG_MMC_IMX
+        /* SD/MMC card detect */
+        imx_gpio_mode(GPIO_PORTB | GPIO_GIUS | GPIO_IN | 20);
+        imx_set_mmc_info(&mx1ads_mmc_info);
+#endif
         platform_add_devices(devices, ARRAY_SIZE(devices));
 }
 
diff --git a/arch/arm/mach-ixp23xx/espresso.c b/arch/arm/mach-ixp23xx/espresso.c
index 2327c9790416..bf688c128630 100644
--- a/arch/arm/mach-ixp23xx/espresso.c
+++ b/arch/arm/mach-ixp23xx/espresso.c
@@ -44,6 +44,15 @@
 #include <asm/mach/irq.h>
 #include <asm/mach/pci.h>
 
+static int __init espresso_pci_init(void)
+{
+        if (machine_is_espresso())
+                ixp23xx_pci_slave_init();
+
+        return 0;
+};
+subsys_initcall(espresso_pci_init);
+
 static void __init espresso_init(void)
 {
         physmap_configure(0x90000000, 0x02000000, 2, NULL);
diff --git a/arch/arm/mach-ixp23xx/pci.c b/arch/arm/mach-ixp23xx/pci.c
index 5330ad78c1bb..ac72f94c5b4d 100644
--- a/arch/arm/mach-ixp23xx/pci.c
+++ b/arch/arm/mach-ixp23xx/pci.c
@@ -201,7 +201,7 @@ int clear_master_aborts(void)
         return 0;
 }
 
-void __init ixp23xx_pci_preinit(void)
+static void __init ixp23xx_pci_common_init(void)
 {
 #ifdef __ARMEB__
         *IXP23XX_PCI_CONTROL |= 0x20000;        /* set I/O swapping */
@@ -219,7 +219,18 @@ void __init ixp23xx_pci_preinit(void)
                 *IXP23XX_PCI_CPP_ADDR_BITS &= ~(1 << 1);
         } else {
                 *IXP23XX_PCI_CPP_ADDR_BITS |= (1 << 1);
+
+                /*
+                 * Enable coherency on A2 silicon.
+                 */
+                if (arch_is_coherent())
+                        *IXP23XX_CPP2XSI_CURR_XFER_REG3 &= ~IXP23XX_CPP2XSI_COH_OFF;
         }
+}
+
+void __init ixp23xx_pci_preinit(void)
+{
+        ixp23xx_pci_common_init();
 
         hook_fault_code(16+6, ixp23xx_pci_abort_handler, SIGBUS,
                         "PCI config cycle to non-existent device");
@@ -273,3 +284,8 @@ int ixp23xx_pci_setup(int nr, struct pci_sys_data *sys)
 
         return 1;
 }
+
+void ixp23xx_pci_slave_init(void)
+{
+        ixp23xx_pci_common_init();
+}
diff --git a/arch/arm/mach-omap1/Kconfig b/arch/arm/mach-omap1/Kconfig
index 86a0f0d14345..f8d716ccc1df 100644
--- a/arch/arm/mach-omap1/Kconfig
+++ b/arch/arm/mach-omap1/Kconfig
@@ -69,12 +69,6 @@ config MACH_VOICEBLUE
           Support for Voiceblue GSM/VoIP gateway. Say Y here if you have
           such a board.
 
-config MACH_NETSTAR
-        bool "NetStar"
-        depends on ARCH_OMAP1 && ARCH_OMAP15XX
-        help
-          Support for NetStar PBX. Say Y here if you have such a board.
-
 config MACH_OMAP_PALMTE
         bool "Palm Tungsten E"
         depends on ARCH_OMAP1 && ARCH_OMAP15XX
@@ -85,6 +79,20 @@ config MACH_OMAP_PALMTE
           informations.
           Say Y here if you have such a PDA, say NO otherwise.
 
+config MACH_NOKIA770
+        bool "Nokia 770"
+        depends on ARCH_OMAP1 && ARCH_OMAP16XX
+        help
+          Support for the Nokia 770 Internet Tablet. Say Y here if you
+          have such a device.
+
+config MACH_AMS_DELTA
+        bool "Amstrad E3 (Delta)"
+        depends on ARCH_OMAP1 && ARCH_OMAP15XX
+        help
+          Support for the Amstrad E3 (codename Delta) videophone. Say Y here
+          if you have such a device.
+
 config MACH_OMAP_GENERIC
         bool "Generic OMAP board"
         depends on ARCH_OMAP1 && (ARCH_OMAP15XX || ARCH_OMAP16XX)
diff --git a/arch/arm/mach-omap1/Makefile b/arch/arm/mach-omap1/Makefile
index b0b00156faae..9ea719550ad3 100644
--- a/arch/arm/mach-omap1/Makefile
+++ b/arch/arm/mach-omap1/Makefile
@@ -3,7 +3,13 @@
 #
 
 # Common support
-obj-y := io.o id.o clock.o irq.o time.o mux.o serial.o devices.o
+obj-y := io.o id.o clock.o irq.o mux.o serial.o devices.o
+
+obj-$(CONFIG_OMAP_MPU_TIMER)            += time.o
+
+# Power Management
+obj-$(CONFIG_PM) += pm.o sleep.o
+
 led-y := leds.o
 
 # Specific board support
@@ -14,8 +20,9 @@ obj-$(CONFIG_MACH_OMAP_PERSEUS2)	+= board-perseus2.o
 obj-$(CONFIG_MACH_OMAP_OSK)             += board-osk.o
 obj-$(CONFIG_MACH_OMAP_H3)              += board-h3.o
 obj-$(CONFIG_MACH_VOICEBLUE)            += board-voiceblue.o
-obj-$(CONFIG_MACH_NETSTAR)              += board-netstar.o
 obj-$(CONFIG_MACH_OMAP_PALMTE)          += board-palmte.o
+obj-$(CONFIG_MACH_NOKIA770)             += board-nokia770.o
+obj-$(CONFIG_MACH_AMS_DELTA)            += board-ams-delta.o
 
 ifeq ($(CONFIG_ARCH_OMAP15XX),y)
 # Innovator-1510 FPGA
diff --git a/arch/arm/mach-omap1/board-ams-delta.c b/arch/arm/mach-omap1/board-ams-delta.c
new file mode 100644
index 000000000000..6178f046f128
--- /dev/null
+++ b/arch/arm/mach-omap1/board-ams-delta.c
@@ -0,0 +1,116 @@
+/*
+ * linux/arch/arm/mach-omap1/board-ams-delta.c
+ *
+ * Modified from board-generic.c
+ *
+ * Board specific inits for the Amstrad E3 (codename Delta) videophone
+ *
+ * Copyright (C) 2006 Jonathan McDowell <noodles@earth.li>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+
+#include <linux/kernel.h>
+#include <linux/init.h>
+#include <linux/platform_device.h>
+
+#include <asm/hardware.h>
+#include <asm/mach-types.h>
+#include <asm/mach/arch.h>
+#include <asm/mach/map.h>
+
+#include <asm/arch/board-ams-delta.h>
+#include <asm/arch/gpio.h>
+#include <asm/arch/mux.h>
+#include <asm/arch/usb.h>
+#include <asm/arch/board.h>
+#include <asm/arch/common.h>
+
+static u8 ams_delta_latch1_reg;
+static u16 ams_delta_latch2_reg;
+
+void ams_delta_latch1_write(u8 mask, u8 value)
+{
+        ams_delta_latch1_reg &= ~mask;
+        ams_delta_latch1_reg |= value;
+        *(volatile __u8 *) AMS_DELTA_LATCH1_VIRT = ams_delta_latch1_reg;
+}
+
+void ams_delta_latch2_write(u16 mask, u16 value)
+{
+        ams_delta_latch2_reg &= ~mask;
+        ams_delta_latch2_reg |= value;
+        *(volatile __u16 *) AMS_DELTA_LATCH2_VIRT = ams_delta_latch2_reg;
+}
+
+static void __init ams_delta_init_irq(void)
+{
+        omap1_init_common_hw();
+        omap_init_irq();
+        omap_gpio_init();
+}
+
+static struct map_desc ams_delta_io_desc[] __initdata = {
+        // AMS_DELTA_LATCH1
+        {
+                .virtual        = AMS_DELTA_LATCH1_VIRT,
+                .pfn            = __phys_to_pfn(AMS_DELTA_LATCH1_PHYS),
+                .length         = 0x01000000,
+                .type           = MT_DEVICE
+        },
+        // AMS_DELTA_LATCH2
+        {
+                .virtual        = AMS_DELTA_LATCH2_VIRT,
+                .pfn            = __phys_to_pfn(AMS_DELTA_LATCH2_PHYS),
+                .length         = 0x01000000,
+                .type           = MT_DEVICE
+        },
+        // AMS_DELTA_MODEM
+        {
+                .virtual        = AMS_DELTA_MODEM_VIRT,
+                .pfn            = __phys_to_pfn(AMS_DELTA_MODEM_PHYS),
+                .length         = 0x01000000,
+                .type           = MT_DEVICE
+        }
+};
+
+static struct omap_uart_config ams_delta_uart_config __initdata = {
+        .enabled_uarts = 1,
+};
+
+static struct omap_board_config_kernel ams_delta_config[] = {
+        { OMAP_TAG_UART,        &ams_delta_uart_config },
+};
+
+static void __init ams_delta_init(void)
+{
+        iotable_init(ams_delta_io_desc, ARRAY_SIZE(ams_delta_io_desc));
+
+        omap_board_config = ams_delta_config;
+        omap_board_config_size = ARRAY_SIZE(ams_delta_config);
+        omap_serial_init();
+
+        /* Clear latch2 (NAND, LCD, modem enable) */
+        ams_delta_latch2_write(~0, 0);
+}
+
+static void __init ams_delta_map_io(void)
+{
+        omap1_map_common_io();
+}
+
+MACHINE_START(AMS_DELTA, "Amstrad E3 (Delta)")
+        /* Maintainer: Jonathan McDowell <noodles@earth.li> */
+        .phys_io        = 0xfff00000,
+        .io_pg_offst    = ((0xfef00000) >> 18) & 0xfffc,
+        .boot_params    = 0x10000100,
+        .map_io         = ams_delta_map_io,
+        .init_irq       = ams_delta_init_irq,
+        .init_machine   = ams_delta_init,
+        .timer          = &omap_timer,
+MACHINE_END
+
+EXPORT_SYMBOL(ams_delta_latch1_write);
+EXPORT_SYMBOL(ams_delta_latch2_write);
diff --git a/arch/arm/mach-omap1/board-generic.c b/arch/arm/mach-omap1/board-generic.c
index a177e78b2b87..33d01adab1ed 100644
--- a/arch/arm/mach-omap1/board-generic.c
+++ b/arch/arm/mach-omap1/board-generic.c
@@ -88,7 +88,7 @@ static struct omap_board_config_kernel generic_config[] = {
 static void __init omap_generic_init(void)
 {
 #ifdef CONFIG_ARCH_OMAP15XX
-        if (cpu_is_omap1510()) {
+        if (cpu_is_omap15xx()) {
                 generic_config[0].data = &generic1510_usb_config;
         }
 #endif
diff --git a/arch/arm/mach-omap1/board-h2.c b/arch/arm/mach-omap1/board-h2.c
index 89f0cc74a519..cd3a06dfc0a8 100644
--- a/arch/arm/mach-omap1/board-h2.c
+++ b/arch/arm/mach-omap1/board-h2.c
@@ -24,7 +24,9 @@
 #include <linux/platform_device.h>
 #include <linux/delay.h>
 #include <linux/mtd/mtd.h>
+#include <linux/mtd/nand.h>
 #include <linux/mtd/partitions.h>
+#include <linux/input.h>
 
 #include <asm/hardware.h>
 #include <asm/mach-types.h>
@@ -35,12 +37,55 @@
 #include <asm/arch/gpio.h>
 #include <asm/arch/mux.h>
 #include <asm/arch/tc.h>
+#include <asm/arch/irda.h>
 #include <asm/arch/usb.h>
+#include <asm/arch/keypad.h>
 #include <asm/arch/common.h>
+#include <asm/arch/mcbsp.h>
+#include <asm/arch/omap-alsa.h>
 
 extern int omap_gpio_init(void);
 
-static struct mtd_partition h2_partitions[] = {
+static int h2_keymap[] = {
+        KEY(0, 0, KEY_LEFT),
+        KEY(0, 1, KEY_RIGHT),
+        KEY(0, 2, KEY_3),
+        KEY(0, 3, KEY_F10),
+        KEY(0, 4, KEY_F5),
+        KEY(0, 5, KEY_9),
+        KEY(1, 0, KEY_DOWN),
+        KEY(1, 1, KEY_UP),
+        KEY(1, 2, KEY_2),
+        KEY(1, 3, KEY_F9),
+        KEY(1, 4, KEY_F7),
+        KEY(1, 5, KEY_0),
+        KEY(2, 0, KEY_ENTER),
+        KEY(2, 1, KEY_6),
+        KEY(2, 2, KEY_1),
+        KEY(2, 3, KEY_F2),
+        KEY(2, 4, KEY_F6),
+        KEY(2, 5, KEY_HOME),
+        KEY(3, 0, KEY_8),
+        KEY(3, 1, KEY_5),
+        KEY(3, 2, KEY_F12),
+        KEY(3, 3, KEY_F3),
+        KEY(3, 4, KEY_F8),
+        KEY(3, 5, KEY_END),
+        KEY(4, 0, KEY_7),
+        KEY(4, 1, KEY_4),
+        KEY(4, 2, KEY_F11),
+        KEY(4, 3, KEY_F1),
+        KEY(4, 4, KEY_F4),
+        KEY(4, 5, KEY_ESC),
+        KEY(5, 0, KEY_F13),
+        KEY(5, 1, KEY_F14),
+        KEY(5, 2, KEY_F15),
+        KEY(5, 3, KEY_F16),
+        KEY(5, 4, KEY_SLEEP),
+        0
+};
+
+static struct mtd_partition h2_nor_partitions[] = {
         /* bootloader (U-Boot, etc) in first sector */
         {
               .name             = "bootloader",
@@ -71,26 +116,26 @@ static struct mtd_partition h2_partitions[] = {
         }
 };
 
-static struct flash_platform_data h2_flash_data = {
+static struct flash_platform_data h2_nor_data = {
         .map_name       = "cfi_probe",
         .width          = 2,
-        .parts          = h2_partitions,
-        .nr_parts       = ARRAY_SIZE(h2_partitions),
+        .parts          = h2_nor_partitions,
+        .nr_parts       = ARRAY_SIZE(h2_nor_partitions),
 };
 
-static struct resource h2_flash_resource = {
+static struct resource h2_nor_resource = {
         /* This is on CS3, wherever it's mapped */
         .flags          = IORESOURCE_MEM,
 };
 
-static struct platform_device h2_flash_device = {
+static struct platform_device h2_nor_device = {
         .name           = "omapflash",
         .id             = 0,
         .dev            = {
-                .platform_data  = &h2_flash_data,
+                .platform_data  = &h2_nor_data,
         },
         .num_resources  = 1,
-        .resource       = &h2_flash_resource,
+        .resource       = &h2_nor_resource,
 };
 
 static struct resource h2_smc91x_resources[] = {
@@ -113,9 +158,119 @@ static struct platform_device h2_smc91x_device = {
         .resource       = h2_smc91x_resources,
 };
 
+static struct resource h2_kp_resources[] = {
+        [0] = {
+                .start  = INT_KEYBOARD,
+                .end    = INT_KEYBOARD,
+                .flags  = IORESOURCE_IRQ,
+        },
+};
+
+static struct omap_kp_platform_data h2_kp_data = {
+        .rows   = 8,
+        .cols   = 8,
+        .keymap = h2_keymap,
+        .rep    = 1,
+};
+
+static struct platform_device h2_kp_device = {
+        .name           = "omap-keypad",
+        .id             = -1,
+        .dev            = {
+                .platform_data = &h2_kp_data,
+        },
+        .num_resources  = ARRAY_SIZE(h2_kp_resources),
+        .resource       = h2_kp_resources,
+};
+
+#define H2_IRDA_FIRSEL_GPIO_PIN 17
+
+#if defined(CONFIG_OMAP_IR) || defined(CONFIG_OMAP_IR_MODULE)
+static int h2_transceiver_mode(struct device *dev, int state)
+{
+        if (state & IR_SIRMODE)
+                omap_set_gpio_dataout(H2_IRDA_FIRSEL_GPIO_PIN, 0);
+        else    /* MIR/FIR */
+                omap_set_gpio_dataout(H2_IRDA_FIRSEL_GPIO_PIN, 1);
+
+        return 0;
+}
+#endif
+
+static struct omap_irda_config h2_irda_data = {
+        .transceiver_cap        = IR_SIRMODE | IR_MIRMODE | IR_FIRMODE,
+        .rx_channel             = OMAP_DMA_UART3_RX,
+        .tx_channel             = OMAP_DMA_UART3_TX,
+        .dest_start             = UART3_THR,
+        .src_start              = UART3_RHR,
+        .tx_trigger             = 0,
+        .rx_trigger             = 0,
+};
+
+static struct resource h2_irda_resources[] = {
+        [0] = {
+                .start  = INT_UART3,
+                .end    = INT_UART3,
+                .flags  = IORESOURCE_IRQ,
+        },
+};
+static struct platform_device h2_irda_device = {
+        .name           = "omapirda",
+        .id             = 0,
+        .dev            = {
+                .platform_data  = &h2_irda_data,
+        },
+        .num_resources  = ARRAY_SIZE(h2_irda_resources),
+        .resource       = h2_irda_resources,
+};
+
+static struct platform_device h2_lcd_device = {
+        .name           = "lcd_h2",
+        .id             = -1,
+};
+
+static struct omap_mcbsp_reg_cfg mcbsp_regs = {
+        .spcr2 = FREE | FRST | GRST | XRST | XINTM(3),
+        .spcr1 = RINTM(3) | RRST,
+        .rcr2  = RPHASE | RFRLEN2(OMAP_MCBSP_WORD_8) |
+                RWDLEN2(OMAP_MCBSP_WORD_16) | RDATDLY(1),
+        .rcr1  = RFRLEN1(OMAP_MCBSP_WORD_8) | RWDLEN1(OMAP_MCBSP_WORD_16),
+        .xcr2  = XPHASE | XFRLEN2(OMAP_MCBSP_WORD_8) |
+                XWDLEN2(OMAP_MCBSP_WORD_16) | XDATDLY(1) | XFIG,
+        .xcr1  = XFRLEN1(OMAP_MCBSP_WORD_8) | XWDLEN1(OMAP_MCBSP_WORD_16),
+        .srgr1 = FWID(15),
+        .srgr2 = GSYNC | CLKSP | FSGM | FPER(31),
+
+        .pcr0  = CLKXM | CLKRM | FSXP | FSRP | CLKXP | CLKRP,
+        //.pcr0 = CLKXP | CLKRP,        /* mcbsp: slave */
+};
+
+static struct omap_alsa_codec_config alsa_config = {
+        .name                   = "H2 TSC2101",
+        .mcbsp_regs_alsa        = &mcbsp_regs,
+        .codec_configure_dev    = NULL, // tsc2101_configure,
+        .codec_set_samplerate   = NULL, // tsc2101_set_samplerate,
+        .codec_clock_setup      = NULL, // tsc2101_clock_setup,
+        .codec_clock_on         = NULL, // tsc2101_clock_on,
+        .codec_clock_off        = NULL, // tsc2101_clock_off,
+        .get_default_samplerate = NULL, // tsc2101_get_default_samplerate,
+};
+
+static struct platform_device h2_mcbsp1_device = {
+        .name   = "omap_alsa_mcbsp",
+        .id     = 1,
+        .dev = {
+                .platform_data  = &alsa_config,
+        },
+};
+
 static struct platform_device *h2_devices[] __initdata = {
-        &h2_flash_device,
+        &h2_nor_device,
         &h2_smc91x_device,
+        &h2_irda_device,
+        &h2_kp_device,
+        &h2_lcd_device,
+        &h2_mcbsp1_device,
 };
 
 static void __init h2_init_smc91x(void)
@@ -164,7 +319,6 @@ static struct omap_uart_config h2_uart_config __initdata = {
 };
 
 static struct omap_lcd_config h2_lcd_config __initdata = {
-        .panel_name     = "h2",
         .ctrl_name      = "internal",
 };
 
@@ -177,16 +331,34 @@ static struct omap_board_config_kernel h2_config[] = {
 
 static void __init h2_init(void)
 {
-        /* NOTE: revC boards support NAND-boot, which can put NOR on CS2B
-         * and NAND (either 16bit or 8bit) on CS3.
+        /* Here we assume the NOR boot config:  NOR on CS3 (possibly swapped
+         * to address 0 by a dip switch), NAND on CS2B.  The NAND driver will
+         * notice whether a NAND chip is enabled at probe time.
+         *
+         * FIXME revC boards (and H3) support NAND-boot, with a dip switch to
+         * put NOR on CS2B and NAND (which on H2 may be 16bit) on CS3.  Try
+         * detecting that in code here, to avoid probing every possible flash
+         * configuration...
          */
-        h2_flash_resource.end = h2_flash_resource.start = omap_cs3_phys();
-        h2_flash_resource.end += SZ_32M - 1;
+        h2_nor_resource.end = h2_nor_resource.start = omap_cs3_phys();
+        h2_nor_resource.end += SZ_32M - 1;
+
+        omap_cfg_reg(L3_1610_FLASH_CS2B_OE);
+        omap_cfg_reg(M8_1610_FLASH_CS2B_WE);
 
         /* MMC:  card detect and WP */
         // omap_cfg_reg(U19_ARMIO1);            /* CD */
         omap_cfg_reg(BALLOUT_V8_ARMIO3);        /* WP */
 
+        /* Irda */
+#if defined(CONFIG_OMAP_IR) || defined(CONFIG_OMAP_IR_MODULE)
+        omap_writel(omap_readl(FUNC_MUX_CTRL_A) | 7, FUNC_MUX_CTRL_A);
+        if (!(omap_request_gpio(H2_IRDA_FIRSEL_GPIO_PIN))) {
+                omap_set_gpio_direction(H2_IRDA_FIRSEL_GPIO_PIN, 0);
+                h2_irda_data.transceiver_mode = h2_transceiver_mode;
+        }
+#endif
+
         platform_add_devices(h2_devices, ARRAY_SIZE(h2_devices));
         omap_board_config = h2_config;
         omap_board_config_size = ARRAY_SIZE(h2_config);
diff --git a/arch/arm/mach-omap1/board-h3.c b/arch/arm/mach-omap1/board-h3.c
index d9f386265996..4b8d0ec73cb7 100644
--- a/arch/arm/mach-omap1/board-h3.c
+++ b/arch/arm/mach-omap1/board-h3.c
@@ -21,8 +21,11 @@
 #include <linux/kernel.h>
 #include <linux/platform_device.h>
 #include <linux/errno.h>
+#include <linux/workqueue.h>
 #include <linux/mtd/mtd.h>
+#include <linux/mtd/nand.h>
 #include <linux/mtd/partitions.h>
+#include <linux/input.h>
 
 #include <asm/setup.h>
 #include <asm/page.h>
@@ -33,15 +36,59 @@
 #include <asm/mach/map.h>
 
 #include <asm/arch/gpio.h>
+#include <asm/arch/gpioexpander.h>
 #include <asm/arch/irqs.h>
 #include <asm/arch/mux.h>
 #include <asm/arch/tc.h>
+#include <asm/arch/irda.h>
 #include <asm/arch/usb.h>
+#include <asm/arch/keypad.h>
+#include <asm/arch/dma.h>
 #include <asm/arch/common.h>
 
 extern int omap_gpio_init(void);
 
-static struct mtd_partition h3_partitions[] = {
+static int h3_keymap[] = {
+        KEY(0, 0, KEY_LEFT),
+        KEY(0, 1, KEY_RIGHT),
+        KEY(0, 2, KEY_3),
+        KEY(0, 3, KEY_F10),
+        KEY(0, 4, KEY_F5),
+        KEY(0, 5, KEY_9),
+        KEY(1, 0, KEY_DOWN),
+        KEY(1, 1, KEY_UP),
+        KEY(1, 2, KEY_2),
+        KEY(1, 3, KEY_F9),
+        KEY(1, 4, KEY_F7),
+        KEY(1, 5, KEY_0),
+        KEY(2, 0, KEY_ENTER),
+        KEY(2, 1, KEY_6),
+        KEY(2, 2, KEY_1),
+        KEY(2, 3, KEY_F2),
+        KEY(2, 4, KEY_F6),
+        KEY(2, 5, KEY_HOME),
+        KEY(3, 0, KEY_8),
+        KEY(3, 1, KEY_5),
+        KEY(3, 2, KEY_F12),
+        KEY(3, 3, KEY_F3),
+        KEY(3, 4, KEY_F8),
+        KEY(3, 5, KEY_END),
+        KEY(4, 0, KEY_7),
+        KEY(4, 1, KEY_4),
+        KEY(4, 2, KEY_F11),
+        KEY(4, 3, KEY_F1),
+        KEY(4, 4, KEY_F4),
+        KEY(4, 5, KEY_ESC),
+        KEY(5, 0, KEY_F13),
+        KEY(5, 1, KEY_F14),
+        KEY(5, 2, KEY_F15),
+        KEY(5, 3, KEY_F16),
+        KEY(5, 4, KEY_SLEEP),
+        0
+};
+
+
+static struct mtd_partition nor_partitions[] = {
         /* bootloader (U-Boot, etc) in first sector */
         {
               .name             = "bootloader",
@@ -72,26 +119,80 @@ static struct mtd_partition h3_partitions[] = {
         }
 };
 
-static struct flash_platform_data h3_flash_data = {
+static struct flash_platform_data nor_data = {
         .map_name       = "cfi_probe",
         .width          = 2,
-        .parts          = h3_partitions,
-        .nr_parts       = ARRAY_SIZE(h3_partitions),
+        .parts          = nor_partitions,
+        .nr_parts       = ARRAY_SIZE(nor_partitions),
 };
 
-static struct resource h3_flash_resource = {
+static struct resource nor_resource = {
         /* This is on CS3, wherever it's mapped */
         .flags          = IORESOURCE_MEM,
 };
 
-static struct platform_device flash_device = {
+static struct platform_device nor_device = {
         .name           = "omapflash",
         .id             = 0,
         .dev            = {
-                .platform_data  = &h3_flash_data,
+                .platform_data  = &nor_data,
+        },
+        .num_resources  = 1,
+        .resource       = &nor_resource,
+};
+
+static struct mtd_partition nand_partitions[] = {
+#if 0
+        /* REVISIT: enable these partitions if you make NAND BOOT work */
+        {
+                .name           = "xloader",
+                .offset         = 0,
+                .size           = 64 * 1024,
+                .mask_flags     = MTD_WRITEABLE,        /* force read-only */
+        },
+        {
+                .name           = "bootloader",
+                .offset         = MTDPART_OFS_APPEND,
+                .size           = 256 * 1024,
+                .mask_flags     = MTD_WRITEABLE,        /* force read-only */
+        },
+        {
+                .name           = "params",
+                .offset         = MTDPART_OFS_APPEND,
+                .size           = 192 * 1024,
+        },
+        {
+                .name           = "kernel",
+                .offset         = MTDPART_OFS_APPEND,
+                .size           = 2 * SZ_1M,
+        },
+#endif
+        {
+                .name           = "filesystem",
+                .size           = MTDPART_SIZ_FULL,
+                .offset         = MTDPART_OFS_APPEND,
+        },
+};
+
+/* dip switches control NAND chip access:  8 bit, 16 bit, or neither */
+static struct nand_platform_data nand_data = {
+        .options        = NAND_SAMSUNG_LP_OPTIONS,
+        .parts          = nand_partitions,
+        .nr_parts       = ARRAY_SIZE(nand_partitions),
+};
+
+static struct resource nand_resource = {
+        .flags          = IORESOURCE_MEM,
+};
+
+static struct platform_device nand_device = {
+        .name           = "omapnand",
+        .id             = 0,
+        .dev            = {
+                .platform_data  = &nand_data,
         },
         .num_resources  = 1,
-        .resource       = &h3_flash_resource,
+        .resource       = &nand_resource,
 };
 
 static struct resource smc91x_resources[] = {
@@ -138,10 +239,136 @@ static struct platform_device intlat_device = {
         .resource       = intlat_resources,
 };
 
+static struct resource h3_kp_resources[] = {
+        [0] = {
+                .start  = INT_KEYBOARD,
+                .end    = INT_KEYBOARD,
+                .flags  = IORESOURCE_IRQ,
+        },
+};
+
+static struct omap_kp_platform_data h3_kp_data = {
+        .rows   = 8,
+        .cols   = 8,
+        .keymap = h3_keymap,
+        .rep    = 1,
+};
+
+static struct platform_device h3_kp_device = {
+        .name           = "omap-keypad",
+        .id             = -1,
+        .dev            = {
+                .platform_data = &h3_kp_data,
+        },
+        .num_resources  = ARRAY_SIZE(h3_kp_resources),
+        .resource       = h3_kp_resources,
+};
+
+
+/* Select between the IrDA and aGPS module
+ */
+static int h3_select_irda(struct device *dev, int state)
+{
+        unsigned char expa;
+        int err = 0;
+
+        if ((err = read_gpio_expa(&expa, 0x26))) {
+                printk(KERN_ERR "Error reading from I/O EXPANDER \n");
+                return err;
+        }
+
+        /* 'P6' enable/disable IRDA_TX and IRDA_RX */
+        if (state & IR_SEL) { /* IrDA */
+                if ((err = write_gpio_expa(expa | 0x40, 0x26))) {
+                        printk(KERN_ERR "Error writing to I/O EXPANDER \n");
+                        return err;
+                }
+        } else {
+                if ((err = write_gpio_expa(expa & ~0x40, 0x26))) {
+                        printk(KERN_ERR "Error writing to I/O EXPANDER \n");
+                        return err;
+                }
+        }
+        return err;
+}
+
+static void set_trans_mode(void *data)
+{
+        int *mode = data;
+        unsigned char expa;
+        int err = 0;
+
+        if ((err = read_gpio_expa(&expa, 0x27)) != 0) {
+                printk(KERN_ERR "Error reading from I/O expander\n");
+        }
+
+        expa &= ~0x03;
+
+        if (*mode & IR_SIRMODE) {
+                expa |= 0x01;
+        } else { /* MIR/FIR */
+                expa |= 0x03;
+        }
+
+        if ((err = write_gpio_expa(expa, 0x27)) != 0) {
+                printk(KERN_ERR "Error writing to I/O expander\n");
+        }
+}
+
+static int h3_transceiver_mode(struct device *dev, int mode)
+{
+        struct omap_irda_config *irda_config = dev->platform_data;
+
+        cancel_delayed_work(&irda_config->gpio_expa);
+        PREPARE_WORK(&irda_config->gpio_expa, set_trans_mode, &mode);
+        schedule_work(&irda_config->gpio_expa);
+
+        return 0;
+}
+
+static struct omap_irda_config h3_irda_data = {
+        .transceiver_cap        = IR_SIRMODE | IR_MIRMODE | IR_FIRMODE,
+        .transceiver_mode       = h3_transceiver_mode,
+        .select_irda            = h3_select_irda,
+        .rx_channel             = OMAP_DMA_UART3_RX,
+        .tx_channel             = OMAP_DMA_UART3_TX,
+        .dest_start             = UART3_THR,
+        .src_start              = UART3_RHR,
+        .tx_trigger             = 0,
+        .rx_trigger             = 0,
+};
+
+static struct resource h3_irda_resources[] = {
+        [0] = {
+                .start  = INT_UART3,
+                .end    = INT_UART3,
+                .flags  = IORESOURCE_IRQ,
+        },
+};
+
+static struct platform_device h3_irda_device = {
+        .name           = "omapirda",
+        .id             = 0,
+        .dev            = {
+                .platform_data  = &h3_irda_data,
+        },
+        .num_resources  = ARRAY_SIZE(h3_irda_resources),
+        .resource       = h3_irda_resources,
+};
+
+static struct platform_device h3_lcd_device = {
+        .name           = "lcd_h3",
+        .id             = -1,
+};
+
 static struct platform_device *devices[] __initdata = {
-        &flash_device,
+        &nor_device,
+        &nand_device,
         &smc91x_device,
         &intlat_device,
+        &h3_irda_device,
+        &h3_kp_device,
+        &h3_lcd_device,
 };
 
 static struct omap_usb_config h3_usb_config __initdata = {
@@ -171,7 +398,6 @@ static struct omap_uart_config h3_uart_config __initdata = {
 };
 
 static struct omap_lcd_config h3_lcd_config __initdata = {
-        .panel_name     = "h3",
         .ctrl_name      = "internal",
 };
 
@@ -182,11 +408,36 @@ static struct omap_board_config_kernel h3_config[] = {
         { OMAP_TAG_LCD,         &h3_lcd_config },
 };
 
+#define H3_NAND_RB_GPIO_PIN     10
+
+static int nand_dev_ready(struct nand_platform_data *data)
+{
+        return omap_get_gpio_datain(H3_NAND_RB_GPIO_PIN);
+}
+
 static void __init h3_init(void)
 {
-        h3_flash_resource.end = h3_flash_resource.start = omap_cs3_phys();
-        h3_flash_resource.end += OMAP_CS3_SIZE - 1;
-        (void) platform_add_devices(devices, ARRAY_SIZE(devices));
+        /* Here we assume the NOR boot config:  NOR on CS3 (possibly swapped
+         * to address 0 by a dip switch), NAND on CS2B.  The NAND driver will
+         * notice whether a NAND chip is enabled at probe time.
+         *
+         * H3 support NAND-boot, with a dip switch to put NOR on CS2B and NAND
+         * (which on H2 may be 16bit) on CS3.  Try detecting that in code here,
+         * to avoid probing every possible flash configuration...
+         */
+        nor_resource.end = nor_resource.start = omap_cs3_phys();
+        nor_resource.end += SZ_32M - 1;
+
+        nand_resource.end = nand_resource.start = OMAP_CS2B_PHYS;
+        nand_resource.end += SZ_4K - 1;
+        if (!(omap_request_gpio(H3_NAND_RB_GPIO_PIN)))
+                nand_data.dev_ready = nand_dev_ready;
+
+        /* GPIO10 Func_MUX_CTRL reg bit 29:27, Configure V2 to mode1 as GPIO */
+        /* GPIO10 pullup/down register, Enable pullup on GPIO10 */
+        omap_cfg_reg(V2_1710_GPIO10);
+
+        platform_add_devices(devices, ARRAY_SIZE(devices));
         omap_board_config = h3_config;
         omap_board_config_size = ARRAY_SIZE(h3_config);
         omap_serial_init();
diff --git a/arch/arm/mach-omap1/board-innovator.c b/arch/arm/mach-omap1/board-innovator.c
index a04e4332915e..e90c137a4cf3 100644
--- a/arch/arm/mach-omap1/board-innovator.c
+++ b/arch/arm/mach-omap1/board-innovator.c
@@ -22,6 +22,7 @@
 #include <linux/delay.h>
 #include <linux/mtd/mtd.h>
 #include <linux/mtd/partitions.h>
+#include <linux/input.h>
 
 #include <asm/hardware.h>
 #include <asm/mach-types.h>
@@ -34,8 +35,22 @@
 #include <asm/arch/gpio.h>
 #include <asm/arch/tc.h>
 #include <asm/arch/usb.h>
+#include <asm/arch/keypad.h>
 #include <asm/arch/common.h>
 
+static int innovator_keymap[] = {
+        KEY(0, 0, KEY_F1),
+        KEY(0, 3, KEY_DOWN),
+        KEY(1, 1, KEY_F2),
+        KEY(1, 2, KEY_RIGHT),
+        KEY(2, 0, KEY_F3),
+        KEY(2, 1, KEY_F4),
+        KEY(2, 2, KEY_UP),
+        KEY(3, 2, KEY_ENTER),
+        KEY(3, 3, KEY_LEFT),
+        0
+};
+
 static struct mtd_partition innovator_partitions[] = {
         /* bootloader (U-Boot, etc) in first sector */
         {
@@ -97,6 +112,31 @@ static struct platform_device innovator_flash_device = {
         .resource       = &innovator_flash_resource,
 };
 
+static struct resource innovator_kp_resources[] = {
+        [0] = {
+                .start  = INT_KEYBOARD,
+                .end    = INT_KEYBOARD,
+                .flags  = IORESOURCE_IRQ,
+        },
+};
+
+static struct omap_kp_platform_data innovator_kp_data = {
+        .rows   = 8,
+        .cols   = 8,
+        .keymap = innovator_keymap,
+};
+
+static struct platform_device innovator_kp_device = {
+        .name           = "omap-keypad",
+        .id             = -1,
+        .dev            = {
+                .platform_data = &innovator_kp_data,
+        },
+        .num_resources  = ARRAY_SIZE(innovator_kp_resources),
+        .resource       = innovator_kp_resources,
+};
+
+
 #ifdef CONFIG_ARCH_OMAP15XX
 
 /* Only FPGA needs to be mapped here. All others are done with ioremap */
@@ -129,9 +169,16 @@ static struct platform_device innovator1510_smc91x_device = {
         .resource       = innovator1510_smc91x_resources,
 };
 
+static struct platform_device innovator1510_lcd_device = {
+        .name           = "lcd_inn1510",
+        .id             = -1,
+};
+
 static struct platform_device *innovator1510_devices[] __initdata = {
         &innovator_flash_device,
         &innovator1510_smc91x_device,
+        &innovator_kp_device,
+        &innovator1510_lcd_device,
 };
 
 #endif /* CONFIG_ARCH_OMAP15XX */
@@ -158,9 +205,16 @@ static struct platform_device innovator1610_smc91x_device = {
         .resource       = innovator1610_smc91x_resources,
 };
 
+static struct platform_device innovator1610_lcd_device = {
+        .name           = "inn1610_lcd",
+        .id             = -1,
+};
+
 static struct platform_device *innovator1610_devices[] __initdata = {
         &innovator_flash_device,
         &innovator1610_smc91x_device,
+        &innovator_kp_device,
+        &innovator1610_lcd_device,
 };
 
 #endif /* CONFIG_ARCH_OMAP16XX */
@@ -206,7 +260,6 @@ static struct omap_usb_config innovator1510_usb_config __initdata = {
 };
 
 static struct omap_lcd_config innovator1510_lcd_config __initdata = {
-        .panel_name     = "inn1510",
         .ctrl_name      = "internal",
 };
 #endif
@@ -228,7 +281,6 @@ static struct omap_usb_config h2_usb_config __initdata = {
 };
 
 static struct omap_lcd_config innovator1610_lcd_config __initdata = {
-        .panel_name     = "inn1610",
         .ctrl_name      = "internal",
 };
 #endif
diff --git a/arch/arm/mach-omap1/board-netstar.c b/arch/arm/mach-omap1/board-netstar.c
deleted file mode 100644
index 7520e602d7a2..000000000000
--- a/arch/arm/mach-omap1/board-netstar.c
+++ /dev/null
@@ -1,160 +0,0 @@
-/*
- * Modified from board-generic.c
- *
- * Copyright (C) 2004 2N Telekomunikace, Ladislav Michl <michl@2n.cz>
- *
- * Code for Netstar OMAP board.
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 2 as
- * published by the Free Software Foundation.
- */
-
-#include <linux/delay.h>
-#include <linux/platform_device.h>
-#include <linux/interrupt.h>
-#include <linux/init.h>
-#include <linux/kernel.h>
-#include <linux/notifier.h>
-#include <linux/reboot.h>
-
-#include <asm/hardware.h>
-#include <asm/mach-types.h>
-#include <asm/mach/arch.h>
-#include <asm/mach/map.h>
-
-#include <asm/arch/gpio.h>
-#include <asm/arch/mux.h>
-#include <asm/arch/usb.h>
-#include <asm/arch/common.h>
-
-extern void __init omap_init_time(void);
-extern int omap_gpio_init(void);
-
-static struct resource netstar_smc91x_resources[] = {
-        [0] = {
-                .start  = OMAP_CS1_PHYS + 0x300,
-                .end    = OMAP_CS1_PHYS + 0x300 + 16,
-                .flags  = IORESOURCE_MEM,
-        },
-        [1] = {
-                .start  = OMAP_GPIO_IRQ(8),
-                .end    = OMAP_GPIO_IRQ(8),
-                .flags  = IORESOURCE_IRQ,
-        },
-};
-
-static struct platform_device netstar_smc91x_device = {
-        .name           = "smc91x",
-        .id             = 0,
-        .num_resources  = ARRAY_SIZE(netstar_smc91x_resources),
-        .resource       = netstar_smc91x_resources,
-};
-
-static struct platform_device *netstar_devices[] __initdata = {
-        &netstar_smc91x_device,
-};
-
-static struct omap_uart_config netstar_uart_config __initdata = {
-        .enabled_uarts = ((1 << 0) | (1 << 1) | (1 << 2)),
-};
-
-static struct omap_board_config_kernel netstar_config[] = {
-        { OMAP_TAG_UART,        &netstar_uart_config },
-};
-
-static void __init netstar_init_irq(void)
-{
-        omap1_init_common_hw();
-        omap_init_irq();
-        omap_gpio_init();
-}
-
-static void __init netstar_init(void)
-{
-        /* green LED */
-        omap_request_gpio(4);
-        omap_set_gpio_direction(4, 0);
-        /* smc91x reset */
-        omap_request_gpio(7);
-        omap_set_gpio_direction(7, 0);
-        omap_set_gpio_dataout(7, 1);
-        udelay(2);      /* wait at least 100ns */
-        omap_set_gpio_dataout(7, 0);
-        mdelay(50);     /* 50ms until PHY ready */
-        /* smc91x interrupt pin */
-        omap_request_gpio(8);
-
-        omap_request_gpio(12);
-        omap_request_gpio(13);
-        omap_request_gpio(14);
-        omap_request_gpio(15);
-        set_irq_type(OMAP_GPIO_IRQ(12), IRQT_FALLING);
-        set_irq_type(OMAP_GPIO_IRQ(13), IRQT_FALLING);
-        set_irq_type(OMAP_GPIO_IRQ(14), IRQT_FALLING);
-        set_irq_type(OMAP_GPIO_IRQ(15), IRQT_FALLING);
-
-        platform_add_devices(netstar_devices, ARRAY_SIZE(netstar_devices));
-
-        /* Switch on green LED */
-        omap_set_gpio_dataout(4, 0);
-        /* Switch off red LED */
-        omap_writeb(0x00, OMAP_LPG1_PMR);       /* Disable clock */
-        omap_writeb(0x80, OMAP_LPG1_LCR);
-
-        omap_board_config = netstar_config;
-        omap_board_config_size = ARRAY_SIZE(netstar_config);
-        omap_serial_init();
-}
-
-static void __init netstar_map_io(void)
-{
-        omap1_map_common_io();
-}
-
-#define MACHINE_PANICED         1
-#define MACHINE_REBOOTING       2
-#define MACHINE_REBOOT          4
-static unsigned long machine_state;
-
-static int panic_event(struct notifier_block *this, unsigned long event,
-         void *ptr)
-{
-        if (test_and_set_bit(MACHINE_PANICED, &machine_state))
-                return NOTIFY_DONE;
-
-        /* Switch off green LED */
-        omap_set_gpio_dataout(4, 1);
-        /* Flash red LED */
-        omap_writeb(0x78, OMAP_LPG1_LCR);
-        omap_writeb(0x01, OMAP_LPG1_PMR);       /* Enable clock */
-
-        return NOTIFY_DONE;
-}
-
-static struct notifier_block panic_block = {
-        .notifier_call  = panic_event,
-};
-
-static int __init netstar_late_init(void)
-{
-        /* TODO: Setup front panel switch here */
-
-        /* Setup panic notifier */
-        atomic_notifier_chain_register(&panic_notifier_list, &panic_block);
-
-        return 0;
-}
-
-postcore_initcall(netstar_late_init);
-
-MACHINE_START(NETSTAR, "NetStar OMAP5910")
-        /* Maintainer: Ladislav Michl <michl@2n.cz> */
-        .phys_io        = 0xfff00000,
-        .io_pg_offst    = ((0xfef00000) >> 18) & 0xfffc,
-        .boot_params    = 0x10000100,
-        .map_io         = netstar_map_io,
-        .init_irq       = netstar_init_irq,
-        .init_machine   = netstar_init,
-        .timer          = &omap_timer,
-MACHINE_END
diff --git a/arch/arm/mach-omap1/board-nokia770.c b/arch/arm/mach-omap1/board-nokia770.c
new file mode 100644
index 000000000000..02b980d77b12
--- /dev/null
+++ b/arch/arm/mach-omap1/board-nokia770.c
@@ -0,0 +1,268 @@
+/*
+ * linux/arch/arm/mach-omap1/board-nokia770.c
+ *
+ * Modified from board-generic.c
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+
+#include <linux/kernel.h>
+#include <linux/init.h>
+#include <linux/platform_device.h>
+#include <linux/input.h>
+#include <linux/clk.h>
+
+#include <linux/spi/spi.h>
+#include <linux/spi/ads7846.h>
+
+#include <asm/hardware.h>
+#include <asm/mach-types.h>
+#include <asm/mach/arch.h>
+#include <asm/mach/map.h>
+
+#include <asm/arch/gpio.h>
+#include <asm/arch/mux.h>
+#include <asm/arch/usb.h>
+#include <asm/arch/board.h>
+#include <asm/arch/keypad.h>
+#include <asm/arch/common.h>
+#include <asm/arch/dsp_common.h>
+#include <asm/arch/aic23.h>
+#include <asm/arch/gpio.h>
+
+static void __init omap_nokia770_init_irq(void)
+{
+        /* On Nokia 770, the SleepX signal is masked with an
+         * MPUIO line by default.  It has to be unmasked for it
+         * to become functional */
+
+        /* SleepX mask direction */
+        omap_writew((omap_readw(0xfffb5008) & ~2), 0xfffb5008);
+        /* Unmask SleepX signal */
+        omap_writew((omap_readw(0xfffb5004) & ~2), 0xfffb5004);
+
+        omap1_init_common_hw();
+        omap_init_irq();
+}
+
+static int nokia770_keymap[] = {
+        KEY(0, 1, GROUP_0 | KEY_UP),
+        KEY(0, 2, GROUP_1 | KEY_F5),
+        KEY(1, 0, GROUP_0 | KEY_LEFT),
+        KEY(1, 1, GROUP_0 | KEY_ENTER),
+        KEY(1, 2, GROUP_0 | KEY_RIGHT),
+        KEY(2, 0, GROUP_1 | KEY_ESC),
+        KEY(2, 1, GROUP_0 | KEY_DOWN),
+        KEY(2, 2, GROUP_1 | KEY_F4),
+        KEY(3, 0, GROUP_2 | KEY_F7),
+        KEY(3, 1, GROUP_2 | KEY_F8),
+        KEY(3, 2, GROUP_2 | KEY_F6),
+        0
+};
+
+static struct resource nokia770_kp_resources[] = {
+        [0] = {
+                .start  = INT_KEYBOARD,
+                .end    = INT_KEYBOARD,
+                .flags  = IORESOURCE_IRQ,
+        },
+};
+
+static struct omap_kp_platform_data nokia770_kp_data = {
+        .rows   = 8,
+        .cols   = 8,
+        .keymap = nokia770_keymap
+};
+
+static struct platform_device nokia770_kp_device = {
+        .name           = "omap-keypad",
+        .id             = -1,
+        .dev            = {
+                .platform_data = &nokia770_kp_data,
+        },
+        .num_resources  = ARRAY_SIZE(nokia770_kp_resources),
+        .resource       = nokia770_kp_resources,
+};
+
+static struct platform_device *nokia770_devices[] __initdata = {
+        &nokia770_kp_device,
+};
+
+static struct ads7846_platform_data nokia770_ads7846_platform_data __initdata = {
+        .x_max          = 0x0fff,
+        .y_max          = 0x0fff,
+        .x_plate_ohms   = 180,
+        .pressure_max   = 255,
+        .debounce_max   = 10,
+        .debounce_tol   = 3,
+};
+
+static struct spi_board_info nokia770_spi_board_info[] __initdata = {
+        [0] = {
+                .modalias       = "lcd_lph8923",
+                .bus_num        = 2,
+                .chip_select    = 3,
+                .max_speed_hz   = 12000000,
+        },
+        [1] = {
+                .modalias       = "ads7846",
+                .bus_num        = 2,
+                .chip_select    = 0,
+                .max_speed_hz   = 2500000,
+                .irq            = OMAP_GPIO_IRQ(15),
+                .platform_data  = &nokia770_ads7846_platform_data,
+        },
+};
+
+
+/* assume no Mini-AB port */
+
+static struct omap_usb_config nokia770_usb_config __initdata = {
+        .otg            = 1,
+        .register_host  = 1,
+        .register_dev   = 1,
+        .hmc_mode       = 16,
+        .pins[0]        = 6,
+};
+
+static struct omap_mmc_config nokia770_mmc_config __initdata = {
+        .mmc[0] = {
+                .enabled        = 0,
+                .wire4          = 0,
+                .wp_pin         = -1,
+                .power_pin      = -1,
+                .switch_pin     = -1,
+        },
+        .mmc[1] = {
+                .enabled        = 0,
+                .wire4          = 0,
+                .wp_pin         = -1,
+                .power_pin      = -1,
+                .switch_pin     = -1,
+        },
+};
+
+static struct omap_board_config_kernel nokia770_config[] = {
+        { OMAP_TAG_USB,         NULL },
+        { OMAP_TAG_MMC,         &nokia770_mmc_config },
+};
+
+/*
+ * audio power control
+ */
+#define HEADPHONE_GPIO          14
+#define AMPLIFIER_CTRL_GPIO     58
+
+static struct clk *dspxor_ck;
+static DECLARE_MUTEX(audio_pwr_sem);
+/*
+ * audio_pwr_state
+ * +--+-------------------------+---------------------------------------+
+ * |-1|down                     |power-up request -> 0                  |
+ * +--+-------------------------+---------------------------------------+
+ * | 0|up                       |power-down(1) request -> 1             |
+ * |  |                         |power-down(2) request -> (ignore)      |
+ * +--+-------------------------+---------------------------------------+
+ * | 1|up,                      |power-up request -> 0                  |
+ * |  |received down(1) request |power-down(2) request -> -1            |
+ * +--+-------------------------+---------------------------------------+
+ */
+static int audio_pwr_state = -1;
+
+/*
+ * audio_pwr_up / down should be called under audio_pwr_sem
+ */
+static void nokia770_audio_pwr_up(void)
+{
+        clk_enable(dspxor_ck);
+
+        /* Turn on codec */
+        tlv320aic23_power_up();
+
+        if (omap_get_gpio_datain(HEADPHONE_GPIO))
+                /* HP not connected, turn on amplifier */
+                omap_set_gpio_dataout(AMPLIFIER_CTRL_GPIO, 1);
+        else
+                /* HP connected, do not turn on amplifier */
+                printk("HP connected\n");
+}
+
+static void codec_delayed_power_down(void *arg)
+{
+        down(&audio_pwr_sem);
+        if (audio_pwr_state == -1)
+                tlv320aic23_power_down();
+        clk_disable(dspxor_ck);
+        up(&audio_pwr_sem);
+}
+
+static DECLARE_WORK(codec_power_down_work, codec_delayed_power_down, NULL);
+
+static void nokia770_audio_pwr_down(void)
+{
+        /* Turn off amplifier */
+        omap_set_gpio_dataout(AMPLIFIER_CTRL_GPIO, 0);
+
+        /* Turn off codec: schedule delayed work */
+        schedule_delayed_work(&codec_power_down_work, HZ / 20); /* 50ms */
+}
+
+void nokia770_audio_pwr_up_request(int stage)
+{
+        down(&audio_pwr_sem);
+        if (audio_pwr_state == -1)
+                nokia770_audio_pwr_up();
+        /* force audio_pwr_state = 0, even if it was 1. */
+        audio_pwr_state = 0;
+        up(&audio_pwr_sem);
+}
+
+void nokia770_audio_pwr_down_request(int stage)
+{
+        down(&audio_pwr_sem);
+        switch (stage) {
+        case 1:
+                if (audio_pwr_state == 0)
+                        audio_pwr_state = 1;
+                break;
+        case 2:
+                if (audio_pwr_state == 1) {
+                        nokia770_audio_pwr_down();
+                        audio_pwr_state = -1;
+                }
+                break;
+        }
+        up(&audio_pwr_sem);
+}
+
+static void __init omap_nokia770_init(void)
+{
+        nokia770_config[0].data = &nokia770_usb_config;
+
+        platform_add_devices(nokia770_devices, ARRAY_SIZE(nokia770_devices));
+        spi_register_board_info(nokia770_spi_board_info,
+                                ARRAY_SIZE(nokia770_spi_board_info));
+        omap_board_config = nokia770_config;
+        omap_board_config_size = ARRAY_SIZE(nokia770_config);
+        omap_serial_init();
+        omap_dsp_audio_pwr_up_request = nokia770_audio_pwr_up_request;
+        omap_dsp_audio_pwr_down_request = nokia770_audio_pwr_down_request;
+        dspxor_ck = clk_get(0, "dspxor_ck");
+}
+
+static void __init omap_nokia770_map_io(void)
+{
+        omap1_map_common_io();
+}
+
+MACHINE_START(NOKIA770, "Nokia 770")
+        .phys_io        = 0xfff00000,
+        .io_pg_offst    = ((0xfef00000) >> 18) & 0xfffc,
+        .boot_params    = 0x10000100,
+        .map_io         = omap_nokia770_map_io,
+        .init_irq       = omap_nokia770_init_irq,
+        .init_machine   = omap_nokia770_init,
+        .timer          = &omap_timer,
+MACHINE_END
diff --git a/arch/arm/mach-omap1/board-osk.c b/arch/arm/mach-omap1/board-osk.c
index 543fa136106d..1160093e8ef6 100644
--- a/arch/arm/mach-omap1/board-osk.c
+++ b/arch/arm/mach-omap1/board-osk.c
@@ -33,6 +33,7 @@
 
 #include <linux/mtd/mtd.h>
 #include <linux/mtd/partitions.h>
+#include <linux/input.h>
 
 #include <asm/hardware.h>
 #include <asm/mach-types.h>
@@ -44,7 +45,24 @@
 #include <asm/arch/usb.h>
 #include <asm/arch/mux.h>
 #include <asm/arch/tc.h>
+#include <asm/arch/keypad.h>
 #include <asm/arch/common.h>
+#include <asm/arch/mcbsp.h>
+#include <asm/arch/omap-alsa.h>
+
+static int osk_keymap[] = {
+        KEY(0, 0, KEY_F1),
+        KEY(0, 3, KEY_UP),
+        KEY(1, 1, KEY_LEFTCTRL),
+        KEY(1, 2, KEY_LEFT),
+        KEY(2, 0, KEY_SPACE),
+        KEY(2, 1, KEY_ESC),
+        KEY(2, 2, KEY_DOWN),
+        KEY(3, 2, KEY_ENTER),
+        KEY(3, 3, KEY_RIGHT),
+        0
+};
+
 
 static struct mtd_partition osk_partitions[] = {
         /* bootloader (U-Boot, etc) in first sector */
@@ -133,9 +151,69 @@ static struct platform_device osk5912_cf_device = {
         .resource       = osk5912_cf_resources,
 };
 
+#define DEFAULT_BITPERSAMPLE 16
+
+static struct omap_mcbsp_reg_cfg mcbsp_regs = {
+        .spcr2 = FREE | FRST | GRST | XRST | XINTM(3),
+        .spcr1 = RINTM(3) | RRST,
+        .rcr2 = RPHASE | RFRLEN2(OMAP_MCBSP_WORD_8) |
+            RWDLEN2(OMAP_MCBSP_WORD_16) | RDATDLY(0),
+        .rcr1 = RFRLEN1(OMAP_MCBSP_WORD_8) | RWDLEN1(OMAP_MCBSP_WORD_16),
+        .xcr2 = XPHASE | XFRLEN2(OMAP_MCBSP_WORD_8) |
+            XWDLEN2(OMAP_MCBSP_WORD_16) | XDATDLY(0) | XFIG,
+        .xcr1 = XFRLEN1(OMAP_MCBSP_WORD_8) | XWDLEN1(OMAP_MCBSP_WORD_16),
+        .srgr1 = FWID(DEFAULT_BITPERSAMPLE - 1),
+        .srgr2 = GSYNC | CLKSP | FSGM | FPER(DEFAULT_BITPERSAMPLE * 2 - 1),
+        /*.pcr0 = FSXM | FSRM | CLKXM | CLKRM | CLKXP | CLKRP,*/ /* mcbsp: master */
+        .pcr0 = CLKXP | CLKRP,  /* mcbsp: slave */
+};
+
+static struct omap_alsa_codec_config alsa_config = {
+        .name                   = "OSK AIC23",
+        .mcbsp_regs_alsa        = &mcbsp_regs,
+        .codec_configure_dev    = NULL, // aic23_configure,
+        .codec_set_samplerate   = NULL, // aic23_set_samplerate,
+        .codec_clock_setup      = NULL, // aic23_clock_setup,
+        .codec_clock_on         = NULL, // aic23_clock_on,
+        .codec_clock_off        = NULL, // aic23_clock_off,
+        .get_default_samplerate = NULL, // aic23_get_default_samplerate,
+};
+
 static struct platform_device osk5912_mcbsp1_device = {
-        .name           = "omap_mcbsp",
-        .id             = 1,
+        .name   = "omap_alsa_mcbsp",
+        .id     = 1,
+        .dev = {
+                .platform_data  = &alsa_config,
+        },
+};
+
+static struct resource osk5912_kp_resources[] = {
+        [0] = {
+                .start  = INT_KEYBOARD,
+                .end    = INT_KEYBOARD,
+                .flags  = IORESOURCE_IRQ,
+        },
+};
+
+static struct omap_kp_platform_data osk_kp_data = {
+        .rows   = 8,
+        .cols   = 8,
+        .keymap = osk_keymap,
+};
+
+static struct platform_device osk5912_kp_device = {
+        .name           = "omap-keypad",
+        .id             = -1,
+        .dev            = {
+                .platform_data = &osk_kp_data,
+        },
+        .num_resources  = ARRAY_SIZE(osk5912_kp_resources),
+        .resource       = osk5912_kp_resources,
+};
+
+static struct platform_device osk5912_lcd_device = {
+        .name           = "lcd_osk",
+        .id             = -1,
 };
 
 static struct platform_device *osk5912_devices[] __initdata = {
@@ -143,6 +221,8 @@ static struct platform_device *osk5912_devices[] __initdata = {
         &osk5912_smc91x_device,
         &osk5912_cf_device,
         &osk5912_mcbsp1_device,
+        &osk5912_kp_device,
+        &osk5912_lcd_device,
 };
 
 static void __init osk_init_smc91x(void)
@@ -197,7 +277,6 @@ static struct omap_uart_config osk_uart_config __initdata = {
 };
 
 static struct omap_lcd_config osk_lcd_config __initdata = {
-        .panel_name     = "osk",
         .ctrl_name      = "internal",
 };
 
@@ -255,8 +334,18 @@ static void __init osk_mistral_init(void)
 static void __init osk_mistral_init(void) { }
 #endif
 
+#define EMIFS_CS3_VAL   (0x88013141)
+
 static void __init osk_init(void)
 {
+        /* Workaround for wrong CS3 (NOR flash) timing
+         * There are some U-Boot versions out there which configure
+         * wrong CS3 memory timings. This mainly leads to CRC
+         * or similiar errors if you use NOR flash (e.g. with JFFS2)
+         */
+        if (EMIFS_CCS(3) != EMIFS_CS3_VAL)
+                EMIFS_CCS(3) = EMIFS_CS3_VAL;
+
         osk_flash_resource.end = osk_flash_resource.start = omap_cs3_phys();
         osk_flash_resource.end += SZ_32M - 1;
         platform_add_devices(osk5912_devices, ARRAY_SIZE(osk5912_devices));
diff --git a/arch/arm/mach-omap1/board-palmte.c b/arch/arm/mach-omap1/board-palmte.c
index e488f7236775..4bc8a62909b9 100644
--- a/arch/arm/mach-omap1/board-palmte.c
+++ b/arch/arm/mach-omap1/board-palmte.c
@@ -38,6 +38,15 @@ static void __init omap_generic_init_irq(void)
         omap_init_irq();
 }
 
+static struct platform_device palmte_lcd_device = {
+        .name           = "lcd_palmte",
+        .id             = -1,
+};
+
+static struct platform_device *devices[] __initdata = {
+        &palmte_lcd_device,
+};
+
 static struct omap_usb_config palmte_usb_config __initdata = {
         .register_dev   = 1,
         .hmc_mode       = 0,
@@ -55,7 +64,6 @@ static struct omap_mmc_config palmte_mmc_config __initdata = {
 };
 
 static struct omap_lcd_config palmte_lcd_config __initdata = {
-        .panel_name     = "palmte",
         .ctrl_name      = "internal",
 };
 
@@ -69,6 +77,8 @@ static void __init omap_generic_init(void)
 {
         omap_board_config = palmte_config;
         omap_board_config_size = ARRAY_SIZE(palmte_config);
+
+        platform_add_devices(devices, ARRAY_SIZE(devices));
 }
 
 static void __init omap_generic_map_io(void)
diff --git a/arch/arm/mach-omap1/board-perseus2.c b/arch/arm/mach-omap1/board-perseus2.c
index 3913a3cc0ce6..64b45d8ae357 100644
--- a/arch/arm/mach-omap1/board-perseus2.c
+++ b/arch/arm/mach-omap1/board-perseus2.c
@@ -16,7 +16,9 @@
 #include <linux/platform_device.h>
 #include <linux/delay.h>
 #include <linux/mtd/mtd.h>
+#include <linux/mtd/nand.h>
 #include <linux/mtd/partitions.h>
+#include <linux/input.h>
 
 #include <asm/hardware.h>
 #include <asm/mach-types.h>
@@ -28,9 +30,44 @@
 #include <asm/arch/gpio.h>
 #include <asm/arch/mux.h>
 #include <asm/arch/fpga.h>
+#include <asm/arch/keypad.h>
 #include <asm/arch/common.h>
 #include <asm/arch/board.h>
 
+static int p2_keymap[] = {
+        KEY(0,0,KEY_UP),
+        KEY(0,1,KEY_RIGHT),
+        KEY(0,2,KEY_LEFT),
+        KEY(0,3,KEY_DOWN),
+        KEY(0,4,KEY_CENTER),
+        KEY(0,5,KEY_0_5),
+        KEY(1,0,KEY_SOFT2),
+        KEY(1,1,KEY_SEND),
+        KEY(1,2,KEY_END),
+        KEY(1,3,KEY_VOLUMEDOWN),
+        KEY(1,4,KEY_VOLUMEUP),
+        KEY(1,5,KEY_RECORD),
+        KEY(2,0,KEY_SOFT1),
+        KEY(2,1,KEY_3),
+        KEY(2,2,KEY_6),
+        KEY(2,3,KEY_9),
+        KEY(2,4,KEY_SHARP),
+        KEY(2,5,KEY_2_5),
+        KEY(3,0,KEY_BACK),
+        KEY(3,1,KEY_2),
+        KEY(3,2,KEY_5),
+        KEY(3,3,KEY_8),
+        KEY(3,4,KEY_0),
+        KEY(3,5,KEY_HEADSETHOOK),
+        KEY(4,0,KEY_HOME),
+        KEY(4,1,KEY_1),
+        KEY(4,2,KEY_4),
+        KEY(4,3,KEY_7),
+        KEY(4,4,KEY_STAR),
+        KEY(4,5,KEY_POWER),
+        0
+};
+
 static struct resource smc91x_resources[] = {
         [0] = {
                 .start  = H2P2_DBG_FPGA_ETHR_START,     /* Physical */
@@ -44,7 +81,7 @@ static struct resource smc91x_resources[] = {
         },
 };
 
-static struct mtd_partition p2_partitions[] = {
+static struct mtd_partition nor_partitions[] = {
         /* bootloader (U-Boot, etc) in first sector */
         {
               .name             = "bootloader",
@@ -75,27 +112,47 @@ static struct mtd_partition p2_partitions[] = {
         },
 };
 
-static struct flash_platform_data p2_flash_data = {
+static struct flash_platform_data nor_data = {
         .map_name       = "cfi_probe",
         .width          = 2,
-        .parts          = p2_partitions,
-        .nr_parts       = ARRAY_SIZE(p2_partitions),
+        .parts          = nor_partitions,
+        .nr_parts       = ARRAY_SIZE(nor_partitions),
 };
 
-static struct resource p2_flash_resource = {
+static struct resource nor_resource = {
         .start          = OMAP_CS0_PHYS,
         .end            = OMAP_CS0_PHYS + SZ_32M - 1,
         .flags          = IORESOURCE_MEM,
 };
 
-static struct platform_device p2_flash_device = {
+static struct platform_device nor_device = {
         .name           = "omapflash",
         .id             = 0,
         .dev            = {
-                .platform_data  = &p2_flash_data,
+                .platform_data  = &nor_data,
+        },
+        .num_resources  = 1,
+        .resource       = &nor_resource,
+};
+
+static struct nand_platform_data nand_data = {
+        .options        = NAND_SAMSUNG_LP_OPTIONS,
+};
+
+static struct resource nand_resource = {
+        .start          = OMAP_CS3_PHYS,
+        .end            = OMAP_CS3_PHYS + SZ_4K - 1,
+        .flags          = IORESOURCE_MEM,
+};
+
+static struct platform_device nand_device = {
+        .name           = "omapnand",
+        .id             = 0,
+        .dev            = {
+                .platform_data  = &nand_data,
         },
         .num_resources  = 1,
-        .resource       = &p2_flash_resource,
+        .resource       = &nand_resource,
 };
 
 static struct platform_device smc91x_device = {
@@ -105,17 +162,55 @@ static struct platform_device smc91x_device = {
         .resource       = smc91x_resources,
 };
 
+static struct resource kp_resources[] = {
+        [0] = {
+                .start  = INT_730_MPUIO_KEYPAD,
+                .end    = INT_730_MPUIO_KEYPAD,
+                .flags  = IORESOURCE_IRQ,
+        },
+};
+
+static struct omap_kp_platform_data kp_data = {
+        .rows   = 8,
+        .cols   = 8,
+        .keymap = p2_keymap,
+};
+
+static struct platform_device kp_device = {
+        .name           = "omap-keypad",
+        .id             = -1,
+        .dev            = {
+                .platform_data = &kp_data,
+        },
+        .num_resources  = ARRAY_SIZE(kp_resources),
+        .resource       = kp_resources,
+};
+
+static struct platform_device lcd_device = {
+        .name           = "lcd_p2",
+        .id             = -1,
+};
+
 static struct platform_device *devices[] __initdata = {
-        &p2_flash_device,
+        &nor_device,
+        &nand_device,
         &smc91x_device,
+        &kp_device,
+        &lcd_device,
 };
 
+#define P2_NAND_RB_GPIO_PIN     62
+
+static int nand_dev_ready(struct nand_platform_data *data)
+{
+        return omap_get_gpio_datain(P2_NAND_RB_GPIO_PIN);
+}
+
 static struct omap_uart_config perseus2_uart_config __initdata = {
         .enabled_uarts = ((1 << 0) | (1 << 1)),
 };
 
 static struct omap_lcd_config perseus2_lcd_config __initdata = {
-        .panel_name     = "p2",
         .ctrl_name      = "internal",
 };
 
@@ -126,7 +221,13 @@ static struct omap_board_config_kernel perseus2_config[] = {
 
 static void __init omap_perseus2_init(void)
 {
-        (void) platform_add_devices(devices, ARRAY_SIZE(devices));
+        if (!(omap_request_gpio(P2_NAND_RB_GPIO_PIN)))
+                nand_data.dev_ready = nand_dev_ready;
+
+        omap_cfg_reg(L3_1610_FLASH_CS2B_OE);
+        omap_cfg_reg(M8_1610_FLASH_CS2B_WE);
+
+        platform_add_devices(devices, ARRAY_SIZE(devices));
 
         omap_board_config = perseus2_config;
         omap_board_config_size = ARRAY_SIZE(perseus2_config);
diff --git a/arch/arm/mach-omap1/board-voiceblue.c b/arch/arm/mach-omap1/board-voiceblue.c
index 52e4a9d69642..447a586eb334 100644
--- a/arch/arm/mach-omap1/board-voiceblue.c
+++ b/arch/arm/mach-omap1/board-voiceblue.c
@@ -155,9 +155,9 @@ static struct omap_uart_config voiceblue_uart_config __initdata = {
 };
 
 static struct omap_board_config_kernel voiceblue_config[] = {
-        { OMAP_TAG_USB, &voiceblue_usb_config },
-        { OMAP_TAG_MMC, &voiceblue_mmc_config },
-        { OMAP_TAG_UART,        &voiceblue_uart_config },
+        { OMAP_TAG_USB,  &voiceblue_usb_config },
+        { OMAP_TAG_MMC,  &voiceblue_mmc_config },
+        { OMAP_TAG_UART, &voiceblue_uart_config },
 };
 
 static void __init voiceblue_init_irq(void)
@@ -235,7 +235,7 @@ static struct notifier_block panic_block = {
 static int __init voiceblue_setup(void)
 {
         /* Setup panic notifier */
-        atomic_notifier_chain_register(&panic_notifier_list, &panic_block);
+        notifier_chain_register(&panic_notifier_list, &panic_block);
 
         return 0;
 }
diff --git a/arch/arm/mach-omap1/clock.c b/arch/arm/mach-omap1/clock.c
index 75110ba10424..619db18144ea 100644
--- a/arch/arm/mach-omap1/clock.c
+++ b/arch/arm/mach-omap1/clock.c
@@ -345,7 +345,7 @@ static unsigned calc_ext_dsor(unsigned long rate)
          */
         for (dsor = 2; dsor < 96; ++dsor) {
                 if ((dsor & 1) && dsor > 8)
-                        continue;
+                        continue;
                 if (rate >= 96000000 / dsor)
                         break;
         }
@@ -687,6 +687,11 @@ int __init omap1_clk_init(void)
                         clk_register(*clkp);
                         continue;
                 }
+
+                if (((*clkp)->flags &CLOCK_IN_OMAP310) && cpu_is_omap310()) {
+                        clk_register(*clkp);
+                        continue;
+                }
         }
 
         info = omap_get_config(OMAP_TAG_CLOCK, struct omap_clock_config);
@@ -784,7 +789,7 @@ int __init omap1_clk_init(void)
         clk_enable(&armxor_ck.clk);
         clk_enable(&armtim_ck.clk); /* This should be done by timer code */
 
-        if (cpu_is_omap1510())
+        if (cpu_is_omap15xx())
                 clk_enable(&arm_gpio_ck);
 
         return 0;
diff --git a/arch/arm/mach-omap1/clock.h b/arch/arm/mach-omap1/clock.h
index 4f18d1b94449..b7c68819c4e7 100644
--- a/arch/arm/mach-omap1/clock.h
+++ b/arch/arm/mach-omap1/clock.h
@@ -151,7 +151,7 @@ static struct clk ck_ref = {
         .name           = "ck_ref",
         .rate           = 12000000,
         .flags          = CLOCK_IN_OMAP1510 | CLOCK_IN_OMAP16XX |
-                          ALWAYS_ENABLED,
+                          CLOCK_IN_OMAP310 | ALWAYS_ENABLED,
         .enable         = &omap1_clk_enable_generic,
         .disable        = &omap1_clk_disable_generic,
 };
@@ -160,7 +160,7 @@ static struct clk ck_dpll1 = {
         .name           = "ck_dpll1",
         .parent         = &ck_ref,
         .flags          = CLOCK_IN_OMAP1510 | CLOCK_IN_OMAP16XX |
-                          RATE_PROPAGATES | ALWAYS_ENABLED,
+                          CLOCK_IN_OMAP310 | RATE_PROPAGATES | ALWAYS_ENABLED,
         .enable         = &omap1_clk_enable_generic,
         .disable        = &omap1_clk_disable_generic,
 };
@@ -183,7 +183,8 @@ static struct clk arm_ck = {
         .name           = "arm_ck",
         .parent         = &ck_dpll1,
         .flags          = CLOCK_IN_OMAP1510 | CLOCK_IN_OMAP16XX |
-                          RATE_CKCTL | RATE_PROPAGATES | ALWAYS_ENABLED,
+                          CLOCK_IN_OMAP310 | RATE_CKCTL | RATE_PROPAGATES |
+                          ALWAYS_ENABLED,
         .rate_offset    = CKCTL_ARMDIV_OFFSET,
         .recalc         = &omap1_ckctl_recalc,
         .enable         = &omap1_clk_enable_generic,
@@ -195,7 +196,8 @@ static struct arm_idlect1_clk armper_ck = {
                 .name           = "armper_ck",
                 .parent         = &ck_dpll1,
                 .flags          = CLOCK_IN_OMAP1510 | CLOCK_IN_OMAP16XX |
-                                  RATE_CKCTL | CLOCK_IDLE_CONTROL,
+                                  CLOCK_IN_OMAP310 | RATE_CKCTL |
+                                  CLOCK_IDLE_CONTROL,
                 .enable_reg     = (void __iomem *)ARM_IDLECT2,
                 .enable_bit     = EN_PERCK,
                 .rate_offset    = CKCTL_PERDIV_OFFSET,
@@ -209,7 +211,7 @@ static struct arm_idlect1_clk armper_ck = {
 static struct clk arm_gpio_ck = {
         .name           = "arm_gpio_ck",
         .parent         = &ck_dpll1,
-        .flags          = CLOCK_IN_OMAP1510,
+        .flags          = CLOCK_IN_OMAP1510 | CLOCK_IN_OMAP310,
         .enable_reg     = (void __iomem *)ARM_IDLECT2,
         .enable_bit     = EN_GPIOCK,
         .recalc         = &followparent_recalc,
@@ -222,7 +224,7 @@ static struct arm_idlect1_clk armxor_ck = {
                 .name           = "armxor_ck",
                 .parent         = &ck_ref,
                 .flags          = CLOCK_IN_OMAP1510 | CLOCK_IN_OMAP16XX |
-                                  CLOCK_IDLE_CONTROL,
+                                  CLOCK_IN_OMAP310 | CLOCK_IDLE_CONTROL,
                 .enable_reg     = (void __iomem *)ARM_IDLECT2,
                 .enable_bit     = EN_XORPCK,
                 .recalc         = &followparent_recalc,
@@ -237,7 +239,7 @@ static struct arm_idlect1_clk armtim_ck = {
                 .name           = "armtim_ck",
                 .parent         = &ck_ref,
                 .flags          = CLOCK_IN_OMAP1510 | CLOCK_IN_OMAP16XX |
-                                  CLOCK_IDLE_CONTROL,
+                                  CLOCK_IN_OMAP310 | CLOCK_IDLE_CONTROL,
                 .enable_reg     = (void __iomem *)ARM_IDLECT2,
                 .enable_bit     = EN_TIMCK,
                 .recalc         = &followparent_recalc,
@@ -252,7 +254,7 @@ static struct arm_idlect1_clk armwdt_ck = {
                 .name           = "armwdt_ck",
                 .parent         = &ck_ref,
                 .flags          = CLOCK_IN_OMAP1510 | CLOCK_IN_OMAP16XX |
-                                  CLOCK_IDLE_CONTROL,
+                                  CLOCK_IN_OMAP310 | CLOCK_IDLE_CONTROL,
                 .enable_reg     = (void __iomem *)ARM_IDLECT2,
                 .enable_bit     = EN_WDTCK,
                 .recalc         = &omap1_watchdog_recalc,
@@ -344,9 +346,9 @@ static struct arm_idlect1_clk tc_ck = {
                 .name           = "tc_ck",
                 .parent         = &ck_dpll1,
                 .flags          = CLOCK_IN_OMAP1510 | CLOCK_IN_OMAP16XX |
-                                  CLOCK_IN_OMAP730 | RATE_CKCTL |
-                                  RATE_PROPAGATES | ALWAYS_ENABLED |
-                                  CLOCK_IDLE_CONTROL,
+                                  CLOCK_IN_OMAP730 | CLOCK_IN_OMAP310 |
+                                  RATE_CKCTL | RATE_PROPAGATES |
+                                  ALWAYS_ENABLED | CLOCK_IDLE_CONTROL,
                 .rate_offset    = CKCTL_TCDIV_OFFSET,
                 .recalc         = &omap1_ckctl_recalc,
                 .enable         = &omap1_clk_enable_generic,
@@ -358,7 +360,8 @@ static struct arm_idlect1_clk tc_ck = {
 static struct clk arminth_ck1510 = {
         .name           = "arminth_ck",
         .parent         = &tc_ck.clk,
-        .flags          = CLOCK_IN_OMAP1510 | ALWAYS_ENABLED,
+        .flags          = CLOCK_IN_OMAP1510 | CLOCK_IN_OMAP310 |
+                          ALWAYS_ENABLED,
         .recalc         = &followparent_recalc,
         /* Note: On 1510 the frequency follows TC_CK
          *
@@ -372,7 +375,8 @@ static struct clk tipb_ck = {
         /* No-idle controlled by "tc_ck" */
         .name           = "tibp_ck",
         .parent         = &tc_ck.clk,
-        .flags          = CLOCK_IN_OMAP1510 | ALWAYS_ENABLED,
+        .flags          = CLOCK_IN_OMAP1510 | CLOCK_IN_OMAP310 |
+                          ALWAYS_ENABLED,
         .recalc         = &followparent_recalc,
         .enable         = &omap1_clk_enable_generic,
         .disable        = &omap1_clk_disable_generic,
@@ -417,7 +421,7 @@ static struct clk dma_ck = {
         .name           = "dma_ck",
         .parent         = &tc_ck.clk,
         .flags          = CLOCK_IN_OMAP1510 | CLOCK_IN_OMAP16XX |
-                          ALWAYS_ENABLED,
+                          CLOCK_IN_OMAP310 | ALWAYS_ENABLED,
         .recalc         = &followparent_recalc,
         .enable         = &omap1_clk_enable_generic,
         .disable        = &omap1_clk_disable_generic,
@@ -437,7 +441,7 @@ static struct arm_idlect1_clk api_ck = {
                 .name           = "api_ck",
                 .parent         = &tc_ck.clk,
                 .flags          = CLOCK_IN_OMAP1510 | CLOCK_IN_OMAP16XX |
-                                  CLOCK_IDLE_CONTROL,
+                                  CLOCK_IN_OMAP310 | CLOCK_IDLE_CONTROL,
                 .enable_reg     = (void __iomem *)ARM_IDLECT2,
                 .enable_bit     = EN_APICK,
                 .recalc         = &followparent_recalc,
@@ -451,7 +455,8 @@ static struct arm_idlect1_clk lb_ck = {
         .clk = {
                 .name           = "lb_ck",
                 .parent         = &tc_ck.clk,
-                .flags          = CLOCK_IN_OMAP1510 | CLOCK_IDLE_CONTROL,
+                .flags          = CLOCK_IN_OMAP1510 | CLOCK_IN_OMAP310 |
+                                  CLOCK_IDLE_CONTROL,
                 .enable_reg     = (void __iomem *)ARM_IDLECT2,
                 .enable_bit     = EN_LBCK,
                 .recalc         = &followparent_recalc,
@@ -495,8 +500,8 @@ static struct arm_idlect1_clk lcd_ck_1510 = {
         .clk = {
                 .name           = "lcd_ck",
                 .parent         = &ck_dpll1,
-                .flags          = CLOCK_IN_OMAP1510 | RATE_CKCTL |
-                                  CLOCK_IDLE_CONTROL,
+                .flags          = CLOCK_IN_OMAP1510 | CLOCK_IN_OMAP310 |
+                                  RATE_CKCTL | CLOCK_IDLE_CONTROL,
                 .enable_reg     = (void __iomem *)ARM_IDLECT2,
                 .enable_bit     = EN_LCDCK,
                 .rate_offset    = CKCTL_LCDDIV_OFFSET,
@@ -512,8 +517,9 @@ static struct clk uart1_1510 = {
         /* Direct from ULPD, no real parent */
         .parent         = &armper_ck.clk,
         .rate           = 12000000,
-        .flags          = CLOCK_IN_OMAP1510 | ENABLE_REG_32BIT |
-                          ALWAYS_ENABLED | CLOCK_NO_IDLE_PARENT,
+        .flags          = CLOCK_IN_OMAP1510 | CLOCK_IN_OMAP310 |
+                          ENABLE_REG_32BIT | ALWAYS_ENABLED |
+                          CLOCK_NO_IDLE_PARENT,
         .enable_reg     = (void __iomem *)MOD_CONF_CTRL_0,
         .enable_bit     = 29,   /* Chooses between 12MHz and 48MHz */
         .set_rate       = &omap1_set_uart_rate,
@@ -544,8 +550,8 @@ static struct clk uart2_ck = {
         .parent         = &armper_ck.clk,
         .rate           = 12000000,
         .flags          = CLOCK_IN_OMAP1510 | CLOCK_IN_OMAP16XX |
-                          ENABLE_REG_32BIT | ALWAYS_ENABLED |
-                          CLOCK_NO_IDLE_PARENT,
+                          CLOCK_IN_OMAP310 | ENABLE_REG_32BIT |
+                          ALWAYS_ENABLED | CLOCK_NO_IDLE_PARENT,
         .enable_reg     = (void __iomem *)MOD_CONF_CTRL_0,
         .enable_bit     = 30,   /* Chooses between 12MHz and 48MHz */
         .set_rate       = &omap1_set_uart_rate,
@@ -559,8 +565,9 @@ static struct clk uart3_1510 = {
         /* Direct from ULPD, no real parent */
         .parent         = &armper_ck.clk,
         .rate           = 12000000,
-        .flags          = CLOCK_IN_OMAP1510 | ENABLE_REG_32BIT |
-                          ALWAYS_ENABLED | CLOCK_NO_IDLE_PARENT,
+        .flags          = CLOCK_IN_OMAP1510 | CLOCK_IN_OMAP310 |
+                          ENABLE_REG_32BIT | ALWAYS_ENABLED |
+                          CLOCK_NO_IDLE_PARENT,
         .enable_reg     = (void __iomem *)MOD_CONF_CTRL_0,
         .enable_bit     = 31,   /* Chooses between 12MHz and 48MHz */
         .set_rate       = &omap1_set_uart_rate,
@@ -590,7 +597,7 @@ static struct clk usb_clko = {	/* 6 MHz output on W4_USB_CLKO */
         /* Direct from ULPD, no parent */
         .rate           = 6000000,
         .flags          = CLOCK_IN_OMAP1510 | CLOCK_IN_OMAP16XX |
-                          RATE_FIXED | ENABLE_REG_32BIT,
+                          CLOCK_IN_OMAP310 | RATE_FIXED | ENABLE_REG_32BIT,
         .enable_reg     = (void __iomem *)ULPD_CLOCK_CTRL,
         .enable_bit     = USB_MCLK_EN_BIT,
         .enable         = &omap1_clk_enable_generic,
@@ -601,7 +608,7 @@ static struct clk usb_hhc_ck1510 = {
         .name           = "usb_hhc_ck",
         /* Direct from ULPD, no parent */
         .rate           = 48000000, /* Actually 2 clocks, 12MHz and 48MHz */
-        .flags          = CLOCK_IN_OMAP1510 |
+        .flags          = CLOCK_IN_OMAP1510 | CLOCK_IN_OMAP310 |
                           RATE_FIXED | ENABLE_REG_32BIT,
         .enable_reg     = (void __iomem *)MOD_CONF_CTRL_0,
         .enable_bit     = USB_HOST_HHC_UHOST_EN,
@@ -637,7 +644,9 @@ static struct clk mclk_1510 = {
         .name           = "mclk",
         /* Direct from ULPD, no parent. May be enabled by ext hardware. */
         .rate           = 12000000,
-        .flags          = CLOCK_IN_OMAP1510 | RATE_FIXED,
+        .flags          = CLOCK_IN_OMAP1510 | CLOCK_IN_OMAP310 | RATE_FIXED,
+        .enable_reg     = (void __iomem *)SOFT_REQ_REG,
+        .enable_bit     = 6,
         .enable         = &omap1_clk_enable_generic,
         .disable        = &omap1_clk_disable_generic,
 };
@@ -659,7 +668,7 @@ static struct clk bclk_1510 = {
         .name           = "bclk",
         /* Direct from ULPD, no parent. May be enabled by ext hardware. */
         .rate           = 12000000,
-        .flags          = CLOCK_IN_OMAP1510 | RATE_FIXED,
+        .flags          = CLOCK_IN_OMAP1510 | CLOCK_IN_OMAP310 | RATE_FIXED,
         .enable         = &omap1_clk_enable_generic,
         .disable        = &omap1_clk_disable_generic,
 };
@@ -678,12 +687,14 @@ static struct clk bclk_16xx = {
 };
 
 static struct clk mmc1_ck = {
-        .name           = "mmc1_ck",
+        .name           = "mmc_ck",
+        .id             = 1,
         /* Functional clock is direct from ULPD, interface clock is ARMPER */
         .parent         = &armper_ck.clk,
         .rate           = 48000000,
         .flags          = CLOCK_IN_OMAP1510 | CLOCK_IN_OMAP16XX |
-                          RATE_FIXED | ENABLE_REG_32BIT | CLOCK_NO_IDLE_PARENT,
+                          CLOCK_IN_OMAP310 | RATE_FIXED | ENABLE_REG_32BIT |
+                          CLOCK_NO_IDLE_PARENT,
         .enable_reg     = (void __iomem *)MOD_CONF_CTRL_0,
         .enable_bit     = 23,
         .enable         = &omap1_clk_enable_generic,
@@ -691,7 +702,8 @@ static struct clk mmc1_ck = {
 };
 
 static struct clk mmc2_ck = {
-        .name           = "mmc2_ck",
+        .name           = "mmc_ck",
+        .id             = 2,
         /* Functional clock is direct from ULPD, interface clock is ARMPER */
         .parent         = &armper_ck.clk,
         .rate           = 48000000,
@@ -706,7 +718,7 @@ static struct clk mmc2_ck = {
 static struct clk virtual_ck_mpu = {
         .name           = "mpu",
         .flags          = CLOCK_IN_OMAP1510 | CLOCK_IN_OMAP16XX |
-                          VIRTUAL_CLOCK | ALWAYS_ENABLED,
+                          CLOCK_IN_OMAP310 | VIRTUAL_CLOCK | ALWAYS_ENABLED,
         .parent         = &arm_ck, /* Is smarter alias for */
         .recalc         = &followparent_recalc,
         .set_rate       = &omap1_select_table_rate,
@@ -715,6 +727,20 @@ static struct clk virtual_ck_mpu = {
         .disable        = &omap1_clk_disable_generic,
 };
 
+/* virtual functional clock domain for I2C. Just for making sure that ARMXOR_CK
+remains active during MPU idle whenever this is enabled */
+static struct clk i2c_fck = {
+        .name           = "i2c_fck",
+        .id             = 1,
+        .flags          = CLOCK_IN_OMAP1510 | CLOCK_IN_OMAP16XX |
+                          VIRTUAL_CLOCK | CLOCK_NO_IDLE_PARENT |
+                          ALWAYS_ENABLED,
+        .parent         = &armxor_ck.clk,
+        .recalc         = &followparent_recalc,
+        .enable         = &omap1_clk_enable_generic,
+        .disable        = &omap1_clk_disable_generic,
+};
+
 static struct clk * onchip_clks[] = {
         /* non-ULPD clocks */
         &ck_ref,
@@ -763,6 +789,7 @@ static struct clk * onchip_clks[] = {
         &mmc2_ck,
         /* Virtual clocks */
         &virtual_ck_mpu,
+        &i2c_fck,
 };
 
 #endif
diff --git a/arch/arm/mach-omap1/devices.c b/arch/arm/mach-omap1/devices.c
index ecbc47514adc..847329cafc5c 100644
--- a/arch/arm/mach-omap1/devices.c
+++ b/arch/arm/mach-omap1/devices.c
@@ -25,10 +25,6 @@
 #include <asm/arch/mux.h>
 #include <asm/arch/gpio.h>
 
-extern void omap_nop_release(struct device *dev);
-
-/*-------------------------------------------------------------------------*/
-
 #if     defined(CONFIG_OMAP1610_IR) || defined(CONFIG_OMAP161O_IR_MODULE)
 
 static u64 irda_dmamask = 0xffffffff;
@@ -37,7 +33,6 @@ static struct platform_device omap1610ir_device = {
         .name = "omap1610-ir",
         .id = -1,
         .dev = {
-                .release        = omap_nop_release,
                 .dma_mask       = &irda_dmamask,
         },
 };
@@ -84,9 +79,6 @@ static struct resource rtc_resources[] = {
 static struct platform_device omap_rtc_device = {
         .name           = "omap_rtc",
         .id             = -1,
-        .dev = {
-                .release        = omap_nop_release,
-        },
         .num_resources  = ARRAY_SIZE(rtc_resources),
         .resource       = rtc_resources,
 };
@@ -99,6 +91,42 @@ static void omap_init_rtc(void)
 static inline void omap_init_rtc(void) {}
 #endif
 
+#if defined(CONFIG_OMAP_STI)
+
+#define OMAP1_STI_BASE          IO_ADDRESS(0xfffea000)
+#define OMAP1_STI_CHANNEL_BASE  (OMAP1_STI_BASE + 0x400)
+
+static struct resource sti_resources[] = {
+        {
+                .start          = OMAP1_STI_BASE,
+                .end            = OMAP1_STI_BASE + SZ_1K - 1,
+                .flags          = IORESOURCE_MEM,
+        },
+        {
+                .start          = OMAP1_STI_CHANNEL_BASE,
+                .end            = OMAP1_STI_CHANNEL_BASE + SZ_1K - 1,
+                .flags          = IORESOURCE_MEM,
+        },
+        {
+                .start          = INT_1610_STI,
+                .flags          = IORESOURCE_IRQ,
+        }
+};
+
+static struct platform_device sti_device = {
+        .name           = "sti",
+        .id             = -1,
+        .num_resources  = ARRAY_SIZE(sti_resources),
+        .resource       = sti_resources,
+};
+
+static inline void omap_init_sti(void)
+{
+        platform_device_register(&sti_device);
+}
+#else
+static inline void omap_init_sti(void) {}
+#endif
 
 /*-------------------------------------------------------------------------*/
 
@@ -129,6 +157,7 @@ static int __init omap1_init_devices(void)
          */
         omap_init_irda();
         omap_init_rtc();
+        omap_init_sti();
 
         return 0;
 }
diff --git a/arch/arm/mach-omap1/io.c b/arch/arm/mach-omap1/io.c
index 82d556be79c5..be3a2a4ee2b8 100644
--- a/arch/arm/mach-omap1/io.c
+++ b/arch/arm/mach-omap1/io.c
@@ -18,6 +18,7 @@
 #include <asm/io.h>
 #include <asm/arch/mux.h>
 #include <asm/arch/tc.h>
+#include <asm/arch/omapfb.h>
 
 extern int omap1_clk_init(void);
 extern void omap_check_revision(void);
@@ -110,7 +111,7 @@ void __init omap1_map_common_io(void)
         }
 #endif
 #ifdef CONFIG_ARCH_OMAP15XX
-        if (cpu_is_omap1510()) {
+        if (cpu_is_omap15xx()) {
                 iotable_init(omap1510_io_desc, ARRAY_SIZE(omap1510_io_desc));
         }
 #endif
@@ -121,6 +122,7 @@ void __init omap1_map_common_io(void)
 #endif
 
         omap_sram_init();
+        omapfb_reserve_mem();
 }
 
 /*
diff --git a/arch/arm/mach-omap1/irq.c b/arch/arm/mach-omap1/irq.c
index ed65a7d2e941..a0431c00fa81 100644
--- a/arch/arm/mach-omap1/irq.c
+++ b/arch/arm/mach-omap1/irq.c
@@ -60,7 +60,7 @@ struct omap_irq_bank {
         unsigned long wake_enable;
 };
 
-static unsigned int irq_bank_count = 0;
+static unsigned int irq_bank_count;
 static struct omap_irq_bank *irq_banks;
 
 static inline unsigned int irq_bank_readl(int bank, int offset)
@@ -142,28 +142,28 @@ static void omap_irq_set_cfg(int irq, int fiq, int priority, int trigger)
 
 #ifdef CONFIG_ARCH_OMAP730
 static struct omap_irq_bank omap730_irq_banks[] = {
-        { .base_reg = OMAP_IH1_BASE,            .trigger_map = 0xb3f8e22f },
-        { .base_reg = OMAP_IH2_BASE,            .trigger_map = 0xfdb9c1f2 },
+        { .base_reg = OMAP_IH1_BASE,            .trigger_map = 0xb3f8e22f },
+        { .base_reg = OMAP_IH2_BASE,            .trigger_map = 0xfdb9c1f2 },
         { .base_reg = OMAP_IH2_BASE + 0x100,    .trigger_map = 0x800040f3 },
 };
 #endif
 
 #ifdef CONFIG_ARCH_OMAP15XX
 static struct omap_irq_bank omap1510_irq_banks[] = {
-        { .base_reg = OMAP_IH1_BASE,            .trigger_map = 0xb3febfff },
-        { .base_reg = OMAP_IH2_BASE,            .trigger_map = 0xffbfffed },
+        { .base_reg = OMAP_IH1_BASE,            .trigger_map = 0xb3febfff },
+        { .base_reg = OMAP_IH2_BASE,            .trigger_map = 0xffbfffed },
 };
 static struct omap_irq_bank omap310_irq_banks[] = {
-        { .base_reg = OMAP_IH1_BASE,            .trigger_map = 0xb3faefc3 },
-        { .base_reg = OMAP_IH2_BASE,            .trigger_map = 0x65b3c061 },
+        { .base_reg = OMAP_IH1_BASE,            .trigger_map = 0xb3faefc3 },
+        { .base_reg = OMAP_IH2_BASE,            .trigger_map = 0x65b3c061 },
 };
 #endif
 
 #if defined(CONFIG_ARCH_OMAP16XX)
 
 static struct omap_irq_bank omap1610_irq_banks[] = {
-        { .base_reg = OMAP_IH1_BASE,            .trigger_map = 0xb3fefe8f },
-        { .base_reg = OMAP_IH2_BASE,            .trigger_map = 0xfdb7c1fd },
+        { .base_reg = OMAP_IH1_BASE,            .trigger_map = 0xb3fefe8f },
+        { .base_reg = OMAP_IH2_BASE,            .trigger_map = 0xfdb7c1fd },
         { .base_reg = OMAP_IH2_BASE + 0x100,    .trigger_map = 0xffffb7ff },
         { .base_reg = OMAP_IH2_BASE + 0x200,    .trigger_map = 0xffffffff },
 };
diff --git a/arch/arm/mach-omap1/mux.c b/arch/arm/mach-omap1/mux.c
index d4b8d624e742..10fe0b3efcac 100644
--- a/arch/arm/mach-omap1/mux.c
+++ b/arch/arm/mach-omap1/mux.c
@@ -35,16 +35,20 @@
 
 #ifdef CONFIG_ARCH_OMAP730
 struct pin_config __initdata_or_module omap730_pins[] = {
-MUX_CFG_730("E2_730_KBR0",      12,   21,    0,   0,   20,   1,   NA,    0,  0)
-MUX_CFG_730("J7_730_KBR1",      12,   25,    0,   0,   24,   1,   NA,    0,  0)
-MUX_CFG_730("E1_730_KBR2",      12,   29,    0,   0,   28,   1,   NA,    0,  0)
-MUX_CFG_730("F3_730_KBR3",      13,    1,    0,   0,   0,    1,   NA,    0,  0)
-MUX_CFG_730("D2_730_KBR4",      13,    5,    0,   0,   4,    1,   NA,    0,  0)
-MUX_CFG_730("C2_730_KBC0",      13,    9,    0,   0,    8,   1,   NA,    0,  0)
-MUX_CFG_730("D3_730_KBC1",      13,   13,    0,   0,   12,   1,   NA,    0,  0)
-MUX_CFG_730("E4_730_KBC2",      13,   17,    0,   0,   16,   1,   NA,    0,  0)
-MUX_CFG_730("F4_730_KBC3",      13,   21,    0,   0,   20,   1,   NA,    0,  0)
-MUX_CFG_730("E3_730_KBC4",      13,   25,    0,   0,   24,   1,   NA,    0,  0)
+MUX_CFG_730("E2_730_KBR0",        12,   21,    0,   20,   1, 0)
+MUX_CFG_730("J7_730_KBR1",        12,   25,    0,   24,   1, 0)
+MUX_CFG_730("E1_730_KBR2",        12,   29,    0,   28,   1, 0)
+MUX_CFG_730("F3_730_KBR3",        13,    1,    0,    0,   1, 0)
+MUX_CFG_730("D2_730_KBR4",        13,    5,    0,    4,   1, 0)
+MUX_CFG_730("C2_730_KBC0",        13,    9,    0,    8,   1, 0)
+MUX_CFG_730("D3_730_KBC1",        13,   13,    0,   12,   1, 0)
+MUX_CFG_730("E4_730_KBC2",        13,   17,    0,   16,   1, 0)
+MUX_CFG_730("F4_730_KBC3",        13,   21,    0,   20,   1, 0)
+MUX_CFG_730("E3_730_KBC4",        13,   25,    0,   24,   1, 0)
+
+MUX_CFG_730("AA17_730_USB_DM",     2,   21,    0,   20,   0, 0)
+MUX_CFG_730("W16_730_USB_PU_EN",   2,   25,    0,   24,   0, 0)
+MUX_CFG_730("W17_730_USB_VBUSI",   2,   29,    0,   28,   0, 0)
 };
 #endif
 
@@ -73,8 +77,8 @@ MUX_CFG("UART3_BCLK",		 A,    0,    0,	  2,   6,   0,	 NA,	 0,  0)
 MUX_CFG("Y15_1610_UART3_RTS",    A,    0,    1,   2,   6,   0,   NA,     0,  0)
 
 /* PWT & PWL, conflicts with UART3 */
-MUX_CFG("PWT",                   6,    0,    2,   0,  30,   0,   NA,     0,  0)
-MUX_CFG("PWL",                   6,    3,    1,   0,  31,   1,   NA,     0,  0)
+MUX_CFG("PWT",                   6,    0,    2,   0,  30,   0,   NA,     0,  0)
+MUX_CFG("PWL",                   6,    3,    1,   0,  31,   1,   NA,     0,  0)
 
 /* USB internal master generic */
 MUX_CFG("R18_USB_VBUS",          7,    9,    2,   1,  11,   0,   NA,     0,  1)
@@ -151,7 +155,7 @@ MUX_CFG("MCBSP3_CLKX",		 9,    3,    1,	  1,  29,   0,	 NA,	 0,  1)
 
 /* Misc ballouts */
 MUX_CFG("BALLOUT_V8_ARMIO3",     B,   18,    0,   2,  25,   1,   NA,     0,  1)
-MUX_CFG("N20_HDQ",             6,   18,    1,   1,   4,   0,    1,     4,  0)
+MUX_CFG("N20_HDQ",               6,   18,    1,   1,   4,   0,    1,     4,  0)
 
 /* OMAP-1610 MMC2 */
 MUX_CFG("W8_1610_MMC2_DAT0",     B,   21,    6,   2,  23,   1,    2,     1,  1)
diff --git a/arch/arm/mach-omap1/pm.c b/arch/arm/mach-omap1/pm.c
new file mode 100644
index 000000000000..ddf6b07dc9c7
--- /dev/null
+++ b/arch/arm/mach-omap1/pm.c
@@ -0,0 +1,770 @@
+/*
+ * linux/arch/arm/mach-omap1/pm.c
+ *
+ * OMAP Power Management Routines
+ *
+ * Original code for the SA11x0:
+ * Copyright (c) 2001 Cliff Brake <cbrake@accelent.com>
+ *
+ * Modified for the PXA250 by Nicolas Pitre:
+ * Copyright (c) 2002 Monta Vista Software, Inc.
+ *
+ * Modified for the OMAP1510 by David Singleton:
+ * Copyright (c) 2002 Monta Vista Software, Inc.
+ *
+ * Cleanup 2004 for OMAP1510/1610 by Dirk Behme <dirk.behme@de.bosch.com>
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the
+ * Free Software Foundation; either version 2 of the License, or (at your
+ * option) any later version.
+ *
+ * THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED
+ * WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN
+ * NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF
+ * USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
+ * ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 675 Mass Ave, Cambridge, MA 02139, USA.
+ */
+
+#include <linux/pm.h>
+#include <linux/sched.h>
+#include <linux/proc_fs.h>
+#include <linux/pm.h>
+#include <linux/interrupt.h>
+#include <linux/sysfs.h>
+#include <linux/module.h>
+
+#include <asm/io.h>
+#include <asm/irq.h>
+#include <asm/atomic.h>
+#include <asm/mach/time.h>
+#include <asm/mach/irq.h>
+#include <asm/mach-types.h>
+
+#include <asm/arch/irqs.h>
+#include <asm/arch/clock.h>
+#include <asm/arch/sram.h>
+#include <asm/arch/tc.h>
+#include <asm/arch/pm.h>
+#include <asm/arch/mux.h>
+#include <asm/arch/tps65010.h>
+#include <asm/arch/dma.h>
+#include <asm/arch/dsp_common.h>
+#include <asm/arch/dmtimer.h>
+
+static unsigned int arm_sleep_save[ARM_SLEEP_SAVE_SIZE];
+static unsigned short dsp_sleep_save[DSP_SLEEP_SAVE_SIZE];
+static unsigned short ulpd_sleep_save[ULPD_SLEEP_SAVE_SIZE];
+static unsigned int mpui730_sleep_save[MPUI730_SLEEP_SAVE_SIZE];
+static unsigned int mpui1510_sleep_save[MPUI1510_SLEEP_SAVE_SIZE];
+static unsigned int mpui1610_sleep_save[MPUI1610_SLEEP_SAVE_SIZE];
+
+static unsigned short enable_dyn_sleep = 1;
+
+static ssize_t omap_pm_sleep_while_idle_show(struct subsystem * subsys, char *buf)
+{
+        return sprintf(buf, "%hu\n", enable_dyn_sleep);
+}
+
+static ssize_t omap_pm_sleep_while_idle_store(struct subsystem * subsys,
+                                              const char * buf,
+                                              size_t n)
+{
+        unsigned short value;
+        if (sscanf(buf, "%hu", &value) != 1 ||
+            (value != 0 && value != 1)) {
+                printk(KERN_ERR "idle_sleep_store: Invalid value\n");
+                return -EINVAL;
+        }
+        enable_dyn_sleep = value;
+        return n;
+}
+
+static struct subsys_attribute sleep_while_idle_attr = {
+        .attr   = {
+                .name = __stringify(sleep_while_idle),
+                .mode = 0644,
+        },
+        .show   = omap_pm_sleep_while_idle_show,
+        .store  = omap_pm_sleep_while_idle_store,
+};
+
+extern struct subsystem power_subsys;
+static void (*omap_sram_idle)(void) = NULL;
+static void (*omap_sram_suspend)(unsigned long r0, unsigned long r1) = NULL;
+
+/*
+ * Let's power down on idle, but only if we are really
+ * idle, because once we start down the path of
+ * going idle we continue to do idle even if we get
+ * a clock tick interrupt . .
+ */
+void omap_pm_idle(void)
+{
+        extern __u32 arm_idlect1_mask;
+        __u32 use_idlect1 = arm_idlect1_mask;
+#ifndef CONFIG_OMAP_MPU_TIMER
+        int do_sleep;
+#endif
+
+        local_irq_disable();
+        local_fiq_disable();
+        if (need_resched()) {
+                local_fiq_enable();
+                local_irq_enable();
+                return;
+        }
+
+        /*
+         * Since an interrupt may set up a timer, we don't want to
+         * reprogram the hardware timer with interrupts enabled.
+         * Re-enable interrupts only after returning from idle.
+         */
+        timer_dyn_reprogram();
+
+#ifdef CONFIG_OMAP_MPU_TIMER
+#warning Enable 32kHz OS timer in order to allow sleep states in idle
+        use_idlect1 = use_idlect1 & ~(1 << 9);
+#else
+
+        do_sleep = 0;
+        while (enable_dyn_sleep) {
+
+#ifdef CONFIG_CBUS_TAHVO_USB
+                extern int vbus_active;
+                /* Clock requirements? */
+                if (vbus_active)
+                        break;
+#endif
+                do_sleep = 1;
+                break;
+        }
+
+#ifdef CONFIG_OMAP_DM_TIMER
+        use_idlect1 = omap_dm_timer_modify_idlect_mask(use_idlect1);
+#endif
+
+        if (omap_dma_running()) {
+                use_idlect1 &= ~(1 << 6);
+                if (omap_lcd_dma_ext_running())
+                        use_idlect1 &= ~(1 << 12);
+        }
+
+        /* We should be able to remove the do_sleep variable and multiple
+         * tests above as soon as drivers, timer and DMA code have been fixed.
+         * Even the sleep block count should become obsolete. */
+        if ((use_idlect1 != ~0) || !do_sleep) {
+
+                __u32 saved_idlect1 = omap_readl(ARM_IDLECT1);
+                if (cpu_is_omap15xx())
+                        use_idlect1 &= OMAP1510_BIG_SLEEP_REQUEST;
+                else
+                        use_idlect1 &= OMAP1610_IDLECT1_SLEEP_VAL;
+                omap_writel(use_idlect1, ARM_IDLECT1);
+                __asm__ volatile ("mcr  p15, 0, r0, c7, c0, 4");
+                omap_writel(saved_idlect1, ARM_IDLECT1);
+
+                local_fiq_enable();
+                local_irq_enable();
+                return;
+        }
+        omap_sram_suspend(omap_readl(ARM_IDLECT1),
+                          omap_readl(ARM_IDLECT2));
+#endif
+
+        local_fiq_enable();
+        local_irq_enable();
+}
+
+/*
+ * Configuration of the wakeup event is board specific. For the
+ * moment we put it into this helper function. Later it may move
+ * to board specific files.
+ */
+static void omap_pm_wakeup_setup(void)
+{
+        u32 level1_wake = 0;
+        u32 level2_wake = OMAP_IRQ_BIT(INT_UART2);
+
+        /*
+         * Turn off all interrupts except GPIO bank 1, L1-2nd level cascade,
+         * and the L2 wakeup interrupts: keypad and UART2. Note that the
+         * drivers must still separately call omap_set_gpio_wakeup() to
+         * wake up to a GPIO interrupt.
+         */
+        if (cpu_is_omap730())
+                level1_wake = OMAP_IRQ_BIT(INT_730_GPIO_BANK1) |
+                        OMAP_IRQ_BIT(INT_730_IH2_IRQ);
+        else if (cpu_is_omap15xx())
+                level1_wake = OMAP_IRQ_BIT(INT_GPIO_BANK1) |
+                        OMAP_IRQ_BIT(INT_1510_IH2_IRQ);
+        else if (cpu_is_omap16xx())
+                level1_wake = OMAP_IRQ_BIT(INT_GPIO_BANK1) |
+                        OMAP_IRQ_BIT(INT_1610_IH2_IRQ);
+
+        omap_writel(~level1_wake, OMAP_IH1_MIR);
+
+        if (cpu_is_omap730()) {
+                omap_writel(~level2_wake, OMAP_IH2_0_MIR);
+                omap_writel(~(OMAP_IRQ_BIT(INT_730_WAKE_UP_REQ) |
+                                OMAP_IRQ_BIT(INT_730_MPUIO_KEYPAD)),
+                                OMAP_IH2_1_MIR);
+        } else if (cpu_is_omap15xx()) {
+                level2_wake |= OMAP_IRQ_BIT(INT_KEYBOARD);
+                omap_writel(~level2_wake,  OMAP_IH2_MIR);
+        } else if (cpu_is_omap16xx()) {
+                level2_wake |= OMAP_IRQ_BIT(INT_KEYBOARD);
+                omap_writel(~level2_wake, OMAP_IH2_0_MIR);
+
+                /* INT_1610_WAKE_UP_REQ is needed for GPIO wakeup... */
+                omap_writel(~OMAP_IRQ_BIT(INT_1610_WAKE_UP_REQ),
+                            OMAP_IH2_1_MIR);
+                omap_writel(~0x0, OMAP_IH2_2_MIR);
+                omap_writel(~0x0, OMAP_IH2_3_MIR);
+        }
+
+        /*  New IRQ agreement, recalculate in cascade order */
+        omap_writel(1, OMAP_IH2_CONTROL);
+        omap_writel(1, OMAP_IH1_CONTROL);
+}
+
+#define EN_DSPCK        13      /* ARM_CKCTL */
+#define EN_APICK        6       /* ARM_IDLECT2 */
+#define DSP_EN          1       /* ARM_RSTCT1 */
+
+void omap_pm_suspend(void)
+{
+        unsigned long arg0 = 0, arg1 = 0;
+
+        printk("PM: OMAP%x is trying to enter deep sleep...\n", system_rev);
+
+        omap_serial_wake_trigger(1);
+
+        if (machine_is_omap_osk()) {
+                /* Stop LED1 (D9) blink */
+                tps65010_set_led(LED1, OFF);
+        }
+
+        omap_writew(0xffff, ULPD_SOFT_DISABLE_REQ_REG);
+
+        /*
+         * Step 1: turn off interrupts (FIXME: NOTE: already disabled)
+         */
+
+        local_irq_disable();
+        local_fiq_disable();
+
+        /*
+         * Step 2: save registers
+         *
+         * The omap is a strange/beautiful device. The caches, memory
+         * and register state are preserved across power saves.
+         * We have to save and restore very little register state to
+         * idle the omap.
+         *
+         * Save interrupt, MPUI, ARM and UPLD control registers.
+         */
+
+        if (cpu_is_omap730()) {
+                MPUI730_SAVE(OMAP_IH1_MIR);
+                MPUI730_SAVE(OMAP_IH2_0_MIR);
+                MPUI730_SAVE(OMAP_IH2_1_MIR);
+                MPUI730_SAVE(MPUI_CTRL);
+                MPUI730_SAVE(MPUI_DSP_BOOT_CONFIG);
+                MPUI730_SAVE(MPUI_DSP_API_CONFIG);
+                MPUI730_SAVE(EMIFS_CONFIG);
+                MPUI730_SAVE(EMIFF_SDRAM_CONFIG);
+
+        } else if (cpu_is_omap15xx()) {
+                MPUI1510_SAVE(OMAP_IH1_MIR);
+                MPUI1510_SAVE(OMAP_IH2_MIR);
+                MPUI1510_SAVE(MPUI_CTRL);
+                MPUI1510_SAVE(MPUI_DSP_BOOT_CONFIG);
+                MPUI1510_SAVE(MPUI_DSP_API_CONFIG);
+                MPUI1510_SAVE(EMIFS_CONFIG);
+                MPUI1510_SAVE(EMIFF_SDRAM_CONFIG);
+        } else if (cpu_is_omap16xx()) {
+                MPUI1610_SAVE(OMAP_IH1_MIR);
+                MPUI1610_SAVE(OMAP_IH2_0_MIR);
+                MPUI1610_SAVE(OMAP_IH2_1_MIR);
+                MPUI1610_SAVE(OMAP_IH2_2_MIR);
+                MPUI1610_SAVE(OMAP_IH2_3_MIR);
+                MPUI1610_SAVE(MPUI_CTRL);
+                MPUI1610_SAVE(MPUI_DSP_BOOT_CONFIG);
+                MPUI1610_SAVE(MPUI_DSP_API_CONFIG);
+                MPUI1610_SAVE(EMIFS_CONFIG);
+                MPUI1610_SAVE(EMIFF_SDRAM_CONFIG);
+        }
+
+        ARM_SAVE(ARM_CKCTL);
+        ARM_SAVE(ARM_IDLECT1);
+        ARM_SAVE(ARM_IDLECT2);
+        if (!(cpu_is_omap15xx()))
+                ARM_SAVE(ARM_IDLECT3);
+        ARM_SAVE(ARM_EWUPCT);
+        ARM_SAVE(ARM_RSTCT1);
+        ARM_SAVE(ARM_RSTCT2);
+        ARM_SAVE(ARM_SYSST);
+        ULPD_SAVE(ULPD_CLOCK_CTRL);
+        ULPD_SAVE(ULPD_STATUS_REQ);
+
+        /* (Step 3 removed - we now allow deep sleep by default) */
+
+        /*
+         * Step 4: OMAP DSP Shutdown
+         */
+
+        /* stop DSP */
+        omap_writew(omap_readw(ARM_RSTCT1) & ~(1 << DSP_EN), ARM_RSTCT1);
+
+        /* shut down dsp_ck */
+        omap_writew(omap_readw(ARM_CKCTL) & ~(1 << EN_DSPCK), ARM_CKCTL);
+
+        /* temporarily enabling api_ck to access DSP registers */
+        omap_writew(omap_readw(ARM_IDLECT2) | 1 << EN_APICK, ARM_IDLECT2);
+
+        /* save DSP registers */
+        DSP_SAVE(DSP_IDLECT2);
+
+        /* Stop all DSP domain clocks */
+        __raw_writew(0, DSP_IDLECT2);
+
+        /*
+         * Step 5: Wakeup Event Setup
+         */
+
+        omap_pm_wakeup_setup();
+
+        /*
+         * Step 6: ARM and Traffic controller shutdown
+         */
+
+        /* disable ARM watchdog */
+        omap_writel(0x00F5, OMAP_WDT_TIMER_MODE);
+        omap_writel(0x00A0, OMAP_WDT_TIMER_MODE);
+
+        /*
+         * Step 6b: ARM and Traffic controller shutdown
+         *
+         * Step 6 continues here. Prepare jump to power management
+         * assembly code in internal SRAM.
+         *
+         * Since the omap_cpu_suspend routine has been copied to
+         * SRAM, we'll do an indirect procedure call to it and pass the
+         * contents of arm_idlect1 and arm_idlect2 so it can restore
+         * them when it wakes up and it will return.
+         */
+
+        arg0 = arm_sleep_save[ARM_SLEEP_SAVE_ARM_IDLECT1];
+        arg1 = arm_sleep_save[ARM_SLEEP_SAVE_ARM_IDLECT2];
+
+        /*
+         * Step 6c: ARM and Traffic controller shutdown
+         *
+         * Jump to assembly code. The processor will stay there
+         * until wake up.
+         */
+        omap_sram_suspend(arg0, arg1);
+
+        /*
+         * If we are here, processor is woken up!
+         */
+
+        /*
+         * Restore DSP clocks
+         */
+
+        /* again temporarily enabling api_ck to access DSP registers */
+        omap_writew(omap_readw(ARM_IDLECT2) | 1 << EN_APICK, ARM_IDLECT2);
+
+        /* Restore DSP domain clocks */
+        DSP_RESTORE(DSP_IDLECT2);
+
+        /*
+         * Restore ARM state, except ARM_IDLECT1/2 which omap_cpu_suspend did
+         */
+
+        if (!(cpu_is_omap15xx()))
+                ARM_RESTORE(ARM_IDLECT3);
+        ARM_RESTORE(ARM_CKCTL);
+        ARM_RESTORE(ARM_EWUPCT);
+        ARM_RESTORE(ARM_RSTCT1);
+        ARM_RESTORE(ARM_RSTCT2);
+        ARM_RESTORE(ARM_SYSST);
+        ULPD_RESTORE(ULPD_CLOCK_CTRL);
+        ULPD_RESTORE(ULPD_STATUS_REQ);
+
+        if (cpu_is_omap730()) {
+                MPUI730_RESTORE(EMIFS_CONFIG);
+                MPUI730_RESTORE(EMIFF_SDRAM_CONFIG);
+                MPUI730_RESTORE(OMAP_IH1_MIR);
+                MPUI730_RESTORE(OMAP_IH2_0_MIR);
+                MPUI730_RESTORE(OMAP_IH2_1_MIR);
+        } else if (cpu_is_omap15xx()) {
+                MPUI1510_RESTORE(MPUI_CTRL);
+                MPUI1510_RESTORE(MPUI_DSP_BOOT_CONFIG);
+                MPUI1510_RESTORE(MPUI_DSP_API_CONFIG);
+                MPUI1510_RESTORE(EMIFS_CONFIG);
+                MPUI1510_RESTORE(EMIFF_SDRAM_CONFIG);
+                MPUI1510_RESTORE(OMAP_IH1_MIR);
+                MPUI1510_RESTORE(OMAP_IH2_MIR);
+        } else if (cpu_is_omap16xx()) {
+                MPUI1610_RESTORE(MPUI_CTRL);
+                MPUI1610_RESTORE(MPUI_DSP_BOOT_CONFIG);
+                MPUI1610_RESTORE(MPUI_DSP_API_CONFIG);
+                MPUI1610_RESTORE(EMIFS_CONFIG);
+                MPUI1610_RESTORE(EMIFF_SDRAM_CONFIG);
+
+                MPUI1610_RESTORE(OMAP_IH1_MIR);
+                MPUI1610_RESTORE(OMAP_IH2_0_MIR);
+                MPUI1610_RESTORE(OMAP_IH2_1_MIR);
+                MPUI1610_RESTORE(OMAP_IH2_2_MIR);
+                MPUI1610_RESTORE(OMAP_IH2_3_MIR);
+        }
+
+        omap_writew(0, ULPD_SOFT_DISABLE_REQ_REG);
+
+        /*
+         * Reenable interrupts
+         */
+
+        local_irq_enable();
+        local_fiq_enable();
+
+        omap_serial_wake_trigger(0);
+
+        printk("PM: OMAP%x is re-starting from deep sleep...\n", system_rev);
+
+        if (machine_is_omap_osk()) {
+                /* Let LED1 (D9) blink again */
+                tps65010_set_led(LED1, BLINK);
+        }
+}
+
+#if defined(DEBUG) && defined(CONFIG_PROC_FS)
+static int g_read_completed;
+
+/*
+ * Read system PM registers for debugging
+ */
+static int omap_pm_read_proc(
+        char *page_buffer,
+        char **my_first_byte,
+        off_t virtual_start,
+        int length,
+        int *eof,
+        void *data)
+{
+        int my_buffer_offset = 0;
+        char * const my_base = page_buffer;
+
+        ARM_SAVE(ARM_CKCTL);
+        ARM_SAVE(ARM_IDLECT1);
+        ARM_SAVE(ARM_IDLECT2);
+        if (!(cpu_is_omap15xx()))
+                ARM_SAVE(ARM_IDLECT3);
+        ARM_SAVE(ARM_EWUPCT);
+        ARM_SAVE(ARM_RSTCT1);
+        ARM_SAVE(ARM_RSTCT2);
+        ARM_SAVE(ARM_SYSST);
+
+        ULPD_SAVE(ULPD_IT_STATUS);
+        ULPD_SAVE(ULPD_CLOCK_CTRL);
+        ULPD_SAVE(ULPD_SOFT_REQ);
+        ULPD_SAVE(ULPD_STATUS_REQ);
+        ULPD_SAVE(ULPD_DPLL_CTRL);
+        ULPD_SAVE(ULPD_POWER_CTRL);
+
+        if (cpu_is_omap730()) {
+                MPUI730_SAVE(MPUI_CTRL);
+                MPUI730_SAVE(MPUI_DSP_STATUS);
+                MPUI730_SAVE(MPUI_DSP_BOOT_CONFIG);
+                MPUI730_SAVE(MPUI_DSP_API_CONFIG);
+                MPUI730_SAVE(EMIFF_SDRAM_CONFIG);
+                MPUI730_SAVE(EMIFS_CONFIG);
+        } else if (cpu_is_omap15xx()) {
+                MPUI1510_SAVE(MPUI_CTRL);
+                MPUI1510_SAVE(MPUI_DSP_STATUS);
+                MPUI1510_SAVE(MPUI_DSP_BOOT_CONFIG);
+                MPUI1510_SAVE(MPUI_DSP_API_CONFIG);
+                MPUI1510_SAVE(EMIFF_SDRAM_CONFIG);
+                MPUI1510_SAVE(EMIFS_CONFIG);
+        } else if (cpu_is_omap16xx()) {
+                MPUI1610_SAVE(MPUI_CTRL);
+                MPUI1610_SAVE(MPUI_DSP_STATUS);
+                MPUI1610_SAVE(MPUI_DSP_BOOT_CONFIG);
+                MPUI1610_SAVE(MPUI_DSP_API_CONFIG);
+                MPUI1610_SAVE(EMIFF_SDRAM_CONFIG);
+                MPUI1610_SAVE(EMIFS_CONFIG);
+        }
+
+        if (virtual_start == 0) {
+                g_read_completed = 0;
+
+                my_buffer_offset += sprintf(my_base + my_buffer_offset,
+                   "ARM_CKCTL_REG:            0x%-8x     \n"
+                   "ARM_IDLECT1_REG:          0x%-8x     \n"
+                   "ARM_IDLECT2_REG:          0x%-8x     \n"
+                   "ARM_IDLECT3_REG:          0x%-8x     \n"
+                   "ARM_EWUPCT_REG:           0x%-8x     \n"
+                   "ARM_RSTCT1_REG:           0x%-8x     \n"
+                   "ARM_RSTCT2_REG:           0x%-8x     \n"
+                   "ARM_SYSST_REG:            0x%-8x     \n"
+                   "ULPD_IT_STATUS_REG:       0x%-4x     \n"
+                   "ULPD_CLOCK_CTRL_REG:      0x%-4x     \n"
+                   "ULPD_SOFT_REQ_REG:        0x%-4x     \n"
+                   "ULPD_DPLL_CTRL_REG:       0x%-4x     \n"
+                   "ULPD_STATUS_REQ_REG:      0x%-4x     \n"
+                   "ULPD_POWER_CTRL_REG:      0x%-4x     \n",
+                   ARM_SHOW(ARM_CKCTL),
+                   ARM_SHOW(ARM_IDLECT1),
+                   ARM_SHOW(ARM_IDLECT2),
+                   ARM_SHOW(ARM_IDLECT3),
+                   ARM_SHOW(ARM_EWUPCT),
+                   ARM_SHOW(ARM_RSTCT1),
+                   ARM_SHOW(ARM_RSTCT2),
+                   ARM_SHOW(ARM_SYSST),
+                   ULPD_SHOW(ULPD_IT_STATUS),
+                   ULPD_SHOW(ULPD_CLOCK_CTRL),
+                   ULPD_SHOW(ULPD_SOFT_REQ),
+                   ULPD_SHOW(ULPD_DPLL_CTRL),
+                   ULPD_SHOW(ULPD_STATUS_REQ),
+                   ULPD_SHOW(ULPD_POWER_CTRL));
+
+                if (cpu_is_omap730()) {
+                        my_buffer_offset += sprintf(my_base + my_buffer_offset,
+                           "MPUI730_CTRL_REG         0x%-8x \n"
+                           "MPUI730_DSP_STATUS_REG:      0x%-8x \n"
+                           "MPUI730_DSP_BOOT_CONFIG_REG: 0x%-8x \n"
+                           "MPUI730_DSP_API_CONFIG_REG:  0x%-8x \n"
+                           "MPUI730_SDRAM_CONFIG_REG:    0x%-8x \n"
+                           "MPUI730_EMIFS_CONFIG_REG:    0x%-8x \n",
+                           MPUI730_SHOW(MPUI_CTRL),
+                           MPUI730_SHOW(MPUI_DSP_STATUS),
+                           MPUI730_SHOW(MPUI_DSP_BOOT_CONFIG),
+                           MPUI730_SHOW(MPUI_DSP_API_CONFIG),
+                           MPUI730_SHOW(EMIFF_SDRAM_CONFIG),
+                           MPUI730_SHOW(EMIFS_CONFIG));
+                } else if (cpu_is_omap15xx()) {
+                        my_buffer_offset += sprintf(my_base + my_buffer_offset,
+                           "MPUI1510_CTRL_REG             0x%-8x \n"
+                           "MPUI1510_DSP_STATUS_REG:      0x%-8x \n"
+                           "MPUI1510_DSP_BOOT_CONFIG_REG: 0x%-8x \n"
+                           "MPUI1510_DSP_API_CONFIG_REG:  0x%-8x \n"
+                           "MPUI1510_SDRAM_CONFIG_REG:    0x%-8x \n"
+                           "MPUI1510_EMIFS_CONFIG_REG:    0x%-8x \n",
+                           MPUI1510_SHOW(MPUI_CTRL),
+                           MPUI1510_SHOW(MPUI_DSP_STATUS),
+                           MPUI1510_SHOW(MPUI_DSP_BOOT_CONFIG),
+                           MPUI1510_SHOW(MPUI_DSP_API_CONFIG),
+                           MPUI1510_SHOW(EMIFF_SDRAM_CONFIG),
+                           MPUI1510_SHOW(EMIFS_CONFIG));
+                } else if (cpu_is_omap16xx()) {
+                        my_buffer_offset += sprintf(my_base + my_buffer_offset,
+                           "MPUI1610_CTRL_REG             0x%-8x \n"
+                           "MPUI1610_DSP_STATUS_REG:      0x%-8x \n"
+                           "MPUI1610_DSP_BOOT_CONFIG_REG: 0x%-8x \n"
+                           "MPUI1610_DSP_API_CONFIG_REG:  0x%-8x \n"
+                           "MPUI1610_SDRAM_CONFIG_REG:    0x%-8x \n"
+                           "MPUI1610_EMIFS_CONFIG_REG:    0x%-8x \n",
+                           MPUI1610_SHOW(MPUI_CTRL),
+                           MPUI1610_SHOW(MPUI_DSP_STATUS),
+                           MPUI1610_SHOW(MPUI_DSP_BOOT_CONFIG),
+                           MPUI1610_SHOW(MPUI_DSP_API_CONFIG),
+                           MPUI1610_SHOW(EMIFF_SDRAM_CONFIG),
+                           MPUI1610_SHOW(EMIFS_CONFIG));
+                }
+
+                g_read_completed++;
+        } else if (g_read_completed >= 1) {
+                 *eof = 1;
+                 return 0;
+        }
+        g_read_completed++;
+
+        *my_first_byte = page_buffer;
+        return  my_buffer_offset;
+}
+
+static void omap_pm_init_proc(void)
+{
+        struct proc_dir_entry *entry;
+
+        entry = create_proc_read_entry("driver/omap_pm",
+                                       S_IWUSR | S_IRUGO, NULL,
+                                       omap_pm_read_proc, NULL);
+}
+
+#endif /* DEBUG && CONFIG_PROC_FS */
+
+static void (*saved_idle)(void) = NULL;
+
+/*
+ *      omap_pm_prepare - Do preliminary suspend work.
+ *      @state:         suspend state we're entering.
+ *
+ */
+static int omap_pm_prepare(suspend_state_t state)
+{
+        int error = 0;
+
+        /* We cannot sleep in idle until we have resumed */
+        saved_idle = pm_idle;
+        pm_idle = NULL;
+
+        switch (state)
+        {
+        case PM_SUSPEND_STANDBY:
+        case PM_SUSPEND_MEM:
+                break;
+
+        case PM_SUSPEND_DISK:
+                return -ENOTSUPP;
+
+        default:
+                return -EINVAL;
+        }
+
+        return error;
+}
+
+
+/*
+ *      omap_pm_enter - Actually enter a sleep state.
+ *      @state:         State we're entering.
+ *
+ */
+
+static int omap_pm_enter(suspend_state_t state)
+{
+        switch (state)
+        {
+        case PM_SUSPEND_STANDBY:
+        case PM_SUSPEND_MEM:
+                omap_pm_suspend();
+                break;
+
+        case PM_SUSPEND_DISK:
+                return -ENOTSUPP;
+
+        default:
+                return -EINVAL;
+        }
+
+        return 0;
+}
+
+
+/**
+ *      omap_pm_finish - Finish up suspend sequence.
+ *      @state:         State we're coming out of.
+ *
+ *      This is called after we wake back up (or if entering the sleep state
+ *      failed).
+ */
+
+static int omap_pm_finish(suspend_state_t state)
+{
+        pm_idle = saved_idle;
+        return 0;
+}
+
+
+static irqreturn_t  omap_wakeup_interrupt(int  irq, void *  dev,
+                                     struct pt_regs *  regs)
+{
+        return IRQ_HANDLED;
+}
+
+static struct irqaction omap_wakeup_irq = {
+        .name           = "peripheral wakeup",
+        .flags          = SA_INTERRUPT,
+        .handler        = omap_wakeup_interrupt
+};
+
+
+
+static struct pm_ops omap_pm_ops ={
+        .pm_disk_mode   = 0,
+        .prepare        = omap_pm_prepare,
+        .enter          = omap_pm_enter,
+        .finish         = omap_pm_finish,
+};
+
+static int __init omap_pm_init(void)
+{
+        printk("Power Management for TI OMAP.\n");
+
+        /*
+         * We copy the assembler sleep/wakeup routines to SRAM.
+         * These routines need to be in SRAM as that's the only
+         * memory the MPU can see when it wakes up.
+         */
+        if (cpu_is_omap730()) {
+                omap_sram_idle = omap_sram_push(omap730_idle_loop_suspend,
+                                                omap730_idle_loop_suspend_sz);
+                omap_sram_suspend = omap_sram_push(omap730_cpu_suspend,
+                                                   omap730_cpu_suspend_sz);
+        } else if (cpu_is_omap15xx()) {
+                omap_sram_idle = omap_sram_push(omap1510_idle_loop_suspend,
+                                                omap1510_idle_loop_suspend_sz);
+                omap_sram_suspend = omap_sram_push(omap1510_cpu_suspend,
+                                                   omap1510_cpu_suspend_sz);
+        } else if (cpu_is_omap16xx()) {
+                omap_sram_idle = omap_sram_push(omap1610_idle_loop_suspend,
+                                                omap1610_idle_loop_suspend_sz);
+                omap_sram_suspend = omap_sram_push(omap1610_cpu_suspend,
+                                                   omap1610_cpu_suspend_sz);
+        }
+
+        if (omap_sram_idle == NULL || omap_sram_suspend == NULL) {
+                printk(KERN_ERR "PM not initialized: Missing SRAM support\n");
+                return -ENODEV;
+        }
+
+        pm_idle = omap_pm_idle;
+
+        if (cpu_is_omap730())
+                setup_irq(INT_730_WAKE_UP_REQ, &omap_wakeup_irq);
+        else if (cpu_is_omap16xx())
+                setup_irq(INT_1610_WAKE_UP_REQ, &omap_wakeup_irq);
+
+        /* Program new power ramp-up time
+         * (0 for most boards since we don't lower voltage when in deep sleep)
+         */
+        omap_writew(ULPD_SETUP_ANALOG_CELL_3_VAL, ULPD_SETUP_ANALOG_CELL_3);
+
+        /* Setup ULPD POWER_CTRL_REG - enter deep sleep whenever possible */
+        omap_writew(ULPD_POWER_CTRL_REG_VAL, ULPD_POWER_CTRL);
+
+        /* Configure IDLECT3 */
+        if (cpu_is_omap730())
+                omap_writel(OMAP730_IDLECT3_VAL, OMAP730_IDLECT3);
+        else if (cpu_is_omap16xx())
+                omap_writel(OMAP1610_IDLECT3_VAL, OMAP1610_IDLECT3);
+
+        pm_set_ops(&omap_pm_ops);
+
+#if defined(DEBUG) && defined(CONFIG_PROC_FS)
+        omap_pm_init_proc();
+#endif
+
+        subsys_create_file(&power_subsys, &sleep_while_idle_attr);
+
+        if (cpu_is_omap16xx()) {
+                /* configure LOW_PWR pin */
+                omap_cfg_reg(T20_1610_LOW_PWR);
+        }
+
+        return 0;
+}
+__initcall(omap_pm_init);
diff --git a/arch/arm/mach-omap1/serial.c b/arch/arm/mach-omap1/serial.c
index e924e0c6a4ce..9b4cd698bec8 100644
--- a/arch/arm/mach-omap1/serial.c
+++ b/arch/arm/mach-omap1/serial.c
@@ -30,9 +30,9 @@
 #include <asm/arch/pm.h>
 #endif
 
-static struct clk * uart1_ck = NULL;
-static struct clk * uart2_ck = NULL;
-static struct clk * uart3_ck = NULL;
+static struct clk * uart1_ck;
+static struct clk * uart2_ck;
+static struct clk * uart3_ck;
 
 static inline unsigned int omap_serial_in(struct plat_serial8250_port *up,
                                           int offset)
diff --git a/arch/arm/plat-omap/sleep.S b/arch/arm/mach-omap1/sleep.S
index 4cd7d292f854..e58295e2d3b2 100644
--- a/arch/arm/plat-omap/sleep.S
+++ b/arch/arm/mach-omap1/sleep.S
@@ -1,5 +1,5 @@
 /*
- * linux/arch/arm/plat-omap/sleep.S
+ * linux/arch/arm/mach-omap1/sleep.S
  *
  * Low-level OMAP730/1510/1610 sleep/wakeUp support
  *
@@ -383,60 +383,133 @@ ENTRY(omap1610_cpu_suspend)
         mcr     p15, 0, r0, c7, c10, 4
         nop
 
-        @ load base address of Traffic Controller
+        @ Load base address of Traffic Controller
         mov     r6, #TCMIF_ASM_BASE & 0xff000000
         orr     r6, r6, #TCMIF_ASM_BASE & 0x00ff0000
         orr     r6, r6, #TCMIF_ASM_BASE & 0x0000ff00
 
-        @ prepare to put SDRAM into self-refresh manually
+        @ Prepare to put SDRAM into self-refresh manually
         ldr     r7, [r6, #EMIFF_SDRAM_CONFIG_ASM_OFFSET & 0xff]
         orr     r9, r7, #SELF_REFRESH_MODE & 0xff000000
         orr     r9, r9, #SELF_REFRESH_MODE & 0x000000ff
         str     r9, [r6, #EMIFF_SDRAM_CONFIG_ASM_OFFSET & 0xff]
 
-        @ prepare to put EMIFS to Sleep
+        @ Prepare to put EMIFS to Sleep
         ldr     r8, [r6, #EMIFS_CONFIG_ASM_OFFSET & 0xff]
         orr     r9, r8, #IDLE_EMIFS_REQUEST & 0xff
         str     r9, [r6, #EMIFS_CONFIG_ASM_OFFSET & 0xff]
 
-        @ load base address of ARM_IDLECT1 and ARM_IDLECT2
+        @ Load base address of ARM_IDLECT1 and ARM_IDLECT2
         mov     r4, #CLKGEN_REG_ASM_BASE & 0xff000000
         orr     r4, r4, #CLKGEN_REG_ASM_BASE & 0x00ff0000
         orr     r4, r4, #CLKGEN_REG_ASM_BASE & 0x0000ff00
 
-        @ turn off clock domains
-        @ do not disable PERCK (0x04)
+        @ Turn off clock domains
+        @ Do not disable PERCK (0x04)
         mov     r5, #OMAP1610_IDLECT2_SLEEP_VAL & 0xff
         orr     r5, r5, #OMAP1610_IDLECT2_SLEEP_VAL & 0xff00
         strh    r5, [r4, #ARM_IDLECT2_ASM_OFFSET & 0xff]
 
-        @ request ARM idle
+        @ Request ARM idle
         mov     r3, #OMAP1610_IDLECT1_SLEEP_VAL & 0xff
         orr     r3, r3, #OMAP1610_IDLECT1_SLEEP_VAL & 0xff00
         strh    r3, [r4, #ARM_IDLECT1_ASM_OFFSET & 0xff]
 
-        @ disable instruction cache
-        mrc     p15, 0, r9, c1, c0, 0
-        bic     r2, r9, #0x1000
-        mcr     p15, 0, r2, c1, c0, 0
-        nop
-
 /*
  * Let's wait for the next wake up event to wake us up. r0 can't be
  * used here because r0 holds ARM_IDLECT1
  */
         mov     r2, #0
         mcr     p15, 0, r2, c7, c0, 4           @ wait for interrupt
+
+        @ Errata (HEL3SU467, section 1.4.4) specifies nop-instructions
+        @ according to this formula:
+        @ 2 + (4*DPLL_MULT)/DPLL_DIV/ARMDIV
+        @ Max DPLL_MULT = 18
+        @ DPLL_DIV = 1
+        @ ARMDIV = 1
+        @ => 74 nop-instructions
+        nop
+        nop
+        nop
+        nop
+        nop
+        nop
+        nop
+        nop
+        nop
+        nop     @10
+        nop
+        nop
+        nop
+        nop
+        nop
+        nop
+        nop
+        nop
+        nop
+        nop     @20
+        nop
+        nop
+        nop
+        nop
+        nop
+        nop
+        nop
+        nop
+        nop
+        nop     @30
+        nop
+        nop
+        nop
+        nop
+        nop
+        nop
+        nop
+        nop
+        nop
+        nop     @40
+        nop
+        nop
+        nop
+        nop
+        nop
+        nop
+        nop
+        nop
+        nop
+        nop     @50
+        nop
+        nop
+        nop
+        nop
+        nop
+        nop
+        nop
+        nop
+        nop
+        nop     @60
+        nop
+        nop
+        nop
+        nop
+        nop
+        nop
+        nop
+        nop
+        nop
+        nop     @70
+        nop
+        nop
+        nop
+        nop     @74
 /*
  * omap1610_cpu_suspend()'s resume point.
  *
  * It will just start executing here, so we'll restore stuff from the
  * stack.
  */
-        @ re-enable Icache
-        mcr     p15, 0, r9, c1, c0, 0
-
-        @ reset the ARM_IDLECT1 and ARM_IDLECT2.
+        @ Restore the ARM_IDLECT1 and ARM_IDLECT2.
         strh    r1, [r4, #ARM_IDLECT2_ASM_OFFSET & 0xff]
         strh    r0, [r4, #ARM_IDLECT1_ASM_OFFSET & 0xff]
 
@@ -444,7 +517,7 @@ ENTRY(omap1610_cpu_suspend)
         str     r7, [r6, #EMIFF_SDRAM_CONFIG_ASM_OFFSET & 0xff]
         str     r8, [r6, #EMIFS_CONFIG_ASM_OFFSET & 0xff]
 
-        @ restore regs and return
+        @ Restore regs and return
         ldmfd   sp!, {r0 - r12, pc}
 
 ENTRY(omap1610_cpu_suspend_sz)
diff --git a/arch/arm/mach-omap1/time.c b/arch/arm/mach-omap1/time.c
index cdbf4d7620c6..a85fe6066bc4 100644
--- a/arch/arm/mach-omap1/time.c
+++ b/arch/arm/mach-omap1/time.c
@@ -51,8 +51,6 @@
 
 struct sys_timer omap_timer;
 
-#ifdef CONFIG_OMAP_MPU_TIMER
-
 /*
  * ---------------------------------------------------------------------------
  * MPU timer
@@ -222,195 +220,6 @@ unsigned long long sched_clock(void)
 
         return cycles_2_ns(ticks64);
 }
-#endif  /* CONFIG_OMAP_MPU_TIMER */
-
-#ifdef CONFIG_OMAP_32K_TIMER
-
-#ifdef CONFIG_ARCH_OMAP15XX
-#error OMAP 32KHz timer does not currently work on 15XX!
-#endif
-
-/*
- * ---------------------------------------------------------------------------
- * 32KHz OS timer
- *
- * This currently works only on 16xx, as 1510 does not have the continuous
- * 32KHz synchronous timer. The 32KHz synchronous timer is used to keep track
- * of time in addition to the 32KHz OS timer. Using only the 32KHz OS timer
- * on 1510 would be possible, but the timer would not be as accurate as
- * with the 32KHz synchronized timer.
- * ---------------------------------------------------------------------------
- */
-#define OMAP_32K_TIMER_BASE             0xfffb9000
-#define OMAP_32K_TIMER_CR               0x08
-#define OMAP_32K_TIMER_TVR              0x00
-#define OMAP_32K_TIMER_TCR              0x04
-
-#define OMAP_32K_TICKS_PER_HZ           (32768 / HZ)
-
-/*
- * TRM says 1 / HZ = ( TVR + 1) / 32768, so TRV = (32768 / HZ) - 1
- * so with HZ = 100, TVR = 327.68.
- */
-#define OMAP_32K_TIMER_TICK_PERIOD      ((32768 / HZ) - 1)
-#define TIMER_32K_SYNCHRONIZED          0xfffbc410
-
-#define JIFFIES_TO_HW_TICKS(nr_jiffies, clock_rate)                     \
-                                (((nr_jiffies) * (clock_rate)) / HZ)
-
-static inline void omap_32k_timer_write(int val, int reg)
-{
-        omap_writew(val, reg + OMAP_32K_TIMER_BASE);
-}
-
-static inline unsigned long omap_32k_timer_read(int reg)
-{
-        return omap_readl(reg + OMAP_32K_TIMER_BASE) & 0xffffff;
-}
-
-/*
- * The 32KHz synchronized timer is an additional timer on 16xx.
- * It is always running.
- */
-static inline unsigned long omap_32k_sync_timer_read(void)
-{
-        return omap_readl(TIMER_32K_SYNCHRONIZED);
-}
-
-static inline void omap_32k_timer_start(unsigned long load_val)
-{
-        omap_32k_timer_write(load_val, OMAP_32K_TIMER_TVR);
-        omap_32k_timer_write(0x0f, OMAP_32K_TIMER_CR);
-}
-
-static inline void omap_32k_timer_stop(void)
-{
-        omap_32k_timer_write(0x0, OMAP_32K_TIMER_CR);
-}
-
-/*
- * Rounds down to nearest usec. Note that this will overflow for larger values.
- */
-static inline unsigned long omap_32k_ticks_to_usecs(unsigned long ticks_32k)
-{
-        return (ticks_32k * 5*5*5*5*5*5) >> 9;
-}
-
-/*
- * Rounds down to nearest nsec.
- */
-static inline unsigned long long
-omap_32k_ticks_to_nsecs(unsigned long ticks_32k)
-{
-        return (unsigned long long) ticks_32k * 1000 * 5*5*5*5*5*5 >> 9;
-}
-
-static unsigned long omap_32k_last_tick = 0;
-
-/*
- * Returns elapsed usecs since last 32k timer interrupt
- */
-static unsigned long omap_32k_timer_gettimeoffset(void)
-{
-        unsigned long now = omap_32k_sync_timer_read();
-        return omap_32k_ticks_to_usecs(now - omap_32k_last_tick);
-}
-
-/*
- * Returns current time from boot in nsecs. It's OK for this to wrap
- * around for now, as it's just a relative time stamp.
- */
-unsigned long long sched_clock(void)
-{
-        return omap_32k_ticks_to_nsecs(omap_32k_sync_timer_read());
-}
-
-/*
- * Timer interrupt for 32KHz timer. When dynamic tick is enabled, this
- * function is also called from other interrupts to remove latency
- * issues with dynamic tick. In the dynamic tick case, we need to lock
- * with irqsave.
- */
-static irqreturn_t omap_32k_timer_interrupt(int irq, void *dev_id,
-                                            struct pt_regs *regs)
-{
-        unsigned long flags;
-        unsigned long now;
-
-        write_seqlock_irqsave(&xtime_lock, flags);
-        now = omap_32k_sync_timer_read();
-
-        while (now - omap_32k_last_tick >= OMAP_32K_TICKS_PER_HZ) {
-                omap_32k_last_tick += OMAP_32K_TICKS_PER_HZ;
-                timer_tick(regs);
-        }
-
-        /* Restart timer so we don't drift off due to modulo or dynamic tick.
-         * By default we program the next timer to be continuous to avoid
-         * latencies during high system load. During dynamic tick operation the
-         * continuous timer can be overridden from pm_idle to be longer.
-         */
-        omap_32k_timer_start(omap_32k_last_tick + OMAP_32K_TICKS_PER_HZ - now);
-        write_sequnlock_irqrestore(&xtime_lock, flags);
-
-        return IRQ_HANDLED;
-}
-
-#ifdef CONFIG_NO_IDLE_HZ
-/*
- * Programs the next timer interrupt needed. Called when dynamic tick is
- * enabled, and to reprogram the ticks to skip from pm_idle. Note that
- * we can keep the timer continuous, and don't need to set it to run in
- * one-shot mode. This is because the timer will get reprogrammed again
- * after next interrupt.
- */
-void omap_32k_timer_reprogram(unsigned long next_tick)
-{
-        omap_32k_timer_start(JIFFIES_TO_HW_TICKS(next_tick, 32768) + 1);
-}
-
-static struct irqaction omap_32k_timer_irq;
-extern struct timer_update_handler timer_update;
-
-static int omap_32k_timer_enable_dyn_tick(void)
-{
-        /* No need to reprogram timer, just use the next interrupt */
-        return 0;
-}
-
-static int omap_32k_timer_disable_dyn_tick(void)
-{
-        omap_32k_timer_start(OMAP_32K_TIMER_TICK_PERIOD);
-        return 0;
-}
-
-static struct dyn_tick_timer omap_dyn_tick_timer = {
-        .enable         = omap_32k_timer_enable_dyn_tick,
-        .disable        = omap_32k_timer_disable_dyn_tick,
-        .reprogram      = omap_32k_timer_reprogram,
-        .handler        = omap_32k_timer_interrupt,
-};
-#endif  /* CONFIG_NO_IDLE_HZ */
-
-static struct irqaction omap_32k_timer_irq = {
-        .name           = "32KHz timer",
-        .flags          = SA_INTERRUPT | SA_TIMER,
-        .handler        = omap_32k_timer_interrupt,
-};
-
-static __init void omap_init_32k_timer(void)
-{
-
-#ifdef CONFIG_NO_IDLE_HZ
-        omap_timer.dyn_tick = &omap_dyn_tick_timer;
-#endif
-
-        setup_irq(INT_OS_TIMER, &omap_32k_timer_irq);
-        omap_timer.offset  = omap_32k_timer_gettimeoffset;
-        omap_32k_last_tick = omap_32k_sync_timer_read();
-        omap_32k_timer_start(OMAP_32K_TIMER_TICK_PERIOD);
-}
-#endif  /* CONFIG_OMAP_32K_TIMER */
 
 /*
  * ---------------------------------------------------------------------------
@@ -419,13 +228,7 @@ static __init void omap_init_32k_timer(void)
  */
 static void __init omap_timer_init(void)
 {
-#if defined(CONFIG_OMAP_MPU_TIMER)
         omap_init_mpu_timer();
-#elif defined(CONFIG_OMAP_32K_TIMER)
-        omap_init_32k_timer();
-#else
-#error No system timer selected in Kconfig!
-#endif
 }
 
 struct sys_timer omap_timer = {
diff --git a/arch/arm/mach-omap2/Kconfig b/arch/arm/mach-omap2/Kconfig
index 578880943cf2..537dd2e6d380 100644
--- a/arch/arm/mach-omap2/Kconfig
+++ b/arch/arm/mach-omap2/Kconfig
@@ -20,3 +20,6 @@ config MACH_OMAP_H4
         bool "OMAP 2420 H4 board"
         depends on ARCH_OMAP2 && ARCH_OMAP24XX
 
+config MACH_OMAP_APOLLON
+        bool "OMAP 2420 Apollon board"
+        depends on ARCH_OMAP2 && ARCH_OMAP24XX
diff --git a/arch/arm/mach-omap2/Makefile b/arch/arm/mach-omap2/Makefile
index 42041166435c..111eaa64258f 100644
--- a/arch/arm/mach-omap2/Makefile
+++ b/arch/arm/mach-omap2/Makefile
@@ -3,11 +3,15 @@
 #
 
 # Common support
-obj-y := irq.o id.o io.o sram-fn.o clock.o mux.o devices.o serial.o
+obj-y := irq.o id.o io.o sram-fn.o memory.o prcm.o clock.o mux.o devices.o serial.o
 
 obj-$(CONFIG_OMAP_MPU_TIMER)            += timer-gp.o
 
+# Power Management
+obj-$(CONFIG_PM) += pm.o sleep.o
+
 # Specific board support
 obj-$(CONFIG_MACH_OMAP_GENERIC)         += board-generic.o
 obj-$(CONFIG_MACH_OMAP_H4)              += board-h4.o
+obj-$(CONFIG_MACH_OMAP_APOLLON)         += board-apollon.o
 
diff --git a/arch/arm/mach-omap2/board-apollon.c b/arch/arm/mach-omap2/board-apollon.c
new file mode 100644
index 000000000000..6c6ba172cdf6
--- /dev/null
+++ b/arch/arm/mach-omap2/board-apollon.c
@@ -0,0 +1,285 @@
+/*
+ * linux/arch/arm/mach-omap/omap2/board-apollon.c
+ *
+ * Copyright (C) 2005,2006 Samsung Electronics
+ * Author: Kyungmin Park <kyungmin.park@samsung.com>
+ *
+ * Modified from mach-omap/omap2/board-h4.c
+ *
+ * Code for apollon OMAP2 board. Should work on many OMAP2 systems where
+ * the bootloader passes the board-specific data to the kernel.
+ * Do not put any board specific code to this file; create a new machine
+ * type if you need custom low-level initializations.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+
+#include <linux/kernel.h>
+#include <linux/init.h>
+#include <linux/platform_device.h>
+#include <linux/mtd/mtd.h>
+#include <linux/mtd/partitions.h>
+#include <linux/mtd/onenand.h>
+#include <linux/interrupt.h>
+#include <linux/delay.h>
+
+#include <asm/hardware.h>
+#include <asm/mach-types.h>
+#include <asm/mach/arch.h>
+#include <asm/mach/flash.h>
+
+#include <asm/arch/gpio.h>
+#include <asm/arch/mux.h>
+#include <asm/arch/usb.h>
+#include <asm/arch/board.h>
+#include <asm/arch/common.h>
+#include "prcm-regs.h"
+
+/* LED & Switch macros */
+#define LED0_GPIO13             13
+#define LED1_GPIO14             14
+#define LED2_GPIO15             15
+#define SW_ENTER_GPIO16         16
+#define SW_UP_GPIO17            17
+#define SW_DOWN_GPIO58          58
+
+static struct mtd_partition apollon_partitions[] = {
+        {
+                .name           = "X-Loader + U-Boot",
+                .offset         = 0,
+                .size           = SZ_128K,
+                .mask_flags     = MTD_WRITEABLE,
+        },
+        {
+                .name           = "params",
+                .offset         = MTDPART_OFS_APPEND,
+                .size           = SZ_128K,
+        },
+        {
+                .name           = "kernel",
+                .offset         = MTDPART_OFS_APPEND,
+                .size           = SZ_2M,
+        },
+        {
+                .name           = "rootfs",
+                .offset         = MTDPART_OFS_APPEND,
+                .size           = SZ_16M,
+        },
+        {
+                .name           = "filesystem00",
+                .offset         = MTDPART_OFS_APPEND,
+                .size           = SZ_32M,
+        },
+        {
+                .name           = "filesystem01",
+                .offset         = MTDPART_OFS_APPEND,
+                .size           = MTDPART_SIZ_FULL,
+        },
+};
+
+static struct flash_platform_data apollon_flash_data = {
+        .parts          = apollon_partitions,
+        .nr_parts       = ARRAY_SIZE(apollon_partitions),
+};
+
+static struct resource apollon_flash_resource = {
+        .start          = APOLLON_CS0_BASE,
+        .end            = APOLLON_CS0_BASE + SZ_128K,
+        .flags          = IORESOURCE_MEM,
+};
+
+static struct platform_device apollon_onenand_device = {
+        .name           = "onenand",
+        .id             = -1,
+        .dev            = {
+                .platform_data  = &apollon_flash_data,
+        },
+        .num_resources  = ARRAY_SIZE(&apollon_flash_resource),
+        .resource       = &apollon_flash_resource,
+};
+
+static struct resource apollon_smc91x_resources[] = {
+        [0] = {
+                .start  = APOLLON_ETHR_START,           /* Physical */
+                .end    = APOLLON_ETHR_START + 0xf,
+                .flags  = IORESOURCE_MEM,
+        },
+        [1] = {
+                .start  = OMAP_GPIO_IRQ(APOLLON_ETHR_GPIO_IRQ),
+                .end    = OMAP_GPIO_IRQ(APOLLON_ETHR_GPIO_IRQ),
+                .flags  = IORESOURCE_IRQ,
+        },
+};
+
+static struct platform_device apollon_smc91x_device = {
+        .name           = "smc91x",
+        .id             = -1,
+        .num_resources  = ARRAY_SIZE(apollon_smc91x_resources),
+        .resource       = apollon_smc91x_resources,
+};
+
+static struct platform_device apollon_lcd_device = {
+        .name           = "apollon_lcd",
+        .id             = -1,
+};
+
+static struct platform_device *apollon_devices[] __initdata = {
+        &apollon_onenand_device,
+        &apollon_smc91x_device,
+        &apollon_lcd_device,
+};
+
+static inline void __init apollon_init_smc91x(void)
+{
+        /* Make sure CS1 timings are correct */
+        GPMC_CONFIG1_1 = 0x00011203;
+        GPMC_CONFIG2_1 = 0x001f1f01;
+        GPMC_CONFIG3_1 = 0x00080803;
+        GPMC_CONFIG4_1 = 0x1c091c09;
+        GPMC_CONFIG5_1 = 0x041f1f1f;
+        GPMC_CONFIG6_1 = 0x000004c4;
+        GPMC_CONFIG7_1 = 0x00000f40 | (APOLLON_CS1_BASE >> 24);
+        udelay(100);
+
+        omap_cfg_reg(W4__24XX_GPIO74);
+        if (omap_request_gpio(APOLLON_ETHR_GPIO_IRQ) < 0) {
+                printk(KERN_ERR "Failed to request GPIO%d for smc91x IRQ\n",
+                        APOLLON_ETHR_GPIO_IRQ);
+                return;
+        }
+        omap_set_gpio_direction(APOLLON_ETHR_GPIO_IRQ, 1);
+}
+
+static void __init omap_apollon_init_irq(void)
+{
+        omap2_init_common_hw();
+        omap_init_irq();
+        omap_gpio_init();
+        apollon_init_smc91x();
+}
+
+static struct omap_uart_config apollon_uart_config __initdata = {
+        .enabled_uarts = (1 << 0) | (0 << 1) | (0 << 2),
+};
+
+static struct omap_mmc_config apollon_mmc_config __initdata = {
+        .mmc [0] = {
+                .enabled        = 0,
+                .wire4          = 0,
+                .wp_pin         = -1,
+                .power_pin      = -1,
+                .switch_pin     = -1,
+        },
+};
+
+static struct omap_lcd_config apollon_lcd_config __initdata = {
+        .ctrl_name      = "internal",
+};
+
+static struct omap_board_config_kernel apollon_config[] = {
+        { OMAP_TAG_UART,        &apollon_uart_config },
+        { OMAP_TAG_MMC,         &apollon_mmc_config },
+        { OMAP_TAG_LCD,         &apollon_lcd_config },
+};
+
+static void __init apollon_led_init(void)
+{
+        /* LED0 - AA10 */
+        omap_cfg_reg(AA10_242X_GPIO13);
+        omap_request_gpio(LED0_GPIO13);
+        omap_set_gpio_direction(LED0_GPIO13, 0);
+        omap_set_gpio_dataout(LED0_GPIO13, 0);
+        /* LED1  - AA6 */
+        omap_cfg_reg(AA6_242X_GPIO14);
+        omap_request_gpio(LED1_GPIO14);
+        omap_set_gpio_direction(LED1_GPIO14, 0);
+        omap_set_gpio_dataout(LED1_GPIO14, 0);
+        /* LED2  - AA4 */
+        omap_cfg_reg(AA4_242X_GPIO15);
+        omap_request_gpio(LED2_GPIO15);
+        omap_set_gpio_direction(LED2_GPIO15, 0);
+        omap_set_gpio_dataout(LED2_GPIO15, 0);
+}
+
+static irqreturn_t apollon_sw_interrupt(int irq, void *ignored, struct pt_regs *regs)
+{
+        static unsigned int led0, led1, led2;
+
+        if (irq == OMAP_GPIO_IRQ(SW_ENTER_GPIO16))
+                omap_set_gpio_dataout(LED0_GPIO13, led0 ^= 1);
+        else if (irq == OMAP_GPIO_IRQ(SW_UP_GPIO17))
+                omap_set_gpio_dataout(LED1_GPIO14, led1 ^= 1);
+        else if (irq == OMAP_GPIO_IRQ(SW_DOWN_GPIO58))
+                omap_set_gpio_dataout(LED2_GPIO15, led2 ^= 1);
+
+        return IRQ_HANDLED;
+}
+
+static void __init apollon_sw_init(void)
+{
+        /* Enter SW - Y11 */
+        omap_cfg_reg(Y11_242X_GPIO16);
+        omap_request_gpio(SW_ENTER_GPIO16);
+        omap_set_gpio_direction(SW_ENTER_GPIO16, 1);
+        /* Up SW - AA12 */
+        omap_cfg_reg(AA12_242X_GPIO17);
+        omap_request_gpio(SW_UP_GPIO17);
+        omap_set_gpio_direction(SW_UP_GPIO17, 1);
+        /* Down SW - AA8 */
+        omap_cfg_reg(AA8_242X_GPIO58);
+        omap_request_gpio(SW_DOWN_GPIO58);
+        omap_set_gpio_direction(SW_DOWN_GPIO58, 1);
+
+        set_irq_type(OMAP_GPIO_IRQ(SW_ENTER_GPIO16), IRQT_RISING);
+        if (request_irq(OMAP_GPIO_IRQ(SW_ENTER_GPIO16), &apollon_sw_interrupt,
+                                SA_SHIRQ, "enter sw",
+                                &apollon_sw_interrupt))
+                return;
+        set_irq_type(OMAP_GPIO_IRQ(SW_UP_GPIO17), IRQT_RISING);
+        if (request_irq(OMAP_GPIO_IRQ(SW_UP_GPIO17), &apollon_sw_interrupt,
+                                SA_SHIRQ, "up sw",
+                                &apollon_sw_interrupt))
+                return;
+        set_irq_type(OMAP_GPIO_IRQ(SW_DOWN_GPIO58), IRQT_RISING);
+        if (request_irq(OMAP_GPIO_IRQ(SW_DOWN_GPIO58), &apollon_sw_interrupt,
+                                SA_SHIRQ, "down sw",
+                                &apollon_sw_interrupt))
+                return;
+}
+
+static void __init omap_apollon_init(void)
+{
+        apollon_led_init();
+        apollon_sw_init();
+
+        /* REVISIT: where's the correct place */
+        omap_cfg_reg(W19_24XX_SYS_NIRQ);
+
+        /*
+         * Make sure the serial ports are muxed on at this point.
+         * You have to mux them off in device drivers later on
+         * if not needed.
+         */
+        platform_add_devices(apollon_devices, ARRAY_SIZE(apollon_devices));
+        omap_board_config = apollon_config;
+        omap_board_config_size = ARRAY_SIZE(apollon_config);
+        omap_serial_init();
+}
+
+static void __init omap_apollon_map_io(void)
+{
+        omap2_map_common_io();
+}
+
+MACHINE_START(OMAP_APOLLON, "OMAP24xx Apollon")
+        /* Maintainer: Kyungmin Park <kyungmin.park@samsung.com> */
+        .phys_io        = 0x48000000,
+        .io_pg_offst    = ((0xd8000000) >> 18) & 0xfffc,
+        .boot_params    = 0x80000100,
+        .map_io         = omap_apollon_map_io,
+        .init_irq       = omap_apollon_init_irq,
+        .init_machine   = omap_apollon_init,
+        .timer          = &omap_timer,
+MACHINE_END
diff --git a/arch/arm/mach-omap2/board-h4.c b/arch/arm/mach-omap2/board-h4.c
index a300d634d8a5..4933fce766c8 100644
--- a/arch/arm/mach-omap2/board-h4.c
+++ b/arch/arm/mach-omap2/board-h4.c
@@ -17,6 +17,8 @@
 #include <linux/mtd/mtd.h>
 #include <linux/mtd/partitions.h>
 #include <linux/delay.h>
+#include <linux/workqueue.h>
+#include <linux/input.h>
 
 #include <asm/hardware.h>
 #include <asm/mach-types.h>
@@ -25,15 +27,57 @@
 #include <asm/mach/flash.h>
 
 #include <asm/arch/gpio.h>
+#include <asm/arch/gpioexpander.h>
 #include <asm/arch/mux.h>
 #include <asm/arch/usb.h>
+#include <asm/arch/irda.h>
 #include <asm/arch/board.h>
 #include <asm/arch/common.h>
-#include <asm/arch/prcm.h>
+#include <asm/arch/keypad.h>
+#include <asm/arch/menelaus.h>
+#include <asm/arch/dma.h>
+#include "prcm-regs.h"
 
 #include <asm/io.h>
 #include <asm/delay.h>
 
+static unsigned int row_gpios[6] = { 88, 89, 124, 11, 6, 96 };
+static unsigned int col_gpios[7] = { 90, 91, 100, 36, 12, 97, 98 };
+
+static int h4_keymap[] = {
+        KEY(0, 0, KEY_LEFT),
+        KEY(0, 1, KEY_RIGHT),
+        KEY(0, 2, KEY_A),
+        KEY(0, 3, KEY_B),
+        KEY(0, 4, KEY_C),
+        KEY(1, 0, KEY_DOWN),
+        KEY(1, 1, KEY_UP),
+        KEY(1, 2, KEY_E),
+        KEY(1, 3, KEY_F),
+        KEY(1, 4, KEY_G),
+        KEY(2, 0, KEY_ENTER),
+        KEY(2, 1, KEY_I),
+        KEY(2, 2, KEY_J),
+        KEY(2, 3, KEY_K),
+        KEY(2, 4, KEY_3),
+        KEY(3, 0, KEY_M),
+        KEY(3, 1, KEY_N),
+        KEY(3, 2, KEY_O),
+        KEY(3, 3, KEY_P),
+        KEY(3, 4, KEY_Q),
+        KEY(4, 0, KEY_R),
+        KEY(4, 1, KEY_4),
+        KEY(4, 2, KEY_T),
+        KEY(4, 3, KEY_U),
+        KEY(4, 4, KEY_ENTER),
+        KEY(5, 0, KEY_V),
+        KEY(5, 1, KEY_W),
+        KEY(5, 2, KEY_L),
+        KEY(5, 3, KEY_S),
+        KEY(5, 4, KEY_ENTER),
+        0
+};
+
 static struct mtd_partition h4_partitions[] = {
         /* bootloader (U-Boot, etc) in first sector */
         {
@@ -108,9 +152,123 @@ static struct platform_device h4_smc91x_device = {
         .resource       = h4_smc91x_resources,
 };
 
+/* Select between the IrDA and aGPS module
+ */
+static int h4_select_irda(struct device *dev, int state)
+{
+        unsigned char expa;
+        int err = 0;
+
+        if ((err = read_gpio_expa(&expa, 0x21))) {
+                printk(KERN_ERR "Error reading from I/O expander\n");
+                return err;
+        }
+
+        /* 'P6' enable/disable IRDA_TX and IRDA_RX */
+        if (state & IR_SEL) {   /* IrDa */
+                if ((err = write_gpio_expa(expa | 0x01, 0x21))) {
+                        printk(KERN_ERR "Error writing to I/O expander\n");
+                        return err;
+                }
+        } else {
+                if ((err = write_gpio_expa(expa & ~0x01, 0x21))) {
+                        printk(KERN_ERR "Error writing to I/O expander\n");
+                        return err;
+                }
+        }
+        return err;
+}
+
+static void set_trans_mode(void *data)
+{
+        int *mode = data;
+        unsigned char expa;
+        int err = 0;
+
+        if ((err = read_gpio_expa(&expa, 0x20)) != 0) {
+                printk(KERN_ERR "Error reading from I/O expander\n");
+        }
+
+        expa &= ~0x01;
+
+        if (!(*mode & IR_SIRMODE)) { /* MIR/FIR */
+                expa |= 0x01;
+        }
+
+        if ((err = write_gpio_expa(expa, 0x20)) != 0) {
+                printk(KERN_ERR "Error writing to I/O expander\n");
+        }
+}
+
+static int h4_transceiver_mode(struct device *dev, int mode)
+{
+        struct omap_irda_config *irda_config = dev->platform_data;
+
+        cancel_delayed_work(&irda_config->gpio_expa);
+        PREPARE_WORK(&irda_config->gpio_expa, set_trans_mode, &mode);
+        schedule_work(&irda_config->gpio_expa);
+
+        return 0;
+}
+
+static struct omap_irda_config h4_irda_data = {
+        .transceiver_cap        = IR_SIRMODE | IR_MIRMODE | IR_FIRMODE,
+        .transceiver_mode       = h4_transceiver_mode,
+        .select_irda            = h4_select_irda,
+        .rx_channel             = OMAP24XX_DMA_UART3_RX,
+        .tx_channel             = OMAP24XX_DMA_UART3_TX,
+        .dest_start             = OMAP_UART3_BASE,
+        .src_start              = OMAP_UART3_BASE,
+        .tx_trigger             = OMAP24XX_DMA_UART3_TX,
+        .rx_trigger             = OMAP24XX_DMA_UART3_RX,
+};
+
+static struct resource h4_irda_resources[] = {
+        [0] = {
+                .start  = INT_24XX_UART3_IRQ,
+                .end    = INT_24XX_UART3_IRQ,
+                .flags  = IORESOURCE_IRQ,
+        },
+};
+
+static struct platform_device h4_irda_device = {
+        .name           = "omapirda",
+        .id             = -1,
+        .dev            = {
+                .platform_data  = &h4_irda_data,
+        },
+        .num_resources  = 1,
+        .resource       = h4_irda_resources,
+};
+
+static struct omap_kp_platform_data h4_kp_data = {
+        .rows           = 6,
+        .cols           = 7,
+        .keymap         = h4_keymap,
+        .rep            = 1,
+        .row_gpios      = row_gpios,
+        .col_gpios      = col_gpios,
+};
+
+static struct platform_device h4_kp_device = {
+        .name           = "omap-keypad",
+        .id             = -1,
+        .dev            = {
+                .platform_data = &h4_kp_data,
+        },
+};
+
+static struct platform_device h4_lcd_device = {
+        .name           = "lcd_h4",
+        .id             = -1,
+};
+
 static struct platform_device *h4_devices[] __initdata = {
         &h4_smc91x_device,
         &h4_flash_device,
+        &h4_irda_device,
+        &h4_kp_device,
+        &h4_lcd_device,
 };
 
 static inline void __init h4_init_smc91x(void)
@@ -157,7 +315,6 @@ static struct omap_mmc_config h4_mmc_config __initdata = {
 };
 
 static struct omap_lcd_config h4_lcd_config __initdata = {
-        .panel_name     = "h4",
         .ctrl_name      = "internal",
 };
 
@@ -174,6 +331,19 @@ static void __init omap_h4_init(void)
          * You have to mux them off in device drivers later on
          * if not needed.
          */
+#if defined(CONFIG_OMAP_IR) || defined(CONFIG_OMAP_IR_MODULE)
+        omap_cfg_reg(K15_24XX_UART3_TX);
+        omap_cfg_reg(K14_24XX_UART3_RX);
+#endif
+
+#if defined(CONFIG_KEYBOARD_OMAP) || defined(CONFIG_KEYBOARD_OMAP_MODULE)
+        if (omap_has_menelaus()) {
+                row_gpios[5] = 0;
+                col_gpios[2] = 15;
+                col_gpios[6] = 18;
+        }
+#endif
+
         platform_add_devices(h4_devices, ARRAY_SIZE(h4_devices));
         omap_board_config = h4_config;
         omap_board_config_size = ARRAY_SIZE(h4_config);
diff --git a/arch/arm/mach-omap2/clock.c b/arch/arm/mach-omap2/clock.c
index 180f675c9064..72eb4bf571ac 100644
--- a/arch/arm/mach-omap2/clock.c
+++ b/arch/arm/mach-omap2/clock.c
@@ -28,14 +28,14 @@
 
 #include <asm/arch/clock.h>
 #include <asm/arch/sram.h>
-#include <asm/arch/prcm.h>
 
+#include "prcm-regs.h"
+#include "memory.h"
 #include "clock.h"
 
 //#define DOWN_VARIABLE_DPLL 1                  /* Experimental */
 
 static struct prcm_config *curr_prcm_set;
-static struct memory_timings mem_timings;
 static u32 curr_perf_level = PRCM_FULL_SPEED;
 
 /*-------------------------------------------------------------------------
@@ -54,11 +54,13 @@ static void omap2_sys_clk_recalc(struct clk * clk)
 
 static u32 omap2_get_dpll_rate(struct clk * tclk)
 {
-        int dpll_clk, dpll_mult, dpll_div, amult;
+        long long dpll_clk;
+        int dpll_mult, dpll_div, amult;
 
         dpll_mult = (CM_CLKSEL1_PLL >> 12) & 0x03ff;    /* 10 bits */
         dpll_div = (CM_CLKSEL1_PLL >> 8) & 0x0f;        /* 4 bits */
-        dpll_clk = (tclk->parent->rate * dpll_mult) / (dpll_div + 1);
+        dpll_clk = (long long)tclk->parent->rate * dpll_mult;
+        do_div(dpll_clk, dpll_div + 1);
         amult = CM_CLKSEL2_PLL & 0x3;
         dpll_clk *= amult;
 
@@ -385,75 +387,23 @@ static u32 omap2_dll_force_needed(void)
                 return 0;
 }
 
-static void omap2_init_memory_params(u32 force_lock_to_unlock_mode)
-{
-        unsigned long dll_cnt;
-        u32 fast_dll = 0;
-
-        mem_timings.m_type = !((SDRC_MR_0 & 0x3) == 0x1); /* DDR = 1, SDR = 0 */
-
-        /* 2422 es2.05 and beyond has a single SIP DDR instead of 2 like others.
-         * In the case of 2422, its ok to use CS1 instead of CS0.
-         */
-
-#if 0   /* FIXME: Enable after 24xx cpu detection works */
-        ctype = get_cpu_type();
-        if (cpu_is_omap2422())
-                mem_timings.base_cs = 1;
-        else
-#endif
-                mem_timings.base_cs = 0;
-
-        if (mem_timings.m_type != M_DDR)
-                return;
-
-        /* With DDR we need to determine the low frequency DLL value */
-        if (((mem_timings.fast_dll_ctrl & (1 << 2)) == M_LOCK_CTRL))
-                mem_timings.dll_mode = M_UNLOCK;
-        else
-                mem_timings.dll_mode = M_LOCK;
-
-        if (mem_timings.base_cs == 0) {
-                fast_dll = SDRC_DLLA_CTRL;
-                dll_cnt = SDRC_DLLA_STATUS & 0xff00;
-        } else {
-                fast_dll = SDRC_DLLB_CTRL;
-                dll_cnt = SDRC_DLLB_STATUS & 0xff00;
-        }
-        if (force_lock_to_unlock_mode) {
-                fast_dll &= ~0xff00;
-                fast_dll |= dll_cnt;            /* Current lock mode */
-        }
-        mem_timings.fast_dll_ctrl = fast_dll;
-
-        /* No disruptions, DDR will be offline & C-ABI not followed */
-        omap2_sram_ddr_init(&mem_timings.slow_dll_ctrl,
-                            mem_timings.fast_dll_ctrl,
-                            mem_timings.base_cs,
-                            force_lock_to_unlock_mode);
-        mem_timings.slow_dll_ctrl &= 0xff00;    /* Keep lock value */
-
-        /* Turn status into unlock ctrl */
-        mem_timings.slow_dll_ctrl |=
-                ((mem_timings.fast_dll_ctrl & 0xF) | (1 << 2));
-
-        /* 90 degree phase for anything below 133Mhz */
-        mem_timings.slow_dll_ctrl |= (1 << 1);
-}
-
 static u32 omap2_reprogram_sdrc(u32 level, u32 force)
 {
+        u32 slow_dll_ctrl, fast_dll_ctrl, m_type;
         u32 prev = curr_perf_level, flags;
 
         if ((curr_perf_level == level) && !force)
                 return prev;
 
+        m_type = omap2_memory_get_type();
+        slow_dll_ctrl = omap2_memory_get_slow_dll_ctrl();
+        fast_dll_ctrl = omap2_memory_get_fast_dll_ctrl();
+
         if (level == PRCM_HALF_SPEED) {
                 local_irq_save(flags);
                 PRCM_VOLTSETUP = 0xffff;
                 omap2_sram_reprogram_sdrc(PRCM_HALF_SPEED,
-                                          mem_timings.slow_dll_ctrl,
-                                          mem_timings.m_type);
+                                          slow_dll_ctrl, m_type);
                 curr_perf_level = PRCM_HALF_SPEED;
                 local_irq_restore(flags);
         }
@@ -461,8 +411,7 @@ static u32 omap2_reprogram_sdrc(u32 level, u32 force)
                 local_irq_save(flags);
                 PRCM_VOLTSETUP = 0xffff;
                 omap2_sram_reprogram_sdrc(PRCM_FULL_SPEED,
-                                          mem_timings.fast_dll_ctrl,
-                                          mem_timings.m_type);
+                                          fast_dll_ctrl, m_type);
                 curr_perf_level = PRCM_FULL_SPEED;
                 local_irq_restore(flags);
         }
@@ -650,7 +599,7 @@ static u32 omap2_get_clksel(u32 *div_sel, u32 *field_mask,
                 case 13:                                /* dss2 */
                         mask = 0x1; break;
                 case 25:                                /* usb */
-                        mask = 0xf; break;
+                        mask = 0x7; break;
                 }
         }
 
diff --git a/arch/arm/mach-omap2/clock.h b/arch/arm/mach-omap2/clock.h
index 6cab20b1d3c1..6c78d471fab7 100644
--- a/arch/arm/mach-omap2/clock.h
+++ b/arch/arm/mach-omap2/clock.h
@@ -33,20 +33,6 @@ static u32 omap2_clksel_get_divisor(struct clk *clk);
 #define RATE_IN_242X    (1 << 0)
 #define RATE_IN_243X    (1 << 1)
 
-/* Memory timings */
-#define M_DDR           1
-#define M_LOCK_CTRL     (1 << 2)
-#define M_UNLOCK        0
-#define M_LOCK          1
-
-struct memory_timings {
-        u32 m_type;             /* ddr = 1, sdr = 0 */
-        u32 dll_mode;           /* use lock mode = 1, unlock mode = 0 */
-        u32 slow_dll_ctrl;      /* unlock mode, dll value for slow speed */
-        u32 fast_dll_ctrl;      /* unlock mode, dll value for fast speed */
-        u32 base_cs;            /* base chip select to use for calculations */
-};
-
 /* Key dividers which make up a PRCM set. Ratio's for a PRCM are mandated.
  * xtal_speed, dpll_speed, mpu_speed, CM_CLKSEL_MPU,CM_CLKSEL_DSP
  * CM_CLKSEL_GFX, CM_CLKSEL1_CORE, CM_CLKSEL1_PLL CM_CLKSEL2_PLL, CM_CLKSEL_MDM
@@ -731,6 +717,16 @@ static struct clk sys_clkout2 = {
         .recalc         = &omap2_clksel_recalc,
 };
 
+static struct clk emul_ck = {
+        .name           = "emul_ck",
+        .parent         = &func_54m_ck,
+        .flags          = CLOCK_IN_OMAP242X,
+        .enable_reg     = (void __iomem *)&PRCM_CLKEMUL_CTRL,
+        .enable_bit     = 0,
+        .recalc         = &omap2_propagate_rate,
+
+};
+
 /*
  * MPU clock domain
  *      Clocks:
@@ -1702,7 +1698,8 @@ static struct clk hdq_fck = {
 };
 
 static struct clk i2c2_ick = {
-        .name           = "i2c2_ick",
+        .name           = "i2c_ick",
+        .id             = 2,
         .parent         = &l4_ck,
         .flags          = CLOCK_IN_OMAP242X | CLOCK_IN_OMAP243X,
         .enable_reg     = (void __iomem *)&CM_ICLKEN1_CORE,
@@ -1711,7 +1708,8 @@ static struct clk i2c2_ick = {
 };
 
 static struct clk i2c2_fck = {
-        .name           = "i2c2_fck",
+        .name           = "i2c_fck",
+        .id             = 2,
         .parent         = &func_12m_ck,
         .flags          = CLOCK_IN_OMAP242X | CLOCK_IN_OMAP243X,
         .enable_reg     = (void __iomem *)&CM_FCLKEN1_CORE,
@@ -1729,7 +1727,8 @@ static struct clk i2chs2_fck = {
 };
 
 static struct clk i2c1_ick = {
-        .name           = "i2c1_ick",
+        .name           = "i2c_ick",
+        .id             = 1,
         .parent         = &l4_ck,
         .flags          = CLOCK_IN_OMAP242X | CLOCK_IN_OMAP243X,
         .enable_reg     = (void __iomem *)&CM_ICLKEN1_CORE,
@@ -1738,7 +1737,8 @@ static struct clk i2c1_ick = {
 };
 
 static struct clk i2c1_fck = {
-        .name           = "i2c1_fck",
+        .name           = "i2c_fck",
+        .id             = 1,
         .parent         = &func_12m_ck,
         .flags          = CLOCK_IN_OMAP242X | CLOCK_IN_OMAP243X,
         .enable_reg     = (void __iomem *)&CM_FCLKEN1_CORE,
@@ -1971,6 +1971,7 @@ static struct clk *onchip_clks[] = {
         &wdt1_osc_ck,
         &sys_clkout,
         &sys_clkout2,
+        &emul_ck,
         /* mpu domain clocks */
         &mpu_ck,
         /* dsp domain clocks */
diff --git a/arch/arm/mach-omap2/devices.c b/arch/arm/mach-omap2/devices.c
index 7181edb89352..fb7f91da1aad 100644
--- a/arch/arm/mach-omap2/devices.c
+++ b/arch/arm/mach-omap2/devices.c
@@ -25,10 +25,6 @@
 #include <asm/arch/mux.h>
 #include <asm/arch/gpio.h>
 
-extern void omap_nop_release(struct device *dev);
-
-/*-------------------------------------------------------------------------*/
-
 #if     defined(CONFIG_I2C_OMAP) || defined(CONFIG_I2C_OMAP_MODULE)
 
 #define OMAP2_I2C_BASE2         0x48072000
@@ -49,9 +45,6 @@ static struct resource i2c_resources2[] = {
 static struct platform_device omap_i2c_device2 = {
         .name           = "i2c_omap",
         .id             = 2,
-        .dev = {
-                .release        = omap_nop_release,
-        },
         .num_resources  = ARRAY_SIZE(i2c_resources2),
         .resource       = i2c_resources2,
 };
@@ -74,6 +67,44 @@ static void omap_init_i2c(void) {}
 
 #endif
 
+#if defined(CONFIG_OMAP_STI)
+
+#define OMAP2_STI_BASE          IO_ADDRESS(0x48068000)
+#define OMAP2_STI_CHANNEL_BASE  0x54000000
+#define OMAP2_STI_IRQ           4
+
+static struct resource sti_resources[] = {
+        {
+                .start          = OMAP2_STI_BASE,
+                .end            = OMAP2_STI_BASE + 0x7ff,
+                .flags          = IORESOURCE_MEM,
+        },
+        {
+                .start          = OMAP2_STI_CHANNEL_BASE,
+                .end            = OMAP2_STI_CHANNEL_BASE + SZ_64K - 1,
+                .flags          = IORESOURCE_MEM,
+        },
+        {
+                .start          = OMAP2_STI_IRQ,
+                .flags          = IORESOURCE_IRQ,
+        }
+};
+
+static struct platform_device sti_device = {
+        .name           = "sti",
+        .id             = -1,
+        .num_resources  = ARRAY_SIZE(sti_resources),
+        .resource       = sti_resources,
+};
+
+static inline void omap_init_sti(void)
+{
+        platform_device_register(&sti_device);
+}
+#else
+static inline void omap_init_sti(void) {}
+#endif
+
 /*-------------------------------------------------------------------------*/
 
 static int __init omap2_init_devices(void)
@@ -82,6 +113,7 @@ static int __init omap2_init_devices(void)
          * in alphabetical order so they're easier to sort through.
          */
         omap_init_i2c();
+        omap_init_sti();
 
         return 0;
 }
diff --git a/arch/arm/mach-omap2/io.c b/arch/arm/mach-omap2/io.c
index 8ea67bf196a5..7d5711611f2f 100644
--- a/arch/arm/mach-omap2/io.c
+++ b/arch/arm/mach-omap2/io.c
@@ -16,9 +16,13 @@
 #include <linux/kernel.h>
 #include <linux/init.h>
 
-#include <asm/mach/map.h>
+#include <asm/tlb.h>
 #include <asm/io.h>
+
+#include <asm/mach/map.h>
+
 #include <asm/arch/mux.h>
+#include <asm/arch/omapfb.h>
 
 extern void omap_sram_init(void);
 extern int omap2_clk_init(void);
@@ -43,11 +47,24 @@ static struct map_desc omap2_io_desc[] __initdata = {
         }
 };
 
-void __init omap_map_common_io(void)
+void __init omap2_map_common_io(void)
 {
         iotable_init(omap2_io_desc, ARRAY_SIZE(omap2_io_desc));
+
+        /* Normally devicemaps_init() would flush caches and tlb after
+         * mdesc->map_io(), but we must also do it here because of the CPU
+         * revision check below.
+         */
+        local_flush_tlb_all();
+        flush_cache_all();
+
         omap2_check_revision();
         omap_sram_init();
+        omapfb_reserve_mem();
+}
+
+void __init omap2_init_common_hw(void)
+{
         omap2_mux_init();
         omap2_clk_init();
 }
diff --git a/arch/arm/mach-omap2/memory.c b/arch/arm/mach-omap2/memory.c
new file mode 100644
index 000000000000..1d925d69fc35
--- /dev/null
+++ b/arch/arm/mach-omap2/memory.c
@@ -0,0 +1,102 @@
+/*
+ * linux/arch/arm/mach-omap2/memory.c
+ *
+ * Memory timing related functions for OMAP24XX
+ *
+ * Copyright (C) 2005 Texas Instruments Inc.
+ * Richard Woodruff <r-woodruff2@ti.com>
+ *
+ * Copyright (C) 2005 Nokia Corporation
+ * Tony Lindgren <tony@atomide.com>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+
+#include <linux/config.h>
+#include <linux/module.h>
+#include <linux/kernel.h>
+#include <linux/device.h>
+#include <linux/list.h>
+#include <linux/errno.h>
+#include <linux/delay.h>
+#include <linux/clk.h>
+
+#include <asm/io.h>
+
+#include <asm/arch/clock.h>
+#include <asm/arch/sram.h>
+
+#include "prcm-regs.h"
+#include "memory.h"
+
+static struct memory_timings mem_timings;
+
+u32 omap2_memory_get_slow_dll_ctrl(void)
+{
+        return mem_timings.slow_dll_ctrl;
+}
+
+u32 omap2_memory_get_fast_dll_ctrl(void)
+{
+        return mem_timings.fast_dll_ctrl;
+}
+
+u32 omap2_memory_get_type(void)
+{
+        return mem_timings.m_type;
+}
+
+void omap2_init_memory_params(u32 force_lock_to_unlock_mode)
+{
+        unsigned long dll_cnt;
+        u32 fast_dll = 0;
+
+        mem_timings.m_type = !((SDRC_MR_0 & 0x3) == 0x1); /* DDR = 1, SDR = 0 */
+
+        /* 2422 es2.05 and beyond has a single SIP DDR instead of 2 like others.
+         * In the case of 2422, its ok to use CS1 instead of CS0.
+         */
+        if (cpu_is_omap2422())
+                mem_timings.base_cs = 1;
+        else
+                mem_timings.base_cs = 0;
+
+        if (mem_timings.m_type != M_DDR)
+                return;
+
+        /* With DDR we need to determine the low frequency DLL value */
+        if (((mem_timings.fast_dll_ctrl & (1 << 2)) == M_LOCK_CTRL))
+                mem_timings.dll_mode = M_UNLOCK;
+        else
+                mem_timings.dll_mode = M_LOCK;
+
+        if (mem_timings.base_cs == 0) {
+                fast_dll = SDRC_DLLA_CTRL;
+                dll_cnt = SDRC_DLLA_STATUS & 0xff00;
+        } else {
+                fast_dll = SDRC_DLLB_CTRL;
+                dll_cnt = SDRC_DLLB_STATUS & 0xff00;
+        }
+        if (force_lock_to_unlock_mode) {
+                fast_dll &= ~0xff00;
+                fast_dll |= dll_cnt;            /* Current lock mode */
+        }
+        /* set fast timings with DLL filter disabled */
+        mem_timings.fast_dll_ctrl = (fast_dll | (3 << 8));
+
+        /* No disruptions, DDR will be offline & C-ABI not followed */
+        omap2_sram_ddr_init(&mem_timings.slow_dll_ctrl,
+                            mem_timings.fast_dll_ctrl,
+                            mem_timings.base_cs,
+                            force_lock_to_unlock_mode);
+        mem_timings.slow_dll_ctrl &= 0xff00;    /* Keep lock value */
+
+        /* Turn status into unlock ctrl */
+        mem_timings.slow_dll_ctrl |=
+                ((mem_timings.fast_dll_ctrl & 0xF) | (1 << 2));
+
+        /* 90 degree phase for anything below 133Mhz + disable DLL filter */
+        mem_timings.slow_dll_ctrl |= ((1 << 1) | (3 << 8));
+}
diff --git a/arch/arm/mach-omap2/memory.h b/arch/arm/mach-omap2/memory.h
new file mode 100644
index 000000000000..d212eea83a05
--- /dev/null
+++ b/arch/arm/mach-omap2/memory.h
@@ -0,0 +1,34 @@
+/*
+ * linux/arch/arm/mach-omap2/memory.h
+ *
+ * Interface for memory timing related functions for OMAP24XX
+ *
+ * Copyright (C) 2005 Texas Instruments Inc.
+ * Richard Woodruff <r-woodruff2@ti.com>
+ *
+ * Copyright (C) 2005 Nokia Corporation
+ * Tony Lindgren <tony@atomide.com>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+
+/* Memory timings */
+#define M_DDR           1
+#define M_LOCK_CTRL     (1 << 2)
+#define M_UNLOCK        0
+#define M_LOCK          1
+
+struct memory_timings {
+        u32 m_type;             /* ddr = 1, sdr = 0 */
+        u32 dll_mode;           /* use lock mode = 1, unlock mode = 0 */
+        u32 slow_dll_ctrl;      /* unlock mode, dll value for slow speed */
+        u32 fast_dll_ctrl;      /* unlock mode, dll value for fast speed */
+        u32 base_cs;            /* base chip select to use for calculations */
+};
+
+extern void omap2_init_memory_params(u32 force_lock_to_unlock_mode);
+extern u32 omap2_memory_get_slow_dll_ctrl(void);
+extern u32 omap2_memory_get_fast_dll_ctrl(void);
+extern u32 omap2_memory_get_type(void);
diff --git a/arch/arm/mach-omap2/mux.c b/arch/arm/mach-omap2/mux.c
index ea4654815dd1..1197dc38c20a 100644
--- a/arch/arm/mach-omap2/mux.c
+++ b/arch/arm/mach-omap2/mux.c
@@ -50,9 +50,54 @@ MUX_CFG_24XX("H19_24XX_I2C2_SDA",	0x114,	0,	0,	0,	1)
 /* Menelaus interrupt */
 MUX_CFG_24XX("W19_24XX_SYS_NIRQ",       0x12c,  0,      1,      1,      1)
 
+/* 24xx clocks */
+MUX_CFG_24XX("W14_24XX_SYS_CLKOUT",     0x137,  0,      1,      1,      1)
+
+/* 24xx McBSP */
+MUX_CFG_24XX("Y15_24XX_MCBSP2_CLKX",    0x124,  1,      1,      0,      1)
+MUX_CFG_24XX("R14_24XX_MCBSP2_FSX",     0x125,  1,      1,      0,      1)
+MUX_CFG_24XX("W15_24XX_MCBSP2_DR",      0x126,  1,      1,      0,      1)
+MUX_CFG_24XX("V15_24XX_MCBSP2_DX",      0x127,  1,      1,      0,      1)
+
 /* 24xx GPIO */
+MUX_CFG_24XX("M21_242X_GPIO11",  0x0c9,  3,      1,      1,      1)
+MUX_CFG_24XX("AA10_242X_GPIO13",        0x0e5,  3,      0,      0,      1)
+MUX_CFG_24XX("AA6_242X_GPIO14",  0x0e6,  3,      0,      0,      1)
+MUX_CFG_24XX("AA4_242X_GPIO15",  0x0e7,  3,      0,      0,      1)
+MUX_CFG_24XX("Y11_242X_GPIO16",  0x0e8,  3,      0,      0,      1)
+MUX_CFG_24XX("AA12_242X_GPIO17",        0x0e9,  3,      0,      0,      1)
+MUX_CFG_24XX("AA8_242X_GPIO58",  0x0ea,  3,      0,      0,      1)
 MUX_CFG_24XX("Y20_24XX_GPIO60",         0x12c,  3,      0,      0,      1)
+MUX_CFG_24XX("W4__24XX_GPIO74",  0x0f2,  3,      0,      0,      1)
 MUX_CFG_24XX("M15_24XX_GPIO92",         0x10a,  3,      0,      0,      1)
+MUX_CFG_24XX("V14_24XX_GPIO117",        0x128,  3,      1,      0,      1)
+
+/* TSC IRQ */
+MUX_CFG_24XX("P20_24XX_TSC_IRQ",        0x108,  0,      0,      0,      1)
+
+/* UART3  */
+MUX_CFG_24XX("K15_24XX_UART3_TX",       0x118,  0,      0,      0,      1)
+MUX_CFG_24XX("K14_24XX_UART3_RX",       0x119,  0,      0,      0,      1)
+
+/* Keypad GPIO*/
+MUX_CFG_24XX("T19_24XX_KBR0",           0x106,  3,      1,      1,      1)
+MUX_CFG_24XX("R19_24XX_KBR1",           0x107,  3,      1,      1,      1)
+MUX_CFG_24XX("V18_24XX_KBR2",           0x139,  3,      1,      1,      1)
+MUX_CFG_24XX("M21_24XX_KBR3",           0xc9,   3,      1,      1,      1)
+MUX_CFG_24XX("E5__24XX_KBR4",           0x138,  3,      1,      1,      1)
+MUX_CFG_24XX("M18_24XX_KBR5",           0x10e,  3,      1,      1,      1)
+MUX_CFG_24XX("R20_24XX_KBC0",           0x108,  3,      0,      0,      1)
+MUX_CFG_24XX("M14_24XX_KBC1",           0x109,  3,      0,      0,      1)
+MUX_CFG_24XX("H19_24XX_KBC2",           0x114,  3,      0,      0,      1)
+MUX_CFG_24XX("V17_24XX_KBC3",           0x135,  3,      0,      0,      1)
+MUX_CFG_24XX("P21_24XX_KBC4",           0xca,   3,      0,      0,      1)
+MUX_CFG_24XX("L14_24XX_KBC5",           0x10f,  3,      0,      0,      1)
+MUX_CFG_24XX("N19_24XX_KBC6",           0x110,  3,      0,      0,      1)
+
+/* 24xx Menelaus Keypad GPIO */
+MUX_CFG_24XX("B3__24XX_KBR5",           0x30,   3,      1,      1,      1)
+MUX_CFG_24XX("AA4_24XX_KBC2",           0xe7,   3,      0,      0,      1)
+MUX_CFG_24XX("B13_24XX_KBC6",           0x110,  3,      0,      0,      1)
 
 };
 
diff --git a/arch/arm/mach-omap2/pm.c b/arch/arm/mach-omap2/pm.c
new file mode 100644
index 000000000000..562168fa2b16
--- /dev/null
+++ b/arch/arm/mach-omap2/pm.c
@@ -0,0 +1,149 @@
+/*
+ * linux/arch/arm/mach-omap2/pm.c
+ *
+ * OMAP2 Power Management Routines
+ *
+ * Copyright (C) 2006 Nokia Corporation
+ * Tony Lindgren <tony@atomide.com>
+ *
+ * Copyright (C) 2005 Texas Instruments, Inc.
+ * Richard Woodruff <r-woodruff2@ti.com>
+ *
+ * Based on pm.c for omap1
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+
+#include <linux/pm.h>
+#include <linux/sched.h>
+#include <linux/proc_fs.h>
+#include <linux/pm.h>
+#include <linux/interrupt.h>
+#include <linux/sysfs.h>
+#include <linux/module.h>
+
+#include <asm/io.h>
+#include <asm/irq.h>
+#include <asm/atomic.h>
+#include <asm/mach/time.h>
+#include <asm/mach/irq.h>
+#include <asm/mach-types.h>
+
+#include <asm/arch/irqs.h>
+#include <asm/arch/clock.h>
+#include <asm/arch/sram.h>
+#include <asm/arch/pm.h>
+
+static struct clk *vclk;
+static void (*omap2_sram_idle)(void);
+static void (*omap2_sram_suspend)(int dllctrl, int cpu_rev);
+static void (*saved_idle)(void);
+
+void omap2_pm_idle(void)
+{
+        local_irq_disable();
+        local_fiq_disable();
+        if (need_resched()) {
+                local_fiq_enable();
+                local_irq_enable();
+                return;
+        }
+
+        /*
+         * Since an interrupt may set up a timer, we don't want to
+         * reprogram the hardware timer with interrupts enabled.
+         * Re-enable interrupts only after returning from idle.
+         */
+        timer_dyn_reprogram();
+
+        omap2_sram_idle();
+        local_fiq_enable();
+        local_irq_enable();
+}
+
+static int omap2_pm_prepare(suspend_state_t state)
+{
+        int error = 0;
+
+        /* We cannot sleep in idle until we have resumed */
+        saved_idle = pm_idle;
+        pm_idle = NULL;
+
+        switch (state)
+        {
+        case PM_SUSPEND_STANDBY:
+        case PM_SUSPEND_MEM:
+                break;
+
+        case PM_SUSPEND_DISK:
+                return -ENOTSUPP;
+
+        default:
+                return -EINVAL;
+        }
+
+        return error;
+}
+
+static int omap2_pm_enter(suspend_state_t state)
+{
+        switch (state)
+        {
+        case PM_SUSPEND_STANDBY:
+        case PM_SUSPEND_MEM:
+                /* FIXME: Add suspend */
+                break;
+
+        case PM_SUSPEND_DISK:
+                return -ENOTSUPP;
+
+        default:
+                return -EINVAL;
+        }
+
+        return 0;
+}
+
+static int omap2_pm_finish(suspend_state_t state)
+{
+        pm_idle = saved_idle;
+        return 0;
+}
+
+static struct pm_ops omap_pm_ops = {
+        .pm_disk_mode   = 0,
+        .prepare        = omap2_pm_prepare,
+        .enter          = omap2_pm_enter,
+        .finish         = omap2_pm_finish,
+};
+
+int __init omap2_pm_init(void)
+{
+        printk("Power Management for TI OMAP.\n");
+
+        vclk = clk_get(NULL, "virt_prcm_set");
+        if (IS_ERR(vclk)) {
+                printk(KERN_ERR "Could not get PM vclk\n");
+                return -ENODEV;
+        }
+
+        /*
+         * We copy the assembler sleep/wakeup routines to SRAM.
+         * These routines need to be in SRAM as that's the only
+         * memory the MPU can see when it wakes up.
+         */
+        omap2_sram_idle = omap_sram_push(omap24xx_idle_loop_suspend,
+                                         omap24xx_idle_loop_suspend_sz);
+
+        omap2_sram_suspend = omap_sram_push(omap24xx_cpu_suspend,
+                                            omap24xx_cpu_suspend_sz);
+
+        pm_set_ops(&omap_pm_ops);
+        pm_idle = omap2_pm_idle;
+
+        return 0;
+}
+
+__initcall(omap2_pm_init);
diff --git a/arch/arm/mach-omap2/prcm.h b/arch/arm/mach-omap2/prcm-regs.h
index 2eb89b936c83..22ac7be4f782 100644
--- a/arch/arm/mach-omap2/prcm.h
+++ b/arch/arm/mach-omap2/prcm-regs.h
@@ -1,5 +1,7 @@
 /*
- * prcm.h - Access definations for use in OMAP24XX clock and power management
+ * linux/arch/arm/mach-omap2/prcm-reg.h
+ *
+ * OMAP24XX Power Reset and Clock Management (PRCM) registers
  *
  * Copyright (C) 2005 Texas Instruments, Inc.
  *
@@ -18,8 +20,8 @@
  * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
  */
 
-#ifndef __ASM_ARM_ARCH_DPM_PRCM_H
-#define __ASM_ARM_ARCH_DPM_PRCM_H
+#ifndef __ARCH_ARM_MACH_OMAP2_PRCM_H
+#define __ARCH_ARM_MACH_OMAP2_PRCM_H
 
 /* SET_PERFORMANCE_LEVEL PARAMETERS */
 #define PRCM_HALF_SPEED 1
@@ -159,54 +161,63 @@
 #define CM_FCLKEN_MDM           PRCM_REG32(0xC00)
 #define CM_ICLKEN_MDM           PRCM_REG32(0xC10)
 #define CM_IDLEST_MDM           PRCM_REG32(0xC20)
+#define CM_AUTOIDLE_MDM         PRCM_REG32(0xC30)
 #define CM_CLKSEL_MDM           PRCM_REG32(0xC40)
-
-/* FIXME: Move to header for 2430 */
-#define DISP_BASE               (OMAP24XX_L4_IO_BASE+0x50000)
+#define CM_CLKSTCTRL_MDM        PRCM_REG32(0xC48)
+#define RM_RSTCTRL_MDM          PRCM_REG32(0xC50)
+#define RM_RSTST_MDM            PRCM_REG32(0xC58)
+#define PM_WKEN_MDM             PRCM_REG32(0xCA0)
+#define PM_WKST_MDM             PRCM_REG32(0xCB0)
+#define PM_WKDEP_MDM            PRCM_REG32(0xCC8)
+#define PM_PWSTCTRL_MDM         PRCM_REG32(0xCE0)
+#define PM_PWSTST_MDM           PRCM_REG32(0xCE4)
+
+#define OMAP24XX_L4_IO_BASE     0x48000000
+
+#define DISP_BASE               (OMAP24XX_L4_IO_BASE + 0x50000)
 #define DISP_REG32(offset)      __REG32(DISP_BASE + (offset))
 
-#define GPMC_BASE               (OMAP24XX_GPMC_BASE)
-#define GPMC_REG32(offset)      __REG32(GPMC_BASE + (offset))
+#define OMAP24XX_GPMC_BASE      (L3_24XX_BASE + 0xa000)
+#define GPMC_REG32(offset)      __REG32(OMAP24XX_GPMC_BASE + (offset))
 
-#define GPT1_BASE               (OMAP24XX_GPT1)
+/* FIXME: Move these to timer code */
+#define GPT1_BASE               (0x48028000)
 #define GPT1_REG32(offset)      __REG32(GPT1_BASE + (offset))
 
 /* Misc sysconfig */
 #define DISPC_SYSCONFIG         DISP_REG32(0x410)
-#define SPI_BASE                (OMAP24XX_L4_IO_BASE+0x98000)
+#define SPI_BASE                (OMAP24XX_L4_IO_BASE + 0x98000)
 #define MCSPI1_SYSCONFIG        __REG32(SPI_BASE + 0x10)
-#define MCSPI2_SYSCONFIG        __REG32(SPI_BASE+0x2000 + 0x10)
-
-//#define DSP_MMU_SYSCONFIG     0x5A000010
-#define CAMERA_MMU_SYSCONFIG    __REG32(DISP_BASE+0x2C10)
-//#define IVA_MMU_SYSCONFIG     0x5D000010
-//#define DSP_DMA_SYSCONFIG     0x00FCC02C
-#define CAMERA_DMA_SYSCONFIG    __REG32(DISP_BASE+0x282C)
-#define SYSTEM_DMA_SYSCONFIG    __REG32(DISP_BASE+0x602C)
+#define MCSPI2_SYSCONFIG        __REG32(SPI_BASE + 0x2000 + 0x10)
+#define MCSPI3_SYSCONFIG        __REG32(OMAP24XX_L4_IO_BASE + 0xb8010)
+
+#define CAMERA_MMU_SYSCONFIG    __REG32(DISP_BASE + 0x2C10)
+#define CAMERA_DMA_SYSCONFIG    __REG32(DISP_BASE + 0x282C)
+#define SYSTEM_DMA_SYSCONFIG    __REG32(DISP_BASE + 0x602C)
 #define GPMC_SYSCONFIG          GPMC_REG32(0x010)
-#define MAILBOXES_SYSCONFIG     __REG32(OMAP24XX_L4_IO_BASE+0x94010)
-#define UART1_SYSCONFIG         __REG32(OMAP24XX_L4_IO_BASE+0x6A054)
-#define UART2_SYSCONFIG         __REG32(OMAP24XX_L4_IO_BASE+0x6C054)
-#define UART3_SYSCONFIG         __REG32(OMAP24XX_L4_IO_BASE+0x6E054)
-//#define IVA_SYSCONFIG         0x5C060010
-#define SDRC_SYSCONFIG          __REG32(OMAP24XX_SDRC_BASE+0x10)
-#define SMS_SYSCONFIG           __REG32(OMAP24XX_SMS_BASE+0x10)
-#define SSI_SYSCONFIG           __REG32(DISP_BASE+0x8010)
-//#define VLYNQ_SYSCONFIG       0x67FFFE10
+#define MAILBOXES_SYSCONFIG     __REG32(OMAP24XX_L4_IO_BASE + 0x94010)
+#define UART1_SYSCONFIG         __REG32(OMAP24XX_L4_IO_BASE + 0x6A054)
+#define UART2_SYSCONFIG         __REG32(OMAP24XX_L4_IO_BASE + 0x6C054)
+#define UART3_SYSCONFIG         __REG32(OMAP24XX_L4_IO_BASE + 0x6E054)
+#define SDRC_SYSCONFIG          __REG32(OMAP24XX_SDRC_BASE + 0x10)
+#define OMAP24XX_SMS_BASE       (L3_24XX_BASE + 0x8000)
+#define SMS_SYSCONFIG           __REG32(OMAP24XX_SMS_BASE + 0x10)
+#define SSI_SYSCONFIG           __REG32(DISP_BASE + 0x8010)
 
 /* rkw - good cannidates for PM_ to start what nm was trying */
-#define OMAP24XX_GPT2           (OMAP24XX_L4_IO_BASE+0x2A000)
-#define OMAP24XX_GPT3           (OMAP24XX_L4_IO_BASE+0x78000)
-#define OMAP24XX_GPT4           (OMAP24XX_L4_IO_BASE+0x7A000)
-#define OMAP24XX_GPT5           (OMAP24XX_L4_IO_BASE+0x7C000)
-#define OMAP24XX_GPT6           (OMAP24XX_L4_IO_BASE+0x7E000)
-#define OMAP24XX_GPT7           (OMAP24XX_L4_IO_BASE+0x80000)
-#define OMAP24XX_GPT8           (OMAP24XX_L4_IO_BASE+0x82000)
-#define OMAP24XX_GPT9           (OMAP24XX_L4_IO_BASE+0x84000)
-#define OMAP24XX_GPT10          (OMAP24XX_L4_IO_BASE+0x86000)
-#define OMAP24XX_GPT11          (OMAP24XX_L4_IO_BASE+0x88000)
-#define OMAP24XX_GPT12          (OMAP24XX_L4_IO_BASE+0x8A000)
-
+#define OMAP24XX_GPT2           (OMAP24XX_L4_IO_BASE + 0x2A000)
+#define OMAP24XX_GPT3           (OMAP24XX_L4_IO_BASE + 0x78000)
+#define OMAP24XX_GPT4           (OMAP24XX_L4_IO_BASE + 0x7A000)
+#define OMAP24XX_GPT5           (OMAP24XX_L4_IO_BASE + 0x7C000)
+#define OMAP24XX_GPT6           (OMAP24XX_L4_IO_BASE + 0x7E000)
+#define OMAP24XX_GPT7           (OMAP24XX_L4_IO_BASE + 0x80000)
+#define OMAP24XX_GPT8           (OMAP24XX_L4_IO_BASE + 0x82000)
+#define OMAP24XX_GPT9           (OMAP24XX_L4_IO_BASE + 0x84000)
+#define OMAP24XX_GPT10          (OMAP24XX_L4_IO_BASE + 0x86000)
+#define OMAP24XX_GPT11          (OMAP24XX_L4_IO_BASE + 0x88000)
+#define OMAP24XX_GPT12          (OMAP24XX_L4_IO_BASE + 0x8A000)
+
+/* FIXME: Move these to timer code */
 #define GPTIMER1_SYSCONFIG      GPT1_REG32(0x010)
 #define GPTIMER2_SYSCONFIG      __REG32(OMAP24XX_GPT2 + 0x10)
 #define GPTIMER3_SYSCONFIG      __REG32(OMAP24XX_GPT3 + 0x10)
@@ -220,12 +231,18 @@
 #define GPTIMER11_SYSCONFIG     __REG32(OMAP24XX_GPT11 + 0x10)
 #define GPTIMER12_SYSCONFIG     __REG32(OMAP24XX_GPT12 + 0x10)
 
-#define GPIOX_BASE(X)           (OMAP24XX_GPIO_BASE+(0x2000*((X)-1)))
+/* FIXME: Move these to gpio code */
+#define OMAP24XX_GPIO_BASE      0x48018000
+#define GPIOX_BASE(X)           (OMAP24XX_GPIO_BASE + (0x2000 * ((X) - 1)))
+
+#define GPIO1_SYSCONFIG         __REG32((GPIOX_BASE(1) + 0x10))
+#define GPIO2_SYSCONFIG         __REG32((GPIOX_BASE(2) + 0x10))
+#define GPIO3_SYSCONFIG         __REG32((GPIOX_BASE(3) + 0x10))
+#define GPIO4_SYSCONFIG         __REG32((GPIOX_BASE(4) + 0x10))
 
-#define GPIO1_SYSCONFIG         __REG32((GPIOX_BASE(1)+0x10))
-#define GPIO2_SYSCONFIG         __REG32((GPIOX_BASE(2)+0x10))
-#define GPIO3_SYSCONFIG         __REG32((GPIOX_BASE(3)+0x10))
-#define GPIO4_SYSCONFIG         __REG32((GPIOX_BASE(4)+0x10))
+#if defined(CONFIG_ARCH_OMAP243X)
+#define GPIO5_SYSCONFIG         __REG32((OMAP24XX_GPIO5_BASE + 0x10))
+#endif
 
 /* GP TIMER 1 */
 #define GPTIMER1_TISTAT         GPT1_REG32(0x014)
@@ -243,15 +260,15 @@
 #define GPTIMER1_TCAR2          GPT1_REG32(0x044)
 
 /* rkw -- base fix up please... */
-#define GPTIMER3_TISR           __REG32(OMAP24XX_L4_IO_BASE+0x78018)
+#define GPTIMER3_TISR           __REG32(OMAP24XX_L4_IO_BASE + 0x78018)
 
 /* SDRC */
-#define SDRC_DLLA_CTRL          __REG32(OMAP24XX_SDRC_BASE+0x060)
-#define SDRC_DLLA_STATUS        __REG32(OMAP24XX_SDRC_BASE+0x064)
-#define SDRC_DLLB_CTRL          __REG32(OMAP24XX_SDRC_BASE+0x068)
-#define SDRC_DLLB_STATUS        __REG32(OMAP24XX_SDRC_BASE+0x06C)
-#define SDRC_POWER              __REG32(OMAP24XX_SDRC_BASE+0x070)
-#define SDRC_MR_0               __REG32(OMAP24XX_SDRC_BASE+0x084)
+#define SDRC_DLLA_CTRL          __REG32(OMAP24XX_SDRC_BASE + 0x060)
+#define SDRC_DLLA_STATUS        __REG32(OMAP24XX_SDRC_BASE + 0x064)
+#define SDRC_DLLB_CTRL          __REG32(OMAP24XX_SDRC_BASE + 0x068)
+#define SDRC_DLLB_STATUS        __REG32(OMAP24XX_SDRC_BASE + 0x06C)
+#define SDRC_POWER              __REG32(OMAP24XX_SDRC_BASE + 0x070)
+#define SDRC_MR_0               __REG32(OMAP24XX_SDRC_BASE + 0x084)
 
 /* GPIO 1 */
 #define GPIO1_BASE              GPIOX_BASE(1)
@@ -278,6 +295,8 @@
 #define GPIO2_DATAIN            GPIO2_REG32(0x038)
 #define GPIO2_OE                GPIO2_REG32(0x034)
 #define GPIO2_DATAOUT           GPIO2_REG32(0x03C)
+#define GPIO2_DEBOUNCENABLE     GPIO2_REG32(0x050)
+#define GPIO2_DEBOUNCINGTIME    GPIO2_REG32(0x054)
 
 /* GPIO 3 */
 #define GPIO3_BASE              GPIOX_BASE(3)
@@ -294,6 +313,8 @@
 #define GPIO3_DATAOUT           GPIO3_REG32(0x03C)
 #define GPIO3_DEBOUNCENABLE     GPIO3_REG32(0x050)
 #define GPIO3_DEBOUNCINGTIME    GPIO3_REG32(0x054)
+#define GPIO3_DEBOUNCENABLE     GPIO3_REG32(0x050)
+#define GPIO3_DEBOUNCINGTIME    GPIO3_REG32(0x054)
 
 /* GPIO 4 */
 #define GPIO4_BASE              GPIOX_BASE(4)
@@ -311,10 +332,26 @@
 #define GPIO4_DEBOUNCENABLE     GPIO4_REG32(0x050)
 #define GPIO4_DEBOUNCINGTIME    GPIO4_REG32(0x054)
 
+#if defined(CONFIG_ARCH_OMAP243X)
+/* GPIO 5 */
+#define GPIO5_REG32(offset)     __REG32((OMAP24XX_GPIO5_BASE + (offset)))
+#define GPIO5_IRQENABLE1        GPIO5_REG32(0x01C)
+#define GPIO5_IRQSTATUS1        GPIO5_REG32(0x018)
+#define GPIO5_IRQENABLE2        GPIO5_REG32(0x02C)
+#define GPIO5_IRQSTATUS2        GPIO5_REG32(0x028)
+#define GPIO5_WAKEUPENABLE      GPIO5_REG32(0x020)
+#define GPIO5_RISINGDETECT      GPIO5_REG32(0x048)
+#define GPIO5_FALLINGDETECT     GPIO5_REG32(0x04C)
+#define GPIO5_DATAIN            GPIO5_REG32(0x038)
+#define GPIO5_OE                GPIO5_REG32(0x034)
+#define GPIO5_DATAOUT           GPIO5_REG32(0x03C)
+#define GPIO5_DEBOUNCENABLE     GPIO5_REG32(0x050)
+#define GPIO5_DEBOUNCINGTIME    GPIO5_REG32(0x054)
+#endif
 
 /* IO CONFIG */
-#define CONTROL_BASE            (OMAP24XX_CTRL_BASE)
-#define CONTROL_REG32(offset)   __REG32(CONTROL_BASE + (offset))
+#define OMAP24XX_CTRL_BASE              (L4_24XX_BASE)
+#define CONTROL_REG32(offset)           __REG32(OMAP24XX_CTRL_BASE + (offset))
 
 #define CONTROL_PADCONF_SPI1_NCS2       CONTROL_REG32(0x104)
 #define CONTROL_PADCONF_SYS_XTALOUT     CONTROL_REG32(0x134)
@@ -322,15 +359,18 @@
 #define CONTROL_PADCONF_MCBSP1_DX       CONTROL_REG32(0x10C)
 #define CONTROL_PADCONF_GPMC_NCS4       CONTROL_REG32(0x090)
 #define CONTROL_PADCONF_DSS_D5          CONTROL_REG32(0x0B8)
-#define CONTROL_PADCONF_DSS_D9          CONTROL_REG32(0x0BC)
+#define CONTROL_PADCONF_DSS_D9          CONTROL_REG32(0x0BC)    /* 2420 */
 #define CONTROL_PADCONF_DSS_D13         CONTROL_REG32(0x0C0)
 #define CONTROL_PADCONF_DSS_VSYNC       CONTROL_REG32(0x0CC)
+#define CONTROL_PADCONF_SYS_NIRQW0      CONTROL_REG32(0x0BC)    /* 2430 */
+#define CONTROL_PADCONF_SSI1_FLAG_TX    CONTROL_REG32(0x108)    /* 2430 */
 
 /* CONTROL */
 #define CONTROL_DEVCONF         CONTROL_REG32(0x274)
+#define CONTROL_DEVCONF1        CONTROL_REG32(0x2E8)
 
 /* INTERRUPT CONTROLLER */
-#define INTC_BASE               (OMAP24XX_L4_IO_BASE+0xfe000)
+#define INTC_BASE               ((L4_24XX_BASE) + 0xfe000)
 #define INTC_REG32(offset)      __REG32(INTC_BASE + (offset))
 
 #define INTC1_U_BASE            INTC_REG32(0x000)
@@ -348,10 +388,12 @@
 #define INTC_ISR_CLEAR2         INTC_REG32(0x0D4)
 #define INTC_SIR_IRQ            INTC_REG32(0x040)
 #define INTC_CONTROL            INTC_REG32(0x048)
-#define INTC_ILR11              INTC_REG32(0x12C)
+#define INTC_ILR11              INTC_REG32(0x12C)       /* PRCM on MPU PIC */
+#define INTC_ILR30              INTC_REG32(0x178)
+#define INTC_ILR31              INTC_REG32(0x17C)
 #define INTC_ILR32              INTC_REG32(0x180)
-#define INTC_ILR37              INTC_REG32(0x194)
-#define INTC_SYSCONFIG          INTC_REG32(0x010)
+#define INTC_ILR37              INTC_REG32(0x194)       /* GPIO4 on MPU PIC */
+#define INTC_SYSCONFIG          INTC_REG32(0x010)       /* GPT1 on MPU PIC */
 
 /* RAM FIREWALL */
 #define RAMFW_BASE              (0x68005000)
@@ -373,6 +415,24 @@
 #define GPMC_CONFIG6_0          GPMC_REG32(0x074)
 #define GPMC_CONFIG7_0          GPMC_REG32(0x078)
 
+/* GPMC CS1 */
+#define GPMC_CONFIG1_1          GPMC_REG32(0x090)
+#define GPMC_CONFIG2_1          GPMC_REG32(0x094)
+#define GPMC_CONFIG3_1          GPMC_REG32(0x098)
+#define GPMC_CONFIG4_1          GPMC_REG32(0x09C)
+#define GPMC_CONFIG5_1          GPMC_REG32(0x0a0)
+#define GPMC_CONFIG6_1          GPMC_REG32(0x0a4)
+#define GPMC_CONFIG7_1          GPMC_REG32(0x0a8)
+
+/* GPMC CS3 */
+#define GPMC_CONFIG1_3          GPMC_REG32(0x0F0)
+#define GPMC_CONFIG2_3          GPMC_REG32(0x0F4)
+#define GPMC_CONFIG3_3          GPMC_REG32(0x0F8)
+#define GPMC_CONFIG4_3          GPMC_REG32(0x0FC)
+#define GPMC_CONFIG5_3          GPMC_REG32(0x100)
+#define GPMC_CONFIG6_3          GPMC_REG32(0x104)
+#define GPMC_CONFIG7_3          GPMC_REG32(0x108)
+
 /* DSS */
 #define DSS_CONTROL             DISP_REG32(0x040)
 #define DISPC_CONTROL           DISP_REG32(0x440)
@@ -405,11 +465,15 @@
 #define DISPC_DATA_CYCLE2       DISP_REG32(0x5D8)
 #define DISPC_DATA_CYCLE3       DISP_REG32(0x5DC)
 
-/* Wake up define for board */
-#define GPIO97                  (1 << 1)
-#define GPIO88                  (1 << 24)
+/* HSUSB Suspend */
+#define HSUSB_CTRL              __REG8(0x480AC001)
+#define USBOTG_POWER            __REG32(0x480AC000)
+
+/* HS MMC */
+#define MMCHS1_SYSCONFIG        __REG32(0x4809C010)
+#define MMCHS2_SYSCONFIG        __REG32(0x480b4010)
 
-#endif /* __ASSEMBLER__ */
+#endif  /* __ASSEMBLER__ */
 
 #endif
 
diff --git a/arch/arm/mach-omap2/prcm.c b/arch/arm/mach-omap2/prcm.c
new file mode 100644
index 000000000000..8893479dc7e0
--- /dev/null
+++ b/arch/arm/mach-omap2/prcm.c
@@ -0,0 +1,40 @@
+/*
+ * linux/arch/arm/mach-omap2/prcm.c
+ *
+ * OMAP 24xx Power Reset and Clock Management (PRCM) functions
+ *
+ * Copyright (C) 2005 Nokia Corporation
+ *
+ * Written by Tony Lindgren <tony.lindgren@nokia.com>
+ *
+ * Some pieces of code Copyright (C) 2005 Texas Instruments, Inc.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+#include <linux/config.h>
+#include <linux/module.h>
+#include <linux/init.h>
+#include <linux/clk.h>
+
+#include "prcm-regs.h"
+
+u32 omap_prcm_get_reset_sources(void)
+{
+        return RM_RSTST_WKUP & 0x7f;
+}
+EXPORT_SYMBOL(omap_prcm_get_reset_sources);
+
+/* Resets clock rates and reboots the system. Only called from system.h */
+void omap_prcm_arch_reset(char mode)
+{
+        u32 rate;
+        struct clk *vclk, *sclk;
+
+        vclk = clk_get(NULL, "virt_prcm_set");
+        sclk = clk_get(NULL, "sys_ck");
+        rate = clk_get_rate(sclk);
+        clk_set_rate(vclk, rate);       /* go to bypass for OMAP limitation */
+        RM_RSTCTRL_WKUP |= 2;
+}
diff --git a/arch/arm/mach-omap2/sleep.S b/arch/arm/mach-omap2/sleep.S
new file mode 100644
index 000000000000..00299cbeb911
--- /dev/null
+++ b/arch/arm/mach-omap2/sleep.S
@@ -0,0 +1,144 @@
+/*
+ * linux/arch/arm/mach-omap2/sleep.S
+ *
+ * (C) Copyright 2004
+ * Texas Instruments, <www.ti.com>
+ * Richard Woodruff <r-woodruff2@ti.com>
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License as
+ * published by the Free Software Foundation; either version 2 of
+ * the License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR /PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 59 Temple Place, Suite 330, Boston,
+ * MA 02111-1307 USA
+ */
+
+#include <linux/config.h>
+#include <linux/linkage.h>
+#include <asm/assembler.h>
+#include <asm/arch/io.h>
+#include <asm/arch/pm.h>
+
+#define A_32KSYNC_CR_V          IO_ADDRESS(OMAP_TIMER32K_BASE+0x10)
+#define A_PRCM_VOLTCTRL_V       IO_ADDRESS(OMAP24XX_PRCM_BASE+0x50)
+#define A_PRCM_CLKCFG_CTRL_V    IO_ADDRESS(OMAP24XX_PRCM_BASE+0x80)
+#define A_CM_CLKEN_PLL_V        IO_ADDRESS(OMAP24XX_PRCM_BASE+0x500)
+#define A_CM_IDLEST_CKGEN_V     IO_ADDRESS(OMAP24XX_PRCM_BASE+0x520)
+#define A_CM_CLKSEL1_PLL_V      IO_ADDRESS(OMAP24XX_PRCM_BASE+0x540)
+#define A_CM_CLKSEL2_PLL_V      IO_ADDRESS(OMAP24XX_PRCM_BASE+0x544)
+
+#define A_SDRC_DLLA_CTRL_V      IO_ADDRESS(OMAP24XX_SDRC_BASE+0x60)
+#define A_SDRC_POWER_V          IO_ADDRESS(OMAP24XX_SDRC_BASE+0x70)
+#define A_SDRC_RFR_CTRL_V       IO_ADDRESS(OMAP24XX_SDRC_BASE+0xA4)
+#define A_SDRC0_V               (0xC0000000)
+#define A_SDRC_MANUAL_V         IO_ADDRESS(OMAP24XX_SDRC_BASE+0xA8)
+
+        .text
+
+/*
+ * Forces OMAP into idle state
+ *
+ * omap24xx_idle_loop_suspend() - This bit of code just executes the WFI
+ * for normal idles.
+ *
+ * Note: This code get's copied to internal SRAM at boot. When the OMAP
+ *       wakes up it continues execution at the point it went to sleep.
+ */
+ENTRY(omap24xx_idle_loop_suspend)
+        stmfd   sp!, {r0, lr}           @ save registers on stack
+        mov     r0, #0                  @ clear for mcr setup
+        mcr     p15, 0, r0, c7, c0, 4   @ wait for interrupt
+        ldmfd   sp!, {r0, pc}           @ restore regs and return
+
+ENTRY(omap24xx_idle_loop_suspend_sz)
+        .word   . - omap24xx_idle_loop_suspend
+
+/*
+ * omap242x_cpu_suspend() - Forces OMAP into deep sleep state by completing
+ * SDRC shutdown then ARM shutdown.  Upon wake MPU is back on so just restore
+ * SDRC.
+ *
+ * Input:
+ * R0 : DLL ctrl value pre-Sleep
+ * R1 : Processor+Revision
+ *      2420: 0x21 = 242xES1, 0x26 = 242xES2.2
+ *      2430: 0x31 = 2430ES1, 0x32 = 2430ES2
+ *
+ * The if the DPLL is going to AutoIdle. It seems like the DPLL may be back on
+ * when we get called, but the DLL probably isn't.  We will wait a bit more in
+ * case the DPLL isn't quite there yet. The code will wait on DLL for DDR even
+ * if in unlocked mode.
+ *
+ * For less than 242x-ES2.2 upon wake from a sleep mode where the external
+ * oscillator was stopped, a timing bug exists where a non-stabilized 12MHz
+ * clock can pass into the PRCM can cause problems at DSP and IVA.
+ * To work around this the code will switch to the 32kHz source prior to sleep.
+ * Post sleep we will shift back to using the DPLL.  Apparently,
+ * CM_IDLEST_CLKGEN does not reflect the full clock change so you need to wait
+ * 3x12MHz + 3x32kHz clocks for a full switch.
+ *
+ * The DLL load value is not kept in RETENTION or OFF.  It needs to be restored
+ * at wake
+ */
+ENTRY(omap24xx_cpu_suspend)
+        stmfd   sp!, {r0 - r12, lr}     @ save registers on stack
+        mov     r3, #0x0                @ clear for mrc call
+        mcr     p15, 0, r3, c7, c10, 4  @ memory barrier, hope SDR/DDR finished
+        nop
+        nop
+        ldr     r3, A_SDRC_POWER        @ addr of sdrc power
+        ldr     r4, [r3]                @ value of sdrc power
+        orr     r4, r4, #0x40           @ enable self refresh on idle req
+        mov     r5, #0x2000             @ set delay (DPLL relock + DLL relock)
+        str     r4, [r3]                @ make it so
+        mov     r2, #0
+        nop
+        mcr     p15, 0, r2, c7, c0, 4   @ wait for interrupt
+        nop
+loop:
+        subs    r5, r5, #0x1            @ awake, wait just a bit
+        bne     loop
+
+        /* The DPLL has on before we take the DDR out of self refresh */
+        bic     r4, r4, #0x40           @ now clear self refresh bit.
+        str     r4, [r3]                @ put vlaue back.
+        ldr     r4, A_SDRC0             @ make a clock happen
+        ldr     r4, [r4]
+        nop                             @ start auto refresh only after clk ok
+        movs    r0, r0                  @ see if DDR or SDR
+        ldrne   r1, A_SDRC_DLLA_CTRL_S  @ get addr of DLL ctrl
+        strne   r0, [r1]                @ rewrite DLLA to force DLL reload
+        addne   r1, r1, #0x8            @ move to DLLB
+        strne   r0, [r1]                @ rewrite DLLB to force DLL reload
+
+        mov     r5, #0x1000
+loop2:
+        subs    r5, r5, #0x1
+        bne     loop2
+        /* resume*/
+        ldmfd   sp!, {r0 - r12, pc}     @ restore regs and return
+
+A_SDRC_POWER:
+        .word A_SDRC_POWER_V
+A_SDRC0:
+        .word A_SDRC0_V
+A_CM_CLKSEL2_PLL_S:
+        .word A_CM_CLKSEL2_PLL_V
+A_CM_CLKEN_PLL:
+        .word A_CM_CLKEN_PLL_V
+A_SDRC_DLLA_CTRL_S:
+        .word A_SDRC_DLLA_CTRL_V
+A_SDRC_MANUAL_S:
+        .word A_SDRC_MANUAL_V
+
+ENTRY(omap24xx_cpu_suspend_sz)
+        .word   . - omap24xx_cpu_suspend
+
diff --git a/arch/arm/mach-omap2/sram-fn.S b/arch/arm/mach-omap2/sram-fn.S
index 2a869e203342..d261e4ff4d9b 100644
--- a/arch/arm/mach-omap2/sram-fn.S
+++ b/arch/arm/mach-omap2/sram-fn.S
@@ -1,5 +1,5 @@
 /*
- * linux/arch/arm/mach-omap1/sram.S
+ * linux/arch/arm/mach-omap2/sram.S
  *
  * Omap2 specific functions that need to be run in internal SRAM
  *
@@ -28,7 +28,7 @@
 #include <asm/arch/io.h>
 #include <asm/hardware.h>
 
-#include <asm/arch/prcm.h>
+#include "prcm-regs.h"
 
 #define TIMER_32KSYNCT_CR_V     IO_ADDRESS(OMAP24XX_32KSYNCT_BASE + 0x010)
 
diff --git a/arch/arm/mach-pxa/poodle.c b/arch/arm/mach-pxa/poodle.c
index b45560a8f6c4..a042473deedd 100644
--- a/arch/arm/mach-pxa/poodle.c
+++ b/arch/arm/mach-pxa/poodle.c
@@ -307,6 +307,10 @@ static void __init fixup_poodle(struct machine_desc *desc,
                 struct tag *tags, char **cmdline, struct meminfo *mi)
 {
         sharpsl_save_param();
+        mi->nr_banks=1;
+        mi->bank[0].start = 0xa0000000;
+        mi->bank[0].node = 0;
+        mi->bank[0].size = (32*1024*1024);
 }
 
 MACHINE_START(POODLE, "SHARP Poodle")
diff --git a/arch/arm/mach-s3c2410/Kconfig b/arch/arm/mach-s3c2410/Kconfig
index ed07c4149d82..ce7d81000695 100644
--- a/arch/arm/mach-s3c2410/Kconfig
+++ b/arch/arm/mach-s3c2410/Kconfig
@@ -50,9 +50,15 @@ config MACH_N30
 
           <http://zoo.weinigel.se/n30>.
 
+config MACH_SMDK
+        bool
+        help
+          Common machine code for SMDK2410 and SMDK2440
+
 config ARCH_SMDK2410
         bool "SMDK2410/A9M2410"
         select CPU_S3C2410
+        select MACH_SMDK
         help
            Say Y here if you are using the SMDK2410 or the derived module A9M2410
            <http://www.fsforth.de>
@@ -60,6 +66,7 @@ config ARCH_SMDK2410
 config ARCH_S3C2440
         bool "SMDK2440"
         select CPU_S3C2440
+        select MACH_SMDK
         help
           Say Y here if you are using the SMDK2440.
 
diff --git a/arch/arm/mach-s3c2410/Makefile b/arch/arm/mach-s3c2410/Makefile
index 1b3b476e5637..3e5712db6b52 100644
--- a/arch/arm/mach-s3c2410/Makefile
+++ b/arch/arm/mach-s3c2410/Makefile
@@ -48,3 +48,5 @@ obj-$(CONFIG_MACH_VR1000)	+= mach-vr1000.o usb-simtec.o
 obj-$(CONFIG_MACH_RX3715)       += mach-rx3715.o
 obj-$(CONFIG_MACH_OTOM)         += mach-otom.o
 obj-$(CONFIG_MACH_NEXCODER_2440) += mach-nexcoder.o
+
+obj-$(CONFIG_MACH_SMDK)         += common-smdk.o
\ No newline at end of file
diff --git a/arch/arm/mach-s3c2410/clock.c b/arch/arm/mach-s3c2410/clock.c
index fec02c92f95f..6de713ad319a 100644
--- a/arch/arm/mach-s3c2410/clock.c
+++ b/arch/arm/mach-s3c2410/clock.c
@@ -249,7 +249,7 @@ static int s3c24xx_upll_enable(struct clk *clk, int enable)
 
         /* if we started the UPLL, then allow to settle */
 
-        if (enable && !(orig & S3C2410_CLKSLOW_UCLK_OFF))
+        if (enable && (orig & S3C2410_CLKSLOW_UCLK_OFF))
                 udelay(200);
 
         return 0;
@@ -367,6 +367,8 @@ static int s3c24xx_clkout_setparent(struct clk *clk, struct clk *parent)
                 source = S3C2410_MISCCR_CLK0_UPLL;
         else if (parent == &clk_f)
                 source = S3C2410_MISCCR_CLK0_FCLK;
+        else if (parent == &clk_h)
+                source = S3C2410_MISCCR_CLK0_HCLK;
         else if (parent == &clk_p)
                 source = S3C2410_MISCCR_CLK0_PCLK;
         else if (clk == &s3c24xx_clkout0 && parent == &s3c24xx_dclk0)
@@ -376,6 +378,8 @@ static int s3c24xx_clkout_setparent(struct clk *clk, struct clk *parent)
         else
                 return -EINVAL;
 
+        clk->parent = parent;
+
         if (clk == &s3c24xx_dclk0)
                 mask = S3C2410_MISCCR_CLK0_MASK;
         else {
diff --git a/arch/arm/mach-s3c2410/common-smdk.c b/arch/arm/mach-s3c2410/common-smdk.c
new file mode 100644
index 000000000000..f372fbda124e
--- /dev/null
+++ b/arch/arm/mach-s3c2410/common-smdk.c
@@ -0,0 +1,135 @@
+/* linux/arch/arm/mach-s3c2410/common-smdk.c
+ *
+ * Copyright (c) 2006 Simtec Electronics
+ *      Ben Dooks <ben@simtec.co.uk>
+ *
+ * Common code for SMDK2410 and SMDK2440 boards
+ *
+ * http://www.fluff.org/ben/smdk2440/
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+*/
+
+#include <linux/kernel.h>
+#include <linux/types.h>
+#include <linux/interrupt.h>
+#include <linux/list.h>
+#include <linux/timer.h>
+#include <linux/init.h>
+#include <linux/platform_device.h>
+
+#include <linux/mtd/mtd.h>
+#include <linux/mtd/nand.h>
+#include <linux/mtd/nand_ecc.h>
+#include <linux/mtd/partitions.h>
+
+#include <asm/mach/arch.h>
+#include <asm/mach/map.h>
+#include <asm/mach/irq.h>
+
+#include <asm/hardware.h>
+#include <asm/io.h>
+#include <asm/irq.h>
+
+#include <asm/arch/regs-gpio.h>
+
+#include <asm/arch/nand.h>
+
+#include "common-smdk.h"
+#include "devs.h"
+#include "pm.h"
+
+/* NAND parititon from 2.4.18-swl5 */
+
+static struct mtd_partition smdk_default_nand_part[] = {
+        [0] = {
+                .name   = "Boot Agent",
+                .size   = SZ_16K,
+                .offset = 0,
+        },
+        [1] = {
+                .name   = "S3C2410 flash parition 1",
+                .offset = 0,
+                .size   = SZ_2M,
+        },
+        [2] = {
+                .name   = "S3C2410 flash partition 2",
+                .offset = SZ_4M,
+                .size   = SZ_4M,
+        },
+        [3] = {
+                .name   = "S3C2410 flash partition 3",
+                .offset = SZ_8M,
+                .size   = SZ_2M,
+        },
+        [4] = {
+                .name   = "S3C2410 flash partition 4",
+                .offset = SZ_1M * 10,
+                .size   = SZ_4M,
+        },
+        [5] = {
+                .name   = "S3C2410 flash partition 5",
+                .offset = SZ_1M * 14,
+                .size   = SZ_1M * 10,
+        },
+        [6] = {
+                .name   = "S3C2410 flash partition 6",
+                .offset = SZ_1M * 24,
+                .size   = SZ_1M * 24,
+        },
+        [7] = {
+                .name   = "S3C2410 flash partition 7",
+                .offset = SZ_1M * 48,
+                .size   = SZ_16M,
+        }
+};
+
+static struct s3c2410_nand_set smdk_nand_sets[] = {
+        [0] = {
+                .name           = "NAND",
+                .nr_chips       = 1,
+                .nr_partitions  = ARRAY_SIZE(smdk_default_nand_part),
+                .partitions     = smdk_default_nand_part,
+        },
+};
+
+/* choose a set of timings which should suit most 512Mbit
+ * chips and beyond.
+*/
+
+static struct s3c2410_platform_nand smdk_nand_info = {
+        .tacls          = 20,
+        .twrph0         = 60,
+        .twrph1         = 20,
+        .nr_sets        = ARRAY_SIZE(smdk_nand_sets),
+        .sets           = smdk_nand_sets,
+};
+
+/* devices we initialise */
+
+static struct platform_device __initdata *smdk_devs[] = {
+        &s3c_device_nand,
+};
+
+void __init smdk_machine_init(void)
+{
+        /* Configure the LEDs (even if we have no LED support)*/
+
+        s3c2410_gpio_cfgpin(S3C2410_GPF4, S3C2410_GPF4_OUTP);
+        s3c2410_gpio_cfgpin(S3C2410_GPF5, S3C2410_GPF5_OUTP);
+        s3c2410_gpio_cfgpin(S3C2410_GPF6, S3C2410_GPF6_OUTP);
+        s3c2410_gpio_cfgpin(S3C2410_GPF7, S3C2410_GPF7_OUTP);
+
+        s3c2410_gpio_setpin(S3C2410_GPF4, 1);
+        s3c2410_gpio_setpin(S3C2410_GPF5, 1);
+        s3c2410_gpio_setpin(S3C2410_GPF6, 1);
+        s3c2410_gpio_setpin(S3C2410_GPF7, 1);
+
+        s3c_device_nand.dev.platform_data = &smdk_nand_info;
+
+        platform_add_devices(smdk_devs, ARRAY_SIZE(smdk_devs));
+
+        s3c2410_pm_init();
+}
diff --git a/arch/arm/mach-s3c2410/common-smdk.h b/arch/arm/mach-s3c2410/common-smdk.h
new file mode 100644
index 000000000000..0e3a3be330a3
--- /dev/null
+++ b/arch/arm/mach-s3c2410/common-smdk.h
@@ -0,0 +1,15 @@
+/* linux/arch/arm/mach-s3c2410/common-smdk.h
+ *
+ * Copyright (c) 2006 Simtec Electronics
+ *      Ben Dooks <ben@simtec.co.uk>
+ *
+ * Common code for SMDK2410 and SMDK2440 boards
+ *
+ * http://www.fluff.org/ben/smdk2440/
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+*/
+
+extern void smdk_machine_init(void);
diff --git a/arch/arm/mach-s3c2410/mach-anubis.c b/arch/arm/mach-s3c2410/mach-anubis.c
index 3e327b8e46be..cc97fbf66291 100644
--- a/arch/arm/mach-s3c2410/mach-anubis.c
+++ b/arch/arm/mach-s3c2410/mach-anubis.c
@@ -232,8 +232,8 @@ static void anubis_nand_select(struct s3c2410_nand_set *set, int slot)
 
 static struct s3c2410_platform_nand anubis_nand_info = {
         .tacls          = 25,
-        .twrph0         = 80,
-        .twrph1         = 80,
+        .twrph0         = 55,
+        .twrph1         = 40,
         .nr_sets        = ARRAY_SIZE(anubis_nand_sets),
         .sets           = anubis_nand_sets,
         .select_chip    = anubis_nand_select,
diff --git a/arch/arm/mach-s3c2410/mach-rx3715.c b/arch/arm/mach-s3c2410/mach-rx3715.c
index 0260ed5ab946..306afc1d7cd3 100644
--- a/arch/arm/mach-s3c2410/mach-rx3715.c
+++ b/arch/arm/mach-s3c2410/mach-rx3715.c
@@ -32,6 +32,11 @@
 #include <linux/serial_core.h>
 #include <linux/serial.h>
 
+#include <linux/mtd/mtd.h>
+#include <linux/mtd/nand.h>
+#include <linux/mtd/nand_ecc.h>
+#include <linux/mtd/partitions.h>
+
 #include <asm/mach/arch.h>
 #include <asm/mach/map.h>
 #include <asm/mach/irq.h>
@@ -46,6 +51,7 @@
 #include <asm/arch/regs-gpio.h>
 #include <asm/arch/regs-lcd.h>
 
+#include <asm/arch/nand.h>
 #include <asm/arch/fb.h>
 
 #include "clock.h"
@@ -170,12 +176,39 @@ static struct s3c2410fb_mach_info rx3715_lcdcfg __initdata = {
         },
 };
 
+static struct mtd_partition rx3715_nand_part[] = {
+        [0] = {
+                .name           = "Whole Flash",
+                .offset         = 0,
+                .size           = MTDPART_SIZ_FULL,
+                .mask_flags     = MTD_WRITEABLE,
+        }
+};
+
+static struct s3c2410_nand_set rx3715_nand_sets[] = {
+        [0] = {
+                .name           = "Internal",
+                .nr_chips       = 1,
+                .nr_partitions  = ARRAY_SIZE(rx3715_nand_part),
+                .partitions     = rx3715_nand_part,
+        },
+};
+
+static struct s3c2410_platform_nand rx3715_nand_info = {
+        .tacls          = 25,
+        .twrph0         = 50,
+        .twrph1         = 15,
+        .nr_sets        = ARRAY_SIZE(rx3715_nand_sets),
+        .sets           = rx3715_nand_sets,
+};
+
 static struct platform_device *rx3715_devices[] __initdata = {
         &s3c_device_usb,
         &s3c_device_lcd,
         &s3c_device_wdt,
         &s3c_device_i2c,
         &s3c_device_iis,
+        &s3c_device_nand,
 };
 
 static struct s3c24xx_board rx3715_board __initdata = {
@@ -185,6 +218,8 @@ static struct s3c24xx_board rx3715_board __initdata = {
 
 static void __init rx3715_map_io(void)
 {
+        s3c_device_nand.dev.platform_data = &rx3715_nand_info;
+
         s3c24xx_init_io(rx3715_iodesc, ARRAY_SIZE(rx3715_iodesc));
         s3c24xx_init_clocks(16934000);
         s3c24xx_init_uarts(rx3715_uartcfgs, ARRAY_SIZE(rx3715_uartcfgs));
diff --git a/arch/arm/mach-s3c2410/mach-smdk2410.c b/arch/arm/mach-s3c2410/mach-smdk2410.c
index 1e76e1fdfcea..2db932d72c5a 100644
--- a/arch/arm/mach-s3c2410/mach-smdk2410.c
+++ b/arch/arm/mach-s3c2410/mach-smdk2410.c
@@ -28,7 +28,8 @@
  * Ben Dooks <ben@simtec.co.uk>
  *
  * 10-Mar-2005 LCVR  Changed S3C2410_VA to S3C24XX_VA
- * 20-Sep-2005 BJD  Added static to non-exported items
+ * 20-Sep-2005 BJD   Added static to non-exported items
+ * 01-Apr-2006 BJD   Moved init code to common smdk
  *
  ***********************************************************************/
 
@@ -54,6 +55,8 @@
 #include "devs.h"
 #include "cpu.h"
 
+#include "common-smdk.h"
+
 static struct map_desc smdk2410_iodesc[] __initdata = {
   /* nothing here yet */
 };
@@ -107,11 +110,6 @@ static void __init smdk2410_map_io(void)
         s3c24xx_set_board(&smdk2410_board);
 }
 
-static void __init smdk2410_init_irq(void)
-{
-        s3c24xx_init_irq();
-}
-
 MACHINE_START(SMDK2410, "SMDK2410") /* @TODO: request a new identifier and switch
                                     * to SMDK2410 */
         /* Maintainer: Jonas Dietsche */
@@ -119,7 +117,8 @@ MACHINE_START(SMDK2410, "SMDK2410") /* @TODO: request a new identifier and switc
         .io_pg_offst    = (((u32)S3C24XX_VA_UART) >> 18) & 0xfffc,
         .boot_params    = S3C2410_SDRAM_PA + 0x100,
         .map_io         = smdk2410_map_io,
-        .init_irq       = smdk2410_init_irq,
+        .init_irq       = s3c24xx_init_irq,
+        .init_machine   = smdk_machine_init,
         .timer          = &s3c24xx_timer,
 MACHINE_END
 
diff --git a/arch/arm/mach-s3c2410/mach-smdk2440.c b/arch/arm/mach-s3c2410/mach-smdk2440.c
index f4315721c3b8..5fffd1d51047 100644
--- a/arch/arm/mach-s3c2410/mach-smdk2440.c
+++ b/arch/arm/mach-s3c2410/mach-smdk2440.c
@@ -53,7 +53,8 @@
 #include "clock.h"
 #include "devs.h"
 #include "cpu.h"
-#include "pm.h"
+
+#include "common-smdk.h"
 
 static struct map_desc smdk2440_iodesc[] __initdata = {
         /* ISA IO Space map (memory space selected by A24) */
@@ -197,21 +198,9 @@ static void __init smdk2440_map_io(void)
 
 static void __init smdk2440_machine_init(void)
 {
-        /* Configure the LEDs (even if we have no LED support)*/
-
-        s3c2410_gpio_cfgpin(S3C2410_GPF4, S3C2410_GPF4_OUTP);
-        s3c2410_gpio_cfgpin(S3C2410_GPF5, S3C2410_GPF5_OUTP);
-        s3c2410_gpio_cfgpin(S3C2410_GPF6, S3C2410_GPF6_OUTP);
-        s3c2410_gpio_cfgpin(S3C2410_GPF7, S3C2410_GPF7_OUTP);
-
-        s3c2410_gpio_setpin(S3C2410_GPF4, 0);
-        s3c2410_gpio_setpin(S3C2410_GPF5, 0);
-        s3c2410_gpio_setpin(S3C2410_GPF6, 0);
-        s3c2410_gpio_setpin(S3C2410_GPF7, 0);
-
         s3c24xx_fb_set_platdata(&smdk2440_lcd_cfg);
 
-        s3c2410_pm_init();
+        smdk_machine_init();
 }
 
 MACHINE_START(S3C2440, "SMDK2440")
diff --git a/arch/arm/mach-sa1100/collie.c b/arch/arm/mach-sa1100/collie.c
index 102454082474..676b5c5b75bb 100644
--- a/arch/arm/mach-sa1100/collie.c
+++ b/arch/arm/mach-sa1100/collie.c
@@ -11,7 +11,8 @@
  * published by the Free Software Foundation.
  *
  * ChangeLog:
- *  03-06-2004 John Lenz <jelenz@wisc.edu>
+ *  2006 Pavel Machek <pavel@suse.cz>
+ *  03-06-2004 John Lenz <lenz@cs.wisc.edu>
  *  06-04-2002 Chris Larson <kergoth@digitalnemesis.net>
  *  04-16-2001 Lineo Japan,Inc. ...
  */
@@ -87,12 +88,75 @@ static struct mcp_plat_data collie_mcp_data = {
         .sclk_rate      = 11981000,
 };
 
+#ifdef CONFIG_SHARP_LOCOMO
+/*
+ * low-level UART features.
+ */
+static struct locomo_dev *uart_dev = NULL;
+
+static void collie_uart_set_mctrl(struct uart_port *port, u_int mctrl)
+{
+        if (!uart_dev) return;
+
+        if (mctrl & TIOCM_RTS)
+                locomo_gpio_write(uart_dev, LOCOMO_GPIO_RTS, 0);
+        else
+                locomo_gpio_write(uart_dev, LOCOMO_GPIO_RTS, 1);
+
+        if (mctrl & TIOCM_DTR)
+                locomo_gpio_write(uart_dev, LOCOMO_GPIO_DTR, 0);
+        else
+                locomo_gpio_write(uart_dev, LOCOMO_GPIO_DTR, 1);
+}
+
+static u_int collie_uart_get_mctrl(struct uart_port *port)
+{
+        int ret = TIOCM_CD;
+        unsigned int r;
+        if (!uart_dev) return ret;
+
+        r = locomo_gpio_read_output(uart_dev, LOCOMO_GPIO_CTS & LOCOMO_GPIO_DSR);
+        if (r & LOCOMO_GPIO_CTS)
+                ret |= TIOCM_CTS;
+        if (r & LOCOMO_GPIO_DSR)
+                ret |= TIOCM_DSR;
+
+        return ret;
+}
 
 static struct sa1100_port_fns collie_port_fns __initdata = {
         .set_mctrl      = collie_uart_set_mctrl,
         .get_mctrl      = collie_uart_get_mctrl,
 };
 
+static int collie_uart_probe(struct locomo_dev *dev)
+{
+        uart_dev = dev;
+        return 0;
+}
+
+static int collie_uart_remove(struct locomo_dev *dev)
+{
+        uart_dev = NULL;
+        return 0;
+}
+
+static struct locomo_driver collie_uart_driver = {
+        .drv = {
+                .name = "collie_uart",
+        },
+        .devid  = LOCOMO_DEVID_UART,
+        .probe  = collie_uart_probe,
+        .remove = collie_uart_remove,
+};
+
+static int __init collie_uart_init(void) {
+        return locomo_driver_register(&collie_uart_driver);
+}
+device_initcall(collie_uart_init);
+
+#endif
+
 
 static struct resource locomo_resources[] = {
         [0] = {
@@ -218,6 +282,12 @@ static void __init collie_map_io(void)
 {
         sa1100_map_io();
         iotable_init(collie_io_desc, ARRAY_SIZE(collie_io_desc));
+
+#ifdef CONFIG_SHARP_LOCOMO
+        sa1100_register_uart_fns(&collie_port_fns);
+#endif
+        sa1100_register_uart(0, 3);
+        sa1100_register_uart(1, 1);
 }
 
 MACHINE_START(COLLIE, "Sharp-Collie")
diff --git a/arch/arm/mm/cache-v4wb.S b/arch/arm/mm/cache-v4wb.S
index 5c4055b62d97..54e3c5bb5186 100644
--- a/arch/arm/mm/cache-v4wb.S
+++ b/arch/arm/mm/cache-v4wb.S
@@ -10,7 +10,7 @@
 #include <linux/config.h>
 #include <linux/linkage.h>
 #include <linux/init.h>
-#include <asm/hardware.h>
+#include <asm/memory.h>
 #include <asm/page.h>
 #include "proc-macros.S"
 
@@ -46,6 +46,11 @@
  */
 #define CACHE_DLIMIT    (CACHE_DSIZE * 4)
 
+        .data
+flush_base:
+        .long   FLUSH_BASE
+        .text
+
 /*
  *      flush_user_cache_all()
  *
@@ -63,11 +68,21 @@ ENTRY(v4wb_flush_kern_cache_all)
         mov     ip, #0
         mcr     p15, 0, ip, c7, c5, 0           @ invalidate I cache
 __flush_whole_cache:
-        mov     r0, #FLUSH_BASE
-        add     r1, r0, #CACHE_DSIZE
-1:      ldr     r2, [r0], #32
-        cmp     r0, r1
+        ldr     r3, =flush_base
+        ldr     r1, [r3, #0]
+        eor     r1, r1, #CACHE_DSIZE
+        str     r1, [r3, #0]
+        add     r2, r1, #CACHE_DSIZE
+1:      ldr     r3, [r1], #32
+        cmp     r1, r2
+        blo     1b
+#ifdef FLUSH_BASE_MINICACHE
+        add     r2, r2, #FLUSH_BASE_MINICACHE - FLUSH_BASE
+        sub     r1, r2, #512                    @ only 512 bytes
+1:      ldr     r3, [r1], #32
+        cmp     r1, r2
         blo     1b
+#endif
         mcr     p15, 0, ip, c7, c10, 4          @ drain write buffer
         mov     pc, lr
 
@@ -82,6 +97,7 @@ __flush_whole_cache:
  *      - flags - vma_area_struct flags describing address space
  */
 ENTRY(v4wb_flush_user_cache_range)
+        mov     ip, #0
         sub     r3, r1, r0                      @ calculate total size
         tst     r2, #VM_EXEC                    @ executable region?
         mcrne   p15, 0, ip, c7, c5, 0           @ invalidate I cache
diff --git a/arch/arm/mm/consistent.c b/arch/arm/mm/consistent.c
index 8a1bfcd50087..50e6b6bfb2e2 100644
--- a/arch/arm/mm/consistent.c
+++ b/arch/arm/mm/consistent.c
@@ -18,6 +18,7 @@
 #include <linux/device.h>
 #include <linux/dma-mapping.h>
 
+#include <asm/memory.h>
 #include <asm/cacheflush.h>
 #include <asm/tlbflush.h>
 #include <asm/sizes.h>
@@ -272,6 +273,17 @@ __dma_alloc(struct device *dev, size_t size, dma_addr_t *handle, gfp_t gfp,
 void *
 dma_alloc_coherent(struct device *dev, size_t size, dma_addr_t *handle, gfp_t gfp)
 {
+        if (arch_is_coherent()) {
+                void *virt;
+
+                virt = kmalloc(size, gfp);
+                if (!virt)
+                        return NULL;
+                *handle =  virt_to_dma(dev, virt);
+
+                return virt;
+        }
+
         return __dma_alloc(dev, size, handle, gfp,
                            pgprot_noncached(pgprot_kernel));
 }
@@ -350,6 +362,11 @@ void dma_free_coherent(struct device *dev, size_t size, void *cpu_addr, dma_addr
 
         WARN_ON(irqs_disabled());
 
+        if (arch_is_coherent()) {
+                kfree(cpu_addr);
+                return;
+        }
+
         size = PAGE_ALIGN(size);
 
         spin_lock_irqsave(&consistent_lock, flags);
diff --git a/arch/arm/mm/init.c b/arch/arm/mm/init.c
index 88279124317a..9ea1f87a7079 100644
--- a/arch/arm/mm/init.c
+++ b/arch/arm/mm/init.c
@@ -20,6 +20,7 @@
 
 #include <asm/mach-types.h>
 #include <asm/setup.h>
+#include <asm/sizes.h>
 #include <asm/tlb.h>
 
 #include <asm/mach/arch.h>
@@ -455,14 +456,14 @@ static void __init devicemaps_init(struct machine_desc *mdesc)
 #ifdef FLUSH_BASE
         map.pfn = __phys_to_pfn(FLUSH_BASE_PHYS);
         map.virtual = FLUSH_BASE;
-        map.length = PGDIR_SIZE;
+        map.length = SZ_1M;
         map.type = MT_CACHECLEAN;
         create_mapping(&map);
 #endif
 #ifdef FLUSH_BASE_MINICACHE
-        map.pfn = __phys_to_pfn(FLUSH_BASE_PHYS + PGDIR_SIZE);
+        map.pfn = __phys_to_pfn(FLUSH_BASE_PHYS + SZ_1M);
         map.virtual = FLUSH_BASE_MINICACHE;
-        map.length = PGDIR_SIZE;
+        map.length = SZ_1M;
         map.type = MT_MINICLEAN;
         create_mapping(&map);
 #endif
diff --git a/arch/arm/mm/mm-armv.c b/arch/arm/mm/mm-armv.c
index 5e5d05bcad50..f14b2d0f3690 100644
--- a/arch/arm/mm/mm-armv.c
+++ b/arch/arm/mm/mm-armv.c
@@ -389,6 +389,17 @@ void __init build_mem_type_table(void)
         kern_pgprot = user_pgprot = cp->pte;
 
         /*
+         * Enable CPU-specific coherency if supported.
+         * (Only available on XSC3 at the moment.)
+         */
+        if (arch_is_coherent()) {
+                if (cpu_is_xsc3()) {
+                        mem_types[MT_MEMORY].prot_sect |= PMD_SECT_S;
+                        mem_types[MT_MEMORY].prot_pte |= L_PTE_COHERENT;
+                }
+        }
+
+        /*
          * ARMv6 and above have extended page tables.
          */
         if (cpu_arch >= CPU_ARCH_ARMv6 && (cr & CR_XP)) {
diff --git a/arch/arm/mm/proc-sa110.S b/arch/arm/mm/proc-sa110.S
index c916a6cae404..a2dd5ae1077d 100644
--- a/arch/arm/mm/proc-sa110.S
+++ b/arch/arm/mm/proc-sa110.S
@@ -26,22 +26,7 @@
  * the cache line size of the I and D cache
  */
 #define DCACHELINESIZE  32
-#define FLUSH_OFFSET    32768
 
-        .macro flush_110_dcache rd, ra, re
-        ldr     \rd, =flush_base
-        ldr     \ra, [\rd]
-        eor     \ra, \ra, #FLUSH_OFFSET
-        str     \ra, [\rd]
-        add     \re, \ra, #16384                @ only necessary for 16k
-1001:   ldr     \rd, [\ra], #DCACHELINESIZE
-        teq     \re, \ra
-        bne     1001b
-        .endm
-
-        .data
-flush_base:
-        .long   FLUSH_BASE
         .text
 
 /*
@@ -145,13 +130,11 @@ ENTRY(cpu_sa110_dcache_clean_area)
  */
         .align  5
 ENTRY(cpu_sa110_switch_mm)
-        flush_110_dcache        r3, ip, r1
-        mov     r1, #0
-        mcr     p15, 0, r1, c7, c5, 0           @ invalidate I cache
-        mcr     p15, 0, r1, c7, c10, 4          @ drain WB
+        str     lr, [sp, #-4]!
+        bl      v4wb_flush_kern_cache_all       @ clears IP
         mcr     p15, 0, r0, c2, c0, 0           @ load page table pointer
-        mcr     p15, 0, r1, c8, c7, 0           @ invalidate I & D TLBs
-        mov     pc, lr
+        mcr     p15, 0, ip, c8, c7, 0           @ invalidate I & D TLBs
+        ldr     pc, [sp], #4
 
 /*
  * cpu_sa110_set_pte(ptep, pte)
diff --git a/arch/arm/mm/proc-sa1100.S b/arch/arm/mm/proc-sa1100.S
index 41f21f2dd8ff..777ad99c1439 100644
--- a/arch/arm/mm/proc-sa1100.S
+++ b/arch/arm/mm/proc-sa1100.S
@@ -30,30 +30,6 @@
  * the cache line size of the I and D cache
  */
 #define DCACHELINESIZE  32
-#define FLUSH_OFFSET    32768
-
-        .macro flush_1100_dcache rd, ra, re
-        ldr     \rd, =flush_base
-        ldr     \ra, [\rd]
-        eor     \ra, \ra, #FLUSH_OFFSET
-        str     \ra, [\rd]
-        add     \re, \ra, #8192                 @ only necessary for 8k
-1001:   ldr     \rd, [\ra], #DCACHELINESIZE
-        teq     \re, \ra
-        bne     1001b
-#ifdef FLUSH_BASE_MINICACHE
-        add     \ra, \ra, #FLUSH_BASE_MINICACHE - FLUSH_BASE
-        add     \re, \ra, #512                  @ only 512 bytes
-1002:   ldr     \rd, [\ra], #DCACHELINESIZE
-        teq     \re, \ra
-        bne     1002b
-#endif
-        .endm
-
-        .data
-flush_base:
-        .long   FLUSH_BASE
-        .text
 
         __INIT
 
@@ -79,9 +55,8 @@ ENTRY(cpu_sa1100_proc_fin)
         stmfd   sp!, {lr}
         mov     ip, #PSR_F_BIT | PSR_I_BIT | SVC_MODE
         msr     cpsr_c, ip
-        flush_1100_dcache r0, r1, r2            @ clean caches
-        mov     r0, #0
-        mcr     p15, 0, r0, c15, c2, 2          @ Disable clock switching
+        bl      v4wb_flush_kern_cache_all
+        mcr     p15, 0, ip, c15, c2, 2          @ Disable clock switching
         mrc     p15, 0, r0, c1, c0, 0           @ ctrl register
         bic     r0, r0, #0x1000                 @ ...i............
         bic     r0, r0, #0x000e                 @ ............wca.
@@ -167,14 +142,12 @@ ENTRY(cpu_sa1100_dcache_clean_area)
  */
         .align  5
 ENTRY(cpu_sa1100_switch_mm)
-        flush_1100_dcache r3, ip, r1
-        mov     ip, #0
-        mcr     p15, 0, ip, c7, c5, 0           @ invalidate I cache
+        str     lr, [sp, #-4]!
+        bl      v4wb_flush_kern_cache_all       @ clears IP
         mcr     p15, 0, ip, c9, c0, 0           @ invalidate RB
-        mcr     p15, 0, ip, c7, c10, 4          @ drain WB
         mcr     p15, 0, r0, c2, c0, 0           @ load page table pointer
         mcr     p15, 0, ip, c8, c7, 0           @ invalidate I & D TLBs
-        mov     pc, lr
+        ldr     pc, [sp], #4
 
 /*
  * cpu_sa1100_set_pte(ptep, pte)
diff --git a/arch/arm/mm/proc-xsc3.S b/arch/arm/mm/proc-xsc3.S
index b9dfce57c272..80873b36c3f7 100644
--- a/arch/arm/mm/proc-xsc3.S
+++ b/arch/arm/mm/proc-xsc3.S
@@ -371,7 +371,7 @@ ENTRY(cpu_xsc3_switch_mm)
 ENTRY(cpu_xsc3_set_pte)
         str     r1, [r0], #-2048                @ linux version
 
-        bic     r2, r1, #0xff0
+        bic     r2, r1, #0xdf0                  @ Keep C, B, coherency bits
         orr     r2, r2, #PTE_TYPE_EXT           @ extended page
 
         eor     r3, r1, #L_PTE_PRESENT | L_PTE_YOUNG | L_PTE_WRITE | L_PTE_DIRTY
diff --git a/arch/arm/plat-omap/Kconfig b/arch/arm/plat-omap/Kconfig
index 0887bb2a2551..ec49495e651e 100644
--- a/arch/arm/plat-omap/Kconfig
+++ b/arch/arm/plat-omap/Kconfig
@@ -70,13 +70,13 @@ config OMAP_MPU_TIMER
 
 config OMAP_32K_TIMER
         bool "Use 32KHz timer"
-        depends on ARCH_OMAP16XX
+        depends on ARCH_OMAP16XX || ARCH_OMAP24XX
         help
           Select this option if you want to enable the OMAP 32KHz timer.
           This timer saves power compared to the OMAP_MPU_TIMER, and has
           support for no tick during idle. The 32KHz timer provides less
           intra-tick resolution than OMAP_MPU_TIMER. The 32KHz timer is
-          currently only available for OMAP-16xx.
+          currently only available for OMAP16XX and 24XX.
 
 endchoice
 
diff --git a/arch/arm/plat-omap/Makefile b/arch/arm/plat-omap/Makefile
index 9ccf1943fc94..2896b4546411 100644
--- a/arch/arm/plat-omap/Makefile
+++ b/arch/arm/plat-omap/Makefile
@@ -3,16 +3,16 @@
 #
 
 # Common support
-obj-y := common.o sram.o sram-fn.o clock.o devices.o dma.o mux.o gpio.o mcbsp.o usb.o
+obj-y := common.o sram.o sram-fn.o clock.o devices.o dma.o mux.o gpio.o mcbsp.o usb.o fb.o
 obj-m :=
 obj-n :=
 obj-  :=
 
+obj-$(CONFIG_OMAP_32K_TIMER)    += timer32k.o
+
 # OCPI interconnect support for 1710, 1610 and 5912
 obj-$(CONFIG_ARCH_OMAP16XX) += ocpi.o
 
-# Power Management
-obj-$(CONFIG_PM) += pm.o sleep.o
 
 obj-$(CONFIG_CPU_FREQ) += cpu-omap.o
 obj-$(CONFIG_OMAP_DM_TIMER) += dmtimer.o
diff --git a/arch/arm/plat-omap/clock.c b/arch/arm/plat-omap/clock.c
index 3c2bfc0efdaf..32ec04c58bcd 100644
--- a/arch/arm/plat-omap/clock.c
+++ b/arch/arm/plat-omap/clock.c
@@ -21,6 +21,7 @@
 #include <linux/string.h>
 #include <linux/clk.h>
 #include <linux/mutex.h>
+#include <linux/platform_device.h>
 
 #include <asm/io.h>
 #include <asm/semaphore.h>
@@ -37,17 +38,38 @@ static struct clk_functions *arch_clock;
  * Standard clock functions defined in include/linux/clk.h
  *-------------------------------------------------------------------------*/
 
+/*
+ * Returns a clock. Note that we first try to use device id on the bus
+ * and clock name. If this fails, we try to use clock name only.
+ */
 struct clk * clk_get(struct device *dev, const char *id)
 {
         struct clk *p, *clk = ERR_PTR(-ENOENT);
+        int idno;
+
+        if (dev == NULL || dev->bus != &platform_bus_type)
+                idno = -1;
+        else
+                idno = to_platform_device(dev)->id;
 
         mutex_lock(&clocks_mutex);
+
+        list_for_each_entry(p, &clocks, node) {
+                if (p->id == idno &&
+                    strcmp(id, p->name) == 0 && try_module_get(p->owner)) {
+                        clk = p;
+                        goto found;
+                }
+        }
+
         list_for_each_entry(p, &clocks, node) {
                 if (strcmp(id, p->name) == 0 && try_module_get(p->owner)) {
                         clk = p;
                         break;
                 }
         }
+
+found:
         mutex_unlock(&clocks_mutex);
 
         return clk;
@@ -59,6 +81,9 @@ int clk_enable(struct clk *clk)
         unsigned long flags;
         int ret = 0;
 
+        if (clk == NULL || IS_ERR(clk))
+                return -EINVAL;
+
         spin_lock_irqsave(&clockfw_lock, flags);
         if (arch_clock->clk_enable)
                 ret = arch_clock->clk_enable(clk);
@@ -72,6 +97,9 @@ void clk_disable(struct clk *clk)
 {
         unsigned long flags;
 
+        if (clk == NULL || IS_ERR(clk))
+                return;
+
         spin_lock_irqsave(&clockfw_lock, flags);
         if (arch_clock->clk_disable)
                 arch_clock->clk_disable(clk);
@@ -84,6 +112,9 @@ int clk_get_usecount(struct clk *clk)
         unsigned long flags;
         int ret = 0;
 
+        if (clk == NULL || IS_ERR(clk))
+                return 0;
+
         spin_lock_irqsave(&clockfw_lock, flags);
         ret = clk->usecount;
         spin_unlock_irqrestore(&clockfw_lock, flags);
@@ -97,6 +128,9 @@ unsigned long clk_get_rate(struct clk *clk)
         unsigned long flags;
         unsigned long ret = 0;
 
+        if (clk == NULL || IS_ERR(clk))
+                return 0;
+
         spin_lock_irqsave(&clockfw_lock, flags);
         ret = clk->rate;
         spin_unlock_irqrestore(&clockfw_lock, flags);
@@ -121,6 +155,9 @@ long clk_round_rate(struct clk *clk, unsigned long rate)
         unsigned long flags;
         long ret = 0;
 
+        if (clk == NULL || IS_ERR(clk))
+                return ret;
+
         spin_lock_irqsave(&clockfw_lock, flags);
         if (arch_clock->clk_round_rate)
                 ret = arch_clock->clk_round_rate(clk, rate);
@@ -133,7 +170,10 @@ EXPORT_SYMBOL(clk_round_rate);
 int clk_set_rate(struct clk *clk, unsigned long rate)
 {
         unsigned long flags;
-        int ret = 0;
+        int ret = -EINVAL;
+
+        if (clk == NULL || IS_ERR(clk))
+                return ret;
 
         spin_lock_irqsave(&clockfw_lock, flags);
         if (arch_clock->clk_set_rate)
@@ -147,7 +187,10 @@ EXPORT_SYMBOL(clk_set_rate);
 int clk_set_parent(struct clk *clk, struct clk *parent)
 {
         unsigned long flags;
-        int ret = 0;
+        int ret = -EINVAL;
+
+        if (clk == NULL || IS_ERR(clk) || parent == NULL || IS_ERR(parent))
+                return ret;
 
         spin_lock_irqsave(&clockfw_lock, flags);
         if (arch_clock->clk_set_parent)
@@ -163,6 +206,9 @@ struct clk *clk_get_parent(struct clk *clk)
         unsigned long flags;
         struct clk * ret = NULL;
 
+        if (clk == NULL || IS_ERR(clk))
+                return ret;
+
         spin_lock_irqsave(&clockfw_lock, flags);
         if (arch_clock->clk_get_parent)
                 ret = arch_clock->clk_get_parent(clk);
@@ -199,6 +245,9 @@ __setup("mpurate=", omap_clk_setup);
 /* Used for clocks that always have same value as the parent clock */
 void followparent_recalc(struct clk *clk)
 {
+        if (clk == NULL || IS_ERR(clk))
+                return;
+
         clk->rate = clk->parent->rate;
 }
 
@@ -207,6 +256,9 @@ void propagate_rate(struct clk * tclk)
 {
         struct clk *clkp;
 
+        if (tclk == NULL || IS_ERR(tclk))
+                return;
+
         list_for_each_entry(clkp, &clocks, node) {
                 if (likely(clkp->parent != tclk))
                         continue;
@@ -217,6 +269,9 @@ void propagate_rate(struct clk * tclk)
 
 int clk_register(struct clk *clk)
 {
+        if (clk == NULL || IS_ERR(clk))
+                return -EINVAL;
+
         mutex_lock(&clocks_mutex);
         list_add(&clk->node, &clocks);
         if (clk->init)
@@ -229,6 +284,9 @@ EXPORT_SYMBOL(clk_register);
 
 void clk_unregister(struct clk *clk)
 {
+        if (clk == NULL || IS_ERR(clk))
+                return;
+
         mutex_lock(&clocks_mutex);
         list_del(&clk->node);
         mutex_unlock(&clocks_mutex);
@@ -239,6 +297,9 @@ void clk_deny_idle(struct clk *clk)
 {
         unsigned long flags;
 
+        if (clk == NULL || IS_ERR(clk))
+                return;
+
         spin_lock_irqsave(&clockfw_lock, flags);
         if (arch_clock->clk_deny_idle)
                 arch_clock->clk_deny_idle(clk);
@@ -250,6 +311,9 @@ void clk_allow_idle(struct clk *clk)
 {
         unsigned long flags;
 
+        if (clk == NULL || IS_ERR(clk))
+                return;
+
         spin_lock_irqsave(&clockfw_lock, flags);
         if (arch_clock->clk_allow_idle)
                 arch_clock->clk_allow_idle(clk);
diff --git a/arch/arm/plat-omap/devices.c b/arch/arm/plat-omap/devices.c
index 9dcce904b608..5d5d6eb222dd 100644
--- a/arch/arm/plat-omap/devices.c
+++ b/arch/arm/plat-omap/devices.c
@@ -24,14 +24,7 @@
 #include <asm/arch/board.h>
 #include <asm/arch/mux.h>
 #include <asm/arch/gpio.h>
-
-
-void omap_nop_release(struct device *dev)
-{
-        /* Nothing */
-}
-
-/*-------------------------------------------------------------------------*/
+#include <asm/arch/menelaus.h>
 
 #if     defined(CONFIG_I2C_OMAP) || defined(CONFIG_I2C_OMAP_MODULE)
 
@@ -58,9 +51,6 @@ static struct resource i2c_resources1[] = {
 static struct platform_device omap_i2c_device1 = {
         .name           = "i2c_omap",
         .id             = 1,
-        .dev = {
-                .release        = omap_nop_release,
-        },
         .num_resources  = ARRAY_SIZE(i2c_resources1),
         .resource       = i2c_resources1,
 };
@@ -98,6 +88,62 @@ static inline void omap_init_i2c(void) {}
 #endif
 
 /*-------------------------------------------------------------------------*/
+#if     defined(CONFIG_KEYBOARD_OMAP) || defined(CONFIG_KEYBOARD_OMAP_MODULE)
+
+static void omap_init_kp(void)
+{
+        if (machine_is_omap_h2() || machine_is_omap_h3()) {
+                omap_cfg_reg(F18_1610_KBC0);
+                omap_cfg_reg(D20_1610_KBC1);
+                omap_cfg_reg(D19_1610_KBC2);
+                omap_cfg_reg(E18_1610_KBC3);
+                omap_cfg_reg(C21_1610_KBC4);
+
+                omap_cfg_reg(G18_1610_KBR0);
+                omap_cfg_reg(F19_1610_KBR1);
+                omap_cfg_reg(H14_1610_KBR2);
+                omap_cfg_reg(E20_1610_KBR3);
+                omap_cfg_reg(E19_1610_KBR4);
+                omap_cfg_reg(N19_1610_KBR5);
+        } else if (machine_is_omap_perseus2()) {
+                omap_cfg_reg(E2_730_KBR0);
+                omap_cfg_reg(J7_730_KBR1);
+                omap_cfg_reg(E1_730_KBR2);
+                omap_cfg_reg(F3_730_KBR3);
+                omap_cfg_reg(D2_730_KBR4);
+
+                omap_cfg_reg(C2_730_KBC0);
+                omap_cfg_reg(D3_730_KBC1);
+                omap_cfg_reg(E4_730_KBC2);
+                omap_cfg_reg(F4_730_KBC3);
+                omap_cfg_reg(E3_730_KBC4);
+        } else if (machine_is_omap_h4()) {
+                omap_cfg_reg(T19_24XX_KBR0);
+                omap_cfg_reg(R19_24XX_KBR1);
+                omap_cfg_reg(V18_24XX_KBR2);
+                omap_cfg_reg(M21_24XX_KBR3);
+                omap_cfg_reg(E5__24XX_KBR4);
+                if (omap_has_menelaus()) {
+                        omap_cfg_reg(B3__24XX_KBR5);
+                        omap_cfg_reg(AA4_24XX_KBC2);
+                        omap_cfg_reg(B13_24XX_KBC6);
+                } else {
+                        omap_cfg_reg(M18_24XX_KBR5);
+                        omap_cfg_reg(H19_24XX_KBC2);
+                        omap_cfg_reg(N19_24XX_KBC6);
+                }
+                omap_cfg_reg(R20_24XX_KBC0);
+                omap_cfg_reg(M14_24XX_KBC1);
+                omap_cfg_reg(V17_24XX_KBC3);
+                omap_cfg_reg(P21_24XX_KBC4);
+                omap_cfg_reg(L14_24XX_KBC5);
+        }
+}
+#else
+static inline void omap_init_kp(void) {}
+#endif
+
+/*-------------------------------------------------------------------------*/
 
 #if     defined(CONFIG_MMC_OMAP) || defined(CONFIG_MMC_OMAP_MODULE)
 
@@ -130,7 +176,6 @@ static struct platform_device mmc_omap_device1 = {
         .name           = "mmci-omap",
         .id             = 1,
         .dev = {
-                .release        = omap_nop_release,
                 .dma_mask       = &mmc1_dmamask,
                 .platform_data  = &mmc1_conf,
         },
@@ -160,7 +205,6 @@ static struct platform_device mmc_omap_device2 = {
         .name           = "mmci-omap",
         .id             = 2,
         .dev = {
-                .release        = omap_nop_release,
                 .dma_mask       = &mmc2_dmamask,
                 .platform_data  = &mmc2_conf,
         },
@@ -240,6 +284,52 @@ static void __init omap_init_mmc(void)
 static inline void omap_init_mmc(void) {}
 #endif
 
+/*-------------------------------------------------------------------------*/
+
+/* Numbering for the SPI-capable controllers when used for SPI:
+ * spi          = 1
+ * uwire        = 2
+ * mmc1..2      = 3..4
+ * mcbsp1..3    = 5..7
+ */
+
+#if defined(CONFIG_SPI_OMAP_UWIRE) || defined(CONFIG_SPI_OMAP_UWIRE_MODULE)
+
+#define OMAP_UWIRE_BASE         0xfffb3000
+
+static struct resource uwire_resources[] = {
+        {
+                .start          = OMAP_UWIRE_BASE,
+                .end            = OMAP_UWIRE_BASE + 0x20,
+                .flags          = IORESOURCE_MEM,
+        },
+};
+
+static struct platform_device omap_uwire_device = {
+        .name      = "omap_uwire",
+        .id          = -1,
+        .num_resources  = ARRAY_SIZE(uwire_resources),
+        .resource       = uwire_resources,
+};
+
+static void omap_init_uwire(void)
+{
+        /* FIXME define and use a boot tag; not all boards will be hooking
+         * up devices to the microwire controller, and multi-board configs
+         * mean that CONFIG_SPI_OMAP_UWIRE may be configured anyway...
+         */
+
+        /* board-specific code must configure chipselects (only a few
+         * are normally used) and SCLK/SDI/SDO (each has two choices).
+         */
+        (void) platform_device_register(&omap_uwire_device);
+}
+#else
+static inline void omap_init_uwire(void) {}
+#endif
+
+/*-------------------------------------------------------------------------*/
+
 #if     defined(CONFIG_OMAP_WATCHDOG) || defined(CONFIG_OMAP_WATCHDOG_MODULE)
 
 #ifdef CONFIG_ARCH_OMAP24XX
@@ -259,9 +349,6 @@ static struct resource wdt_resources[] = {
 static struct platform_device omap_wdt_device = {
         .name      = "omap_wdt",
         .id          = -1,
-        .dev = {
-                .release        = omap_nop_release,
-        },
         .num_resources  = ARRAY_SIZE(wdt_resources),
         .resource       = wdt_resources,
 };
@@ -295,9 +382,6 @@ static struct resource rng_resources[] = {
 static struct platform_device omap_rng_device = {
         .name      = "omap_rng",
         .id          = -1,
-        .dev = {
-                .release        = omap_nop_release,
-        },
         .num_resources  = ARRAY_SIZE(rng_resources),
         .resource       = rng_resources,
 };
@@ -310,40 +394,6 @@ static void omap_init_rng(void)
 static inline void omap_init_rng(void) {}
 #endif
 
-#if defined(CONFIG_FB_OMAP) || defined(CONFIG_FB_OMAP_MODULE)
-
-static struct omap_lcd_config omap_fb_conf;
-
-static u64 omap_fb_dma_mask = ~(u32)0;
-
-static struct platform_device omap_fb_device = {
-        .name           = "omapfb",
-        .id             = -1,
-        .dev = {
-                .release                = omap_nop_release,
-                .dma_mask               = &omap_fb_dma_mask,
-                .coherent_dma_mask      = ~(u32)0,
-                .platform_data          = &omap_fb_conf,
-        },
-        .num_resources = 0,
-};
-
-static inline void omap_init_fb(void)
-{
-        const struct omap_lcd_config *conf;
-
-        conf = omap_get_config(OMAP_TAG_LCD, struct omap_lcd_config);
-        if (conf != NULL)
-                omap_fb_conf = *conf;
-        platform_device_register(&omap_fb_device);
-}
-
-#else
-
-static inline void omap_init_fb(void) {}
-
-#endif
-
 /*
  * This gets called after board-specific INIT_MACHINE, and initializes most
  * on-chip peripherals accessible on this board (except for few like USB):
@@ -369,9 +419,10 @@ static int __init omap_init_devices(void)
         /* please keep these calls, and their implementations above,
          * in alphabetical order so they're easier to sort through.
          */
-        omap_init_fb();
         omap_init_i2c();
+        omap_init_kp();
         omap_init_mmc();
+        omap_init_uwire();
         omap_init_wdt();
         omap_init_rng();
 
diff --git a/arch/arm/plat-omap/dma.c b/arch/arm/plat-omap/dma.c
index a4e5ac77f6df..5dac4230360d 100644
--- a/arch/arm/plat-omap/dma.c
+++ b/arch/arm/plat-omap/dma.c
@@ -1258,6 +1258,11 @@ void omap_stop_lcd_dma(void)
         omap_writew(w, OMAP1610_DMA_LCD_CTRL);
 }
 
+int omap_lcd_dma_ext_running(void)
+{
+        return lcd_dma.ext_ctrl && lcd_dma.active;
+}
+
 /*----------------------------------------------------------------------------*/
 
 static int __init omap_init_dma(void)
@@ -1389,6 +1394,7 @@ EXPORT_SYMBOL(omap_free_lcd_dma);
 EXPORT_SYMBOL(omap_enable_lcd_dma);
 EXPORT_SYMBOL(omap_setup_lcd_dma);
 EXPORT_SYMBOL(omap_stop_lcd_dma);
+EXPORT_SYMBOL(omap_lcd_dma_ext_running);
 EXPORT_SYMBOL(omap_set_lcd_dma_b1);
 EXPORT_SYMBOL(omap_set_lcd_dma_single_transfer);
 EXPORT_SYMBOL(omap_set_lcd_dma_ext_controller);
diff --git a/arch/arm/plat-omap/dmtimer.c b/arch/arm/plat-omap/dmtimer.c
index 38d7ebf87920..eba3cb52ad87 100644
--- a/arch/arm/plat-omap/dmtimer.c
+++ b/arch/arm/plat-omap/dmtimer.c
@@ -97,6 +97,32 @@ int omap_dm_timers_active(void)
 }
 
 
+/**
+ * omap_dm_timer_modify_idlect_mask - Check if any running timers use ARMXOR
+ * @inputmask: current value of idlect mask
+ */
+__u32 omap_dm_timer_modify_idlect_mask(__u32 inputmask)
+{
+        int n;
+
+        /* If ARMXOR cannot be idled this function call is unnecessary */
+        if (!(inputmask & (1 << 1)))
+                return inputmask;
+
+        /* If any active timer is using ARMXOR return modified mask */
+        for (n = 0; dm_timers[n].base; ++n)
+                if (omap_dm_timer_read_reg(&dm_timers[n], OMAP_TIMER_CTRL_REG)&
+                    OMAP_TIMER_CTRL_ST) {
+                        if (((omap_readl(MOD_CONF_CTRL_1)>>(n*2)) & 0x03) == 0)
+                                inputmask &= ~(1 << 1);
+                        else
+                                inputmask &= ~(1 << 2);
+                }
+
+        return inputmask;
+}
+
+
 void omap_dm_timer_set_source(struct omap_dm_timer *timer, int source)
 {
         int n = (timer - dm_timers) << 1;
diff --git a/arch/arm/plat-omap/fb.c b/arch/arm/plat-omap/fb.c
new file mode 100644
index 000000000000..305e9b990b71
--- /dev/null
+++ b/arch/arm/plat-omap/fb.c
@@ -0,0 +1,80 @@
+#include <linux/config.h>
+#include <linux/module.h>
+#include <linux/kernel.h>
+#include <linux/init.h>
+#include <linux/platform_device.h>
+#include <linux/bootmem.h>
+
+#include <asm/hardware.h>
+#include <asm/io.h>
+#include <asm/mach-types.h>
+#include <asm/mach/map.h>
+
+#include <asm/arch/board.h>
+#include <asm/arch/sram.h>
+#include <asm/arch/omapfb.h>
+
+#if defined(CONFIG_FB_OMAP) || defined(CONFIG_FB_OMAP_MODULE)
+
+static struct omapfb_platform_data omapfb_config;
+
+static u64 omap_fb_dma_mask = ~(u32)0;
+
+static struct platform_device omap_fb_device = {
+        .name           = "omapfb",
+        .id             = -1,
+        .dev = {
+                .dma_mask               = &omap_fb_dma_mask,
+                .coherent_dma_mask      = ~(u32)0,
+                .platform_data          = &omapfb_config,
+        },
+        .num_resources = 0,
+};
+
+/* called from map_io */
+void omapfb_reserve_mem(void)
+{
+        const struct omap_fbmem_config *fbmem_conf;
+
+        omapfb_config.fbmem.fb_sram_start = omap_fb_sram_start;
+        omapfb_config.fbmem.fb_sram_size = omap_fb_sram_size;
+
+        fbmem_conf = omap_get_config(OMAP_TAG_FBMEM, struct omap_fbmem_config);
+
+        if (fbmem_conf != NULL) {
+                /* indicate that the bootloader already initialized the
+                 * fb device, so we'll skip that part in the fb driver
+                 */
+                omapfb_config.fbmem.fb_sdram_start = fbmem_conf->fb_sdram_start;
+                omapfb_config.fbmem.fb_sdram_size = fbmem_conf->fb_sdram_size;
+                if (fbmem_conf->fb_sdram_size) {
+                        pr_info("Reserving %u bytes SDRAM for frame buffer\n",
+                                fbmem_conf->fb_sdram_size);
+                        reserve_bootmem(fbmem_conf->fb_sdram_start,
+                                        fbmem_conf->fb_sdram_size);
+                }
+        }
+}
+
+static inline int omap_init_fb(void)
+{
+        const struct omap_lcd_config *conf;
+
+        conf = omap_get_config(OMAP_TAG_LCD, struct omap_lcd_config);
+        if (conf == NULL)
+                return 0;
+
+        omapfb_config.lcd = *conf;
+
+        return platform_device_register(&omap_fb_device);
+}
+
+arch_initcall(omap_init_fb);
+
+#else
+
+void omapfb_reserve_mem(void) {}
+
+#endif
+
+
diff --git a/arch/arm/plat-omap/gpio.c b/arch/arm/plat-omap/gpio.c
index b4d5b9e4bfce..d3c8ea7eecfd 100644
--- a/arch/arm/plat-omap/gpio.c
+++ b/arch/arm/plat-omap/gpio.c
@@ -174,7 +174,7 @@ static int gpio_bank_count;
 static inline struct gpio_bank *get_gpio_bank(int gpio)
 {
 #ifdef CONFIG_ARCH_OMAP15XX
-        if (cpu_is_omap1510()) {
+        if (cpu_is_omap15xx()) {
                 if (OMAP_GPIO_IS_MPUIO(gpio))
                         return &gpio_bank[0];
                 return &gpio_bank[1];
@@ -223,7 +223,7 @@ static inline int gpio_valid(int gpio)
                 return 0;
         }
 #ifdef CONFIG_ARCH_OMAP15XX
-        if (cpu_is_omap1510() && gpio < 16)
+        if (cpu_is_omap15xx() && gpio < 16)
                 return 0;
 #endif
 #if defined(CONFIG_ARCH_OMAP16XX)
@@ -402,13 +402,13 @@ static inline void set_24xx_gpio_triggering(void __iomem *base, int gpio, int tr
         u32 gpio_bit = 1 << gpio;
 
         MOD_REG_BIT(OMAP24XX_GPIO_LEVELDETECT0, gpio_bit,
-                trigger & IRQT_LOW);
+                trigger & __IRQT_LOWLVL);
         MOD_REG_BIT(OMAP24XX_GPIO_LEVELDETECT1, gpio_bit,
-                trigger & IRQT_HIGH);
+                trigger & __IRQT_HIGHLVL);
         MOD_REG_BIT(OMAP24XX_GPIO_RISINGDETECT, gpio_bit,
-                trigger & IRQT_RISING);
+                trigger & __IRQT_RISEDGE);
         MOD_REG_BIT(OMAP24XX_GPIO_FALLINGDETECT, gpio_bit,
-                trigger & IRQT_FALLING);
+                trigger & __IRQT_FALEDGE);
         /* FIXME: Possibly do 'set_irq_handler(j, do_level_IRQ)' if only level
          * triggering requested. */
 }
@@ -422,9 +422,9 @@ static int _set_gpio_triggering(struct gpio_bank *bank, int gpio, int trigger)
         case METHOD_MPUIO:
                 reg += OMAP_MPUIO_GPIO_INT_EDGE;
                 l = __raw_readl(reg);
-                if (trigger == IRQT_RISING)
+                if (trigger & __IRQT_RISEDGE)
                         l |= 1 << gpio;
-                else if (trigger == IRQT_FALLING)
+                else if (trigger & __IRQT_FALEDGE)
                         l &= ~(1 << gpio);
                 else
                         goto bad;
@@ -432,9 +432,9 @@ static int _set_gpio_triggering(struct gpio_bank *bank, int gpio, int trigger)
         case METHOD_GPIO_1510:
                 reg += OMAP1510_GPIO_INT_CONTROL;
                 l = __raw_readl(reg);
-                if (trigger == IRQT_RISING)
+                if (trigger & __IRQT_RISEDGE)
                         l |= 1 << gpio;
-                else if (trigger == IRQT_FALLING)
+                else if (trigger & __IRQT_FALEDGE)
                         l &= ~(1 << gpio);
                 else
                         goto bad;
@@ -446,20 +446,21 @@ static int _set_gpio_triggering(struct gpio_bank *bank, int gpio, int trigger)
                         reg += OMAP1610_GPIO_EDGE_CTRL1;
                 gpio &= 0x07;
                 /* We allow only edge triggering, i.e. two lowest bits */
-                if (trigger & ~IRQT_BOTHEDGE)
+                if (trigger & (__IRQT_LOWLVL | __IRQT_HIGHLVL))
                         BUG();
-                /* NOTE: knows __IRQT_{FAL,RIS}EDGE match OMAP hardware */
-                trigger &= 0x03;
                 l = __raw_readl(reg);
                 l &= ~(3 << (gpio << 1));
-                l |= trigger << (gpio << 1);
+                if (trigger & __IRQT_RISEDGE)
+                        l |= 2 << (gpio << 1);
+                if (trigger & __IRQT_FALEDGE)
+                        l |= 1 << (gpio << 1);
                 break;
         case METHOD_GPIO_730:
                 reg += OMAP730_GPIO_INT_CONTROL;
                 l = __raw_readl(reg);
-                if (trigger == IRQT_RISING)
+                if (trigger & __IRQT_RISEDGE)
                         l |= 1 << gpio;
-                else if (trigger == IRQT_FALLING)
+                else if (trigger & __IRQT_FALEDGE)
                         l &= ~(1 << gpio);
                 else
                         goto bad;
@@ -491,7 +492,9 @@ static int gpio_irq_type(unsigned irq, unsigned type)
         if (check_gpio(gpio) < 0)
                 return -EINVAL;
 
-        if (type & (__IRQT_LOWLVL|__IRQT_HIGHLVL|IRQT_PROBE))
+        if (type & IRQT_PROBE)
+                return -EINVAL;
+        if (!cpu_is_omap24xx() && (type & (__IRQT_LOWLVL|__IRQT_HIGHLVL)))
                 return -EINVAL;
 
         bank = get_gpio_bank(gpio);
@@ -755,13 +758,32 @@ static void gpio_irq_handler(unsigned int irq, struct irqdesc *desc,
         if (bank->method == METHOD_GPIO_24XX)
                 isr_reg = bank->base + OMAP24XX_GPIO_IRQSTATUS1;
 #endif
-
         while(1) {
-                isr = __raw_readl(isr_reg);
-                _enable_gpio_irqbank(bank, isr, 0);
-                _clear_gpio_irqbank(bank, isr);
-                _enable_gpio_irqbank(bank, isr, 1);
-                desc->chip->unmask(irq);
+                u32 isr_saved, level_mask = 0;
+
+                isr_saved = isr = __raw_readl(isr_reg);
+
+                if (cpu_is_omap15xx() && (bank->method == METHOD_MPUIO))
+                        isr &= 0x0000ffff;
+
+                if (cpu_is_omap24xx())
+                        level_mask =
+                                __raw_readl(bank->base +
+                                        OMAP24XX_GPIO_LEVELDETECT0) |
+                                __raw_readl(bank->base +
+                                        OMAP24XX_GPIO_LEVELDETECT1);
+
+                /* clear edge sensitive interrupts before handler(s) are
+                called so that we don't miss any interrupt occurred while
+                executing them */
+                _enable_gpio_irqbank(bank, isr_saved & ~level_mask, 0);
+                _clear_gpio_irqbank(bank, isr_saved & ~level_mask);
+                _enable_gpio_irqbank(bank, isr_saved & ~level_mask, 1);
+
+                /* if there is only edge sensitive GPIO pin interrupts
+                configured, we could unmask GPIO bank interrupt immediately */
+                if (!level_mask)
+                        desc->chip->unmask(irq);
 
                 if (!isr)
                         break;
@@ -774,6 +796,20 @@ static void gpio_irq_handler(unsigned int irq, struct irqdesc *desc,
                         d = irq_desc + gpio_irq;
                         desc_handle_irq(gpio_irq, d, regs);
                 }
+
+                if (cpu_is_omap24xx()) {
+                        /* clear level sensitive interrupts after handler(s) */
+                        _enable_gpio_irqbank(bank, isr_saved & level_mask, 0);
+                        _clear_gpio_irqbank(bank, isr_saved & level_mask);
+                        _enable_gpio_irqbank(bank, isr_saved & level_mask, 1);
+                }
+
+                /* if bank has any level sensitive GPIO pin interrupt
+                configured, we must unmask the bank interrupt only after
+                handler(s) are executed in order to avoid spurious bank
+                interrupt */
+                if (level_mask)
+                        desc->chip->unmask(irq);
         }
 }
 
@@ -848,7 +884,7 @@ static int __init _omap_gpio_init(void)
 
         initialized = 1;
 
-        if (cpu_is_omap1510()) {
+        if (cpu_is_omap15xx()) {
                 gpio_ick = clk_get(NULL, "arm_gpio_ck");
                 if (IS_ERR(gpio_ick))
                         printk("Could not get arm_gpio_ck\n");
@@ -869,7 +905,7 @@ static int __init _omap_gpio_init(void)
         }
 
 #ifdef CONFIG_ARCH_OMAP15XX
-        if (cpu_is_omap1510()) {
+        if (cpu_is_omap15xx()) {
                 printk(KERN_INFO "OMAP1510 GPIO hardware\n");
                 gpio_bank_count = 2;
                 gpio_bank = gpio_bank_1510;
diff --git a/arch/arm/plat-omap/mcbsp.c b/arch/arm/plat-omap/mcbsp.c
index 1cd2cace7e1b..196aac3ac329 100644
--- a/arch/arm/plat-omap/mcbsp.c
+++ b/arch/arm/plat-omap/mcbsp.c
@@ -34,7 +34,7 @@
 #ifdef CONFIG_MCBSP_DEBUG
 #define DBG(x...)       printk(x)
 #else
-#define DBG(x...)       do { } while (0)
+#define DBG(x...)                       do { } while (0)
 #endif
 
 struct omap_mcbsp {
@@ -44,6 +44,7 @@ struct omap_mcbsp {
         omap_mcbsp_word_length       rx_word_length;
         omap_mcbsp_word_length       tx_word_length;
 
+        omap_mcbsp_io_type_t         io_type; /* IRQ or poll */
         /* IRQ based TX/RX */
         int                          rx_irq;
         int                          tx_irq;
@@ -64,10 +65,19 @@ struct omap_mcbsp {
 };
 
 static struct omap_mcbsp mcbsp[OMAP_MAX_MCBSP_COUNT];
+#ifdef CONFIG_ARCH_OMAP1
 static struct clk *mcbsp_dsp_ck = 0;
 static struct clk *mcbsp_api_ck = 0;
 static struct clk *mcbsp_dspxor_ck = 0;
-
+#endif
+#ifdef CONFIG_ARCH_OMAP2
+static struct clk *mcbsp1_ick = 0;
+static struct clk *mcbsp1_fck = 0;
+static struct clk *mcbsp2_ick = 0;
+static struct clk *mcbsp2_fck = 0;
+static struct clk *sys_ck = 0;
+static struct clk *sys_clkout = 0;
+#endif
 
 static void omap_mcbsp_dump_reg(u8 id)
 {
@@ -88,7 +98,6 @@ static void omap_mcbsp_dump_reg(u8 id)
         DBG("***********************\n");
 }
 
-
 static irqreturn_t omap_mcbsp_tx_irq_handler(int irq, void *dev_id, struct pt_regs *regs)
 {
         struct omap_mcbsp * mcbsp_tx = (struct omap_mcbsp *)(dev_id);
@@ -109,7 +118,6 @@ static irqreturn_t omap_mcbsp_rx_irq_handler(int irq, void *dev_id, struct pt_re
         return IRQ_HANDLED;
 }
 
-
 static void omap_mcbsp_tx_dma_callback(int lch, u16 ch_status, void *data)
 {
         struct omap_mcbsp * mcbsp_dma_tx = (struct omap_mcbsp *)(data);
@@ -176,7 +184,7 @@ static int omap_mcbsp_check(unsigned int id)
                 return 0;
         }
 
-        if (cpu_is_omap1510() || cpu_is_omap16xx()) {
+        if (cpu_is_omap15xx() || cpu_is_omap16xx() || cpu_is_omap24xx()) {
                 if (id > OMAP_MAX_MCBSP_COUNT) {
                         printk(KERN_ERR "OMAP-McBSP: McBSP%d doesn't exist\n", id + 1);
                         return -1;
@@ -187,9 +195,10 @@ static int omap_mcbsp_check(unsigned int id)
         return -1;
 }
 
+#ifdef CONFIG_ARCH_OMAP1
 static void omap_mcbsp_dsp_request(void)
 {
-        if (cpu_is_omap1510() || cpu_is_omap16xx()) {
+        if (cpu_is_omap15xx() || cpu_is_omap16xx()) {
                 clk_enable(mcbsp_dsp_ck);
                 clk_enable(mcbsp_api_ck);
 
@@ -207,12 +216,49 @@ static void omap_mcbsp_dsp_request(void)
 
 static void omap_mcbsp_dsp_free(void)
 {
-        if (cpu_is_omap1510() || cpu_is_omap16xx()) {
+        if (cpu_is_omap15xx() || cpu_is_omap16xx()) {
                 clk_disable(mcbsp_dspxor_ck);
                 clk_disable(mcbsp_dsp_ck);
                 clk_disable(mcbsp_api_ck);
         }
 }
+#endif
+
+#ifdef CONFIG_ARCH_OMAP2
+static void omap2_mcbsp2_mux_setup(void)
+{
+        omap_cfg_reg(Y15_24XX_MCBSP2_CLKX);
+        omap_cfg_reg(R14_24XX_MCBSP2_FSX);
+        omap_cfg_reg(W15_24XX_MCBSP2_DR);
+        omap_cfg_reg(V15_24XX_MCBSP2_DX);
+        omap_cfg_reg(V14_24XX_GPIO117);
+        omap_cfg_reg(W14_24XX_SYS_CLKOUT);
+}
+#endif
+
+/*
+ * We can choose between IRQ based or polled IO.
+ * This needs to be called before omap_mcbsp_request().
+ */
+int omap_mcbsp_set_io_type(unsigned int id, omap_mcbsp_io_type_t io_type)
+{
+        if (omap_mcbsp_check(id) < 0)
+                return -EINVAL;
+
+        spin_lock(&mcbsp[id].lock);
+
+        if (!mcbsp[id].free) {
+                printk (KERN_ERR "OMAP-McBSP: McBSP%d is currently in use\n", id + 1);
+                spin_unlock(&mcbsp[id].lock);
+                return -EINVAL;
+        }
+
+        mcbsp[id].io_type = io_type;
+
+        spin_unlock(&mcbsp[id].lock);
+
+        return 0;
+}
 
 int omap_mcbsp_request(unsigned int id)
 {
@@ -221,12 +267,26 @@ int omap_mcbsp_request(unsigned int id)
         if (omap_mcbsp_check(id) < 0)
                 return -EINVAL;
 
+#ifdef CONFIG_ARCH_OMAP1
         /*
          * On 1510, 1610 and 1710, McBSP1 and McBSP3
          * are DSP public peripherals.
          */
         if (id == OMAP_MCBSP1 || id == OMAP_MCBSP3)
                 omap_mcbsp_dsp_request();
+#endif
+
+#ifdef CONFIG_ARCH_OMAP2
+        if (cpu_is_omap24xx()) {
+                if (id == OMAP_MCBSP1) {
+                        clk_enable(mcbsp1_ick);
+                        clk_enable(mcbsp1_fck);
+                } else {
+                        clk_enable(mcbsp2_ick);
+                        clk_enable(mcbsp2_fck);
+                }
+        }
+#endif
 
         spin_lock(&mcbsp[id].lock);
         if (!mcbsp[id].free) {
@@ -238,30 +298,33 @@ int omap_mcbsp_request(unsigned int id)
         mcbsp[id].free = 0;
         spin_unlock(&mcbsp[id].lock);
 
-        /* We need to get IRQs here */
-        err = request_irq(mcbsp[id].tx_irq, omap_mcbsp_tx_irq_handler, 0,
-                          "McBSP",
-                          (void *) (&mcbsp[id]));
-        if (err != 0) {
-                printk(KERN_ERR "OMAP-McBSP: Unable to request TX IRQ %d for McBSP%d\n",
-                       mcbsp[id].tx_irq, mcbsp[id].id);
-                return err;
-        }
+        if (mcbsp[id].io_type == OMAP_MCBSP_IRQ_IO) {
+                /* We need to get IRQs here */
+                err = request_irq(mcbsp[id].tx_irq, omap_mcbsp_tx_irq_handler, 0,
+                                  "McBSP",
+                                  (void *) (&mcbsp[id]));
+                if (err != 0) {
+                        printk(KERN_ERR "OMAP-McBSP: Unable to request TX IRQ %d for McBSP%d\n",
+                               mcbsp[id].tx_irq, mcbsp[id].id);
+                        return err;
+                }
 
-        init_completion(&(mcbsp[id].tx_irq_completion));
+                init_completion(&(mcbsp[id].tx_irq_completion));
 
 
-        err = request_irq(mcbsp[id].rx_irq, omap_mcbsp_rx_irq_handler, 0,
-                          "McBSP",
-                          (void *) (&mcbsp[id]));
-        if (err != 0) {
-                printk(KERN_ERR "OMAP-McBSP: Unable to request RX IRQ %d for McBSP%d\n",
-                       mcbsp[id].rx_irq, mcbsp[id].id);
-                free_irq(mcbsp[id].tx_irq, (void *) (&mcbsp[id]));
-                return err;
+                err = request_irq(mcbsp[id].rx_irq, omap_mcbsp_rx_irq_handler, 0,
+                                  "McBSP",
+                                  (void *) (&mcbsp[id]));
+                if (err != 0) {
+                        printk(KERN_ERR "OMAP-McBSP: Unable to request RX IRQ %d for McBSP%d\n",
+                               mcbsp[id].rx_irq, mcbsp[id].id);
+                        free_irq(mcbsp[id].tx_irq, (void *) (&mcbsp[id]));
+                        return err;
+                }
+
+                init_completion(&(mcbsp[id].rx_irq_completion));
         }
 
-        init_completion(&(mcbsp[id].rx_irq_completion));
         return 0;
 
 }
@@ -271,8 +334,24 @@ void omap_mcbsp_free(unsigned int id)
         if (omap_mcbsp_check(id) < 0)
                 return;
 
-        if (id == OMAP_MCBSP1 || id == OMAP_MCBSP3)
-                omap_mcbsp_dsp_free();
+#ifdef CONFIG_ARCH_OMAP1
+        if (cpu_class_is_omap1()) {
+                if (id == OMAP_MCBSP1 || id == OMAP_MCBSP3)
+                        omap_mcbsp_dsp_free();
+        }
+#endif
+
+#ifdef CONFIG_ARCH_OMAP2
+        if (cpu_is_omap24xx()) {
+                if (id == OMAP_MCBSP1) {
+                        clk_disable(mcbsp1_ick);
+                        clk_disable(mcbsp1_fck);
+                } else {
+                        clk_disable(mcbsp2_ick);
+                        clk_disable(mcbsp2_fck);
+                }
+        }
+#endif
 
         spin_lock(&mcbsp[id].lock);
         if (mcbsp[id].free) {
@@ -284,9 +363,11 @@ void omap_mcbsp_free(unsigned int id)
         mcbsp[id].free = 1;
         spin_unlock(&mcbsp[id].lock);
 
-        /* Free IRQs */
-        free_irq(mcbsp[id].rx_irq, (void *) (&mcbsp[id]));
-        free_irq(mcbsp[id].tx_irq, (void *) (&mcbsp[id]));
+        if (mcbsp[id].io_type == OMAP_MCBSP_IRQ_IO) {
+                /* Free IRQs */
+                free_irq(mcbsp[id].rx_irq, (void *) (&mcbsp[id]));
+                free_irq(mcbsp[id].tx_irq, (void *) (&mcbsp[id]));
+        }
 }
 
 /*
@@ -461,6 +542,115 @@ u32 omap_mcbsp_recv_word(unsigned int id)
 }
 
 
+int omap_mcbsp_spi_master_xmit_word_poll(unsigned int id, u32 word)
+{
+        u32 io_base = mcbsp[id].io_base;
+        omap_mcbsp_word_length tx_word_length = mcbsp[id].tx_word_length;
+        omap_mcbsp_word_length rx_word_length = mcbsp[id].rx_word_length;
+        u16 spcr2, spcr1, attempts = 0, word_lsb, word_msb = 0;
+
+        if (tx_word_length != rx_word_length)
+                return -EINVAL;
+
+        /* First we wait for the transmitter to be ready */
+        spcr2 = OMAP_MCBSP_READ(io_base, SPCR2);
+        while (!(spcr2 & XRDY)) {
+                spcr2 = OMAP_MCBSP_READ(io_base, SPCR2);
+                if (attempts++ > 1000) {
+                        /* We must reset the transmitter */
+                        OMAP_MCBSP_WRITE(io_base, SPCR2, spcr2 & (~XRST));
+                        udelay(10);
+                        OMAP_MCBSP_WRITE(io_base, SPCR2, spcr2 | XRST);
+                        udelay(10);
+                        printk("McBSP transmitter not ready\n");
+                        return -EAGAIN;
+                }
+        }
+
+        /* Now we can push the data */
+        if (tx_word_length > OMAP_MCBSP_WORD_16)
+                OMAP_MCBSP_WRITE(io_base, DXR2, word >> 16);
+        OMAP_MCBSP_WRITE(io_base, DXR1, word & 0xffff);
+
+        /* We wait for the receiver to be ready */
+        spcr1 = OMAP_MCBSP_READ(io_base, SPCR1);
+        while (!(spcr1 & RRDY)) {
+                spcr1 = OMAP_MCBSP_READ(io_base, SPCR1);
+                if (attempts++ > 1000) {
+                        /* We must reset the receiver */
+                        OMAP_MCBSP_WRITE(io_base, SPCR1, spcr1 & (~RRST));
+                        udelay(10);
+                        OMAP_MCBSP_WRITE(io_base, SPCR1, spcr1 | RRST);
+                        udelay(10);
+                        printk("McBSP receiver not ready\n");
+                        return -EAGAIN;
+                }
+        }
+
+        /* Receiver is ready, let's read the dummy data */
+        if (rx_word_length > OMAP_MCBSP_WORD_16)
+                word_msb = OMAP_MCBSP_READ(io_base, DRR2);
+        word_lsb = OMAP_MCBSP_READ(io_base, DRR1);
+
+        return 0;
+}
+
+int omap_mcbsp_spi_master_recv_word_poll(unsigned int id, u32 * word)
+{
+        u32 io_base = mcbsp[id].io_base, clock_word = 0;
+        omap_mcbsp_word_length tx_word_length = mcbsp[id].tx_word_length;
+        omap_mcbsp_word_length rx_word_length = mcbsp[id].rx_word_length;
+        u16 spcr2, spcr1, attempts = 0, word_lsb, word_msb = 0;
+
+        if (tx_word_length != rx_word_length)
+                return -EINVAL;
+
+        /* First we wait for the transmitter to be ready */
+        spcr2 = OMAP_MCBSP_READ(io_base, SPCR2);
+        while (!(spcr2 & XRDY)) {
+                spcr2 = OMAP_MCBSP_READ(io_base, SPCR2);
+                if (attempts++ > 1000) {
+                        /* We must reset the transmitter */
+                        OMAP_MCBSP_WRITE(io_base, SPCR2, spcr2 & (~XRST));
+                        udelay(10);
+                        OMAP_MCBSP_WRITE(io_base, SPCR2, spcr2 | XRST);
+                        udelay(10);
+                        printk("McBSP transmitter not ready\n");
+                        return -EAGAIN;
+                }
+        }
+
+        /* We first need to enable the bus clock */
+        if (tx_word_length > OMAP_MCBSP_WORD_16)
+                OMAP_MCBSP_WRITE(io_base, DXR2, clock_word >> 16);
+        OMAP_MCBSP_WRITE(io_base, DXR1, clock_word & 0xffff);
+
+        /* We wait for the receiver to be ready */
+        spcr1 = OMAP_MCBSP_READ(io_base, SPCR1);
+        while (!(spcr1 & RRDY)) {
+                spcr1 = OMAP_MCBSP_READ(io_base, SPCR1);
+                if (attempts++ > 1000) {
+                        /* We must reset the receiver */
+                        OMAP_MCBSP_WRITE(io_base, SPCR1, spcr1 & (~RRST));
+                        udelay(10);
+                        OMAP_MCBSP_WRITE(io_base, SPCR1, spcr1 | RRST);
+                        udelay(10);
+                        printk("McBSP receiver not ready\n");
+                        return -EAGAIN;
+                }
+        }
+
+        /* Receiver is ready, there is something for us */
+        if (rx_word_length > OMAP_MCBSP_WORD_16)
+                word_msb = OMAP_MCBSP_READ(io_base, DRR2);
+        word_lsb = OMAP_MCBSP_READ(io_base, DRR1);
+
+        word[0] = (word_lsb | (word_msb << 16));
+
+        return 0;
+}
+
+
 /*
  * Simple DMA based buffer rx/tx routines.
  * Nothing fancy, just a single buffer tx/rx through DMA.
@@ -471,6 +661,9 @@ u32 omap_mcbsp_recv_word(unsigned int id)
 int omap_mcbsp_xmit_buffer(unsigned int id, dma_addr_t buffer, unsigned int length)
 {
         int dma_tx_ch;
+        int src_port = 0;
+        int dest_port = 0;
+        int sync_dev = 0;
 
         if (omap_mcbsp_check(id) < 0)
                 return -EINVAL;
@@ -487,20 +680,27 @@ int omap_mcbsp_xmit_buffer(unsigned int id, dma_addr_t buffer, unsigned int leng
 
         init_completion(&(mcbsp[id].tx_dma_completion));
 
+        if (cpu_class_is_omap1()) {
+                src_port = OMAP_DMA_PORT_TIPB;
+                dest_port = OMAP_DMA_PORT_EMIFF;
+        }
+        if (cpu_is_omap24xx())
+                sync_dev = mcbsp[id].dma_tx_sync;
+
         omap_set_dma_transfer_params(mcbsp[id].dma_tx_lch,
                                      OMAP_DMA_DATA_TYPE_S16,
                                      length >> 1, 1,
                                      OMAP_DMA_SYNC_ELEMENT,
-                                     0, 0);
+         sync_dev, 0);
 
         omap_set_dma_dest_params(mcbsp[id].dma_tx_lch,
-                                 OMAP_DMA_PORT_TIPB,
+                                 src_port,
                                  OMAP_DMA_AMODE_CONSTANT,
                                  mcbsp[id].io_base + OMAP_MCBSP_REG_DXR1,
                                  0, 0);
 
         omap_set_dma_src_params(mcbsp[id].dma_tx_lch,
-                                OMAP_DMA_PORT_EMIFF,
+                                dest_port,
                                 OMAP_DMA_AMODE_POST_INC,
                                 buffer,
                                 0, 0);
@@ -514,6 +714,9 @@ int omap_mcbsp_xmit_buffer(unsigned int id, dma_addr_t buffer, unsigned int leng
 int omap_mcbsp_recv_buffer(unsigned int id, dma_addr_t buffer, unsigned int length)
 {
         int dma_rx_ch;
+        int src_port = 0;
+        int dest_port = 0;
+        int sync_dev = 0;
 
         if (omap_mcbsp_check(id) < 0)
                 return -EINVAL;
@@ -530,20 +733,27 @@ int omap_mcbsp_recv_buffer(unsigned int id, dma_addr_t buffer, unsigned int leng
 
         init_completion(&(mcbsp[id].rx_dma_completion));
 
+        if (cpu_class_is_omap1()) {
+                src_port = OMAP_DMA_PORT_TIPB;
+                dest_port = OMAP_DMA_PORT_EMIFF;
+        }
+        if (cpu_is_omap24xx())
+                sync_dev = mcbsp[id].dma_rx_sync;
+
         omap_set_dma_transfer_params(mcbsp[id].dma_rx_lch,
                                      OMAP_DMA_DATA_TYPE_S16,
                                      length >> 1, 1,
                                      OMAP_DMA_SYNC_ELEMENT,
-                                     0, 0);
+         sync_dev, 0);
 
         omap_set_dma_src_params(mcbsp[id].dma_rx_lch,
-                                OMAP_DMA_PORT_TIPB,
+                                src_port,
                                 OMAP_DMA_AMODE_CONSTANT,
                                 mcbsp[id].io_base + OMAP_MCBSP_REG_DRR1,
                                 0, 0);
 
         omap_set_dma_dest_params(mcbsp[id].dma_rx_lch,
-                                 OMAP_DMA_PORT_EMIFF,
+                                 dest_port,
                                  OMAP_DMA_AMODE_POST_INC,
                                  buffer,
                                  0, 0);
@@ -688,6 +898,23 @@ static const struct omap_mcbsp_info mcbsp_1610[] = {
 };
 #endif
 
+#if defined(CONFIG_ARCH_OMAP24XX)
+static const struct omap_mcbsp_info mcbsp_24xx[] = {
+        [0] = { .virt_base = IO_ADDRESS(OMAP24XX_MCBSP1_BASE),
+                .dma_rx_sync = OMAP24XX_DMA_MCBSP1_RX,
+                .dma_tx_sync = OMAP24XX_DMA_MCBSP1_TX,
+                .rx_irq = INT_24XX_MCBSP1_IRQ_RX,
+                .tx_irq = INT_24XX_MCBSP1_IRQ_TX,
+                },
+        [1] = { .virt_base = IO_ADDRESS(OMAP24XX_MCBSP2_BASE),
+                .dma_rx_sync = OMAP24XX_DMA_MCBSP2_RX,
+                .dma_tx_sync = OMAP24XX_DMA_MCBSP2_TX,
+                .rx_irq = INT_24XX_MCBSP2_IRQ_RX,
+                .tx_irq = INT_24XX_MCBSP2_IRQ_TX,
+                },
+};
+#endif
+
 static int __init omap_mcbsp_init(void)
 {
         int mcbsp_count = 0, i;
@@ -695,6 +922,7 @@ static int __init omap_mcbsp_init(void)
 
         printk("Initializing OMAP McBSP system\n");
 
+#ifdef CONFIG_ARCH_OMAP1
         mcbsp_dsp_ck = clk_get(0, "dsp_ck");
         if (IS_ERR(mcbsp_dsp_ck)) {
                 printk(KERN_ERR "mcbsp: could not acquire dsp_ck handle.\n");
@@ -710,6 +938,29 @@ static int __init omap_mcbsp_init(void)
                 printk(KERN_ERR "mcbsp: could not acquire dspxor_ck handle.\n");
                 return PTR_ERR(mcbsp_dspxor_ck);
         }
+#endif
+#ifdef CONFIG_ARCH_OMAP2
+        mcbsp1_ick = clk_get(0, "mcbsp1_ick");
+        if (IS_ERR(mcbsp1_ick)) {
+                printk(KERN_ERR "mcbsp: could not acquire mcbsp1_ick handle.\n");
+                return PTR_ERR(mcbsp1_ick);
+        }
+        mcbsp1_fck = clk_get(0, "mcbsp1_fck");
+        if (IS_ERR(mcbsp1_fck)) {
+                printk(KERN_ERR "mcbsp: could not acquire mcbsp1_fck handle.\n");
+                return PTR_ERR(mcbsp1_fck);
+        }
+        mcbsp2_ick = clk_get(0, "mcbsp2_ick");
+        if (IS_ERR(mcbsp2_ick)) {
+                printk(KERN_ERR "mcbsp: could not acquire mcbsp2_ick handle.\n");
+                return PTR_ERR(mcbsp2_ick);
+        }
+        mcbsp2_fck = clk_get(0, "mcbsp2_fck");
+        if (IS_ERR(mcbsp2_fck)) {
+                printk(KERN_ERR "mcbsp: could not acquire mcbsp2_fck handle.\n");
+                return PTR_ERR(mcbsp2_fck);
+        }
+#endif
 
 #ifdef CONFIG_ARCH_OMAP730
         if (cpu_is_omap730()) {
@@ -718,7 +969,7 @@ static int __init omap_mcbsp_init(void)
         }
 #endif
 #ifdef CONFIG_ARCH_OMAP15XX
-        if (cpu_is_omap1510()) {
+        if (cpu_is_omap15xx()) {
                 mcbsp_info = mcbsp_1510;
                 mcbsp_count = ARRAY_SIZE(mcbsp_1510);
         }
@@ -729,6 +980,19 @@ static int __init omap_mcbsp_init(void)
                 mcbsp_count = ARRAY_SIZE(mcbsp_1610);
         }
 #endif
+#if defined(CONFIG_ARCH_OMAP24XX)
+        if (cpu_is_omap24xx()) {
+                mcbsp_info = mcbsp_24xx;
+                mcbsp_count = ARRAY_SIZE(mcbsp_24xx);
+
+                /* REVISIT: where's the right place? */
+                omap2_mcbsp2_mux_setup();
+                sys_ck = clk_get(0, "sys_ck");
+                sys_clkout = clk_get(0, "sys_clkout");
+                clk_set_parent(sys_clkout, sys_ck);
+                clk_enable(sys_clkout);
+        }
+#endif
         for (i = 0; i < OMAP_MAX_MCBSP_COUNT ; i++) {
                 if (i >= mcbsp_count) {
                         mcbsp[i].io_base = 0;
@@ -741,6 +1005,7 @@ static int __init omap_mcbsp_init(void)
                 mcbsp[i].dma_rx_lch = -1;
 
                 mcbsp[i].io_base = mcbsp_info[i].virt_base;
+                mcbsp[i].io_type = OMAP_MCBSP_IRQ_IO; /* Default I/O is IRQ based */
                 mcbsp[i].tx_irq = mcbsp_info[i].tx_irq;
                 mcbsp[i].rx_irq = mcbsp_info[i].rx_irq;
                 mcbsp[i].dma_rx_sync = mcbsp_info[i].dma_rx_sync;
@@ -751,11 +1016,11 @@ static int __init omap_mcbsp_init(void)
         return 0;
 }
 
-
 arch_initcall(omap_mcbsp_init);
 
 EXPORT_SYMBOL(omap_mcbsp_config);
 EXPORT_SYMBOL(omap_mcbsp_request);
+EXPORT_SYMBOL(omap_mcbsp_set_io_type);
 EXPORT_SYMBOL(omap_mcbsp_free);
 EXPORT_SYMBOL(omap_mcbsp_start);
 EXPORT_SYMBOL(omap_mcbsp_stop);
@@ -763,4 +1028,6 @@ EXPORT_SYMBOL(omap_mcbsp_xmit_word);
 EXPORT_SYMBOL(omap_mcbsp_recv_word);
 EXPORT_SYMBOL(omap_mcbsp_xmit_buffer);
 EXPORT_SYMBOL(omap_mcbsp_recv_buffer);
+EXPORT_SYMBOL(omap_mcbsp_spi_master_xmit_word_poll);
+EXPORT_SYMBOL(omap_mcbsp_spi_master_recv_word_poll);
 EXPORT_SYMBOL(omap_mcbsp_set_spi_mode);
diff --git a/arch/arm/plat-omap/ocpi.c b/arch/arm/plat-omap/ocpi.c
index 5cc6775c789c..37792d43738b 100644
--- a/arch/arm/plat-omap/ocpi.c
+++ b/arch/arm/plat-omap/ocpi.c
@@ -62,9 +62,6 @@ int ocpi_enable(void)
         if (!cpu_is_omap16xx())
                 return -ENODEV;
 
-        /* Make sure there's clock for OCPI */
-        clk_enable(ocpi_ck);
-
         /* Enable access for OHCI in OCPI */
         val = omap_readl(OCPI_PROT);
         val &= ~0xff;
diff --git a/arch/arm/plat-omap/pm.c b/arch/arm/plat-omap/pm.c
index 093efd786f21..1a24e2c10714 100644
--- a/arch/arm/plat-omap/pm.c
+++ b/arch/arm/plat-omap/pm.c
@@ -38,6 +38,7 @@
 #include <linux/pm.h>
 #include <linux/sched.h>
 #include <linux/proc_fs.h>
+#include <linux/pm.h>
 #include <linux/interrupt.h>
 
 #include <asm/io.h>
diff --git a/arch/arm/plat-omap/sram.c b/arch/arm/plat-omap/sram.c
index ee82763b02b8..b7bf09b1b412 100644
--- a/arch/arm/plat-omap/sram.c
+++ b/arch/arm/plat-omap/sram.c
@@ -16,24 +16,94 @@
 #include <linux/kernel.h>
 #include <linux/init.h>
 
-#include <asm/mach/map.h>
 #include <asm/tlb.h>
 #include <asm/io.h>
 #include <asm/cacheflush.h>
 
+#include <asm/mach/map.h>
+
 #include <asm/arch/sram.h>
+#include <asm/arch/board.h>
 
 #define OMAP1_SRAM_PA           0x20000000
 #define OMAP1_SRAM_VA           0xd0000000
 #define OMAP2_SRAM_PA           0x40200000
+#define OMAP2_SRAM_PUB_PA       0x4020f800
 #define OMAP2_SRAM_VA           0xd0000000
+#define OMAP2_SRAM_PUB_VA       0xd0000800
 
+#if defined(CONFIG_ARCH_OMAP24XX)
+#define SRAM_BOOTLOADER_SZ      0x00
+#else
 #define SRAM_BOOTLOADER_SZ      0x80
+#endif
+
+#define VA_REQINFOPERM0         IO_ADDRESS(0x68005048)
+#define VA_READPERM0            IO_ADDRESS(0x68005050)
+#define VA_WRITEPERM0           IO_ADDRESS(0x68005058)
+#define VA_CONTROL_STAT         IO_ADDRESS(0x480002F8)
+#define GP_DEVICE               0x300
+#define TYPE_MASK               0x700
+
+#define ROUND_DOWN(value,boundary)      ((value) & (~((boundary)-1)))
 
 static unsigned long omap_sram_base;
 static unsigned long omap_sram_size;
 static unsigned long omap_sram_ceil;
 
+unsigned long omap_fb_sram_start;
+unsigned long omap_fb_sram_size;
+
+/* Depending on the target RAMFS firewall setup, the public usable amount of
+ * SRAM varies.  The default accessable size for all device types is 2k. A GP
+ * device allows ARM11 but not other initators for full size. This
+ * functionality seems ok until some nice security API happens.
+ */
+static int is_sram_locked(void)
+{
+        int type = 0;
+
+        if (cpu_is_omap242x())
+                type = __raw_readl(VA_CONTROL_STAT) & TYPE_MASK;
+
+        if (type == GP_DEVICE) {
+                /* RAMFW: R/W access to all initators for all qualifier sets */
+                if (cpu_is_omap242x()) {
+                        __raw_writel(0xFF, VA_REQINFOPERM0); /* all q-vects */
+                        __raw_writel(0xCFDE, VA_READPERM0);  /* all i-read */
+                        __raw_writel(0xCFDE, VA_WRITEPERM0); /* all i-write */
+                }
+                return 0;
+        } else
+                return 1; /* assume locked with no PPA or security driver */
+}
+
+void get_fb_sram_conf(unsigned long start_avail, unsigned size_avail,
+                      unsigned long *start, unsigned long *size)
+{
+        const struct omap_fbmem_config *fbmem_conf;
+
+        fbmem_conf = omap_get_config(OMAP_TAG_FBMEM, struct omap_fbmem_config);
+        if (fbmem_conf != NULL) {
+                *start = fbmem_conf->fb_sram_start;
+                *size = fbmem_conf->fb_sram_size;
+        } else {
+                *size = 0;
+                *start = 0;
+        }
+
+        if (*size && (
+            *start < start_avail ||
+            *start + *size > start_avail + size_avail)) {
+                printk(KERN_ERR "invalid FB SRAM configuration\n");
+                *start = start_avail;
+                *size = size_avail;
+        }
+
+        if (*size)
+                pr_info("Reserving %lu bytes SRAM for frame buffer\n", *size);
+}
+
 /*
  * The amount of SRAM depends on the core type.
  * Note that we cannot try to test for SRAM here because writes
@@ -42,26 +112,45 @@ static unsigned long omap_sram_ceil;
  */
 void __init omap_detect_sram(void)
 {
-        if (!cpu_is_omap24xx())
+        unsigned long sram_start;
+
+        if (cpu_is_omap24xx()) {
+                if (is_sram_locked()) {
+                        omap_sram_base = OMAP2_SRAM_PUB_VA;
+                        sram_start = OMAP2_SRAM_PUB_PA;
+                        omap_sram_size = 0x800; /* 2K */
+                } else {
+                        omap_sram_base = OMAP2_SRAM_VA;
+                        sram_start = OMAP2_SRAM_PA;
+                        if (cpu_is_omap242x())
+                                omap_sram_size = 0xa0000; /* 640K */
+                        else if (cpu_is_omap243x())
+                                omap_sram_size = 0x10000; /* 64K */
+                }
+        } else {
                 omap_sram_base = OMAP1_SRAM_VA;
-        else
-                omap_sram_base = OMAP2_SRAM_VA;
-
-        if (cpu_is_omap730())
-                omap_sram_size = 0x32000;       /* 200K */
-        else if (cpu_is_omap15xx())
-                omap_sram_size = 0x30000;       /* 192K */
-        else if (cpu_is_omap1610() || cpu_is_omap1621() || cpu_is_omap1710())
-                omap_sram_size = 0x4000;        /* 16K */
-        else if (cpu_is_omap1611())
-                omap_sram_size = 0x3e800;       /* 250K */
-        else if (cpu_is_omap2420())
-                omap_sram_size = 0xa0014;       /* 640K */
-        else {
-                printk(KERN_ERR "Could not detect SRAM size\n");
-                omap_sram_size = 0x4000;
+                sram_start = OMAP1_SRAM_PA;
+
+                if (cpu_is_omap730())
+                        omap_sram_size = 0x32000;       /* 200K */
+                else if (cpu_is_omap15xx())
+                        omap_sram_size = 0x30000;       /* 192K */
+                else if (cpu_is_omap1610() || cpu_is_omap1621() ||
+                     cpu_is_omap1710())
+                        omap_sram_size = 0x4000;        /* 16K */
+                else if (cpu_is_omap1611())
+                        omap_sram_size = 0x3e800;       /* 250K */
+                else {
+                        printk(KERN_ERR "Could not detect SRAM size\n");
+                        omap_sram_size = 0x4000;
+                }
         }
-
+        get_fb_sram_conf(sram_start + SRAM_BOOTLOADER_SZ,
+                         omap_sram_size - SRAM_BOOTLOADER_SZ,
+                         &omap_fb_sram_start, &omap_fb_sram_size);
+        if (omap_fb_sram_size)
+                omap_sram_size -= sram_start + omap_sram_size -
+                                  omap_fb_sram_start;
         omap_sram_ceil = omap_sram_base + omap_sram_size;
 }
 
@@ -80,12 +169,20 @@ static struct map_desc omap_sram_io_desc[] __initdata = {
  */
 void __init omap_map_sram(void)
 {
+        unsigned long base;
+
         if (omap_sram_size == 0)
                 return;
 
         if (cpu_is_omap24xx()) {
                 omap_sram_io_desc[0].virtual = OMAP2_SRAM_VA;
-                omap_sram_io_desc[0].pfn = __phys_to_pfn(OMAP2_SRAM_PA);
+
+                if (is_sram_locked())
+                        base = OMAP2_SRAM_PUB_PA;
+                else
+                        base = OMAP2_SRAM_PA;
+                base = ROUND_DOWN(base, PAGE_SIZE);
+                omap_sram_io_desc[0].pfn = __phys_to_pfn(base);
         }
 
         omap_sram_io_desc[0].length = (omap_sram_size + PAGE_SIZE-1)/PAGE_SIZE;
@@ -93,7 +190,8 @@ void __init omap_map_sram(void)
         iotable_init(omap_sram_io_desc, ARRAY_SIZE(omap_sram_io_desc));
 
         printk(KERN_INFO "SRAM: Mapped pa 0x%08lx to va 0x%08lx size: 0x%lx\n",
-               omap_sram_io_desc[0].pfn, omap_sram_io_desc[0].virtual,
+        __pfn_to_phys(omap_sram_io_desc[0].pfn),
+        omap_sram_io_desc[0].virtual,
                omap_sram_io_desc[0].length);
 
         /*
@@ -118,8 +216,9 @@ void * omap_sram_push(void * start, unsigned long size)
                 printk(KERN_ERR "Not enough space in SRAM\n");
                 return NULL;
         }
+
         omap_sram_ceil -= size;
-        omap_sram_ceil &= ~0x3;
+        omap_sram_ceil = ROUND_DOWN(omap_sram_ceil, sizeof(void *));
         memcpy((void *)omap_sram_ceil, start, size);
 
         return (void *)omap_sram_ceil;
diff --git a/arch/arm/plat-omap/timer32k.c b/arch/arm/plat-omap/timer32k.c
new file mode 100644
index 000000000000..b2a943bf11ef
--- /dev/null
+++ b/arch/arm/plat-omap/timer32k.c
@@ -0,0 +1,325 @@
+/*
+ * linux/arch/arm/plat-omap/timer32k.c
+ *
+ * OMAP 32K Timer
+ *
+ * Copyright (C) 2004 - 2005 Nokia Corporation
+ * Partial timer rewrite and additional dynamic tick timer support by
+ * Tony Lindgen <tony@atomide.com> and
+ * Tuukka Tikkanen <tuukka.tikkanen@elektrobit.com>
+ *
+ * MPU timer code based on the older MPU timer code for OMAP
+ * Copyright (C) 2000 RidgeRun, Inc.
+ * Author: Greg Lonnon <glonnon@ridgerun.com>
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the
+ * Free Software Foundation; either version 2 of the License, or (at your
+ * option) any later version.
+ *
+ * THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED
+ * WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN
+ * NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF
+ * USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
+ * ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ *
+ * You should have received a copy of the  GNU General Public License along
+ * with this program; if not, write  to the Free Software Foundation, Inc.,
+ * 675 Mass Ave, Cambridge, MA 02139, USA.
+ */
+
+#include <linux/config.h>
+#include <linux/kernel.h>
+#include <linux/init.h>
+#include <linux/delay.h>
+#include <linux/interrupt.h>
+#include <linux/sched.h>
+#include <linux/spinlock.h>
+#include <linux/err.h>
+#include <linux/clk.h>
+
+#include <asm/system.h>
+#include <asm/hardware.h>
+#include <asm/io.h>
+#include <asm/leds.h>
+#include <asm/irq.h>
+#include <asm/mach/irq.h>
+#include <asm/mach/time.h>
+
+struct sys_timer omap_timer;
+
+/*
+ * ---------------------------------------------------------------------------
+ * 32KHz OS timer
+ *
+ * This currently works only on 16xx, as 1510 does not have the continuous
+ * 32KHz synchronous timer. The 32KHz synchronous timer is used to keep track
+ * of time in addition to the 32KHz OS timer. Using only the 32KHz OS timer
+ * on 1510 would be possible, but the timer would not be as accurate as
+ * with the 32KHz synchronized timer.
+ * ---------------------------------------------------------------------------
+ */
+
+#if defined(CONFIG_ARCH_OMAP16XX)
+#define TIMER_32K_SYNCHRONIZED          0xfffbc410
+#elif defined(CONFIG_ARCH_OMAP24XX)
+#define TIMER_32K_SYNCHRONIZED          0x48004010
+#else
+#error OMAP 32KHz timer does not currently work on 15XX!
+#endif
+
+/* 16xx specific defines */
+#define OMAP1_32K_TIMER_BASE            0xfffb9000
+#define OMAP1_32K_TIMER_CR              0x08
+#define OMAP1_32K_TIMER_TVR             0x00
+#define OMAP1_32K_TIMER_TCR             0x04
+
+/* 24xx specific defines */
+#define OMAP2_GP_TIMER_BASE             0x48028000
+#define CM_CLKSEL_WKUP                  0x48008440
+#define GP_TIMER_TIDR                   0x00
+#define GP_TIMER_TISR                   0x18
+#define GP_TIMER_TIER                   0x1c
+#define GP_TIMER_TCLR                   0x24
+#define GP_TIMER_TCRR                   0x28
+#define GP_TIMER_TLDR                   0x2c
+#define GP_TIMER_TTGR                   0x30
+#define GP_TIMER_TSICR                  0x40
+
+#define OMAP_32K_TICKS_PER_HZ           (32768 / HZ)
+
+/*
+ * TRM says 1 / HZ = ( TVR + 1) / 32768, so TRV = (32768 / HZ) - 1
+ * so with HZ = 128, TVR = 255.
+ */
+#define OMAP_32K_TIMER_TICK_PERIOD      ((32768 / HZ) - 1)
+
+#define JIFFIES_TO_HW_TICKS(nr_jiffies, clock_rate)                     \
+                                (((nr_jiffies) * (clock_rate)) / HZ)
+
+static inline void omap_32k_timer_write(int val, int reg)
+{
+        if (cpu_class_is_omap1())
+                omap_writew(val, OMAP1_32K_TIMER_BASE + reg);
+
+        if (cpu_is_omap24xx())
+                omap_writel(val, OMAP2_GP_TIMER_BASE + reg);
+}
+
+static inline unsigned long omap_32k_timer_read(int reg)
+{
+        if (cpu_class_is_omap1())
+                return omap_readl(OMAP1_32K_TIMER_BASE + reg) & 0xffffff;
+
+        if (cpu_is_omap24xx())
+                return omap_readl(OMAP2_GP_TIMER_BASE + reg);
+}
+
+/*
+ * The 32KHz synchronized timer is an additional timer on 16xx.
+ * It is always running.
+ */
+static inline unsigned long omap_32k_sync_timer_read(void)
+{
+        return omap_readl(TIMER_32K_SYNCHRONIZED);
+}
+
+static inline void omap_32k_timer_start(unsigned long load_val)
+{
+        if (cpu_class_is_omap1()) {
+                omap_32k_timer_write(load_val, OMAP1_32K_TIMER_TVR);
+                omap_32k_timer_write(0x0f, OMAP1_32K_TIMER_CR);
+        }
+
+        if (cpu_is_omap24xx()) {
+                omap_32k_timer_write(0xffffffff - load_val, GP_TIMER_TCRR);
+                omap_32k_timer_write((1 << 1), GP_TIMER_TIER);
+                omap_32k_timer_write((1 << 1) | 1, GP_TIMER_TCLR);
+        }
+}
+
+static inline void omap_32k_timer_stop(void)
+{
+        if (cpu_class_is_omap1())
+                omap_32k_timer_write(0x0, OMAP1_32K_TIMER_CR);
+
+        if (cpu_is_omap24xx())
+                omap_32k_timer_write(0x0, GP_TIMER_TCLR);
+}
+
+/*
+ * Rounds down to nearest usec. Note that this will overflow for larger values.
+ */
+static inline unsigned long omap_32k_ticks_to_usecs(unsigned long ticks_32k)
+{
+        return (ticks_32k * 5*5*5*5*5*5) >> 9;
+}
+
+/*
+ * Rounds down to nearest nsec.
+ */
+static inline unsigned long long
+omap_32k_ticks_to_nsecs(unsigned long ticks_32k)
+{
+        return (unsigned long long) ticks_32k * 1000 * 5*5*5*5*5*5 >> 9;
+}
+
+static unsigned long omap_32k_last_tick = 0;
+
+/*
+ * Returns elapsed usecs since last 32k timer interrupt
+ */
+static unsigned long omap_32k_timer_gettimeoffset(void)
+{
+        unsigned long now = omap_32k_sync_timer_read();
+        return omap_32k_ticks_to_usecs(now - omap_32k_last_tick);
+}
+
+/*
+ * Returns current time from boot in nsecs. It's OK for this to wrap
+ * around for now, as it's just a relative time stamp.
+ */
+unsigned long long sched_clock(void)
+{
+        return omap_32k_ticks_to_nsecs(omap_32k_sync_timer_read());
+}
+
+/*
+ * Timer interrupt for 32KHz timer. When dynamic tick is enabled, this
+ * function is also called from other interrupts to remove latency
+ * issues with dynamic tick. In the dynamic tick case, we need to lock
+ * with irqsave.
+ */
+static irqreturn_t omap_32k_timer_interrupt(int irq, void *dev_id,
+                                            struct pt_regs *regs)
+{
+        unsigned long flags;
+        unsigned long now;
+
+        write_seqlock_irqsave(&xtime_lock, flags);
+
+        if (cpu_is_omap24xx()) {
+                u32 status = omap_32k_timer_read(GP_TIMER_TISR);
+                omap_32k_timer_write(status, GP_TIMER_TISR);
+        }
+
+        now = omap_32k_sync_timer_read();
+
+        while (now - omap_32k_last_tick >= OMAP_32K_TICKS_PER_HZ) {
+                omap_32k_last_tick += OMAP_32K_TICKS_PER_HZ;
+                timer_tick(regs);
+        }
+
+        /* Restart timer so we don't drift off due to modulo or dynamic tick.
+         * By default we program the next timer to be continuous to avoid
+         * latencies during high system load. During dynamic tick operation the
+         * continuous timer can be overridden from pm_idle to be longer.
+         */
+        omap_32k_timer_start(omap_32k_last_tick + OMAP_32K_TICKS_PER_HZ - now);
+        write_sequnlock_irqrestore(&xtime_lock, flags);
+
+        return IRQ_HANDLED;
+}
+
+#ifdef CONFIG_NO_IDLE_HZ
+/*
+ * Programs the next timer interrupt needed. Called when dynamic tick is
+ * enabled, and to reprogram the ticks to skip from pm_idle. Note that
+ * we can keep the timer continuous, and don't need to set it to run in
+ * one-shot mode. This is because the timer will get reprogrammed again
+ * after next interrupt.
+ */
+void omap_32k_timer_reprogram(unsigned long next_tick)
+{
+        omap_32k_timer_start(JIFFIES_TO_HW_TICKS(next_tick, 32768) + 1);
+}
+
+static struct irqaction omap_32k_timer_irq;
+extern struct timer_update_handler timer_update;
+
+static int omap_32k_timer_enable_dyn_tick(void)
+{
+        /* No need to reprogram timer, just use the next interrupt */
+        return 0;
+}
+
+static int omap_32k_timer_disable_dyn_tick(void)
+{
+        omap_32k_timer_start(OMAP_32K_TIMER_TICK_PERIOD);
+        return 0;
+}
+
+static struct dyn_tick_timer omap_dyn_tick_timer = {
+        .enable         = omap_32k_timer_enable_dyn_tick,
+        .disable        = omap_32k_timer_disable_dyn_tick,
+        .reprogram      = omap_32k_timer_reprogram,
+        .handler        = omap_32k_timer_interrupt,
+};
+#endif  /* CONFIG_NO_IDLE_HZ */
+
+static struct irqaction omap_32k_timer_irq = {
+        .name           = "32KHz timer",
+        .flags          = SA_INTERRUPT | SA_TIMER,
+        .handler        = omap_32k_timer_interrupt,
+};
+
+static struct clk * gpt1_ick;
+static struct clk * gpt1_fck;
+
+static __init void omap_init_32k_timer(void)
+{
+#ifdef CONFIG_NO_IDLE_HZ
+        omap_timer.dyn_tick = &omap_dyn_tick_timer;
+#endif
+
+        if (cpu_class_is_omap1())
+                setup_irq(INT_OS_TIMER, &omap_32k_timer_irq);
+        if (cpu_is_omap24xx())
+                setup_irq(37, &omap_32k_timer_irq);
+        omap_timer.offset  = omap_32k_timer_gettimeoffset;
+        omap_32k_last_tick = omap_32k_sync_timer_read();
+
+        /* REVISIT: Check 24xx TIOCP_CFG settings after idle works */
+        if (cpu_is_omap24xx()) {
+                omap_32k_timer_write(0, GP_TIMER_TCLR);
+                omap_writel(0, CM_CLKSEL_WKUP);         /* 32KHz clock source */
+
+                gpt1_ick = clk_get(NULL, "gpt1_ick");
+                if (IS_ERR(gpt1_ick))
+                        printk(KERN_ERR "Could not get gpt1_ick\n");
+                else
+                        clk_enable(gpt1_ick);
+
+                gpt1_fck = clk_get(NULL, "gpt1_fck");
+                if (IS_ERR(gpt1_fck))
+                        printk(KERN_ERR "Could not get gpt1_fck\n");
+                else
+                        clk_enable(gpt1_fck);
+
+                mdelay(100);            /* Wait for clocks to stabilize */
+
+                omap_32k_timer_write(0x7, GP_TIMER_TISR);
+        }
+
+        omap_32k_timer_start(OMAP_32K_TIMER_TICK_PERIOD);
+}
+
+/*
+ * ---------------------------------------------------------------------------
+ * Timer initialization
+ * ---------------------------------------------------------------------------
+ */
+static void __init omap_timer_init(void)
+{
+        omap_init_32k_timer();
+}
+
+struct sys_timer omap_timer = {
+        .init           = omap_timer_init,
+        .offset         = NULL,         /* Initialized later */
+};
diff --git a/arch/arm/vfp/vfpdouble.c b/arch/arm/vfp/vfpdouble.c
index 9b367a65cb4d..febd115dba28 100644
--- a/arch/arm/vfp/vfpdouble.c
+++ b/arch/arm/vfp/vfpdouble.c
@@ -588,6 +588,7 @@ static u32 vfp_double_ftosi(int sd, int unused, int dm, u32 fpscr)
         struct vfp_double vdm;
         u32 d, exceptions = 0;
         int rmode = fpscr & FPSCR_RMODE_MASK;
+        int tm;
 
         vfp_double_unpack(&vdm, vfp_get_double(dm));
         vfp_double_dump("VDM", &vdm);
@@ -595,10 +596,14 @@ static u32 vfp_double_ftosi(int sd, int unused, int dm, u32 fpscr)
         /*
          * Do we have denormalised number?
          */
-        if (vfp_double_type(&vdm) & VFP_DENORMAL)
+        tm = vfp_double_type(&vdm);
+        if (tm & VFP_DENORMAL)
                 exceptions |= FPSCR_IDC;
 
-        if (vdm.exponent >= 1023 + 32) {
+        if (tm & VFP_NAN) {
+                d = 0;
+                exceptions |= FPSCR_IOC;
+        } else if (vdm.exponent >= 1023 + 32) {
                 d = 0x7fffffff;
                 if (vdm.sign)
                         d = ~d;
@@ -1122,9 +1127,9 @@ u32 vfp_double_cpdo(u32 inst, u32 fpscr)
 {
         u32 op = inst & FOP_MASK;
         u32 exceptions = 0;
-        unsigned int dd = vfp_get_sd(inst);
-        unsigned int dn = vfp_get_sn(inst);
-        unsigned int dm = vfp_get_sm(inst);
+        unsigned int dd = vfp_get_dd(inst);
+        unsigned int dn = vfp_get_dn(inst);
+        unsigned int dm = vfp_get_dm(inst);
         unsigned int vecitr, veclen, vecstride;
         u32 (*fop)(int, int, s32, u32);
 
@@ -1141,7 +1146,7 @@ u32 vfp_double_cpdo(u32 inst, u32 fpscr)
         pr_debug("VFP: vecstride=%u veclen=%u\n", vecstride,
                  (veclen >> FPSCR_LENGTH_BIT) + 1);
 
-        fop = (op == FOP_EXT) ? fop_extfns[dn] : fop_fns[FOP_TO_IDX(op)];
+        fop = (op == FOP_EXT) ? fop_extfns[FEXT_TO_IDX(inst)] : fop_fns[FOP_TO_IDX(op)];
         if (!fop)
                 goto invalid;
 
@@ -1149,17 +1154,13 @@ u32 vfp_double_cpdo(u32 inst, u32 fpscr)
                 u32 except;
 
                 if (op == FOP_EXT)
-                        pr_debug("VFP: itr%d (d%u.%u) = op[%u] (d%u.%u)\n",
+                        pr_debug("VFP: itr%d (d%u) = op[%u] (d%u)\n",
                                  vecitr >> FPSCR_LENGTH_BIT,
-                                 dd >> 1, dd & 1, dn,
-                                 dm >> 1, dm & 1);
+                                 dd, dn, dm);
                 else
-                        pr_debug("VFP: itr%d (d%u.%u) = (d%u.%u) op[%u] (d%u.%u)\n",
+                        pr_debug("VFP: itr%d (d%u) = (d%u) op[%u] (d%u)\n",
                                  vecitr >> FPSCR_LENGTH_BIT,
-                                 dd >> 1, dd & 1,
-                                 dn >> 1, dn & 1,
-                                 FOP_TO_IDX(op),
-                                 dm >> 1, dm & 1);
+                                 dd, dn, FOP_TO_IDX(op), dm);
 
                 except = fop(dd, dn, dm, fpscr);
                 pr_debug("VFP: itr%d: exceptions=%08x\n",
diff --git a/arch/arm/vfp/vfphw.S b/arch/arm/vfp/vfphw.S
index b7ed57e00cd4..a3f65b47aea9 100644
--- a/arch/arm/vfp/vfphw.S
+++ b/arch/arm/vfp/vfphw.S
@@ -189,11 +189,10 @@ vfp_put_float:
 
         .globl  vfp_get_double
 vfp_get_double:
-        mov     r0, r0, lsr #1
         add     pc, pc, r0, lsl #3
         mov     r0, r0
         .irp    dr,0,1,2,3,4,5,6,7,8,9,10,11,12,13,14,15
-        mrrc    p10, 1, r0, r1, c\dr    @ fmrrd r0, r1, d\dr
+        mrrc    p11, 1, r0, r1, c\dr    @ fmrrd r0, r1, d\dr
         mov     pc, lr
         .endr
 
@@ -204,10 +203,9 @@ vfp_get_double:
 
         .globl  vfp_put_double
 vfp_put_double:
-        mov     r0, r0, lsr #1
         add     pc, pc, r0, lsl #3
         mov     r0, r0
         .irp    dr,0,1,2,3,4,5,6,7,8,9,10,11,12,13,14,15
-        mcrr    p10, 1, r1, r2, c\dr    @ fmrrd r1, r2, d\dr
+        mcrr    p11, 1, r1, r2, c\dr    @ fmdrr r1, r2, d\dr
         mov     pc, lr
         .endr
diff --git a/arch/arm/vfp/vfpsingle.c b/arch/arm/vfp/vfpsingle.c
index 14dd696ddeb1..4ac27f193934 100644
--- a/arch/arm/vfp/vfpsingle.c
+++ b/arch/arm/vfp/vfpsingle.c
@@ -632,6 +632,7 @@ static u32 vfp_single_ftosi(int sd, int unused, s32 m, u32 fpscr)
         struct vfp_single vsm;
         u32 d, exceptions = 0;
         int rmode = fpscr & FPSCR_RMODE_MASK;
+        int tm;
 
         vfp_single_unpack(&vsm, m);
         vfp_single_dump("VSM", &vsm);
@@ -639,10 +640,14 @@ static u32 vfp_single_ftosi(int sd, int unused, s32 m, u32 fpscr)
         /*
          * Do we have a denormalised number?
          */
+        tm = vfp_single_type(&vsm);
         if (vfp_single_type(&vsm) & VFP_DENORMAL)
                 exceptions |= FPSCR_IDC;
 
-        if (vsm.exponent >= 127 + 32) {
+        if (tm & VFP_NAN) {
+                d = 0;
+                exceptions |= FPSCR_IOC;
+        } else if (vsm.exponent >= 127 + 32) {
                 /*
                  * m >= 2^31-2^7: invalid
                  */
@@ -1188,7 +1193,7 @@ u32 vfp_single_cpdo(u32 inst, u32 fpscr)
         pr_debug("VFP: vecstride=%u veclen=%u\n", vecstride,
                  (veclen >> FPSCR_LENGTH_BIT) + 1);
 
-        fop = (op == FOP_EXT) ? fop_extfns[sn] : fop_fns[FOP_TO_IDX(op)];
+        fop = (op == FOP_EXT) ? fop_extfns[FEXT_TO_IDX(inst)] : fop_fns[FOP_TO_IDX(op)];
         if (!fop)
                 goto invalid;
 
diff --git a/arch/arm26/kernel/armksyms.c b/arch/arm26/kernel/armksyms.c
index a6a1b3373444..9d66c27f2724 100644
--- a/arch/arm26/kernel/armksyms.c
+++ b/arch/arm26/kernel/armksyms.c
@@ -152,7 +152,6 @@ EXPORT_SYMBOL(strncmp);
 EXPORT_SYMBOL(strchr);
 EXPORT_SYMBOL(strlen);
 EXPORT_SYMBOL(strnlen);
-EXPORT_SYMBOL(strpbrk);
 EXPORT_SYMBOL(strrchr);
 EXPORT_SYMBOL(strstr);
 EXPORT_SYMBOL(memset);
diff --git a/arch/cris/kernel/crisksyms.c b/arch/cris/kernel/crisksyms.c
index de39725da920..d57859053ce7 100644
--- a/arch/cris/kernel/crisksyms.c
+++ b/arch/cris/kernel/crisksyms.c
@@ -39,7 +39,6 @@ EXPORT_SYMBOL(loops_per_usec);
 /* String functions */
 EXPORT_SYMBOL(memcmp);
 EXPORT_SYMBOL(memmove);
-EXPORT_SYMBOL(strpbrk);
 EXPORT_SYMBOL(strstr);
 EXPORT_SYMBOL(strcpy);
 EXPORT_SYMBOL(strchr);
diff --git a/arch/frv/kernel/entry.S b/arch/frv/kernel/entry.S
index 1d21c8d34d8a..a9b59527a741 100644
--- a/arch/frv/kernel/entry.S
+++ b/arch/frv/kernel/entry.S
@@ -1170,12 +1170,6 @@ __syscall_badsys:
 # syscall vector table
 #
 ###############################################################################
-#ifdef CONFIG_MMU
-#define __MMU(X) X
-#else
-#define __MMU(X) sys_ni_syscall
-#endif
-
         .section .rodata
 ALIGN
         .globl          sys_call_table
@@ -1305,7 +1299,7 @@ sys_call_table:
         .long sys_newuname
         .long sys_ni_syscall    /* old "cacheflush" */
         .long sys_adjtimex
-        .long __MMU(sys_mprotect) /* 125 */
+        .long sys_mprotect      /* 125 */
         .long sys_sigprocmask
         .long sys_ni_syscall    /* old "create_module" */
         .long sys_init_module
@@ -1324,16 +1318,16 @@ sys_call_table:
         .long sys_getdents
         .long sys_select
         .long sys_flock
-        .long __MMU(sys_msync)
+        .long sys_msync
         .long sys_readv         /* 145 */
         .long sys_writev
         .long sys_getsid
         .long sys_fdatasync
         .long sys_sysctl
-        .long __MMU(sys_mlock)          /* 150 */
-        .long __MMU(sys_munlock)
-        .long __MMU(sys_mlockall)
-        .long __MMU(sys_munlockall)
+        .long sys_mlock         /* 150 */
+        .long sys_munlock
+        .long sys_mlockall
+        .long sys_munlockall
         .long sys_sched_setparam
         .long sys_sched_getparam   /* 155 */
         .long sys_sched_setscheduler
@@ -1343,7 +1337,7 @@ sys_call_table:
         .long sys_sched_get_priority_min  /* 160 */
         .long sys_sched_rr_get_interval
         .long sys_nanosleep
-        .long __MMU(sys_mremap)
+        .long sys_mremap
         .long sys_setresuid16
         .long sys_getresuid16   /* 165 */
         .long sys_ni_syscall    /* for vm86 */
@@ -1398,8 +1392,8 @@ sys_call_table:
         .long sys_setfsuid              /* 215 */
         .long sys_setfsgid
         .long sys_pivot_root
-        .long __MMU(sys_mincore)
-        .long __MMU(sys_madvise)
+        .long sys_mincore
+        .long sys_madvise
         .long sys_getdents64    /* 220 */
         .long sys_fcntl64
         .long sys_ni_syscall    /* reserved for TUX */
@@ -1437,7 +1431,7 @@ sys_call_table:
         .long sys_epoll_create
         .long sys_epoll_ctl     /* 255 */
         .long sys_epoll_wait
-        .long __MMU(sys_remap_file_pages)
+        .long sys_remap_file_pages
         .long sys_set_tid_address
         .long sys_timer_create
         .long sys_timer_settime         /* 260 */
diff --git a/arch/frv/kernel/frv_ksyms.c b/arch/frv/kernel/frv_ksyms.c
index 07c8ffa0dd39..0f273a7aca5a 100644
--- a/arch/frv/kernel/frv_ksyms.c
+++ b/arch/frv/kernel/frv_ksyms.c
@@ -27,7 +27,6 @@ EXPORT_SYMBOL(__ioremap);
 EXPORT_SYMBOL(iounmap);
 
 EXPORT_SYMBOL(strnlen);
-EXPORT_SYMBOL(strpbrk);
 EXPORT_SYMBOL(strrchr);
 EXPORT_SYMBOL(strstr);
 EXPORT_SYMBOL(strchr);
diff --git a/arch/h8300/kernel/h8300_ksyms.c b/arch/h8300/kernel/h8300_ksyms.c
index b6cd78c972bb..f8d6dee84781 100644
--- a/arch/h8300/kernel/h8300_ksyms.c
+++ b/arch/h8300/kernel/h8300_ksyms.c
@@ -25,7 +25,6 @@ extern char h8300_debug_device[];
 /* platform dependent support */
 
 EXPORT_SYMBOL(strnlen);
-EXPORT_SYMBOL(strpbrk);
 EXPORT_SYMBOL(strrchr);
 EXPORT_SYMBOL(strstr);
 EXPORT_SYMBOL(strchr);
diff --git a/arch/i386/Kconfig b/arch/i386/Kconfig
index f17bd1d2707e..18ec9fe6deb6 100644
--- a/arch/i386/Kconfig
+++ b/arch/i386/Kconfig
@@ -53,6 +53,35 @@ source "init/Kconfig"
 
 menu "Processor type and features"
 
+config SMP
+        bool "Symmetric multi-processing support"
+        ---help---
+          This enables support for systems with more than one CPU. If you have
+          a system with only one CPU, like most personal computers, say N. If
+          you have a system with more than one CPU, say Y.
+
+          If you say N here, the kernel will run on single and multiprocessor
+          machines, but will use only one CPU of a multiprocessor machine. If
+          you say Y here, the kernel will run on many, but not all,
+          singleprocessor machines. On a singleprocessor machine, the kernel
+          will run faster if you say N here.
+
+          Note that if you say Y here and choose architecture "586" or
+          "Pentium" under "Processor family", the kernel will not work on 486
+          architectures. Similarly, multiprocessor kernels for the "PPro"
+          architecture may not work on all Pentium based boards.
+
+          People using multiprocessor machines who say Y here should also say
+          Y to "Enhanced Real Time Clock Support", below. The "Advanced Power
+          Management" code will be disabled if you say Y here.
+
+          See also the <file:Documentation/smp.txt>,
+          <file:Documentation/i386/IO-APIC.txt>,
+          <file:Documentation/nmi_watchdog.txt> and the SMP-HOWTO available at
+          <http://www.tldp.org/docs.html#howto>.
+
+          If you don't know what to do here, say N.
+
 choice
         prompt "Subarchitecture Type"
         default X86_PC
@@ -178,35 +207,6 @@ config HPET_EMULATE_RTC
         depends on HPET_TIMER && RTC=y
         default y
 
-config SMP
-        bool "Symmetric multi-processing support"
-        ---help---
-          This enables support for systems with more than one CPU. If you have
-          a system with only one CPU, like most personal computers, say N. If
-          you have a system with more than one CPU, say Y.
-
-          If you say N here, the kernel will run on single and multiprocessor
-          machines, but will use only one CPU of a multiprocessor machine. If
-          you say Y here, the kernel will run on many, but not all,
-          singleprocessor machines. On a singleprocessor machine, the kernel
-          will run faster if you say N here.
-
-          Note that if you say Y here and choose architecture "586" or
-          "Pentium" under "Processor family", the kernel will not work on 486
-          architectures. Similarly, multiprocessor kernels for the "PPro"
-          architecture may not work on all Pentium based boards.
-
-          People using multiprocessor machines who say Y here should also say
-          Y to "Enhanced Real Time Clock Support", below. The "Advanced Power
-          Management" code will be disabled if you say Y here.
-
-          See also the <file:Documentation/smp.txt>,
-          <file:Documentation/i386/IO-APIC.txt>,
-          <file:Documentation/nmi_watchdog.txt> and the SMP-HOWTO available at
-          <http://www.tldp.org/docs.html#howto>.
-
-          If you don't know what to do here, say N.
-
 config NR_CPUS
         int "Maximum number of CPUs (2-255)"
         range 2 255
@@ -522,6 +522,12 @@ config NUMA
 comment "NUMA (Summit) requires SMP, 64GB highmem support, ACPI"
         depends on X86_SUMMIT && (!HIGHMEM64G || !ACPI)
 
+config NODES_SHIFT
+        int
+        default "4" if X86_NUMAQ
+        default "3"
+        depends on NEED_MULTIPLE_NODES
+
 config HAVE_ARCH_BOOTMEM_NODE
         bool
         depends on NUMA
@@ -757,15 +763,6 @@ config HOTPLUG_CPU
 
           Say N.
 
-config DOUBLEFAULT
-        default y
-        bool "Enable doublefault exception handler" if EMBEDDED
-        help
-          This option allows trapping of rare doublefault exceptions that
-          would otherwise cause a system to silently reboot. Disabling this
-          option saves about 4k and might cause you much additional grey
-          hair.
-
 endmenu
 
 
diff --git a/arch/i386/Kconfig.cpu b/arch/i386/Kconfig.cpu
index 79603b3471f9..eb130482ba18 100644
--- a/arch/i386/Kconfig.cpu
+++ b/arch/i386/Kconfig.cpu
@@ -311,5 +311,5 @@ config X86_OOSTORE
 
 config X86_TSC
         bool
-        depends on (MWINCHIP3D || MWINCHIP2 || MCRUSOE || MEFFICEON || MCYRIXIII || MK7 || MK6 || MPENTIUM4 || MPENTIUMM || MPENTIUMIII || MPENTIUMII || M686 || M586MMX || M586TSC || MK8 || MVIAC3_2 || MGEODEGX1) && !X86_NUMAQ
+        depends on (MWINCHIP3D || MWINCHIP2 || MCRUSOE || MEFFICEON || MCYRIXIII || MK7 || MK6 || MPENTIUM4 || MPENTIUMM || MPENTIUMIII || MPENTIUMII || M686 || M586MMX || M586TSC || MK8 || MVIAC3_2 || MGEODEGX1 || MGEODE_LX) && !X86_NUMAQ
         default y
diff --git a/arch/i386/boot/video.S b/arch/i386/boot/video.S
index 0000a2674537..c9343c3a8082 100644
--- a/arch/i386/boot/video.S
+++ b/arch/i386/boot/video.S
@@ -97,6 +97,7 @@
 #define PARAM_VESAPM_OFF        0x30
 #define PARAM_LFB_PAGES         0x32
 #define PARAM_VESA_ATTRIB       0x34
+#define PARAM_CAPABILITIES      0x36
 
 /* Define DO_STORE according to CONFIG_VIDEO_RETAIN */
 #ifdef CONFIG_VIDEO_RETAIN
@@ -233,6 +234,10 @@ mopar_gr:
         movw    18(%di), %ax
         movl    %eax, %fs:(PARAM_LFB_SIZE)
 
+# store mode capabilities
+        movl 10(%di), %eax
+        movl %eax, %fs:(PARAM_CAPABILITIES)
+
 # switching the DAC to 8-bit is for <= 8 bpp only
         movw    %fs:(PARAM_LFB_DEPTH), %ax
         cmpw    $8, %ax
diff --git a/arch/i386/kernel/acpi/boot.c b/arch/i386/kernel/acpi/boot.c
index 033066176b3e..030a0007a4e0 100644
--- a/arch/i386/kernel/acpi/boot.c
+++ b/arch/i386/kernel/acpi/boot.c
@@ -168,7 +168,7 @@ int __init acpi_parse_mcfg(unsigned long phys_addr, unsigned long size)
         unsigned long i;
         int config_size;
 
-        if (!phys_addr || !size)
+        if (!phys_addr || !size || !cpu_has_apic)
                 return -EINVAL;
 
         mcfg = (struct acpi_table_mcfg *)__acpi_map_table(phys_addr, size);
@@ -215,7 +215,7 @@ static int __init acpi_parse_madt(unsigned long phys_addr, unsigned long size)
 {
         struct acpi_table_madt *madt = NULL;
 
-        if (!phys_addr || !size)
+        if (!phys_addr || !size || !cpu_has_apic)
                 return -EINVAL;
 
         madt = (struct acpi_table_madt *)__acpi_map_table(phys_addr, size);
@@ -693,6 +693,9 @@ static int __init acpi_parse_madt_lapic_entries(void)
 {
         int count;
 
+        if (!cpu_has_apic)
+                return -ENODEV;
+
         /* 
          * Note that the LAPIC address is obtained from the MADT (32-bit value)
          * and (optionally) overriden by a LAPIC_ADDR_OVR entry (64-bit value).
@@ -751,6 +754,9 @@ static int __init acpi_parse_madt_ioapic_entries(void)
                 return -ENODEV;
         }
 
+        if (!cpu_has_apic)
+                return -ENODEV;
+
         /*
          * if "noapic" boot option, don't look for IO-APICs
          */
diff --git a/arch/i386/kernel/apic.c b/arch/i386/kernel/apic.c
index 6273bf74c203..254cee9f0b7b 100644
--- a/arch/i386/kernel/apic.c
+++ b/arch/i386/kernel/apic.c
@@ -62,6 +62,18 @@ int apic_verbosity;
 
 static void apic_pm_activate(void);
 
+int modern_apic(void)
+{
+        unsigned int lvr, version;
+        /* AMD systems use old APIC versions, so check the CPU */
+        if (boot_cpu_data.x86_vendor == X86_VENDOR_AMD &&
+                boot_cpu_data.x86 >= 0xf)
+                return 1;
+        lvr = apic_read(APIC_LVR);
+        version = GET_APIC_VERSION(lvr);
+        return version >= 0x14;
+}
+
 /*
  * 'what should we do if we get a hw irq event on an illegal vector'.
  * each architecture has to answer this themselves.
@@ -119,10 +131,7 @@ void enable_NMI_through_LVT0 (void * dummy)
 
 int get_physical_broadcast(void)
 {
-        unsigned int lvr, version;
-        lvr = apic_read(APIC_LVR);
-        version = GET_APIC_VERSION(lvr);
-        if (!APIC_INTEGRATED(version) || version >= 0x14)
+        if (modern_apic())
                 return 0xff;
         else
                 return 0xf;
@@ -349,9 +358,9 @@ int __init verify_local_APIC(void)
 
 void __init sync_Arb_IDs(void)
 {
-        /* Unsupported on P4 - see Intel Dev. Manual Vol. 3, Ch. 8.6.1 */
-        unsigned int ver = GET_APIC_VERSION(apic_read(APIC_LVR));
-        if (ver >= 0x14)        /* P4 or higher */
+        /* Unsupported on P4 - see Intel Dev. Manual Vol. 3, Ch. 8.6.1
+           And not needed on AMD */
+        if (modern_apic())
                 return;
         /*
          * Wait for idle.
diff --git a/arch/i386/kernel/cpu/amd.c b/arch/i386/kernel/cpu/amd.c
index 0810f81f2a05..ff2b2154ac1b 100644
--- a/arch/i386/kernel/cpu/amd.c
+++ b/arch/i386/kernel/cpu/amd.c
@@ -212,8 +212,6 @@ static void __init init_amd(struct cpuinfo_x86 *c)
 
         if (cpuid_eax(0x80000000) >= 0x80000008) {
                 c->x86_max_cores = (cpuid_ecx(0x80000008) & 0xff) + 1;
-                if (c->x86_max_cores & (c->x86_max_cores - 1))
-                        c->x86_max_cores = 1;
         }
 
         if (cpuid_eax(0x80000000) >= 0x80000007) {
diff --git a/arch/i386/kernel/cpu/cpufreq/powernow-k8.c b/arch/i386/kernel/cpu/cpufreq/powernow-k8.c
index 712a26bd4457..7c0e160a2145 100644
--- a/arch/i386/kernel/cpu/cpufreq/powernow-k8.c
+++ b/arch/i386/kernel/cpu/cpufreq/powernow-k8.c
@@ -46,7 +46,7 @@
 
 #define PFX "powernow-k8: "
 #define BFX PFX "BIOS error: "
-#define VERSION "version 1.60.1"
+#define VERSION "version 1.60.2"
 #include "powernow-k8.h"
 
 /* serialize freq changes  */
@@ -55,7 +55,7 @@ static DEFINE_MUTEX(fidvid_mutex);
 static struct powernow_k8_data *powernow_data[NR_CPUS];
 
 #ifndef CONFIG_SMP
-static cpumask_t cpu_core_map[1] = { CPU_MASK_ALL };
+static cpumask_t cpu_core_map[1];
 #endif
 
 /* Return a frequency in MHz, given an input fid */
@@ -910,6 +910,9 @@ static int powernowk8_target(struct cpufreq_policy *pol, unsigned targfreq, unsi
         unsigned int newstate;
         int ret = -EIO;
 
+        if (!data)
+                return -EINVAL;
+
         /* only run on specific CPU from here on */
         oldmask = current->cpus_allowed;
         set_cpus_allowed(current, cpumask_of_cpu(pol->cpu));
@@ -969,6 +972,9 @@ static int powernowk8_verify(struct cpufreq_policy *pol)
 {
         struct powernow_k8_data *data = powernow_data[pol->cpu];
 
+        if (!data)
+                return -EINVAL;
+
         return cpufreq_frequency_table_verify(pol, data->powernow_table);
 }
 
@@ -977,7 +983,7 @@ static int __cpuinit powernowk8_cpu_init(struct cpufreq_policy *pol)
 {
         struct powernow_k8_data *data;
         cpumask_t oldmask = CPU_MASK_ALL;
-        int rc, i;
+        int rc;
 
         if (!cpu_online(pol->cpu))
                 return -ENODEV;
@@ -1063,8 +1069,7 @@ static int __cpuinit powernowk8_cpu_init(struct cpufreq_policy *pol)
         printk("cpu_init done, current fid 0x%x, vid 0x%x\n",
                data->currfid, data->currvid);
 
-        for_each_cpu_mask(i, cpu_core_map[pol->cpu])
-                powernow_data[i] = data;
+        powernow_data[pol->cpu] = data;
 
         return 0;
 
@@ -1104,6 +1109,9 @@ static unsigned int powernowk8_get (unsigned int cpu)
         if (!data)
                 return -EINVAL;
 
+        if (!data)
+                return -EINVAL;
+
         set_cpus_allowed(current, cpumask_of_cpu(cpu));
         if (smp_processor_id() != cpu) {
                 printk(KERN_ERR PFX "limiting to CPU %d failed in powernowk8_get\n", cpu);
diff --git a/arch/i386/kernel/crash.c b/arch/i386/kernel/crash.c
index e3c5fca0aa8a..2b0cfce24a61 100644
--- a/arch/i386/kernel/crash.c
+++ b/arch/i386/kernel/crash.c
@@ -69,7 +69,7 @@ static void crash_save_this_cpu(struct pt_regs *regs, int cpu)
          * for the data I pass, and I need tags
          * on the data to indicate what information I have
          * squirrelled away.  ELF notes happen to provide
-         * all of that that no need to invent something new.
+         * all of that, so there is no need to invent something new.
          */
         buf = (u32*)per_cpu_ptr(crash_notes, cpu);
         if (!buf)
diff --git a/arch/i386/kernel/i386_ksyms.c b/arch/i386/kernel/i386_ksyms.c
index 055325056a74..036a9857936f 100644
--- a/arch/i386/kernel/i386_ksyms.c
+++ b/arch/i386/kernel/i386_ksyms.c
@@ -19,7 +19,6 @@ EXPORT_SYMBOL(__put_user_2);
 EXPORT_SYMBOL(__put_user_4);
 EXPORT_SYMBOL(__put_user_8);
 
-EXPORT_SYMBOL(strpbrk);
 EXPORT_SYMBOL(strstr);
 
 #ifdef CONFIG_SMP
diff --git a/arch/i386/kernel/mpparse.c b/arch/i386/kernel/mpparse.c
index 8d8aa9d1796d..34d21e21e012 100644
--- a/arch/i386/kernel/mpparse.c
+++ b/arch/i386/kernel/mpparse.c
@@ -38,12 +38,6 @@
 int smp_found_config;
 unsigned int __initdata maxcpus = NR_CPUS;
 
-#ifdef CONFIG_HOTPLUG_CPU
-#define CPU_HOTPLUG_ENABLED     (1)
-#else
-#define CPU_HOTPLUG_ENABLED     (0)
-#endif
-
 /*
  * Various Linux-internal data structures created from the
  * MP-table.
@@ -110,21 +104,6 @@ static int __init mpf_checksum(unsigned char *mp, int len)
 static int mpc_record; 
 static struct mpc_config_translation *translation_table[MAX_MPC_ENTRY] __initdata;
 
-#ifdef CONFIG_X86_NUMAQ
-static int MP_valid_apicid(int apicid, int version)
-{
-        return hweight_long(apicid & 0xf) == 1 && (apicid >> 4) != 0xf;
-}
-#else
-static int MP_valid_apicid(int apicid, int version)
-{
-        if (version >= 0x14)
-                return apicid < 0xff;
-        else
-                return apicid < 0xf;
-}
-#endif
-
 static void __devinit MP_processor_info (struct mpc_config_processor *m)
 {
         int ver, apicid;
@@ -190,12 +169,6 @@ static void __devinit MP_processor_info (struct mpc_config_processor *m)
 
         ver = m->mpc_apicver;
 
-        if (!MP_valid_apicid(apicid, ver)) {
-                printk(KERN_WARNING "Processor #%d INVALID. (Max ID: %d).\n",
-                        m->mpc_apicid, MAX_APICS);
-                return;
-        }
-
         /*
          * Validate version
          */
@@ -225,7 +198,14 @@ static void __devinit MP_processor_info (struct mpc_config_processor *m)
         cpu_set(num_processors, cpu_possible_map);
         num_processors++;
 
-        if (CPU_HOTPLUG_ENABLED || (num_processors > 8)) {
+        /*
+         * Would be preferable to switch to bigsmp when CONFIG_HOTPLUG_CPU=y
+         * but we need to work other dependencies like SMP_SUSPEND etc
+         * before this can be done without some confusion.
+         * if (CPU_HOTPLUG_ENABLED || num_processors > 8)
+         *       - Ashok Raj <ashok.raj@intel.com>
+         */
+        if (num_processors > 8) {
                 switch (boot_cpu_data.x86_vendor) {
                 case X86_VENDOR_INTEL:
                         if (!APIC_XAPIC(ver)) {
@@ -249,6 +229,13 @@ static void __init MP_bus_info (struct mpc_config_bus *m)
 
         mpc_oem_bus_info(m, str, translation_table[mpc_record]);
 
+        if (m->mpc_busid >= MAX_MP_BUSSES) {
+                printk(KERN_WARNING "MP table busid value (%d) for bustype %s "
+                        " is too large, max. supported is %d\n",
+                        m->mpc_busid, str, MAX_MP_BUSSES - 1);
+                return;
+        }
+
         if (strncmp(str, BUSTYPE_ISA, sizeof(BUSTYPE_ISA)-1) == 0) {
                 mp_bus_id_to_type[m->mpc_busid] = MP_BUS_ISA;
         } else if (strncmp(str, BUSTYPE_EISA, sizeof(BUSTYPE_EISA)-1) == 0) {
diff --git a/arch/i386/kernel/reboot_fixups.c b/arch/i386/kernel/reboot_fixups.c
index 10e21a4773dd..99aab41a05b0 100644
--- a/arch/i386/kernel/reboot_fixups.c
+++ b/arch/i386/kernel/reboot_fixups.c
@@ -51,7 +51,5 @@ void mach_reboot_fixups(void)
 
                 cur->reboot_fixup(dev);
         }
-
-        printk(KERN_WARNING "No reboot fixup found for your hardware\n");
 }
 
diff --git a/arch/i386/kernel/setup.c b/arch/i386/kernel/setup.c
index 8c08660b4e5d..80cb3b2d0997 100644
--- a/arch/i386/kernel/setup.c
+++ b/arch/i386/kernel/setup.c
@@ -34,6 +34,7 @@
 #include <linux/initrd.h>
 #include <linux/bootmem.h>
 #include <linux/seq_file.h>
+#include <linux/platform_device.h>
 #include <linux/console.h>
 #include <linux/mca.h>
 #include <linux/root_dev.h>
@@ -962,6 +963,36 @@ efi_memory_present_wrapper(unsigned long start, unsigned long end, void *arg)
         return 0;
 }
 
+ /*
+  * This function checks if the entire range <start,end> is mapped with type.
+  *
+  * Note: this function only works correct if the e820 table is sorted and
+  * not-overlapping, which is the case
+  */
+int __init
+e820_all_mapped(unsigned long start, unsigned long end, unsigned type)
+{
+        int i;
+        for (i = 0; i < e820.nr_map; i++) {
+                struct e820entry *ei = &e820.map[i];
+                if (type && ei->type != type)
+                        continue;
+                /* is the region (part) in overlap with the current region ?*/
+                if (ei->addr >= end || ei->addr + ei->size <= start)
+                        continue;
+                /* if the region is at the beginning of <start,end> we move
+                 * start to the end of the region since it's ok until there
+                 */
+                if (ei->addr <= start)
+                        start = ei->addr + ei->size;
+                /* if start is now at or beyond end, we're done, full
+                 * coverage */
+                if (start >= end)
+                        return 1; /* we're done */
+        }
+        return 0;
+}
+
 /*
  * Find the highest page frame number we have available
  */
@@ -1316,8 +1347,8 @@ legacy_init_iomem_resources(struct resource *code_resource, struct resource *dat
 /*
  * Request address space for all standard resources
  *
- * This is called just before pcibios_assign_resources(), which is also
- * an fs_initcall, but is linked in later (in arch/i386/pci/i386.c).
+ * This is called just before pcibios_init(), which is also a
+ * subsys_initcall, but is linked in later (in arch/i386/pci/common.c).
  */
 static int __init request_standard_resources(void)
 {
@@ -1338,7 +1369,7 @@ static int __init request_standard_resources(void)
         return 0;
 }
 
-fs_initcall(request_standard_resources);
+subsys_initcall(request_standard_resources);
 
 static void __init register_memory(void)
 {
@@ -1547,6 +1578,23 @@ void __init setup_arch(char **cmdline_p)
 #endif
 }
 
+static __init int add_pcspkr(void)
+{
+        struct platform_device *pd;
+        int ret;
+
+        pd = platform_device_alloc("pcspkr", -1);
+        if (!pd)
+                return -ENOMEM;
+
+        ret = platform_device_add(pd);
+        if (ret)
+                platform_device_put(pd);
+
+        return ret;
+}
+device_initcall(add_pcspkr);
+
 #include "setup_arch_post.h"
 /*
  * Local Variables:
diff --git a/arch/i386/kernel/traps.c b/arch/i386/kernel/traps.c
index e38527994590..2d22f5761b1d 100644
--- a/arch/i386/kernel/traps.c
+++ b/arch/i386/kernel/traps.c
@@ -365,6 +365,9 @@ void die(const char * str, struct pt_regs * regs, long err)
 
         if (++die.lock_owner_depth < 3) {
                 int nl = 0;
+                unsigned long esp;
+                unsigned short ss;
+
                 handle_BUG(regs);
                 printk(KERN_EMERG "%s: %04lx [#%d]\n", str, err & 0xffff, ++die_counter);
 #ifdef CONFIG_PREEMPT
@@ -387,8 +390,19 @@ void die(const char * str, struct pt_regs * regs, long err)
                         printk("\n");
                 if (notify_die(DIE_OOPS, str, regs, err,
                                         current->thread.trap_no, SIGSEGV) !=
-                                NOTIFY_STOP)
+                                NOTIFY_STOP) {
                         show_registers(regs);
+                        /* Executive summary in case the oops scrolled away */
+                        esp = (unsigned long) (&regs->esp);
+                        savesegment(ss, ss);
+                        if (user_mode(regs)) {
+                                esp = regs->esp;
+                                ss = regs->xss & 0xffff;
+                        }
+                        printk(KERN_EMERG "EIP: [<%08lx>] ", regs->eip);
+                        print_symbol("%s", regs->eip);
+                        printk(" SS:ESP %04x:%08lx\n", ss, esp);
+                }
                 else
                         regs = NULL;
         } else
diff --git a/arch/i386/mach-voyager/voyager_cat.c b/arch/i386/mach-voyager/voyager_cat.c
index 23967fe658d3..3039539de51e 100644
--- a/arch/i386/mach-voyager/voyager_cat.c
+++ b/arch/i386/mach-voyager/voyager_cat.c
@@ -106,9 +106,15 @@ voyager_module_t *voyager_cat_list;
 
 /* the I/O port assignments for the VIC and QIC */
 static struct resource vic_res = {
-        "Voyager Interrupt Controller", 0xFC00, 0xFC6F };
+        .name   = "Voyager Interrupt Controller",
+        .start  = 0xFC00,
+        .end    = 0xFC6F
+};
 static struct resource qic_res = {
-        "Quad Interrupt Controller", 0xFC70, 0xFCFF };
+        .name   = "Quad Interrupt Controller",
+        .start  = 0xFC70,
+        .end    = 0xFCFF
+};
 
 /* This function is used to pack a data bit stream inside a message.
  * It writes num_bits of the data buffer in msg starting at start_bit.
diff --git a/arch/i386/mm/init.c b/arch/i386/mm/init.c
index 9f66ac582a8b..ae6534ad8161 100644
--- a/arch/i386/mm/init.c
+++ b/arch/i386/mm/init.c
@@ -651,6 +651,7 @@ void __init mem_init(void)
  * Specifically, in the case of x86, we will always add
  * memory to the highmem for now.
  */
+#ifdef CONFIG_HOTPLUG_MEMORY
 #ifndef CONFIG_NEED_MULTIPLE_NODES
 int add_memory(u64 start, u64 size)
 {
@@ -667,6 +668,7 @@ int remove_memory(u64 start, u64 size)
         return -EINVAL;
 }
 #endif
+#endif
 
 kmem_cache_t *pgd_cache;
 kmem_cache_t *pmd_cache;
diff --git a/arch/i386/pci/direct.c b/arch/i386/pci/direct.c
index 99012b93bd12..5d81fb510375 100644
--- a/arch/i386/pci/direct.c
+++ b/arch/i386/pci/direct.c
@@ -4,6 +4,7 @@
 
 #include <linux/pci.h>
 #include <linux/init.h>
+#include <linux/dmi.h>
 #include "pci.h"
 
 /*
@@ -18,8 +19,10 @@ int pci_conf1_read(unsigned int seg, unsigned int bus,
 {
         unsigned long flags;
 
-        if (!value || (bus > 255) || (devfn > 255) || (reg > 255))
+        if ((bus > 255) || (devfn > 255) || (reg > 255)) {
+                *value = -1;
                 return -EINVAL;
+        }
 
         spin_lock_irqsave(&pci_config_lock, flags);
 
@@ -91,8 +94,10 @@ static int pci_conf2_read(unsigned int seg, unsigned int bus,
         unsigned long flags;
         int dev, fn;
 
-        if (!value || (bus > 255) || (devfn > 255) || (reg > 255))
+        if ((bus > 255) || (devfn > 255) || (reg > 255)) {
+                *value = -1;
                 return -EINVAL;
+        }
 
         dev = PCI_SLOT(devfn);
         fn = PCI_FUNC(devfn);
@@ -188,6 +193,10 @@ static int __init pci_sanity_check(struct pci_raw_ops *o)
 
         if (pci_probe & PCI_NO_CHECKS)
                 return 1;
+        /* Assume Type 1 works for newer systems.
+           This handles machines that don't have anything on PCI Bus 0. */
+        if (dmi_get_year(DMI_BIOS_DATE) >= 2001)
+                return 1;
 
         for (devfn = 0; devfn < 0x100; devfn++) {
                 if (o->read(0, 0, devfn, PCI_CLASS_DEVICE, 2, &x))
diff --git a/arch/i386/pci/mmconfig.c b/arch/i386/pci/mmconfig.c
index 613789071f30..6b1ea0c9a570 100644
--- a/arch/i386/pci/mmconfig.c
+++ b/arch/i386/pci/mmconfig.c
@@ -12,14 +12,20 @@
 #include <linux/pci.h>
 #include <linux/init.h>
 #include <linux/acpi.h>
+#include <asm/e820.h>
 #include "pci.h"
 
+#define MMCONFIG_APER_SIZE (256*1024*1024)
+
+/* Assume systems with more busses have correct MCFG */
+#define MAX_CHECK_BUS 16
+
 #define mmcfg_virt_addr ((void __iomem *) fix_to_virt(FIX_PCIE_MCFG))
 
 /* The base address of the last MMCONFIG device accessed */
 static u32 mmcfg_last_accessed_device;
 
-static DECLARE_BITMAP(fallback_slots, 32);
+static DECLARE_BITMAP(fallback_slots, MAX_CHECK_BUS*32);
 
 /*
  * Functions for accessing PCI configuration space with MMCONFIG accesses
@@ -29,8 +35,8 @@ static u32 get_base_addr(unsigned int seg, int bus, unsigned devfn)
         int cfg_num = -1;
         struct acpi_table_mcfg_config *cfg;
 
-        if (seg == 0 && bus == 0 &&
-            test_bit(PCI_SLOT(devfn), fallback_slots))
+        if (seg == 0 && bus < MAX_CHECK_BUS &&
+            test_bit(PCI_SLOT(devfn) + 32*bus, fallback_slots))
                 return 0;
 
         while (1) {
@@ -74,8 +80,10 @@ static int pci_mmcfg_read(unsigned int seg, unsigned int bus,
         unsigned long flags;
         u32 base;
 
-        if (!value || (bus > 255) || (devfn > 255) || (reg > 4095))
+        if ((bus > 255) || (devfn > 255) || (reg > 4095)) {
+                *value = -1;
                 return -EINVAL;
+        }
 
         base = get_base_addr(seg, bus, devfn);
         if (!base)
@@ -146,29 +154,34 @@ static struct pci_raw_ops pci_mmcfg = {
    Normally this can be expressed in the MCFG by not listing them
    and assigning suitable _SEGs, but this isn't implemented in some BIOS.
    Instead try to discover all devices on bus 0 that are unreachable using MM
-   and fallback for them.
-   We only do this for bus 0/seg 0 */
+   and fallback for them. */
 static __init void unreachable_devices(void)
 {
-        int i;
+        int i, k;
         unsigned long flags;
 
-        for (i = 0; i < 32; i++) {
-                u32 val1;
-                u32 addr;
-
-                pci_conf1_read(0, 0, PCI_DEVFN(i, 0), 0, 4, &val1);
-                if (val1 == 0xffffffff)
-                        continue;
-
-                /* Locking probably not needed, but safer */
-                spin_lock_irqsave(&pci_config_lock, flags);
-                addr = get_base_addr(0, 0, PCI_DEVFN(i, 0));
-                if (addr != 0)
-                        pci_exp_set_dev_base(addr, 0, PCI_DEVFN(i, 0));
-                if (addr == 0 || readl((u32 __iomem *)mmcfg_virt_addr) != val1)
-                        set_bit(i, fallback_slots);
-                spin_unlock_irqrestore(&pci_config_lock, flags);
+        for (k = 0; k < MAX_CHECK_BUS; k++) {
+                for (i = 0; i < 32; i++) {
+                        u32 val1;
+                        u32 addr;
+
+                        pci_conf1_read(0, k, PCI_DEVFN(i, 0), 0, 4, &val1);
+                        if (val1 == 0xffffffff)
+                                continue;
+
+                        /* Locking probably not needed, but safer */
+                        spin_lock_irqsave(&pci_config_lock, flags);
+                        addr = get_base_addr(0, k, PCI_DEVFN(i, 0));
+                        if (addr != 0)
+                                pci_exp_set_dev_base(addr, k, PCI_DEVFN(i, 0));
+                        if (addr == 0 ||
+                            readl((u32 __iomem *)mmcfg_virt_addr) != val1) {
+                                set_bit(i, fallback_slots);
+                                printk(KERN_NOTICE
+                        "PCI: No mmconfig possible on %x:%x\n", k, i);
+                        }
+                        spin_unlock_irqrestore(&pci_config_lock, flags);
+                }
         }
 }
 
@@ -183,6 +196,14 @@ void __init pci_mmcfg_init(void)
             (pci_mmcfg_config[0].base_address == 0))
                 return;
 
+        if (!e820_all_mapped(pci_mmcfg_config[0].base_address,
+                        pci_mmcfg_config[0].base_address + MMCONFIG_APER_SIZE,
+                        E820_RESERVED)) {
+                printk(KERN_ERR "PCI: BIOS Bug: MCFG area is not E820-reserved\n");
+                printk(KERN_ERR "PCI: Not using MMCONFIG.\n");
+                return;
+        }
+
         printk(KERN_INFO "PCI: Using MMCONFIG\n");
         raw_pci_ops = &pci_mmcfg;
         pci_probe = (pci_probe & ~PCI_PROBE_MASK) | PCI_PROBE_MMCONF;
diff --git a/arch/ia64/Kconfig b/arch/ia64/Kconfig
index edffe25a477a..9f40eeff0b5c 100644
--- a/arch/ia64/Kconfig
+++ b/arch/ia64/Kconfig
@@ -260,15 +260,6 @@ config NR_CPUS
           than 64 will cause the use of a CPU mask array, causing a small
           performance hit.
 
-config IA64_NR_NODES
-        int "Maximum number of NODEs (256-1024)" if (IA64_SGI_SN2 || IA64_GENERIC)
-        range 256 1024
-        depends on IA64_SGI_SN2 || IA64_GENERIC
-        default "256"
-        help
-          This option specifies the maximum number of nodes in your SSI system.
-          If in doubt, use the default.
-
 config HOTPLUG_CPU
         bool "Support for hot-pluggable CPUs (EXPERIMENTAL)"
         depends on SMP && EXPERIMENTAL
@@ -352,6 +343,16 @@ config NUMA
           Access).  This option is for configuring high-end multiprocessor
           server systems.  If in doubt, say N.
 
+config NODES_SHIFT
+        int "Max num nodes shift(3-10)"
+        range 3 10
+        default "8"
+        depends on NEED_MULTIPLE_NODES
+        help
+          This option specifies the maximum number of nodes in your SSI system.
+          MAX_NUMNODES will be 2^(This value).
+          If in doubt, use the default.
+
 # VIRTUAL_MEM_MAP and FLAT_NODE_MEM_MAP are functionally equivalent.
 # VIRTUAL_MEM_MAP has been retained for historical reasons.
 config VIRTUAL_MEM_MAP
diff --git a/arch/ia64/kernel/acpi-ext.c b/arch/ia64/kernel/acpi-ext.c
index 4a5574ff007b..fff82929d225 100644
--- a/arch/ia64/kernel/acpi-ext.c
+++ b/arch/ia64/kernel/acpi-ext.c
@@ -1,105 +1,104 @@
 /*
- * arch/ia64/kernel/acpi-ext.c
+ * (c) Copyright 2003, 2006 Hewlett-Packard Development Company, L.P.
+ *      Alex Williamson <alex.williamson@hp.com>
+ *      Bjorn Helgaas <bjorn.helgaas@hp.com>
  *
- * Copyright (C) 2003 Hewlett-Packard
- * Copyright (C) Alex Williamson
- * Copyright (C) Bjorn Helgaas
- *
- * Vendor specific extensions to ACPI.
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
  */
 
 #include <linux/config.h>
 #include <linux/module.h>
 #include <linux/types.h>
 #include <linux/acpi.h>
-#include <linux/efi.h>
 
 #include <asm/acpi-ext.h>
 
-struct acpi_vendor_descriptor {
-        u8 guid_id;
-        efi_guid_t guid;
-};
+/*
+ * Device CSRs that do not appear in PCI config space should be described
+ * via ACPI.  This would normally be done with Address Space Descriptors
+ * marked as "consumer-only," but old versions of Windows and Linux ignore
+ * the producer/consumer flag, so HP invented a vendor-defined resource to
+ * describe the location and size of CSR space.
+ */
 
-struct acpi_vendor_info {
-        struct acpi_vendor_descriptor *descriptor;
-        u8 *data;
-        u32 length;
+struct acpi_vendor_uuid hp_ccsr_uuid = {
+        .subtype = 2,
+        .data = { 0xf9, 0xad, 0xe9, 0x69, 0x4f, 0x92, 0x5f, 0xab, 0xf6, 0x4a,
+            0x24, 0xd2, 0x01, 0x37, 0x0e, 0xad },
 };
 
-acpi_status
-acpi_vendor_resource_match(struct acpi_resource *resource, void *context)
+static acpi_status hp_ccsr_locate(acpi_handle obj, u64 *base, u64 *length)
 {
-        struct acpi_vendor_info *info = (struct acpi_vendor_info *)context;
-        struct acpi_resource_vendor *vendor;
-        struct acpi_vendor_descriptor *descriptor;
-        u32 byte_length;
-
-        if (resource->type != ACPI_RESOURCE_TYPE_VENDOR)
-                return AE_OK;
-
-        vendor = (struct acpi_resource_vendor *)&resource->data;
-        descriptor = (struct acpi_vendor_descriptor *)vendor->byte_data;
-        if (vendor->byte_length <= sizeof(*info->descriptor) ||
-            descriptor->guid_id != info->descriptor->guid_id ||
-            efi_guidcmp(descriptor->guid, info->descriptor->guid))
-                return AE_OK;
-
-        byte_length = vendor->byte_length - sizeof(struct acpi_vendor_descriptor);
-        info->data = acpi_os_allocate(byte_length);
-        if (!info->data)
-                return AE_NO_MEMORY;
-
-        memcpy(info->data,
-               vendor->byte_data + sizeof(struct acpi_vendor_descriptor),
-               byte_length);
-        info->length = byte_length;
-        return AE_CTRL_TERMINATE;
-}
+        acpi_status status;
+        struct acpi_buffer buffer = { ACPI_ALLOCATE_BUFFER, NULL };
+        struct acpi_resource *resource;
+        struct acpi_resource_vendor_typed *vendor;
 
-acpi_status
-acpi_find_vendor_resource(acpi_handle obj, struct acpi_vendor_descriptor * id,
-                          u8 ** data, u32 * byte_length)
-{
-        struct acpi_vendor_info info;
+        status = acpi_get_vendor_resource(obj, METHOD_NAME__CRS, &hp_ccsr_uuid,
+                &buffer);
 
-        info.descriptor = id;
-        info.data = NULL;
+        resource = buffer.pointer;
+        vendor = &resource->data.vendor_typed;
 
-        acpi_walk_resources(obj, METHOD_NAME__CRS, acpi_vendor_resource_match,
-                            &info);
-        if (!info.data)
-                return AE_NOT_FOUND;
+        if (ACPI_FAILURE(status) || vendor->byte_length < 16) {
+                status = AE_NOT_FOUND;
+                goto exit;
+        }
 
-        *data = info.data;
-        *byte_length = info.length;
-        return AE_OK;
+        memcpy(base, vendor->byte_data, sizeof(*base));
+        memcpy(length, vendor->byte_data + 8, sizeof(*length));
+
+  exit:
+        acpi_os_free(buffer.pointer);
+        return status;
 }
 
-struct acpi_vendor_descriptor hp_ccsr_descriptor = {
-        .guid_id = 2,
-        .guid =
-            EFI_GUID(0x69e9adf9, 0x924f, 0xab5f, 0xf6, 0x4a, 0x24, 0xd2, 0x01,
-                     0x37, 0x0e, 0xad)
+struct csr_space {
+        u64     base;
+        u64     length;
 };
 
-acpi_status hp_acpi_csr_space(acpi_handle obj, u64 * csr_base, u64 * csr_length)
+static acpi_status find_csr_space(struct acpi_resource *resource, void *data)
 {
+        struct csr_space *space = data;
+        struct acpi_resource_address64 addr;
         acpi_status status;
-        u8 *data;
-        u32 length;
 
-        status =
-            acpi_find_vendor_resource(obj, &hp_ccsr_descriptor, &data, &length);
+        status = acpi_resource_to_address64(resource, &addr);
+        if (ACPI_SUCCESS(status) &&
+            addr.resource_type == ACPI_MEMORY_RANGE &&
+            addr.address_length &&
+            addr.producer_consumer == ACPI_CONSUMER) {
+                space->base = addr.minimum;
+                space->length = addr.address_length;
+                return AE_CTRL_TERMINATE;
+        }
+        return AE_OK;           /* keep looking */
+}
 
-        if (ACPI_FAILURE(status) || length != 16)
-                return AE_NOT_FOUND;
+static acpi_status hp_crs_locate(acpi_handle obj, u64 *base, u64 *length)
+{
+        struct csr_space space = { 0, 0 };
 
-        memcpy(csr_base, data, sizeof(*csr_base));
-        memcpy(csr_length, data + 8, sizeof(*csr_length));
-        acpi_os_free(data);
+        acpi_walk_resources(obj, METHOD_NAME__CRS, find_csr_space, &space);
+        if (!space.length)
+                return AE_NOT_FOUND;
 
+        *base = space.base;
+        *length = space.length;
         return AE_OK;
 }
 
+acpi_status hp_acpi_csr_space(acpi_handle obj, u64 *csr_base, u64 *csr_length)
+{
+        acpi_status status;
+
+        status = hp_ccsr_locate(obj, csr_base, csr_length);
+        if (ACPI_SUCCESS(status))
+                return status;
+
+        return hp_crs_locate(obj, csr_base, csr_length);
+}
 EXPORT_SYMBOL(hp_acpi_csr_space);
diff --git a/arch/ia64/kernel/entry.S b/arch/ia64/kernel/entry.S
index 750e8e7fbdc3..6e16f6b35bd3 100644
--- a/arch/ia64/kernel/entry.S
+++ b/arch/ia64/kernel/entry.S
@@ -1606,5 +1606,8 @@ sys_call_table:
         data8 sys_ni_syscall                    // 1295 reserved for ppoll
         data8 sys_unshare
         data8 sys_splice
+        data8 sys_set_robust_list
+        data8 sys_get_robust_list
+        data8 sys_sync_file_range               // 1300
 
         .org sys_call_table + 8*NR_syscalls     // guard against failures to increase NR_syscalls
diff --git a/arch/ia64/kernel/mca.c b/arch/ia64/kernel/mca.c
index 8963171788d5..5e6fdbe78bcd 100644
--- a/arch/ia64/kernel/mca.c
+++ b/arch/ia64/kernel/mca.c
@@ -581,10 +581,12 @@ ia64_mca_rendez_int_handler(int rendez_irq, void *arg, struct pt_regs *regs)
 {
         unsigned long flags;
         int cpu = smp_processor_id();
+        struct ia64_mca_notify_die nd =
+                { .sos = NULL, .monarch_cpu = &monarch_cpu };
 
         /* Mask all interrupts */
         local_irq_save(flags);
-        if (notify_die(DIE_MCA_RENDZVOUS_ENTER, "MCA", regs, 0, 0, 0)
+        if (notify_die(DIE_MCA_RENDZVOUS_ENTER, "MCA", regs, (long)&nd, 0, 0)
                         == NOTIFY_STOP)
                 ia64_mca_spin(__FUNCTION__);
 
@@ -594,7 +596,7 @@ ia64_mca_rendez_int_handler(int rendez_irq, void *arg, struct pt_regs *regs)
          */
         ia64_sal_mc_rendez();
 
-        if (notify_die(DIE_MCA_RENDZVOUS_PROCESS, "MCA", regs, 0, 0, 0)
+        if (notify_die(DIE_MCA_RENDZVOUS_PROCESS, "MCA", regs, (long)&nd, 0, 0)
                         == NOTIFY_STOP)
                 ia64_mca_spin(__FUNCTION__);
 
@@ -602,7 +604,7 @@ ia64_mca_rendez_int_handler(int rendez_irq, void *arg, struct pt_regs *regs)
         while (monarch_cpu != -1)
                cpu_relax();     /* spin until monarch leaves */
 
-        if (notify_die(DIE_MCA_RENDZVOUS_LEAVE, "MCA", regs, 0, 0, 0)
+        if (notify_die(DIE_MCA_RENDZVOUS_LEAVE, "MCA", regs, (long)&nd, 0, 0)
                         == NOTIFY_STOP)
                 ia64_mca_spin(__FUNCTION__);
 
@@ -1023,6 +1025,8 @@ ia64_mca_handler(struct pt_regs *regs, struct switch_stack *sw,
                 &sos->proc_state_param;
         int recover, cpu = smp_processor_id();
         task_t *previous_current;
+        struct ia64_mca_notify_die nd =
+                { .sos = sos, .monarch_cpu = &monarch_cpu };
 
         oops_in_progress = 1;   /* FIXME: make printk NMI/MCA/INIT safe */
         console_loglevel = 15;  /* make sure printks make it to console */
@@ -1031,7 +1035,7 @@ ia64_mca_handler(struct pt_regs *regs, struct switch_stack *sw,
 
         previous_current = ia64_mca_modify_original_stack(regs, sw, sos, "MCA");
         monarch_cpu = cpu;
-        if (notify_die(DIE_MCA_MONARCH_ENTER, "MCA", regs, 0, 0, 0)
+        if (notify_die(DIE_MCA_MONARCH_ENTER, "MCA", regs, (long)&nd, 0, 0)
                         == NOTIFY_STOP)
                 ia64_mca_spin(__FUNCTION__);
         ia64_wait_for_slaves(cpu);
@@ -1043,7 +1047,7 @@ ia64_mca_handler(struct pt_regs *regs, struct switch_stack *sw,
          * spinning in SAL does not work.
          */
         ia64_mca_wakeup_all();
-        if (notify_die(DIE_MCA_MONARCH_PROCESS, "MCA", regs, 0, 0, 0)
+        if (notify_die(DIE_MCA_MONARCH_PROCESS, "MCA", regs, (long)&nd, 0, 0)
                         == NOTIFY_STOP)
                 ia64_mca_spin(__FUNCTION__);
 
@@ -1064,7 +1068,7 @@ ia64_mca_handler(struct pt_regs *regs, struct switch_stack *sw,
                 ia64_sal_clear_state_info(SAL_INFO_TYPE_MCA);
                 sos->os_status = IA64_MCA_CORRECTED;
         }
-        if (notify_die(DIE_MCA_MONARCH_LEAVE, "MCA", regs, 0, 0, recover)
+        if (notify_die(DIE_MCA_MONARCH_LEAVE, "MCA", regs, (long)&nd, 0, recover)
                         == NOTIFY_STOP)
                 ia64_mca_spin(__FUNCTION__);
 
@@ -1351,10 +1355,14 @@ ia64_init_handler(struct pt_regs *regs, struct switch_stack *sw,
         static atomic_t monarchs;
         task_t *previous_current;
         int cpu = smp_processor_id();
+        struct ia64_mca_notify_die nd =
+                { .sos = sos, .monarch_cpu = &monarch_cpu };
 
         oops_in_progress = 1;   /* FIXME: make printk NMI/MCA/INIT safe */
         console_loglevel = 15;  /* make sure printks make it to console */
 
+        (void) notify_die(DIE_INIT_ENTER, "INIT", regs, (long)&nd, 0, 0);
+
         printk(KERN_INFO "Entered OS INIT handler. PSP=%lx cpu=%d monarch=%ld\n",
                 sos->proc_state_param, cpu, sos->monarch);
         salinfo_log_wakeup(SAL_INFO_TYPE_INIT, NULL, 0, 0);
@@ -1390,15 +1398,15 @@ ia64_init_handler(struct pt_regs *regs, struct switch_stack *sw,
                 ia64_mc_info.imi_rendez_checkin[cpu] = IA64_MCA_RENDEZ_CHECKIN_INIT;
                 while (monarch_cpu == -1)
                        cpu_relax();     /* spin until monarch enters */
-                if (notify_die(DIE_INIT_SLAVE_ENTER, "INIT", regs, 0, 0, 0)
+                if (notify_die(DIE_INIT_SLAVE_ENTER, "INIT", regs, (long)&nd, 0, 0)
                                 == NOTIFY_STOP)
                         ia64_mca_spin(__FUNCTION__);
-                if (notify_die(DIE_INIT_SLAVE_PROCESS, "INIT", regs, 0, 0, 0)
+                if (notify_die(DIE_INIT_SLAVE_PROCESS, "INIT", regs, (long)&nd, 0, 0)
                                 == NOTIFY_STOP)
                         ia64_mca_spin(__FUNCTION__);
                 while (monarch_cpu != -1)
                        cpu_relax();     /* spin until monarch leaves */
-                if (notify_die(DIE_INIT_SLAVE_LEAVE, "INIT", regs, 0, 0, 0)
+                if (notify_die(DIE_INIT_SLAVE_LEAVE, "INIT", regs, (long)&nd, 0, 0)
                                 == NOTIFY_STOP)
                         ia64_mca_spin(__FUNCTION__);
                 printk("Slave on cpu %d returning to normal service.\n", cpu);
@@ -1409,7 +1417,7 @@ ia64_init_handler(struct pt_regs *regs, struct switch_stack *sw,
         }
 
         monarch_cpu = cpu;
-        if (notify_die(DIE_INIT_MONARCH_ENTER, "INIT", regs, 0, 0, 0)
+        if (notify_die(DIE_INIT_MONARCH_ENTER, "INIT", regs, (long)&nd, 0, 0)
                         == NOTIFY_STOP)
                 ia64_mca_spin(__FUNCTION__);
 
@@ -1426,10 +1434,10 @@ ia64_init_handler(struct pt_regs *regs, struct switch_stack *sw,
          * to default_monarch_init_process() above and just print all the
          * tasks.
          */
-        if (notify_die(DIE_INIT_MONARCH_PROCESS, "INIT", regs, 0, 0, 0)
+        if (notify_die(DIE_INIT_MONARCH_PROCESS, "INIT", regs, (long)&nd, 0, 0)
                         == NOTIFY_STOP)
                 ia64_mca_spin(__FUNCTION__);
-        if (notify_die(DIE_INIT_MONARCH_LEAVE, "INIT", regs, 0, 0, 0)
+        if (notify_die(DIE_INIT_MONARCH_LEAVE, "INIT", regs, (long)&nd, 0, 0)
                         == NOTIFY_STOP)
                 ia64_mca_spin(__FUNCTION__);
         printk("\nINIT dump complete.  Monarch on cpu %d returning to normal service.\n", cpu);
@@ -1631,6 +1639,7 @@ ia64_mca_init(void)
                         printk(KERN_INFO "Increasing MCA rendezvous timeout from "
                                 "%ld to %ld milliseconds\n", timeout, isrv.v0);
                         timeout = isrv.v0;
+                        (void) notify_die(DIE_MCA_NEW_TIMEOUT, "MCA", NULL, timeout, 0, 0);
                         continue;
                 }
                 printk(KERN_ERR "Failed to register rendezvous interrupt "
diff --git a/arch/ia64/kernel/mca_asm.S b/arch/ia64/kernel/mca_asm.S
index 60a464bfd9e2..6dff024cd62b 100644
--- a/arch/ia64/kernel/mca_asm.S
+++ b/arch/ia64/kernel/mca_asm.S
@@ -827,7 +827,7 @@ ia64_state_restore:
         ld8 r9=[temp2],16       // sal_gp
         ;;
         ld8 r22=[temp1],16      // pal_min_state, virtual
-        ld8 r21=[temp2],16      // prev_IA64_KR_CURRENT
+        ld8 r13=[temp2],16      // prev_IA64_KR_CURRENT
         ;;
         ld8 r16=[temp1],16      // prev_IA64_KR_CURRENT_STACK
         ld8 r20=[temp2],16      // prev_task
@@ -848,7 +848,7 @@ ia64_state_restore:
         mov cr.iim=temp3
         mov cr.iha=temp4
         dep r22=0,r22,62,1      // pal_min_state, physical, uncached
-        mov IA64_KR(CURRENT)=r21
+        mov IA64_KR(CURRENT)=r13
         ld8 r8=[temp1]          // os_status
         ld8 r10=[temp2]         // context
 
@@ -856,7 +856,7 @@ ia64_state_restore:
          * avoid any dependencies on the algorithm in ia64_switch_to(), just
          * purge any existing CURRENT_STACK mapping and insert the new one.
          *
-         * r16 contains prev_IA64_KR_CURRENT_STACK, r21 contains
+         * r16 contains prev_IA64_KR_CURRENT_STACK, r13 contains
          * prev_IA64_KR_CURRENT, these values may have been changed by the C
          * code.  Do not use r8, r9, r10, r22, they contain values ready for
          * the return to SAL.
@@ -873,7 +873,7 @@ ia64_state_restore:
         ;;
         srlz.d
 
-        extr.u r19=r21,61,3                     // r21 = prev_IA64_KR_CURRENT
+        extr.u r19=r13,61,3                     // r13 = prev_IA64_KR_CURRENT
         shl r20=r16,IA64_GRANULE_SHIFT          // r16 = prev_IA64_KR_CURRENT_STACK
         movl r21=PAGE_KERNEL                    // page properties
         ;;
@@ -883,7 +883,7 @@ ia64_state_restore:
 (p6)    br.spnt 1f                              // the dreaded cpu 0 idle task in region 5:(
         ;;
         mov cr.itir=r18
-        mov cr.ifa=r21
+        mov cr.ifa=r13
         mov r20=IA64_TR_CURRENT_STACK
         ;;
         itr.d dtr[r20]=r21
diff --git a/arch/ia64/kernel/module.c b/arch/ia64/kernel/module.c
index 7a2f0a798d12..3a30cfc9574f 100644
--- a/arch/ia64/kernel/module.c
+++ b/arch/ia64/kernel/module.c
@@ -947,7 +947,7 @@ void
 percpu_modcopy (void *pcpudst, const void *src, unsigned long size)
 {
         unsigned int i;
-        for_each_cpu(i) {
+        for_each_possible_cpu(i) {
                 memcpy(pcpudst + __per_cpu_offset[i], src, size);
         }
 }
diff --git a/arch/ia64/mm/fault.c b/arch/ia64/mm/fault.c
index af7eb087dca7..d98ec49570b8 100644
--- a/arch/ia64/mm/fault.c
+++ b/arch/ia64/mm/fault.c
@@ -60,6 +60,9 @@ ia64_do_page_fault (unsigned long address, unsigned long isr, struct pt_regs *re
         struct siginfo si;
         unsigned long mask;
 
+        /* mmap_sem is performance critical.... */
+        prefetchw(&mm->mmap_sem);
+
         /*
          * If we're in an interrupt or have no user context, we must not take the fault..
          */
diff --git a/arch/ia64/sn/kernel/xpc_channel.c b/arch/ia64/sn/kernel/xpc_channel.c
index d0abddd9ffe6..8255a9be4632 100644
--- a/arch/ia64/sn/kernel/xpc_channel.c
+++ b/arch/ia64/sn/kernel/xpc_channel.c
@@ -1831,7 +1831,7 @@ xpc_initiate_allocate(partid_t partid, int ch_number, u32 flags, void **payload)
 {
         struct xpc_partition *part = &xpc_partitions[partid];
         enum xpc_retval ret = xpcUnknownReason;
-        struct xpc_msg *msg;
+        struct xpc_msg *msg = NULL;
 
 
         DBUG_ON(partid <= 0 || partid >= XP_MAX_PARTITIONS);
diff --git a/arch/m32r/Kconfig b/arch/m32r/Kconfig
index 05c864c6c2d9..41fd490af3b4 100644
--- a/arch/m32r/Kconfig
+++ b/arch/m32r/Kconfig
@@ -285,6 +285,11 @@ config NUMA
         depends on SMP && BROKEN
         default n
 
+config NODES_SHIFT
+        int
+        default "1"
+        depends on NEED_MULTIPLE_NODES
+
 # turning this on wastes a bunch of space.
 # Summit needs it only when NUMA is on
 config BOOT_IOREMAP
diff --git a/arch/m32r/kernel/m32r_ksyms.c b/arch/m32r/kernel/m32r_ksyms.c
index be8b711367ec..c50330fa83b9 100644
--- a/arch/m32r/kernel/m32r_ksyms.c
+++ b/arch/m32r/kernel/m32r_ksyms.c
@@ -23,9 +23,6 @@ EXPORT_SYMBOL(boot_cpu_data);
 EXPORT_SYMBOL(dump_fpu);
 EXPORT_SYMBOL(__ioremap);
 EXPORT_SYMBOL(iounmap);
-EXPORT_SYMBOL(enable_irq);
-EXPORT_SYMBOL(disable_irq);
-EXPORT_SYMBOL(disable_irq_nosync);
 EXPORT_SYMBOL(kernel_thread);
 EXPORT_SYMBOL(__down);
 EXPORT_SYMBOL(__down_interruptible);
@@ -38,13 +35,6 @@ EXPORT_SYMBOL(__udelay);
 EXPORT_SYMBOL(__delay);
 EXPORT_SYMBOL(__const_udelay);
 
-EXPORT_SYMBOL(__get_user_1);
-EXPORT_SYMBOL(__get_user_2);
-EXPORT_SYMBOL(__get_user_4);
-
-EXPORT_SYMBOL(strpbrk);
-EXPORT_SYMBOL(strstr);
-
 EXPORT_SYMBOL(strncpy_from_user);
 EXPORT_SYMBOL(__strncpy_from_user);
 EXPORT_SYMBOL(clear_user);
@@ -59,11 +49,8 @@ extern void *dcache_dummy;
 EXPORT_SYMBOL(dcache_dummy);
 #endif
 EXPORT_SYMBOL(cpu_data);
-EXPORT_SYMBOL(cpu_online_map);
-EXPORT_SYMBOL(cpu_callout_map);
 
 /* Global SMP stuff */
-EXPORT_SYMBOL(synchronize_irq);
 EXPORT_SYMBOL(smp_call_function);
 
 /* TLB flushing */
@@ -83,27 +70,11 @@ EXPORT_SYMBOL(__lshrdi3);
 EXPORT_SYMBOL(__muldi3);
 
 /* memory and string operations */
-EXPORT_SYMBOL(memchr);
 EXPORT_SYMBOL(memcpy);
-/* EXPORT_SYMBOL(memcpy_fromio); // not implement yet */
-/* EXPORT_SYMBOL(memcpy_toio); // not implement yet */
 EXPORT_SYMBOL(memset);
-/* EXPORT_SYMBOL(memset_io); // not implement yet */
-EXPORT_SYMBOL(memmove);
-EXPORT_SYMBOL(memcmp);
-EXPORT_SYMBOL(memscan);
 EXPORT_SYMBOL(copy_page);
 EXPORT_SYMBOL(clear_page);
-
-EXPORT_SYMBOL(strcat);
-EXPORT_SYMBOL(strchr);
-EXPORT_SYMBOL(strcmp);
-EXPORT_SYMBOL(strcpy);
 EXPORT_SYMBOL(strlen);
-EXPORT_SYMBOL(strncat);
-EXPORT_SYMBOL(strncmp);
-EXPORT_SYMBOL(strnlen);
-EXPORT_SYMBOL(strncpy);
 
 EXPORT_SYMBOL(_inb);
 EXPORT_SYMBOL(_inw);
diff --git a/arch/m32r/kernel/setup.c b/arch/m32r/kernel/setup.c
index 0d78942b4c76..3cd3c2988a48 100644
--- a/arch/m32r/kernel/setup.c
+++ b/arch/m32r/kernel/setup.c
@@ -9,6 +9,7 @@
 
 #include <linux/config.h>
 #include <linux/init.h>
+#include <linux/kernel.h>
 #include <linux/stddef.h>
 #include <linux/fs.h>
 #include <linux/sched.h>
@@ -219,8 +220,6 @@ static unsigned long __init setup_memory(void)
 extern unsigned long setup_memory(void);
 #endif  /* CONFIG_DISCONTIGMEM */
 
-#define M32R_PCC_PCATCR 0x00ef7014      /* will move to m32r.h */
-
 void __init setup_arch(char **cmdline_p)
 {
         ROOT_DEV = old_decode_dev(ORIG_ROOT_DEV);
@@ -269,15 +268,14 @@ void __init setup_arch(char **cmdline_p)
         paging_init();
 }
 
-static struct cpu cpu[NR_CPUS];
+static struct cpu cpu_devices[NR_CPUS];
 
 static int __init topology_init(void)
 {
-        int cpu_id;
+        int i;
 
-        for (cpu_id = 0; cpu_id < NR_CPUS; cpu_id++)
-                if (cpu_possible(cpu_id))
-                        register_cpu(&cpu[cpu_id], cpu_id, NULL);
+        for_each_present_cpu(i)
+                register_cpu(&cpu_devices[i], i, NULL);
 
         return 0;
 }
diff --git a/arch/m32r/kernel/smpboot.c b/arch/m32r/kernel/smpboot.c
index d7ec16e7fb25..840b4348bf0c 100644
--- a/arch/m32r/kernel/smpboot.c
+++ b/arch/m32r/kernel/smpboot.c
@@ -39,8 +39,10 @@
  *              Martin J. Bligh :       Added support for multi-quad systems
  */
 
+#include <linux/module.h>
 #include <linux/config.h>
 #include <linux/init.h>
+#include <linux/kernel.h>
 #include <linux/mm.h>
 #include <linux/smp_lock.h>
 #include <linux/irq.h>
@@ -72,11 +74,15 @@ physid_mask_t phys_cpu_present_map;
 
 /* Bitmask of currently online CPUs */
 cpumask_t cpu_online_map;
+EXPORT_SYMBOL(cpu_online_map);
 
 cpumask_t cpu_bootout_map;
 cpumask_t cpu_bootin_map;
-cpumask_t cpu_callout_map;
 static cpumask_t cpu_callin_map;
+cpumask_t cpu_callout_map;
+EXPORT_SYMBOL(cpu_callout_map);
+cpumask_t cpu_possible_map = CPU_MASK_ALL;
+EXPORT_SYMBOL(cpu_possible_map);
 
 /* Per CPU bogomips and other parameters */
 struct cpuinfo_m32r cpu_data[NR_CPUS] __cacheline_aligned;
@@ -110,7 +116,6 @@ static unsigned int calibration_result;
 
 void smp_prepare_boot_cpu(void);
 void smp_prepare_cpus(unsigned int);
-static void smp_tune_scheduling(void);
 static void init_ipi_lock(void);
 static void do_boot_cpu(int);
 int __cpu_up(unsigned int);
@@ -177,6 +182,9 @@ void __init smp_prepare_cpus(unsigned int max_cpus)
         }
         for (phys_id = 0 ; phys_id < nr_cpu ; phys_id++)
                 physid_set(phys_id, phys_cpu_present_map);
+#ifndef CONFIG_HOTPLUG_CPU
+        cpu_present_map = cpu_possible_map;
+#endif
 
         show_mp_info(nr_cpu);
 
@@ -186,7 +194,6 @@ void __init smp_prepare_cpus(unsigned int max_cpus)
          * Setup boot CPU information
          */
         smp_store_cpu_info(0); /* Final full version of the data */
-        smp_tune_scheduling();
 
         /*
          * If SMP should be disabled, then really disable it!
@@ -230,11 +237,6 @@ smp_done:
         Dprintk("Boot done.\n");
 }
 
-static void __init smp_tune_scheduling(void)
-{
-        /* Nothing to do. */
-}
-
 /*
  * init_ipi_lock : Initialize IPI locks.
  */
@@ -629,4 +631,3 @@ static void __init unmap_cpu_to_physid(int cpu_id, int phys_id)
         physid_2_cpu[phys_id] = -1;
         cpu_2_physid[cpu_id] = -1;
 }
-
diff --git a/arch/m32r/lib/Makefile b/arch/m32r/lib/Makefile
index e632d10c7d78..d16b4e40d1ae 100644
--- a/arch/m32r/lib/Makefile
+++ b/arch/m32r/lib/Makefile
@@ -2,6 +2,6 @@
 # Makefile for M32R-specific library files..
 #
 
-lib-y  := checksum.o ashxdi3.o memset.o memcpy.o getuser.o \
-          putuser.o delay.o strlen.o usercopy.o csum_partial_copy.o
+lib-y  := checksum.o ashxdi3.o memset.o memcpy.o \
+          delay.o strlen.o usercopy.o csum_partial_copy.o
 
diff --git a/arch/m32r/lib/getuser.S b/arch/m32r/lib/getuser.S
deleted file mode 100644
index 58a0db055c5c..000000000000
--- a/arch/m32r/lib/getuser.S
+++ /dev/null
@@ -1,88 +0,0 @@
-/*
- * __get_user functions.
- *
- * (C) Copyright 2001 Hirokazu Takata
- *
- * These functions have a non-standard call interface
- * to make them more efficient, especially as they
- * return an error value in addition to the "real"
- * return value.
- */
-
-#include <linux/config.h>
-
-/*
- * __get_user_X
- *
- * Inputs:      r0 contains the address
- *
- * Outputs:     r0 is error code (0 or -EFAULT)
- *              r1 contains zero-extended value
- *
- * These functions should not modify any other registers,
- * as they get called from within inline assembly.
- */
-
-#ifdef CONFIG_ISA_DUAL_ISSUE
-
-        .text
-        .balign 4
-        .globl __get_user_1
-__get_user_1:
-1:      ldub    r1, @r0             ||  ldi     r0, #0
-        jmp     r14
-
-        .balign 4
-        .globl __get_user_2
-__get_user_2:
-2:      lduh    r1, @r0             ||  ldi     r0, #0
-        jmp     r14
-
-        .balign 4
-        .globl __get_user_4
-__get_user_4:
-3:      ld      r1, @r0             ||  ldi     r0, #0
-        jmp     r14
-
-bad_get_user:
-        ldi     r1, #0              ||  ldi     r0, #-14
-        jmp     r14
-
-#else /* not CONFIG_ISA_DUAL_ISSUE */
-
-        .text
-        .balign 4
-        .globl __get_user_1
-__get_user_1:
-1:      ldub    r1, @r0
-        ldi     r0, #0
-        jmp     r14
-
-        .balign 4
-        .globl __get_user_2
-__get_user_2:
-2:      lduh    r1, @r0
-        ldi     r0, #0
-        jmp     r14
-
-        .balign 4
-        .globl __get_user_4
-__get_user_4:
-3:      ld      r1, @r0
-        ldi     r0, #0
-        jmp     r14
-
-bad_get_user:
-        ldi     r1, #0
-        ldi     r0, #-14
-        jmp     r14
-
-#endif /* not CONFIG_ISA_DUAL_ISSUE */
-
-.section __ex_table,"a"
-        .long 1b,bad_get_user
-        .long 2b,bad_get_user
-        .long 3b,bad_get_user
-.previous
-
-        .end
diff --git a/arch/m32r/lib/putuser.S b/arch/m32r/lib/putuser.S
deleted file mode 100644
index 218154cc3890..000000000000
--- a/arch/m32r/lib/putuser.S
+++ /dev/null
@@ -1,84 +0,0 @@
-/*
- * __put_user functions.
- *
- * (C) Copyright 1998 Linus Torvalds
- * (C) Copyright 2001 Hirokazu Takata
- *
- * These functions have a non-standard call interface
- * to make them more efficient.
- */
-
-#include <linux/config.h>
-
-/*
- * __put_user_X
- *
- * Inputs:      r0 contains the address
- *              r1 contains the value
- *
- * Outputs:     r0 is error code (0 or -EFAULT)
- *              r1 is corrupted (will contain "current_task").
- *
- * These functions should not modify any other registers,
- * as they get called from within inline assembly.
- */
-
-#ifdef CONFIG_ISA_DUAL_ISSUE
-
-        .text
-        .balign 4
-        .globl __put_user_1
-__put_user_1:
-1:      stb     r1, @r0             ||  ldi     r0, #0
-        jmp     r14
-
-        .balign 4
-        .globl __put_user_2
-__put_user_2:
-2:      sth     r1, @r0             ||  ldi     r0, #0
-        jmp     r14
-
-        .balign 4
-        .globl __put_user_4
-__put_user_4:
-3:      st      r1, @r0             ||  ldi     r0, #0
-        jmp     r14
-
-bad_put_user:
-        ldi     r0, #-14            ||  jmp     r14
-
-#else /* not CONFIG_ISA_DUAL_ISSUE */
-
-        .text
-        .balign 4
-        .globl __put_user_1
-__put_user_1:
-1:      stb     r1, @r0
-        ldi     r0, #0
-        jmp     r14
-
-        .balign 4
-        .globl __put_user_2
-__put_user_2:
-2:      sth     r1, @r0
-        ldi     r0, #0
-        jmp     r14
-
-        .balign 4
-        .globl __put_user_4
-__put_user_4:
-3:      st      r1, @r0
-        ldi     r0, #0
-        jmp     r14
-
-bad_put_user:
-        ldi     r0, #-14
-        jmp     r14
-
-#endif /* not CONFIG_ISA_DUAL_ISSUE */
-
-.section __ex_table,"a"
-        .long 1b,bad_put_user
-        .long 2b,bad_put_user
-        .long 3b,bad_put_user
-.previous
diff --git a/arch/m68k/kernel/m68k_ksyms.c b/arch/m68k/kernel/m68k_ksyms.c
index c3319514a85e..5b7952ea2bae 100644
--- a/arch/m68k/kernel/m68k_ksyms.c
+++ b/arch/m68k/kernel/m68k_ksyms.c
@@ -57,7 +57,6 @@ EXPORT_SYMBOL(dump_thread);
 EXPORT_SYMBOL(strnlen);
 EXPORT_SYMBOL(strrchr);
 EXPORT_SYMBOL(strstr);
-EXPORT_SYMBOL(strpbrk);
 EXPORT_SYMBOL(enable_irq);
 EXPORT_SYMBOL(disable_irq);
 EXPORT_SYMBOL(kernel_thread);
diff --git a/arch/m68knommu/kernel/m68k_ksyms.c b/arch/m68knommu/kernel/m68k_ksyms.c
index f9b4ea16c099..4320d5dcc9cb 100644
--- a/arch/m68knommu/kernel/m68k_ksyms.c
+++ b/arch/m68knommu/kernel/m68k_ksyms.c
@@ -26,7 +26,6 @@ EXPORT_SYMBOL(__ioremap);
 EXPORT_SYMBOL(iounmap);
 EXPORT_SYMBOL(dump_fpu);
 EXPORT_SYMBOL(strnlen);
-EXPORT_SYMBOL(strpbrk);
 EXPORT_SYMBOL(strrchr);
 EXPORT_SYMBOL(strstr);
 EXPORT_SYMBOL(strchr);
diff --git a/arch/mips/Kconfig b/arch/mips/Kconfig
index 5080ea1799a4..7aec60d40420 100644
--- a/arch/mips/Kconfig
+++ b/arch/mips/Kconfig
@@ -233,6 +233,7 @@ config MACH_JAZZ
         select ARC32
         select ARCH_MAY_HAVE_PC_FDC
         select GENERIC_ISA_DMA
+        select I8253
         select I8259
         select ISA
         select SYS_HAS_CPU_R4X00
@@ -530,6 +531,7 @@ config QEMU
         select DMA_COHERENT
         select GENERIC_ISA_DMA
         select HAVE_STD_PC_SERIAL_PORT
+        select I8253
         select I8259
         select ISA
         select SWAP_IO_SPACE
@@ -714,6 +716,7 @@ config SNI_RM200_PCI
         select HAVE_STD_PC_SERIAL_PORT
         select HW_HAS_EISA
         select HW_HAS_PCI
+        select I8253
         select I8259
         select ISA
         select SYS_HAS_CPU_R4X00
@@ -1587,6 +1590,11 @@ config ARCH_FLATMEM_ENABLE
         def_bool y
         depends on !NUMA
 
+config NODES_SHIFT
+        int
+        default "6"
+        depends on NEED_MULTIPLE_NODES
+
 source "mm/Kconfig"
 
 config SMP
@@ -1721,6 +1729,9 @@ config MMU
         bool
         default y
 
+config I8253
+        bool
+
 source "drivers/pcmcia/Kconfig"
 
 source "drivers/pci/hotplug/Kconfig"
diff --git a/arch/mips/kernel/Makefile b/arch/mips/kernel/Makefile
index f36c4f20ee8a..309d54cceda3 100644
--- a/arch/mips/kernel/Makefile
+++ b/arch/mips/kernel/Makefile
@@ -59,6 +59,8 @@ obj-$(CONFIG_PROC_FS)		+= proc.o
 
 obj-$(CONFIG_64BIT)             += cpu-bugs64.o
 
+obj-$(CONFIG_I8253)             += i8253.o
+
 CFLAGS_cpu-bugs64.o     = $(shell if $(CC) $(CFLAGS) -Wa,-mdaddi -c -o /dev/null -xc /dev/null >/dev/null 2>&1; then echo "-DHAVE_AS_SET_DADDI"; fi)
 
 EXTRA_AFLAGS := $(CFLAGS)
diff --git a/arch/mips/kernel/i8253.c b/arch/mips/kernel/i8253.c
new file mode 100644
index 000000000000..475df6904219
--- /dev/null
+++ b/arch/mips/kernel/i8253.c
@@ -0,0 +1,28 @@
+/*
+ * Copyright (C) 2006 IBM Corporation
+ *
+ * Implements device information for i8253 timer chip
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License version
+ * 2 as published by the Free Software Foundation
+ */
+
+#include <linux/platform_device.h>
+
+static __init int add_pcspkr(void)
+{
+        struct platform_device *pd;
+        int ret;
+
+        pd = platform_device_alloc("pcspkr", -1);
+        if (!pd)
+                return -ENOMEM;
+
+        ret = platform_device_add(pd);
+        if (ret)
+                platform_device_put(pd);
+
+        return ret;
+}
+device_initcall(add_pcspkr);
diff --git a/arch/mips/kernel/mips_ksyms.c b/arch/mips/kernel/mips_ksyms.c
index 86e42c633f73..e042f9d2ba31 100644
--- a/arch/mips/kernel/mips_ksyms.c
+++ b/arch/mips/kernel/mips_ksyms.c
@@ -39,7 +39,6 @@ EXPORT_SYMBOL(strchr);
 EXPORT_SYMBOL(strncmp);
 #endif
 EXPORT_SYMBOL(strlen);
-EXPORT_SYMBOL(strpbrk);
 EXPORT_SYMBOL(strncat);
 EXPORT_SYMBOL(strnlen);
 EXPORT_SYMBOL(strrchr);
diff --git a/arch/parisc/Kconfig b/arch/parisc/Kconfig
index 2fdf21989dc2..19f911c5dd58 100644
--- a/arch/parisc/Kconfig
+++ b/arch/parisc/Kconfig
@@ -177,6 +177,11 @@ config ARCH_DISCONTIGMEM_DEFAULT
         def_bool y
         depends on ARCH_DISCONTIGMEM_ENABLE
 
+config NODES_SHIFT
+        int
+        default "3"
+        depends on NEED_MULTIPLE_NODES
+
 source "kernel/Kconfig.preempt"
 source "kernel/Kconfig.hz"
 source "mm/Kconfig"
diff --git a/arch/parisc/kernel/parisc_ksyms.c b/arch/parisc/kernel/parisc_ksyms.c
index 47ca5c0a323b..fc107add627c 100644
--- a/arch/parisc/kernel/parisc_ksyms.c
+++ b/arch/parisc/kernel/parisc_ksyms.c
@@ -31,7 +31,6 @@
 
 #include <linux/string.h>
 EXPORT_SYMBOL(memset);
-EXPORT_SYMBOL(strpbrk);
 
 #include <asm/atomic.h>
 EXPORT_SYMBOL(__xchg8);
diff --git a/arch/powerpc/Kconfig b/arch/powerpc/Kconfig
index 2cdc35ce8045..167e70e95556 100644
--- a/arch/powerpc/Kconfig
+++ b/arch/powerpc/Kconfig
@@ -649,6 +649,11 @@ config NUMA
         depends on PPC64
         default y if SMP && PPC_PSERIES
 
+config NODES_SHIFT
+        int
+        default "4"
+        depends on NEED_MULTIPLE_NODES
+
 config ARCH_SELECT_MEMORY_MODEL
         def_bool y
         depends on PPC64
diff --git a/arch/powerpc/kernel/lparcfg.c b/arch/powerpc/kernel/lparcfg.c
index 1b73508ecb2b..2cbde865d4f5 100644
--- a/arch/powerpc/kernel/lparcfg.c
+++ b/arch/powerpc/kernel/lparcfg.c
@@ -37,7 +37,7 @@
 #include <asm/prom.h>
 #include <asm/vdso_datapage.h>
 
-#define MODULE_VERS "1.6"
+#define MODULE_VERS "1.7"
 #define MODULE_NAME "lparcfg"
 
 /* #define LPARCFG_DEBUG */
@@ -149,17 +149,17 @@ static void log_plpar_hcall_return(unsigned long rc, char *tag)
         if (rc == 0)            /* success, return */
                 return;
 /* check for null tag ? */
-        if (rc == H_Hardware)
+        if (rc == H_HARDWARE)
                 printk(KERN_INFO
                        "plpar-hcall (%s) failed with hardware fault\n", tag);
-        else if (rc == H_Function)
+        else if (rc == H_FUNCTION)
                 printk(KERN_INFO
                        "plpar-hcall (%s) failed; function not allowed\n", tag);
-        else if (rc == H_Authority)
+        else if (rc == H_AUTHORITY)
                 printk(KERN_INFO
-                       "plpar-hcall (%s) failed; not authorized to this function\n",
-                       tag);
-        else if (rc == H_Parameter)
+                       "plpar-hcall (%s) failed; not authorized to this"
+                       " function\n", tag);
+        else if (rc == H_PARAMETER)
                 printk(KERN_INFO "plpar-hcall (%s) failed; Bad parameter(s)\n",
                        tag);
         else
@@ -209,7 +209,7 @@ static void h_pic(unsigned long *pool_idle_time, unsigned long *num_procs)
         unsigned long dummy;
         rc = plpar_hcall(H_PIC, 0, 0, 0, 0, pool_idle_time, num_procs, &dummy);
 
-        if (rc != H_Authority)
+        if (rc != H_AUTHORITY)
                 log_plpar_hcall_return(rc, "H_PIC");
 }
 
@@ -242,7 +242,7 @@ static void parse_system_parameter_string(struct seq_file *m)
 {
         int call_status;
 
-        char *local_buffer = kmalloc(SPLPAR_MAXLENGTH, GFP_KERNEL);
+        unsigned char *local_buffer = kmalloc(SPLPAR_MAXLENGTH, GFP_KERNEL);
         if (!local_buffer) {
                 printk(KERN_ERR "%s %s kmalloc failure at line %d \n",
                        __FILE__, __FUNCTION__, __LINE__);
@@ -254,7 +254,8 @@ static void parse_system_parameter_string(struct seq_file *m)
         call_status = rtas_call(rtas_token("ibm,get-system-parameter"), 3, 1,
                                 NULL,
                                 SPLPAR_CHARACTERISTICS_TOKEN,
-                                __pa(rtas_data_buf));
+                                __pa(rtas_data_buf),
+                                RTAS_DATA_BUF_SIZE);
         memcpy(local_buffer, rtas_data_buf, SPLPAR_MAXLENGTH);
         spin_unlock(&rtas_data_buf_lock);
 
@@ -275,7 +276,7 @@ static void parse_system_parameter_string(struct seq_file *m)
 #ifdef LPARCFG_DEBUG
                 printk(KERN_INFO "success calling get-system-parameter \n");
 #endif
-                splpar_strlen = local_buffer[0] * 16 + local_buffer[1];
+                splpar_strlen = local_buffer[0] * 256 + local_buffer[1];
                 local_buffer += 2;      /* step over strlen value */
 
                 memset(workbuffer, 0, SPLPAR_MAXLENGTH);
@@ -529,13 +530,13 @@ static ssize_t lparcfg_write(struct file *file, const char __user * buf,
         retval = plpar_hcall_norets(H_SET_PPP, *new_entitled_ptr,
                                     *new_weight_ptr);
 
-        if (retval == H_Success || retval == H_Constrained) {
+        if (retval == H_SUCCESS || retval == H_CONSTRAINED) {
                 retval = count;
-        } else if (retval == H_Busy) {
+        } else if (retval == H_BUSY) {
                 retval = -EBUSY;
-        } else if (retval == H_Hardware) {
+        } else if (retval == H_HARDWARE) {
                 retval = -EIO;
-        } else if (retval == H_Parameter) {
+        } else if (retval == H_PARAMETER) {
                 retval = -EINVAL;
         } else {
                 printk(KERN_WARNING "%s: received unknown hv return code %ld",
diff --git a/arch/powerpc/kernel/rtas.c b/arch/powerpc/kernel/rtas.c
index 06636c927a7e..0112318213ab 100644
--- a/arch/powerpc/kernel/rtas.c
+++ b/arch/powerpc/kernel/rtas.c
@@ -578,18 +578,18 @@ static void rtas_percpu_suspend_me(void *info)
          * We use "waiting" to indicate our state.  As long
          * as it is >0, we are still trying to all join up.
          * If it goes to 0, we have successfully joined up and
-         * one thread got H_Continue.  If any error happens,
+         * one thread got H_CONTINUE.  If any error happens,
          * we set it to <0.
          */
         local_irq_save(flags);
         do {
                 rc = plpar_hcall_norets(H_JOIN);
                 smp_rmb();
-        } while (rc == H_Success && data->waiting > 0);
-        if (rc == H_Success)
+        } while (rc == H_SUCCESS && data->waiting > 0);
+        if (rc == H_SUCCESS)
                 goto out;
 
-        if (rc == H_Continue) {
+        if (rc == H_CONTINUE) {
                 data->waiting = 0;
                 data->args->args[data->args->nargs] =
                         rtas_call(ibm_suspend_me_token, 0, 1, NULL);
@@ -597,7 +597,7 @@ static void rtas_percpu_suspend_me(void *info)
                         plpar_hcall_norets(H_PROD,i);
         } else {
                 data->waiting = -EBUSY;
-                printk(KERN_ERR "Error on H_Join hypervisor call\n");
+                printk(KERN_ERR "Error on H_JOIN hypervisor call\n");
         }
 
 out:
@@ -624,7 +624,7 @@ static int rtas_ibm_suspend_me(struct rtas_args *args)
                 printk(KERN_ERR "Error doing global join\n");
 
         /* Prod each CPU.  This won't hurt, and will wake
-         * anyone we successfully put to sleep with H_Join
+         * anyone we successfully put to sleep with H_JOIN.
          */
         for_each_possible_cpu(i)
                 plpar_hcall_norets(H_PROD, i);
diff --git a/arch/powerpc/kernel/setup-common.c b/arch/powerpc/kernel/setup-common.c
index c607f3b9ca17..1d93e73a7003 100644
--- a/arch/powerpc/kernel/setup-common.c
+++ b/arch/powerpc/kernel/setup-common.c
@@ -21,6 +21,7 @@
 #include <linux/reboot.h>
 #include <linux/delay.h>
 #include <linux/initrd.h>
+#include <linux/platform_device.h>
 #include <linux/ide.h>
 #include <linux/seq_file.h>
 #include <linux/ioport.h>
@@ -462,6 +463,29 @@ static int __init early_xmon(char *p)
 early_param("xmon", early_xmon);
 #endif
 
+static __init int add_pcspkr(void)
+{
+        struct device_node *np;
+        struct platform_device *pd;
+        int ret;
+
+        np = of_find_compatible_node(NULL, NULL, "pnpPNP,100");
+        of_node_put(np);
+        if (!np)
+                return -ENODEV;
+
+        pd = platform_device_alloc("pcspkr", -1);
+        if (!pd)
+                return -ENOMEM;
+
+        ret = platform_device_add(pd);
+        if (ret)
+                platform_device_put(pd);
+
+        return ret;
+}
+device_initcall(add_pcspkr);
+
 void probe_machine(void)
 {
         extern struct machdep_calls __machine_desc_start;
diff --git a/arch/powerpc/kernel/setup_32.c b/arch/powerpc/kernel/setup_32.c
index a72bf5dceeee..69ac25701344 100644
--- a/arch/powerpc/kernel/setup_32.c
+++ b/arch/powerpc/kernel/setup_32.c
@@ -50,7 +50,6 @@
 #include <asm/kgdb.h>
 #endif
 
-extern void platform_init(void);
 extern void bootx_init(unsigned long r4, unsigned long phys);
 
 boot_infos_t *boot_infos;
@@ -138,12 +137,7 @@ void __init machine_init(unsigned long dt_ptr, unsigned long phys)
                 strlcpy(cmd_line, CONFIG_CMDLINE, sizeof(cmd_line));
 #endif /* CONFIG_CMDLINE */
 
-#ifdef CONFIG_PPC_MULTIPLATFORM
         probe_machine();
-#else
-        /* Base init based on machine type. Obsoloete, please kill ! */
-        platform_init();
-#endif
 
 #ifdef CONFIG_6xx
         if (cpu_has_feature(CPU_FTR_CAN_DOZE) ||
diff --git a/arch/powerpc/kernel/setup_64.c b/arch/powerpc/kernel/setup_64.c
index 59aa92cd6fa4..13e91c4d70a8 100644
--- a/arch/powerpc/kernel/setup_64.c
+++ b/arch/powerpc/kernel/setup_64.c
@@ -215,12 +215,10 @@ void __init early_setup(unsigned long dt_ptr)
         /*
          * Initialize stab / SLB management except on iSeries
          */
-        if (!firmware_has_feature(FW_FEATURE_ISERIES)) {
-                if (cpu_has_feature(CPU_FTR_SLB))
-                        slb_initialize();
-                else
-                        stab_initialize(get_paca()->stab_real);
-        }
+        if (cpu_has_feature(CPU_FTR_SLB))
+                slb_initialize();
+        else if (!firmware_has_feature(FW_FEATURE_ISERIES))
+                stab_initialize(get_paca()->stab_real);
 
         DBG(" <- early_setup()\n");
 }
diff --git a/arch/powerpc/kernel/systbl.S b/arch/powerpc/kernel/systbl.S
index 1ad55f0466fd..1424eab450ee 100644
--- a/arch/powerpc/kernel/systbl.S
+++ b/arch/powerpc/kernel/systbl.S
@@ -322,3 +322,4 @@ SYSCALL(spu_create)
 COMPAT_SYS(pselect6)
 COMPAT_SYS(ppoll)
 SYSCALL(unshare)
+SYSCALL(splice)
diff --git a/arch/powerpc/kernel/traps.c b/arch/powerpc/kernel/traps.c
index 4cbde211eb69..064a52564692 100644
--- a/arch/powerpc/kernel/traps.c
+++ b/arch/powerpc/kernel/traps.c
@@ -228,7 +228,7 @@ void system_reset_exception(struct pt_regs *regs)
  */
 static inline int check_io_access(struct pt_regs *regs)
 {
-#ifdef CONFIG_PPC_PMAC
+#if defined(CONFIG_PPC_PMAC) && defined(CONFIG_PPC32)
         unsigned long msr = regs->msr;
         const struct exception_table_entry *entry;
         unsigned int *nip = (unsigned int *)regs->nip;
@@ -261,7 +261,7 @@ static inline int check_io_access(struct pt_regs *regs)
                         return 1;
                 }
         }
-#endif /* CONFIG_PPC_PMAC */
+#endif /* CONFIG_PPC_PMAC && CONFIG_PPC32 */
         return 0;
 }
 
@@ -308,8 +308,8 @@ platform_machine_check(struct pt_regs *regs)
 
 void machine_check_exception(struct pt_regs *regs)
 {
-#ifdef CONFIG_PPC64
         int recover = 0;
+        unsigned long reason = get_mc_reason(regs);
 
         /* See if any machine dependent calls */
         if (ppc_md.machine_check_exception)
@@ -317,8 +317,6 @@ void machine_check_exception(struct pt_regs *regs)
 
         if (recover)
                 return;
-#else
-        unsigned long reason = get_mc_reason(regs);
 
         if (user_mode(regs)) {
                 regs->msr |= MSR_RI;
@@ -462,7 +460,6 @@ void machine_check_exception(struct pt_regs *regs)
          * additional info, e.g. bus error registers.
          */
         platform_machine_check(regs);
-#endif /* CONFIG_PPC64 */
 
         if (debugger_fault_handler(regs))
                 return;
diff --git a/arch/powerpc/mm/fault.c b/arch/powerpc/mm/fault.c
index 5aea0909a5ec..fdbba4206d59 100644
--- a/arch/powerpc/mm/fault.c
+++ b/arch/powerpc/mm/fault.c
@@ -177,15 +177,15 @@ int __kprobes do_page_fault(struct pt_regs *regs, unsigned long address,
 
         /* When running in the kernel we expect faults to occur only to
          * addresses in user space.  All other faults represent errors in the
-         * kernel and should generate an OOPS.  Unfortunatly, in the case of an
-         * erroneous fault occuring in a code path which already holds mmap_sem
+         * kernel and should generate an OOPS.  Unfortunately, in the case of an
+         * erroneous fault occurring in a code path which already holds mmap_sem
          * we will deadlock attempting to validate the fault against the
          * address space.  Luckily the kernel only validly references user
          * space from well defined areas of code, which are listed in the
          * exceptions table.
          *
          * As the vast majority of faults will be valid we will only perform
-         * the source reference check when there is a possibilty of a deadlock.
+         * the source reference check when there is a possibility of a deadlock.
          * Attempt to lock the address space, if we cannot we then validate the
          * source.  If this is invalid we can skip the address space check,
          * thus avoiding the deadlock.
diff --git a/arch/powerpc/platforms/83xx/mpc834x_sys.c b/arch/powerpc/platforms/83xx/mpc834x_sys.c
index 7c18b4cd5db4..7e789d2420ba 100644
--- a/arch/powerpc/platforms/83xx/mpc834x_sys.c
+++ b/arch/powerpc/platforms/83xx/mpc834x_sys.c
@@ -158,25 +158,25 @@ static int __init mpc834x_rtc_hookup(void)
 late_initcall(mpc834x_rtc_hookup);
 #endif
 
-void __init platform_init(void)
+/*
+ * Called very early, MMU is off, device-tree isn't unflattened
+ */
+static int __init mpc834x_sys_probe(void)
 {
-        /* setup the PowerPC module struct */
-        ppc_md.setup_arch = mpc834x_sys_setup_arch;
-
-        ppc_md.init_IRQ = mpc834x_sys_init_IRQ;
-        ppc_md.get_irq = ipic_get_irq;
-
-        ppc_md.restart = mpc83xx_restart;
-
-        ppc_md.time_init = mpc83xx_time_init;
-        ppc_md.set_rtc_time = NULL;
-        ppc_md.get_rtc_time = NULL;
-        ppc_md.calibrate_decr = generic_calibrate_decr;
-
-        ppc_md.progress = udbg_progress;
-
-        if (ppc_md.progress)
-                ppc_md.progress("mpc834x_sys_init(): exit", 0);
-
-        return;
+        /* We always match for now, eventually we should look at the flat
+           dev tree to ensure this is the board we are suppose to run on
+        */
+        return 1;
 }
+
+define_machine(mpc834x_sys) {
+        .name                   = "MPC834x SYS",
+        .probe                  = mpc834x_sys_probe,
+        .setup_arch             = mpc834x_sys_setup_arch,
+        .init_IRQ               = mpc834x_sys_init_IRQ,
+        .get_irq                = ipic_get_irq,
+        .restart                = mpc83xx_restart,
+        .time_init              = mpc83xx_time_init,
+        .calibrate_decr         = generic_calibrate_decr,
+        .progress               = udbg_progress,
+};
diff --git a/arch/powerpc/platforms/85xx/mpc85xx_ads.c b/arch/powerpc/platforms/85xx/mpc85xx_ads.c
index b7821dbae00d..5eeff370f5fc 100644
--- a/arch/powerpc/platforms/85xx/mpc85xx_ads.c
+++ b/arch/powerpc/platforms/85xx/mpc85xx_ads.c
@@ -220,25 +220,25 @@ void mpc85xx_ads_show_cpuinfo(struct seq_file *m)
         seq_printf(m, "Memory\t\t: %d MB\n", memsize / (1024 * 1024));
 }
 
-void __init platform_init(void)
+/*
+ * Called very early, device-tree isn't unflattened
+ */
+static int __init mpc85xx_ads_probe(void)
 {
-        ppc_md.setup_arch = mpc85xx_ads_setup_arch;
-        ppc_md.show_cpuinfo = mpc85xx_ads_show_cpuinfo;
-
-        ppc_md.init_IRQ = mpc85xx_ads_pic_init;
-        ppc_md.get_irq = mpic_get_irq;
-
-        ppc_md.restart = mpc85xx_restart;
-        ppc_md.power_off = NULL;
-        ppc_md.halt = NULL;
-
-        ppc_md.time_init = NULL;
-        ppc_md.set_rtc_time = NULL;
-        ppc_md.get_rtc_time = NULL;
-        ppc_md.calibrate_decr = generic_calibrate_decr;
-
-        ppc_md.progress = udbg_progress;
-
-        if (ppc_md.progress)
-                ppc_md.progress("mpc85xx_ads platform_init(): exit", 0);
+        /* We always match for now, eventually we should look at the flat
+           dev tree to ensure this is the board we are suppose to run on
+        */
+        return 1;
 }
+
+define_machine(mpc85xx_ads) {
+        .name                   = "MPC85xx ADS",
+        .probe                  = mpc85xx_ads_probe,
+        .setup_arch             = mpc85xx_ads_setup_arch,
+        .init_IRQ               = mpc85xx_ads_pic_init,
+        .show_cpuinfo           = mpc85xx_ads_show_cpuinfo,
+        .get_irq                = mpic_get_irq,
+        .restart                = mpc85xx_restart,
+        .calibrate_decr         = generic_calibrate_decr,
+        .progress               = udbg_progress,
+};
diff --git a/arch/powerpc/platforms/cell/spu_callbacks.c b/arch/powerpc/platforms/cell/spu_callbacks.c
index 3a4245c926ad..6594bec73882 100644
--- a/arch/powerpc/platforms/cell/spu_callbacks.c
+++ b/arch/powerpc/platforms/cell/spu_callbacks.c
@@ -316,6 +316,7 @@ void *spu_syscall_table[] = {
         [__NR_pselect6]                 sys_ni_syscall, /* sys_pselect */
         [__NR_ppoll]                    sys_ni_syscall, /* sys_ppoll */
         [__NR_unshare]                  sys_unshare,
+        [__NR_splice]                   sys_splice,
 };
 
 long spu_sys_callback(struct spu_syscall_block *s)
diff --git a/arch/powerpc/platforms/cell/spufs/run.c b/arch/powerpc/platforms/cell/spufs/run.c
index c04e078c0fe5..483c8b76232c 100644
--- a/arch/powerpc/platforms/cell/spufs/run.c
+++ b/arch/powerpc/platforms/cell/spufs/run.c
@@ -2,6 +2,7 @@
 #include <linux/ptrace.h>
 
 #include <asm/spu.h>
+#include <asm/unistd.h>
 
 #include "spufs.h"
 
diff --git a/arch/powerpc/platforms/pseries/eeh.c b/arch/powerpc/platforms/pseries/eeh.c
index 9b2b1cb117b3..780fb27a0099 100644
--- a/arch/powerpc/platforms/pseries/eeh.c
+++ b/arch/powerpc/platforms/pseries/eeh.c
@@ -865,7 +865,7 @@ void __init eeh_init(void)
  * on the CEC architecture, type of the device, on earlier boot
  * command-line arguments & etc.
  */
-void eeh_add_device_early(struct device_node *dn)
+static void eeh_add_device_early(struct device_node *dn)
 {
         struct pci_controller *phb;
         struct eeh_early_enable_info info;
@@ -882,7 +882,6 @@ void eeh_add_device_early(struct device_node *dn)
         info.buid_lo = BUID_LO(phb->buid);
         early_enable_eeh(dn, &info);
 }
-EXPORT_SYMBOL_GPL(eeh_add_device_early);
 
 void eeh_add_device_tree_early(struct device_node *dn)
 {
@@ -893,20 +892,6 @@ void eeh_add_device_tree_early(struct device_node *dn)
 }
 EXPORT_SYMBOL_GPL(eeh_add_device_tree_early);
 
-void eeh_add_device_tree_late(struct pci_bus *bus)
-{
-        struct pci_dev *dev;
-
-        list_for_each_entry(dev, &bus->devices, bus_list) {
-                eeh_add_device_late(dev);
-                if (dev->hdr_type == PCI_HEADER_TYPE_BRIDGE) {
-                        struct pci_bus *subbus = dev->subordinate;
-                        if (subbus)
-                                eeh_add_device_tree_late(subbus);
-                }
-        }
-}
-
 /**
  * eeh_add_device_late - perform EEH initialization for the indicated pci device
  * @dev: pci device for which to set up EEH
@@ -914,7 +899,7 @@ void eeh_add_device_tree_late(struct pci_bus *bus)
  * This routine must be used to complete EEH initialization for PCI
  * devices that were added after system boot (e.g. hotplug, dlpar).
  */
-void eeh_add_device_late(struct pci_dev *dev)
+static void eeh_add_device_late(struct pci_dev *dev)
 {
         struct device_node *dn;
         struct pci_dn *pdn;
@@ -933,16 +918,33 @@ void eeh_add_device_late(struct pci_dev *dev)
 
         pci_addr_cache_insert_device (dev);
 }
-EXPORT_SYMBOL_GPL(eeh_add_device_late);
+
+void eeh_add_device_tree_late(struct pci_bus *bus)
+{
+        struct pci_dev *dev;
+
+        list_for_each_entry(dev, &bus->devices, bus_list) {
+                eeh_add_device_late(dev);
+                if (dev->hdr_type == PCI_HEADER_TYPE_BRIDGE) {
+                        struct pci_bus *subbus = dev->subordinate;
+                        if (subbus)
+                                eeh_add_device_tree_late(subbus);
+                }
+        }
+}
+EXPORT_SYMBOL_GPL(eeh_add_device_tree_late);
 
 /**
  * eeh_remove_device - undo EEH setup for the indicated pci device
  * @dev: pci device to be removed
  *
- * This routine should be when a device is removed from a running
- * system (e.g. by hotplug or dlpar).
+ * This routine should be called when a device is removed from
+ * a running system (e.g. by hotplug or dlpar).  It unregisters
+ * the PCI device from the EEH subsystem.  I/O errors affecting
+ * this device will no longer be detected after this call; thus,
+ * i/o errors affecting this slot may leave this device unusable.
  */
-void eeh_remove_device(struct pci_dev *dev)
+static void eeh_remove_device(struct pci_dev *dev)
 {
         struct device_node *dn;
         if (!dev || !eeh_subsystem_enabled)
@@ -958,21 +960,17 @@ void eeh_remove_device(struct pci_dev *dev)
         PCI_DN(dn)->pcidev = NULL;
         pci_dev_put (dev);
 }
-EXPORT_SYMBOL_GPL(eeh_remove_device);
 
 void eeh_remove_bus_device(struct pci_dev *dev)
 {
+        struct pci_bus *bus = dev->subordinate;
+        struct pci_dev *child, *tmp;
+
         eeh_remove_device(dev);
-        if (dev->hdr_type == PCI_HEADER_TYPE_BRIDGE) {
-                struct pci_bus *bus = dev->subordinate;
-                struct list_head *ln;
-                if (!bus)
-                        return; 
-                for (ln = bus->devices.next; ln != &bus->devices; ln = ln->next) {
-                        struct pci_dev *pdev = pci_dev_b(ln);
-                        if (pdev)
-                                eeh_remove_bus_device(pdev);
-                }
+
+        if (bus && dev->hdr_type == PCI_HEADER_TYPE_BRIDGE) {
+                list_for_each_entry_safe(child, tmp, &bus->devices, bus_list)
+                         eeh_remove_bus_device(child);
         }
 }
 EXPORT_SYMBOL_GPL(eeh_remove_bus_device);
diff --git a/arch/powerpc/platforms/pseries/eeh_driver.c b/arch/powerpc/platforms/pseries/eeh_driver.c
index cc2495a0cdd5..1fba695e32e8 100644
--- a/arch/powerpc/platforms/pseries/eeh_driver.c
+++ b/arch/powerpc/platforms/pseries/eeh_driver.c
@@ -293,15 +293,16 @@ void handle_eeh_events (struct eeh_event *event)
         frozen_pdn = PCI_DN(frozen_dn);
         frozen_pdn->eeh_freeze_count++;
 
-        pci_str = pci_name (frozen_pdn->pcidev);
-        drv_str = pcid_name (frozen_pdn->pcidev);
-        if (!pci_str) {
+        if (frozen_pdn->pcidev) {
+                pci_str = pci_name (frozen_pdn->pcidev);
+                drv_str = pcid_name (frozen_pdn->pcidev);
+        } else {
                 pci_str = pci_name (event->dev);
                 drv_str = pcid_name (event->dev);
         }
         
         if (frozen_pdn->eeh_freeze_count > EEH_MAX_ALLOWED_FREEZES)
-                goto hard_fail;
+                goto excess_failures;
 
         /* If the reset state is a '5' and the time to reset is 0 (infinity)
          * or is more then 15 seconds, then mark this as a permanent failure.
@@ -356,7 +357,7 @@ void handle_eeh_events (struct eeh_event *event)
 
         return;
         
-hard_fail:
+excess_failures:
         /*
          * About 90% of all real-life EEH failures in the field
          * are due to poorly seated PCI cards. Only 10% or so are
@@ -367,7 +368,15 @@ hard_fail:
            "and has been permanently disabled.  Please try reseating\n"
            "this device or replacing it.\n",
                 drv_str, pci_str, frozen_pdn->eeh_freeze_count);
+        goto perm_error;
+
+hard_fail:
+        printk(KERN_ERR
+           "EEH: Unable to recover from failure of PCI device %s - %s\n"
+           "Please try reseating this device or replacing it.\n",
+                drv_str, pci_str);
 
+perm_error:
         eeh_slot_error_detail(frozen_pdn, 2 /* Permanent Error */);
 
         /* Notify all devices that they're about to go down. */
diff --git a/arch/powerpc/platforms/pseries/eeh_event.c b/arch/powerpc/platforms/pseries/eeh_event.c
index 9a9961f27480..a1bda6f96fd1 100644
--- a/arch/powerpc/platforms/pseries/eeh_event.c
+++ b/arch/powerpc/platforms/pseries/eeh_event.c
@@ -19,7 +19,9 @@
  */
 
 #include <linux/list.h>
+#include <linux/mutex.h>
 #include <linux/pci.h>
+#include <linux/workqueue.h>
 #include <asm/eeh_event.h>
 #include <asm/ppc-pci.h>
 
@@ -37,14 +39,18 @@ LIST_HEAD(eeh_eventlist);
 static void eeh_thread_launcher(void *);
 DECLARE_WORK(eeh_event_wq, eeh_thread_launcher, NULL);
 
+/* Serialize reset sequences for a given pci device */
+DEFINE_MUTEX(eeh_event_mutex);
+
 /**
- * eeh_event_handler - dispatch EEH events.  The detection of a frozen
- * slot can occur inside an interrupt, where it can be hard to do
- * anything about it.  The goal of this routine is to pull these
- * detection events out of the context of the interrupt handler, and
- * re-dispatch them for processing at a later time in a normal context.
- *
+ * eeh_event_handler - dispatch EEH events.
  * @dummy - unused
+ *
+ * The detection of a frozen slot can occur inside an interrupt,
+ * where it can be hard to do anything about it.  The goal of this
+ * routine is to pull these detection events out of the context
+ * of the interrupt handler, and re-dispatch them for processing
+ * at a later time in a normal context.
  */
 static int eeh_event_handler(void * dummy)
 {
@@ -64,23 +70,24 @@ static int eeh_event_handler(void * dummy)
                         event = list_entry(eeh_eventlist.next, struct eeh_event, list);
                         list_del(&event->list);
                 }
-                
-                if (event)
-                        eeh_mark_slot(event->dn, EEH_MODE_RECOVERING);
-
                 spin_unlock_irqrestore(&eeh_eventlist_lock, flags);
+
                 if (event == NULL)
                         break;
 
+                /* Serialize processing of EEH events */
+                mutex_lock(&eeh_event_mutex);
+                eeh_mark_slot(event->dn, EEH_MODE_RECOVERING);
+
                 printk(KERN_INFO "EEH: Detected PCI bus error on device %s\n",
                        pci_name(event->dev));
 
                 handle_eeh_events(event);
 
                 eeh_clear_slot(event->dn, EEH_MODE_RECOVERING);
-
                 pci_dev_put(event->dev);
                 kfree(event);
+                mutex_unlock(&eeh_event_mutex);
         }
 
         return 0;
@@ -88,7 +95,6 @@ static int eeh_event_handler(void * dummy)
 
 /**
  * eeh_thread_launcher
- *
  * @dummy - unused
  */
 static void eeh_thread_launcher(void *dummy)
diff --git a/arch/powerpc/platforms/pseries/hvCall.S b/arch/powerpc/platforms/pseries/hvCall.S
index db7c19fe9297..c9ff547f9d25 100644
--- a/arch/powerpc/platforms/pseries/hvCall.S
+++ b/arch/powerpc/platforms/pseries/hvCall.S
@@ -127,3 +127,103 @@ _GLOBAL(plpar_hcall_4out)
 
         mtcrf   0xff,r0
         blr                             /* return r3 = status */
+
+/* plpar_hcall_7arg_7ret(unsigned long opcode,          R3
+                         unsigned long arg1,            R4
+                         unsigned long arg2,            R5
+                         unsigned long arg3,            R6
+                         unsigned long arg4,            R7
+                         unsigned long arg5,            R8
+                         unsigned long arg6,            R9
+                         unsigned long arg7,            R10
+                         unsigned long *out1,           112(R1)
+                         unsigned long *out2,           110(R1)
+                         unsigned long *out3,           108(R1)
+                         unsigned long *out4,           106(R1)
+                         unsigned long *out5,           104(R1)
+                         unsigned long *out6,           102(R1)
+                         unsigned long *out7);          100(R1)
+*/
+_GLOBAL(plpar_hcall_7arg_7ret)
+        HMT_MEDIUM
+
+        mfcr    r0
+        stw     r0,8(r1)
+
+        HVSC                            /* invoke the hypervisor */
+
+        lwz     r0,8(r1)
+
+        ld      r11,STK_PARM(r11)(r1)   /* Fetch r4 ret arg */
+        std     r4,0(r11)
+        ld      r11,STK_PARM(r12)(r1)   /* Fetch r5 ret arg */
+        std     r5,0(r11)
+        ld      r11,STK_PARM(r13)(r1)   /* Fetch r6 ret arg */
+        std     r6,0(r11)
+        ld      r11,STK_PARM(r14)(r1)   /* Fetch r7 ret arg */
+        std     r7,0(r11)
+        ld      r11,STK_PARM(r15)(r1)   /* Fetch r8 ret arg */
+        std     r8,0(r11)
+        ld      r11,STK_PARM(r16)(r1)   /* Fetch r9 ret arg */
+        std     r9,0(r11)
+        ld      r11,STK_PARM(r17)(r1)   /* Fetch r10 ret arg */
+        std     r10,0(r11)
+
+        mtcrf   0xff,r0
+
+        blr                             /* return r3 = status */
+
+/* plpar_hcall_9arg_9ret(unsigned long opcode,          R3
+                         unsigned long arg1,            R4
+                         unsigned long arg2,            R5
+                         unsigned long arg3,            R6
+                         unsigned long arg4,            R7
+                         unsigned long arg5,            R8
+                         unsigned long arg6,            R9
+                         unsigned long arg7,            R10
+                         unsigned long arg8,            112(R1)
+                         unsigned long arg9,            110(R1)
+                         unsigned long *out1,           108(R1)
+                         unsigned long *out2,           106(R1)
+                         unsigned long *out3,           104(R1)
+                         unsigned long *out4,           102(R1)
+                         unsigned long *out5,           100(R1)
+                         unsigned long *out6,            98(R1)
+                         unsigned long *out7);           96(R1)
+                         unsigned long *out8,            94(R1)
+                         unsigned long *out9,            92(R1)
+*/
+_GLOBAL(plpar_hcall_9arg_9ret)
+        HMT_MEDIUM
+
+        mfcr    r0
+        stw     r0,8(r1)
+
+        ld      r11,STK_PARM(r11)(r1)    /* put arg8 in R11 */
+        ld      r12,STK_PARM(r12)(r1)    /* put arg9 in R12 */
+
+        HVSC                            /* invoke the hypervisor */
+
+        ld      r0,STK_PARM(r13)(r1)    /* Fetch r4 ret arg */
+        stdx    r4,r0,r0
+        ld      r0,STK_PARM(r14)(r1)    /* Fetch r5 ret arg */
+        stdx    r5,r0,r0
+        ld      r0,STK_PARM(r15)(r1)    /* Fetch r6 ret arg */
+        stdx    r6,r0,r0
+        ld      r0,STK_PARM(r16)(r1)    /* Fetch r7 ret arg */
+        stdx    r7,r0,r0
+        ld      r0,STK_PARM(r17)(r1)    /* Fetch r8 ret arg */
+        stdx    r8,r0,r0
+        ld      r0,STK_PARM(r18)(r1)    /* Fetch r9 ret arg */
+        stdx    r9,r0,r0
+        ld      r0,STK_PARM(r19)(r1)    /* Fetch r10 ret arg */
+        stdx    r10,r0,r0
+        ld      r0,STK_PARM(r20)(r1)    /* Fetch r11 ret arg */
+        stdx    r11,r0,r0
+        ld      r0,STK_PARM(r21)(r1)    /* Fetch r12 ret arg */
+        stdx    r12,r0,r0
+
+        lwz     r0,8(r1)
+        mtcrf   0xff,r0
+
+        blr                             /* return r3 = status */
diff --git a/arch/powerpc/platforms/pseries/hvconsole.c b/arch/powerpc/platforms/pseries/hvconsole.c
index ba6befd96636..a72a987f1d4d 100644
--- a/arch/powerpc/platforms/pseries/hvconsole.c
+++ b/arch/powerpc/platforms/pseries/hvconsole.c
@@ -41,7 +41,7 @@ int hvc_get_chars(uint32_t vtermno, char *buf, int count)
         unsigned long got;
 
         if (plpar_hcall(H_GET_TERM_CHAR, vtermno, 0, 0, 0, &got,
-                (unsigned long *)buf, (unsigned long *)buf+1) == H_Success)
+                (unsigned long *)buf, (unsigned long *)buf+1) == H_SUCCESS)
                 return got;
         return 0;
 }
@@ -69,9 +69,9 @@ int hvc_put_chars(uint32_t vtermno, const char *buf, int count)
 
         ret = plpar_hcall_norets(H_PUT_TERM_CHAR, vtermno, count, lbuf[0],
                                  lbuf[1]);
-        if (ret == H_Success)
+        if (ret == H_SUCCESS)
                 return count;
-        if (ret == H_Busy)
+        if (ret == H_BUSY)
                 return 0;
         return -EIO;
 }
diff --git a/arch/powerpc/platforms/pseries/hvcserver.c b/arch/powerpc/platforms/pseries/hvcserver.c
index 22bfb5c89db9..fcf4b4cbeaf3 100644
--- a/arch/powerpc/platforms/pseries/hvcserver.c
+++ b/arch/powerpc/platforms/pseries/hvcserver.c
@@ -43,21 +43,21 @@ MODULE_VERSION(HVCS_ARCH_VERSION);
 static int hvcs_convert(long to_convert)
 {
         switch (to_convert) {
-                case H_Success:
+                case H_SUCCESS:
                         return 0;
-                case H_Parameter:
+                case H_PARAMETER:
                         return -EINVAL;
-                case H_Hardware:
+                case H_HARDWARE:
                         return -EIO;
-                case H_Busy:
-                case H_LongBusyOrder1msec:
-                case H_LongBusyOrder10msec:
-                case H_LongBusyOrder100msec:
-                case H_LongBusyOrder1sec:
-                case H_LongBusyOrder10sec:
-                case H_LongBusyOrder100sec:
+                case H_BUSY:
+                case H_LONG_BUSY_ORDER_1_MSEC:
+                case H_LONG_BUSY_ORDER_10_MSEC:
+                case H_LONG_BUSY_ORDER_100_MSEC:
+                case H_LONG_BUSY_ORDER_1_SEC:
+                case H_LONG_BUSY_ORDER_10_SEC:
+                case H_LONG_BUSY_ORDER_100_SEC:
                         return -EBUSY;
-                case H_Function: /* fall through */
+                case H_FUNCTION: /* fall through */
                 default:
                         return -EPERM;
         }
diff --git a/arch/powerpc/platforms/pseries/lpar.c b/arch/powerpc/platforms/pseries/lpar.c
index 8952528d31ac..634b7d06d3cc 100644
--- a/arch/powerpc/platforms/pseries/lpar.c
+++ b/arch/powerpc/platforms/pseries/lpar.c
@@ -54,7 +54,8 @@ EXPORT_SYMBOL(plpar_hcall);
 EXPORT_SYMBOL(plpar_hcall_4out);
 EXPORT_SYMBOL(plpar_hcall_norets);
 EXPORT_SYMBOL(plpar_hcall_8arg_2ret);
-
+EXPORT_SYMBOL(plpar_hcall_7arg_7ret);
+EXPORT_SYMBOL(plpar_hcall_9arg_9ret);
 extern void pSeries_find_serial_port(void);
 
 
@@ -72,7 +73,7 @@ static void udbg_hvsi_putc(char c)
 
         do {
                 rc = plpar_put_term_char(vtermno, sizeof(packet), packet);
-        } while (rc == H_Busy);
+        } while (rc == H_BUSY);
 }
 
 static long hvsi_udbg_buf_len;
@@ -85,7 +86,7 @@ static int udbg_hvsi_getc_poll(void)
 
         if (hvsi_udbg_buf_len == 0) {
                 rc = plpar_get_term_char(vtermno, &hvsi_udbg_buf_len, hvsi_udbg_buf);
-                if (rc != H_Success || hvsi_udbg_buf[0] != 0xff) {
+                if (rc != H_SUCCESS || hvsi_udbg_buf[0] != 0xff) {
                         /* bad read or non-data packet */
                         hvsi_udbg_buf_len = 0;
                 } else {
@@ -139,7 +140,7 @@ static void udbg_putcLP(char c)
         buf[0] = c;
         do {
                 rc = plpar_put_term_char(vtermno, 1, buf);
-        } while(rc == H_Busy);
+        } while(rc == H_BUSY);
 }
 
 /* Buffered chars getc */
@@ -158,7 +159,7 @@ static int udbg_getc_pollLP(void)
                 /* get some more chars. */
                 inbuflen = 0;
                 rc = plpar_get_term_char(vtermno, &inbuflen, buf);
-                if (rc != H_Success)
+                if (rc != H_SUCCESS)
                         inbuflen = 0;   /* otherwise inbuflen is garbage */
         }
         if (inbuflen <= 0 || inbuflen > 16) {
@@ -304,7 +305,7 @@ long pSeries_lpar_hpte_insert(unsigned long hpte_group,
 
         lpar_rc = plpar_hcall(H_ENTER, flags, hpte_group, hpte_v,
                               hpte_r, &slot, &dummy0, &dummy1);
-        if (unlikely(lpar_rc == H_PTEG_Full)) {
+        if (unlikely(lpar_rc == H_PTEG_FULL)) {
                 if (!(vflags & HPTE_V_BOLTED))
                         DBG_LOW(" full\n");
                 return -1;
@@ -315,7 +316,7 @@ long pSeries_lpar_hpte_insert(unsigned long hpte_group,
          * will fail. However we must catch the failure in hash_page
          * or we will loop forever, so return -2 in this case.
          */
-        if (unlikely(lpar_rc != H_Success)) {
+        if (unlikely(lpar_rc != H_SUCCESS)) {
                 if (!(vflags & HPTE_V_BOLTED))
                         DBG_LOW(" lpar err %d\n", lpar_rc);
                 return -2;
@@ -346,9 +347,9 @@ static long pSeries_lpar_hpte_remove(unsigned long hpte_group)
                 /* don't remove a bolted entry */
                 lpar_rc = plpar_pte_remove(H_ANDCOND, hpte_group + slot_offset,
                                            (0x1UL << 4), &dummy1, &dummy2);
-                if (lpar_rc == H_Success)
+                if (lpar_rc == H_SUCCESS)
                         return i;
-                BUG_ON(lpar_rc != H_Not_Found);
+                BUG_ON(lpar_rc != H_NOT_FOUND);
 
                 slot_offset++;
                 slot_offset &= 0x7;
@@ -391,14 +392,14 @@ static long pSeries_lpar_hpte_updatepp(unsigned long slot,
 
         lpar_rc = plpar_pte_protect(flags, slot, want_v & HPTE_V_AVPN);
 
-        if (lpar_rc == H_Not_Found) {
+        if (lpar_rc == H_NOT_FOUND) {
                 DBG_LOW("not found !\n");
                 return -1;
         }
 
         DBG_LOW("ok\n");
 
-        BUG_ON(lpar_rc != H_Success);
+        BUG_ON(lpar_rc != H_SUCCESS);
 
         return 0;
 }
@@ -417,7 +418,7 @@ static unsigned long pSeries_lpar_hpte_getword0(unsigned long slot)
 
         lpar_rc = plpar_pte_read(flags, slot, &dword0, &dummy_word1);
 
-        BUG_ON(lpar_rc != H_Success);
+        BUG_ON(lpar_rc != H_SUCCESS);
 
         return dword0;
 }
@@ -468,7 +469,7 @@ static void pSeries_lpar_hpte_updateboltedpp(unsigned long newpp,
         flags = newpp & 7;
         lpar_rc = plpar_pte_protect(flags, slot, 0);
 
-        BUG_ON(lpar_rc != H_Success);
+        BUG_ON(lpar_rc != H_SUCCESS);
 }
 
 static void pSeries_lpar_hpte_invalidate(unsigned long slot, unsigned long va,
@@ -484,10 +485,10 @@ static void pSeries_lpar_hpte_invalidate(unsigned long slot, unsigned long va,
         want_v = hpte_encode_v(va, psize);
         lpar_rc = plpar_pte_remove(H_AVPN, slot, want_v & HPTE_V_AVPN,
                                    &dummy1, &dummy2);
-        if (lpar_rc == H_Not_Found)
+        if (lpar_rc == H_NOT_FOUND)
                 return;
 
-        BUG_ON(lpar_rc != H_Success);
+        BUG_ON(lpar_rc != H_SUCCESS);
 }
 
 /*
diff --git a/arch/powerpc/platforms/pseries/setup.c b/arch/powerpc/platforms/pseries/setup.c
index b2fbf8ba8fbb..5eb55ef1c91c 100644
--- a/arch/powerpc/platforms/pseries/setup.c
+++ b/arch/powerpc/platforms/pseries/setup.c
@@ -463,7 +463,7 @@ static void pseries_dedicated_idle_sleep(void)
          * very low priority.  The cede enables interrupts, which
          * doesn't matter here.
          */
-        if (!lppaca[cpu ^ 1].idle || poll_pending() == H_Pending)
+        if (!lppaca[cpu ^ 1].idle || poll_pending() == H_PENDING)
                 cede_processor();
 
 out:
diff --git a/arch/powerpc/platforms/pseries/vio.c b/arch/powerpc/platforms/pseries/vio.c
index 866379b80c09..8e53e04ada8b 100644
--- a/arch/powerpc/platforms/pseries/vio.c
+++ b/arch/powerpc/platforms/pseries/vio.c
@@ -258,7 +258,7 @@ EXPORT_SYMBOL(vio_find_node);
 int vio_enable_interrupts(struct vio_dev *dev)
 {
         int rc = h_vio_signal(dev->unit_address, VIO_IRQ_ENABLE);
-        if (rc != H_Success)
+        if (rc != H_SUCCESS)
                 printk(KERN_ERR "vio: Error 0x%x enabling interrupts\n", rc);
         return rc;
 }
@@ -267,7 +267,7 @@ EXPORT_SYMBOL(vio_enable_interrupts);
 int vio_disable_interrupts(struct vio_dev *dev)
 {
         int rc = h_vio_signal(dev->unit_address, VIO_IRQ_DISABLE);
-        if (rc != H_Success)
+        if (rc != H_SUCCESS)
                 printk(KERN_ERR "vio: Error 0x%x disabling interrupts\n", rc);
         return rc;
 }
diff --git a/arch/powerpc/platforms/pseries/xics.c b/arch/powerpc/platforms/pseries/xics.c
index 4864cb32be25..2d60ea30fed6 100644
--- a/arch/powerpc/platforms/pseries/xics.c
+++ b/arch/powerpc/platforms/pseries/xics.c
@@ -168,7 +168,7 @@ static int pSeriesLP_xirr_info_get(int n_cpu)
         unsigned long return_value;
 
         lpar_rc = plpar_xirr(&return_value);
-        if (lpar_rc != H_Success)
+        if (lpar_rc != H_SUCCESS)
                 panic(" bad return code xirr - rc = %lx \n", lpar_rc);
         return (int)return_value;
 }
@@ -179,7 +179,7 @@ static void pSeriesLP_xirr_info_set(int n_cpu, int value)
         unsigned long val64 = value & 0xffffffff;
 
         lpar_rc = plpar_eoi(val64);
-        if (lpar_rc != H_Success)
+        if (lpar_rc != H_SUCCESS)
                 panic("bad return code EOI - rc = %ld, value=%lx\n", lpar_rc,
                       val64);
 }
@@ -189,7 +189,7 @@ void pSeriesLP_cppr_info(int n_cpu, u8 value)
         unsigned long lpar_rc;
 
         lpar_rc = plpar_cppr(value);
-        if (lpar_rc != H_Success)
+        if (lpar_rc != H_SUCCESS)
                 panic("bad return code cppr - rc = %lx\n", lpar_rc);
 }
 
@@ -198,7 +198,7 @@ static void pSeriesLP_qirr_info(int n_cpu , u8 value)
         unsigned long lpar_rc;
 
         lpar_rc = plpar_ipi(get_hard_smp_processor_id(n_cpu), value);
-        if (lpar_rc != H_Success)
+        if (lpar_rc != H_SUCCESS)
                 panic("bad return code qirr - rc = %lx\n", lpar_rc);
 }
 
diff --git a/arch/ppc/boot/lib/Makefile b/arch/ppc/boot/lib/Makefile
index d4077e69086f..80c84d562fa4 100644
--- a/arch/ppc/boot/lib/Makefile
+++ b/arch/ppc/boot/lib/Makefile
@@ -3,7 +3,7 @@
 #
 
 CFLAGS_kbd.o    := -Idrivers/char
-CFLAGS_vreset.o := -I$(srctree)/arch/ppc/boot/include
+CFLAGS_vreset.o := -Iarch/ppc/boot/include
 
 zlib  := infblock.c infcodes.c inffast.c inflate.c inftrees.c infutil.c
          
diff --git a/arch/s390/Makefile b/arch/s390/Makefile
index 6c6b197898d0..7bb16fb97d4f 100644
--- a/arch/s390/Makefile
+++ b/arch/s390/Makefile
@@ -67,7 +67,6 @@ cflags-$(CONFIG_WARN_STACK) += -mwarn-framesize=$(CONFIG_WARN_STACK_SIZE)
 endif
 
 CFLAGS          += -mbackchain -msoft-float $(cflags-y)
-CFLAGS          += $(call cc-option,-finline-limit=10000)
 CFLAGS          += -pipe -fno-strength-reduce -Wno-sign-compare 
 AFLAGS          += $(aflags-y)
 
diff --git a/arch/s390/defconfig b/arch/s390/defconfig
index f8d0cd540a06..f4dfc10026d2 100644
--- a/arch/s390/defconfig
+++ b/arch/s390/defconfig
@@ -1,10 +1,11 @@
 #
 # Automatically generated make config: don't edit
-# Linux kernel version: 2.6.16-rc2
-# Wed Feb  8 10:44:39 2006
+# Linux kernel version: 2.6.17-rc1
+# Mon Apr  3 14:34:15 2006
 #
 CONFIG_MMU=y
 CONFIG_RWSEM_XCHGADD_ALGORITHM=y
+CONFIG_GENERIC_HWEIGHT=y
 CONFIG_GENERIC_CALIBRATE_DELAY=y
 CONFIG_S390=y
 
@@ -30,8 +31,8 @@ CONFIG_AUDIT=y
 CONFIG_IKCONFIG=y
 CONFIG_IKCONFIG_PROC=y
 # CONFIG_CPUSETS is not set
+# CONFIG_RELAY is not set
 CONFIG_INITRAMFS_SOURCE=""
-CONFIG_UID16=y
 # CONFIG_CC_OPTIMIZE_FOR_SIZE is not set
 # CONFIG_EMBEDDED is not set
 CONFIG_KALLSYMS=y
@@ -45,10 +46,6 @@ CONFIG_BASE_FULL=y
 CONFIG_FUTEX=y
 CONFIG_EPOLL=y
 CONFIG_SHMEM=y
-CONFIG_CC_ALIGN_FUNCTIONS=0
-CONFIG_CC_ALIGN_LABELS=0
-CONFIG_CC_ALIGN_LOOPS=0
-CONFIG_CC_ALIGN_JUMPS=0
 CONFIG_SLAB=y
 # CONFIG_TINY_SHMEM is not set
 CONFIG_BASE_SMALL=0
@@ -60,7 +57,6 @@ CONFIG_BASE_SMALL=0
 CONFIG_MODULES=y
 CONFIG_MODULE_UNLOAD=y
 # CONFIG_MODULE_FORCE_UNLOAD is not set
-CONFIG_OBSOLETE_MODPARM=y
 CONFIG_MODVERSIONS=y
 # CONFIG_MODULE_SRCVERSION_ALL is not set
 CONFIG_KMOD=y
@@ -69,7 +65,7 @@ CONFIG_STOP_MACHINE=y
 #
 # Block layer
 #
-# CONFIG_LBD is not set
+# CONFIG_BLK_DEV_IO_TRACE is not set
 
 #
 # IO Schedulers
@@ -91,17 +87,20 @@ CONFIG_DEFAULT_IOSCHED="deadline"
 #
 # Processor type and features
 #
-# CONFIG_64BIT is not set
+CONFIG_64BIT=y
 CONFIG_SMP=y
 CONFIG_NR_CPUS=32
 CONFIG_HOTPLUG_CPU=y
-CONFIG_MATHEMU=y
+CONFIG_DEFAULT_MIGRATION_COST=1000000
+CONFIG_COMPAT=y
+CONFIG_SYSVIPC_COMPAT=y
+CONFIG_BINFMT_ELF32=y
 
 #
 # Code generation options
 #
-CONFIG_MARCH_G5=y
-# CONFIG_MARCH_Z900 is not set
+# CONFIG_MARCH_G5 is not set
+CONFIG_MARCH_Z900=y
 # CONFIG_MARCH_Z990 is not set
 CONFIG_PACK_STACK=y
 # CONFIG_SMALL_STACK is not set
@@ -143,7 +142,7 @@ CONFIG_VIRT_CPU_ACCOUNTING=y
 # CONFIG_APPLDATA_BASE is not set
 CONFIG_NO_IDLE_HZ=y
 CONFIG_NO_IDLE_HZ_INIT=y
-# CONFIG_KEXEC is not set
+CONFIG_KEXEC=y
 
 #
 # Networking
@@ -173,6 +172,7 @@ CONFIG_IP_FIB_HASH=y
 # CONFIG_INET_AH is not set
 # CONFIG_INET_ESP is not set
 # CONFIG_INET_IPCOMP is not set
+# CONFIG_INET_XFRM_TUNNEL is not set
 # CONFIG_INET_TUNNEL is not set
 CONFIG_INET_DIAG=y
 CONFIG_INET_TCP_DIAG=y
@@ -180,9 +180,11 @@ CONFIG_INET_TCP_DIAG=y
 CONFIG_TCP_CONG_BIC=y
 CONFIG_IPV6=y
 # CONFIG_IPV6_PRIVACY is not set
+# CONFIG_IPV6_ROUTER_PREF is not set
 # CONFIG_INET6_AH is not set
 # CONFIG_INET6_ESP is not set
 # CONFIG_INET6_IPCOMP is not set
+# CONFIG_INET6_XFRM_TUNNEL is not set
 # CONFIG_INET6_TUNNEL is not set
 # CONFIG_IPV6_TUNNEL is not set
 # CONFIG_NETFILTER is not set
@@ -276,6 +278,11 @@ CONFIG_PREVENT_FIRMWARE_BUILD=y
 # CONFIG_DEBUG_DRIVER is not set
 
 #
+# Connector - unified userspace <-> kernelspace linker
+#
+# CONFIG_CONNECTOR is not set
+
+#
 # SCSI device support
 #
 # CONFIG_RAID_ATTRS is not set
@@ -340,8 +347,7 @@ CONFIG_DASD_PROFILE=y
 CONFIG_DASD_ECKD=y
 CONFIG_DASD_FBA=y
 CONFIG_DASD_DIAG=y
-CONFIG_DASD_EER=m
-# CONFIG_DASD_CMB is not set
+CONFIG_DASD_EER=y
 # CONFIG_ATA_OVER_ETH is not set
 
 #
@@ -354,6 +360,7 @@ CONFIG_MD_RAID0=m
 CONFIG_MD_RAID1=m
 # CONFIG_MD_RAID10 is not set
 CONFIG_MD_RAID5=m
+# CONFIG_MD_RAID5_RESHAPE is not set
 # CONFIG_MD_RAID6 is not set
 CONFIG_MD_MULTIPATH=m
 # CONFIG_MD_FAULTY is not set
@@ -404,6 +411,7 @@ CONFIG_S390_TAPE_BLOCK=y
 # S/390 tape hardware support
 #
 CONFIG_S390_TAPE_34XX=m
+# CONFIG_S390_TAPE_3590 is not set
 # CONFIG_VMLOGRDR is not set
 # CONFIG_VMCP is not set
 # CONFIG_MONREADER is not set
@@ -529,7 +537,6 @@ CONFIG_SYSFS=y
 CONFIG_TMPFS=y
 # CONFIG_HUGETLB_PAGE is not set
 CONFIG_RAMFS=y
-# CONFIG_RELAYFS_FS is not set
 # CONFIG_CONFIGFS_FS is not set
 
 #
@@ -619,14 +626,15 @@ CONFIG_LOG_BUF_SHIFT=17
 # CONFIG_DETECT_SOFTLOCKUP is not set
 # CONFIG_SCHEDSTATS is not set
 # CONFIG_DEBUG_SLAB is not set
-# CONFIG_DEBUG_PREEMPT is not set
+CONFIG_DEBUG_PREEMPT=y
 CONFIG_DEBUG_MUTEXES=y
-# CONFIG_DEBUG_SPINLOCK is not set
-# CONFIG_DEBUG_SPINLOCK_SLEEP is not set
+CONFIG_DEBUG_SPINLOCK=y
+CONFIG_DEBUG_SPINLOCK_SLEEP=y
 # CONFIG_DEBUG_KOBJECT is not set
 # CONFIG_DEBUG_INFO is not set
 CONFIG_DEBUG_FS=y
 # CONFIG_DEBUG_VM is not set
+# CONFIG_UNWIND_INFO is not set
 CONFIG_FORCED_INLINING=y
 # CONFIG_RCU_TORTURE_TEST is not set
 
diff --git a/arch/sh/Kconfig b/arch/sh/Kconfig
index 58583f459471..2bcecf422573 100644
--- a/arch/sh/Kconfig
+++ b/arch/sh/Kconfig
@@ -527,6 +527,11 @@ config CPU_HAS_SR_RB
           See <file:Documentation/sh/register-banks.txt> for further
           information on SR.RB and register banking in the kernel in general.
 
+config NODES_SHIFT
+        int
+        default "1"
+        depends on NEED_MULTIPLE_NODES
+
 endmenu
 
 menu "Boot options"
diff --git a/arch/sh/kernel/sh_ksyms.c b/arch/sh/kernel/sh_ksyms.c
index 1cf94a618be3..d5d032533a8b 100644
--- a/arch/sh/kernel/sh_ksyms.c
+++ b/arch/sh/kernel/sh_ksyms.c
@@ -37,7 +37,6 @@ EXPORT_SYMBOL(disable_irq_nosync);
 EXPORT_SYMBOL(irq_desc);
 EXPORT_SYMBOL(no_irq_type);
 
-EXPORT_SYMBOL(strpbrk);
 EXPORT_SYMBOL(strstr);
 EXPORT_SYMBOL(strlen);
 EXPORT_SYMBOL(strnlen);
diff --git a/arch/sh64/kernel/sh_ksyms.c b/arch/sh64/kernel/sh_ksyms.c
index de29c45f23a7..6f3a1c946339 100644
--- a/arch/sh64/kernel/sh_ksyms.c
+++ b/arch/sh64/kernel/sh_ksyms.c
@@ -41,7 +41,6 @@ EXPORT_SYMBOL(kernel_thread);
 /* Networking helper routines. */
 EXPORT_SYMBOL(csum_partial_copy);
 
-EXPORT_SYMBOL(strpbrk);
 EXPORT_SYMBOL(strstr);
 
 #ifdef CONFIG_VT
diff --git a/arch/sparc/kernel/smp.c b/arch/sparc/kernel/smp.c
index 2be812115197..a93f5da6855d 100644
--- a/arch/sparc/kernel/smp.c
+++ b/arch/sparc/kernel/smp.c
@@ -244,7 +244,7 @@ int setup_profiling_timer(unsigned int multiplier)
                 return -EINVAL;
 
         spin_lock_irqsave(&prof_setup_lock, flags);
-        for_each_cpu(i) {
+        for_each_possible_cpu(i) {
                 load_profile_irq(i, lvl14_resolution / multiplier);
                 prof_multiplier(i) = multiplier;
         }
diff --git a/arch/sparc/kernel/sparc_ksyms.c b/arch/sparc/kernel/sparc_ksyms.c
index 2c21d7907635..ec1c9687d679 100644
--- a/arch/sparc/kernel/sparc_ksyms.c
+++ b/arch/sparc/kernel/sparc_ksyms.c
@@ -263,7 +263,6 @@ EXPORT_SYMBOL(strcmp);
 EXPORT_SYMBOL(strncmp);
 EXPORT_SYMBOL(strchr);
 EXPORT_SYMBOL(strrchr);
-EXPORT_SYMBOL(strpbrk);
 EXPORT_SYMBOL(strstr);
 EXPORT_SYMBOL(page_kernel);
 
diff --git a/arch/sparc/kernel/systbls.S b/arch/sparc/kernel/systbls.S
index 768de64b371f..fbbec5e761c6 100644
--- a/arch/sparc/kernel/systbls.S
+++ b/arch/sparc/kernel/systbls.S
@@ -64,13 +64,13 @@ sys_call_table:
 /*215*/ .long sys_ipc, sys_sigreturn, sys_clone, sys_ioprio_get, sys_adjtimex
 /*220*/ .long sys_sigprocmask, sys_ni_syscall, sys_delete_module, sys_ni_syscall, sys_getpgid
 /*225*/ .long sys_bdflush, sys_sysfs, sys_nis_syscall, sys_setfsuid16, sys_setfsgid16
-/*230*/ .long sys_select, sys_time, sys_nis_syscall, sys_stime, sys_statfs64
+/*230*/ .long sys_select, sys_time, sys_splice, sys_stime, sys_statfs64
                                           /* "We are the Knights of the Forest of Ni!!" */
 /*235*/ .long sys_fstatfs64, sys_llseek, sys_mlock, sys_munlock, sys_mlockall
 /*240*/ .long sys_munlockall, sys_sched_setparam, sys_sched_getparam, sys_sched_setscheduler, sys_sched_getscheduler
 /*245*/ .long sys_sched_yield, sys_sched_get_priority_max, sys_sched_get_priority_min, sys_sched_rr_get_interval, sys_nanosleep
 /*250*/ .long sparc_mremap, sys_sysctl, sys_getsid, sys_fdatasync, sys_nfsservctl
-/*255*/ .long sys_nis_syscall, sys_clock_settime, sys_clock_gettime, sys_clock_getres, sys_clock_nanosleep
+/*255*/ .long sys_sync_file_range, sys_clock_settime, sys_clock_gettime, sys_clock_getres, sys_clock_nanosleep
 /*260*/ .long sys_sched_getaffinity, sys_sched_setaffinity, sys_timer_settime, sys_timer_gettime, sys_timer_getoverrun
 /*265*/ .long sys_timer_delete, sys_timer_create, sys_nis_syscall, sys_io_setup, sys_io_destroy
 /*270*/ .long sys_io_submit, sys_io_cancel, sys_io_getevents, sys_mq_open, sys_mq_unlink
diff --git a/arch/sparc/math-emu/Makefile b/arch/sparc/math-emu/Makefile
index f84a9a6162be..8136987977f4 100644
--- a/arch/sparc/math-emu/Makefile
+++ b/arch/sparc/math-emu/Makefile
@@ -5,4 +5,4 @@
 obj-y    := math.o
 
 EXTRA_AFLAGS := -ansi
-EXTRA_CFLAGS = -I. -I$(TOPDIR)/include/math-emu -w
+EXTRA_CFLAGS = -I. -Iinclude/math-emu -w
diff --git a/arch/sparc64/Kconfig b/arch/sparc64/Kconfig
index d1e2fc566486..648047a0bce3 100644
--- a/arch/sparc64/Kconfig
+++ b/arch/sparc64/Kconfig
@@ -194,6 +194,9 @@ endchoice
 
 endmenu
 
+config ARCH_SELECT_MEMORY_MODEL
+        def_bool y
+
 config ARCH_SPARSEMEM_ENABLE
         def_bool y
 
diff --git a/arch/sparc64/defconfig b/arch/sparc64/defconfig
index 900fb0b940d8..1317380fa937 100644
--- a/arch/sparc64/defconfig
+++ b/arch/sparc64/defconfig
@@ -1,7 +1,7 @@
 #
 # Automatically generated make config: don't edit
 # Linux kernel version: 2.6.16
-# Sun Mar 26 14:58:11 2006
+# Sun Apr  2 19:31:04 2006
 #
 CONFIG_SPARC=y
 CONFIG_SPARC64=y
@@ -180,6 +180,7 @@ CONFIG_SYN_COOKIES=y
 CONFIG_INET_AH=y
 CONFIG_INET_ESP=y
 CONFIG_INET_IPCOMP=y
+CONFIG_INET_XFRM_TUNNEL=y
 CONFIG_INET_TUNNEL=y
 CONFIG_INET_DIAG=y
 CONFIG_INET_TCP_DIAG=y
@@ -203,6 +204,7 @@ CONFIG_IPV6_ROUTE_INFO=y
 CONFIG_INET6_AH=m
 CONFIG_INET6_ESP=m
 CONFIG_INET6_IPCOMP=m
+CONFIG_INET6_XFRM_TUNNEL=m
 CONFIG_INET6_TUNNEL=m
 CONFIG_IPV6_TUNNEL=m
 # CONFIG_NETFILTER is not set
@@ -308,7 +310,6 @@ CONFIG_BLK_DEV_NBD=m
 # CONFIG_BLK_DEV_SX8 is not set
 CONFIG_BLK_DEV_UB=m
 # CONFIG_BLK_DEV_RAM is not set
-CONFIG_BLK_DEV_RAM_COUNT=16
 # CONFIG_BLK_DEV_INITRD is not set
 CONFIG_CDROM_PKTCDVD=m
 CONFIG_CDROM_PKTCDVD_BUFFERS=8
@@ -449,6 +450,7 @@ CONFIG_MD_RAID0=m
 CONFIG_MD_RAID1=m
 CONFIG_MD_RAID10=m
 CONFIG_MD_RAID5=m
+# CONFIG_MD_RAID5_RESHAPE is not set
 CONFIG_MD_RAID6=m
 CONFIG_MD_MULTIPATH=m
 # CONFIG_MD_FAULTY is not set
@@ -741,9 +743,7 @@ CONFIG_I2C_ALGOBIT=y
 # CONFIG_SENSORS_PCF8574 is not set
 # CONFIG_SENSORS_PCA9539 is not set
 # CONFIG_SENSORS_PCF8591 is not set
-# CONFIG_SENSORS_RTC8564 is not set
 # CONFIG_SENSORS_MAX6875 is not set
-# CONFIG_RTC_X1205_I2C is not set
 # CONFIG_I2C_DEBUG_CORE is not set
 # CONFIG_I2C_DEBUG_ALGO is not set
 # CONFIG_I2C_DEBUG_BUS is not set
@@ -826,6 +826,7 @@ CONFIG_FB_CFB_FILLRECT=y
 CONFIG_FB_CFB_COPYAREA=y
 CONFIG_FB_CFB_IMAGEBLIT=y
 # CONFIG_FB_MACMODES is not set
+# CONFIG_FB_FIRMWARE_EDID is not set
 CONFIG_FB_MODE_HELPERS=y
 CONFIG_FB_TILEBLITTING=y
 # CONFIG_FB_CIRRUS is not set
@@ -837,7 +838,6 @@ CONFIG_FB_TILEBLITTING=y
 # CONFIG_FB_NVIDIA is not set
 # CONFIG_FB_RIVA is not set
 # CONFIG_FB_MATROX is not set
-# CONFIG_FB_RADEON_OLD is not set
 CONFIG_FB_RADEON=y
 CONFIG_FB_RADEON_I2C=y
 # CONFIG_FB_RADEON_DEBUG is not set
@@ -923,6 +923,7 @@ CONFIG_SND_MTPAV=m
 # PCI devices
 #
 # CONFIG_SND_AD1889 is not set
+# CONFIG_SND_ALS300 is not set
 CONFIG_SND_ALI5451=m
 # CONFIG_SND_ATIIXP is not set
 # CONFIG_SND_ATIIXP_MODEM is not set
@@ -954,6 +955,7 @@ CONFIG_SND_ALI5451=m
 # CONFIG_SND_MIXART is not set
 # CONFIG_SND_NM256 is not set
 # CONFIG_SND_PCXHR is not set
+# CONFIG_SND_RIPTIDE is not set
 # CONFIG_SND_RME32 is not set
 # CONFIG_SND_RME96 is not set
 # CONFIG_SND_RME9652 is not set
@@ -1108,6 +1110,11 @@ CONFIG_USB_HIDDEV=y
 # CONFIG_MMC is not set
 
 #
+# LED devices
+#
+# CONFIG_NEW_LEDS is not set
+
+#
 # InfiniBand support
 #
 # CONFIG_INFINIBAND is not set
@@ -1117,6 +1124,11 @@ CONFIG_USB_HIDDEV=y
 #
 
 #
+# Real Time Clock
+#
+# CONFIG_RTC_CLASS is not set
+
+#
 # Misc Linux/SPARC drivers
 #
 CONFIG_SUN_OPENPROMIO=m
diff --git a/arch/sparc64/kernel/pci_sun4v.c b/arch/sparc64/kernel/pci_sun4v.c
index 9372d4f376d5..9e94db2573a2 100644
--- a/arch/sparc64/kernel/pci_sun4v.c
+++ b/arch/sparc64/kernel/pci_sun4v.c
@@ -1092,7 +1092,7 @@ void sun4v_pci_init(int node, char *model_name)
                 }
         }
 
-        for_each_cpu(i) {
+        for_each_possible_cpu(i) {
                 unsigned long page = get_zeroed_page(GFP_ATOMIC);
 
                 if (!page)
diff --git a/arch/sparc64/kernel/ptrace.c b/arch/sparc64/kernel/ptrace.c
index eb93e9c52846..49e6dedd027d 100644
--- a/arch/sparc64/kernel/ptrace.c
+++ b/arch/sparc64/kernel/ptrace.c
@@ -244,6 +244,13 @@ asmlinkage void do_ptrace(struct pt_regs *regs)
         }
 
         switch(request) {
+        case PTRACE_PEEKUSR:
+                if (addr != 0)
+                        pt_error_return(regs, EIO);
+                else
+                        pt_succ_return(regs, 0);
+                goto out_tsk;
+
         case PTRACE_PEEKTEXT: /* read word at location addr. */ 
         case PTRACE_PEEKDATA: {
                 unsigned long tmp64;
@@ -602,6 +609,22 @@ asmlinkage void do_ptrace(struct pt_regs *regs)
 
         /* PTRACE_DUMPCORE unsupported... */
 
+        case PTRACE_GETEVENTMSG: {
+                int err;
+
+                if (test_thread_flag(TIF_32BIT))
+                        err = put_user(child->ptrace_message,
+                                       (unsigned int __user *) data);
+                else
+                        err = put_user(child->ptrace_message,
+                                       (unsigned long __user *) data);
+                if (err)
+                        pt_error_return(regs, -err);
+                else
+                        pt_succ_return(regs, 0);
+                break;
+        }
+
         default: {
                 int err = ptrace_request(child, request, addr, data);
                 if (err)
diff --git a/arch/sparc64/kernel/setup.c b/arch/sparc64/kernel/setup.c
index 7d0e67c1ce50..005167f82419 100644
--- a/arch/sparc64/kernel/setup.c
+++ b/arch/sparc64/kernel/setup.c
@@ -535,7 +535,7 @@ static int __init topology_init(void)
         while (!cpu_find_by_instance(ncpus_probed, NULL, NULL))
                 ncpus_probed++;
 
-        for_each_cpu(i) {
+        for_each_possible_cpu(i) {
                 struct cpu *p = kzalloc(sizeof(*p), GFP_KERNEL);
                 if (p) {
                         register_cpu(p, i, NULL);
diff --git a/arch/sparc64/kernel/smp.c b/arch/sparc64/kernel/smp.c
index 7dc28a484268..90eaca3ec9a6 100644
--- a/arch/sparc64/kernel/smp.c
+++ b/arch/sparc64/kernel/smp.c
@@ -745,12 +745,21 @@ struct call_data_struct {
         int wait;
 };
 
-static DEFINE_SPINLOCK(call_lock);
+static __cacheline_aligned_in_smp DEFINE_SPINLOCK(call_lock);
 static struct call_data_struct *call_data;
 
 extern unsigned long xcall_call_function;
 
-/*
+/**
+ * smp_call_function(): Run a function on all other CPUs.
+ * @func: The function to run. This must be fast and non-blocking.
+ * @info: An arbitrary pointer to pass to the function.
+ * @nonatomic: currently unused.
+ * @wait: If true, wait (atomically) until function has completed on other CPUs.
+ *
+ * Returns 0 on success, else a negative status code. Does not return until
+ * remote CPUs are nearly ready to execute <<func>> or are or have executed.
+ *
  * You must not call this function with disabled interrupts or from a
  * hardware interrupt handler or from a bottom half handler.
  */
@@ -759,7 +768,6 @@ static int smp_call_function_mask(void (*func)(void *info), void *info,
 {
         struct call_data_struct data;
         int cpus;
-        long timeout;
 
         /* Can deadlock when called with interrupts disabled */
         WARN_ON(irqs_disabled());
@@ -777,31 +785,18 @@ static int smp_call_function_mask(void (*func)(void *info), void *info,
                 goto out_unlock;
 
         call_data = &data;
+        mb();
 
         smp_cross_call_masked(&xcall_call_function, 0, 0, 0, mask);
 
-        /* 
-         * Wait for other cpus to complete function or at
-         * least snap the call data.
-         */
-        timeout = 1000000;
-        while (atomic_read(&data.finished) != cpus) {
-                if (--timeout <= 0)
-                        goto out_timeout;
-                barrier();
-                udelay(1);
-        }
+        /* Wait for response */
+        while (atomic_read(&data.finished) != cpus)
+                cpu_relax();
 
 out_unlock:
         spin_unlock(&call_lock);
 
         return 0;
-
-out_timeout:
-        spin_unlock(&call_lock);
-        printk("XCALL: Remote cpus not responding, ncpus=%d finished=%d\n",
-               cpus, atomic_read(&data.finished));
-        return 0;
 }
 
 int smp_call_function(void (*func)(void *info), void *info,
@@ -830,9 +825,16 @@ void smp_call_function_client(int irq, struct pt_regs *regs)
 
 static void tsb_sync(void *info)
 {
+        struct trap_per_cpu *tp = &trap_block[raw_smp_processor_id()];
         struct mm_struct *mm = info;
 
-        if (current->active_mm == mm)
+        /* It is not valid to test "currrent->active_mm == mm" here.
+         *
+         * The value of "current" is not changed atomically with
+         * switch_mm().  But that's OK, we just need to check the
+         * current cpu's trap block PGD physical address.
+         */
+        if (tp->pgd_paddr == __pa(mm->pgd))
                 tsb_context_switch(mm);
 }
 
@@ -1278,7 +1280,7 @@ int setup_profiling_timer(unsigned int multiplier)
                 return -EINVAL;
 
         spin_lock_irqsave(&prof_setup_lock, flags);
-        for_each_cpu(i)
+        for_each_possible_cpu(i)
                 prof_multiplier(i) = multiplier;
         current_tick_offset = (timer_tick_offset / multiplier);
         spin_unlock_irqrestore(&prof_setup_lock, flags);
@@ -1306,12 +1308,12 @@ void __init smp_prepare_cpus(unsigned int max_cpus)
                 }
         }
 
-        for_each_cpu(i) {
+        for_each_possible_cpu(i) {
                 if (tlb_type == hypervisor) {
                         int j;
 
                         /* XXX get this mapping from machine description */
-                        for_each_cpu(j) {
+                        for_each_possible_cpu(j) {
                                 if ((j >> 2) == (i >> 2))
                                         cpu_set(j, cpu_sibling_map[i]);
                         }
diff --git a/arch/sparc64/kernel/sparc64_ksyms.c b/arch/sparc64/kernel/sparc64_ksyms.c
index f5e8db1de76b..62d8a99271ea 100644
--- a/arch/sparc64/kernel/sparc64_ksyms.c
+++ b/arch/sparc64/kernel/sparc64_ksyms.c
@@ -276,7 +276,6 @@ EXPORT_SYMBOL(__prom_getsibling);
 EXPORT_SYMBOL(strlen);
 EXPORT_SYMBOL(__strlen_user);
 EXPORT_SYMBOL(__strnlen_user);
-EXPORT_SYMBOL(strpbrk);
 
 #ifdef CONFIG_SOLARIS_EMUL_MODULE
 EXPORT_SYMBOL(linux_sparc_syscall);
diff --git a/arch/sparc64/kernel/sys32.S b/arch/sparc64/kernel/sys32.S
index c4a1cef4b1e5..86dd5cb81e09 100644
--- a/arch/sparc64/kernel/sys32.S
+++ b/arch/sparc64/kernel/sys32.S
@@ -136,6 +136,8 @@ SIGN1(sys32_getpeername, sys_getpeername, %o0)
 SIGN1(sys32_getsockname, sys_getsockname, %o0)
 SIGN2(sys32_ioprio_get, sys_ioprio_get, %o0, %o1)
 SIGN3(sys32_ioprio_set, sys_ioprio_set, %o0, %o1, %o2)
+SIGN2(sys32_splice, sys_splice, %o0, %o1)
+SIGN2(sys32_sync_file_range, compat_sync_file_range, %o0, %o5)
 
         .globl          sys32_mmap2
 sys32_mmap2:
diff --git a/arch/sparc64/kernel/sys_sparc32.c b/arch/sparc64/kernel/sys_sparc32.c
index 2e906bad56fa..31030bf00f1a 100644
--- a/arch/sparc64/kernel/sys_sparc32.c
+++ b/arch/sparc64/kernel/sys_sparc32.c
@@ -1069,3 +1069,11 @@ long sys32_lookup_dcookie(unsigned long cookie_high,
         return sys_lookup_dcookie((cookie_high << 32) | cookie_low,
                                   buf, len);
 }
+
+long compat_sync_file_range(int fd, unsigned long off_high, unsigned long off_low, unsigned long nb_high, unsigned long nb_low, int flags)
+{
+        return sys_sync_file_range(fd,
+                                   (off_high << 32) | off_low,
+                                   (nb_high << 32) | nb_low,
+                                   flags);
+}
diff --git a/arch/sparc64/kernel/systbls.S b/arch/sparc64/kernel/systbls.S
index 3b250f2318fd..857b82c82875 100644
--- a/arch/sparc64/kernel/systbls.S
+++ b/arch/sparc64/kernel/systbls.S
@@ -66,12 +66,12 @@ sys_call_table32:
         .word sys32_ipc, sys32_sigreturn, sys_clone, sys32_ioprio_get, compat_sys_adjtimex
 /*220*/ .word sys32_sigprocmask, sys_ni_syscall, sys32_delete_module, sys_ni_syscall, sys32_getpgid
         .word sys32_bdflush, sys32_sysfs, sys_nis_syscall, sys32_setfsuid16, sys32_setfsgid16
-/*230*/ .word sys32_select, compat_sys_time, sys_nis_syscall, compat_sys_stime, compat_sys_statfs64
+/*230*/ .word sys32_select, compat_sys_time, sys32_splice, compat_sys_stime, compat_sys_statfs64
         .word compat_sys_fstatfs64, sys_llseek, sys_mlock, sys_munlock, sys32_mlockall
 /*240*/ .word sys_munlockall, sys32_sched_setparam, sys32_sched_getparam, sys32_sched_setscheduler, sys32_sched_getscheduler
         .word sys_sched_yield, sys32_sched_get_priority_max, sys32_sched_get_priority_min, sys32_sched_rr_get_interval, compat_sys_nanosleep
 /*250*/ .word sys32_mremap, sys32_sysctl, sys32_getsid, sys_fdatasync, sys32_nfsservctl
-        .word sys_ni_syscall, compat_sys_clock_settime, compat_sys_clock_gettime, compat_sys_clock_getres, sys32_clock_nanosleep
+        .word sys32_sync_file_range, compat_sys_clock_settime, compat_sys_clock_gettime, compat_sys_clock_getres, sys32_clock_nanosleep
 /*260*/ .word compat_sys_sched_getaffinity, compat_sys_sched_setaffinity, sys32_timer_settime, compat_sys_timer_gettime, sys_timer_getoverrun
         .word sys_timer_delete, compat_sys_timer_create, sys_ni_syscall, compat_sys_io_setup, sys_io_destroy
 /*270*/ .word sys32_io_submit, sys_io_cancel, compat_sys_io_getevents, sys32_mq_open, sys_mq_unlink
@@ -135,12 +135,12 @@ sys_call_table:
         .word sys_ipc, sys_nis_syscall, sys_clone, sys_ioprio_get, sys_adjtimex
 /*220*/ .word sys_nis_syscall, sys_ni_syscall, sys_delete_module, sys_ni_syscall, sys_getpgid
         .word sys_bdflush, sys_sysfs, sys_nis_syscall, sys_setfsuid, sys_setfsgid
-/*230*/ .word sys_select, sys_nis_syscall, sys_nis_syscall, sys_stime, sys_statfs64
+/*230*/ .word sys_select, sys_nis_syscall, sys_splice, sys_stime, sys_statfs64
         .word sys_fstatfs64, sys_llseek, sys_mlock, sys_munlock, sys_mlockall
 /*240*/ .word sys_munlockall, sys_sched_setparam, sys_sched_getparam, sys_sched_setscheduler, sys_sched_getscheduler
         .word sys_sched_yield, sys_sched_get_priority_max, sys_sched_get_priority_min, sys_sched_rr_get_interval, sys_nanosleep
 /*250*/ .word sys64_mremap, sys_sysctl, sys_getsid, sys_fdatasync, sys_nfsservctl
-        .word sys_ni_syscall, sys_clock_settime, sys_clock_gettime, sys_clock_getres, sys_clock_nanosleep
+        .word sys_sync_file_range, sys_clock_settime, sys_clock_gettime, sys_clock_getres, sys_clock_nanosleep
 /*260*/ .word sys_sched_getaffinity, sys_sched_setaffinity, sys_timer_settime, sys_timer_gettime, sys_timer_getoverrun
         .word sys_timer_delete, sys_timer_create, sys_ni_syscall, sys_io_setup, sys_io_destroy
 /*270*/ .word sys_io_submit, sys_io_cancel, sys_io_getevents, sys_mq_open, sys_mq_unlink
diff --git a/arch/sparc64/kernel/traps.c b/arch/sparc64/kernel/traps.c
index ff090bb9734b..2793a5d82380 100644
--- a/arch/sparc64/kernel/traps.c
+++ b/arch/sparc64/kernel/traps.c
@@ -1130,9 +1130,9 @@ static void cheetah_log_errors(struct pt_regs *regs, struct cheetah_err_info *in
                (recoverable ? KERN_WARNING : KERN_CRIT), smp_processor_id(),
                afsr, afar,
                (afsr & CHAFSR_TL1) ? 1 : 0);
-        printk("%s" "ERROR(%d): TPC[%016lx] TNPC[%016lx] TSTATE[%016lx]\n",
+        printk("%s" "ERROR(%d): TPC[%lx] TNPC[%lx] O7[%lx] TSTATE[%lx]\n",
                (recoverable ? KERN_WARNING : KERN_CRIT), smp_processor_id(),
-               regs->tpc, regs->tnpc, regs->tstate);
+               regs->tpc, regs->tnpc, regs->u_regs[UREG_I7], regs->tstate);
         printk("%s" "ERROR(%d): M_SYND(%lx),  E_SYND(%lx)%s%s\n",
                (recoverable ? KERN_WARNING : KERN_CRIT), smp_processor_id(),
                (afsr & CHAFSR_M_SYNDROME) >> CHAFSR_M_SYNDROME_SHIFT,
diff --git a/arch/sparc64/mm/fault.c b/arch/sparc64/mm/fault.c
index 0db2f7d9fab5..6e002aacb961 100644
--- a/arch/sparc64/mm/fault.c
+++ b/arch/sparc64/mm/fault.c
@@ -327,8 +327,12 @@ asmlinkage void __kprobes do_sparc64_fault(struct pt_regs *regs)
                 insn = get_fault_insn(regs, 0);
                 if (!insn)
                         goto continue_fault;
+                /* All loads, stores and atomics have bits 30 and 31 both set
+                 * in the instruction.  Bit 21 is set in all stores, but we
+                 * have to avoid prefetches which also have bit 21 set.
+                 */
                 if ((insn & 0xc0200000) == 0xc0200000 &&
-                    (insn & 0x1780000) != 0x1680000) {
+                    (insn & 0x01780000) != 0x01680000) {
                         /* Don't bother updating thread struct value,
                          * because update_mmu_cache only cares which tlb
                          * the access came from.
diff --git a/arch/sparc64/mm/hugetlbpage.c b/arch/sparc64/mm/hugetlbpage.c
index 074620d413d4..fbbbebbad8a4 100644
--- a/arch/sparc64/mm/hugetlbpage.c
+++ b/arch/sparc64/mm/hugetlbpage.c
@@ -198,6 +198,13 @@ pte_t *huge_pte_alloc(struct mm_struct *mm, unsigned long addr)
         pmd_t *pmd;
         pte_t *pte = NULL;
 
+        /* We must align the address, because our caller will run
+         * set_huge_pte_at() on whatever we return, which writes out
+         * all of the sub-ptes for the hugepage range.  So we have
+         * to give it the first such sub-pte.
+         */
+        addr &= HPAGE_MASK;
+
         pgd = pgd_offset(mm, addr);
         pud = pud_alloc(mm, pgd, addr);
         if (pud) {
diff --git a/arch/um/Makefile b/arch/um/Makefile
index 24790bed2054..a508e7a02891 100644
--- a/arch/um/Makefile
+++ b/arch/um/Makefile
@@ -159,6 +159,7 @@ archclean:
 $(SYMLINK_HEADERS):
         @echo '  SYMLINK $@'
 ifneq ($(KBUILD_SRC),)
+        $(Q)mkdir -p $(objtree)/include/asm-um
         $(Q)ln -fsn $(srctree)/include/asm-um/$(basename $(notdir $@))-$(SUBARCH)$(suffix $@) $@
 else
         $(Q)cd $(TOPDIR)/$(dir $@) ; \
@@ -168,7 +169,7 @@ endif
 include/asm-um/arch:
         @echo '  SYMLINK $@'
 ifneq ($(KBUILD_SRC),)
-        $(Q)mkdir -p include/asm-um
+        $(Q)mkdir -p $(objtree)/include/asm-um
         $(Q)ln -fsn $(srctree)/include/asm-$(SUBARCH) include/asm-um/arch
 else
         $(Q)cd $(TOPDIR)/include/asm-um && ln -sf ../asm-$(SUBARCH) arch
diff --git a/arch/um/drivers/cow.h b/arch/um/drivers/cow.h
index 04e3958266e0..dc36b222100b 100644
--- a/arch/um/drivers/cow.h
+++ b/arch/um/drivers/cow.h
@@ -46,7 +46,7 @@ extern int file_reader(__u64 offset, char *buf, int len, void *arg);
 extern int read_cow_header(int (*reader)(__u64, char *, int, void *),
                            void *arg, __u32 *version_out,
                            char **backing_file_out, time_t *mtime_out,
-                           __u64 *size_out, int *sectorsize_out,
+                           unsigned long long *size_out, int *sectorsize_out,
                            __u32 *align_out, int *bitmap_offset_out);
 
 extern int write_cow_header(char *cow_file, int fd, char *backing_file,
diff --git a/arch/um/drivers/cow_sys.h b/arch/um/drivers/cow_sys.h
index 94de4ead4f7a..7a5b4afde692 100644
--- a/arch/um/drivers/cow_sys.h
+++ b/arch/um/drivers/cow_sys.h
@@ -28,7 +28,7 @@ static inline int cow_seek_file(int fd, __u64 offset)
         return(os_seek_file(fd, offset));
 }
 
-static inline int cow_file_size(char *file, __u64 *size_out)
+static inline int cow_file_size(char *file, unsigned long long *size_out)
 {
         return(os_file_size(file, size_out));
 }
diff --git a/arch/um/drivers/cow_user.c b/arch/um/drivers/cow_user.c
index 61951b721268..0ec4052db9c5 100644
--- a/arch/um/drivers/cow_user.c
+++ b/arch/um/drivers/cow_user.c
@@ -17,30 +17,34 @@
 
 #define PATH_LEN_V1 256
 
+typedef __u32 time32_t;
+
 struct cow_header_v1 {
-        int magic;
-        int version;
+        __s32 magic;
+        __s32 version;
         char backing_file[PATH_LEN_V1];
-        time_t mtime;
+        time32_t mtime;
         __u64 size;
-        int sectorsize;
-};
+        __s32 sectorsize;
+} __attribute__((packed));
 
-#define PATH_LEN_V2 MAXPATHLEN
+/* Define PATH_LEN_V3 as the usual value of MAXPATHLEN, just hard-code it in
+ * case other systems have different values for MAXPATHLEN.
+ *
+ * The same must hold for V2 - we want file format compatibility, not anything
+ * else.
+ */
+#define PATH_LEN_V3 4096
+#define PATH_LEN_V2 PATH_LEN_V3
 
 struct cow_header_v2 {
         __u32 magic;
         __u32 version;
         char backing_file[PATH_LEN_V2];
-        time_t mtime;
+        time32_t mtime;
         __u64 size;
-        int sectorsize;
-};
-
-/* Define PATH_LEN_V3 as the usual value of MAXPATHLEN, just hard-code it in
- * case other systems have different values for MAXPATHLEN
- */
-#define PATH_LEN_V3 4096
+        __s32 sectorsize;
+} __attribute__((packed));
 
 /* Changes from V2 -
  *      PATH_LEN_V3 as described above
@@ -66,6 +70,15 @@ struct cow_header_v2 {
  *      Fixed (finally!) the rounding bug
  */
 
+/* Until Dec2005, __attribute__((packed)) was left out from the below
+ * definition, leading on 64-bit systems to 4 bytes of padding after mtime, to
+ * align size to 8-byte alignment.  This shifted all fields above (no padding
+ * was present on 32-bit, no other padding was added).
+ *
+ * However, this _can be detected_: it means that cow_format (always 0 until
+ * now) is shifted onto the first 4 bytes of backing_file, where it is otherwise
+ * impossible to find 4 zeros. -bb */
+
 struct cow_header_v3 {
         __u32 magic;
         __u32 version;
@@ -75,6 +88,18 @@ struct cow_header_v3 {
         __u32 alignment;
         __u32 cow_format;
         char backing_file[PATH_LEN_V3];
+} __attribute__((packed));
+
+/* This is the broken layout used by some 64-bit binaries. */
+struct cow_header_v3_broken {
+        __u32 magic;
+        __u32 version;
+        __s64 mtime;
+        __u64 size;
+        __u32 sectorsize;
+        __u32 alignment;
+        __u32 cow_format;
+        char backing_file[PATH_LEN_V3];
 };
 
 /* COW format definitions - for now, we have only the usual COW bitmap */
@@ -84,6 +109,7 @@ union cow_header {
         struct cow_header_v1 v1;
         struct cow_header_v2 v2;
         struct cow_header_v3 v3;
+        struct cow_header_v3_broken v3_b;
 };
 
 #define COW_MAGIC 0x4f4f4f4d  /* MOOO */
@@ -184,8 +210,9 @@ int write_cow_header(char *cow_file, int fd, char *backing_file,
 
         err = -EINVAL;
         if(strlen(backing_file) > sizeof(header->backing_file) - 1){
+                /* Below, %zd is for a size_t value */
                 cow_printf("Backing file name \"%s\" is too long - names are "
-                           "limited to %d characters\n", backing_file,
+                           "limited to %zd characters\n", backing_file,
                            sizeof(header->backing_file) - 1);
                 goto out_free;
         }
@@ -300,7 +327,8 @@ int read_cow_header(int (*reader)(__u64, char *, int, void *), void *arg,
                 *align_out = *sectorsize_out;
                 file = header->v2.backing_file;
         }
-        else if(version == 3){
+        /* This is very subtle - see above at union cow_header definition */
+        else if(version == 3 && (*((int*)header->v3.backing_file) != 0)){
                 if(n < sizeof(header->v3)){
                         cow_printf("read_cow_header - failed to read V3 "
                                    "header\n");
@@ -310,9 +338,43 @@ int read_cow_header(int (*reader)(__u64, char *, int, void *), void *arg,
                 *size_out = ntohll(header->v3.size);
                 *sectorsize_out = ntohl(header->v3.sectorsize);
                 *align_out = ntohl(header->v3.alignment);
+                if (*align_out == 0) {
+                        cow_printf("read_cow_header - invalid COW header, "
+                                   "align == 0\n");
+                }
                 *bitmap_offset_out = ROUND_UP(sizeof(header->v3), *align_out);
                 file = header->v3.backing_file;
         }
+        else if(version == 3){
+                cow_printf("read_cow_header - broken V3 file with"
+                           " 64-bit layout - recovering content.\n");
+
+                if(n < sizeof(header->v3_b)){
+                        cow_printf("read_cow_header - failed to read V3 "
+                                   "header\n");
+                        goto out;
+                }
+
+                /* this was used until Dec2005 - 64bits are needed to represent
+                 * 2038+. I.e. we can safely do this truncating cast.
+                 *
+                 * Additionally, we must use ntohl() instead of ntohll(), since
+                 * the program used to use the former (tested - I got mtime
+                 * mismatch "0 vs whatever").
+                 *
+                 * Ever heard about bug-to-bug-compatibility ? ;-) */
+                *mtime_out = (time32_t) ntohl(header->v3_b.mtime);
+
+                *size_out = ntohll(header->v3_b.size);
+                *sectorsize_out = ntohl(header->v3_b.sectorsize);
+                *align_out = ntohl(header->v3_b.alignment);
+                if (*align_out == 0) {
+                        cow_printf("read_cow_header - invalid COW header, "
+                                   "align == 0\n");
+                }
+                *bitmap_offset_out = ROUND_UP(sizeof(header->v3_b), *align_out);
+                file = header->v3_b.backing_file;
+        }
         else {
                 cow_printf("read_cow_header - invalid COW version\n");
                 goto out;
diff --git a/arch/um/drivers/mconsole_kern.c b/arch/um/drivers/mconsole_kern.c
index 28e3760e8b98..6d7173fc55a3 100644
--- a/arch/um/drivers/mconsole_kern.c
+++ b/arch/um/drivers/mconsole_kern.c
@@ -62,7 +62,7 @@ static void mc_work_proc(void *unused)
         unsigned long flags;
 
         while(!list_empty(&mc_requests)){
-                local_save_flags(flags);
+                local_irq_save(flags);
                 req = list_entry(mc_requests.next, struct mconsole_entry,
                                  list);
                 list_del(&req->list);
@@ -87,7 +87,7 @@ static irqreturn_t mconsole_interrupt(int irq, void *dev_id,
                 if(req.cmd->context == MCONSOLE_INTR)
                         (*req.cmd->handler)(&req);
                 else {
-                        new = kmalloc(sizeof(*new), GFP_ATOMIC);
+                        new = kmalloc(sizeof(*new), GFP_NOWAIT);
                         if(new == NULL)
                                 mconsole_reply(&req, "Out of memory", 1, 0);
                         else {
@@ -415,7 +415,6 @@ static int mem_config(char *str)
 
                         unplugged = page_address(page);
                         if(unplug_index == UNPLUGGED_PER_PAGE){
-                                INIT_LIST_HEAD(&unplugged->list);
                                 list_add(&unplugged->list, &unplugged_pages);
                                 unplug_index = 0;
                         }
@@ -616,7 +615,7 @@ static void console_write(struct console *console, const char *string,
                 return;
 
         while(1){
-                n = min((size_t)len, ARRAY_SIZE(console_buf) - console_index);
+                n = min((size_t) len, ARRAY_SIZE(console_buf) - console_index);
                 strncpy(&console_buf[console_index], string, n);
                 console_index += n;
                 string += n;
@@ -655,7 +654,6 @@ static void with_console(struct mc_request *req, void (*proc)(void *),
         struct mconsole_entry entry;
         unsigned long flags;
 
-        INIT_LIST_HEAD(&entry.list);
         entry.request = *req;
         list_add(&entry.list, &clients);
         spin_lock_irqsave(&console_lock, flags);
diff --git a/arch/um/drivers/net_user.c b/arch/um/drivers/net_user.c
index 0e2f06187ea7..0a7786e00cfb 100644
--- a/arch/um/drivers/net_user.c
+++ b/arch/um/drivers/net_user.c
@@ -182,7 +182,9 @@ static int change_tramp(char **argv, char *output, int output_len)
         pe_data.stdout = fds[1];
         pid = run_helper(change_pre_exec, &pe_data, argv, NULL);
 
-        read_output(fds[0], output, output_len);
+        if (pid > 0)    /* Avoid hang as we won't get data in failure case. */
+                read_output(fds[0], output, output_len);
+
         os_close_file(fds[0]);
         os_close_file(fds[1]);
 
diff --git a/arch/um/drivers/slirp_user.c b/arch/um/drivers/slirp_user.c
index b94c66114bc8..33c5f6e625e8 100644
--- a/arch/um/drivers/slirp_user.c
+++ b/arch/um/drivers/slirp_user.c
@@ -104,7 +104,7 @@ static void slirp_close(int fd, void *data)
         }
 
         if(err == 0) {
-                printk("slirp_close: process %d has not exited\n");
+                printk("slirp_close: process %d has not exited\n", pri->pid);
                 return;
         }
 
diff --git a/arch/um/include/kern_util.h b/arch/um/include/kern_util.h
index 42557130a408..efa3d33c0be6 100644
--- a/arch/um/include/kern_util.h
+++ b/arch/um/include/kern_util.h
@@ -117,10 +117,6 @@ extern struct task_struct *get_task(int pid, int require);
 extern void machine_halt(void);
 extern int is_syscall(unsigned long addr);
 
-extern void arch_switch_to_tt(struct task_struct *from, struct task_struct *to);
-
-extern void arch_switch_to_skas(struct task_struct *from, struct task_struct *to);
-
 extern void free_irq(unsigned int, void *);
 extern int cpu(void);
 
diff --git a/arch/um/include/tt/tt.h b/arch/um/include/tt/tt.h
index 808521980186..acb8356e1f98 100644
--- a/arch/um/include/tt/tt.h
+++ b/arch/um/include/tt/tt.h
@@ -19,7 +19,8 @@ extern int fork_tramp(void *sig_stack);
 extern int do_proc_op(void *t, int proc_id);
 extern int tracer(int (*init_proc)(void *), void *sp);
 extern void attach_process(int pid);
-extern void tracer_panic(char *format, ...);
+extern void tracer_panic(char *format, ...)
+        __attribute__ ((format (printf, 1, 2)));
 extern void set_init_pid(int pid);
 extern int set_user_mode(void *task);
 extern void set_tracing(void *t, int tracing);
diff --git a/arch/um/include/user.h b/arch/um/include/user.h
index 91b0ac4ad88c..39f8c8801076 100644
--- a/arch/um/include/user.h
+++ b/arch/um/include/user.h
@@ -6,8 +6,10 @@
 #ifndef __USER_H__
 #define __USER_H__
 
-extern void panic(const char *fmt, ...);
-extern int printk(const char *fmt, ...);
+extern void panic(const char *fmt, ...)
+        __attribute__ ((format (printf, 1, 2)));
+extern int printk(const char *fmt, ...)
+        __attribute__ ((format (printf, 1, 2)));
 extern void schedule(void);
 extern void *um_kmalloc(int size);
 extern void *um_kmalloc_atomic(int size);
diff --git a/arch/um/include/user_util.h b/arch/um/include/user_util.h
index fe0c29b5144d..802d7842514d 100644
--- a/arch/um/include/user_util.h
+++ b/arch/um/include/user_util.h
@@ -55,7 +55,8 @@ extern int get_pty(void);
 extern void *um_kmalloc(int size);
 extern int switcheroo(int fd, int prot, void *from, void *to, int size);
 extern void do_exec(int old_pid, int new_pid);
-extern void tracer_panic(char *msg, ...);
+extern void tracer_panic(char *msg, ...)
+        __attribute__ ((format (printf, 1, 2)));
 extern int detach(int pid, int sig);
 extern int attach(int pid);
 extern void kill_child_dead(int pid);
diff --git a/arch/um/kernel/ksyms.c b/arch/um/kernel/ksyms.c
index 7713e7a6f476..432cf0b97a13 100644
--- a/arch/um/kernel/ksyms.c
+++ b/arch/um/kernel/ksyms.c
@@ -39,7 +39,6 @@ EXPORT_SYMBOL(um_virt_to_phys);
 EXPORT_SYMBOL(mode_tt);
 EXPORT_SYMBOL(handle_page_fault);
 EXPORT_SYMBOL(find_iomem);
-EXPORT_SYMBOL(end_iomem);
 
 #ifdef CONFIG_MODE_TT
 EXPORT_SYMBOL(strncpy_from_user_tt);
@@ -89,12 +88,10 @@ EXPORT_SYMBOL(dump_thread);
 EXPORT_SYMBOL(do_gettimeofday);
 EXPORT_SYMBOL(do_settimeofday);
 
-/* This is here because UML expands open to sys_open, not to a system
+/* This is here because UML expands lseek to sys_lseek, not to a system
  * call instruction.
  */
-EXPORT_SYMBOL(sys_open);
 EXPORT_SYMBOL(sys_lseek);
-EXPORT_SYMBOL(sys_read);
 EXPORT_SYMBOL(sys_wait4);
 
 #ifdef CONFIG_SMP
diff --git a/arch/um/os-Linux/drivers/ethertap_user.c b/arch/um/os-Linux/drivers/ethertap_user.c
index 901b85e8a1c6..8f49507e64ef 100644
--- a/arch/um/os-Linux/drivers/ethertap_user.c
+++ b/arch/um/os-Linux/drivers/ethertap_user.c
@@ -40,7 +40,7 @@ static void etap_change(int op, unsigned char *addr, unsigned char *netmask,
                         int fd)
 {
         struct addr_change change;
-        void *output;
+        char *output;
         int n;
 
         change.what = op;
diff --git a/arch/um/os-Linux/helper.c b/arch/um/os-Linux/helper.c
index 6490a4ff40ac..6987d1d247a2 100644
--- a/arch/um/os-Linux/helper.c
+++ b/arch/um/os-Linux/helper.c
@@ -43,7 +43,7 @@ static int helper_child(void *arg)
                 (*data->pre_exec)(data->pre_data);
         execvp(argv[0], argv);
         errval = errno;
-        printk("execvp of '%s' failed - errno = %d\n", argv[0], errno);
+        printk("helper_child - execve of '%s' failed - errno = %d\n", argv[0], errno);
         os_write_file(data->fd, &errval, sizeof(errval));
         kill(os_getpid(), SIGKILL);
         return(0);
@@ -92,15 +92,15 @@ int run_helper(void (*pre_exec)(void *), void *pre_data, char **argv,
         close(fds[1]);
         fds[1] = -1;
 
-        /*Read the errno value from the child.*/
+        /* Read the errno value from the child, if the exec failed, or get 0 if
+         * the exec succeeded because the pipe fd was set as close-on-exec. */
         n = os_read_file(fds[0], &ret, sizeof(ret));
-        if(n < 0){
+        if (n < 0) {
                 printk("run_helper : read on pipe failed, ret = %d\n", -n);
                 ret = n;
                 kill(pid, SIGKILL);
                 CATCH_EINTR(waitpid(pid, NULL, 0));
-        }
-        else if(n != 0){
+        } else if(n != 0){
                 CATCH_EINTR(n = waitpid(pid, NULL, 0));
                 ret = -errno;
         } else {
diff --git a/arch/um/os-Linux/mem.c b/arch/um/os-Linux/mem.c
index 6ab372da9657..71bb90a7606d 100644
--- a/arch/um/os-Linux/mem.c
+++ b/arch/um/os-Linux/mem.c
@@ -53,33 +53,36 @@ static void __init find_tempdir(void)
  */
 int make_tempfile(const char *template, char **out_tempname, int do_unlink)
 {
-        char tempname[MAXPATHLEN];
+        char *tempname;
         int fd;
 
+        tempname = malloc(MAXPATHLEN);
+
         find_tempdir();
-        if (*template != '/')
+        if (template[0] != '/')
                 strcpy(tempname, tempdir);
         else
-                *tempname = 0;
+                tempname[0] = '\0';
         strcat(tempname, template);
         fd = mkstemp(tempname);
         if(fd < 0){
                 fprintf(stderr, "open - cannot create %s: %s\n", tempname,
                         strerror(errno));
-                return -1;
+                goto out;
         }
         if(do_unlink && (unlink(tempname) < 0)){
                 perror("unlink");
-                return -1;
+                goto out;
         }
         if(out_tempname){
-                *out_tempname = strdup(tempname);
-                if(*out_tempname == NULL){
-                        perror("strdup");
-                        return -1;
-                }
+                *out_tempname = tempname;
+        } else {
+                free(tempname);
         }
         return(fd);
+out:
+        free(tempname);
+        return -1;
 }
 
 #define TEMPNAME_TEMPLATE "vm_file-XXXXXX"
diff --git a/arch/um/os-Linux/sigio.c b/arch/um/os-Linux/sigio.c
index 9ba942947146..00e9388e947a 100644
--- a/arch/um/os-Linux/sigio.c
+++ b/arch/um/os-Linux/sigio.c
@@ -304,8 +304,8 @@ out_clear_poll:
                                            .size        = 0,
                                            .used        = 0 });
 out_free:
-        kfree(p);
         sigio_unlock();
+        kfree(p);
 out_close2:
         close(l_sigio_private[0]);
         close(l_sigio_private[1]);
diff --git a/arch/um/os-Linux/skas/mem.c b/arch/um/os-Linux/skas/mem.c
index fbb080c2fc26..b3c11cfa995a 100644
--- a/arch/um/os-Linux/skas/mem.c
+++ b/arch/um/os-Linux/skas/mem.c
@@ -82,8 +82,8 @@ static inline long do_syscall_stub(struct mm_id * mm_idp, void **addr)
         if (offset) {
                 data = (unsigned long *)(mm_idp->stack +
                                          offset - UML_CONFIG_STUB_DATA);
-                printk("do_syscall_stub : ret = %d, offset = %d, "
-                       "data = 0x%x\n", ret, offset, data);
+                printk("do_syscall_stub : ret = %ld, offset = %ld, "
+                       "data = %p\n", ret, offset, data);
                 syscall = (unsigned long *)((unsigned long)data + data[0]);
                 printk("do_syscall_stub: syscall %ld failed, return value = "
                        "0x%lx, expected return value = 0x%lx\n",
diff --git a/arch/um/os-Linux/skas/process.c b/arch/um/os-Linux/skas/process.c
index bbf34cb91ce1..045ae0037456 100644
--- a/arch/um/os-Linux/skas/process.c
+++ b/arch/um/os-Linux/skas/process.c
@@ -265,7 +265,7 @@ void userspace(union uml_pt_regs *regs)
                 if(err)
                         panic("userspace - could not resume userspace process, "
                               "pid=%d, ptrace operation = %d, errno = %d\n",
-                              op, errno);
+                              pid, op, errno);
 
                 CATCH_EINTR(err = waitpid(pid, &status, WUNTRACED));
                 if(err < 0)
@@ -369,7 +369,7 @@ int copy_context_skas0(unsigned long new_stack, int pid)
          */
         wait_stub_done(pid, -1, "copy_context_skas0");
         if (child_data->err != UML_CONFIG_STUB_DATA)
-                panic("copy_context_skas0 - stub-child reports error %d\n",
+                panic("copy_context_skas0 - stub-child reports error %ld\n",
                       child_data->err);
 
         if (ptrace(PTRACE_OLDSETOPTIONS, pid, NULL,
diff --git a/arch/um/os-Linux/sys-i386/tls.c b/arch/um/os-Linux/sys-i386/tls.c
index ba21f0e04a2f..120abbe4e3ce 100644
--- a/arch/um/os-Linux/sys-i386/tls.c
+++ b/arch/um/os-Linux/sys-i386/tls.c
@@ -1,3 +1,4 @@
+#include <errno.h>
 #include <linux/unistd.h>
 #include "sysdep/tls.h"
 #include "user_util.h"
diff --git a/arch/um/os-Linux/umid.c b/arch/um/os-Linux/umid.c
index 198e59163288..34bfc1bb9e38 100644
--- a/arch/um/os-Linux/umid.c
+++ b/arch/um/os-Linux/umid.c
@@ -120,7 +120,8 @@ static int not_dead_yet(char *dir)
 
         dead = 0;
         fd = open(file, O_RDONLY);
-        if(fd < 0){
+        if(fd < 0) {
+                fd = -errno;
                 if(fd != -ENOENT){
                         printk("not_dead_yet : couldn't open pid file '%s', "
                                "err = %d\n", file, -fd);
@@ -130,9 +131,13 @@ static int not_dead_yet(char *dir)
 
         err = 0;
         n = read(fd, pid, sizeof(pid));
-        if(n <= 0){
+        if(n < 0){
+                printk("not_dead_yet : couldn't read pid file '%s', "
+                       "err = %d\n", file, errno);
+                goto out_close;
+        } else if(n == 0){
                 printk("not_dead_yet : couldn't read pid file '%s', "
-                       "err = %d\n", file, -n);
+                       "0-byte read\n", file);
                 goto out_close;
         }
 
@@ -155,9 +160,9 @@ static int not_dead_yet(char *dir)
 
         return err;
 
- out_close:
+out_close:
         close(fd);
- out:
+out:
         return 0;
 }
 
diff --git a/arch/um/os-Linux/user_syms.c b/arch/um/os-Linux/user_syms.c
index 8da6ab31152a..2598158e1f53 100644
--- a/arch/um/os-Linux/user_syms.c
+++ b/arch/um/os-Linux/user_syms.c
@@ -18,14 +18,19 @@ extern void *memmove(void *, const void *, size_t);
 extern void *memset(void *, int, size_t);
 extern int printf(const char *, ...);
 
+/* If they're not defined, the export is included in lib/string.c.*/
+#ifdef __HAVE_ARCH_STRLEN
 EXPORT_SYMBOL(strlen);
+#endif
+#ifdef __HAVE_ARCH_STRSTR
+EXPORT_SYMBOL(strstr);
+#endif
+
 EXPORT_SYMBOL(memcpy);
 EXPORT_SYMBOL(memmove);
 EXPORT_SYMBOL(memset);
 EXPORT_SYMBOL(printf);
 
-EXPORT_SYMBOL(strstr);
-
 /* Here, instead, I can provide a fake prototype. Yes, someone cares: genksyms.
  * However, the modules will use the CRC defined *here*, no matter if it is
  * good; so the versions of these symbols will always match
diff --git a/arch/um/scripts/Makefile.rules b/arch/um/scripts/Makefile.rules
index b696b451774c..5e7a9c310aa5 100644
--- a/arch/um/scripts/Makefile.rules
+++ b/arch/um/scripts/Makefile.rules
@@ -9,10 +9,8 @@ USER_OBJS := $(foreach file,$(USER_OBJS),$(obj)/$(file))
 
 $(USER_OBJS) $(USER_OBJS:.o=.i) $(USER_OBJS:.o=.s) $(USER_OBJS:.o=.lst): \
         c_flags = -Wp,-MD,$(depfile) $(USER_CFLAGS) $(CFLAGS_$(notdir $@))
-$(USER_OBJS): cmd_checksrc =
-$(USER_OBJS): quiet_cmd_checksrc =
-$(USER_OBJS): cmd_force_checksrc =
-$(USER_OBJS): quiet_cmd_force_checksrc =
+$(USER_OBJS) : CHECKFLAGS := -D__linux__ -Dlinux -D__STDC__ \
+        -Dunix -D__unix__ -D__$(SUBARCH)__
 
 
 # The stubs and unmap.o can't try to call mcount or update basic block data
diff --git a/arch/um/sys-i386/ksyms.c b/arch/um/sys-i386/ksyms.c
index db524ab3f743..2a1eac1859ce 100644
--- a/arch/um/sys-i386/ksyms.c
+++ b/arch/um/sys-i386/ksyms.c
@@ -15,7 +15,3 @@ EXPORT_SYMBOL(__up_wakeup);
 
 /* Networking helper routines. */
 EXPORT_SYMBOL(csum_partial);
-
-/* delay core functions */
-EXPORT_SYMBOL(__const_udelay);
-EXPORT_SYMBOL(__udelay);
diff --git a/arch/um/sys-i386/ptrace_user.c b/arch/um/sys-i386/ptrace_user.c
index 9f3bd8ed78f5..40aa88531446 100644
--- a/arch/um/sys-i386/ptrace_user.c
+++ b/arch/um/sys-i386/ptrace_user.c
@@ -57,7 +57,7 @@ static void write_debugregs(int pid, unsigned long *regs)
                 if(ptrace(PTRACE_POKEUSR, pid, &dummy->u_debugreg[i],
                           regs[i]) < 0)
                         printk("write_debugregs - ptrace failed on "
-                               "register %d, value = 0x%x, errno = %d\n", i,
+                               "register %d, value = 0x%lx, errno = %d\n", i,
                                regs[i], errno);
         }
 }
diff --git a/arch/um/sys-i386/signal.c b/arch/um/sys-i386/signal.c
index f5d0e1c37ea2..618fd8594643 100644
--- a/arch/um/sys-i386/signal.c
+++ b/arch/um/sys-i386/signal.c
@@ -147,7 +147,7 @@ int copy_sc_to_user_tt(struct sigcontext *to, struct _fpstate __user *fp,
          * delivery.  The sp passed in is the original, and this needs
          * to be restored, so we stick it in separately.
          */
-        err |= copy_to_user(&SC_SP(to), sp, sizeof(sp));
+        err |= copy_to_user(&SC_SP(to), &sp, sizeof(sp));
 
         if(from_fp != NULL){
                 err |= copy_to_user(&to->fpstate, &to_fp, sizeof(to->fpstate));
diff --git a/arch/um/sys-i386/tls.c b/arch/um/sys-i386/tls.c
index a3188e861cc7..71b9796258ef 100644
--- a/arch/um/sys-i386/tls.c
+++ b/arch/um/sys-i386/tls.c
@@ -378,7 +378,7 @@ static int __init __setup_host_supports_tls(void) {
         } else
                 printk(KERN_ERR "  Host TLS support NOT detected! "
                                 "TLS support inside UML will not work\n");
-        return 1;
+        return 0;
 }
 
 __initcall(__setup_host_supports_tls);
diff --git a/arch/um/sys-x86_64/signal.c b/arch/um/sys-x86_64/signal.c
index e75c4e1838b0..a4c46a8af008 100644
--- a/arch/um/sys-x86_64/signal.c
+++ b/arch/um/sys-x86_64/signal.c
@@ -137,7 +137,7 @@ int copy_sc_to_user_tt(struct sigcontext *to, struct _fpstate *fp,
          * delivery.  The sp passed in is the original, and this needs
          * to be restored, so we stick it in separately.
          */
-        err |= copy_to_user(&SC_SP(to), sp, sizeof(sp));
+        err |= copy_to_user(&SC_SP(to), &sp, sizeof(sp));
 
         if(from_fp != NULL){
                 err |= copy_to_user(&to->fpstate, &to_fp, sizeof(to->fpstate));
diff --git a/arch/v850/kernel/v850_ksyms.c b/arch/v850/kernel/v850_ksyms.c
index 8ffc29c1c89d..6bcfcfe88384 100644
--- a/arch/v850/kernel/v850_ksyms.c
+++ b/arch/v850/kernel/v850_ksyms.c
@@ -43,7 +43,6 @@ EXPORT_SYMBOL (strncmp);
 EXPORT_SYMBOL (strchr);
 EXPORT_SYMBOL (strlen);
 EXPORT_SYMBOL (strnlen);
-EXPORT_SYMBOL (strpbrk);
 EXPORT_SYMBOL (strrchr);
 EXPORT_SYMBOL (strstr);
 EXPORT_SYMBOL (memset);
diff --git a/arch/x86_64/Kconfig b/arch/x86_64/Kconfig
index 4310b4a311a5..408d44a59756 100644
--- a/arch/x86_64/Kconfig
+++ b/arch/x86_64/Kconfig
@@ -136,6 +136,11 @@ config X86_L1_CACHE_SHIFT
         default "7" if GENERIC_CPU || MPSC
         default "6" if MK8
 
+config X86_INTERNODE_CACHE_BYTES
+        int
+        default "4096" if X86_VSMP
+        default X86_L1_CACHE_BYTES if !X86_VSMP
+
 config X86_TSC
         bool
         default y
@@ -283,6 +288,11 @@ config K8_NUMA
          Northbridge of Opteron. It is recommended to use X86_64_ACPI_NUMA
          instead, which also takes priority if both are compiled in.   
 
+config NODES_SHIFT
+        int
+        default "6"
+        depends on NEED_MULTIPLE_NODES
+
 # Dummy CONFIG option to select ACPI_NUMA from drivers/acpi/Kconfig.
 
 config X86_64_ACPI_NUMA
diff --git a/arch/x86_64/Makefile b/arch/x86_64/Makefile
index 585fd4a559c8..e573e2ab5510 100644
--- a/arch/x86_64/Makefile
+++ b/arch/x86_64/Makefile
@@ -24,37 +24,37 @@
 LDFLAGS         := -m elf_x86_64
 OBJCOPYFLAGS    := -O binary -R .note -R .comment -S
 LDFLAGS_vmlinux :=
-
 CHECKFLAGS      += -D__x86_64__ -m64
 
+cflags-y        :=
 cflags-$(CONFIG_MK8) += $(call cc-option,-march=k8)
 cflags-$(CONFIG_MPSC) += $(call cc-option,-march=nocona)
 cflags-$(CONFIG_GENERIC_CPU) += $(call cc-option,-mtune=generic)
-CFLAGS += $(cflags-y)
 
-CFLAGS += -m64
-CFLAGS += -mno-red-zone
-CFLAGS += -mcmodel=kernel
-CFLAGS += -pipe
+cflags-y += -m64
+cflags-y += -mno-red-zone
+cflags-y += -mcmodel=kernel
+cflags-y += -pipe
 cflags-$(CONFIG_REORDER) += -ffunction-sections
 # this makes reading assembly source easier, but produces worse code
 # actually it makes the kernel smaller too.
-CFLAGS += -fno-reorder-blocks   
-CFLAGS += -Wno-sign-compare
+cflags-y += -fno-reorder-blocks
+cflags-y += -Wno-sign-compare
 ifneq ($(CONFIG_UNWIND_INFO),y)
-CFLAGS += -fno-asynchronous-unwind-tables
+cflags-y += -fno-asynchronous-unwind-tables
 endif
 ifneq ($(CONFIG_DEBUG_INFO),y)
 # -fweb shrinks the kernel a bit, but the difference is very small
 # it also messes up debugging, so don't use it for now.
-#CFLAGS += $(call cc-option,-fweb)
+#cflags-y += $(call cc-option,-fweb)
 endif
 # -funit-at-a-time shrinks the kernel .text considerably
 # unfortunately it makes reading oopses harder.
-CFLAGS += $(call cc-option,-funit-at-a-time)
+cflags-y += $(call cc-option,-funit-at-a-time)
 # prevent gcc from generating any FP code by mistake
-CFLAGS += $(call cc-option,-mno-sse -mno-mmx -mno-sse2 -mno-3dnow,)
+cflags-y += $(call cc-option,-mno-sse -mno-mmx -mno-sse2 -mno-3dnow,)
 
+CFLAGS += $(cflags-y)
 AFLAGS += -m64
 
 head-y := arch/x86_64/kernel/head.o arch/x86_64/kernel/head64.o arch/x86_64/kernel/init_task.o
diff --git a/arch/x86_64/boot/video.S b/arch/x86_64/boot/video.S
index 0587477c99f2..32327bb37aff 100644
--- a/arch/x86_64/boot/video.S
+++ b/arch/x86_64/boot/video.S
@@ -97,6 +97,7 @@
 #define PARAM_VESAPM_OFF        0x30
 #define PARAM_LFB_PAGES         0x32
 #define PARAM_VESA_ATTRIB       0x34
+#define PARAM_CAPABILITIES      0x36
 
 /* Define DO_STORE according to CONFIG_VIDEO_RETAIN */
 #ifdef CONFIG_VIDEO_RETAIN
@@ -233,6 +234,10 @@ mopar_gr:
         movw    18(%di), %ax
         movl    %eax, %fs:(PARAM_LFB_SIZE)
 
+# store mode capabilities
+        movl 10(%di), %eax
+        movl %eax, %fs:(PARAM_CAPABILITIES)
+
 # switching the DAC to 8-bit is for <= 8 bpp only
         movw    %fs:(PARAM_LFB_DEPTH), %ax
         cmpw    $8, %ax
diff --git a/arch/x86_64/defconfig b/arch/x86_64/defconfig
index 566ecc97ee5a..3c45ec22b3fe 100644
--- a/arch/x86_64/defconfig
+++ b/arch/x86_64/defconfig
@@ -1,7 +1,7 @@
 #
 # Automatically generated make config: don't edit
-# Linux kernel version: 2.6.16-git9
-# Sat Mar 25 15:18:40 2006
+# Linux kernel version: 2.6.17-rc1
+# Mon Apr  3 16:11:14 2006
 #
 CONFIG_X86_64=y
 CONFIG_64BIT=y
@@ -9,6 +9,7 @@ CONFIG_X86=y
 CONFIG_SEMAPHORE_SLEEPERS=y
 CONFIG_MMU=y
 CONFIG_RWSEM_GENERIC_SPINLOCK=y
+CONFIG_GENERIC_HWEIGHT=y
 CONFIG_GENERIC_CALIBRATE_DELAY=y
 CONFIG_X86_CMPXCHG=y
 CONFIG_EARLY_PRINTK=y
@@ -55,10 +56,6 @@ CONFIG_BASE_FULL=y
 CONFIG_FUTEX=y
 CONFIG_EPOLL=y
 CONFIG_SHMEM=y
-CONFIG_CC_ALIGN_FUNCTIONS=0
-CONFIG_CC_ALIGN_LABELS=0
-CONFIG_CC_ALIGN_LOOPS=0
-CONFIG_CC_ALIGN_JUMPS=0
 CONFIG_SLAB=y
 # CONFIG_TINY_SHMEM is not set
 CONFIG_BASE_SMALL=0
@@ -70,7 +67,6 @@ CONFIG_BASE_SMALL=0
 CONFIG_MODULES=y
 CONFIG_MODULE_UNLOAD=y
 CONFIG_MODULE_FORCE_UNLOAD=y
-CONFIG_OBSOLETE_MODPARM=y
 # CONFIG_MODVERSIONS is not set
 # CONFIG_MODULE_SRCVERSION_ALL is not set
 # CONFIG_KMOD is not set
@@ -81,6 +77,7 @@ CONFIG_STOP_MACHINE=y
 #
 CONFIG_LBD=y
 # CONFIG_BLK_DEV_IO_TRACE is not set
+# CONFIG_LSF is not set
 
 #
 # IO Schedulers
@@ -105,6 +102,7 @@ CONFIG_X86_PC=y
 CONFIG_GENERIC_CPU=y
 CONFIG_X86_L1_CACHE_BYTES=128
 CONFIG_X86_L1_CACHE_SHIFT=7
+CONFIG_X86_INTERNODE_CACHE_BYTES=128
 CONFIG_X86_TSC=y
 CONFIG_X86_GOOD_APIC=y
 # CONFIG_MICROCODE is not set
@@ -116,6 +114,7 @@ CONFIG_X86_LOCAL_APIC=y
 CONFIG_MTRR=y
 CONFIG_SMP=y
 CONFIG_SCHED_SMT=y
+CONFIG_SCHED_MC=y
 # CONFIG_PREEMPT_NONE is not set
 CONFIG_PREEMPT_VOLUNTARY=y
 # CONFIG_PREEMPT is not set
@@ -138,6 +137,7 @@ CONFIG_NEED_MULTIPLE_NODES=y
 CONFIG_SPLIT_PTLOCK_CPUS=4
 CONFIG_MIGRATION=y
 CONFIG_HAVE_ARCH_EARLY_PFN_TO_NID=y
+CONFIG_OUT_OF_LINE_PFN_TO_PAGE=y
 CONFIG_NR_CPUS=32
 CONFIG_HOTPLUG_CPU=y
 CONFIG_HPET_TIMER=y
@@ -289,6 +289,7 @@ CONFIG_IP_PNP_DHCP=y
 # CONFIG_INET_AH is not set
 # CONFIG_INET_ESP is not set
 # CONFIG_INET_IPCOMP is not set
+# CONFIG_INET_XFRM_TUNNEL is not set
 # CONFIG_INET_TUNNEL is not set
 CONFIG_INET_DIAG=y
 CONFIG_INET_TCP_DIAG=y
@@ -300,6 +301,7 @@ CONFIG_IPV6=y
 # CONFIG_INET6_AH is not set
 # CONFIG_INET6_ESP is not set
 # CONFIG_INET6_IPCOMP is not set
+# CONFIG_INET6_XFRM_TUNNEL is not set
 # CONFIG_INET6_TUNNEL is not set
 # CONFIG_IPV6_TUNNEL is not set
 # CONFIG_NETFILTER is not set
@@ -704,7 +706,6 @@ CONFIG_S2IO=m
 # Wireless LAN (non-hamradio)
 #
 # CONFIG_NET_RADIO is not set
-# CONFIG_NET_WIRELESS_RTNETLINK is not set
 
 #
 # Wan interfaces
@@ -791,7 +792,7 @@ CONFIG_HW_CONSOLE=y
 #
 CONFIG_SERIAL_8250=y
 CONFIG_SERIAL_8250_CONSOLE=y
-# CONFIG_SERIAL_8250_ACPI is not set
+CONFIG_SERIAL_8250_PCI=y
 CONFIG_SERIAL_8250_NR_UARTS=4
 CONFIG_SERIAL_8250_RUNTIME_UARTS=4
 # CONFIG_SERIAL_8250_EXTENDED is not set
@@ -921,6 +922,7 @@ CONFIG_HWMON=y
 # Digital Video Broadcasting Devices
 #
 # CONFIG_DVB is not set
+# CONFIG_USB_DABUSB is not set
 
 #
 # Graphics support
@@ -932,6 +934,8 @@ CONFIG_VIDEO_SELECT=y
 # Console display driver support
 #
 CONFIG_VGA_CONSOLE=y
+CONFIG_VGACON_SOFT_SCROLLBACK=y
+CONFIG_VGACON_SOFT_SCROLLBACK_SIZE=256
 CONFIG_DUMMY_CONSOLE=y
 
 #
@@ -1058,15 +1062,6 @@ CONFIG_USB_HIDINPUT=y
 # CONFIG_USB_MICROTEK is not set
 
 #
-# USB Multimedia devices
-#
-# CONFIG_USB_DABUSB is not set
-
-#
-# Video4Linux support is needed for USB Multimedia device support
-#
-
-#
 # USB Network Adapters
 #
 # CONFIG_USB_CATC is not set
@@ -1118,9 +1113,15 @@ CONFIG_USB_MON=y
 # CONFIG_MMC is not set
 
 #
+# LED devices
+#
+# CONFIG_NEW_LEDS is not set
+
+#
 # InfiniBand support
 #
 # CONFIG_INFINIBAND is not set
+# CONFIG_IPATH_CORE is not set
 
 #
 # EDAC - error detection and reporting (RAS) (EXPERIMENTAL)
@@ -1128,6 +1129,11 @@ CONFIG_USB_MON=y
 # CONFIG_EDAC is not set
 
 #
+# Real Time Clock
+#
+# CONFIG_RTC_CLASS is not set
+
+#
 # Firmware Drivers
 #
 # CONFIG_EDD is not set
diff --git a/arch/x86_64/ia32/ia32entry.S b/arch/x86_64/ia32/ia32entry.S
index 35b2faccdc6c..5a9802676689 100644
--- a/arch/x86_64/ia32/ia32entry.S
+++ b/arch/x86_64/ia32/ia32entry.S
@@ -15,6 +15,8 @@
 #include <asm/vsyscall32.h>
 #include <linux/linkage.h>
 
+#define IA32_NR_syscalls ((ia32_syscall_end - ia32_sys_call_table)/8)
+
         .macro IA32_ARG_FIXUP noebp=0
         movl    %edi,%r8d
         .if \noebp
@@ -109,8 +111,8 @@ ENTRY(ia32_sysenter_target)
         CFI_REMEMBER_STATE
         jnz  sysenter_tracesys
 sysenter_do_call:       
-        cmpl    $(IA32_NR_syscalls),%eax
-        jae     ia32_badsys
+        cmpl    $(IA32_NR_syscalls-1),%eax
+        ja      ia32_badsys
         IA32_ARG_FIXUP 1
         call    *ia32_sys_call_table(,%rax,8)
         movq    %rax,RAX-ARGOFFSET(%rsp)
@@ -210,8 +212,8 @@ ENTRY(ia32_cstar_target)
         CFI_REMEMBER_STATE
         jnz   cstar_tracesys
 cstar_do_call:  
-        cmpl $IA32_NR_syscalls,%eax
-        jae  ia32_badsys
+        cmpl $IA32_NR_syscalls-1,%eax
+        ja  ia32_badsys
         IA32_ARG_FIXUP 1
         call *ia32_sys_call_table(,%rax,8)
         movq %rax,RAX-ARGOFFSET(%rsp)
@@ -296,8 +298,8 @@ ENTRY(ia32_syscall)
         testl $(_TIF_SYSCALL_TRACE|_TIF_SYSCALL_AUDIT|_TIF_SECCOMP),threadinfo_flags(%r10)
         jnz ia32_tracesys
 ia32_do_syscall:        
-        cmpl $(IA32_NR_syscalls),%eax
-        jae  ia32_badsys
+        cmpl $(IA32_NR_syscalls-1),%eax
+        ja  ia32_badsys
         IA32_ARG_FIXUP
         call *ia32_sys_call_table(,%rax,8) # xxx: rip relative
 ia32_sysret:
@@ -685,12 +687,11 @@ ia32_sys_call_table:
         .quad sys_readlinkat            /* 305 */
         .quad sys_fchmodat
         .quad sys_faccessat
-        .quad sys_ni_syscall            /* pselect6 for now */
-        .quad sys_ni_syscall            /* ppoll for now */
+        .quad quiet_ni_syscall          /* pselect6 for now */
+        .quad quiet_ni_syscall          /* ppoll for now */
         .quad sys_unshare               /* 310 */
         .quad compat_sys_set_robust_list
         .quad compat_sys_get_robust_list
+        .quad sys_splice
+        .quad sys_sync_file_range
 ia32_syscall_end:               
-        .rept IA32_NR_syscalls-(ia32_syscall_end-ia32_sys_call_table)/8
-                .quad ni_syscall
-        .endr
diff --git a/arch/x86_64/kernel/aperture.c b/arch/x86_64/kernel/aperture.c
index fffd6b0a2fab..70b9d21ed675 100644
--- a/arch/x86_64/kernel/aperture.c
+++ b/arch/x86_64/kernel/aperture.c
@@ -80,7 +80,7 @@ static int __init aperture_valid(char *name, u64 aper_base, u32 aper_size)
                 printk("Aperture from %s beyond 4GB. Ignoring.\n",name);
                 return 0; 
         }
-        if (e820_mapped(aper_base, aper_base + aper_size, E820_RAM)) {  
+        if (e820_any_mapped(aper_base, aper_base + aper_size, E820_RAM)) {
                 printk("Aperture from %s pointing to e820 RAM. Ignoring.\n",name);
                 return 0; 
         } 
diff --git a/arch/x86_64/kernel/e820.c b/arch/x86_64/kernel/e820.c
index 293cd71a266a..62776c07cff1 100644
--- a/arch/x86_64/kernel/e820.c
+++ b/arch/x86_64/kernel/e820.c
@@ -80,7 +80,12 @@ static inline int bad_addr(unsigned long *addrp, unsigned long size)
         return 0;
 } 
 
-int __init e820_mapped(unsigned long start, unsigned long end, unsigned type) 
+/*
+ * This function checks if any part of the range <start,end> is mapped
+ * with type.
+ */
+int __meminit
+e820_any_mapped(unsigned long start, unsigned long end, unsigned type)
 { 
         int i;
         for (i = 0; i < e820.nr_map; i++) { 
@@ -94,6 +99,35 @@ int __init e820_mapped(unsigned long start, unsigned long end, unsigned type)
         return 0;
 }
 
+/*
+ * This function checks if the entire range <start,end> is mapped with type.
+ *
+ * Note: this function only works correct if the e820 table is sorted and
+ * not-overlapping, which is the case
+ */
+int __init e820_all_mapped(unsigned long start, unsigned long end, unsigned type)
+{
+        int i;
+        for (i = 0; i < e820.nr_map; i++) {
+                struct e820entry *ei = &e820.map[i];
+                if (type && ei->type != type)
+                        continue;
+                /* is the region (part) in overlap with the current region ?*/
+                if (ei->addr >= end || ei->addr + ei->size <= start)
+                        continue;
+
+                /* if the region is at the beginning of <start,end> we move
+                 * start to the end of the region since it's ok until there
+                 */
+                if (ei->addr <= start)
+                        start = ei->addr + ei->size;
+                /* if start is now at or beyond end, we're done, full coverage */
+                if (start >= end)
+                        return 1; /* we're done */
+        }
+        return 0;
+}
+
 /* 
  * Find a free area in a specific range. 
  */ 
diff --git a/arch/x86_64/kernel/entry.S b/arch/x86_64/kernel/entry.S
index 8538bfea30e6..c946e4fe67a7 100644
--- a/arch/x86_64/kernel/entry.S
+++ b/arch/x86_64/kernel/entry.S
@@ -180,6 +180,10 @@ rff_trace:
  *
  * XXX  if we had a free scratch register we could save the RSP into the stack frame
  *      and report it properly in ps. Unfortunately we haven't.
+ *
+ * When user can change the frames always force IRET. That is because
+ * it deals with uncanonical addresses better. SYSRET has trouble
+ * with them due to bugs in both AMD and Intel CPUs.
  */                                     
 
 ENTRY(system_call)
@@ -254,7 +258,10 @@ sysret_signal:
         xorl %esi,%esi # oldset -> arg2
         call ptregscall_common
 1:      movl $_TIF_NEED_RESCHED,%edi
-        jmp sysret_check
+        /* Use IRET because user could have changed frame. This
+           works because ptregscall_common has called FIXUP_TOP_OF_STACK. */
+        cli
+        jmp int_with_check
         
 badsys:
         movq $-ENOSYS,RAX-ARGOFFSET(%rsp)
@@ -280,7 +287,8 @@ tracesys:
         call syscall_trace_leave
         RESTORE_TOP_OF_STACK %rbx
         RESTORE_REST
-        jmp ret_from_sys_call
+        /* Use IRET because user could have changed frame */
+        jmp int_ret_from_sys_call
         CFI_ENDPROC
                 
 /* 
@@ -408,25 +416,9 @@ ENTRY(stub_execve)
         CFI_ADJUST_CFA_OFFSET -8
         CFI_REGISTER rip, r11
         SAVE_REST
-        movq %r11, %r15
-        CFI_REGISTER rip, r15
         FIXUP_TOP_OF_STACK %r11
         call sys_execve
-        GET_THREAD_INFO(%rcx)
-        bt $TIF_IA32,threadinfo_flags(%rcx)
-        CFI_REMEMBER_STATE
-        jc exec_32bit
         RESTORE_TOP_OF_STACK %r11
-        movq %r15, %r11
-        CFI_REGISTER rip, r11
-        RESTORE_REST
-        pushq %r11
-        CFI_ADJUST_CFA_OFFSET 8
-        CFI_REL_OFFSET rip, 0
-        ret
-
-exec_32bit:
-        CFI_RESTORE_STATE
         movq %rax,RAX(%rsp)
         RESTORE_REST
         jmp int_ret_from_sys_call
diff --git a/arch/x86_64/kernel/mce.c b/arch/x86_64/kernel/mce.c
index 10b3e348fc99..6f0790e8b6d3 100644
--- a/arch/x86_64/kernel/mce.c
+++ b/arch/x86_64/kernel/mce.c
@@ -29,6 +29,8 @@
 #define MISC_MCELOG_MINOR 227
 #define NR_BANKS 6
 
+atomic_t mce_entry;
+
 static int mce_dont_init;
 
 /* 0: always panic, 1: panic if deadlock possible, 2: try to avoid panic,
@@ -172,10 +174,12 @@ void do_machine_check(struct pt_regs * regs, long error_code)
         int i;
         int panicm_found = 0;
 
+        atomic_inc(&mce_entry);
+
         if (regs)
                 notify_die(DIE_NMI, "machine check", regs, error_code, 18, SIGKILL);
         if (!banks)
-                return;
+                goto out2;
 
         memset(&m, 0, sizeof(struct mce));
         m.cpu = safe_smp_processor_id();
@@ -266,6 +270,8 @@ void do_machine_check(struct pt_regs * regs, long error_code)
  out:
         /* Last thing done in the machine check exception to clear state. */
         wrmsrl(MSR_IA32_MCG_STATUS, 0);
+ out2:
+        atomic_dec(&mce_entry);
 }
 
 /*
diff --git a/arch/x86_64/kernel/nmi.c b/arch/x86_64/kernel/nmi.c
index d9e4067faf05..4e6357fe0ec3 100644
--- a/arch/x86_64/kernel/nmi.c
+++ b/arch/x86_64/kernel/nmi.c
@@ -34,6 +34,7 @@
 #include <asm/proto.h>
 #include <asm/kdebug.h>
 #include <asm/local.h>
+#include <asm/mce.h>
 
 /*
  * lapic_nmi_owner tracks the ownership of the lapic NMI hardware:
@@ -480,6 +481,12 @@ void __kprobes nmi_watchdog_tick(struct pt_regs * regs, unsigned reason)
                 __get_cpu_var(nmi_touch) = 0;
                 touched = 1;
         }
+#ifdef CONFIG_X86_MCE
+        /* Could check oops_in_progress here too, but it's safer
+           not too */
+        if (atomic_read(&mce_entry) > 0)
+                touched = 1;
+#endif
         if (!touched && __get_cpu_var(last_irq_sum) == sum) {
                 /*
                  * Ayiee, looks like this CPU is stuck ...
diff --git a/arch/x86_64/kernel/pci-dma.c b/arch/x86_64/kernel/pci-dma.c
index 03c9eeedb0f3..af035ede70cd 100644
--- a/arch/x86_64/kernel/pci-dma.c
+++ b/arch/x86_64/kernel/pci-dma.c
@@ -48,9 +48,11 @@ dma_alloc_pages(struct device *dev, gfp_t gfp, unsigned order)
 {
         struct page *page;
         int node;
+#ifdef CONFIG_PCI
         if (dev->bus == &pci_bus_type)
                 node = pcibus_to_node(to_pci_dev(dev)->bus);
         else
+#endif
                 node = numa_node_id();
         page = alloc_pages_node(node, gfp, order);
         return page ? page_address(page) : NULL;
diff --git a/arch/x86_64/kernel/process.c b/arch/x86_64/kernel/process.c
index 70dd8e5c6889..1c44b53cb15b 100644
--- a/arch/x86_64/kernel/process.c
+++ b/arch/x86_64/kernel/process.c
@@ -781,10 +781,16 @@ long do_arch_prctl(struct task_struct *task, int code, unsigned long addr)
         }
         case ARCH_GET_GS: { 
                 unsigned long base;
+                unsigned gsindex;
                 if (task->thread.gsindex == GS_TLS_SEL)
                         base = read_32bit_tls(task, GS_TLS);
-                else if (doit)
-                        rdmsrl(MSR_KERNEL_GS_BASE, base);
+                else if (doit) {
+                        asm("movl %%gs,%0" : "=r" (gsindex));
+                        if (gsindex)
+                                rdmsrl(MSR_KERNEL_GS_BASE, base);
+                        else
+                                base = task->thread.gs;
+                }
                 else
                         base = task->thread.gs;
                 ret = put_user(base, (unsigned long __user *)addr); 
diff --git a/arch/x86_64/kernel/ptrace.c b/arch/x86_64/kernel/ptrace.c
index d44b2c1e63a6..da8e7903d817 100644
--- a/arch/x86_64/kernel/ptrace.c
+++ b/arch/x86_64/kernel/ptrace.c
@@ -274,11 +274,6 @@ static int putreg(struct task_struct *child,
                                 return -EIO;
                         value &= 0xffff;
                         break;
-                case offsetof(struct user_regs_struct, rip):
-                        /* Check if the new RIP address is canonical */
-                        if (value >= TASK_SIZE_OF(child))
-                                return -EIO;
-                        break;
         }
         put_stack_long(child, regno - sizeof(struct pt_regs), value);
         return 0;
diff --git a/arch/x86_64/kernel/setup.c b/arch/x86_64/kernel/setup.c
index 0856ad444f90..c50b06765a80 100644
--- a/arch/x86_64/kernel/setup.c
+++ b/arch/x86_64/kernel/setup.c
@@ -353,8 +353,10 @@ static __init void parse_cmdline_early (char ** cmdline_p)
                 if (fullarg(from, "enable_timer_pin_1"))
                         disable_timer_pin_1 = -1;
 
-                if (fullarg(from, "nolapic") || fullarg(from, "disableapic"))
+                if (fullarg(from, "nolapic") || fullarg(from, "disableapic")) {
+                        clear_bit(X86_FEATURE_APIC, boot_cpu_data.x86_capability);
                         disable_apic = 1;
+                }
 
                 if (fullarg(from, "noapic"))
                         skip_ioapic_setup = 1;
diff --git a/arch/x86_64/kernel/time.c b/arch/x86_64/kernel/time.c
index ef8bc46dc140..7392570f975d 100644
--- a/arch/x86_64/kernel/time.c
+++ b/arch/x86_64/kernel/time.c
@@ -726,7 +726,7 @@ static __init int late_hpet_init(void)
         unsigned int            ntimer;
 
         if (!vxtime.hpet_address)
-                return -1;
+                return 0;
 
         memset(&hd, 0, sizeof (hd));
 
@@ -917,6 +917,8 @@ void __init time_init(void)
                 vxtime.hpet_address = 0;
 
         if (hpet_use_timer) {
+                /* set tick_nsec to use the proper rate for HPET */
+                tick_nsec = TICK_NSEC_HPET;
                 cpu_khz = hpet_calibrate_tsc();
                 timename = "HPET";
 #ifdef CONFIG_X86_PM_TIMER
diff --git a/arch/x86_64/kernel/vmlinux.lds.S b/arch/x86_64/kernel/vmlinux.lds.S
index 39ff0708f803..b81f473c4a19 100644
--- a/arch/x86_64/kernel/vmlinux.lds.S
+++ b/arch/x86_64/kernel/vmlinux.lds.S
@@ -65,7 +65,7 @@ SECTIONS
   .data.cacheline_aligned : AT(ADDR(.data.cacheline_aligned) - LOAD_OFFSET) {
         *(.data.cacheline_aligned)
   }
-  . = ALIGN(CONFIG_X86_L1_CACHE_BYTES);
+  . = ALIGN(CONFIG_X86_INTERNODE_CACHE_BYTES);
   .data.read_mostly : AT(ADDR(.data.read_mostly) - LOAD_OFFSET) {
         *(.data.read_mostly)
   }
diff --git a/arch/x86_64/kernel/x8664_ksyms.c b/arch/x86_64/kernel/x8664_ksyms.c
index d78f46056bda..1def21c9f7cd 100644
--- a/arch/x86_64/kernel/x8664_ksyms.c
+++ b/arch/x86_64/kernel/x8664_ksyms.c
@@ -112,7 +112,6 @@ EXPORT_SYMBOL_GPL(unset_nmi_callback);
 #undef memcpy
 #undef memset
 #undef memmove
-#undef strlen
 
 extern void * memset(void *,int,__kernel_size_t);
 extern size_t strlen(const char *);
@@ -121,8 +120,6 @@ extern void * memcpy(void *,const void *,__kernel_size_t);
 extern void * __memcpy(void *,const void *,__kernel_size_t);
 
 EXPORT_SYMBOL(memset);
-EXPORT_SYMBOL(strlen);
-EXPORT_SYMBOL(strpbrk);
 EXPORT_SYMBOL(memmove);
 EXPORT_SYMBOL(memcpy);
 EXPORT_SYMBOL(__memcpy);
diff --git a/arch/x86_64/mm/init.c b/arch/x86_64/mm/init.c
index e5f7f1c34462..4ba34e95d835 100644
--- a/arch/x86_64/mm/init.c
+++ b/arch/x86_64/mm/init.c
@@ -305,7 +305,7 @@ static void __meminit phys_pud_init(pud_t *pud, unsigned long address, unsigned
                 if (paddr >= end)
                         break;
 
-                if (!after_bootmem && !e820_mapped(paddr, paddr+PUD_SIZE, 0)) {
+                if (!after_bootmem && !e820_any_mapped(paddr, paddr+PUD_SIZE, 0)) {
                         set_pud(pud, __pud(0)); 
                         continue;
                 } 
@@ -507,9 +507,8 @@ void __init clear_kernel_mapping(unsigned long address, unsigned long size)
 
 /*
  * Memory hotplug specific functions
- * These are only for non-NUMA machines right now.
  */
-#ifdef CONFIG_MEMORY_HOTPLUG
+#if defined(CONFIG_ACPI_HOTPLUG_MEMORY) || defined(CONFIG_ACPI_HOTPLUG_MEMORY_MODULE)
 
 void online_page(struct page *page)
 {
@@ -520,6 +519,38 @@ void online_page(struct page *page)
         num_physpages++;
 }
 
+#ifndef CONFIG_MEMORY_HOTPLUG
+/*
+ * Memory Hotadd without sparsemem. The mem_maps have been allocated in advance,
+ * just online the pages.
+ */
+int __add_pages(struct zone *z, unsigned long start_pfn, unsigned long nr_pages)
+{
+        int err = -EIO;
+        unsigned long pfn;
+        unsigned long total = 0, mem = 0;
+        for (pfn = start_pfn; pfn < start_pfn + nr_pages; pfn++) {
+                if (pfn_valid(pfn)) {
+                        online_page(pfn_to_page(pfn));
+                        err = 0;
+                        mem++;
+                }
+                total++;
+        }
+        if (!err) {
+                z->spanned_pages += total;
+                z->present_pages += mem;
+                z->zone_pgdat->node_spanned_pages += total;
+                z->zone_pgdat->node_present_pages += mem;
+        }
+        return err;
+}
+#endif
+
+/*
+ * Memory is added always to NORMAL zone. This means you will never get
+ * additional DMA/DMA32 memory.
+ */
 int add_memory(u64 start, u64 size)
 {
         struct pglist_data *pgdat = NODE_DATA(0);
diff --git a/arch/x86_64/mm/numa.c b/arch/x86_64/mm/numa.c
index 4be82d6e2b48..cc02573a3271 100644
--- a/arch/x86_64/mm/numa.c
+++ b/arch/x86_64/mm/numa.c
@@ -100,11 +100,30 @@ int early_pfn_to_nid(unsigned long pfn)
 }
 #endif
 
+static void * __init
+early_node_mem(int nodeid, unsigned long start, unsigned long end,
+              unsigned long size)
+{
+        unsigned long mem = find_e820_area(start, end, size);
+        void *ptr;
+        if (mem != -1L)
+                return __va(mem);
+        ptr = __alloc_bootmem_nopanic(size,
+                                SMP_CACHE_BYTES, __pa(MAX_DMA_ADDRESS));
+        if (ptr == 0) {
+                printk(KERN_ERR "Cannot find %lu bytes in node %d\n",
+                        size, nodeid);
+                return NULL;
+        }
+        return ptr;
+}
+
 /* Initialize bootmem allocator for a node */
 void __init setup_node_bootmem(int nodeid, unsigned long start, unsigned long end)
 { 
         unsigned long start_pfn, end_pfn, bootmap_pages, bootmap_size, bootmap_start; 
         unsigned long nodedata_phys;
+        void *bootmap;
         const int pgdat_size = round_up(sizeof(pg_data_t), PAGE_SIZE);
 
         start = round_up(start, ZONE_ALIGN); 
@@ -114,13 +133,11 @@ void __init setup_node_bootmem(int nodeid, unsigned long start, unsigned long en
         start_pfn = start >> PAGE_SHIFT;
         end_pfn = end >> PAGE_SHIFT;
 
-        nodedata_phys = find_e820_area(start, end, pgdat_size); 
-        if (nodedata_phys == -1L) 
-                panic("Cannot find memory pgdat in node %d\n", nodeid);
-
-        Dprintk("nodedata_phys %lx\n", nodedata_phys); 
+        node_data[nodeid] = early_node_mem(nodeid, start, end, pgdat_size);
+        if (node_data[nodeid] == NULL)
+                return;
+        nodedata_phys = __pa(node_data[nodeid]);
 
-        node_data[nodeid] = phys_to_virt(nodedata_phys);
         memset(NODE_DATA(nodeid), 0, sizeof(pg_data_t));
         NODE_DATA(nodeid)->bdata = &plat_node_bdata[nodeid];
         NODE_DATA(nodeid)->node_start_pfn = start_pfn;
@@ -129,9 +146,15 @@ void __init setup_node_bootmem(int nodeid, unsigned long start, unsigned long en
         /* Find a place for the bootmem map */
         bootmap_pages = bootmem_bootmap_pages(end_pfn - start_pfn); 
         bootmap_start = round_up(nodedata_phys + pgdat_size, PAGE_SIZE);
-        bootmap_start = find_e820_area(bootmap_start, end, bootmap_pages<<PAGE_SHIFT);
-        if (bootmap_start == -1L) 
-                panic("Not enough continuous space for bootmap on node %d", nodeid); 
+        bootmap = early_node_mem(nodeid, bootmap_start, end,
+                                        bootmap_pages<<PAGE_SHIFT);
+        if (bootmap == NULL)  {
+                if (nodedata_phys < start || nodedata_phys >= end)
+                        free_bootmem((unsigned long)node_data[nodeid],pgdat_size);
+                node_data[nodeid] = NULL;
+                return;
+        }
+        bootmap_start = __pa(bootmap);
         Dprintk("bootmap start %lu pages %lu\n", bootmap_start, bootmap_pages); 
         
         bootmap_size = init_bootmem_node(NODE_DATA(nodeid),
@@ -142,6 +165,9 @@ void __init setup_node_bootmem(int nodeid, unsigned long start, unsigned long en
 
         reserve_bootmem_node(NODE_DATA(nodeid), nodedata_phys, pgdat_size); 
         reserve_bootmem_node(NODE_DATA(nodeid), bootmap_start, bootmap_pages<<PAGE_SHIFT);
+#ifdef CONFIG_ACPI_NUMA
+        srat_reserve_add_area(nodeid);
+#endif
         node_set_online(nodeid);
 } 
 
@@ -335,6 +361,8 @@ __init int numa_setup(char *opt)
 #ifdef CONFIG_ACPI_NUMA
         if (!strncmp(opt,"noacpi",6))
                 acpi_numa = -1;
+        if (!strncmp(opt,"hotadd=", 7))
+                hotadd_percent = simple_strtoul(opt+7, NULL, 10);
 #endif
         return 1;
 } 
diff --git a/arch/x86_64/mm/srat.c b/arch/x86_64/mm/srat.c
index 2eb879590dc4..15ae9fcd65a7 100644
--- a/arch/x86_64/mm/srat.c
+++ b/arch/x86_64/mm/srat.c
@@ -15,15 +15,26 @@
 #include <linux/bitmap.h>
 #include <linux/module.h>
 #include <linux/topology.h>
+#include <linux/bootmem.h>
+#include <linux/mm.h>
 #include <asm/proto.h>
 #include <asm/numa.h>
 #include <asm/e820.h>
 
+#if (defined(CONFIG_ACPI_HOTPLUG_MEMORY) || \
+        defined(CONFIG_ACPI_HOTPLUG_MEMORY_MODULE)) \
+                && !defined(CONFIG_MEMORY_HOTPLUG)
+#define RESERVE_HOTADD 1
+#endif
+
 static struct acpi_table_slit *acpi_slit;
 
 static nodemask_t nodes_parsed __initdata;
 static nodemask_t nodes_found __initdata;
 static struct bootnode nodes[MAX_NUMNODES] __initdata;
+static struct bootnode nodes_add[MAX_NUMNODES] __initdata;
+static int found_add_area __initdata;
+int hotadd_percent __initdata = 10;
 static u8 pxm2node[256] = { [0 ... 255] = 0xff };
 
 /* Too small nodes confuse the VM badly. Usually they result
@@ -71,6 +82,10 @@ static __init int conflicting_nodes(unsigned long start, unsigned long end)
 static __init void cutoff_node(int i, unsigned long start, unsigned long end)
 {
         struct bootnode *nd = &nodes[i];
+
+        if (found_add_area)
+                return;
+
         if (nd->start < start) {
                 nd->start = start;
                 if (nd->end < nd->start)
@@ -90,6 +105,8 @@ static __init void bad_srat(void)
         acpi_numa = -1;
         for (i = 0; i < MAX_LOCAL_APIC; i++)
                 apicid_to_node[i] = NUMA_NO_NODE;
+        for (i = 0; i < MAX_NUMNODES; i++)
+                nodes_add[i].start = nodes[i].end = 0;
 }
 
 static __init inline int srat_disabled(void)
@@ -155,11 +172,114 @@ acpi_numa_processor_affinity_init(struct acpi_table_processor_affinity *pa)
                pxm, pa->apic_id, node);
 }
 
+#ifdef RESERVE_HOTADD
+/*
+ * Protect against too large hotadd areas that would fill up memory.
+ */
+static int hotadd_enough_memory(struct bootnode *nd)
+{
+        static unsigned long allocated;
+        static unsigned long last_area_end;
+        unsigned long pages = (nd->end - nd->start) >> PAGE_SHIFT;
+        long mem = pages * sizeof(struct page);
+        unsigned long addr;
+        unsigned long allowed;
+        unsigned long oldpages = pages;
+
+        if (mem < 0)
+                return 0;
+        allowed = (end_pfn - e820_hole_size(0, end_pfn)) * PAGE_SIZE;
+        allowed = (allowed / 100) * hotadd_percent;
+        if (allocated + mem > allowed) {
+                /* Give them at least part of their hotadd memory upto hotadd_percent
+                   It would be better to spread the limit out
+                   over multiple hotplug areas, but that is too complicated
+                   right now */
+                if (allocated >= allowed)
+                        return 0;
+                pages = (allowed - allocated + mem) / sizeof(struct page);
+                mem = pages * sizeof(struct page);
+                nd->end = nd->start + pages*PAGE_SIZE;
+        }
+        /* Not completely fool proof, but a good sanity check */
+        addr = find_e820_area(last_area_end, end_pfn<<PAGE_SHIFT, mem);
+        if (addr == -1UL)
+                return 0;
+        if (pages != oldpages)
+                printk(KERN_NOTICE "SRAT: Hotadd area limited to %lu bytes\n",
+                        pages << PAGE_SHIFT);
+        last_area_end = addr + mem;
+        allocated += mem;
+        return 1;
+}
+
+/*
+ * It is fine to add this area to the nodes data it will be used later
+ * This code supports one contigious hot add area per node.
+ */
+static int reserve_hotadd(int node, unsigned long start, unsigned long end)
+{
+        unsigned long s_pfn = start >> PAGE_SHIFT;
+        unsigned long e_pfn = end >> PAGE_SHIFT;
+        int changed = 0;
+        struct bootnode *nd = &nodes_add[node];
+
+        /* I had some trouble with strange memory hotadd regions breaking
+           the boot. Be very strict here and reject anything unexpected.
+           If you want working memory hotadd write correct SRATs.
+
+           The node size check is a basic sanity check to guard against
+           mistakes */
+        if ((signed long)(end - start) < NODE_MIN_SIZE) {
+                printk(KERN_ERR "SRAT: Hotplug area too small\n");
+                return -1;
+        }
+
+        /* This check might be a bit too strict, but I'm keeping it for now. */
+        if (e820_hole_size(s_pfn, e_pfn) != e_pfn - s_pfn) {
+                printk(KERN_ERR "SRAT: Hotplug area has existing memory\n");
+                return -1;
+        }
+
+        if (!hotadd_enough_memory(&nodes_add[node]))  {
+                printk(KERN_ERR "SRAT: Hotplug area too large\n");
+                return -1;
+        }
+
+        /* Looks good */
+
+        found_add_area = 1;
+        if (nd->start == nd->end) {
+                nd->start = start;
+                nd->end = end;
+                changed = 1;
+        } else {
+                if (nd->start == end) {
+                        nd->start = start;
+                        changed = 1;
+                }
+                if (nd->end == start) {
+                        nd->end = end;
+                        changed = 1;
+                }
+                if (!changed)
+                        printk(KERN_ERR "SRAT: Hotplug zone not continuous. Partly ignored\n");
+        }
+
+        if ((nd->end >> PAGE_SHIFT) > end_pfn)
+                end_pfn = nd->end >> PAGE_SHIFT;
+
+        if (changed)
+                printk(KERN_INFO "SRAT: hot plug zone found %Lx - %Lx\n", nd->start, nd->end);
+        return 0;
+}
+#endif
+
 /* Callback for parsing of the Proximity Domain <-> Memory Area mappings */
 void __init
 acpi_numa_memory_affinity_init(struct acpi_table_memory_affinity *ma)
 {
-        struct bootnode *nd;
+        struct bootnode *nd, oldnode;
         unsigned long start, end;
         int node, pxm;
         int i;
@@ -172,6 +292,8 @@ acpi_numa_memory_affinity_init(struct acpi_table_memory_affinity *ma)
         }
         if (ma->flags.enabled == 0)
                 return;
+        if (ma->flags.hot_pluggable && hotadd_percent == 0)
+                return;
         start = ma->base_addr_lo | ((u64)ma->base_addr_hi << 32);
         end = start + (ma->length_lo | ((u64)ma->length_hi << 32));
         pxm = ma->proximity_domain;
@@ -181,10 +303,6 @@ acpi_numa_memory_affinity_init(struct acpi_table_memory_affinity *ma)
                 bad_srat();
                 return;
         }
-        /* It is fine to add this area to the nodes data it will be used later*/
-        if (ma->flags.hot_pluggable == 1)
-                printk(KERN_INFO "SRAT: hot plug zone found %lx - %lx \n",
-                                start, end);
         i = conflicting_nodes(start, end);
         if (i == node) {
                 printk(KERN_WARNING
@@ -199,6 +317,7 @@ acpi_numa_memory_affinity_init(struct acpi_table_memory_affinity *ma)
                 return;
         }
         nd = &nodes[node];
+        oldnode = *nd;
         if (!node_test_and_set(node, nodes_parsed)) {
                 nd->start = start;
                 nd->end = end;
@@ -208,8 +327,19 @@ acpi_numa_memory_affinity_init(struct acpi_table_memory_affinity *ma)
                 if (nd->end < end)
                         nd->end = end;
         }
+
         printk(KERN_INFO "SRAT: Node %u PXM %u %Lx-%Lx\n", node, pxm,
                nd->start, nd->end);
+
+#ifdef RESERVE_HOTADD
+        if (ma->flags.hot_pluggable && reserve_hotadd(node, start, end) < 0) {
+                /* Ignore hotadd region. Undo damage */
+                printk(KERN_NOTICE "SRAT: Hotplug region ignored\n");
+                *nd = oldnode;
+                if ((nd->start | nd->end) == 0)
+                        node_clear(node, nodes_parsed);
+        }
+#endif
 }
 
 /* Sanity check to catch more bad SRATs (they are amazingly common).
@@ -225,6 +355,9 @@ static int nodes_cover_memory(void)
                 unsigned long e = nodes[i].end >> PAGE_SHIFT;
                 pxmram += e - s;
                 pxmram -= e820_hole_size(s, e);
+                pxmram -= nodes_add[i].end - nodes_add[i].start;
+                if ((long)pxmram < 0)
+                        pxmram = 0;
         }
 
         e820ram = end_pfn - e820_hole_size(0, end_pfn);
@@ -258,7 +391,7 @@ int __init acpi_scan_nodes(unsigned long start, unsigned long end)
 
         /* First clean up the node list */
         for (i = 0; i < MAX_NUMNODES; i++) {
-                cutoff_node(i, start, end);
+                cutoff_node(i, start, end);
                 if ((nodes[i].end - nodes[i].start) < NODE_MIN_SIZE)
                         unparse_node(i);
         }
@@ -282,6 +415,12 @@ int __init acpi_scan_nodes(unsigned long start, unsigned long end)
         /* Finally register nodes */
         for_each_node_mask(i, nodes_parsed)
                 setup_node_bootmem(i, nodes[i].start, nodes[i].end);
+        /* Try again in case setup_node_bootmem missed one due
+           to missing bootmem */
+        for_each_node_mask(i, nodes_parsed)
+                if (!node_online(i))
+                        setup_node_bootmem(i, nodes[i].start, nodes[i].end);
+
         for (i = 0; i < NR_CPUS; i++) { 
                 if (cpu_to_node[i] == NUMA_NO_NODE)
                         continue;
@@ -303,6 +442,25 @@ static int node_to_pxm(int n)
        return 0;
 }
 
+void __init srat_reserve_add_area(int nodeid)
+{
+        if (found_add_area && nodes_add[nodeid].end) {
+                u64 total_mb;
+
+                printk(KERN_INFO "SRAT: Reserving hot-add memory space "
+                                "for node %d at %Lx-%Lx\n",
+                        nodeid, nodes_add[nodeid].start, nodes_add[nodeid].end);
+                total_mb = (nodes_add[nodeid].end - nodes_add[nodeid].start)
+                                        >> PAGE_SHIFT;
+                total_mb *= sizeof(struct page);
+                total_mb >>= 20;
+                printk(KERN_INFO "SRAT: This will cost you %Lu MB of "
+                                "pre-allocated memory.\n", (unsigned long long)total_mb);
+                reserve_bootmem_node(NODE_DATA(nodeid), nodes_add[nodeid].start,
+                               nodes_add[nodeid].end - nodes_add[nodeid].start);
+        }
+}
+
 int __node_distance(int a, int b)
 {
         int index;
diff --git a/arch/x86_64/pci/mmconfig.c b/arch/x86_64/pci/mmconfig.c
index e616500207e4..a2060e4d5de6 100644
--- a/arch/x86_64/pci/mmconfig.c
+++ b/arch/x86_64/pci/mmconfig.c
@@ -9,11 +9,16 @@
 #include <linux/init.h>
 #include <linux/acpi.h>
 #include <linux/bitmap.h>
+#include <asm/e820.h>
+
 #include "pci.h"
 
 #define MMCONFIG_APER_SIZE (256*1024*1024)
+/* Verify the first 16 busses. We assume that systems with more busses
+   get MCFG right. */
+#define MAX_CHECK_BUS 16
 
-static DECLARE_BITMAP(fallback_slots, 32);
+static DECLARE_BITMAP(fallback_slots, 32*MAX_CHECK_BUS);
 
 /* Static virtual mapping of the MMCONFIG aperture */
 struct mmcfg_virt {
@@ -55,7 +60,8 @@ static char __iomem *get_virt(unsigned int seg, unsigned bus)
 static char __iomem *pci_dev_base(unsigned int seg, unsigned int bus, unsigned int devfn)
 {
         char __iomem *addr;
-        if (seg == 0 && bus == 0 && test_bit(PCI_SLOT(devfn), fallback_slots))
+        if (seg == 0 && bus < MAX_CHECK_BUS &&
+                test_bit(32*bus + PCI_SLOT(devfn), fallback_slots))
                 return NULL;
         addr = get_virt(seg, bus);
         if (!addr)
@@ -69,8 +75,10 @@ static int pci_mmcfg_read(unsigned int seg, unsigned int bus,
         char __iomem *addr;
 
         /* Why do we have this when nobody checks it. How about a BUG()!? -AK */
-        if (unlikely(!value || (bus > 255) || (devfn > 255) || (reg > 4095)))
+        if (unlikely((bus > 255) || (devfn > 255) || (reg > 4095))) {
+                *value = -1;
                 return -EINVAL;
+        }
 
         addr = pci_dev_base(seg, bus, devfn);
         if (!addr)
@@ -129,21 +137,26 @@ static struct pci_raw_ops pci_mmcfg = {
    Normally this can be expressed in the MCFG by not listing them
    and assigning suitable _SEGs, but this isn't implemented in some BIOS.
    Instead try to discover all devices on bus 0 that are unreachable using MM
-   and fallback for them.
-   We only do this for bus 0/seg 0 */
+   and fallback for them. */
 static __init void unreachable_devices(void)
 {
-        int i;
-        for (i = 0; i < 32; i++) {
-                u32 val1;
-                char __iomem *addr;
-
-                pci_conf1_read(0, 0, PCI_DEVFN(i,0), 0, 4, &val1);
-                if (val1 == 0xffffffff)
-                        continue;
-                addr = pci_dev_base(0, 0, PCI_DEVFN(i, 0));
-                if (addr == NULL|| readl(addr) != val1) {
-                        set_bit(i, fallback_slots);
+        int i, k;
+        /* Use the max bus number from ACPI here? */
+        for (k = 0; k < MAX_CHECK_BUS; k++) {
+                for (i = 0; i < 32; i++) {
+                        u32 val1;
+                        char __iomem *addr;
+
+                        pci_conf1_read(0, k, PCI_DEVFN(i,0), 0, 4, &val1);
+                        if (val1 == 0xffffffff)
+                                continue;
+                        addr = pci_dev_base(0, k, PCI_DEVFN(i, 0));
+                        if (addr == NULL|| readl(addr) != val1) {
+                                set_bit(i + 32*k, fallback_slots);
+                                printk(KERN_NOTICE
+                                "PCI: No mmconfig possible on device %x:%x\n",
+                                        k, i);
+                        }
                 }
         }
 }
@@ -161,6 +174,14 @@ void __init pci_mmcfg_init(void)
             (pci_mmcfg_config[0].base_address == 0))
                 return;
 
+        if (!e820_all_mapped(pci_mmcfg_config[0].base_address,
+                        pci_mmcfg_config[0].base_address + MMCONFIG_APER_SIZE,
+                        E820_RESERVED)) {
+                printk(KERN_ERR "PCI: BIOS Bug: MCFG area is not E820-reserved\n");
+                printk(KERN_ERR "PCI: Not using MMCONFIG.\n");
+                return;
+        }
+
         /* RED-PEN i386 doesn't do _nocache right now */
         pci_mmcfg_virt = kmalloc(sizeof(*pci_mmcfg_virt) * pci_mmcfg_config_num, GFP_KERNEL);
         if (pci_mmcfg_virt == NULL) {
diff --git a/arch/xtensa/kernel/xtensa_ksyms.c b/arch/xtensa/kernel/xtensa_ksyms.c
index 152b9370789b..a15b6e3e72c8 100644
--- a/arch/xtensa/kernel/xtensa_ksyms.c
+++ b/arch/xtensa/kernel/xtensa_ksyms.c
@@ -48,7 +48,6 @@ EXPORT_SYMBOL(memchr);
 EXPORT_SYMBOL(strcat);
 EXPORT_SYMBOL(strchr);
 EXPORT_SYMBOL(strlen);
-EXPORT_SYMBOL(strpbrk);
 EXPORT_SYMBOL(strncat);
 EXPORT_SYMBOL(strnlen);
 EXPORT_SYMBOL(strrchr);
diff --git a/block/ll_rw_blk.c b/block/ll_rw_blk.c
index 5b26af8597f3..e112d1a5dab6 100644
--- a/block/ll_rw_blk.c
+++ b/block/ll_rw_blk.c
@@ -1740,7 +1740,7 @@ EXPORT_SYMBOL(blk_run_queue);
 
 /**
  * blk_cleanup_queue: - release a &request_queue_t when it is no longer needed
- * @q:    the request queue to be released
+ * @kobj:    the kobj belonging of the request queue to be released
  *
  * Description:
  *     blk_cleanup_queue is the pair to blk_init_queue() or
diff --git a/drivers/Makefile b/drivers/Makefile
index d6e8ffbd8132..447d8e68887a 100644
--- a/drivers/Makefile
+++ b/drivers/Makefile
@@ -25,9 +25,6 @@ obj-$(CONFIG_CONNECTOR)		+= connector/
 obj-$(CONFIG_FB_I810)           += video/i810/
 obj-$(CONFIG_FB_INTEL)          += video/intelfb/
 
-# we also need input/serio early so serio bus is initialized by the time
-# serial drivers start registering their serio ports
-obj-$(CONFIG_SERIO)             += input/serio/
 obj-y                           += serial/
 obj-$(CONFIG_PARPORT)           += parport/
 obj-y                           += base/ block/ misc/ mfd/ net/ media/
@@ -53,6 +50,7 @@ obj-$(CONFIG_TC)		+= tc/
 obj-$(CONFIG_USB)               += usb/
 obj-$(CONFIG_PCI)               += usb/
 obj-$(CONFIG_USB_GADGET)        += usb/gadget/
+obj-$(CONFIG_SERIO)             += input/serio/
 obj-$(CONFIG_GAMEPORT)          += input/gameport/
 obj-$(CONFIG_INPUT)             += input/
 obj-$(CONFIG_I2O)               += message/
@@ -71,6 +69,7 @@ obj-$(CONFIG_CPU_FREQ)		+= cpufreq/
 obj-$(CONFIG_MMC)               += mmc/
 obj-$(CONFIG_NEW_LEDS)          += leds/
 obj-$(CONFIG_INFINIBAND)        += infiniband/
+obj-$(CONFIG_IPATH_CORE)        += infiniband/
 obj-$(CONFIG_SGI_SN)            += sn/
 obj-y                           += firmware/
 obj-$(CONFIG_CRYPTO)            += crypto/
diff --git a/drivers/acpi/Kconfig b/drivers/acpi/Kconfig
index 5cb96300eb0f..c24652d31bf9 100644
--- a/drivers/acpi/Kconfig
+++ b/drivers/acpi/Kconfig
@@ -329,7 +329,7 @@ config ACPI_CONTAINER
 config ACPI_HOTPLUG_MEMORY
         tristate "Memory Hotplug"
         depends on ACPI
-        depends on MEMORY_HOTPLUG
+        depends on MEMORY_HOTPLUG || X86_64
         default n
         help
           This driver adds supports for ACPI Memory Hotplug.  This driver
diff --git a/drivers/base/node.c b/drivers/base/node.c
index 16c513aa4d48..c80c3aeed004 100644
--- a/drivers/base/node.c
+++ b/drivers/base/node.c
@@ -106,7 +106,7 @@ static ssize_t node_read_numastat(struct sys_device * dev, char * buf)
         other_node = 0;
         for (i = 0; i < MAX_NR_ZONES; i++) {
                 struct zone *z = &pg->node_zones[i];
-                for (cpu = 0; cpu < NR_CPUS; cpu++) {
+                for_each_online_cpu(cpu) {
                         struct per_cpu_pageset *ps = zone_pcp(z,cpu);
                         numa_hit += ps->numa_hit;
                         numa_miss += ps->numa_miss;
diff --git a/drivers/bluetooth/bluecard_cs.c b/drivers/bluetooth/bluecard_cs.c
index 9888bc151755..473a13b22b29 100644
--- a/drivers/bluetooth/bluecard_cs.c
+++ b/drivers/bluetooth/bluecard_cs.c
@@ -65,7 +65,7 @@ MODULE_LICENSE("GPL");
 
 
 typedef struct bluecard_info_t {
-        dev_link_t link;
+        struct pcmcia_device *p_dev;
         dev_node_t node;
 
         struct hci_dev *hdev;
@@ -85,8 +85,8 @@ typedef struct bluecard_info_t {
 } bluecard_info_t;
 
 
-static void bluecard_config(dev_link_t *link);
-static void bluecard_release(dev_link_t *link);
+static int bluecard_config(struct pcmcia_device *link);
+static void bluecard_release(struct pcmcia_device *link);
 
 static void bluecard_detach(struct pcmcia_device *p_dev);
 
@@ -162,7 +162,7 @@ static void bluecard_detach(struct pcmcia_device *p_dev);
 static void bluecard_activity_led_timeout(u_long arg)
 {
         bluecard_info_t *info = (bluecard_info_t *)arg;
-        unsigned int iobase = info->link.io.BasePort1;
+        unsigned int iobase = info->p_dev->io.BasePort1;
 
         if (!test_bit(CARD_HAS_PCCARD_ID, &(info->hw_state)))
                 return;
@@ -179,7 +179,7 @@ static void bluecard_activity_led_timeout(u_long arg)
 
 static void bluecard_enable_activity_led(bluecard_info_t *info)
 {
-        unsigned int iobase = info->link.io.BasePort1;
+        unsigned int iobase = info->p_dev->io.BasePort1;
 
         if (!test_bit(CARD_HAS_PCCARD_ID, &(info->hw_state)))
                 return;
@@ -235,7 +235,7 @@ static void bluecard_write_wakeup(bluecard_info_t *info)
         }
 
         do {
-                register unsigned int iobase = info->link.io.BasePort1;
+                register unsigned int iobase = info->p_dev->io.BasePort1;
                 register unsigned int offset;
                 register unsigned char command;
                 register unsigned long ready_bit;
@@ -244,7 +244,7 @@ static void bluecard_write_wakeup(bluecard_info_t *info)
 
                 clear_bit(XMIT_WAKEUP, &(info->tx_state));
 
-                if (!(info->link.state & DEV_PRESENT))
+                if (!pcmcia_dev_present(info->p_dev))
                         return;
 
                 if (test_bit(XMIT_BUFFER_NUMBER, &(info->tx_state))) {
@@ -382,7 +382,7 @@ static void bluecard_receive(bluecard_info_t *info, unsigned int offset)
                 return;
         }
 
-        iobase = info->link.io.BasePort1;
+        iobase = info->p_dev->io.BasePort1;
 
         if (test_bit(XMIT_SENDING_READY, &(info->tx_state)))
                 bluecard_enable_activity_led(info);
@@ -512,7 +512,7 @@ static irqreturn_t bluecard_interrupt(int irq, void *dev_inst, struct pt_regs *r
         if (!test_bit(CARD_READY, &(info->hw_state)))
                 return IRQ_HANDLED;
 
-        iobase = info->link.io.BasePort1;
+        iobase = info->p_dev->io.BasePort1;
 
         spin_lock(&(info->lock));
 
@@ -626,7 +626,7 @@ static int bluecard_hci_flush(struct hci_dev *hdev)
 static int bluecard_hci_open(struct hci_dev *hdev)
 {
         bluecard_info_t *info = (bluecard_info_t *)(hdev->driver_data);
-        unsigned int iobase = info->link.io.BasePort1;
+        unsigned int iobase = info->p_dev->io.BasePort1;
 
         if (test_bit(CARD_HAS_PCCARD_ID, &(info->hw_state)))
                 bluecard_hci_set_baud_rate(hdev, DEFAULT_BAUD_RATE);
@@ -646,7 +646,7 @@ static int bluecard_hci_open(struct hci_dev *hdev)
 static int bluecard_hci_close(struct hci_dev *hdev)
 {
         bluecard_info_t *info = (bluecard_info_t *)(hdev->driver_data);
-        unsigned int iobase = info->link.io.BasePort1;
+        unsigned int iobase = info->p_dev->io.BasePort1;
 
         if (!test_and_clear_bit(HCI_RUNNING, &(hdev->flags)))
                 return 0;
@@ -713,7 +713,7 @@ static int bluecard_hci_ioctl(struct hci_dev *hdev, unsigned int cmd, unsigned l
 
 static int bluecard_open(bluecard_info_t *info)
 {
-        unsigned int iobase = info->link.io.BasePort1;
+        unsigned int iobase = info->p_dev->io.BasePort1;
         struct hci_dev *hdev;
         unsigned char id;
 
@@ -831,7 +831,7 @@ static int bluecard_open(bluecard_info_t *info)
 
 static int bluecard_close(bluecard_info_t *info)
 {
-        unsigned int iobase = info->link.io.BasePort1;
+        unsigned int iobase = info->p_dev->io.BasePort1;
         struct hci_dev *hdev = info->hdev;
 
         if (!hdev)
@@ -856,17 +856,16 @@ static int bluecard_close(bluecard_info_t *info)
         return 0;
 }
 
-static int bluecard_attach(struct pcmcia_device *p_dev)
+static int bluecard_probe(struct pcmcia_device *link)
 {
         bluecard_info_t *info;
-        dev_link_t *link;
 
         /* Create new info device */
         info = kzalloc(sizeof(*info), GFP_KERNEL);
         if (!info)
                 return -ENOMEM;
 
-        link = &info->link;
+        info->p_dev = link;
         link->priv = info;
 
         link->io.Attributes1 = IO_DATA_PATH_WIDTH_8;
@@ -878,32 +877,22 @@ static int bluecard_attach(struct pcmcia_device *p_dev)
         link->irq.Instance = info;
 
         link->conf.Attributes = CONF_ENABLE_IRQ;
-        link->conf.Vcc = 50;
         link->conf.IntType = INT_MEMORY_AND_IO;
 
-        link->handle = p_dev;
-        p_dev->instance = link;
-
-        link->state |= DEV_PRESENT | DEV_CONFIG_PENDING;
-        bluecard_config(link);
-
-        return 0;
+        return bluecard_config(link);
 }
 
 
-static void bluecard_detach(struct pcmcia_device *p_dev)
+static void bluecard_detach(struct pcmcia_device *link)
 {
-        dev_link_t *link = dev_to_instance(p_dev);
         bluecard_info_t *info = link->priv;
 
-        if (link->state & DEV_CONFIG)
-                bluecard_release(link);
-
+        bluecard_release(link);
         kfree(info);
 }
 
 
-static int first_tuple(client_handle_t handle, tuple_t *tuple, cisparse_t *parse)
+static int first_tuple(struct pcmcia_device *handle, tuple_t *tuple, cisparse_t *parse)
 {
         int i;
 
@@ -918,14 +907,12 @@ static int first_tuple(client_handle_t handle, tuple_t *tuple, cisparse_t *parse
         return pcmcia_parse_tuple(handle, tuple, parse);
 }
 
-static void bluecard_config(dev_link_t *link)
+static int bluecard_config(struct pcmcia_device *link)
 {
-        client_handle_t handle = link->handle;
         bluecard_info_t *info = link->priv;
         tuple_t tuple;
         u_short buf[256];
         cisparse_t parse;
-        config_info_t config;
         int i, n, last_ret, last_fn;
 
         tuple.TupleData = (cisdata_t *)buf;
@@ -935,7 +922,7 @@ static void bluecard_config(dev_link_t *link)
 
         /* Get configuration register information */
         tuple.DesiredTuple = CISTPL_CONFIG;
-        last_ret = first_tuple(handle, &tuple, &parse);
+        last_ret = first_tuple(link, &tuple, &parse);
         if (last_ret != CS_SUCCESS) {
                 last_fn = ParseTuple;
                 goto cs_failed;
@@ -943,36 +930,31 @@ static void bluecard_config(dev_link_t *link)
         link->conf.ConfigBase = parse.config.base;
         link->conf.Present = parse.config.rmask[0];
 
-        /* Configure card */
-        link->state |= DEV_CONFIG;
-        i = pcmcia_get_configuration_info(handle, &config);
-        link->conf.Vcc = config.Vcc;
-
         link->conf.ConfigIndex = 0x20;
         link->io.NumPorts1 = 64;
         link->io.IOAddrLines = 6;
 
         for (n = 0; n < 0x400; n += 0x40) {
                 link->io.BasePort1 = n ^ 0x300;
-                i = pcmcia_request_io(link->handle, &link->io);
+                i = pcmcia_request_io(link, &link->io);
                 if (i == CS_SUCCESS)
                         break;
         }
 
         if (i != CS_SUCCESS) {
-                cs_error(link->handle, RequestIO, i);
+                cs_error(link, RequestIO, i);
                 goto failed;
         }
 
-        i = pcmcia_request_irq(link->handle, &link->irq);
+        i = pcmcia_request_irq(link, &link->irq);
         if (i != CS_SUCCESS) {
-                cs_error(link->handle, RequestIRQ, i);
+                cs_error(link, RequestIRQ, i);
                 link->irq.AssignedIRQ = 0;
         }
 
-        i = pcmcia_request_configuration(link->handle, &link->conf);
+        i = pcmcia_request_configuration(link, &link->conf);
         if (i != CS_SUCCESS) {
-                cs_error(link->handle, RequestConfiguration, i);
+                cs_error(link, RequestConfiguration, i);
                 goto failed;
         }
 
@@ -980,57 +962,28 @@ static void bluecard_config(dev_link_t *link)
                 goto failed;
 
         strcpy(info->node.dev_name, info->hdev->name);
-        link->dev = &info->node;
-        link->state &= ~DEV_CONFIG_PENDING;
+        link->dev_node = &info->node;
 
-        return;
+        return 0;
 
 cs_failed:
-        cs_error(link->handle, last_fn, last_ret);
+        cs_error(link, last_fn, last_ret);
 
 failed:
         bluecard_release(link);
+        return -ENODEV;
 }
 
 
-static void bluecard_release(dev_link_t *link)
+static void bluecard_release(struct pcmcia_device *link)
 {
         bluecard_info_t *info = link->priv;
 
-        if (link->state & DEV_PRESENT)
-                bluecard_close(info);
+        bluecard_close(info);
 
         del_timer(&(info->timer));
 
-        link->dev = NULL;
-
-        pcmcia_release_configuration(link->handle);
-        pcmcia_release_io(link->handle, &link->io);
-        pcmcia_release_irq(link->handle, &link->irq);
-
-        link->state &= ~DEV_CONFIG;
-}
-
-static int bluecard_suspend(struct pcmcia_device *dev)
-{
-        dev_link_t *link = dev_to_instance(dev);
-
-        link->state |= DEV_SUSPEND;
-        if (link->state & DEV_CONFIG)
-                pcmcia_release_configuration(link->handle);
-
-        return 0;
-}
-
-static int bluecard_resume(struct pcmcia_device *dev)
-{
-        dev_link_t *link = dev_to_instance(dev);
-
-        link->state &= ~DEV_SUSPEND;
-        if (DEV_OK(link))
-                pcmcia_request_configuration(link->handle, &link->conf);
-
-        return 0;
+        pcmcia_disable_device(link);
 }
 
 static struct pcmcia_device_id bluecard_ids[] = {
@@ -1046,11 +999,9 @@ static struct pcmcia_driver bluecard_driver = {
         .drv            = {
                 .name   = "bluecard_cs",
         },
-        .probe          = bluecard_attach,
+        .probe          = bluecard_probe,
         .remove         = bluecard_detach,
         .id_table       = bluecard_ids,
-        .suspend        = bluecard_suspend,
-        .resume         = bluecard_resume,
 };
 
 static int __init init_bluecard_cs(void)
diff --git a/drivers/bluetooth/bt3c_cs.c b/drivers/bluetooth/bt3c_cs.c
index 7e21b1ff27c4..b94ac2f9f7ba 100644
--- a/drivers/bluetooth/bt3c_cs.c
+++ b/drivers/bluetooth/bt3c_cs.c
@@ -72,7 +72,7 @@ MODULE_LICENSE("GPL");
 
 
 typedef struct bt3c_info_t {
-        dev_link_t link;
+        struct pcmcia_device *p_dev;
         dev_node_t node;
 
         struct hci_dev *hdev;
@@ -88,8 +88,8 @@ typedef struct bt3c_info_t {
 } bt3c_info_t;
 
 
-static void bt3c_config(dev_link_t *link);
-static void bt3c_release(dev_link_t *link);
+static int bt3c_config(struct pcmcia_device *link);
+static void bt3c_release(struct pcmcia_device *link);
 
 static void bt3c_detach(struct pcmcia_device *p_dev);
 
@@ -191,11 +191,11 @@ static void bt3c_write_wakeup(bt3c_info_t *info)
                 return;
 
         do {
-                register unsigned int iobase = info->link.io.BasePort1;
+                register unsigned int iobase = info->p_dev->io.BasePort1;
                 register struct sk_buff *skb;
                 register int len;
 
-                if (!(info->link.state & DEV_PRESENT))
+                if (!pcmcia_dev_present(info->p_dev))
                         break;
 
 
@@ -229,7 +229,7 @@ static void bt3c_receive(bt3c_info_t *info)
                 return;
         }
 
-        iobase = info->link.io.BasePort1;
+        iobase = info->p_dev->io.BasePort1;
 
         avail = bt3c_read(iobase, 0x7006);
         //printk("bt3c_cs: receiving %d bytes\n", avail);
@@ -350,7 +350,7 @@ static irqreturn_t bt3c_interrupt(int irq, void *dev_inst, struct pt_regs *regs)
                 return IRQ_NONE;
         }
 
-        iobase = info->link.io.BasePort1;
+        iobase = info->p_dev->io.BasePort1;
 
         spin_lock(&(info->lock));
 
@@ -481,7 +481,7 @@ static int bt3c_load_firmware(bt3c_info_t *info, unsigned char *firmware, int co
         unsigned int iobase, size, addr, fcs, tmp;
         int i, err = 0;
 
-        iobase = info->link.io.BasePort1;
+        iobase = info->p_dev->io.BasePort1;
 
         /* Reset */
         bt3c_io_write(iobase, 0x8040, 0x0404);
@@ -562,7 +562,6 @@ static int bt3c_open(bt3c_info_t *info)
 {
         const struct firmware *firmware;
         struct hci_dev *hdev;
-        client_handle_t handle;
         int err;
 
         spin_lock_init(&(info->lock));
@@ -594,10 +593,8 @@ static int bt3c_open(bt3c_info_t *info)
 
         hdev->owner = THIS_MODULE;
 
-        handle = info->link.handle;
-
         /* Load firmware */
-        err = request_firmware(&firmware, "BT3CPCC.bin", &handle_to_dev(handle));
+        err = request_firmware(&firmware, "BT3CPCC.bin", &info->p_dev->dev);
         if (err < 0) {
                 BT_ERR("Firmware request failed");
                 goto error;
@@ -648,17 +645,16 @@ static int bt3c_close(bt3c_info_t *info)
         return 0;
 }
 
-static int bt3c_attach(struct pcmcia_device *p_dev)
+static int bt3c_probe(struct pcmcia_device *link)
 {
         bt3c_info_t *info;
-        dev_link_t *link;
 
         /* Create new info device */
         info = kzalloc(sizeof(*info), GFP_KERNEL);
         if (!info)
                 return -ENOMEM;
 
-        link = &info->link;
+        info->p_dev = link;
         link->priv = info;
 
         link->io.Attributes1 = IO_DATA_PATH_WIDTH_8;
@@ -670,31 +666,21 @@ static int bt3c_attach(struct pcmcia_device *p_dev)
         link->irq.Instance = info;
 
         link->conf.Attributes = CONF_ENABLE_IRQ;
-        link->conf.Vcc = 50;
         link->conf.IntType = INT_MEMORY_AND_IO;
 
-        link->handle = p_dev;
-        p_dev->instance = link;
-
-        link->state |= DEV_PRESENT | DEV_CONFIG_PENDING;
-        bt3c_config(link);
-
-        return 0;
+        return bt3c_config(link);
 }
 
 
-static void bt3c_detach(struct pcmcia_device *p_dev)
+static void bt3c_detach(struct pcmcia_device *link)
 {
-        dev_link_t *link = dev_to_instance(p_dev);
         bt3c_info_t *info = link->priv;
 
-        if (link->state & DEV_CONFIG)
-                bt3c_release(link);
-
+        bt3c_release(link);
         kfree(info);
 }
 
-static int get_tuple(client_handle_t handle, tuple_t *tuple, cisparse_t *parse)
+static int get_tuple(struct pcmcia_device *handle, tuple_t *tuple, cisparse_t *parse)
 {
         int i;
 
@@ -705,30 +691,28 @@ static int get_tuple(client_handle_t handle, tuple_t *tuple, cisparse_t *parse)
         return pcmcia_parse_tuple(handle, tuple, parse);
 }
 
-static int first_tuple(client_handle_t handle, tuple_t *tuple, cisparse_t *parse)
+static int first_tuple(struct pcmcia_device *handle, tuple_t *tuple, cisparse_t *parse)
 {
         if (pcmcia_get_first_tuple(handle, tuple) != CS_SUCCESS)
                 return CS_NO_MORE_ITEMS;
         return get_tuple(handle, tuple, parse);
 }
 
-static int next_tuple(client_handle_t handle, tuple_t *tuple, cisparse_t *parse)
+static int next_tuple(struct pcmcia_device *handle, tuple_t *tuple, cisparse_t *parse)
 {
         if (pcmcia_get_next_tuple(handle, tuple) != CS_SUCCESS)
                 return CS_NO_MORE_ITEMS;
         return get_tuple(handle, tuple, parse);
 }
 
-static void bt3c_config(dev_link_t *link)
+static int bt3c_config(struct pcmcia_device *link)
 {
         static kio_addr_t base[5] = { 0x3f8, 0x2f8, 0x3e8, 0x2e8, 0x0 };
-        client_handle_t handle = link->handle;
         bt3c_info_t *info = link->priv;
         tuple_t tuple;
         u_short buf[256];
         cisparse_t parse;
         cistpl_cftable_entry_t *cf = &parse.cftable_entry;
-        config_info_t config;
         int i, j, try, last_ret, last_fn;
 
         tuple.TupleData = (cisdata_t *)buf;
@@ -738,7 +722,7 @@ static void bt3c_config(dev_link_t *link)
 
         /* Get configuration register information */
         tuple.DesiredTuple = CISTPL_CONFIG;
-        last_ret = first_tuple(handle, &tuple, &parse);
+        last_ret = first_tuple(link, &tuple, &parse);
         if (last_ret != CS_SUCCESS) {
                 last_fn = ParseTuple;
                 goto cs_failed;
@@ -746,11 +730,6 @@ static void bt3c_config(dev_link_t *link)
         link->conf.ConfigBase = parse.config.base;
         link->conf.Present = parse.config.rmask[0];
 
-        /* Configure card */
-        link->state |= DEV_CONFIG;
-        i = pcmcia_get_configuration_info(handle, &config);
-        link->conf.Vcc = config.Vcc;
-
         /* First pass: look for a config entry that looks normal. */
         tuple.TupleData = (cisdata_t *)buf;
         tuple.TupleOffset = 0;
@@ -759,59 +738,59 @@ static void bt3c_config(dev_link_t *link)
         tuple.DesiredTuple = CISTPL_CFTABLE_ENTRY;
         /* Two tries: without IO aliases, then with aliases */
         for (try = 0; try < 2; try++) {
-                i = first_tuple(handle, &tuple, &parse);
+                i = first_tuple(link, &tuple, &parse);
                 while (i != CS_NO_MORE_ITEMS) {
                         if (i != CS_SUCCESS)
                                 goto next_entry;
                         if (cf->vpp1.present & (1 << CISTPL_POWER_VNOM))
-                                link->conf.Vpp1 = link->conf.Vpp2 = cf->vpp1.param[CISTPL_POWER_VNOM] / 10000;
+                                link->conf.Vpp = cf->vpp1.param[CISTPL_POWER_VNOM] / 10000;
                         if ((cf->io.nwin > 0) && (cf->io.win[0].len == 8) && (cf->io.win[0].base != 0)) {
                                 link->conf.ConfigIndex = cf->index;
                                 link->io.BasePort1 = cf->io.win[0].base;
                                 link->io.IOAddrLines = (try == 0) ? 16 : cf->io.flags & CISTPL_IO_LINES_MASK;
-                                i = pcmcia_request_io(link->handle, &link->io);
+                                i = pcmcia_request_io(link, &link->io);
                                 if (i == CS_SUCCESS)
                                         goto found_port;
                         }
 next_entry:
-                        i = next_tuple(handle, &tuple, &parse);
+                        i = next_tuple(link, &tuple, &parse);
                 }
         }
 
         /* Second pass: try to find an entry that isn't picky about
            its base address, then try to grab any standard serial port
            address, and finally try to get any free port. */
-        i = first_tuple(handle, &tuple, &parse);
+        i = first_tuple(link, &tuple, &parse);
         while (i != CS_NO_MORE_ITEMS) {
                 if ((i == CS_SUCCESS) && (cf->io.nwin > 0) && ((cf->io.flags & CISTPL_IO_LINES_MASK) <= 3)) {
                         link->conf.ConfigIndex = cf->index;
                         for (j = 0; j < 5; j++) {
                                 link->io.BasePort1 = base[j];
                                 link->io.IOAddrLines = base[j] ? 16 : 3;
-                                i = pcmcia_request_io(link->handle, &link->io);
+                                i = pcmcia_request_io(link, &link->io);
                                 if (i == CS_SUCCESS)
                                         goto found_port;
                         }
                 }
-                i = next_tuple(handle, &tuple, &parse);
+                i = next_tuple(link, &tuple, &parse);
         }
 
 found_port:
         if (i != CS_SUCCESS) {
                 BT_ERR("No usable port range found");
-                cs_error(link->handle, RequestIO, i);
+                cs_error(link, RequestIO, i);
                 goto failed;
         }
 
-        i = pcmcia_request_irq(link->handle, &link->irq);
+        i = pcmcia_request_irq(link, &link->irq);
         if (i != CS_SUCCESS) {
-                cs_error(link->handle, RequestIRQ, i);
+                cs_error(link, RequestIRQ, i);
                 link->irq.AssignedIRQ = 0;
         }
 
-        i = pcmcia_request_configuration(link->handle, &link->conf);
+        i = pcmcia_request_configuration(link, &link->conf);
         if (i != CS_SUCCESS) {
-                cs_error(link->handle, RequestConfiguration, i);
+                cs_error(link, RequestConfiguration, i);
                 goto failed;
         }
 
@@ -819,55 +798,26 @@ found_port:
                 goto failed;
 
         strcpy(info->node.dev_name, info->hdev->name);
-        link->dev = &info->node;
-        link->state &= ~DEV_CONFIG_PENDING;
+        link->dev_node = &info->node;
 
-        return;
+        return 0;
 
 cs_failed:
-        cs_error(link->handle, last_fn, last_ret);
+        cs_error(link, last_fn, last_ret);
 
 failed:
         bt3c_release(link);
+        return -ENODEV;
 }
 
 
-static void bt3c_release(dev_link_t *link)
+static void bt3c_release(struct pcmcia_device *link)
 {
         bt3c_info_t *info = link->priv;
 
-        if (link->state & DEV_PRESENT)
-                bt3c_close(info);
-
-        link->dev = NULL;
-
-        pcmcia_release_configuration(link->handle);
-        pcmcia_release_io(link->handle, &link->io);
-        pcmcia_release_irq(link->handle, &link->irq);
-
-        link->state &= ~DEV_CONFIG;
-}
-
-static int bt3c_suspend(struct pcmcia_device *dev)
-{
-        dev_link_t *link = dev_to_instance(dev);
+        bt3c_close(info);
 
-        link->state |= DEV_SUSPEND;
-        if (link->state & DEV_CONFIG)
-                pcmcia_release_configuration(link->handle);
-
-        return 0;
-}
-
-static int bt3c_resume(struct pcmcia_device *dev)
-{
-        dev_link_t *link = dev_to_instance(dev);
-
-        link->state &= ~DEV_SUSPEND;
-        if (DEV_OK(link))
-                pcmcia_request_configuration(link->handle, &link->conf);
-
-        return 0;
+        pcmcia_disable_device(link);
 }
 
 
@@ -882,11 +832,9 @@ static struct pcmcia_driver bt3c_driver = {
         .drv            = {
                 .name   = "bt3c_cs",
         },
-        .probe          = bt3c_attach,
+        .probe          = bt3c_probe,
         .remove         = bt3c_detach,
         .id_table       = bt3c_ids,
-        .suspend        = bt3c_suspend,
-        .resume         = bt3c_resume,
 };
 
 static int __init init_bt3c_cs(void)
diff --git a/drivers/bluetooth/btuart_cs.c b/drivers/bluetooth/btuart_cs.c
index 7b4bff4cfa2d..9ce4c93467e5 100644
--- a/drivers/bluetooth/btuart_cs.c
+++ b/drivers/bluetooth/btuart_cs.c
@@ -68,7 +68,7 @@ MODULE_LICENSE("GPL");
 
 
 typedef struct btuart_info_t {
-        dev_link_t link;
+        struct pcmcia_device *p_dev;
         dev_node_t node;
 
         struct hci_dev *hdev;
@@ -84,8 +84,8 @@ typedef struct btuart_info_t {
 } btuart_info_t;
 
 
-static void btuart_config(dev_link_t *link);
-static void btuart_release(dev_link_t *link);
+static int btuart_config(struct pcmcia_device *link);
+static void btuart_release(struct pcmcia_device *link);
 
 static void btuart_detach(struct pcmcia_device *p_dev);
 
@@ -146,13 +146,13 @@ static void btuart_write_wakeup(btuart_info_t *info)
         }
 
         do {
-                register unsigned int iobase = info->link.io.BasePort1;
+                register unsigned int iobase = info->p_dev->io.BasePort1;
                 register struct sk_buff *skb;
                 register int len;
 
                 clear_bit(XMIT_WAKEUP, &(info->tx_state));
 
-                if (!(info->link.state & DEV_PRESENT))
+                if (!pcmcia_dev_present(info->p_dev))
                         return;
 
                 if (!(skb = skb_dequeue(&(info->txq))))
@@ -187,7 +187,7 @@ static void btuart_receive(btuart_info_t *info)
                 return;
         }
 
-        iobase = info->link.io.BasePort1;
+        iobase = info->p_dev->io.BasePort1;
 
         do {
                 info->hdev->stat.byte_rx++;
@@ -301,7 +301,7 @@ static irqreturn_t btuart_interrupt(int irq, void *dev_inst, struct pt_regs *reg
                 return IRQ_NONE;
         }
 
-        iobase = info->link.io.BasePort1;
+        iobase = info->p_dev->io.BasePort1;
 
         spin_lock(&(info->lock));
 
@@ -357,7 +357,7 @@ static void btuart_change_speed(btuart_info_t *info, unsigned int speed)
                 return;
         }
 
-        iobase = info->link.io.BasePort1;
+        iobase = info->p_dev->io.BasePort1;
 
         spin_lock_irqsave(&(info->lock), flags);
 
@@ -481,7 +481,7 @@ static int btuart_hci_ioctl(struct hci_dev *hdev, unsigned int cmd, unsigned lon
 static int btuart_open(btuart_info_t *info)
 {
         unsigned long flags;
-        unsigned int iobase = info->link.io.BasePort1;
+        unsigned int iobase = info->p_dev->io.BasePort1;
         struct hci_dev *hdev;
 
         spin_lock_init(&(info->lock));
@@ -550,7 +550,7 @@ static int btuart_open(btuart_info_t *info)
 static int btuart_close(btuart_info_t *info)
 {
         unsigned long flags;
-        unsigned int iobase = info->link.io.BasePort1;
+        unsigned int iobase = info->p_dev->io.BasePort1;
         struct hci_dev *hdev = info->hdev;
 
         if (!hdev)
@@ -576,17 +576,16 @@ static int btuart_close(btuart_info_t *info)
         return 0;
 }
 
-static int btuart_attach(struct pcmcia_device *p_dev)
+static int btuart_probe(struct pcmcia_device *link)
 {
         btuart_info_t *info;
-        dev_link_t *link;
 
         /* Create new info device */
         info = kzalloc(sizeof(*info), GFP_KERNEL);
         if (!info)
                 return -ENOMEM;
 
-        link = &info->link;
+        info->p_dev = link;
         link->priv = info;
 
         link->io.Attributes1 = IO_DATA_PATH_WIDTH_8;
@@ -598,31 +597,21 @@ static int btuart_attach(struct pcmcia_device *p_dev)
         link->irq.Instance = info;
 
         link->conf.Attributes = CONF_ENABLE_IRQ;
-        link->conf.Vcc = 50;
         link->conf.IntType = INT_MEMORY_AND_IO;
 
-        link->handle = p_dev;
-        p_dev->instance = link;
-
-        link->state |= DEV_PRESENT | DEV_CONFIG_PENDING;
-        btuart_config(link);
-
-        return 0;
+        return btuart_config(link);
 }
 
 
-static void btuart_detach(struct pcmcia_device *p_dev)
+static void btuart_detach(struct pcmcia_device *link)
 {
-        dev_link_t *link = dev_to_instance(p_dev);
         btuart_info_t *info = link->priv;
 
-        if (link->state & DEV_CONFIG)
-                btuart_release(link);
-
+        btuart_release(link);
         kfree(info);
 }
 
-static int get_tuple(client_handle_t handle, tuple_t *tuple, cisparse_t *parse)
+static int get_tuple(struct pcmcia_device *handle, tuple_t *tuple, cisparse_t *parse)
 {
         int i;
 
@@ -633,30 +622,28 @@ static int get_tuple(client_handle_t handle, tuple_t *tuple, cisparse_t *parse)
         return pcmcia_parse_tuple(handle, tuple, parse);
 }
 
-static int first_tuple(client_handle_t handle, tuple_t *tuple, cisparse_t *parse)
+static int first_tuple(struct pcmcia_device *handle, tuple_t *tuple, cisparse_t *parse)
 {
         if (pcmcia_get_first_tuple(handle, tuple) != CS_SUCCESS)
                 return CS_NO_MORE_ITEMS;
         return get_tuple(handle, tuple, parse);
 }
 
-static int next_tuple(client_handle_t handle, tuple_t *tuple, cisparse_t *parse)
+static int next_tuple(struct pcmcia_device *handle, tuple_t *tuple, cisparse_t *parse)
 {
         if (pcmcia_get_next_tuple(handle, tuple) != CS_SUCCESS)
                 return CS_NO_MORE_ITEMS;
         return get_tuple(handle, tuple, parse);
 }
 
-static void btuart_config(dev_link_t *link)
+static int btuart_config(struct pcmcia_device *link)
 {
         static kio_addr_t base[5] = { 0x3f8, 0x2f8, 0x3e8, 0x2e8, 0x0 };
-        client_handle_t handle = link->handle;
         btuart_info_t *info = link->priv;
         tuple_t tuple;
         u_short buf[256];
         cisparse_t parse;
         cistpl_cftable_entry_t *cf = &parse.cftable_entry;
-        config_info_t config;
         int i, j, try, last_ret, last_fn;
 
         tuple.TupleData = (cisdata_t *)buf;
@@ -666,7 +653,7 @@ static void btuart_config(dev_link_t *link)
 
         /* Get configuration register information */
         tuple.DesiredTuple = CISTPL_CONFIG;
-        last_ret = first_tuple(handle, &tuple, &parse);
+        last_ret = first_tuple(link, &tuple, &parse);
         if (last_ret != CS_SUCCESS) {
                 last_fn = ParseTuple;
                 goto cs_failed;
@@ -674,11 +661,6 @@ static void btuart_config(dev_link_t *link)
         link->conf.ConfigBase = parse.config.base;
         link->conf.Present = parse.config.rmask[0];
 
-        /* Configure card */
-        link->state |= DEV_CONFIG;
-        i = pcmcia_get_configuration_info(handle, &config);
-        link->conf.Vcc = config.Vcc;
-
         /* First pass: look for a config entry that looks normal. */
         tuple.TupleData = (cisdata_t *) buf;
         tuple.TupleOffset = 0;
@@ -687,29 +669,29 @@ static void btuart_config(dev_link_t *link)
         tuple.DesiredTuple = CISTPL_CFTABLE_ENTRY;
         /* Two tries: without IO aliases, then with aliases */
         for (try = 0; try < 2; try++) {
-                i = first_tuple(handle, &tuple, &parse);
+                i = first_tuple(link, &tuple, &parse);
                 while (i != CS_NO_MORE_ITEMS) {
                         if (i != CS_SUCCESS)
                                 goto next_entry;
                         if (cf->vpp1.present & (1 << CISTPL_POWER_VNOM))
-                                link->conf.Vpp1 = link->conf.Vpp2 = cf->vpp1.param[CISTPL_POWER_VNOM] / 10000;
+                                link->conf.Vpp = cf->vpp1.param[CISTPL_POWER_VNOM] / 10000;
                         if ((cf->io.nwin > 0) && (cf->io.win[0].len == 8) && (cf->io.win[0].base != 0)) {
                                 link->conf.ConfigIndex = cf->index;
                                 link->io.BasePort1 = cf->io.win[0].base;
                                 link->io.IOAddrLines = (try == 0) ? 16 : cf->io.flags & CISTPL_IO_LINES_MASK;
-                                i = pcmcia_request_io(link->handle, &link->io);
+                                i = pcmcia_request_io(link, &link->io);
                                 if (i == CS_SUCCESS)
                                         goto found_port;
                         }
 next_entry:
-                        i = next_tuple(handle, &tuple, &parse);
+                        i = next_tuple(link, &tuple, &parse);
                 }
         }
 
         /* Second pass: try to find an entry that isn't picky about
            its base address, then try to grab any standard serial port
            address, and finally try to get any free port. */
-        i = first_tuple(handle, &tuple, &parse);
+        i = first_tuple(link, &tuple, &parse);
         while (i != CS_NO_MORE_ITEMS) {
                 if ((i == CS_SUCCESS) && (cf->io.nwin > 0)
                     && ((cf->io.flags & CISTPL_IO_LINES_MASK) <= 3)) {
@@ -717,30 +699,30 @@ next_entry:
                         for (j = 0; j < 5; j++) {
                                 link->io.BasePort1 = base[j];
                                 link->io.IOAddrLines = base[j] ? 16 : 3;
-                                i = pcmcia_request_io(link->handle, &link->io);
+                                i = pcmcia_request_io(link, &link->io);
                                 if (i == CS_SUCCESS)
                                         goto found_port;
                         }
                 }
-                i = next_tuple(handle, &tuple, &parse);
+                i = next_tuple(link, &tuple, &parse);
         }
 
 found_port:
         if (i != CS_SUCCESS) {
                 BT_ERR("No usable port range found");
-                cs_error(link->handle, RequestIO, i);
+                cs_error(link, RequestIO, i);
                 goto failed;
         }
 
-        i = pcmcia_request_irq(link->handle, &link->irq);
+        i = pcmcia_request_irq(link, &link->irq);
         if (i != CS_SUCCESS) {
-                cs_error(link->handle, RequestIRQ, i);
+                cs_error(link, RequestIRQ, i);
                 link->irq.AssignedIRQ = 0;
         }
 
-        i = pcmcia_request_configuration(link->handle, &link->conf);
+        i = pcmcia_request_configuration(link, &link->conf);
         if (i != CS_SUCCESS) {
-                cs_error(link->handle, RequestConfiguration, i);
+                cs_error(link, RequestConfiguration, i);
                 goto failed;
         }
 
@@ -748,58 +730,28 @@ found_port:
                 goto failed;
 
         strcpy(info->node.dev_name, info->hdev->name);
-        link->dev = &info->node;
-        link->state &= ~DEV_CONFIG_PENDING;
+        link->dev_node = &info->node;
 
-        return;
+        return 0;
 
 cs_failed:
-        cs_error(link->handle, last_fn, last_ret);
+        cs_error(link, last_fn, last_ret);
 
 failed:
         btuart_release(link);
+        return -ENODEV;
 }
 
 
-static void btuart_release(dev_link_t *link)
+static void btuart_release(struct pcmcia_device *link)
 {
         btuart_info_t *info = link->priv;
 
-        if (link->state & DEV_PRESENT)
-                btuart_close(info);
-
-        link->dev = NULL;
-
-        pcmcia_release_configuration(link->handle);
-        pcmcia_release_io(link->handle, &link->io);
-        pcmcia_release_irq(link->handle, &link->irq);
-
-        link->state &= ~DEV_CONFIG;
-}
-
-static int btuart_suspend(struct pcmcia_device *dev)
-{
-        dev_link_t *link = dev_to_instance(dev);
-
-        link->state |= DEV_SUSPEND;
-        if (link->state & DEV_CONFIG)
-                pcmcia_release_configuration(link->handle);
+        btuart_close(info);
 
-        return 0;
+        pcmcia_disable_device(link);
 }
 
-static int btuart_resume(struct pcmcia_device *dev)
-{
-        dev_link_t *link = dev_to_instance(dev);
-
-        link->state &= ~DEV_SUSPEND;
-        if (DEV_OK(link))
-                pcmcia_request_configuration(link->handle, &link->conf);
-
-        return 0;
-}
-
-
 static struct pcmcia_device_id btuart_ids[] = {
         /* don't use this driver. Use serial_cs + hci_uart instead */
         PCMCIA_DEVICE_NULL
@@ -811,11 +763,9 @@ static struct pcmcia_driver btuart_driver = {
         .drv            = {
                 .name   = "btuart_cs",
         },
-        .probe          = btuart_attach,
+        .probe          = btuart_probe,
         .remove         = btuart_detach,
         .id_table       = btuart_ids,
-        .suspend        = btuart_suspend,
-        .resume         = btuart_resume,
 };
 
 static int __init init_btuart_cs(void)
diff --git a/drivers/bluetooth/dtl1_cs.c b/drivers/bluetooth/dtl1_cs.c
index 0449bc45ae5e..a71a240611e0 100644
--- a/drivers/bluetooth/dtl1_cs.c
+++ b/drivers/bluetooth/dtl1_cs.c
@@ -68,7 +68,7 @@ MODULE_LICENSE("GPL");
 
 
 typedef struct dtl1_info_t {
-        dev_link_t link;
+        struct pcmcia_device *p_dev;
         dev_node_t node;
 
         struct hci_dev *hdev;
@@ -87,8 +87,8 @@ typedef struct dtl1_info_t {
 } dtl1_info_t;
 
 
-static void dtl1_config(dev_link_t *link);
-static void dtl1_release(dev_link_t *link);
+static int dtl1_config(struct pcmcia_device *link);
+static void dtl1_release(struct pcmcia_device *link);
 
 static void dtl1_detach(struct pcmcia_device *p_dev);
 
@@ -153,13 +153,13 @@ static void dtl1_write_wakeup(dtl1_info_t *info)
         }
 
         do {
-                register unsigned int iobase = info->link.io.BasePort1;
+                register unsigned int iobase = info->p_dev->io.BasePort1;
                 register struct sk_buff *skb;
                 register int len;
 
                 clear_bit(XMIT_WAKEUP, &(info->tx_state));
 
-                if (!(info->link.state & DEV_PRESENT))
+                if (!pcmcia_dev_present(info->p_dev))
                         return;
 
                 if (!(skb = skb_dequeue(&(info->txq))))
@@ -218,7 +218,7 @@ static void dtl1_receive(dtl1_info_t *info)
                 return;
         }
 
-        iobase = info->link.io.BasePort1;
+        iobase = info->p_dev->io.BasePort1;
 
         do {
                 info->hdev->stat.byte_rx++;
@@ -305,7 +305,7 @@ static irqreturn_t dtl1_interrupt(int irq, void *dev_inst, struct pt_regs *regs)
                 return IRQ_NONE;
         }
 
-        iobase = info->link.io.BasePort1;
+        iobase = info->p_dev->io.BasePort1;
 
         spin_lock(&(info->lock));
 
@@ -458,7 +458,7 @@ static int dtl1_hci_ioctl(struct hci_dev *hdev, unsigned int cmd,  unsigned long
 static int dtl1_open(dtl1_info_t *info)
 {
         unsigned long flags;
-        unsigned int iobase = info->link.io.BasePort1;
+        unsigned int iobase = info->p_dev->io.BasePort1;
         struct hci_dev *hdev;
 
         spin_lock_init(&(info->lock));
@@ -504,7 +504,7 @@ static int dtl1_open(dtl1_info_t *info)
         outb(UART_LCR_WLEN8, iobase + UART_LCR);        /* Reset DLAB */
         outb((UART_MCR_DTR | UART_MCR_RTS | UART_MCR_OUT2), iobase + UART_MCR);
 
-        info->ri_latch = inb(info->link.io.BasePort1 + UART_MSR) & UART_MSR_RI;
+        info->ri_latch = inb(info->p_dev->io.BasePort1 + UART_MSR) & UART_MSR_RI;
 
         /* Turn on interrupts */
         outb(UART_IER_RLSI | UART_IER_RDI | UART_IER_THRI, iobase + UART_IER);
@@ -529,7 +529,7 @@ static int dtl1_open(dtl1_info_t *info)
 static int dtl1_close(dtl1_info_t *info)
 {
         unsigned long flags;
-        unsigned int iobase = info->link.io.BasePort1;
+        unsigned int iobase = info->p_dev->io.BasePort1;
         struct hci_dev *hdev = info->hdev;
 
         if (!hdev)
@@ -555,17 +555,16 @@ static int dtl1_close(dtl1_info_t *info)
         return 0;
 }
 
-static int dtl1_attach(struct pcmcia_device *p_dev)
+static int dtl1_probe(struct pcmcia_device *link)
 {
         dtl1_info_t *info;
-        dev_link_t *link;
 
         /* Create new info device */
         info = kzalloc(sizeof(*info), GFP_KERNEL);
         if (!info)
                 return -ENOMEM;
 
-        link = &info->link;
+        info->p_dev = link;
         link->priv = info;
 
         link->io.Attributes1 = IO_DATA_PATH_WIDTH_8;
@@ -577,31 +576,22 @@ static int dtl1_attach(struct pcmcia_device *p_dev)
         link->irq.Instance = info;
 
         link->conf.Attributes = CONF_ENABLE_IRQ;
-        link->conf.Vcc = 50;
         link->conf.IntType = INT_MEMORY_AND_IO;
 
-        link->handle = p_dev;
-        p_dev->instance = link;
-
-        link->state |= DEV_PRESENT | DEV_CONFIG_PENDING;
-        dtl1_config(link);
-
-        return 0;
+        return dtl1_config(link);
 }
 
 
-static void dtl1_detach(struct pcmcia_device *p_dev)
+static void dtl1_detach(struct pcmcia_device *link)
 {
-        dev_link_t *link = dev_to_instance(p_dev);
         dtl1_info_t *info = link->priv;
 
-        if (link->state & DEV_CONFIG)
-                dtl1_release(link);
+        dtl1_release(link);
 
         kfree(info);
 }
 
-static int get_tuple(client_handle_t handle, tuple_t *tuple, cisparse_t *parse)
+static int get_tuple(struct pcmcia_device *handle, tuple_t *tuple, cisparse_t *parse)
 {
         int i;
 
@@ -612,29 +602,27 @@ static int get_tuple(client_handle_t handle, tuple_t *tuple, cisparse_t *parse)
         return pcmcia_parse_tuple(handle, tuple, parse);
 }
 
-static int first_tuple(client_handle_t handle, tuple_t *tuple, cisparse_t *parse)
+static int first_tuple(struct pcmcia_device *handle, tuple_t *tuple, cisparse_t *parse)
 {
         if (pcmcia_get_first_tuple(handle, tuple) != CS_SUCCESS)
                 return CS_NO_MORE_ITEMS;
         return get_tuple(handle, tuple, parse);
 }
 
-static int next_tuple(client_handle_t handle, tuple_t *tuple, cisparse_t *parse)
+static int next_tuple(struct pcmcia_device *handle, tuple_t *tuple, cisparse_t *parse)
 {
         if (pcmcia_get_next_tuple(handle, tuple) != CS_SUCCESS)
                 return CS_NO_MORE_ITEMS;
         return get_tuple(handle, tuple, parse);
 }
 
-static void dtl1_config(dev_link_t *link)
+static int dtl1_config(struct pcmcia_device *link)
 {
-        client_handle_t handle = link->handle;
         dtl1_info_t *info = link->priv;
         tuple_t tuple;
         u_short buf[256];
         cisparse_t parse;
         cistpl_cftable_entry_t *cf = &parse.cftable_entry;
-        config_info_t config;
         int i, last_ret, last_fn;
 
         tuple.TupleData = (cisdata_t *)buf;
@@ -644,7 +632,7 @@ static void dtl1_config(dev_link_t *link)
 
         /* Get configuration register information */
         tuple.DesiredTuple = CISTPL_CONFIG;
-        last_ret = first_tuple(handle, &tuple, &parse);
+        last_ret = first_tuple(link, &tuple, &parse);
         if (last_ret != CS_SUCCESS) {
                 last_fn = ParseTuple;
                 goto cs_failed;
@@ -652,11 +640,6 @@ static void dtl1_config(dev_link_t *link)
         link->conf.ConfigBase = parse.config.base;
         link->conf.Present = parse.config.rmask[0];
 
-        /* Configure card */
-        link->state |= DEV_CONFIG;
-        i = pcmcia_get_configuration_info(handle, &config);
-        link->conf.Vcc = config.Vcc;
-
         tuple.TupleData = (cisdata_t *)buf;
         tuple.TupleOffset = 0;
         tuple.TupleDataMax = 255;
@@ -665,34 +648,34 @@ static void dtl1_config(dev_link_t *link)
 
         /* Look for a generic full-sized window */
         link->io.NumPorts1 = 8;
-        i = first_tuple(handle, &tuple, &parse);
+        i = first_tuple(link, &tuple, &parse);
         while (i != CS_NO_MORE_ITEMS) {
                 if ((i == CS_SUCCESS) && (cf->io.nwin == 1) && (cf->io.win[0].len > 8)) {
                         link->conf.ConfigIndex = cf->index;
                         link->io.BasePort1 = cf->io.win[0].base;
                         link->io.NumPorts1 = cf->io.win[0].len; /*yo */
                         link->io.IOAddrLines = cf->io.flags & CISTPL_IO_LINES_MASK;
-                        i = pcmcia_request_io(link->handle, &link->io);
+                        i = pcmcia_request_io(link, &link->io);
                         if (i == CS_SUCCESS)
                                 break;
                 }
-                i = next_tuple(handle, &tuple, &parse);
+                i = next_tuple(link, &tuple, &parse);
         }
 
         if (i != CS_SUCCESS) {
-                cs_error(link->handle, RequestIO, i);
+                cs_error(link, RequestIO, i);
                 goto failed;
         }
 
-        i = pcmcia_request_irq(link->handle, &link->irq);
+        i = pcmcia_request_irq(link, &link->irq);
         if (i != CS_SUCCESS) {
-                cs_error(link->handle, RequestIRQ, i);
+                cs_error(link, RequestIRQ, i);
                 link->irq.AssignedIRQ = 0;
         }
 
-        i = pcmcia_request_configuration(link->handle, &link->conf);
+        i = pcmcia_request_configuration(link, &link->conf);
         if (i != CS_SUCCESS) {
-                cs_error(link->handle, RequestConfiguration, i);
+                cs_error(link, RequestConfiguration, i);
                 goto failed;
         }
 
@@ -700,55 +683,26 @@ static void dtl1_config(dev_link_t *link)
                 goto failed;
 
         strcpy(info->node.dev_name, info->hdev->name);
-        link->dev = &info->node;
-        link->state &= ~DEV_CONFIG_PENDING;
+        link->dev_node = &info->node;
 
-        return;
+        return 0;
 
 cs_failed:
-        cs_error(link->handle, last_fn, last_ret);
+        cs_error(link, last_fn, last_ret);
 
 failed:
         dtl1_release(link);
+        return -ENODEV;
 }
 
 
-static void dtl1_release(dev_link_t *link)
+static void dtl1_release(struct pcmcia_device *link)
 {
         dtl1_info_t *info = link->priv;
 
-        if (link->state & DEV_PRESENT)
-                dtl1_close(info);
-
-        link->dev = NULL;
-
-        pcmcia_release_configuration(link->handle);
-        pcmcia_release_io(link->handle, &link->io);
-        pcmcia_release_irq(link->handle, &link->irq);
-
-        link->state &= ~DEV_CONFIG;
-}
-
-static int dtl1_suspend(struct pcmcia_device *dev)
-{
-        dev_link_t *link = dev_to_instance(dev);
-
-        link->state |= DEV_SUSPEND;
-        if (link->state & DEV_CONFIG)
-                pcmcia_release_configuration(link->handle);
-
-        return 0;
-}
-
-static int dtl1_resume(struct pcmcia_device *dev)
-{
-        dev_link_t *link = dev_to_instance(dev);
+        dtl1_close(info);
 
-        link->state &= ~DEV_SUSPEND;
-        if (DEV_OK(link))
-                pcmcia_request_configuration(link->handle, &link->conf);
-
-        return 0;
+        pcmcia_disable_device(link);
 }
 
 
@@ -765,11 +719,9 @@ static struct pcmcia_driver dtl1_driver = {
         .drv            = {
                 .name   = "dtl1_cs",
         },
-        .probe          = dtl1_attach,
+        .probe          = dtl1_probe,
         .remove         = dtl1_detach,
         .id_table       = dtl1_ids,
-        .suspend        = dtl1_suspend,
-        .resume         = dtl1_resume,
 };
 
 static int __init init_dtl1_cs(void)
diff --git a/drivers/cdrom/aztcd.c b/drivers/cdrom/aztcd.c
index ce4a1ce59d6a..ec004897b634 100644
--- a/drivers/cdrom/aztcd.c
+++ b/drivers/cdrom/aztcd.c
@@ -1763,7 +1763,7 @@ static int __init aztcd_init(void)
                                 release_region(azt_port, 4);
                         }
                 }
-                if ((azt_port_auto[i] == 0) || (i == 16)) {
+                if ((i == 16) || (azt_port_auto[i] == 0)) {
                         printk(KERN_INFO "aztcd: no AZTECH CD-ROM drive found\n");
                         return -EIO;
                 }
diff --git a/drivers/char/Kconfig b/drivers/char/Kconfig
index 889cad07774e..402296670d3a 100644
--- a/drivers/char/Kconfig
+++ b/drivers/char/Kconfig
@@ -805,10 +805,6 @@ config S3C2410_RTC
           Samsung S3C2410. This can provide periodic interrupt rates
           from 1Hz to 64Hz for user programs, and wakeup from Alarm.
 
-config RTC_VR41XX
-        tristate "NEC VR4100 series Real Time Clock Support"
-        depends on CPU_VR41XX
-
 config COBALT_LCD
         bool "Support for Cobalt LCD"
         depends on MIPS_COBALT
diff --git a/drivers/char/Makefile b/drivers/char/Makefile
index a73cb4956928..f5b01c6d498e 100644
--- a/drivers/char/Makefile
+++ b/drivers/char/Makefile
@@ -67,7 +67,6 @@ obj-$(CONFIG_SGI_DS1286)	+= ds1286.o
 obj-$(CONFIG_SGI_IP27_RTC)      += ip27-rtc.o
 obj-$(CONFIG_DS1302)            += ds1302.o
 obj-$(CONFIG_S3C2410_RTC)       += s3c2410-rtc.o
-obj-$(CONFIG_RTC_VR41XX)        += vr41xx_rtc.o
 ifeq ($(CONFIG_GENERIC_NVRAM),y)
   obj-$(CONFIG_NVRAM)   += generic_nvram.o
 else
diff --git a/drivers/char/applicom.c b/drivers/char/applicom.c
index 927a5bbe112c..a370e7a0bad5 100644
--- a/drivers/char/applicom.c
+++ b/drivers/char/applicom.c
@@ -142,7 +142,7 @@ static int ac_register_board(unsigned long physloc, void __iomem *loc,
         if (!boardno)
                 boardno = readb(loc + NUMCARD_OWNER_TO_PC);
 
-        if (!boardno && boardno > MAX_BOARD) {
+        if (!boardno || boardno > MAX_BOARD) {
                 printk(KERN_WARNING "Board #%d (at 0x%lx) is out of range (1 <= x <= %d).\n",
                        boardno, physloc, MAX_BOARD);
                 return 0;
diff --git a/drivers/char/dtlk.c b/drivers/char/dtlk.c
index a229915ce1b2..87dcaa237f07 100644
--- a/drivers/char/dtlk.c
+++ b/drivers/char/dtlk.c
@@ -490,7 +490,7 @@ for (i = 0; i < 10; i++)			\
                 release_region(dtlk_portlist[i], DTLK_IO_EXTENT);
         }
 
-        printk(KERN_INFO "\nDoubleTalk PC - not found\n");
+        printk(KERN_INFO "DoubleTalk PC - not found\n");
         return -ENODEV;
 }
 
diff --git a/drivers/char/hvcs.c b/drivers/char/hvcs.c
index 327b00c3c45e..8d97b3911293 100644
--- a/drivers/char/hvcs.c
+++ b/drivers/char/hvcs.c
@@ -904,7 +904,7 @@ static int hvcs_enable_device(struct hvcs_struct *hvcsd, uint32_t unit_address,
                  * It is possible the vty-server was removed after the irq was
                  * requested but before we have time to enable interrupts.
                  */
-                if (vio_enable_interrupts(vdev) == H_Success)
+                if (vio_enable_interrupts(vdev) == H_SUCCESS)
                         return 0;
                 else {
                         printk(KERN_ERR "HVCS: int enable failed for"
diff --git a/drivers/char/ipmi/ipmi_msghandler.c b/drivers/char/ipmi/ipmi_msghandler.c
index 0ded046d5aa8..9f2f8fdec69a 100644
--- a/drivers/char/ipmi/ipmi_msghandler.c
+++ b/drivers/char/ipmi/ipmi_msghandler.c
@@ -941,6 +941,7 @@ int ipmi_set_gets_events(ipmi_user_t user, int val)
                         list_del(&msg->link);
                         list_add_tail(&msg->link, &msgs);
                 }
+                intf->waiting_events_count = 0;
         }
 
         /* Hold the events lock while doing this to preserve order. */
@@ -2916,6 +2917,7 @@ static int handle_read_event_rsp(ipmi_smi_t          intf,
 
                 copy_event_into_recv_msg(recv_msg, msg);
                 list_add_tail(&(recv_msg->link), &(intf->waiting_events));
+                intf->waiting_events_count++;
         } else {
                 /* There's too many things in the queue, discard this
                    message. */
diff --git a/drivers/char/keyboard.c b/drivers/char/keyboard.c
index 8b603b2d1c42..935670a3cd98 100644
--- a/drivers/char/keyboard.c
+++ b/drivers/char/keyboard.c
@@ -74,7 +74,7 @@ void compute_shiftstate(void);
         k_self,         k_fn,           k_spec,         k_pad,\
         k_dead,         k_cons,         k_cur,          k_shift,\
         k_meta,         k_ascii,        k_lock,         k_lowercase,\
-        k_slock,        k_dead2,        k_ignore,       k_ignore
+        k_slock,        k_dead2,        k_brl,          k_ignore
 
 typedef void (k_handler_fn)(struct vc_data *vc, unsigned char value,
                             char up_flag, struct pt_regs *regs);
@@ -100,7 +100,7 @@ static fn_handler_fn *fn_handler[] = { FN_HANDLERS };
 const int max_vals[] = {
         255, ARRAY_SIZE(func_table) - 1, ARRAY_SIZE(fn_handler) - 1, NR_PAD - 1,
         NR_DEAD - 1, 255, 3, NR_SHIFT - 1, 255, NR_ASCII - 1, NR_LOCK - 1,
-        255, NR_LOCK - 1, 255
+        255, NR_LOCK - 1, 255, NR_BRL - 1
 };
 
 const int NR_TYPES = ARRAY_SIZE(max_vals);
@@ -126,7 +126,7 @@ static unsigned long key_down[NBITS(KEY_MAX)];		/* keyboard key bitmap */
 static unsigned char shift_down[NR_SHIFT];              /* shift state counters.. */
 static int dead_key_next;
 static int npadch = -1;                                 /* -1 or number assembled on pad */
-static unsigned char diacr;
+static unsigned int diacr;
 static char rep;                                        /* flag telling character repeat */
 
 static unsigned char ledstate = 0xff;                   /* undefined */
@@ -394,22 +394,30 @@ void compute_shiftstate(void)
  * Otherwise, conclude that DIACR was not combining after all,
  * queue it and return CH.
  */
-static unsigned char handle_diacr(struct vc_data *vc, unsigned char ch)
+static unsigned int handle_diacr(struct vc_data *vc, unsigned int ch)
 {
-        int d = diacr;
+        unsigned int d = diacr;
         unsigned int i;
 
         diacr = 0;
 
-        for (i = 0; i < accent_table_size; i++) {
-                if (accent_table[i].diacr == d && accent_table[i].base == ch)
-                        return accent_table[i].result;
+        if ((d & ~0xff) == BRL_UC_ROW) {
+                if ((ch & ~0xff) == BRL_UC_ROW)
+                        return d | ch;
+        } else {
+                for (i = 0; i < accent_table_size; i++)
+                        if (accent_table[i].diacr == d && accent_table[i].base == ch)
+                                return accent_table[i].result;
         }
 
-        if (ch == ' ' || ch == d)
+        if (ch == ' ' || ch == (BRL_UC_ROW|0) || ch == d)
                 return d;
 
-        put_queue(vc, d);
+        if (kbd->kbdmode == VC_UNICODE)
+                to_utf8(vc, d);
+        else if (d < 0x100)
+                put_queue(vc, d);
+
         return ch;
 }
 
@@ -419,7 +427,10 @@ static unsigned char handle_diacr(struct vc_data *vc, unsigned char ch)
 static void fn_enter(struct vc_data *vc, struct pt_regs *regs)
 {
         if (diacr) {
-                put_queue(vc, diacr);
+                if (kbd->kbdmode == VC_UNICODE)
+                        to_utf8(vc, diacr);
+                else if (diacr < 0x100)
+                        put_queue(vc, diacr);
                 diacr = 0;
         }
         put_queue(vc, 13);
@@ -615,7 +626,7 @@ static void k_lowercase(struct vc_data *vc, unsigned char value, char up_flag, s
         printk(KERN_ERR "keyboard.c: k_lowercase was called - impossible\n");
 }
 
-static void k_self(struct vc_data *vc, unsigned char value, char up_flag, struct pt_regs *regs)
+static void k_unicode(struct vc_data *vc, unsigned int value, char up_flag, struct pt_regs *regs)
 {
         if (up_flag)
                 return;         /* no action, if this is a key release */
@@ -628,7 +639,10 @@ static void k_self(struct vc_data *vc, unsigned char value, char up_flag, struct
                 diacr = value;
                 return;
         }
-        put_queue(vc, value);
+        if (kbd->kbdmode == VC_UNICODE)
+                to_utf8(vc, value);
+        else if (value < 0x100)
+                put_queue(vc, value);
 }
 
 /*
@@ -636,13 +650,23 @@ static void k_self(struct vc_data *vc, unsigned char value, char up_flag, struct
  * dead keys modifying the same character. Very useful
  * for Vietnamese.
  */
-static void k_dead2(struct vc_data *vc, unsigned char value, char up_flag, struct pt_regs *regs)
+static void k_deadunicode(struct vc_data *vc, unsigned int value, char up_flag, struct pt_regs *regs)
 {
         if (up_flag)
                 return;
         diacr = (diacr ? handle_diacr(vc, value) : value);
 }
 
+static void k_self(struct vc_data *vc, unsigned char value, char up_flag, struct pt_regs *regs)
+{
+        k_unicode(vc, value, up_flag, regs);
+}
+
+static void k_dead2(struct vc_data *vc, unsigned char value, char up_flag, struct pt_regs *regs)
+{
+        k_deadunicode(vc, value, up_flag, regs);
+}
+
 /*
  * Obsolete - for backwards compatibility only
  */
@@ -650,7 +674,7 @@ static void k_dead(struct vc_data *vc, unsigned char value, char up_flag, struct
 {
         static unsigned char ret_diacr[NR_DEAD] = {'`', '\'', '^', '~', '"', ',' };
         value = ret_diacr[value];
-        k_dead2(vc, value, up_flag, regs);
+        k_deadunicode(vc, value, up_flag, regs);
 }
 
 static void k_cons(struct vc_data *vc, unsigned char value, char up_flag, struct pt_regs *regs)
@@ -835,6 +859,62 @@ static void k_slock(struct vc_data *vc, unsigned char value, char up_flag, struc
         }
 }
 
+/* by default, 300ms interval for combination release */
+static long brl_timeout = 300;
+MODULE_PARM_DESC(brl_timeout, "Braille keys release delay in ms (0 for combination on first release, < 0 for dead characters)");
+module_param(brl_timeout, long, 0644);
+static void k_brl(struct vc_data *vc, unsigned char value, char up_flag, struct pt_regs *regs)
+{
+        static unsigned pressed,committing;
+        static unsigned long releasestart;
+
+        if (kbd->kbdmode != VC_UNICODE) {
+                if (!up_flag)
+                        printk("keyboard mode must be unicode for braille patterns\n");
+                return;
+        }
+
+        if (!value) {
+                k_unicode(vc, BRL_UC_ROW, up_flag, regs);
+                return;
+        }
+
+        if (value > 8)
+                return;
+
+        if (brl_timeout < 0) {
+                k_deadunicode(vc, BRL_UC_ROW | (1 << (value - 1)), up_flag, regs);
+                return;
+        }
+
+        if (up_flag) {
+                if (brl_timeout) {
+                        if (!committing ||
+                            jiffies - releasestart > (brl_timeout * HZ) / 1000) {
+                                committing = pressed;
+                                releasestart = jiffies;
+                        }
+                        pressed &= ~(1 << (value - 1));
+                        if (!pressed) {
+                                if (committing) {
+                                        k_unicode(vc, BRL_UC_ROW | committing, 0, regs);
+                                        committing = 0;
+                                }
+                        }
+                } else {
+                        if (committing) {
+                                k_unicode(vc, BRL_UC_ROW | committing, 0, regs);
+                                committing = 0;
+                        }
+                        pressed &= ~(1 << (value - 1));
+                }
+        } else {
+                pressed |= 1 << (value - 1);
+                if (!brl_timeout)
+                        committing = pressed;
+        }
+}
+
 /*
  * The leds display either (i) the status of NumLock, CapsLock, ScrollLock,
  * or (ii) whatever pattern of lights people want to show using KDSETLED,
@@ -1125,9 +1205,13 @@ static void kbd_keycode(unsigned int keycode, int down,
         }
 
         if (keycode > NR_KEYS)
-                return;
+                if (keycode >= KEY_BRL_DOT1 && keycode <= KEY_BRL_DOT8)
+                        keysym = K(KT_BRL, keycode - KEY_BRL_DOT1 + 1);
+                else
+                        return;
+        else
+                keysym = key_map[keycode];
 
-        keysym = key_map[keycode];
         type = KTYP(keysym);
 
         if (type < 0xf0) {
diff --git a/drivers/char/pcmcia/cm4000_cs.c b/drivers/char/pcmcia/cm4000_cs.c
index 5fdf18515433..02114a0bd0d9 100644
--- a/drivers/char/pcmcia/cm4000_cs.c
+++ b/drivers/char/pcmcia/cm4000_cs.c
@@ -46,7 +46,7 @@
 /* #define ATR_CSUM */
 
 #ifdef PCMCIA_DEBUG
-#define reader_to_dev(x)        (&handle_to_dev(x->link.handle))
+#define reader_to_dev(x)        (&handle_to_dev(x->p_dev->handle))
 static int pc_debug = PCMCIA_DEBUG;
 module_param(pc_debug, int, 0600);
 #define DEBUGP(n, rdr, x, args...) do {                                 \
@@ -67,7 +67,7 @@ static char *version = "cm4000_cs.c v2.4.0gm6 - All bugs added by Harald Welte";
 #define T_100MSEC       msecs_to_jiffies(100)
 #define T_500MSEC       msecs_to_jiffies(500)
 
-static void cm4000_release(dev_link_t *link);
+static void cm4000_release(struct pcmcia_device *link);
 
 static int major;               /* major number we get from the kernel */
 
@@ -106,7 +106,7 @@ static int major;		/* major number we get from the kernel */
 #define REG_STOPBITS(x)         (x + 7)
 
 struct cm4000_dev {
-        dev_link_t link;                /* pcmcia link */
+        struct pcmcia_device *p_dev;
         dev_node_t node;                /* OS node (major,minor) */
 
         unsigned char atr[MAX_ATR];
@@ -149,14 +149,14 @@ struct cm4000_dev {
 #define ZERO_DEV(dev)                                           \
         memset(&dev->atr_csum,0,                                \
                 sizeof(struct cm4000_dev) -                     \
-                /*link*/ sizeof(dev_link_t) -                   \
+                /*link*/ sizeof(struct pcmcia_device) -         \
                 /*node*/ sizeof(dev_node_t) -                   \
                 /*atr*/ MAX_ATR*sizeof(char) -                  \
                 /*rbuf*/ 512*sizeof(char) -                     \
                 /*sbuf*/ 512*sizeof(char) -                     \
                 /*queue*/ 4*sizeof(wait_queue_head_t))
 
-static dev_link_t *dev_table[CM4000_MAX_DEV];
+static struct pcmcia_device *dev_table[CM4000_MAX_DEV];
 static struct class *cmm_class;
 
 /* This table doesn't use spaces after the comma between fields and thus
@@ -454,7 +454,7 @@ static struct card_fixup card_fixups[] = {
 static void set_cardparameter(struct cm4000_dev *dev)
 {
         int i;
-        ioaddr_t iobase = dev->link.io.BasePort1;
+        ioaddr_t iobase = dev->p_dev->io.BasePort1;
         u_int8_t stopbits = 0x02; /* ISO default */
 
         DEBUGP(3, dev, "-> set_cardparameter\n");
@@ -487,7 +487,7 @@ static int set_protocol(struct cm4000_dev *dev, struct ptsreq *ptsreq)
         unsigned short num_bytes_read;
         unsigned char pts_reply[4];
         ssize_t rc;
-        ioaddr_t iobase = dev->link.io.BasePort1;
+        ioaddr_t iobase = dev->p_dev->io.BasePort1;
 
         rc = 0;
 
@@ -699,7 +699,7 @@ static void terminate_monitor(struct cm4000_dev *dev)
 static void monitor_card(unsigned long p)
 {
         struct cm4000_dev *dev = (struct cm4000_dev *) p;
-        ioaddr_t iobase = dev->link.io.BasePort1;
+        ioaddr_t iobase = dev->p_dev->io.BasePort1;
         unsigned short s;
         struct ptsreq ptsreq;
         int i, atrc;
@@ -962,7 +962,7 @@ static ssize_t cmm_read(struct file *filp, __user char *buf, size_t count,
                         loff_t *ppos)
 {
         struct cm4000_dev *dev = filp->private_data;
-        ioaddr_t iobase = dev->link.io.BasePort1;
+        ioaddr_t iobase = dev->p_dev->io.BasePort1;
         ssize_t rc;
         int i, j, k;
 
@@ -971,7 +971,7 @@ static ssize_t cmm_read(struct file *filp, __user char *buf, size_t count,
         if (count == 0)         /* according to manpage */
                 return 0;
 
-        if ((dev->link.state & DEV_PRESENT) == 0 ||     /* socket removed */
+        if (!pcmcia_dev_present(dev->p_dev) || /* device removed */
             test_bit(IS_CMM_ABSENT, &dev->flags))
                 return -ENODEV;
 
@@ -1083,7 +1083,7 @@ static ssize_t cmm_write(struct file *filp, const char __user *buf,
                          size_t count, loff_t *ppos)
 {
         struct cm4000_dev *dev = (struct cm4000_dev *) filp->private_data;
-        ioaddr_t iobase = dev->link.io.BasePort1;
+        ioaddr_t iobase = dev->p_dev->io.BasePort1;
         unsigned short s;
         unsigned char tmp;
         unsigned char infolen;
@@ -1108,7 +1108,7 @@ static ssize_t cmm_write(struct file *filp, const char __user *buf,
 
         sendT0 = dev->proto ? 0 : nr > 5 ? 0x08 : 0;
 
-        if ((dev->link.state & DEV_PRESENT) == 0 ||     /* socket removed */
+        if (!pcmcia_dev_present(dev->p_dev) || /* device removed */
             test_bit(IS_CMM_ABSENT, &dev->flags))
                 return -ENODEV;
 
@@ -1440,8 +1440,8 @@ static int cmm_ioctl(struct inode *inode, struct file *filp, unsigned int cmd,
                      unsigned long arg)
 {
         struct cm4000_dev *dev = filp->private_data;
-        ioaddr_t iobase = dev->link.io.BasePort1;
-        dev_link_t *link;
+        ioaddr_t iobase = dev->p_dev->io.BasePort1;
+        struct pcmcia_device *link;
         int size;
         int rc;
         void __user *argp = (void __user *)arg;
@@ -1458,7 +1458,7 @@ static int cmm_ioctl(struct inode *inode, struct file *filp, unsigned int cmd,
                iminor(inode), ioctl_names[_IOC_NR(cmd)]);
 
         link = dev_table[iminor(inode)];
-        if (!(DEV_OK(link))) {
+        if (!pcmcia_dev_present(link)) {
                 DEBUGP(4, dev, "DEV_OK false\n");
                 return -ENODEV;
         }
@@ -1660,14 +1660,14 @@ static int cmm_ioctl(struct inode *inode, struct file *filp, unsigned int cmd,
 static int cmm_open(struct inode *inode, struct file *filp)
 {
         struct cm4000_dev *dev;
-        dev_link_t *link;
+        struct pcmcia_device *link;
         int rc, minor = iminor(inode);
 
         if (minor >= CM4000_MAX_DEV)
                 return -ENODEV;
 
         link = dev_table[minor];
-        if (link == NULL || !(DEV_OK(link)))
+        if (link == NULL || !pcmcia_dev_present(link))
                 return -ENODEV;
 
         if (link->open)
@@ -1709,7 +1709,7 @@ static int cmm_open(struct inode *inode, struct file *filp)
 static int cmm_close(struct inode *inode, struct file *filp)
 {
         struct cm4000_dev *dev;
-        dev_link_t *link;
+        struct pcmcia_device *link;
         int minor = iminor(inode);
 
         if (minor >= CM4000_MAX_DEV)
@@ -1735,7 +1735,7 @@ static int cmm_close(struct inode *inode, struct file *filp)
         return 0;
 }
 
-static void cmm_cm4000_release(dev_link_t * link)
+static void cmm_cm4000_release(struct pcmcia_device * link)
 {
         struct cm4000_dev *dev = link->priv;
 
@@ -1759,13 +1759,11 @@ static void cmm_cm4000_release(dev_link_t * link)
 
 /*==== Interface to PCMCIA Layer =======================================*/
 
-static void cm4000_config(dev_link_t * link, int devno)
+static int cm4000_config(struct pcmcia_device * link, int devno)
 {
-        client_handle_t handle = link->handle;
         struct cm4000_dev *dev;
         tuple_t tuple;
         cisparse_t parse;
-        config_info_t conf;
         u_char buf[64];
         int fail_fn, fail_rc;
         int rc;
@@ -1777,41 +1775,34 @@ static void cm4000_config(dev_link_t * link, int devno)
         tuple.TupleDataMax = sizeof(buf);
         tuple.TupleOffset = 0;
 
-        if ((fail_rc = pcmcia_get_first_tuple(handle, &tuple)) != CS_SUCCESS) {
+        if ((fail_rc = pcmcia_get_first_tuple(link, &tuple)) != CS_SUCCESS) {
                 fail_fn = GetFirstTuple;
                 goto cs_failed;
         }
-        if ((fail_rc = pcmcia_get_tuple_data(handle, &tuple)) != CS_SUCCESS) {
+        if ((fail_rc = pcmcia_get_tuple_data(link, &tuple)) != CS_SUCCESS) {
                 fail_fn = GetTupleData;
                 goto cs_failed;
         }
         if ((fail_rc =
-             pcmcia_parse_tuple(handle, &tuple, &parse)) != CS_SUCCESS) {
+             pcmcia_parse_tuple(link, &tuple, &parse)) != CS_SUCCESS) {
                 fail_fn = ParseTuple;
                 goto cs_failed;
         }
-        if ((fail_rc =
-             pcmcia_get_configuration_info(handle, &conf)) != CS_SUCCESS) {
-                fail_fn = GetConfigurationInfo;
-                goto cs_failed;
-        }
 
-        link->state |= DEV_CONFIG;
         link->conf.ConfigBase = parse.config.base;
         link->conf.Present = parse.config.rmask[0];
-        link->conf.Vcc = conf.Vcc;
 
         link->io.BasePort2 = 0;
         link->io.NumPorts2 = 0;
         link->io.Attributes2 = 0;
         tuple.DesiredTuple = CISTPL_CFTABLE_ENTRY;
-        for (rc = pcmcia_get_first_tuple(handle, &tuple);
-             rc == CS_SUCCESS; rc = pcmcia_get_next_tuple(handle, &tuple)) {
+        for (rc = pcmcia_get_first_tuple(link, &tuple);
+             rc == CS_SUCCESS; rc = pcmcia_get_next_tuple(link, &tuple)) {
 
-                rc = pcmcia_get_tuple_data(handle, &tuple);
+                rc = pcmcia_get_tuple_data(link, &tuple);
                 if (rc != CS_SUCCESS)
                         continue;
-                rc = pcmcia_parse_tuple(handle, &tuple, &parse);
+                rc = pcmcia_parse_tuple(link, &tuple, &parse);
                 if (rc != CS_SUCCESS)
                         continue;
 
@@ -1831,7 +1822,7 @@ static void cm4000_config(dev_link_t * link, int devno)
                 link->io.IOAddrLines = parse.cftable_entry.io.flags
                     & CISTPL_IO_LINES_MASK;
 
-                rc = pcmcia_request_io(handle, &link->io);
+                rc = pcmcia_request_io(link, &link->io);
                 if (rc == CS_SUCCESS)
                         break;  /* we are done */
         }
@@ -1841,7 +1832,7 @@ static void cm4000_config(dev_link_t * link, int devno)
         link->conf.IntType = 00000002;
 
         if ((fail_rc =
-             pcmcia_request_configuration(handle, &link->conf)) != CS_SUCCESS) {
+             pcmcia_request_configuration(link, &link->conf)) != CS_SUCCESS) {
                 fail_fn = RequestConfiguration;
                 goto cs_release;
         }
@@ -1851,63 +1842,48 @@ static void cm4000_config(dev_link_t * link, int devno)
         dev->node.major = major;
         dev->node.minor = devno;
         dev->node.next = NULL;
-        link->dev = &dev->node;
-        link->state &= ~DEV_CONFIG_PENDING;
+        link->dev_node = &dev->node;
 
-        return;
+        return 0;
 
 cs_failed:
-        cs_error(handle, fail_fn, fail_rc);
+        cs_error(link, fail_fn, fail_rc);
 cs_release:
         cm4000_release(link);
-
-        link->state &= ~DEV_CONFIG_PENDING;
+        return -ENODEV;
 }
 
-static int cm4000_suspend(struct pcmcia_device *p_dev)
+static int cm4000_suspend(struct pcmcia_device *link)
 {
-        dev_link_t *link = dev_to_instance(p_dev);
         struct cm4000_dev *dev;
 
         dev = link->priv;
-
-        link->state |= DEV_SUSPEND;
-        if (link->state & DEV_CONFIG)
-                pcmcia_release_configuration(link->handle);
         stop_monitor(dev);
 
         return 0;
 }
 
-static int cm4000_resume(struct pcmcia_device *p_dev)
+static int cm4000_resume(struct pcmcia_device *link)
 {
-        dev_link_t *link = dev_to_instance(p_dev);
         struct cm4000_dev *dev;
 
         dev = link->priv;
-
-        link->state &= ~DEV_SUSPEND;
-        if (link->state & DEV_CONFIG)
-                pcmcia_request_configuration(link->handle, &link->conf);
-
         if (link->open)
                 start_monitor(dev);
 
         return 0;
 }
 
-static void cm4000_release(dev_link_t *link)
+static void cm4000_release(struct pcmcia_device *link)
 {
         cmm_cm4000_release(link->priv); /* delay release until device closed */
-        pcmcia_release_configuration(link->handle);
-        pcmcia_release_io(link->handle, &link->io);
+        pcmcia_disable_device(link);
 }
 
-static int cm4000_attach(struct pcmcia_device *p_dev)
+static int cm4000_probe(struct pcmcia_device *link)
 {
         struct cm4000_dev *dev;
-        dev_link_t *link;
-        int i;
+        int i, ret;
 
         for (i = 0; i < CM4000_MAX_DEV; i++)
                 if (dev_table[i] == NULL)
@@ -1923,7 +1899,7 @@ static int cm4000_attach(struct pcmcia_device *p_dev)
         if (dev == NULL)
                 return -ENOMEM;
 
-        link = &dev->link;
+        dev->p_dev = link;
         link->priv = dev;
         link->conf.IntType = INT_MEMORY_AND_IO;
         dev_table[i] = link;
@@ -1933,11 +1909,9 @@ static int cm4000_attach(struct pcmcia_device *p_dev)
         init_waitqueue_head(&dev->atrq);
         init_waitqueue_head(&dev->readq);
 
-        link->handle = p_dev;
-        p_dev->instance = link;
-
-        link->state |= DEV_PRESENT | DEV_CONFIG_PENDING;
-        cm4000_config(link, i);
+        ret = cm4000_config(link, i);
+        if (ret)
+                return ret;
 
         class_device_create(cmm_class, NULL, MKDEV(major, i), NULL,
                             "cmm%d", i);
@@ -1945,9 +1919,8 @@ static int cm4000_attach(struct pcmcia_device *p_dev)
         return 0;
 }
 
-static void cm4000_detach(struct pcmcia_device *p_dev)
+static void cm4000_detach(struct pcmcia_device *link)
 {
-        dev_link_t *link = dev_to_instance(p_dev);
         struct cm4000_dev *dev = link->priv;
         int devno;
 
@@ -1958,11 +1931,9 @@ static void cm4000_detach(struct pcmcia_device *p_dev)
         if (devno == CM4000_MAX_DEV)
                 return;
 
-        link->state &= ~DEV_PRESENT;
         stop_monitor(dev);
 
-        if (link->state & DEV_CONFIG)
-                cm4000_release(link);
+        cm4000_release(link);
 
         dev_table[devno] = NULL;
         kfree(dev);
@@ -1993,7 +1964,7 @@ static struct pcmcia_driver cm4000_driver = {
         .drv      = {
                 .name = "cm4000_cs",
                 },
-        .probe    = cm4000_attach,
+        .probe    = cm4000_probe,
         .remove   = cm4000_detach,
         .suspend  = cm4000_suspend,
         .resume   = cm4000_resume,
diff --git a/drivers/char/pcmcia/cm4040_cs.c b/drivers/char/pcmcia/cm4040_cs.c
index 466e33bab029..29efa64580a8 100644
--- a/drivers/char/pcmcia/cm4040_cs.c
+++ b/drivers/char/pcmcia/cm4040_cs.c
@@ -41,7 +41,7 @@
 
 
 #ifdef PCMCIA_DEBUG
-#define reader_to_dev(x)        (&handle_to_dev(x->link.handle))
+#define reader_to_dev(x)        (&handle_to_dev(x->p_dev->handle))
 static int pc_debug = PCMCIA_DEBUG;
 module_param(pc_debug, int, 0600);
 #define DEBUGP(n, rdr, x, args...) do {                                 \
@@ -65,7 +65,7 @@ static char *version =
 /* how often to poll for fifo status change */
 #define POLL_PERIOD                             msecs_to_jiffies(10)
 
-static void reader_release(dev_link_t *link);
+static void reader_release(struct pcmcia_device *link);
 
 static int major;
 static struct class *cmx_class;
@@ -74,7 +74,7 @@ static struct class *cmx_class;
 #define         BS_WRITABLE     0x02
 
 struct reader_dev {
-        dev_link_t              link;
+        struct pcmcia_device    *p_dev;
         dev_node_t              node;
         wait_queue_head_t       devq;
         wait_queue_head_t       poll_wait;
@@ -87,7 +87,7 @@ struct reader_dev {
         struct timer_list       poll_timer;
 };
 
-static dev_link_t *dev_table[CM_MAX_DEV];
+static struct pcmcia_device *dev_table[CM_MAX_DEV];
 
 #ifndef PCMCIA_DEBUG
 #define xoutb   outb
@@ -116,7 +116,7 @@ static inline unsigned char xinb(unsigned short port)
 static void cm4040_do_poll(unsigned long dummy)
 {
         struct reader_dev *dev = (struct reader_dev *) dummy;
-        unsigned int obs = xinb(dev->link.io.BasePort1
+        unsigned int obs = xinb(dev->p_dev->io.BasePort1
                                 + REG_OFFSET_BUFFER_STATUS);
 
         if ((obs & BSR_BULK_IN_FULL)) {
@@ -147,7 +147,7 @@ static void cm4040_stop_poll(struct reader_dev *dev)
 static int wait_for_bulk_out_ready(struct reader_dev *dev)
 {
         int i, rc;
-        int iobase = dev->link.io.BasePort1;
+        int iobase = dev->p_dev->io.BasePort1;
 
         for (i = 0; i < POLL_LOOP_COUNT; i++) {
                 if ((xinb(iobase + REG_OFFSET_BUFFER_STATUS)
@@ -177,7 +177,7 @@ static int wait_for_bulk_out_ready(struct reader_dev *dev)
 /* Write to Sync Control Register */
 static int write_sync_reg(unsigned char val, struct reader_dev *dev)
 {
-        int iobase = dev->link.io.BasePort1;
+        int iobase = dev->p_dev->io.BasePort1;
         int rc;
 
         rc = wait_for_bulk_out_ready(dev);
@@ -195,7 +195,7 @@ static int write_sync_reg(unsigned char val, struct reader_dev *dev)
 static int wait_for_bulk_in_ready(struct reader_dev *dev)
 {
         int i, rc;
-        int iobase = dev->link.io.BasePort1;
+        int iobase = dev->p_dev->io.BasePort1;
 
         for (i = 0; i < POLL_LOOP_COUNT; i++) {
                 if ((xinb(iobase + REG_OFFSET_BUFFER_STATUS)
@@ -225,7 +225,7 @@ static ssize_t cm4040_read(struct file *filp, char __user *buf,
                         size_t count, loff_t *ppos)
 {
         struct reader_dev *dev = filp->private_data;
-        int iobase = dev->link.io.BasePort1;
+        int iobase = dev->p_dev->io.BasePort1;
         size_t bytes_to_read;
         unsigned long i;
         size_t min_bytes_to_read;
@@ -246,7 +246,7 @@ static ssize_t cm4040_read(struct file *filp, char __user *buf,
                 return -EAGAIN;
         }
 
-        if ((dev->link.state & DEV_PRESENT)==0)
+        if (!pcmcia_dev_present(dev->p_dev))
                 return -ENODEV;
 
         for (i = 0; i < 5; i++) {
@@ -328,7 +328,7 @@ static ssize_t cm4040_write(struct file *filp, const char __user *buf,
                          size_t count, loff_t *ppos)
 {
         struct reader_dev *dev = filp->private_data;
-        int iobase = dev->link.io.BasePort1;
+        int iobase = dev->p_dev->io.BasePort1;
         ssize_t rc;
         int i;
         unsigned int bytes_to_write;
@@ -351,7 +351,7 @@ static ssize_t cm4040_write(struct file *filp, const char __user *buf,
                 return -EAGAIN;
         }
 
-        if ((dev->link.state & DEV_PRESENT) == 0)
+        if (!pcmcia_dev_present(dev->p_dev))
                 return -ENODEV;
 
         bytes_to_write = count;
@@ -445,14 +445,14 @@ static unsigned int cm4040_poll(struct file *filp, poll_table *wait)
 static int cm4040_open(struct inode *inode, struct file *filp)
 {
         struct reader_dev *dev;
-        dev_link_t *link;
+        struct pcmcia_device *link;
         int minor = iminor(inode);
 
         if (minor >= CM_MAX_DEV)
                 return -ENODEV;
 
         link = dev_table[minor];
-        if (link == NULL || !(DEV_OK(link)))
+        if (link == NULL || !pcmcia_dev_present(link))
                 return -ENODEV;
 
         if (link->open)
@@ -478,7 +478,7 @@ static int cm4040_open(struct inode *inode, struct file *filp)
 static int cm4040_close(struct inode *inode, struct file *filp)
 {
         struct reader_dev *dev = filp->private_data;
-        dev_link_t *link;
+        struct pcmcia_device *link;
         int minor = iminor(inode);
 
         DEBUGP(2, dev, "-> cm4040_close(maj/min=%d.%d)\n", imajor(inode),
@@ -500,7 +500,7 @@ static int cm4040_close(struct inode *inode, struct file *filp)
         return 0;
 }
 
-static void cm4040_reader_release(dev_link_t *link)
+static void cm4040_reader_release(struct pcmcia_device *link)
 {
         struct reader_dev *dev = link->priv;
 
@@ -514,60 +514,49 @@ static void cm4040_reader_release(dev_link_t *link)
         return;
 }
 
-static void reader_config(dev_link_t *link, int devno)
+static int reader_config(struct pcmcia_device *link, int devno)
 {
-        client_handle_t handle;
         struct reader_dev *dev;
         tuple_t tuple;
         cisparse_t parse;
-        config_info_t conf;
         u_char buf[64];
         int fail_fn, fail_rc;
         int rc;
 
-        handle = link->handle;
-
         tuple.DesiredTuple = CISTPL_CONFIG;
         tuple.Attributes = 0;
         tuple.TupleData = buf;
         tuple.TupleDataMax = sizeof(buf);
         tuple.TupleOffset = 0;
 
-        if ((fail_rc = pcmcia_get_first_tuple(handle, &tuple)) != CS_SUCCESS) {
+        if ((fail_rc = pcmcia_get_first_tuple(link, &tuple)) != CS_SUCCESS) {
                 fail_fn = GetFirstTuple;
                 goto cs_failed;
         }
-        if ((fail_rc = pcmcia_get_tuple_data(handle, &tuple)) != CS_SUCCESS) {
+        if ((fail_rc = pcmcia_get_tuple_data(link, &tuple)) != CS_SUCCESS) {
                 fail_fn = GetTupleData;
                 goto cs_failed;
         }
-        if ((fail_rc = pcmcia_parse_tuple(handle, &tuple, &parse))
+        if ((fail_rc = pcmcia_parse_tuple(link, &tuple, &parse))
                                                         != CS_SUCCESS) {
                 fail_fn = ParseTuple;
                 goto cs_failed;
         }
-        if ((fail_rc = pcmcia_get_configuration_info(handle, &conf))
-                                                        != CS_SUCCESS) {
-                fail_fn = GetConfigurationInfo;
-                goto cs_failed;
-        }
 
-        link->state |= DEV_CONFIG;
         link->conf.ConfigBase = parse.config.base;
         link->conf.Present = parse.config.rmask[0];
-        link->conf.Vcc = conf.Vcc;
 
         link->io.BasePort2 = 0;
         link->io.NumPorts2 = 0;
         link->io.Attributes2 = 0;
         tuple.DesiredTuple = CISTPL_CFTABLE_ENTRY;
-        for (rc = pcmcia_get_first_tuple(handle, &tuple);
+        for (rc = pcmcia_get_first_tuple(link, &tuple);
              rc == CS_SUCCESS;
-             rc = pcmcia_get_next_tuple(handle, &tuple)) {
-                rc = pcmcia_get_tuple_data(handle, &tuple);
+             rc = pcmcia_get_next_tuple(link, &tuple)) {
+                rc = pcmcia_get_tuple_data(link, &tuple);
                 if (rc != CS_SUCCESS)
                         continue;
-                rc = pcmcia_parse_tuple(handle, &tuple, &parse);
+                rc = pcmcia_parse_tuple(link, &tuple, &parse);
                 if (rc != CS_SUCCESS)
                         continue;
 
@@ -585,13 +574,13 @@ static void reader_config(dev_link_t *link, int devno)
                         link->io.Attributes1 = IO_DATA_PATH_WIDTH_8;
                 link->io.IOAddrLines = parse.cftable_entry.io.flags
                                                 & CISTPL_IO_LINES_MASK;
-                rc = pcmcia_request_io(handle, &link->io);
+                rc = pcmcia_request_io(link, &link->io);
 
-                dev_printk(KERN_INFO, &handle_to_dev(handle), "foo");
+                dev_printk(KERN_INFO, &handle_to_dev(link), "foo");
                 if (rc == CS_SUCCESS)
                         break;
                 else
-                        dev_printk(KERN_INFO, &handle_to_dev(handle),
+                        dev_printk(KERN_INFO, &handle_to_dev(link),
                                    "pcmcia_request_io failed 0x%x\n", rc);
         }
         if (rc != CS_SUCCESS)
@@ -599,10 +588,10 @@ static void reader_config(dev_link_t *link, int devno)
 
         link->conf.IntType = 00000002;
 
-        if ((fail_rc = pcmcia_request_configuration(handle,&link->conf))
+        if ((fail_rc = pcmcia_request_configuration(link,&link->conf))
                                                                 !=CS_SUCCESS) {
                 fail_fn = RequestConfiguration;
-                dev_printk(KERN_INFO, &handle_to_dev(handle),
+                dev_printk(KERN_INFO, &handle_to_dev(link),
                            "pcmcia_request_configuration failed 0x%x\n",
                            fail_rc);
                 goto cs_release;
@@ -612,57 +601,31 @@ static void reader_config(dev_link_t *link, int devno)
         sprintf(dev->node.dev_name, DEVICE_NAME "%d", devno);
         dev->node.major = major;
         dev->node.minor = devno;
-        dev->node.next = NULL;
-        link->dev = &dev->node;
-        link->state &= ~DEV_CONFIG_PENDING;
+        dev->node.next = &dev->node;
 
         DEBUGP(2, dev, "device " DEVICE_NAME "%d at 0x%.4x-0x%.4x\n", devno,
               link->io.BasePort1, link->io.BasePort1+link->io.NumPorts1);
         DEBUGP(2, dev, "<- reader_config (succ)\n");
 
-        return;
+        return 0;
 
 cs_failed:
-        cs_error(handle, fail_fn, fail_rc);
+        cs_error(link, fail_fn, fail_rc);
 cs_release:
         reader_release(link);
-        link->state &= ~DEV_CONFIG_PENDING;
-}
-
-static int reader_suspend(struct pcmcia_device *p_dev)
-{
-        dev_link_t *link = dev_to_instance(p_dev);
-
-        link->state |= DEV_SUSPEND;
-        if (link->state & DEV_CONFIG)
-                pcmcia_release_configuration(link->handle);
-
-        return 0;
+        return -ENODEV;
 }
 
-static int reader_resume(struct pcmcia_device *p_dev)
-{
-        dev_link_t *link = dev_to_instance(p_dev);
-
-        link->state &= ~DEV_SUSPEND;
-        if (link->state & DEV_CONFIG)
-                pcmcia_request_configuration(link->handle, &link->conf);
-
-        return 0;
-}
-
-static void reader_release(dev_link_t *link)
+static void reader_release(struct pcmcia_device *link)
 {
         cm4040_reader_release(link->priv);
-        pcmcia_release_configuration(link->handle);
-        pcmcia_release_io(link->handle, &link->io);
+        pcmcia_disable_device(link);
 }
 
-static int reader_attach(struct pcmcia_device *p_dev)
+static int reader_probe(struct pcmcia_device *link)
 {
         struct reader_dev *dev;
-        dev_link_t *link;
-        int i;
+        int i, ret;
 
         for (i = 0; i < CM_MAX_DEV; i++) {
                 if (dev_table[i] == NULL)
@@ -679,8 +642,8 @@ static int reader_attach(struct pcmcia_device *p_dev)
         dev->timeout = CCID_DRIVER_MINIMUM_TIMEOUT;
         dev->buffer_status = 0;
 
-        link = &dev->link;
         link->priv = dev;
+        dev->p_dev = link;
 
         link->conf.IntType = INT_MEMORY_AND_IO;
         dev_table[i] = link;
@@ -692,11 +655,9 @@ static int reader_attach(struct pcmcia_device *p_dev)
         init_timer(&dev->poll_timer);
         dev->poll_timer.function = &cm4040_do_poll;
 
-        link->handle = p_dev;
-        p_dev->instance = link;
-
-        link->state |= DEV_PRESENT | DEV_CONFIG_PENDING;
-        reader_config(link, i);
+        ret = reader_config(link, i);
+        if (ret)
+                return ret;
 
         class_device_create(cmx_class, NULL, MKDEV(major, i), NULL,
                             "cmx%d", i);
@@ -704,9 +665,8 @@ static int reader_attach(struct pcmcia_device *p_dev)
         return 0;
 }
 
-static void reader_detach(struct pcmcia_device *p_dev)
+static void reader_detach(struct pcmcia_device *link)
 {
-        dev_link_t *link = dev_to_instance(p_dev);
         struct reader_dev *dev = link->priv;
         int devno;
 
@@ -718,10 +678,7 @@ static void reader_detach(struct pcmcia_device *p_dev)
         if (devno == CM_MAX_DEV)
                 return;
 
-        link->state &= ~DEV_PRESENT;
-
-        if (link->state & DEV_CONFIG)
-                reader_release(link);
+        reader_release(link);
 
         dev_table[devno] = NULL;
         kfree(dev);
@@ -753,10 +710,8 @@ static struct pcmcia_driver reader_driver = {
         .drv            = {
                 .name   = "cm4040_cs",
         },
-        .probe          = reader_attach,
+        .probe          = reader_probe,
         .remove         = reader_detach,
-        .suspend        = reader_suspend,
-        .resume         = reader_resume,
         .id_table       = cm4040_ids,
 };
 
diff --git a/drivers/char/pcmcia/synclink_cs.c b/drivers/char/pcmcia/synclink_cs.c
index e6b714b6390d..07213454c458 100644
--- a/drivers/char/pcmcia/synclink_cs.c
+++ b/drivers/char/pcmcia/synclink_cs.c
@@ -228,7 +228,7 @@ typedef struct _mgslpc_info {
         struct  _input_signal_events    input_signal_events;
 
         /* PCMCIA support */
-        dev_link_t            link;
+        struct pcmcia_device    *p_dev;
         dev_node_t            node;
         int                   stop;
 
@@ -484,7 +484,7 @@ static void mgslpc_wait_until_sent(struct tty_struct *tty, int timeout);
 
 /* PCMCIA prototypes */
 
-static void mgslpc_config(dev_link_t *link);
+static int mgslpc_config(struct pcmcia_device *link);
 static void mgslpc_release(u_long arg);
 static void mgslpc_detach(struct pcmcia_device *p_dev);
 
@@ -533,14 +533,14 @@ static void ldisc_receive_buf(struct tty_struct *tty,
         }
 }
 
-static int mgslpc_attach(struct pcmcia_device *p_dev)
+static int mgslpc_probe(struct pcmcia_device *link)
 {
     MGSLPC_INFO *info;
-    dev_link_t *link;
-    
+    int ret;
+
     if (debug_level >= DEBUG_LEVEL_INFO)
             printk("mgslpc_attach\n");
-        
+
     info = (MGSLPC_INFO *)kmalloc(sizeof(MGSLPC_INFO), GFP_KERNEL);
     if (!info) {
             printk("Error can't allocate device instance data\n");
@@ -565,25 +565,22 @@ static int mgslpc_attach(struct pcmcia_device *p_dev)
     info->imrb_value = 0xffff;
     info->pim_value = 0xff;
 
-    link = &info->link;
+    info->p_dev = link;
     link->priv = info;
-    
-    /* Initialize the dev_link_t structure */
+
+    /* Initialize the struct pcmcia_device structure */
 
     /* Interrupt setup */
     link->irq.Attributes = IRQ_TYPE_EXCLUSIVE;
     link->irq.IRQInfo1   = IRQ_LEVEL_ID;
     link->irq.Handler = NULL;
-    
+
     link->conf.Attributes = 0;
-    link->conf.Vcc = 50;
     link->conf.IntType = INT_MEMORY_AND_IO;
 
-    link->handle = p_dev;
-    p_dev->instance = link;
-
-    link->state |= DEV_PRESENT | DEV_CONFIG_PENDING;
-    mgslpc_config(link);
+    ret = mgslpc_config(link);
+    if (ret)
+            return ret;
 
     mgslpc_add_device(info);
 
@@ -596,15 +593,13 @@ static int mgslpc_attach(struct pcmcia_device *p_dev)
 #define CS_CHECK(fn, ret) \
 do { last_fn = (fn); if ((last_ret = (ret)) != 0) goto cs_failed; } while (0)
 
-static void mgslpc_config(dev_link_t *link)
+static int mgslpc_config(struct pcmcia_device *link)
 {
-    client_handle_t handle = link->handle;
     MGSLPC_INFO *info = link->priv;
     tuple_t tuple;
     cisparse_t parse;
     int last_fn, last_ret;
     u_char buf[64];
-    config_info_t conf;
     cistpl_cftable_entry_t dflt = { 0 };
     cistpl_cftable_entry_t *cfg;
     
@@ -617,27 +612,20 @@ static void mgslpc_config(dev_link_t *link)
     tuple.TupleData = buf;
     tuple.TupleDataMax = sizeof(buf);
     tuple.TupleOffset = 0;
-    CS_CHECK(GetFirstTuple, pcmcia_get_first_tuple(handle, &tuple));
-    CS_CHECK(GetTupleData, pcmcia_get_tuple_data(handle, &tuple));
-    CS_CHECK(ParseTuple, pcmcia_parse_tuple(handle, &tuple, &parse));
+    CS_CHECK(GetFirstTuple, pcmcia_get_first_tuple(link, &tuple));
+    CS_CHECK(GetTupleData, pcmcia_get_tuple_data(link, &tuple));
+    CS_CHECK(ParseTuple, pcmcia_parse_tuple(link, &tuple, &parse));
     link->conf.ConfigBase = parse.config.base;
     link->conf.Present = parse.config.rmask[0];
-    
-    /* Configure card */
-    link->state |= DEV_CONFIG;
-
-    /* Look up the current Vcc */
-    CS_CHECK(GetConfigurationInfo, pcmcia_get_configuration_info(handle, &conf));
-    link->conf.Vcc = conf.Vcc;
 
     /* get CIS configuration entry */
 
     tuple.DesiredTuple = CISTPL_CFTABLE_ENTRY;
-    CS_CHECK(GetFirstTuple, pcmcia_get_first_tuple(handle, &tuple));
+    CS_CHECK(GetFirstTuple, pcmcia_get_first_tuple(link, &tuple));
 
     cfg = &(parse.cftable_entry);
-    CS_CHECK(GetTupleData, pcmcia_get_tuple_data(handle, &tuple));
-    CS_CHECK(ParseTuple, pcmcia_parse_tuple(handle, &tuple, &parse));
+    CS_CHECK(GetTupleData, pcmcia_get_tuple_data(link, &tuple));
+    CS_CHECK(ParseTuple, pcmcia_parse_tuple(link, &tuple, &parse));
 
     if (cfg->flags & CISTPL_CFTABLE_DEFAULT) dflt = *cfg;
     if (cfg->index == 0)
@@ -658,11 +646,10 @@ static void mgslpc_config(dev_link_t *link)
             link->io.IOAddrLines = io->flags & CISTPL_IO_LINES_MASK;
             link->io.BasePort1 = io->win[0].base;
             link->io.NumPorts1 = io->win[0].len;
-            CS_CHECK(RequestIO, pcmcia_request_io(link->handle, &link->io));
+            CS_CHECK(RequestIO, pcmcia_request_io(link, &link->io));
     }
 
     link->conf.Attributes = CONF_ENABLE_IRQ;
-    link->conf.Vcc = 50;
     link->conf.IntType = INT_MEMORY_AND_IO;
     link->conf.ConfigIndex = 8;
     link->conf.Present = PRESENT_OPTION;
@@ -670,9 +657,9 @@ static void mgslpc_config(dev_link_t *link)
     link->irq.Attributes |= IRQ_HANDLE_PRESENT;
     link->irq.Handler     = mgslpc_isr;
     link->irq.Instance    = info;
-    CS_CHECK(RequestIRQ, pcmcia_request_irq(link->handle, &link->irq));
+    CS_CHECK(RequestIRQ, pcmcia_request_irq(link, &link->irq));
 
-    CS_CHECK(RequestConfiguration, pcmcia_request_configuration(link->handle, &link->conf));
+    CS_CHECK(RequestConfiguration, pcmcia_request_configuration(link, &link->conf));
 
     info->io_base = link->io.BasePort1;
     info->irq_level = link->irq.AssignedIRQ;
@@ -680,7 +667,7 @@ static void mgslpc_config(dev_link_t *link)
     /* add to linked list of devices */
     sprintf(info->node.dev_name, "mgslpc0");
     info->node.major = info->node.minor = 0;
-    link->dev = &info->node;
+    link->dev_node = &info->node;
 
     printk(KERN_INFO "%s: index 0x%02x:",
            info->node.dev_name, link->conf.ConfigIndex);
@@ -690,13 +677,12 @@ static void mgslpc_config(dev_link_t *link)
             printk(", io 0x%04x-0x%04x", link->io.BasePort1,
                    link->io.BasePort1+link->io.NumPorts1-1);
     printk("\n");
-    
-    link->state &= ~DEV_CONFIG_PENDING;
-    return;
+    return 0;
 
 cs_failed:
-    cs_error(link->handle, last_fn, last_ret);
+    cs_error(link, last_fn, last_ret);
     mgslpc_release((u_long)link);
+    return -ENODEV;
 }
 
 /* Card has been removed.
@@ -705,58 +691,38 @@ cs_failed:
  */
 static void mgslpc_release(u_long arg)
 {
-    dev_link_t *link = (dev_link_t *)arg;
+        struct pcmcia_device *link = (struct pcmcia_device *)arg;
 
-    if (debug_level >= DEBUG_LEVEL_INFO)
-            printk("mgslpc_release(0x%p)\n", link);
-
-    /* Unlink the device chain */
-    link->dev = NULL;
-    link->state &= ~DEV_CONFIG;
+        if (debug_level >= DEBUG_LEVEL_INFO)
+                printk("mgslpc_release(0x%p)\n", link);
 
-    pcmcia_release_configuration(link->handle);
-    if (link->io.NumPorts1)
-            pcmcia_release_io(link->handle, &link->io);
-    if (link->irq.AssignedIRQ)
-            pcmcia_release_irq(link->handle, &link->irq);
+        pcmcia_disable_device(link);
 }
 
-static void mgslpc_detach(struct pcmcia_device *p_dev)
+static void mgslpc_detach(struct pcmcia_device *link)
 {
-    dev_link_t *link = dev_to_instance(p_dev);
-
-    if (debug_level >= DEBUG_LEVEL_INFO)
-            printk("mgslpc_detach(0x%p)\n", link);
+        if (debug_level >= DEBUG_LEVEL_INFO)
+                printk("mgslpc_detach(0x%p)\n", link);
 
-    if (link->state & DEV_CONFIG) {
-            ((MGSLPC_INFO *)link->priv)->stop = 1;
-            mgslpc_release((u_long)link);
-    }
+        ((MGSLPC_INFO *)link->priv)->stop = 1;
+        mgslpc_release((u_long)link);
 
-    mgslpc_remove_device((MGSLPC_INFO *)link->priv);
+        mgslpc_remove_device((MGSLPC_INFO *)link->priv);
 }
 
-static int mgslpc_suspend(struct pcmcia_device *dev)
+static int mgslpc_suspend(struct pcmcia_device *link)
 {
-        dev_link_t *link = dev_to_instance(dev);
         MGSLPC_INFO *info = link->priv;
 
-        link->state |= DEV_SUSPEND;
         info->stop = 1;
-        if (link->state & DEV_CONFIG)
-                pcmcia_release_configuration(link->handle);
 
         return 0;
 }
 
-static int mgslpc_resume(struct pcmcia_device *dev)
+static int mgslpc_resume(struct pcmcia_device *link)
 {
-        dev_link_t *link = dev_to_instance(dev);
         MGSLPC_INFO *info = link->priv;
 
-        link->state &= ~DEV_SUSPEND;
-        if (link->state & DEV_CONFIG)
-                pcmcia_request_configuration(link->handle, &link->conf);
         info->stop = 0;
 
         return 0;
@@ -1280,7 +1246,7 @@ static irqreturn_t mgslpc_isr(int irq, void *dev_id, struct pt_regs * regs)
         if (!info)
                 return IRQ_NONE;
                 
-        if (!(info->link.state & DEV_CONFIG))
+        if (!(info->p_dev->_locked))
                 return IRQ_HANDLED;
 
         spin_lock(&info->lock);
@@ -3033,7 +2999,7 @@ static struct pcmcia_driver mgslpc_driver = {
         .drv            = {
                 .name   = "synclink_cs",
         },
-        .probe          = mgslpc_attach,
+        .probe          = mgslpc_probe,
         .remove         = mgslpc_detach,
         .id_table       = mgslpc_ids,
         .suspend        = mgslpc_suspend,
diff --git a/drivers/char/random.c b/drivers/char/random.c
index 86be04b241e1..58f3512c52e1 100644
--- a/drivers/char/random.c
+++ b/drivers/char/random.c
@@ -1584,7 +1584,6 @@ u32 secure_ipv6_port_ephemeral(const __u32 *saddr, const __u32 *daddr, __u16 dpo
 
         return twothirdsMD4Transform(daddr, hash);
 }
-EXPORT_SYMBOL(secure_ipv6_port_ephemeral);
 #endif
 
 #if defined(CONFIG_IP_DCCP) || defined(CONFIG_IP_DCCP_MODULE)
diff --git a/drivers/char/tlclk.c b/drivers/char/tlclk.c
index 2546637a55c0..f58ad7f68267 100644
--- a/drivers/char/tlclk.c
+++ b/drivers/char/tlclk.c
@@ -327,7 +327,7 @@ static ssize_t store_received_ref_clk3a(struct device *d,
         return strnlen(buf, count);
 }
 
-static DEVICE_ATTR(received_ref_clk3a, S_IWUGO, NULL,
+static DEVICE_ATTR(received_ref_clk3a, (S_IWUSR|S_IWGRP), NULL,
                 store_received_ref_clk3a);
 
 
@@ -349,7 +349,7 @@ static ssize_t store_received_ref_clk3b(struct device *d,
         return strnlen(buf, count);
 }
 
-static DEVICE_ATTR(received_ref_clk3b, S_IWUGO, NULL,
+static DEVICE_ATTR(received_ref_clk3b, (S_IWUSR|S_IWGRP), NULL,
                 store_received_ref_clk3b);
 
 
@@ -371,7 +371,7 @@ static ssize_t store_enable_clk3b_output(struct device *d,
         return strnlen(buf, count);
 }
 
-static DEVICE_ATTR(enable_clk3b_output, S_IWUGO, NULL,
+static DEVICE_ATTR(enable_clk3b_output, (S_IWUSR|S_IWGRP), NULL,
                 store_enable_clk3b_output);
 
 static ssize_t store_enable_clk3a_output(struct device *d,
@@ -392,7 +392,7 @@ static ssize_t store_enable_clk3a_output(struct device *d,
         return strnlen(buf, count);
 }
 
-static DEVICE_ATTR(enable_clk3a_output, S_IWUGO, NULL,
+static DEVICE_ATTR(enable_clk3a_output, (S_IWUSR|S_IWGRP), NULL,
                 store_enable_clk3a_output);
 
 static ssize_t store_enable_clkb1_output(struct device *d,
@@ -413,7 +413,7 @@ static ssize_t store_enable_clkb1_output(struct device *d,
         return strnlen(buf, count);
 }
 
-static DEVICE_ATTR(enable_clkb1_output, S_IWUGO, NULL,
+static DEVICE_ATTR(enable_clkb1_output, (S_IWUSR|S_IWGRP), NULL,
                 store_enable_clkb1_output);
 
 
@@ -435,7 +435,7 @@ static ssize_t store_enable_clka1_output(struct device *d,
         return strnlen(buf, count);
 }
 
-static DEVICE_ATTR(enable_clka1_output, S_IWUGO, NULL,
+static DEVICE_ATTR(enable_clka1_output, (S_IWUSR|S_IWGRP), NULL,
                 store_enable_clka1_output);
 
 static ssize_t store_enable_clkb0_output(struct device *d,
@@ -456,7 +456,7 @@ static ssize_t store_enable_clkb0_output(struct device *d,
         return strnlen(buf, count);
 }
 
-static DEVICE_ATTR(enable_clkb0_output, S_IWUGO, NULL,
+static DEVICE_ATTR(enable_clkb0_output, (S_IWUSR|S_IWGRP), NULL,
                 store_enable_clkb0_output);
 
 static ssize_t store_enable_clka0_output(struct device *d,
@@ -477,7 +477,7 @@ static ssize_t store_enable_clka0_output(struct device *d,
         return strnlen(buf, count);
 }
 
-static DEVICE_ATTR(enable_clka0_output, S_IWUGO, NULL,
+static DEVICE_ATTR(enable_clka0_output, (S_IWUSR|S_IWGRP), NULL,
                 store_enable_clka0_output);
 
 static ssize_t store_select_amcb2_transmit_clock(struct device *d,
@@ -519,7 +519,7 @@ static ssize_t store_select_amcb2_transmit_clock(struct device *d,
         return strnlen(buf, count);
 }
 
-static DEVICE_ATTR(select_amcb2_transmit_clock, S_IWUGO, NULL,
+static DEVICE_ATTR(select_amcb2_transmit_clock, (S_IWUSR|S_IWGRP), NULL,
         store_select_amcb2_transmit_clock);
 
 static ssize_t store_select_amcb1_transmit_clock(struct device *d,
@@ -560,7 +560,7 @@ static ssize_t store_select_amcb1_transmit_clock(struct device *d,
         return strnlen(buf, count);
 }
 
-static DEVICE_ATTR(select_amcb1_transmit_clock, S_IWUGO, NULL,
+static DEVICE_ATTR(select_amcb1_transmit_clock, (S_IWUSR|S_IWGRP), NULL,
                 store_select_amcb1_transmit_clock);
 
 static ssize_t store_select_redundant_clock(struct device *d,
@@ -581,7 +581,7 @@ static ssize_t store_select_redundant_clock(struct device *d,
         return strnlen(buf, count);
 }
 
-static DEVICE_ATTR(select_redundant_clock, S_IWUGO, NULL,
+static DEVICE_ATTR(select_redundant_clock, (S_IWUSR|S_IWGRP), NULL,
                 store_select_redundant_clock);
 
 static ssize_t store_select_ref_frequency(struct device *d,
@@ -602,7 +602,7 @@ static ssize_t store_select_ref_frequency(struct device *d,
         return strnlen(buf, count);
 }
 
-static DEVICE_ATTR(select_ref_frequency, S_IWUGO, NULL,
+static DEVICE_ATTR(select_ref_frequency, (S_IWUSR|S_IWGRP), NULL,
                 store_select_ref_frequency);
 
 static ssize_t store_filter_select(struct device *d,
@@ -623,7 +623,7 @@ static ssize_t store_filter_select(struct device *d,
         return strnlen(buf, count);
 }
 
-static DEVICE_ATTR(filter_select, S_IWUGO, NULL, store_filter_select);
+static DEVICE_ATTR(filter_select, (S_IWUSR|S_IWGRP), NULL, store_filter_select);
 
 static ssize_t store_hardware_switching_mode(struct device *d,
                  struct device_attribute *attr, const char *buf, size_t count)
@@ -643,7 +643,7 @@ static ssize_t store_hardware_switching_mode(struct device *d,
         return strnlen(buf, count);
 }
 
-static DEVICE_ATTR(hardware_switching_mode, S_IWUGO, NULL,
+static DEVICE_ATTR(hardware_switching_mode, (S_IWUSR|S_IWGRP), NULL,
                 store_hardware_switching_mode);
 
 static ssize_t store_hardware_switching(struct device *d,
@@ -664,7 +664,7 @@ static ssize_t store_hardware_switching(struct device *d,
         return strnlen(buf, count);
 }
 
-static DEVICE_ATTR(hardware_switching, S_IWUGO, NULL,
+static DEVICE_ATTR(hardware_switching, (S_IWUSR|S_IWGRP), NULL,
                 store_hardware_switching);
 
 static ssize_t store_refalign (struct device *d,
@@ -684,7 +684,7 @@ static ssize_t store_refalign (struct device *d,
         return strnlen(buf, count);
 }
 
-static DEVICE_ATTR(refalign, S_IWUGO, NULL, store_refalign);
+static DEVICE_ATTR(refalign, (S_IWUSR|S_IWGRP), NULL, store_refalign);
 
 static ssize_t store_mode_select (struct device *d,
                  struct device_attribute *attr, const char *buf, size_t count)
@@ -704,7 +704,7 @@ static ssize_t store_mode_select (struct device *d,
         return strnlen(buf, count);
 }
 
-static DEVICE_ATTR(mode_select, S_IWUGO, NULL, store_mode_select);
+static DEVICE_ATTR(mode_select, (S_IWUSR|S_IWGRP), NULL, store_mode_select);
 
 static ssize_t store_reset (struct device *d,
                  struct device_attribute *attr, const char *buf, size_t count)
@@ -724,7 +724,7 @@ static ssize_t store_reset (struct device *d,
         return strnlen(buf, count);
 }
 
-static DEVICE_ATTR(reset, S_IWUGO, NULL, store_reset);
+static DEVICE_ATTR(reset, (S_IWUSR|S_IWGRP), NULL, store_reset);
 
 static struct attribute *tlclk_sysfs_entries[] = {
         &dev_attr_current_ref.attr,
diff --git a/drivers/char/tty_io.c b/drivers/char/tty_io.c
index 98b126c2ded8..f70a47eadb52 100644
--- a/drivers/char/tty_io.c
+++ b/drivers/char/tty_io.c
@@ -351,10 +351,10 @@ int tty_buffer_request_room(struct tty_struct *tty, size_t size)
         spin_unlock_irqrestore(&tty->buf.lock, flags);
         return size;
 }
-
 EXPORT_SYMBOL_GPL(tty_buffer_request_room);
 
-int tty_insert_flip_string(struct tty_struct *tty, const unsigned char *chars, size_t size)
+int tty_insert_flip_string(struct tty_struct *tty, const unsigned char *chars,
+                                size_t size)
 {
         int copied = 0;
         do {
@@ -368,17 +368,16 @@ int tty_insert_flip_string(struct tty_struct *tty, const unsigned char *chars, s
                 tb->used += space;
                 copied += space;
                 chars += space;
-/*              printk("Flip insert %d.\n", space); */
         }
         /* There is a small chance that we need to split the data over
            several buffers. If this is the case we must loop */
         while (unlikely(size > copied));
         return copied;
 }
-
 EXPORT_SYMBOL(tty_insert_flip_string);
 
-int tty_insert_flip_string_flags(struct tty_struct *tty, const unsigned char *chars, const char *flags, size_t size)
+int tty_insert_flip_string_flags(struct tty_struct *tty,
+                const unsigned char *chars, const char *flags, size_t size)
 {
         int copied = 0;
         do {
@@ -399,9 +398,20 @@ int tty_insert_flip_string_flags(struct tty_struct *tty, const unsigned char *ch
         while (unlikely(size > copied));
         return copied;
 }
-
 EXPORT_SYMBOL_GPL(tty_insert_flip_string_flags);
 
+void tty_schedule_flip(struct tty_struct *tty)
+{
+        unsigned long flags;
+        spin_lock_irqsave(&tty->buf.lock, flags);
+        if (tty->buf.tail != NULL) {
+                tty->buf.tail->active = 0;
+                tty->buf.tail->commit = tty->buf.tail->used;
+        }
+        spin_unlock_irqrestore(&tty->buf.lock, flags);
+        schedule_delayed_work(&tty->buf.work, 1);
+}
+EXPORT_SYMBOL(tty_schedule_flip);
 
 /*
  *      Prepare a block of space in the buffer for data. Returns the length
@@ -1730,7 +1740,7 @@ static void release_dev(struct file * filp)
 {
         struct tty_struct *tty, *o_tty;
         int     pty_master, tty_closing, o_tty_closing, do_sleep;
-        int     devpts_master, devpts;
+        int     devpts;
         int     idx;
         char    buf[64];
         unsigned long flags;
@@ -1747,7 +1757,6 @@ static void release_dev(struct file * filp)
         pty_master = (tty->driver->type == TTY_DRIVER_TYPE_PTY &&
                       tty->driver->subtype == PTY_TYPE_MASTER);
         devpts = (tty->driver->flags & TTY_DRIVER_DEVPTS_MEM) != 0;
-        devpts_master = pty_master && devpts;
         o_tty = tty->link;
 
 #ifdef TTY_PARANOIA_CHECK
@@ -2185,6 +2194,7 @@ static int ptmx_open(struct inode * inode, struct file * filp)
                 return 0;
 out1:
         release_dev(filp);
+        return retval;
 out:
         down(&allocated_ptys_lock);
         idr_remove(&allocated_ptys, index);
diff --git a/drivers/char/watchdog/Kconfig b/drivers/char/watchdog/Kconfig
index 16e99db2e12d..d53f664a4dd8 100644
--- a/drivers/char/watchdog/Kconfig
+++ b/drivers/char/watchdog/Kconfig
@@ -60,6 +60,13 @@ config SOFT_WATCHDOG
 
 # ARM Architecture
 
+config AT91_WATCHDOG
+        tristate "AT91RM9200 watchdog"
+        depends on WATCHDOG && ARCH_AT91RM9200
+        help
+          Watchdog timer embedded into AT91RM9200 chips. This will reboot your
+          system when the timeout is reached.
+
 config 21285_WATCHDOG
         tristate "DC21285 watchdog"
         depends on WATCHDOG && FOOTBRIDGE
diff --git a/drivers/char/watchdog/Makefile b/drivers/char/watchdog/Makefile
index d6f27fde9905..6ab77b61a643 100644
--- a/drivers/char/watchdog/Makefile
+++ b/drivers/char/watchdog/Makefile
@@ -23,6 +23,7 @@ obj-$(CONFIG_WDTPCI) += wdt_pci.o
 obj-$(CONFIG_USBPCWATCHDOG) += pcwd_usb.o
 
 # ARM Architecture
+obj-$(CONFIG_AT91_WATCHDOG) += at91_wdt.o
 obj-$(CONFIG_21285_WATCHDOG) += wdt285.o
 obj-$(CONFIG_977_WATCHDOG) += wdt977.o
 obj-$(CONFIG_IXP2000_WATCHDOG) += ixp2000_wdt.o
diff --git a/drivers/char/watchdog/at91_wdt.c b/drivers/char/watchdog/at91_wdt.c
new file mode 100644
index 000000000000..ac83bc4b019a
--- /dev/null
+++ b/drivers/char/watchdog/at91_wdt.c
@@ -0,0 +1,228 @@
+/*
+ * Watchdog driver for Atmel AT91RM9200 (Thunder)
+ *
+ *  Copyright (C) 2003 SAN People (Pty) Ltd
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * as published by the Free Software Foundation; either version
+ * 2 of the License, or (at your option) any later version.
+ */
+
+#include <linux/config.h>
+#include <linux/errno.h>
+#include <linux/fs.h>
+#include <linux/init.h>
+#include <linux/kernel.h>
+#include <linux/miscdevice.h>
+#include <linux/module.h>
+#include <linux/moduleparam.h>
+#include <linux/types.h>
+#include <linux/watchdog.h>
+#include <asm/bitops.h>
+#include <asm/uaccess.h>
+
+
+#define WDT_DEFAULT_TIME        5       /* 5 seconds */
+#define WDT_MAX_TIME            256     /* 256 seconds */
+
+static int wdt_time = WDT_DEFAULT_TIME;
+static int nowayout = WATCHDOG_NOWAYOUT;
+
+module_param(wdt_time, int, 0);
+MODULE_PARM_DESC(wdt_time, "Watchdog time in seconds. (default="__MODULE_STRING(WDT_DEFAULT_TIME) ")");
+
+module_param(nowayout, int, 0);
+MODULE_PARM_DESC(nowayout, "Watchdog cannot be stopped once started (default=" __MODULE_STRING(WATCHDOG_NOWAYOUT) ")");
+
+
+static unsigned long at91wdt_busy;
+
+/* ......................................................................... */
+
+/*
+ * Disable the watchdog.
+ */
+static void inline at91_wdt_stop(void)
+{
+        at91_sys_write(AT91_ST_WDMR, AT91_ST_EXTEN);
+}
+
+/*
+ * Enable and reset the watchdog.
+ */
+static void inline at91_wdt_start(void)
+{
+        at91_sys_write(AT91_ST_WDMR, AT91_ST_EXTEN | AT91_ST_RSTEN | (((65536 * wdt_time) >> 8) & AT91_ST_WDV));
+        at91_sys_write(AT91_ST_CR, AT91_ST_WDRST);
+}
+
+/*
+ * Reload the watchdog timer.  (ie, pat the watchdog)
+ */
+static void inline at91_wdt_reload(void)
+{
+        at91_sys_write(AT91_ST_CR, AT91_ST_WDRST);
+}
+
+/* ......................................................................... */
+
+/*
+ * Watchdog device is opened, and watchdog starts running.
+ */
+static int at91_wdt_open(struct inode *inode, struct file *file)
+{
+        if (test_and_set_bit(0, &at91wdt_busy))
+                return -EBUSY;
+
+        at91_wdt_start();
+        return nonseekable_open(inode, file);
+}
+
+/*
+ * Close the watchdog device.
+ * If CONFIG_WATCHDOG_NOWAYOUT is NOT defined then the watchdog is also
+ *  disabled.
+ */
+static int at91_wdt_close(struct inode *inode, struct file *file)
+{
+        if (!nowayout)
+                at91_wdt_stop();        /* Disable the watchdog when file is closed */
+
+        clear_bit(0, &at91wdt_busy);
+        return 0;
+}
+
+/*
+ * Change the watchdog time interval.
+ */
+static int at91_wdt_settimeout(int new_time)
+{
+        /*
+         * All counting occurs at SLOW_CLOCK / 128 = 0.256 Hz
+         *
+         * Since WDV is a 16-bit counter, the maximum period is
+         * 65536 / 0.256 = 256 seconds.
+         */
+        if ((new_time <= 0) || (new_time > WDT_MAX_TIME))
+                return -EINVAL;
+
+        /* Set new watchdog time. It will be used when at91_wdt_start() is called. */
+        wdt_time = new_time;
+        return 0;
+}
+
+static struct watchdog_info at91_wdt_info = {
+        .identity       = "at91 watchdog",
+        .options        = WDIOF_SETTIMEOUT | WDIOF_KEEPALIVEPING,
+};
+
+/*
+ * Handle commands from user-space.
+ */
+static int at91_wdt_ioctl(struct inode *inode, struct file *file,
+                unsigned int cmd, unsigned long arg)
+{
+        void __user *argp = (void __user *)arg;
+        int __user *p = argp;
+        int new_value;
+
+        switch(cmd) {
+                case WDIOC_KEEPALIVE:
+                        at91_wdt_reload();      /* pat the watchdog */
+                        return 0;
+
+                case WDIOC_GETSUPPORT:
+                        return copy_to_user(argp, &at91_wdt_info, sizeof(at91_wdt_info)) ? -EFAULT : 0;
+
+                case WDIOC_SETTIMEOUT:
+                        if (get_user(new_value, p))
+                                return -EFAULT;
+                                
+                        if (at91_wdt_settimeout(new_value))
+                                return -EINVAL;
+
+                        /* Enable new time value */
+                        at91_wdt_start();
+
+                        /* Return current value */
+                        return put_user(wdt_time, p);
+
+                case WDIOC_GETTIMEOUT:
+                        return put_user(wdt_time, p);
+
+                case WDIOC_GETSTATUS:
+                case WDIOC_GETBOOTSTATUS:
+                        return put_user(0, p);
+
+                case WDIOC_SETOPTIONS:
+                        if (get_user(new_value, p))
+                                return -EFAULT;
+
+                        if (new_value & WDIOS_DISABLECARD)
+                                at91_wdt_stop();
+                        if (new_value & WDIOS_ENABLECARD)
+                                at91_wdt_start();
+                        return 0;
+
+                default:
+                        return -ENOIOCTLCMD;
+        }
+}
+
+/*
+ * Pat the watchdog whenever device is written to.
+ */
+static ssize_t at91_wdt_write(struct file *file, const char *data, size_t len, loff_t *ppos)
+{
+        at91_wdt_reload();              /* pat the watchdog */
+        return len;
+}
+
+/* ......................................................................... */
+
+static struct file_operations at91wdt_fops = {
+        .owner          = THIS_MODULE,
+        .llseek         = no_llseek,
+        .ioctl          = at91_wdt_ioctl,
+        .open           = at91_wdt_open,
+        .release        = at91_wdt_close,
+        .write          = at91_wdt_write,
+};
+
+static struct miscdevice at91wdt_miscdev = {
+        .minor          = WATCHDOG_MINOR,
+        .name           = "watchdog",
+        .fops           = &at91wdt_fops,
+};
+
+static int __init at91_wdt_init(void)
+{
+        int res;
+
+        /* Check that the heartbeat value is within range; if not reset to the default */
+        if (at91_wdt_settimeout(wdt_time)) {
+                at91_wdt_settimeout(WDT_DEFAULT_TIME);
+                printk(KERN_INFO "at91_wdt: wdt_time value must be 1 <= wdt_time <= 256, using %d\n", wdt_time);
+        }
+
+        res = misc_register(&at91wdt_miscdev);
+        if (res)
+                return res;
+
+        printk("AT91 Watchdog Timer enabled (%d seconds, nowayout=%d)\n", wdt_time, nowayout);
+        return 0;
+}
+
+static void __exit at91_wdt_exit(void)
+{
+        misc_deregister(&at91wdt_miscdev);
+}
+
+module_init(at91_wdt_init);
+module_exit(at91_wdt_exit);
+
+MODULE_AUTHOR("Andrew Victor");
+MODULE_DESCRIPTION("Watchdog driver for Atmel AT91RM9200");
+MODULE_LICENSE("GPL");
+MODULE_ALIAS_MISCDEV(WATCHDOG_MINOR);
diff --git a/drivers/char/watchdog/pcwd.c b/drivers/char/watchdog/pcwd.c
index 8d6b249ad66b..6d44ca68312d 100644
--- a/drivers/char/watchdog/pcwd.c
+++ b/drivers/char/watchdog/pcwd.c
@@ -66,15 +66,13 @@
 #include <linux/fs.h>           /* For file operations */
 #include <linux/ioport.h>       /* For io-port access */
 #include <linux/spinlock.h>     /* For spin_lock/spin_unlock/... */
-#include <linux/sched.h>        /* TASK_INTERRUPTIBLE, set_current_state() and friends */
-#include <linux/slab.h>         /* For kmalloc */
 
 #include <asm/uaccess.h>        /* For copy_to_user/put_user/... */
 #include <asm/io.h>             /* For inb/outb/... */
 
 /* Module and version information */
-#define WATCHDOG_VERSION "1.16"
-#define WATCHDOG_DATE "03 Jan 2006"
+#define WATCHDOG_VERSION "1.17"
+#define WATCHDOG_DATE "12 Feb 2006"
 #define WATCHDOG_DRIVER_NAME "ISA-PC Watchdog"
 #define WATCHDOG_NAME "pcwd"
 #define PFX WATCHDOG_NAME ": "
@@ -96,15 +94,19 @@
  * PCI-PC Watchdog card.
 */
 /* Port 1 : Control Status #1 for the PC Watchdog card, revision A. */
-#define WD_WDRST                0x01    /* Previously reset state */
-#define WD_T110                 0x02    /* Temperature overheat sense */
-#define WD_HRTBT                0x04    /* Heartbeat sense */
-#define WD_RLY2                 0x08    /* External relay triggered */
-#define WD_SRLY2                0x80    /* Software external relay triggered */
+#define WD_WDRST                0x01    /* Previously reset state */
+#define WD_T110                 0x02    /* Temperature overheat sense */
+#define WD_HRTBT                0x04    /* Heartbeat sense */
+#define WD_RLY2                 0x08    /* External relay triggered */
+#define WD_SRLY2                0x80    /* Software external relay triggered */
 /* Port 1 : Control Status #1 for the PC Watchdog card, revision C. */
-#define WD_REVC_WTRP            0x01    /* Watchdog Trip status */
-#define WD_REVC_HRBT            0x02    /* Watchdog Heartbeat */
-#define WD_REVC_TTRP            0x04    /* Temperature Trip status */
+#define WD_REVC_WTRP            0x01    /* Watchdog Trip status */
+#define WD_REVC_HRBT            0x02    /* Watchdog Heartbeat */
+#define WD_REVC_TTRP            0x04    /* Temperature Trip status */
+#define WD_REVC_RL2A            0x08    /* Relay 2 activated by on-board processor */
+#define WD_REVC_RL1A            0x10    /* Relay 1 active */
+#define WD_REVC_R2DS            0x40    /* Relay 2 disable */
+#define WD_REVC_RLY2            0x80    /* Relay 2 activated? */
 /* Port 2 : Control Status #2 */
 #define WD_WDIS                 0x10    /* Watchdog Disabled */
 #define WD_ENTP                 0x20    /* Watchdog Enable Temperature Trip */
@@ -122,9 +124,14 @@
 #define CMD_ISA_VERSION_HUNDRETH        0x03
 #define CMD_ISA_VERSION_MINOR           0x04
 #define CMD_ISA_SWITCH_SETTINGS         0x05
+#define CMD_ISA_RESET_PC                0x06
+#define CMD_ISA_ARM_0                   0x07
+#define CMD_ISA_ARM_30                  0x08
+#define CMD_ISA_ARM_60                  0x09
 #define CMD_ISA_DELAY_TIME_2SECS        0x0A
 #define CMD_ISA_DELAY_TIME_4SECS        0x0B
 #define CMD_ISA_DELAY_TIME_8SECS        0x0C
+#define CMD_ISA_RESET_RELAYS            0x0D
 
 /*
  * We are using an kernel timer to do the pinging of the watchdog
@@ -142,6 +149,7 @@ static atomic_t open_allowed = ATOMIC_INIT(1);
 static char expect_close;
 static int temp_panic;
 static struct {                         /* this is private data for each ISA-PC watchdog card */
+        char fw_ver_str[6];             /* The cards firmware version */
         int revision;                   /* The card's revision */
         int supports_temp;              /* Wether or not the card has a temperature device */
         int command_mode;               /* Wether or not the card is in command mode */
@@ -153,6 +161,13 @@ static struct {				/* this is private data for each ISA-PC watchdog card */
 } pcwd_private;
 
 /* module parameters */
+#define QUIET   0       /* Default */
+#define VERBOSE 1       /* Verbose */
+#define DEBUG   2       /* print fancy stuff too */
+static int debug = QUIET;
+module_param(debug, int, 0);
+MODULE_PARM_DESC(debug, "Debug level: 0=Quiet, 1=Verbose, 2=Debug (default=0)");
+
 #define WATCHDOG_HEARTBEAT 60           /* 60 sec default heartbeat */
 static int heartbeat = WATCHDOG_HEARTBEAT;
 module_param(heartbeat, int, 0);
@@ -172,6 +187,10 @@ static int send_isa_command(int cmd)
         int control_status;
         int port0, last_port0;  /* Double read for stabilising */
 
+        if (debug >= DEBUG)
+                printk(KERN_DEBUG PFX "sending following data cmd=0x%02x\n",
+                        cmd);
+
         /* The WCMD bit must be 1 and the command is only 4 bits in size */
         control_status = (cmd & 0x0F) | WD_WCMD;
         outb_p(control_status, pcwd_private.io_addr + 2);
@@ -188,6 +207,10 @@ static int send_isa_command(int cmd)
                 udelay (250);
         }
 
+        if (debug >= DEBUG)
+                printk(KERN_DEBUG PFX "received following data for cmd=0x%02x: port0=0x%02x last_port0=0x%02x\n",
+                        cmd, port0, last_port0);
+
         return port0;
 }
 
@@ -214,6 +237,10 @@ static int set_command_mode(void)
         spin_unlock(&pcwd_private.io_lock);
         pcwd_private.command_mode = found;
 
+        if (debug >= DEBUG)
+                printk(KERN_DEBUG PFX "command_mode=%d\n",
+                                pcwd_private.command_mode);
+
         return(found);
 }
 
@@ -226,6 +253,10 @@ static void unset_command_mode(void)
         spin_unlock(&pcwd_private.io_lock);
 
         pcwd_private.command_mode = 0;
+
+        if (debug >= DEBUG)
+                printk(KERN_DEBUG PFX "command_mode=%d\n",
+                                pcwd_private.command_mode);
 }
 
 static inline void pcwd_check_temperature_support(void)
@@ -234,27 +265,22 @@ static inline void pcwd_check_temperature_support(void)
                 pcwd_private.supports_temp = 1;
 }
 
-static inline char *get_firmware(void)
+static inline void pcwd_get_firmware(void)
 {
         int one, ten, hund, minor;
-        char *ret;
 
-        ret = kmalloc(6, GFP_KERNEL);
-        if(ret == NULL)
-                return NULL;
+        strcpy(pcwd_private.fw_ver_str, "ERROR");
 
         if (set_command_mode()) {
                 one = send_isa_command(CMD_ISA_VERSION_INTEGER);
                 ten = send_isa_command(CMD_ISA_VERSION_TENTH);
                 hund = send_isa_command(CMD_ISA_VERSION_HUNDRETH);
                 minor = send_isa_command(CMD_ISA_VERSION_MINOR);
-                sprintf(ret, "%c.%c%c%c", one, ten, hund, minor);
+                sprintf(pcwd_private.fw_ver_str, "%c.%c%c%c", one, ten, hund, minor);
         }
-        else
-                sprintf(ret, "ERROR");
-
         unset_command_mode();
-        return(ret);
+
+        return;
 }
 
 static inline int pcwd_get_option_switches(void)
@@ -272,17 +298,15 @@ static inline int pcwd_get_option_switches(void)
 
 static void pcwd_show_card_info(void)
 {
-        char *firmware;
         int option_switches;
 
         /* Get some extra info from the hardware (in command/debug/diag mode) */
         if (pcwd_private.revision == PCWD_REVISION_A)
                 printk(KERN_INFO PFX "ISA-PC Watchdog (REV.A) detected at port 0x%04x\n", pcwd_private.io_addr);
         else if (pcwd_private.revision == PCWD_REVISION_C) {
-                firmware = get_firmware();
+                pcwd_get_firmware();
                 printk(KERN_INFO PFX "ISA-PC Watchdog (REV.C) detected at port 0x%04x (Firmware version: %s)\n",
-                        pcwd_private.io_addr, firmware);
-                kfree(firmware);
+                        pcwd_private.io_addr, pcwd_private.fw_ver_str);
                 option_switches = pcwd_get_option_switches();
                 printk(KERN_INFO PFX "Option switches (0x%02x): Temperature Reset Enable=%s, Power On Delay=%s\n",
                         option_switches,
@@ -362,6 +386,10 @@ static int pcwd_start(void)
                         return -EIO;
                 }
         }
+
+        if (debug >= VERBOSE)
+                printk(KERN_DEBUG PFX "Watchdog started\n");
+
         return 0;
 }
 
@@ -386,6 +414,10 @@ static int pcwd_stop(void)
                         return -EIO;
                 }
         }
+
+        if (debug >= VERBOSE)
+                printk(KERN_DEBUG PFX "Watchdog stopped\n");
+
         return 0;
 }
 
@@ -393,6 +425,10 @@ static int pcwd_keepalive(void)
 {
         /* user land ping */
         pcwd_private.next_heartbeat = jiffies + (heartbeat * HZ);
+
+        if (debug >= DEBUG)
+                printk(KERN_DEBUG PFX "Watchdog keepalive signal send\n");
+
         return 0;
 }
 
@@ -402,12 +438,17 @@ static int pcwd_set_heartbeat(int t)
                 return -EINVAL;
 
         heartbeat = t;
+
+        if (debug >= VERBOSE)
+                printk(KERN_DEBUG PFX "New heartbeat: %d\n",
+                       heartbeat);
+
         return 0;
 }
 
 static int pcwd_get_status(int *status)
 {
-        int card_status;
+        int control_status;
 
         *status=0;
         spin_lock(&pcwd_private.io_lock);
@@ -415,37 +456,39 @@ static int pcwd_get_status(int *status)
                 /* Rev A cards return status information from
                  * the base register, which is used for the
                  * temperature in other cards. */
-                card_status = inb(pcwd_private.io_addr);
+                control_status = inb(pcwd_private.io_addr);
         else {
                 /* Rev C cards return card status in the base
                  * address + 1 register. And use different bits
                  * to indicate a card initiated reset, and an
                  * over-temperature condition. And the reboot
                  * status can be reset. */
-                card_status = inb(pcwd_private.io_addr + 1);
+                control_status = inb(pcwd_private.io_addr + 1);
         }
         spin_unlock(&pcwd_private.io_lock);
 
         if (pcwd_private.revision == PCWD_REVISION_A) {
-                if (card_status & WD_WDRST)
+                if (control_status & WD_WDRST)
                         *status |= WDIOF_CARDRESET;
 
-                if (card_status & WD_T110) {
+                if (control_status & WD_T110) {
                         *status |= WDIOF_OVERHEAT;
                         if (temp_panic) {
                                 printk (KERN_INFO PFX "Temperature overheat trip!\n");
                                 kernel_power_off();
+                                /* or should we just do a: panic(PFX "Temperature overheat trip!\n"); */
                         }
                 }
         } else {
-                if (card_status & WD_REVC_WTRP)
+                if (control_status & WD_REVC_WTRP)
                         *status |= WDIOF_CARDRESET;
 
-                if (card_status & WD_REVC_TTRP) {
+                if (control_status & WD_REVC_TTRP) {
                         *status |= WDIOF_OVERHEAT;
                         if (temp_panic) {
                                 printk (KERN_INFO PFX "Temperature overheat trip!\n");
                                 kernel_power_off();
+                                /* or should we just do a: panic(PFX "Temperature overheat trip!\n"); */
                         }
                 }
         }
@@ -455,9 +498,25 @@ static int pcwd_get_status(int *status)
 
 static int pcwd_clear_status(void)
 {
+        int control_status;
+
         if (pcwd_private.revision == PCWD_REVISION_C) {
                 spin_lock(&pcwd_private.io_lock);
-                outb_p(0x00, pcwd_private.io_addr + 1); /* clear reset status */
+
+                if (debug >= VERBOSE)
+                        printk(KERN_INFO PFX "clearing watchdog trip status\n");
+
+                control_status = inb_p(pcwd_private.io_addr + 1);
+
+                if (debug >= DEBUG) {
+                        printk(KERN_DEBUG PFX "status was: 0x%02x\n", control_status);
+                        printk(KERN_DEBUG PFX "sending: 0x%02x\n",
+                                (control_status & WD_REVC_R2DS));
+                }
+
+                /* clear reset status & Keep Relay 2 disable state as it is */
+                outb_p((control_status & WD_REVC_R2DS), pcwd_private.io_addr + 1);
+
                 spin_unlock(&pcwd_private.io_lock);
         }
         return 0;
@@ -481,6 +540,11 @@ static int pcwd_get_temperature(int *temperature)
         *temperature = ((inb(pcwd_private.io_addr)) * 9 / 5) + 32;
         spin_unlock(&pcwd_private.io_lock);
 
+        if (debug >= DEBUG) {
+                printk(KERN_DEBUG PFX "temperature is: %d F\n",
+                        *temperature);
+        }
+
         return 0;
 }
 
@@ -599,6 +663,8 @@ static ssize_t pcwd_write(struct file *file, const char __user *buf, size_t len,
 static int pcwd_open(struct inode *inode, struct file *file)
 {
         if (!atomic_dec_and_test(&open_allowed) ) {
+                if (debug >= VERBOSE)
+                        printk(KERN_ERR PFX "Attempt to open already opened device.\n");
                 atomic_inc( &open_allowed );
                 return -EBUSY;
         }
@@ -922,7 +988,8 @@ static void __exit pcwd_cleanup_module(void)
 {
         if (pcwd_private.io_addr)
                 pcwatchdog_exit();
-        return;
+
+        printk(KERN_INFO PFX "Watchdog Module Unloaded.\n");
 }
 
 module_init(pcwd_init_module);
diff --git a/drivers/char/watchdog/pcwd_usb.c b/drivers/char/watchdog/pcwd_usb.c
index 2700c5c45b8a..3fdfda9324fa 100644
--- a/drivers/char/watchdog/pcwd_usb.c
+++ b/drivers/char/watchdog/pcwd_usb.c
@@ -705,7 +705,8 @@ err_out_misc_deregister:
 err_out_unregister_reboot:
         unregister_reboot_notifier(&usb_pcwd_notifier);
 error:
-        usb_pcwd_delete (usb_pcwd);
+        if (usb_pcwd)
+                usb_pcwd_delete(usb_pcwd);
         usb_pcwd_device = NULL;
         return retval;
 }
diff --git a/drivers/hwmon/hdaps.c b/drivers/hwmon/hdaps.c
index 7636c1a58f9c..1659f6c41458 100644
--- a/drivers/hwmon/hdaps.c
+++ b/drivers/hwmon/hdaps.c
@@ -33,7 +33,6 @@
 #include <linux/module.h>
 #include <linux/timer.h>
 #include <linux/dmi.h>
-#include <linux/mutex.h>
 #include <asm/io.h>
 
 #define HDAPS_LOW_PORT          0x1600  /* first port used by hdaps */
@@ -71,10 +70,10 @@ static u8 km_activity;
 static int rest_x;
 static int rest_y;
 
-static DEFINE_MUTEX(hdaps_mutex);
+static DECLARE_MUTEX(hdaps_sem);
 
 /*
- * __get_latch - Get the value from a given port.  Callers must hold hdaps_mutex.
+ * __get_latch - Get the value from a given port.  Callers must hold hdaps_sem.
  */
 static inline u8 __get_latch(u16 port)
 {
@@ -83,7 +82,7 @@ static inline u8 __get_latch(u16 port)
 
 /*
  * __check_latch - Check a port latch for a given value.  Returns zero if the
- * port contains the given value.  Callers must hold hdaps_mutex.
+ * port contains the given value.  Callers must hold hdaps_sem.
  */
 static inline int __check_latch(u16 port, u8 val)
 {
@@ -94,7 +93,7 @@ static inline int __check_latch(u16 port, u8 val)
 
 /*
  * __wait_latch - Wait up to 100us for a port latch to get a certain value,
- * returning zero if the value is obtained.  Callers must hold hdaps_mutex.
+ * returning zero if the value is obtained.  Callers must hold hdaps_sem.
  */
 static int __wait_latch(u16 port, u8 val)
 {
@@ -111,7 +110,7 @@ static int __wait_latch(u16 port, u8 val)
 
 /*
  * __device_refresh - request a refresh from the accelerometer.  Does not wait
- * for refresh to complete.  Callers must hold hdaps_mutex.
+ * for refresh to complete.  Callers must hold hdaps_sem.
  */
 static void __device_refresh(void)
 {
@@ -125,7 +124,7 @@ static void __device_refresh(void)
 /*
  * __device_refresh_sync - request a synchronous refresh from the
  * accelerometer.  We wait for the refresh to complete.  Returns zero if
- * successful and nonzero on error.  Callers must hold hdaps_mutex.
+ * successful and nonzero on error.  Callers must hold hdaps_sem.
  */
 static int __device_refresh_sync(void)
 {
@@ -135,7 +134,7 @@ static int __device_refresh_sync(void)
 
 /*
  * __device_complete - indicate to the accelerometer that we are done reading
- * data, and then initiate an async refresh.  Callers must hold hdaps_mutex.
+ * data, and then initiate an async refresh.  Callers must hold hdaps_sem.
  */
 static inline void __device_complete(void)
 {
@@ -153,7 +152,7 @@ static int hdaps_readb_one(unsigned int port, u8 *val)
 {
         int ret;
 
-        mutex_lock(&hdaps_mutex);
+        down(&hdaps_sem);
 
         /* do a sync refresh -- we need to be sure that we read fresh data */
         ret = __device_refresh_sync();
@@ -164,7 +163,7 @@ static int hdaps_readb_one(unsigned int port, u8 *val)
         __device_complete();
 
 out:
-        mutex_unlock(&hdaps_mutex);
+        up(&hdaps_sem);
         return ret;
 }
 
@@ -199,9 +198,9 @@ static int hdaps_read_pair(unsigned int port1, unsigned int port2,
 {
         int ret;
 
-        mutex_lock(&hdaps_mutex);
+        down(&hdaps_sem);
         ret = __hdaps_read_pair(port1, port2, val1, val2);
-        mutex_unlock(&hdaps_mutex);
+        up(&hdaps_sem);
 
         return ret;
 }
@@ -214,7 +213,7 @@ static int hdaps_device_init(void)
 {
         int total, ret = -ENXIO;
 
-        mutex_lock(&hdaps_mutex);
+        down(&hdaps_sem);
 
         outb(0x13, 0x1610);
         outb(0x01, 0x161f);
@@ -280,7 +279,7 @@ static int hdaps_device_init(void)
         }
 
 out:
-        mutex_unlock(&hdaps_mutex);
+        up(&hdaps_sem);
         return ret;
 }
 
@@ -314,7 +313,7 @@ static struct platform_driver hdaps_driver = {
 };
 
 /*
- * hdaps_calibrate - Set our "resting" values.  Callers must hold hdaps_mutex.
+ * hdaps_calibrate - Set our "resting" values.  Callers must hold hdaps_sem.
  */
 static void hdaps_calibrate(void)
 {
@@ -326,7 +325,7 @@ static void hdaps_mousedev_poll(unsigned long unused)
         int x, y;
 
         /* Cannot sleep.  Try nonblockingly.  If we fail, try again later. */
-        if (!mutex_trylock(&hdaps_mutex)) {
+        if (down_trylock(&hdaps_sem)) {
                 mod_timer(&hdaps_timer,jiffies + HDAPS_POLL_PERIOD);
                 return;
         }
@@ -341,7 +340,7 @@ static void hdaps_mousedev_poll(unsigned long unused)
         mod_timer(&hdaps_timer, jiffies + HDAPS_POLL_PERIOD);
 
 out:
-        mutex_unlock(&hdaps_mutex);
+        up(&hdaps_sem);
 }
 
 
@@ -421,9 +420,9 @@ static ssize_t hdaps_calibrate_store(struct device *dev,
                                      struct device_attribute *attr,
                                      const char *buf, size_t count)
 {
-        mutex_lock(&hdaps_mutex);
+        down(&hdaps_sem);
         hdaps_calibrate();
-        mutex_unlock(&hdaps_mutex);
+        up(&hdaps_sem);
 
         return count;
 }
@@ -510,12 +509,22 @@ static int hdaps_dmi_match_invert(struct dmi_system_id *id)
         }                                               \
 }
 
+#define HDAPS_DMI_MATCH_LENOVO(model)   {               \
+        .ident = "Lenovo " model,                       \
+        .callback = hdaps_dmi_match_invert,             \
+        .matches = {                                    \
+                DMI_MATCH(DMI_BOARD_VENDOR, "LENOVO"),  \
+                DMI_MATCH(DMI_PRODUCT_VERSION, model)   \
+        }                                               \
+}
+
 static int __init hdaps_init(void)
 {
         int ret;
 
         /* Note that DMI_MATCH(...,"ThinkPad T42") will match "ThinkPad T42p" */
         struct dmi_system_id hdaps_whitelist[] = {
+                HDAPS_DMI_MATCH_NORMAL("ThinkPad H"),
                 HDAPS_DMI_MATCH_INVERT("ThinkPad R50p"),
                 HDAPS_DMI_MATCH_NORMAL("ThinkPad R50"),
                 HDAPS_DMI_MATCH_NORMAL("ThinkPad R51"),
@@ -525,15 +534,17 @@ static int __init hdaps_init(void)
                 HDAPS_DMI_MATCH_INVERT("ThinkPad T42p"),
                 HDAPS_DMI_MATCH_NORMAL("ThinkPad T42"),
                 HDAPS_DMI_MATCH_NORMAL("ThinkPad T43"),
+                HDAPS_DMI_MATCH_LENOVO("ThinkPad T60p"),
                 HDAPS_DMI_MATCH_NORMAL("ThinkPad X40"),
                 HDAPS_DMI_MATCH_NORMAL("ThinkPad X41 Tablet"),
                 HDAPS_DMI_MATCH_NORMAL("ThinkPad X41"),
+                HDAPS_DMI_MATCH_LENOVO("ThinkPad X60"),
                 { .ident = NULL }
         };
 
         if (!dmi_check_system(hdaps_whitelist)) {
                 printk(KERN_WARNING "hdaps: supported laptop not found!\n");
-                ret = -ENXIO;
+                ret = -ENODEV;
                 goto out;
         }
 
diff --git a/drivers/ide/legacy/ide-cs.c b/drivers/ide/legacy/ide-cs.c
index 6213bd3caee5..4961f1e764a7 100644
--- a/drivers/ide/legacy/ide-cs.c
+++ b/drivers/ide/legacy/ide-cs.c
@@ -81,14 +81,14 @@ static const char ide_major[] = {
 };
 
 typedef struct ide_info_t {
-    dev_link_t  link;
+        struct pcmcia_device    *p_dev;
     int         ndev;
     dev_node_t  node;
     int         hd;
 } ide_info_t;
 
-static void ide_release(dev_link_t *);
-static void ide_config(dev_link_t *);
+static void ide_release(struct pcmcia_device *);
+static int ide_config(struct pcmcia_device *);
 
 static void ide_detach(struct pcmcia_device *p_dev);
 
@@ -103,10 +103,9 @@ static void ide_detach(struct pcmcia_device *p_dev);
 
 ======================================================================*/
 
-static int ide_attach(struct pcmcia_device *p_dev)
+static int ide_probe(struct pcmcia_device *link)
 {
     ide_info_t *info;
-    dev_link_t *link;
 
     DEBUG(0, "ide_attach()\n");
 
@@ -114,7 +113,9 @@ static int ide_attach(struct pcmcia_device *p_dev)
     info = kzalloc(sizeof(*info), GFP_KERNEL);
     if (!info)
         return -ENOMEM;
-    link = &info->link; link->priv = info;
+
+    info->p_dev = link;
+    link->priv = info;
 
     link->io.Attributes1 = IO_DATA_PATH_WIDTH_AUTO;
     link->io.Attributes2 = IO_DATA_PATH_WIDTH_8;
@@ -122,16 +123,9 @@ static int ide_attach(struct pcmcia_device *p_dev)
     link->irq.Attributes = IRQ_TYPE_EXCLUSIVE;
     link->irq.IRQInfo1 = IRQ_LEVEL_ID;
     link->conf.Attributes = CONF_ENABLE_IRQ;
-    link->conf.Vcc = 50;
     link->conf.IntType = INT_MEMORY_AND_IO;
 
-    link->handle = p_dev;
-    p_dev->instance = link;
-
-    link->state |= DEV_PRESENT | DEV_CONFIG_PENDING;
-    ide_config(link);
-
-    return 0;
+    return ide_config(link);
 } /* ide_attach */
 
 /*======================================================================
@@ -143,14 +137,11 @@ static int ide_attach(struct pcmcia_device *p_dev)
 
 ======================================================================*/
 
-static void ide_detach(struct pcmcia_device *p_dev)
+static void ide_detach(struct pcmcia_device *link)
 {
-    dev_link_t *link = dev_to_instance(p_dev);
-
     DEBUG(0, "ide_detach(0x%p)\n", link);
 
-    if (link->state & DEV_CONFIG)
-        ide_release(link);
+    ide_release(link);
 
     kfree(link->priv);
 } /* ide_detach */
@@ -177,9 +168,8 @@ static int idecs_register(unsigned long io, unsigned long ctl, unsigned long irq
 #define CS_CHECK(fn, ret) \
 do { last_fn = (fn); if ((last_ret = (ret)) != 0) goto cs_failed; } while (0)
 
-static void ide_config(dev_link_t *link)
+static int ide_config(struct pcmcia_device *link)
 {
-    client_handle_t handle = link->handle;
     ide_info_t *info = link->priv;
     tuple_t tuple;
     struct {
@@ -203,34 +193,30 @@ static void ide_config(dev_link_t *link)
     tuple.TupleDataMax = 255;
     tuple.Attributes = 0;
     tuple.DesiredTuple = CISTPL_CONFIG;
-    CS_CHECK(GetFirstTuple, pcmcia_get_first_tuple(handle, &tuple));
-    CS_CHECK(GetTupleData, pcmcia_get_tuple_data(handle, &tuple));
-    CS_CHECK(ParseTuple, pcmcia_parse_tuple(handle, &tuple, &stk->parse));
+    CS_CHECK(GetFirstTuple, pcmcia_get_first_tuple(link, &tuple));
+    CS_CHECK(GetTupleData, pcmcia_get_tuple_data(link, &tuple));
+    CS_CHECK(ParseTuple, pcmcia_parse_tuple(link, &tuple, &stk->parse));
     link->conf.ConfigBase = stk->parse.config.base;
     link->conf.Present = stk->parse.config.rmask[0];
 
     tuple.DesiredTuple = CISTPL_MANFID;
-    if (!pcmcia_get_first_tuple(handle, &tuple) &&
-        !pcmcia_get_tuple_data(handle, &tuple) &&
-        !pcmcia_parse_tuple(handle, &tuple, &stk->parse))
+    if (!pcmcia_get_first_tuple(link, &tuple) &&
+        !pcmcia_get_tuple_data(link, &tuple) &&
+        !pcmcia_parse_tuple(link, &tuple, &stk->parse))
         is_kme = ((stk->parse.manfid.manf == MANFID_KME) &&
                   ((stk->parse.manfid.card == PRODID_KME_KXLC005_A) ||
                    (stk->parse.manfid.card == PRODID_KME_KXLC005_B)));
 
-    /* Configure card */
-    link->state |= DEV_CONFIG;
-
     /* Not sure if this is right... look up the current Vcc */
-    CS_CHECK(GetConfigurationInfo, pcmcia_get_configuration_info(handle, &stk->conf));
-    link->conf.Vcc = stk->conf.Vcc;
+    CS_CHECK(GetConfigurationInfo, pcmcia_get_configuration_info(link, &stk->conf));
 
     pass = io_base = ctl_base = 0;
     tuple.DesiredTuple = CISTPL_CFTABLE_ENTRY;
     tuple.Attributes = 0;
-    CS_CHECK(GetFirstTuple, pcmcia_get_first_tuple(handle, &tuple));
+    CS_CHECK(GetFirstTuple, pcmcia_get_first_tuple(link, &tuple));
     while (1) {
-        if (pcmcia_get_tuple_data(handle, &tuple) != 0) goto next_entry;
-        if (pcmcia_parse_tuple(handle, &tuple, &stk->parse) != 0) goto next_entry;
+        if (pcmcia_get_tuple_data(link, &tuple) != 0) goto next_entry;
+        if (pcmcia_parse_tuple(link, &tuple, &stk->parse) != 0) goto next_entry;
 
         /* Check for matching Vcc, unless we're desperate */
         if (!pass) {
@@ -244,10 +230,10 @@ static void ide_config(dev_link_t *link)
         }
 
         if (cfg->vpp1.present & (1 << CISTPL_POWER_VNOM))
-            link->conf.Vpp1 = link->conf.Vpp2 =
+            link->conf.Vpp =
                 cfg->vpp1.param[CISTPL_POWER_VNOM] / 10000;
         else if (stk->dflt.vpp1.present & (1 << CISTPL_POWER_VNOM))
-            link->conf.Vpp1 = link->conf.Vpp2 =
+            link->conf.Vpp =
                 stk->dflt.vpp1.param[CISTPL_POWER_VNOM] / 10000;
 
         if ((cfg->io.nwin > 0) || (stk->dflt.io.nwin > 0)) {
@@ -261,14 +247,14 @@ static void ide_config(dev_link_t *link)
                 link->io.NumPorts1 = 8;
                 link->io.BasePort2 = io->win[1].base;
                 link->io.NumPorts2 = (is_kme) ? 2 : 1;
-                if (pcmcia_request_io(link->handle, &link->io) != 0)
+                if (pcmcia_request_io(link, &link->io) != 0)
                         goto next_entry;
                 io_base = link->io.BasePort1;
                 ctl_base = link->io.BasePort2;
             } else if ((io->nwin == 1) && (io->win[0].len >= 16)) {
                 link->io.NumPorts1 = io->win[0].len;
                 link->io.NumPorts2 = 0;
-                if (pcmcia_request_io(link->handle, &link->io) != 0)
+                if (pcmcia_request_io(link, &link->io) != 0)
                         goto next_entry;
                 io_base = link->io.BasePort1;
                 ctl_base = link->io.BasePort1 + 0x0e;
@@ -281,16 +267,16 @@ static void ide_config(dev_link_t *link)
         if (cfg->flags & CISTPL_CFTABLE_DEFAULT)
             memcpy(&stk->dflt, cfg, sizeof(stk->dflt));
         if (pass) {
-            CS_CHECK(GetNextTuple, pcmcia_get_next_tuple(handle, &tuple));
-        } else if (pcmcia_get_next_tuple(handle, &tuple) != 0) {
-            CS_CHECK(GetFirstTuple, pcmcia_get_first_tuple(handle, &tuple));
+            CS_CHECK(GetNextTuple, pcmcia_get_next_tuple(link, &tuple));
+        } else if (pcmcia_get_next_tuple(link, &tuple) != 0) {
+            CS_CHECK(GetFirstTuple, pcmcia_get_first_tuple(link, &tuple));
             memset(&stk->dflt, 0, sizeof(stk->dflt));
             pass++;
         }
     }
 
-    CS_CHECK(RequestIRQ, pcmcia_request_irq(handle, &link->irq));
-    CS_CHECK(RequestConfiguration, pcmcia_request_configuration(handle, &link->conf));
+    CS_CHECK(RequestIRQ, pcmcia_request_irq(link, &link->irq));
+    CS_CHECK(RequestConfiguration, pcmcia_request_configuration(link, &link->conf));
 
     /* disable drive interrupts during IDE probe */
     outb(0x02, ctl_base);
@@ -301,12 +287,12 @@ static void ide_config(dev_link_t *link)
 
     /* retry registration in case device is still spinning up */
     for (hd = -1, i = 0; i < 10; i++) {
-        hd = idecs_register(io_base, ctl_base, link->irq.AssignedIRQ, handle);
+        hd = idecs_register(io_base, ctl_base, link->irq.AssignedIRQ, link);
         if (hd >= 0) break;
         if (link->io.NumPorts1 == 0x20) {
             outb(0x02, ctl_base + 0x10);
             hd = idecs_register(io_base + 0x10, ctl_base + 0x10,
-                                link->irq.AssignedIRQ, handle);
+                                link->irq.AssignedIRQ, link);
             if (hd >= 0) {
                 io_base += 0x10;
                 ctl_base += 0x10;
@@ -328,25 +314,23 @@ static void ide_config(dev_link_t *link)
     info->node.major = ide_major[hd];
     info->node.minor = 0;
     info->hd = hd;
-    link->dev = &info->node;
-    printk(KERN_INFO "ide-cs: %s: Vcc = %d.%d, Vpp = %d.%d\n",
-           info->node.dev_name, link->conf.Vcc / 10, link->conf.Vcc % 10,
-           link->conf.Vpp1 / 10, link->conf.Vpp1 % 10);
+    link->dev_node = &info->node;
+    printk(KERN_INFO "ide-cs: %s: Vpp = %d.%d\n",
+           info->node.dev_name, link->conf.Vpp / 10, link->conf.Vpp % 10);
 
-    link->state &= ~DEV_CONFIG_PENDING;
     kfree(stk);
-    return;
+    return 0;
 
 err_mem:
     printk(KERN_NOTICE "ide-cs: ide_config failed memory allocation\n");
     goto failed;
 
 cs_failed:
-    cs_error(link->handle, last_fn, last_ret);
+    cs_error(link, last_fn, last_ret);
 failed:
     kfree(stk);
     ide_release(link);
-    link->state &= ~DEV_CONFIG_PENDING;
+    return -ENODEV;
 } /* ide_config */
 
 /*======================================================================
@@ -357,7 +341,7 @@ failed:
     
 ======================================================================*/
 
-void ide_release(dev_link_t *link)
+void ide_release(struct pcmcia_device *link)
 {
     ide_info_t *info = link->priv;
     
@@ -369,37 +353,10 @@ void ide_release(dev_link_t *link)
         ide_unregister(info->hd);
     }
     info->ndev = 0;
-    link->dev = NULL;
-    
-    pcmcia_release_configuration(link->handle);
-    pcmcia_release_io(link->handle, &link->io);
-    pcmcia_release_irq(link->handle, &link->irq);
-    
-    link->state &= ~DEV_CONFIG;
 
+    pcmcia_disable_device(link);
 } /* ide_release */
 
-static int ide_suspend(struct pcmcia_device *dev)
-{
-        dev_link_t *link = dev_to_instance(dev);
-
-        link->state |= DEV_SUSPEND;
-        if (link->state & DEV_CONFIG)
-                pcmcia_release_configuration(link->handle);
-
-        return 0;
-}
-
-static int ide_resume(struct pcmcia_device *dev)
-{
-        dev_link_t *link = dev_to_instance(dev);
-
-        link->state &= ~DEV_SUSPEND;
-        if (DEV_OK(link))
-                pcmcia_request_configuration(link->handle, &link->conf);
-
-        return 0;
-}
 
 /*======================================================================
 
@@ -459,11 +416,9 @@ static struct pcmcia_driver ide_cs_driver = {
         .drv            = {
                 .name   = "ide-cs",
         },
-        .probe          = ide_attach,
+        .probe          = ide_probe,
         .remove         = ide_detach,
         .id_table       = ide_ids,
-        .suspend        = ide_suspend,
-        .resume         = ide_resume,
 };
 
 static int __init init_ide_cs(void)
diff --git a/drivers/ieee1394/sbp2.c b/drivers/ieee1394/sbp2.c
index 2c765ca5aa50..f4206604db03 100644
--- a/drivers/ieee1394/sbp2.c
+++ b/drivers/ieee1394/sbp2.c
@@ -496,22 +496,17 @@ static struct sbp2_command_info *sbp2util_find_command_for_orb(
 /*
  * This function finds the sbp2_command for a given outstanding SCpnt.
  * Only looks at the inuse list.
+ * Must be called with scsi_id->sbp2_command_orb_lock held.
  */
-static struct sbp2_command_info *sbp2util_find_command_for_SCpnt(struct scsi_id_instance_data *scsi_id, void *SCpnt)
+static struct sbp2_command_info *sbp2util_find_command_for_SCpnt(
+                struct scsi_id_instance_data *scsi_id, void *SCpnt)
 {
         struct sbp2_command_info *command;
-        unsigned long flags;
 
-        spin_lock_irqsave(&scsi_id->sbp2_command_orb_lock, flags);
-        if (!list_empty(&scsi_id->sbp2_command_orb_inuse)) {
-                list_for_each_entry(command, &scsi_id->sbp2_command_orb_inuse, list) {
-                        if (command->Current_SCpnt == SCpnt) {
-                                spin_unlock_irqrestore(&scsi_id->sbp2_command_orb_lock, flags);
+        if (!list_empty(&scsi_id->sbp2_command_orb_inuse))
+                list_for_each_entry(command, &scsi_id->sbp2_command_orb_inuse, list)
+                        if (command->Current_SCpnt == SCpnt)
                                 return command;
-                        }
-                }
-        }
-        spin_unlock_irqrestore(&scsi_id->sbp2_command_orb_lock, flags);
         return NULL;
 }
 
@@ -580,17 +575,15 @@ static void sbp2util_free_command_dma(struct sbp2_command_info *command)
 
 /*
  * This function moves a command to the completed orb list.
+ * Must be called with scsi_id->sbp2_command_orb_lock held.
  */
-static void sbp2util_mark_command_completed(struct scsi_id_instance_data *scsi_id,
-                                            struct sbp2_command_info *command)
+static void sbp2util_mark_command_completed(
+                struct scsi_id_instance_data *scsi_id,
+                struct sbp2_command_info *command)
 {
-        unsigned long flags;
-
-        spin_lock_irqsave(&scsi_id->sbp2_command_orb_lock, flags);
         list_del(&command->list);
         sbp2util_free_command_dma(command);
         list_add_tail(&command->list, &scsi_id->sbp2_command_orb_completed);
-        spin_unlock_irqrestore(&scsi_id->sbp2_command_orb_lock, flags);
 }
 
 /*
@@ -2148,7 +2141,9 @@ static int sbp2_handle_status_write(struct hpsb_host *host, int nodeid, int dest
                  * Matched status with command, now grab scsi command pointers and check status
                  */
                 SCpnt = command->Current_SCpnt;
+                spin_lock_irqsave(&scsi_id->sbp2_command_orb_lock, flags);
                 sbp2util_mark_command_completed(scsi_id, command);
+                spin_unlock_irqrestore(&scsi_id->sbp2_command_orb_lock, flags);
 
                 if (SCpnt) {
 
@@ -2484,6 +2479,7 @@ static int sbp2scsi_abort(struct scsi_cmnd *SCpnt)
                 (struct scsi_id_instance_data *)SCpnt->device->host->hostdata[0];
         struct sbp2scsi_host_info *hi = scsi_id->hi;
         struct sbp2_command_info *command;
+        unsigned long flags;
 
         SBP2_ERR("aborting sbp2 command");
         scsi_print_command(SCpnt);
@@ -2494,6 +2490,7 @@ static int sbp2scsi_abort(struct scsi_cmnd *SCpnt)
                  * Right now, just return any matching command structures
                  * to the free pool.
                  */
+                spin_lock_irqsave(&scsi_id->sbp2_command_orb_lock, flags);
                 command = sbp2util_find_command_for_SCpnt(scsi_id, SCpnt);
                 if (command) {
                         SBP2_DEBUG("Found command to abort");
@@ -2511,6 +2508,7 @@ static int sbp2scsi_abort(struct scsi_cmnd *SCpnt)
                                 command->Current_done(command->Current_SCpnt);
                         }
                 }
+                spin_unlock_irqrestore(&scsi_id->sbp2_command_orb_lock, flags);
 
                 /*
                  * Initiate a fetch agent reset.
diff --git a/drivers/infiniband/Kconfig b/drivers/infiniband/Kconfig
index bdf0891a92dd..afc612b8577d 100644
--- a/drivers/infiniband/Kconfig
+++ b/drivers/infiniband/Kconfig
@@ -30,6 +30,7 @@ config INFINIBAND_USER_ACCESS
           <http://www.openib.org>.
 
 source "drivers/infiniband/hw/mthca/Kconfig"
+source "drivers/infiniband/hw/ipath/Kconfig"
 
 source "drivers/infiniband/ulp/ipoib/Kconfig"
 
diff --git a/drivers/infiniband/Makefile b/drivers/infiniband/Makefile
index a43fb34cca94..eea27322a22d 100644
--- a/drivers/infiniband/Makefile
+++ b/drivers/infiniband/Makefile
@@ -1,4 +1,5 @@
 obj-$(CONFIG_INFINIBAND)                += core/
 obj-$(CONFIG_INFINIBAND_MTHCA)          += hw/mthca/
+obj-$(CONFIG_IPATH_CORE)                += hw/ipath/
 obj-$(CONFIG_INFINIBAND_IPOIB)          += ulp/ipoib/
 obj-$(CONFIG_INFINIBAND_SRP)            += ulp/srp/
diff --git a/drivers/infiniband/hw/ipath/Kconfig b/drivers/infiniband/hw/ipath/Kconfig
new file mode 100644
index 000000000000..9ea67c409b6d
--- /dev/null
+++ b/drivers/infiniband/hw/ipath/Kconfig
@@ -0,0 +1,16 @@
+config IPATH_CORE
+        tristate "PathScale InfiniPath Driver"
+        depends on 64BIT && PCI_MSI && NET
+        ---help---
+        This is a low-level driver for PathScale InfiniPath host channel
+        adapters (HCAs) based on the HT-400 and PE-800 chips.
+
+config INFINIBAND_IPATH
+        tristate "PathScale InfiniPath Verbs Driver"
+        depends on IPATH_CORE && INFINIBAND
+        ---help---
+        This is a driver that provides InfiniBand verbs support for
+        PathScale InfiniPath host channel adapters (HCAs).  This
+        allows these devices to be used with both kernel upper level
+        protocols such as IP-over-InfiniBand as well as with userspace
+        applications (in conjunction with InfiniBand userspace access).
diff --git a/drivers/infiniband/hw/ipath/Makefile b/drivers/infiniband/hw/ipath/Makefile
new file mode 100644
index 000000000000..b4d084abfd22
--- /dev/null
+++ b/drivers/infiniband/hw/ipath/Makefile
@@ -0,0 +1,36 @@
+EXTRA_CFLAGS += -DIPATH_IDSTR='"PathScale kernel.org driver"' \
+        -DIPATH_KERN_TYPE=0
+
+obj-$(CONFIG_IPATH_CORE) += ipath_core.o
+obj-$(CONFIG_INFINIBAND_IPATH) += ib_ipath.o
+
+ipath_core-y := \
+        ipath_diag.o \
+        ipath_driver.o \
+        ipath_eeprom.o \
+        ipath_file_ops.o \
+        ipath_fs.o \
+        ipath_ht400.o \
+        ipath_init_chip.o \
+        ipath_intr.o \
+        ipath_layer.o \
+        ipath_pe800.o \
+        ipath_stats.o \
+        ipath_sysfs.o \
+        ipath_user_pages.o
+
+ipath_core-$(CONFIG_X86_64) += ipath_wc_x86_64.o
+
+ib_ipath-y := \
+        ipath_cq.o \
+        ipath_keys.o \
+        ipath_mad.o \
+        ipath_mr.o \
+        ipath_qp.o \
+        ipath_rc.o \
+        ipath_ruc.o \
+        ipath_srq.o \
+        ipath_uc.o \
+        ipath_ud.o \
+        ipath_verbs.o \
+        ipath_verbs_mcast.o
diff --git a/drivers/infiniband/hw/ipath/ipath_common.h b/drivers/infiniband/hw/ipath/ipath_common.h
new file mode 100644
index 000000000000..48a55247b832
--- /dev/null
+++ b/drivers/infiniband/hw/ipath/ipath_common.h
@@ -0,0 +1,616 @@
+/*
+ * Copyright (c) 2003, 2004, 2005, 2006 PathScale, Inc. All rights reserved.
+ *
+ * This software is available to you under a choice of one of two
+ * licenses.  You may choose to be licensed under the terms of the GNU
+ * General Public License (GPL) Version 2, available from the file
+ * COPYING in the main directory of this source tree, or the
+ * OpenIB.org BSD license below:
+ *
+ *     Redistribution and use in source and binary forms, with or
+ *     without modification, are permitted provided that the following
+ *     conditions are met:
+ *
+ *      - Redistributions of source code must retain the above
+ *        copyright notice, this list of conditions and the following
+ *        disclaimer.
+ *
+ *      - Redistributions in binary form must reproduce the above
+ *        copyright notice, this list of conditions and the following
+ *        disclaimer in the documentation and/or other materials
+ *        provided with the distribution.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+ * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+ * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+ * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
+ * BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
+ * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
+ * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+ * SOFTWARE.
+ */
+
+#ifndef _IPATH_COMMON_H
+#define _IPATH_COMMON_H
+
+/*
+ * This file contains defines, structures, etc. that are used
+ * to communicate between kernel and user code.
+ */
+
+/* This is the IEEE-assigned OUI for PathScale, Inc. */
+#define IPATH_SRC_OUI_1 0x00
+#define IPATH_SRC_OUI_2 0x11
+#define IPATH_SRC_OUI_3 0x75
+
+/* version of protocol header (known to chip also). In the long run,
+ * we should be able to generate and accept a range of version numbers;
+ * for now we only accept one, and it's compiled in.
+ */
+#define IPS_PROTO_VERSION 2
+
+/*
+ * These are compile time constants that you may want to enable or disable
+ * if you are trying to debug problems with code or performance.
+ * IPATH_VERBOSE_TRACING define as 1 if you want additional tracing in
+ * fastpath code
+ * IPATH_TRACE_REGWRITES define as 1 if you want register writes to be
+ * traced in faspath code
+ * _IPATH_TRACING define as 0 if you want to remove all tracing in a
+ * compilation unit
+ * _IPATH_DEBUGGING define as 0 if you want to remove debug prints
+ */
+
+/*
+ * The value in the BTH QP field that InfiniPath uses to differentiate
+ * an infinipath protocol IB packet vs standard IB transport
+ */
+#define IPATH_KD_QP 0x656b79
+
+/*
+ * valid states passed to ipath_set_linkstate() user call
+ */
+#define IPATH_IB_LINKDOWN               0
+#define IPATH_IB_LINKARM                1
+#define IPATH_IB_LINKACTIVE             2
+#define IPATH_IB_LINKINIT               3
+#define IPATH_IB_LINKDOWN_SLEEP         4
+#define IPATH_IB_LINKDOWN_DISABLE       5
+
+/*
+ * stats maintained by the driver.  For now, at least, this is global
+ * to all minor devices.
+ */
+struct infinipath_stats {
+        /* number of interrupts taken */
+        __u64 sps_ints;
+        /* number of interrupts for errors */
+        __u64 sps_errints;
+        /* number of errors from chip (not incl. packet errors or CRC) */
+        __u64 sps_errs;
+        /* number of packet errors from chip other than CRC */
+        __u64 sps_pkterrs;
+        /* number of packets with CRC errors (ICRC and VCRC) */
+        __u64 sps_crcerrs;
+        /* number of hardware errors reported (parity, etc.) */
+        __u64 sps_hwerrs;
+        /* number of times IB link changed state unexpectedly */
+        __u64 sps_iblink;
+        /* no longer used; left for compatibility */
+        __u64 sps_unused3;
+        /* number of kernel (port0) packets received */
+        __u64 sps_port0pkts;
+        /* number of "ethernet" packets sent by driver */
+        __u64 sps_ether_spkts;
+        /* number of "ethernet" packets received by driver */
+        __u64 sps_ether_rpkts;
+        /* number of SMA packets sent by driver */
+        __u64 sps_sma_spkts;
+        /* number of SMA packets received by driver */
+        __u64 sps_sma_rpkts;
+        /* number of times all ports rcvhdrq was full and packet dropped */
+        __u64 sps_hdrqfull;
+        /* number of times all ports egrtid was full and packet dropped */
+        __u64 sps_etidfull;
+        /*
+         * number of times we tried to send from driver, but no pio buffers
+         * avail
+         */
+        __u64 sps_nopiobufs;
+        /* number of ports currently open */
+        __u64 sps_ports;
+        /* list of pkeys (other than default) accepted (0 means not set) */
+        __u16 sps_pkeys[4];
+        /* lids for up to 4 infinipaths, indexed by infinipath # */
+        __u16 sps_lid[4];
+        /* number of user ports per chip (not IB ports) */
+        __u32 sps_nports;
+        /* not our interrupt, or already handled */
+        __u32 sps_nullintr;
+        /* max number of packets handled per receive call */
+        __u32 sps_maxpkts_call;
+        /* avg number of packets handled per receive call */
+        __u32 sps_avgpkts_call;
+        /* total number of pages locked */
+        __u64 sps_pagelocks;
+        /* total number of pages unlocked */
+        __u64 sps_pageunlocks;
+        /*
+         * Number of packets dropped in kernel other than errors (ether
+         * packets if ipath not configured, sma/mad, etc.)
+         */
+        __u64 sps_krdrops;
+        /* mlids for up to 4 infinipaths, indexed by infinipath # */
+        __u16 sps_mlid[4];
+        /* pad for future growth */
+        __u64 __sps_pad[45];
+};
+
+/*
+ * These are the status bits readable (in ascii form, 64bit value)
+ * from the "status" sysfs file.
+ */
+#define IPATH_STATUS_INITTED       0x1  /* basic initialization done */
+#define IPATH_STATUS_DISABLED      0x2  /* hardware disabled */
+/* Device has been disabled via admin request */
+#define IPATH_STATUS_ADMIN_DISABLED    0x4
+#define IPATH_STATUS_OIB_SMA       0x8  /* ipath_mad kernel SMA running */
+#define IPATH_STATUS_SMA          0x10  /* user SMA running */
+/* Chip has been found and initted */
+#define IPATH_STATUS_CHIP_PRESENT 0x20
+/* IB link is at ACTIVE, usable for data traffic */
+#define IPATH_STATUS_IB_READY     0x40
+/* link is configured, LID, MTU, etc. have been set */
+#define IPATH_STATUS_IB_CONF      0x80
+/* no link established, probably no cable */
+#define IPATH_STATUS_IB_NOCABLE  0x100
+/* A Fatal hardware error has occurred. */
+#define IPATH_STATUS_HWERROR     0x200
+
+/*
+ * The list of usermode accessible registers.  Also see Reg_* later in file.
+ */
+typedef enum _ipath_ureg {
+        /* (RO)  DMA RcvHdr to be used next. */
+        ur_rcvhdrtail = 0,
+        /* (RW)  RcvHdr entry to be processed next by host. */
+        ur_rcvhdrhead = 1,
+        /* (RO)  Index of next Eager index to use. */
+        ur_rcvegrindextail = 2,
+        /* (RW)  Eager TID to be processed next */
+        ur_rcvegrindexhead = 3,
+        /* For internal use only; max register number. */
+        _IPATH_UregMax
+} ipath_ureg;
+
+/* bit values for spi_runtime_flags */
+#define IPATH_RUNTIME_HT        0x1
+#define IPATH_RUNTIME_PCIE      0x2
+#define IPATH_RUNTIME_FORCE_WC_ORDER    0x4
+#define IPATH_RUNTIME_RCVHDR_COPY       0x8
+
+/*
+ * This structure is returned by ipath_userinit() immediately after
+ * open to get implementation-specific info, and info specific to this
+ * instance.
+ *
+ * This struct must have explict pad fields where type sizes
+ * may result in different alignments between 32 and 64 bit
+ * programs, since the 64 bit * bit kernel requires the user code
+ * to have matching offsets
+ */
+struct ipath_base_info {
+        /* version of hardware, for feature checking. */
+        __u32 spi_hw_version;
+        /* version of software, for feature checking. */
+        __u32 spi_sw_version;
+        /* InfiniPath port assigned, goes into sent packets */
+        __u32 spi_port;
+        /*
+         * IB MTU, packets IB data must be less than this.
+         * The MTU is in bytes, and will be a multiple of 4 bytes.
+         */
+        __u32 spi_mtu;
+        /*
+         * Size of a PIO buffer.  Any given packet's total size must be less
+         * than this (in words).  Included is the starting control word, so
+         * if 513 is returned, then total pkt size is 512 words or less.
+         */
+        __u32 spi_piosize;
+        /* size of the TID cache in infinipath, in entries */
+        __u32 spi_tidcnt;
+        /* size of the TID Eager list in infinipath, in entries */
+        __u32 spi_tidegrcnt;
+        /* size of a single receive header queue entry. */
+        __u32 spi_rcvhdrent_size;
+        /*
+         * Count of receive header queue entries allocated.
+         * This may be less than the spu_rcvhdrcnt passed in!.
+         */
+        __u32 spi_rcvhdr_cnt;
+
+        /* per-chip and other runtime features bitmap (IPATH_RUNTIME_*) */
+        __u32 spi_runtime_flags;
+
+        /* address where receive buffer queue is mapped into */
+        __u64 spi_rcvhdr_base;
+
+        /* user program. */
+
+        /* base address of eager TID receive buffers. */
+        __u64 spi_rcv_egrbufs;
+
+        /* Allocated by initialization code, not by protocol. */
+
+        /*
+         * Size of each TID buffer in host memory, starting at
+         * spi_rcv_egrbufs.  The buffers are virtually contiguous.
+         */
+        __u32 spi_rcv_egrbufsize;
+        /*
+         * The special QP (queue pair) value that identifies an infinipath
+         * protocol packet from standard IB packets.  More, probably much
+         * more, to be added.
+         */
+        __u32 spi_qpair;
+
+        /*
+         * User register base for init code, not to be used directly by
+         * protocol or applications.
+         */
+        __u64 __spi_uregbase;
+        /*
+         * Maximum buffer size in bytes that can be used in a single TID
+         * entry (assuming the buffer is aligned to this boundary).  This is
+         * the minimum of what the hardware and software support Guaranteed
+         * to be a power of 2.
+         */
+        __u32 spi_tid_maxsize;
+        /*
+         * alignment of each pio send buffer (byte count
+         * to add to spi_piobufbase to get to second buffer)
+         */
+        __u32 spi_pioalign;
+        /*
+         * The index of the first pio buffer available to this process;
+         * needed to do lookup in spi_pioavailaddr; not added to
+         * spi_piobufbase.
+         */
+        __u32 spi_pioindex;
+         /* number of buffers mapped for this process */
+        __u32 spi_piocnt;
+
+        /*
+         * Base address of writeonly pio buffers for this process.
+         * Each buffer has spi_piosize words, and is aligned on spi_pioalign
+         * boundaries.  spi_piocnt buffers are mapped from this address
+         */
+        __u64 spi_piobufbase;
+
+        /*
+         * Base address of readonly memory copy of the pioavail registers.
+         * There are 2 bits for each buffer.
+         */
+        __u64 spi_pioavailaddr;
+
+        /*
+         * Address where driver updates a copy of the interface and driver
+         * status (IPATH_STATUS_*) as a 64 bit value.  It's followed by a
+         * string indicating hardware error, if there was one.
+         */
+        __u64 spi_status;
+
+        /* number of chip ports available to user processes */
+        __u32 spi_nports;
+        /* unit number of chip we are using */
+        __u32 spi_unit;
+        /* num bufs in each contiguous set */
+        __u32 spi_rcv_egrperchunk;
+        /* size in bytes of each contiguous set */
+        __u32 spi_rcv_egrchunksize;
+        /* total size of mmap to cover full rcvegrbuffers */
+        __u32 spi_rcv_egrbuftotlen;
+} __attribute__ ((aligned(8)));
+
+
+/*
+ * This version number is given to the driver by the user code during
+ * initialization in the spu_userversion field of ipath_user_info, so
+ * the driver can check for compatibility with user code.
+ *
+ * The major version changes when data structures
+ * change in an incompatible way.  The driver must be the same or higher
+ * for initialization to succeed.  In some cases, a higher version
+ * driver will not interoperate with older software, and initialization
+ * will return an error.
+ */
+#define IPATH_USER_SWMAJOR 1
+
+/*
+ * Minor version differences are always compatible
+ * a within a major version, however if if user software is larger
+ * than driver software, some new features and/or structure fields
+ * may not be implemented; the user code must deal with this if it
+ * cares, or it must abort after initialization reports the difference
+ */
+#define IPATH_USER_SWMINOR 2
+
+#define IPATH_USER_SWVERSION ((IPATH_USER_SWMAJOR<<16) | IPATH_USER_SWMINOR)
+
+#define IPATH_KERN_TYPE 0
+
+/*
+ * Similarly, this is the kernel version going back to the user.  It's
+ * slightly different, in that we want to tell if the driver was built as
+ * part of a PathScale release, or from the driver from OpenIB, kernel.org,
+ * or a standard distribution, for support reasons.  The high bit is 0 for
+ * non-PathScale, and 1 for PathScale-built/supplied.
+ *
+ * It's returned by the driver to the user code during initialization in the
+ * spi_sw_version field of ipath_base_info, so the user code can in turn
+ * check for compatibility with the kernel.
+*/
+#define IPATH_KERN_SWVERSION ((IPATH_KERN_TYPE<<31) | IPATH_USER_SWVERSION)
+
+/*
+ * This structure is passed to ipath_userinit() to tell the driver where
+ * user code buffers are, sizes, etc.   The offsets and sizes of the
+ * fields must remain unchanged, for binary compatibility.  It can
+ * be extended, if userversion is changed so user code can tell, if needed
+ */
+struct ipath_user_info {
+        /*
+         * version of user software, to detect compatibility issues.
+         * Should be set to IPATH_USER_SWVERSION.
+         */
+        __u32 spu_userversion;
+
+        /* desired number of receive header queue entries */
+        __u32 spu_rcvhdrcnt;
+
+        /* size of struct base_info to write to */
+        __u32 spu_base_info_size;
+
+        /*
+         * number of words in KD protocol header
+         * This tells InfiniPath how many words to copy to rcvhdrq.  If 0,
+         * kernel uses a default.  Once set, attempts to set any other value
+         * are an error (EAGAIN) until driver is reloaded.
+         */
+        __u32 spu_rcvhdrsize;
+
+        /*
+         * cache line aligned (64 byte) user address to
+         * which the rcvhdrtail register will be written by infinipath
+         * whenever it changes, so that no chip registers are read in
+         * the performance path.
+         */
+        __u64 spu_rcvhdraddr;
+
+        /*
+         * address of struct base_info to write to
+         */
+        __u64 spu_base_info;
+
+} __attribute__ ((aligned(8)));
+
+/* User commands. */
+
+#define IPATH_CMD_MIN           16
+
+#define IPATH_CMD_USER_INIT     16      /* set up userspace */
+#define IPATH_CMD_PORT_INFO     17      /* find out what resources we got */
+#define IPATH_CMD_RECV_CTRL     18      /* control receipt of packets */
+#define IPATH_CMD_TID_UPDATE    19      /* update expected TID entries */
+#define IPATH_CMD_TID_FREE      20      /* free expected TID entries */
+#define IPATH_CMD_SET_PART_KEY  21      /* add partition key */
+
+#define IPATH_CMD_MAX           21
+
+struct ipath_port_info {
+        __u32 num_active;       /* number of active units */
+        __u32 unit;             /* unit (chip) assigned to caller */
+        __u32 port;             /* port on unit assigned to caller */
+};
+
+struct ipath_tid_info {
+        __u32 tidcnt;
+        /* make structure same size in 32 and 64 bit */
+        __u32 tid__unused;
+        /* virtual address of first page in transfer */
+        __u64 tidvaddr;
+        /* pointer (same size 32/64 bit) to __u16 tid array */
+        __u64 tidlist;
+
+        /*
+         * pointer (same size 32/64 bit) to bitmap of TIDs used
+         * for this call; checked for being large enough at open
+         */
+        __u64 tidmap;
+};
+
+struct ipath_cmd {
+        __u32 type;                     /* command type */
+        union {
+                struct ipath_tid_info tid_info;
+                struct ipath_user_info user_info;
+                /* address in userspace of struct ipath_port_info to
+                   write result to */
+                __u64 port_info;
+                /* enable/disable receipt of packets */
+                __u32 recv_ctrl;
+                /* partition key to set */
+                __u16 part_key;
+        } cmd;
+};
+
+struct ipath_iovec {
+        /* Pointer to data, but same size 32 and 64 bit */
+        __u64 iov_base;
+
+        /*
+         * Length of data; don't need 64 bits, but want
+         * ipath_sendpkt to remain same size as before 32 bit changes, so...
+         */
+        __u64 iov_len;
+};
+
+/*
+ * Describes a single packet for send.  Each packet can have one or more
+ * buffers, but the total length (exclusive of IB headers) must be less
+ * than the MTU, and if using the PIO method, entire packet length,
+ * including IB headers, must be less than the ipath_piosize value (words).
+ * Use of this necessitates including sys/uio.h
+ */
+struct __ipath_sendpkt {
+        __u32 sps_flags;        /* flags for packet (TBD) */
+        __u32 sps_cnt;          /* number of entries to use in sps_iov */
+        /* array of iov's describing packet. TEMPORARY */
+        struct ipath_iovec sps_iov[4];
+};
+
+/* Passed into SMA special file's ->read and ->write methods. */
+struct ipath_sma_pkt
+{
+        __u32 unit;     /* unit on which to send packet */
+        __u64 data;     /* address of payload in userspace */
+        __u32 len;      /* length of payload */
+};
+
+/*
+ * Data layout in I2C flash (for GUID, etc.)
+ * All fields are little-endian binary unless otherwise stated
+ */
+#define IPATH_FLASH_VERSION 1
+struct ipath_flash {
+        /* flash layout version (IPATH_FLASH_VERSION) */
+        __u8 if_fversion;
+        /* checksum protecting if_length bytes */
+        __u8 if_csum;
+        /*
+         * valid length (in use, protected by if_csum), including
+         * if_fversion and if_sum themselves)
+         */
+        __u8 if_length;
+        /* the GUID, in network order */
+        __u8 if_guid[8];
+        /* number of GUIDs to use, starting from if_guid */
+        __u8 if_numguid;
+        /* the board serial number, in ASCII */
+        char if_serial[12];
+        /* board mfg date (YYYYMMDD ASCII) */
+        char if_mfgdate[8];
+        /* last board rework/test date (YYYYMMDD ASCII) */
+        char if_testdate[8];
+        /* logging of error counts, TBD */
+        __u8 if_errcntp[4];
+        /* powered on hours, updated at driver unload */
+        __u8 if_powerhour[2];
+        /* ASCII free-form comment field */
+        char if_comment[32];
+        /* 78 bytes used, min flash size is 128 bytes */
+        __u8 if_future[50];
+};
+
+/*
+ * These are the counters implemented in the chip, and are listed in order.
+ * The InterCaps naming is taken straight from the chip spec.
+ */
+struct infinipath_counters {
+        __u64 LBIntCnt;
+        __u64 LBFlowStallCnt;
+        __u64 Reserved1;
+        __u64 TxUnsupVLErrCnt;
+        __u64 TxDataPktCnt;
+        __u64 TxFlowPktCnt;
+        __u64 TxDwordCnt;
+        __u64 TxLenErrCnt;
+        __u64 TxMaxMinLenErrCnt;
+        __u64 TxUnderrunCnt;
+        __u64 TxFlowStallCnt;
+        __u64 TxDroppedPktCnt;
+        __u64 RxDroppedPktCnt;
+        __u64 RxDataPktCnt;
+        __u64 RxFlowPktCnt;
+        __u64 RxDwordCnt;
+        __u64 RxLenErrCnt;
+        __u64 RxMaxMinLenErrCnt;
+        __u64 RxICRCErrCnt;
+        __u64 RxVCRCErrCnt;
+        __u64 RxFlowCtrlErrCnt;
+        __u64 RxBadFormatCnt;
+        __u64 RxLinkProblemCnt;
+        __u64 RxEBPCnt;
+        __u64 RxLPCRCErrCnt;
+        __u64 RxBufOvflCnt;
+        __u64 RxTIDFullErrCnt;
+        __u64 RxTIDValidErrCnt;
+        __u64 RxPKeyMismatchCnt;
+        __u64 RxP0HdrEgrOvflCnt;
+        __u64 RxP1HdrEgrOvflCnt;
+        __u64 RxP2HdrEgrOvflCnt;
+        __u64 RxP3HdrEgrOvflCnt;
+        __u64 RxP4HdrEgrOvflCnt;
+        __u64 RxP5HdrEgrOvflCnt;
+        __u64 RxP6HdrEgrOvflCnt;
+        __u64 RxP7HdrEgrOvflCnt;
+        __u64 RxP8HdrEgrOvflCnt;
+        __u64 Reserved6;
+        __u64 Reserved7;
+        __u64 IBStatusChangeCnt;
+        __u64 IBLinkErrRecoveryCnt;
+        __u64 IBLinkDownedCnt;
+        __u64 IBSymbolErrCnt;
+};
+
+/*
+ * The next set of defines are for packet headers, and chip register
+ * and memory bits that are visible to and/or used by user-mode software
+ * The other bits that are used only by the driver or diags are in
+ * ipath_registers.h
+ */
+
+/* RcvHdrFlags bits */
+#define INFINIPATH_RHF_LENGTH_MASK 0x7FF
+#define INFINIPATH_RHF_LENGTH_SHIFT 0
+#define INFINIPATH_RHF_RCVTYPE_MASK 0x7
+#define INFINIPATH_RHF_RCVTYPE_SHIFT 11
+#define INFINIPATH_RHF_EGRINDEX_MASK 0x7FF
+#define INFINIPATH_RHF_EGRINDEX_SHIFT 16
+#define INFINIPATH_RHF_H_ICRCERR   0x80000000
+#define INFINIPATH_RHF_H_VCRCERR   0x40000000
+#define INFINIPATH_RHF_H_PARITYERR 0x20000000
+#define INFINIPATH_RHF_H_LENERR    0x10000000
+#define INFINIPATH_RHF_H_MTUERR    0x08000000
+#define INFINIPATH_RHF_H_IHDRERR   0x04000000
+#define INFINIPATH_RHF_H_TIDERR    0x02000000
+#define INFINIPATH_RHF_H_MKERR     0x01000000
+#define INFINIPATH_RHF_H_IBERR     0x00800000
+#define INFINIPATH_RHF_L_SWA       0x00008000
+#define INFINIPATH_RHF_L_SWB       0x00004000
+
+/* infinipath header fields */
+#define INFINIPATH_I_VERS_MASK 0xF
+#define INFINIPATH_I_VERS_SHIFT 28
+#define INFINIPATH_I_PORT_MASK 0xF
+#define INFINIPATH_I_PORT_SHIFT 24
+#define INFINIPATH_I_TID_MASK 0x7FF
+#define INFINIPATH_I_TID_SHIFT 13
+#define INFINIPATH_I_OFFSET_MASK 0x1FFF
+#define INFINIPATH_I_OFFSET_SHIFT 0
+
+/* K_PktFlags bits */
+#define INFINIPATH_KPF_INTR 0x1
+
+/* SendPIO per-buffer control */
+#define INFINIPATH_SP_LENGTHP1_MASK 0x3FF
+#define INFINIPATH_SP_LENGTHP1_SHIFT 0
+#define INFINIPATH_SP_INTR    0x80000000
+#define INFINIPATH_SP_TEST    0x40000000
+#define INFINIPATH_SP_TESTEBP 0x20000000
+
+/* SendPIOAvail bits */
+#define INFINIPATH_SENDPIOAVAIL_BUSY_SHIFT 1
+#define INFINIPATH_SENDPIOAVAIL_CHECK_SHIFT 0
+
+#endif                          /* _IPATH_COMMON_H */
diff --git a/drivers/infiniband/hw/ipath/ipath_cq.c b/drivers/infiniband/hw/ipath/ipath_cq.c
new file mode 100644
index 000000000000..7ece1135ddfe
--- /dev/null
+++ b/drivers/infiniband/hw/ipath/ipath_cq.c
@@ -0,0 +1,295 @@
+/*
+ * Copyright (c) 2005, 2006 PathScale, Inc. All rights reserved.
+ *
+ * This software is available to you under a choice of one of two
+ * licenses.  You may choose to be licensed under the terms of the GNU
+ * General Public License (GPL) Version 2, available from the file
+ * COPYING in the main directory of this source tree, or the
+ * OpenIB.org BSD license below:
+ *
+ *     Redistribution and use in source and binary forms, with or
+ *     without modification, are permitted provided that the following
+ *     conditions are met:
+ *
+ *      - Redistributions of source code must retain the above
+ *        copyright notice, this list of conditions and the following
+ *        disclaimer.
+ *
+ *      - Redistributions in binary form must reproduce the above
+ *        copyright notice, this list of conditions and the following
+ *        disclaimer in the documentation and/or other materials
+ *        provided with the distribution.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+ * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+ * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+ * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
+ * BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
+ * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
+ * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+ * SOFTWARE.
+ */
+
+#include <linux/err.h>
+#include <linux/vmalloc.h>
+
+#include "ipath_verbs.h"
+
+/**
+ * ipath_cq_enter - add a new entry to the completion queue
+ * @cq: completion queue
+ * @entry: work completion entry to add
+ * @sig: true if @entry is a solicitated entry
+ *
+ * This may be called with one of the qp->s_lock or qp->r_rq.lock held.
+ */
+void ipath_cq_enter(struct ipath_cq *cq, struct ib_wc *entry, int solicited)
+{
+        unsigned long flags;
+        u32 next;
+
+        spin_lock_irqsave(&cq->lock, flags);
+
+        if (cq->head == cq->ibcq.cqe)
+                next = 0;
+        else
+                next = cq->head + 1;
+        if (unlikely(next == cq->tail)) {
+                spin_unlock_irqrestore(&cq->lock, flags);
+                if (cq->ibcq.event_handler) {
+                        struct ib_event ev;
+
+                        ev.device = cq->ibcq.device;
+                        ev.element.cq = &cq->ibcq;
+                        ev.event = IB_EVENT_CQ_ERR;
+                        cq->ibcq.event_handler(&ev, cq->ibcq.cq_context);
+                }
+                return;
+        }
+        cq->queue[cq->head] = *entry;
+        cq->head = next;
+
+        if (cq->notify == IB_CQ_NEXT_COMP ||
+            (cq->notify == IB_CQ_SOLICITED && solicited)) {
+                cq->notify = IB_CQ_NONE;
+                cq->triggered++;
+                /*
+                 * This will cause send_complete() to be called in
+                 * another thread.
+                 */
+                tasklet_hi_schedule(&cq->comptask);
+        }
+
+        spin_unlock_irqrestore(&cq->lock, flags);
+
+        if (entry->status != IB_WC_SUCCESS)
+                to_idev(cq->ibcq.device)->n_wqe_errs++;
+}
+
+/**
+ * ipath_poll_cq - poll for work completion entries
+ * @ibcq: the completion queue to poll
+ * @num_entries: the maximum number of entries to return
+ * @entry: pointer to array where work completions are placed
+ *
+ * Returns the number of completion entries polled.
+ *
+ * This may be called from interrupt context.  Also called by ib_poll_cq()
+ * in the generic verbs code.
+ */
+int ipath_poll_cq(struct ib_cq *ibcq, int num_entries, struct ib_wc *entry)
+{
+        struct ipath_cq *cq = to_icq(ibcq);
+        unsigned long flags;
+        int npolled;
+
+        spin_lock_irqsave(&cq->lock, flags);
+
+        for (npolled = 0; npolled < num_entries; ++npolled, ++entry) {
+                if (cq->tail == cq->head)
+                        break;
+                *entry = cq->queue[cq->tail];
+                if (cq->tail == cq->ibcq.cqe)
+                        cq->tail = 0;
+                else
+                        cq->tail++;
+        }
+
+        spin_unlock_irqrestore(&cq->lock, flags);
+
+        return npolled;
+}
+
+static void send_complete(unsigned long data)
+{
+        struct ipath_cq *cq = (struct ipath_cq *)data;
+
+        /*
+         * The completion handler will most likely rearm the notification
+         * and poll for all pending entries.  If a new completion entry
+         * is added while we are in this routine, tasklet_hi_schedule()
+         * won't call us again until we return so we check triggered to
+         * see if we need to call the handler again.
+         */
+        for (;;) {
+                u8 triggered = cq->triggered;
+
+                cq->ibcq.comp_handler(&cq->ibcq, cq->ibcq.cq_context);
+
+                if (cq->triggered == triggered)
+                        return;
+        }
+}
+
+/**
+ * ipath_create_cq - create a completion queue
+ * @ibdev: the device this completion queue is attached to
+ * @entries: the minimum size of the completion queue
+ * @context: unused by the InfiniPath driver
+ * @udata: unused by the InfiniPath driver
+ *
+ * Returns a pointer to the completion queue or negative errno values
+ * for failure.
+ *
+ * Called by ib_create_cq() in the generic verbs code.
+ */
+struct ib_cq *ipath_create_cq(struct ib_device *ibdev, int entries,
+                              struct ib_ucontext *context,
+                              struct ib_udata *udata)
+{
+        struct ipath_cq *cq;
+        struct ib_wc *wc;
+        struct ib_cq *ret;
+
+        /*
+         * Need to use vmalloc() if we want to support large #s of
+         * entries.
+         */
+        cq = kmalloc(sizeof(*cq), GFP_KERNEL);
+        if (!cq) {
+                ret = ERR_PTR(-ENOMEM);
+                goto bail;
+        }
+
+        /*
+         * Need to use vmalloc() if we want to support large #s of entries.
+         */
+        wc = vmalloc(sizeof(*wc) * (entries + 1));
+        if (!wc) {
+                kfree(cq);
+                ret = ERR_PTR(-ENOMEM);
+                goto bail;
+        }
+        /*
+         * ib_create_cq() will initialize cq->ibcq except for cq->ibcq.cqe.
+         * The number of entries should be >= the number requested or return
+         * an error.
+         */
+        cq->ibcq.cqe = entries;
+        cq->notify = IB_CQ_NONE;
+        cq->triggered = 0;
+        spin_lock_init(&cq->lock);
+        tasklet_init(&cq->comptask, send_complete, (unsigned long)cq);
+        cq->head = 0;
+        cq->tail = 0;
+        cq->queue = wc;
+
+        ret = &cq->ibcq;
+
+bail:
+        return ret;
+}
+
+/**
+ * ipath_destroy_cq - destroy a completion queue
+ * @ibcq: the completion queue to destroy.
+ *
+ * Returns 0 for success.
+ *
+ * Called by ib_destroy_cq() in the generic verbs code.
+ */
+int ipath_destroy_cq(struct ib_cq *ibcq)
+{
+        struct ipath_cq *cq = to_icq(ibcq);
+
+        tasklet_kill(&cq->comptask);
+        vfree(cq->queue);
+        kfree(cq);
+
+        return 0;
+}
+
+/**
+ * ipath_req_notify_cq - change the notification type for a completion queue
+ * @ibcq: the completion queue
+ * @notify: the type of notification to request
+ *
+ * Returns 0 for success.
+ *
+ * This may be called from interrupt context.  Also called by
+ * ib_req_notify_cq() in the generic verbs code.
+ */
+int ipath_req_notify_cq(struct ib_cq *ibcq, enum ib_cq_notify notify)
+{
+        struct ipath_cq *cq = to_icq(ibcq);
+        unsigned long flags;
+
+        spin_lock_irqsave(&cq->lock, flags);
+        /*
+         * Don't change IB_CQ_NEXT_COMP to IB_CQ_SOLICITED but allow
+         * any other transitions.
+         */
+        if (cq->notify != IB_CQ_NEXT_COMP)
+                cq->notify = notify;
+        spin_unlock_irqrestore(&cq->lock, flags);
+        return 0;
+}
+
+int ipath_resize_cq(struct ib_cq *ibcq, int cqe, struct ib_udata *udata)
+{
+        struct ipath_cq *cq = to_icq(ibcq);
+        struct ib_wc *wc, *old_wc;
+        u32 n;
+        int ret;
+
+        /*
+         * Need to use vmalloc() if we want to support large #s of entries.
+         */
+        wc = vmalloc(sizeof(*wc) * (cqe + 1));
+        if (!wc) {
+                ret = -ENOMEM;
+                goto bail;
+        }
+
+        spin_lock_irq(&cq->lock);
+        if (cq->head < cq->tail)
+                n = cq->ibcq.cqe + 1 + cq->head - cq->tail;
+        else
+                n = cq->head - cq->tail;
+        if (unlikely((u32)cqe < n)) {
+                spin_unlock_irq(&cq->lock);
+                vfree(wc);
+                ret = -EOVERFLOW;
+                goto bail;
+        }
+        for (n = 0; cq->tail != cq->head; n++) {
+                wc[n] = cq->queue[cq->tail];
+                if (cq->tail == cq->ibcq.cqe)
+                        cq->tail = 0;
+                else
+                        cq->tail++;
+        }
+        cq->ibcq.cqe = cqe;
+        cq->head = n;
+        cq->tail = 0;
+        old_wc = cq->queue;
+        cq->queue = wc;
+        spin_unlock_irq(&cq->lock);
+
+        vfree(old_wc);
+
+        ret = 0;
+
+bail:
+        return ret;
+}
diff --git a/drivers/infiniband/hw/ipath/ipath_debug.h b/drivers/infiniband/hw/ipath/ipath_debug.h
new file mode 100644
index 000000000000..593e28969c69
--- /dev/null
+++ b/drivers/infiniband/hw/ipath/ipath_debug.h
@@ -0,0 +1,96 @@
+/*
+ * Copyright (c) 2003, 2004, 2005, 2006 PathScale, Inc. All rights reserved.
+ *
+ * This software is available to you under a choice of one of two
+ * licenses.  You may choose to be licensed under the terms of the GNU
+ * General Public License (GPL) Version 2, available from the file
+ * COPYING in the main directory of this source tree, or the
+ * OpenIB.org BSD license below:
+ *
+ *     Redistribution and use in source and binary forms, with or
+ *     without modification, are permitted provided that the following
+ *     conditions are met:
+ *
+ *      - Redistributions of source code must retain the above
+ *        copyright notice, this list of conditions and the following
+ *        disclaimer.
+ *
+ *      - Redistributions in binary form must reproduce the above
+ *        copyright notice, this list of conditions and the following
+ *        disclaimer in the documentation and/or other materials
+ *        provided with the distribution.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+ * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+ * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+ * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
+ * BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
+ * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
+ * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+ * SOFTWARE.
+ */
+
+#ifndef _IPATH_DEBUG_H
+#define _IPATH_DEBUG_H
+
+#ifndef _IPATH_DEBUGGING        /* debugging enabled or not */
+#define _IPATH_DEBUGGING 1
+#endif
+
+#if _IPATH_DEBUGGING
+
+/*
+ * Mask values for debugging.  The scheme allows us to compile out any
+ * of the debug tracing stuff, and if compiled in, to enable or disable
+ * dynamically.  This can be set at modprobe time also:
+ *      modprobe infinipath.ko infinipath_debug=7
+ */
+
+#define __IPATH_INFO        0x1 /* generic low verbosity stuff */
+#define __IPATH_DBG         0x2 /* generic debug */
+#define __IPATH_TRSAMPLE    0x8 /* generate trace buffer sample entries */
+/* leave some low verbosity spots open */
+#define __IPATH_VERBDBG     0x40        /* very verbose debug */
+#define __IPATH_PKTDBG      0x80        /* print packet data */
+/* print process startup (init)/exit messages */
+#define __IPATH_PROCDBG     0x100
+/* print mmap/nopage stuff, not using VDBG any more */
+#define __IPATH_MMDBG       0x200
+#define __IPATH_USER_SEND   0x1000      /* use user mode send */
+#define __IPATH_KERNEL_SEND 0x2000      /* use kernel mode send */
+#define __IPATH_EPKTDBG     0x4000      /* print ethernet packet data */
+#define __IPATH_SMADBG      0x8000      /* sma packet debug */
+#define __IPATH_IPATHDBG    0x10000     /* Ethernet (IPATH) general debug on */
+#define __IPATH_IPATHWARN   0x20000     /* Ethernet (IPATH) warnings on */
+#define __IPATH_IPATHERR    0x40000     /* Ethernet (IPATH) errors on */
+#define __IPATH_IPATHPD     0x80000     /* Ethernet (IPATH) packet dump on */
+#define __IPATH_IPATHTABLE  0x100000    /* Ethernet (IPATH) table dump on */
+
+#else                           /* _IPATH_DEBUGGING */
+
+/*
+ * define all of these even with debugging off, for the few places that do
+ * if(infinipath_debug & _IPATH_xyzzy), but in a way that will make the
+ * compiler eliminate the code
+ */
+
+#define __IPATH_INFO      0x0   /* generic low verbosity stuff */
+#define __IPATH_DBG       0x0   /* generic debug */
+#define __IPATH_TRSAMPLE  0x0   /* generate trace buffer sample entries */
+#define __IPATH_VERBDBG   0x0   /* very verbose debug */
+#define __IPATH_PKTDBG    0x0   /* print packet data */
+#define __IPATH_PROCDBG   0x0   /* print process startup (init)/exit messages */
+/* print mmap/nopage stuff, not using VDBG any more */
+#define __IPATH_MMDBG     0x0
+#define __IPATH_EPKTDBG   0x0   /* print ethernet packet data */
+#define __IPATH_SMADBG    0x0   /* print process startup (init)/exit messages */#define __IPATH_IPATHDBG  0x0   /* Ethernet (IPATH) table dump on */
+#define __IPATH_IPATHWARN 0x0   /* Ethernet (IPATH) warnings on   */
+#define __IPATH_IPATHERR  0x0   /* Ethernet (IPATH) errors on   */
+#define __IPATH_IPATHPD   0x0   /* Ethernet (IPATH) packet dump on   */
+#define __IPATH_IPATHTABLE 0x0  /* Ethernet (IPATH) packet dump on   */
+
+#endif                          /* _IPATH_DEBUGGING */
+
+#define __IPATH_VERBOSEDBG __IPATH_VERBDBG
+
+#endif                          /* _IPATH_DEBUG_H */
diff --git a/drivers/infiniband/hw/ipath/ipath_diag.c b/drivers/infiniband/hw/ipath/ipath_diag.c
new file mode 100644
index 000000000000..cd533cf951c2
--- /dev/null
+++ b/drivers/infiniband/hw/ipath/ipath_diag.c
@@ -0,0 +1,379 @@
+/*
+ * Copyright (c) 2003, 2004, 2005, 2006 PathScale, Inc. All rights reserved.
+ *
+ * This software is available to you under a choice of one of two
+ * licenses.  You may choose to be licensed under the terms of the GNU
+ * General Public License (GPL) Version 2, available from the file
+ * COPYING in the main directory of this source tree, or the
+ * OpenIB.org BSD license below:
+ *
+ *     Redistribution and use in source and binary forms, with or
+ *     without modification, are permitted provided that the following
+ *     conditions are met:
+ *
+ *      - Redistributions of source code must retain the above
+ *        copyright notice, this list of conditions and the following
+ *        disclaimer.
+ *
+ *      - Redistributions in binary form must reproduce the above
+ *        copyright notice, this list of conditions and the following
+ *        disclaimer in the documentation and/or other materials
+ *        provided with the distribution.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+ * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+ * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+ * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
+ * BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
+ * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
+ * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+ * SOFTWARE.
+ */
+
+/*
+ * This file contains support for diagnostic functions.  It is accessed by
+ * opening the ipath_diag device, normally minor number 129.  Diagnostic use
+ * of the InfiniPath chip may render the chip or board unusable until the
+ * driver is unloaded, or in some cases, until the system is rebooted.
+ *
+ * Accesses to the chip through this interface are not similar to going
+ * through the /sys/bus/pci resource mmap interface.
+ */
+
+#include <linux/pci.h>
+#include <asm/uaccess.h>
+
+#include "ipath_common.h"
+#include "ipath_kernel.h"
+#include "ips_common.h"
+#include "ipath_layer.h"
+
+int ipath_diag_inuse;
+static int diag_set_link;
+
+static int ipath_diag_open(struct inode *in, struct file *fp);
+static int ipath_diag_release(struct inode *in, struct file *fp);
+static ssize_t ipath_diag_read(struct file *fp, char __user *data,
+                               size_t count, loff_t *off);
+static ssize_t ipath_diag_write(struct file *fp, const char __user *data,
+                                size_t count, loff_t *off);
+
+static struct file_operations diag_file_ops = {
+        .owner = THIS_MODULE,
+        .write = ipath_diag_write,
+        .read = ipath_diag_read,
+        .open = ipath_diag_open,
+        .release = ipath_diag_release
+};
+
+static struct cdev *diag_cdev;
+static struct class_device *diag_class_dev;
+
+int ipath_diag_init(void)
+{
+        return ipath_cdev_init(IPATH_DIAG_MINOR, "ipath_diag",
+                               &diag_file_ops, &diag_cdev, &diag_class_dev);
+}
+
+void ipath_diag_cleanup(void)
+{
+        ipath_cdev_cleanup(&diag_cdev, &diag_class_dev);
+}
+
+/**
+ * ipath_read_umem64 - read a 64-bit quantity from the chip into user space
+ * @dd: the infinipath device
+ * @uaddr: the location to store the data in user memory
+ * @caddr: the source chip address (full pointer, not offset)
+ * @count: number of bytes to copy (multiple of 32 bits)
+ *
+ * This function also localizes all chip memory accesses.
+ * The copy should be written such that we read full cacheline packets
+ * from the chip.  This is usually used for a single qword
+ *
+ * NOTE:  This assumes the chip address is 64-bit aligned.
+ */
+static int ipath_read_umem64(struct ipath_devdata *dd, void __user *uaddr,
+                             const void __iomem *caddr, size_t count)
+{
+        const u64 __iomem *reg_addr = caddr;
+        const u64 __iomem *reg_end = reg_addr + (count / sizeof(u64));
+        int ret;
+
+        /* not very efficient, but it works for now */
+        if (reg_addr < dd->ipath_kregbase ||
+            reg_end > dd->ipath_kregend) {
+                ret = -EINVAL;
+                goto bail;
+        }
+        while (reg_addr < reg_end) {
+                u64 data = readq(reg_addr);
+                if (copy_to_user(uaddr, &data, sizeof(u64))) {
+                        ret = -EFAULT;
+                        goto bail;
+                }
+                reg_addr++;
+                uaddr++;
+        }
+        ret = 0;
+bail:
+        return ret;
+}
+
+/**
+ * ipath_write_umem64 - write a 64-bit quantity to the chip from user space
+ * @dd: the infinipath device
+ * @caddr: the destination chip address (full pointer, not offset)
+ * @uaddr: the source of the data in user memory
+ * @count: the number of bytes to copy (multiple of 32 bits)
+ *
+ * This is usually used for a single qword
+ * NOTE:  This assumes the chip address is 64-bit aligned.
+ */
+
+static int ipath_write_umem64(struct ipath_devdata *dd, void __iomem *caddr,
+                              const void __user *uaddr, size_t count)
+{
+        u64 __iomem *reg_addr = caddr;
+        const u64 __iomem *reg_end = reg_addr + (count / sizeof(u64));
+        int ret;
+
+        /* not very efficient, but it works for now */
+        if (reg_addr < dd->ipath_kregbase ||
+            reg_end > dd->ipath_kregend) {
+                ret = -EINVAL;
+                goto bail;
+        }
+        while (reg_addr < reg_end) {
+                u64 data;
+                if (copy_from_user(&data, uaddr, sizeof(data))) {
+                        ret = -EFAULT;
+                        goto bail;
+                }
+                writeq(data, reg_addr);
+
+                reg_addr++;
+                uaddr++;
+        }
+        ret = 0;
+bail:
+        return ret;
+}
+
+/**
+ * ipath_read_umem32 - read a 32-bit quantity from the chip into user space
+ * @dd: the infinipath device
+ * @uaddr: the location to store the data in user memory
+ * @caddr: the source chip address (full pointer, not offset)
+ * @count: number of bytes to copy
+ *
+ * read 32 bit values, not 64 bit; for memories that only
+ * support 32 bit reads; usually a single dword.
+ */
+static int ipath_read_umem32(struct ipath_devdata *dd, void __user *uaddr,
+                             const void __iomem *caddr, size_t count)
+{
+        const u32 __iomem *reg_addr = caddr;
+        const u32 __iomem *reg_end = reg_addr + (count / sizeof(u32));
+        int ret;
+
+        if (reg_addr < (u32 __iomem *) dd->ipath_kregbase ||
+            reg_end > (u32 __iomem *) dd->ipath_kregend) {
+                ret = -EINVAL;
+                goto bail;
+        }
+        /* not very efficient, but it works for now */
+        while (reg_addr < reg_end) {
+                u32 data = readl(reg_addr);
+                if (copy_to_user(uaddr, &data, sizeof(data))) {
+                        ret = -EFAULT;
+                        goto bail;
+                }
+
+                reg_addr++;
+                uaddr++;
+        }
+        ret = 0;
+bail:
+        return ret;
+}
+
+/**
+ * ipath_write_umem32 - write a 32-bit quantity to the chip from user space
+ * @dd: the infinipath device
+ * @caddr: the destination chip address (full pointer, not offset)
+ * @uaddr: the source of the data in user memory
+ * @count: number of bytes to copy
+ *
+ * write 32 bit values, not 64 bit; for memories that only
+ * support 32 bit write; usually a single dword.
+ */
+
+static int ipath_write_umem32(struct ipath_devdata *dd, void __iomem *caddr,
+                              const void __user *uaddr, size_t count)
+{
+        u32 __iomem *reg_addr = caddr;
+        const u32 __iomem *reg_end = reg_addr + (count / sizeof(u32));
+        int ret;
+
+        if (reg_addr < (u32 __iomem *) dd->ipath_kregbase ||
+            reg_end > (u32 __iomem *) dd->ipath_kregend) {
+                ret = -EINVAL;
+                goto bail;
+        }
+        while (reg_addr < reg_end) {
+                u32 data;
+                if (copy_from_user(&data, uaddr, sizeof(data))) {
+                        ret = -EFAULT;
+                        goto bail;
+                }
+                writel(data, reg_addr);
+
+                reg_addr++;
+                uaddr++;
+        }
+        ret = 0;
+bail:
+        return ret;
+}
+
+static int ipath_diag_open(struct inode *in, struct file *fp)
+{
+        struct ipath_devdata *dd;
+        int unit = 0; /* XXX this is bogus */
+        unsigned long flags;
+        int ret;
+
+        dd = ipath_lookup(unit);
+
+        mutex_lock(&ipath_mutex);
+        spin_lock_irqsave(&ipath_devs_lock, flags);
+
+        if (ipath_diag_inuse) {
+                ret = -EBUSY;
+                goto bail;
+        }
+
+        list_for_each_entry(dd, &ipath_dev_list, ipath_list) {
+                /*
+                 * we need at least one infinipath device to be present
+                 * (don't use INITTED, because we want to be able to open
+                 * even if device is in freeze mode, which cleared INITTED).
+                 * There is a small amount of risk to this, which is why we
+                 * also verify kregbase is set.
+                 */
+
+                if (!(dd->ipath_flags & IPATH_PRESENT) ||
+                    !dd->ipath_kregbase)
+                        continue;
+
+                ipath_diag_inuse = 1;
+                diag_set_link = 0;
+                ret = 0;
+                goto bail;
+        }
+
+        ret = -ENODEV;
+
+bail:
+        spin_unlock_irqrestore(&ipath_devs_lock, flags);
+        mutex_unlock(&ipath_mutex);
+
+        /* Only expose a way to reset the device if we
+           make it into diag mode. */
+        if (ret == 0)
+                ipath_expose_reset(&dd->pcidev->dev);
+
+        return ret;
+}
+
+static int ipath_diag_release(struct inode *i, struct file *f)
+{
+        mutex_lock(&ipath_mutex);
+        ipath_diag_inuse = 0;
+        mutex_unlock(&ipath_mutex);
+        return 0;
+}
+
+static ssize_t ipath_diag_read(struct file *fp, char __user *data,
+                               size_t count, loff_t *off)
+{
+        int unit = 0; /* XXX provide for reads on other units some day */
+        struct ipath_devdata *dd;
+        void __iomem *kreg_base;
+        ssize_t ret;
+
+        dd = ipath_lookup(unit);
+        if (!dd) {
+                ret = -ENODEV;
+                goto bail;
+        }
+
+        kreg_base = dd->ipath_kregbase;
+
+        if (count == 0)
+                ret = 0;
+        else if ((count % 4) || (*off % 4))
+                /* address or length is not 32-bit aligned, hence invalid */
+                ret = -EINVAL;
+        else if ((count % 8) || (*off % 8))
+                /* address or length not 64-bit aligned; do 32-bit reads */
+                ret = ipath_read_umem32(dd, data, kreg_base + *off, count);
+        else
+                ret = ipath_read_umem64(dd, data, kreg_base + *off, count);
+
+        if (ret >= 0) {
+                *off += count;
+                ret = count;
+        }
+
+bail:
+        return ret;
+}
+
+static ssize_t ipath_diag_write(struct file *fp, const char __user *data,
+                                size_t count, loff_t *off)
+{
+        int unit = 0; /* XXX this is bogus */
+        struct ipath_devdata *dd;
+        void __iomem *kreg_base;
+        ssize_t ret;
+
+        dd = ipath_lookup(unit);
+        if (!dd) {
+                ret = -ENODEV;
+                goto bail;
+        }
+        kreg_base = dd->ipath_kregbase;
+
+        if (count == 0)
+                ret = 0;
+        else if ((count % 4) || (*off % 4))
+                /* address or length is not 32-bit aligned, hence invalid */
+                ret = -EINVAL;
+        else if ((count % 8) || (*off % 8))
+                /* address or length not 64-bit aligned; do 32-bit writes */
+                ret = ipath_write_umem32(dd, kreg_base + *off, data, count);
+        else
+                ret = ipath_write_umem64(dd, kreg_base + *off, data, count);
+
+        if (ret >= 0) {
+                *off += count;
+                ret = count;
+        }
+
+bail:
+        return ret;
+}
+
+void ipath_diag_bringup_link(struct ipath_devdata *dd)
+{
+        if (diag_set_link || (dd->ipath_flags & IPATH_LINKACTIVE))
+                return;
+
+        diag_set_link = 1;
+        ipath_cdbg(VERBOSE, "Trying to set to set link active for "
+                   "diag pkt\n");
+        ipath_layer_set_linkstate(dd, IPATH_IB_LINKARM);
+        ipath_layer_set_linkstate(dd, IPATH_IB_LINKACTIVE);
+}
diff --git a/drivers/infiniband/hw/ipath/ipath_driver.c b/drivers/infiniband/hw/ipath/ipath_driver.c
new file mode 100644
index 000000000000..58a94efb0070
--- /dev/null
+++ b/drivers/infiniband/hw/ipath/ipath_driver.c
@@ -0,0 +1,1983 @@
+/*
+ * Copyright (c) 2003, 2004, 2005, 2006 PathScale, Inc. All rights reserved.
+ *
+ * This software is available to you under a choice of one of two
+ * licenses.  You may choose to be licensed under the terms of the GNU
+ * General Public License (GPL) Version 2, available from the file
+ * COPYING in the main directory of this source tree, or the
+ * OpenIB.org BSD license below:
+ *
+ *     Redistribution and use in source and binary forms, with or
+ *     without modification, are permitted provided that the following
+ *     conditions are met:
+ *
+ *      - Redistributions of source code must retain the above
+ *        copyright notice, this list of conditions and the following
+ *        disclaimer.
+ *
+ *      - Redistributions in binary form must reproduce the above
+ *        copyright notice, this list of conditions and the following
+ *        disclaimer in the documentation and/or other materials
+ *        provided with the distribution.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+ * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+ * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+ * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
+ * BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
+ * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
+ * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+ * SOFTWARE.
+ */
+
+#include <linux/spinlock.h>
+#include <linux/idr.h>
+#include <linux/pci.h>
+#include <linux/delay.h>
+#include <linux/netdevice.h>
+#include <linux/vmalloc.h>
+
+#include "ipath_kernel.h"
+#include "ips_common.h"
+#include "ipath_layer.h"
+
+static void ipath_update_pio_bufs(struct ipath_devdata *);
+
+const char *ipath_get_unit_name(int unit)
+{
+        static char iname[16];
+        snprintf(iname, sizeof iname, "infinipath%u", unit);
+        return iname;
+}
+
+EXPORT_SYMBOL_GPL(ipath_get_unit_name);
+
+#define DRIVER_LOAD_MSG "PathScale " IPATH_DRV_NAME " loaded: "
+#define PFX IPATH_DRV_NAME ": "
+
+/*
+ * The size has to be longer than this string, so we can append
+ * board/chip information to it in the init code.
+ */
+const char ipath_core_version[] = IPATH_IDSTR "\n";
+
+static struct idr unit_table;
+DEFINE_SPINLOCK(ipath_devs_lock);
+LIST_HEAD(ipath_dev_list);
+
+wait_queue_head_t ipath_sma_state_wait;
+
+unsigned ipath_debug = __IPATH_INFO;
+
+module_param_named(debug, ipath_debug, uint, S_IWUSR | S_IRUGO);
+MODULE_PARM_DESC(debug, "mask for debug prints");
+EXPORT_SYMBOL_GPL(ipath_debug);
+
+MODULE_LICENSE("GPL");
+MODULE_AUTHOR("PathScale <support@pathscale.com>");
+MODULE_DESCRIPTION("Pathscale InfiniPath driver");
+
+const char *ipath_ibcstatus_str[] = {
+        "Disabled",
+        "LinkUp",
+        "PollActive",
+        "PollQuiet",
+        "SleepDelay",
+        "SleepQuiet",
+        "LState6",              /* unused */
+        "LState7",              /* unused */
+        "CfgDebounce",
+        "CfgRcvfCfg",
+        "CfgWaitRmt",
+        "CfgIdle",
+        "RecovRetrain",
+        "LState0xD",            /* unused */
+        "RecovWaitRmt",
+        "RecovIdle",
+};
+
+/*
+ * These variables are initialized in the chip-specific files
+ * but are defined here.
+ */
+u16 ipath_gpio_sda_num, ipath_gpio_scl_num;
+u64 ipath_gpio_sda, ipath_gpio_scl;
+u64 infinipath_i_bitsextant;
+ipath_err_t infinipath_e_bitsextant, infinipath_hwe_bitsextant;
+u32 infinipath_i_rcvavail_mask, infinipath_i_rcvurg_mask;
+
+static void __devexit ipath_remove_one(struct pci_dev *);
+static int __devinit ipath_init_one(struct pci_dev *,
+                                    const struct pci_device_id *);
+
+/* Only needed for registration, nothing else needs this info */
+#define PCI_VENDOR_ID_PATHSCALE 0x1fc1
+#define PCI_DEVICE_ID_INFINIPATH_HT 0xd
+#define PCI_DEVICE_ID_INFINIPATH_PE800 0x10
+
+static const struct pci_device_id ipath_pci_tbl[] = {
+        {PCI_DEVICE(PCI_VENDOR_ID_PATHSCALE,
+                    PCI_DEVICE_ID_INFINIPATH_HT)},
+        {PCI_DEVICE(PCI_VENDOR_ID_PATHSCALE,
+                    PCI_DEVICE_ID_INFINIPATH_PE800)},
+};
+
+MODULE_DEVICE_TABLE(pci, ipath_pci_tbl);
+
+static struct pci_driver ipath_driver = {
+        .name = IPATH_DRV_NAME,
+        .probe = ipath_init_one,
+        .remove = __devexit_p(ipath_remove_one),
+        .id_table = ipath_pci_tbl,
+};
+
+/*
+ * This is where port 0's rcvhdrtail register is written back; we also
+ * want nothing else sharing the cache line, so make it a cache line
+ * in size.  Used for all units.
+ */
+volatile __le64 *ipath_port0_rcvhdrtail;
+dma_addr_t ipath_port0_rcvhdrtail_dma;
+static int port0_rcvhdrtail_refs;
+
+static inline void read_bars(struct ipath_devdata *dd, struct pci_dev *dev,
+                             u32 *bar0, u32 *bar1)
+{
+        int ret;
+
+        ret = pci_read_config_dword(dev, PCI_BASE_ADDRESS_0, bar0);
+        if (ret)
+                ipath_dev_err(dd, "failed to read bar0 before enable: "
+                              "error %d\n", -ret);
+
+        ret = pci_read_config_dword(dev, PCI_BASE_ADDRESS_1, bar1);
+        if (ret)
+                ipath_dev_err(dd, "failed to read bar1 before enable: "
+                              "error %d\n", -ret);
+
+        ipath_dbg("Read bar0 %x bar1 %x\n", *bar0, *bar1);
+}
+
+static void ipath_free_devdata(struct pci_dev *pdev,
+                               struct ipath_devdata *dd)
+{
+        unsigned long flags;
+
+        pci_set_drvdata(pdev, NULL);
+
+        if (dd->ipath_unit != -1) {
+                spin_lock_irqsave(&ipath_devs_lock, flags);
+                idr_remove(&unit_table, dd->ipath_unit);
+                list_del(&dd->ipath_list);
+                spin_unlock_irqrestore(&ipath_devs_lock, flags);
+        }
+        dma_free_coherent(&pdev->dev, sizeof(*dd), dd, dd->ipath_dma_addr);
+}
+
+static struct ipath_devdata *ipath_alloc_devdata(struct pci_dev *pdev)
+{
+        unsigned long flags;
+        struct ipath_devdata *dd;
+        dma_addr_t dma_addr;
+        int ret;
+
+        if (!idr_pre_get(&unit_table, GFP_KERNEL)) {
+                dd = ERR_PTR(-ENOMEM);
+                goto bail;
+        }
+
+        dd = dma_alloc_coherent(&pdev->dev, sizeof(*dd), &dma_addr,
+                                GFP_KERNEL);
+
+        if (!dd) {
+                dd = ERR_PTR(-ENOMEM);
+                goto bail;
+        }
+
+        dd->ipath_dma_addr = dma_addr;
+        dd->ipath_unit = -1;
+
+        spin_lock_irqsave(&ipath_devs_lock, flags);
+
+        ret = idr_get_new(&unit_table, dd, &dd->ipath_unit);
+        if (ret < 0) {
+                printk(KERN_ERR IPATH_DRV_NAME
+                       ": Could not allocate unit ID: error %d\n", -ret);
+                ipath_free_devdata(pdev, dd);
+                dd = ERR_PTR(ret);
+                goto bail_unlock;
+        }
+
+        dd->pcidev = pdev;
+        pci_set_drvdata(pdev, dd);
+
+        list_add(&dd->ipath_list, &ipath_dev_list);
+
+bail_unlock:
+        spin_unlock_irqrestore(&ipath_devs_lock, flags);
+
+bail:
+        return dd;
+}
+
+static inline struct ipath_devdata *__ipath_lookup(int unit)
+{
+        return idr_find(&unit_table, unit);
+}
+
+struct ipath_devdata *ipath_lookup(int unit)
+{
+        struct ipath_devdata *dd;
+        unsigned long flags;
+
+        spin_lock_irqsave(&ipath_devs_lock, flags);
+        dd = __ipath_lookup(unit);
+        spin_unlock_irqrestore(&ipath_devs_lock, flags);
+
+        return dd;
+}
+
+int ipath_count_units(int *npresentp, int *nupp, u32 *maxportsp)
+{
+        int nunits, npresent, nup;
+        struct ipath_devdata *dd;
+        unsigned long flags;
+        u32 maxports;
+
+        nunits = npresent = nup = maxports = 0;
+
+        spin_lock_irqsave(&ipath_devs_lock, flags);
+
+        list_for_each_entry(dd, &ipath_dev_list, ipath_list) {
+                nunits++;
+                if ((dd->ipath_flags & IPATH_PRESENT) && dd->ipath_kregbase)
+                        npresent++;
+                if (dd->ipath_lid &&
+                    !(dd->ipath_flags & (IPATH_DISABLED | IPATH_LINKDOWN
+                                         | IPATH_LINKUNK)))
+                        nup++;
+                if (dd->ipath_cfgports > maxports)
+                        maxports = dd->ipath_cfgports;
+        }
+
+        spin_unlock_irqrestore(&ipath_devs_lock, flags);
+
+        if (npresentp)
+                *npresentp = npresent;
+        if (nupp)
+                *nupp = nup;
+        if (maxportsp)
+                *maxportsp = maxports;
+
+        return nunits;
+}
+
+static int init_port0_rcvhdrtail(struct pci_dev *pdev)
+{
+        int ret;
+
+        mutex_lock(&ipath_mutex);
+
+        if (!ipath_port0_rcvhdrtail) {
+                ipath_port0_rcvhdrtail =
+                        dma_alloc_coherent(&pdev->dev,
+                                           IPATH_PORT0_RCVHDRTAIL_SIZE,
+                                           &ipath_port0_rcvhdrtail_dma,
+                                           GFP_KERNEL);
+
+                if (!ipath_port0_rcvhdrtail) {
+                        ret = -ENOMEM;
+                        goto bail;
+                }
+        }
+        port0_rcvhdrtail_refs++;
+        ret = 0;
+
+bail:
+        mutex_unlock(&ipath_mutex);
+
+        return ret;
+}
+
+static void cleanup_port0_rcvhdrtail(struct pci_dev *pdev)
+{
+        mutex_lock(&ipath_mutex);
+
+        if (!--port0_rcvhdrtail_refs) {
+                dma_free_coherent(&pdev->dev, IPATH_PORT0_RCVHDRTAIL_SIZE,
+                                  (void *) ipath_port0_rcvhdrtail,
+                                  ipath_port0_rcvhdrtail_dma);
+                ipath_port0_rcvhdrtail = NULL;
+        }
+
+        mutex_unlock(&ipath_mutex);
+}
+
+/*
+ * These next two routines are placeholders in case we don't have per-arch
+ * code for controlling write combining.  If explicit control of write
+ * combining is not available, performance will probably be awful.
+ */
+
+int __attribute__((weak)) ipath_enable_wc(struct ipath_devdata *dd)
+{
+        return -EOPNOTSUPP;
+}
+
+void __attribute__((weak)) ipath_disable_wc(struct ipath_devdata *dd)
+{
+}
+
+static int __devinit ipath_init_one(struct pci_dev *pdev,
+                                    const struct pci_device_id *ent)
+{
+        int ret, len, j;
+        struct ipath_devdata *dd;
+        unsigned long long addr;
+        u32 bar0 = 0, bar1 = 0;
+        u8 rev;
+
+        ret = init_port0_rcvhdrtail(pdev);
+        if (ret < 0) {
+                printk(KERN_ERR IPATH_DRV_NAME
+                       ": Could not allocate port0_rcvhdrtail: error %d\n",
+                       -ret);
+                goto bail;
+        }
+
+        dd = ipath_alloc_devdata(pdev);
+        if (IS_ERR(dd)) {
+                ret = PTR_ERR(dd);
+                printk(KERN_ERR IPATH_DRV_NAME
+                       ": Could not allocate devdata: error %d\n", -ret);
+                goto bail_rcvhdrtail;
+        }
+
+        ipath_cdbg(VERBOSE, "initializing unit #%u\n", dd->ipath_unit);
+
+        read_bars(dd, pdev, &bar0, &bar1);
+
+        ret = pci_enable_device(pdev);
+        if (ret) {
+                /* This can happen iff:
+                 *
+                 * We did a chip reset, and then failed to reprogram the
+                 * BAR, or the chip reset due to an internal error.  We then
+                 * unloaded the driver and reloaded it.
+                 *
+                 * Both reset cases set the BAR back to initial state.  For
+                 * the latter case, the AER sticky error bit at offset 0x718
+                 * should be set, but the Linux kernel doesn't yet know
+                 * about that, it appears.  If the original BAR was retained
+                 * in the kernel data structures, this may be OK.
+                 */
+                ipath_dev_err(dd, "enable unit %d failed: error %d\n",
+                              dd->ipath_unit, -ret);
+                goto bail_devdata;
+        }
+        addr = pci_resource_start(pdev, 0);
+        len = pci_resource_len(pdev, 0);
+        ipath_cdbg(VERBOSE, "regbase (0) %llx len %d irq %x, vend %x/%x "
+                   "driver_data %lx\n", addr, len, pdev->irq, ent->vendor,
+                   ent->device, ent->driver_data);
+
+        read_bars(dd, pdev, &bar0, &bar1);
+
+        if (!bar1 && !(bar0 & ~0xf)) {
+                if (addr) {
+                        dev_info(&pdev->dev, "BAR is 0 (probable RESET), "
+                                 "rewriting as %llx\n", addr);
+                        ret = pci_write_config_dword(
+                                pdev, PCI_BASE_ADDRESS_0, addr);
+                        if (ret) {
+                                ipath_dev_err(dd, "rewrite of BAR0 "
+                                              "failed: err %d\n", -ret);
+                                goto bail_disable;
+                        }
+                        ret = pci_write_config_dword(
+                                pdev, PCI_BASE_ADDRESS_1, addr >> 32);
+                        if (ret) {
+                                ipath_dev_err(dd, "rewrite of BAR1 "
+                                              "failed: err %d\n", -ret);
+                                goto bail_disable;
+                        }
+                } else {
+                        ipath_dev_err(dd, "BAR is 0 (probable RESET), "
+                                      "not usable until reboot\n");
+                        ret = -ENODEV;
+                        goto bail_disable;
+                }
+        }
+
+        ret = pci_request_regions(pdev, IPATH_DRV_NAME);
+        if (ret) {
+                dev_info(&pdev->dev, "pci_request_regions unit %u fails: "
+                         "err %d\n", dd->ipath_unit, -ret);
+                goto bail_disable;
+        }
+
+        ret = pci_set_dma_mask(pdev, DMA_64BIT_MASK);
+        if (ret) {
+                dev_info(&pdev->dev, "pci_set_dma_mask unit %u "
+                         "fails: %d\n", dd->ipath_unit, ret);
+                goto bail_regions;
+        }
+
+        pci_set_master(pdev);
+
+        /*
+         * Save BARs to rewrite after device reset.  Save all 64 bits of
+         * BAR, just in case.
+         */
+        dd->ipath_pcibar0 = addr;
+        dd->ipath_pcibar1 = addr >> 32;
+        dd->ipath_deviceid = ent->device;       /* save for later use */
+        dd->ipath_vendorid = ent->vendor;
+
+        /* setup the chip-specific functions, as early as possible. */
+        switch (ent->device) {
+        case PCI_DEVICE_ID_INFINIPATH_HT:
+                ipath_init_ht400_funcs(dd);
+                break;
+        case PCI_DEVICE_ID_INFINIPATH_PE800:
+                ipath_init_pe800_funcs(dd);
+                break;
+        default:
+                ipath_dev_err(dd, "Found unknown PathScale deviceid 0x%x, "
+                              "failing\n", ent->device);
+                return -ENODEV;
+        }
+
+        for (j = 0; j < 6; j++) {
+                if (!pdev->resource[j].start)
+                        continue;
+                ipath_cdbg(VERBOSE, "BAR %d start %lx, end %lx, len %lx\n",
+                           j, pdev->resource[j].start,
+                           pdev->resource[j].end,
+                           pci_resource_len(pdev, j));
+        }
+
+        if (!addr) {
+                ipath_dev_err(dd, "No valid address in BAR 0!\n");
+                ret = -ENODEV;
+                goto bail_regions;
+        }
+
+        dd->ipath_deviceid = ent->device;       /* save for later use */
+        dd->ipath_vendorid = ent->vendor;
+
+        ret = pci_read_config_byte(pdev, PCI_REVISION_ID, &rev);
+        if (ret) {
+                ipath_dev_err(dd, "Failed to read PCI revision ID unit "
+                              "%u: err %d\n", dd->ipath_unit, -ret);
+                goto bail_regions;      /* shouldn't ever happen */
+        }
+        dd->ipath_pcirev = rev;
+
+        dd->ipath_kregbase = ioremap_nocache(addr, len);
+
+        if (!dd->ipath_kregbase) {
+                ipath_dbg("Unable to map io addr %llx to kvirt, failing\n",
+                          addr);
+                ret = -ENOMEM;
+                goto bail_iounmap;
+        }
+        dd->ipath_kregend = (u64 __iomem *)
+                ((void __iomem *)dd->ipath_kregbase + len);
+        dd->ipath_physaddr = addr;      /* used for io_remap, etc. */
+        /* for user mmap */
+        dd->ipath_kregvirt = (u64 __iomem *) phys_to_virt(addr);
+        ipath_cdbg(VERBOSE, "mapped io addr %llx to kregbase %p "
+                   "kregvirt %p\n", addr, dd->ipath_kregbase,
+                   dd->ipath_kregvirt);
+
+        /*
+         * clear ipath_flags here instead of in ipath_init_chip as it is set
+         * by ipath_setup_htconfig.
+         */
+        dd->ipath_flags = 0;
+
+        if (dd->ipath_f_bus(dd, pdev))
+                ipath_dev_err(dd, "Failed to setup config space; "
+                              "continuing anyway\n");
+
+        /*
+         * set up our interrupt handler; SA_SHIRQ probably not needed,
+         * since MSI interrupts shouldn't be shared but won't  hurt for now.
+         * check 0 irq after we return from chip-specific bus setup, since
+         * that can affect this due to setup
+         */
+        if (!pdev->irq)
+                ipath_dev_err(dd, "irq is 0, BIOS error?  Interrupts won't "
+                              "work\n");
+        else {
+                ret = request_irq(pdev->irq, ipath_intr, SA_SHIRQ,
+                                  IPATH_DRV_NAME, dd);
+                if (ret) {
+                        ipath_dev_err(dd, "Couldn't setup irq handler, "
+                                      "irq=%u: %d\n", pdev->irq, ret);
+                        goto bail_iounmap;
+                }
+        }
+
+        ret = ipath_init_chip(dd, 0);   /* do the chip-specific init */
+        if (ret)
+                goto bail_iounmap;
+
+        ret = ipath_enable_wc(dd);
+
+        if (ret) {
+                ipath_dev_err(dd, "Write combining not enabled "
+                              "(err %d): performance may be poor\n",
+                              -ret);
+                ret = 0;
+        }
+
+        ipath_device_create_group(&pdev->dev, dd);
+        ipathfs_add_device(dd);
+        ipath_user_add(dd);
+        ipath_layer_add(dd);
+
+        goto bail;
+
+bail_iounmap:
+        iounmap((volatile void __iomem *) dd->ipath_kregbase);
+
+bail_regions:
+        pci_release_regions(pdev);
+
+bail_disable:
+        pci_disable_device(pdev);
+
+bail_devdata:
+        ipath_free_devdata(pdev, dd);
+
+bail_rcvhdrtail:
+        cleanup_port0_rcvhdrtail(pdev);
+
+bail:
+        return ret;
+}
+
+static void __devexit ipath_remove_one(struct pci_dev *pdev)
+{
+        struct ipath_devdata *dd;
+
+        ipath_cdbg(VERBOSE, "removing, pdev=%p\n", pdev);
+        if (!pdev)
+                return;
+
+        dd = pci_get_drvdata(pdev);
+        ipath_layer_del(dd);
+        ipath_user_del(dd);
+        ipathfs_remove_device(dd);
+        ipath_device_remove_group(&pdev->dev, dd);
+        ipath_cdbg(VERBOSE, "Releasing pci memory regions, dd %p, "
+                   "unit %u\n", dd, (u32) dd->ipath_unit);
+        if (dd->ipath_kregbase) {
+                ipath_cdbg(VERBOSE, "Unmapping kregbase %p\n",
+                           dd->ipath_kregbase);
+                iounmap((volatile void __iomem *) dd->ipath_kregbase);
+                dd->ipath_kregbase = NULL;
+        }
+        pci_release_regions(pdev);
+        ipath_cdbg(VERBOSE, "calling pci_disable_device\n");
+        pci_disable_device(pdev);
+
+        ipath_free_devdata(pdev, dd);
+        cleanup_port0_rcvhdrtail(pdev);
+}
+
+/* general driver use */
+DEFINE_MUTEX(ipath_mutex);
+
+static DEFINE_SPINLOCK(ipath_pioavail_lock);
+
+/**
+ * ipath_disarm_piobufs - cancel a range of PIO buffers
+ * @dd: the infinipath device
+ * @first: the first PIO buffer to cancel
+ * @cnt: the number of PIO buffers to cancel
+ *
+ * cancel a range of PIO buffers, used when they might be armed, but
+ * not triggered.  Used at init to ensure buffer state, and also user
+ * process close, in case it died while writing to a PIO buffer
+ * Also after errors.
+ */
+void ipath_disarm_piobufs(struct ipath_devdata *dd, unsigned first,
+                          unsigned cnt)
+{
+        unsigned i, last = first + cnt;
+        u64 sendctrl, sendorig;
+
+        ipath_cdbg(PKT, "disarm %u PIObufs first=%u\n", cnt, first);
+        sendorig = dd->ipath_sendctrl | INFINIPATH_S_DISARM;
+        for (i = first; i < last; i++) {
+                sendctrl = sendorig |
+                        (i << INFINIPATH_S_DISARMPIOBUF_SHIFT);
+                ipath_write_kreg(dd, dd->ipath_kregs->kr_sendctrl,
+                                 sendctrl);
+        }
+
+        /*
+         * Write it again with current value, in case ipath_sendctrl changed
+         * while we were looping; no critical bits that would require
+         * locking.
+         *
+         * Write a 0, and then the original value, reading scratch in
+         * between.  This seems to avoid a chip timing race that causes
+         * pioavail updates to memory to stop.
+         */
+        ipath_write_kreg(dd, dd->ipath_kregs->kr_sendctrl,
+                         0);
+        sendorig = ipath_read_kreg64(dd, dd->ipath_kregs->kr_scratch);
+        ipath_write_kreg(dd, dd->ipath_kregs->kr_sendctrl,
+                         dd->ipath_sendctrl);
+}
+
+/**
+ * ipath_wait_linkstate - wait for an IB link state change to occur
+ * @dd: the infinipath device
+ * @state: the state to wait for
+ * @msecs: the number of milliseconds to wait
+ *
+ * wait up to msecs milliseconds for IB link state change to occur for
+ * now, take the easy polling route.  Currently used only by
+ * ipath_layer_set_linkstate.  Returns 0 if state reached, otherwise
+ * -ETIMEDOUT state can have multiple states set, for any of several
+ * transitions.
+ */
+int ipath_wait_linkstate(struct ipath_devdata *dd, u32 state, int msecs)
+{
+        dd->ipath_sma_state_wanted = state;
+        wait_event_interruptible_timeout(ipath_sma_state_wait,
+                                         (dd->ipath_flags & state),
+                                         msecs_to_jiffies(msecs));
+        dd->ipath_sma_state_wanted = 0;
+
+        if (!(dd->ipath_flags & state)) {
+                u64 val;
+                ipath_cdbg(SMA, "Didn't reach linkstate %s within %u ms\n",
+                           /* test INIT ahead of DOWN, both can be set */
+                           (state & IPATH_LINKINIT) ? "INIT" :
+                           ((state & IPATH_LINKDOWN) ? "DOWN" :
+                            ((state & IPATH_LINKARMED) ? "ARM" : "ACTIVE")),
+                           msecs);
+                val = ipath_read_kreg64(dd, dd->ipath_kregs->kr_ibcstatus);
+                ipath_cdbg(VERBOSE, "ibcc=%llx ibcstatus=%llx (%s)\n",
+                           (unsigned long long) ipath_read_kreg64(
+                                   dd, dd->ipath_kregs->kr_ibcctrl),
+                           (unsigned long long) val,
+                           ipath_ibcstatus_str[val & 0xf]);
+        }
+        return (dd->ipath_flags & state) ? 0 : -ETIMEDOUT;
+}
+
+void ipath_decode_err(char *buf, size_t blen, ipath_err_t err)
+{
+        *buf = '\0';
+        if (err & INFINIPATH_E_RHDRLEN)
+                strlcat(buf, "rhdrlen ", blen);
+        if (err & INFINIPATH_E_RBADTID)
+                strlcat(buf, "rbadtid ", blen);
+        if (err & INFINIPATH_E_RBADVERSION)
+                strlcat(buf, "rbadversion ", blen);
+        if (err & INFINIPATH_E_RHDR)
+                strlcat(buf, "rhdr ", blen);
+        if (err & INFINIPATH_E_RLONGPKTLEN)
+                strlcat(buf, "rlongpktlen ", blen);
+        if (err & INFINIPATH_E_RSHORTPKTLEN)
+                strlcat(buf, "rshortpktlen ", blen);
+        if (err & INFINIPATH_E_RMAXPKTLEN)
+                strlcat(buf, "rmaxpktlen ", blen);
+        if (err & INFINIPATH_E_RMINPKTLEN)
+                strlcat(buf, "rminpktlen ", blen);
+        if (err & INFINIPATH_E_RFORMATERR)
+                strlcat(buf, "rformaterr ", blen);
+        if (err & INFINIPATH_E_RUNSUPVL)
+                strlcat(buf, "runsupvl ", blen);
+        if (err & INFINIPATH_E_RUNEXPCHAR)
+                strlcat(buf, "runexpchar ", blen);
+        if (err & INFINIPATH_E_RIBFLOW)
+                strlcat(buf, "ribflow ", blen);
+        if (err & INFINIPATH_E_REBP)
+                strlcat(buf, "EBP ", blen);
+        if (err & INFINIPATH_E_SUNDERRUN)
+                strlcat(buf, "sunderrun ", blen);
+        if (err & INFINIPATH_E_SPIOARMLAUNCH)
+                strlcat(buf, "spioarmlaunch ", blen);
+        if (err & INFINIPATH_E_SUNEXPERRPKTNUM)
+                strlcat(buf, "sunexperrpktnum ", blen);
+        if (err & INFINIPATH_E_SDROPPEDDATAPKT)
+                strlcat(buf, "sdroppeddatapkt ", blen);
+        if (err & INFINIPATH_E_SDROPPEDSMPPKT)
+                strlcat(buf, "sdroppedsmppkt ", blen);
+        if (err & INFINIPATH_E_SMAXPKTLEN)
+                strlcat(buf, "smaxpktlen ", blen);
+        if (err & INFINIPATH_E_SMINPKTLEN)
+                strlcat(buf, "sminpktlen ", blen);
+        if (err & INFINIPATH_E_SUNSUPVL)
+                strlcat(buf, "sunsupVL ", blen);
+        if (err & INFINIPATH_E_SPKTLEN)
+                strlcat(buf, "spktlen ", blen);
+        if (err & INFINIPATH_E_INVALIDADDR)
+                strlcat(buf, "invalidaddr ", blen);
+        if (err & INFINIPATH_E_RICRC)
+                strlcat(buf, "CRC ", blen);
+        if (err & INFINIPATH_E_RVCRC)
+                strlcat(buf, "VCRC ", blen);
+        if (err & INFINIPATH_E_RRCVEGRFULL)
+                strlcat(buf, "rcvegrfull ", blen);
+        if (err & INFINIPATH_E_RRCVHDRFULL)
+                strlcat(buf, "rcvhdrfull ", blen);
+        if (err & INFINIPATH_E_IBSTATUSCHANGED)
+                strlcat(buf, "ibcstatuschg ", blen);
+        if (err & INFINIPATH_E_RIBLOSTLINK)
+                strlcat(buf, "riblostlink ", blen);
+        if (err & INFINIPATH_E_HARDWARE)
+                strlcat(buf, "hardware ", blen);
+        if (err & INFINIPATH_E_RESET)
+                strlcat(buf, "reset ", blen);
+}
+
+/**
+ * get_rhf_errstring - decode RHF errors
+ * @err: the err number
+ * @msg: the output buffer
+ * @len: the length of the output buffer
+ *
+ * only used one place now, may want more later
+ */
+static void get_rhf_errstring(u32 err, char *msg, size_t len)
+{
+        /* if no errors, and so don't need to check what's first */
+        *msg = '\0';
+
+        if (err & INFINIPATH_RHF_H_ICRCERR)
+                strlcat(msg, "icrcerr ", len);
+        if (err & INFINIPATH_RHF_H_VCRCERR)
+                strlcat(msg, "vcrcerr ", len);
+        if (err & INFINIPATH_RHF_H_PARITYERR)
+                strlcat(msg, "parityerr ", len);
+        if (err & INFINIPATH_RHF_H_LENERR)
+                strlcat(msg, "lenerr ", len);
+        if (err & INFINIPATH_RHF_H_MTUERR)
+                strlcat(msg, "mtuerr ", len);
+        if (err & INFINIPATH_RHF_H_IHDRERR)
+                /* infinipath hdr checksum error */
+                strlcat(msg, "ipathhdrerr ", len);
+        if (err & INFINIPATH_RHF_H_TIDERR)
+                strlcat(msg, "tiderr ", len);
+        if (err & INFINIPATH_RHF_H_MKERR)
+                /* bad port, offset, etc. */
+                strlcat(msg, "invalid ipathhdr ", len);
+        if (err & INFINIPATH_RHF_H_IBERR)
+                strlcat(msg, "iberr ", len);
+        if (err & INFINIPATH_RHF_L_SWA)
+                strlcat(msg, "swA ", len);
+        if (err & INFINIPATH_RHF_L_SWB)
+                strlcat(msg, "swB ", len);
+}
+
+/**
+ * ipath_get_egrbuf - get an eager buffer
+ * @dd: the infinipath device
+ * @bufnum: the eager buffer to get
+ * @err: unused
+ *
+ * must only be called if ipath_pd[port] is known to be allocated
+ */
+static inline void *ipath_get_egrbuf(struct ipath_devdata *dd, u32 bufnum,
+                                     int err)
+{
+        return dd->ipath_port0_skbs ?
+                (void *)dd->ipath_port0_skbs[bufnum]->data : NULL;
+}
+
+/**
+ * ipath_alloc_skb - allocate an skb and buffer with possible constraints
+ * @dd: the infinipath device
+ * @gfp_mask: the sk_buff SFP mask
+ */
+struct sk_buff *ipath_alloc_skb(struct ipath_devdata *dd,
+                                gfp_t gfp_mask)
+{
+        struct sk_buff *skb;
+        u32 len;
+
+        /*
+         * Only fully supported way to handle this is to allocate lots
+         * extra, align as needed, and then do skb_reserve().  That wastes
+         * a lot of memory...  I'll have to hack this into infinipath_copy
+         * also.
+         */
+
+        /*
+         * We need 4 extra bytes for unaligned transfer copying
+         */
+        if (dd->ipath_flags & IPATH_4BYTE_TID) {
+                /* we need a 4KB multiple alignment, and there is no way
+                 * to do it except to allocate extra and then skb_reserve
+                 * enough to bring it up to the right alignment.
+                 */
+                len = dd->ipath_ibmaxlen + 4 + (1 << 11) - 1;
+        }
+        else
+                len = dd->ipath_ibmaxlen + 4;
+        skb = __dev_alloc_skb(len, gfp_mask);
+        if (!skb) {
+                ipath_dev_err(dd, "Failed to allocate skbuff, length %u\n",
+                              len);
+                goto bail;
+        }
+        if (dd->ipath_flags & IPATH_4BYTE_TID) {
+                u32 una = ((1 << 11) - 1) & (unsigned long)(skb->data + 4);
+                if (una)
+                        skb_reserve(skb, 4 + (1 << 11) - una);
+                else
+                        skb_reserve(skb, 4);
+        } else
+                skb_reserve(skb, 4);
+
+bail:
+        return skb;
+}
+
+/**
+ * ipath_rcv_layer - receive a packet for the layered (ethernet) driver
+ * @dd: the infinipath device
+ * @etail: the sk_buff number
+ * @tlen: the total packet length
+ * @hdr: the ethernet header
+ *
+ * Separate routine for better overall optimization
+ */
+static void ipath_rcv_layer(struct ipath_devdata *dd, u32 etail,
+                            u32 tlen, struct ether_header *hdr)
+{
+        u32 elen;
+        u8 pad, *bthbytes;
+        struct sk_buff *skb, *nskb;
+
+        if (dd->ipath_port0_skbs && hdr->sub_opcode == OPCODE_ENCAP) {
+                /*
+                 * Allocate a new sk_buff to replace the one we give
+                 * to the network stack.
+                 */
+                nskb = ipath_alloc_skb(dd, GFP_ATOMIC);
+                if (!nskb) {
+                        /* count OK packets that we drop */
+                        ipath_stats.sps_krdrops++;
+                        return;
+                }
+
+                bthbytes = (u8 *) hdr->bth;
+                pad = (bthbytes[1] >> 4) & 3;
+                /* +CRC32 */
+                elen = tlen - (sizeof(*hdr) + pad + sizeof(u32));
+
+                skb = dd->ipath_port0_skbs[etail];
+                dd->ipath_port0_skbs[etail] = nskb;
+                skb_put(skb, elen);
+
+                dd->ipath_f_put_tid(dd, etail + (u64 __iomem *)
+                                    ((char __iomem *) dd->ipath_kregbase
+                                     + dd->ipath_rcvegrbase), 0,
+                                    virt_to_phys(nskb->data));
+
+                __ipath_layer_rcv(dd, hdr, skb);
+
+                /* another ether packet received */
+                ipath_stats.sps_ether_rpkts++;
+        }
+        else if (hdr->sub_opcode == OPCODE_LID_ARP)
+                __ipath_layer_rcv_lid(dd, hdr);
+}
+
+/*
+ * ipath_kreceive - receive a packet
+ * @dd: the infinipath device
+ *
+ * called from interrupt handler for errors or receive interrupt
+ */
+void ipath_kreceive(struct ipath_devdata *dd)
+{
+        u64 *rc;
+        void *ebuf;
+        const u32 rsize = dd->ipath_rcvhdrentsize;      /* words */
+        const u32 maxcnt = dd->ipath_rcvhdrcnt * rsize; /* words */
+        u32 etail = -1, l, hdrqtail;
+        struct ips_message_header *hdr;
+        u32 eflags, i, etype, tlen, pkttot = 0;
+        static u64 totcalls;    /* stats, may eventually remove */
+        char emsg[128];
+
+        if (!dd->ipath_hdrqtailptr) {
+                ipath_dev_err(dd,
+                              "hdrqtailptr not set, can't do receives\n");
+                goto bail;
+        }
+
+        /* There is already a thread processing this queue. */
+        if (test_and_set_bit(0, &dd->ipath_rcv_pending))
+                goto bail;
+
+        if (dd->ipath_port0head ==
+            (u32)le64_to_cpu(*dd->ipath_hdrqtailptr))
+                goto done;
+
+gotmore:
+        /*
+         * read only once at start.  If in flood situation, this helps
+         * performance slightly.  If more arrive while we are processing,
+         * we'll come back here and do them
+         */
+        hdrqtail = (u32)le64_to_cpu(*dd->ipath_hdrqtailptr);
+
+        for (i = 0, l = dd->ipath_port0head; l != hdrqtail; i++) {
+                u32 qp;
+                u8 *bthbytes;
+
+                rc = (u64 *) (dd->ipath_pd[0]->port_rcvhdrq + (l << 2));
+                hdr = (struct ips_message_header *)&rc[1];
+                /*
+                 * could make a network order version of IPATH_KD_QP, and
+                 * do the obvious shift before masking to speed this up.
+                 */
+                qp = ntohl(hdr->bth[1]) & 0xffffff;
+                bthbytes = (u8 *) hdr->bth;
+
+                eflags = ips_get_hdr_err_flags((__le32 *) rc);
+                etype = ips_get_rcv_type((__le32 *) rc);
+                /* total length */
+                tlen = ips_get_length_in_bytes((__le32 *) rc);
+                ebuf = NULL;
+                if (etype != RCVHQ_RCV_TYPE_EXPECTED) {
+                        /*
+                         * it turns out that the chips uses an eager buffer
+                         * for all non-expected packets, whether it "needs"
+                         * one or not.  So always get the index, but don't
+                         * set ebuf (so we try to copy data) unless the
+                         * length requires it.
+                         */
+                        etail = ips_get_index((__le32 *) rc);
+                        if (tlen > sizeof(*hdr) ||
+                            etype == RCVHQ_RCV_TYPE_NON_KD)
+                                ebuf = ipath_get_egrbuf(dd, etail, 0);
+                }
+
+                /*
+                 * both tiderr and ipathhdrerr are set for all plain IB
+                 * packets; only ipathhdrerr should be set.
+                 */
+
+                if (etype != RCVHQ_RCV_TYPE_NON_KD && etype !=
+                    RCVHQ_RCV_TYPE_ERROR && ips_get_ipath_ver(
+                            hdr->iph.ver_port_tid_offset) !=
+                    IPS_PROTO_VERSION) {
+                        ipath_cdbg(PKT, "Bad InfiniPath protocol version "
+                                   "%x\n", etype);
+                }
+
+                if (eflags & ~(INFINIPATH_RHF_H_TIDERR |
+                               INFINIPATH_RHF_H_IHDRERR)) {
+                        get_rhf_errstring(eflags, emsg, sizeof emsg);
+                        ipath_cdbg(PKT, "RHFerrs %x hdrqtail=%x typ=%u "
+                                   "tlen=%x opcode=%x egridx=%x: %s\n",
+                                   eflags, l, etype, tlen, bthbytes[0],
+                                   ips_get_index((__le32 *) rc), emsg);
+                } else if (etype == RCVHQ_RCV_TYPE_NON_KD) {
+                                int ret = __ipath_verbs_rcv(dd, rc + 1,
+                                                            ebuf, tlen);
+                                if (ret == -ENODEV)
+                                        ipath_cdbg(VERBOSE,
+                                                   "received IB packet, "
+                                                   "not SMA (QP=%x)\n", qp);
+                } else if (etype == RCVHQ_RCV_TYPE_EAGER) {
+                        if (qp == IPATH_KD_QP &&
+                            bthbytes[0] == ipath_layer_rcv_opcode &&
+                            ebuf)
+                                ipath_rcv_layer(dd, etail, tlen,
+                                                (struct ether_header *)hdr);
+                        else
+                                ipath_cdbg(PKT, "typ %x, opcode %x (eager, "
+                                           "qp=%x), len %x; ignored\n",
+                                           etype, bthbytes[0], qp, tlen);
+                }
+                else if (etype == RCVHQ_RCV_TYPE_EXPECTED)
+                        ipath_dbg("Bug: Expected TID, opcode %x; ignored\n",
+                                  be32_to_cpu(hdr->bth[0]) & 0xff);
+                else if (eflags & (INFINIPATH_RHF_H_TIDERR |
+                                   INFINIPATH_RHF_H_IHDRERR)) {
+                        /*
+                         * This is a type 3 packet, only the LRH is in the
+                         * rcvhdrq, the rest of the header is in the eager
+                         * buffer.
+                         */
+                        u8 opcode;
+                        if (ebuf) {
+                                bthbytes = (u8 *) ebuf;
+                                opcode = *bthbytes;
+                        }
+                        else
+                                opcode = 0;
+                        get_rhf_errstring(eflags, emsg, sizeof emsg);
+                        ipath_dbg("Err %x (%s), opcode %x, egrbuf %x, "
+                                  "len %x\n", eflags, emsg, opcode, etail,
+                                  tlen);
+                } else {
+                        /*
+                         * error packet, type of error  unknown.
+                         * Probably type 3, but we don't know, so don't
+                         * even try to print the opcode, etc.
+                         */
+                        ipath_dbg("Error Pkt, but no eflags! egrbuf %x, "
+                                  "len %x\nhdrq@%lx;hdrq+%x rhf: %llx; "
+                                  "hdr %llx %llx %llx %llx %llx\n",
+                                  etail, tlen, (unsigned long) rc, l,
+                                  (unsigned long long) rc[0],
+                                  (unsigned long long) rc[1],
+                                  (unsigned long long) rc[2],
+                                  (unsigned long long) rc[3],
+                                  (unsigned long long) rc[4],
+                                  (unsigned long long) rc[5]);
+                }
+                l += rsize;
+                if (l >= maxcnt)
+                        l = 0;
+                /*
+                 * update for each packet, to help prevent overflows if we
+                 * have lots of packets.
+                 */
+                (void)ipath_write_ureg(dd, ur_rcvhdrhead,
+                                       dd->ipath_rhdrhead_intr_off | l, 0);
+                if (etype != RCVHQ_RCV_TYPE_EXPECTED)
+                        (void)ipath_write_ureg(dd, ur_rcvegrindexhead,
+                                               etail, 0);
+        }
+
+        pkttot += i;
+
+        dd->ipath_port0head = l;
+
+        if (hdrqtail != (u32)le64_to_cpu(*dd->ipath_hdrqtailptr))
+                /* more arrived while we handled first batch */
+                goto gotmore;
+
+        if (pkttot > ipath_stats.sps_maxpkts_call)
+                ipath_stats.sps_maxpkts_call = pkttot;
+        ipath_stats.sps_port0pkts += pkttot;
+        ipath_stats.sps_avgpkts_call =
+                ipath_stats.sps_port0pkts / ++totcalls;
+
+done:
+        clear_bit(0, &dd->ipath_rcv_pending);
+        smp_mb__after_clear_bit();
+
+bail:;
+}
+
+/**
+ * ipath_update_pio_bufs - update shadow copy of the PIO availability map
+ * @dd: the infinipath device
+ *
+ * called whenever our local copy indicates we have run out of send buffers
+ * NOTE: This can be called from interrupt context by some code
+ * and from non-interrupt context by ipath_getpiobuf().
+ */
+
+static void ipath_update_pio_bufs(struct ipath_devdata *dd)
+{
+        unsigned long flags;
+        int i;
+        const unsigned piobregs = (unsigned)dd->ipath_pioavregs;
+
+        /* If the generation (check) bits have changed, then we update the
+         * busy bit for the corresponding PIO buffer.  This algorithm will
+         * modify positions to the value they already have in some cases
+         * (i.e., no change), but it's faster than changing only the bits
+         * that have changed.
+         *
+         * We would like to do this atomicly, to avoid spinlocks in the
+         * critical send path, but that's not really possible, given the
+         * type of changes, and that this routine could be called on
+         * multiple cpu's simultaneously, so we lock in this routine only,
+         * to avoid conflicting updates; all we change is the shadow, and
+         * it's a single 64 bit memory location, so by definition the update
+         * is atomic in terms of what other cpu's can see in testing the
+         * bits.  The spin_lock overhead isn't too bad, since it only
+         * happens when all buffers are in use, so only cpu overhead, not
+         * latency or bandwidth is affected.
+         */
+#define _IPATH_ALL_CHECKBITS 0x5555555555555555ULL
+        if (!dd->ipath_pioavailregs_dma) {
+                ipath_dbg("Update shadow pioavail, but regs_dma NULL!\n");
+                return;
+        }
+        if (ipath_debug & __IPATH_VERBDBG) {
+                /* only if packet debug and verbose */
+                volatile __le64 *dma = dd->ipath_pioavailregs_dma;
+                unsigned long *shadow = dd->ipath_pioavailshadow;
+
+                ipath_cdbg(PKT, "Refill avail, dma0=%llx shad0=%lx, "
+                           "d1=%llx s1=%lx, d2=%llx s2=%lx, d3=%llx "
+                           "s3=%lx\n",
+                           (unsigned long long) le64_to_cpu(dma[0]),
+                           shadow[0],
+                           (unsigned long long) le64_to_cpu(dma[1]),
+                           shadow[1],
+                           (unsigned long long) le64_to_cpu(dma[2]),
+                           shadow[2],
+                           (unsigned long long) le64_to_cpu(dma[3]),
+                           shadow[3]);
+                if (piobregs > 4)
+                        ipath_cdbg(
+                                PKT, "2nd group, dma4=%llx shad4=%lx, "
+                                "d5=%llx s5=%lx, d6=%llx s6=%lx, "
+                                "d7=%llx s7=%lx\n",
+                                (unsigned long long) le64_to_cpu(dma[4]),
+                                shadow[4],
+                                (unsigned long long) le64_to_cpu(dma[5]),
+                                shadow[5],
+                                (unsigned long long) le64_to_cpu(dma[6]),
+                                shadow[6],
+                                (unsigned long long) le64_to_cpu(dma[7]),
+                                shadow[7]);
+        }
+        spin_lock_irqsave(&ipath_pioavail_lock, flags);
+        for (i = 0; i < piobregs; i++) {
+                u64 pchbusy, pchg, piov, pnew;
+                /*
+                 * Chip Errata: bug 6641; even and odd qwords>3 are swapped
+                 */
+                if (i > 3) {
+                        if (i & 1)
+                                piov = le64_to_cpu(
+                                        dd->ipath_pioavailregs_dma[i - 1]);
+                        else
+                                piov = le64_to_cpu(
+                                        dd->ipath_pioavailregs_dma[i + 1]);
+                } else
+                        piov = le64_to_cpu(dd->ipath_pioavailregs_dma[i]);
+                pchg = _IPATH_ALL_CHECKBITS &
+                        ~(dd->ipath_pioavailshadow[i] ^ piov);
+                pchbusy = pchg << INFINIPATH_SENDPIOAVAIL_BUSY_SHIFT;
+                if (pchg && (pchbusy & dd->ipath_pioavailshadow[i])) {
+                        pnew = dd->ipath_pioavailshadow[i] & ~pchbusy;
+                        pnew |= piov & pchbusy;
+                        dd->ipath_pioavailshadow[i] = pnew;
+                }
+        }
+        spin_unlock_irqrestore(&ipath_pioavail_lock, flags);
+}
+
+/**
+ * ipath_setrcvhdrsize - set the receive header size
+ * @dd: the infinipath device
+ * @rhdrsize: the receive header size
+ *
+ * called from user init code, and also layered driver init
+ */
+int ipath_setrcvhdrsize(struct ipath_devdata *dd, unsigned rhdrsize)
+{
+        int ret = 0;
+
+        if (dd->ipath_flags & IPATH_RCVHDRSZ_SET) {
+                if (dd->ipath_rcvhdrsize != rhdrsize) {
+                        dev_info(&dd->pcidev->dev,
+                                 "Error: can't set protocol header "
+                                 "size %u, already %u\n",
+                                 rhdrsize, dd->ipath_rcvhdrsize);
+                        ret = -EAGAIN;
+                } else
+                        ipath_cdbg(VERBOSE, "Reuse same protocol header "
+                                   "size %u\n", dd->ipath_rcvhdrsize);
+        } else if (rhdrsize > (dd->ipath_rcvhdrentsize -
+                               (sizeof(u64) / sizeof(u32)))) {
+                ipath_dbg("Error: can't set protocol header size %u "
+                          "(> max %u)\n", rhdrsize,
+                          dd->ipath_rcvhdrentsize -
+                          (u32) (sizeof(u64) / sizeof(u32)));
+                ret = -EOVERFLOW;
+        } else {
+                dd->ipath_flags |= IPATH_RCVHDRSZ_SET;
+                dd->ipath_rcvhdrsize = rhdrsize;
+                ipath_write_kreg(dd, dd->ipath_kregs->kr_rcvhdrsize,
+                                 dd->ipath_rcvhdrsize);
+                ipath_cdbg(VERBOSE, "Set protocol header size to %u\n",
+                           dd->ipath_rcvhdrsize);
+        }
+        return ret;
+}
+
+/**
+ * ipath_getpiobuf - find an available pio buffer
+ * @dd: the infinipath device
+ * @pbufnum: the buffer number is placed here
+ *
+ * do appropriate marking as busy, etc.
+ * returns buffer number if one found (>=0), negative number is error.
+ * Used by ipath_sma_send_pkt and ipath_layer_send
+ */
+u32 __iomem *ipath_getpiobuf(struct ipath_devdata *dd, u32 * pbufnum)
+{
+        int i, j, starti, updated = 0;
+        unsigned piobcnt, iter;
+        unsigned long flags;
+        unsigned long *shadow = dd->ipath_pioavailshadow;
+        u32 __iomem *buf;
+
+        piobcnt = (unsigned)(dd->ipath_piobcnt2k
+                             + dd->ipath_piobcnt4k);
+        starti = dd->ipath_lastport_piobuf;
+        iter = piobcnt - starti;
+        if (dd->ipath_upd_pio_shadow) {
+                /*
+                 * Minor optimization.  If we had no buffers on last call,
+                 * start out by doing the update; continue and do scan even
+                 * if no buffers were updated, to be paranoid
+                 */
+                ipath_update_pio_bufs(dd);
+                /* we scanned here, don't do it at end of scan */
+                updated = 1;
+                i = starti;
+        } else
+                i = dd->ipath_lastpioindex;
+
+rescan:
+        /*
+         * while test_and_set_bit() is atomic, we do that and then the
+         * change_bit(), and the pair is not.  See if this is the cause
+         * of the remaining armlaunch errors.
+         */
+        spin_lock_irqsave(&ipath_pioavail_lock, flags);
+        for (j = 0; j < iter; j++, i++) {
+                if (i >= piobcnt)
+                        i = starti;
+                /*
+                 * To avoid bus lock overhead, we first find a candidate
+                 * buffer, then do the test and set, and continue if that
+                 * fails.
+                 */
+                if (test_bit((2 * i) + 1, shadow) ||
+                    test_and_set_bit((2 * i) + 1, shadow))
+                        continue;
+                /* flip generation bit */
+                change_bit(2 * i, shadow);
+                break;
+        }
+        spin_unlock_irqrestore(&ipath_pioavail_lock, flags);
+
+        if (j == iter) {
+                volatile __le64 *dma = dd->ipath_pioavailregs_dma;
+
+                /*
+                 * first time through; shadow exhausted, but may be real
+                 * buffers available, so go see; if any updated, rescan
+                 * (once)
+                 */
+                if (!updated) {
+                        ipath_update_pio_bufs(dd);
+                        updated = 1;
+                        i = starti;
+                        goto rescan;
+                }
+                dd->ipath_upd_pio_shadow = 1;
+                /*
+                 * not atomic, but if we lose one once in a while, that's OK
+                 */
+                ipath_stats.sps_nopiobufs++;
+                if (!(++dd->ipath_consec_nopiobuf % 100000)) {
+                        ipath_dbg(
+                                "%u pio sends with no bufavail; dmacopy: "
+                                "%llx %llx %llx %llx; shadow:  "
+                                "%lx %lx %lx %lx\n",
+                                dd->ipath_consec_nopiobuf,
+                                (unsigned long long) le64_to_cpu(dma[0]),
+                                (unsigned long long) le64_to_cpu(dma[1]),
+                                (unsigned long long) le64_to_cpu(dma[2]),
+                                (unsigned long long) le64_to_cpu(dma[3]),
+                                shadow[0], shadow[1], shadow[2],
+                                shadow[3]);
+                        /*
+                         * 4 buffers per byte, 4 registers above, cover rest
+                         * below
+                         */
+                        if ((dd->ipath_piobcnt2k + dd->ipath_piobcnt4k) >
+                            (sizeof(shadow[0]) * 4 * 4))
+                                ipath_dbg("2nd group: dmacopy: %llx %llx "
+                                          "%llx %llx; shadow: %lx %lx "
+                                          "%lx %lx\n",
+                                          (unsigned long long)
+                                          le64_to_cpu(dma[4]),
+                                          (unsigned long long)
+                                          le64_to_cpu(dma[5]),
+                                          (unsigned long long)
+                                          le64_to_cpu(dma[6]),
+                                          (unsigned long long)
+                                          le64_to_cpu(dma[7]),
+                                          shadow[4], shadow[5],
+                                          shadow[6], shadow[7]);
+                }
+                buf = NULL;
+                goto bail;
+        }
+
+        if (updated)
+                /*
+                 * ran out of bufs, now some (at least this one we just
+                 * got) are now available, so tell the layered driver.
+                 */
+                __ipath_layer_intr(dd, IPATH_LAYER_INT_SEND_CONTINUE);
+
+        /*
+         * set next starting place.  Since it's just an optimization,
+         * it doesn't matter who wins on this, so no locking
+         */
+        dd->ipath_lastpioindex = i + 1;
+        if (dd->ipath_upd_pio_shadow)
+                dd->ipath_upd_pio_shadow = 0;
+        if (dd->ipath_consec_nopiobuf)
+                dd->ipath_consec_nopiobuf = 0;
+        if (i < dd->ipath_piobcnt2k)
+                buf = (u32 __iomem *) (dd->ipath_pio2kbase +
+                                       i * dd->ipath_palign);
+        else
+                buf = (u32 __iomem *)
+                        (dd->ipath_pio4kbase +
+                         (i - dd->ipath_piobcnt2k) * dd->ipath_4kalign);
+        ipath_cdbg(VERBOSE, "Return piobuf%u %uk @ %p\n",
+                   i, (i < dd->ipath_piobcnt2k) ? 2 : 4, buf);
+        if (pbufnum)
+                *pbufnum = i;
+
+bail:
+        return buf;
+}
+
+/**
+ * ipath_create_rcvhdrq - create a receive header queue
+ * @dd: the infinipath device
+ * @pd: the port data
+ *
+ * this *must* be physically contiguous memory, and for now,
+ * that limits it to what kmalloc can do.
+ */
+int ipath_create_rcvhdrq(struct ipath_devdata *dd,
+                         struct ipath_portdata *pd)
+{
+        int ret = 0, amt;
+
+        amt = ALIGN(dd->ipath_rcvhdrcnt * dd->ipath_rcvhdrentsize *
+                    sizeof(u32), PAGE_SIZE);
+        if (!pd->port_rcvhdrq) {
+                /*
+                 * not using REPEAT isn't viable; at 128KB, we can easily
+                 * fail this.  The problem with REPEAT is we can block here
+                 * "forever".  There isn't an inbetween, unfortunately.  We
+                 * could reduce the risk by never freeing the rcvhdrq except
+                 * at unload, but even then, the first time a port is used,
+                 * we could delay for some time...
+                 */
+                gfp_t gfp_flags = GFP_USER | __GFP_COMP;
+
+                pd->port_rcvhdrq = dma_alloc_coherent(
+                        &dd->pcidev->dev, amt, &pd->port_rcvhdrq_phys,
+                        gfp_flags);
+
+                if (!pd->port_rcvhdrq) {
+                        ipath_dev_err(dd, "attempt to allocate %d bytes "
+                                      "for port %u rcvhdrq failed\n",
+                                      amt, pd->port_port);
+                        ret = -ENOMEM;
+                        goto bail;
+                }
+
+                pd->port_rcvhdrq_size = amt;
+
+                ipath_cdbg(VERBOSE, "%d pages at %p (phys %lx) size=%lu "
+                           "for port %u rcvhdr Q\n",
+                           amt >> PAGE_SHIFT, pd->port_rcvhdrq,
+                           (unsigned long) pd->port_rcvhdrq_phys,
+                           (unsigned long) pd->port_rcvhdrq_size,
+                           pd->port_port);
+        } else {
+                /*
+                 * clear for security, sanity, and/or debugging, each
+                 * time we reuse
+                 */
+                memset(pd->port_rcvhdrq, 0, amt);
+        }
+
+        /*
+         * tell chip each time we init it, even if we are re-using previous
+         * memory (we zero it at process close)
+         */
+        ipath_cdbg(VERBOSE, "writing port %d rcvhdraddr as %lx\n",
+                   pd->port_port, (unsigned long) pd->port_rcvhdrq_phys);
+        ipath_write_kreg_port(dd, dd->ipath_kregs->kr_rcvhdraddr,
+                              pd->port_port, pd->port_rcvhdrq_phys);
+
+        ret = 0;
+bail:
+        return ret;
+}
+
+int ipath_waitfor_complete(struct ipath_devdata *dd, ipath_kreg reg_id,
+                           u64 bits_to_wait_for, u64 * valp)
+{
+        unsigned long timeout;
+        u64 lastval, val;
+        int ret;
+
+        lastval = ipath_read_kreg64(dd, reg_id);
+        /* wait a ridiculously long time */
+        timeout = jiffies + msecs_to_jiffies(5);
+        do {
+                val = ipath_read_kreg64(dd, reg_id);
+                /* set so they have something, even on failures. */
+                *valp = val;
+                if ((val & bits_to_wait_for) == bits_to_wait_for) {
+                        ret = 0;
+                        break;
+                }
+                if (val != lastval)
+                        ipath_cdbg(VERBOSE, "Changed from %llx to %llx, "
+                                   "waiting for %llx bits\n",
+                                   (unsigned long long) lastval,
+                                   (unsigned long long) val,
+                                   (unsigned long long) bits_to_wait_for);
+                cond_resched();
+                if (time_after(jiffies, timeout)) {
+                        ipath_dbg("Didn't get bits %llx in register 0x%x, "
+                                  "got %llx\n",
+                                  (unsigned long long) bits_to_wait_for,
+                                  reg_id, (unsigned long long) *valp);
+                        ret = -ENODEV;
+                        break;
+                }
+        } while (1);
+
+        return ret;
+}
+
+/**
+ * ipath_waitfor_mdio_cmdready - wait for last command to complete
+ * @dd: the infinipath device
+ *
+ * Like ipath_waitfor_complete(), but we wait for the CMDVALID bit to go
+ * away indicating the last command has completed.  It doesn't return data
+ */
+int ipath_waitfor_mdio_cmdready(struct ipath_devdata *dd)
+{
+        unsigned long timeout;
+        u64 val;
+        int ret;
+
+        /* wait a ridiculously long time */
+        timeout = jiffies + msecs_to_jiffies(5);
+        do {
+                val = ipath_read_kreg64(dd, dd->ipath_kregs->kr_mdio);
+                if (!(val & IPATH_MDIO_CMDVALID)) {
+                        ret = 0;
+                        break;
+                }
+                cond_resched();
+                if (time_after(jiffies, timeout)) {
+                        ipath_dbg("CMDVALID stuck in mdio reg? (%llx)\n",
+                                  (unsigned long long) val);
+                        ret = -ENODEV;
+                        break;
+                }
+        } while (1);
+
+        return ret;
+}
+
+void ipath_set_ib_lstate(struct ipath_devdata *dd, int which)
+{
+        static const char *what[4] = {
+                [0] = "DOWN",
+                [INFINIPATH_IBCC_LINKCMD_INIT] = "INIT",
+                [INFINIPATH_IBCC_LINKCMD_ARMED] = "ARMED",
+                [INFINIPATH_IBCC_LINKCMD_ACTIVE] = "ACTIVE"
+        };
+        ipath_cdbg(SMA, "Trying to move unit %u to %s, current ltstate "
+                   "is %s\n", dd->ipath_unit,
+                   what[(which >> INFINIPATH_IBCC_LINKCMD_SHIFT) &
+                        INFINIPATH_IBCC_LINKCMD_MASK],
+                   ipath_ibcstatus_str[
+                           (ipath_read_kreg64
+                            (dd, dd->ipath_kregs->kr_ibcstatus) >>
+                            INFINIPATH_IBCS_LINKTRAININGSTATE_SHIFT) &
+                           INFINIPATH_IBCS_LINKTRAININGSTATE_MASK]);
+
+        ipath_write_kreg(dd, dd->ipath_kregs->kr_ibcctrl,
+                         dd->ipath_ibcctrl | which);
+}
+
+/**
+ * ipath_read_kreg64_port - read a device's per-port 64-bit kernel register
+ * @dd: the infinipath device
+ * @regno: the register number to read
+ * @port: the port containing the register
+ *
+ * Registers that vary with the chip implementation constants (port)
+ * use this routine.
+ */
+u64 ipath_read_kreg64_port(const struct ipath_devdata *dd, ipath_kreg regno,
+                           unsigned port)
+{
+        u16 where;
+
+        if (port < dd->ipath_portcnt &&
+            (regno == dd->ipath_kregs->kr_rcvhdraddr ||
+             regno == dd->ipath_kregs->kr_rcvhdrtailaddr))
+                where = regno + port;
+        else
+                where = -1;
+
+        return ipath_read_kreg64(dd, where);
+}
+
+/**
+ * ipath_write_kreg_port - write a device's per-port 64-bit kernel register
+ * @dd: the infinipath device
+ * @regno: the register number to write
+ * @port: the port containing the register
+ * @value: the value to write
+ *
+ * Registers that vary with the chip implementation constants (port)
+ * use this routine.
+ */
+void ipath_write_kreg_port(const struct ipath_devdata *dd, ipath_kreg regno,
+                          unsigned port, u64 value)
+{
+        u16 where;
+
+        if (port < dd->ipath_portcnt &&
+            (regno == dd->ipath_kregs->kr_rcvhdraddr ||
+             regno == dd->ipath_kregs->kr_rcvhdrtailaddr))
+                where = regno + port;
+        else
+                where = -1;
+
+        ipath_write_kreg(dd, where, value);
+}
+
+/**
+ * ipath_shutdown_device - shut down a device
+ * @dd: the infinipath device
+ *
+ * This is called to make the device quiet when we are about to
+ * unload the driver, and also when the device is administratively
+ * disabled.   It does not free any data structures.
+ * Everything it does has to be setup again by ipath_init_chip(dd,1)
+ */
+void ipath_shutdown_device(struct ipath_devdata *dd)
+{
+        u64 val;
+
+        ipath_dbg("Shutting down the device\n");
+
+        dd->ipath_flags |= IPATH_LINKUNK;
+        dd->ipath_flags &= ~(IPATH_INITTED | IPATH_LINKDOWN |
+                             IPATH_LINKINIT | IPATH_LINKARMED |
+                             IPATH_LINKACTIVE);
+        *dd->ipath_statusp &= ~(IPATH_STATUS_IB_CONF |
+                                IPATH_STATUS_IB_READY);
+
+        /* mask interrupts, but not errors */
+        ipath_write_kreg(dd, dd->ipath_kregs->kr_intmask, 0ULL);
+
+        dd->ipath_rcvctrl = 0;
+        ipath_write_kreg(dd, dd->ipath_kregs->kr_rcvctrl,
+                         dd->ipath_rcvctrl);
+
+        /*
+         * gracefully stop all sends allowing any in progress to trickle out
+         * first.
+         */
+        ipath_write_kreg(dd, dd->ipath_kregs->kr_sendctrl, 0ULL);
+        /* flush it */
+        val = ipath_read_kreg64(dd, dd->ipath_kregs->kr_scratch);
+        /*
+         * enough for anything that's going to trickle out to have actually
+         * done so.
+         */
+        udelay(5);
+
+        /*
+         * abort any armed or launched PIO buffers that didn't go. (self
+         * clearing).  Will cause any packet currently being transmitted to
+         * go out with an EBP, and may also cause a short packet error on
+         * the receiver.
+         */
+        ipath_write_kreg(dd, dd->ipath_kregs->kr_sendctrl,
+                         INFINIPATH_S_ABORT);
+
+        ipath_set_ib_lstate(dd, INFINIPATH_IBCC_LINKINITCMD_DISABLE <<
+                            INFINIPATH_IBCC_LINKINITCMD_SHIFT);
+
+        /*
+         * we are shutting down, so tell the layered driver.  We don't do
+         * this on just a link state change, much like ethernet, a cable
+         * unplug, etc. doesn't change driver state
+         */
+        ipath_layer_intr(dd, IPATH_LAYER_INT_IF_DOWN);
+
+        /* disable IBC */
+        dd->ipath_control &= ~INFINIPATH_C_LINKENABLE;
+        ipath_write_kreg(dd, dd->ipath_kregs->kr_control,
+                         dd->ipath_control);
+
+        /*
+         * clear SerdesEnable and turn the leds off; do this here because
+         * we are unloading, so don't count on interrupts to move along
+         * Turn the LEDs off explictly for the same reason.
+         */
+        dd->ipath_f_quiet_serdes(dd);
+        dd->ipath_f_setextled(dd, 0, 0);
+
+        if (dd->ipath_stats_timer_active) {
+                del_timer_sync(&dd->ipath_stats_timer);
+                dd->ipath_stats_timer_active = 0;
+        }
+
+        /*
+         * clear all interrupts and errors, so that the next time the driver
+         * is loaded or device is enabled, we know that whatever is set
+         * happened while we were unloaded
+         */
+        ipath_write_kreg(dd, dd->ipath_kregs->kr_hwerrclear,
+                         ~0ULL & ~INFINIPATH_HWE_MEMBISTFAILED);
+        ipath_write_kreg(dd, dd->ipath_kregs->kr_errorclear, -1LL);
+        ipath_write_kreg(dd, dd->ipath_kregs->kr_intclear, -1LL);
+}
+
+/**
+ * ipath_free_pddata - free a port's allocated data
+ * @dd: the infinipath device
+ * @port: the port
+ * @freehdrq: free the port data structure if true
+ *
+ * when closing, free up any allocated data for a port, if the
+ * reference count goes to zero
+ * Note: this also optionally frees the portdata itself!
+ * Any changes here have to be matched up with the reinit case
+ * of ipath_init_chip(), which calls this routine on reinit after reset.
+ */
+void ipath_free_pddata(struct ipath_devdata *dd, u32 port, int freehdrq)
+{
+        struct ipath_portdata *pd = dd->ipath_pd[port];
+
+        if (!pd)
+                return;
+        if (freehdrq)
+                /*
+                 * only clear and free portdata if we are going to also
+                 * release the hdrq, otherwise we leak the hdrq on each
+                 * open/close cycle
+                 */
+                dd->ipath_pd[port] = NULL;
+        if (freehdrq && pd->port_rcvhdrq) {
+                ipath_cdbg(VERBOSE, "free closed port %d rcvhdrq @ %p "
+                           "(size=%lu)\n", pd->port_port, pd->port_rcvhdrq,
+                           (unsigned long) pd->port_rcvhdrq_size);
+                dma_free_coherent(&dd->pcidev->dev, pd->port_rcvhdrq_size,
+                                  pd->port_rcvhdrq, pd->port_rcvhdrq_phys);
+                pd->port_rcvhdrq = NULL;
+        }
+        if (port && pd->port_rcvegrbuf) {
+                /* always free this */
+                if (pd->port_rcvegrbuf) {
+                        unsigned e;
+
+                        for (e = 0; e < pd->port_rcvegrbuf_chunks; e++) {
+                                void *base = pd->port_rcvegrbuf[e];
+                                size_t size = pd->port_rcvegrbuf_size;
+
+                                ipath_cdbg(VERBOSE, "egrbuf free(%p, %lu), "
+                                           "chunk %u/%u\n", base,
+                                           (unsigned long) size,
+                                           e, pd->port_rcvegrbuf_chunks);
+                                dma_free_coherent(
+                                        &dd->pcidev->dev, size, base,
+                                        pd->port_rcvegrbuf_phys[e]);
+                        }
+                        vfree(pd->port_rcvegrbuf);
+                        pd->port_rcvegrbuf = NULL;
+                        vfree(pd->port_rcvegrbuf_phys);
+                        pd->port_rcvegrbuf_phys = NULL;
+                }
+                pd->port_rcvegrbuf_chunks = 0;
+        } else if (port == 0 && dd->ipath_port0_skbs) {
+                unsigned e;
+                struct sk_buff **skbs = dd->ipath_port0_skbs;
+
+                dd->ipath_port0_skbs = NULL;
+                ipath_cdbg(VERBOSE, "free closed port %d ipath_port0_skbs "
+                           "@ %p\n", pd->port_port, skbs);
+                for (e = 0; e < dd->ipath_rcvegrcnt; e++)
+                        if (skbs[e])
+                                dev_kfree_skb(skbs[e]);
+                vfree(skbs);
+        }
+        if (freehdrq) {
+                kfree(pd->port_tid_pg_list);
+                kfree(pd);
+        }
+}
+
+int __init infinipath_init(void)
+{
+        int ret;
+
+        ipath_dbg(KERN_INFO DRIVER_LOAD_MSG "%s", ipath_core_version);
+
+        /*
+         * These must be called before the driver is registered with
+         * the PCI subsystem.
+         */
+        idr_init(&unit_table);
+        if (!idr_pre_get(&unit_table, GFP_KERNEL)) {
+                ret = -ENOMEM;
+                goto bail;
+        }
+
+        ret = pci_register_driver(&ipath_driver);
+        if (ret < 0) {
+                printk(KERN_ERR IPATH_DRV_NAME
+                       ": Unable to register driver: error %d\n", -ret);
+                goto bail_unit;
+        }
+
+        ret = ipath_driver_create_group(&ipath_driver.driver);
+        if (ret < 0) {
+                printk(KERN_ERR IPATH_DRV_NAME ": Unable to create driver "
+                       "sysfs entries: error %d\n", -ret);
+                goto bail_pci;
+        }
+
+        ret = ipath_init_ipathfs();
+        if (ret < 0) {
+                printk(KERN_ERR IPATH_DRV_NAME ": Unable to create "
+                       "ipathfs: error %d\n", -ret);
+                goto bail_group;
+        }
+
+        goto bail;
+
+bail_group:
+        ipath_driver_remove_group(&ipath_driver.driver);
+
+bail_pci:
+        pci_unregister_driver(&ipath_driver);
+
+bail_unit:
+        idr_destroy(&unit_table);
+
+bail:
+        return ret;
+}
+
+static void cleanup_device(struct ipath_devdata *dd)
+{
+        int port;
+
+        ipath_shutdown_device(dd);
+
+        if (*dd->ipath_statusp & IPATH_STATUS_CHIP_PRESENT) {
+                /* can't do anything more with chip; needs re-init */
+                *dd->ipath_statusp &= ~IPATH_STATUS_CHIP_PRESENT;
+                if (dd->ipath_kregbase) {
+                        /*
+                         * if we haven't already cleaned up before these are
+                         * to ensure any register reads/writes "fail" until
+                         * re-init
+                         */
+                        dd->ipath_kregbase = NULL;
+                        dd->ipath_kregvirt = NULL;
+                        dd->ipath_uregbase = 0;
+                        dd->ipath_sregbase = 0;
+                        dd->ipath_cregbase = 0;
+                        dd->ipath_kregsize = 0;
+                }
+                ipath_disable_wc(dd);
+        }
+
+        if (dd->ipath_pioavailregs_dma) {
+                dma_free_coherent(&dd->pcidev->dev, PAGE_SIZE,
+                                  (void *) dd->ipath_pioavailregs_dma,
+                                  dd->ipath_pioavailregs_phys);
+                dd->ipath_pioavailregs_dma = NULL;
+        }
+
+        if (dd->ipath_pageshadow) {
+                struct page **tmpp = dd->ipath_pageshadow;
+                int i, cnt = 0;
+
+                ipath_cdbg(VERBOSE, "Unlocking any expTID pages still "
+                           "locked\n");
+                for (port = 0; port < dd->ipath_cfgports; port++) {
+                        int port_tidbase = port * dd->ipath_rcvtidcnt;
+                        int maxtid = port_tidbase + dd->ipath_rcvtidcnt;
+                        for (i = port_tidbase; i < maxtid; i++) {
+                                if (!tmpp[i])
+                                        continue;
+                                ipath_release_user_pages(&tmpp[i], 1);
+                                tmpp[i] = NULL;
+                                cnt++;
+                        }
+                }
+                if (cnt) {
+                        ipath_stats.sps_pageunlocks += cnt;
+                        ipath_cdbg(VERBOSE, "There were still %u expTID "
+                                   "entries locked\n", cnt);
+                }
+                if (ipath_stats.sps_pagelocks ||
+                    ipath_stats.sps_pageunlocks)
+                        ipath_cdbg(VERBOSE, "%llu pages locked, %llu "
+                                   "unlocked via ipath_m{un}lock\n",
+                                   (unsigned long long)
+                                   ipath_stats.sps_pagelocks,
+                                   (unsigned long long)
+                                   ipath_stats.sps_pageunlocks);
+
+                ipath_cdbg(VERBOSE, "Free shadow page tid array at %p\n",
+                           dd->ipath_pageshadow);
+                vfree(dd->ipath_pageshadow);
+                dd->ipath_pageshadow = NULL;
+        }
+
+        /*
+         * free any resources still in use (usually just kernel ports)
+         * at unload
+         */
+        for (port = 0; port < dd->ipath_cfgports; port++)
+                ipath_free_pddata(dd, port, 1);
+        kfree(dd->ipath_pd);
+        /*
+         * debuggability, in case some cleanup path tries to use it
+         * after this
+         */
+        dd->ipath_pd = NULL;
+}
+
+static void __exit infinipath_cleanup(void)
+{
+        struct ipath_devdata *dd, *tmp;
+        unsigned long flags;
+
+        ipath_exit_ipathfs();
+
+        ipath_driver_remove_group(&ipath_driver.driver);
+
+        spin_lock_irqsave(&ipath_devs_lock, flags);
+
+        /*
+         * turn off rcv, send, and interrupts for all ports, all drivers
+         * should also hard reset the chip here?
+         * free up port 0 (kernel) rcvhdr, egr bufs, and eventually tid bufs
+         * for all versions of the driver, if they were allocated
+         */
+        list_for_each_entry_safe(dd, tmp, &ipath_dev_list, ipath_list) {
+                spin_unlock_irqrestore(&ipath_devs_lock, flags);
+
+                if (dd->ipath_kregbase)
+                        cleanup_device(dd);
+
+                if (dd->pcidev) {
+                        if (dd->pcidev->irq) {
+                                ipath_cdbg(VERBOSE,
+                                           "unit %u free_irq of irq %x\n",
+                                           dd->ipath_unit, dd->pcidev->irq);
+                                free_irq(dd->pcidev->irq, dd);
+                        } else
+                                ipath_dbg("irq is 0, not doing free_irq "
+                                          "for unit %u\n", dd->ipath_unit);
+                        dd->pcidev = NULL;
+                }
+
+                /*
+                 * we check for NULL here, because it's outside the kregbase
+                 * check, and we need to call it after the free_irq.  Thus
+                 * it's possible that the function pointers were never
+                 * initialized.
+                 */
+                if (dd->ipath_f_cleanup)
+                        /* clean up chip-specific stuff */
+                        dd->ipath_f_cleanup(dd);
+
+                spin_lock_irqsave(&ipath_devs_lock, flags);
+        }
+
+        spin_unlock_irqrestore(&ipath_devs_lock, flags);
+
+        ipath_cdbg(VERBOSE, "Unregistering pci driver\n");
+        pci_unregister_driver(&ipath_driver);
+
+        idr_destroy(&unit_table);
+}
+
+/**
+ * ipath_reset_device - reset the chip if possible
+ * @unit: the device to reset
+ *
+ * Whether or not reset is successful, we attempt to re-initialize the chip
+ * (that is, much like a driver unload/reload).  We clear the INITTED flag
+ * so that the various entry points will fail until we reinitialize.  For
+ * now, we only allow this if no user ports are open that use chip resources
+ */
+int ipath_reset_device(int unit)
+{
+        int ret, i;
+        struct ipath_devdata *dd = ipath_lookup(unit);
+
+        if (!dd) {
+                ret = -ENODEV;
+                goto bail;
+        }
+
+        dev_info(&dd->pcidev->dev, "Reset on unit %u requested\n", unit);
+
+        if (!dd->ipath_kregbase || !(dd->ipath_flags & IPATH_PRESENT)) {
+                dev_info(&dd->pcidev->dev, "Invalid unit number %u or "
+                         "not initialized or not present\n", unit);
+                ret = -ENXIO;
+                goto bail;
+        }
+
+        if (dd->ipath_pd)
+                for (i = 1; i < dd->ipath_portcnt; i++) {
+                        if (dd->ipath_pd[i] && dd->ipath_pd[i]->port_cnt) {
+                                ipath_dbg("unit %u port %d is in use "
+                                          "(PID %u cmd %s), can't reset\n",
+                                          unit, i,
+                                          dd->ipath_pd[i]->port_pid,
+                                          dd->ipath_pd[i]->port_comm);
+                                ret = -EBUSY;
+                                goto bail;
+                        }
+                }
+
+        dd->ipath_flags &= ~IPATH_INITTED;
+        ret = dd->ipath_f_reset(dd);
+        if (ret != 1)
+                ipath_dbg("reset was not successful\n");
+        ipath_dbg("Trying to reinitialize unit %u after reset attempt\n",
+                  unit);
+        ret = ipath_init_chip(dd, 1);
+        if (ret)
+                ipath_dev_err(dd, "Reinitialize unit %u after "
+                              "reset failed with %d\n", unit, ret);
+        else
+                dev_info(&dd->pcidev->dev, "Reinitialized unit %u after "
+                         "resetting\n", unit);
+
+bail:
+        return ret;
+}
+
+module_init(infinipath_init);
+module_exit(infinipath_cleanup);
diff --git a/drivers/infiniband/hw/ipath/ipath_eeprom.c b/drivers/infiniband/hw/ipath/ipath_eeprom.c
new file mode 100644
index 000000000000..f11a900e8cd7
--- /dev/null
+++ b/drivers/infiniband/hw/ipath/ipath_eeprom.c
@@ -0,0 +1,613 @@
+/*
+ * Copyright (c) 2003, 2004, 2005, 2006 PathScale, Inc. All rights reserved.
+ *
+ * This software is available to you under a choice of one of two
+ * licenses.  You may choose to be licensed under the terms of the GNU
+ * General Public License (GPL) Version 2, available from the file
+ * COPYING in the main directory of this source tree, or the
+ * OpenIB.org BSD license below:
+ *
+ *     Redistribution and use in source and binary forms, with or
+ *     without modification, are permitted provided that the following
+ *     conditions are met:
+ *
+ *      - Redistributions of source code must retain the above
+ *        copyright notice, this list of conditions and the following
+ *        disclaimer.
+ *
+ *      - Redistributions in binary form must reproduce the above
+ *        copyright notice, this list of conditions and the following
+ *        disclaimer in the documentation and/or other materials
+ *        provided with the distribution.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+ * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+ * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+ * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
+ * BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
+ * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
+ * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+ * SOFTWARE.
+ */
+
+#include <linux/delay.h>
+#include <linux/pci.h>
+#include <linux/vmalloc.h>
+
+#include "ipath_kernel.h"
+
+/*
+ * InfiniPath I2C driver for a serial eeprom.  This is not a generic
+ * I2C interface.  For a start, the device we're using (Atmel AT24C11)
+ * doesn't work like a regular I2C device.  It looks like one
+ * electrically, but not logically.  Normal I2C devices have a single
+ * 7-bit or 10-bit I2C address that they respond to.  Valid 7-bit
+ * addresses range from 0x03 to 0x77.  Addresses 0x00 to 0x02 and 0x78
+ * to 0x7F are special reserved addresses (e.g. 0x00 is the "general
+ * call" address.)  The Atmel device, on the other hand, responds to ALL
+ * 7-bit addresses.  It's designed to be the only device on a given I2C
+ * bus.  A 7-bit address corresponds to the memory address within the
+ * Atmel device itself.
+ *
+ * Also, the timing requirements mean more than simple software
+ * bitbanging, with readbacks from chip to ensure timing (simple udelay
+ * is not enough).
+ *
+ * This all means that accessing the device is specialized enough
+ * that using the standard kernel I2C bitbanging interface would be
+ * impossible.  For example, the core I2C eeprom driver expects to find
+ * a device at one or more of a limited set of addresses only.  It doesn't
+ * allow writing to an eeprom.  It also doesn't provide any means of
+ * accessing eeprom contents from within the kernel, only via sysfs.
+ */
+
+enum i2c_type {
+        i2c_line_scl = 0,
+        i2c_line_sda
+};
+
+enum i2c_state {
+        i2c_line_low = 0,
+        i2c_line_high
+};
+
+#define READ_CMD 1
+#define WRITE_CMD 0
+
+static int eeprom_init;
+
+/*
+ * The gpioval manipulation really should be protected by spinlocks
+ * or be converted to use atomic operations.
+ */
+
+/**
+ * i2c_gpio_set - set a GPIO line
+ * @dd: the infinipath device
+ * @line: the line to set
+ * @new_line_state: the state to set
+ *
+ * Returns 0 if the line was set to the new state successfully, non-zero
+ * on error.
+ */
+static int i2c_gpio_set(struct ipath_devdata *dd,
+                        enum i2c_type line,
+                        enum i2c_state new_line_state)
+{
+        u64 read_val, write_val, mask, *gpioval;
+
+        gpioval = &dd->ipath_gpio_out;
+        read_val = ipath_read_kreg64(dd, dd->ipath_kregs->kr_extctrl);
+        if (line == i2c_line_scl)
+                mask = ipath_gpio_scl;
+        else
+                mask = ipath_gpio_sda;
+
+        if (new_line_state == i2c_line_high)
+                /* tri-state the output rather than force high */
+                write_val = read_val & ~mask;
+        else
+                /* config line to be an output */
+                write_val = read_val | mask;
+        ipath_write_kreg(dd, dd->ipath_kregs->kr_extctrl, write_val);
+
+        /* set high and verify */
+        if (new_line_state == i2c_line_high)
+                write_val = 0x1UL;
+        else
+                write_val = 0x0UL;
+
+        if (line == i2c_line_scl) {
+                write_val <<= ipath_gpio_scl_num;
+                *gpioval = *gpioval & ~(1UL << ipath_gpio_scl_num);
+                *gpioval |= write_val;
+        } else {
+                write_val <<= ipath_gpio_sda_num;
+                *gpioval = *gpioval & ~(1UL << ipath_gpio_sda_num);
+                *gpioval |= write_val;
+        }
+        ipath_write_kreg(dd, dd->ipath_kregs->kr_gpio_out, *gpioval);
+
+        return 0;
+}
+
+/**
+ * i2c_gpio_get - get a GPIO line state
+ * @dd: the infinipath device
+ * @line: the line to get
+ * @curr_statep: where to put the line state
+ *
+ * Returns 0 if the line was set to the new state successfully, non-zero
+ * on error.  curr_state is not set on error.
+ */
+static int i2c_gpio_get(struct ipath_devdata *dd,
+                        enum i2c_type line,
+                        enum i2c_state *curr_statep)
+{
+        u64 read_val, write_val, mask;
+        int ret;
+
+        /* check args */
+        if (curr_statep == NULL) {
+                ret = 1;
+                goto bail;
+        }
+
+        read_val = ipath_read_kreg64(dd, dd->ipath_kregs->kr_extctrl);
+        /* config line to be an input */
+        if (line == i2c_line_scl)
+                mask = ipath_gpio_scl;
+        else
+                mask = ipath_gpio_sda;
+        write_val = read_val & ~mask;
+        ipath_write_kreg(dd, dd->ipath_kregs->kr_extctrl, write_val);
+        read_val = ipath_read_kreg64(dd, dd->ipath_kregs->kr_extstatus);
+
+        if (read_val & mask)
+                *curr_statep = i2c_line_high;
+        else
+                *curr_statep = i2c_line_low;
+
+        ret = 0;
+
+bail:
+        return ret;
+}
+
+/**
+ * i2c_wait_for_writes - wait for a write
+ * @dd: the infinipath device
+ *
+ * We use this instead of udelay directly, so we can make sure
+ * that previous register writes have been flushed all the way
+ * to the chip.  Since we are delaying anyway, the cost doesn't
+ * hurt, and makes the bit twiddling more regular
+ */
+static void i2c_wait_for_writes(struct ipath_devdata *dd)
+{
+        (void)ipath_read_kreg32(dd, dd->ipath_kregs->kr_scratch);
+}
+
+static void scl_out(struct ipath_devdata *dd, u8 bit)
+{
+        i2c_gpio_set(dd, i2c_line_scl, bit ? i2c_line_high : i2c_line_low);
+
+        i2c_wait_for_writes(dd);
+}
+
+static void sda_out(struct ipath_devdata *dd, u8 bit)
+{
+        i2c_gpio_set(dd, i2c_line_sda, bit ? i2c_line_high : i2c_line_low);
+
+        i2c_wait_for_writes(dd);
+}
+
+static u8 sda_in(struct ipath_devdata *dd, int wait)
+{
+        enum i2c_state bit;
+
+        if (i2c_gpio_get(dd, i2c_line_sda, &bit))
+                ipath_dbg("get bit failed!\n");
+
+        if (wait)
+                i2c_wait_for_writes(dd);
+
+        return bit == i2c_line_high ? 1U : 0;
+}
+
+/**
+ * i2c_ackrcv - see if ack following write is true
+ * @dd: the infinipath device
+ */
+static int i2c_ackrcv(struct ipath_devdata *dd)
+{
+        u8 ack_received;
+
+        /* AT ENTRY SCL = LOW */
+        /* change direction, ignore data */
+        ack_received = sda_in(dd, 1);
+        scl_out(dd, i2c_line_high);
+        ack_received = sda_in(dd, 1) == 0;
+        scl_out(dd, i2c_line_low);
+        return ack_received;
+}
+
+/**
+ * wr_byte - write a byte, one bit at a time
+ * @dd: the infinipath device
+ * @data: the byte to write
+ *
+ * Returns 0 if we got the following ack, otherwise 1
+ */
+static int wr_byte(struct ipath_devdata *dd, u8 data)
+{
+        int bit_cntr;
+        u8 bit;
+
+        for (bit_cntr = 7; bit_cntr >= 0; bit_cntr--) {
+                bit = (data >> bit_cntr) & 1;
+                sda_out(dd, bit);
+                scl_out(dd, i2c_line_high);
+                scl_out(dd, i2c_line_low);
+        }
+        return (!i2c_ackrcv(dd)) ? 1 : 0;
+}
+
+static void send_ack(struct ipath_devdata *dd)
+{
+        sda_out(dd, i2c_line_low);
+        scl_out(dd, i2c_line_high);
+        scl_out(dd, i2c_line_low);
+        sda_out(dd, i2c_line_high);
+}
+
+/**
+ * i2c_startcmd - transmit the start condition, followed by address/cmd
+ * @dd: the infinipath device
+ * @offset_dir: direction byte
+ *
+ *      (both clock/data high, clock high, data low while clock is high)
+ */
+static int i2c_startcmd(struct ipath_devdata *dd, u8 offset_dir)
+{
+        int res;
+
+        /* issue start sequence */
+        sda_out(dd, i2c_line_high);
+        scl_out(dd, i2c_line_high);
+        sda_out(dd, i2c_line_low);
+        scl_out(dd, i2c_line_low);
+
+        /* issue length and direction byte */
+        res = wr_byte(dd, offset_dir);
+
+        if (res)
+                ipath_cdbg(VERBOSE, "No ack to complete start\n");
+
+        return res;
+}
+
+/**
+ * stop_cmd - transmit the stop condition
+ * @dd: the infinipath device
+ *
+ * (both clock/data low, clock high, data high while clock is high)
+ */
+static void stop_cmd(struct ipath_devdata *dd)
+{
+        scl_out(dd, i2c_line_low);
+        sda_out(dd, i2c_line_low);
+        scl_out(dd, i2c_line_high);
+        sda_out(dd, i2c_line_high);
+        udelay(2);
+}
+
+/**
+ * eeprom_reset - reset I2C communication
+ * @dd: the infinipath device
+ */
+
+static int eeprom_reset(struct ipath_devdata *dd)
+{
+        int clock_cycles_left = 9;
+        u64 *gpioval = &dd->ipath_gpio_out;
+        int ret;
+
+        eeprom_init = 1;
+        *gpioval = ipath_read_kreg64(dd, dd->ipath_kregs->kr_gpio_out);
+        ipath_cdbg(VERBOSE, "Resetting i2c eeprom; initial gpioout reg "
+                   "is %llx\n", (unsigned long long) *gpioval);
+
+        /*
+         * This is to get the i2c into a known state, by first going low,
+         * then tristate sda (and then tristate scl as first thing
+         * in loop)
+         */
+        scl_out(dd, i2c_line_low);
+        sda_out(dd, i2c_line_high);
+
+        while (clock_cycles_left--) {
+                scl_out(dd, i2c_line_high);
+
+                if (sda_in(dd, 0)) {
+                        sda_out(dd, i2c_line_low);
+                        scl_out(dd, i2c_line_low);
+                        ret = 0;
+                        goto bail;
+                }
+
+                scl_out(dd, i2c_line_low);
+        }
+
+        ret = 1;
+
+bail:
+        return ret;
+}
+
+/**
+ * ipath_eeprom_read - receives bytes from the eeprom via I2C
+ * @dd: the infinipath device
+ * @eeprom_offset: address to read from
+ * @buffer: where to store result
+ * @len: number of bytes to receive
+ */
+
+int ipath_eeprom_read(struct ipath_devdata *dd, u8 eeprom_offset,
+                      void *buffer, int len)
+{
+        /* compiler complains unless initialized */
+        u8 single_byte = 0;
+        int bit_cntr;
+        int ret;
+
+        if (!eeprom_init)
+                eeprom_reset(dd);
+
+        eeprom_offset = (eeprom_offset << 1) | READ_CMD;
+
+        if (i2c_startcmd(dd, eeprom_offset)) {
+                ipath_dbg("Failed startcmd\n");
+                stop_cmd(dd);
+                ret = 1;
+                goto bail;
+        }
+
+        /*
+         * eeprom keeps clocking data out as long as we ack, automatically
+         * incrementing the address.
+         */
+        while (len-- > 0) {
+                /* get data */
+                single_byte = 0;
+                for (bit_cntr = 8; bit_cntr; bit_cntr--) {
+                        u8 bit;
+                        scl_out(dd, i2c_line_high);
+                        bit = sda_in(dd, 0);
+                        single_byte |= bit << (bit_cntr - 1);
+                        scl_out(dd, i2c_line_low);
+                }
+
+                /* send ack if not the last byte */
+                if (len)
+                        send_ack(dd);
+
+                *((u8 *) buffer) = single_byte;
+                buffer++;
+        }
+
+        stop_cmd(dd);
+
+        ret = 0;
+
+bail:
+        return ret;
+}
+
+/**
+ * ipath_eeprom_write - writes data to the eeprom via I2C
+ * @dd: the infinipath device
+ * @eeprom_offset: where to place data
+ * @buffer: data to write
+ * @len: number of bytes to write
+ */
+int ipath_eeprom_write(struct ipath_devdata *dd, u8 eeprom_offset,
+                       const void *buffer, int len)
+{
+        u8 single_byte;
+        int sub_len;
+        const u8 *bp = buffer;
+        int max_wait_time, i;
+        int ret;
+
+        if (!eeprom_init)
+                eeprom_reset(dd);
+
+        while (len > 0) {
+                if (i2c_startcmd(dd, (eeprom_offset << 1) | WRITE_CMD)) {
+                        ipath_dbg("Failed to start cmd offset %u\n",
+                                  eeprom_offset);
+                        goto failed_write;
+                }
+
+                sub_len = min(len, 4);
+                eeprom_offset += sub_len;
+                len -= sub_len;
+
+                for (i = 0; i < sub_len; i++) {
+                        if (wr_byte(dd, *bp++)) {
+                                ipath_dbg("no ack after byte %u/%u (%u "
+                                          "total remain)\n", i, sub_len,
+                                          len + sub_len - i);
+                                goto failed_write;
+                        }
+                }
+
+                stop_cmd(dd);
+
+                /*
+                 * wait for write complete by waiting for a successful
+                 * read (the chip replies with a zero after the write
+                 * cmd completes, and before it writes to the eeprom.
+                 * The startcmd for the read will fail the ack until
+                 * the writes have completed.   We do this inline to avoid
+                 * the debug prints that are in the real read routine
+                 * if the startcmd fails.
+                 */
+                max_wait_time = 100;
+                while (i2c_startcmd(dd, READ_CMD)) {
+                        stop_cmd(dd);
+                        if (!--max_wait_time) {
+                                ipath_dbg("Did not get successful read to "
+                                          "complete write\n");
+                                goto failed_write;
+                        }
+                }
+                /* now read the zero byte */
+                for (i = single_byte = 0; i < 8; i++) {
+                        u8 bit;
+                        scl_out(dd, i2c_line_high);
+                        bit = sda_in(dd, 0);
+                        scl_out(dd, i2c_line_low);
+                        single_byte <<= 1;
+                        single_byte |= bit;
+                }
+                stop_cmd(dd);
+        }
+
+        ret = 0;
+        goto bail;
+
+failed_write:
+        stop_cmd(dd);
+        ret = 1;
+
+bail:
+        return ret;
+}
+
+static u8 flash_csum(struct ipath_flash *ifp, int adjust)
+{
+        u8 *ip = (u8 *) ifp;
+        u8 csum = 0, len;
+
+        for (len = 0; len < ifp->if_length; len++)
+                csum += *ip++;
+        csum -= ifp->if_csum;
+        csum = ~csum;
+        if (adjust)
+                ifp->if_csum = csum;
+
+        return csum;
+}
+
+/**
+ * ipath_get_guid - get the GUID from the i2c device
+ * @dd: the infinipath device
+ *
+ * When we add the multi-chip support, we will probably have to add
+ * the ability to use the number of guids field, and get the guid from
+ * the first chip's flash, to use for all of them.
+ */
+void ipath_get_guid(struct ipath_devdata *dd)
+{
+        void *buf;
+        struct ipath_flash *ifp;
+        __be64 guid;
+        int len;
+        u8 csum, *bguid;
+        int t = dd->ipath_unit;
+        struct ipath_devdata *dd0 = ipath_lookup(0);
+
+        if (t && dd0->ipath_nguid > 1 && t <= dd0->ipath_nguid) {
+                u8 *bguid, oguid;
+                dd->ipath_guid = dd0->ipath_guid;
+                bguid = (u8 *) & dd->ipath_guid;
+
+                oguid = bguid[7];
+                bguid[7] += t;
+                if (oguid > bguid[7]) {
+                        if (bguid[6] == 0xff) {
+                                if (bguid[5] == 0xff) {
+                                        ipath_dev_err(
+                                                dd,
+                                                "Can't set %s GUID from "
+                                                "base, wraps to OUI!\n",
+                                                ipath_get_unit_name(t));
+                                        dd->ipath_guid = 0;
+                                        goto bail;
+                                }
+                                bguid[5]++;
+                        }
+                        bguid[6]++;
+                }
+                dd->ipath_nguid = 1;
+
+                ipath_dbg("nguid %u, so adding %u to device 0 guid, "
+                          "for %llx\n",
+                          dd0->ipath_nguid, t,
+                          (unsigned long long) be64_to_cpu(dd->ipath_guid));
+                goto bail;
+        }
+
+        len = offsetof(struct ipath_flash, if_future);
+        buf = vmalloc(len);
+        if (!buf) {
+                ipath_dev_err(dd, "Couldn't allocate memory to read %u "
+                              "bytes from eeprom for GUID\n", len);
+                goto bail;
+        }
+
+        if (ipath_eeprom_read(dd, 0, buf, len)) {
+                ipath_dev_err(dd, "Failed reading GUID from eeprom\n");
+                goto done;
+        }
+        ifp = (struct ipath_flash *)buf;
+
+        csum = flash_csum(ifp, 0);
+        if (csum != ifp->if_csum) {
+                dev_info(&dd->pcidev->dev, "Bad I2C flash checksum: "
+                         "0x%x, not 0x%x\n", csum, ifp->if_csum);
+                goto done;
+        }
+        if (*(__be64 *) ifp->if_guid == 0ULL ||
+            *(__be64 *) ifp->if_guid == __constant_cpu_to_be64(-1LL)) {
+                ipath_dev_err(dd, "Invalid GUID %llx from flash; "
+                              "ignoring\n",
+                              *(unsigned long long *) ifp->if_guid);
+                /* don't allow GUID if all 0 or all 1's */
+                goto done;
+        }
+
+        /* complain, but allow it */
+        if (*(u64 *) ifp->if_guid == 0x100007511000000ULL)
+                dev_info(&dd->pcidev->dev, "Warning, GUID %llx is "
+                         "default, probably not correct!\n",
+                         *(unsigned long long *) ifp->if_guid);
+
+        bguid = ifp->if_guid;
+        if (!bguid[0] && !bguid[1] && !bguid[2]) {
+                /* original incorrect GUID format in flash; fix in
+                 * core copy, by shifting up 2 octets; don't need to
+                 * change top octet, since both it and shifted are
+                 * 0.. */
+                bguid[1] = bguid[3];
+                bguid[2] = bguid[4];
+                bguid[3] = bguid[4] = 0;
+                guid = *(__be64 *) ifp->if_guid;
+                ipath_cdbg(VERBOSE, "Old GUID format in flash, top 3 zero, "
+                           "shifting 2 octets\n");
+        } else
+                guid = *(__be64 *) ifp->if_guid;
+        dd->ipath_guid = guid;
+        dd->ipath_nguid = ifp->if_numguid;
+        memcpy(dd->ipath_serial, ifp->if_serial,
+               sizeof(ifp->if_serial));
+        ipath_cdbg(VERBOSE, "Initted GUID to %llx from eeprom\n",
+                   (unsigned long long) be64_to_cpu(dd->ipath_guid));
+
+done:
+        vfree(buf);
+
+bail:;
+}
diff --git a/drivers/infiniband/hw/ipath/ipath_file_ops.c b/drivers/infiniband/hw/ipath/ipath_file_ops.c
new file mode 100644
index 000000000000..c347191f02bf
--- /dev/null
+++ b/drivers/infiniband/hw/ipath/ipath_file_ops.c
@@ -0,0 +1,1910 @@
+/*
+ * Copyright (c) 2003, 2004, 2005, 2006 PathScale, Inc. All rights reserved.
+ *
+ * This software is available to you under a choice of one of two
+ * licenses.  You may choose to be licensed under the terms of the GNU
+ * General Public License (GPL) Version 2, available from the file
+ * COPYING in the main directory of this source tree, or the
+ * OpenIB.org BSD license below:
+ *
+ *     Redistribution and use in source and binary forms, with or
+ *     without modification, are permitted provided that the following
+ *     conditions are met:
+ *
+ *      - Redistributions of source code must retain the above
+ *        copyright notice, this list of conditions and the following
+ *        disclaimer.
+ *
+ *      - Redistributions in binary form must reproduce the above
+ *        copyright notice, this list of conditions and the following
+ *        disclaimer in the documentation and/or other materials
+ *        provided with the distribution.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+ * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+ * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+ * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
+ * BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
+ * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
+ * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+ * SOFTWARE.
+ */
+
+#include <linux/pci.h>
+#include <linux/poll.h>
+#include <linux/cdev.h>
+#include <linux/swap.h>
+#include <linux/vmalloc.h>
+#include <asm/pgtable.h>
+
+#include "ipath_kernel.h"
+#include "ips_common.h"
+#include "ipath_layer.h"
+
+static int ipath_open(struct inode *, struct file *);
+static int ipath_close(struct inode *, struct file *);
+static ssize_t ipath_write(struct file *, const char __user *, size_t,
+                           loff_t *);
+static unsigned int ipath_poll(struct file *, struct poll_table_struct *);
+static int ipath_mmap(struct file *, struct vm_area_struct *);
+
+static struct file_operations ipath_file_ops = {
+        .owner = THIS_MODULE,
+        .write = ipath_write,
+        .open = ipath_open,
+        .release = ipath_close,
+        .poll = ipath_poll,
+        .mmap = ipath_mmap
+};
+
+static int ipath_get_base_info(struct ipath_portdata *pd,
+                               void __user *ubase, size_t ubase_size)
+{
+        int ret = 0;
+        struct ipath_base_info *kinfo = NULL;
+        struct ipath_devdata *dd = pd->port_dd;
+
+        if (ubase_size < sizeof(*kinfo)) {
+                ipath_cdbg(PROC,
+                           "Base size %lu, need %lu (version mismatch?)\n",
+                           (unsigned long) ubase_size,
+                           (unsigned long) sizeof(*kinfo));
+                ret = -EINVAL;
+                goto bail;
+        }
+
+        kinfo = kzalloc(sizeof(*kinfo), GFP_KERNEL);
+        if (kinfo == NULL) {
+                ret = -ENOMEM;
+                goto bail;
+        }
+
+        ret = dd->ipath_f_get_base_info(pd, kinfo);
+        if (ret < 0)
+                goto bail;
+
+        kinfo->spi_rcvhdr_cnt = dd->ipath_rcvhdrcnt;
+        kinfo->spi_rcvhdrent_size = dd->ipath_rcvhdrentsize;
+        kinfo->spi_tidegrcnt = dd->ipath_rcvegrcnt;
+        kinfo->spi_rcv_egrbufsize = dd->ipath_rcvegrbufsize;
+        /*
+         * have to mmap whole thing
+         */
+        kinfo->spi_rcv_egrbuftotlen =
+                pd->port_rcvegrbuf_chunks * pd->port_rcvegrbuf_size;
+        kinfo->spi_rcv_egrperchunk = pd->port_rcvegrbufs_perchunk;
+        kinfo->spi_rcv_egrchunksize = kinfo->spi_rcv_egrbuftotlen /
+                pd->port_rcvegrbuf_chunks;
+        kinfo->spi_tidcnt = dd->ipath_rcvtidcnt;
+        /*
+         * for this use, may be ipath_cfgports summed over all chips that
+         * are are configured and present
+         */
+        kinfo->spi_nports = dd->ipath_cfgports;
+        /* unit (chip/board) our port is on */
+        kinfo->spi_unit = dd->ipath_unit;
+        /* for now, only a single page */
+        kinfo->spi_tid_maxsize = PAGE_SIZE;
+
+        /*
+         * Doing this per port, and based on the skip value, etc.  This has
+         * to be the actual buffer size, since the protocol code treats it
+         * as an array.
+         *
+         * These have to be set to user addresses in the user code via mmap.
+         * These values are used on return to user code for the mmap target
+         * addresses only.  For 32 bit, same 44 bit address problem, so use
+         * the physical address, not virtual.  Before 2.6.11, using the
+         * page_address() macro worked, but in 2.6.11, even that returns the
+         * full 64 bit address (upper bits all 1's).  So far, using the
+         * physical addresses (or chip offsets, for chip mapping) works, but
+         * no doubt some future kernel release will chang that, and we'll be
+         * on to yet another method of dealing with this
+         */
+        kinfo->spi_rcvhdr_base = (u64) pd->port_rcvhdrq_phys;
+        kinfo->spi_rcv_egrbufs = (u64) pd->port_rcvegr_phys;
+        kinfo->spi_pioavailaddr = (u64) dd->ipath_pioavailregs_phys;
+        kinfo->spi_status = (u64) kinfo->spi_pioavailaddr +
+                (void *) dd->ipath_statusp -
+                (void *) dd->ipath_pioavailregs_dma;
+        kinfo->spi_piobufbase = (u64) pd->port_piobufs;
+        kinfo->__spi_uregbase =
+                dd->ipath_uregbase + dd->ipath_palign * pd->port_port;
+
+        kinfo->spi_pioindex = dd->ipath_pbufsport * (pd->port_port - 1);
+        kinfo->spi_piocnt = dd->ipath_pbufsport;
+        kinfo->spi_pioalign = dd->ipath_palign;
+
+        kinfo->spi_qpair = IPATH_KD_QP;
+        kinfo->spi_piosize = dd->ipath_ibmaxlen;
+        kinfo->spi_mtu = dd->ipath_ibmaxlen;    /* maxlen, not ibmtu */
+        kinfo->spi_port = pd->port_port;
+        kinfo->spi_sw_version = IPATH_USER_SWVERSION;
+        kinfo->spi_hw_version = dd->ipath_revision;
+
+        if (copy_to_user(ubase, kinfo, sizeof(*kinfo)))
+                ret = -EFAULT;
+
+bail:
+        kfree(kinfo);
+        return ret;
+}
+
+/**
+ * ipath_tid_update - update a port TID
+ * @pd: the port
+ * @ti: the TID information
+ *
+ * The new implementation as of Oct 2004 is that the driver assigns
+ * the tid and returns it to the caller.   To make it easier to
+ * catch bugs, and to reduce search time, we keep a cursor for
+ * each port, walking the shadow tid array to find one that's not
+ * in use.
+ *
+ * For now, if we can't allocate the full list, we fail, although
+ * in the long run, we'll allocate as many as we can, and the
+ * caller will deal with that by trying the remaining pages later.
+ * That means that when we fail, we have to mark the tids as not in
+ * use again, in our shadow copy.
+ *
+ * It's up to the caller to free the tids when they are done.
+ * We'll unlock the pages as they free them.
+ *
+ * Also, right now we are locking one page at a time, but since
+ * the intended use of this routine is for a single group of
+ * virtually contiguous pages, that should change to improve
+ * performance.
+ */
+static int ipath_tid_update(struct ipath_portdata *pd,
+                            const struct ipath_tid_info *ti)
+{
+        int ret = 0, ntids;
+        u32 tid, porttid, cnt, i, tidcnt;
+        u16 *tidlist;
+        struct ipath_devdata *dd = pd->port_dd;
+        u64 physaddr;
+        unsigned long vaddr;
+        u64 __iomem *tidbase;
+        unsigned long tidmap[8];
+        struct page **pagep = NULL;
+
+        if (!dd->ipath_pageshadow) {
+                ret = -ENOMEM;
+                goto done;
+        }
+
+        cnt = ti->tidcnt;
+        if (!cnt) {
+                ipath_dbg("After copyin, tidcnt 0, tidlist %llx\n",
+                          (unsigned long long) ti->tidlist);
+                /*
+                 * Should we treat as success?  likely a bug
+                 */
+                ret = -EFAULT;
+                goto done;
+        }
+        tidcnt = dd->ipath_rcvtidcnt;
+        if (cnt >= tidcnt) {
+                /* make sure it all fits in port_tid_pg_list */
+                dev_info(&dd->pcidev->dev, "Process tried to allocate %u "
+                         "TIDs, only trying max (%u)\n", cnt, tidcnt);
+                cnt = tidcnt;
+        }
+        pagep = (struct page **)pd->port_tid_pg_list;
+        tidlist = (u16 *) (&pagep[cnt]);
+
+        memset(tidmap, 0, sizeof(tidmap));
+        tid = pd->port_tidcursor;
+        /* before decrement; chip actual # */
+        porttid = pd->port_port * tidcnt;
+        ntids = tidcnt;
+        tidbase = (u64 __iomem *) (((char __iomem *) dd->ipath_kregbase) +
+                                   dd->ipath_rcvtidbase +
+                                   porttid * sizeof(*tidbase));
+
+        ipath_cdbg(VERBOSE, "Port%u %u tids, cursor %u, tidbase %p\n",
+                   pd->port_port, cnt, tid, tidbase);
+
+        /* virtual address of first page in transfer */
+        vaddr = ti->tidvaddr;
+        if (!access_ok(VERIFY_WRITE, (void __user *) vaddr,
+                       cnt * PAGE_SIZE)) {
+                ipath_dbg("Fail vaddr %p, %u pages, !access_ok\n",
+                          (void *)vaddr, cnt);
+                ret = -EFAULT;
+                goto done;
+        }
+        ret = ipath_get_user_pages(vaddr, cnt, pagep);
+        if (ret) {
+                if (ret == -EBUSY) {
+                        ipath_dbg("Failed to lock addr %p, %u pages "
+                                  "(already locked)\n",
+                                  (void *) vaddr, cnt);
+                        /*
+                         * for now, continue, and see what happens but with
+                         * the new implementation, this should never happen,
+                         * unless perhaps the user has mpin'ed the pages
+                         * themselves (something we need to test)
+                         */
+                        ret = 0;
+                } else {
+                        dev_info(&dd->pcidev->dev,
+                                 "Failed to lock addr %p, %u pages: "
+                                 "errno %d\n", (void *) vaddr, cnt, -ret);
+                        goto done;
+                }
+        }
+        for (i = 0; i < cnt; i++, vaddr += PAGE_SIZE) {
+                for (; ntids--; tid++) {
+                        if (tid == tidcnt)
+                                tid = 0;
+                        if (!dd->ipath_pageshadow[porttid + tid])
+                                break;
+                }
+                if (ntids < 0) {
+                        /*
+                         * oops, wrapped all the way through their TIDs,
+                         * and didn't have enough free; see comments at
+                         * start of routine
+                         */
+                        ipath_dbg("Not enough free TIDs for %u pages "
+                                  "(index %d), failing\n", cnt, i);
+                        i--;    /* last tidlist[i] not filled in */
+                        ret = -ENOMEM;
+                        break;
+                }
+                tidlist[i] = tid;
+                ipath_cdbg(VERBOSE, "Updating idx %u to TID %u, "
+                           "vaddr %lx\n", i, tid, vaddr);
+                /* we "know" system pages and TID pages are same size */
+                dd->ipath_pageshadow[porttid + tid] = pagep[i];
+                /*
+                 * don't need atomic or it's overhead
+                 */
+                __set_bit(tid, tidmap);
+                physaddr = page_to_phys(pagep[i]);
+                ipath_stats.sps_pagelocks++;
+                ipath_cdbg(VERBOSE,
+                           "TID %u, vaddr %lx, physaddr %llx pgp %p\n",
+                           tid, vaddr, (unsigned long long) physaddr,
+                           pagep[i]);
+                dd->ipath_f_put_tid(dd, &tidbase[tid], 1, physaddr);
+                /*
+                 * don't check this tid in ipath_portshadow, since we
+                 * just filled it in; start with the next one.
+                 */
+                tid++;
+        }
+
+        if (ret) {
+                u32 limit;
+        cleanup:
+                /* jump here if copy out of updated info failed... */
+                ipath_dbg("After failure (ret=%d), undo %d of %d entries\n",
+                          -ret, i, cnt);
+                /* same code that's in ipath_free_tid() */
+                limit = sizeof(tidmap) * BITS_PER_BYTE;
+                if (limit > tidcnt)
+                        /* just in case size changes in future */
+                        limit = tidcnt;
+                tid = find_first_bit((const unsigned long *)tidmap, limit);
+                for (; tid < limit; tid++) {
+                        if (!test_bit(tid, tidmap))
+                                continue;
+                        if (dd->ipath_pageshadow[porttid + tid]) {
+                                ipath_cdbg(VERBOSE, "Freeing TID %u\n",
+                                           tid);
+                                dd->ipath_f_put_tid(dd, &tidbase[tid], 1,
+                                                    dd->ipath_tidinvalid);
+                                dd->ipath_pageshadow[porttid + tid] = NULL;
+                                ipath_stats.sps_pageunlocks++;
+                        }
+                }
+                ipath_release_user_pages(pagep, cnt);
+        } else {
+                /*
+                 * Copy the updated array, with ipath_tid's filled in, back
+                 * to user.  Since we did the copy in already, this "should
+                 * never fail" If it does, we have to clean up...
+                 */
+                if (copy_to_user((void __user *)
+                                 (unsigned long) ti->tidlist,
+                                 tidlist, cnt * sizeof(*tidlist))) {
+                        ret = -EFAULT;
+                        goto cleanup;
+                }
+                if (copy_to_user((void __user *) (unsigned long) ti->tidmap,
+                                 tidmap, sizeof tidmap)) {
+                        ret = -EFAULT;
+                        goto cleanup;
+                }
+                if (tid == tidcnt)
+                        tid = 0;
+                pd->port_tidcursor = tid;
+        }
+
+done:
+        if (ret)
+                ipath_dbg("Failed to map %u TID pages, failing with %d\n",
+                          ti->tidcnt, -ret);
+        return ret;
+}
+
+/**
+ * ipath_tid_free - free a port TID
+ * @pd: the port
+ * @ti: the TID info
+ *
+ * right now we are unlocking one page at a time, but since
+ * the intended use of this routine is for a single group of
+ * virtually contiguous pages, that should change to improve
+ * performance.  We check that the TID is in range for this port
+ * but otherwise don't check validity; if user has an error and
+ * frees the wrong tid, it's only their own data that can thereby
+ * be corrupted.  We do check that the TID was in use, for sanity
+ * We always use our idea of the saved address, not the address that
+ * they pass in to us.
+ */
+
+static int ipath_tid_free(struct ipath_portdata *pd,
+                          const struct ipath_tid_info *ti)
+{
+        int ret = 0;
+        u32 tid, porttid, cnt, limit, tidcnt;
+        struct ipath_devdata *dd = pd->port_dd;
+        u64 __iomem *tidbase;
+        unsigned long tidmap[8];
+
+        if (!dd->ipath_pageshadow) {
+                ret = -ENOMEM;
+                goto done;
+        }
+
+        if (copy_from_user(tidmap, (void __user *)(unsigned long)ti->tidmap,
+                           sizeof tidmap)) {
+                ret = -EFAULT;
+                goto done;
+        }
+
+        porttid = pd->port_port * dd->ipath_rcvtidcnt;
+        tidbase = (u64 __iomem *) ((char __iomem *)(dd->ipath_kregbase) +
+                                   dd->ipath_rcvtidbase +
+                                   porttid * sizeof(*tidbase));
+
+        tidcnt = dd->ipath_rcvtidcnt;
+        limit = sizeof(tidmap) * BITS_PER_BYTE;
+        if (limit > tidcnt)
+                /* just in case size changes in future */
+                limit = tidcnt;
+        tid = find_first_bit(tidmap, limit);
+        ipath_cdbg(VERBOSE, "Port%u free %u tids; first bit (max=%d) "
+                   "set is %d, porttid %u\n", pd->port_port, ti->tidcnt,
+                   limit, tid, porttid);
+        for (cnt = 0; tid < limit; tid++) {
+                /*
+                 * small optimization; if we detect a run of 3 or so without
+                 * any set, use find_first_bit again.  That's mainly to
+                 * accelerate the case where we wrapped, so we have some at
+                 * the beginning, and some at the end, and a big gap
+                 * in the middle.
+                 */
+                if (!test_bit(tid, tidmap))
+                        continue;
+                cnt++;
+                if (dd->ipath_pageshadow[porttid + tid]) {
+                        ipath_cdbg(VERBOSE, "PID %u freeing TID %u\n",
+                                   pd->port_pid, tid);
+                        dd->ipath_f_put_tid(dd, &tidbase[tid], 1,
+                                            dd->ipath_tidinvalid);
+                        ipath_release_user_pages(
+                                &dd->ipath_pageshadow[porttid + tid], 1);
+                        dd->ipath_pageshadow[porttid + tid] = NULL;
+                        ipath_stats.sps_pageunlocks++;
+                } else
+                        ipath_dbg("Unused tid %u, ignoring\n", tid);
+        }
+        if (cnt != ti->tidcnt)
+                ipath_dbg("passed in tidcnt %d, only %d bits set in map\n",
+                          ti->tidcnt, cnt);
+done:
+        if (ret)
+                ipath_dbg("Failed to unmap %u TID pages, failing with %d\n",
+                          ti->tidcnt, -ret);
+        return ret;
+}
+
+/**
+ * ipath_set_part_key - set a partition key
+ * @pd: the port
+ * @key: the key
+ *
+ * We can have up to 4 active at a time (other than the default, which is
+ * always allowed).  This is somewhat tricky, since multiple ports may set
+ * the same key, so we reference count them, and clean up at exit.  All 4
+ * partition keys are packed into a single infinipath register.  It's an
+ * error for a process to set the same pkey multiple times.  We provide no
+ * mechanism to de-allocate a pkey at this time, we may eventually need to
+ * do that.  I've used the atomic operations, and no locking, and only make
+ * a single pass through what's available.  This should be more than
+ * adequate for some time. I'll think about spinlocks or the like if and as
+ * it's necessary.
+ */
+static int ipath_set_part_key(struct ipath_portdata *pd, u16 key)
+{
+        struct ipath_devdata *dd = pd->port_dd;
+        int i, any = 0, pidx = -1;
+        u16 lkey = key & 0x7FFF;
+        int ret;
+
+        if (lkey == (IPS_DEFAULT_P_KEY & 0x7FFF)) {
+                /* nothing to do; this key always valid */
+                ret = 0;
+                goto bail;
+        }
+
+        ipath_cdbg(VERBOSE, "p%u try to set pkey %hx, current keys "
+                   "%hx:%x %hx:%x %hx:%x %hx:%x\n",
+                   pd->port_port, key, dd->ipath_pkeys[0],
+                   atomic_read(&dd->ipath_pkeyrefs[0]), dd->ipath_pkeys[1],
+                   atomic_read(&dd->ipath_pkeyrefs[1]), dd->ipath_pkeys[2],
+                   atomic_read(&dd->ipath_pkeyrefs[2]), dd->ipath_pkeys[3],
+                   atomic_read(&dd->ipath_pkeyrefs[3]));
+
+        if (!lkey) {
+                ipath_cdbg(PROC, "p%u tries to set key 0, not allowed\n",
+                           pd->port_port);
+                ret = -EINVAL;
+                goto bail;
+        }
+
+        /*
+         * Set the full membership bit, because it has to be
+         * set in the register or the packet, and it seems
+         * cleaner to set in the register than to force all
+         * callers to set it. (see bug 4331)
+         */
+        key |= 0x8000;
+
+        for (i = 0; i < ARRAY_SIZE(pd->port_pkeys); i++) {
+                if (!pd->port_pkeys[i] && pidx == -1)
+                        pidx = i;
+                if (pd->port_pkeys[i] == key) {
+                        ipath_cdbg(VERBOSE, "p%u tries to set same pkey "
+                                   "(%x) more than once\n",
+                                   pd->port_port, key);
+                        ret = -EEXIST;
+                        goto bail;
+                }
+        }
+        if (pidx == -1) {
+                ipath_dbg("All pkeys for port %u already in use, "
+                          "can't set %x\n", pd->port_port, key);
+                ret = -EBUSY;
+                goto bail;
+        }
+        for (any = i = 0; i < ARRAY_SIZE(dd->ipath_pkeys); i++) {
+                if (!dd->ipath_pkeys[i]) {
+                        any++;
+                        continue;
+                }
+                if (dd->ipath_pkeys[i] == key) {
+                        atomic_t *pkrefs = &dd->ipath_pkeyrefs[i];
+
+                        if (atomic_inc_return(pkrefs) > 1) {
+                                pd->port_pkeys[pidx] = key;
+                                ipath_cdbg(VERBOSE, "p%u set key %x "
+                                           "matches #%d, count now %d\n",
+                                           pd->port_port, key, i,
+                                           atomic_read(pkrefs));
+                                ret = 0;
+                                goto bail;
+                        } else {
+                                /*
+                                 * lost race, decrement count, catch below
+                                 */
+                                atomic_dec(pkrefs);
+                                ipath_cdbg(VERBOSE, "Lost race, count was "
+                                           "0, after dec, it's %d\n",
+                                           atomic_read(pkrefs));
+                                any++;
+                        }
+                }
+                if ((dd->ipath_pkeys[i] & 0x7FFF) == lkey) {
+                        /*
+                         * It makes no sense to have both the limited and
+                         * full membership PKEY set at the same time since
+                         * the unlimited one will disable the limited one.
+                         */
+                        ret = -EEXIST;
+                        goto bail;
+                }
+        }
+        if (!any) {
+                ipath_dbg("port %u, all pkeys already in use, "
+                          "can't set %x\n", pd->port_port, key);
+                ret = -EBUSY;
+                goto bail;
+        }
+        for (any = i = 0; i < ARRAY_SIZE(dd->ipath_pkeys); i++) {
+                if (!dd->ipath_pkeys[i] &&
+                    atomic_inc_return(&dd->ipath_pkeyrefs[i]) == 1) {
+                        u64 pkey;
+
+                        /* for ipathstats, etc. */
+                        ipath_stats.sps_pkeys[i] = lkey;
+                        pd->port_pkeys[pidx] = dd->ipath_pkeys[i] = key;
+                        pkey =
+                                (u64) dd->ipath_pkeys[0] |
+                                ((u64) dd->ipath_pkeys[1] << 16) |
+                                ((u64) dd->ipath_pkeys[2] << 32) |
+                                ((u64) dd->ipath_pkeys[3] << 48);
+                        ipath_cdbg(PROC, "p%u set key %x in #%d, "
+                                   "portidx %d, new pkey reg %llx\n",
+                                   pd->port_port, key, i, pidx,
+                                   (unsigned long long) pkey);
+                        ipath_write_kreg(
+                                dd, dd->ipath_kregs->kr_partitionkey, pkey);
+
+                        ret = 0;
+                        goto bail;
+                }
+        }
+        ipath_dbg("port %u, all pkeys already in use 2nd pass, "
+                  "can't set %x\n", pd->port_port, key);
+        ret = -EBUSY;
+
+bail:
+        return ret;
+}
+
+/**
+ * ipath_manage_rcvq - manage a port's receive queue
+ * @pd: the port
+ * @start_stop: action to carry out
+ *
+ * start_stop == 0 disables receive on the port, for use in queue
+ * overflow conditions.  start_stop==1 re-enables, to be used to
+ * re-init the software copy of the head register
+ */
+static int ipath_manage_rcvq(struct ipath_portdata *pd, int start_stop)
+{
+        struct ipath_devdata *dd = pd->port_dd;
+        u64 tval;
+
+        ipath_cdbg(PROC, "%sabling rcv for unit %u port %u\n",
+                   start_stop ? "en" : "dis", dd->ipath_unit,
+                   pd->port_port);
+        /* atomically clear receive enable port. */
+        if (start_stop) {
+                /*
+                 * On enable, force in-memory copy of the tail register to
+                 * 0, so that protocol code doesn't have to worry about
+                 * whether or not the chip has yet updated the in-memory
+                 * copy or not on return from the system call. The chip
+                 * always resets it's tail register back to 0 on a
+                 * transition from disabled to enabled.  This could cause a
+                 * problem if software was broken, and did the enable w/o
+                 * the disable, but eventually the in-memory copy will be
+                 * updated and correct itself, even in the face of software
+                 * bugs.
+                 */
+                *pd->port_rcvhdrtail_kvaddr = 0;
+                set_bit(INFINIPATH_R_PORTENABLE_SHIFT + pd->port_port,
+                        &dd->ipath_rcvctrl);
+        } else
+                clear_bit(INFINIPATH_R_PORTENABLE_SHIFT + pd->port_port,
+                          &dd->ipath_rcvctrl);
+        ipath_write_kreg(dd, dd->ipath_kregs->kr_rcvctrl,
+                         dd->ipath_rcvctrl);
+        /* now be sure chip saw it before we return */
+        tval = ipath_read_kreg64(dd, dd->ipath_kregs->kr_scratch);
+        if (start_stop) {
+                /*
+                 * And try to be sure that tail reg update has happened too.
+                 * This should in theory interlock with the RXE changes to
+                 * the tail register.  Don't assign it to the tail register
+                 * in memory copy, since we could overwrite an update by the
+                 * chip if we did.
+                 */
+                tval = ipath_read_ureg32(dd, ur_rcvhdrtail, pd->port_port);
+        }
+        /* always; new head should be equal to new tail; see above */
+        return 0;
+}
+
+static void ipath_clean_part_key(struct ipath_portdata *pd,
+                                 struct ipath_devdata *dd)
+{
+        int i, j, pchanged = 0;
+        u64 oldpkey;
+
+        /* for debugging only */
+        oldpkey = (u64) dd->ipath_pkeys[0] |
+                ((u64) dd->ipath_pkeys[1] << 16) |
+                ((u64) dd->ipath_pkeys[2] << 32) |
+                ((u64) dd->ipath_pkeys[3] << 48);
+
+        for (i = 0; i < ARRAY_SIZE(pd->port_pkeys); i++) {
+                if (!pd->port_pkeys[i])
+                        continue;
+                ipath_cdbg(VERBOSE, "look for key[%d] %hx in pkeys\n", i,
+                           pd->port_pkeys[i]);
+                for (j = 0; j < ARRAY_SIZE(dd->ipath_pkeys); j++) {
+                        /* check for match independent of the global bit */
+                        if ((dd->ipath_pkeys[j] & 0x7fff) !=
+                            (pd->port_pkeys[i] & 0x7fff))
+                                continue;
+                        if (atomic_dec_and_test(&dd->ipath_pkeyrefs[j])) {
+                                ipath_cdbg(VERBOSE, "p%u clear key "
+                                           "%x matches #%d\n",
+                                           pd->port_port,
+                                           pd->port_pkeys[i], j);
+                                ipath_stats.sps_pkeys[j] =
+                                        dd->ipath_pkeys[j] = 0;
+                                pchanged++;
+                        }
+                        else ipath_cdbg(
+                                VERBOSE, "p%u key %x matches #%d, "
+                                "but ref still %d\n", pd->port_port,
+                                pd->port_pkeys[i], j,
+                                atomic_read(&dd->ipath_pkeyrefs[j]));
+                        break;
+                }
+                pd->port_pkeys[i] = 0;
+        }
+        if (pchanged) {
+                u64 pkey = (u64) dd->ipath_pkeys[0] |
+                        ((u64) dd->ipath_pkeys[1] << 16) |
+                        ((u64) dd->ipath_pkeys[2] << 32) |
+                        ((u64) dd->ipath_pkeys[3] << 48);
+                ipath_cdbg(VERBOSE, "p%u old pkey reg %llx, "
+                           "new pkey reg %llx\n", pd->port_port,
+                           (unsigned long long) oldpkey,
+                           (unsigned long long) pkey);
+                ipath_write_kreg(dd, dd->ipath_kregs->kr_partitionkey,
+                                 pkey);
+        }
+}
+
+/**
+ * ipath_create_user_egr - allocate eager TID buffers
+ * @pd: the port to allocate TID buffers for
+ *
+ * This routine is now quite different for user and kernel, because
+ * the kernel uses skb's, for the accelerated network performance
+ * This is the user port version
+ *
+ * Allocate the eager TID buffers and program them into infinipath
+ * They are no longer completely contiguous, we do multiple allocation
+ * calls.
+ */
+static int ipath_create_user_egr(struct ipath_portdata *pd)
+{
+        struct ipath_devdata *dd = pd->port_dd;
+        unsigned e, egrcnt, alloced, egrperchunk, chunk, egrsize, egroff;
+        size_t size;
+        int ret;
+
+        egrcnt = dd->ipath_rcvegrcnt;
+        /* TID number offset for this port */
+        egroff = pd->port_port * egrcnt;
+        egrsize = dd->ipath_rcvegrbufsize;
+        ipath_cdbg(VERBOSE, "Allocating %d egr buffers, at egrtid "
+                   "offset %x, egrsize %u\n", egrcnt, egroff, egrsize);
+
+        /*
+         * to avoid wasting a lot of memory, we allocate 32KB chunks of
+         * physically contiguous memory, advance through it until used up
+         * and then allocate more.  Of course, we need memory to store those
+         * extra pointers, now.  Started out with 256KB, but under heavy
+         * memory pressure (creating large files and then copying them over
+         * NFS while doing lots of MPI jobs), we hit some allocation
+         * failures, even though we can sleep...  (2.6.10) Still get
+         * failures at 64K.  32K is the lowest we can go without waiting
+         * more memory again.  It seems likely that the coalescing in
+         * free_pages, etc. still has issues (as it has had previously
+         * during 2.6.x development).
+         */
+        size = 0x8000;
+        alloced = ALIGN(egrsize * egrcnt, size);
+        egrperchunk = size / egrsize;
+        chunk = (egrcnt + egrperchunk - 1) / egrperchunk;
+        pd->port_rcvegrbuf_chunks = chunk;
+        pd->port_rcvegrbufs_perchunk = egrperchunk;
+        pd->port_rcvegrbuf_size = size;
+        pd->port_rcvegrbuf = vmalloc(chunk * sizeof(pd->port_rcvegrbuf[0]));
+        if (!pd->port_rcvegrbuf) {
+                ret = -ENOMEM;
+                goto bail;
+        }
+        pd->port_rcvegrbuf_phys =
+                vmalloc(chunk * sizeof(pd->port_rcvegrbuf_phys[0]));
+        if (!pd->port_rcvegrbuf_phys) {
+                ret = -ENOMEM;
+                goto bail_rcvegrbuf;
+        }
+        for (e = 0; e < pd->port_rcvegrbuf_chunks; e++) {
+                /*
+                 * GFP_USER, but without GFP_FS, so buffer cache can be
+                 * coalesced (we hope); otherwise, even at order 4,
+                 * heavy filesystem activity makes these fail
+                 */
+                gfp_t gfp_flags = __GFP_WAIT | __GFP_IO | __GFP_COMP;
+
+                pd->port_rcvegrbuf[e] = dma_alloc_coherent(
+                        &dd->pcidev->dev, size, &pd->port_rcvegrbuf_phys[e],
+                        gfp_flags);
+
+                if (!pd->port_rcvegrbuf[e]) {
+                        ret = -ENOMEM;
+                        goto bail_rcvegrbuf_phys;
+                }
+        }
+
+        pd->port_rcvegr_phys = pd->port_rcvegrbuf_phys[0];
+
+        for (e = chunk = 0; chunk < pd->port_rcvegrbuf_chunks; chunk++) {
+                dma_addr_t pa = pd->port_rcvegrbuf_phys[chunk];
+                unsigned i;
+
+                for (i = 0; e < egrcnt && i < egrperchunk; e++, i++) {
+                        dd->ipath_f_put_tid(dd, e + egroff +
+                                            (u64 __iomem *)
+                                            ((char __iomem *)
+                                             dd->ipath_kregbase +
+                                             dd->ipath_rcvegrbase), 0, pa);
+                        pa += egrsize;
+                }
+                cond_resched(); /* don't hog the cpu */
+        }
+
+        ret = 0;
+        goto bail;
+
+bail_rcvegrbuf_phys:
+        for (e = 0; e < pd->port_rcvegrbuf_chunks &&
+                     pd->port_rcvegrbuf[e]; e++)
+                dma_free_coherent(&dd->pcidev->dev, size,
+                                  pd->port_rcvegrbuf[e],
+                                  pd->port_rcvegrbuf_phys[e]);
+
+        vfree(pd->port_rcvegrbuf_phys);
+        pd->port_rcvegrbuf_phys = NULL;
+bail_rcvegrbuf:
+        vfree(pd->port_rcvegrbuf);
+        pd->port_rcvegrbuf = NULL;
+bail:
+        return ret;
+}
+
+static int ipath_do_user_init(struct ipath_portdata *pd,
+                              const struct ipath_user_info *uinfo)
+{
+        int ret = 0;
+        struct ipath_devdata *dd = pd->port_dd;
+        u64 physaddr, uaddr, off, atmp;
+        struct page *pagep;
+        u32 head32;
+        u64 head;
+
+        /* for now, if major version is different, bail */
+        if ((uinfo->spu_userversion >> 16) != IPATH_USER_SWMAJOR) {
+                dev_info(&dd->pcidev->dev,
+                         "User major version %d not same as driver "
+                         "major %d\n", uinfo->spu_userversion >> 16,
+                         IPATH_USER_SWMAJOR);
+                ret = -ENODEV;
+                goto done;
+        }
+
+        if ((uinfo->spu_userversion & 0xffff) != IPATH_USER_SWMINOR)
+                ipath_dbg("User minor version %d not same as driver "
+                          "minor %d\n", uinfo->spu_userversion & 0xffff,
+                          IPATH_USER_SWMINOR);
+
+        if (uinfo->spu_rcvhdrsize) {
+                ret = ipath_setrcvhdrsize(dd, uinfo->spu_rcvhdrsize);
+                if (ret)
+                        goto done;
+        }
+
+        /* for now we do nothing with rcvhdrcnt: uinfo->spu_rcvhdrcnt */
+
+        /* set up for the rcvhdr Q tail register writeback to user memory */
+        if (!uinfo->spu_rcvhdraddr ||
+            !access_ok(VERIFY_WRITE, (u64 __user *) (unsigned long)
+                       uinfo->spu_rcvhdraddr, sizeof(u64))) {
+                ipath_dbg("Port %d rcvhdrtail addr %llx not valid\n",
+                          pd->port_port,
+                          (unsigned long long) uinfo->spu_rcvhdraddr);
+                ret = -EINVAL;
+                goto done;
+        }
+
+        off = offset_in_page(uinfo->spu_rcvhdraddr);
+        uaddr = PAGE_MASK & (unsigned long) uinfo->spu_rcvhdraddr;
+        ret = ipath_get_user_pages_nocopy(uaddr, &pagep);
+        if (ret) {
+                dev_info(&dd->pcidev->dev, "Failed to lookup and lock "
+                         "address %llx for rcvhdrtail: errno %d\n",
+                         (unsigned long long) uinfo->spu_rcvhdraddr, -ret);
+                goto done;
+        }
+        ipath_stats.sps_pagelocks++;
+        pd->port_rcvhdrtail_uaddr = uaddr;
+        pd->port_rcvhdrtail_pagep = pagep;
+        pd->port_rcvhdrtail_kvaddr =
+                page_address(pagep);
+        pd->port_rcvhdrtail_kvaddr += off;
+        physaddr = page_to_phys(pagep) + off;
+        ipath_cdbg(VERBOSE, "port %d user addr %llx hdrtailaddr, %llx "
+                   "physical (off=%llx)\n",
+                   pd->port_port,
+                   (unsigned long long) uinfo->spu_rcvhdraddr,
+                   (unsigned long long) physaddr, (unsigned long long) off);
+        ipath_write_kreg_port(dd, dd->ipath_kregs->kr_rcvhdrtailaddr,
+                              pd->port_port, physaddr);
+        atmp = ipath_read_kreg64_port(dd,
+                                      dd->ipath_kregs->kr_rcvhdrtailaddr,
+                                      pd->port_port);
+        if (physaddr != atmp) {
+                ipath_dev_err(dd,
+                              "Catastrophic software error, "
+                              "RcvHdrTailAddr%u written as %llx, "
+                              "read back as %llx\n", pd->port_port,
+                              (unsigned long long) physaddr,
+                              (unsigned long long) atmp);
+                ret = -EINVAL;
+                goto done;
+        }
+
+        /* for right now, kernel piobufs are at end, so port 1 is at 0 */
+        pd->port_piobufs = dd->ipath_piobufbase +
+                dd->ipath_pbufsport * (pd->port_port -
+                                       1) * dd->ipath_palign;
+        ipath_cdbg(VERBOSE, "Set base of piobufs for port %u to 0x%x\n",
+                   pd->port_port, pd->port_piobufs);
+
+        /*
+         * Now allocate the rcvhdr Q and eager TIDs; skip the TID
+         * array for time being.  If pd->port_port > chip-supported,
+         * we need to do extra stuff here to handle by handling overflow
+         * through port 0, someday
+         */
+        ret = ipath_create_rcvhdrq(dd, pd);
+        if (!ret)
+                ret = ipath_create_user_egr(pd);
+        if (ret)
+                goto done;
+        /* enable receives now */
+        /* atomically set enable bit for this port */
+        set_bit(INFINIPATH_R_PORTENABLE_SHIFT + pd->port_port,
+                &dd->ipath_rcvctrl);
+
+        /*
+         * set the head registers for this port to the current values
+         * of the tail pointers, since we don't know if they were
+         * updated on last use of the port.
+         */
+        head32 = ipath_read_ureg32(dd, ur_rcvhdrtail, pd->port_port);
+        head = (u64) head32;
+        ipath_write_ureg(dd, ur_rcvhdrhead, head, pd->port_port);
+        head32 = ipath_read_ureg32(dd, ur_rcvegrindextail, pd->port_port);
+        ipath_write_ureg(dd, ur_rcvegrindexhead, head32, pd->port_port);
+        dd->ipath_lastegrheads[pd->port_port] = -1;
+        dd->ipath_lastrcvhdrqtails[pd->port_port] = -1;
+        ipath_cdbg(VERBOSE, "Wrote port%d head %llx, egrhead %x from "
+                   "tail regs\n", pd->port_port,
+                   (unsigned long long) head, head32);
+        pd->port_tidcursor = 0; /* start at beginning after open */
+        /*
+         * now enable the port; the tail registers will be written to memory
+         * by the chip as soon as it sees the write to
+         * dd->ipath_kregs->kr_rcvctrl.  The update only happens on
+         * transition from 0 to 1, so clear it first, then set it as part of
+         * enabling the port.  This will (very briefly) affect any other
+         * open ports, but it shouldn't be long enough to be an issue.
+         */
+        ipath_write_kreg(dd, dd->ipath_kregs->kr_rcvctrl,
+                         dd->ipath_rcvctrl & ~INFINIPATH_R_TAILUPD);
+        ipath_write_kreg(dd, dd->ipath_kregs->kr_rcvctrl,
+                         dd->ipath_rcvctrl);
+
+done:
+        return ret;
+}
+
+static int mmap_ureg(struct vm_area_struct *vma, struct ipath_devdata *dd,
+                     u64 ureg)
+{
+        unsigned long phys;
+        int ret;
+
+        /* it's the real hardware, so io_remap works */
+
+        if ((vma->vm_end - vma->vm_start) > PAGE_SIZE) {
+                dev_info(&dd->pcidev->dev, "FAIL mmap userreg: reqlen "
+                         "%lx > PAGE\n", vma->vm_end - vma->vm_start);
+                ret = -EFAULT;
+        } else {
+                phys = dd->ipath_physaddr + ureg;
+                vma->vm_page_prot = pgprot_noncached(vma->vm_page_prot);
+
+                vma->vm_flags |= VM_DONTCOPY | VM_DONTEXPAND;
+                ret = io_remap_pfn_range(vma, vma->vm_start,
+                                         phys >> PAGE_SHIFT,
+                                         vma->vm_end - vma->vm_start,
+                                         vma->vm_page_prot);
+        }
+        return ret;
+}
+
+static int mmap_piobufs(struct vm_area_struct *vma,
+                        struct ipath_devdata *dd,
+                        struct ipath_portdata *pd)
+{
+        unsigned long phys;
+        int ret;
+
+        /*
+         * When we map the PIO buffers, we want to map them as writeonly, no
+         * read possible.
+         */
+
+        if ((vma->vm_end - vma->vm_start) >
+            (dd->ipath_pbufsport * dd->ipath_palign)) {
+                dev_info(&dd->pcidev->dev, "FAIL mmap piobufs: "
+                         "reqlen %lx > PAGE\n",
+                         vma->vm_end - vma->vm_start);
+                ret = -EFAULT;
+                goto bail;
+        }
+
+        phys = dd->ipath_physaddr + pd->port_piobufs;
+        /*
+         * Do *NOT* mark this as non-cached (PWT bit), or we don't get the
+         * write combining behavior we want on the PIO buffers!
+         * vma->vm_page_prot =
+         *        pgprot_noncached(vma->vm_page_prot);
+         */
+
+        if (vma->vm_flags & VM_READ) {
+                dev_info(&dd->pcidev->dev,
+                         "Can't map piobufs as readable (flags=%lx)\n",
+                         vma->vm_flags);
+                ret = -EPERM;
+                goto bail;
+        }
+
+        /* don't allow them to later change to readable with mprotect */
+
+        vma->vm_flags &= ~VM_MAYWRITE;
+        vma->vm_flags |= VM_DONTCOPY | VM_DONTEXPAND;
+
+        ret = io_remap_pfn_range(vma, vma->vm_start, phys >> PAGE_SHIFT,
+                                 vma->vm_end - vma->vm_start,
+                                 vma->vm_page_prot);
+bail:
+        return ret;
+}
+
+static int mmap_rcvegrbufs(struct vm_area_struct *vma,
+                           struct ipath_portdata *pd)
+{
+        struct ipath_devdata *dd = pd->port_dd;
+        unsigned long start, size;
+        size_t total_size, i;
+        dma_addr_t *phys;
+        int ret;
+
+        if (!pd->port_rcvegrbuf) {
+                ret = -EFAULT;
+                goto bail;
+        }
+
+        size = pd->port_rcvegrbuf_size;
+        total_size = pd->port_rcvegrbuf_chunks * size;
+        if ((vma->vm_end - vma->vm_start) > total_size) {
+                dev_info(&dd->pcidev->dev, "FAIL on egr bufs: "
+                         "reqlen %lx > actual %lx\n",
+                         vma->vm_end - vma->vm_start,
+                         (unsigned long) total_size);
+                ret = -EFAULT;
+                goto bail;
+        }
+
+        if (vma->vm_flags & VM_WRITE) {
+                dev_info(&dd->pcidev->dev, "Can't map eager buffers as "
+                         "writable (flags=%lx)\n", vma->vm_flags);
+                ret = -EPERM;
+                goto bail;
+        }
+
+        start = vma->vm_start;
+        phys = pd->port_rcvegrbuf_phys;
+
+        /* don't allow them to later change to writeable with mprotect */
+        vma->vm_flags &= ~VM_MAYWRITE;
+
+        for (i = 0; i < pd->port_rcvegrbuf_chunks; i++, start += size) {
+                ret = remap_pfn_range(vma, start, phys[i] >> PAGE_SHIFT,
+                                      size, vma->vm_page_prot);
+                if (ret < 0)
+                        goto bail;
+        }
+        ret = 0;
+
+bail:
+        return ret;
+}
+
+static int mmap_rcvhdrq(struct vm_area_struct *vma,
+                        struct ipath_portdata *pd)
+{
+        struct ipath_devdata *dd = pd->port_dd;
+        size_t total_size;
+        int ret;
+
+        /*
+         * kmalloc'ed memory, physically contiguous; this is from
+         * spi_rcvhdr_base; we allow user to map read-write so they can
+         * write hdrq entries to allow protocol code to directly poll
+         * whether a hdrq entry has been written.
+         */
+        total_size = ALIGN(dd->ipath_rcvhdrcnt * dd->ipath_rcvhdrentsize *
+                           sizeof(u32), PAGE_SIZE);
+        if ((vma->vm_end - vma->vm_start) > total_size) {
+                dev_info(&dd->pcidev->dev,
+                         "FAIL on rcvhdrq: reqlen %lx > actual %lx\n",
+                         vma->vm_end - vma->vm_start,
+                         (unsigned long) total_size);
+                ret = -EFAULT;
+                goto bail;
+        }
+
+        ret = remap_pfn_range(vma, vma->vm_start,
+                              pd->port_rcvhdrq_phys >> PAGE_SHIFT,
+                              vma->vm_end - vma->vm_start,
+                              vma->vm_page_prot);
+bail:
+        return ret;
+}
+
+static int mmap_pioavailregs(struct vm_area_struct *vma,
+                             struct ipath_portdata *pd)
+{
+        struct ipath_devdata *dd = pd->port_dd;
+        int ret;
+
+        /*
+         * when we map the PIO bufferavail registers, we want to map them as
+         * readonly, no write possible.
+         *
+         * kmalloc'ed memory, physically contiguous, one page only, readonly
+         */
+
+        if ((vma->vm_end - vma->vm_start) > PAGE_SIZE) {
+                dev_info(&dd->pcidev->dev, "FAIL on pioavailregs_dma: "
+                         "reqlen %lx > actual %lx\n",
+                         vma->vm_end - vma->vm_start,
+                         (unsigned long) PAGE_SIZE);
+                ret = -EFAULT;
+                goto bail;
+        }
+
+        if (vma->vm_flags & VM_WRITE) {
+                dev_info(&dd->pcidev->dev,
+                         "Can't map pioavailregs as writable (flags=%lx)\n",
+                         vma->vm_flags);
+                ret = -EPERM;
+                goto bail;
+        }
+
+        /* don't allow them to later change with mprotect */
+        vma->vm_flags &= ~VM_MAYWRITE;
+
+        ret = remap_pfn_range(vma, vma->vm_start,
+                              dd->ipath_pioavailregs_phys >> PAGE_SHIFT,
+                              PAGE_SIZE, vma->vm_page_prot);
+bail:
+        return ret;
+}
+
+/**
+ * ipath_mmap - mmap various structures into user space
+ * @fp: the file pointer
+ * @vma: the VM area
+ *
+ * We use this to have a shared buffer between the kernel and the user code
+ * for the rcvhdr queue, egr buffers, and the per-port user regs and pio
+ * buffers in the chip.  We have the open and close entries so we can bump
+ * the ref count and keep the driver from being unloaded while still mapped.
+ */
+static int ipath_mmap(struct file *fp, struct vm_area_struct *vma)
+{
+        struct ipath_portdata *pd;
+        struct ipath_devdata *dd;
+        u64 pgaddr, ureg;
+        int ret;
+
+        pd = port_fp(fp);
+        dd = pd->port_dd;
+        /*
+         * This is the ipath_do_user_init() code, mapping the shared buffers
+         * into the user process. The address referred to by vm_pgoff is the
+         * virtual, not physical, address; we only do one mmap for each
+         * space mapped.
+         */
+        pgaddr = vma->vm_pgoff << PAGE_SHIFT;
+
+        /*
+         * note that ureg does *NOT* have the kregvirt as part of it, to be
+         * sure that for 32 bit programs, we don't end up trying to map a >
+         * 44 address.  Has to match ipath_get_base_info() code that sets
+         * __spi_uregbase
+         */
+
+        ureg = dd->ipath_uregbase + dd->ipath_palign * pd->port_port;
+
+        ipath_cdbg(MM, "ushare: pgaddr %llx vm_start=%lx, vmlen %lx\n",
+                   (unsigned long long) pgaddr, vma->vm_start,
+                   vma->vm_end - vma->vm_start);
+
+        if (pgaddr == ureg)
+                ret = mmap_ureg(vma, dd, ureg);
+        else if (pgaddr == pd->port_piobufs)
+                ret = mmap_piobufs(vma, dd, pd);
+        else if (pgaddr == (u64) pd->port_rcvegr_phys)
+                ret = mmap_rcvegrbufs(vma, pd);
+        else if (pgaddr == (u64) pd->port_rcvhdrq_phys)
+                ret = mmap_rcvhdrq(vma, pd);
+        else if (pgaddr == dd->ipath_pioavailregs_phys)
+                ret = mmap_pioavailregs(vma, pd);
+        else
+                ret = -EINVAL;
+
+        vma->vm_private_data = NULL;
+
+        if (ret < 0)
+                dev_info(&dd->pcidev->dev,
+                         "Failure %d on addr %lx, off %lx\n",
+                         -ret, vma->vm_start, vma->vm_pgoff);
+
+        return ret;
+}
+
+static unsigned int ipath_poll(struct file *fp,
+                               struct poll_table_struct *pt)
+{
+        struct ipath_portdata *pd;
+        u32 head, tail;
+        int bit;
+        struct ipath_devdata *dd;
+
+        pd = port_fp(fp);
+        dd = pd->port_dd;
+
+        bit = pd->port_port + INFINIPATH_R_INTRAVAIL_SHIFT;
+        set_bit(bit, &dd->ipath_rcvctrl);
+
+        /*
+         * Before blocking, make sure that head is still == tail,
+         * reading from the chip, so we can be sure the interrupt
+         * enable has made it to the chip.  If not equal, disable
+         * interrupt again and return immediately.  This avoids races,
+         * and the overhead of the chip read doesn't matter much at
+         * this point, since we are waiting for something anyway.
+         */
+
+        ipath_write_kreg(dd, dd->ipath_kregs->kr_rcvctrl,
+                         dd->ipath_rcvctrl);
+
+        head = ipath_read_ureg32(dd, ur_rcvhdrhead, pd->port_port);
+        tail = ipath_read_ureg32(dd, ur_rcvhdrtail, pd->port_port);
+
+        if (tail == head) {
+                set_bit(IPATH_PORT_WAITING_RCV, &pd->port_flag);
+                poll_wait(fp, &pd->port_wait, pt);
+
+                if (test_bit(IPATH_PORT_WAITING_RCV, &pd->port_flag)) {
+                        /* timed out, no packets received */
+                        clear_bit(IPATH_PORT_WAITING_RCV, &pd->port_flag);
+                        pd->port_rcvwait_to++;
+                }
+        }
+        else {
+                /* it's already happened; don't do wait_event overhead */
+                pd->port_rcvnowait++;
+        }
+
+        clear_bit(bit, &dd->ipath_rcvctrl);
+        ipath_write_kreg(dd, dd->ipath_kregs->kr_rcvctrl,
+                         dd->ipath_rcvctrl);
+
+        return 0;
+}
+
+static int try_alloc_port(struct ipath_devdata *dd, int port,
+                          struct file *fp)
+{
+        int ret;
+
+        if (!dd->ipath_pd[port]) {
+                void *p, *ptmp;
+
+                p = kzalloc(sizeof(struct ipath_portdata), GFP_KERNEL);
+
+                /*
+                 * Allocate memory for use in ipath_tid_update() just once
+                 * at open, not per call.  Reduces cost of expected send
+                 * setup.
+                 */
+                ptmp = kmalloc(dd->ipath_rcvtidcnt * sizeof(u16) +
+                               dd->ipath_rcvtidcnt * sizeof(struct page **),
+                               GFP_KERNEL);
+                if (!p || !ptmp) {
+                        ipath_dev_err(dd, "Unable to allocate portdata "
+                                      "memory, failing open\n");
+                        ret = -ENOMEM;
+                        kfree(p);
+                        kfree(ptmp);
+                        goto bail;
+                }
+                dd->ipath_pd[port] = p;
+                dd->ipath_pd[port]->port_port = port;
+                dd->ipath_pd[port]->port_dd = dd;
+                dd->ipath_pd[port]->port_tid_pg_list = ptmp;
+                init_waitqueue_head(&dd->ipath_pd[port]->port_wait);
+        }
+        if (!dd->ipath_pd[port]->port_cnt) {
+                dd->ipath_pd[port]->port_cnt = 1;
+                fp->private_data = (void *) dd->ipath_pd[port];
+                ipath_cdbg(PROC, "%s[%u] opened unit:port %u:%u\n",
+                           current->comm, current->pid, dd->ipath_unit,
+                           port);
+                dd->ipath_pd[port]->port_pid = current->pid;
+                strncpy(dd->ipath_pd[port]->port_comm, current->comm,
+                        sizeof(dd->ipath_pd[port]->port_comm));
+                ipath_stats.sps_ports++;
+                ret = 0;
+                goto bail;
+        }
+        ret = -EBUSY;
+
+bail:
+        return ret;
+}
+
+static inline int usable(struct ipath_devdata *dd)
+{
+        return dd &&
+                (dd->ipath_flags & IPATH_PRESENT) &&
+                dd->ipath_kregbase &&
+                dd->ipath_lid &&
+                !(dd->ipath_flags & (IPATH_LINKDOWN | IPATH_DISABLED
+                                     | IPATH_LINKUNK));
+}
+
+static int find_free_port(int unit, struct file *fp)
+{
+        struct ipath_devdata *dd = ipath_lookup(unit);
+        int ret, i;
+
+        if (!dd) {
+                ret = -ENODEV;
+                goto bail;
+        }
+
+        if (!usable(dd)) {
+                ret = -ENETDOWN;
+                goto bail;
+        }
+
+        for (i = 0; i < dd->ipath_cfgports; i++) {
+                ret = try_alloc_port(dd, i, fp);
+                if (ret != -EBUSY)
+                        goto bail;
+        }
+        ret = -EBUSY;
+
+bail:
+        return ret;
+}
+
+static int find_best_unit(struct file *fp)
+{
+        int ret = 0, i, prefunit = -1, devmax;
+        int maxofallports, npresent, nup;
+        int ndev;
+
+        (void) ipath_count_units(&npresent, &nup, &maxofallports);
+
+        /*
+         * This code is present to allow a knowledgeable person to
+         * specify the layout of processes to processors before opening
+         * this driver, and then we'll assign the process to the "closest"
+         * HT-400 to that processor (we assume reasonable connectivity,
+         * for now).  This code assumes that if affinity has been set
+         * before this point, that at most one cpu is set; for now this
+         * is reasonable.  I check for both cpus_empty() and cpus_full(),
+         * in case some kernel variant sets none of the bits when no
+         * affinity is set.  2.6.11 and 12 kernels have all present
+         * cpus set.  Some day we'll have to fix it up further to handle
+         * a cpu subset.  This algorithm fails for two HT-400's connected
+         * in tunnel fashion.  Eventually this needs real topology
+         * information.  There may be some issues with dual core numbering
+         * as well.  This needs more work prior to release.
+         */
+        if (!cpus_empty(current->cpus_allowed) &&
+            !cpus_full(current->cpus_allowed)) {
+                int ncpus = num_online_cpus(), curcpu = -1;
+                for (i = 0; i < ncpus; i++)
+                        if (cpu_isset(i, current->cpus_allowed)) {
+                                ipath_cdbg(PROC, "%s[%u] affinity set for "
+                                           "cpu %d\n", current->comm,
+                                           current->pid, i);
+                                curcpu = i;
+                        }
+                if (curcpu != -1) {
+                        if (npresent) {
+                                prefunit = curcpu / (ncpus / npresent);
+                                ipath_dbg("%s[%u] %d chips, %d cpus, "
+                                          "%d cpus/chip, select unit %d\n",
+                                          current->comm, current->pid,
+                                          npresent, ncpus, ncpus / npresent,
+                                          prefunit);
+                        }
+                }
+        }
+
+        /*
+         * user ports start at 1, kernel port is 0
+         * For now, we do round-robin access across all chips
+         */
+
+        if (prefunit != -1)
+                devmax = prefunit + 1;
+        else
+                devmax = ipath_count_units(NULL, NULL, NULL);
+recheck:
+        for (i = 1; i < maxofallports; i++) {
+                for (ndev = prefunit != -1 ? prefunit : 0; ndev < devmax;
+                     ndev++) {
+                        struct ipath_devdata *dd = ipath_lookup(ndev);
+
+                        if (!usable(dd))
+                                continue; /* can't use this unit */
+                        if (i >= dd->ipath_cfgports)
+                                /*
+                                 * Maxed out on users of this unit. Try
+                                 * next.
+                                 */
+                                continue;
+                        ret = try_alloc_port(dd, i, fp);
+                        if (!ret)
+                                goto done;
+                }
+        }
+
+        if (npresent) {
+                if (nup == 0) {
+                        ret = -ENETDOWN;
+                        ipath_dbg("No ports available (none initialized "
+                                  "and ready)\n");
+                } else {
+                        if (prefunit > 0) {
+                                /* if started above 0, retry from 0 */
+                                ipath_cdbg(PROC,
+                                           "%s[%u] no ports on prefunit "
+                                           "%d, clear and re-check\n",
+                                           current->comm, current->pid,
+                                           prefunit);
+                                devmax = ipath_count_units(NULL, NULL,
+                                                           NULL);
+                                prefunit = -1;
+                                goto recheck;
+                        }
+                        ret = -EBUSY;
+                        ipath_dbg("No ports available\n");
+                }
+        } else {
+                ret = -ENXIO;
+                ipath_dbg("No boards found\n");
+        }
+
+done:
+        return ret;
+}
+
+static int ipath_open(struct inode *in, struct file *fp)
+{
+        int ret, minor;
+
+        mutex_lock(&ipath_mutex);
+
+        minor = iminor(in);
+        ipath_cdbg(VERBOSE, "open on dev %lx (minor %d)\n",
+                   (long)in->i_rdev, minor);
+
+        if (minor)
+                ret = find_free_port(minor - 1, fp);
+        else
+                ret = find_best_unit(fp);
+
+        mutex_unlock(&ipath_mutex);
+        return ret;
+}
+
+/**
+ * unlock_exptid - unlock any expected TID entries port still had in use
+ * @pd: port
+ *
+ * We don't actually update the chip here, because we do a bulk update
+ * below, using ipath_f_clear_tids.
+ */
+static void unlock_expected_tids(struct ipath_portdata *pd)
+{
+        struct ipath_devdata *dd = pd->port_dd;
+        int port_tidbase = pd->port_port * dd->ipath_rcvtidcnt;
+        int i, cnt = 0, maxtid = port_tidbase + dd->ipath_rcvtidcnt;
+
+        ipath_cdbg(VERBOSE, "Port %u unlocking any locked expTID pages\n",
+                   pd->port_port);
+        for (i = port_tidbase; i < maxtid; i++) {
+                if (!dd->ipath_pageshadow[i])
+                        continue;
+
+                ipath_release_user_pages_on_close(&dd->ipath_pageshadow[i],
+                                                  1);
+                dd->ipath_pageshadow[i] = NULL;
+                cnt++;
+                ipath_stats.sps_pageunlocks++;
+        }
+        if (cnt)
+                ipath_cdbg(VERBOSE, "Port %u locked %u expTID entries\n",
+                           pd->port_port, cnt);
+
+        if (ipath_stats.sps_pagelocks || ipath_stats.sps_pageunlocks)
+                ipath_cdbg(VERBOSE, "%llu pages locked, %llu unlocked\n",
+                           (unsigned long long) ipath_stats.sps_pagelocks,
+                           (unsigned long long)
+                           ipath_stats.sps_pageunlocks);
+}
+
+static int ipath_close(struct inode *in, struct file *fp)
+{
+        int ret = 0;
+        struct ipath_portdata *pd;
+        struct ipath_devdata *dd;
+        unsigned port;
+
+        ipath_cdbg(VERBOSE, "close on dev %lx, private data %p\n",
+                   (long)in->i_rdev, fp->private_data);
+
+        mutex_lock(&ipath_mutex);
+
+        pd = port_fp(fp);
+        port = pd->port_port;
+        fp->private_data = NULL;
+        dd = pd->port_dd;
+
+        if (pd->port_hdrqfull) {
+                ipath_cdbg(PROC, "%s[%u] had %u rcvhdrqfull errors "
+                           "during run\n", pd->port_comm, pd->port_pid,
+                           pd->port_hdrqfull);
+                pd->port_hdrqfull = 0;
+        }
+
+        if (pd->port_rcvwait_to || pd->port_piowait_to
+            || pd->port_rcvnowait || pd->port_pionowait) {
+                ipath_cdbg(VERBOSE, "port%u, %u rcv, %u pio wait timeo; "
+                           "%u rcv %u, pio already\n",
+                           pd->port_port, pd->port_rcvwait_to,
+                           pd->port_piowait_to, pd->port_rcvnowait,
+                           pd->port_pionowait);
+                pd->port_rcvwait_to = pd->port_piowait_to =
+                        pd->port_rcvnowait = pd->port_pionowait = 0;
+        }
+        if (pd->port_flag) {
+                ipath_dbg("port %u port_flag still set to 0x%lx\n",
+                          pd->port_port, pd->port_flag);
+                pd->port_flag = 0;
+        }
+
+        if (dd->ipath_kregbase) {
+                if (pd->port_rcvhdrtail_uaddr) {
+                        pd->port_rcvhdrtail_uaddr = 0;
+                        pd->port_rcvhdrtail_kvaddr = NULL;
+                        ipath_release_user_pages_on_close(
+                                &pd->port_rcvhdrtail_pagep, 1);
+                        pd->port_rcvhdrtail_pagep = NULL;
+                        ipath_stats.sps_pageunlocks++;
+                }
+                ipath_write_kreg_port(
+                        dd, dd->ipath_kregs->kr_rcvhdrtailaddr,
+                        port, 0ULL);
+                ipath_write_kreg_port(
+                        dd, dd->ipath_kregs->kr_rcvhdraddr,
+                        pd->port_port, 0);
+
+                /* clean up the pkeys for this port user */
+                ipath_clean_part_key(pd, dd);
+
+                if (port < dd->ipath_cfgports) {
+                        int i = dd->ipath_pbufsport * (port - 1);
+                        ipath_disarm_piobufs(dd, i, dd->ipath_pbufsport);
+
+                        /* atomically clear receive enable port. */
+                        clear_bit(INFINIPATH_R_PORTENABLE_SHIFT + port,
+                                  &dd->ipath_rcvctrl);
+                        ipath_write_kreg(
+                                dd,
+                                dd->ipath_kregs->kr_rcvctrl,
+                                dd->ipath_rcvctrl);
+
+                        if (dd->ipath_pageshadow)
+                                unlock_expected_tids(pd);
+                        ipath_stats.sps_ports--;
+                        ipath_cdbg(PROC, "%s[%u] closed port %u:%u\n",
+                                   pd->port_comm, pd->port_pid,
+                                   dd->ipath_unit, port);
+                }
+        }
+
+        pd->port_cnt = 0;
+        pd->port_pid = 0;
+
+        dd->ipath_f_clear_tids(dd, pd->port_port);
+
+        ipath_free_pddata(dd, pd->port_port, 0);
+
+        mutex_unlock(&ipath_mutex);
+
+        return ret;
+}
+
+static int ipath_port_info(struct ipath_portdata *pd,
+                           struct ipath_port_info __user *uinfo)
+{
+        struct ipath_port_info info;
+        int nup;
+        int ret;
+
+        (void) ipath_count_units(NULL, &nup, NULL);
+        info.num_active = nup;
+        info.unit = pd->port_dd->ipath_unit;
+        info.port = pd->port_port;
+
+        if (copy_to_user(uinfo, &info, sizeof(info))) {
+                ret = -EFAULT;
+                goto bail;
+        }
+        ret = 0;
+
+bail:
+        return ret;
+}
+
+static ssize_t ipath_write(struct file *fp, const char __user *data,
+                           size_t count, loff_t *off)
+{
+        const struct ipath_cmd __user *ucmd;
+        struct ipath_portdata *pd;
+        const void __user *src;
+        size_t consumed, copy;
+        struct ipath_cmd cmd;
+        ssize_t ret = 0;
+        void *dest;
+
+        if (count < sizeof(cmd.type)) {
+                ret = -EINVAL;
+                goto bail;
+        }
+
+        ucmd = (const struct ipath_cmd __user *) data;
+
+        if (copy_from_user(&cmd.type, &ucmd->type, sizeof(cmd.type))) {
+                ret = -EFAULT;
+                goto bail;
+        }
+
+        consumed = sizeof(cmd.type);
+
+        switch (cmd.type) {
+        case IPATH_CMD_USER_INIT:
+                copy = sizeof(cmd.cmd.user_info);
+                dest = &cmd.cmd.user_info;
+                src = &ucmd->cmd.user_info;
+                break;
+        case IPATH_CMD_RECV_CTRL:
+                copy = sizeof(cmd.cmd.recv_ctrl);
+                dest = &cmd.cmd.recv_ctrl;
+                src = &ucmd->cmd.recv_ctrl;
+                break;
+        case IPATH_CMD_PORT_INFO:
+                copy = sizeof(cmd.cmd.port_info);
+                dest = &cmd.cmd.port_info;
+                src = &ucmd->cmd.port_info;
+                break;
+        case IPATH_CMD_TID_UPDATE:
+        case IPATH_CMD_TID_FREE:
+                copy = sizeof(cmd.cmd.tid_info);
+                dest = &cmd.cmd.tid_info;
+                src = &ucmd->cmd.tid_info;
+                break;
+        case IPATH_CMD_SET_PART_KEY:
+                copy = sizeof(cmd.cmd.part_key);
+                dest = &cmd.cmd.part_key;
+                src = &ucmd->cmd.part_key;
+                break;
+        default:
+                ret = -EINVAL;
+                goto bail;
+        }
+
+        if ((count - consumed) < copy) {
+                ret = -EINVAL;
+                goto bail;
+        }
+
+        if (copy_from_user(dest, src, copy)) {
+                ret = -EFAULT;
+                goto bail;
+        }
+
+        consumed += copy;
+        pd = port_fp(fp);
+
+        switch (cmd.type) {
+        case IPATH_CMD_USER_INIT:
+                ret = ipath_do_user_init(pd, &cmd.cmd.user_info);
+                if (ret < 0)
+                        goto bail;
+                ret = ipath_get_base_info(
+                        pd, (void __user *) (unsigned long)
+                        cmd.cmd.user_info.spu_base_info,
+                        cmd.cmd.user_info.spu_base_info_size);
+                break;
+        case IPATH_CMD_RECV_CTRL:
+                ret = ipath_manage_rcvq(pd, cmd.cmd.recv_ctrl);
+                break;
+        case IPATH_CMD_PORT_INFO:
+                ret = ipath_port_info(pd,
+                                      (struct ipath_port_info __user *)
+                                      (unsigned long) cmd.cmd.port_info);
+                break;
+        case IPATH_CMD_TID_UPDATE:
+                ret = ipath_tid_update(pd, &cmd.cmd.tid_info);
+                break;
+        case IPATH_CMD_TID_FREE:
+                ret = ipath_tid_free(pd, &cmd.cmd.tid_info);
+                break;
+        case IPATH_CMD_SET_PART_KEY:
+                ret = ipath_set_part_key(pd, cmd.cmd.part_key);
+                break;
+        }
+
+        if (ret >= 0)
+                ret = consumed;
+
+bail:
+        return ret;
+}
+
+static struct class *ipath_class;
+
+static int init_cdev(int minor, char *name, struct file_operations *fops,
+                     struct cdev **cdevp, struct class_device **class_devp)
+{
+        const dev_t dev = MKDEV(IPATH_MAJOR, minor);
+        struct cdev *cdev = NULL;
+        struct class_device *class_dev = NULL;
+        int ret;
+
+        cdev = cdev_alloc();
+        if (!cdev) {
+                printk(KERN_ERR IPATH_DRV_NAME
+                       ": Could not allocate cdev for minor %d, %s\n",
+                       minor, name);
+                ret = -ENOMEM;
+                goto done;
+        }
+
+        cdev->owner = THIS_MODULE;
+        cdev->ops = fops;
+        kobject_set_name(&cdev->kobj, name);
+
+        ret = cdev_add(cdev, dev, 1);
+        if (ret < 0) {
+                printk(KERN_ERR IPATH_DRV_NAME
+                       ": Could not add cdev for minor %d, %s (err %d)\n",
+                       minor, name, -ret);
+                goto err_cdev;
+        }
+
+        class_dev = class_device_create(ipath_class, NULL, dev, NULL, name);
+
+        if (IS_ERR(class_dev)) {
+                ret = PTR_ERR(class_dev);
+                printk(KERN_ERR IPATH_DRV_NAME ": Could not create "
+                       "class_dev for minor %d, %s (err %d)\n",
+                       minor, name, -ret);
+                goto err_cdev;
+        }
+
+        goto done;
+
+err_cdev:
+        cdev_del(cdev);
+        cdev = NULL;
+
+done:
+        if (ret >= 0) {
+                *cdevp = cdev;
+                *class_devp = class_dev;
+        } else {
+                *cdevp = NULL;
+                *class_devp = NULL;
+        }
+
+        return ret;
+}
+
+int ipath_cdev_init(int minor, char *name, struct file_operations *fops,
+                    struct cdev **cdevp, struct class_device **class_devp)
+{
+        return init_cdev(minor, name, fops, cdevp, class_devp);
+}
+
+static void cleanup_cdev(struct cdev **cdevp,
+                         struct class_device **class_devp)
+{
+        struct class_device *class_dev = *class_devp;
+
+        if (class_dev) {
+                class_device_unregister(class_dev);
+                *class_devp = NULL;
+        }
+
+        if (*cdevp) {
+                cdev_del(*cdevp);
+                *cdevp = NULL;
+        }
+}
+
+void ipath_cdev_cleanup(struct cdev **cdevp,
+                        struct class_device **class_devp)
+{
+        cleanup_cdev(cdevp, class_devp);
+}
+
+static struct cdev *wildcard_cdev;
+static struct class_device *wildcard_class_dev;
+
+static const dev_t dev = MKDEV(IPATH_MAJOR, 0);
+
+static int user_init(void)
+{
+        int ret;
+
+        ret = register_chrdev_region(dev, IPATH_NMINORS, IPATH_DRV_NAME);
+        if (ret < 0) {
+                printk(KERN_ERR IPATH_DRV_NAME ": Could not register "
+                       "chrdev region (err %d)\n", -ret);
+                goto done;
+        }
+
+        ipath_class = class_create(THIS_MODULE, IPATH_DRV_NAME);
+
+        if (IS_ERR(ipath_class)) {
+                ret = PTR_ERR(ipath_class);
+                printk(KERN_ERR IPATH_DRV_NAME ": Could not create "
+                       "device class (err %d)\n", -ret);
+                goto bail;
+        }
+
+        goto done;
+bail:
+        unregister_chrdev_region(dev, IPATH_NMINORS);
+done:
+        return ret;
+}
+
+static void user_cleanup(void)
+{
+        if (ipath_class) {
+                class_destroy(ipath_class);
+                ipath_class = NULL;
+        }
+
+        unregister_chrdev_region(dev, IPATH_NMINORS);
+}
+
+static atomic_t user_count = ATOMIC_INIT(0);
+static atomic_t user_setup = ATOMIC_INIT(0);
+
+int ipath_user_add(struct ipath_devdata *dd)
+{
+        char name[10];
+        int ret;
+
+        if (atomic_inc_return(&user_count) == 1) {
+                ret = user_init();
+                if (ret < 0) {
+                        ipath_dev_err(dd, "Unable to set up user support: "
+                                      "error %d\n", -ret);
+                        goto bail;
+                }
+                ret = ipath_diag_init();
+                if (ret < 0) {
+                        ipath_dev_err(dd, "Unable to set up diag support: "
+                                      "error %d\n", -ret);
+                        goto bail_sma;
+                }
+
+                ret = init_cdev(0, "ipath", &ipath_file_ops, &wildcard_cdev,
+                                &wildcard_class_dev);
+                if (ret < 0) {
+                        ipath_dev_err(dd, "Could not create wildcard "
+                                      "minor: error %d\n", -ret);
+                        goto bail_diag;
+                }
+
+                atomic_set(&user_setup, 1);
+        }
+
+        snprintf(name, sizeof(name), "ipath%d", dd->ipath_unit);
+
+        ret = init_cdev(dd->ipath_unit + 1, name, &ipath_file_ops,
+                        &dd->cdev, &dd->class_dev);
+        if (ret < 0)
+                ipath_dev_err(dd, "Could not create user minor %d, %s\n",
+                              dd->ipath_unit + 1, name);
+
+        goto bail;
+
+bail_diag:
+        ipath_diag_cleanup();
+bail_sma:
+        user_cleanup();
+bail:
+        return ret;
+}
+
+void ipath_user_del(struct ipath_devdata *dd)
+{
+        cleanup_cdev(&dd->cdev, &dd->class_dev);
+
+        if (atomic_dec_return(&user_count) == 0) {
+                if (atomic_read(&user_setup) == 0)
+                        goto bail;
+
+                cleanup_cdev(&wildcard_cdev, &wildcard_class_dev);
+                ipath_diag_cleanup();
+                user_cleanup();
+
+                atomic_set(&user_setup, 0);
+        }
+bail:
+        return;
+}
diff --git a/drivers/infiniband/hw/ipath/ipath_fs.c b/drivers/infiniband/hw/ipath/ipath_fs.c
new file mode 100644
index 000000000000..e274120567e1
--- /dev/null
+++ b/drivers/infiniband/hw/ipath/ipath_fs.c
@@ -0,0 +1,605 @@
+/*
+ * Copyright (c) 2006 PathScale, Inc. All rights reserved.
+ *
+ * This software is available to you under a choice of one of two
+ * licenses.  You may choose to be licensed under the terms of the GNU
+ * General Public License (GPL) Version 2, available from the file
+ * COPYING in the main directory of this source tree, or the
+ * OpenIB.org BSD license below:
+ *
+ *     Redistribution and use in source and binary forms, with or
+ *     without modification, are permitted provided that the following
+ *     conditions are met:
+ *
+ *      - Redistributions of source code must retain the above
+ *        copyright notice, this list of conditions and the following
+ *        disclaimer.
+ *
+ *      - Redistributions in binary form must reproduce the above
+ *        copyright notice, this list of conditions and the following
+ *        disclaimer in the documentation and/or other materials
+ *        provided with the distribution.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+ * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+ * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+ * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
+ * BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
+ * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
+ * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+ * SOFTWARE.
+ */
+
+#include <linux/version.h>
+#include <linux/config.h>
+#include <linux/module.h>
+#include <linux/fs.h>
+#include <linux/mount.h>
+#include <linux/pagemap.h>
+#include <linux/init.h>
+#include <linux/namei.h>
+#include <linux/pci.h>
+
+#include "ipath_kernel.h"
+
+#define IPATHFS_MAGIC 0x726a77
+
+static struct super_block *ipath_super;
+
+static int ipathfs_mknod(struct inode *dir, struct dentry *dentry,
+                         int mode, struct file_operations *fops,
+                         void *data)
+{
+        int error;
+        struct inode *inode = new_inode(dir->i_sb);
+
+        if (!inode) {
+                error = -EPERM;
+                goto bail;
+        }
+
+        inode->i_mode = mode;
+        inode->i_uid = 0;
+        inode->i_gid = 0;
+        inode->i_blksize = PAGE_CACHE_SIZE;
+        inode->i_blocks = 0;
+        inode->i_atime = inode->i_mtime = inode->i_ctime = CURRENT_TIME;
+        inode->u.generic_ip = data;
+        if ((mode & S_IFMT) == S_IFDIR) {
+                inode->i_op = &simple_dir_inode_operations;
+                inode->i_nlink++;
+                dir->i_nlink++;
+        }
+
+        inode->i_fop = fops;
+
+        d_instantiate(dentry, inode);
+        error = 0;
+
+bail:
+        return error;
+}
+
+static int create_file(const char *name, mode_t mode,
+                       struct dentry *parent, struct dentry **dentry,
+                       struct file_operations *fops, void *data)
+{
+        int error;
+
+        *dentry = NULL;
+        mutex_lock(&parent->d_inode->i_mutex);
+        *dentry = lookup_one_len(name, parent, strlen(name));
+        if (!IS_ERR(dentry))
+                error = ipathfs_mknod(parent->d_inode, *dentry,
+                                      mode, fops, data);
+        else
+                error = PTR_ERR(dentry);
+        mutex_unlock(&parent->d_inode->i_mutex);
+
+        return error;
+}
+
+static ssize_t atomic_stats_read(struct file *file, char __user *buf,
+                                 size_t count, loff_t *ppos)
+{
+        return simple_read_from_buffer(buf, count, ppos, &ipath_stats,
+                                       sizeof ipath_stats);
+}
+
+static struct file_operations atomic_stats_ops = {
+        .read = atomic_stats_read,
+};
+
+#define NUM_COUNTERS sizeof(struct infinipath_counters) / sizeof(u64)
+
+static ssize_t atomic_counters_read(struct file *file, char __user *buf,
+                                    size_t count, loff_t *ppos)
+{
+        u64 counters[NUM_COUNTERS];
+        u16 i;
+        struct ipath_devdata *dd;
+
+        dd = file->f_dentry->d_inode->u.generic_ip;
+
+        for (i = 0; i < NUM_COUNTERS; i++)
+                counters[i] = ipath_snap_cntr(dd, i);
+
+        return simple_read_from_buffer(buf, count, ppos, counters,
+                                       sizeof counters);
+}
+
+static struct file_operations atomic_counters_ops = {
+        .read = atomic_counters_read,
+};
+
+static ssize_t atomic_node_info_read(struct file *file, char __user *buf,
+                                     size_t count, loff_t *ppos)
+{
+        u32 nodeinfo[10];
+        struct ipath_devdata *dd;
+        u64 guid;
+
+        dd = file->f_dentry->d_inode->u.generic_ip;
+
+        guid = be64_to_cpu(dd->ipath_guid);
+
+        nodeinfo[0] =                   /* BaseVersion is SMA */
+                /* ClassVersion is SMA */
+                (1 << 8)                /* NodeType  */
+                | (1 << 0);             /* NumPorts */
+        nodeinfo[1] = (u32) (guid >> 32);
+        nodeinfo[2] = (u32) (guid & 0xffffffff);
+        /* PortGUID == SystemImageGUID for us */
+        nodeinfo[3] = nodeinfo[1];
+        /* PortGUID == SystemImageGUID for us */
+        nodeinfo[4] = nodeinfo[2];
+        /* PortGUID == NodeGUID for us */
+        nodeinfo[5] = nodeinfo[3];
+        /* PortGUID == NodeGUID for us */
+        nodeinfo[6] = nodeinfo[4];
+        nodeinfo[7] = (4 << 16) /* we support 4 pkeys */
+                | (dd->ipath_deviceid << 0);
+        /* our chip version as 16 bits major, 16 bits minor */
+        nodeinfo[8] = dd->ipath_minrev | (dd->ipath_majrev << 16);
+        nodeinfo[9] = (dd->ipath_unit << 24) | (dd->ipath_vendorid << 0);
+
+        return simple_read_from_buffer(buf, count, ppos, nodeinfo,
+                                       sizeof nodeinfo);
+}
+
+static struct file_operations atomic_node_info_ops = {
+        .read = atomic_node_info_read,
+};
+
+static ssize_t atomic_port_info_read(struct file *file, char __user *buf,
+                                     size_t count, loff_t *ppos)
+{
+        u32 portinfo[13];
+        u32 tmp, tmp2;
+        struct ipath_devdata *dd;
+
+        dd = file->f_dentry->d_inode->u.generic_ip;
+
+        /* so we only initialize non-zero fields. */
+        memset(portinfo, 0, sizeof portinfo);
+
+        /*
+         * Notimpl yet M_Key (64)
+         * Notimpl yet GID (64)
+         */
+
+        portinfo[4] = (dd->ipath_lid << 16);
+
+        /*
+         * Notimpl yet SMLID (should we store this in the driver, in case
+         * SMA dies?)  CapabilityMask is 0, we don't support any of these
+         * DiagCode is 0; we don't store any diag info for now Notimpl yet
+         * M_KeyLeasePeriod (we don't support M_Key)
+         */
+
+        /* LocalPortNum is whichever port number they ask for */
+        portinfo[7] = (dd->ipath_unit << 24)
+                /* LinkWidthEnabled */
+                | (2 << 16)
+                /* LinkWidthSupported (really 2, but not IB valid) */
+                | (3 << 8)
+                /* LinkWidthActive */
+                | (2 << 0);
+        tmp = dd->ipath_lastibcstat & IPATH_IBSTATE_MASK;
+        tmp2 = 5;
+        if (tmp == IPATH_IBSTATE_INIT)
+                tmp = 2;
+        else if (tmp == IPATH_IBSTATE_ARM)
+                tmp = 3;
+        else if (tmp == IPATH_IBSTATE_ACTIVE)
+                tmp = 4;
+        else {
+                tmp = 0;        /* down */
+                tmp2 = tmp & 0xf;
+        }
+
+        portinfo[8] = (1 << 28) /* LinkSpeedSupported */
+                | (tmp << 24)   /* PortState */
+                | (tmp2 << 20)  /* PortPhysicalState */
+                | (2 << 16)
+
+                /* LinkDownDefaultState */
+                /* M_KeyProtectBits == 0 */
+                /* NotImpl yet LMC == 0 (we can support all values) */
+                | (1 << 4)      /* LinkSpeedActive */
+                | (1 << 0);     /* LinkSpeedEnabled */
+        switch (dd->ipath_ibmtu) {
+        case 4096:
+                tmp = 5;
+                break;
+        case 2048:
+                tmp = 4;
+                break;
+        case 1024:
+                tmp = 3;
+                break;
+        case 512:
+                tmp = 2;
+                break;
+        case 256:
+                tmp = 1;
+                break;
+        default:                /* oops, something is wrong */
+                ipath_dbg("Problem, ipath_ibmtu 0x%x not a valid IB MTU, "
+                          "treat as 2048\n", dd->ipath_ibmtu);
+                tmp = 4;
+                break;
+        }
+        portinfo[9] = (tmp << 28)
+                /* NeighborMTU */
+                /* Notimpl MasterSMSL */
+                | (1 << 20)
+
+                /* VLCap */
+                /* Notimpl InitType (actually, an SMA decision) */
+                /* VLHighLimit is 0 (only one VL) */
+                ; /* VLArbitrationHighCap is 0 (only one VL) */
+        portinfo[10] =  /* VLArbitrationLowCap is 0 (only one VL) */
+                /* InitTypeReply is SMA decision */
+                (5 << 16)       /* MTUCap 4096 */
+                | (7 << 13)     /* VLStallCount */
+                | (0x1f << 8)   /* HOQLife */
+                | (1 << 4)
+
+                /* OperationalVLs 0 */
+                /* PartitionEnforcementInbound */
+                /* PartitionEnforcementOutbound not enforced */
+                /* FilterRawinbound not enforced */
+                ;               /* FilterRawOutbound not enforced */
+        /* M_KeyViolations are not counted by hardware, SMA can count */
+        tmp = ipath_read_creg32(dd, dd->ipath_cregs->cr_errpkey);
+        /* P_KeyViolations are counted by hardware. */
+        portinfo[11] = ((tmp & 0xffff) << 0);
+        portinfo[12] =
+                /* Q_KeyViolations are not counted by hardware */
+                (1 << 8)
+
+                /* GUIDCap */
+                /* SubnetTimeOut handled by SMA */
+                /* RespTimeValue handled by SMA */
+                ;
+        /* LocalPhyErrors are programmed to max */
+        portinfo[12] |= (0xf << 20)
+                | (0xf << 16)   /* OverRunErrors are programmed to max */
+                ;
+
+        return simple_read_from_buffer(buf, count, ppos, portinfo,
+                                       sizeof portinfo);
+}
+
+static struct file_operations atomic_port_info_ops = {
+        .read = atomic_port_info_read,
+};
+
+static ssize_t flash_read(struct file *file, char __user *buf,
+                          size_t count, loff_t *ppos)
+{
+        struct ipath_devdata *dd;
+        ssize_t ret;
+        loff_t pos;
+        char *tmp;
+
+        pos = *ppos;
+
+        if ( pos < 0) {
+                ret = -EINVAL;
+                goto bail;
+        }
+
+        if (pos >= sizeof(struct ipath_flash)) {
+                ret = 0;
+                goto bail;
+        }
+
+        if (count > sizeof(struct ipath_flash) - pos)
+                count = sizeof(struct ipath_flash) - pos;
+
+        tmp = kmalloc(count, GFP_KERNEL);
+        if (!tmp) {
+                ret = -ENOMEM;
+                goto bail;
+        }
+
+        dd = file->f_dentry->d_inode->u.generic_ip;
+        if (ipath_eeprom_read(dd, pos, tmp, count)) {
+                ipath_dev_err(dd, "failed to read from flash\n");
+                ret = -ENXIO;
+                goto bail_tmp;
+        }
+
+        if (copy_to_user(buf, tmp, count)) {
+                ret = -EFAULT;
+                goto bail_tmp;
+        }
+
+        *ppos = pos + count;
+        ret = count;
+
+bail_tmp:
+        kfree(tmp);
+
+bail:
+        return ret;
+}
+
+static ssize_t flash_write(struct file *file, const char __user *buf,
+                           size_t count, loff_t *ppos)
+{
+        struct ipath_devdata *dd;
+        ssize_t ret;
+        loff_t pos;
+        char *tmp;
+
+        pos = *ppos;
+
+        if ( pos < 0) {
+                ret = -EINVAL;
+                goto bail;
+        }
+
+        if (pos >= sizeof(struct ipath_flash)) {
+                ret = 0;
+                goto bail;
+        }
+
+        if (count > sizeof(struct ipath_flash) - pos)
+                count = sizeof(struct ipath_flash) - pos;
+
+        tmp = kmalloc(count, GFP_KERNEL);
+        if (!tmp) {
+                ret = -ENOMEM;
+                goto bail;
+        }
+
+        if (copy_from_user(tmp, buf, count)) {
+                ret = -EFAULT;
+                goto bail_tmp;
+        }
+
+        dd = file->f_dentry->d_inode->u.generic_ip;
+        if (ipath_eeprom_write(dd, pos, tmp, count)) {
+                ret = -ENXIO;
+                ipath_dev_err(dd, "failed to write to flash\n");
+                goto bail_tmp;
+        }
+
+        *ppos = pos + count;
+        ret = count;
+
+bail_tmp:
+        kfree(tmp);
+
+bail:
+        return ret;
+}
+
+static struct file_operations flash_ops = {
+        .read = flash_read,
+        .write = flash_write,
+};
+
+static int create_device_files(struct super_block *sb,
+                               struct ipath_devdata *dd)
+{
+        struct dentry *dir, *tmp;
+        char unit[10];
+        int ret;
+
+        snprintf(unit, sizeof unit, "%02d", dd->ipath_unit);
+        ret = create_file(unit, S_IFDIR|S_IRUGO|S_IXUGO, sb->s_root, &dir,
+                          (struct file_operations *) &simple_dir_operations,
+                          dd);
+        if (ret) {
+                printk(KERN_ERR "create_file(%s) failed: %d\n", unit, ret);
+                goto bail;
+        }
+
+        ret = create_file("atomic_counters", S_IFREG|S_IRUGO, dir, &tmp,
+                          &atomic_counters_ops, dd);
+        if (ret) {
+                printk(KERN_ERR "create_file(%s/atomic_counters) "
+                       "failed: %d\n", unit, ret);
+                goto bail;
+        }
+
+        ret = create_file("node_info", S_IFREG|S_IRUGO, dir, &tmp,
+                          &atomic_node_info_ops, dd);
+        if (ret) {
+                printk(KERN_ERR "create_file(%s/node_info) "
+                       "failed: %d\n", unit, ret);
+                goto bail;
+        }
+
+        ret = create_file("port_info", S_IFREG|S_IRUGO, dir, &tmp,
+                          &atomic_port_info_ops, dd);
+        if (ret) {
+                printk(KERN_ERR "create_file(%s/port_info) "
+                       "failed: %d\n", unit, ret);
+                goto bail;
+        }
+
+        ret = create_file("flash", S_IFREG|S_IWUSR|S_IRUGO, dir, &tmp,
+                          &flash_ops, dd);
+        if (ret) {
+                printk(KERN_ERR "create_file(%s/flash) "
+                       "failed: %d\n", unit, ret);
+                goto bail;
+        }
+
+bail:
+        return ret;
+}
+
+static void remove_file(struct dentry *parent, char *name)
+{
+        struct dentry *tmp;
+
+        tmp = lookup_one_len(name, parent, strlen(name));
+
+        spin_lock(&dcache_lock);
+        spin_lock(&tmp->d_lock);
+        if (!(d_unhashed(tmp) && tmp->d_inode)) {
+                dget_locked(tmp);
+                __d_drop(tmp);
+                spin_unlock(&tmp->d_lock);
+                spin_unlock(&dcache_lock);
+                simple_unlink(parent->d_inode, tmp);
+        } else {
+                spin_unlock(&tmp->d_lock);
+                spin_unlock(&dcache_lock);
+        }
+}
+
+static int remove_device_files(struct super_block *sb,
+                               struct ipath_devdata *dd)
+{
+        struct dentry *dir, *root;
+        char unit[10];
+        int ret;
+
+        root = dget(sb->s_root);
+        mutex_lock(&root->d_inode->i_mutex);
+        snprintf(unit, sizeof unit, "%02d", dd->ipath_unit);
+        dir = lookup_one_len(unit, root, strlen(unit));
+
+        if (IS_ERR(dir)) {
+                ret = PTR_ERR(dir);
+                printk(KERN_ERR "Lookup of %s failed\n", unit);
+                goto bail;
+        }
+
+        remove_file(dir, "flash");
+        remove_file(dir, "port_info");
+        remove_file(dir, "node_info");
+        remove_file(dir, "atomic_counters");
+        d_delete(dir);
+        ret = simple_rmdir(root->d_inode, dir);
+
+bail:
+        mutex_unlock(&root->d_inode->i_mutex);
+        dput(root);
+        return ret;
+}
+
+static int ipathfs_fill_super(struct super_block *sb, void *data,
+                              int silent)
+{
+        struct ipath_devdata *dd, *tmp;
+        unsigned long flags;
+        int ret;
+
+        static struct tree_descr files[] = {
+                [1] = {"atomic_stats", &atomic_stats_ops, S_IRUGO},
+                {""},
+        };
+
+        ret = simple_fill_super(sb, IPATHFS_MAGIC, files);
+        if (ret) {
+                printk(KERN_ERR "simple_fill_super failed: %d\n", ret);
+                goto bail;
+        }
+
+        spin_lock_irqsave(&ipath_devs_lock, flags);
+
+        list_for_each_entry_safe(dd, tmp, &ipath_dev_list, ipath_list) {
+                spin_unlock_irqrestore(&ipath_devs_lock, flags);
+                ret = create_device_files(sb, dd);
+                if (ret) {
+                        deactivate_super(sb);
+                        goto bail;
+                }
+                spin_lock_irqsave(&ipath_devs_lock, flags);
+        }
+
+        spin_unlock_irqrestore(&ipath_devs_lock, flags);
+
+bail:
+        return ret;
+}
+
+static struct super_block *ipathfs_get_sb(struct file_system_type *fs_type,
+                                        int flags, const char *dev_name,
+                                        void *data)
+{
+        ipath_super = get_sb_single(fs_type, flags, data,
+                                    ipathfs_fill_super);
+        return ipath_super;
+}
+
+static void ipathfs_kill_super(struct super_block *s)
+{
+        kill_litter_super(s);
+        ipath_super = NULL;
+}
+
+int ipathfs_add_device(struct ipath_devdata *dd)
+{
+        int ret;
+
+        if (ipath_super == NULL) {
+                ret = 0;
+                goto bail;
+        }
+
+        ret = create_device_files(ipath_super, dd);
+
+bail:
+        return ret;
+}
+
+int ipathfs_remove_device(struct ipath_devdata *dd)
+{
+        int ret;
+
+        if (ipath_super == NULL) {
+                ret = 0;
+                goto bail;
+        }
+
+        ret = remove_device_files(ipath_super, dd);
+
+bail:
+        return ret;
+}
+
+static struct file_system_type ipathfs_fs_type = {
+        .owner =        THIS_MODULE,
+        .name =         "ipathfs",
+        .get_sb =       ipathfs_get_sb,
+        .kill_sb =      ipathfs_kill_super,
+};
+
+int __init ipath_init_ipathfs(void)
+{
+        return register_filesystem(&ipathfs_fs_type);
+}
+
+void __exit ipath_exit_ipathfs(void)
+{
+        unregister_filesystem(&ipathfs_fs_type);
+}
diff --git a/drivers/infiniband/hw/ipath/ipath_ht400.c b/drivers/infiniband/hw/ipath/ipath_ht400.c
new file mode 100644
index 000000000000..4652435998f3
--- /dev/null
+++ b/drivers/infiniband/hw/ipath/ipath_ht400.c
@@ -0,0 +1,1586 @@
+/*
+ * Copyright (c) 2003, 2004, 2005, 2006 PathScale, Inc. All rights reserved.
+ *
+ * This software is available to you under a choice of one of two
+ * licenses.  You may choose to be licensed under the terms of the GNU
+ * General Public License (GPL) Version 2, available from the file
+ * COPYING in the main directory of this source tree, or the
+ * OpenIB.org BSD license below:
+ *
+ *     Redistribution and use in source and binary forms, with or
+ *     without modification, are permitted provided that the following
+ *     conditions are met:
+ *
+ *      - Redistributions of source code must retain the above
+ *        copyright notice, this list of conditions and the following
+ *        disclaimer.
+ *
+ *      - Redistributions in binary form must reproduce the above
+ *        copyright notice, this list of conditions and the following
+ *        disclaimer in the documentation and/or other materials
+ *        provided with the distribution.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+ * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+ * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+ * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
+ * BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
+ * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
+ * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+ * SOFTWARE.
+ */
+
+/*
+ * This file contains all of the code that is specific to the InfiniPath
+ * HT-400 chip.
+ */
+
+#include <linux/pci.h>
+#include <linux/delay.h>
+
+#include "ipath_kernel.h"
+#include "ipath_registers.h"
+
+/*
+ * This lists the InfiniPath HT400 registers, in the actual chip layout.
+ * This structure should never be directly accessed.
+ *
+ * The names are in InterCap form because they're taken straight from
+ * the chip specification.  Since they're only used in this file, they
+ * don't pollute the rest of the source.
+*/
+
+struct _infinipath_do_not_use_kernel_regs {
+        unsigned long long Revision;
+        unsigned long long Control;
+        unsigned long long PageAlign;
+        unsigned long long PortCnt;
+        unsigned long long DebugPortSelect;
+        unsigned long long DebugPort;
+        unsigned long long SendRegBase;
+        unsigned long long UserRegBase;
+        unsigned long long CounterRegBase;
+        unsigned long long Scratch;
+        unsigned long long ReservedMisc1;
+        unsigned long long InterruptConfig;
+        unsigned long long IntBlocked;
+        unsigned long long IntMask;
+        unsigned long long IntStatus;
+        unsigned long long IntClear;
+        unsigned long long ErrorMask;
+        unsigned long long ErrorStatus;
+        unsigned long long ErrorClear;
+        unsigned long long HwErrMask;
+        unsigned long long HwErrStatus;
+        unsigned long long HwErrClear;
+        unsigned long long HwDiagCtrl;
+        unsigned long long MDIO;
+        unsigned long long IBCStatus;
+        unsigned long long IBCCtrl;
+        unsigned long long ExtStatus;
+        unsigned long long ExtCtrl;
+        unsigned long long GPIOOut;
+        unsigned long long GPIOMask;
+        unsigned long long GPIOStatus;
+        unsigned long long GPIOClear;
+        unsigned long long RcvCtrl;
+        unsigned long long RcvBTHQP;
+        unsigned long long RcvHdrSize;
+        unsigned long long RcvHdrCnt;
+        unsigned long long RcvHdrEntSize;
+        unsigned long long RcvTIDBase;
+        unsigned long long RcvTIDCnt;
+        unsigned long long RcvEgrBase;
+        unsigned long long RcvEgrCnt;
+        unsigned long long RcvBufBase;
+        unsigned long long RcvBufSize;
+        unsigned long long RxIntMemBase;
+        unsigned long long RxIntMemSize;
+        unsigned long long RcvPartitionKey;
+        unsigned long long ReservedRcv[10];
+        unsigned long long SendCtrl;
+        unsigned long long SendPIOBufBase;
+        unsigned long long SendPIOSize;
+        unsigned long long SendPIOBufCnt;
+        unsigned long long SendPIOAvailAddr;
+        unsigned long long TxIntMemBase;
+        unsigned long long TxIntMemSize;
+        unsigned long long ReservedSend[9];
+        unsigned long long SendBufferError;
+        unsigned long long SendBufferErrorCONT1;
+        unsigned long long SendBufferErrorCONT2;
+        unsigned long long SendBufferErrorCONT3;
+        unsigned long long ReservedSBE[4];
+        unsigned long long RcvHdrAddr0;
+        unsigned long long RcvHdrAddr1;
+        unsigned long long RcvHdrAddr2;
+        unsigned long long RcvHdrAddr3;
+        unsigned long long RcvHdrAddr4;
+        unsigned long long RcvHdrAddr5;
+        unsigned long long RcvHdrAddr6;
+        unsigned long long RcvHdrAddr7;
+        unsigned long long RcvHdrAddr8;
+        unsigned long long ReservedRHA[7];
+        unsigned long long RcvHdrTailAddr0;
+        unsigned long long RcvHdrTailAddr1;
+        unsigned long long RcvHdrTailAddr2;
+        unsigned long long RcvHdrTailAddr3;
+        unsigned long long RcvHdrTailAddr4;
+        unsigned long long RcvHdrTailAddr5;
+        unsigned long long RcvHdrTailAddr6;
+        unsigned long long RcvHdrTailAddr7;
+        unsigned long long RcvHdrTailAddr8;
+        unsigned long long ReservedRHTA[7];
+        unsigned long long Sync;        /* Software only */
+        unsigned long long Dump;        /* Software only */
+        unsigned long long SimVer;      /* Software only */
+        unsigned long long ReservedSW[5];
+        unsigned long long SerdesConfig0;
+        unsigned long long SerdesConfig1;
+        unsigned long long SerdesStatus;
+        unsigned long long XGXSConfig;
+        unsigned long long ReservedSW2[4];
+};
+
+#define IPATH_KREG_OFFSET(field) (offsetof(struct \
+    _infinipath_do_not_use_kernel_regs, field) / sizeof(u64))
+#define IPATH_CREG_OFFSET(field) (offsetof( \
+    struct infinipath_counters, field) / sizeof(u64))
+
+static const struct ipath_kregs ipath_ht_kregs = {
+        .kr_control = IPATH_KREG_OFFSET(Control),
+        .kr_counterregbase = IPATH_KREG_OFFSET(CounterRegBase),
+        .kr_debugport = IPATH_KREG_OFFSET(DebugPort),
+        .kr_debugportselect = IPATH_KREG_OFFSET(DebugPortSelect),
+        .kr_errorclear = IPATH_KREG_OFFSET(ErrorClear),
+        .kr_errormask = IPATH_KREG_OFFSET(ErrorMask),
+        .kr_errorstatus = IPATH_KREG_OFFSET(ErrorStatus),
+        .kr_extctrl = IPATH_KREG_OFFSET(ExtCtrl),
+        .kr_extstatus = IPATH_KREG_OFFSET(ExtStatus),
+        .kr_gpio_clear = IPATH_KREG_OFFSET(GPIOClear),
+        .kr_gpio_mask = IPATH_KREG_OFFSET(GPIOMask),
+        .kr_gpio_out = IPATH_KREG_OFFSET(GPIOOut),
+        .kr_gpio_status = IPATH_KREG_OFFSET(GPIOStatus),
+        .kr_hwdiagctrl = IPATH_KREG_OFFSET(HwDiagCtrl),
+        .kr_hwerrclear = IPATH_KREG_OFFSET(HwErrClear),
+        .kr_hwerrmask = IPATH_KREG_OFFSET(HwErrMask),
+        .kr_hwerrstatus = IPATH_KREG_OFFSET(HwErrStatus),
+        .kr_ibcctrl = IPATH_KREG_OFFSET(IBCCtrl),
+        .kr_ibcstatus = IPATH_KREG_OFFSET(IBCStatus),
+        .kr_intblocked = IPATH_KREG_OFFSET(IntBlocked),
+        .kr_intclear = IPATH_KREG_OFFSET(IntClear),
+        .kr_interruptconfig = IPATH_KREG_OFFSET(InterruptConfig),
+        .kr_intmask = IPATH_KREG_OFFSET(IntMask),
+        .kr_intstatus = IPATH_KREG_OFFSET(IntStatus),
+        .kr_mdio = IPATH_KREG_OFFSET(MDIO),
+        .kr_pagealign = IPATH_KREG_OFFSET(PageAlign),
+        .kr_partitionkey = IPATH_KREG_OFFSET(RcvPartitionKey),
+        .kr_portcnt = IPATH_KREG_OFFSET(PortCnt),
+        .kr_rcvbthqp = IPATH_KREG_OFFSET(RcvBTHQP),
+        .kr_rcvbufbase = IPATH_KREG_OFFSET(RcvBufBase),
+        .kr_rcvbufsize = IPATH_KREG_OFFSET(RcvBufSize),
+        .kr_rcvctrl = IPATH_KREG_OFFSET(RcvCtrl),
+        .kr_rcvegrbase = IPATH_KREG_OFFSET(RcvEgrBase),
+        .kr_rcvegrcnt = IPATH_KREG_OFFSET(RcvEgrCnt),
+        .kr_rcvhdrcnt = IPATH_KREG_OFFSET(RcvHdrCnt),
+        .kr_rcvhdrentsize = IPATH_KREG_OFFSET(RcvHdrEntSize),
+        .kr_rcvhdrsize = IPATH_KREG_OFFSET(RcvHdrSize),
+        .kr_rcvintmembase = IPATH_KREG_OFFSET(RxIntMemBase),
+        .kr_rcvintmemsize = IPATH_KREG_OFFSET(RxIntMemSize),
+        .kr_rcvtidbase = IPATH_KREG_OFFSET(RcvTIDBase),
+        .kr_rcvtidcnt = IPATH_KREG_OFFSET(RcvTIDCnt),
+        .kr_revision = IPATH_KREG_OFFSET(Revision),
+        .kr_scratch = IPATH_KREG_OFFSET(Scratch),
+        .kr_sendbuffererror = IPATH_KREG_OFFSET(SendBufferError),
+        .kr_sendctrl = IPATH_KREG_OFFSET(SendCtrl),
+        .kr_sendpioavailaddr = IPATH_KREG_OFFSET(SendPIOAvailAddr),
+        .kr_sendpiobufbase = IPATH_KREG_OFFSET(SendPIOBufBase),
+        .kr_sendpiobufcnt = IPATH_KREG_OFFSET(SendPIOBufCnt),
+        .kr_sendpiosize = IPATH_KREG_OFFSET(SendPIOSize),
+        .kr_sendregbase = IPATH_KREG_OFFSET(SendRegBase),
+        .kr_txintmembase = IPATH_KREG_OFFSET(TxIntMemBase),
+        .kr_txintmemsize = IPATH_KREG_OFFSET(TxIntMemSize),
+        .kr_userregbase = IPATH_KREG_OFFSET(UserRegBase),
+        .kr_serdesconfig0 = IPATH_KREG_OFFSET(SerdesConfig0),
+        .kr_serdesconfig1 = IPATH_KREG_OFFSET(SerdesConfig1),
+        .kr_serdesstatus = IPATH_KREG_OFFSET(SerdesStatus),
+        .kr_xgxsconfig = IPATH_KREG_OFFSET(XGXSConfig),
+        /*
+         * These should not be used directly via ipath_read_kreg64(),
+         * use them with ipath_read_kreg64_port(),
+         */
+        .kr_rcvhdraddr = IPATH_KREG_OFFSET(RcvHdrAddr0),
+        .kr_rcvhdrtailaddr = IPATH_KREG_OFFSET(RcvHdrTailAddr0)
+};
+
+static const struct ipath_cregs ipath_ht_cregs = {
+        .cr_badformatcnt = IPATH_CREG_OFFSET(RxBadFormatCnt),
+        .cr_erricrccnt = IPATH_CREG_OFFSET(RxICRCErrCnt),
+        .cr_errlinkcnt = IPATH_CREG_OFFSET(RxLinkProblemCnt),
+        .cr_errlpcrccnt = IPATH_CREG_OFFSET(RxLPCRCErrCnt),
+        .cr_errpkey = IPATH_CREG_OFFSET(RxPKeyMismatchCnt),
+        .cr_errrcvflowctrlcnt = IPATH_CREG_OFFSET(RxFlowCtrlErrCnt),
+        .cr_err_rlencnt = IPATH_CREG_OFFSET(RxLenErrCnt),
+        .cr_errslencnt = IPATH_CREG_OFFSET(TxLenErrCnt),
+        .cr_errtidfull = IPATH_CREG_OFFSET(RxTIDFullErrCnt),
+        .cr_errtidvalid = IPATH_CREG_OFFSET(RxTIDValidErrCnt),
+        .cr_errvcrccnt = IPATH_CREG_OFFSET(RxVCRCErrCnt),
+        .cr_ibstatuschange = IPATH_CREG_OFFSET(IBStatusChangeCnt),
+        /* calc from Reg_CounterRegBase + offset */
+        .cr_intcnt = IPATH_CREG_OFFSET(LBIntCnt),
+        .cr_invalidrlencnt = IPATH_CREG_OFFSET(RxMaxMinLenErrCnt),
+        .cr_invalidslencnt = IPATH_CREG_OFFSET(TxMaxMinLenErrCnt),
+        .cr_lbflowstallcnt = IPATH_CREG_OFFSET(LBFlowStallCnt),
+        .cr_pktrcvcnt = IPATH_CREG_OFFSET(RxDataPktCnt),
+        .cr_pktrcvflowctrlcnt = IPATH_CREG_OFFSET(RxFlowPktCnt),
+        .cr_pktsendcnt = IPATH_CREG_OFFSET(TxDataPktCnt),
+        .cr_pktsendflowcnt = IPATH_CREG_OFFSET(TxFlowPktCnt),
+        .cr_portovflcnt = IPATH_CREG_OFFSET(RxP0HdrEgrOvflCnt),
+        .cr_rcvebpcnt = IPATH_CREG_OFFSET(RxEBPCnt),
+        .cr_rcvovflcnt = IPATH_CREG_OFFSET(RxBufOvflCnt),
+        .cr_senddropped = IPATH_CREG_OFFSET(TxDroppedPktCnt),
+        .cr_sendstallcnt = IPATH_CREG_OFFSET(TxFlowStallCnt),
+        .cr_sendunderruncnt = IPATH_CREG_OFFSET(TxUnderrunCnt),
+        .cr_wordrcvcnt = IPATH_CREG_OFFSET(RxDwordCnt),
+        .cr_wordsendcnt = IPATH_CREG_OFFSET(TxDwordCnt),
+        .cr_unsupvlcnt = IPATH_CREG_OFFSET(TxUnsupVLErrCnt),
+        .cr_rxdroppktcnt = IPATH_CREG_OFFSET(RxDroppedPktCnt),
+        .cr_iblinkerrrecovcnt = IPATH_CREG_OFFSET(IBLinkErrRecoveryCnt),
+        .cr_iblinkdowncnt = IPATH_CREG_OFFSET(IBLinkDownedCnt),
+        .cr_ibsymbolerrcnt = IPATH_CREG_OFFSET(IBSymbolErrCnt)
+};
+
+/* kr_intstatus, kr_intclear, kr_intmask bits */
+#define INFINIPATH_I_RCVURG_MASK 0x1FF
+#define INFINIPATH_I_RCVAVAIL_MASK 0x1FF
+
+/* kr_hwerrclear, kr_hwerrmask, kr_hwerrstatus, bits */
+#define INFINIPATH_HWE_HTCMEMPARITYERR_SHIFT 0
+#define INFINIPATH_HWE_HTCMEMPARITYERR_MASK 0x3FFFFFULL
+#define INFINIPATH_HWE_HTCLNKABYTE0CRCERR   0x0000000000800000ULL
+#define INFINIPATH_HWE_HTCLNKABYTE1CRCERR   0x0000000001000000ULL
+#define INFINIPATH_HWE_HTCLNKBBYTE0CRCERR   0x0000000002000000ULL
+#define INFINIPATH_HWE_HTCLNKBBYTE1CRCERR   0x0000000004000000ULL
+#define INFINIPATH_HWE_HTCMISCERR4          0x0000000008000000ULL
+#define INFINIPATH_HWE_HTCMISCERR5          0x0000000010000000ULL
+#define INFINIPATH_HWE_HTCMISCERR6          0x0000000020000000ULL
+#define INFINIPATH_HWE_HTCMISCERR7          0x0000000040000000ULL
+#define INFINIPATH_HWE_HTCBUSTREQPARITYERR  0x0000000080000000ULL
+#define INFINIPATH_HWE_HTCBUSTRESPPARITYERR 0x0000000100000000ULL
+#define INFINIPATH_HWE_HTCBUSIREQPARITYERR  0x0000000200000000ULL
+#define INFINIPATH_HWE_COREPLL_FBSLIP       0x0080000000000000ULL
+#define INFINIPATH_HWE_COREPLL_RFSLIP       0x0100000000000000ULL
+#define INFINIPATH_HWE_HTBPLL_FBSLIP        0x0200000000000000ULL
+#define INFINIPATH_HWE_HTBPLL_RFSLIP        0x0400000000000000ULL
+#define INFINIPATH_HWE_HTAPLL_FBSLIP        0x0800000000000000ULL
+#define INFINIPATH_HWE_HTAPLL_RFSLIP        0x1000000000000000ULL
+#define INFINIPATH_HWE_SERDESPLLFAILED      0x2000000000000000ULL
+
+/* kr_extstatus bits */
+#define INFINIPATH_EXTS_FREQSEL 0x2
+#define INFINIPATH_EXTS_SERDESSEL 0x4
+#define INFINIPATH_EXTS_MEMBIST_ENDTEST     0x0000000000004000
+#define INFINIPATH_EXTS_MEMBIST_CORRECT     0x0000000000008000
+
+/*
+ * masks and bits that are different in different chips, or present only
+ * in one
+ */
+static const ipath_err_t infinipath_hwe_htcmemparityerr_mask =
+    INFINIPATH_HWE_HTCMEMPARITYERR_MASK;
+static const ipath_err_t infinipath_hwe_htcmemparityerr_shift =
+    INFINIPATH_HWE_HTCMEMPARITYERR_SHIFT;
+
+static const ipath_err_t infinipath_hwe_htclnkabyte0crcerr =
+    INFINIPATH_HWE_HTCLNKABYTE0CRCERR;
+static const ipath_err_t infinipath_hwe_htclnkabyte1crcerr =
+    INFINIPATH_HWE_HTCLNKABYTE1CRCERR;
+static const ipath_err_t infinipath_hwe_htclnkbbyte0crcerr =
+    INFINIPATH_HWE_HTCLNKBBYTE0CRCERR;
+static const ipath_err_t infinipath_hwe_htclnkbbyte1crcerr =
+    INFINIPATH_HWE_HTCLNKBBYTE1CRCERR;
+
+#define _IPATH_GPIO_SDA_NUM 1
+#define _IPATH_GPIO_SCL_NUM 0
+
+#define IPATH_GPIO_SDA \
+        (1ULL << (_IPATH_GPIO_SDA_NUM+INFINIPATH_EXTC_GPIOOE_SHIFT))
+#define IPATH_GPIO_SCL \
+        (1ULL << (_IPATH_GPIO_SCL_NUM+INFINIPATH_EXTC_GPIOOE_SHIFT))
+
+/* keep the code below somewhat more readonable; not used elsewhere */
+#define _IPATH_HTLINK0_CRCBITS (infinipath_hwe_htclnkabyte0crcerr |     \
+                                infinipath_hwe_htclnkabyte1crcerr)
+#define _IPATH_HTLINK1_CRCBITS (infinipath_hwe_htclnkbbyte0crcerr |     \
+                                infinipath_hwe_htclnkbbyte1crcerr)
+#define _IPATH_HTLANE0_CRCBITS (infinipath_hwe_htclnkabyte0crcerr |     \
+                                infinipath_hwe_htclnkbbyte0crcerr)
+#define _IPATH_HTLANE1_CRCBITS (infinipath_hwe_htclnkabyte1crcerr |     \
+                                infinipath_hwe_htclnkbbyte1crcerr)
+
+static void hwerr_crcbits(struct ipath_devdata *dd, ipath_err_t hwerrs,
+                          char *msg, size_t msgl)
+{
+        char bitsmsg[64];
+        ipath_err_t crcbits = hwerrs &
+                (_IPATH_HTLINK0_CRCBITS | _IPATH_HTLINK1_CRCBITS);
+        /* don't check if 8bit HT */
+        if (dd->ipath_flags & IPATH_8BIT_IN_HT0)
+                crcbits &= ~infinipath_hwe_htclnkabyte1crcerr;
+        /* don't check if 8bit HT */
+        if (dd->ipath_flags & IPATH_8BIT_IN_HT1)
+                crcbits &= ~infinipath_hwe_htclnkbbyte1crcerr;
+        /*
+         * we'll want to ignore link errors on link that is
+         * not in use, if any.  For now, complain about both
+         */
+        if (crcbits) {
+                u16 ctrl0, ctrl1;
+                snprintf(bitsmsg, sizeof bitsmsg,
+                         "[HT%s lane %s CRC (%llx); ignore till reload]",
+                         !(crcbits & _IPATH_HTLINK1_CRCBITS) ?
+                         "0 (A)" : (!(crcbits & _IPATH_HTLINK0_CRCBITS)
+                                    ? "1 (B)" : "0+1 (A+B)"),
+                         !(crcbits & _IPATH_HTLANE1_CRCBITS) ? "0"
+                         : (!(crcbits & _IPATH_HTLANE0_CRCBITS) ? "1" :
+                            "0+1"), (unsigned long long) crcbits);
+                strlcat(msg, bitsmsg, msgl);
+
+                /*
+                 * print extra info for debugging.  slave/primary
+                 * config word 4, 8 (link control 0, 1)
+                 */
+
+                if (pci_read_config_word(dd->pcidev,
+                                         dd->ipath_ht_slave_off + 0x4,
+                                         &ctrl0))
+                        dev_info(&dd->pcidev->dev, "Couldn't read "
+                                 "linkctrl0 of slave/primary "
+                                 "config block\n");
+                else if (!(ctrl0 & 1 << 6))
+                        /* not if EOC bit set */
+                        ipath_dbg("HT linkctrl0 0x%x%s%s\n", ctrl0,
+                                  ((ctrl0 >> 8) & 7) ? " CRC" : "",
+                                  ((ctrl0 >> 4) & 1) ? "linkfail" :
+                                  "");
+                if (pci_read_config_word(dd->pcidev,
+                                         dd->ipath_ht_slave_off + 0x8,
+                                         &ctrl1))
+                        dev_info(&dd->pcidev->dev, "Couldn't read "
+                                 "linkctrl1 of slave/primary "
+                                 "config block\n");
+                else if (!(ctrl1 & 1 << 6))
+                        /* not if EOC bit set */
+                        ipath_dbg("HT linkctrl1 0x%x%s%s\n", ctrl1,
+                                  ((ctrl1 >> 8) & 7) ? " CRC" : "",
+                                  ((ctrl1 >> 4) & 1) ? "linkfail" :
+                                  "");
+
+                /* disable until driver reloaded */
+                dd->ipath_hwerrmask &= ~crcbits;
+                ipath_write_kreg(dd, dd->ipath_kregs->kr_hwerrmask,
+                                 dd->ipath_hwerrmask);
+                ipath_dbg("HT crc errs: %s\n", msg);
+        } else
+                ipath_dbg("ignoring HT crc errors 0x%llx, "
+                          "not in use\n", (unsigned long long)
+                          (hwerrs & (_IPATH_HTLINK0_CRCBITS |
+                                     _IPATH_HTLINK1_CRCBITS)));
+}
+
+/**
+ * ipath_ht_handle_hwerrors - display hardware errors
+ * @dd: the infinipath device
+ * @msg: the output buffer
+ * @msgl: the size of the output buffer
+ *
+ * Use same msg buffer as regular errors to avoid
+ * excessive stack use.  Most hardware errors are catastrophic, but for
+ * right now, we'll print them and continue.
+ * We reuse the same message buffer as ipath_handle_errors() to avoid
+ * excessive stack usage.
+ */
+static void ipath_ht_handle_hwerrors(struct ipath_devdata *dd, char *msg,
+                                     size_t msgl)
+{
+        ipath_err_t hwerrs;
+        u32 bits, ctrl;
+        int isfatal = 0;
+        char bitsmsg[64];
+
+        hwerrs = ipath_read_kreg64(dd, dd->ipath_kregs->kr_hwerrstatus);
+
+        if (!hwerrs) {
+                ipath_cdbg(VERBOSE, "Called but no hardware errors set\n");
+                /*
+                 * better than printing cofusing messages
+                 * This seems to be related to clearing the crc error, or
+                 * the pll error during init.
+                 */
+                goto bail;
+        } else if (hwerrs == -1LL) {
+                ipath_dev_err(dd, "Read of hardware error status failed "
+                              "(all bits set); ignoring\n");
+                goto bail;
+        }
+        ipath_stats.sps_hwerrs++;
+
+        /* Always clear the error status register, except MEMBISTFAIL,
+         * regardless of whether we continue or stop using the chip.
+         * We want that set so we know it failed, even across driver reload.
+         * We'll still ignore it in the hwerrmask.  We do this partly for
+         * diagnostics, but also for support */
+        ipath_write_kreg(dd, dd->ipath_kregs->kr_hwerrclear,
+                         hwerrs&~INFINIPATH_HWE_MEMBISTFAILED);
+
+        hwerrs &= dd->ipath_hwerrmask;
+
+        /*
+         * make sure we get this much out, unless told to be quiet,
+         * or it's occurred within the last 5 seconds
+         */
+        if ((hwerrs & ~dd->ipath_lasthwerror) ||
+            (ipath_debug & __IPATH_VERBDBG))
+                dev_info(&dd->pcidev->dev, "Hardware error: hwerr=0x%llx "
+                         "(cleared)\n", (unsigned long long) hwerrs);
+        dd->ipath_lasthwerror |= hwerrs;
+
+        if (hwerrs & ~infinipath_hwe_bitsextant)
+                ipath_dev_err(dd, "hwerror interrupt with unknown errors "
+                              "%llx set\n", (unsigned long long)
+                              (hwerrs & ~infinipath_hwe_bitsextant));
+
+        ctrl = ipath_read_kreg32(dd, dd->ipath_kregs->kr_control);
+        if (ctrl & INFINIPATH_C_FREEZEMODE) {
+                if (hwerrs) {
+                        /*
+                         * if any set that we aren't ignoring; only
+                         * make the complaint once, in case it's stuck
+                         * or recurring, and we get here multiple
+                         * times.
+                         */
+                        if (dd->ipath_flags & IPATH_INITTED) {
+                                ipath_dev_err(dd, "Fatal Error (freeze "
+                                              "mode), no longer usable\n");
+                                isfatal = 1;
+                        }
+                        *dd->ipath_statusp &= ~IPATH_STATUS_IB_READY;
+                        /* mark as having had error */
+                        *dd->ipath_statusp |= IPATH_STATUS_HWERROR;
+                        /*
+                         * mark as not usable, at a minimum until driver
+                         * is reloaded, probably until reboot, since no
+                         * other reset is possible.
+                         */
+                        dd->ipath_flags &= ~IPATH_INITTED;
+                } else {
+                        ipath_dbg("Clearing freezemode on ignored hardware "
+                                  "error\n");
+                        ctrl &= ~INFINIPATH_C_FREEZEMODE;
+                        ipath_write_kreg(dd, dd->ipath_kregs->kr_control,
+                                         ctrl);
+                }
+        }
+
+        *msg = '\0';
+
+        /*
+         * may someday want to decode into which bits are which
+         * functional area for parity errors, etc.
+         */
+        if (hwerrs & (infinipath_hwe_htcmemparityerr_mask
+                      << INFINIPATH_HWE_HTCMEMPARITYERR_SHIFT)) {
+                bits = (u32) ((hwerrs >>
+                               INFINIPATH_HWE_HTCMEMPARITYERR_SHIFT) &
+                              INFINIPATH_HWE_HTCMEMPARITYERR_MASK);
+                snprintf(bitsmsg, sizeof bitsmsg, "[HTC Parity Errs %x] ",
+                         bits);
+                strlcat(msg, bitsmsg, msgl);
+        }
+        if (hwerrs & (INFINIPATH_HWE_RXEMEMPARITYERR_MASK
+                      << INFINIPATH_HWE_RXEMEMPARITYERR_SHIFT)) {
+                bits = (u32) ((hwerrs >>
+                               INFINIPATH_HWE_RXEMEMPARITYERR_SHIFT) &
+                              INFINIPATH_HWE_RXEMEMPARITYERR_MASK);
+                snprintf(bitsmsg, sizeof bitsmsg, "[RXE Parity Errs %x] ",
+                         bits);
+                strlcat(msg, bitsmsg, msgl);
+        }
+        if (hwerrs & (INFINIPATH_HWE_TXEMEMPARITYERR_MASK
+                      << INFINIPATH_HWE_TXEMEMPARITYERR_SHIFT)) {
+                bits = (u32) ((hwerrs >>
+                               INFINIPATH_HWE_TXEMEMPARITYERR_SHIFT) &
+                              INFINIPATH_HWE_TXEMEMPARITYERR_MASK);
+                snprintf(bitsmsg, sizeof bitsmsg, "[TXE Parity Errs %x] ",
+                         bits);
+                strlcat(msg, bitsmsg, msgl);
+        }
+        if (hwerrs & INFINIPATH_HWE_IBCBUSTOSPCPARITYERR)
+                strlcat(msg, "[IB2IPATH Parity]", msgl);
+        if (hwerrs & INFINIPATH_HWE_IBCBUSFRSPCPARITYERR)
+                strlcat(msg, "[IPATH2IB Parity]", msgl);
+        if (hwerrs & INFINIPATH_HWE_HTCBUSIREQPARITYERR)
+                strlcat(msg, "[HTC Ireq Parity]", msgl);
+        if (hwerrs & INFINIPATH_HWE_HTCBUSTREQPARITYERR)
+                strlcat(msg, "[HTC Treq Parity]", msgl);
+        if (hwerrs & INFINIPATH_HWE_HTCBUSTRESPPARITYERR)
+                strlcat(msg, "[HTC Tresp Parity]", msgl);
+
+        if (hwerrs & (_IPATH_HTLINK0_CRCBITS | _IPATH_HTLINK1_CRCBITS))
+                hwerr_crcbits(dd, hwerrs, msg, msgl);
+
+        if (hwerrs & INFINIPATH_HWE_HTCMISCERR5)
+                strlcat(msg, "[HT core Misc5]", msgl);
+        if (hwerrs & INFINIPATH_HWE_HTCMISCERR6)
+                strlcat(msg, "[HT core Misc6]", msgl);
+        if (hwerrs & INFINIPATH_HWE_HTCMISCERR7)
+                strlcat(msg, "[HT core Misc7]", msgl);
+        if (hwerrs & INFINIPATH_HWE_MEMBISTFAILED) {
+                strlcat(msg, "[Memory BIST test failed, HT-400 unusable]",
+                        msgl);
+                /* ignore from now on, so disable until driver reloaded */
+                dd->ipath_hwerrmask &= ~INFINIPATH_HWE_MEMBISTFAILED;
+                ipath_write_kreg(dd, dd->ipath_kregs->kr_hwerrmask,
+                                 dd->ipath_hwerrmask);
+        }
+#define _IPATH_PLL_FAIL (INFINIPATH_HWE_COREPLL_FBSLIP |        \
+                         INFINIPATH_HWE_COREPLL_RFSLIP |        \
+                         INFINIPATH_HWE_HTBPLL_FBSLIP |         \
+                         INFINIPATH_HWE_HTBPLL_RFSLIP |         \
+                         INFINIPATH_HWE_HTAPLL_FBSLIP |         \
+                         INFINIPATH_HWE_HTAPLL_RFSLIP)
+
+        if (hwerrs & _IPATH_PLL_FAIL) {
+                snprintf(bitsmsg, sizeof bitsmsg,
+                         "[PLL failed (%llx), HT-400 unusable]",
+                         (unsigned long long) (hwerrs & _IPATH_PLL_FAIL));
+                strlcat(msg, bitsmsg, msgl);
+                /* ignore from now on, so disable until driver reloaded */
+                dd->ipath_hwerrmask &= ~(hwerrs & _IPATH_PLL_FAIL);
+                ipath_write_kreg(dd, dd->ipath_kregs->kr_hwerrmask,
+                                 dd->ipath_hwerrmask);
+        }
+
+        if (hwerrs & INFINIPATH_HWE_SERDESPLLFAILED) {
+                /*
+                 * If it occurs, it is left masked since the eternal
+                 * interface is unused
+                 */
+                dd->ipath_hwerrmask &= ~INFINIPATH_HWE_SERDESPLLFAILED;
+                ipath_write_kreg(dd, dd->ipath_kregs->kr_hwerrmask,
+                                 dd->ipath_hwerrmask);
+        }
+
+        if (hwerrs & INFINIPATH_HWE_RXDSYNCMEMPARITYERR)
+                strlcat(msg, "[Rx Dsync]", msgl);
+        if (hwerrs & INFINIPATH_HWE_SERDESPLLFAILED)
+                strlcat(msg, "[SerDes PLL]", msgl);
+
+        ipath_dev_err(dd, "%s hardware error\n", msg);
+        if (isfatal && !ipath_diag_inuse && dd->ipath_freezemsg)
+                /*
+                 * for status file; if no trailing brace is copied,
+                 * we'll know it was truncated.
+                 */
+                snprintf(dd->ipath_freezemsg,
+                         dd->ipath_freezelen, "{%s}", msg);
+
+bail:;
+}
+
+/**
+ * ipath_ht_boardname - fill in the board name
+ * @dd: the infinipath device
+ * @name: the output buffer
+ * @namelen: the size of the output buffer
+ *
+ * fill in the board name, based on the board revision register
+ */
+static int ipath_ht_boardname(struct ipath_devdata *dd, char *name,
+                              size_t namelen)
+{
+        char *n = NULL;
+        u8 boardrev = dd->ipath_boardrev;
+        int ret;
+
+        switch (boardrev) {
+        case 4:         /* Ponderosa is one of the bringup boards */
+                n = "Ponderosa";
+                break;
+        case 5:         /* HT-460 original production board */
+                n = "InfiniPath_HT-460";
+                break;
+        case 6:
+                n = "OEM_Board_3";
+                break;
+        case 7:
+                /* HT-460 small form factor production board */
+                n = "InfiniPath_HT-465";
+                break;
+        case 8:
+                n = "LS/X-1";
+                break;
+        case 9:         /* Comstock bringup test board */
+                n = "Comstock";
+                break;
+        case 10:
+                n = "OEM_Board_2";
+                break;
+        case 11:
+                n = "InfiniPath_HT-470";
+                break;
+        case 12:
+                n = "OEM_Board_4";
+                break;
+        default:                /* don't know, just print the number */
+                ipath_dev_err(dd, "Don't yet know about board "
+                              "with ID %u\n", boardrev);
+                snprintf(name, namelen, "Unknown_InfiniPath_HT-4xx_%u",
+                         boardrev);
+                break;
+        }
+        if (n)
+                snprintf(name, namelen, "%s", n);
+
+        if (dd->ipath_majrev != 3 || dd->ipath_minrev != 2) {
+                /*
+                 * This version of the driver only supports the HT-400
+                 * Rev 3.2
+                 */
+                ipath_dev_err(dd,
+                              "Unsupported HT-400 revision %u.%u!\n",
+                              dd->ipath_majrev, dd->ipath_minrev);
+                ret = 1;
+                goto bail;
+        }
+        /*
+         * pkt/word counters are 32 bit, and therefore wrap fast enough
+         * that we snapshot them from a timer, and maintain 64 bit shadow
+         * copies
+         */
+        dd->ipath_flags |= IPATH_32BITCOUNTERS;
+        if (dd->ipath_htspeed != 800)
+                ipath_dev_err(dd,
+                              "Incorrectly configured for HT @ %uMHz\n",
+                              dd->ipath_htspeed);
+        if (dd->ipath_boardrev == 7 || dd->ipath_boardrev == 11 ||
+            dd->ipath_boardrev == 6)
+                dd->ipath_flags |= IPATH_GPIO_INTR;
+        else
+                dd->ipath_flags |= IPATH_POLL_RX_INTR;
+        if (dd->ipath_boardrev == 8) {  /* LS/X-1 */
+                u64 val;
+                val = ipath_read_kreg64(dd, dd->ipath_kregs->kr_extstatus);
+                if (val & INFINIPATH_EXTS_SERDESSEL) {
+                        /*
+                         * hardware disabled
+                         *
+                         * This means that the chip is hardware disabled,
+                         * and will not be able to bring up the link,
+                         * in any case.  We special case this and abort
+                         * early, to avoid later messages.  We also set
+                         * the DISABLED status bit
+                         */
+                        ipath_dbg("Unit %u is hardware-disabled\n",
+                                  dd->ipath_unit);
+                        *dd->ipath_statusp |= IPATH_STATUS_DISABLED;
+                        /* this value is handled differently */
+                        ret = 2;
+                        goto bail;
+                }
+        }
+        ret = 0;
+
+bail:
+        return ret;
+}
+
+static void ipath_check_htlink(struct ipath_devdata *dd)
+{
+        u8 linkerr, link_off, i;
+
+        for (i = 0; i < 2; i++) {
+                link_off = dd->ipath_ht_slave_off + i * 4 + 0xd;
+                if (pci_read_config_byte(dd->pcidev, link_off, &linkerr))
+                        dev_info(&dd->pcidev->dev, "Couldn't read "
+                                 "linkerror%d of HT slave/primary block\n",
+                                 i);
+                else if (linkerr & 0xf0) {
+                        ipath_cdbg(VERBOSE, "HT linkerr%d bits 0x%x set, "
+                                   "clearing\n", linkerr >> 4, i);
+                        /*
+                         * writing the linkerr bits that are set should
+                         * clear them
+                         */
+                        if (pci_write_config_byte(dd->pcidev, link_off,
+                                                  linkerr))
+                                ipath_dbg("Failed write to clear HT "
+                                          "linkerror%d\n", i);
+                        if (pci_read_config_byte(dd->pcidev, link_off,
+                                                 &linkerr))
+                                dev_info(&dd->pcidev->dev,
+                                         "Couldn't reread linkerror%d of "
+                                         "HT slave/primary block\n", i);
+                        else if (linkerr & 0xf0)
+                                dev_info(&dd->pcidev->dev,
+                                         "HT linkerror%d bits 0x%x "
+                                         "couldn't be cleared\n",
+                                         i, linkerr >> 4);
+                }
+        }
+}
+
+static int ipath_setup_ht_reset(struct ipath_devdata *dd)
+{
+        ipath_dbg("No reset possible for HT-400\n");
+        return 0;
+}
+
+#define HT_CAPABILITY_ID   0x08 /* HT capabilities not defined in kernel */
+#define HT_INTR_DISC_CONFIG  0x80       /* HT interrupt and discovery cap */
+#define HT_INTR_REG_INDEX    2  /* intconfig requires indirect accesses */
+
+/*
+ * Bits 13-15 of command==0 is slave/primary block.  Clear any HT CRC
+ * errors.  We only bother to do this at load time, because it's OK if
+ * it happened before we were loaded (first time after boot/reset),
+ * but any time after that, it's fatal anyway.  Also need to not check
+ * for for upper byte errors if we are in 8 bit mode, so figure out
+ * our width.  For now, at least, also complain if it's 8 bit.
+ */
+static void slave_or_pri_blk(struct ipath_devdata *dd, struct pci_dev *pdev,
+                             int pos, u8 cap_type)
+{
+        u8 linkwidth = 0, linkerr, link_a_b_off, link_off;
+        u16 linkctrl = 0;
+        int i;
+
+        dd->ipath_ht_slave_off = pos;
+        /* command word, master_host bit */
+        /* master host || slave */
+        if ((cap_type >> 2) & 1)
+                link_a_b_off = 4;
+        else
+                link_a_b_off = 0;
+        ipath_cdbg(VERBOSE, "HT%u (Link %c) connected to processor\n",
+                   link_a_b_off ? 1 : 0,
+                   link_a_b_off ? 'B' : 'A');
+
+        link_a_b_off += pos;
+
+        /*
+         * check both link control registers; clear both HT CRC sets if
+         * necessary.
+         */
+        for (i = 0; i < 2; i++) {
+                link_off = pos + i * 4 + 0x4;
+                if (pci_read_config_word(pdev, link_off, &linkctrl))
+                        ipath_dev_err(dd, "Couldn't read HT link control%d "
+                                      "register\n", i);
+                else if (linkctrl & (0xf << 8)) {
+                        ipath_cdbg(VERBOSE, "Clear linkctrl%d CRC Error "
+                                   "bits %x\n", i, linkctrl & (0xf << 8));
+                        /*
+                         * now write them back to clear the error.
+                         */
+                        pci_write_config_byte(pdev, link_off,
+                                              linkctrl & (0xf << 8));
+                }
+        }
+
+        /*
+         * As with HT CRC bits, same for protocol errors that might occur
+         * during boot.
+         */
+        for (i = 0; i < 2; i++) {
+                link_off = pos + i * 4 + 0xd;
+                if (pci_read_config_byte(pdev, link_off, &linkerr))
+                        dev_info(&pdev->dev, "Couldn't read linkerror%d "
+                                 "of HT slave/primary block\n", i);
+                else if (linkerr & 0xf0) {
+                        ipath_cdbg(VERBOSE, "HT linkerr%d bits 0x%x set, "
+                                   "clearing\n", linkerr >> 4, i);
+                        /*
+                         * writing the linkerr bits that are set will clear
+                         * them
+                         */
+                        if (pci_write_config_byte
+                            (pdev, link_off, linkerr))
+                                ipath_dbg("Failed write to clear HT "
+                                          "linkerror%d\n", i);
+                        if (pci_read_config_byte(pdev, link_off, &linkerr))
+                                dev_info(&pdev->dev, "Couldn't reread "
+                                         "linkerror%d of HT slave/primary "
+                                         "block\n", i);
+                        else if (linkerr & 0xf0)
+                                dev_info(&pdev->dev, "HT linkerror%d bits "
+                                         "0x%x couldn't be cleared\n",
+                                         i, linkerr >> 4);
+                }
+        }
+
+        /*
+         * this is just for our link to the host, not devices connected
+         * through tunnel.
+         */
+
+        if (pci_read_config_byte(pdev, link_a_b_off + 7, &linkwidth))
+                ipath_dev_err(dd, "Couldn't read HT link width "
+                              "config register\n");
+        else {
+                u32 width;
+                switch (linkwidth & 7) {
+                case 5:
+                        width = 4;
+                        break;
+                case 4:
+                        width = 2;
+                        break;
+                case 3:
+                        width = 32;
+                        break;
+                case 1:
+                        width = 16;
+                        break;
+                case 0:
+                default:        /* if wrong, assume 8 bit */
+                        width = 8;
+                        break;
+                }
+
+                dd->ipath_htwidth = width;
+
+                if (linkwidth != 0x11) {
+                        ipath_dev_err(dd, "Not configured for 16 bit HT "
+                                      "(%x)\n", linkwidth);
+                        if (!(linkwidth & 0xf)) {
+                                ipath_dbg("Will ignore HT lane1 errors\n");
+                                dd->ipath_flags |= IPATH_8BIT_IN_HT0;
+                        }
+                }
+        }
+
+        /*
+         * this is just for our link to the host, not devices connected
+         * through tunnel.
+         */
+        if (pci_read_config_byte(pdev, link_a_b_off + 0xd, &linkwidth))
+                ipath_dev_err(dd, "Couldn't read HT link frequency "
+                              "config register\n");
+        else {
+                u32 speed;
+                switch (linkwidth & 0xf) {
+                case 6:
+                        speed = 1000;
+                        break;
+                case 5:
+                        speed = 800;
+                        break;
+                case 4:
+                        speed = 600;
+                        break;
+                case 3:
+                        speed = 500;
+                        break;
+                case 2:
+                        speed = 400;
+                        break;
+                case 1:
+                        speed = 300;
+                        break;
+                default:
+                        /*
+                         * assume reserved and vendor-specific are 200...
+                         */
+                case 0:
+                        speed = 200;
+                        break;
+                }
+                dd->ipath_htspeed = speed;
+        }
+}
+
+static int set_int_handler(struct ipath_devdata *dd, struct pci_dev *pdev,
+                            int pos)
+{
+        u32 int_handler_addr_lower;
+        u32 int_handler_addr_upper;
+        u64 ihandler;
+        u32 intvec;
+
+        /* use indirection register to get the intr handler */
+        pci_write_config_byte(pdev, pos + HT_INTR_REG_INDEX, 0x10);
+        pci_read_config_dword(pdev, pos + 4, &int_handler_addr_lower);
+        pci_write_config_byte(pdev, pos + HT_INTR_REG_INDEX, 0x11);
+        pci_read_config_dword(pdev, pos + 4, &int_handler_addr_upper);
+
+        ihandler = (u64) int_handler_addr_lower |
+                ((u64) int_handler_addr_upper << 32);
+
+        /*
+         * kernels with CONFIG_PCI_MSI set the vector in the irq field of
+         * struct pci_device, so we use that to program the HT-400 internal
+         * interrupt register (not config space) with that value. The BIOS
+         * must still have done the basic MSI setup.
+         */
+        intvec = pdev->irq;
+        /*
+         * clear any vector bits there; normally not set but we'll overload
+         * this for some debug purposes (setting the HTC debug register
+         * value from software, rather than GPIOs), so it might be set on a
+         * driver reload.
+         */
+        ihandler &= ~0xff0000;
+        /* x86 vector goes in intrinfo[23:16] */
+        ihandler |= intvec << 16;
+        ipath_cdbg(VERBOSE, "ihandler lower %x, upper %x, intvec %x, "
+                   "interruptconfig %llx\n", int_handler_addr_lower,
+                   int_handler_addr_upper, intvec,
+                   (unsigned long long) ihandler);
+
+        /* can't program yet, so save for interrupt setup */
+        dd->ipath_intconfig = ihandler;
+        /* keep going, so we find link control stuff also */
+
+        return ihandler != 0;
+}
+
+/**
+ * ipath_setup_ht_config - setup the interruptconfig register
+ * @dd: the infinipath device
+ * @pdev: the PCI device
+ *
+ * setup the interruptconfig register from the HT config info.
+ * Also clear CRC errors in HT linkcontrol, if necessary.
+ * This is done only for the real hardware.  It is done before
+ * chip address space is initted, so can't touch infinipath registers
+ */
+static int ipath_setup_ht_config(struct ipath_devdata *dd,
+                                 struct pci_dev *pdev)
+{
+        int pos, ret = 0;
+        int ihandler = 0;
+
+        /*
+         * Read the capability info to find the interrupt info, and also
+         * handle clearing CRC errors in linkctrl register if necessary.  We
+         * do this early, before we ever enable errors or hardware errors,
+         * mostly to avoid causing the chip to enter freeze mode.
+         */
+        pos = pci_find_capability(pdev, HT_CAPABILITY_ID);
+        if (!pos) {
+                ipath_dev_err(dd, "Couldn't find HyperTransport "
+                              "capability; no interrupts\n");
+                ret = -ENODEV;
+                goto bail;
+        }
+        do {
+                u8 cap_type;
+
+                /* the HT capability type byte is 3 bytes after the
+                 * capability byte.
+                 */
+                if (pci_read_config_byte(pdev, pos + 3, &cap_type)) {
+                        dev_info(&pdev->dev, "Couldn't read config "
+                                 "command @ %d\n", pos);
+                        continue;
+                }
+                if (!(cap_type & 0xE0))
+                        slave_or_pri_blk(dd, pdev, pos, cap_type);
+                else if (cap_type == HT_INTR_DISC_CONFIG)
+                        ihandler = set_int_handler(dd, pdev, pos);
+        } while ((pos = pci_find_next_capability(pdev, pos,
+                                                 HT_CAPABILITY_ID)));
+
+        if (!ihandler) {
+                ipath_dev_err(dd, "Couldn't find interrupt handler in "
+                              "config space\n");
+                ret = -ENODEV;
+        }
+
+bail:
+        return ret;
+}
+
+/**
+ * ipath_setup_ht_cleanup - clean up any per-chip chip-specific stuff
+ * @dd: the infinipath device
+ *
+ * Called during driver unload.
+ * This is currently a nop for the HT-400, not for all chips
+ */
+static void ipath_setup_ht_cleanup(struct ipath_devdata *dd)
+{
+}
+
+/**
+ * ipath_setup_ht_setextled - set the state of the two external LEDs
+ * @dd: the infinipath device
+ * @lst: the L state
+ * @ltst: the LT state
+ *
+ * Set the state of the two external LEDs, to indicate physical and
+ * logical state of IB link.   For this chip (at least with recommended
+ * board pinouts), LED1 is Green (physical state), and LED2 is Yellow
+ * (logical state)
+ *
+ * Note:  We try to match the Mellanox HCA LED behavior as best
+ * we can.  Green indicates physical link state is OK (something is
+ * plugged in, and we can train).
+ * Amber indicates the link is logically up (ACTIVE).
+ * Mellanox further blinks the amber LED to indicate data packet
+ * activity, but we have no hardware support for that, so it would
+ * require waking up every 10-20 msecs and checking the counters
+ * on the chip, and then turning the LED off if appropriate.  That's
+ * visible overhead, so not something we will do.
+ *
+ */
+static void ipath_setup_ht_setextled(struct ipath_devdata *dd,
+                                     u64 lst, u64 ltst)
+{
+        u64 extctl;
+
+        /* the diags use the LED to indicate diag info, so we leave
+         * the external LED alone when the diags are running */
+        if (ipath_diag_inuse)
+                return;
+
+        /*
+         * start by setting both LED control bits to off, then turn
+         * on the appropriate bit(s).
+         */
+        if (dd->ipath_boardrev == 8) { /* LS/X-1 uses different pins */
+                /*
+                 * major difference is that INFINIPATH_EXTC_LEDGBLERR_OFF
+                 * is inverted,  because it is normally used to indicate
+                 * a hardware fault at reset, if there were errors
+                 */
+                extctl = (dd->ipath_extctrl & ~INFINIPATH_EXTC_LEDGBLOK_ON)
+                        | INFINIPATH_EXTC_LEDGBLERR_OFF;
+                if (ltst == INFINIPATH_IBCS_LT_STATE_LINKUP)
+                        extctl &= ~INFINIPATH_EXTC_LEDGBLERR_OFF;
+                if (lst == INFINIPATH_IBCS_L_STATE_ACTIVE)
+                        extctl |= INFINIPATH_EXTC_LEDGBLOK_ON;
+        }
+        else {
+                extctl = dd->ipath_extctrl &
+                        ~(INFINIPATH_EXTC_LED1PRIPORT_ON |
+                          INFINIPATH_EXTC_LED2PRIPORT_ON);
+                if (ltst == INFINIPATH_IBCS_LT_STATE_LINKUP)
+                        extctl |= INFINIPATH_EXTC_LED1PRIPORT_ON;
+                if (lst == INFINIPATH_IBCS_L_STATE_ACTIVE)
+                        extctl |= INFINIPATH_EXTC_LED2PRIPORT_ON;
+        }
+        dd->ipath_extctrl = extctl;
+        ipath_write_kreg(dd, dd->ipath_kregs->kr_extctrl, extctl);
+}
+
+static void ipath_init_ht_variables(void)
+{
+        ipath_gpio_sda_num = _IPATH_GPIO_SDA_NUM;
+        ipath_gpio_scl_num = _IPATH_GPIO_SCL_NUM;
+        ipath_gpio_sda = IPATH_GPIO_SDA;
+        ipath_gpio_scl = IPATH_GPIO_SCL;
+
+        infinipath_i_bitsextant =
+                (INFINIPATH_I_RCVURG_MASK << INFINIPATH_I_RCVURG_SHIFT) |
+                (INFINIPATH_I_RCVAVAIL_MASK <<
+                 INFINIPATH_I_RCVAVAIL_SHIFT) |
+                INFINIPATH_I_ERROR | INFINIPATH_I_SPIOSENT |
+                INFINIPATH_I_SPIOBUFAVAIL | INFINIPATH_I_GPIO;
+
+        infinipath_e_bitsextant =
+                INFINIPATH_E_RFORMATERR | INFINIPATH_E_RVCRC |
+                INFINIPATH_E_RICRC | INFINIPATH_E_RMINPKTLEN |
+                INFINIPATH_E_RMAXPKTLEN | INFINIPATH_E_RLONGPKTLEN |
+                INFINIPATH_E_RSHORTPKTLEN | INFINIPATH_E_RUNEXPCHAR |
+                INFINIPATH_E_RUNSUPVL | INFINIPATH_E_REBP |
+                INFINIPATH_E_RIBFLOW | INFINIPATH_E_RBADVERSION |
+                INFINIPATH_E_RRCVEGRFULL | INFINIPATH_E_RRCVHDRFULL |
+                INFINIPATH_E_RBADTID | INFINIPATH_E_RHDRLEN |
+                INFINIPATH_E_RHDR | INFINIPATH_E_RIBLOSTLINK |
+                INFINIPATH_E_SMINPKTLEN | INFINIPATH_E_SMAXPKTLEN |
+                INFINIPATH_E_SUNDERRUN | INFINIPATH_E_SPKTLEN |
+                INFINIPATH_E_SDROPPEDSMPPKT | INFINIPATH_E_SDROPPEDDATAPKT |
+                INFINIPATH_E_SPIOARMLAUNCH | INFINIPATH_E_SUNEXPERRPKTNUM |
+                INFINIPATH_E_SUNSUPVL | INFINIPATH_E_IBSTATUSCHANGED |
+                INFINIPATH_E_INVALIDADDR | INFINIPATH_E_RESET |
+                INFINIPATH_E_HARDWARE;
+
+        infinipath_hwe_bitsextant =
+                (INFINIPATH_HWE_HTCMEMPARITYERR_MASK <<
+                 INFINIPATH_HWE_HTCMEMPARITYERR_SHIFT) |
+                (INFINIPATH_HWE_TXEMEMPARITYERR_MASK <<
+                 INFINIPATH_HWE_TXEMEMPARITYERR_SHIFT) |
+                (INFINIPATH_HWE_RXEMEMPARITYERR_MASK <<
+                 INFINIPATH_HWE_RXEMEMPARITYERR_SHIFT) |
+                INFINIPATH_HWE_HTCLNKABYTE0CRCERR |
+                INFINIPATH_HWE_HTCLNKABYTE1CRCERR |
+                INFINIPATH_HWE_HTCLNKBBYTE0CRCERR |
+                INFINIPATH_HWE_HTCLNKBBYTE1CRCERR |
+                INFINIPATH_HWE_HTCMISCERR4 |
+                INFINIPATH_HWE_HTCMISCERR5 | INFINIPATH_HWE_HTCMISCERR6 |
+                INFINIPATH_HWE_HTCMISCERR7 |
+                INFINIPATH_HWE_HTCBUSTREQPARITYERR |
+                INFINIPATH_HWE_HTCBUSTRESPPARITYERR |
+                INFINIPATH_HWE_HTCBUSIREQPARITYERR |
+                INFINIPATH_HWE_RXDSYNCMEMPARITYERR |
+                INFINIPATH_HWE_MEMBISTFAILED |
+                INFINIPATH_HWE_COREPLL_FBSLIP |
+                INFINIPATH_HWE_COREPLL_RFSLIP |
+                INFINIPATH_HWE_HTBPLL_FBSLIP |
+                INFINIPATH_HWE_HTBPLL_RFSLIP |
+                INFINIPATH_HWE_HTAPLL_FBSLIP |
+                INFINIPATH_HWE_HTAPLL_RFSLIP |
+                INFINIPATH_HWE_SERDESPLLFAILED |
+                INFINIPATH_HWE_IBCBUSTOSPCPARITYERR |
+                INFINIPATH_HWE_IBCBUSFRSPCPARITYERR;
+
+        infinipath_i_rcvavail_mask = INFINIPATH_I_RCVAVAIL_MASK;
+        infinipath_i_rcvurg_mask = INFINIPATH_I_RCVURG_MASK;
+}
+
+/**
+ * ipath_ht_init_hwerrors - enable hardware errors
+ * @dd: the infinipath device
+ *
+ * now that we have finished initializing everything that might reasonably
+ * cause a hardware error, and cleared those errors bits as they occur,
+ * we can enable hardware errors in the mask (potentially enabling
+ * freeze mode), and enable hardware errors as errors (along with
+ * everything else) in errormask
+ */
+static void ipath_ht_init_hwerrors(struct ipath_devdata *dd)
+{
+        ipath_err_t val;
+        u64 extsval;
+
+        extsval = ipath_read_kreg64(dd, dd->ipath_kregs->kr_extstatus);
+
+        if (!(extsval & INFINIPATH_EXTS_MEMBIST_ENDTEST))
+                ipath_dev_err(dd, "MemBIST did not complete!\n");
+
+        ipath_check_htlink(dd);
+
+        /* barring bugs, all hwerrors become interrupts, which can */
+        val = -1LL;
+        /* don't look at crc lane1 if 8 bit */
+        if (dd->ipath_flags & IPATH_8BIT_IN_HT0)
+                val &= ~infinipath_hwe_htclnkabyte1crcerr;
+        /* don't look at crc lane1 if 8 bit */
+        if (dd->ipath_flags & IPATH_8BIT_IN_HT1)
+                val &= ~infinipath_hwe_htclnkbbyte1crcerr;
+
+        /*
+         * disable RXDSYNCMEMPARITY because external serdes is unused,
+         * and therefore the logic will never be used or initialized,
+         * and uninitialized state will normally result in this error
+         * being asserted.  Similarly for the external serdess pll
+         * lock signal.
+         */
+        val &= ~(INFINIPATH_HWE_SERDESPLLFAILED |
+                 INFINIPATH_HWE_RXDSYNCMEMPARITYERR);
+
+        /*
+         * Disable MISCERR4 because of an inversion in the HT core
+         * logic checking for errors that cause this bit to be set.
+         * The errata can also cause the protocol error bit to be set
+         * in the HT config space linkerror register(s).
+         */
+        val &= ~INFINIPATH_HWE_HTCMISCERR4;
+
+        /*
+         * PLL ignored because MDIO interface has a logic problem
+         * for reads, on Comstock and Ponderosa.  BRINGUP
+         */
+        if (dd->ipath_boardrev == 4 || dd->ipath_boardrev == 9)
+                val &= ~INFINIPATH_HWE_SERDESPLLFAILED;
+        dd->ipath_hwerrmask = val;
+}
+
+/**
+ * ipath_ht_bringup_serdes - bring up the serdes
+ * @dd: the infinipath device
+ */
+static int ipath_ht_bringup_serdes(struct ipath_devdata *dd)
+{
+        u64 val, config1;
+        int ret = 0, change = 0;
+
+        ipath_dbg("Trying to bringup serdes\n");
+
+        if (ipath_read_kreg64(dd, dd->ipath_kregs->kr_hwerrstatus) &
+            INFINIPATH_HWE_SERDESPLLFAILED)
+        {
+                ipath_dbg("At start, serdes PLL failed bit set in "
+                          "hwerrstatus, clearing and continuing\n");
+                ipath_write_kreg(dd, dd->ipath_kregs->kr_hwerrclear,
+                                 INFINIPATH_HWE_SERDESPLLFAILED);
+        }
+
+        val = ipath_read_kreg64(dd, dd->ipath_kregs->kr_serdesconfig0);
+        config1 = ipath_read_kreg64(dd, dd->ipath_kregs->kr_serdesconfig1);
+
+        ipath_cdbg(VERBOSE, "Initial serdes status is config0=%llx "
+                   "config1=%llx, sstatus=%llx xgxs %llx\n",
+                   (unsigned long long) val, (unsigned long long) config1,
+                   (unsigned long long)
+                   ipath_read_kreg64(dd, dd->ipath_kregs->kr_serdesstatus),
+                   (unsigned long long)
+                   ipath_read_kreg64(dd, dd->ipath_kregs->kr_xgxsconfig));
+
+        /* force reset on */
+        val |= INFINIPATH_SERDC0_RESET_PLL
+                /* | INFINIPATH_SERDC0_RESET_MASK */
+                ;
+        ipath_write_kreg(dd, dd->ipath_kregs->kr_serdesconfig0, val);
+        udelay(15);             /* need pll reset set at least for a bit */
+
+        if (val & INFINIPATH_SERDC0_RESET_PLL) {
+                u64 val2 = val &= ~INFINIPATH_SERDC0_RESET_PLL;
+                /* set lane resets, and tx idle, during pll reset */
+                val2 |= INFINIPATH_SERDC0_RESET_MASK |
+                        INFINIPATH_SERDC0_TXIDLE;
+                ipath_cdbg(VERBOSE, "Clearing serdes PLL reset (writing "
+                           "%llx)\n", (unsigned long long) val2);
+                ipath_write_kreg(dd, dd->ipath_kregs->kr_serdesconfig0,
+                                 val2);
+                /*
+                 * be sure chip saw it
+                 */
+                val = ipath_read_kreg64(dd, dd->ipath_kregs->kr_scratch);
+                /*
+                 * need pll reset clear at least 11 usec before lane
+                 * resets cleared; give it a few more
+                 */
+                udelay(15);
+                val = val2;     /* for check below */
+        }
+
+        if (val & (INFINIPATH_SERDC0_RESET_PLL |
+                   INFINIPATH_SERDC0_RESET_MASK |
+                   INFINIPATH_SERDC0_TXIDLE)) {
+                val &= ~(INFINIPATH_SERDC0_RESET_PLL |
+                         INFINIPATH_SERDC0_RESET_MASK |
+                         INFINIPATH_SERDC0_TXIDLE);
+                /* clear them */
+                ipath_write_kreg(dd, dd->ipath_kregs->kr_serdesconfig0,
+                                 val);
+        }
+
+        val = ipath_read_kreg64(dd, dd->ipath_kregs->kr_xgxsconfig);
+        if (((val >> INFINIPATH_XGXS_MDIOADDR_SHIFT) &
+             INFINIPATH_XGXS_MDIOADDR_MASK) != 3) {
+                val &= ~(INFINIPATH_XGXS_MDIOADDR_MASK <<
+                         INFINIPATH_XGXS_MDIOADDR_SHIFT);
+                /*
+                 * we use address 3
+                 */
+                val |= 3ULL << INFINIPATH_XGXS_MDIOADDR_SHIFT;
+                change = 1;
+        }
+        if (val & INFINIPATH_XGXS_RESET) {
+                /* normally true after boot */
+                val &= ~INFINIPATH_XGXS_RESET;
+                change = 1;
+        }
+        if (change)
+                ipath_write_kreg(dd, dd->ipath_kregs->kr_xgxsconfig, val);
+
+        val = ipath_read_kreg64(dd, dd->ipath_kregs->kr_serdesconfig0);
+
+        /* clear current and de-emphasis bits */
+        config1 &= ~0x0ffffffff00ULL;
+        /* set current to 20ma */
+        config1 |= 0x00000000000ULL;
+        /* set de-emphasis to -5.68dB */
+        config1 |= 0x0cccc000000ULL;
+        ipath_write_kreg(dd, dd->ipath_kregs->kr_serdesconfig1, config1);
+
+        ipath_cdbg(VERBOSE, "After setup: serdes status is config0=%llx "
+                   "config1=%llx, sstatus=%llx xgxs %llx\n",
+                   (unsigned long long) val, (unsigned long long) config1,
+                   (unsigned long long)
+                   ipath_read_kreg64(dd, dd->ipath_kregs->kr_serdesstatus),
+                   (unsigned long long)
+                   ipath_read_kreg64(dd, dd->ipath_kregs->kr_xgxsconfig));
+
+        if (!ipath_waitfor_mdio_cmdready(dd)) {
+                ipath_write_kreg(dd, dd->ipath_kregs->kr_mdio,
+                                 ipath_mdio_req(IPATH_MDIO_CMD_READ, 31,
+                                                IPATH_MDIO_CTRL_XGXS_REG_8,
+                                                0));
+                if (ipath_waitfor_complete(dd, dd->ipath_kregs->kr_mdio,
+                                           IPATH_MDIO_DATAVALID, &val))
+                        ipath_dbg("Never got MDIO data for XGXS status "
+                                  "read\n");
+                else
+                        ipath_cdbg(VERBOSE, "MDIO Read reg8, "
+                                   "'bank' 31 %x\n", (u32) val);
+        } else
+                ipath_dbg("Never got MDIO cmdready for XGXS status read\n");
+
+        return ret;             /* for now, say we always succeeded */
+}
+
+/**
+ * ipath_ht_quiet_serdes - set serdes to txidle
+ * @dd: the infinipath device
+ * driver is being unloaded
+ */
+static void ipath_ht_quiet_serdes(struct ipath_devdata *dd)
+{
+        u64 val = ipath_read_kreg64(dd, dd->ipath_kregs->kr_serdesconfig0);
+
+        val |= INFINIPATH_SERDC0_TXIDLE;
+        ipath_dbg("Setting TxIdleEn on serdes (config0 = %llx)\n",
+                  (unsigned long long) val);
+        ipath_write_kreg(dd, dd->ipath_kregs->kr_serdesconfig0, val);
+}
+
+static int ipath_ht_intconfig(struct ipath_devdata *dd)
+{
+        int ret;
+
+        if (!dd->ipath_intconfig) {
+                ipath_dev_err(dd, "No interrupts enabled, couldn't setup "
+                              "interrupt address\n");
+                ret = 1;
+                goto bail;
+        }
+
+        ipath_write_kreg(dd, dd->ipath_kregs->kr_interruptconfig,
+                         dd->ipath_intconfig);  /* interrupt address */
+        ret = 0;
+
+bail:
+        return ret;
+}
+
+/**
+ * ipath_pe_put_tid - write a TID in chip
+ * @dd: the infinipath device
+ * @tidptr: pointer to the expected TID (in chip) to udpate
+ * @tidtype: 0 for eager, 1 for expected
+ * @pa: physical address of in memory buffer; ipath_tidinvalid if freeing
+ *
+ * This exists as a separate routine to allow for special locking etc.
+ * It's used for both the full cleanup on exit, as well as the normal
+ * setup and teardown.
+ */
+static void ipath_ht_put_tid(struct ipath_devdata *dd,
+                             u64 __iomem *tidptr, u32 type,
+                             unsigned long pa)
+{
+        if (pa != dd->ipath_tidinvalid) {
+                if (unlikely((pa & ~INFINIPATH_RT_ADDR_MASK))) {
+                        dev_info(&dd->pcidev->dev,
+                                 "physaddr %lx has more than "
+                                 "40 bits, using only 40!!!\n", pa);
+                        pa &= INFINIPATH_RT_ADDR_MASK;
+                }
+                if (type == 0)
+                        pa |= dd->ipath_tidtemplate;
+                else {
+                        /* in words (fixed, full page).  */
+                        u64 lenvalid = PAGE_SIZE >> 2;
+                        lenvalid <<= INFINIPATH_RT_BUFSIZE_SHIFT;
+                        pa |= lenvalid | INFINIPATH_RT_VALID;
+                }
+        }
+        if (dd->ipath_kregbase)
+                writeq(pa, tidptr);
+}
+
+/**
+ * ipath_ht_clear_tid - clear all TID entries for a port, expected and eager
+ * @dd: the infinipath device
+ * @port: the port
+ *
+ * Used from ipath_close(), and at chip initialization.
+ */
+static void ipath_ht_clear_tids(struct ipath_devdata *dd, unsigned port)
+{
+        u64 __iomem *tidbase;
+        int i;
+
+        if (!dd->ipath_kregbase)
+                return;
+
+        ipath_cdbg(VERBOSE, "Invalidate TIDs for port %u\n", port);
+
+        /*
+         * need to invalidate all of the expected TID entries for this
+         * port, so we don't have valid entries that might somehow get
+         * used (early in next use of this port, or through some bug)
+         */
+        tidbase = (u64 __iomem *) ((char __iomem *)(dd->ipath_kregbase) +
+                                   dd->ipath_rcvtidbase +
+                                   port * dd->ipath_rcvtidcnt *
+                                   sizeof(*tidbase));
+        for (i = 0; i < dd->ipath_rcvtidcnt; i++)
+                ipath_ht_put_tid(dd, &tidbase[i], 1, dd->ipath_tidinvalid);
+
+        tidbase = (u64 __iomem *) ((char __iomem *)(dd->ipath_kregbase) +
+                                   dd->ipath_rcvegrbase +
+                                   port * dd->ipath_rcvegrcnt *
+                                   sizeof(*tidbase));
+
+        for (i = 0; i < dd->ipath_rcvegrcnt; i++)
+                ipath_ht_put_tid(dd, &tidbase[i], 0, dd->ipath_tidinvalid);
+}
+
+/**
+ * ipath_ht_tidtemplate - setup constants for TID updates
+ * @dd: the infinipath device
+ *
+ * We setup stuff that we use a lot, to avoid calculating each time
+ */
+static void ipath_ht_tidtemplate(struct ipath_devdata *dd)
+{
+        dd->ipath_tidtemplate = dd->ipath_ibmaxlen >> 2;
+        dd->ipath_tidtemplate <<= INFINIPATH_RT_BUFSIZE_SHIFT;
+        dd->ipath_tidtemplate |= INFINIPATH_RT_VALID;
+
+        /*
+         * work around chip errata bug 7358, by marking invalid tids
+         * as having max length
+         */
+        dd->ipath_tidinvalid = (-1LL & INFINIPATH_RT_BUFSIZE_MASK) <<
+                INFINIPATH_RT_BUFSIZE_SHIFT;
+}
+
+static int ipath_ht_early_init(struct ipath_devdata *dd)
+{
+        u32 __iomem *piobuf;
+        u32 pioincr, val32, egrsize;
+        int i;
+
+        /*
+         * one cache line; long IB headers will spill over into received
+         * buffer
+         */
+        dd->ipath_rcvhdrentsize = 16;
+        dd->ipath_rcvhdrsize = IPATH_DFLT_RCVHDRSIZE;
+
+        /*
+         * For HT-400, we allocate a somewhat overly large eager buffer,
+         * such that we can guarantee that we can receive the largest
+         * packet that we can send out.  To truly support a 4KB MTU,
+         * we need to bump this to a large value.  To date, other than
+         * testing, we have never encountered an HCA that can really
+         * send 4KB MTU packets, so we do not handle that (we'll get
+         * errors interrupts if we ever see one).
+         */
+        dd->ipath_rcvegrbufsize = dd->ipath_piosize2k;
+        egrsize = dd->ipath_rcvegrbufsize;
+
+        /*
+         * the min() check here is currently a nop, but it may not
+         * always be, depending on just how we do ipath_rcvegrbufsize
+         */
+        dd->ipath_ibmaxlen = min(dd->ipath_piosize2k,
+                                 dd->ipath_rcvegrbufsize);
+        dd->ipath_init_ibmaxlen = dd->ipath_ibmaxlen;
+        ipath_ht_tidtemplate(dd);
+
+        /*
+         * zero all the TID entries at startup.  We do this for sanity,
+         * in case of a previous driver crash of some kind, and also
+         * because the chip powers up with these memories in an unknown
+         * state.  Use portcnt, not cfgports, since this is for the
+         * full chip, not for current (possibly different) configuration
+         * value.
+         * Chip Errata bug 6447
+         */
+        for (val32 = 0; val32 < dd->ipath_portcnt; val32++)
+                ipath_ht_clear_tids(dd, val32);
+
+        /*
+         * write the pbc of each buffer, to be sure it's initialized, then
+         * cancel all the buffers, and also abort any packets that might
+         * have been in flight for some reason (the latter is for driver
+         * unload/reload, but isn't a bad idea at first init).  PIO send
+         * isn't enabled at this point, so there is no danger of sending
+         * these out on the wire.
+         * Chip Errata bug 6610
+         */
+        piobuf = (u32 __iomem *) (((char __iomem *)(dd->ipath_kregbase)) +
+                                  dd->ipath_piobufbase);
+        pioincr = dd->ipath_palign / sizeof(*piobuf);
+        for (i = 0; i < dd->ipath_piobcnt2k; i++) {
+                /*
+                 * reasonable word count, just to init pbc
+                 */
+                writel(16, piobuf);
+                piobuf += pioincr;
+        }
+        /*
+         * self-clearing
+         */
+        ipath_write_kreg(dd, dd->ipath_kregs->kr_sendctrl,
+                         INFINIPATH_S_ABORT);
+        return 0;
+}
+
+/**
+ * ipath_init_ht_get_base_info - set chip-specific flags for user code
+ * @dd: the infinipath device
+ * @kbase: ipath_base_info pointer
+ *
+ * We set the PCIE flag because the lower bandwidth on PCIe vs
+ * HyperTransport can affect some user packet algorithims.
+ */
+static int ipath_ht_get_base_info(struct ipath_portdata *pd, void *kbase)
+{
+        struct ipath_base_info *kinfo = kbase;
+
+        kinfo->spi_runtime_flags |= IPATH_RUNTIME_HT |
+                IPATH_RUNTIME_RCVHDR_COPY;
+
+        return 0;
+}
+
+/**
+ * ipath_init_ht400_funcs - set up the chip-specific function pointers
+ * @dd: the infinipath device
+ *
+ * This is global, and is called directly at init to set up the
+ * chip-specific function pointers for later use.
+ */
+void ipath_init_ht400_funcs(struct ipath_devdata *dd)
+{
+        dd->ipath_f_intrsetup = ipath_ht_intconfig;
+        dd->ipath_f_bus = ipath_setup_ht_config;
+        dd->ipath_f_reset = ipath_setup_ht_reset;
+        dd->ipath_f_get_boardname = ipath_ht_boardname;
+        dd->ipath_f_init_hwerrors = ipath_ht_init_hwerrors;
+        dd->ipath_f_init_hwerrors = ipath_ht_init_hwerrors;
+        dd->ipath_f_early_init = ipath_ht_early_init;
+        dd->ipath_f_handle_hwerrors = ipath_ht_handle_hwerrors;
+        dd->ipath_f_quiet_serdes = ipath_ht_quiet_serdes;
+        dd->ipath_f_bringup_serdes = ipath_ht_bringup_serdes;
+        dd->ipath_f_clear_tids = ipath_ht_clear_tids;
+        dd->ipath_f_put_tid = ipath_ht_put_tid;
+        dd->ipath_f_cleanup = ipath_setup_ht_cleanup;
+        dd->ipath_f_setextled = ipath_setup_ht_setextled;
+        dd->ipath_f_get_base_info = ipath_ht_get_base_info;
+
+        /*
+         * initialize chip-specific variables
+         */
+        dd->ipath_f_tidtemplate = ipath_ht_tidtemplate;
+
+        /*
+         * setup the register offsets, since they are different for each
+         * chip
+         */
+        dd->ipath_kregs = &ipath_ht_kregs;
+        dd->ipath_cregs = &ipath_ht_cregs;
+
+        /*
+         * do very early init that is needed before ipath_f_bus is
+         * called
+         */
+        ipath_init_ht_variables();
+}
diff --git a/drivers/infiniband/hw/ipath/ipath_init_chip.c b/drivers/infiniband/hw/ipath/ipath_init_chip.c
new file mode 100644
index 000000000000..2823ff9c0c62
--- /dev/null
+++ b/drivers/infiniband/hw/ipath/ipath_init_chip.c
@@ -0,0 +1,951 @@
+/*
+ * Copyright (c) 2003, 2004, 2005, 2006 PathScale, Inc. All rights reserved.
+ *
+ * This software is available to you under a choice of one of two
+ * licenses.  You may choose to be licensed under the terms of the GNU
+ * General Public License (GPL) Version 2, available from the file
+ * COPYING in the main directory of this source tree, or the
+ * OpenIB.org BSD license below:
+ *
+ *     Redistribution and use in source and binary forms, with or
+ *     without modification, are permitted provided that the following
+ *     conditions are met:
+ *
+ *      - Redistributions of source code must retain the above
+ *        copyright notice, this list of conditions and the following
+ *        disclaimer.
+ *
+ *      - Redistributions in binary form must reproduce the above
+ *        copyright notice, this list of conditions and the following
+ *        disclaimer in the documentation and/or other materials
+ *        provided with the distribution.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+ * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+ * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+ * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
+ * BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
+ * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
+ * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+ * SOFTWARE.
+ */
+
+#include <linux/pci.h>
+#include <linux/netdevice.h>
+#include <linux/vmalloc.h>
+
+#include "ipath_kernel.h"
+#include "ips_common.h"
+
+/*
+ * min buffers we want to have per port, after driver
+ */
+#define IPATH_MIN_USER_PORT_BUFCNT 8
+
+/*
+ * Number of ports we are configured to use (to allow for more pio
+ * buffers per port, etc.)  Zero means use chip value.
+ */
+static ushort ipath_cfgports;
+
+module_param_named(cfgports, ipath_cfgports, ushort, S_IRUGO);
+MODULE_PARM_DESC(cfgports, "Set max number of ports to use");
+
+/*
+ * Number of buffers reserved for driver (layered drivers and SMA
+ * send).  Reserved at end of buffer list.
+ */
+static ushort ipath_kpiobufs = 32;
+
+static int ipath_set_kpiobufs(const char *val, struct kernel_param *kp);
+
+module_param_call(kpiobufs, ipath_set_kpiobufs, param_get_uint,
+                  &ipath_kpiobufs, S_IWUSR | S_IRUGO);
+MODULE_PARM_DESC(kpiobufs, "Set number of PIO buffers for driver");
+
+/**
+ * create_port0_egr - allocate the eager TID buffers
+ * @dd: the infinipath device
+ *
+ * This code is now quite different for user and kernel, because
+ * the kernel uses skb's, for the accelerated network performance.
+ * This is the kernel (port0) version.
+ *
+ * Allocate the eager TID buffers and program them into infinipath.
+ * We use the network layer alloc_skb() allocator to allocate the
+ * memory, and either use the buffers as is for things like SMA
+ * packets, or pass the buffers up to the ipath layered driver and
+ * thence the network layer, replacing them as we do so (see
+ * ipath_rcv_layer()).
+ */
+static int create_port0_egr(struct ipath_devdata *dd)
+{
+        unsigned e, egrcnt;
+        struct sk_buff **skbs;
+        int ret;
+
+        egrcnt = dd->ipath_rcvegrcnt;
+
+        skbs = vmalloc(sizeof(*dd->ipath_port0_skbs) * egrcnt);
+        if (skbs == NULL) {
+                ipath_dev_err(dd, "allocation error for eager TID "
+                              "skb array\n");
+                ret = -ENOMEM;
+                goto bail;
+        }
+        for (e = 0; e < egrcnt; e++) {
+                /*
+                 * This is a bit tricky in that we allocate extra
+                 * space for 2 bytes of the 14 byte ethernet header.
+                 * These two bytes are passed in the ipath header so
+                 * the rest of the data is word aligned.  We allocate
+                 * 4 bytes so that the data buffer stays word aligned.
+                 * See ipath_kreceive() for more details.
+                 */
+                skbs[e] = ipath_alloc_skb(dd, GFP_KERNEL);
+                if (!skbs[e]) {
+                        ipath_dev_err(dd, "SKB allocation error for "
+                                      "eager TID %u\n", e);
+                        while (e != 0)
+                                dev_kfree_skb(skbs[--e]);
+                        ret = -ENOMEM;
+                        goto bail;
+                }
+        }
+        /*
+         * After loop above, so we can test non-NULL to see if ready
+         * to use at receive, etc.
+         */
+        dd->ipath_port0_skbs = skbs;
+
+        for (e = 0; e < egrcnt; e++) {
+                unsigned long phys =
+                        virt_to_phys(dd->ipath_port0_skbs[e]->data);
+                dd->ipath_f_put_tid(dd, e + (u64 __iomem *)
+                                    ((char __iomem *) dd->ipath_kregbase +
+                                     dd->ipath_rcvegrbase), 0, phys);
+        }
+
+        ret = 0;
+
+bail:
+        return ret;
+}
+
+static int bringup_link(struct ipath_devdata *dd)
+{
+        u64 val, ibc;
+        int ret = 0;
+
+        /* hold IBC in reset */
+        dd->ipath_control &= ~INFINIPATH_C_LINKENABLE;
+        ipath_write_kreg(dd, dd->ipath_kregs->kr_control,
+                         dd->ipath_control);
+
+        /*
+         * Note that prior to try 14 or 15 of IB, the credit scaling
+         * wasn't working, because it was swapped for writes with the
+         * 1 bit default linkstate field
+         */
+
+        /* ignore pbc and align word */
+        val = dd->ipath_piosize2k - 2 * sizeof(u32);
+        /*
+         * for ICRC, which we only send in diag test pkt mode, and we
+         * don't need to worry about that for mtu
+         */
+        val += 1;
+        /*
+         * Set the IBC maxpktlength to the size of our pio buffers the
+         * maxpktlength is in words.  This is *not* the IB data MTU.
+         */
+        ibc = (val / sizeof(u32)) << INFINIPATH_IBCC_MAXPKTLEN_SHIFT;
+        /* in KB */
+        ibc |= 0x5ULL << INFINIPATH_IBCC_FLOWCTRLWATERMARK_SHIFT;
+        /*
+         * How often flowctrl sent.  More or less in usecs; balance against
+         * watermark value, so that in theory senders always get a flow
+         * control update in time to not let the IB link go idle.
+         */
+        ibc |= 0x3ULL << INFINIPATH_IBCC_FLOWCTRLPERIOD_SHIFT;
+        /* max error tolerance */
+        ibc |= 0xfULL << INFINIPATH_IBCC_PHYERRTHRESHOLD_SHIFT;
+        /* use "real" buffer space for */
+        ibc |= 4ULL << INFINIPATH_IBCC_CREDITSCALE_SHIFT;
+        /* IB credit flow control. */
+        ibc |= 0xfULL << INFINIPATH_IBCC_OVERRUNTHRESHOLD_SHIFT;
+        /* initially come up waiting for TS1, without sending anything. */
+        dd->ipath_ibcctrl = ibc;
+        /*
+         * Want to start out with both LINKCMD and LINKINITCMD in NOP
+         * (0 and 0).  Don't put linkinitcmd in ipath_ibcctrl, want that
+         * to stay a NOP
+         */
+        ibc |= INFINIPATH_IBCC_LINKINITCMD_DISABLE <<
+                INFINIPATH_IBCC_LINKINITCMD_SHIFT;
+        ipath_cdbg(VERBOSE, "Writing 0x%llx to ibcctrl\n",
+                   (unsigned long long) ibc);
+        ipath_write_kreg(dd, dd->ipath_kregs->kr_ibcctrl, ibc);
+
+        // be sure chip saw it
+        val = ipath_read_kreg64(dd, dd->ipath_kregs->kr_scratch);
+
+        ret = dd->ipath_f_bringup_serdes(dd);
+
+        if (ret)
+                dev_info(&dd->pcidev->dev, "Could not initialize SerDes, "
+                         "not usable\n");
+        else {
+                /* enable IBC */
+                dd->ipath_control |= INFINIPATH_C_LINKENABLE;
+                ipath_write_kreg(dd, dd->ipath_kregs->kr_control,
+                                 dd->ipath_control);
+        }
+
+        return ret;
+}
+
+static int init_chip_first(struct ipath_devdata *dd,
+                           struct ipath_portdata **pdp)
+{
+        struct ipath_portdata *pd = NULL;
+        int ret = 0;
+        u64 val;
+
+        /*
+         * skip cfgports stuff because we are not allocating memory,
+         * and we don't want problems if the portcnt changed due to
+         * cfgports.  We do still check and report a difference, if
+         * not same (should be impossible).
+         */
+        dd->ipath_portcnt =
+                ipath_read_kreg32(dd, dd->ipath_kregs->kr_portcnt);
+        if (!ipath_cfgports)
+                dd->ipath_cfgports = dd->ipath_portcnt;
+        else if (ipath_cfgports <= dd->ipath_portcnt) {
+                dd->ipath_cfgports = ipath_cfgports;
+                ipath_dbg("Configured to use %u ports out of %u in chip\n",
+                          dd->ipath_cfgports, dd->ipath_portcnt);
+        } else {
+                dd->ipath_cfgports = dd->ipath_portcnt;
+                ipath_dbg("Tried to configured to use %u ports; chip "
+                          "only supports %u\n", ipath_cfgports,
+                          dd->ipath_portcnt);
+        }
+        dd->ipath_pd = kzalloc(sizeof(*dd->ipath_pd) * dd->ipath_cfgports,
+                               GFP_KERNEL);
+
+        if (!dd->ipath_pd) {
+                ipath_dev_err(dd, "Unable to allocate portdata array, "
+                              "failing\n");
+                ret = -ENOMEM;
+                goto done;
+        }
+
+        dd->ipath_lastegrheads = kzalloc(sizeof(*dd->ipath_lastegrheads)
+                                         * dd->ipath_cfgports,
+                                         GFP_KERNEL);
+        dd->ipath_lastrcvhdrqtails =
+                kzalloc(sizeof(*dd->ipath_lastrcvhdrqtails)
+                        * dd->ipath_cfgports, GFP_KERNEL);
+
+        if (!dd->ipath_lastegrheads || !dd->ipath_lastrcvhdrqtails) {
+                ipath_dev_err(dd, "Unable to allocate head arrays, "
+                              "failing\n");
+                ret = -ENOMEM;
+                goto done;
+        }
+
+        dd->ipath_pd[0] = kzalloc(sizeof(*pd), GFP_KERNEL);
+
+        if (!dd->ipath_pd[0]) {
+                ipath_dev_err(dd, "Unable to allocate portdata for port "
+                              "0, failing\n");
+                ret = -ENOMEM;
+                goto done;
+        }
+        pd = dd->ipath_pd[0];
+        pd->port_dd = dd;
+        pd->port_port = 0;
+        pd->port_cnt = 1;
+        /* The port 0 pkey table is used by the layer interface. */
+        pd->port_pkeys[0] = IPS_DEFAULT_P_KEY;
+        dd->ipath_rcvtidcnt =
+                ipath_read_kreg32(dd, dd->ipath_kregs->kr_rcvtidcnt);
+        dd->ipath_rcvtidbase =
+                ipath_read_kreg32(dd, dd->ipath_kregs->kr_rcvtidbase);
+        dd->ipath_rcvegrcnt =
+                ipath_read_kreg32(dd, dd->ipath_kregs->kr_rcvegrcnt);
+        dd->ipath_rcvegrbase =
+                ipath_read_kreg32(dd, dd->ipath_kregs->kr_rcvegrbase);
+        dd->ipath_palign =
+                ipath_read_kreg32(dd, dd->ipath_kregs->kr_pagealign);
+        dd->ipath_piobufbase =
+                ipath_read_kreg64(dd, dd->ipath_kregs->kr_sendpiobufbase);
+        val = ipath_read_kreg64(dd, dd->ipath_kregs->kr_sendpiosize);
+        dd->ipath_piosize2k = val & ~0U;
+        dd->ipath_piosize4k = val >> 32;
+        dd->ipath_ibmtu = 4096; /* default to largest legal MTU */
+        val = ipath_read_kreg64(dd, dd->ipath_kregs->kr_sendpiobufcnt);
+        dd->ipath_piobcnt2k = val & ~0U;
+        dd->ipath_piobcnt4k = val >> 32;
+        dd->ipath_pio2kbase =
+                (u32 __iomem *) (((char __iomem *) dd->ipath_kregbase) +
+                                 (dd->ipath_piobufbase & 0xffffffff));
+        if (dd->ipath_piobcnt4k) {
+                dd->ipath_pio4kbase = (u32 __iomem *)
+                        (((char __iomem *) dd->ipath_kregbase) +
+                         (dd->ipath_piobufbase >> 32));
+                /*
+                 * 4K buffers take 2 pages; we use roundup just to be
+                 * paranoid; we calculate it once here, rather than on
+                 * ever buf allocate
+                 */
+                dd->ipath_4kalign = ALIGN(dd->ipath_piosize4k,
+                                          dd->ipath_palign);
+                ipath_dbg("%u 2k(%x) piobufs @ %p, %u 4k(%x) @ %p "
+                          "(%x aligned)\n",
+                          dd->ipath_piobcnt2k, dd->ipath_piosize2k,
+                          dd->ipath_pio2kbase, dd->ipath_piobcnt4k,
+                          dd->ipath_piosize4k, dd->ipath_pio4kbase,
+                          dd->ipath_4kalign);
+        }
+        else ipath_dbg("%u 2k piobufs @ %p\n",
+                       dd->ipath_piobcnt2k, dd->ipath_pio2kbase);
+
+        spin_lock_init(&dd->ipath_tid_lock);
+
+done:
+        *pdp = pd;
+        return ret;
+}
+
+/**
+ * init_chip_reset - re-initialize after a reset, or enable
+ * @dd: the infinipath device
+ * @pdp: output for port data
+ *
+ * sanity check at least some of the values after reset, and
+ * ensure no receive or transmit (explictly, in case reset
+ * failed
+ */
+static int init_chip_reset(struct ipath_devdata *dd,
+                           struct ipath_portdata **pdp)
+{
+        struct ipath_portdata *pd;
+        u32 rtmp;
+
+        *pdp = pd = dd->ipath_pd[0];
+        /* ensure chip does no sends or receives while we re-initialize */
+        dd->ipath_control = dd->ipath_sendctrl = dd->ipath_rcvctrl = 0U;
+        ipath_write_kreg(dd, dd->ipath_kregs->kr_rcvctrl, 0);
+        ipath_write_kreg(dd, dd->ipath_kregs->kr_sendctrl, 0);
+        ipath_write_kreg(dd, dd->ipath_kregs->kr_control, 0);
+
+        rtmp = ipath_read_kreg32(dd, dd->ipath_kregs->kr_portcnt);
+        if (dd->ipath_portcnt != rtmp)
+                dev_info(&dd->pcidev->dev, "portcnt was %u before "
+                         "reset, now %u, using original\n",
+                         dd->ipath_portcnt, rtmp);
+        rtmp = ipath_read_kreg32(dd, dd->ipath_kregs->kr_rcvtidcnt);
+        if (rtmp != dd->ipath_rcvtidcnt)
+                dev_info(&dd->pcidev->dev, "tidcnt was %u before "
+                         "reset, now %u, using original\n",
+                         dd->ipath_rcvtidcnt, rtmp);
+        rtmp = ipath_read_kreg32(dd, dd->ipath_kregs->kr_rcvtidbase);
+        if (rtmp != dd->ipath_rcvtidbase)
+                dev_info(&dd->pcidev->dev, "tidbase was %u before "
+                         "reset, now %u, using original\n",
+                         dd->ipath_rcvtidbase, rtmp);
+        rtmp = ipath_read_kreg32(dd, dd->ipath_kregs->kr_rcvegrcnt);
+        if (rtmp != dd->ipath_rcvegrcnt)
+                dev_info(&dd->pcidev->dev, "egrcnt was %u before "
+                         "reset, now %u, using original\n",
+                         dd->ipath_rcvegrcnt, rtmp);
+        rtmp = ipath_read_kreg32(dd, dd->ipath_kregs->kr_rcvegrbase);
+        if (rtmp != dd->ipath_rcvegrbase)
+                dev_info(&dd->pcidev->dev, "egrbase was %u before "
+                         "reset, now %u, using original\n",
+                         dd->ipath_rcvegrbase, rtmp);
+
+        return 0;
+}
+
+static int init_pioavailregs(struct ipath_devdata *dd)
+{
+        int ret;
+
+        dd->ipath_pioavailregs_dma = dma_alloc_coherent(
+                &dd->pcidev->dev, PAGE_SIZE, &dd->ipath_pioavailregs_phys,
+                GFP_KERNEL);
+        if (!dd->ipath_pioavailregs_dma) {
+                ipath_dev_err(dd, "failed to allocate PIOavail reg area "
+                              "in memory\n");
+                ret = -ENOMEM;
+                goto done;
+        }
+
+        /*
+         * we really want L2 cache aligned, but for current CPUs of
+         * interest, they are the same.
+         */
+        dd->ipath_statusp = (u64 *)
+                ((char *)dd->ipath_pioavailregs_dma +
+                 ((2 * L1_CACHE_BYTES +
+                   dd->ipath_pioavregs * sizeof(u64)) & ~L1_CACHE_BYTES));
+        /* copy the current value now that it's really allocated */
+        *dd->ipath_statusp = dd->_ipath_status;
+        /*
+         * setup buffer to hold freeze msg, accessible to apps,
+         * following statusp
+         */
+        dd->ipath_freezemsg = (char *)&dd->ipath_statusp[1];
+        /* and its length */
+        dd->ipath_freezelen = L1_CACHE_BYTES - sizeof(dd->ipath_statusp[0]);
+
+        if (dd->ipath_unit * 64 > (IPATH_PORT0_RCVHDRTAIL_SIZE - 64)) {
+                ipath_dev_err(dd, "unit %u too large for port 0 "
+                              "rcvhdrtail buffer size\n", dd->ipath_unit);
+                ret = -ENODEV;
+        }
+        else
+                ret = 0;
+
+        /* so we can get current tail in ipath_kreceive(), per chip */
+        dd->ipath_hdrqtailptr = &ipath_port0_rcvhdrtail[
+                dd->ipath_unit * (64 / sizeof(*ipath_port0_rcvhdrtail))];
+done:
+        return ret;
+}
+
+/**
+ * init_shadow_tids - allocate the shadow TID array
+ * @dd: the infinipath device
+ *
+ * allocate the shadow TID array, so we can ipath_munlock previous
+ * entries.  It may make more sense to move the pageshadow to the
+ * port data structure, so we only allocate memory for ports actually
+ * in use, since we at 8k per port, now.
+ */
+static void init_shadow_tids(struct ipath_devdata *dd)
+{
+        dd->ipath_pageshadow = (struct page **)
+                vmalloc(dd->ipath_cfgports * dd->ipath_rcvtidcnt *
+                        sizeof(struct page *));
+        if (!dd->ipath_pageshadow)
+                ipath_dev_err(dd, "failed to allocate shadow page * "
+                              "array, no expected sends!\n");
+        else
+                memset(dd->ipath_pageshadow, 0,
+                       dd->ipath_cfgports * dd->ipath_rcvtidcnt *
+                       sizeof(struct page *));
+}
+
+static void enable_chip(struct ipath_devdata *dd,
+                        struct ipath_portdata *pd, int reinit)
+{
+        u32 val;
+        int i;
+
+        if (!reinit) {
+                init_waitqueue_head(&ipath_sma_state_wait);
+        }
+        ipath_write_kreg(dd, dd->ipath_kregs->kr_rcvctrl,
+                         dd->ipath_rcvctrl);
+
+        /* Enable PIO send, and update of PIOavail regs to memory. */
+        dd->ipath_sendctrl = INFINIPATH_S_PIOENABLE |
+                INFINIPATH_S_PIOBUFAVAILUPD;
+        ipath_write_kreg(dd, dd->ipath_kregs->kr_sendctrl,
+                         dd->ipath_sendctrl);
+
+        /*
+         * enable port 0 receive, and receive interrupt.  other ports
+         * done as user opens and inits them.
+         */
+        dd->ipath_rcvctrl = INFINIPATH_R_TAILUPD |
+                (1ULL << INFINIPATH_R_PORTENABLE_SHIFT) |
+                (1ULL << INFINIPATH_R_INTRAVAIL_SHIFT);
+        ipath_write_kreg(dd, dd->ipath_kregs->kr_rcvctrl,
+                         dd->ipath_rcvctrl);
+
+        /*
+         * now ready for use.  this should be cleared whenever we
+         * detect a reset, or initiate one.
+         */
+        dd->ipath_flags |= IPATH_INITTED;
+
+        /*
+         * init our shadow copies of head from tail values, and write
+         * head values to match.
+         */
+        val = ipath_read_ureg32(dd, ur_rcvegrindextail, 0);
+        (void)ipath_write_ureg(dd, ur_rcvegrindexhead, val, 0);
+        dd->ipath_port0head = ipath_read_ureg32(dd, ur_rcvhdrtail, 0);
+
+        /* Initialize so we interrupt on next packet received */
+        (void)ipath_write_ureg(dd, ur_rcvhdrhead,
+                               dd->ipath_rhdrhead_intr_off |
+                               dd->ipath_port0head, 0);
+
+        /*
+         * by now pioavail updates to memory should have occurred, so
+         * copy them into our working/shadow registers; this is in
+         * case something went wrong with abort, but mostly to get the
+         * initial values of the generation bit correct.
+         */
+        for (i = 0; i < dd->ipath_pioavregs; i++) {
+                __le64 val;
+
+                /*
+                 * Chip Errata bug 6641; even and odd qwords>3 are swapped.
+                 */
+                if (i > 3) {
+                        if (i & 1)
+                                val = dd->ipath_pioavailregs_dma[i - 1];
+                        else
+                                val = dd->ipath_pioavailregs_dma[i + 1];
+                }
+                else
+                        val = dd->ipath_pioavailregs_dma[i];
+                dd->ipath_pioavailshadow[i] = le64_to_cpu(val);
+        }
+        /* can get counters, stats, etc. */
+        dd->ipath_flags |= IPATH_PRESENT;
+}
+
+static int init_housekeeping(struct ipath_devdata *dd,
+                             struct ipath_portdata **pdp, int reinit)
+{
+        char boardn[32];
+        int ret = 0;
+
+        /*
+         * have to clear shadow copies of registers at init that are
+         * not otherwise set here, or all kinds of bizarre things
+         * happen with driver on chip reset
+         */
+        dd->ipath_rcvhdrsize = 0;
+
+        /*
+         * Don't clear ipath_flags as 8bit mode was set before
+         * entering this func. However, we do set the linkstate to
+         * unknown, so we can watch for a transition.
+         */
+        dd->ipath_flags |= IPATH_LINKUNK;
+        dd->ipath_flags &= ~(IPATH_LINKACTIVE | IPATH_LINKARMED |
+                             IPATH_LINKDOWN | IPATH_LINKINIT);
+
+        ipath_cdbg(VERBOSE, "Try to read spc chip revision\n");
+        dd->ipath_revision =
+                ipath_read_kreg64(dd, dd->ipath_kregs->kr_revision);
+
+        /*
+         * set up fundamental info we need to use the chip; we assume
+         * if the revision reg and these regs are OK, we don't need to
+         * special case the rest
+         */
+        dd->ipath_sregbase =
+                ipath_read_kreg32(dd, dd->ipath_kregs->kr_sendregbase);
+        dd->ipath_cregbase =
+                ipath_read_kreg32(dd, dd->ipath_kregs->kr_counterregbase);
+        dd->ipath_uregbase =
+                ipath_read_kreg32(dd, dd->ipath_kregs->kr_userregbase);
+        ipath_cdbg(VERBOSE, "ipath_kregbase %p, sendbase %x usrbase %x, "
+                   "cntrbase %x\n", dd->ipath_kregbase, dd->ipath_sregbase,
+                   dd->ipath_uregbase, dd->ipath_cregbase);
+        if ((dd->ipath_revision & 0xffffffff) == 0xffffffff
+            || (dd->ipath_sregbase & 0xffffffff) == 0xffffffff
+            || (dd->ipath_cregbase & 0xffffffff) == 0xffffffff
+            || (dd->ipath_uregbase & 0xffffffff) == 0xffffffff) {
+                ipath_dev_err(dd, "Register read failures from chip, "
+                              "giving up initialization\n");
+                ret = -ENODEV;
+                goto done;
+        }
+
+        /* clear the initial reset flag, in case first driver load */
+        ipath_write_kreg(dd, dd->ipath_kregs->kr_errorclear,
+                         INFINIPATH_E_RESET);
+
+        if (reinit)
+                ret = init_chip_reset(dd, pdp);
+        else
+                ret = init_chip_first(dd, pdp);
+
+        if (ret)
+                goto done;
+
+        ipath_cdbg(VERBOSE, "Revision %llx (PCI %x), %u ports, %u tids, "
+                   "%u egrtids\n", (unsigned long long) dd->ipath_revision,
+                   dd->ipath_pcirev, dd->ipath_portcnt, dd->ipath_rcvtidcnt,
+                   dd->ipath_rcvegrcnt);
+
+        if (((dd->ipath_revision >> INFINIPATH_R_SOFTWARE_SHIFT) &
+             INFINIPATH_R_SOFTWARE_MASK) != IPATH_CHIP_SWVERSION) {
+                ipath_dev_err(dd, "Driver only handles version %d, "
+                              "chip swversion is %d (%llx), failng\n",
+                              IPATH_CHIP_SWVERSION,
+                              (int)(dd->ipath_revision >>
+                                    INFINIPATH_R_SOFTWARE_SHIFT) &
+                              INFINIPATH_R_SOFTWARE_MASK,
+                              (unsigned long long) dd->ipath_revision);
+                ret = -ENOSYS;
+                goto done;
+        }
+        dd->ipath_majrev = (u8) ((dd->ipath_revision >>
+                                  INFINIPATH_R_CHIPREVMAJOR_SHIFT) &
+                                 INFINIPATH_R_CHIPREVMAJOR_MASK);
+        dd->ipath_minrev = (u8) ((dd->ipath_revision >>
+                                  INFINIPATH_R_CHIPREVMINOR_SHIFT) &
+                                 INFINIPATH_R_CHIPREVMINOR_MASK);
+        dd->ipath_boardrev = (u8) ((dd->ipath_revision >>
+                                    INFINIPATH_R_BOARDID_SHIFT) &
+                                   INFINIPATH_R_BOARDID_MASK);
+
+        ret = dd->ipath_f_get_boardname(dd, boardn, sizeof boardn);
+
+        snprintf(dd->ipath_boardversion, sizeof(dd->ipath_boardversion),
+                 "Driver %u.%u, %s, InfiniPath%u %u.%u, PCI %u, "
+                 "SW Compat %u\n",
+                 IPATH_CHIP_VERS_MAJ, IPATH_CHIP_VERS_MIN, boardn,
+                 (unsigned)(dd->ipath_revision >> INFINIPATH_R_ARCH_SHIFT) &
+                 INFINIPATH_R_ARCH_MASK,
+                 dd->ipath_majrev, dd->ipath_minrev, dd->ipath_pcirev,
+                 (unsigned)(dd->ipath_revision >>
+                            INFINIPATH_R_SOFTWARE_SHIFT) &
+                 INFINIPATH_R_SOFTWARE_MASK);
+
+        ipath_dbg("%s", dd->ipath_boardversion);
+
+done:
+        return ret;
+}
+
+
+/**
+ * ipath_init_chip - do the actual initialization sequence on the chip
+ * @dd: the infinipath device
+ * @reinit: reinitializing, so don't allocate new memory
+ *
+ * Do the actual initialization sequence on the chip.  This is done
+ * both from the init routine called from the PCI infrastructure, and
+ * when we reset the chip, or detect that it was reset internally,
+ * or it's administratively re-enabled.
+ *
+ * Memory allocation here and in called routines is only done in
+ * the first case (reinit == 0).  We have to be careful, because even
+ * without memory allocation, we need to re-write all the chip registers
+ * TIDs, etc. after the reset or enable has completed.
+ */
+int ipath_init_chip(struct ipath_devdata *dd, int reinit)
+{
+        int ret = 0, i;
+        u32 val32, kpiobufs;
+        u64 val, atmp;
+        struct ipath_portdata *pd = NULL; /* keep gcc4 happy */
+
+        ret = init_housekeeping(dd, &pd, reinit);
+        if (ret)
+                goto done;
+
+        /*
+         * we ignore most issues after reporting them, but have to specially
+         * handle hardware-disabled chips.
+         */
+        if (ret == 2) {
+                /* unique error, known to ipath_init_one */
+                ret = -EPERM;
+                goto done;
+        }
+
+        /*
+         * We could bump this to allow for full rcvegrcnt + rcvtidcnt,
+         * but then it no longer nicely fits power of two, and since
+         * we now use routines that backend onto __get_free_pages, the
+         * rest would be wasted.
+         */
+        dd->ipath_rcvhdrcnt = dd->ipath_rcvegrcnt;
+        ipath_write_kreg(dd, dd->ipath_kregs->kr_rcvhdrcnt,
+                         dd->ipath_rcvhdrcnt);
+
+        /*
+         * Set up the shadow copies of the piobufavail registers,
+         * which we compare against the chip registers for now, and
+         * the in memory DMA'ed copies of the registers.  This has to
+         * be done early, before we calculate lastport, etc.
+         */
+        val = dd->ipath_piobcnt2k + dd->ipath_piobcnt4k;
+        /*
+         * calc number of pioavail registers, and save it; we have 2
+         * bits per buffer.
+         */
+        dd->ipath_pioavregs = ALIGN(val, sizeof(u64) * BITS_PER_BYTE / 2)
+                / (sizeof(u64) * BITS_PER_BYTE / 2);
+        if (!ipath_kpiobufs)    /* have to have at least 1, for SMA */
+                kpiobufs = ipath_kpiobufs = 1;
+        else if ((dd->ipath_piobcnt2k + dd->ipath_piobcnt4k) <
+                 (dd->ipath_cfgports * IPATH_MIN_USER_PORT_BUFCNT)) {
+                dev_info(&dd->pcidev->dev, "Too few PIO buffers (%u) "
+                         "for %u ports to have %u each!\n",
+                         dd->ipath_piobcnt2k + dd->ipath_piobcnt4k,
+                         dd->ipath_cfgports, IPATH_MIN_USER_PORT_BUFCNT);
+                kpiobufs = 1;   /* reserve just the minimum for SMA/ether */
+        } else
+                kpiobufs = ipath_kpiobufs;
+
+        if (kpiobufs >
+            (dd->ipath_piobcnt2k + dd->ipath_piobcnt4k -
+             (dd->ipath_cfgports * IPATH_MIN_USER_PORT_BUFCNT))) {
+                i = dd->ipath_piobcnt2k + dd->ipath_piobcnt4k -
+                        (dd->ipath_cfgports * IPATH_MIN_USER_PORT_BUFCNT);
+                if (i < 0)
+                        i = 0;
+                dev_info(&dd->pcidev->dev, "Allocating %d PIO bufs for "
+                         "kernel leaves too few for %d user ports "
+                         "(%d each); using %u\n", kpiobufs,
+                         dd->ipath_cfgports - 1,
+                         IPATH_MIN_USER_PORT_BUFCNT, i);
+                /*
+                 * shouldn't change ipath_kpiobufs, because could be
+                 * different for different devices...
+                 */
+                kpiobufs = i;
+        }
+        dd->ipath_lastport_piobuf =
+                dd->ipath_piobcnt2k + dd->ipath_piobcnt4k - kpiobufs;
+        dd->ipath_pbufsport = dd->ipath_cfgports > 1
+                ? dd->ipath_lastport_piobuf / (dd->ipath_cfgports - 1)
+                : 0;
+        val32 = dd->ipath_lastport_piobuf -
+                (dd->ipath_pbufsport * (dd->ipath_cfgports - 1));
+        if (val32 > 0) {
+                ipath_dbg("allocating %u pbufs/port leaves %u unused, "
+                          "add to kernel\n", dd->ipath_pbufsport, val32);
+                dd->ipath_lastport_piobuf -= val32;
+                ipath_dbg("%u pbufs/port leaves %u unused, add to kernel\n",
+                          dd->ipath_pbufsport, val32);
+        }
+        dd->ipath_lastpioindex = dd->ipath_lastport_piobuf;
+        ipath_cdbg(VERBOSE, "%d PIO bufs for kernel out of %d total %u "
+                   "each for %u user ports\n", kpiobufs,
+                   dd->ipath_piobcnt2k + dd->ipath_piobcnt4k,
+                   dd->ipath_pbufsport, dd->ipath_cfgports - 1);
+
+        dd->ipath_f_early_init(dd);
+
+        /* early_init sets rcvhdrentsize and rcvhdrsize, so this must be
+         * done after early_init */
+        dd->ipath_hdrqlast =
+                dd->ipath_rcvhdrentsize * (dd->ipath_rcvhdrcnt - 1);
+        ipath_write_kreg(dd, dd->ipath_kregs->kr_rcvhdrentsize,
+                         dd->ipath_rcvhdrentsize);
+        ipath_write_kreg(dd, dd->ipath_kregs->kr_rcvhdrsize,
+                         dd->ipath_rcvhdrsize);
+
+        if (!reinit) {
+                ret = init_pioavailregs(dd);
+                init_shadow_tids(dd);
+                if (ret)
+                        goto done;
+        }
+
+        (void)ipath_write_kreg(dd, dd->ipath_kregs->kr_sendpioavailaddr,
+                               dd->ipath_pioavailregs_phys);
+        /*
+         * this is to detect s/w errors, which the h/w works around by
+         * ignoring the low 6 bits of address, if it wasn't aligned.
+         */
+        val = ipath_read_kreg64(dd, dd->ipath_kregs->kr_sendpioavailaddr);
+        if (val != dd->ipath_pioavailregs_phys) {
+                ipath_dev_err(dd, "Catastrophic software error, "
+                              "SendPIOAvailAddr written as %lx, "
+                              "read back as %llx\n",
+                              (unsigned long) dd->ipath_pioavailregs_phys,
+                              (unsigned long long) val);
+                ret = -EINVAL;
+                goto done;
+        }
+
+        val = ipath_port0_rcvhdrtail_dma + dd->ipath_unit * 64;
+
+        /* verify that the alignment requirement was met */
+        ipath_write_kreg_port(dd, dd->ipath_kregs->kr_rcvhdrtailaddr,
+                              0, val);
+        atmp = ipath_read_kreg64_port(
+                dd, dd->ipath_kregs->kr_rcvhdrtailaddr, 0);
+        if (val != atmp) {
+                ipath_dev_err(dd, "Catastrophic software error, "
+                              "RcvHdrTailAddr0 written as %llx, "
+                              "read back as %llx from %x\n",
+                              (unsigned long long) val,
+                              (unsigned long long) atmp,
+                              dd->ipath_kregs->kr_rcvhdrtailaddr);
+                ret = -EINVAL;
+                goto done;
+        }
+
+        ipath_write_kreg(dd, dd->ipath_kregs->kr_rcvbthqp, IPATH_KD_QP);
+
+        /*
+         * make sure we are not in freeze, and PIO send enabled, so
+         * writes to pbc happen
+         */
+        ipath_write_kreg(dd, dd->ipath_kregs->kr_hwerrmask, 0ULL);
+        ipath_write_kreg(dd, dd->ipath_kregs->kr_hwerrclear,
+                         ~0ULL&~INFINIPATH_HWE_MEMBISTFAILED);
+        ipath_write_kreg(dd, dd->ipath_kregs->kr_control, 0ULL);
+        ipath_write_kreg(dd, dd->ipath_kregs->kr_sendctrl,
+                         INFINIPATH_S_PIOENABLE);
+
+        /*
+         * before error clears, since we expect serdes pll errors during
+         * this, the first time after reset
+         */
+        if (bringup_link(dd)) {
+                dev_info(&dd->pcidev->dev, "Failed to bringup IB link\n");
+                ret = -ENETDOWN;
+                goto done;
+        }
+
+        /*
+         * clear any "expected" hwerrs from reset and/or initialization
+         * clear any that aren't enabled (at least this once), and then
+         * set the enable mask
+         */
+        dd->ipath_f_init_hwerrors(dd);
+        ipath_write_kreg(dd, dd->ipath_kregs->kr_hwerrclear,
+                         ~0ULL&~INFINIPATH_HWE_MEMBISTFAILED);
+        ipath_write_kreg(dd, dd->ipath_kregs->kr_hwerrmask,
+                         dd->ipath_hwerrmask);
+
+        dd->ipath_maskederrs = dd->ipath_ignorederrs;
+        /* clear all */
+        ipath_write_kreg(dd, dd->ipath_kregs->kr_errorclear, -1LL);
+        /* enable errors that are masked, at least this first time. */
+        ipath_write_kreg(dd, dd->ipath_kregs->kr_errormask,
+                         ~dd->ipath_maskederrs);
+        /* clear any interrups up to this point (ints still not enabled) */
+        ipath_write_kreg(dd, dd->ipath_kregs->kr_intclear, -1LL);
+
+        ipath_stats.sps_lid[dd->ipath_unit] = dd->ipath_lid;
+
+        /*
+         * Set up the port 0 (kernel) rcvhdr q and egr TIDs.  If doing
+         * re-init, the simplest way to handle this is to free
+         * existing, and re-allocate.
+         */
+        if (reinit)
+                ipath_free_pddata(dd, 0, 0);
+        dd->ipath_f_tidtemplate(dd);
+        ret = ipath_create_rcvhdrq(dd, pd);
+        if (!ret)
+                ret = create_port0_egr(dd);
+        if (ret)
+                ipath_dev_err(dd, "failed to allocate port 0 (kernel) "
+                              "rcvhdrq and/or egr bufs\n");
+        else
+                enable_chip(dd, pd, reinit);
+
+        /*
+         * cause retrigger of pending interrupts ignored during init,
+         * even if we had errors
+         */
+        ipath_write_kreg(dd, dd->ipath_kregs->kr_intclear, 0ULL);
+
+        if(!dd->ipath_stats_timer_active) {
+                /*
+                 * first init, or after an admin disable/enable
+                 * set up stats retrieval timer, even if we had errors
+                 * in last portion of setup
+                 */
+                init_timer(&dd->ipath_stats_timer);
+                dd->ipath_stats_timer.function = ipath_get_faststats;
+                dd->ipath_stats_timer.data = (unsigned long) dd;
+                /* every 5 seconds; */
+                dd->ipath_stats_timer.expires = jiffies + 5 * HZ;
+                /* takes ~16 seconds to overflow at full IB 4x bandwdith */
+                add_timer(&dd->ipath_stats_timer);
+                dd->ipath_stats_timer_active = 1;
+        }
+
+done:
+        if (!ret) {
+                ipath_get_guid(dd);
+                *dd->ipath_statusp |= IPATH_STATUS_CHIP_PRESENT;
+                if (!dd->ipath_f_intrsetup(dd)) {
+                        /* now we can enable all interrupts from the chip */
+                        ipath_write_kreg(dd, dd->ipath_kregs->kr_intmask,
+                                         -1LL);
+                        /* force re-interrupt of any pending interrupts. */
+                        ipath_write_kreg(dd, dd->ipath_kregs->kr_intclear,
+                                         0ULL);
+                        /* chip is usable; mark it as initialized */
+                        *dd->ipath_statusp |= IPATH_STATUS_INITTED;
+                } else
+                        ipath_dev_err(dd, "No interrupts enabled, couldn't "
+                                      "setup interrupt address\n");
+
+                if (dd->ipath_cfgports > ipath_stats.sps_nports)
+                        /*
+                         * sps_nports is a global, so, we set it to
+                         * the highest number of ports of any of the
+                         * chips we find; we never decrement it, at
+                         * least for now.  Since this might have changed
+                         * over disable/enable or prior to reset, always
+                         * do the check and potentially adjust.
+                         */
+                        ipath_stats.sps_nports = dd->ipath_cfgports;
+        } else
+                ipath_dbg("Failed (%d) to initialize chip\n", ret);
+
+        /* if ret is non-zero, we probably should do some cleanup
+           here... */
+        return ret;
+}
+
+static int ipath_set_kpiobufs(const char *str, struct kernel_param *kp)
+{
+        struct ipath_devdata *dd;
+        unsigned long flags;
+        unsigned short val;
+        int ret;
+
+        ret = ipath_parse_ushort(str, &val);
+
+        spin_lock_irqsave(&ipath_devs_lock, flags);
+
+        if (ret < 0)
+                goto bail;
+
+        if (val == 0) {
+                ret = -EINVAL;
+                goto bail;
+        }
+
+        list_for_each_entry(dd, &ipath_dev_list, ipath_list) {
+                if (dd->ipath_kregbase)
+                        continue;
+                if (val > (dd->ipath_piobcnt2k + dd->ipath_piobcnt4k -
+                           (dd->ipath_cfgports *
+                            IPATH_MIN_USER_PORT_BUFCNT)))
+                {
+                        ipath_dev_err(
+                                dd,
+                                "Allocating %d PIO bufs for kernel leaves "
+                                "too few for %d user ports (%d each)\n",
+                                val, dd->ipath_cfgports - 1,
+                                IPATH_MIN_USER_PORT_BUFCNT);
+                        ret = -EINVAL;
+                        goto bail;
+                }
+                dd->ipath_lastport_piobuf =
+                        dd->ipath_piobcnt2k + dd->ipath_piobcnt4k - val;
+        }
+
+        ret = 0;
+bail:
+        spin_unlock_irqrestore(&ipath_devs_lock, flags);
+
+        return ret;
+}
diff --git a/drivers/infiniband/hw/ipath/ipath_intr.c b/drivers/infiniband/hw/ipath/ipath_intr.c
new file mode 100644
index 000000000000..60f5f4108069
--- /dev/null
+++ b/drivers/infiniband/hw/ipath/ipath_intr.c
@@ -0,0 +1,841 @@
+/*
+ * Copyright (c) 2003, 2004, 2005, 2006 PathScale, Inc. All rights reserved.
+ *
+ * This software is available to you under a choice of one of two
+ * licenses.  You may choose to be licensed under the terms of the GNU
+ * General Public License (GPL) Version 2, available from the file
+ * COPYING in the main directory of this source tree, or the
+ * OpenIB.org BSD license below:
+ *
+ *     Redistribution and use in source and binary forms, with or
+ *     without modification, are permitted provided that the following
+ *     conditions are met:
+ *
+ *      - Redistributions of source code must retain the above
+ *        copyright notice, this list of conditions and the following
+ *        disclaimer.
+ *
+ *      - Redistributions in binary form must reproduce the above
+ *        copyright notice, this list of conditions and the following
+ *        disclaimer in the documentation and/or other materials
+ *        provided with the distribution.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+ * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+ * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+ * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
+ * BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
+ * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
+ * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+ * SOFTWARE.
+ */
+
+#include <linux/pci.h>
+
+#include "ipath_kernel.h"
+#include "ips_common.h"
+#include "ipath_layer.h"
+
+#define E_SUM_PKTERRS \
+        (INFINIPATH_E_RHDRLEN | INFINIPATH_E_RBADTID | \
+         INFINIPATH_E_RBADVERSION | INFINIPATH_E_RHDR | \
+         INFINIPATH_E_RLONGPKTLEN | INFINIPATH_E_RSHORTPKTLEN | \
+         INFINIPATH_E_RMAXPKTLEN | INFINIPATH_E_RMINPKTLEN | \
+         INFINIPATH_E_RFORMATERR | INFINIPATH_E_RUNSUPVL | \
+         INFINIPATH_E_RUNEXPCHAR | INFINIPATH_E_REBP)
+
+#define E_SUM_ERRS \
+        (INFINIPATH_E_SPIOARMLAUNCH | INFINIPATH_E_SUNEXPERRPKTNUM | \
+         INFINIPATH_E_SDROPPEDDATAPKT | INFINIPATH_E_SDROPPEDSMPPKT | \
+         INFINIPATH_E_SMAXPKTLEN | INFINIPATH_E_SUNSUPVL | \
+         INFINIPATH_E_SMINPKTLEN | INFINIPATH_E_SPKTLEN | \
+         INFINIPATH_E_INVALIDADDR)
+
+static u64 handle_e_sum_errs(struct ipath_devdata *dd, ipath_err_t errs)
+{
+        unsigned long sbuf[4];
+        u64 ignore_this_time = 0;
+        u32 piobcnt;
+
+        /* if possible that sendbuffererror could be valid */
+        piobcnt = dd->ipath_piobcnt2k + dd->ipath_piobcnt4k;
+        /* read these before writing errorclear */
+        sbuf[0] = ipath_read_kreg64(
+                dd, dd->ipath_kregs->kr_sendbuffererror);
+        sbuf[1] = ipath_read_kreg64(
+                dd, dd->ipath_kregs->kr_sendbuffererror + 1);
+        if (piobcnt > 128) {
+                sbuf[2] = ipath_read_kreg64(
+                        dd, dd->ipath_kregs->kr_sendbuffererror + 2);
+                sbuf[3] = ipath_read_kreg64(
+                        dd, dd->ipath_kregs->kr_sendbuffererror + 3);
+        }
+
+        if (sbuf[0] || sbuf[1] || (piobcnt > 128 && (sbuf[2] || sbuf[3]))) {
+                int i;
+
+                ipath_cdbg(PKT, "SendbufErrs %lx %lx ", sbuf[0], sbuf[1]);
+                if (ipath_debug & __IPATH_PKTDBG && piobcnt > 128)
+                        printk("%lx %lx ", sbuf[2], sbuf[3]);
+                for (i = 0; i < piobcnt; i++) {
+                        if (test_bit(i, sbuf)) {
+                                u32 __iomem *piobuf;
+                                if (i < dd->ipath_piobcnt2k)
+                                        piobuf = (u32 __iomem *)
+                                                (dd->ipath_pio2kbase +
+                                                 i * dd->ipath_palign);
+                                else
+                                        piobuf = (u32 __iomem *)
+                                                (dd->ipath_pio4kbase +
+                                                 (i - dd->ipath_piobcnt2k) *
+                                                 dd->ipath_4kalign);
+
+                                ipath_cdbg(PKT,
+                                           "PIObuf[%u] @%p pbc is %x; ",
+                                           i, piobuf, readl(piobuf));
+
+                                ipath_disarm_piobufs(dd, i, 1);
+                        }
+                }
+                if (ipath_debug & __IPATH_PKTDBG)
+                        printk("\n");
+        }
+        if ((errs & (INFINIPATH_E_SDROPPEDDATAPKT |
+                     INFINIPATH_E_SDROPPEDSMPPKT |
+                     INFINIPATH_E_SMINPKTLEN)) &&
+            !(dd->ipath_flags & IPATH_LINKACTIVE)) {
+                /*
+                 * This can happen when SMA is trying to bring the link
+                 * up, but the IB link changes state at the "wrong" time.
+                 * The IB logic then complains that the packet isn't
+                 * valid.  We don't want to confuse people, so we just
+                 * don't print them, except at debug
+                 */
+                ipath_dbg("Ignoring pktsend errors %llx, because not "
+                          "yet active\n", (unsigned long long) errs);
+                ignore_this_time = INFINIPATH_E_SDROPPEDDATAPKT |
+                        INFINIPATH_E_SDROPPEDSMPPKT |
+                        INFINIPATH_E_SMINPKTLEN;
+        }
+
+        return ignore_this_time;
+}
+
+/* return the strings for the most common link states */
+static char *ib_linkstate(u32 linkstate)
+{
+        char *ret;
+
+        switch (linkstate) {
+        case IPATH_IBSTATE_INIT:
+                ret = "Init";
+                break;
+        case IPATH_IBSTATE_ARM:
+                ret = "Arm";
+                break;
+        case IPATH_IBSTATE_ACTIVE:
+                ret = "Active";
+                break;
+        default:
+                ret = "Down";
+        }
+
+        return ret;
+}
+
+static void handle_e_ibstatuschanged(struct ipath_devdata *dd,
+                                     ipath_err_t errs, int noprint)
+{
+        u64 val;
+        u32 ltstate, lstate;
+
+        /*
+         * even if diags are enabled, we want to notice LINKINIT, etc.
+         * We just don't want to change the LED state, or
+         * dd->ipath_kregs->kr_ibcctrl
+         */
+        val = ipath_read_kreg64(dd, dd->ipath_kregs->kr_ibcstatus);
+        lstate = val & IPATH_IBSTATE_MASK;
+        if (lstate == IPATH_IBSTATE_INIT || lstate == IPATH_IBSTATE_ARM ||
+            lstate == IPATH_IBSTATE_ACTIVE) {
+                /*
+                 * only print at SMA if there is a change, debug if not
+                 * (sometimes we want to know that, usually not).
+                 */
+                if (lstate == ((unsigned) dd->ipath_lastibcstat
+                               & IPATH_IBSTATE_MASK)) {
+                        ipath_dbg("Status change intr but no change (%s)\n",
+                                  ib_linkstate(lstate));
+                }
+                else
+                        ipath_cdbg(SMA, "Unit %u link state %s, last "
+                                   "was %s\n", dd->ipath_unit,
+                                   ib_linkstate(lstate),
+                                   ib_linkstate((unsigned)
+                                                dd->ipath_lastibcstat
+                                                & IPATH_IBSTATE_MASK));
+        }
+        else {
+                lstate = dd->ipath_lastibcstat & IPATH_IBSTATE_MASK;
+                if (lstate == IPATH_IBSTATE_INIT ||
+                    lstate == IPATH_IBSTATE_ARM ||
+                    lstate == IPATH_IBSTATE_ACTIVE)
+                        ipath_cdbg(SMA, "Unit %u link state down"
+                                   " (state 0x%x), from %s\n",
+                                   dd->ipath_unit,
+                                   (u32)val & IPATH_IBSTATE_MASK,
+                                   ib_linkstate(lstate));
+                else
+                        ipath_cdbg(VERBOSE, "Unit %u link state changed "
+                                   "to 0x%x from down (%x)\n",
+                                   dd->ipath_unit, (u32) val, lstate);
+        }
+        ltstate = (val >> INFINIPATH_IBCS_LINKTRAININGSTATE_SHIFT) &
+                INFINIPATH_IBCS_LINKTRAININGSTATE_MASK;
+        lstate = (val >> INFINIPATH_IBCS_LINKSTATE_SHIFT) &
+                INFINIPATH_IBCS_LINKSTATE_MASK;
+
+        if (ltstate == INFINIPATH_IBCS_LT_STATE_POLLACTIVE ||
+            ltstate == INFINIPATH_IBCS_LT_STATE_POLLQUIET) {
+                u32 last_ltstate;
+
+                /*
+                 * Ignore cycling back and forth from Polling.Active
+                 * to Polling.Quiet while waiting for the other end of
+                 * the link to come up. We will cycle back and forth
+                 * between them if no cable is plugged in,
+                 * the other device is powered off or disabled, etc.
+                 */
+                last_ltstate = (dd->ipath_lastibcstat >>
+                                INFINIPATH_IBCS_LINKTRAININGSTATE_SHIFT)
+                        & INFINIPATH_IBCS_LINKTRAININGSTATE_MASK;
+                if (last_ltstate == INFINIPATH_IBCS_LT_STATE_POLLACTIVE
+                    || last_ltstate ==
+                    INFINIPATH_IBCS_LT_STATE_POLLQUIET) {
+                        if (dd->ipath_ibpollcnt > 40) {
+                                dd->ipath_flags |= IPATH_NOCABLE;
+                                *dd->ipath_statusp |=
+                                        IPATH_STATUS_IB_NOCABLE;
+                        } else
+                                dd->ipath_ibpollcnt++;
+                        goto skip_ibchange;
+                }
+        }
+        dd->ipath_ibpollcnt = 0;        /* some state other than 2 or 3 */
+        ipath_stats.sps_iblink++;
+        if (ltstate != INFINIPATH_IBCS_LT_STATE_LINKUP) {
+                dd->ipath_flags |= IPATH_LINKDOWN;
+                dd->ipath_flags &= ~(IPATH_LINKUNK | IPATH_LINKINIT
+                                     | IPATH_LINKACTIVE |
+                                     IPATH_LINKARMED);
+                *dd->ipath_statusp &= ~IPATH_STATUS_IB_READY;
+                if (!noprint) {
+                        if (((dd->ipath_lastibcstat >>
+                              INFINIPATH_IBCS_LINKSTATE_SHIFT) &
+                             INFINIPATH_IBCS_LINKSTATE_MASK)
+                            == INFINIPATH_IBCS_L_STATE_ACTIVE)
+                                /* if from up to down be more vocal */
+                                ipath_cdbg(SMA,
+                                           "Unit %u link now down (%s)\n",
+                                           dd->ipath_unit,
+                                           ipath_ibcstatus_str[ltstate]);
+                        else
+                                ipath_cdbg(VERBOSE, "Unit %u link is "
+                                           "down (%s)\n", dd->ipath_unit,
+                                           ipath_ibcstatus_str[ltstate]);
+                }
+
+                dd->ipath_f_setextled(dd, lstate, ltstate);
+        } else if ((val & IPATH_IBSTATE_MASK) == IPATH_IBSTATE_ACTIVE) {
+                dd->ipath_flags |= IPATH_LINKACTIVE;
+                dd->ipath_flags &=
+                        ~(IPATH_LINKUNK | IPATH_LINKINIT | IPATH_LINKDOWN |
+                          IPATH_LINKARMED | IPATH_NOCABLE);
+                *dd->ipath_statusp &= ~IPATH_STATUS_IB_NOCABLE;
+                *dd->ipath_statusp |=
+                        IPATH_STATUS_IB_READY | IPATH_STATUS_IB_CONF;
+                dd->ipath_f_setextled(dd, lstate, ltstate);
+
+                __ipath_layer_intr(dd, IPATH_LAYER_INT_IF_UP);
+        } else if ((val & IPATH_IBSTATE_MASK) == IPATH_IBSTATE_INIT) {
+                /*
+                 * set INIT and DOWN.  Down is checked by most of the other
+                 * code, but INIT is useful to know in a few places.
+                 */
+                dd->ipath_flags |= IPATH_LINKINIT | IPATH_LINKDOWN;
+                dd->ipath_flags &=
+                        ~(IPATH_LINKUNK | IPATH_LINKACTIVE | IPATH_LINKARMED
+                          | IPATH_NOCABLE);
+                *dd->ipath_statusp &= ~(IPATH_STATUS_IB_NOCABLE
+                                        | IPATH_STATUS_IB_READY);
+                dd->ipath_f_setextled(dd, lstate, ltstate);
+        } else if ((val & IPATH_IBSTATE_MASK) == IPATH_IBSTATE_ARM) {
+                dd->ipath_flags |= IPATH_LINKARMED;
+                dd->ipath_flags &=
+                        ~(IPATH_LINKUNK | IPATH_LINKDOWN | IPATH_LINKINIT |
+                          IPATH_LINKACTIVE | IPATH_NOCABLE);
+                *dd->ipath_statusp &= ~(IPATH_STATUS_IB_NOCABLE
+                                        | IPATH_STATUS_IB_READY);
+                dd->ipath_f_setextled(dd, lstate, ltstate);
+        } else {
+                if (!noprint)
+                        ipath_dbg("IBstatuschange unit %u: %s (%x)\n",
+                                  dd->ipath_unit,
+                                  ipath_ibcstatus_str[ltstate], ltstate);
+        }
+skip_ibchange:
+        dd->ipath_lastibcstat = val;
+}
+
+static void handle_supp_msgs(struct ipath_devdata *dd,
+                             unsigned supp_msgs, char msg[512])
+{
+        /*
+         * Print the message unless it's ibc status change only, which
+         * happens so often we never want to count it.
+         */
+        if (dd->ipath_lasterror & ~INFINIPATH_E_IBSTATUSCHANGED) {
+                ipath_decode_err(msg, sizeof msg, dd->ipath_lasterror &
+                                 ~INFINIPATH_E_IBSTATUSCHANGED);
+                if (dd->ipath_lasterror &
+                    ~(INFINIPATH_E_RRCVEGRFULL | INFINIPATH_E_RRCVHDRFULL))
+                        ipath_dev_err(dd, "Suppressed %u messages for "
+                                      "fast-repeating errors (%s) (%llx)\n",
+                                      supp_msgs, msg,
+                                      (unsigned long long)
+                                      dd->ipath_lasterror);
+                else {
+                        /*
+                         * rcvegrfull and rcvhdrqfull are "normal", for some
+                         * types of processes (mostly benchmarks) that send
+                         * huge numbers of messages, while not processing
+                         * them. So only complain about these at debug
+                         * level.
+                         */
+                        ipath_dbg("Suppressed %u messages for %s\n",
+                                  supp_msgs, msg);
+                }
+        }
+}
+
+static unsigned handle_frequent_errors(struct ipath_devdata *dd,
+                                       ipath_err_t errs, char msg[512],
+                                       int *noprint)
+{
+        unsigned long nc;
+        static unsigned long nextmsg_time;
+        static unsigned nmsgs, supp_msgs;
+
+        /*
+         * Throttle back "fast" messages to no more than 10 per 5 seconds.
+         * This isn't perfect, but it's a reasonable heuristic. If we get
+         * more than 10, give a 6x longer delay.
+         */
+        nc = jiffies;
+        if (nmsgs > 10) {
+                if (time_before(nc, nextmsg_time)) {
+                        *noprint = 1;
+                        if (!supp_msgs++)
+                                nextmsg_time = nc + HZ * 3;
+                }
+                else if (supp_msgs) {
+                        handle_supp_msgs(dd, supp_msgs, msg);
+                        supp_msgs = 0;
+                        nmsgs = 0;
+                }
+        }
+        else if (!nmsgs++ || time_after(nc, nextmsg_time))
+                nextmsg_time = nc + HZ / 2;
+
+        return supp_msgs;
+}
+
+static void handle_errors(struct ipath_devdata *dd, ipath_err_t errs)
+{
+        char msg[512];
+        u64 ignore_this_time = 0;
+        int i;
+        int chkerrpkts = 0, noprint = 0;
+        unsigned supp_msgs;
+
+        supp_msgs = handle_frequent_errors(dd, errs, msg, &noprint);
+
+        /*
+         * don't report errors that are masked (includes those always
+         * ignored)
+         */
+        errs &= ~dd->ipath_maskederrs;
+
+        /* do these first, they are most important */
+        if (errs & INFINIPATH_E_HARDWARE) {
+                /* reuse same msg buf */
+                dd->ipath_f_handle_hwerrors(dd, msg, sizeof msg);
+        }
+
+        if (!noprint && (errs & ~infinipath_e_bitsextant))
+                ipath_dev_err(dd, "error interrupt with unknown errors "
+                              "%llx set\n", (unsigned long long)
+                              (errs & ~infinipath_e_bitsextant));
+
+        if (errs & E_SUM_ERRS)
+                ignore_this_time = handle_e_sum_errs(dd, errs);
+
+        if (supp_msgs == 250000) {
+                /*
+                 * It's not entirely reasonable assuming that the errors set
+                 * in the last clear period are all responsible for the
+                 * problem, but the alternative is to assume it's the only
+                 * ones on this particular interrupt, which also isn't great
+                 */
+                dd->ipath_maskederrs |= dd->ipath_lasterror | errs;
+                ipath_write_kreg(dd, dd->ipath_kregs->kr_errormask,
+                                 ~dd->ipath_maskederrs);
+                ipath_decode_err(msg, sizeof msg,
+                                 (dd->ipath_maskederrs & ~dd->
+                                  ipath_ignorederrs));
+
+                if ((dd->ipath_maskederrs & ~dd->ipath_ignorederrs) &
+                    ~(INFINIPATH_E_RRCVEGRFULL | INFINIPATH_E_RRCVHDRFULL))
+                        ipath_dev_err(dd, "Disabling error(s) %llx because "
+                                      "occuring too frequently (%s)\n",
+                                      (unsigned long long)
+                                      (dd->ipath_maskederrs &
+                                       ~dd->ipath_ignorederrs), msg);
+                else {
+                        /*
+                         * rcvegrfull and rcvhdrqfull are "normal",
+                         * for some types of processes (mostly benchmarks)
+                         * that send huge numbers of messages, while not
+                         * processing them.  So only complain about
+                         * these at debug level.
+                         */
+                        ipath_dbg("Disabling frequent queue full errors "
+                                  "(%s)\n", msg);
+                }
+
+                /*
+                 * Re-enable the masked errors after around 3 minutes.  in
+                 * ipath_get_faststats().  If we have a series of fast
+                 * repeating but different errors, the interval will keep
+                 * stretching out, but that's OK, as that's pretty
+                 * catastrophic.
+                 */
+                dd->ipath_unmasktime = jiffies + HZ * 180;
+        }
+
+        ipath_write_kreg(dd, dd->ipath_kregs->kr_errorclear, errs);
+        if (ignore_this_time)
+                errs &= ~ignore_this_time;
+        if (errs & ~dd->ipath_lasterror) {
+                errs &= ~dd->ipath_lasterror;
+                /* never suppress duplicate hwerrors or ibstatuschange */
+                dd->ipath_lasterror |= errs &
+                        ~(INFINIPATH_E_HARDWARE |
+                          INFINIPATH_E_IBSTATUSCHANGED);
+        }
+        if (!errs)
+                return;
+
+        if (!noprint)
+                /*
+                 * the ones we mask off are handled specially below or above
+                 */
+                ipath_decode_err(msg, sizeof msg,
+                                 errs & ~(INFINIPATH_E_IBSTATUSCHANGED |
+                                          INFINIPATH_E_RRCVEGRFULL |
+                                          INFINIPATH_E_RRCVHDRFULL |
+                                          INFINIPATH_E_HARDWARE));
+        else
+                /* so we don't need if (!noprint) at strlcat's below */
+                *msg = 0;
+
+        if (errs & E_SUM_PKTERRS) {
+                ipath_stats.sps_pkterrs++;
+                chkerrpkts = 1;
+        }
+        if (errs & E_SUM_ERRS)
+                ipath_stats.sps_errs++;
+
+        if (errs & (INFINIPATH_E_RICRC | INFINIPATH_E_RVCRC)) {
+                ipath_stats.sps_crcerrs++;
+                chkerrpkts = 1;
+        }
+
+        /*
+         * We don't want to print these two as they happen, or we can make
+         * the situation even worse, because it takes so long to print
+         * messages to serial consoles.  Kernel ports get printed from
+         * fast_stats, no more than every 5 seconds, user ports get printed
+         * on close
+         */
+        if (errs & INFINIPATH_E_RRCVHDRFULL) {
+                int any;
+                u32 hd, tl;
+                ipath_stats.sps_hdrqfull++;
+                for (any = i = 0; i < dd->ipath_cfgports; i++) {
+                        struct ipath_portdata *pd = dd->ipath_pd[i];
+                        if (i == 0) {
+                                hd = dd->ipath_port0head;
+                                tl = (u32) le64_to_cpu(
+                                        *dd->ipath_hdrqtailptr);
+                        } else if (pd && pd->port_cnt &&
+                                   pd->port_rcvhdrtail_kvaddr) {
+                                /*
+                                 * don't report same point multiple times,
+                                 * except kernel
+                                 */
+                                tl = (u32) * pd->port_rcvhdrtail_kvaddr;
+                                if (tl == dd->ipath_lastrcvhdrqtails[i])
+                                        continue;
+                                hd = ipath_read_ureg32(dd, ur_rcvhdrhead,
+                                                       i);
+                        } else
+                                continue;
+                        if (hd == (tl + 1) ||
+                            (!hd && tl == dd->ipath_hdrqlast)) {
+                                dd->ipath_lastrcvhdrqtails[i] = tl;
+                                pd->port_hdrqfull++;
+                                if (i == 0)
+                                        chkerrpkts = 1;
+                        }
+                }
+        }
+        if (errs & INFINIPATH_E_RRCVEGRFULL) {
+                /*
+                 * since this is of less importance and not likely to
+                 * happen without also getting hdrfull, only count
+                 * occurrences; don't check each port (or even the kernel
+                 * vs user)
+                 */
+                ipath_stats.sps_etidfull++;
+                if (dd->ipath_port0head !=
+                    (u32) le64_to_cpu(*dd->ipath_hdrqtailptr))
+                        chkerrpkts = 1;
+        }
+
+        /*
+         * do this before IBSTATUSCHANGED, in case both bits set in a single
+         * interrupt; we want the STATUSCHANGE to "win", so we do our
+         * internal copy of state machine correctly
+         */
+        if (errs & INFINIPATH_E_RIBLOSTLINK) {
+                /*
+                 * force through block below
+                 */
+                errs |= INFINIPATH_E_IBSTATUSCHANGED;
+                ipath_stats.sps_iblink++;
+                dd->ipath_flags |= IPATH_LINKDOWN;
+                dd->ipath_flags &= ~(IPATH_LINKUNK | IPATH_LINKINIT
+                                     | IPATH_LINKARMED | IPATH_LINKACTIVE);
+                *dd->ipath_statusp &= ~IPATH_STATUS_IB_READY;
+                if (!noprint) {
+                        u64 st = ipath_read_kreg64(
+                                dd, dd->ipath_kregs->kr_ibcstatus);
+
+                        ipath_dbg("Lost link, link now down (%s)\n",
+                                  ipath_ibcstatus_str[st & 0xf]);
+                }
+        }
+        if (errs & INFINIPATH_E_IBSTATUSCHANGED)
+                handle_e_ibstatuschanged(dd, errs, noprint);
+
+        if (errs & INFINIPATH_E_RESET) {
+                if (!noprint)
+                        ipath_dev_err(dd, "Got reset, requires re-init "
+                                      "(unload and reload driver)\n");
+                dd->ipath_flags &= ~IPATH_INITTED;      /* needs re-init */
+                /* mark as having had error */
+                *dd->ipath_statusp |= IPATH_STATUS_HWERROR;
+                *dd->ipath_statusp &= ~IPATH_STATUS_IB_CONF;
+        }
+
+        if (!noprint && *msg)
+                ipath_dev_err(dd, "%s error\n", msg);
+        if (dd->ipath_sma_state_wanted & dd->ipath_flags) {
+                ipath_cdbg(VERBOSE, "sma wanted state %x, iflags now %x, "
+                           "waking\n", dd->ipath_sma_state_wanted,
+                           dd->ipath_flags);
+                wake_up_interruptible(&ipath_sma_state_wait);
+        }
+
+        if (chkerrpkts)
+                /* process possible error packets in hdrq */
+                ipath_kreceive(dd);
+}
+
+/* this is separate to allow for better optimization of ipath_intr() */
+
+static void ipath_bad_intr(struct ipath_devdata *dd, u32 * unexpectp)
+{
+        /*
+         * sometimes happen during driver init and unload, don't want
+         * to process any interrupts at that point
+         */
+
+        /* this is just a bandaid, not a fix, if something goes badly
+         * wrong */
+        if (++*unexpectp > 100) {
+                if (++*unexpectp > 105) {
+                        /*
+                         * ok, we must be taking somebody else's interrupts,
+                         * due to a messed up mptable and/or PIRQ table, so
+                         * unregister the interrupt.  We've seen this during
+                         * linuxbios development work, and it may happen in
+                         * the future again.
+                         */
+                        if (dd->pcidev && dd->pcidev->irq) {
+                                ipath_dev_err(dd, "Now %u unexpected "
+                                              "interrupts, unregistering "
+                                              "interrupt handler\n",
+                                              *unexpectp);
+                                ipath_dbg("free_irq of irq %x\n",
+                                          dd->pcidev->irq);
+                                free_irq(dd->pcidev->irq, dd);
+                        }
+                }
+                if (ipath_read_kreg32(dd, dd->ipath_kregs->kr_intmask)) {
+                        ipath_dev_err(dd, "%u unexpected interrupts, "
+                                      "disabling interrupts completely\n",
+                                      *unexpectp);
+                        /*
+                         * disable all interrupts, something is very wrong
+                         */
+                        ipath_write_kreg(dd, dd->ipath_kregs->kr_intmask,
+                                         0ULL);
+                }
+        } else if (*unexpectp > 1)
+                ipath_dbg("Interrupt when not ready, should not happen, "
+                          "ignoring\n");
+}
+
+static void ipath_bad_regread(struct ipath_devdata *dd)
+{
+        static int allbits;
+
+        /* separate routine, for better optimization of ipath_intr() */
+
+        /*
+         * We print the message and disable interrupts, in hope of
+         * having a better chance of debugging the problem.
+         */
+        ipath_dev_err(dd,
+                      "Read of interrupt status failed (all bits set)\n");
+        if (allbits++) {
+                /* disable all interrupts, something is very wrong */
+                ipath_write_kreg(dd, dd->ipath_kregs->kr_intmask, 0ULL);
+                if (allbits == 2) {
+                        ipath_dev_err(dd, "Still bad interrupt status, "
+                                      "unregistering interrupt\n");
+                        free_irq(dd->pcidev->irq, dd);
+                } else if (allbits > 2) {
+                        if ((allbits % 10000) == 0)
+                                printk(".");
+                } else
+                        ipath_dev_err(dd, "Disabling interrupts, "
+                                      "multiple errors\n");
+        }
+}
+
+static void handle_port_pioavail(struct ipath_devdata *dd)
+{
+        u32 i;
+        /*
+         * start from port 1, since for now port 0  is never using
+         * wait_event for PIO
+         */
+        for (i = 1; dd->ipath_portpiowait && i < dd->ipath_cfgports; i++) {
+                struct ipath_portdata *pd = dd->ipath_pd[i];
+
+                if (pd && pd->port_cnt &&
+                    dd->ipath_portpiowait & (1U << i)) {
+                        clear_bit(i, &dd->ipath_portpiowait);
+                        if (test_bit(IPATH_PORT_WAITING_PIO,
+                                     &pd->port_flag)) {
+                                clear_bit(IPATH_PORT_WAITING_PIO,
+                                          &pd->port_flag);
+                                wake_up_interruptible(&pd->port_wait);
+                        }
+                }
+        }
+}
+
+static void handle_layer_pioavail(struct ipath_devdata *dd)
+{
+        int ret;
+
+        ret = __ipath_layer_intr(dd, IPATH_LAYER_INT_SEND_CONTINUE);
+        if (ret > 0)
+                goto clear;
+
+        ret = __ipath_verbs_piobufavail(dd);
+        if (ret > 0)
+                goto clear;
+
+        return;
+clear:
+        set_bit(IPATH_S_PIOINTBUFAVAIL, &dd->ipath_sendctrl);
+        ipath_write_kreg(dd, dd->ipath_kregs->kr_sendctrl,
+                         dd->ipath_sendctrl);
+}
+
+static void handle_rcv(struct ipath_devdata *dd, u32 istat)
+{
+        u64 portr;
+        int i;
+        int rcvdint = 0;
+
+        portr = ((istat >> INFINIPATH_I_RCVAVAIL_SHIFT) &
+                 infinipath_i_rcvavail_mask)
+                | ((istat >> INFINIPATH_I_RCVURG_SHIFT) &
+                   infinipath_i_rcvurg_mask);
+        for (i = 0; i < dd->ipath_cfgports; i++) {
+                struct ipath_portdata *pd = dd->ipath_pd[i];
+                if (portr & (1 << i) && pd &&
+                    pd->port_cnt) {
+                        if (i == 0)
+                                ipath_kreceive(dd);
+                        else if (test_bit(IPATH_PORT_WAITING_RCV,
+                                          &pd->port_flag)) {
+                                int rcbit;
+                                clear_bit(IPATH_PORT_WAITING_RCV,
+                                          &pd->port_flag);
+                                rcbit = i + INFINIPATH_R_INTRAVAIL_SHIFT;
+                                clear_bit(1UL << rcbit, &dd->ipath_rcvctrl);
+                                wake_up_interruptible(&pd->port_wait);
+                                rcvdint = 1;
+                        }
+                }
+        }
+        if (rcvdint) {
+                /* only want to take one interrupt, so turn off the rcv
+                 * interrupt for all the ports that we did the wakeup on
+                 * (but never for kernel port)
+                 */
+                ipath_write_kreg(dd, dd->ipath_kregs->kr_rcvctrl,
+                                 dd->ipath_rcvctrl);
+        }
+}
+
+irqreturn_t ipath_intr(int irq, void *data, struct pt_regs *regs)
+{
+        struct ipath_devdata *dd = data;
+        u32 istat = ipath_read_kreg32(dd, dd->ipath_kregs->kr_intstatus);
+        ipath_err_t estat = 0;
+        static unsigned unexpected = 0;
+        irqreturn_t ret;
+
+        if (unlikely(!istat)) {
+                ipath_stats.sps_nullintr++;
+                ret = IRQ_NONE; /* not our interrupt, or already handled */
+                goto bail;
+        }
+        if (unlikely(istat == -1)) {
+                ipath_bad_regread(dd);
+                /* don't know if it was our interrupt or not */
+                ret = IRQ_NONE;
+                goto bail;
+        }
+
+        ipath_stats.sps_ints++;
+
+        /*
+         * this needs to be flags&initted, not statusp, so we keep
+         * taking interrupts even after link goes down, etc.
+         * Also, we *must* clear the interrupt at some point, or we won't
+         * take it again, which can be real bad for errors, etc...
+         */
+
+        if (!(dd->ipath_flags & IPATH_INITTED)) {
+                ipath_bad_intr(dd, &unexpected);
+                ret = IRQ_NONE;
+                goto bail;
+        }
+        if (unexpected)
+                unexpected = 0;
+
+        ipath_cdbg(VERBOSE, "intr stat=0x%x\n", istat);
+
+        if (istat & ~infinipath_i_bitsextant)
+                ipath_dev_err(dd,
+                              "interrupt with unknown interrupts %x set\n",
+                              istat & (u32) ~ infinipath_i_bitsextant);
+
+        if (istat & INFINIPATH_I_ERROR) {
+                ipath_stats.sps_errints++;
+                estat = ipath_read_kreg64(dd,
+                                          dd->ipath_kregs->kr_errorstatus);
+                if (!estat)
+                        dev_info(&dd->pcidev->dev, "error interrupt (%x), "
+                                 "but no error bits set!\n", istat);
+                else if (estat == -1LL)
+                        /*
+                         * should we try clearing all, or hope next read
+                         * works?
+                         */
+                        ipath_dev_err(dd, "Read of error status failed "
+                                      "(all bits set); ignoring\n");
+                else
+                        handle_errors(dd, estat);
+        }
+
+        if (istat & INFINIPATH_I_GPIO) {
+                if (unlikely(!(dd->ipath_flags & IPATH_GPIO_INTR))) {
+                        u32 gpiostatus;
+                        gpiostatus = ipath_read_kreg32(
+                                dd, dd->ipath_kregs->kr_gpio_status);
+                        ipath_dbg("Unexpected GPIO interrupt bits %x\n",
+                                  gpiostatus);
+                        ipath_write_kreg(dd, dd->ipath_kregs->kr_gpio_clear,
+                                         gpiostatus);
+                }
+                else {
+                        /* Clear GPIO status bit 2 */
+                        ipath_write_kreg(dd, dd->ipath_kregs->kr_gpio_clear,
+                                         (u64) (1 << 2));
+
+                        /*
+                         * Packets are available in the port 0 rcv queue.
+                         * Eventually this needs to be generalized to check
+                         * IPATH_GPIO_INTR, and the specific GPIO bit, if
+                         * GPIO interrupts are used for anything else.
+                         */
+                        ipath_kreceive(dd);
+                }
+        }
+
+        /*
+         * clear the ones we will deal with on this round
+         * We clear it early, mostly for receive interrupts, so we
+         * know the chip will have seen this by the time we process
+         * the queue, and will re-interrupt if necessary.  The processor
+         * itself won't take the interrupt again until we return.
+         */
+        ipath_write_kreg(dd, dd->ipath_kregs->kr_intclear, istat);
+
+        if (istat & INFINIPATH_I_SPIOBUFAVAIL) {
+                clear_bit(IPATH_S_PIOINTBUFAVAIL, &dd->ipath_sendctrl);
+                ipath_write_kreg(dd, dd->ipath_kregs->kr_sendctrl,
+                                 dd->ipath_sendctrl);
+
+                if (dd->ipath_portpiowait)
+                        handle_port_pioavail(dd);
+
+                handle_layer_pioavail(dd);
+        }
+
+        /*
+         * we check for both transition from empty to non-empty, and urgent
+         * packets (those with the interrupt bit set in the header)
+         */
+
+        if (istat & ((infinipath_i_rcvavail_mask <<
+                      INFINIPATH_I_RCVAVAIL_SHIFT)
+                     | (infinipath_i_rcvurg_mask <<
+                        INFINIPATH_I_RCVURG_SHIFT)))
+                handle_rcv(dd, istat);
+
+        ret = IRQ_HANDLED;
+
+bail:
+        return ret;
+}
diff --git a/drivers/infiniband/hw/ipath/ipath_kernel.h b/drivers/infiniband/hw/ipath/ipath_kernel.h
new file mode 100644
index 000000000000..159d0aed31a5
--- /dev/null
+++ b/drivers/infiniband/hw/ipath/ipath_kernel.h
@@ -0,0 +1,884 @@
+#ifndef _IPATH_KERNEL_H
+#define _IPATH_KERNEL_H
+/*
+ * Copyright (c) 2003, 2004, 2005, 2006 PathScale, Inc. All rights reserved.
+ *
+ * This software is available to you under a choice of one of two
+ * licenses.  You may choose to be licensed under the terms of the GNU
+ * General Public License (GPL) Version 2, available from the file
+ * COPYING in the main directory of this source tree, or the
+ * OpenIB.org BSD license below:
+ *
+ *     Redistribution and use in source and binary forms, with or
+ *     without modification, are permitted provided that the following
+ *     conditions are met:
+ *
+ *      - Redistributions of source code must retain the above
+ *        copyright notice, this list of conditions and the following
+ *        disclaimer.
+ *
+ *      - Redistributions in binary form must reproduce the above
+ *        copyright notice, this list of conditions and the following
+ *        disclaimer in the documentation and/or other materials
+ *        provided with the distribution.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+ * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+ * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+ * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
+ * BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
+ * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
+ * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+ * SOFTWARE.
+ */
+
+/*
+ * This header file is the base header file for infinipath kernel code
+ * ipath_user.h serves a similar purpose for user code.
+ */
+
+#include <linux/interrupt.h>
+#include <asm/io.h>
+
+#include "ipath_common.h"
+#include "ipath_debug.h"
+#include "ipath_registers.h"
+
+/* only s/w major version of InfiniPath we can handle */
+#define IPATH_CHIP_VERS_MAJ 2U
+
+/* don't care about this except printing */
+#define IPATH_CHIP_VERS_MIN 0U
+
+/* temporary, maybe always */
+extern struct infinipath_stats ipath_stats;
+
+#define IPATH_CHIP_SWVERSION IPATH_CHIP_VERS_MAJ
+
+struct ipath_portdata {
+        void **port_rcvegrbuf;
+        dma_addr_t *port_rcvegrbuf_phys;
+        /* rcvhdrq base, needs mmap before useful */
+        void *port_rcvhdrq;
+        /* kernel virtual address where hdrqtail is updated */
+        u64 *port_rcvhdrtail_kvaddr;
+        /* page * used for uaddr */
+        struct page *port_rcvhdrtail_pagep;
+        /*
+         * temp buffer for expected send setup, allocated at open, instead
+         * of each setup call
+         */
+        void *port_tid_pg_list;
+        /* when waiting for rcv or pioavail */
+        wait_queue_head_t port_wait;
+        /*
+         * rcvegr bufs base, physical, must fit
+         * in 44 bits so 32 bit programs mmap64 44 bit works)
+         */
+        dma_addr_t port_rcvegr_phys;
+        /* mmap of hdrq, must fit in 44 bits */
+        dma_addr_t port_rcvhdrq_phys;
+        /*
+         * the actual user address that we ipath_mlock'ed, so we can
+         * ipath_munlock it at close
+         */
+        unsigned long port_rcvhdrtail_uaddr;
+        /*
+         * number of opens on this instance (0 or 1; ignoring forks, dup,
+         * etc. for now)
+         */
+        int port_cnt;
+        /*
+         * how much space to leave at start of eager TID entries for
+         * protocol use, on each TID
+         */
+        /* instead of calculating it */
+        unsigned port_port;
+        /* chip offset of PIO buffers for this port */
+        u32 port_piobufs;
+        /* how many alloc_pages() chunks in port_rcvegrbuf_pages */
+        u32 port_rcvegrbuf_chunks;
+        /* how many egrbufs per chunk */
+        u32 port_rcvegrbufs_perchunk;
+        /* order for port_rcvegrbuf_pages */
+        size_t port_rcvegrbuf_size;
+        /* rcvhdrq size (for freeing) */
+        size_t port_rcvhdrq_size;
+        /* next expected TID to check when looking for free */
+        u32 port_tidcursor;
+        /* next expected TID to check */
+        unsigned long port_flag;
+        /* WAIT_RCV that timed out, no interrupt */
+        u32 port_rcvwait_to;
+        /* WAIT_PIO that timed out, no interrupt */
+        u32 port_piowait_to;
+        /* WAIT_RCV already happened, no wait */
+        u32 port_rcvnowait;
+        /* WAIT_PIO already happened, no wait */
+        u32 port_pionowait;
+        /* total number of rcvhdrqfull errors */
+        u32 port_hdrqfull;
+        /* pid of process using this port */
+        pid_t port_pid;
+        /* same size as task_struct .comm[] */
+        char port_comm[16];
+        /* pkeys set by this use of this port */
+        u16 port_pkeys[4];
+        /* so file ops can get at unit */
+        struct ipath_devdata *port_dd;
+};
+
+struct sk_buff;
+
+/*
+ * control information for layered drivers
+ */
+struct _ipath_layer {
+        void *l_arg;
+};
+
+/* Verbs layer interface */
+struct _verbs_layer {
+        void *l_arg;
+        struct timer_list l_timer;
+};
+
+struct ipath_devdata {
+        struct list_head ipath_list;
+
+        struct ipath_kregs const *ipath_kregs;
+        struct ipath_cregs const *ipath_cregs;
+
+        /* mem-mapped pointer to base of chip regs */
+        u64 __iomem *ipath_kregbase;
+        /* end of mem-mapped chip space; range checking */
+        u64 __iomem *ipath_kregend;
+        /* physical address of chip for io_remap, etc. */
+        unsigned long ipath_physaddr;
+        /* base of memory alloced for ipath_kregbase, for free */
+        u64 *ipath_kregalloc;
+        /*
+         * version of kregbase that doesn't have high bits set (for 32 bit
+         * programs, so mmap64 44 bit works)
+         */
+        u64 __iomem *ipath_kregvirt;
+        /*
+         * virtual address where port0 rcvhdrqtail updated for this unit.
+         * only written to by the chip, not the driver.
+         */
+        volatile __le64 *ipath_hdrqtailptr;
+        dma_addr_t ipath_dma_addr;
+        /* ipath_cfgports pointers */
+        struct ipath_portdata **ipath_pd;
+        /* sk_buffs used by port 0 eager receive queue */
+        struct sk_buff **ipath_port0_skbs;
+        /* kvirt address of 1st 2k pio buffer */
+        void __iomem *ipath_pio2kbase;
+        /* kvirt address of 1st 4k pio buffer */
+        void __iomem *ipath_pio4kbase;
+        /*
+         * points to area where PIOavail registers will be DMA'ed.
+         * Has to be on a page of it's own, because the page will be
+         * mapped into user program space.  This copy is *ONLY* ever
+         * written by DMA, not by the driver!  Need a copy per device
+         * when we get to multiple devices
+         */
+        volatile __le64 *ipath_pioavailregs_dma;
+        /* physical address where updates occur */
+        dma_addr_t ipath_pioavailregs_phys;
+        struct _ipath_layer ipath_layer;
+        /* setup intr */
+        int (*ipath_f_intrsetup)(struct ipath_devdata *);
+        /* setup on-chip bus config */
+        int (*ipath_f_bus)(struct ipath_devdata *, struct pci_dev *);
+        /* hard reset chip */
+        int (*ipath_f_reset)(struct ipath_devdata *);
+        int (*ipath_f_get_boardname)(struct ipath_devdata *, char *,
+                                     size_t);
+        void (*ipath_f_init_hwerrors)(struct ipath_devdata *);
+        void (*ipath_f_handle_hwerrors)(struct ipath_devdata *, char *,
+                                        size_t);
+        void (*ipath_f_quiet_serdes)(struct ipath_devdata *);
+        int (*ipath_f_bringup_serdes)(struct ipath_devdata *);
+        int (*ipath_f_early_init)(struct ipath_devdata *);
+        void (*ipath_f_clear_tids)(struct ipath_devdata *, unsigned);
+        void (*ipath_f_put_tid)(struct ipath_devdata *, u64 __iomem*,
+                                u32, unsigned long);
+        void (*ipath_f_tidtemplate)(struct ipath_devdata *);
+        void (*ipath_f_cleanup)(struct ipath_devdata *);
+        void (*ipath_f_setextled)(struct ipath_devdata *, u64, u64);
+        /* fill out chip-specific fields */
+        int (*ipath_f_get_base_info)(struct ipath_portdata *, void *);
+        struct _verbs_layer verbs_layer;
+        /* total dwords sent (summed from counter) */
+        u64 ipath_sword;
+        /* total dwords rcvd (summed from counter) */
+        u64 ipath_rword;
+        /* total packets sent (summed from counter) */
+        u64 ipath_spkts;
+        /* total packets rcvd (summed from counter) */
+        u64 ipath_rpkts;
+        /* ipath_statusp initially points to this. */
+        u64 _ipath_status;
+        /* GUID for this interface, in network order */
+        __be64 ipath_guid;
+        /*
+         * aggregrate of error bits reported since last cleared, for
+         * limiting of error reporting
+         */
+        ipath_err_t ipath_lasterror;
+        /*
+         * aggregrate of error bits reported since last cleared, for
+         * limiting of hwerror reporting
+         */
+        ipath_err_t ipath_lasthwerror;
+        /*
+         * errors masked because they occur too fast, also includes errors
+         * that are always ignored (ipath_ignorederrs)
+         */
+        ipath_err_t ipath_maskederrs;
+        /* time in jiffies at which to re-enable maskederrs */
+        unsigned long ipath_unmasktime;
+        /*
+         * errors always ignored (masked), at least for a given
+         * chip/device, because they are wrong or not useful
+         */
+        ipath_err_t ipath_ignorederrs;
+        /* count of egrfull errors, combined for all ports */
+        u64 ipath_last_tidfull;
+        /* for ipath_qcheck() */
+        u64 ipath_lastport0rcv_cnt;
+        /* template for writing TIDs  */
+        u64 ipath_tidtemplate;
+        /* value to write to free TIDs */
+        u64 ipath_tidinvalid;
+        /* PE-800 rcv interrupt setup */
+        u64 ipath_rhdrhead_intr_off;
+
+        /* size of memory at ipath_kregbase */
+        u32 ipath_kregsize;
+        /* number of registers used for pioavail */
+        u32 ipath_pioavregs;
+        /* IPATH_POLL, etc. */
+        u32 ipath_flags;
+        /* ipath_flags sma is waiting for */
+        u32 ipath_sma_state_wanted;
+        /* last buffer for user use, first buf for kernel use is this
+         * index. */
+        u32 ipath_lastport_piobuf;
+        /* is a stats timer active */
+        u32 ipath_stats_timer_active;
+        /* dwords sent read from counter */
+        u32 ipath_lastsword;
+        /* dwords received read from counter */
+        u32 ipath_lastrword;
+        /* sent packets read from counter */
+        u32 ipath_lastspkts;
+        /* received packets read from counter */
+        u32 ipath_lastrpkts;
+        /* pio bufs allocated per port */
+        u32 ipath_pbufsport;
+        /*
+         * number of ports configured as max; zero is set to number chip
+         * supports, less gives more pio bufs/port, etc.
+         */
+        u32 ipath_cfgports;
+        /* port0 rcvhdrq head offset */
+        u32 ipath_port0head;
+        /* count of port 0 hdrqfull errors */
+        u32 ipath_p0_hdrqfull;
+
+        /*
+         * (*cfgports) used to suppress multiple instances of same
+         * port staying stuck at same point
+         */
+        u32 *ipath_lastrcvhdrqtails;
+        /*
+         * (*cfgports) used to suppress multiple instances of same
+         * port staying stuck at same point
+         */
+        u32 *ipath_lastegrheads;
+        /*
+         * index of last piobuffer we used.  Speeds up searching, by
+         * starting at this point.  Doesn't matter if multiple cpu's use and
+         * update, last updater is only write that matters.  Whenever it
+         * wraps, we update shadow copies.  Need a copy per device when we
+         * get to multiple devices
+         */
+        u32 ipath_lastpioindex;
+        /* max length of freezemsg */
+        u32 ipath_freezelen;
+        /*
+         * consecutive times we wanted a PIO buffer but were unable to
+         * get one
+         */
+        u32 ipath_consec_nopiobuf;
+        /*
+         * hint that we should update ipath_pioavailshadow before
+         * looking for a PIO buffer
+         */
+        u32 ipath_upd_pio_shadow;
+        /* so we can rewrite it after a chip reset */
+        u32 ipath_pcibar0;
+        /* so we can rewrite it after a chip reset */
+        u32 ipath_pcibar1;
+        /* sequential tries for SMA send and no bufs */
+        u32 ipath_nosma_bufs;
+        /* duration (seconds) ipath_nosma_bufs set */
+        u32 ipath_nosma_secs;
+
+        /* HT/PCI Vendor ID (here for NodeInfo) */
+        u16 ipath_vendorid;
+        /* HT/PCI Device ID (here for NodeInfo) */
+        u16 ipath_deviceid;
+        /* offset in HT config space of slave/primary interface block */
+        u8 ipath_ht_slave_off;
+        /* for write combining settings */
+        unsigned long ipath_wc_cookie;
+        /* ref count for each pkey */
+        atomic_t ipath_pkeyrefs[4];
+        /* shadow copy of all exptids physaddr; used only by funcsim */
+        u64 *ipath_tidsimshadow;
+        /* shadow copy of struct page *'s for exp tid pages */
+        struct page **ipath_pageshadow;
+        /* lock to workaround chip bug 9437 */
+        spinlock_t ipath_tid_lock;
+
+        /*
+         * IPATH_STATUS_*,
+         * this address is mapped readonly into user processes so they can
+         * get status cheaply, whenever they want.
+         */
+        u64 *ipath_statusp;
+        /* freeze msg if hw error put chip in freeze */
+        char *ipath_freezemsg;
+        /* pci access data structure */
+        struct pci_dev *pcidev;
+        struct cdev *cdev;
+        struct class_device *class_dev;
+        /* timer used to prevent stats overflow, error throttling, etc. */
+        struct timer_list ipath_stats_timer;
+        /* check for stale messages in rcv queue */
+        /* only allow one intr at a time. */
+        unsigned long ipath_rcv_pending;
+
+        /*
+         * Shadow copies of registers; size indicates read access size.
+         * Most of them are readonly, but some are write-only register,
+         * where we manipulate the bits in the shadow copy, and then write
+         * the shadow copy to infinipath.
+         *
+         * We deliberately make most of these 32 bits, since they have
+         * restricted range.  For any that we read, we won't to generate 32
+         * bit accesses, since Opteron will generate 2 separate 32 bit HT
+         * transactions for a 64 bit read, and we want to avoid unnecessary
+         * HT transactions.
+         */
+
+        /* This is the 64 bit group */
+
+        /*
+         * shadow of pioavail, check to be sure it's large enough at
+         * init time.
+         */
+        unsigned long ipath_pioavailshadow[8];
+        /* shadow of kr_gpio_out, for rmw ops */
+        u64 ipath_gpio_out;
+        /* kr_revision shadow */
+        u64 ipath_revision;
+        /*
+         * shadow of ibcctrl, for interrupt handling of link changes,
+         * etc.
+         */
+        u64 ipath_ibcctrl;
+        /*
+         * last ibcstatus, to suppress "duplicate" status change messages,
+         * mostly from 2 to 3
+         */
+        u64 ipath_lastibcstat;
+        /* hwerrmask shadow */
+        ipath_err_t ipath_hwerrmask;
+        /* interrupt config reg shadow */
+        u64 ipath_intconfig;
+        /* kr_sendpiobufbase value */
+        u64 ipath_piobufbase;
+
+        /* these are the "32 bit" regs */
+
+        /*
+         * number of GUIDs in the flash for this interface; may need some
+         * rethinking for setting on other ifaces
+         */
+        u32 ipath_nguid;
+        /*
+         * the following two are 32-bit bitmasks, but {test,clear,set}_bit
+         * all expect bit fields to be "unsigned long"
+         */
+        /* shadow kr_rcvctrl */
+        unsigned long ipath_rcvctrl;
+        /* shadow kr_sendctrl */
+        unsigned long ipath_sendctrl;
+
+        /* value we put in kr_rcvhdrcnt */
+        u32 ipath_rcvhdrcnt;
+        /* value we put in kr_rcvhdrsize */
+        u32 ipath_rcvhdrsize;
+        /* value we put in kr_rcvhdrentsize */
+        u32 ipath_rcvhdrentsize;
+        /* offset of last entry in rcvhdrq */
+        u32 ipath_hdrqlast;
+        /* kr_portcnt value */
+        u32 ipath_portcnt;
+        /* kr_pagealign value */
+        u32 ipath_palign;
+        /* number of "2KB" PIO buffers */
+        u32 ipath_piobcnt2k;
+        /* size in bytes of "2KB" PIO buffers */
+        u32 ipath_piosize2k;
+        /* number of "4KB" PIO buffers */
+        u32 ipath_piobcnt4k;
+        /* size in bytes of "4KB" PIO buffers */
+        u32 ipath_piosize4k;
+        /* kr_rcvegrbase value */
+        u32 ipath_rcvegrbase;
+        /* kr_rcvegrcnt value */
+        u32 ipath_rcvegrcnt;
+        /* kr_rcvtidbase value */
+        u32 ipath_rcvtidbase;
+        /* kr_rcvtidcnt value */
+        u32 ipath_rcvtidcnt;
+        /* kr_sendregbase */
+        u32 ipath_sregbase;
+        /* kr_userregbase */
+        u32 ipath_uregbase;
+        /* kr_counterregbase */
+        u32 ipath_cregbase;
+        /* shadow the control register contents */
+        u32 ipath_control;
+        /* shadow the gpio output contents */
+        u32 ipath_extctrl;
+        /* PCI revision register (HTC rev on FPGA) */
+        u32 ipath_pcirev;
+
+        /* chip address space used by 4k pio buffers */
+        u32 ipath_4kalign;
+        /* The MTU programmed for this unit */
+        u32 ipath_ibmtu;
+        /*
+         * The max size IB packet, included IB headers that we can send.
+         * Starts same as ipath_piosize, but is affected when ibmtu is
+         * changed, or by size of eager buffers
+         */
+        u32 ipath_ibmaxlen;
+        /*
+         * ibmaxlen at init time, limited by chip and by receive buffer
+         * size.  Not changed after init.
+         */
+        u32 ipath_init_ibmaxlen;
+        /* size of each rcvegrbuffer */
+        u32 ipath_rcvegrbufsize;
+        /* width (2,4,8,16,32) from HT config reg */
+        u32 ipath_htwidth;
+        /* HT speed (200,400,800,1000) from HT config */
+        u32 ipath_htspeed;
+        /* ports waiting for PIOavail intr */
+        unsigned long ipath_portpiowait;
+        /*
+         * number of sequential ibcstatus change for polling active/quiet
+         * (i.e., link not coming up).
+         */
+        u32 ipath_ibpollcnt;
+        /* low and high portions of MSI capability/vector */
+        u32 ipath_msi_lo;
+        /* saved after PCIe init for restore after reset */
+        u32 ipath_msi_hi;
+        /* MSI data (vector) saved for restore */
+        u16 ipath_msi_data;
+        /* MLID programmed for this instance */
+        u16 ipath_mlid;
+        /* LID programmed for this instance */
+        u16 ipath_lid;
+        /* list of pkeys programmed; 0 if not set */
+        u16 ipath_pkeys[4];
+        /* ASCII serial number, from flash */
+        u8 ipath_serial[12];
+        /* human readable board version */
+        u8 ipath_boardversion[80];
+        /* chip major rev, from ipath_revision */
+        u8 ipath_majrev;
+        /* chip minor rev, from ipath_revision */
+        u8 ipath_minrev;
+        /* board rev, from ipath_revision */
+        u8 ipath_boardrev;
+        /* unit # of this chip, if present */
+        int ipath_unit;
+        /* saved for restore after reset */
+        u8 ipath_pci_cacheline;
+        /* LID mask control */
+        u8 ipath_lmc;
+};
+
+extern volatile __le64 *ipath_port0_rcvhdrtail;
+extern dma_addr_t ipath_port0_rcvhdrtail_dma;
+
+#define IPATH_PORT0_RCVHDRTAIL_SIZE PAGE_SIZE
+
+extern struct list_head ipath_dev_list;
+extern spinlock_t ipath_devs_lock;
+extern struct ipath_devdata *ipath_lookup(int unit);
+
+extern u16 ipath_layer_rcv_opcode;
+extern int ipath_verbs_registered;
+extern int __ipath_layer_intr(struct ipath_devdata *, u32);
+extern int ipath_layer_intr(struct ipath_devdata *, u32);
+extern int __ipath_layer_rcv(struct ipath_devdata *, void *,
+                             struct sk_buff *);
+extern int __ipath_layer_rcv_lid(struct ipath_devdata *, void *);
+extern int __ipath_verbs_piobufavail(struct ipath_devdata *);
+extern int __ipath_verbs_rcv(struct ipath_devdata *, void *, void *, u32);
+
+void ipath_layer_add(struct ipath_devdata *);
+void ipath_layer_del(struct ipath_devdata *);
+
+int ipath_init_chip(struct ipath_devdata *, int);
+int ipath_enable_wc(struct ipath_devdata *dd);
+void ipath_disable_wc(struct ipath_devdata *dd);
+int ipath_count_units(int *npresentp, int *nupp, u32 *maxportsp);
+void ipath_shutdown_device(struct ipath_devdata *);
+
+struct file_operations;
+int ipath_cdev_init(int minor, char *name, struct file_operations *fops,
+                    struct cdev **cdevp, struct class_device **class_devp);
+void ipath_cdev_cleanup(struct cdev **cdevp,
+                        struct class_device **class_devp);
+
+int ipath_diag_init(void);
+void ipath_diag_cleanup(void);
+void ipath_diag_bringup_link(struct ipath_devdata *);
+
+extern wait_queue_head_t ipath_sma_state_wait;
+
+int ipath_user_add(struct ipath_devdata *dd);
+void ipath_user_del(struct ipath_devdata *dd);
+
+struct sk_buff *ipath_alloc_skb(struct ipath_devdata *dd, gfp_t);
+
+extern int ipath_diag_inuse;
+
+irqreturn_t ipath_intr(int irq, void *devid, struct pt_regs *regs);
+void ipath_decode_err(char *buf, size_t blen, ipath_err_t err);
+#if __IPATH_INFO || __IPATH_DBG
+extern const char *ipath_ibcstatus_str[];
+#endif
+
+/* clean up any per-chip chip-specific stuff */
+void ipath_chip_cleanup(struct ipath_devdata *);
+/* clean up any chip type-specific stuff */
+void ipath_chip_done(void);
+
+/* check to see if we have to force ordering for write combining */
+int ipath_unordered_wc(void);
+
+void ipath_disarm_piobufs(struct ipath_devdata *, unsigned first,
+                          unsigned cnt);
+
+int ipath_create_rcvhdrq(struct ipath_devdata *, struct ipath_portdata *);
+void ipath_free_pddata(struct ipath_devdata *, u32, int);
+
+int ipath_parse_ushort(const char *str, unsigned short *valp);
+
+int ipath_wait_linkstate(struct ipath_devdata *, u32, int);
+void ipath_set_ib_lstate(struct ipath_devdata *, int);
+void ipath_kreceive(struct ipath_devdata *);
+int ipath_setrcvhdrsize(struct ipath_devdata *, unsigned);
+int ipath_reset_device(int);
+void ipath_get_faststats(unsigned long);
+
+/* for use in system calls, where we want to know device type, etc. */
+#define port_fp(fp) ((struct ipath_portdata *) (fp)->private_data)
+
+/*
+ * values for ipath_flags
+ */
+/* The chip is up and initted */
+#define IPATH_INITTED       0x2
+                /* set if any user code has set kr_rcvhdrsize */
+#define IPATH_RCVHDRSZ_SET  0x4
+                /* The chip is present and valid for accesses */
+#define IPATH_PRESENT       0x8
+                /* HT link0 is only 8 bits wide, ignore upper byte crc
+                 * errors, etc. */
+#define IPATH_8BIT_IN_HT0   0x10
+                /* HT link1 is only 8 bits wide, ignore upper byte crc
+                 * errors, etc. */
+#define IPATH_8BIT_IN_HT1   0x20
+                /* The link is down */
+#define IPATH_LINKDOWN      0x40
+                /* The link level is up (0x11) */
+#define IPATH_LINKINIT      0x80
+                /* The link is in the armed (0x21) state */
+#define IPATH_LINKARMED     0x100
+                /* The link is in the active (0x31) state */
+#define IPATH_LINKACTIVE    0x200
+                /* link current state is unknown */
+#define IPATH_LINKUNK       0x400
+                /* no IB cable, or no device on IB cable */
+#define IPATH_NOCABLE       0x4000
+                /* Supports port zero per packet receive interrupts via
+                 * GPIO */
+#define IPATH_GPIO_INTR     0x8000
+                /* uses the coded 4byte TID, not 8 byte */
+#define IPATH_4BYTE_TID     0x10000
+                /* packet/word counters are 32 bit, else those 4 counters
+                 * are 64bit */
+#define IPATH_32BITCOUNTERS 0x20000
+                /* can miss port0 rx interrupts */
+#define IPATH_POLL_RX_INTR  0x40000
+#define IPATH_DISABLED      0x80000 /* administratively disabled */
+
+/* portdata flag bit offsets */
+                /* waiting for a packet to arrive */
+#define IPATH_PORT_WAITING_RCV   2
+                /* waiting for a PIO buffer to be available */
+#define IPATH_PORT_WAITING_PIO   3
+
+/* free up any allocated data at closes */
+void ipath_free_data(struct ipath_portdata *dd);
+int ipath_waitfor_mdio_cmdready(struct ipath_devdata *);
+int ipath_waitfor_complete(struct ipath_devdata *, ipath_kreg, u64, u64 *);
+u32 __iomem *ipath_getpiobuf(struct ipath_devdata *, u32 *);
+/* init PE-800-specific func */
+void ipath_init_pe800_funcs(struct ipath_devdata *);
+/* init HT-400-specific func */
+void ipath_init_ht400_funcs(struct ipath_devdata *);
+void ipath_get_guid(struct ipath_devdata *);
+u64 ipath_snap_cntr(struct ipath_devdata *, ipath_creg);
+
+/*
+ * number of words used for protocol header if not set by ipath_userinit();
+ */
+#define IPATH_DFLT_RCVHDRSIZE 9
+
+#define IPATH_MDIO_CMD_WRITE   1
+#define IPATH_MDIO_CMD_READ    2
+#define IPATH_MDIO_CLD_DIV     25       /* to get 2.5 Mhz mdio clock */
+#define IPATH_MDIO_CMDVALID    0x40000000       /* bit 30 */
+#define IPATH_MDIO_DATAVALID   0x80000000       /* bit 31 */
+#define IPATH_MDIO_CTRL_STD    0x0
+
+static inline u64 ipath_mdio_req(int cmd, int dev, int reg, int data)
+{
+        return (((u64) IPATH_MDIO_CLD_DIV) << 32) |
+                (cmd << 26) |
+                (dev << 21) |
+                (reg << 16) |
+                (data & 0xFFFF);
+}
+
+                /* signal and fifo status, in bank 31 */
+#define IPATH_MDIO_CTRL_XGXS_REG_8  0x8
+                /* controls loopback, redundancy */
+#define IPATH_MDIO_CTRL_8355_REG_1  0x10
+                /* premph, encdec, etc. */
+#define IPATH_MDIO_CTRL_8355_REG_2  0x11
+                /* Kchars, etc. */
+#define IPATH_MDIO_CTRL_8355_REG_6  0x15
+#define IPATH_MDIO_CTRL_8355_REG_9  0x18
+#define IPATH_MDIO_CTRL_8355_REG_10 0x1D
+
+int ipath_get_user_pages(unsigned long, size_t, struct page **);
+int ipath_get_user_pages_nocopy(unsigned long, struct page **);
+void ipath_release_user_pages(struct page **, size_t);
+void ipath_release_user_pages_on_close(struct page **, size_t);
+int ipath_eeprom_read(struct ipath_devdata *, u8, void *, int);
+int ipath_eeprom_write(struct ipath_devdata *, u8, const void *, int);
+
+/* these are used for the registers that vary with port */
+void ipath_write_kreg_port(const struct ipath_devdata *, ipath_kreg,
+                           unsigned, u64);
+u64 ipath_read_kreg64_port(const struct ipath_devdata *, ipath_kreg,
+                           unsigned);
+
+/*
+ * We could have a single register get/put routine, that takes a group type,
+ * but this is somewhat clearer and cleaner.  It also gives us some error
+ * checking.  64 bit register reads should always work, but are inefficient
+ * on opteron (the northbridge always generates 2 separate HT 32 bit reads),
+ * so we use kreg32 wherever possible.  User register and counter register
+ * reads are always 32 bit reads, so only one form of those routines.
+ */
+
+/*
+ * At the moment, none of the s-registers are writable, so no
+ * ipath_write_sreg(), and none of the c-registers are writable, so no
+ * ipath_write_creg().
+ */
+
+/**
+ * ipath_read_ureg32 - read 32-bit virtualized per-port register
+ * @dd: device
+ * @regno: register number
+ * @port: port number
+ *
+ * Return the contents of a register that is virtualized to be per port.
+ * Prints a debug message and returns -1 on errors (not distinguishable from
+ * valid contents at runtime; we may add a separate error variable at some
+ * point).
+ *
+ * This is normally not used by the kernel, but may be for debugging, and
+ * has a different implementation than user mode, which is why it's not in
+ * _common.h.
+ */
+static inline u32 ipath_read_ureg32(const struct ipath_devdata *dd,
+                                    ipath_ureg regno, int port)
+{
+        if (!dd->ipath_kregbase)
+                return 0;
+
+        return readl(regno + (u64 __iomem *)
+                     (dd->ipath_uregbase +
+                      (char __iomem *)dd->ipath_kregbase +
+                      dd->ipath_palign * port));
+}
+
+/**
+ * ipath_write_ureg - write 32-bit virtualized per-port register
+ * @dd: device
+ * @regno: register number
+ * @value: value
+ * @port: port
+ *
+ * Write the contents of a register that is virtualized to be per port.
+ */
+static inline void ipath_write_ureg(const struct ipath_devdata *dd,
+                                    ipath_ureg regno, u64 value, int port)
+{
+        u64 __iomem *ubase = (u64 __iomem *)
+                (dd->ipath_uregbase + (char __iomem *) dd->ipath_kregbase +
+                 dd->ipath_palign * port);
+        if (dd->ipath_kregbase)
+                writeq(value, &ubase[regno]);
+}
+
+static inline u32 ipath_read_kreg32(const struct ipath_devdata *dd,
+                                    ipath_kreg regno)
+{
+        if (!dd->ipath_kregbase)
+                return -1;
+        return readl((u32 __iomem *) & dd->ipath_kregbase[regno]);
+}
+
+static inline u64 ipath_read_kreg64(const struct ipath_devdata *dd,
+                                    ipath_kreg regno)
+{
+        if (!dd->ipath_kregbase)
+                return -1;
+
+        return readq(&dd->ipath_kregbase[regno]);
+}
+
+static inline void ipath_write_kreg(const struct ipath_devdata *dd,
+                                    ipath_kreg regno, u64 value)
+{
+        if (dd->ipath_kregbase)
+                writeq(value, &dd->ipath_kregbase[regno]);
+}
+
+static inline u64 ipath_read_creg(const struct ipath_devdata *dd,
+                                  ipath_sreg regno)
+{
+        if (!dd->ipath_kregbase)
+                return 0;
+
+        return readq(regno + (u64 __iomem *)
+                     (dd->ipath_cregbase +
+                      (char __iomem *)dd->ipath_kregbase));
+}
+
+static inline u32 ipath_read_creg32(const struct ipath_devdata *dd,
+                                         ipath_sreg regno)
+{
+        if (!dd->ipath_kregbase)
+                return 0;
+        return readl(regno + (u64 __iomem *)
+                     (dd->ipath_cregbase +
+                      (char __iomem *)dd->ipath_kregbase));
+}
+
+/*
+ * sysfs interface.
+ */
+
+struct device_driver;
+
+extern const char ipath_core_version[];
+
+int ipath_driver_create_group(struct device_driver *);
+void ipath_driver_remove_group(struct device_driver *);
+
+int ipath_device_create_group(struct device *, struct ipath_devdata *);
+void ipath_device_remove_group(struct device *, struct ipath_devdata *);
+int ipath_expose_reset(struct device *);
+
+int ipath_init_ipathfs(void);
+void ipath_exit_ipathfs(void);
+int ipathfs_add_device(struct ipath_devdata *);
+int ipathfs_remove_device(struct ipath_devdata *);
+
+/*
+ * Flush write combining store buffers (if present) and perform a write
+ * barrier.
+ */
+#if defined(CONFIG_X86_64)
+#define ipath_flush_wc() asm volatile("sfence" ::: "memory")
+#else
+#define ipath_flush_wc() wmb()
+#endif
+
+extern unsigned ipath_debug; /* debugging bit mask */
+
+const char *ipath_get_unit_name(int unit);
+
+extern struct mutex ipath_mutex;
+
+#define IPATH_DRV_NAME          "ipath_core"
+#define IPATH_MAJOR             233
+#define IPATH_SMA_MINOR         128
+#define IPATH_DIAG_MINOR        129
+#define IPATH_NMINORS           130
+
+#define ipath_dev_err(dd,fmt,...) \
+        do { \
+                const struct ipath_devdata *__dd = (dd); \
+                if (__dd->pcidev) \
+                        dev_err(&__dd->pcidev->dev, "%s: " fmt, \
+                                ipath_get_unit_name(__dd->ipath_unit), \
+                                ##__VA_ARGS__); \
+                else \
+                        printk(KERN_ERR IPATH_DRV_NAME ": %s: " fmt, \
+                               ipath_get_unit_name(__dd->ipath_unit), \
+                               ##__VA_ARGS__); \
+        } while (0)
+
+#if _IPATH_DEBUGGING
+
+# define __IPATH_DBG_WHICH(which,fmt,...) \
+        do { \
+                if(unlikely(ipath_debug&(which))) \
+                        printk(KERN_DEBUG IPATH_DRV_NAME ": %s: " fmt, \
+                               __func__,##__VA_ARGS__); \
+        } while(0)
+
+# define ipath_dbg(fmt,...) \
+        __IPATH_DBG_WHICH(__IPATH_DBG,fmt,##__VA_ARGS__)
+# define ipath_cdbg(which,fmt,...) \
+        __IPATH_DBG_WHICH(__IPATH_##which##DBG,fmt,##__VA_ARGS__)
+
+#else /* ! _IPATH_DEBUGGING */
+
+# define ipath_dbg(fmt,...)
+# define ipath_cdbg(which,fmt,...)
+
+#endif /* _IPATH_DEBUGGING */
+
+#endif                          /* _IPATH_KERNEL_H */
diff --git a/drivers/infiniband/hw/ipath/ipath_keys.c b/drivers/infiniband/hw/ipath/ipath_keys.c
new file mode 100644
index 000000000000..aa33b0e9f2f6
--- /dev/null
+++ b/drivers/infiniband/hw/ipath/ipath_keys.c
@@ -0,0 +1,236 @@
+/*
+ * Copyright (c) 2005, 2006 PathScale, Inc. All rights reserved.
+ *
+ * This software is available to you under a choice of one of two
+ * licenses.  You may choose to be licensed under the terms of the GNU
+ * General Public License (GPL) Version 2, available from the file
+ * COPYING in the main directory of this source tree, or the
+ * OpenIB.org BSD license below:
+ *
+ *     Redistribution and use in source and binary forms, with or
+ *     without modification, are permitted provided that the following
+ *     conditions are met:
+ *
+ *      - Redistributions of source code must retain the above
+ *        copyright notice, this list of conditions and the following
+ *        disclaimer.
+ *
+ *      - Redistributions in binary form must reproduce the above
+ *        copyright notice, this list of conditions and the following
+ *        disclaimer in the documentation and/or other materials
+ *        provided with the distribution.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+ * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+ * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+ * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
+ * BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
+ * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
+ * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+ * SOFTWARE.
+ */
+
+#include <asm/io.h>
+
+#include "ipath_verbs.h"
+
+/**
+ * ipath_alloc_lkey - allocate an lkey
+ * @rkt: lkey table in which to allocate the lkey
+ * @mr: memory region that this lkey protects
+ *
+ * Returns 1 if successful, otherwise returns 0.
+ */
+
+int ipath_alloc_lkey(struct ipath_lkey_table *rkt, struct ipath_mregion *mr)
+{
+        unsigned long flags;
+        u32 r;
+        u32 n;
+        int ret;
+
+        spin_lock_irqsave(&rkt->lock, flags);
+
+        /* Find the next available LKEY */
+        r = n = rkt->next;
+        for (;;) {
+                if (rkt->table[r] == NULL)
+                        break;
+                r = (r + 1) & (rkt->max - 1);
+                if (r == n) {
+                        spin_unlock_irqrestore(&rkt->lock, flags);
+                        _VERBS_INFO("LKEY table full\n");
+                        ret = 0;
+                        goto bail;
+                }
+        }
+        rkt->next = (r + 1) & (rkt->max - 1);
+        /*
+         * Make sure lkey is never zero which is reserved to indicate an
+         * unrestricted LKEY.
+         */
+        rkt->gen++;
+        mr->lkey = (r << (32 - ib_ipath_lkey_table_size)) |
+                ((((1 << (24 - ib_ipath_lkey_table_size)) - 1) & rkt->gen)
+                 << 8);
+        if (mr->lkey == 0) {
+                mr->lkey |= 1 << 8;
+                rkt->gen++;
+        }
+        rkt->table[r] = mr;
+        spin_unlock_irqrestore(&rkt->lock, flags);
+
+        ret = 1;
+
+bail:
+        return ret;
+}
+
+/**
+ * ipath_free_lkey - free an lkey
+ * @rkt: table from which to free the lkey
+ * @lkey: lkey id to free
+ */
+void ipath_free_lkey(struct ipath_lkey_table *rkt, u32 lkey)
+{
+        unsigned long flags;
+        u32 r;
+
+        if (lkey == 0)
+                return;
+        r = lkey >> (32 - ib_ipath_lkey_table_size);
+        spin_lock_irqsave(&rkt->lock, flags);
+        rkt->table[r] = NULL;
+        spin_unlock_irqrestore(&rkt->lock, flags);
+}
+
+/**
+ * ipath_lkey_ok - check IB SGE for validity and initialize
+ * @rkt: table containing lkey to check SGE against
+ * @isge: outgoing internal SGE
+ * @sge: SGE to check
+ * @acc: access flags
+ *
+ * Return 1 if valid and successful, otherwise returns 0.
+ *
+ * Check the IB SGE for validity and initialize our internal version
+ * of it.
+ */
+int ipath_lkey_ok(struct ipath_lkey_table *rkt, struct ipath_sge *isge,
+                  struct ib_sge *sge, int acc)
+{
+        struct ipath_mregion *mr;
+        size_t off;
+        int ret;
+
+        /*
+         * We use LKEY == zero to mean a physical kmalloc() address.
+         * This is a bit of a hack since we rely on dma_map_single()
+         * being reversible by calling bus_to_virt().
+         */
+        if (sge->lkey == 0) {
+                isge->mr = NULL;
+                isge->vaddr = bus_to_virt(sge->addr);
+                isge->length = sge->length;
+                isge->sge_length = sge->length;
+                ret = 1;
+                goto bail;
+        }
+        spin_lock(&rkt->lock);
+        mr = rkt->table[(sge->lkey >> (32 - ib_ipath_lkey_table_size))];
+        spin_unlock(&rkt->lock);
+        if (unlikely(mr == NULL || mr->lkey != sge->lkey)) {
+                ret = 0;
+                goto bail;
+        }
+
+        off = sge->addr - mr->user_base;
+        if (unlikely(sge->addr < mr->user_base ||
+                     off + sge->length > mr->length ||
+                     (mr->access_flags & acc) != acc)) {
+                ret = 0;
+                goto bail;
+        }
+
+        off += mr->offset;
+        isge->mr = mr;
+        isge->m = 0;
+        isge->n = 0;
+        while (off >= mr->map[isge->m]->segs[isge->n].length) {
+                off -= mr->map[isge->m]->segs[isge->n].length;
+                isge->n++;
+                if (isge->n >= IPATH_SEGSZ) {
+                        isge->m++;
+                        isge->n = 0;
+                }
+        }
+        isge->vaddr = mr->map[isge->m]->segs[isge->n].vaddr + off;
+        isge->length = mr->map[isge->m]->segs[isge->n].length - off;
+        isge->sge_length = sge->length;
+
+        ret = 1;
+
+bail:
+        return ret;
+}
+
+/**
+ * ipath_rkey_ok - check the IB virtual address, length, and RKEY
+ * @dev: infiniband device
+ * @ss: SGE state
+ * @len: length of data
+ * @vaddr: virtual address to place data
+ * @rkey: rkey to check
+ * @acc: access flags
+ *
+ * Return 1 if successful, otherwise 0.
+ *
+ * The QP r_rq.lock should be held.
+ */
+int ipath_rkey_ok(struct ipath_ibdev *dev, struct ipath_sge_state *ss,
+                  u32 len, u64 vaddr, u32 rkey, int acc)
+{
+        struct ipath_lkey_table *rkt = &dev->lk_table;
+        struct ipath_sge *sge = &ss->sge;
+        struct ipath_mregion *mr;
+        size_t off;
+        int ret;
+
+        spin_lock(&rkt->lock);
+        mr = rkt->table[(rkey >> (32 - ib_ipath_lkey_table_size))];
+        spin_unlock(&rkt->lock);
+        if (unlikely(mr == NULL || mr->lkey != rkey)) {
+                ret = 0;
+                goto bail;
+        }
+
+        off = vaddr - mr->iova;
+        if (unlikely(vaddr < mr->iova || off + len > mr->length ||
+                     (mr->access_flags & acc) == 0)) {
+                ret = 0;
+                goto bail;
+        }
+
+        off += mr->offset;
+        sge->mr = mr;
+        sge->m = 0;
+        sge->n = 0;
+        while (off >= mr->map[sge->m]->segs[sge->n].length) {
+                off -= mr->map[sge->m]->segs[sge->n].length;
+                sge->n++;
+                if (sge->n >= IPATH_SEGSZ) {
+                        sge->m++;
+                        sge->n = 0;
+                }
+        }
+        sge->vaddr = mr->map[sge->m]->segs[sge->n].vaddr + off;
+        sge->length = mr->map[sge->m]->segs[sge->n].length - off;
+        sge->sge_length = len;
+        ss->sg_list = NULL;
+        ss->num_sge = 1;
+
+        ret = 1;
+
+bail:
+        return ret;
+}
diff --git a/drivers/infiniband/hw/ipath/ipath_layer.c b/drivers/infiniband/hw/ipath/ipath_layer.c
new file mode 100644
index 000000000000..2cabf6340572
--- /dev/null
+++ b/drivers/infiniband/hw/ipath/ipath_layer.c
@@ -0,0 +1,1515 @@
+/*
+ * Copyright (c) 2003, 2004, 2005, 2006 PathScale, Inc. All rights reserved.
+ *
+ * This software is available to you under a choice of one of two
+ * licenses.  You may choose to be licensed under the terms of the GNU
+ * General Public License (GPL) Version 2, available from the file
+ * COPYING in the main directory of this source tree, or the
+ * OpenIB.org BSD license below:
+ *
+ *     Redistribution and use in source and binary forms, with or
+ *     without modification, are permitted provided that the following
+ *     conditions are met:
+ *
+ *      - Redistributions of source code must retain the above
+ *        copyright notice, this list of conditions and the following
+ *        disclaimer.
+ *
+ *      - Redistributions in binary form must reproduce the above
+ *        copyright notice, this list of conditions and the following
+ *        disclaimer in the documentation and/or other materials
+ *        provided with the distribution.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+ * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+ * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+ * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
+ * BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
+ * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
+ * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+ * SOFTWARE.
+ */
+
+/*
+ * These are the routines used by layered drivers, currently just the
+ * layered ethernet driver and verbs layer.
+ */
+
+#include <linux/io.h>
+#include <linux/pci.h>
+#include <asm/byteorder.h>
+
+#include "ipath_kernel.h"
+#include "ips_common.h"
+#include "ipath_layer.h"
+
+/* Acquire before ipath_devs_lock. */
+static DEFINE_MUTEX(ipath_layer_mutex);
+
+u16 ipath_layer_rcv_opcode;
+static int (*layer_intr)(void *, u32);
+static int (*layer_rcv)(void *, void *, struct sk_buff *);
+static int (*layer_rcv_lid)(void *, void *);
+static int (*verbs_piobufavail)(void *);
+static void (*verbs_rcv)(void *, void *, void *, u32);
+int ipath_verbs_registered;
+
+static void *(*layer_add_one)(int, struct ipath_devdata *);
+static void (*layer_remove_one)(void *);
+static void *(*verbs_add_one)(int, struct ipath_devdata *);
+static void (*verbs_remove_one)(void *);
+static void (*verbs_timer_cb)(void *);
+
+int __ipath_layer_intr(struct ipath_devdata *dd, u32 arg)
+{
+        int ret = -ENODEV;
+
+        if (dd->ipath_layer.l_arg && layer_intr)
+                ret = layer_intr(dd->ipath_layer.l_arg, arg);
+
+        return ret;
+}
+
+int ipath_layer_intr(struct ipath_devdata *dd, u32 arg)
+{
+        int ret;
+
+        mutex_lock(&ipath_layer_mutex);
+
+        ret = __ipath_layer_intr(dd, arg);
+
+        mutex_unlock(&ipath_layer_mutex);
+
+        return ret;
+}
+
+int __ipath_layer_rcv(struct ipath_devdata *dd, void *hdr,
+                      struct sk_buff *skb)
+{
+        int ret = -ENODEV;
+
+        if (dd->ipath_layer.l_arg && layer_rcv)
+                ret = layer_rcv(dd->ipath_layer.l_arg, hdr, skb);
+
+        return ret;
+}
+
+int __ipath_layer_rcv_lid(struct ipath_devdata *dd, void *hdr)
+{
+        int ret = -ENODEV;
+
+        if (dd->ipath_layer.l_arg && layer_rcv_lid)
+                ret = layer_rcv_lid(dd->ipath_layer.l_arg, hdr);
+
+        return ret;
+}
+
+int __ipath_verbs_piobufavail(struct ipath_devdata *dd)
+{
+        int ret = -ENODEV;
+
+        if (dd->verbs_layer.l_arg && verbs_piobufavail)
+                ret = verbs_piobufavail(dd->verbs_layer.l_arg);
+
+        return ret;
+}
+
+int __ipath_verbs_rcv(struct ipath_devdata *dd, void *rc, void *ebuf,
+                      u32 tlen)
+{
+        int ret = -ENODEV;
+
+        if (dd->verbs_layer.l_arg && verbs_rcv) {
+                verbs_rcv(dd->verbs_layer.l_arg, rc, ebuf, tlen);
+                ret = 0;
+        }
+
+        return ret;
+}
+
+int ipath_layer_set_linkstate(struct ipath_devdata *dd, u8 newstate)
+{
+        u32 lstate;
+        int ret;
+
+        switch (newstate) {
+        case IPATH_IB_LINKDOWN:
+                ipath_set_ib_lstate(dd, INFINIPATH_IBCC_LINKINITCMD_POLL <<
+                                    INFINIPATH_IBCC_LINKINITCMD_SHIFT);
+                /* don't wait */
+                ret = 0;
+                goto bail;
+
+        case IPATH_IB_LINKDOWN_SLEEP:
+                ipath_set_ib_lstate(dd, INFINIPATH_IBCC_LINKINITCMD_SLEEP <<
+                                    INFINIPATH_IBCC_LINKINITCMD_SHIFT);
+                /* don't wait */
+                ret = 0;
+                goto bail;
+
+        case IPATH_IB_LINKDOWN_DISABLE:
+                ipath_set_ib_lstate(dd,
+                                    INFINIPATH_IBCC_LINKINITCMD_DISABLE <<
+                                    INFINIPATH_IBCC_LINKINITCMD_SHIFT);
+                /* don't wait */
+                ret = 0;
+                goto bail;
+
+        case IPATH_IB_LINKINIT:
+                if (dd->ipath_flags & IPATH_LINKINIT) {
+                        ret = 0;
+                        goto bail;
+                }
+                ipath_set_ib_lstate(dd, INFINIPATH_IBCC_LINKCMD_INIT <<
+                                    INFINIPATH_IBCC_LINKCMD_SHIFT);
+                lstate = IPATH_LINKINIT;
+                break;
+
+        case IPATH_IB_LINKARM:
+                if (dd->ipath_flags & IPATH_LINKARMED) {
+                        ret = 0;
+                        goto bail;
+                }
+                if (!(dd->ipath_flags &
+                      (IPATH_LINKINIT | IPATH_LINKACTIVE))) {
+                        ret = -EINVAL;
+                        goto bail;
+                }
+                ipath_set_ib_lstate(dd, INFINIPATH_IBCC_LINKCMD_ARMED <<
+                                    INFINIPATH_IBCC_LINKCMD_SHIFT);
+                /*
+                 * Since the port can transition to ACTIVE by receiving
+                 * a non VL 15 packet, wait for either state.
+                 */
+                lstate = IPATH_LINKARMED | IPATH_LINKACTIVE;
+                break;
+
+        case IPATH_IB_LINKACTIVE:
+                if (dd->ipath_flags & IPATH_LINKACTIVE) {
+                        ret = 0;
+                        goto bail;
+                }
+                if (!(dd->ipath_flags & IPATH_LINKARMED)) {
+                        ret = -EINVAL;
+                        goto bail;
+                }
+                ipath_set_ib_lstate(dd, INFINIPATH_IBCC_LINKCMD_ACTIVE <<
+                                    INFINIPATH_IBCC_LINKCMD_SHIFT);
+                lstate = IPATH_LINKACTIVE;
+                break;
+
+        default:
+                ipath_dbg("Invalid linkstate 0x%x requested\n", newstate);
+                ret = -EINVAL;
+                goto bail;
+        }
+        ret = ipath_wait_linkstate(dd, lstate, 2000);
+
+bail:
+        return ret;
+}
+
+EXPORT_SYMBOL_GPL(ipath_layer_set_linkstate);
+
+/**
+ * ipath_layer_set_mtu - set the MTU
+ * @dd: the infinipath device
+ * @arg: the new MTU
+ *
+ * we can handle "any" incoming size, the issue here is whether we
+ * need to restrict our outgoing size.   For now, we don't do any
+ * sanity checking on this, and we don't deal with what happens to
+ * programs that are already running when the size changes.
+ * NOTE: changing the MTU will usually cause the IBC to go back to
+ * link initialize (IPATH_IBSTATE_INIT) state...
+ */
+int ipath_layer_set_mtu(struct ipath_devdata *dd, u16 arg)
+{
+        u32 piosize;
+        int changed = 0;
+        int ret;
+
+        /*
+         * mtu is IB data payload max.  It's the largest power of 2 less
+         * than piosize (or even larger, since it only really controls the
+         * largest we can receive; we can send the max of the mtu and
+         * piosize).  We check that it's one of the valid IB sizes.
+         */
+        if (arg != 256 && arg != 512 && arg != 1024 && arg != 2048 &&
+            arg != 4096) {
+                ipath_dbg("Trying to set invalid mtu %u, failing\n", arg);
+                ret = -EINVAL;
+                goto bail;
+        }
+        if (dd->ipath_ibmtu == arg) {
+                ret = 0;        /* same as current */
+                goto bail;
+        }
+
+        piosize = dd->ipath_ibmaxlen;
+        dd->ipath_ibmtu = arg;
+
+        if (arg >= (piosize - IPATH_PIO_MAXIBHDR)) {
+                /* Only if it's not the initial value (or reset to it) */
+                if (piosize != dd->ipath_init_ibmaxlen) {
+                        dd->ipath_ibmaxlen = piosize;
+                        changed = 1;
+                }
+        } else if ((arg + IPATH_PIO_MAXIBHDR) != dd->ipath_ibmaxlen) {
+                piosize = arg + IPATH_PIO_MAXIBHDR;
+                ipath_cdbg(VERBOSE, "ibmaxlen was 0x%x, setting to 0x%x "
+                           "(mtu 0x%x)\n", dd->ipath_ibmaxlen, piosize,
+                           arg);
+                dd->ipath_ibmaxlen = piosize;
+                changed = 1;
+        }
+
+        if (changed) {
+                /*
+                 * set the IBC maxpktlength to the size of our pio
+                 * buffers in words
+                 */
+                u64 ibc = dd->ipath_ibcctrl;
+                ibc &= ~(INFINIPATH_IBCC_MAXPKTLEN_MASK <<
+                         INFINIPATH_IBCC_MAXPKTLEN_SHIFT);
+
+                piosize = piosize - 2 * sizeof(u32);    /* ignore pbc */
+                dd->ipath_ibmaxlen = piosize;
+                piosize /= sizeof(u32); /* in words */
+                /*
+                 * for ICRC, which we only send in diag test pkt mode, and
+                 * we don't need to worry about that for mtu
+                 */
+                piosize += 1;
+
+                ibc |= piosize << INFINIPATH_IBCC_MAXPKTLEN_SHIFT;
+                dd->ipath_ibcctrl = ibc;
+                ipath_write_kreg(dd, dd->ipath_kregs->kr_ibcctrl,
+                                 dd->ipath_ibcctrl);
+                dd->ipath_f_tidtemplate(dd);
+        }
+
+        ret = 0;
+
+bail:
+        return ret;
+}
+
+EXPORT_SYMBOL_GPL(ipath_layer_set_mtu);
+
+int ipath_set_sps_lid(struct ipath_devdata *dd, u32 arg, u8 lmc)
+{
+        ipath_stats.sps_lid[dd->ipath_unit] = arg;
+        dd->ipath_lid = arg;
+        dd->ipath_lmc = lmc;
+
+        mutex_lock(&ipath_layer_mutex);
+
+        if (dd->ipath_layer.l_arg && layer_intr)
+                layer_intr(dd->ipath_layer.l_arg, IPATH_LAYER_INT_LID);
+
+        mutex_unlock(&ipath_layer_mutex);
+
+        return 0;
+}
+
+EXPORT_SYMBOL_GPL(ipath_set_sps_lid);
+
+int ipath_layer_set_guid(struct ipath_devdata *dd, __be64 guid)
+{
+        /* XXX - need to inform anyone who cares this just happened. */
+        dd->ipath_guid = guid;
+        return 0;
+}
+
+EXPORT_SYMBOL_GPL(ipath_layer_set_guid);
+
+__be64 ipath_layer_get_guid(struct ipath_devdata *dd)
+{
+        return dd->ipath_guid;
+}
+
+EXPORT_SYMBOL_GPL(ipath_layer_get_guid);
+
+u32 ipath_layer_get_nguid(struct ipath_devdata *dd)
+{
+        return dd->ipath_nguid;
+}
+
+EXPORT_SYMBOL_GPL(ipath_layer_get_nguid);
+
+int ipath_layer_query_device(struct ipath_devdata *dd, u32 * vendor,
+                             u32 * boardrev, u32 * majrev, u32 * minrev)
+{
+        *vendor = dd->ipath_vendorid;
+        *boardrev = dd->ipath_boardrev;
+        *majrev = dd->ipath_majrev;
+        *minrev = dd->ipath_minrev;
+
+        return 0;
+}
+
+EXPORT_SYMBOL_GPL(ipath_layer_query_device);
+
+u32 ipath_layer_get_flags(struct ipath_devdata *dd)
+{
+        return dd->ipath_flags;
+}
+
+EXPORT_SYMBOL_GPL(ipath_layer_get_flags);
+
+struct device *ipath_layer_get_device(struct ipath_devdata *dd)
+{
+        return &dd->pcidev->dev;
+}
+
+EXPORT_SYMBOL_GPL(ipath_layer_get_device);
+
+u16 ipath_layer_get_deviceid(struct ipath_devdata *dd)
+{
+        return dd->ipath_deviceid;
+}
+
+EXPORT_SYMBOL_GPL(ipath_layer_get_deviceid);
+
+u64 ipath_layer_get_lastibcstat(struct ipath_devdata *dd)
+{
+        return dd->ipath_lastibcstat;
+}
+
+EXPORT_SYMBOL_GPL(ipath_layer_get_lastibcstat);
+
+u32 ipath_layer_get_ibmtu(struct ipath_devdata *dd)
+{
+        return dd->ipath_ibmtu;
+}
+
+EXPORT_SYMBOL_GPL(ipath_layer_get_ibmtu);
+
+void ipath_layer_add(struct ipath_devdata *dd)
+{
+        mutex_lock(&ipath_layer_mutex);
+
+        if (layer_add_one)
+                dd->ipath_layer.l_arg =
+                        layer_add_one(dd->ipath_unit, dd);
+
+        if (verbs_add_one)
+                dd->verbs_layer.l_arg =
+                        verbs_add_one(dd->ipath_unit, dd);
+
+        mutex_unlock(&ipath_layer_mutex);
+}
+
+void ipath_layer_del(struct ipath_devdata *dd)
+{
+        mutex_lock(&ipath_layer_mutex);
+
+        if (dd->ipath_layer.l_arg && layer_remove_one) {
+                layer_remove_one(dd->ipath_layer.l_arg);
+                dd->ipath_layer.l_arg = NULL;
+        }
+
+        if (dd->verbs_layer.l_arg && verbs_remove_one) {
+                verbs_remove_one(dd->verbs_layer.l_arg);
+                dd->verbs_layer.l_arg = NULL;
+        }
+
+        mutex_unlock(&ipath_layer_mutex);
+}
+
+int ipath_layer_register(void *(*l_add)(int, struct ipath_devdata *),
+                         void (*l_remove)(void *),
+                         int (*l_intr)(void *, u32),
+                         int (*l_rcv)(void *, void *, struct sk_buff *),
+                         u16 l_rcv_opcode,
+                         int (*l_rcv_lid)(void *, void *))
+{
+        struct ipath_devdata *dd, *tmp;
+        unsigned long flags;
+
+        mutex_lock(&ipath_layer_mutex);
+
+        layer_add_one = l_add;
+        layer_remove_one = l_remove;
+        layer_intr = l_intr;
+        layer_rcv = l_rcv;
+        layer_rcv_lid = l_rcv_lid;
+        ipath_layer_rcv_opcode = l_rcv_opcode;
+
+        spin_lock_irqsave(&ipath_devs_lock, flags);
+
+        list_for_each_entry_safe(dd, tmp, &ipath_dev_list, ipath_list) {
+                if (!(dd->ipath_flags & IPATH_INITTED))
+                        continue;
+
+                if (dd->ipath_layer.l_arg)
+                        continue;
+
+                if (!(*dd->ipath_statusp & IPATH_STATUS_SMA))
+                        *dd->ipath_statusp |= IPATH_STATUS_OIB_SMA;
+
+                spin_unlock_irqrestore(&ipath_devs_lock, flags);
+                dd->ipath_layer.l_arg = l_add(dd->ipath_unit, dd);
+                spin_lock_irqsave(&ipath_devs_lock, flags);
+        }
+
+        spin_unlock_irqrestore(&ipath_devs_lock, flags);
+        mutex_unlock(&ipath_layer_mutex);
+
+        return 0;
+}
+
+EXPORT_SYMBOL_GPL(ipath_layer_register);
+
+void ipath_layer_unregister(void)
+{
+        struct ipath_devdata *dd, *tmp;
+        unsigned long flags;
+
+        mutex_lock(&ipath_layer_mutex);
+        spin_lock_irqsave(&ipath_devs_lock, flags);
+
+        list_for_each_entry_safe(dd, tmp, &ipath_dev_list, ipath_list) {
+                if (dd->ipath_layer.l_arg && layer_remove_one) {
+                        spin_unlock_irqrestore(&ipath_devs_lock, flags);
+                        layer_remove_one(dd->ipath_layer.l_arg);
+                        spin_lock_irqsave(&ipath_devs_lock, flags);
+                        dd->ipath_layer.l_arg = NULL;
+                }
+        }
+
+        spin_unlock_irqrestore(&ipath_devs_lock, flags);
+
+        layer_add_one = NULL;
+        layer_remove_one = NULL;
+        layer_intr = NULL;
+        layer_rcv = NULL;
+        layer_rcv_lid = NULL;
+
+        mutex_unlock(&ipath_layer_mutex);
+}
+
+EXPORT_SYMBOL_GPL(ipath_layer_unregister);
+
+static void __ipath_verbs_timer(unsigned long arg)
+{
+        struct ipath_devdata *dd = (struct ipath_devdata *) arg;
+
+        /*
+         * If port 0 receive packet interrupts are not available, or
+         * can be missed, poll the receive queue
+         */
+        if (dd->ipath_flags & IPATH_POLL_RX_INTR)
+                ipath_kreceive(dd);
+
+        /* Handle verbs layer timeouts. */
+        if (dd->verbs_layer.l_arg && verbs_timer_cb)
+                verbs_timer_cb(dd->verbs_layer.l_arg);
+
+        mod_timer(&dd->verbs_layer.l_timer, jiffies + 1);
+}
+
+/**
+ * ipath_verbs_register - verbs layer registration
+ * @l_piobufavail: callback for when PIO buffers become available
+ * @l_rcv: callback for receiving a packet
+ * @l_timer_cb: timer callback
+ * @ipath_devdata: device data structure is put here
+ */
+int ipath_verbs_register(void *(*l_add)(int, struct ipath_devdata *),
+                         void (*l_remove)(void *arg),
+                         int (*l_piobufavail) (void *arg),
+                         void (*l_rcv) (void *arg, void *rhdr,
+                                        void *data, u32 tlen),
+                         void (*l_timer_cb) (void *arg))
+{
+        struct ipath_devdata *dd, *tmp;
+        unsigned long flags;
+
+        mutex_lock(&ipath_layer_mutex);
+
+        verbs_add_one = l_add;
+        verbs_remove_one = l_remove;
+        verbs_piobufavail = l_piobufavail;
+        verbs_rcv = l_rcv;
+        verbs_timer_cb = l_timer_cb;
+
+        spin_lock_irqsave(&ipath_devs_lock, flags);
+
+        list_for_each_entry_safe(dd, tmp, &ipath_dev_list, ipath_list) {
+                if (!(dd->ipath_flags & IPATH_INITTED))
+                        continue;
+
+                if (dd->verbs_layer.l_arg)
+                        continue;
+
+                spin_unlock_irqrestore(&ipath_devs_lock, flags);
+                dd->verbs_layer.l_arg = l_add(dd->ipath_unit, dd);
+                spin_lock_irqsave(&ipath_devs_lock, flags);
+        }
+
+        spin_unlock_irqrestore(&ipath_devs_lock, flags);
+        mutex_unlock(&ipath_layer_mutex);
+
+        ipath_verbs_registered = 1;
+
+        return 0;
+}
+
+EXPORT_SYMBOL_GPL(ipath_verbs_register);
+
+void ipath_verbs_unregister(void)
+{
+        struct ipath_devdata *dd, *tmp;
+        unsigned long flags;
+
+        mutex_lock(&ipath_layer_mutex);
+        spin_lock_irqsave(&ipath_devs_lock, flags);
+
+        list_for_each_entry_safe(dd, tmp, &ipath_dev_list, ipath_list) {
+                *dd->ipath_statusp &= ~IPATH_STATUS_OIB_SMA;
+
+                if (dd->verbs_layer.l_arg && verbs_remove_one) {
+                        spin_unlock_irqrestore(&ipath_devs_lock, flags);
+                        verbs_remove_one(dd->verbs_layer.l_arg);
+                        spin_lock_irqsave(&ipath_devs_lock, flags);
+                        dd->verbs_layer.l_arg = NULL;
+                }
+        }
+
+        spin_unlock_irqrestore(&ipath_devs_lock, flags);
+
+        verbs_add_one = NULL;
+        verbs_remove_one = NULL;
+        verbs_piobufavail = NULL;
+        verbs_rcv = NULL;
+        verbs_timer_cb = NULL;
+
+        mutex_unlock(&ipath_layer_mutex);
+}
+
+EXPORT_SYMBOL_GPL(ipath_verbs_unregister);
+
+int ipath_layer_open(struct ipath_devdata *dd, u32 * pktmax)
+{
+        int ret;
+        u32 intval = 0;
+
+        mutex_lock(&ipath_layer_mutex);
+
+        if (!dd->ipath_layer.l_arg) {
+                ret = -EINVAL;
+                goto bail;
+        }
+
+        ret = ipath_setrcvhdrsize(dd, NUM_OF_EXTRA_WORDS_IN_HEADER_QUEUE);
+
+        if (ret < 0)
+                goto bail;
+
+        *pktmax = dd->ipath_ibmaxlen;
+
+        if (*dd->ipath_statusp & IPATH_STATUS_IB_READY)
+                intval |= IPATH_LAYER_INT_IF_UP;
+        if (ipath_stats.sps_lid[dd->ipath_unit])
+                intval |= IPATH_LAYER_INT_LID;
+        if (ipath_stats.sps_mlid[dd->ipath_unit])
+                intval |= IPATH_LAYER_INT_BCAST;
+        /*
+         * do this on open, in case low level is already up and
+         * just layered driver was reloaded, etc.
+         */
+        if (intval)
+                layer_intr(dd->ipath_layer.l_arg, intval);
+
+        ret = 0;
+bail:
+        mutex_unlock(&ipath_layer_mutex);
+
+        return ret;
+}
+
+EXPORT_SYMBOL_GPL(ipath_layer_open);
+
+u16 ipath_layer_get_lid(struct ipath_devdata *dd)
+{
+        return dd->ipath_lid;
+}
+
+EXPORT_SYMBOL_GPL(ipath_layer_get_lid);
+
+/**
+ * ipath_layer_get_mac - get the MAC address
+ * @dd: the infinipath device
+ * @mac: the MAC is put here
+ *
+ * This is the EUID-64 OUI octets (top 3), then
+ * skip the next 2 (which should both be zero or 0xff).
+ * The returned MAC is in network order
+ * mac points to at least 6 bytes of buffer
+ * We assume that by the time the LID is set, that the GUID is as valid
+ * as it's ever going to be, rather than adding yet another status bit.
+ */
+
+int ipath_layer_get_mac(struct ipath_devdata *dd, u8 * mac)
+{
+        u8 *guid;
+
+        guid = (u8 *) &dd->ipath_guid;
+
+        mac[0] = guid[0];
+        mac[1] = guid[1];
+        mac[2] = guid[2];
+        mac[3] = guid[5];
+        mac[4] = guid[6];
+        mac[5] = guid[7];
+        if ((guid[3] || guid[4]) && !(guid[3] == 0xff && guid[4] == 0xff))
+                ipath_dbg("Warning, guid bytes 3 and 4 not 0 or 0xffff: "
+                          "%x %x\n", guid[3], guid[4]);
+        return 0;
+}
+
+EXPORT_SYMBOL_GPL(ipath_layer_get_mac);
+
+u16 ipath_layer_get_bcast(struct ipath_devdata *dd)
+{
+        return dd->ipath_mlid;
+}
+
+EXPORT_SYMBOL_GPL(ipath_layer_get_bcast);
+
+u32 ipath_layer_get_cr_errpkey(struct ipath_devdata *dd)
+{
+        return ipath_read_creg32(dd, dd->ipath_cregs->cr_errpkey);
+}
+
+EXPORT_SYMBOL_GPL(ipath_layer_get_cr_errpkey);
+
+static void update_sge(struct ipath_sge_state *ss, u32 length)
+{
+        struct ipath_sge *sge = &ss->sge;
+
+        sge->vaddr += length;
+        sge->length -= length;
+        sge->sge_length -= length;
+        if (sge->sge_length == 0) {
+                if (--ss->num_sge)
+                        *sge = *ss->sg_list++;
+        } else if (sge->length == 0 && sge->mr != NULL) {
+                if (++sge->n >= IPATH_SEGSZ) {
+                        if (++sge->m >= sge->mr->mapsz)
+                                return;
+                        sge->n = 0;
+                }
+                sge->vaddr = sge->mr->map[sge->m]->segs[sge->n].vaddr;
+                sge->length = sge->mr->map[sge->m]->segs[sge->n].length;
+        }
+}
+
+#ifdef __LITTLE_ENDIAN
+static inline u32 get_upper_bits(u32 data, u32 shift)
+{
+        return data >> shift;
+}
+
+static inline u32 set_upper_bits(u32 data, u32 shift)
+{
+        return data << shift;
+}
+
+static inline u32 clear_upper_bytes(u32 data, u32 n, u32 off)
+{
+        data <<= ((sizeof(u32) - n) * BITS_PER_BYTE);
+        data >>= ((sizeof(u32) - n - off) * BITS_PER_BYTE);
+        return data;
+}
+#else
+static inline u32 get_upper_bits(u32 data, u32 shift)
+{
+        return data << shift;
+}
+
+static inline u32 set_upper_bits(u32 data, u32 shift)
+{
+        return data >> shift;
+}
+
+static inline u32 clear_upper_bytes(u32 data, u32 n, u32 off)
+{
+        data >>= ((sizeof(u32) - n) * BITS_PER_BYTE);
+        data <<= ((sizeof(u32) - n - off) * BITS_PER_BYTE);
+        return data;
+}
+#endif
+
+static void copy_io(u32 __iomem *piobuf, struct ipath_sge_state *ss,
+                    u32 length)
+{
+        u32 extra = 0;
+        u32 data = 0;
+        u32 last;
+
+        while (1) {
+                u32 len = ss->sge.length;
+                u32 off;
+
+                BUG_ON(len == 0);
+                if (len > length)
+                        len = length;
+                if (len > ss->sge.sge_length)
+                        len = ss->sge.sge_length;
+                /* If the source address is not aligned, try to align it. */
+                off = (unsigned long)ss->sge.vaddr & (sizeof(u32) - 1);
+                if (off) {
+                        u32 *addr = (u32 *)((unsigned long)ss->sge.vaddr &
+                                            ~(sizeof(u32) - 1));
+                        u32 v = get_upper_bits(*addr, off * BITS_PER_BYTE);
+                        u32 y;
+
+                        y = sizeof(u32) - off;
+                        if (len > y)
+                                len = y;
+                        if (len + extra >= sizeof(u32)) {
+                                data |= set_upper_bits(v, extra *
+                                                       BITS_PER_BYTE);
+                                len = sizeof(u32) - extra;
+                                if (len == length) {
+                                        last = data;
+                                        break;
+                                }
+                                __raw_writel(data, piobuf);
+                                piobuf++;
+                                extra = 0;
+                                data = 0;
+                        } else {
+                                /* Clear unused upper bytes */
+                                data |= clear_upper_bytes(v, len, extra);
+                                if (len == length) {
+                                        last = data;
+                                        break;
+                                }
+                                extra += len;
+                        }
+                } else if (extra) {
+                        /* Source address is aligned. */
+                        u32 *addr = (u32 *) ss->sge.vaddr;
+                        int shift = extra * BITS_PER_BYTE;
+                        int ushift = 32 - shift;
+                        u32 l = len;
+
+                        while (l >= sizeof(u32)) {
+                                u32 v = *addr;
+
+                                data |= set_upper_bits(v, shift);
+                                __raw_writel(data, piobuf);
+                                data = get_upper_bits(v, ushift);
+                                piobuf++;
+                                addr++;
+                                l -= sizeof(u32);
+                        }
+                        /*
+                         * We still have 'extra' number of bytes leftover.
+                         */
+                        if (l) {
+                                u32 v = *addr;
+
+                                if (l + extra >= sizeof(u32)) {
+                                        data |= set_upper_bits(v, shift);
+                                        len -= l + extra - sizeof(u32);
+                                        if (len == length) {
+                                                last = data;
+                                                break;
+                                        }
+                                        __raw_writel(data, piobuf);
+                                        piobuf++;
+                                        extra = 0;
+                                        data = 0;
+                                } else {
+                                        /* Clear unused upper bytes */
+                                        data |= clear_upper_bytes(v, l,
+                                                                  extra);
+                                        if (len == length) {
+                                                last = data;
+                                                break;
+                                        }
+                                        extra += l;
+                                }
+                        } else if (len == length) {
+                                last = data;
+                                break;
+                        }
+                } else if (len == length) {
+                        u32 w;
+
+                        /*
+                         * Need to round up for the last dword in the
+                         * packet.
+                         */
+                        w = (len + 3) >> 2;
+                        __iowrite32_copy(piobuf, ss->sge.vaddr, w - 1);
+                        piobuf += w - 1;
+                        last = ((u32 *) ss->sge.vaddr)[w - 1];
+                        break;
+                } else {
+                        u32 w = len >> 2;
+
+                        __iowrite32_copy(piobuf, ss->sge.vaddr, w);
+                        piobuf += w;
+
+                        extra = len & (sizeof(u32) - 1);
+                        if (extra) {
+                                u32 v = ((u32 *) ss->sge.vaddr)[w];
+
+                                /* Clear unused upper bytes */
+                                data = clear_upper_bytes(v, extra, 0);
+                        }
+                }
+                update_sge(ss, len);
+                length -= len;
+        }
+        /* must flush early everything before trigger word */
+        ipath_flush_wc();
+        __raw_writel(last, piobuf);
+        /* be sure trigger word is written */
+        ipath_flush_wc();
+        update_sge(ss, length);
+}
+
+/**
+ * ipath_verbs_send - send a packet from the verbs layer
+ * @dd: the infinipath device
+ * @hdrwords: the number of works in the header
+ * @hdr: the packet header
+ * @len: the length of the packet in bytes
+ * @ss: the SGE to send
+ *
+ * This is like ipath_sma_send_pkt() in that we need to be able to send
+ * packets after the chip is initialized (MADs) but also like
+ * ipath_layer_send_hdr() since its used by the verbs layer.
+ */
+int ipath_verbs_send(struct ipath_devdata *dd, u32 hdrwords,
+                     u32 *hdr, u32 len, struct ipath_sge_state *ss)
+{
+        u32 __iomem *piobuf;
+        u32 plen;
+        int ret;
+
+        /* +1 is for the qword padding of pbc */
+        plen = hdrwords + ((len + 3) >> 2) + 1;
+        if (unlikely((plen << 2) > dd->ipath_ibmaxlen)) {
+                ipath_dbg("packet len 0x%x too long, failing\n", plen);
+                ret = -EINVAL;
+                goto bail;
+        }
+
+        /* Get a PIO buffer to use. */
+        piobuf = ipath_getpiobuf(dd, NULL);
+        if (unlikely(piobuf == NULL)) {
+                ret = -EBUSY;
+                goto bail;
+        }
+
+        /*
+         * Write len to control qword, no flags.
+         * We have to flush after the PBC for correctness on some cpus
+         * or WC buffer can be written out of order.
+         */
+        writeq(plen, piobuf);
+        ipath_flush_wc();
+        piobuf += 2;
+        if (len == 0) {
+                /*
+                 * If there is just the header portion, must flush before
+                 * writing last word of header for correctness, and after
+                 * the last header word (trigger word).
+                 */
+                __iowrite32_copy(piobuf, hdr, hdrwords - 1);
+                ipath_flush_wc();
+                __raw_writel(hdr[hdrwords - 1], piobuf + hdrwords - 1);
+                ipath_flush_wc();
+                ret = 0;
+                goto bail;
+        }
+
+        __iowrite32_copy(piobuf, hdr, hdrwords);
+        piobuf += hdrwords;
+
+        /* The common case is aligned and contained in one segment. */
+        if (likely(ss->num_sge == 1 && len <= ss->sge.length &&
+                   !((unsigned long)ss->sge.vaddr & (sizeof(u32) - 1)))) {
+                u32 w;
+
+                /* Need to round up for the last dword in the packet. */
+                w = (len + 3) >> 2;
+                __iowrite32_copy(piobuf, ss->sge.vaddr, w - 1);
+                /* must flush early everything before trigger word */
+                ipath_flush_wc();
+                __raw_writel(((u32 *) ss->sge.vaddr)[w - 1],
+                             piobuf + w - 1);
+                /* be sure trigger word is written */
+                ipath_flush_wc();
+                update_sge(ss, len);
+                ret = 0;
+                goto bail;
+        }
+        copy_io(piobuf, ss, len);
+        ret = 0;
+
+bail:
+        return ret;
+}
+
+EXPORT_SYMBOL_GPL(ipath_verbs_send);
+
+int ipath_layer_snapshot_counters(struct ipath_devdata *dd, u64 *swords,
+                                  u64 *rwords, u64 *spkts, u64 *rpkts,
+                                  u64 *xmit_wait)
+{
+        int ret;
+
+        if (!(dd->ipath_flags & IPATH_INITTED)) {
+                /* no hardware, freeze, etc. */
+                ipath_dbg("unit %u not usable\n", dd->ipath_unit);
+                ret = -EINVAL;
+                goto bail;
+        }
+        *swords = ipath_snap_cntr(dd, dd->ipath_cregs->cr_wordsendcnt);
+        *rwords = ipath_snap_cntr(dd, dd->ipath_cregs->cr_wordrcvcnt);
+        *spkts = ipath_snap_cntr(dd, dd->ipath_cregs->cr_pktsendcnt);
+        *rpkts = ipath_snap_cntr(dd, dd->ipath_cregs->cr_pktrcvcnt);
+        *xmit_wait = ipath_snap_cntr(dd, dd->ipath_cregs->cr_sendstallcnt);
+
+        ret = 0;
+
+bail:
+        return ret;
+}
+
+EXPORT_SYMBOL_GPL(ipath_layer_snapshot_counters);
+
+/**
+ * ipath_layer_get_counters - get various chip counters
+ * @dd: the infinipath device
+ * @cntrs: counters are placed here
+ *
+ * Return the counters needed by recv_pma_get_portcounters().
+ */
+int ipath_layer_get_counters(struct ipath_devdata *dd,
+                              struct ipath_layer_counters *cntrs)
+{
+        int ret;
+
+        if (!(dd->ipath_flags & IPATH_INITTED)) {
+                /* no hardware, freeze, etc. */
+                ipath_dbg("unit %u not usable\n", dd->ipath_unit);
+                ret = -EINVAL;
+                goto bail;
+        }
+        cntrs->symbol_error_counter =
+                ipath_snap_cntr(dd, dd->ipath_cregs->cr_ibsymbolerrcnt);
+        cntrs->link_error_recovery_counter =
+                ipath_snap_cntr(dd, dd->ipath_cregs->cr_iblinkerrrecovcnt);
+        cntrs->link_downed_counter =
+                ipath_snap_cntr(dd, dd->ipath_cregs->cr_iblinkdowncnt);
+        cntrs->port_rcv_errors =
+                ipath_snap_cntr(dd, dd->ipath_cregs->cr_rxdroppktcnt) +
+                ipath_snap_cntr(dd, dd->ipath_cregs->cr_rcvovflcnt) +
+                ipath_snap_cntr(dd, dd->ipath_cregs->cr_portovflcnt) +
+                ipath_snap_cntr(dd, dd->ipath_cregs->cr_errrcvflowctrlcnt) +
+                ipath_snap_cntr(dd, dd->ipath_cregs->cr_err_rlencnt) +
+                ipath_snap_cntr(dd, dd->ipath_cregs->cr_invalidrlencnt) +
+                ipath_snap_cntr(dd, dd->ipath_cregs->cr_erricrccnt) +
+                ipath_snap_cntr(dd, dd->ipath_cregs->cr_errvcrccnt) +
+                ipath_snap_cntr(dd, dd->ipath_cregs->cr_errlpcrccnt) +
+                ipath_snap_cntr(dd, dd->ipath_cregs->cr_errlinkcnt) +
+                ipath_snap_cntr(dd, dd->ipath_cregs->cr_badformatcnt);
+        cntrs->port_rcv_remphys_errors =
+                ipath_snap_cntr(dd, dd->ipath_cregs->cr_rcvebpcnt);
+        cntrs->port_xmit_discards =
+                ipath_snap_cntr(dd, dd->ipath_cregs->cr_unsupvlcnt);
+        cntrs->port_xmit_data =
+                ipath_snap_cntr(dd, dd->ipath_cregs->cr_wordsendcnt);
+        cntrs->port_rcv_data =
+                ipath_snap_cntr(dd, dd->ipath_cregs->cr_wordrcvcnt);
+        cntrs->port_xmit_packets =
+                ipath_snap_cntr(dd, dd->ipath_cregs->cr_pktsendcnt);
+        cntrs->port_rcv_packets =
+                ipath_snap_cntr(dd, dd->ipath_cregs->cr_pktrcvcnt);
+
+        ret = 0;
+
+bail:
+        return ret;
+}
+
+EXPORT_SYMBOL_GPL(ipath_layer_get_counters);
+
+int ipath_layer_want_buffer(struct ipath_devdata *dd)
+{
+        set_bit(IPATH_S_PIOINTBUFAVAIL, &dd->ipath_sendctrl);
+        ipath_write_kreg(dd, dd->ipath_kregs->kr_sendctrl,
+                         dd->ipath_sendctrl);
+
+        return 0;
+}
+
+EXPORT_SYMBOL_GPL(ipath_layer_want_buffer);
+
+int ipath_layer_send_hdr(struct ipath_devdata *dd, struct ether_header *hdr)
+{
+        int ret = 0;
+        u32 __iomem *piobuf;
+        u32 plen, *uhdr;
+        size_t count;
+        __be16 vlsllnh;
+
+        if (!(dd->ipath_flags & IPATH_RCVHDRSZ_SET)) {
+                ipath_dbg("send while not open\n");
+                ret = -EINVAL;
+        } else
+                if ((dd->ipath_flags & (IPATH_LINKUNK | IPATH_LINKDOWN)) ||
+                    dd->ipath_lid == 0) {
+                        /*
+                         * lid check is for when sma hasn't yet configured
+                         */
+                        ret = -ENETDOWN;
+                        ipath_cdbg(VERBOSE, "send while not ready, "
+                                   "mylid=%u, flags=0x%x\n",
+                                   dd->ipath_lid, dd->ipath_flags);
+                }
+
+        vlsllnh = *((__be16 *) hdr);
+        if (vlsllnh != htons(IPS_LRH_BTH)) {
+                ipath_dbg("Warning: lrh[0] wrong (%x, not %x); "
+                          "not sending\n", be16_to_cpu(vlsllnh),
+                          IPS_LRH_BTH);
+                ret = -EINVAL;
+        }
+        if (ret)
+                goto done;
+
+        /* Get a PIO buffer to use. */
+        piobuf = ipath_getpiobuf(dd, NULL);
+        if (piobuf == NULL) {
+                ret = -EBUSY;
+                goto done;
+        }
+
+        plen = (sizeof(*hdr) >> 2); /* actual length */
+        ipath_cdbg(EPKT, "0x%x+1w pio %p\n", plen, piobuf);
+
+        writeq(plen+1, piobuf); /* len (+1 for pad) to pbc, no flags */
+        ipath_flush_wc();
+        piobuf += 2;
+        uhdr = (u32 *)hdr;
+        count = plen-1; /* amount we can copy before trigger word */
+        __iowrite32_copy(piobuf, uhdr, count);
+        ipath_flush_wc();
+        __raw_writel(uhdr[count], piobuf + count);
+        ipath_flush_wc(); /* ensure it's sent, now */
+
+        ipath_stats.sps_ether_spkts++;  /* ether packet sent */
+
+done:
+        return ret;
+}
+
+EXPORT_SYMBOL_GPL(ipath_layer_send_hdr);
+
+int ipath_layer_set_piointbufavail_int(struct ipath_devdata *dd)
+{
+        set_bit(IPATH_S_PIOINTBUFAVAIL, &dd->ipath_sendctrl);
+
+        ipath_write_kreg(dd, dd->ipath_kregs->kr_sendctrl,
+                         dd->ipath_sendctrl);
+        return 0;
+}
+
+EXPORT_SYMBOL_GPL(ipath_layer_set_piointbufavail_int);
+
+int ipath_layer_enable_timer(struct ipath_devdata *dd)
+{
+        /*
+         * HT-400 has a design flaw where the chip and kernel idea
+         * of the tail register don't always agree, and therefore we won't
+         * get an interrupt on the next packet received.
+         * If the board supports per packet receive interrupts, use it.
+         * Otherwise, the timer function periodically checks for packets
+         * to cover this case.
+         * Either way, the timer is needed for verbs layer related
+         * processing.
+         */
+        if (dd->ipath_flags & IPATH_GPIO_INTR) {
+                ipath_write_kreg(dd, dd->ipath_kregs->kr_debugportselect,
+                                 0x2074076542310ULL);
+                /* Enable GPIO bit 2 interrupt */
+                ipath_write_kreg(dd, dd->ipath_kregs->kr_gpio_mask,
+                                 (u64) (1 << 2));
+        }
+
+        init_timer(&dd->verbs_layer.l_timer);
+        dd->verbs_layer.l_timer.function = __ipath_verbs_timer;
+        dd->verbs_layer.l_timer.data = (unsigned long)dd;
+        dd->verbs_layer.l_timer.expires = jiffies + 1;
+        add_timer(&dd->verbs_layer.l_timer);
+
+        return 0;
+}
+
+EXPORT_SYMBOL_GPL(ipath_layer_enable_timer);
+
+int ipath_layer_disable_timer(struct ipath_devdata *dd)
+{
+        /* Disable GPIO bit 2 interrupt */
+        if (dd->ipath_flags & IPATH_GPIO_INTR)
+                ipath_write_kreg(dd, dd->ipath_kregs->kr_gpio_mask, 0);
+
+        del_timer_sync(&dd->verbs_layer.l_timer);
+
+        return 0;
+}
+
+EXPORT_SYMBOL_GPL(ipath_layer_disable_timer);
+
+/**
+ * ipath_layer_set_verbs_flags - set the verbs layer flags
+ * @dd: the infinipath device
+ * @flags: the flags to set
+ */
+int ipath_layer_set_verbs_flags(struct ipath_devdata *dd, unsigned flags)
+{
+        struct ipath_devdata *ss;
+        unsigned long lflags;
+
+        spin_lock_irqsave(&ipath_devs_lock, lflags);
+
+        list_for_each_entry(ss, &ipath_dev_list, ipath_list) {
+                if (!(ss->ipath_flags & IPATH_INITTED))
+                        continue;
+                if ((flags & IPATH_VERBS_KERNEL_SMA) &&
+                    !(*ss->ipath_statusp & IPATH_STATUS_SMA))
+                        *ss->ipath_statusp |= IPATH_STATUS_OIB_SMA;
+                else
+                        *ss->ipath_statusp &= ~IPATH_STATUS_OIB_SMA;
+        }
+
+        spin_unlock_irqrestore(&ipath_devs_lock, lflags);
+
+        return 0;
+}
+
+EXPORT_SYMBOL_GPL(ipath_layer_set_verbs_flags);
+
+/**
+ * ipath_layer_get_npkeys - return the size of the PKEY table for port 0
+ * @dd: the infinipath device
+ */
+unsigned ipath_layer_get_npkeys(struct ipath_devdata *dd)
+{
+        return ARRAY_SIZE(dd->ipath_pd[0]->port_pkeys);
+}
+
+EXPORT_SYMBOL_GPL(ipath_layer_get_npkeys);
+
+/**
+ * ipath_layer_get_pkey - return the indexed PKEY from the port 0 PKEY table
+ * @dd: the infinipath device
+ * @index: the PKEY index
+ */
+unsigned ipath_layer_get_pkey(struct ipath_devdata *dd, unsigned index)
+{
+        unsigned ret;
+
+        if (index >= ARRAY_SIZE(dd->ipath_pd[0]->port_pkeys))
+                ret = 0;
+        else
+                ret = dd->ipath_pd[0]->port_pkeys[index];
+
+        return ret;
+}
+
+EXPORT_SYMBOL_GPL(ipath_layer_get_pkey);
+
+/**
+ * ipath_layer_get_pkeys - return the PKEY table for port 0
+ * @dd: the infinipath device
+ * @pkeys: the pkey table is placed here
+ */
+int ipath_layer_get_pkeys(struct ipath_devdata *dd, u16 * pkeys)
+{
+        struct ipath_portdata *pd = dd->ipath_pd[0];
+
+        memcpy(pkeys, pd->port_pkeys, sizeof(pd->port_pkeys));
+
+        return 0;
+}
+
+EXPORT_SYMBOL_GPL(ipath_layer_get_pkeys);
+
+/**
+ * rm_pkey - decrecment the reference count for the given PKEY
+ * @dd: the infinipath device
+ * @key: the PKEY index
+ *
+ * Return true if this was the last reference and the hardware table entry
+ * needs to be changed.
+ */
+static int rm_pkey(struct ipath_devdata *dd, u16 key)
+{
+        int i;
+        int ret;
+
+        for (i = 0; i < ARRAY_SIZE(dd->ipath_pkeys); i++) {
+                if (dd->ipath_pkeys[i] != key)
+                        continue;
+                if (atomic_dec_and_test(&dd->ipath_pkeyrefs[i])) {
+                        dd->ipath_pkeys[i] = 0;
+                        ret = 1;
+                        goto bail;
+                }
+                break;
+        }
+
+        ret = 0;
+
+bail:
+        return ret;
+}
+
+/**
+ * add_pkey - add the given PKEY to the hardware table
+ * @dd: the infinipath device
+ * @key: the PKEY
+ *
+ * Return an error code if unable to add the entry, zero if no change,
+ * or 1 if the hardware PKEY register needs to be updated.
+ */
+static int add_pkey(struct ipath_devdata *dd, u16 key)
+{
+        int i;
+        u16 lkey = key & 0x7FFF;
+        int any = 0;
+        int ret;
+
+        if (lkey == 0x7FFF) {
+                ret = 0;
+                goto bail;
+        }
+
+        /* Look for an empty slot or a matching PKEY. */
+        for (i = 0; i < ARRAY_SIZE(dd->ipath_pkeys); i++) {
+                if (!dd->ipath_pkeys[i]) {
+                        any++;
+                        continue;
+                }
+                /* If it matches exactly, try to increment the ref count */
+                if (dd->ipath_pkeys[i] == key) {
+                        if (atomic_inc_return(&dd->ipath_pkeyrefs[i]) > 1) {
+                                ret = 0;
+                                goto bail;
+                        }
+                        /* Lost the race. Look for an empty slot below. */
+                        atomic_dec(&dd->ipath_pkeyrefs[i]);
+                        any++;
+                }
+                /*
+                 * It makes no sense to have both the limited and unlimited
+                 * PKEY set at the same time since the unlimited one will
+                 * disable the limited one.
+                 */
+                if ((dd->ipath_pkeys[i] & 0x7FFF) == lkey) {
+                        ret = -EEXIST;
+                        goto bail;
+                }
+        }
+        if (!any) {
+                ret = -EBUSY;
+                goto bail;
+        }
+        for (i = 0; i < ARRAY_SIZE(dd->ipath_pkeys); i++) {
+                if (!dd->ipath_pkeys[i] &&
+                    atomic_inc_return(&dd->ipath_pkeyrefs[i]) == 1) {
+                        /* for ipathstats, etc. */
+                        ipath_stats.sps_pkeys[i] = lkey;
+                        dd->ipath_pkeys[i] = key;
+                        ret = 1;
+                        goto bail;
+                }
+        }
+        ret = -EBUSY;
+
+bail:
+        return ret;
+}
+
+/**
+ * ipath_layer_set_pkeys - set the PKEY table for port 0
+ * @dd: the infinipath device
+ * @pkeys: the PKEY table
+ */
+int ipath_layer_set_pkeys(struct ipath_devdata *dd, u16 * pkeys)
+{
+        struct ipath_portdata *pd;
+        int i;
+        int changed = 0;
+
+        pd = dd->ipath_pd[0];
+
+        for (i = 0; i < ARRAY_SIZE(pd->port_pkeys); i++) {
+                u16 key = pkeys[i];
+                u16 okey = pd->port_pkeys[i];
+
+                if (key == okey)
+                        continue;
+                /*
+                 * The value of this PKEY table entry is changing.
+                 * Remove the old entry in the hardware's array of PKEYs.
+                 */
+                if (okey & 0x7FFF)
+                        changed |= rm_pkey(dd, okey);
+                if (key & 0x7FFF) {
+                        int ret = add_pkey(dd, key);
+
+                        if (ret < 0)
+                                key = 0;
+                        else
+                                changed |= ret;
+                }
+                pd->port_pkeys[i] = key;
+        }
+        if (changed) {
+                u64 pkey;
+
+                pkey = (u64) dd->ipath_pkeys[0] |
+                        ((u64) dd->ipath_pkeys[1] << 16) |
+                        ((u64) dd->ipath_pkeys[2] << 32) |
+                        ((u64) dd->ipath_pkeys[3] << 48);
+                ipath_cdbg(VERBOSE, "p0 new pkey reg %llx\n",
+                           (unsigned long long) pkey);
+                ipath_write_kreg(dd, dd->ipath_kregs->kr_partitionkey,
+                                 pkey);
+        }
+        return 0;
+}
+
+EXPORT_SYMBOL_GPL(ipath_layer_set_pkeys);
+
+/**
+ * ipath_layer_get_linkdowndefaultstate - get the default linkdown state
+ * @dd: the infinipath device
+ *
+ * Returns zero if the default is POLL, 1 if the default is SLEEP.
+ */
+int ipath_layer_get_linkdowndefaultstate(struct ipath_devdata *dd)
+{
+        return !!(dd->ipath_ibcctrl & INFINIPATH_IBCC_LINKDOWNDEFAULTSTATE);
+}
+
+EXPORT_SYMBOL_GPL(ipath_layer_get_linkdowndefaultstate);
+
+/**
+ * ipath_layer_set_linkdowndefaultstate - set the default linkdown state
+ * @dd: the infinipath device
+ * @sleep: the new state
+ *
+ * Note that this will only take effect when the link state changes.
+ */
+int ipath_layer_set_linkdowndefaultstate(struct ipath_devdata *dd,
+                                         int sleep)
+{
+        if (sleep)
+                dd->ipath_ibcctrl |= INFINIPATH_IBCC_LINKDOWNDEFAULTSTATE;
+        else
+                dd->ipath_ibcctrl &= ~INFINIPATH_IBCC_LINKDOWNDEFAULTSTATE;
+        ipath_write_kreg(dd, dd->ipath_kregs->kr_ibcctrl,
+                         dd->ipath_ibcctrl);
+        return 0;
+}
+
+EXPORT_SYMBOL_GPL(ipath_layer_set_linkdowndefaultstate);
+
+int ipath_layer_get_phyerrthreshold(struct ipath_devdata *dd)
+{
+        return (dd->ipath_ibcctrl >>
+                INFINIPATH_IBCC_PHYERRTHRESHOLD_SHIFT) &
+                INFINIPATH_IBCC_PHYERRTHRESHOLD_MASK;
+}
+
+EXPORT_SYMBOL_GPL(ipath_layer_get_phyerrthreshold);
+
+/**
+ * ipath_layer_set_phyerrthreshold - set the physical error threshold
+ * @dd: the infinipath device
+ * @n: the new threshold
+ *
+ * Note that this will only take effect when the link state changes.
+ */
+int ipath_layer_set_phyerrthreshold(struct ipath_devdata *dd, unsigned n)
+{
+        unsigned v;
+
+        v = (dd->ipath_ibcctrl >> INFINIPATH_IBCC_PHYERRTHRESHOLD_SHIFT) &
+                INFINIPATH_IBCC_PHYERRTHRESHOLD_MASK;
+        if (v != n) {
+                dd->ipath_ibcctrl &=
+                        ~(INFINIPATH_IBCC_PHYERRTHRESHOLD_MASK <<
+                          INFINIPATH_IBCC_PHYERRTHRESHOLD_SHIFT);
+                dd->ipath_ibcctrl |=
+                        (u64) n << INFINIPATH_IBCC_PHYERRTHRESHOLD_SHIFT;
+                ipath_write_kreg(dd, dd->ipath_kregs->kr_ibcctrl,
+                                 dd->ipath_ibcctrl);
+        }
+        return 0;
+}
+
+EXPORT_SYMBOL_GPL(ipath_layer_set_phyerrthreshold);
+
+int ipath_layer_get_overrunthreshold(struct ipath_devdata *dd)
+{
+        return (dd->ipath_ibcctrl >>
+                INFINIPATH_IBCC_OVERRUNTHRESHOLD_SHIFT) &
+                INFINIPATH_IBCC_OVERRUNTHRESHOLD_MASK;
+}
+
+EXPORT_SYMBOL_GPL(ipath_layer_get_overrunthreshold);
+
+/**
+ * ipath_layer_set_overrunthreshold - set the overrun threshold
+ * @dd: the infinipath device
+ * @n: the new threshold
+ *
+ * Note that this will only take effect when the link state changes.
+ */
+int ipath_layer_set_overrunthreshold(struct ipath_devdata *dd, unsigned n)
+{
+        unsigned v;
+
+        v = (dd->ipath_ibcctrl >> INFINIPATH_IBCC_OVERRUNTHRESHOLD_SHIFT) &
+                INFINIPATH_IBCC_OVERRUNTHRESHOLD_MASK;
+        if (v != n) {
+                dd->ipath_ibcctrl &=
+                        ~(INFINIPATH_IBCC_OVERRUNTHRESHOLD_MASK <<
+                          INFINIPATH_IBCC_OVERRUNTHRESHOLD_SHIFT);
+                dd->ipath_ibcctrl |=
+                        (u64) n << INFINIPATH_IBCC_OVERRUNTHRESHOLD_SHIFT;
+                ipath_write_kreg(dd, dd->ipath_kregs->kr_ibcctrl,
+                                 dd->ipath_ibcctrl);
+        }
+        return 0;
+}
+
+EXPORT_SYMBOL_GPL(ipath_layer_set_overrunthreshold);
+
+int ipath_layer_get_boardname(struct ipath_devdata *dd, char *name,
+                              size_t namelen)
+{
+        return dd->ipath_f_get_boardname(dd, name, namelen);
+}
+EXPORT_SYMBOL_GPL(ipath_layer_get_boardname);
+
+u32 ipath_layer_get_rcvhdrentsize(struct ipath_devdata *dd)
+{
+        return dd->ipath_rcvhdrentsize;
+}
+EXPORT_SYMBOL_GPL(ipath_layer_get_rcvhdrentsize);
diff --git a/drivers/infiniband/hw/ipath/ipath_layer.h b/drivers/infiniband/hw/ipath/ipath_layer.h
new file mode 100644
index 000000000000..6fefd15bd2da
--- /dev/null
+++ b/drivers/infiniband/hw/ipath/ipath_layer.h
@@ -0,0 +1,181 @@
+/*
+ * Copyright (c) 2003, 2004, 2005, 2006 PathScale, Inc. All rights reserved.
+ *
+ * This software is available to you under a choice of one of two
+ * licenses.  You may choose to be licensed under the terms of the GNU
+ * General Public License (GPL) Version 2, available from the file
+ * COPYING in the main directory of this source tree, or the
+ * OpenIB.org BSD license below:
+ *
+ *     Redistribution and use in source and binary forms, with or
+ *     without modification, are permitted provided that the following
+ *     conditions are met:
+ *
+ *      - Redistributions of source code must retain the above
+ *        copyright notice, this list of conditions and the following
+ *        disclaimer.
+ *
+ *      - Redistributions in binary form must reproduce the above
+ *        copyright notice, this list of conditions and the following
+ *        disclaimer in the documentation and/or other materials
+ *        provided with the distribution.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+ * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+ * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+ * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
+ * BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
+ * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
+ * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+ * SOFTWARE.
+ */
+
+#ifndef _IPATH_LAYER_H
+#define _IPATH_LAYER_H
+
+/*
+ * This header file is for symbols shared between the infinipath driver
+ * and drivers layered upon it (such as ipath).
+ */
+
+struct sk_buff;
+struct ipath_sge_state;
+struct ipath_devdata;
+struct ether_header;
+
+struct ipath_layer_counters {
+        u64 symbol_error_counter;
+        u64 link_error_recovery_counter;
+        u64 link_downed_counter;
+        u64 port_rcv_errors;
+        u64 port_rcv_remphys_errors;
+        u64 port_xmit_discards;
+        u64 port_xmit_data;
+        u64 port_rcv_data;
+        u64 port_xmit_packets;
+        u64 port_rcv_packets;
+};
+
+/*
+ * A segment is a linear region of low physical memory.
+ * XXX Maybe we should use phys addr here and kmap()/kunmap().
+ * Used by the verbs layer.
+ */
+struct ipath_seg {
+        void *vaddr;
+        size_t length;
+};
+
+/* The number of ipath_segs that fit in a page. */
+#define IPATH_SEGSZ     (PAGE_SIZE / sizeof (struct ipath_seg))
+
+struct ipath_segarray {
+        struct ipath_seg segs[IPATH_SEGSZ];
+};
+
+struct ipath_mregion {
+        u64 user_base;          /* User's address for this region */
+        u64 iova;               /* IB start address of this region */
+        size_t length;
+        u32 lkey;
+        u32 offset;             /* offset (bytes) to start of region */
+        int access_flags;
+        u32 max_segs;           /* number of ipath_segs in all the arrays */
+        u32 mapsz;              /* size of the map array */
+        struct ipath_segarray *map[0];  /* the segments */
+};
+
+/*
+ * These keep track of the copy progress within a memory region.
+ * Used by the verbs layer.
+ */
+struct ipath_sge {
+        struct ipath_mregion *mr;
+        void *vaddr;            /* current pointer into the segment */
+        u32 sge_length;         /* length of the SGE */
+        u32 length;             /* remaining length of the segment */
+        u16 m;                  /* current index: mr->map[m] */
+        u16 n;                  /* current index: mr->map[m]->segs[n] */
+};
+
+struct ipath_sge_state {
+        struct ipath_sge *sg_list;      /* next SGE to be used if any */
+        struct ipath_sge sge;   /* progress state for the current SGE */
+        u8 num_sge;
+};
+
+int ipath_layer_register(void *(*l_add)(int, struct ipath_devdata *),
+                         void (*l_remove)(void *),
+                         int (*l_intr)(void *, u32),
+                         int (*l_rcv)(void *, void *,
+                                      struct sk_buff *),
+                         u16 rcv_opcode,
+                         int (*l_rcv_lid)(void *, void *));
+int ipath_verbs_register(void *(*l_add)(int, struct ipath_devdata *),
+                         void (*l_remove)(void *arg),
+                         int (*l_piobufavail)(void *arg),
+                         void (*l_rcv)(void *arg, void *rhdr,
+                                       void *data, u32 tlen),
+                         void (*l_timer_cb)(void *arg));
+void ipath_layer_unregister(void);
+void ipath_verbs_unregister(void);
+int ipath_layer_open(struct ipath_devdata *, u32 * pktmax);
+u16 ipath_layer_get_lid(struct ipath_devdata *dd);
+int ipath_layer_get_mac(struct ipath_devdata *dd, u8 *);
+u16 ipath_layer_get_bcast(struct ipath_devdata *dd);
+u32 ipath_layer_get_cr_errpkey(struct ipath_devdata *dd);
+int ipath_layer_set_linkstate(struct ipath_devdata *dd, u8 state);
+int ipath_layer_set_mtu(struct ipath_devdata *, u16);
+int ipath_set_sps_lid(struct ipath_devdata *, u32, u8);
+int ipath_layer_send_hdr(struct ipath_devdata *dd,
+                         struct ether_header *hdr);
+int ipath_verbs_send(struct ipath_devdata *dd, u32 hdrwords,
+                     u32 * hdr, u32 len, struct ipath_sge_state *ss);
+int ipath_layer_set_piointbufavail_int(struct ipath_devdata *dd);
+int ipath_layer_get_boardname(struct ipath_devdata *dd, char *name,
+                              size_t namelen);
+int ipath_layer_snapshot_counters(struct ipath_devdata *dd, u64 *swords,
+                                  u64 *rwords, u64 *spkts, u64 *rpkts,
+                                  u64 *xmit_wait);
+int ipath_layer_get_counters(struct ipath_devdata *dd,
+                             struct ipath_layer_counters *cntrs);
+int ipath_layer_want_buffer(struct ipath_devdata *dd);
+int ipath_layer_set_guid(struct ipath_devdata *, __be64 guid);
+__be64 ipath_layer_get_guid(struct ipath_devdata *);
+u32 ipath_layer_get_nguid(struct ipath_devdata *);
+int ipath_layer_query_device(struct ipath_devdata *, u32 * vendor,
+                             u32 * boardrev, u32 * majrev, u32 * minrev);
+u32 ipath_layer_get_flags(struct ipath_devdata *dd);
+struct device *ipath_layer_get_device(struct ipath_devdata *dd);
+u16 ipath_layer_get_deviceid(struct ipath_devdata *dd);
+u64 ipath_layer_get_lastibcstat(struct ipath_devdata *dd);
+u32 ipath_layer_get_ibmtu(struct ipath_devdata *dd);
+int ipath_layer_enable_timer(struct ipath_devdata *dd);
+int ipath_layer_disable_timer(struct ipath_devdata *dd);
+int ipath_layer_set_verbs_flags(struct ipath_devdata *dd, unsigned flags);
+unsigned ipath_layer_get_npkeys(struct ipath_devdata *dd);
+unsigned ipath_layer_get_pkey(struct ipath_devdata *dd, unsigned index);
+int ipath_layer_get_pkeys(struct ipath_devdata *dd, u16 *pkeys);
+int ipath_layer_set_pkeys(struct ipath_devdata *dd, u16 *pkeys);
+int ipath_layer_get_linkdowndefaultstate(struct ipath_devdata *dd);
+int ipath_layer_set_linkdowndefaultstate(struct ipath_devdata *dd,
+                                         int sleep);
+int ipath_layer_get_phyerrthreshold(struct ipath_devdata *dd);
+int ipath_layer_set_phyerrthreshold(struct ipath_devdata *dd, unsigned n);
+int ipath_layer_get_overrunthreshold(struct ipath_devdata *dd);
+int ipath_layer_set_overrunthreshold(struct ipath_devdata *dd, unsigned n);
+u32 ipath_layer_get_rcvhdrentsize(struct ipath_devdata *dd);
+
+/* ipath_ether interrupt values */
+#define IPATH_LAYER_INT_IF_UP 0x2
+#define IPATH_LAYER_INT_IF_DOWN 0x4
+#define IPATH_LAYER_INT_LID 0x8
+#define IPATH_LAYER_INT_SEND_CONTINUE 0x10
+#define IPATH_LAYER_INT_BCAST 0x40
+
+/* _verbs_layer.l_flags */
+#define IPATH_VERBS_KERNEL_SMA 0x1
+
+extern unsigned ipath_debug; /* debugging bit mask */
+
+#endif                          /* _IPATH_LAYER_H */
diff --git a/drivers/infiniband/hw/ipath/ipath_mad.c b/drivers/infiniband/hw/ipath/ipath_mad.c
new file mode 100644
index 000000000000..f7f8391fe43f
--- /dev/null
+++ b/drivers/infiniband/hw/ipath/ipath_mad.c
@@ -0,0 +1,1352 @@
+/*
+ * Copyright (c) 2005, 2006 PathScale, Inc. All rights reserved.
+ *
+ * This software is available to you under a choice of one of two
+ * licenses.  You may choose to be licensed under the terms of the GNU
+ * General Public License (GPL) Version 2, available from the file
+ * COPYING in the main directory of this source tree, or the
+ * OpenIB.org BSD license below:
+ *
+ *     Redistribution and use in source and binary forms, with or
+ *     without modification, are permitted provided that the following
+ *     conditions are met:
+ *
+ *      - Redistributions of source code must retain the above
+ *        copyright notice, this list of conditions and the following
+ *        disclaimer.
+ *
+ *      - Redistributions in binary form must reproduce the above
+ *        copyright notice, this list of conditions and the following
+ *        disclaimer in the documentation and/or other materials
+ *        provided with the distribution.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+ * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+ * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+ * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
+ * BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
+ * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
+ * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+ * SOFTWARE.
+ */
+
+#include <rdma/ib_smi.h>
+
+#include "ipath_kernel.h"
+#include "ipath_verbs.h"
+#include "ips_common.h"
+
+#define IB_SMP_UNSUP_VERSION    __constant_htons(0x0004)
+#define IB_SMP_UNSUP_METHOD     __constant_htons(0x0008)
+#define IB_SMP_UNSUP_METH_ATTR  __constant_htons(0x000C)
+#define IB_SMP_INVALID_FIELD    __constant_htons(0x001C)
+
+static int reply(struct ib_smp *smp)
+{
+        /*
+         * The verbs framework will handle the directed/LID route
+         * packet changes.
+         */
+        smp->method = IB_MGMT_METHOD_GET_RESP;
+        if (smp->mgmt_class == IB_MGMT_CLASS_SUBN_DIRECTED_ROUTE)
+                smp->status |= IB_SMP_DIRECTION;
+        return IB_MAD_RESULT_SUCCESS | IB_MAD_RESULT_REPLY;
+}
+
+static int recv_subn_get_nodedescription(struct ib_smp *smp,
+                                         struct ib_device *ibdev)
+{
+        if (smp->attr_mod)
+                smp->status |= IB_SMP_INVALID_FIELD;
+
+        strncpy(smp->data, ibdev->node_desc, sizeof(smp->data));
+
+        return reply(smp);
+}
+
+struct nodeinfo {
+        u8 base_version;
+        u8 class_version;
+        u8 node_type;
+        u8 num_ports;
+        __be64 sys_guid;
+        __be64 node_guid;
+        __be64 port_guid;
+        __be16 partition_cap;
+        __be16 device_id;
+        __be32 revision;
+        u8 local_port_num;
+        u8 vendor_id[3];
+} __attribute__ ((packed));
+
+static int recv_subn_get_nodeinfo(struct ib_smp *smp,
+                                  struct ib_device *ibdev, u8 port)
+{
+        struct nodeinfo *nip = (struct nodeinfo *)&smp->data;
+        struct ipath_devdata *dd = to_idev(ibdev)->dd;
+        u32 vendor, boardid, majrev, minrev;
+
+        if (smp->attr_mod)
+                smp->status |= IB_SMP_INVALID_FIELD;
+
+        nip->base_version = 1;
+        nip->class_version = 1;
+        nip->node_type = 1;     /* channel adapter */
+        /*
+         * XXX The num_ports value will need a layer function to get
+         * the value if we ever have more than one IB port on a chip.
+         * We will also need to get the GUID for the port.
+         */
+        nip->num_ports = ibdev->phys_port_cnt;
+        /* This is already in network order */
+        nip->sys_guid = to_idev(ibdev)->sys_image_guid;
+        nip->node_guid = ipath_layer_get_guid(dd);
+        nip->port_guid = nip->sys_guid;
+        nip->partition_cap = cpu_to_be16(ipath_layer_get_npkeys(dd));
+        nip->device_id = cpu_to_be16(ipath_layer_get_deviceid(dd));
+        ipath_layer_query_device(dd, &vendor, &boardid, &majrev, &minrev);
+        nip->revision = cpu_to_be32((majrev << 16) | minrev);
+        nip->local_port_num = port;
+        nip->vendor_id[0] = 0;
+        nip->vendor_id[1] = vendor >> 8;
+        nip->vendor_id[2] = vendor;
+
+        return reply(smp);
+}
+
+static int recv_subn_get_guidinfo(struct ib_smp *smp,
+                                  struct ib_device *ibdev)
+{
+        u32 startgx = 8 * be32_to_cpu(smp->attr_mod);
+        __be64 *p = (__be64 *) smp->data;
+
+        /* 32 blocks of 8 64-bit GUIDs per block */
+
+        memset(smp->data, 0, sizeof(smp->data));
+
+        /*
+         * We only support one GUID for now.  If this changes, the
+         * portinfo.guid_cap field needs to be updated too.
+         */
+        if (startgx == 0)
+                /* The first is a copy of the read-only HW GUID. */
+                *p = ipath_layer_get_guid(to_idev(ibdev)->dd);
+        else
+                smp->status |= IB_SMP_INVALID_FIELD;
+
+        return reply(smp);
+}
+
+struct port_info {
+        __be64 mkey;
+        __be64 gid_prefix;
+        __be16 lid;
+        __be16 sm_lid;
+        __be32 cap_mask;
+        __be16 diag_code;
+        __be16 mkey_lease_period;
+        u8 local_port_num;
+        u8 link_width_enabled;
+        u8 link_width_supported;
+        u8 link_width_active;
+        u8 linkspeed_portstate;                 /* 4 bits, 4 bits */
+        u8 portphysstate_linkdown;              /* 4 bits, 4 bits */
+        u8 mkeyprot_resv_lmc;                   /* 2 bits, 3, 3 */
+        u8 linkspeedactive_enabled;             /* 4 bits, 4 bits */
+        u8 neighbormtu_mastersmsl;              /* 4 bits, 4 bits */
+        u8 vlcap_inittype;                      /* 4 bits, 4 bits */
+        u8 vl_high_limit;
+        u8 vl_arb_high_cap;
+        u8 vl_arb_low_cap;
+        u8 inittypereply_mtucap;                /* 4 bits, 4 bits */
+        u8 vlstallcnt_hoqlife;                  /* 3 bits, 5 bits */
+        u8 operationalvl_pei_peo_fpi_fpo;       /* 4 bits, 1, 1, 1, 1 */
+        __be16 mkey_violations;
+        __be16 pkey_violations;
+        __be16 qkey_violations;
+        u8 guid_cap;
+        u8 clientrereg_resv_subnetto;           /* 1 bit, 2 bits, 5 */
+        u8 resv_resptimevalue;                  /* 3 bits, 5 bits */
+        u8 localphyerrors_overrunerrors;        /* 4 bits, 4 bits */
+        __be16 max_credit_hint;
+        u8 resv;
+        u8 link_roundtrip_latency[3];
+} __attribute__ ((packed));
+
+static int recv_subn_get_portinfo(struct ib_smp *smp,
+                                  struct ib_device *ibdev, u8 port)
+{
+        struct ipath_ibdev *dev;
+        struct port_info *pip = (struct port_info *)smp->data;
+        u16 lid;
+        u8 ibcstat;
+        u8 mtu;
+        int ret;
+
+        if (be32_to_cpu(smp->attr_mod) > ibdev->phys_port_cnt) {
+                smp->status |= IB_SMP_INVALID_FIELD;
+                ret = reply(smp);
+                goto bail;
+        }
+
+        dev = to_idev(ibdev);
+
+        /* Clear all fields.  Only set the non-zero fields. */
+        memset(smp->data, 0, sizeof(smp->data));
+
+        /* Only return the mkey if the protection field allows it. */
+        if (smp->method == IB_MGMT_METHOD_SET || dev->mkey == smp->mkey ||
+            (dev->mkeyprot_resv_lmc >> 6) == 0)
+                pip->mkey = dev->mkey;
+        pip->gid_prefix = dev->gid_prefix;
+        lid = ipath_layer_get_lid(dev->dd);
+        pip->lid = lid ? cpu_to_be16(lid) : IB_LID_PERMISSIVE;
+        pip->sm_lid = cpu_to_be16(dev->sm_lid);
+        pip->cap_mask = cpu_to_be32(dev->port_cap_flags);
+        /* pip->diag_code; */
+        pip->mkey_lease_period = cpu_to_be16(dev->mkey_lease_period);
+        pip->local_port_num = port;
+        pip->link_width_enabled = dev->link_width_enabled;
+        pip->link_width_supported = 3;  /* 1x or 4x */
+        pip->link_width_active = 2;     /* 4x */
+        pip->linkspeed_portstate = 0x10;        /* 2.5Gbps */
+        ibcstat = ipath_layer_get_lastibcstat(dev->dd);
+        pip->linkspeed_portstate |= ((ibcstat >> 4) & 0x3) + 1;
+        pip->portphysstate_linkdown =
+                (ipath_cvt_physportstate[ibcstat & 0xf] << 4) |
+                (ipath_layer_get_linkdowndefaultstate(dev->dd) ? 1 : 2);
+        pip->mkeyprot_resv_lmc = dev->mkeyprot_resv_lmc;
+        pip->linkspeedactive_enabled = 0x11;    /* 2.5Gbps, 2.5Gbps */
+        switch (ipath_layer_get_ibmtu(dev->dd)) {
+        case 4096:
+                mtu = IB_MTU_4096;
+                break;
+        case 2048:
+                mtu = IB_MTU_2048;
+                break;
+        case 1024:
+                mtu = IB_MTU_1024;
+                break;
+        case 512:
+                mtu = IB_MTU_512;
+                break;
+        case 256:
+                mtu = IB_MTU_256;
+                break;
+        default:                /* oops, something is wrong */
+                mtu = IB_MTU_2048;
+                break;
+        }
+        pip->neighbormtu_mastersmsl = (mtu << 4) | dev->sm_sl;
+        pip->vlcap_inittype = 0x10;     /* VLCap = VL0, InitType = 0 */
+        pip->vl_high_limit = dev->vl_high_limit;
+        /* pip->vl_arb_high_cap; // only one VL */
+        /* pip->vl_arb_low_cap; // only one VL */
+        /* InitTypeReply = 0 */
+        pip->inittypereply_mtucap = IB_MTU_4096;
+        // HCAs ignore VLStallCount and HOQLife
+        /* pip->vlstallcnt_hoqlife; */
+        pip->operationalvl_pei_peo_fpi_fpo = 0x10;      /* OVLs = 1 */
+        pip->mkey_violations = cpu_to_be16(dev->mkey_violations);
+        /* P_KeyViolations are counted by hardware. */
+        pip->pkey_violations =
+                cpu_to_be16((ipath_layer_get_cr_errpkey(dev->dd) -
+                             dev->n_pkey_violations) & 0xFFFF);
+        pip->qkey_violations = cpu_to_be16(dev->qkey_violations);
+        /* Only the hardware GUID is supported for now */
+        pip->guid_cap = 1;
+        pip->clientrereg_resv_subnetto = dev->subnet_timeout;
+        /* 32.768 usec. response time (guessing) */
+        pip->resv_resptimevalue = 3;
+        pip->localphyerrors_overrunerrors =
+                (ipath_layer_get_phyerrthreshold(dev->dd) << 4) |
+                ipath_layer_get_overrunthreshold(dev->dd);
+        /* pip->max_credit_hint; */
+        /* pip->link_roundtrip_latency[3]; */
+
+        ret = reply(smp);
+
+bail:
+        return ret;
+}
+
+static int recv_subn_get_pkeytable(struct ib_smp *smp,
+                                   struct ib_device *ibdev)
+{
+        u32 startpx = 32 * (be32_to_cpu(smp->attr_mod) & 0xffff);
+        u16 *p = (u16 *) smp->data;
+        __be16 *q = (__be16 *) smp->data;
+
+        /* 64 blocks of 32 16-bit P_Key entries */
+
+        memset(smp->data, 0, sizeof(smp->data));
+        if (startpx == 0) {
+                struct ipath_ibdev *dev = to_idev(ibdev);
+                unsigned i, n = ipath_layer_get_npkeys(dev->dd);
+
+                ipath_layer_get_pkeys(dev->dd, p);
+
+                for (i = 0; i < n; i++)
+                        q[i] = cpu_to_be16(p[i]);
+        } else
+                smp->status |= IB_SMP_INVALID_FIELD;
+
+        return reply(smp);
+}
+
+static int recv_subn_set_guidinfo(struct ib_smp *smp,
+                                  struct ib_device *ibdev)
+{
+        /* The only GUID we support is the first read-only entry. */
+        return recv_subn_get_guidinfo(smp, ibdev);
+}
+
+/**
+ * recv_subn_set_portinfo - set port information
+ * @smp: the incoming SM packet
+ * @ibdev: the infiniband device
+ * @port: the port on the device
+ *
+ * Set Portinfo (see ch. 14.2.5.6).
+ */
+static int recv_subn_set_portinfo(struct ib_smp *smp,
+                                  struct ib_device *ibdev, u8 port)
+{
+        struct port_info *pip = (struct port_info *)smp->data;
+        struct ib_event event;
+        struct ipath_ibdev *dev;
+        u32 flags;
+        char clientrereg = 0;
+        u16 lid, smlid;
+        u8 lwe;
+        u8 lse;
+        u8 state;
+        u16 lstate;
+        u32 mtu;
+        int ret;
+
+        if (be32_to_cpu(smp->attr_mod) > ibdev->phys_port_cnt)
+                goto err;
+
+        dev = to_idev(ibdev);
+        event.device = ibdev;
+        event.element.port_num = port;
+
+        dev->mkey = pip->mkey;
+        dev->gid_prefix = pip->gid_prefix;
+        dev->mkey_lease_period = be16_to_cpu(pip->mkey_lease_period);
+
+        lid = be16_to_cpu(pip->lid);
+        if (lid != ipath_layer_get_lid(dev->dd)) {
+                /* Must be a valid unicast LID address. */
+                if (lid == 0 || lid >= IPS_MULTICAST_LID_BASE)
+                        goto err;
+                ipath_set_sps_lid(dev->dd, lid, pip->mkeyprot_resv_lmc & 7);
+                event.event = IB_EVENT_LID_CHANGE;
+                ib_dispatch_event(&event);
+        }
+
+        smlid = be16_to_cpu(pip->sm_lid);
+        if (smlid != dev->sm_lid) {
+                /* Must be a valid unicast LID address. */
+                if (smlid == 0 || smlid >= IPS_MULTICAST_LID_BASE)
+                        goto err;
+                dev->sm_lid = smlid;
+                event.event = IB_EVENT_SM_CHANGE;
+                ib_dispatch_event(&event);
+        }
+
+        /* Only 4x supported but allow 1x or 4x to be set (see 14.2.6.6). */
+        lwe = pip->link_width_enabled;
+        if ((lwe >= 4 && lwe <= 8) || (lwe >= 0xC && lwe <= 0xFE))
+                goto err;
+        if (lwe == 0xFF)
+                dev->link_width_enabled = 3;    /* 1x or 4x */
+        else if (lwe)
+                dev->link_width_enabled = lwe;
+
+        /* Only 2.5 Gbs supported. */
+        lse = pip->linkspeedactive_enabled & 0xF;
+        if (lse >= 2 && lse <= 0xE)
+                goto err;
+
+        /* Set link down default state. */
+        switch (pip->portphysstate_linkdown & 0xF) {
+        case 0: /* NOP */
+                break;
+        case 1: /* SLEEP */
+                if (ipath_layer_set_linkdowndefaultstate(dev->dd, 1))
+                        goto err;
+                break;
+        case 2: /* POLL */
+                if (ipath_layer_set_linkdowndefaultstate(dev->dd, 0))
+                        goto err;
+                break;
+        default:
+                goto err;
+        }
+
+        dev->mkeyprot_resv_lmc = pip->mkeyprot_resv_lmc;
+        dev->vl_high_limit = pip->vl_high_limit;
+
+        switch ((pip->neighbormtu_mastersmsl >> 4) & 0xF) {
+        case IB_MTU_256:
+                mtu = 256;
+                break;
+        case IB_MTU_512:
+                mtu = 512;
+                break;
+        case IB_MTU_1024:
+                mtu = 1024;
+                break;
+        case IB_MTU_2048:
+                mtu = 2048;
+                break;
+        case IB_MTU_4096:
+                mtu = 4096;
+                break;
+        default:
+                /* XXX We have already partially updated our state! */
+                goto err;
+        }
+        ipath_layer_set_mtu(dev->dd, mtu);
+
+        dev->sm_sl = pip->neighbormtu_mastersmsl & 0xF;
+
+        /* We only support VL0 */
+        if (((pip->operationalvl_pei_peo_fpi_fpo >> 4) & 0xF) > 1)
+                goto err;
+
+        if (pip->mkey_violations == 0)
+                dev->mkey_violations = 0;
+
+        /*
+         * Hardware counter can't be reset so snapshot and subtract
+         * later.
+         */
+        if (pip->pkey_violations == 0)
+                dev->n_pkey_violations =
+                        ipath_layer_get_cr_errpkey(dev->dd);
+
+        if (pip->qkey_violations == 0)
+                dev->qkey_violations = 0;
+
+        if (ipath_layer_set_phyerrthreshold(
+                    dev->dd,
+                    (pip->localphyerrors_overrunerrors >> 4) & 0xF))
+                goto err;
+
+        if (ipath_layer_set_overrunthreshold(
+                    dev->dd,
+                    (pip->localphyerrors_overrunerrors & 0xF)))
+                goto err;
+
+        dev->subnet_timeout = pip->clientrereg_resv_subnetto & 0x1F;
+
+        if (pip->clientrereg_resv_subnetto & 0x80) {
+                clientrereg = 1;
+                event.event = IB_EVENT_LID_CHANGE;
+                ib_dispatch_event(&event);
+        }
+
+        /*
+         * Do the port state change now that the other link parameters
+         * have been set.
+         * Changing the port physical state only makes sense if the link
+         * is down or is being set to down.
+         */
+        state = pip->linkspeed_portstate & 0xF;
+        flags = ipath_layer_get_flags(dev->dd);
+        lstate = (pip->portphysstate_linkdown >> 4) & 0xF;
+        if (lstate && !(state == IB_PORT_DOWN || state == IB_PORT_NOP))
+                goto err;
+
+        /*
+         * Only state changes of DOWN, ARM, and ACTIVE are valid
+         * and must be in the correct state to take effect (see 7.2.6).
+         */
+        switch (state) {
+        case IB_PORT_NOP:
+                if (lstate == 0)
+                        break;
+                /* FALLTHROUGH */
+        case IB_PORT_DOWN:
+                if (lstate == 0)
+                        if (ipath_layer_get_linkdowndefaultstate(dev->dd))
+                                lstate = IPATH_IB_LINKDOWN_SLEEP;
+                        else
+                                lstate = IPATH_IB_LINKDOWN;
+                else if (lstate == 1)
+                        lstate = IPATH_IB_LINKDOWN_SLEEP;
+                else if (lstate == 2)
+                        lstate = IPATH_IB_LINKDOWN;
+                else if (lstate == 3)
+                        lstate = IPATH_IB_LINKDOWN_DISABLE;
+                else
+                        goto err;
+                ipath_layer_set_linkstate(dev->dd, lstate);
+                if (flags & IPATH_LINKACTIVE) {
+                        event.event = IB_EVENT_PORT_ERR;
+                        ib_dispatch_event(&event);
+                }
+                break;
+        case IB_PORT_ARMED:
+                if (!(flags & (IPATH_LINKINIT | IPATH_LINKACTIVE)))
+                        break;
+                ipath_layer_set_linkstate(dev->dd, IPATH_IB_LINKARM);
+                if (flags & IPATH_LINKACTIVE) {
+                        event.event = IB_EVENT_PORT_ERR;
+                        ib_dispatch_event(&event);
+                }
+                break;
+        case IB_PORT_ACTIVE:
+                if (!(flags & IPATH_LINKARMED))
+                        break;
+                ipath_layer_set_linkstate(dev->dd, IPATH_IB_LINKACTIVE);
+                event.event = IB_EVENT_PORT_ACTIVE;
+                ib_dispatch_event(&event);
+                break;
+        default:
+                /* XXX We have already partially updated our state! */
+                goto err;
+        }
+
+        ret = recv_subn_get_portinfo(smp, ibdev, port);
+
+        if (clientrereg)
+                pip->clientrereg_resv_subnetto |= 0x80;
+
+        goto done;
+
+err:
+        smp->status |= IB_SMP_INVALID_FIELD;
+        ret = recv_subn_get_portinfo(smp, ibdev, port);
+
+done:
+        return ret;
+}
+
+static int recv_subn_set_pkeytable(struct ib_smp *smp,
+                                   struct ib_device *ibdev)
+{
+        u32 startpx = 32 * (be32_to_cpu(smp->attr_mod) & 0xffff);
+        __be16 *p = (__be16 *) smp->data;
+        u16 *q = (u16 *) smp->data;
+        struct ipath_ibdev *dev = to_idev(ibdev);
+        unsigned i, n = ipath_layer_get_npkeys(dev->dd);
+
+        for (i = 0; i < n; i++)
+                q[i] = be16_to_cpu(p[i]);
+
+        if (startpx != 0 ||
+            ipath_layer_set_pkeys(dev->dd, q) != 0)
+                smp->status |= IB_SMP_INVALID_FIELD;
+
+        return recv_subn_get_pkeytable(smp, ibdev);
+}
+
+#define IB_PMA_CLASS_PORT_INFO          __constant_htons(0x0001)
+#define IB_PMA_PORT_SAMPLES_CONTROL     __constant_htons(0x0010)
+#define IB_PMA_PORT_SAMPLES_RESULT      __constant_htons(0x0011)
+#define IB_PMA_PORT_COUNTERS            __constant_htons(0x0012)
+#define IB_PMA_PORT_COUNTERS_EXT        __constant_htons(0x001D)
+#define IB_PMA_PORT_SAMPLES_RESULT_EXT  __constant_htons(0x001E)
+
+struct ib_perf {
+        u8 base_version;
+        u8 mgmt_class;
+        u8 class_version;
+        u8 method;
+        __be16 status;
+        __be16 unused;
+        __be64 tid;
+        __be16 attr_id;
+        __be16 resv;
+        __be32 attr_mod;
+        u8 reserved[40];
+        u8 data[192];
+} __attribute__ ((packed));
+
+struct ib_pma_classportinfo {
+        u8 base_version;
+        u8 class_version;
+        __be16 cap_mask;
+        u8 reserved[3];
+        u8 resp_time_value;     /* only lower 5 bits */
+        union ib_gid redirect_gid;
+        __be32 redirect_tc_sl_fl;       /* 8, 4, 20 bits respectively */
+        __be16 redirect_lid;
+        __be16 redirect_pkey;
+        __be32 redirect_qp;     /* only lower 24 bits */
+        __be32 redirect_qkey;
+        union ib_gid trap_gid;
+        __be32 trap_tc_sl_fl;   /* 8, 4, 20 bits respectively */
+        __be16 trap_lid;
+        __be16 trap_pkey;
+        __be32 trap_hl_qp;      /* 8, 24 bits respectively */
+        __be32 trap_qkey;
+} __attribute__ ((packed));
+
+struct ib_pma_portsamplescontrol {
+        u8 opcode;
+        u8 port_select;
+        u8 tick;
+        u8 counter_width;       /* only lower 3 bits */
+        __be32 counter_mask0_9; /* 2, 10 * 3, bits */
+        __be16 counter_mask10_14;       /* 1, 5 * 3, bits */
+        u8 sample_mechanisms;
+        u8 sample_status;       /* only lower 2 bits */
+        __be64 option_mask;
+        __be64 vendor_mask;
+        __be32 sample_start;
+        __be32 sample_interval;
+        __be16 tag;
+        __be16 counter_select[15];
+} __attribute__ ((packed));
+
+struct ib_pma_portsamplesresult {
+        __be16 tag;
+        __be16 sample_status;   /* only lower 2 bits */
+        __be32 counter[15];
+} __attribute__ ((packed));
+
+struct ib_pma_portsamplesresult_ext {
+        __be16 tag;
+        __be16 sample_status;   /* only lower 2 bits */
+        __be32 extended_width;  /* only upper 2 bits */
+        __be64 counter[15];
+} __attribute__ ((packed));
+
+struct ib_pma_portcounters {
+        u8 reserved;
+        u8 port_select;
+        __be16 counter_select;
+        __be16 symbol_error_counter;
+        u8 link_error_recovery_counter;
+        u8 link_downed_counter;
+        __be16 port_rcv_errors;
+        __be16 port_rcv_remphys_errors;
+        __be16 port_rcv_switch_relay_errors;
+        __be16 port_xmit_discards;
+        u8 port_xmit_constraint_errors;
+        u8 port_rcv_constraint_errors;
+        u8 reserved1;
+        u8 lli_ebor_errors;     /* 4, 4, bits */
+        __be16 reserved2;
+        __be16 vl15_dropped;
+        __be32 port_xmit_data;
+        __be32 port_rcv_data;
+        __be32 port_xmit_packets;
+        __be32 port_rcv_packets;
+} __attribute__ ((packed));
+
+#define IB_PMA_SEL_SYMBOL_ERROR                 __constant_htons(0x0001)
+#define IB_PMA_SEL_LINK_ERROR_RECOVERY          __constant_htons(0x0002)
+#define IB_PMA_SEL_LINK_DOWNED                  __constant_htons(0x0004)
+#define IB_PMA_SEL_PORT_RCV_ERRORS              __constant_htons(0x0008)
+#define IB_PMA_SEL_PORT_RCV_REMPHYS_ERRORS      __constant_htons(0x0010)
+#define IB_PMA_SEL_PORT_XMIT_DISCARDS           __constant_htons(0x0040)
+#define IB_PMA_SEL_PORT_XMIT_DATA               __constant_htons(0x1000)
+#define IB_PMA_SEL_PORT_RCV_DATA                __constant_htons(0x2000)
+#define IB_PMA_SEL_PORT_XMIT_PACKETS            __constant_htons(0x4000)
+#define IB_PMA_SEL_PORT_RCV_PACKETS             __constant_htons(0x8000)
+
+struct ib_pma_portcounters_ext {
+        u8 reserved;
+        u8 port_select;
+        __be16 counter_select;
+        __be32 reserved1;
+        __be64 port_xmit_data;
+        __be64 port_rcv_data;
+        __be64 port_xmit_packets;
+        __be64 port_rcv_packets;
+        __be64 port_unicast_xmit_packets;
+        __be64 port_unicast_rcv_packets;
+        __be64 port_multicast_xmit_packets;
+        __be64 port_multicast_rcv_packets;
+} __attribute__ ((packed));
+
+#define IB_PMA_SELX_PORT_XMIT_DATA              __constant_htons(0x0001)
+#define IB_PMA_SELX_PORT_RCV_DATA               __constant_htons(0x0002)
+#define IB_PMA_SELX_PORT_XMIT_PACKETS           __constant_htons(0x0004)
+#define IB_PMA_SELX_PORT_RCV_PACKETS            __constant_htons(0x0008)
+#define IB_PMA_SELX_PORT_UNI_XMIT_PACKETS       __constant_htons(0x0010)
+#define IB_PMA_SELX_PORT_UNI_RCV_PACKETS        __constant_htons(0x0020)
+#define IB_PMA_SELX_PORT_MULTI_XMIT_PACKETS     __constant_htons(0x0040)
+#define IB_PMA_SELX_PORT_MULTI_RCV_PACKETS      __constant_htons(0x0080)
+
+static int recv_pma_get_classportinfo(struct ib_perf *pmp)
+{
+        struct ib_pma_classportinfo *p =
+                (struct ib_pma_classportinfo *)pmp->data;
+
+        memset(pmp->data, 0, sizeof(pmp->data));
+
+        if (pmp->attr_mod != 0)
+                pmp->status |= IB_SMP_INVALID_FIELD;
+
+        /* Indicate AllPortSelect is valid (only one port anyway) */
+        p->cap_mask = __constant_cpu_to_be16(1 << 8);
+        p->base_version = 1;
+        p->class_version = 1;
+        /*
+         * Expected response time is 4.096 usec. * 2^18 == 1.073741824
+         * sec.
+         */
+        p->resp_time_value = 18;
+
+        return reply((struct ib_smp *) pmp);
+}
+
+/*
+ * The PortSamplesControl.CounterMasks field is an array of 3 bit fields
+ * which specify the N'th counter's capabilities. See ch. 16.1.3.2.
+ * We support 5 counters which only count the mandatory quantities.
+ */
+#define COUNTER_MASK(q, n) (q << ((9 - n) * 3))
+#define COUNTER_MASK0_9 \
+        __constant_cpu_to_be32(COUNTER_MASK(1, 0) | \
+                               COUNTER_MASK(1, 1) | \
+                               COUNTER_MASK(1, 2) | \
+                               COUNTER_MASK(1, 3) | \
+                               COUNTER_MASK(1, 4))
+
+static int recv_pma_get_portsamplescontrol(struct ib_perf *pmp,
+                                           struct ib_device *ibdev, u8 port)
+{
+        struct ib_pma_portsamplescontrol *p =
+                (struct ib_pma_portsamplescontrol *)pmp->data;
+        struct ipath_ibdev *dev = to_idev(ibdev);
+        unsigned long flags;
+        u8 port_select = p->port_select;
+
+        memset(pmp->data, 0, sizeof(pmp->data));
+
+        p->port_select = port_select;
+        if (pmp->attr_mod != 0 ||
+            (port_select != port && port_select != 0xFF))
+                pmp->status |= IB_SMP_INVALID_FIELD;
+        /*
+         * Ticks are 10x the link transfer period which for 2.5Gbs is 4
+         * nsec.  0 == 4 nsec., 1 == 8 nsec., ..., 255 == 1020 nsec.  Sample
+         * intervals are counted in ticks.  Since we use Linux timers, that
+         * count in jiffies, we can't sample for less than 1000 ticks if HZ
+         * == 1000 (4000 ticks if HZ is 250).
+         */
+        /* XXX This is WRONG. */
+        p->tick = 250;          /* 1 usec. */
+        p->counter_width = 4;   /* 32 bit counters */
+        p->counter_mask0_9 = COUNTER_MASK0_9;
+        spin_lock_irqsave(&dev->pending_lock, flags);
+        p->sample_status = dev->pma_sample_status;
+        p->sample_start = cpu_to_be32(dev->pma_sample_start);
+        p->sample_interval = cpu_to_be32(dev->pma_sample_interval);
+        p->tag = cpu_to_be16(dev->pma_tag);
+        p->counter_select[0] = dev->pma_counter_select[0];
+        p->counter_select[1] = dev->pma_counter_select[1];
+        p->counter_select[2] = dev->pma_counter_select[2];
+        p->counter_select[3] = dev->pma_counter_select[3];
+        p->counter_select[4] = dev->pma_counter_select[4];
+        spin_unlock_irqrestore(&dev->pending_lock, flags);
+
+        return reply((struct ib_smp *) pmp);
+}
+
+static int recv_pma_set_portsamplescontrol(struct ib_perf *pmp,
+                                           struct ib_device *ibdev, u8 port)
+{
+        struct ib_pma_portsamplescontrol *p =
+                (struct ib_pma_portsamplescontrol *)pmp->data;
+        struct ipath_ibdev *dev = to_idev(ibdev);
+        unsigned long flags;
+        u32 start;
+        int ret;
+
+        if (pmp->attr_mod != 0 ||
+            (p->port_select != port && p->port_select != 0xFF)) {
+                pmp->status |= IB_SMP_INVALID_FIELD;
+                ret = reply((struct ib_smp *) pmp);
+                goto bail;
+        }
+
+        start = be32_to_cpu(p->sample_start);
+        if (start != 0) {
+                spin_lock_irqsave(&dev->pending_lock, flags);
+                if (dev->pma_sample_status == IB_PMA_SAMPLE_STATUS_DONE) {
+                        dev->pma_sample_status =
+                                IB_PMA_SAMPLE_STATUS_STARTED;
+                        dev->pma_sample_start = start;
+                        dev->pma_sample_interval =
+                                be32_to_cpu(p->sample_interval);
+                        dev->pma_tag = be16_to_cpu(p->tag);
+                        if (p->counter_select[0])
+                                dev->pma_counter_select[0] =
+                                        p->counter_select[0];
+                        if (p->counter_select[1])
+                                dev->pma_counter_select[1] =
+                                        p->counter_select[1];
+                        if (p->counter_select[2])
+                                dev->pma_counter_select[2] =
+                                        p->counter_select[2];
+                        if (p->counter_select[3])
+                                dev->pma_counter_select[3] =
+                                        p->counter_select[3];
+                        if (p->counter_select[4])
+                                dev->pma_counter_select[4] =
+                                        p->counter_select[4];
+                }
+                spin_unlock_irqrestore(&dev->pending_lock, flags);
+        }
+        ret = recv_pma_get_portsamplescontrol(pmp, ibdev, port);
+
+bail:
+        return ret;
+}
+
+static u64 get_counter(struct ipath_ibdev *dev, __be16 sel)
+{
+        u64 ret;
+
+        switch (sel) {
+        case IB_PMA_PORT_XMIT_DATA:
+                ret = dev->ipath_sword;
+                break;
+        case IB_PMA_PORT_RCV_DATA:
+                ret = dev->ipath_rword;
+                break;
+        case IB_PMA_PORT_XMIT_PKTS:
+                ret = dev->ipath_spkts;
+                break;
+        case IB_PMA_PORT_RCV_PKTS:
+                ret = dev->ipath_rpkts;
+                break;
+        case IB_PMA_PORT_XMIT_WAIT:
+                ret = dev->ipath_xmit_wait;
+                break;
+        default:
+                ret = 0;
+        }
+
+        return ret;
+}
+
+static int recv_pma_get_portsamplesresult(struct ib_perf *pmp,
+                                          struct ib_device *ibdev)
+{
+        struct ib_pma_portsamplesresult *p =
+                (struct ib_pma_portsamplesresult *)pmp->data;
+        struct ipath_ibdev *dev = to_idev(ibdev);
+        int i;
+
+        memset(pmp->data, 0, sizeof(pmp->data));
+        p->tag = cpu_to_be16(dev->pma_tag);
+        p->sample_status = cpu_to_be16(dev->pma_sample_status);
+        for (i = 0; i < ARRAY_SIZE(dev->pma_counter_select); i++)
+                p->counter[i] = cpu_to_be32(
+                        get_counter(dev, dev->pma_counter_select[i]));
+
+        return reply((struct ib_smp *) pmp);
+}
+
+static int recv_pma_get_portsamplesresult_ext(struct ib_perf *pmp,
+                                              struct ib_device *ibdev)
+{
+        struct ib_pma_portsamplesresult_ext *p =
+                (struct ib_pma_portsamplesresult_ext *)pmp->data;
+        struct ipath_ibdev *dev = to_idev(ibdev);
+        int i;
+
+        memset(pmp->data, 0, sizeof(pmp->data));
+        p->tag = cpu_to_be16(dev->pma_tag);
+        p->sample_status = cpu_to_be16(dev->pma_sample_status);
+        /* 64 bits */
+        p->extended_width = __constant_cpu_to_be32(0x80000000);
+        for (i = 0; i < ARRAY_SIZE(dev->pma_counter_select); i++)
+                p->counter[i] = cpu_to_be64(
+                        get_counter(dev, dev->pma_counter_select[i]));
+
+        return reply((struct ib_smp *) pmp);
+}
+
+static int recv_pma_get_portcounters(struct ib_perf *pmp,
+                                     struct ib_device *ibdev, u8 port)
+{
+        struct ib_pma_portcounters *p = (struct ib_pma_portcounters *)
+                pmp->data;
+        struct ipath_ibdev *dev = to_idev(ibdev);
+        struct ipath_layer_counters cntrs;
+        u8 port_select = p->port_select;
+
+        ipath_layer_get_counters(dev->dd, &cntrs);
+
+        /* Adjust counters for any resets done. */
+        cntrs.symbol_error_counter -= dev->n_symbol_error_counter;
+        cntrs.link_error_recovery_counter -=
+                dev->n_link_error_recovery_counter;
+        cntrs.link_downed_counter -= dev->n_link_downed_counter;
+        cntrs.port_rcv_errors += dev->rcv_errors;
+        cntrs.port_rcv_errors -= dev->n_port_rcv_errors;
+        cntrs.port_rcv_remphys_errors -= dev->n_port_rcv_remphys_errors;
+        cntrs.port_xmit_discards -= dev->n_port_xmit_discards;
+        cntrs.port_xmit_data -= dev->n_port_xmit_data;
+        cntrs.port_rcv_data -= dev->n_port_rcv_data;
+        cntrs.port_xmit_packets -= dev->n_port_xmit_packets;
+        cntrs.port_rcv_packets -= dev->n_port_rcv_packets;
+
+        memset(pmp->data, 0, sizeof(pmp->data));
+
+        p->port_select = port_select;
+        if (pmp->attr_mod != 0 ||
+            (port_select != port && port_select != 0xFF))
+                pmp->status |= IB_SMP_INVALID_FIELD;
+
+        if (cntrs.symbol_error_counter > 0xFFFFUL)
+                p->symbol_error_counter = __constant_cpu_to_be16(0xFFFF);
+        else
+                p->symbol_error_counter =
+                        cpu_to_be16((u16)cntrs.symbol_error_counter);
+        if (cntrs.link_error_recovery_counter > 0xFFUL)
+                p->link_error_recovery_counter = 0xFF;
+        else
+                p->link_error_recovery_counter =
+                        (u8)cntrs.link_error_recovery_counter;
+        if (cntrs.link_downed_counter > 0xFFUL)
+                p->link_downed_counter = 0xFF;
+        else
+                p->link_downed_counter = (u8)cntrs.link_downed_counter;
+        if (cntrs.port_rcv_errors > 0xFFFFUL)
+                p->port_rcv_errors = __constant_cpu_to_be16(0xFFFF);
+        else
+                p->port_rcv_errors =
+                        cpu_to_be16((u16) cntrs.port_rcv_errors);
+        if (cntrs.port_rcv_remphys_errors > 0xFFFFUL)
+                p->port_rcv_remphys_errors = __constant_cpu_to_be16(0xFFFF);
+        else
+                p->port_rcv_remphys_errors =
+                        cpu_to_be16((u16)cntrs.port_rcv_remphys_errors);
+        if (cntrs.port_xmit_discards > 0xFFFFUL)
+                p->port_xmit_discards = __constant_cpu_to_be16(0xFFFF);
+        else
+                p->port_xmit_discards =
+                        cpu_to_be16((u16)cntrs.port_xmit_discards);
+        if (cntrs.port_xmit_data > 0xFFFFFFFFUL)
+                p->port_xmit_data = __constant_cpu_to_be32(0xFFFFFFFF);
+        else
+                p->port_xmit_data = cpu_to_be32((u32)cntrs.port_xmit_data);
+        if (cntrs.port_rcv_data > 0xFFFFFFFFUL)
+                p->port_rcv_data = __constant_cpu_to_be32(0xFFFFFFFF);
+        else
+                p->port_rcv_data = cpu_to_be32((u32)cntrs.port_rcv_data);
+        if (cntrs.port_xmit_packets > 0xFFFFFFFFUL)
+                p->port_xmit_packets = __constant_cpu_to_be32(0xFFFFFFFF);
+        else
+                p->port_xmit_packets =
+                        cpu_to_be32((u32)cntrs.port_xmit_packets);
+        if (cntrs.port_rcv_packets > 0xFFFFFFFFUL)
+                p->port_rcv_packets = __constant_cpu_to_be32(0xFFFFFFFF);
+        else
+                p->port_rcv_packets =
+                        cpu_to_be32((u32) cntrs.port_rcv_packets);
+
+        return reply((struct ib_smp *) pmp);
+}
+
+static int recv_pma_get_portcounters_ext(struct ib_perf *pmp,
+                                         struct ib_device *ibdev, u8 port)
+{
+        struct ib_pma_portcounters_ext *p =
+                (struct ib_pma_portcounters_ext *)pmp->data;
+        struct ipath_ibdev *dev = to_idev(ibdev);
+        u64 swords, rwords, spkts, rpkts, xwait;
+        u8 port_select = p->port_select;
+
+        ipath_layer_snapshot_counters(dev->dd, &swords, &rwords, &spkts,
+                                      &rpkts, &xwait);
+
+        /* Adjust counters for any resets done. */
+        swords -= dev->n_port_xmit_data;
+        rwords -= dev->n_port_rcv_data;
+        spkts -= dev->n_port_xmit_packets;
+        rpkts -= dev->n_port_rcv_packets;
+
+        memset(pmp->data, 0, sizeof(pmp->data));
+
+        p->port_select = port_select;
+        if (pmp->attr_mod != 0 ||
+            (port_select != port && port_select != 0xFF))
+                pmp->status |= IB_SMP_INVALID_FIELD;
+
+        p->port_xmit_data = cpu_to_be64(swords);
+        p->port_rcv_data = cpu_to_be64(rwords);
+        p->port_xmit_packets = cpu_to_be64(spkts);
+        p->port_rcv_packets = cpu_to_be64(rpkts);
+        p->port_unicast_xmit_packets = cpu_to_be64(dev->n_unicast_xmit);
+        p->port_unicast_rcv_packets = cpu_to_be64(dev->n_unicast_rcv);
+        p->port_multicast_xmit_packets = cpu_to_be64(dev->n_multicast_xmit);
+        p->port_multicast_rcv_packets = cpu_to_be64(dev->n_multicast_rcv);
+
+        return reply((struct ib_smp *) pmp);
+}
+
+static int recv_pma_set_portcounters(struct ib_perf *pmp,
+                                     struct ib_device *ibdev, u8 port)
+{
+        struct ib_pma_portcounters *p = (struct ib_pma_portcounters *)
+                pmp->data;
+        struct ipath_ibdev *dev = to_idev(ibdev);
+        struct ipath_layer_counters cntrs;
+
+        /*
+         * Since the HW doesn't support clearing counters, we save the
+         * current count and subtract it from future responses.
+         */
+        ipath_layer_get_counters(dev->dd, &cntrs);
+
+        if (p->counter_select & IB_PMA_SEL_SYMBOL_ERROR)
+                dev->n_symbol_error_counter = cntrs.symbol_error_counter;
+
+        if (p->counter_select & IB_PMA_SEL_LINK_ERROR_RECOVERY)
+                dev->n_link_error_recovery_counter =
+                        cntrs.link_error_recovery_counter;
+
+        if (p->counter_select & IB_PMA_SEL_LINK_DOWNED)
+                dev->n_link_downed_counter = cntrs.link_downed_counter;
+
+        if (p->counter_select & IB_PMA_SEL_PORT_RCV_ERRORS)
+                dev->n_port_rcv_errors =
+                        cntrs.port_rcv_errors + dev->rcv_errors;
+
+        if (p->counter_select & IB_PMA_SEL_PORT_RCV_REMPHYS_ERRORS)
+                dev->n_port_rcv_remphys_errors =
+                        cntrs.port_rcv_remphys_errors;
+
+        if (p->counter_select & IB_PMA_SEL_PORT_XMIT_DISCARDS)
+                dev->n_port_xmit_discards = cntrs.port_xmit_discards;
+
+        if (p->counter_select & IB_PMA_SEL_PORT_XMIT_DATA)
+                dev->n_port_xmit_data = cntrs.port_xmit_data;
+
+        if (p->counter_select & IB_PMA_SEL_PORT_RCV_DATA)
+                dev->n_port_rcv_data = cntrs.port_rcv_data;
+
+        if (p->counter_select & IB_PMA_SEL_PORT_XMIT_PACKETS)
+                dev->n_port_xmit_packets = cntrs.port_xmit_packets;
+
+        if (p->counter_select & IB_PMA_SEL_PORT_RCV_PACKETS)
+                dev->n_port_rcv_packets = cntrs.port_rcv_packets;
+
+        return recv_pma_get_portcounters(pmp, ibdev, port);
+}
+
+static int recv_pma_set_portcounters_ext(struct ib_perf *pmp,
+                                         struct ib_device *ibdev, u8 port)
+{
+        struct ib_pma_portcounters *p = (struct ib_pma_portcounters *)
+                pmp->data;
+        struct ipath_ibdev *dev = to_idev(ibdev);
+        u64 swords, rwords, spkts, rpkts, xwait;
+
+        ipath_layer_snapshot_counters(dev->dd, &swords, &rwords, &spkts,
+                                      &rpkts, &xwait);
+
+        if (p->counter_select & IB_PMA_SELX_PORT_XMIT_DATA)
+                dev->n_port_xmit_data = swords;
+
+        if (p->counter_select & IB_PMA_SELX_PORT_RCV_DATA)
+                dev->n_port_rcv_data = rwords;
+
+        if (p->counter_select & IB_PMA_SELX_PORT_XMIT_PACKETS)
+                dev->n_port_xmit_packets = spkts;
+
+        if (p->counter_select & IB_PMA_SELX_PORT_RCV_PACKETS)
+                dev->n_port_rcv_packets = rpkts;
+
+        if (p->counter_select & IB_PMA_SELX_PORT_UNI_XMIT_PACKETS)
+                dev->n_unicast_xmit = 0;
+
+        if (p->counter_select & IB_PMA_SELX_PORT_UNI_RCV_PACKETS)
+                dev->n_unicast_rcv = 0;
+
+        if (p->counter_select & IB_PMA_SELX_PORT_MULTI_XMIT_PACKETS)
+                dev->n_multicast_xmit = 0;
+
+        if (p->counter_select & IB_PMA_SELX_PORT_MULTI_RCV_PACKETS)
+                dev->n_multicast_rcv = 0;
+
+        return recv_pma_get_portcounters_ext(pmp, ibdev, port);
+}
+
+static int process_subn(struct ib_device *ibdev, int mad_flags,
+                        u8 port_num, struct ib_mad *in_mad,
+                        struct ib_mad *out_mad)
+{
+        struct ib_smp *smp = (struct ib_smp *)out_mad;
+        struct ipath_ibdev *dev = to_idev(ibdev);
+        int ret;
+
+        *out_mad = *in_mad;
+        if (smp->class_version != 1) {
+                smp->status |= IB_SMP_UNSUP_VERSION;
+                ret = reply(smp);
+                goto bail;
+        }
+
+        /* Is the mkey in the process of expiring? */
+        if (dev->mkey_lease_timeout && jiffies >= dev->mkey_lease_timeout) {
+                /* Clear timeout and mkey protection field. */
+                dev->mkey_lease_timeout = 0;
+                dev->mkeyprot_resv_lmc &= 0x3F;
+        }
+
+        /*
+         * M_Key checking depends on
+         * Portinfo:M_Key_protect_bits
+         */
+        if ((mad_flags & IB_MAD_IGNORE_MKEY) == 0 && dev->mkey != 0 &&
+            dev->mkey != smp->mkey &&
+            (smp->method == IB_MGMT_METHOD_SET ||
+             (smp->method == IB_MGMT_METHOD_GET &&
+              (dev->mkeyprot_resv_lmc >> 7) != 0))) {
+                if (dev->mkey_violations != 0xFFFF)
+                        ++dev->mkey_violations;
+                if (dev->mkey_lease_timeout ||
+                    dev->mkey_lease_period == 0) {
+                        ret = IB_MAD_RESULT_SUCCESS |
+                                IB_MAD_RESULT_CONSUMED;
+                        goto bail;
+                }
+                dev->mkey_lease_timeout = jiffies +
+                        dev->mkey_lease_period * HZ;
+                /* Future: Generate a trap notice. */
+                ret = IB_MAD_RESULT_SUCCESS | IB_MAD_RESULT_CONSUMED;
+                goto bail;
+        } else if (dev->mkey_lease_timeout)
+                dev->mkey_lease_timeout = 0;
+
+        switch (smp->method) {
+        case IB_MGMT_METHOD_GET:
+                switch (smp->attr_id) {
+                case IB_SMP_ATTR_NODE_DESC:
+                        ret = recv_subn_get_nodedescription(smp, ibdev);
+                        goto bail;
+                case IB_SMP_ATTR_NODE_INFO:
+                        ret = recv_subn_get_nodeinfo(smp, ibdev, port_num);
+                        goto bail;
+                case IB_SMP_ATTR_GUID_INFO:
+                        ret = recv_subn_get_guidinfo(smp, ibdev);
+                        goto bail;
+                case IB_SMP_ATTR_PORT_INFO:
+                        ret = recv_subn_get_portinfo(smp, ibdev, port_num);
+                        goto bail;
+                case IB_SMP_ATTR_PKEY_TABLE:
+                        ret = recv_subn_get_pkeytable(smp, ibdev);
+                        goto bail;
+                case IB_SMP_ATTR_SM_INFO:
+                        if (dev->port_cap_flags & IB_PORT_SM_DISABLED) {
+                                ret = IB_MAD_RESULT_SUCCESS |
+                                        IB_MAD_RESULT_CONSUMED;
+                                goto bail;
+                        }
+                        if (dev->port_cap_flags & IB_PORT_SM) {
+                                ret = IB_MAD_RESULT_SUCCESS;
+                                goto bail;
+                        }
+                        /* FALLTHROUGH */
+                default:
+                        smp->status |= IB_SMP_UNSUP_METH_ATTR;
+                        ret = reply(smp);
+                        goto bail;
+                }
+
+        case IB_MGMT_METHOD_SET:
+                switch (smp->attr_id) {
+                case IB_SMP_ATTR_GUID_INFO:
+                        ret = recv_subn_set_guidinfo(smp, ibdev);
+                        goto bail;
+                case IB_SMP_ATTR_PORT_INFO:
+                        ret = recv_subn_set_portinfo(smp, ibdev, port_num);
+                        goto bail;
+                case IB_SMP_ATTR_PKEY_TABLE:
+                        ret = recv_subn_set_pkeytable(smp, ibdev);
+                        goto bail;
+                case IB_SMP_ATTR_SM_INFO:
+                        if (dev->port_cap_flags & IB_PORT_SM_DISABLED) {
+                                ret = IB_MAD_RESULT_SUCCESS |
+                                        IB_MAD_RESULT_CONSUMED;
+                                goto bail;
+                        }
+                        if (dev->port_cap_flags & IB_PORT_SM) {
+                                ret = IB_MAD_RESULT_SUCCESS;
+                                goto bail;
+                        }
+                        /* FALLTHROUGH */
+                default:
+                        smp->status |= IB_SMP_UNSUP_METH_ATTR;
+                        ret = reply(smp);
+                        goto bail;
+                }
+
+        case IB_MGMT_METHOD_GET_RESP:
+                /*
+                 * The ib_mad module will call us to process responses
+                 * before checking for other consumers.
+                 * Just tell the caller to process it normally.
+                 */
+                ret = IB_MAD_RESULT_FAILURE;
+                goto bail;
+        default:
+                smp->status |= IB_SMP_UNSUP_METHOD;
+                ret = reply(smp);
+        }
+
+bail:
+        return ret;
+}
+
+static int process_perf(struct ib_device *ibdev, u8 port_num,
+                        struct ib_mad *in_mad,
+                        struct ib_mad *out_mad)
+{
+        struct ib_perf *pmp = (struct ib_perf *)out_mad;
+        int ret;
+
+        *out_mad = *in_mad;
+        if (pmp->class_version != 1) {
+                pmp->status |= IB_SMP_UNSUP_VERSION;
+                ret = reply((struct ib_smp *) pmp);
+                goto bail;
+        }
+
+        switch (pmp->method) {
+        case IB_MGMT_METHOD_GET:
+                switch (pmp->attr_id) {
+                case IB_PMA_CLASS_PORT_INFO:
+                        ret = recv_pma_get_classportinfo(pmp);
+                        goto bail;
+                case IB_PMA_PORT_SAMPLES_CONTROL:
+                        ret = recv_pma_get_portsamplescontrol(pmp, ibdev,
+                                                              port_num);
+                        goto bail;
+                case IB_PMA_PORT_SAMPLES_RESULT:
+                        ret = recv_pma_get_portsamplesresult(pmp, ibdev);
+                        goto bail;
+                case IB_PMA_PORT_SAMPLES_RESULT_EXT:
+                        ret = recv_pma_get_portsamplesresult_ext(pmp,
+                                                                 ibdev);
+                        goto bail;
+                case IB_PMA_PORT_COUNTERS:
+                        ret = recv_pma_get_portcounters(pmp, ibdev,
+                                                        port_num);
+                        goto bail;
+                case IB_PMA_PORT_COUNTERS_EXT:
+                        ret = recv_pma_get_portcounters_ext(pmp, ibdev,
+                                                            port_num);
+                        goto bail;
+                default:
+                        pmp->status |= IB_SMP_UNSUP_METH_ATTR;
+                        ret = reply((struct ib_smp *) pmp);
+                        goto bail;
+                }
+
+        case IB_MGMT_METHOD_SET:
+                switch (pmp->attr_id) {
+                case IB_PMA_PORT_SAMPLES_CONTROL:
+                        ret = recv_pma_set_portsamplescontrol(pmp, ibdev,
+                                                              port_num);
+                        goto bail;
+                case IB_PMA_PORT_COUNTERS:
+                        ret = recv_pma_set_portcounters(pmp, ibdev,
+                                                        port_num);
+                        goto bail;
+                case IB_PMA_PORT_COUNTERS_EXT:
+                        ret = recv_pma_set_portcounters_ext(pmp, ibdev,
+                                                            port_num);
+                        goto bail;
+                default:
+                        pmp->status |= IB_SMP_UNSUP_METH_ATTR;
+                        ret = reply((struct ib_smp *) pmp);
+                        goto bail;
+                }
+
+        case IB_MGMT_METHOD_GET_RESP:
+                /*
+                 * The ib_mad module will call us to process responses
+                 * before checking for other consumers.
+                 * Just tell the caller to process it normally.
+                 */
+                ret = IB_MAD_RESULT_FAILURE;
+                goto bail;
+        default:
+                pmp->status |= IB_SMP_UNSUP_METHOD;
+                ret = reply((struct ib_smp *) pmp);
+        }
+
+bail:
+        return ret;
+}
+
+/**
+ * ipath_process_mad - process an incoming MAD packet
+ * @ibdev: the infiniband device this packet came in on
+ * @mad_flags: MAD flags
+ * @port_num: the port number this packet came in on
+ * @in_wc: the work completion entry for this packet
+ * @in_grh: the global route header for this packet
+ * @in_mad: the incoming MAD
+ * @out_mad: any outgoing MAD reply
+ *
+ * Returns IB_MAD_RESULT_SUCCESS if this is a MAD that we are not
+ * interested in processing.
+ *
+ * Note that the verbs framework has already done the MAD sanity checks,
+ * and hop count/pointer updating for IB_MGMT_CLASS_SUBN_DIRECTED_ROUTE
+ * MADs.
+ *
+ * This is called by the ib_mad module.
+ */
+int ipath_process_mad(struct ib_device *ibdev, int mad_flags, u8 port_num,
+                      struct ib_wc *in_wc, struct ib_grh *in_grh,
+                      struct ib_mad *in_mad, struct ib_mad *out_mad)
+{
+        struct ipath_ibdev *dev = to_idev(ibdev);
+        int ret;
+
+        /*
+         * Snapshot current HW counters to "clear" them.
+         * This should be done when the driver is loaded except that for
+         * some reason we get a zillion errors when brining up the link.
+         */
+        if (dev->rcv_errors == 0) {
+                struct ipath_layer_counters cntrs;
+
+                ipath_layer_get_counters(to_idev(ibdev)->dd, &cntrs);
+                dev->rcv_errors++;
+                dev->n_symbol_error_counter = cntrs.symbol_error_counter;
+                dev->n_link_error_recovery_counter =
+                        cntrs.link_error_recovery_counter;
+                dev->n_link_downed_counter = cntrs.link_downed_counter;
+                dev->n_port_rcv_errors = cntrs.port_rcv_errors + 1;
+                dev->n_port_rcv_remphys_errors =
+                        cntrs.port_rcv_remphys_errors;
+                dev->n_port_xmit_discards = cntrs.port_xmit_discards;
+                dev->n_port_xmit_data = cntrs.port_xmit_data;
+                dev->n_port_rcv_data = cntrs.port_rcv_data;
+                dev->n_port_xmit_packets = cntrs.port_xmit_packets;
+                dev->n_port_rcv_packets = cntrs.port_rcv_packets;
+        }
+        switch (in_mad->mad_hdr.mgmt_class) {
+        case IB_MGMT_CLASS_SUBN_DIRECTED_ROUTE:
+        case IB_MGMT_CLASS_SUBN_LID_ROUTED:
+                ret = process_subn(ibdev, mad_flags, port_num,
+                                   in_mad, out_mad);
+                goto bail;
+        case IB_MGMT_CLASS_PERF_MGMT:
+                ret = process_perf(ibdev, port_num, in_mad, out_mad);
+                goto bail;
+        default:
+                ret = IB_MAD_RESULT_SUCCESS;
+        }
+
+bail:
+        return ret;
+}
diff --git a/drivers/infiniband/hw/ipath/ipath_mr.c b/drivers/infiniband/hw/ipath/ipath_mr.c
new file mode 100644
index 000000000000..69ffec66d45d
--- /dev/null
+++ b/drivers/infiniband/hw/ipath/ipath_mr.c
@@ -0,0 +1,383 @@
+/*
+ * Copyright (c) 2005, 2006 PathScale, Inc. All rights reserved.
+ *
+ * This software is available to you under a choice of one of two
+ * licenses.  You may choose to be licensed under the terms of the GNU
+ * General Public License (GPL) Version 2, available from the file
+ * COPYING in the main directory of this source tree, or the
+ * OpenIB.org BSD license below:
+ *
+ *     Redistribution and use in source and binary forms, with or
+ *     without modification, are permitted provided that the following
+ *     conditions are met:
+ *
+ *      - Redistributions of source code must retain the above
+ *        copyright notice, this list of conditions and the following
+ *        disclaimer.
+ *
+ *      - Redistributions in binary form must reproduce the above
+ *        copyright notice, this list of conditions and the following
+ *        disclaimer in the documentation and/or other materials
+ *        provided with the distribution.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+ * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+ * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+ * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
+ * BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
+ * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
+ * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+ * SOFTWARE.
+ */
+
+#include <rdma/ib_pack.h>
+#include <rdma/ib_smi.h>
+
+#include "ipath_verbs.h"
+
+/**
+ * ipath_get_dma_mr - get a DMA memory region
+ * @pd: protection domain for this memory region
+ * @acc: access flags
+ *
+ * Returns the memory region on success, otherwise returns an errno.
+ */
+struct ib_mr *ipath_get_dma_mr(struct ib_pd *pd, int acc)
+{
+        struct ipath_mr *mr;
+        struct ib_mr *ret;
+
+        mr = kzalloc(sizeof *mr, GFP_KERNEL);
+        if (!mr) {
+                ret = ERR_PTR(-ENOMEM);
+                goto bail;
+        }
+
+        mr->mr.access_flags = acc;
+        ret = &mr->ibmr;
+
+bail:
+        return ret;
+}
+
+static struct ipath_mr *alloc_mr(int count,
+                                 struct ipath_lkey_table *lk_table)
+{
+        struct ipath_mr *mr;
+        int m, i = 0;
+
+        /* Allocate struct plus pointers to first level page tables. */
+        m = (count + IPATH_SEGSZ - 1) / IPATH_SEGSZ;
+        mr = kmalloc(sizeof *mr + m * sizeof mr->mr.map[0], GFP_KERNEL);
+        if (!mr)
+                goto done;
+
+        /* Allocate first level page tables. */
+        for (; i < m; i++) {
+                mr->mr.map[i] = kmalloc(sizeof *mr->mr.map[0], GFP_KERNEL);
+                if (!mr->mr.map[i])
+                        goto bail;
+        }
+        mr->mr.mapsz = m;
+
+        /*
+         * ib_reg_phys_mr() will initialize mr->ibmr except for
+         * lkey and rkey.
+         */
+        if (!ipath_alloc_lkey(lk_table, &mr->mr))
+                goto bail;
+        mr->ibmr.rkey = mr->ibmr.lkey = mr->mr.lkey;
+
+        goto done;
+
+bail:
+        while (i) {
+                i--;
+                kfree(mr->mr.map[i]);
+        }
+        kfree(mr);
+        mr = NULL;
+
+done:
+        return mr;
+}
+
+/**
+ * ipath_reg_phys_mr - register a physical memory region
+ * @pd: protection domain for this memory region
+ * @buffer_list: pointer to the list of physical buffers to register
+ * @num_phys_buf: the number of physical buffers to register
+ * @iova_start: the starting address passed over IB which maps to this MR
+ *
+ * Returns the memory region on success, otherwise returns an errno.
+ */
+struct ib_mr *ipath_reg_phys_mr(struct ib_pd *pd,
+                                struct ib_phys_buf *buffer_list,
+                                int num_phys_buf, int acc, u64 *iova_start)
+{
+        struct ipath_mr *mr;
+        int n, m, i;
+        struct ib_mr *ret;
+
+        mr = alloc_mr(num_phys_buf, &to_idev(pd->device)->lk_table);
+        if (mr == NULL) {
+                ret = ERR_PTR(-ENOMEM);
+                goto bail;
+        }
+
+        mr->mr.user_base = *iova_start;
+        mr->mr.iova = *iova_start;
+        mr->mr.length = 0;
+        mr->mr.offset = 0;
+        mr->mr.access_flags = acc;
+        mr->mr.max_segs = num_phys_buf;
+
+        m = 0;
+        n = 0;
+        for (i = 0; i < num_phys_buf; i++) {
+                mr->mr.map[m]->segs[n].vaddr =
+                        phys_to_virt(buffer_list[i].addr);
+                mr->mr.map[m]->segs[n].length = buffer_list[i].size;
+                mr->mr.length += buffer_list[i].size;
+                n++;
+                if (n == IPATH_SEGSZ) {
+                        m++;
+                        n = 0;
+                }
+        }
+
+        ret = &mr->ibmr;
+
+bail:
+        return ret;
+}
+
+/**
+ * ipath_reg_user_mr - register a userspace memory region
+ * @pd: protection domain for this memory region
+ * @region: the user memory region
+ * @mr_access_flags: access flags for this memory region
+ * @udata: unused by the InfiniPath driver
+ *
+ * Returns the memory region on success, otherwise returns an errno.
+ */
+struct ib_mr *ipath_reg_user_mr(struct ib_pd *pd, struct ib_umem *region,
+                                int mr_access_flags, struct ib_udata *udata)
+{
+        struct ipath_mr *mr;
+        struct ib_umem_chunk *chunk;
+        int n, m, i;
+        struct ib_mr *ret;
+
+        n = 0;
+        list_for_each_entry(chunk, &region->chunk_list, list)
+                n += chunk->nents;
+
+        mr = alloc_mr(n, &to_idev(pd->device)->lk_table);
+        if (!mr) {
+                ret = ERR_PTR(-ENOMEM);
+                goto bail;
+        }
+
+        mr->mr.user_base = region->user_base;
+        mr->mr.iova = region->virt_base;
+        mr->mr.length = region->length;
+        mr->mr.offset = region->offset;
+        mr->mr.access_flags = mr_access_flags;
+        mr->mr.max_segs = n;
+
+        m = 0;
+        n = 0;
+        list_for_each_entry(chunk, &region->chunk_list, list) {
+                for (i = 0; i < chunk->nmap; i++) {
+                        mr->mr.map[m]->segs[n].vaddr =
+                                page_address(chunk->page_list[i].page);
+                        mr->mr.map[m]->segs[n].length = region->page_size;
+                        n++;
+                        if (n == IPATH_SEGSZ) {
+                                m++;
+                                n = 0;
+                        }
+                }
+        }
+        ret = &mr->ibmr;
+
+bail:
+        return ret;
+}
+
+/**
+ * ipath_dereg_mr - unregister and free a memory region
+ * @ibmr: the memory region to free
+ *
+ * Returns 0 on success.
+ *
+ * Note that this is called to free MRs created by ipath_get_dma_mr()
+ * or ipath_reg_user_mr().
+ */
+int ipath_dereg_mr(struct ib_mr *ibmr)
+{
+        struct ipath_mr *mr = to_imr(ibmr);
+        int i;
+
+        ipath_free_lkey(&to_idev(ibmr->device)->lk_table, ibmr->lkey);
+        i = mr->mr.mapsz;
+        while (i) {
+                i--;
+                kfree(mr->mr.map[i]);
+        }
+        kfree(mr);
+        return 0;
+}
+
+/**
+ * ipath_alloc_fmr - allocate a fast memory region
+ * @pd: the protection domain for this memory region
+ * @mr_access_flags: access flags for this memory region
+ * @fmr_attr: fast memory region attributes
+ *
+ * Returns the memory region on success, otherwise returns an errno.
+ */
+struct ib_fmr *ipath_alloc_fmr(struct ib_pd *pd, int mr_access_flags,
+                               struct ib_fmr_attr *fmr_attr)
+{
+        struct ipath_fmr *fmr;
+        int m, i = 0;
+        struct ib_fmr *ret;
+
+        /* Allocate struct plus pointers to first level page tables. */
+        m = (fmr_attr->max_pages + IPATH_SEGSZ - 1) / IPATH_SEGSZ;
+        fmr = kmalloc(sizeof *fmr + m * sizeof fmr->mr.map[0], GFP_KERNEL);
+        if (!fmr)
+                goto bail;
+
+        /* Allocate first level page tables. */
+        for (; i < m; i++) {
+                fmr->mr.map[i] = kmalloc(sizeof *fmr->mr.map[0],
+                                         GFP_KERNEL);
+                if (!fmr->mr.map[i])
+                        goto bail;
+        }
+        fmr->mr.mapsz = m;
+
+        /*
+         * ib_alloc_fmr() will initialize fmr->ibfmr except for lkey &
+         * rkey.
+         */
+        if (!ipath_alloc_lkey(&to_idev(pd->device)->lk_table, &fmr->mr))
+                goto bail;
+        fmr->ibfmr.rkey = fmr->ibfmr.lkey = fmr->mr.lkey;
+        /*
+         * Resources are allocated but no valid mapping (RKEY can't be
+         * used).
+         */
+        fmr->mr.user_base = 0;
+        fmr->mr.iova = 0;
+        fmr->mr.length = 0;
+        fmr->mr.offset = 0;
+        fmr->mr.access_flags = mr_access_flags;
+        fmr->mr.max_segs = fmr_attr->max_pages;
+        fmr->page_shift = fmr_attr->page_shift;
+
+        ret = &fmr->ibfmr;
+        goto done;
+
+bail:
+        while (i)
+                kfree(fmr->mr.map[--i]);
+        kfree(fmr);
+        ret = ERR_PTR(-ENOMEM);
+
+done:
+        return ret;
+}
+
+/**
+ * ipath_map_phys_fmr - set up a fast memory region
+ * @ibmfr: the fast memory region to set up
+ * @page_list: the list of pages to associate with the fast memory region
+ * @list_len: the number of pages to associate with the fast memory region
+ * @iova: the virtual address of the start of the fast memory region
+ *
+ * This may be called from interrupt context.
+ */
+
+int ipath_map_phys_fmr(struct ib_fmr *ibfmr, u64 * page_list,
+                       int list_len, u64 iova)
+{
+        struct ipath_fmr *fmr = to_ifmr(ibfmr);
+        struct ipath_lkey_table *rkt;
+        unsigned long flags;
+        int m, n, i;
+        u32 ps;
+        int ret;
+
+        if (list_len > fmr->mr.max_segs) {
+                ret = -EINVAL;
+                goto bail;
+        }
+        rkt = &to_idev(ibfmr->device)->lk_table;
+        spin_lock_irqsave(&rkt->lock, flags);
+        fmr->mr.user_base = iova;
+        fmr->mr.iova = iova;
+        ps = 1 << fmr->page_shift;
+        fmr->mr.length = list_len * ps;
+        m = 0;
+        n = 0;
+        ps = 1 << fmr->page_shift;
+        for (i = 0; i < list_len; i++) {
+                fmr->mr.map[m]->segs[n].vaddr = phys_to_virt(page_list[i]);
+                fmr->mr.map[m]->segs[n].length = ps;
+                if (++n == IPATH_SEGSZ) {
+                        m++;
+                        n = 0;
+                }
+        }
+        spin_unlock_irqrestore(&rkt->lock, flags);
+        ret = 0;
+
+bail:
+        return ret;
+}
+
+/**
+ * ipath_unmap_fmr - unmap fast memory regions
+ * @fmr_list: the list of fast memory regions to unmap
+ *
+ * Returns 0 on success.
+ */
+int ipath_unmap_fmr(struct list_head *fmr_list)
+{
+        struct ipath_fmr *fmr;
+        struct ipath_lkey_table *rkt;
+        unsigned long flags;
+
+        list_for_each_entry(fmr, fmr_list, ibfmr.list) {
+                rkt = &to_idev(fmr->ibfmr.device)->lk_table;
+                spin_lock_irqsave(&rkt->lock, flags);
+                fmr->mr.user_base = 0;
+                fmr->mr.iova = 0;
+                fmr->mr.length = 0;
+                spin_unlock_irqrestore(&rkt->lock, flags);
+        }
+        return 0;
+}
+
+/**
+ * ipath_dealloc_fmr - deallocate a fast memory region
+ * @ibfmr: the fast memory region to deallocate
+ *
+ * Returns 0 on success.
+ */
+int ipath_dealloc_fmr(struct ib_fmr *ibfmr)
+{
+        struct ipath_fmr *fmr = to_ifmr(ibfmr);
+        int i;
+
+        ipath_free_lkey(&to_idev(ibfmr->device)->lk_table, ibfmr->lkey);
+        i = fmr->mr.mapsz;
+        while (i)
+                kfree(fmr->mr.map[--i]);
+        kfree(fmr);
+        return 0;
+}
diff --git a/drivers/infiniband/hw/ipath/ipath_pe800.c b/drivers/infiniband/hw/ipath/ipath_pe800.c
new file mode 100644
index 000000000000..e693a7a82667
--- /dev/null
+++ b/drivers/infiniband/hw/ipath/ipath_pe800.c
@@ -0,0 +1,1247 @@
+/*
+ * Copyright (c) 2003, 2004, 2005, 2006 PathScale, Inc. All rights reserved.
+ *
+ * This software is available to you under a choice of one of two
+ * licenses.  You may choose to be licensed under the terms of the GNU
+ * General Public License (GPL) Version 2, available from the file
+ * COPYING in the main directory of this source tree, or the
+ * OpenIB.org BSD license below:
+ *
+ *     Redistribution and use in source and binary forms, with or
+ *     without modification, are permitted provided that the following
+ *     conditions are met:
+ *
+ *      - Redistributions of source code must retain the above
+ *        copyright notice, this list of conditions and the following
+ *        disclaimer.
+ *
+ *      - Redistributions in binary form must reproduce the above
+ *        copyright notice, this list of conditions and the following
+ *        disclaimer in the documentation and/or other materials
+ *        provided with the distribution.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+ * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+ * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+ * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
+ * BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
+ * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
+ * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+ * SOFTWARE.
+ */
+/*
+ * This file contains all of the code that is specific to the
+ * InfiniPath PE-800 chip.
+ */
+
+#include <linux/interrupt.h>
+#include <linux/pci.h>
+#include <linux/delay.h>
+
+
+#include "ipath_kernel.h"
+#include "ipath_registers.h"
+
+/*
+ * This file contains all the chip-specific register information and
+ * access functions for the PathScale PE800, the PCI-Express chip.
+ *
+ * This lists the InfiniPath PE800 registers, in the actual chip layout.
+ * This structure should never be directly accessed.
+ */
+struct _infinipath_do_not_use_kernel_regs {
+        unsigned long long Revision;
+        unsigned long long Control;
+        unsigned long long PageAlign;
+        unsigned long long PortCnt;
+        unsigned long long DebugPortSelect;
+        unsigned long long Reserved0;
+        unsigned long long SendRegBase;
+        unsigned long long UserRegBase;
+        unsigned long long CounterRegBase;
+        unsigned long long Scratch;
+        unsigned long long Reserved1;
+        unsigned long long Reserved2;
+        unsigned long long IntBlocked;
+        unsigned long long IntMask;
+        unsigned long long IntStatus;
+        unsigned long long IntClear;
+        unsigned long long ErrorMask;
+        unsigned long long ErrorStatus;
+        unsigned long long ErrorClear;
+        unsigned long long HwErrMask;
+        unsigned long long HwErrStatus;
+        unsigned long long HwErrClear;
+        unsigned long long HwDiagCtrl;
+        unsigned long long MDIO;
+        unsigned long long IBCStatus;
+        unsigned long long IBCCtrl;
+        unsigned long long ExtStatus;
+        unsigned long long ExtCtrl;
+        unsigned long long GPIOOut;
+        unsigned long long GPIOMask;
+        unsigned long long GPIOStatus;
+        unsigned long long GPIOClear;
+        unsigned long long RcvCtrl;
+        unsigned long long RcvBTHQP;
+        unsigned long long RcvHdrSize;
+        unsigned long long RcvHdrCnt;
+        unsigned long long RcvHdrEntSize;
+        unsigned long long RcvTIDBase;
+        unsigned long long RcvTIDCnt;
+        unsigned long long RcvEgrBase;
+        unsigned long long RcvEgrCnt;
+        unsigned long long RcvBufBase;
+        unsigned long long RcvBufSize;
+        unsigned long long RxIntMemBase;
+        unsigned long long RxIntMemSize;
+        unsigned long long RcvPartitionKey;
+        unsigned long long Reserved3;
+        unsigned long long RcvPktLEDCnt;
+        unsigned long long Reserved4[8];
+        unsigned long long SendCtrl;
+        unsigned long long SendPIOBufBase;
+        unsigned long long SendPIOSize;
+        unsigned long long SendPIOBufCnt;
+        unsigned long long SendPIOAvailAddr;
+        unsigned long long TxIntMemBase;
+        unsigned long long TxIntMemSize;
+        unsigned long long Reserved5;
+        unsigned long long PCIeRBufTestReg0;
+        unsigned long long PCIeRBufTestReg1;
+        unsigned long long Reserved51[6];
+        unsigned long long SendBufferError;
+        unsigned long long SendBufferErrorCONT1;
+        unsigned long long Reserved6SBE[6];
+        unsigned long long RcvHdrAddr0;
+        unsigned long long RcvHdrAddr1;
+        unsigned long long RcvHdrAddr2;
+        unsigned long long RcvHdrAddr3;
+        unsigned long long RcvHdrAddr4;
+        unsigned long long Reserved7RHA[11];
+        unsigned long long RcvHdrTailAddr0;
+        unsigned long long RcvHdrTailAddr1;
+        unsigned long long RcvHdrTailAddr2;
+        unsigned long long RcvHdrTailAddr3;
+        unsigned long long RcvHdrTailAddr4;
+        unsigned long long Reserved8RHTA[11];
+        unsigned long long Reserved9SW[8];
+        unsigned long long SerdesConfig0;
+        unsigned long long SerdesConfig1;
+        unsigned long long SerdesStatus;
+        unsigned long long XGXSConfig;
+        unsigned long long IBPLLCfg;
+        unsigned long long Reserved10SW2[3];
+        unsigned long long PCIEQ0SerdesConfig0;
+        unsigned long long PCIEQ0SerdesConfig1;
+        unsigned long long PCIEQ0SerdesStatus;
+        unsigned long long Reserved11;
+        unsigned long long PCIEQ1SerdesConfig0;
+        unsigned long long PCIEQ1SerdesConfig1;
+        unsigned long long PCIEQ1SerdesStatus;
+        unsigned long long Reserved12;
+};
+
+#define IPATH_KREG_OFFSET(field) (offsetof(struct \
+    _infinipath_do_not_use_kernel_regs, field) / sizeof(u64))
+#define IPATH_CREG_OFFSET(field) (offsetof( \
+    struct infinipath_counters, field) / sizeof(u64))
+
+static const struct ipath_kregs ipath_pe_kregs = {
+        .kr_control = IPATH_KREG_OFFSET(Control),
+        .kr_counterregbase = IPATH_KREG_OFFSET(CounterRegBase),
+        .kr_debugportselect = IPATH_KREG_OFFSET(DebugPortSelect),
+        .kr_errorclear = IPATH_KREG_OFFSET(ErrorClear),
+        .kr_errormask = IPATH_KREG_OFFSET(ErrorMask),
+        .kr_errorstatus = IPATH_KREG_OFFSET(ErrorStatus),
+        .kr_extctrl = IPATH_KREG_OFFSET(ExtCtrl),
+        .kr_extstatus = IPATH_KREG_OFFSET(ExtStatus),
+        .kr_gpio_clear = IPATH_KREG_OFFSET(GPIOClear),
+        .kr_gpio_mask = IPATH_KREG_OFFSET(GPIOMask),
+        .kr_gpio_out = IPATH_KREG_OFFSET(GPIOOut),
+        .kr_gpio_status = IPATH_KREG_OFFSET(GPIOStatus),
+        .kr_hwdiagctrl = IPATH_KREG_OFFSET(HwDiagCtrl),
+        .kr_hwerrclear = IPATH_KREG_OFFSET(HwErrClear),
+        .kr_hwerrmask = IPATH_KREG_OFFSET(HwErrMask),
+        .kr_hwerrstatus = IPATH_KREG_OFFSET(HwErrStatus),
+        .kr_ibcctrl = IPATH_KREG_OFFSET(IBCCtrl),
+        .kr_ibcstatus = IPATH_KREG_OFFSET(IBCStatus),
+        .kr_intblocked = IPATH_KREG_OFFSET(IntBlocked),
+        .kr_intclear = IPATH_KREG_OFFSET(IntClear),
+        .kr_intmask = IPATH_KREG_OFFSET(IntMask),
+        .kr_intstatus = IPATH_KREG_OFFSET(IntStatus),
+        .kr_mdio = IPATH_KREG_OFFSET(MDIO),
+        .kr_pagealign = IPATH_KREG_OFFSET(PageAlign),
+        .kr_partitionkey = IPATH_KREG_OFFSET(RcvPartitionKey),
+        .kr_portcnt = IPATH_KREG_OFFSET(PortCnt),
+        .kr_rcvbthqp = IPATH_KREG_OFFSET(RcvBTHQP),
+        .kr_rcvbufbase = IPATH_KREG_OFFSET(RcvBufBase),
+        .kr_rcvbufsize = IPATH_KREG_OFFSET(RcvBufSize),
+        .kr_rcvctrl = IPATH_KREG_OFFSET(RcvCtrl),
+        .kr_rcvegrbase = IPATH_KREG_OFFSET(RcvEgrBase),
+        .kr_rcvegrcnt = IPATH_KREG_OFFSET(RcvEgrCnt),
+        .kr_rcvhdrcnt = IPATH_KREG_OFFSET(RcvHdrCnt),
+        .kr_rcvhdrentsize = IPATH_KREG_OFFSET(RcvHdrEntSize),
+        .kr_rcvhdrsize = IPATH_KREG_OFFSET(RcvHdrSize),
+        .kr_rcvintmembase = IPATH_KREG_OFFSET(RxIntMemBase),
+        .kr_rcvintmemsize = IPATH_KREG_OFFSET(RxIntMemSize),
+        .kr_rcvtidbase = IPATH_KREG_OFFSET(RcvTIDBase),
+        .kr_rcvtidcnt = IPATH_KREG_OFFSET(RcvTIDCnt),
+        .kr_revision = IPATH_KREG_OFFSET(Revision),
+        .kr_scratch = IPATH_KREG_OFFSET(Scratch),
+        .kr_sendbuffererror = IPATH_KREG_OFFSET(SendBufferError),
+        .kr_sendctrl = IPATH_KREG_OFFSET(SendCtrl),
+        .kr_sendpioavailaddr = IPATH_KREG_OFFSET(SendPIOAvailAddr),
+        .kr_sendpiobufbase = IPATH_KREG_OFFSET(SendPIOBufBase),
+        .kr_sendpiobufcnt = IPATH_KREG_OFFSET(SendPIOBufCnt),
+        .kr_sendpiosize = IPATH_KREG_OFFSET(SendPIOSize),
+        .kr_sendregbase = IPATH_KREG_OFFSET(SendRegBase),
+        .kr_txintmembase = IPATH_KREG_OFFSET(TxIntMemBase),
+        .kr_txintmemsize = IPATH_KREG_OFFSET(TxIntMemSize),
+        .kr_userregbase = IPATH_KREG_OFFSET(UserRegBase),
+        .kr_serdesconfig0 = IPATH_KREG_OFFSET(SerdesConfig0),
+        .kr_serdesconfig1 = IPATH_KREG_OFFSET(SerdesConfig1),
+        .kr_serdesstatus = IPATH_KREG_OFFSET(SerdesStatus),
+        .kr_xgxsconfig = IPATH_KREG_OFFSET(XGXSConfig),
+        .kr_ibpllcfg = IPATH_KREG_OFFSET(IBPLLCfg),
+
+        /*
+         * These should not be used directly via ipath_read_kreg64(),
+         * use them with ipath_read_kreg64_port()
+         */
+        .kr_rcvhdraddr = IPATH_KREG_OFFSET(RcvHdrAddr0),
+        .kr_rcvhdrtailaddr = IPATH_KREG_OFFSET(RcvHdrTailAddr0),
+
+        /* This group is pe-800-specific; and used only in this file */
+        /* The rcvpktled register controls one of the debug port signals, so
+         * a packet activity LED can be connected to it. */
+        .kr_rcvpktledcnt = IPATH_KREG_OFFSET(RcvPktLEDCnt),
+        .kr_pcierbuftestreg0 = IPATH_KREG_OFFSET(PCIeRBufTestReg0),
+        .kr_pcierbuftestreg1 = IPATH_KREG_OFFSET(PCIeRBufTestReg1),
+        .kr_pcieq0serdesconfig0 = IPATH_KREG_OFFSET(PCIEQ0SerdesConfig0),
+        .kr_pcieq0serdesconfig1 = IPATH_KREG_OFFSET(PCIEQ0SerdesConfig1),
+        .kr_pcieq0serdesstatus = IPATH_KREG_OFFSET(PCIEQ0SerdesStatus),
+        .kr_pcieq1serdesconfig0 = IPATH_KREG_OFFSET(PCIEQ1SerdesConfig0),
+        .kr_pcieq1serdesconfig1 = IPATH_KREG_OFFSET(PCIEQ1SerdesConfig1),
+        .kr_pcieq1serdesstatus = IPATH_KREG_OFFSET(PCIEQ1SerdesStatus)
+};
+
+static const struct ipath_cregs ipath_pe_cregs = {
+        .cr_badformatcnt = IPATH_CREG_OFFSET(RxBadFormatCnt),
+        .cr_erricrccnt = IPATH_CREG_OFFSET(RxICRCErrCnt),
+        .cr_errlinkcnt = IPATH_CREG_OFFSET(RxLinkProblemCnt),
+        .cr_errlpcrccnt = IPATH_CREG_OFFSET(RxLPCRCErrCnt),
+        .cr_errpkey = IPATH_CREG_OFFSET(RxPKeyMismatchCnt),
+        .cr_errrcvflowctrlcnt = IPATH_CREG_OFFSET(RxFlowCtrlErrCnt),
+        .cr_err_rlencnt = IPATH_CREG_OFFSET(RxLenErrCnt),
+        .cr_errslencnt = IPATH_CREG_OFFSET(TxLenErrCnt),
+        .cr_errtidfull = IPATH_CREG_OFFSET(RxTIDFullErrCnt),
+        .cr_errtidvalid = IPATH_CREG_OFFSET(RxTIDValidErrCnt),
+        .cr_errvcrccnt = IPATH_CREG_OFFSET(RxVCRCErrCnt),
+        .cr_ibstatuschange = IPATH_CREG_OFFSET(IBStatusChangeCnt),
+        .cr_intcnt = IPATH_CREG_OFFSET(LBIntCnt),
+        .cr_invalidrlencnt = IPATH_CREG_OFFSET(RxMaxMinLenErrCnt),
+        .cr_invalidslencnt = IPATH_CREG_OFFSET(TxMaxMinLenErrCnt),
+        .cr_lbflowstallcnt = IPATH_CREG_OFFSET(LBFlowStallCnt),
+        .cr_pktrcvcnt = IPATH_CREG_OFFSET(RxDataPktCnt),
+        .cr_pktrcvflowctrlcnt = IPATH_CREG_OFFSET(RxFlowPktCnt),
+        .cr_pktsendcnt = IPATH_CREG_OFFSET(TxDataPktCnt),
+        .cr_pktsendflowcnt = IPATH_CREG_OFFSET(TxFlowPktCnt),
+        .cr_portovflcnt = IPATH_CREG_OFFSET(RxP0HdrEgrOvflCnt),
+        .cr_rcvebpcnt = IPATH_CREG_OFFSET(RxEBPCnt),
+        .cr_rcvovflcnt = IPATH_CREG_OFFSET(RxBufOvflCnt),
+        .cr_senddropped = IPATH_CREG_OFFSET(TxDroppedPktCnt),
+        .cr_sendstallcnt = IPATH_CREG_OFFSET(TxFlowStallCnt),
+        .cr_sendunderruncnt = IPATH_CREG_OFFSET(TxUnderrunCnt),
+        .cr_wordrcvcnt = IPATH_CREG_OFFSET(RxDwordCnt),
+        .cr_wordsendcnt = IPATH_CREG_OFFSET(TxDwordCnt),
+        .cr_unsupvlcnt = IPATH_CREG_OFFSET(TxUnsupVLErrCnt),
+        .cr_rxdroppktcnt = IPATH_CREG_OFFSET(RxDroppedPktCnt),
+        .cr_iblinkerrrecovcnt = IPATH_CREG_OFFSET(IBLinkErrRecoveryCnt),
+        .cr_iblinkdowncnt = IPATH_CREG_OFFSET(IBLinkDownedCnt),
+        .cr_ibsymbolerrcnt = IPATH_CREG_OFFSET(IBSymbolErrCnt)
+};
+
+/* kr_intstatus, kr_intclear, kr_intmask bits */
+#define INFINIPATH_I_RCVURG_MASK 0x1F
+#define INFINIPATH_I_RCVAVAIL_MASK 0x1F
+
+/* kr_hwerrclear, kr_hwerrmask, kr_hwerrstatus, bits */
+#define INFINIPATH_HWE_PCIEMEMPARITYERR_MASK  0x000000000000003fULL
+#define INFINIPATH_HWE_PCIEMEMPARITYERR_SHIFT 0
+#define INFINIPATH_HWE_PCIEPOISONEDTLP      0x0000000010000000ULL
+#define INFINIPATH_HWE_PCIECPLTIMEOUT       0x0000000020000000ULL
+#define INFINIPATH_HWE_PCIEBUSPARITYXTLH    0x0000000040000000ULL
+#define INFINIPATH_HWE_PCIEBUSPARITYXADM    0x0000000080000000ULL
+#define INFINIPATH_HWE_PCIEBUSPARITYRADM    0x0000000100000000ULL
+#define INFINIPATH_HWE_COREPLL_FBSLIP       0x0080000000000000ULL
+#define INFINIPATH_HWE_COREPLL_RFSLIP       0x0100000000000000ULL
+#define INFINIPATH_HWE_PCIE1PLLFAILED       0x0400000000000000ULL
+#define INFINIPATH_HWE_PCIE0PLLFAILED       0x0800000000000000ULL
+#define INFINIPATH_HWE_SERDESPLLFAILED      0x1000000000000000ULL
+
+/* kr_extstatus bits */
+#define INFINIPATH_EXTS_FREQSEL 0x2
+#define INFINIPATH_EXTS_SERDESSEL 0x4
+#define INFINIPATH_EXTS_MEMBIST_ENDTEST     0x0000000000004000
+#define INFINIPATH_EXTS_MEMBIST_FOUND       0x0000000000008000
+
+#define _IPATH_GPIO_SDA_NUM 1
+#define _IPATH_GPIO_SCL_NUM 0
+
+#define IPATH_GPIO_SDA (1ULL << \
+        (_IPATH_GPIO_SDA_NUM+INFINIPATH_EXTC_GPIOOE_SHIFT))
+#define IPATH_GPIO_SCL (1ULL << \
+        (_IPATH_GPIO_SCL_NUM+INFINIPATH_EXTC_GPIOOE_SHIFT))
+
+/**
+ * ipath_pe_handle_hwerrors - display hardware errors.
+ * @dd: the infinipath device
+ * @msg: the output buffer
+ * @msgl: the size of the output buffer
+ *
+ * Use same msg buffer as regular errors to avoid excessive stack
+ * use.  Most hardware errors are catastrophic, but for right now,
+ * we'll print them and continue.  We reuse the same message buffer as
+ * ipath_handle_errors() to avoid excessive stack usage.
+ */
+void ipath_pe_handle_hwerrors(struct ipath_devdata *dd, char *msg,
+        size_t msgl)
+{
+        ipath_err_t hwerrs;
+        u32 bits, ctrl;
+        int isfatal = 0;
+        char bitsmsg[64];
+
+        hwerrs = ipath_read_kreg64(dd, dd->ipath_kregs->kr_hwerrstatus);
+        if (!hwerrs) {
+                /*
+                 * better than printing cofusing messages
+                 * This seems to be related to clearing the crc error, or
+                 * the pll error during init.
+                 */
+                ipath_cdbg(VERBOSE, "Called but no hardware errors set\n");
+                return;
+        } else if (hwerrs == ~0ULL) {
+                ipath_dev_err(dd, "Read of hardware error status failed "
+                              "(all bits set); ignoring\n");
+                return;
+        }
+        ipath_stats.sps_hwerrs++;
+
+        /* Always clear the error status register, except MEMBISTFAIL,
+         * regardless of whether we continue or stop using the chip.
+         * We want that set so we know it failed, even across driver reload.
+         * We'll still ignore it in the hwerrmask.  We do this partly for
+         * diagnostics, but also for support */
+        ipath_write_kreg(dd, dd->ipath_kregs->kr_hwerrclear,
+                         hwerrs&~INFINIPATH_HWE_MEMBISTFAILED);
+
+        hwerrs &= dd->ipath_hwerrmask;
+
+        /*
+         * make sure we get this much out, unless told to be quiet,
+         * or it's occurred within the last 5 seconds
+         */
+        if ((hwerrs & ~dd->ipath_lasthwerror) ||
+            (ipath_debug & __IPATH_VERBDBG))
+                dev_info(&dd->pcidev->dev, "Hardware error: hwerr=0x%llx "
+                         "(cleared)\n", (unsigned long long) hwerrs);
+        dd->ipath_lasthwerror |= hwerrs;
+
+        if (hwerrs & ~infinipath_hwe_bitsextant)
+                ipath_dev_err(dd, "hwerror interrupt with unknown errors "
+                              "%llx set\n", (unsigned long long)
+                              (hwerrs & ~infinipath_hwe_bitsextant));
+
+        ctrl = ipath_read_kreg32(dd, dd->ipath_kregs->kr_control);
+        if (ctrl & INFINIPATH_C_FREEZEMODE) {
+                if (hwerrs) {
+                        /*
+                         * if any set that we aren't ignoring only make the
+                         * complaint once, in case it's stuck or recurring,
+                         * and we get here multiple times
+                         */
+                        if (dd->ipath_flags & IPATH_INITTED) {
+                                ipath_dev_err(dd, "Fatal Error (freeze "
+                                              "mode), no longer usable\n");
+                                isfatal = 1;
+                        }
+                        /*
+                         * Mark as having had an error for driver, and also
+                         * for /sys and status word mapped to user programs.
+                         * This marks unit as not usable, until reset
+                         */
+                        *dd->ipath_statusp &= ~IPATH_STATUS_IB_READY;
+                        *dd->ipath_statusp |= IPATH_STATUS_HWERROR;
+                        dd->ipath_flags &= ~IPATH_INITTED;
+                } else {
+                        ipath_dbg("Clearing freezemode on ignored hardware "
+                                  "error\n");
+                        ctrl &= ~INFINIPATH_C_FREEZEMODE;
+                        ipath_write_kreg(dd, dd->ipath_kregs->kr_control,
+                                         ctrl);
+                }
+        }
+
+        *msg = '\0';
+
+        if (hwerrs & INFINIPATH_HWE_MEMBISTFAILED) {
+                strlcat(msg, "[Memory BIST test failed, PE-800 unusable]",
+                        msgl);
+                /* ignore from now on, so disable until driver reloaded */
+                *dd->ipath_statusp |= IPATH_STATUS_HWERROR;
+                dd->ipath_hwerrmask &= ~INFINIPATH_HWE_MEMBISTFAILED;
+                ipath_write_kreg(dd, dd->ipath_kregs->kr_hwerrmask,
+                                 dd->ipath_hwerrmask);
+        }
+        if (hwerrs & (INFINIPATH_HWE_RXEMEMPARITYERR_MASK
+                      << INFINIPATH_HWE_RXEMEMPARITYERR_SHIFT)) {
+                bits = (u32) ((hwerrs >>
+                               INFINIPATH_HWE_RXEMEMPARITYERR_SHIFT) &
+                              INFINIPATH_HWE_RXEMEMPARITYERR_MASK);
+                snprintf(bitsmsg, sizeof bitsmsg, "[RXE Parity Errs %x] ",
+                         bits);
+                strlcat(msg, bitsmsg, msgl);
+        }
+        if (hwerrs & (INFINIPATH_HWE_TXEMEMPARITYERR_MASK
+                      << INFINIPATH_HWE_TXEMEMPARITYERR_SHIFT)) {
+                bits = (u32) ((hwerrs >>
+                               INFINIPATH_HWE_TXEMEMPARITYERR_SHIFT) &
+                              INFINIPATH_HWE_TXEMEMPARITYERR_MASK);
+                snprintf(bitsmsg, sizeof bitsmsg, "[TXE Parity Errs %x] ",
+                         bits);
+                strlcat(msg, bitsmsg, msgl);
+        }
+        if (hwerrs & (INFINIPATH_HWE_PCIEMEMPARITYERR_MASK
+                      << INFINIPATH_HWE_PCIEMEMPARITYERR_SHIFT)) {
+                bits = (u32) ((hwerrs >>
+                               INFINIPATH_HWE_PCIEMEMPARITYERR_SHIFT) &
+                              INFINIPATH_HWE_PCIEMEMPARITYERR_MASK);
+                snprintf(bitsmsg, sizeof bitsmsg,
+                         "[PCIe Mem Parity Errs %x] ", bits);
+                strlcat(msg, bitsmsg, msgl);
+        }
+        if (hwerrs & INFINIPATH_HWE_IBCBUSTOSPCPARITYERR)
+                strlcat(msg, "[IB2IPATH Parity]", msgl);
+        if (hwerrs & INFINIPATH_HWE_IBCBUSFRSPCPARITYERR)
+                strlcat(msg, "[IPATH2IB Parity]", msgl);
+
+#define _IPATH_PLL_FAIL (INFINIPATH_HWE_COREPLL_FBSLIP |        \
+                         INFINIPATH_HWE_COREPLL_RFSLIP )
+
+        if (hwerrs & _IPATH_PLL_FAIL) {
+                snprintf(bitsmsg, sizeof bitsmsg,
+                         "[PLL failed (%llx), PE-800 unusable]",
+                         (unsigned long long) hwerrs & _IPATH_PLL_FAIL);
+                strlcat(msg, bitsmsg, msgl);
+                /* ignore from now on, so disable until driver reloaded */
+                dd->ipath_hwerrmask &= ~(hwerrs & _IPATH_PLL_FAIL);
+                ipath_write_kreg(dd, dd->ipath_kregs->kr_hwerrmask,
+                                 dd->ipath_hwerrmask);
+        }
+
+        if (hwerrs & INFINIPATH_HWE_SERDESPLLFAILED) {
+                /*
+                 * If it occurs, it is left masked since the eternal
+                 * interface is unused
+                 */
+                dd->ipath_hwerrmask &= ~INFINIPATH_HWE_SERDESPLLFAILED;
+                ipath_write_kreg(dd, dd->ipath_kregs->kr_hwerrmask,
+                                 dd->ipath_hwerrmask);
+        }
+
+        if (hwerrs & INFINIPATH_HWE_PCIEPOISONEDTLP)
+                strlcat(msg, "[PCIe Poisoned TLP]", msgl);
+        if (hwerrs & INFINIPATH_HWE_PCIECPLTIMEOUT)
+                strlcat(msg, "[PCIe completion timeout]", msgl);
+
+        /*
+         * In practice, it's unlikely wthat we'll see PCIe PLL, or bus
+         * parity or memory parity error failures, because most likely we
+         * won't be able to talk to the core of the chip.  Nonetheless, we
+         * might see them, if they are in parts of the PCIe core that aren't
+         * essential.
+         */
+        if (hwerrs & INFINIPATH_HWE_PCIE1PLLFAILED)
+                strlcat(msg, "[PCIePLL1]", msgl);
+        if (hwerrs & INFINIPATH_HWE_PCIE0PLLFAILED)
+                strlcat(msg, "[PCIePLL0]", msgl);
+        if (hwerrs & INFINIPATH_HWE_PCIEBUSPARITYXTLH)
+                strlcat(msg, "[PCIe XTLH core parity]", msgl);
+        if (hwerrs & INFINIPATH_HWE_PCIEBUSPARITYXADM)
+                strlcat(msg, "[PCIe ADM TX core parity]", msgl);
+        if (hwerrs & INFINIPATH_HWE_PCIEBUSPARITYRADM)
+                strlcat(msg, "[PCIe ADM RX core parity]", msgl);
+
+        if (hwerrs & INFINIPATH_HWE_RXDSYNCMEMPARITYERR)
+                strlcat(msg, "[Rx Dsync]", msgl);
+        if (hwerrs & INFINIPATH_HWE_SERDESPLLFAILED)
+                strlcat(msg, "[SerDes PLL]", msgl);
+
+        ipath_dev_err(dd, "%s hardware error\n", msg);
+        if (isfatal && !ipath_diag_inuse && dd->ipath_freezemsg) {
+                /*
+                 * for /sys status file ; if no trailing } is copied, we'll
+                 * know it was truncated.
+                 */
+                snprintf(dd->ipath_freezemsg, dd->ipath_freezelen,
+                         "{%s}", msg);
+        }
+}
+
+/**
+ * ipath_pe_boardname - fill in the board name
+ * @dd: the infinipath device
+ * @name: the output buffer
+ * @namelen: the size of the output buffer
+ *
+ * info is based on the board revision register
+ */
+static int ipath_pe_boardname(struct ipath_devdata *dd, char *name,
+                              size_t namelen)
+{
+        char *n = NULL;
+        u8 boardrev = dd->ipath_boardrev;
+        int ret;
+
+        switch (boardrev) {
+        case 0:
+                n = "InfiniPath_Emulation";
+                break;
+        case 1:
+                n = "InfiniPath_PE-800-Bringup";
+                break;
+        case 2:
+                n = "InfiniPath_PE-880";
+                break;
+        case 3:
+                n = "InfiniPath_PE-850";
+                break;
+        case 4:
+                n = "InfiniPath_PE-860";
+                break;
+        default:
+                ipath_dev_err(dd,
+                              "Don't yet know about board with ID %u\n",
+                              boardrev);
+                snprintf(name, namelen, "Unknown_InfiniPath_PE-8xx_%u",
+                         boardrev);
+                break;
+        }
+        if (n)
+                snprintf(name, namelen, "%s", n);
+
+        if (dd->ipath_majrev != 4 || dd->ipath_minrev != 1) {
+                ipath_dev_err(dd, "Unsupported PE-800 revision %u.%u!\n",
+                              dd->ipath_majrev, dd->ipath_minrev);
+                ret = 1;
+        } else
+                ret = 0;
+
+        return ret;
+}
+
+/**
+ * ipath_pe_init_hwerrors - enable hardware errors
+ * @dd: the infinipath device
+ *
+ * now that we have finished initializing everything that might reasonably
+ * cause a hardware error, and cleared those errors bits as they occur,
+ * we can enable hardware errors in the mask (potentially enabling
+ * freeze mode), and enable hardware errors as errors (along with
+ * everything else) in errormask
+ */
+void ipath_pe_init_hwerrors(struct ipath_devdata *dd)
+{
+        ipath_err_t val;
+        u64 extsval;
+
+        extsval = ipath_read_kreg64(dd, dd->ipath_kregs->kr_extstatus);
+
+        if (!(extsval & INFINIPATH_EXTS_MEMBIST_ENDTEST))
+                ipath_dev_err(dd, "MemBIST did not complete!\n");
+
+        val = ~0ULL;    /* barring bugs, all hwerrors become interrupts, */
+
+        if (!dd->ipath_boardrev)        // no PLL for Emulator
+                val &= ~INFINIPATH_HWE_SERDESPLLFAILED;
+
+        /* workaround bug 9460 in internal interface bus parity checking */
+        val &= ~INFINIPATH_HWE_PCIEBUSPARITYRADM;
+
+        dd->ipath_hwerrmask = val;
+}
+
+/**
+ * ipath_pe_bringup_serdes - bring up the serdes
+ * @dd: the infinipath device
+ */
+int ipath_pe_bringup_serdes(struct ipath_devdata *dd)
+{
+        u64 val, tmp, config1;
+        int ret = 0, change = 0;
+
+        ipath_dbg("Trying to bringup serdes\n");
+
+        if (ipath_read_kreg64(dd, dd->ipath_kregs->kr_hwerrstatus) &
+            INFINIPATH_HWE_SERDESPLLFAILED) {
+                ipath_dbg("At start, serdes PLL failed bit set "
+                          "in hwerrstatus, clearing and continuing\n");
+                ipath_write_kreg(dd, dd->ipath_kregs->kr_hwerrclear,
+                                 INFINIPATH_HWE_SERDESPLLFAILED);
+        }
+
+        val = ipath_read_kreg64(dd, dd->ipath_kregs->kr_serdesconfig0);
+        config1 = ipath_read_kreg64(dd, dd->ipath_kregs->kr_serdesconfig1);
+
+        ipath_cdbg(VERBOSE, "SerDes status config0=%llx config1=%llx, "
+                   "xgxsconfig %llx\n", (unsigned long long) val,
+                   (unsigned long long) config1, (unsigned long long)
+                   ipath_read_kreg64(dd, dd->ipath_kregs->kr_xgxsconfig));
+
+        /*
+         * Force reset on, also set rxdetect enable.  Must do before reading
+         * serdesstatus at least for simulation, or some of the bits in
+         * serdes status will come back as undefined and cause simulation
+         * failures
+         */
+        val |= INFINIPATH_SERDC0_RESET_PLL | INFINIPATH_SERDC0_RXDETECT_EN
+                | INFINIPATH_SERDC0_L1PWR_DN;
+        ipath_write_kreg(dd, dd->ipath_kregs->kr_serdesconfig0, val);
+        /* be sure chip saw it */
+        tmp = ipath_read_kreg64(dd, dd->ipath_kregs->kr_scratch);
+        udelay(5);              /* need pll reset set at least for a bit */
+        /*
+         * after PLL is reset, set the per-lane Resets and TxIdle and
+         * clear the PLL reset and rxdetect (to get falling edge).
+         * Leave L1PWR bits set (permanently)
+         */
+        val &= ~(INFINIPATH_SERDC0_RXDETECT_EN | INFINIPATH_SERDC0_RESET_PLL
+                 | INFINIPATH_SERDC0_L1PWR_DN);
+        val |= INFINIPATH_SERDC0_RESET_MASK | INFINIPATH_SERDC0_TXIDLE;
+        ipath_cdbg(VERBOSE, "Clearing pll reset and setting lane resets "
+                   "and txidle (%llx)\n", (unsigned long long) val);
+        ipath_write_kreg(dd, dd->ipath_kregs->kr_serdesconfig0, val);
+        /* be sure chip saw it */
+        tmp = ipath_read_kreg64(dd, dd->ipath_kregs->kr_scratch);
+        /* need PLL reset clear for at least 11 usec before lane
+         * resets cleared; give it a few more to be sure */
+        udelay(15);
+        val &= ~(INFINIPATH_SERDC0_RESET_MASK | INFINIPATH_SERDC0_TXIDLE);
+
+        ipath_cdbg(VERBOSE, "Clearing lane resets and txidle "
+                   "(writing %llx)\n", (unsigned long long) val);
+        ipath_write_kreg(dd, dd->ipath_kregs->kr_serdesconfig0, val);
+        /* be sure chip saw it */
+        val = ipath_read_kreg64(dd, dd->ipath_kregs->kr_scratch);
+
+        val = ipath_read_kreg64(dd, dd->ipath_kregs->kr_xgxsconfig);
+        if (((val >> INFINIPATH_XGXS_MDIOADDR_SHIFT) &
+             INFINIPATH_XGXS_MDIOADDR_MASK) != 3) {
+                val &=
+                        ~(INFINIPATH_XGXS_MDIOADDR_MASK <<
+                          INFINIPATH_XGXS_MDIOADDR_SHIFT);
+                /* MDIO address 3 */
+                val |= 3ULL << INFINIPATH_XGXS_MDIOADDR_SHIFT;
+                change = 1;
+        }
+        if (val & INFINIPATH_XGXS_RESET) {
+                val &= ~INFINIPATH_XGXS_RESET;
+                change = 1;
+        }
+        if (change)
+                ipath_write_kreg(dd, dd->ipath_kregs->kr_xgxsconfig, val);
+
+        val = ipath_read_kreg64(dd, dd->ipath_kregs->kr_serdesconfig0);
+
+        /* clear current and de-emphasis bits */
+        config1 &= ~0x0ffffffff00ULL;
+        /* set current to 20ma */
+        config1 |= 0x00000000000ULL;
+        /* set de-emphasis to -5.68dB */
+        config1 |= 0x0cccc000000ULL;
+        ipath_write_kreg(dd, dd->ipath_kregs->kr_serdesconfig1, config1);
+
+        ipath_cdbg(VERBOSE, "done: SerDes status config0=%llx "
+                   "config1=%llx, sstatus=%llx xgxs=%llx\n",
+                   (unsigned long long) val, (unsigned long long) config1,
+                   (unsigned long long)
+                   ipath_read_kreg64(dd, dd->ipath_kregs->kr_serdesstatus),
+                   (unsigned long long)
+                   ipath_read_kreg64(dd, dd->ipath_kregs->kr_xgxsconfig));
+
+        if (!ipath_waitfor_mdio_cmdready(dd)) {
+                ipath_write_kreg(
+                        dd, dd->ipath_kregs->kr_mdio,
+                        ipath_mdio_req(IPATH_MDIO_CMD_READ, 31,
+                                       IPATH_MDIO_CTRL_XGXS_REG_8, 0));
+                if (ipath_waitfor_complete(dd, dd->ipath_kregs->kr_mdio,
+                                           IPATH_MDIO_DATAVALID, &val))
+                        ipath_dbg("Never got MDIO data for XGXS "
+                                  "status read\n");
+                else
+                        ipath_cdbg(VERBOSE, "MDIO Read reg8, "
+                                   "'bank' 31 %x\n", (u32) val);
+        } else
+                ipath_dbg("Never got MDIO cmdready for XGXS status read\n");
+
+        return ret;
+}
+
+/**
+ * ipath_pe_quiet_serdes - set serdes to txidle
+ * @dd: the infinipath device
+ * Called when driver is being unloaded
+ */
+void ipath_pe_quiet_serdes(struct ipath_devdata *dd)
+{
+        u64 val = ipath_read_kreg64(dd, dd->ipath_kregs->kr_serdesconfig0);
+
+        val |= INFINIPATH_SERDC0_TXIDLE;
+        ipath_dbg("Setting TxIdleEn on serdes (config0 = %llx)\n",
+                  (unsigned long long) val);
+        ipath_write_kreg(dd, dd->ipath_kregs->kr_serdesconfig0, val);
+}
+
+/* this is not yet needed on the PE800, so just return 0. */
+static int ipath_pe_intconfig(struct ipath_devdata *dd)
+{
+        return 0;
+}
+
+/**
+ * ipath_setup_pe_setextled - set the state of the two external LEDs
+ * @dd: the infinipath device
+ * @lst: the L state
+ * @ltst: the LT state
+
+ * These LEDs indicate the physical and logical state of IB link.
+ * For this chip (at least with recommended board pinouts), LED1
+ * is Yellow (logical state) and LED2 is Green (physical state),
+ *
+ * Note:  We try to match the Mellanox HCA LED behavior as best
+ * we can.  Green indicates physical link state is OK (something is
+ * plugged in, and we can train).
+ * Amber indicates the link is logically up (ACTIVE).
+ * Mellanox further blinks the amber LED to indicate data packet
+ * activity, but we have no hardware support for that, so it would
+ * require waking up every 10-20 msecs and checking the counters
+ * on the chip, and then turning the LED off if appropriate.  That's
+ * visible overhead, so not something we will do.
+ *
+ */
+static void ipath_setup_pe_setextled(struct ipath_devdata *dd, u64 lst,
+                                     u64 ltst)
+{
+        u64 extctl;
+
+        /* the diags use the LED to indicate diag info, so we leave
+         * the external LED alone when the diags are running */
+        if (ipath_diag_inuse)
+                return;
+
+        extctl = dd->ipath_extctrl & ~(INFINIPATH_EXTC_LED1PRIPORT_ON |
+                                       INFINIPATH_EXTC_LED2PRIPORT_ON);
+
+        if (ltst & INFINIPATH_IBCS_LT_STATE_LINKUP)
+                extctl |= INFINIPATH_EXTC_LED2PRIPORT_ON;
+        if (lst == INFINIPATH_IBCS_L_STATE_ACTIVE)
+                extctl |= INFINIPATH_EXTC_LED1PRIPORT_ON;
+        dd->ipath_extctrl = extctl;
+        ipath_write_kreg(dd, dd->ipath_kregs->kr_extctrl, extctl);
+}
+
+/**
+ * ipath_setup_pe_cleanup - clean up any per-chip chip-specific stuff
+ * @dd: the infinipath device
+ *
+ * This is called during driver unload.
+ * We do the pci_disable_msi here, not in generic code, because it
+ * isn't used for the HT-400. If we do end up needing pci_enable_msi
+ * at some point in the future for HT-400, we'll move the call back
+ * into the main init_one code.
+ */
+static void ipath_setup_pe_cleanup(struct ipath_devdata *dd)
+{
+        dd->ipath_msi_lo = 0;   /* just in case unload fails */
+        pci_disable_msi(dd->pcidev);
+}
+
+/**
+ * ipath_setup_pe_config - setup PCIe config related stuff
+ * @dd: the infinipath device
+ * @pdev: the PCI device
+ *
+ * The pci_enable_msi() call will fail on systems with MSI quirks
+ * such as those with AMD8131, even if the device of interest is not
+ * attached to that device, (in the 2.6.13 - 2.6.15 kernels, at least, fixed
+ * late in 2.6.16).
+ * All that can be done is to edit the kernel source to remove the quirk
+ * check until that is fixed.
+ * We do not need to call enable_msi() for our HyperTransport chip (HT-400),
+ * even those it uses MSI, and we want to avoid the quirk warning, so
+ * So we call enable_msi only for the PE-800.  If we do end up needing
+ * pci_enable_msi at some point in the future for HT-400, we'll move the
+ * call back into the main init_one code.
+ * We save the msi lo and hi values, so we can restore them after
+ * chip reset (the kernel PCI infrastructure doesn't yet handle that
+ * correctly).
+ */
+static int ipath_setup_pe_config(struct ipath_devdata *dd,
+                                 struct pci_dev *pdev)
+{
+        int pos, ret;
+
+        dd->ipath_msi_lo = 0;   /* used as a flag during reset processing */
+        ret = pci_enable_msi(dd->pcidev);
+        if (ret)
+                ipath_dev_err(dd, "pci_enable_msi failed: %d, "
+                              "interrupts may not work\n", ret);
+        /* continue even if it fails, we may still be OK... */
+
+        if ((pos = pci_find_capability(dd->pcidev, PCI_CAP_ID_MSI))) {
+                u16 control;
+                pci_read_config_dword(dd->pcidev, pos + PCI_MSI_ADDRESS_LO,
+                                      &dd->ipath_msi_lo);
+                pci_read_config_dword(dd->pcidev, pos + PCI_MSI_ADDRESS_HI,
+                                      &dd->ipath_msi_hi);
+                pci_read_config_word(dd->pcidev, pos + PCI_MSI_FLAGS,
+                                     &control);
+                /* now save the data (vector) info */
+                pci_read_config_word(dd->pcidev,
+                                     pos + ((control & PCI_MSI_FLAGS_64BIT)
+                                            ? 12 : 8),
+                                     &dd->ipath_msi_data);
+                ipath_cdbg(VERBOSE, "Read msi data 0x%x from config offset "
+                           "0x%x, control=0x%x\n", dd->ipath_msi_data,
+                           pos + ((control & PCI_MSI_FLAGS_64BIT) ? 12 : 8),
+                           control);
+                /* we save the cachelinesize also, although it doesn't
+                 * really matter */
+                pci_read_config_byte(dd->pcidev, PCI_CACHE_LINE_SIZE,
+                                     &dd->ipath_pci_cacheline);
+        } else
+                ipath_dev_err(dd, "Can't find MSI capability, "
+                              "can't save MSI settings for reset\n");
+        if ((pos = pci_find_capability(dd->pcidev, PCI_CAP_ID_EXP))) {
+                u16 linkstat;
+                pci_read_config_word(dd->pcidev, pos + PCI_EXP_LNKSTA,
+                                     &linkstat);
+                linkstat >>= 4;
+                linkstat &= 0x1f;
+                if (linkstat != 8)
+                        ipath_dev_err(dd, "PCIe width %u, "
+                                      "performance reduced\n", linkstat);
+        }
+        else
+                ipath_dev_err(dd, "Can't find PCI Express "
+                              "capability!\n");
+        return 0;
+}
+
+static void ipath_init_pe_variables(void)
+{
+        /*
+         * bits for selecting i2c direction and values,
+         * used for I2C serial flash
+         */
+        ipath_gpio_sda_num = _IPATH_GPIO_SDA_NUM;
+        ipath_gpio_scl_num = _IPATH_GPIO_SCL_NUM;
+        ipath_gpio_sda = IPATH_GPIO_SDA;
+        ipath_gpio_scl = IPATH_GPIO_SCL;
+
+        /* variables for sanity checking interrupt and errors */
+        infinipath_hwe_bitsextant =
+                (INFINIPATH_HWE_RXEMEMPARITYERR_MASK <<
+                 INFINIPATH_HWE_RXEMEMPARITYERR_SHIFT) |
+                (INFINIPATH_HWE_PCIEMEMPARITYERR_MASK <<
+                 INFINIPATH_HWE_PCIEMEMPARITYERR_SHIFT) |
+                INFINIPATH_HWE_PCIE1PLLFAILED |
+                INFINIPATH_HWE_PCIE0PLLFAILED |
+                INFINIPATH_HWE_PCIEPOISONEDTLP |
+                INFINIPATH_HWE_PCIECPLTIMEOUT |
+                INFINIPATH_HWE_PCIEBUSPARITYXTLH |
+                INFINIPATH_HWE_PCIEBUSPARITYXADM |
+                INFINIPATH_HWE_PCIEBUSPARITYRADM |
+                INFINIPATH_HWE_MEMBISTFAILED |
+                INFINIPATH_HWE_COREPLL_FBSLIP |
+                INFINIPATH_HWE_COREPLL_RFSLIP |
+                INFINIPATH_HWE_SERDESPLLFAILED |
+                INFINIPATH_HWE_IBCBUSTOSPCPARITYERR |
+                INFINIPATH_HWE_IBCBUSFRSPCPARITYERR;
+        infinipath_i_bitsextant =
+                (INFINIPATH_I_RCVURG_MASK << INFINIPATH_I_RCVURG_SHIFT) |
+                (INFINIPATH_I_RCVAVAIL_MASK <<
+                 INFINIPATH_I_RCVAVAIL_SHIFT) |
+                INFINIPATH_I_ERROR | INFINIPATH_I_SPIOSENT |
+                INFINIPATH_I_SPIOBUFAVAIL | INFINIPATH_I_GPIO;
+        infinipath_e_bitsextant =
+                INFINIPATH_E_RFORMATERR | INFINIPATH_E_RVCRC |
+                INFINIPATH_E_RICRC | INFINIPATH_E_RMINPKTLEN |
+                INFINIPATH_E_RMAXPKTLEN | INFINIPATH_E_RLONGPKTLEN |
+                INFINIPATH_E_RSHORTPKTLEN | INFINIPATH_E_RUNEXPCHAR |
+                INFINIPATH_E_RUNSUPVL | INFINIPATH_E_REBP |
+                INFINIPATH_E_RIBFLOW | INFINIPATH_E_RBADVERSION |
+                INFINIPATH_E_RRCVEGRFULL | INFINIPATH_E_RRCVHDRFULL |
+                INFINIPATH_E_RBADTID | INFINIPATH_E_RHDRLEN |
+                INFINIPATH_E_RHDR | INFINIPATH_E_RIBLOSTLINK |
+                INFINIPATH_E_SMINPKTLEN | INFINIPATH_E_SMAXPKTLEN |
+                INFINIPATH_E_SUNDERRUN | INFINIPATH_E_SPKTLEN |
+                INFINIPATH_E_SDROPPEDSMPPKT | INFINIPATH_E_SDROPPEDDATAPKT |
+                INFINIPATH_E_SPIOARMLAUNCH | INFINIPATH_E_SUNEXPERRPKTNUM |
+                INFINIPATH_E_SUNSUPVL | INFINIPATH_E_IBSTATUSCHANGED |
+                INFINIPATH_E_INVALIDADDR | INFINIPATH_E_RESET |
+                INFINIPATH_E_HARDWARE;
+
+        infinipath_i_rcvavail_mask = INFINIPATH_I_RCVAVAIL_MASK;
+        infinipath_i_rcvurg_mask = INFINIPATH_I_RCVURG_MASK;
+}
+
+/* setup the MSI stuff again after a reset.  I'd like to just call
+ * pci_enable_msi() and request_irq() again, but when I do that,
+ * the MSI enable bit doesn't get set in the command word, and
+ * we switch to to a different interrupt vector, which is confusing,
+ * so I instead just do it all inline.  Perhaps somehow can tie this
+ * into the PCIe hotplug support at some point
+ * Note, because I'm doing it all here, I don't call pci_disable_msi()
+ * or free_irq() at the start of ipath_setup_pe_reset().
+ */
+static int ipath_reinit_msi(struct ipath_devdata *dd)
+{
+        int pos;
+        u16 control;
+        int ret;
+
+        if (!dd->ipath_msi_lo) {
+                dev_info(&dd->pcidev->dev, "Can't restore MSI config, "
+                         "initial setup failed?\n");
+                ret = 0;
+                goto bail;
+        }
+
+        if (!(pos = pci_find_capability(dd->pcidev, PCI_CAP_ID_MSI))) {
+                ipath_dev_err(dd, "Can't find MSI capability, "
+                              "can't restore MSI settings\n");
+                ret = 0;
+                goto bail;
+        }
+        ipath_cdbg(VERBOSE, "Writing msi_lo 0x%x to config offset 0x%x\n",
+                   dd->ipath_msi_lo, pos + PCI_MSI_ADDRESS_LO);
+        pci_write_config_dword(dd->pcidev, pos + PCI_MSI_ADDRESS_LO,
+                               dd->ipath_msi_lo);
+        ipath_cdbg(VERBOSE, "Writing msi_lo 0x%x to config offset 0x%x\n",
+                   dd->ipath_msi_hi, pos + PCI_MSI_ADDRESS_HI);
+        pci_write_config_dword(dd->pcidev, pos + PCI_MSI_ADDRESS_HI,
+                               dd->ipath_msi_hi);
+        pci_read_config_word(dd->pcidev, pos + PCI_MSI_FLAGS, &control);
+        if (!(control & PCI_MSI_FLAGS_ENABLE)) {
+                ipath_cdbg(VERBOSE, "MSI control at off %x was %x, "
+                           "setting MSI enable (%x)\n", pos + PCI_MSI_FLAGS,
+                           control, control | PCI_MSI_FLAGS_ENABLE);
+                control |= PCI_MSI_FLAGS_ENABLE;
+                pci_write_config_word(dd->pcidev, pos + PCI_MSI_FLAGS,
+                                      control);
+        }
+        /* now rewrite the data (vector) info */
+        pci_write_config_word(dd->pcidev, pos +
+                              ((control & PCI_MSI_FLAGS_64BIT) ? 12 : 8),
+                              dd->ipath_msi_data);
+        /* we restore the cachelinesize also, although it doesn't really
+         * matter */
+        pci_write_config_byte(dd->pcidev, PCI_CACHE_LINE_SIZE,
+                              dd->ipath_pci_cacheline);
+        /* and now set the pci master bit again */
+        pci_set_master(dd->pcidev);
+        ret = 1;
+
+bail:
+        return ret;
+}
+
+/* This routine sleeps, so it can only be called from user context, not
+ * from interrupt context.  If we need interrupt context, we can split
+ * it into two routines.
+*/
+static int ipath_setup_pe_reset(struct ipath_devdata *dd)
+{
+        u64 val;
+        int i;
+        int ret;
+
+        /* Use ERROR so it shows up in logs, etc. */
+        ipath_dev_err(dd, "Resetting PE-800 unit %u\n",
+                      dd->ipath_unit);
+        val = dd->ipath_control | INFINIPATH_C_RESET;
+        ipath_write_kreg(dd, dd->ipath_kregs->kr_control, val);
+        mb();
+
+        for (i = 1; i <= 5; i++) {
+                int r;
+                /* allow MBIST, etc. to complete; longer on each retry.
+                 * We sometimes get machine checks from bus timeout if no
+                 * response, so for now, make it *really* long.
+                 */
+                msleep(1000 + (1 + i) * 2000);
+                if ((r =
+                     pci_write_config_dword(dd->pcidev, PCI_BASE_ADDRESS_0,
+                                            dd->ipath_pcibar0)))
+                        ipath_dev_err(dd, "rewrite of BAR0 failed: %d\n",
+                                      r);
+                if ((r =
+                     pci_write_config_dword(dd->pcidev, PCI_BASE_ADDRESS_1,
+                                            dd->ipath_pcibar1)))
+                        ipath_dev_err(dd, "rewrite of BAR1 failed: %d\n",
+                                      r);
+                /* now re-enable memory access */
+                if ((r = pci_enable_device(dd->pcidev)))
+                        ipath_dev_err(dd, "pci_enable_device failed after "
+                                      "reset: %d\n", r);
+                val = ipath_read_kreg64(dd, dd->ipath_kregs->kr_revision);
+                if (val == dd->ipath_revision) {
+                        ipath_cdbg(VERBOSE, "Got matching revision "
+                                   "register %llx on try %d\n",
+                                   (unsigned long long) val, i);
+                        ret = ipath_reinit_msi(dd);
+                        goto bail;
+                }
+                /* Probably getting -1 back */
+                ipath_dbg("Didn't get expected revision register, "
+                          "got %llx, try %d\n", (unsigned long long) val,
+                          i + 1);
+        }
+        ret = 0; /* failed */
+
+bail:
+        return ret;
+}
+
+/**
+ * ipath_pe_put_tid - write a TID in chip
+ * @dd: the infinipath device
+ * @tidptr: pointer to the expected TID (in chip) to udpate
+ * @tidtype: 0 for eager, 1 for expected
+ * @pa: physical address of in memory buffer; ipath_tidinvalid if freeing
+ *
+ * This exists as a separate routine to allow for special locking etc.
+ * It's used for both the full cleanup on exit, as well as the normal
+ * setup and teardown.
+ */
+static void ipath_pe_put_tid(struct ipath_devdata *dd, u64 __iomem *tidptr,
+                             u32 type, unsigned long pa)
+{
+        u32 __iomem *tidp32 = (u32 __iomem *)tidptr;
+        unsigned long flags = 0; /* keep gcc quiet */
+
+        if (pa != dd->ipath_tidinvalid) {
+                if (pa & ((1U << 11) - 1)) {
+                        dev_info(&dd->pcidev->dev, "BUG: physaddr %lx "
+                                 "not 4KB aligned!\n", pa);
+                        return;
+                }
+                pa >>= 11;
+                /* paranoia check */
+                if (pa & (7<<29))
+                        ipath_dev_err(dd,
+                                      "BUG: Physical page address 0x%lx "
+                                      "has bits set in 31-29\n", pa);
+
+                if (type == 0)
+                        pa |= dd->ipath_tidtemplate;
+                else /* for now, always full 4KB page */
+                        pa |= 2 << 29;
+        }
+
+        /* workaround chip bug 9437 by writing each TID twice
+         * and holding a spinlock around the writes, so they don't
+         * intermix with other TID (eager or expected) writes
+         * Unfortunately, this call can be done from interrupt level
+         * for the port 0 eager TIDs, so we have to use irqsave
+         */
+        spin_lock_irqsave(&dd->ipath_tid_lock, flags);
+        ipath_write_kreg(dd, dd->ipath_kregs->kr_scratch, 0xfeeddeaf);
+        if (dd->ipath_kregbase)
+                writel(pa, tidp32);
+        ipath_write_kreg(dd, dd->ipath_kregs->kr_scratch, 0xdeadbeef);
+        mmiowb();
+        spin_unlock_irqrestore(&dd->ipath_tid_lock, flags);
+}
+
+/**
+ * ipath_pe_clear_tid - clear all TID entries for a port, expected and eager
+ * @dd: the infinipath device
+ * @port: the port
+ *
+ * clear all TID entries for a port, expected and eager.
+ * Used from ipath_close().  On PE800, TIDs are only 32 bits,
+ * not 64, but they are still on 64 bit boundaries, so tidbase
+ * is declared as u64 * for the pointer math, even though we write 32 bits
+ */
+static void ipath_pe_clear_tids(struct ipath_devdata *dd, unsigned port)
+{
+        u64 __iomem *tidbase;
+        unsigned long tidinv;
+        int i;
+
+        if (!dd->ipath_kregbase)
+                return;
+
+        ipath_cdbg(VERBOSE, "Invalidate TIDs for port %u\n", port);
+
+        tidinv = dd->ipath_tidinvalid;
+        tidbase = (u64 __iomem *)
+                ((char __iomem *)(dd->ipath_kregbase) +
+                 dd->ipath_rcvtidbase +
+                 port * dd->ipath_rcvtidcnt * sizeof(*tidbase));
+
+        for (i = 0; i < dd->ipath_rcvtidcnt; i++)
+                ipath_pe_put_tid(dd, &tidbase[i], 0, tidinv);
+
+        tidbase = (u64 __iomem *)
+                ((char __iomem *)(dd->ipath_kregbase) +
+                 dd->ipath_rcvegrbase +
+                 port * dd->ipath_rcvegrcnt * sizeof(*tidbase));
+
+        for (i = 0; i < dd->ipath_rcvegrcnt; i++)
+                ipath_pe_put_tid(dd, &tidbase[i], 1, tidinv);
+}
+
+/**
+ * ipath_pe_tidtemplate - setup constants for TID updates
+ * @dd: the infinipath device
+ *
+ * We setup stuff that we use a lot, to avoid calculating each time
+ */
+static void ipath_pe_tidtemplate(struct ipath_devdata *dd)
+{
+        u32 egrsize = dd->ipath_rcvegrbufsize;
+
+        /* For now, we always allocate 4KB buffers (at init) so we can
+         * receive max size packets.  We may want a module parameter to
+         * specify 2KB or 4KB and/or make be per port instead of per device
+         * for those who want to reduce memory footprint.  Note that the
+         * ipath_rcvhdrentsize size must be large enough to hold the largest
+         * IB header (currently 96 bytes) that we expect to handle (plus of
+         * course the 2 dwords of RHF).
+         */
+        if (egrsize == 2048)
+                dd->ipath_tidtemplate = 1U << 29;
+        else if (egrsize == 4096)
+                dd->ipath_tidtemplate = 2U << 29;
+        else {
+                egrsize = 4096;
+                dev_info(&dd->pcidev->dev, "BUG: unsupported egrbufsize "
+                         "%u, using %u\n", dd->ipath_rcvegrbufsize,
+                         egrsize);
+                dd->ipath_tidtemplate = 2U << 29;
+        }
+        dd->ipath_tidinvalid = 0;
+}
+
+static int ipath_pe_early_init(struct ipath_devdata *dd)
+{
+        dd->ipath_flags |= IPATH_4BYTE_TID;
+
+        /*
+         * For openib, we need to be able to handle an IB header of 96 bytes
+         * or 24 dwords.  HT-400 has arbitrary sized receive buffers, so we
+         * made them the same size as the PIO buffers.  The PE-800 does not
+         * handle arbitrary size buffers, so we need the header large enough
+         * to handle largest IB header, but still have room for a 2KB MTU
+         * standard IB packet.
+         */
+        dd->ipath_rcvhdrentsize = 24;
+        dd->ipath_rcvhdrsize = IPATH_DFLT_RCVHDRSIZE;
+
+        /* For HT-400, we allocate a somewhat overly large eager buffer,
+         * such that we can guarantee that we can receive the largest packet
+         * that we can send out.  To truly support a 4KB MTU, we need to
+         * bump this to a larger value.  We'll do this when I get around to
+         * testing 4KB sends on the PE-800, which I have not yet done.
+         */
+        dd->ipath_rcvegrbufsize = 2048;
+        /*
+         * the min() check here is currently a nop, but it may not always
+         * be, depending on just how we do ipath_rcvegrbufsize
+         */
+        dd->ipath_ibmaxlen = min(dd->ipath_piosize2k,
+                                 dd->ipath_rcvegrbufsize +
+                                 (dd->ipath_rcvhdrentsize << 2));
+        dd->ipath_init_ibmaxlen = dd->ipath_ibmaxlen;
+
+        /*
+         * For PE-800, we can request a receive interrupt for 1 or
+         * more packets from current offset.  For now, we set this
+         * up for a single packet, to match the HT-400 behavior.
+         */
+        dd->ipath_rhdrhead_intr_off = 1ULL<<32;
+
+        return 0;
+}
+
+int __attribute__((weak)) ipath_unordered_wc(void)
+{
+        return 0;
+}
+
+/**
+ * ipath_init_pe_get_base_info - set chip-specific flags for user code
+ * @dd: the infinipath device
+ * @kbase: ipath_base_info pointer
+ *
+ * We set the PCIE flag because the lower bandwidth on PCIe vs
+ * HyperTransport can affect some user packet algorithims.
+ */
+static int ipath_pe_get_base_info(struct ipath_portdata *pd, void *kbase)
+{
+        struct ipath_base_info *kinfo = kbase;
+
+        if (ipath_unordered_wc()) {
+                kinfo->spi_runtime_flags |= IPATH_RUNTIME_FORCE_WC_ORDER;
+                ipath_cdbg(PROC, "Intel processor, forcing WC order\n");
+        }
+        else
+                ipath_cdbg(PROC, "Not Intel processor, WC ordered\n");
+
+        kinfo->spi_runtime_flags |= IPATH_RUNTIME_PCIE;
+
+        return 0;
+}
+
+/**
+ * ipath_init_pe800_funcs - set up the chip-specific function pointers
+ * @dd: the infinipath device
+ *
+ * This is global, and is called directly at init to set up the
+ * chip-specific function pointers for later use.
+ */
+void ipath_init_pe800_funcs(struct ipath_devdata *dd)
+{
+        dd->ipath_f_intrsetup = ipath_pe_intconfig;
+        dd->ipath_f_bus = ipath_setup_pe_config;
+        dd->ipath_f_reset = ipath_setup_pe_reset;
+        dd->ipath_f_get_boardname = ipath_pe_boardname;
+        dd->ipath_f_init_hwerrors = ipath_pe_init_hwerrors;
+        dd->ipath_f_early_init = ipath_pe_early_init;
+        dd->ipath_f_handle_hwerrors = ipath_pe_handle_hwerrors;
+        dd->ipath_f_quiet_serdes = ipath_pe_quiet_serdes;
+        dd->ipath_f_bringup_serdes = ipath_pe_bringup_serdes;
+        dd->ipath_f_clear_tids = ipath_pe_clear_tids;
+        dd->ipath_f_put_tid = ipath_pe_put_tid;
+        dd->ipath_f_cleanup = ipath_setup_pe_cleanup;
+        dd->ipath_f_setextled = ipath_setup_pe_setextled;
+        dd->ipath_f_get_base_info = ipath_pe_get_base_info;
+
+        /* initialize chip-specific variables */
+        dd->ipath_f_tidtemplate = ipath_pe_tidtemplate;
+
+        /*
+         * setup the register offsets, since they are different for each
+         * chip
+         */
+        dd->ipath_kregs = &ipath_pe_kregs;
+        dd->ipath_cregs = &ipath_pe_cregs;
+
+        ipath_init_pe_variables();
+}
+
diff --git a/drivers/infiniband/hw/ipath/ipath_qp.c b/drivers/infiniband/hw/ipath/ipath_qp.c
new file mode 100644
index 000000000000..6058d70d7577
--- /dev/null
+++ b/drivers/infiniband/hw/ipath/ipath_qp.c
@@ -0,0 +1,913 @@
+/*
+ * Copyright (c) 2005, 2006 PathScale, Inc. All rights reserved.
+ *
+ * This software is available to you under a choice of one of two
+ * licenses.  You may choose to be licensed under the terms of the GNU
+ * General Public License (GPL) Version 2, available from the file
+ * COPYING in the main directory of this source tree, or the
+ * OpenIB.org BSD license below:
+ *
+ *     Redistribution and use in source and binary forms, with or
+ *     without modification, are permitted provided that the following
+ *     conditions are met:
+ *
+ *      - Redistributions of source code must retain the above
+ *        copyright notice, this list of conditions and the following
+ *        disclaimer.
+ *
+ *      - Redistributions in binary form must reproduce the above
+ *        copyright notice, this list of conditions and the following
+ *        disclaimer in the documentation and/or other materials
+ *        provided with the distribution.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+ * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+ * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+ * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
+ * BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
+ * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
+ * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+ * SOFTWARE.
+ */
+
+#include <linux/err.h>
+#include <linux/vmalloc.h>
+
+#include "ipath_verbs.h"
+#include "ips_common.h"
+
+#define BITS_PER_PAGE           (PAGE_SIZE*BITS_PER_BYTE)
+#define BITS_PER_PAGE_MASK      (BITS_PER_PAGE-1)
+#define mk_qpn(qpt, map, off)   (((map) - (qpt)->map) * BITS_PER_PAGE + \
+                                 (off))
+#define find_next_offset(map, off) find_next_zero_bit((map)->page, \
+                                                      BITS_PER_PAGE, off)
+
+#define TRANS_INVALID   0
+#define TRANS_ANY2RST   1
+#define TRANS_RST2INIT  2
+#define TRANS_INIT2INIT 3
+#define TRANS_INIT2RTR  4
+#define TRANS_RTR2RTS   5
+#define TRANS_RTS2RTS   6
+#define TRANS_SQERR2RTS 7
+#define TRANS_ANY2ERR   8
+#define TRANS_RTS2SQD   9  /* XXX Wait for expected ACKs & signal event */
+#define TRANS_SQD2SQD   10 /* error if not drained & parameter change */
+#define TRANS_SQD2RTS   11 /* error if not drained */
+
+/*
+ * Convert the AETH credit code into the number of credits.
+ */
+static u32 credit_table[31] = {
+        0,                      /* 0 */
+        1,                      /* 1 */
+        2,                      /* 2 */
+        3,                      /* 3 */
+        4,                      /* 4 */
+        6,                      /* 5 */
+        8,                      /* 6 */
+        12,                     /* 7 */
+        16,                     /* 8 */
+        24,                     /* 9 */
+        32,                     /* A */
+        48,                     /* B */
+        64,                     /* C */
+        96,                     /* D */
+        128,                    /* E */
+        192,                    /* F */
+        256,                    /* 10 */
+        384,                    /* 11 */
+        512,                    /* 12 */
+        768,                    /* 13 */
+        1024,                   /* 14 */
+        1536,                   /* 15 */
+        2048,                   /* 16 */
+        3072,                   /* 17 */
+        4096,                   /* 18 */
+        6144,                   /* 19 */
+        8192,                   /* 1A */
+        12288,                  /* 1B */
+        16384,                  /* 1C */
+        24576,                  /* 1D */
+        32768                   /* 1E */
+};
+
+static u32 alloc_qpn(struct ipath_qp_table *qpt)
+{
+        u32 i, offset, max_scan, qpn;
+        struct qpn_map *map;
+        u32 ret;
+
+        qpn = qpt->last + 1;
+        if (qpn >= QPN_MAX)
+                qpn = 2;
+        offset = qpn & BITS_PER_PAGE_MASK;
+        map = &qpt->map[qpn / BITS_PER_PAGE];
+        max_scan = qpt->nmaps - !offset;
+        for (i = 0;;) {
+                if (unlikely(!map->page)) {
+                        unsigned long page = get_zeroed_page(GFP_KERNEL);
+                        unsigned long flags;
+
+                        /*
+                         * Free the page if someone raced with us
+                         * installing it:
+                         */
+                        spin_lock_irqsave(&qpt->lock, flags);
+                        if (map->page)
+                                free_page(page);
+                        else
+                                map->page = (void *)page;
+                        spin_unlock_irqrestore(&qpt->lock, flags);
+                        if (unlikely(!map->page))
+                                break;
+                }
+                if (likely(atomic_read(&map->n_free))) {
+                        do {
+                                if (!test_and_set_bit(offset, map->page)) {
+                                        atomic_dec(&map->n_free);
+                                        qpt->last = qpn;
+                                        ret = qpn;
+                                        goto bail;
+                                }
+                                offset = find_next_offset(map, offset);
+                                qpn = mk_qpn(qpt, map, offset);
+                                /*
+                                 * This test differs from alloc_pidmap().
+                                 * If find_next_offset() does find a zero
+                                 * bit, we don't need to check for QPN
+                                 * wrapping around past our starting QPN.
+                                 * We just need to be sure we don't loop
+                                 * forever.
+                                 */
+                        } while (offset < BITS_PER_PAGE && qpn < QPN_MAX);
+                }
+                /*
+                 * In order to keep the number of pages allocated to a
+                 * minimum, we scan the all existing pages before increasing
+                 * the size of the bitmap table.
+                 */
+                if (++i > max_scan) {
+                        if (qpt->nmaps == QPNMAP_ENTRIES)
+                                break;
+                        map = &qpt->map[qpt->nmaps++];
+                        offset = 0;
+                } else if (map < &qpt->map[qpt->nmaps]) {
+                        ++map;
+                        offset = 0;
+                } else {
+                        map = &qpt->map[0];
+                        offset = 2;
+                }
+                qpn = mk_qpn(qpt, map, offset);
+        }
+
+        ret = 0;
+
+bail:
+        return ret;
+}
+
+static void free_qpn(struct ipath_qp_table *qpt, u32 qpn)
+{
+        struct qpn_map *map;
+
+        map = qpt->map + qpn / BITS_PER_PAGE;
+        if (map->page)
+                clear_bit(qpn & BITS_PER_PAGE_MASK, map->page);
+        atomic_inc(&map->n_free);
+}
+
+/**
+ * ipath_alloc_qpn - allocate a QP number
+ * @qpt: the QP table
+ * @qp: the QP
+ * @type: the QP type (IB_QPT_SMI and IB_QPT_GSI are special)
+ *
+ * Allocate the next available QPN and put the QP into the hash table.
+ * The hash table holds a reference to the QP.
+ */
+int ipath_alloc_qpn(struct ipath_qp_table *qpt, struct ipath_qp *qp,
+                    enum ib_qp_type type)
+{
+        unsigned long flags;
+        u32 qpn;
+        int ret;
+
+        if (type == IB_QPT_SMI)
+                qpn = 0;
+        else if (type == IB_QPT_GSI)
+                qpn = 1;
+        else {
+                /* Allocate the next available QPN */
+                qpn = alloc_qpn(qpt);
+                if (qpn == 0) {
+                        ret = -ENOMEM;
+                        goto bail;
+                }
+        }
+        qp->ibqp.qp_num = qpn;
+
+        /* Add the QP to the hash table. */
+        spin_lock_irqsave(&qpt->lock, flags);
+
+        qpn %= qpt->max;
+        qp->next = qpt->table[qpn];
+        qpt->table[qpn] = qp;
+        atomic_inc(&qp->refcount);
+
+        spin_unlock_irqrestore(&qpt->lock, flags);
+        ret = 0;
+
+bail:
+        return ret;
+}
+
+/**
+ * ipath_free_qp - remove a QP from the QP table
+ * @qpt: the QP table
+ * @qp: the QP to remove
+ *
+ * Remove the QP from the table so it can't be found asynchronously by
+ * the receive interrupt routine.
+ */
+void ipath_free_qp(struct ipath_qp_table *qpt, struct ipath_qp *qp)
+{
+        struct ipath_qp *q, **qpp;
+        unsigned long flags;
+        int fnd = 0;
+
+        spin_lock_irqsave(&qpt->lock, flags);
+
+        /* Remove QP from the hash table. */
+        qpp = &qpt->table[qp->ibqp.qp_num % qpt->max];
+        for (; (q = *qpp) != NULL; qpp = &q->next) {
+                if (q == qp) {
+                        *qpp = qp->next;
+                        qp->next = NULL;
+                        atomic_dec(&qp->refcount);
+                        fnd = 1;
+                        break;
+                }
+        }
+
+        spin_unlock_irqrestore(&qpt->lock, flags);
+
+        if (!fnd)
+                return;
+
+        /* If QPN is not reserved, mark QPN free in the bitmap. */
+        if (qp->ibqp.qp_num > 1)
+                free_qpn(qpt, qp->ibqp.qp_num);
+
+        wait_event(qp->wait, !atomic_read(&qp->refcount));
+}
+
+/**
+ * ipath_free_all_qps - remove all QPs from the table
+ * @qpt: the QP table to empty
+ */
+void ipath_free_all_qps(struct ipath_qp_table *qpt)
+{
+        unsigned long flags;
+        struct ipath_qp *qp, *nqp;
+        u32 n;
+
+        for (n = 0; n < qpt->max; n++) {
+                spin_lock_irqsave(&qpt->lock, flags);
+                qp = qpt->table[n];
+                qpt->table[n] = NULL;
+                spin_unlock_irqrestore(&qpt->lock, flags);
+
+                while (qp) {
+                        nqp = qp->next;
+                        if (qp->ibqp.qp_num > 1)
+                                free_qpn(qpt, qp->ibqp.qp_num);
+                        if (!atomic_dec_and_test(&qp->refcount) ||
+                            !ipath_destroy_qp(&qp->ibqp))
+                                _VERBS_INFO("QP memory leak!\n");
+                        qp = nqp;
+                }
+        }
+
+        for (n = 0; n < ARRAY_SIZE(qpt->map); n++) {
+                if (qpt->map[n].page)
+                        free_page((unsigned long)qpt->map[n].page);
+        }
+}
+
+/**
+ * ipath_lookup_qpn - return the QP with the given QPN
+ * @qpt: the QP table
+ * @qpn: the QP number to look up
+ *
+ * The caller is responsible for decrementing the QP reference count
+ * when done.
+ */
+struct ipath_qp *ipath_lookup_qpn(struct ipath_qp_table *qpt, u32 qpn)
+{
+        unsigned long flags;
+        struct ipath_qp *qp;
+
+        spin_lock_irqsave(&qpt->lock, flags);
+
+        for (qp = qpt->table[qpn % qpt->max]; qp; qp = qp->next) {
+                if (qp->ibqp.qp_num == qpn) {
+                        atomic_inc(&qp->refcount);
+                        break;
+                }
+        }
+
+        spin_unlock_irqrestore(&qpt->lock, flags);
+        return qp;
+}
+
+/**
+ * ipath_reset_qp - initialize the QP state to the reset state
+ * @qp: the QP to reset
+ */
+static void ipath_reset_qp(struct ipath_qp *qp)
+{
+        qp->remote_qpn = 0;
+        qp->qkey = 0;
+        qp->qp_access_flags = 0;
+        qp->s_hdrwords = 0;
+        qp->s_psn = 0;
+        qp->r_psn = 0;
+        atomic_set(&qp->msn, 0);
+        if (qp->ibqp.qp_type == IB_QPT_RC) {
+                qp->s_state = IB_OPCODE_RC_SEND_LAST;
+                qp->r_state = IB_OPCODE_RC_SEND_LAST;
+        } else {
+                qp->s_state = IB_OPCODE_UC_SEND_LAST;
+                qp->r_state = IB_OPCODE_UC_SEND_LAST;
+        }
+        qp->s_ack_state = IB_OPCODE_RC_ACKNOWLEDGE;
+        qp->s_nak_state = 0;
+        qp->s_rnr_timeout = 0;
+        qp->s_head = 0;
+        qp->s_tail = 0;
+        qp->s_cur = 0;
+        qp->s_last = 0;
+        qp->s_ssn = 1;
+        qp->s_lsn = 0;
+        qp->r_rq.head = 0;
+        qp->r_rq.tail = 0;
+        qp->r_reuse_sge = 0;
+}
+
+/**
+ * ipath_modify_qp - modify the attributes of a queue pair
+ * @ibqp: the queue pair who's attributes we're modifying
+ * @attr: the new attributes
+ * @attr_mask: the mask of attributes to modify
+ *
+ * Returns 0 on success, otherwise returns an errno.
+ */
+int ipath_modify_qp(struct ib_qp *ibqp, struct ib_qp_attr *attr,
+                    int attr_mask)
+{
+        struct ipath_qp *qp = to_iqp(ibqp);
+        enum ib_qp_state cur_state, new_state;
+        unsigned long flags;
+        int ret;
+
+        spin_lock_irqsave(&qp->r_rq.lock, flags);
+        spin_lock(&qp->s_lock);
+
+        cur_state = attr_mask & IB_QP_CUR_STATE ?
+                attr->cur_qp_state : qp->state;
+        new_state = attr_mask & IB_QP_STATE ? attr->qp_state : cur_state;
+
+        if (!ib_modify_qp_is_ok(cur_state, new_state, ibqp->qp_type,
+                                attr_mask))
+                goto inval;
+
+        switch (new_state) {
+        case IB_QPS_RESET:
+                ipath_reset_qp(qp);
+                break;
+
+        case IB_QPS_ERR:
+                ipath_error_qp(qp);
+                break;
+
+        default:
+                break;
+
+        }
+
+        if (attr_mask & IB_QP_PKEY_INDEX) {
+                struct ipath_ibdev *dev = to_idev(ibqp->device);
+
+                if (attr->pkey_index >= ipath_layer_get_npkeys(dev->dd))
+                        goto inval;
+                qp->s_pkey_index = attr->pkey_index;
+        }
+
+        if (attr_mask & IB_QP_DEST_QPN)
+                qp->remote_qpn = attr->dest_qp_num;
+
+        if (attr_mask & IB_QP_SQ_PSN) {
+                qp->s_next_psn = attr->sq_psn;
+                qp->s_last_psn = qp->s_next_psn - 1;
+        }
+
+        if (attr_mask & IB_QP_RQ_PSN)
+                qp->r_psn = attr->rq_psn;
+
+        if (attr_mask & IB_QP_ACCESS_FLAGS)
+                qp->qp_access_flags = attr->qp_access_flags;
+
+        if (attr_mask & IB_QP_AV) {
+                if (attr->ah_attr.dlid == 0 ||
+                    attr->ah_attr.dlid >= IPS_MULTICAST_LID_BASE)
+                        goto inval;
+                qp->remote_ah_attr = attr->ah_attr;
+        }
+
+        if (attr_mask & IB_QP_PATH_MTU)
+                qp->path_mtu = attr->path_mtu;
+
+        if (attr_mask & IB_QP_RETRY_CNT)
+                qp->s_retry = qp->s_retry_cnt = attr->retry_cnt;
+
+        if (attr_mask & IB_QP_RNR_RETRY) {
+                qp->s_rnr_retry = attr->rnr_retry;
+                if (qp->s_rnr_retry > 7)
+                        qp->s_rnr_retry = 7;
+                qp->s_rnr_retry_cnt = qp->s_rnr_retry;
+        }
+
+        if (attr_mask & IB_QP_MIN_RNR_TIMER) {
+                if (attr->min_rnr_timer > 31)
+                        goto inval;
+                qp->s_min_rnr_timer = attr->min_rnr_timer;
+        }
+
+        if (attr_mask & IB_QP_QKEY)
+                qp->qkey = attr->qkey;
+
+        if (attr_mask & IB_QP_PKEY_INDEX)
+                qp->s_pkey_index = attr->pkey_index;
+
+        qp->state = new_state;
+        spin_unlock(&qp->s_lock);
+        spin_unlock_irqrestore(&qp->r_rq.lock, flags);
+
+        /*
+         * If QP1 changed to the RTS state, try to move to the link to INIT
+         * even if it was ACTIVE so the SM will reinitialize the SMA's
+         * state.
+         */
+        if (qp->ibqp.qp_num == 1 && new_state == IB_QPS_RTS) {
+                struct ipath_ibdev *dev = to_idev(ibqp->device);
+
+                ipath_layer_set_linkstate(dev->dd, IPATH_IB_LINKDOWN);
+        }
+        ret = 0;
+        goto bail;
+
+inval:
+        spin_unlock(&qp->s_lock);
+        spin_unlock_irqrestore(&qp->r_rq.lock, flags);
+        ret = -EINVAL;
+
+bail:
+        return ret;
+}
+
+int ipath_query_qp(struct ib_qp *ibqp, struct ib_qp_attr *attr,
+                   int attr_mask, struct ib_qp_init_attr *init_attr)
+{
+        struct ipath_qp *qp = to_iqp(ibqp);
+
+        attr->qp_state = qp->state;
+        attr->cur_qp_state = attr->qp_state;
+        attr->path_mtu = qp->path_mtu;
+        attr->path_mig_state = 0;
+        attr->qkey = qp->qkey;
+        attr->rq_psn = qp->r_psn;
+        attr->sq_psn = qp->s_next_psn;
+        attr->dest_qp_num = qp->remote_qpn;
+        attr->qp_access_flags = qp->qp_access_flags;
+        attr->cap.max_send_wr = qp->s_size - 1;
+        attr->cap.max_recv_wr = qp->r_rq.size - 1;
+        attr->cap.max_send_sge = qp->s_max_sge;
+        attr->cap.max_recv_sge = qp->r_rq.max_sge;
+        attr->cap.max_inline_data = 0;
+        attr->ah_attr = qp->remote_ah_attr;
+        memset(&attr->alt_ah_attr, 0, sizeof(attr->alt_ah_attr));
+        attr->pkey_index = qp->s_pkey_index;
+        attr->alt_pkey_index = 0;
+        attr->en_sqd_async_notify = 0;
+        attr->sq_draining = 0;
+        attr->max_rd_atomic = 1;
+        attr->max_dest_rd_atomic = 1;
+        attr->min_rnr_timer = qp->s_min_rnr_timer;
+        attr->port_num = 1;
+        attr->timeout = 0;
+        attr->retry_cnt = qp->s_retry_cnt;
+        attr->rnr_retry = qp->s_rnr_retry;
+        attr->alt_port_num = 0;
+        attr->alt_timeout = 0;
+
+        init_attr->event_handler = qp->ibqp.event_handler;
+        init_attr->qp_context = qp->ibqp.qp_context;
+        init_attr->send_cq = qp->ibqp.send_cq;
+        init_attr->recv_cq = qp->ibqp.recv_cq;
+        init_attr->srq = qp->ibqp.srq;
+        init_attr->cap = attr->cap;
+        init_attr->sq_sig_type =
+                (qp->s_flags & (1 << IPATH_S_SIGNAL_REQ_WR))
+                ? IB_SIGNAL_REQ_WR : 0;
+        init_attr->qp_type = qp->ibqp.qp_type;
+        init_attr->port_num = 1;
+        return 0;
+}
+
+/**
+ * ipath_compute_aeth - compute the AETH (syndrome + MSN)
+ * @qp: the queue pair to compute the AETH for
+ *
+ * Returns the AETH.
+ *
+ * The QP s_lock should be held.
+ */
+__be32 ipath_compute_aeth(struct ipath_qp *qp)
+{
+        u32 aeth = atomic_read(&qp->msn) & IPS_MSN_MASK;
+
+        if (qp->s_nak_state) {
+                aeth |= qp->s_nak_state << IPS_AETH_CREDIT_SHIFT;
+        } else if (qp->ibqp.srq) {
+                /*
+                 * Shared receive queues don't generate credits.
+                 * Set the credit field to the invalid value.
+                 */
+                aeth |= IPS_AETH_CREDIT_INVAL << IPS_AETH_CREDIT_SHIFT;
+        } else {
+                u32 min, max, x;
+                u32 credits;
+
+                /*
+                 * Compute the number of credits available (RWQEs).
+                 * XXX Not holding the r_rq.lock here so there is a small
+                 * chance that the pair of reads are not atomic.
+                 */
+                credits = qp->r_rq.head - qp->r_rq.tail;
+                if ((int)credits < 0)
+                        credits += qp->r_rq.size;
+                /*
+                 * Binary search the credit table to find the code to
+                 * use.
+                 */
+                min = 0;
+                max = 31;
+                for (;;) {
+                        x = (min + max) / 2;
+                        if (credit_table[x] == credits)
+                                break;
+                        if (credit_table[x] > credits)
+                                max = x;
+                        else if (min == x)
+                                break;
+                        else
+                                min = x;
+                }
+                aeth |= x << IPS_AETH_CREDIT_SHIFT;
+        }
+        return cpu_to_be32(aeth);
+}
+
+/**
+ * ipath_create_qp - create a queue pair for a device
+ * @ibpd: the protection domain who's device we create the queue pair for
+ * @init_attr: the attributes of the queue pair
+ * @udata: unused by InfiniPath
+ *
+ * Returns the queue pair on success, otherwise returns an errno.
+ *
+ * Called by the ib_create_qp() core verbs function.
+ */
+struct ib_qp *ipath_create_qp(struct ib_pd *ibpd,
+                              struct ib_qp_init_attr *init_attr,
+                              struct ib_udata *udata)
+{
+        struct ipath_qp *qp;
+        int err;
+        struct ipath_swqe *swq = NULL;
+        struct ipath_ibdev *dev;
+        size_t sz;
+        struct ib_qp *ret;
+
+        if (init_attr->cap.max_send_sge > 255 ||
+            init_attr->cap.max_recv_sge > 255) {
+                ret = ERR_PTR(-ENOMEM);
+                goto bail;
+        }
+
+        switch (init_attr->qp_type) {
+        case IB_QPT_UC:
+        case IB_QPT_RC:
+                sz = sizeof(struct ipath_sge) *
+                        init_attr->cap.max_send_sge +
+                        sizeof(struct ipath_swqe);
+                swq = vmalloc((init_attr->cap.max_send_wr + 1) * sz);
+                if (swq == NULL) {
+                        ret = ERR_PTR(-ENOMEM);
+                        goto bail;
+                }
+                /* FALLTHROUGH */
+        case IB_QPT_UD:
+        case IB_QPT_SMI:
+        case IB_QPT_GSI:
+                qp = kmalloc(sizeof(*qp), GFP_KERNEL);
+                if (!qp) {
+                        ret = ERR_PTR(-ENOMEM);
+                        goto bail;
+                }
+                qp->r_rq.size = init_attr->cap.max_recv_wr + 1;
+                sz = sizeof(struct ipath_sge) *
+                        init_attr->cap.max_recv_sge +
+                        sizeof(struct ipath_rwqe);
+                qp->r_rq.wq = vmalloc(qp->r_rq.size * sz);
+                if (!qp->r_rq.wq) {
+                        kfree(qp);
+                        ret = ERR_PTR(-ENOMEM);
+                        goto bail;
+                }
+
+                /*
+                 * ib_create_qp() will initialize qp->ibqp
+                 * except for qp->ibqp.qp_num.
+                 */
+                spin_lock_init(&qp->s_lock);
+                spin_lock_init(&qp->r_rq.lock);
+                atomic_set(&qp->refcount, 0);
+                init_waitqueue_head(&qp->wait);
+                tasklet_init(&qp->s_task,
+                             init_attr->qp_type == IB_QPT_RC ?
+                             ipath_do_rc_send : ipath_do_uc_send,
+                             (unsigned long)qp);
+                qp->piowait.next = LIST_POISON1;
+                qp->piowait.prev = LIST_POISON2;
+                qp->timerwait.next = LIST_POISON1;
+                qp->timerwait.prev = LIST_POISON2;
+                qp->state = IB_QPS_RESET;
+                qp->s_wq = swq;
+                qp->s_size = init_attr->cap.max_send_wr + 1;
+                qp->s_max_sge = init_attr->cap.max_send_sge;
+                qp->r_rq.max_sge = init_attr->cap.max_recv_sge;
+                qp->s_flags = init_attr->sq_sig_type == IB_SIGNAL_REQ_WR ?
+                        1 << IPATH_S_SIGNAL_REQ_WR : 0;
+                dev = to_idev(ibpd->device);
+                err = ipath_alloc_qpn(&dev->qp_table, qp,
+                                      init_attr->qp_type);
+                if (err) {
+                        vfree(swq);
+                        vfree(qp->r_rq.wq);
+                        kfree(qp);
+                        ret = ERR_PTR(err);
+                        goto bail;
+                }
+                ipath_reset_qp(qp);
+
+                /* Tell the core driver that the kernel SMA is present. */
+                if (qp->ibqp.qp_type == IB_QPT_SMI)
+                        ipath_layer_set_verbs_flags(dev->dd,
+                                                    IPATH_VERBS_KERNEL_SMA);
+                break;
+
+        default:
+                /* Don't support raw QPs */
+                ret = ERR_PTR(-ENOSYS);
+                goto bail;
+        }
+
+        init_attr->cap.max_inline_data = 0;
+
+        ret = &qp->ibqp;
+
+bail:
+        return ret;
+}
+
+/**
+ * ipath_destroy_qp - destroy a queue pair
+ * @ibqp: the queue pair to destroy
+ *
+ * Returns 0 on success.
+ *
+ * Note that this can be called while the QP is actively sending or
+ * receiving!
+ */
+int ipath_destroy_qp(struct ib_qp *ibqp)
+{
+        struct ipath_qp *qp = to_iqp(ibqp);
+        struct ipath_ibdev *dev = to_idev(ibqp->device);
+        unsigned long flags;
+
+        /* Tell the core driver that the kernel SMA is gone. */
+        if (qp->ibqp.qp_type == IB_QPT_SMI)
+                ipath_layer_set_verbs_flags(dev->dd, 0);
+
+        spin_lock_irqsave(&qp->r_rq.lock, flags);
+        spin_lock(&qp->s_lock);
+        qp->state = IB_QPS_ERR;
+        spin_unlock(&qp->s_lock);
+        spin_unlock_irqrestore(&qp->r_rq.lock, flags);
+
+        /* Stop the sending tasklet. */
+        tasklet_kill(&qp->s_task);
+
+        /* Make sure the QP isn't on the timeout list. */
+        spin_lock_irqsave(&dev->pending_lock, flags);
+        if (qp->timerwait.next != LIST_POISON1)
+                list_del(&qp->timerwait);
+        if (qp->piowait.next != LIST_POISON1)
+                list_del(&qp->piowait);
+        spin_unlock_irqrestore(&dev->pending_lock, flags);
+
+        /*
+         * Make sure that the QP is not in the QPN table so receive
+         * interrupts will discard packets for this QP.  XXX Also remove QP
+         * from multicast table.
+         */
+        if (atomic_read(&qp->refcount) != 0)
+                ipath_free_qp(&dev->qp_table, qp);
+
+        vfree(qp->s_wq);
+        vfree(qp->r_rq.wq);
+        kfree(qp);
+        return 0;
+}
+
+/**
+ * ipath_init_qp_table - initialize the QP table for a device
+ * @idev: the device who's QP table we're initializing
+ * @size: the size of the QP table
+ *
+ * Returns 0 on success, otherwise returns an errno.
+ */
+int ipath_init_qp_table(struct ipath_ibdev *idev, int size)
+{
+        int i;
+        int ret;
+
+        idev->qp_table.last = 1;        /* QPN 0 and 1 are special. */
+        idev->qp_table.max = size;
+        idev->qp_table.nmaps = 1;
+        idev->qp_table.table = kzalloc(size * sizeof(*idev->qp_table.table),
+                                       GFP_KERNEL);
+        if (idev->qp_table.table == NULL) {
+                ret = -ENOMEM;
+                goto bail;
+        }
+
+        for (i = 0; i < ARRAY_SIZE(idev->qp_table.map); i++) {
+                atomic_set(&idev->qp_table.map[i].n_free, BITS_PER_PAGE);
+                idev->qp_table.map[i].page = NULL;
+        }
+
+        ret = 0;
+
+bail:
+        return ret;
+}
+
+/**
+ * ipath_sqerror_qp - put a QP's send queue into an error state
+ * @qp: QP who's send queue will be put into an error state
+ * @wc: the WC responsible for putting the QP in this state
+ *
+ * Flushes the send work queue.
+ * The QP s_lock should be held.
+ */
+
+void ipath_sqerror_qp(struct ipath_qp *qp, struct ib_wc *wc)
+{
+        struct ipath_ibdev *dev = to_idev(qp->ibqp.device);
+        struct ipath_swqe *wqe = get_swqe_ptr(qp, qp->s_last);
+
+        _VERBS_INFO("Send queue error on QP%d/%d: err: %d\n",
+                    qp->ibqp.qp_num, qp->remote_qpn, wc->status);
+
+        spin_lock(&dev->pending_lock);
+        /* XXX What if its already removed by the timeout code? */
+        if (qp->timerwait.next != LIST_POISON1)
+                list_del(&qp->timerwait);
+        if (qp->piowait.next != LIST_POISON1)
+                list_del(&qp->piowait);
+        spin_unlock(&dev->pending_lock);
+
+        ipath_cq_enter(to_icq(qp->ibqp.send_cq), wc, 1);
+        if (++qp->s_last >= qp->s_size)
+                qp->s_last = 0;
+
+        wc->status = IB_WC_WR_FLUSH_ERR;
+
+        while (qp->s_last != qp->s_head) {
+                wc->wr_id = wqe->wr.wr_id;
+                wc->opcode = ib_ipath_wc_opcode[wqe->wr.opcode];
+                ipath_cq_enter(to_icq(qp->ibqp.send_cq), wc, 1);
+                if (++qp->s_last >= qp->s_size)
+                        qp->s_last = 0;
+                wqe = get_swqe_ptr(qp, qp->s_last);
+        }
+        qp->s_cur = qp->s_tail = qp->s_head;
+        qp->state = IB_QPS_SQE;
+}
+
+/**
+ * ipath_error_qp - put a QP into an error state
+ * @qp: the QP to put into an error state
+ *
+ * Flushes both send and receive work queues.
+ * QP r_rq.lock and s_lock should be held.
+ */
+
+void ipath_error_qp(struct ipath_qp *qp)
+{
+        struct ipath_ibdev *dev = to_idev(qp->ibqp.device);
+        struct ib_wc wc;
+
+        _VERBS_INFO("QP%d/%d in error state\n",
+                    qp->ibqp.qp_num, qp->remote_qpn);
+
+        spin_lock(&dev->pending_lock);
+        /* XXX What if its already removed by the timeout code? */
+        if (qp->timerwait.next != LIST_POISON1)
+                list_del(&qp->timerwait);
+        if (qp->piowait.next != LIST_POISON1)
+                list_del(&qp->piowait);
+        spin_unlock(&dev->pending_lock);
+
+        wc.status = IB_WC_WR_FLUSH_ERR;
+        wc.vendor_err = 0;
+        wc.byte_len = 0;
+        wc.imm_data = 0;
+        wc.qp_num = qp->ibqp.qp_num;
+        wc.src_qp = 0;
+        wc.wc_flags = 0;
+        wc.pkey_index = 0;
+        wc.slid = 0;
+        wc.sl = 0;
+        wc.dlid_path_bits = 0;
+        wc.port_num = 0;
+
+        while (qp->s_last != qp->s_head) {
+                struct ipath_swqe *wqe = get_swqe_ptr(qp, qp->s_last);
+
+                wc.wr_id = wqe->wr.wr_id;
+                wc.opcode = ib_ipath_wc_opcode[wqe->wr.opcode];
+                if (++qp->s_last >= qp->s_size)
+                        qp->s_last = 0;
+                ipath_cq_enter(to_icq(qp->ibqp.send_cq), &wc, 1);
+        }
+        qp->s_cur = qp->s_tail = qp->s_head;
+        qp->s_hdrwords = 0;
+        qp->s_ack_state = IB_OPCODE_RC_ACKNOWLEDGE;
+
+        wc.opcode = IB_WC_RECV;
+        while (qp->r_rq.tail != qp->r_rq.head) {
+                wc.wr_id = get_rwqe_ptr(&qp->r_rq, qp->r_rq.tail)->wr_id;
+                if (++qp->r_rq.tail >= qp->r_rq.size)
+                        qp->r_rq.tail = 0;
+                ipath_cq_enter(to_icq(qp->ibqp.recv_cq), &wc, 1);
+        }
+}
+
+/**
+ * ipath_get_credit - flush the send work queue of a QP
+ * @qp: the qp who's send work queue to flush
+ * @aeth: the Acknowledge Extended Transport Header
+ *
+ * The QP s_lock should be held.
+ */
+void ipath_get_credit(struct ipath_qp *qp, u32 aeth)
+{
+        u32 credit = (aeth >> IPS_AETH_CREDIT_SHIFT) & IPS_AETH_CREDIT_MASK;
+
+        /*
+         * If the credit is invalid, we can send
+         * as many packets as we like.  Otherwise, we have to
+         * honor the credit field.
+         */
+        if (credit == IPS_AETH_CREDIT_INVAL) {
+                qp->s_lsn = (u32) -1;
+        } else if (qp->s_lsn != (u32) -1) {
+                /* Compute new LSN (i.e., MSN + credit) */
+                credit = (aeth + credit_table[credit]) & IPS_MSN_MASK;
+                if (ipath_cmp24(credit, qp->s_lsn) > 0)
+                        qp->s_lsn = credit;
+        }
+
+        /* Restart sending if it was blocked due to lack of credits. */
+        if (qp->s_cur != qp->s_head &&
+            (qp->s_lsn == (u32) -1 ||
+             ipath_cmp24(get_swqe_ptr(qp, qp->s_cur)->ssn,
+                         qp->s_lsn + 1) <= 0))
+                tasklet_hi_schedule(&qp->s_task);
+}
diff --git a/drivers/infiniband/hw/ipath/ipath_rc.c b/drivers/infiniband/hw/ipath/ipath_rc.c
new file mode 100644
index 000000000000..a4055ca00614
--- /dev/null
+++ b/drivers/infiniband/hw/ipath/ipath_rc.c
@@ -0,0 +1,1857 @@
+/*
+ * Copyright (c) 2005, 2006 PathScale, Inc. All rights reserved.
+ *
+ * This software is available to you under a choice of one of two
+ * licenses.  You may choose to be licensed under the terms of the GNU
+ * General Public License (GPL) Version 2, available from the file
+ * COPYING in the main directory of this source tree, or the
+ * OpenIB.org BSD license below:
+ *
+ *     Redistribution and use in source and binary forms, with or
+ *     without modification, are permitted provided that the following
+ *     conditions are met:
+ *
+ *      - Redistributions of source code must retain the above
+ *        copyright notice, this list of conditions and the following
+ *        disclaimer.
+ *
+ *      - Redistributions in binary form must reproduce the above
+ *        copyright notice, this list of conditions and the following
+ *        disclaimer in the documentation and/or other materials
+ *        provided with the distribution.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+ * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+ * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+ * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
+ * BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
+ * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
+ * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+ * SOFTWARE.
+ */
+
+#include "ipath_verbs.h"
+#include "ips_common.h"
+
+/* cut down ridiculously long IB macro names */
+#define OP(x) IB_OPCODE_RC_##x
+
+/**
+ * ipath_init_restart- initialize the qp->s_sge after a restart
+ * @qp: the QP who's SGE we're restarting
+ * @wqe: the work queue to initialize the QP's SGE from
+ *
+ * The QP s_lock should be held.
+ */
+static void ipath_init_restart(struct ipath_qp *qp, struct ipath_swqe *wqe)
+{
+        struct ipath_ibdev *dev;
+        u32 len;
+
+        len = ((qp->s_psn - wqe->psn) & IPS_PSN_MASK) *
+                ib_mtu_enum_to_int(qp->path_mtu);
+        qp->s_sge.sge = wqe->sg_list[0];
+        qp->s_sge.sg_list = wqe->sg_list + 1;
+        qp->s_sge.num_sge = wqe->wr.num_sge;
+        ipath_skip_sge(&qp->s_sge, len);
+        qp->s_len = wqe->length - len;
+        dev = to_idev(qp->ibqp.device);
+        spin_lock(&dev->pending_lock);
+        if (qp->timerwait.next == LIST_POISON1)
+                list_add_tail(&qp->timerwait,
+                              &dev->pending[dev->pending_index]);
+        spin_unlock(&dev->pending_lock);
+}
+
+/**
+ * ipath_make_rc_ack - construct a response packet (ACK, NAK, or RDMA read)
+ * @qp: a pointer to the QP
+ * @ohdr: a pointer to the IB header being constructed
+ * @pmtu: the path MTU
+ *
+ * Return bth0 if constructed; otherwise, return 0.
+ * Note the QP s_lock must be held.
+ */
+static inline u32 ipath_make_rc_ack(struct ipath_qp *qp,
+                                    struct ipath_other_headers *ohdr,
+                                    u32 pmtu)
+{
+        struct ipath_sge_state *ss;
+        u32 hwords;
+        u32 len;
+        u32 bth0;
+
+        /* header size in 32-bit words LRH+BTH = (8+12)/4. */
+        hwords = 5;
+
+        /*
+         * Send a response.  Note that we are in the responder's
+         * side of the QP context.
+         */
+        switch (qp->s_ack_state) {
+        case OP(RDMA_READ_REQUEST):
+                ss = &qp->s_rdma_sge;
+                len = qp->s_rdma_len;
+                if (len > pmtu) {
+                        len = pmtu;
+                        qp->s_ack_state = OP(RDMA_READ_RESPONSE_FIRST);
+                }
+                else
+                        qp->s_ack_state = OP(RDMA_READ_RESPONSE_ONLY);
+                qp->s_rdma_len -= len;
+                bth0 = qp->s_ack_state << 24;
+                ohdr->u.aeth = ipath_compute_aeth(qp);
+                hwords++;
+                break;
+
+        case OP(RDMA_READ_RESPONSE_FIRST):
+                qp->s_ack_state = OP(RDMA_READ_RESPONSE_MIDDLE);
+                /* FALLTHROUGH */
+        case OP(RDMA_READ_RESPONSE_MIDDLE):
+                ss = &qp->s_rdma_sge;
+                len = qp->s_rdma_len;
+                if (len > pmtu)
+                        len = pmtu;
+                else {
+                        ohdr->u.aeth = ipath_compute_aeth(qp);
+                        hwords++;
+                        qp->s_ack_state = OP(RDMA_READ_RESPONSE_LAST);
+                }
+                qp->s_rdma_len -= len;
+                bth0 = qp->s_ack_state << 24;
+                break;
+
+        case OP(RDMA_READ_RESPONSE_LAST):
+        case OP(RDMA_READ_RESPONSE_ONLY):
+                /*
+                 * We have to prevent new requests from changing
+                 * the r_sge state while a ipath_verbs_send()
+                 * is in progress.
+                 * Changing r_state allows the receiver
+                 * to continue processing new packets.
+                 * We do it here now instead of above so
+                 * that we are sure the packet was sent before
+                 * changing the state.
+                 */
+                qp->r_state = OP(RDMA_READ_RESPONSE_LAST);
+                qp->s_ack_state = OP(ACKNOWLEDGE);
+                return 0;
+
+        case OP(COMPARE_SWAP):
+        case OP(FETCH_ADD):
+                ss = NULL;
+                len = 0;
+                qp->r_state = OP(SEND_LAST);
+                qp->s_ack_state = OP(ACKNOWLEDGE);
+                bth0 = IB_OPCODE_ATOMIC_ACKNOWLEDGE << 24;
+                ohdr->u.at.aeth = ipath_compute_aeth(qp);
+                ohdr->u.at.atomic_ack_eth = cpu_to_be64(qp->s_ack_atomic);
+                hwords += sizeof(ohdr->u.at) / 4;
+                break;
+
+        default:
+                /* Send a regular ACK. */
+                ss = NULL;
+                len = 0;
+                qp->s_ack_state = OP(ACKNOWLEDGE);
+                bth0 = qp->s_ack_state << 24;
+                ohdr->u.aeth = ipath_compute_aeth(qp);
+                hwords++;
+        }
+        qp->s_hdrwords = hwords;
+        qp->s_cur_sge = ss;
+        qp->s_cur_size = len;
+
+        return bth0;
+}
+
+/**
+ * ipath_make_rc_req - construct a request packet (SEND, RDMA r/w, ATOMIC)
+ * @qp: a pointer to the QP
+ * @ohdr: a pointer to the IB header being constructed
+ * @pmtu: the path MTU
+ * @bth0p: pointer to the BTH opcode word
+ * @bth2p: pointer to the BTH PSN word
+ *
+ * Return 1 if constructed; otherwise, return 0.
+ * Note the QP s_lock must be held.
+ */
+static inline int ipath_make_rc_req(struct ipath_qp *qp,
+                                    struct ipath_other_headers *ohdr,
+                                    u32 pmtu, u32 *bth0p, u32 *bth2p)
+{
+        struct ipath_ibdev *dev = to_idev(qp->ibqp.device);
+        struct ipath_sge_state *ss;
+        struct ipath_swqe *wqe;
+        u32 hwords;
+        u32 len;
+        u32 bth0;
+        u32 bth2;
+        char newreq;
+
+        if (!(ib_ipath_state_ops[qp->state] & IPATH_PROCESS_SEND_OK) ||
+            qp->s_rnr_timeout)
+                goto done;
+
+        /* header size in 32-bit words LRH+BTH = (8+12)/4. */
+        hwords = 5;
+        bth0 = 0;
+
+        /* Send a request. */
+        wqe = get_swqe_ptr(qp, qp->s_cur);
+        switch (qp->s_state) {
+        default:
+                /*
+                 * Resend an old request or start a new one.
+                 *
+                 * We keep track of the current SWQE so that
+                 * we don't reset the "furthest progress" state
+                 * if we need to back up.
+                 */
+                newreq = 0;
+                if (qp->s_cur == qp->s_tail) {
+                        /* Check if send work queue is empty. */
+                        if (qp->s_tail == qp->s_head)
+                                goto done;
+                        qp->s_psn = wqe->psn = qp->s_next_psn;
+                        newreq = 1;
+                }
+                /*
+                 * Note that we have to be careful not to modify the
+                 * original work request since we may need to resend
+                 * it.
+                 */
+                qp->s_sge.sge = wqe->sg_list[0];
+                qp->s_sge.sg_list = wqe->sg_list + 1;
+                qp->s_sge.num_sge = wqe->wr.num_sge;
+                qp->s_len = len = wqe->length;
+                ss = &qp->s_sge;
+                bth2 = 0;
+                switch (wqe->wr.opcode) {
+                case IB_WR_SEND:
+                case IB_WR_SEND_WITH_IMM:
+                        /* If no credit, return. */
+                        if (qp->s_lsn != (u32) -1 &&
+                            ipath_cmp24(wqe->ssn, qp->s_lsn + 1) > 0)
+                                goto done;
+                        wqe->lpsn = wqe->psn;
+                        if (len > pmtu) {
+                                wqe->lpsn += (len - 1) / pmtu;
+                                qp->s_state = OP(SEND_FIRST);
+                                len = pmtu;
+                                break;
+                        }
+                        if (wqe->wr.opcode == IB_WR_SEND)
+                                qp->s_state = OP(SEND_ONLY);
+                        else {
+                                qp->s_state = OP(SEND_ONLY_WITH_IMMEDIATE);
+                                /* Immediate data comes after the BTH */
+                                ohdr->u.imm_data = wqe->wr.imm_data;
+                                hwords += 1;
+                        }
+                        if (wqe->wr.send_flags & IB_SEND_SOLICITED)
+                                bth0 |= 1 << 23;
+                        bth2 = 1 << 31; /* Request ACK. */
+                        if (++qp->s_cur == qp->s_size)
+                                qp->s_cur = 0;
+                        break;
+
+                case IB_WR_RDMA_WRITE:
+                        if (newreq)
+                                qp->s_lsn++;
+                        /* FALLTHROUGH */
+                case IB_WR_RDMA_WRITE_WITH_IMM:
+                        /* If no credit, return. */
+                        if (qp->s_lsn != (u32) -1 &&
+                            ipath_cmp24(wqe->ssn, qp->s_lsn + 1) > 0)
+                                goto done;
+                        ohdr->u.rc.reth.vaddr =
+                                cpu_to_be64(wqe->wr.wr.rdma.remote_addr);
+                        ohdr->u.rc.reth.rkey =
+                                cpu_to_be32(wqe->wr.wr.rdma.rkey);
+                        ohdr->u.rc.reth.length = cpu_to_be32(len);
+                        hwords += sizeof(struct ib_reth) / 4;
+                        wqe->lpsn = wqe->psn;
+                        if (len > pmtu) {
+                                wqe->lpsn += (len - 1) / pmtu;
+                                qp->s_state = OP(RDMA_WRITE_FIRST);
+                                len = pmtu;
+                                break;
+                        }
+                        if (wqe->wr.opcode == IB_WR_RDMA_WRITE)
+                                qp->s_state = OP(RDMA_WRITE_ONLY);
+                        else {
+                                qp->s_state =
+                                        OP(RDMA_WRITE_ONLY_WITH_IMMEDIATE);
+                                /* Immediate data comes
+                                 * after RETH */
+                                ohdr->u.rc.imm_data = wqe->wr.imm_data;
+                                hwords += 1;
+                                if (wqe->wr.send_flags & IB_SEND_SOLICITED)
+                                        bth0 |= 1 << 23;
+                        }
+                        bth2 = 1 << 31; /* Request ACK. */
+                        if (++qp->s_cur == qp->s_size)
+                                qp->s_cur = 0;
+                        break;
+
+                case IB_WR_RDMA_READ:
+                        ohdr->u.rc.reth.vaddr =
+                                cpu_to_be64(wqe->wr.wr.rdma.remote_addr);
+                        ohdr->u.rc.reth.rkey =
+                                cpu_to_be32(wqe->wr.wr.rdma.rkey);
+                        ohdr->u.rc.reth.length = cpu_to_be32(len);
+                        qp->s_state = OP(RDMA_READ_REQUEST);
+                        hwords += sizeof(ohdr->u.rc.reth) / 4;
+                        if (newreq) {
+                                qp->s_lsn++;
+                                /*
+                                 * Adjust s_next_psn to count the
+                                 * expected number of responses.
+                                 */
+                                if (len > pmtu)
+                                        qp->s_next_psn += (len - 1) / pmtu;
+                                wqe->lpsn = qp->s_next_psn++;
+                        }
+                        ss = NULL;
+                        len = 0;
+                        if (++qp->s_cur == qp->s_size)
+                                qp->s_cur = 0;
+                        break;
+
+                case IB_WR_ATOMIC_CMP_AND_SWP:
+                case IB_WR_ATOMIC_FETCH_AND_ADD:
+                        if (wqe->wr.opcode == IB_WR_ATOMIC_CMP_AND_SWP)
+                                qp->s_state = OP(COMPARE_SWAP);
+                        else
+                                qp->s_state = OP(FETCH_ADD);
+                        ohdr->u.atomic_eth.vaddr = cpu_to_be64(
+                                wqe->wr.wr.atomic.remote_addr);
+                        ohdr->u.atomic_eth.rkey = cpu_to_be32(
+                                wqe->wr.wr.atomic.rkey);
+                        ohdr->u.atomic_eth.swap_data = cpu_to_be64(
+                                wqe->wr.wr.atomic.swap);
+                        ohdr->u.atomic_eth.compare_data = cpu_to_be64(
+                                wqe->wr.wr.atomic.compare_add);
+                        hwords += sizeof(struct ib_atomic_eth) / 4;
+                        if (newreq) {
+                                qp->s_lsn++;
+                                wqe->lpsn = wqe->psn;
+                        }
+                        if (++qp->s_cur == qp->s_size)
+                                qp->s_cur = 0;
+                        ss = NULL;
+                        len = 0;
+                        break;
+
+                default:
+                        goto done;
+                }
+                if (newreq) {
+                        qp->s_tail++;
+                        if (qp->s_tail >= qp->s_size)
+                                qp->s_tail = 0;
+                }
+                bth2 |= qp->s_psn++ & IPS_PSN_MASK;
+                if ((int)(qp->s_psn - qp->s_next_psn) > 0)
+                        qp->s_next_psn = qp->s_psn;
+                spin_lock(&dev->pending_lock);
+                if (qp->timerwait.next == LIST_POISON1)
+                        list_add_tail(&qp->timerwait,
+                                      &dev->pending[dev->pending_index]);
+                spin_unlock(&dev->pending_lock);
+                break;
+
+        case OP(RDMA_READ_RESPONSE_FIRST):
+                /*
+                 * This case can only happen if a send is restarted.  See
+                 * ipath_restart_rc().
+                 */
+                ipath_init_restart(qp, wqe);
+                /* FALLTHROUGH */
+        case OP(SEND_FIRST):
+                qp->s_state = OP(SEND_MIDDLE);
+                /* FALLTHROUGH */
+        case OP(SEND_MIDDLE):
+                bth2 = qp->s_psn++ & IPS_PSN_MASK;
+                if ((int)(qp->s_psn - qp->s_next_psn) > 0)
+                        qp->s_next_psn = qp->s_psn;
+                ss = &qp->s_sge;
+                len = qp->s_len;
+                if (len > pmtu) {
+                        /*
+                         * Request an ACK every 1/2 MB to avoid retransmit
+                         * timeouts.
+                         */
+                        if (((wqe->length - len) % (512 * 1024)) == 0)
+                                bth2 |= 1 << 31;
+                        len = pmtu;
+                        break;
+                }
+                if (wqe->wr.opcode == IB_WR_SEND)
+                        qp->s_state = OP(SEND_LAST);
+                else {
+                        qp->s_state = OP(SEND_LAST_WITH_IMMEDIATE);
+                        /* Immediate data comes after the BTH */
+                        ohdr->u.imm_data = wqe->wr.imm_data;
+                        hwords += 1;
+                }
+                if (wqe->wr.send_flags & IB_SEND_SOLICITED)
+                        bth0 |= 1 << 23;
+                bth2 |= 1 << 31;        /* Request ACK. */
+                qp->s_cur++;
+                if (qp->s_cur >= qp->s_size)
+                        qp->s_cur = 0;
+                break;
+
+        case OP(RDMA_READ_RESPONSE_LAST):
+                /*
+                 * This case can only happen if a RDMA write is restarted.
+                 * See ipath_restart_rc().
+                 */
+                ipath_init_restart(qp, wqe);
+                /* FALLTHROUGH */
+        case OP(RDMA_WRITE_FIRST):
+                qp->s_state = OP(RDMA_WRITE_MIDDLE);
+                /* FALLTHROUGH */
+        case OP(RDMA_WRITE_MIDDLE):
+                bth2 = qp->s_psn++ & IPS_PSN_MASK;
+                if ((int)(qp->s_psn - qp->s_next_psn) > 0)
+                        qp->s_next_psn = qp->s_psn;
+                ss = &qp->s_sge;
+                len = qp->s_len;
+                if (len > pmtu) {
+                        /*
+                         * Request an ACK every 1/2 MB to avoid retransmit
+                         * timeouts.
+                         */
+                        if (((wqe->length - len) % (512 * 1024)) == 0)
+                                bth2 |= 1 << 31;
+                        len = pmtu;
+                        break;
+                }
+                if (wqe->wr.opcode == IB_WR_RDMA_WRITE)
+                        qp->s_state = OP(RDMA_WRITE_LAST);
+                else {
+                        qp->s_state = OP(RDMA_WRITE_LAST_WITH_IMMEDIATE);
+                        /* Immediate data comes after the BTH */
+                        ohdr->u.imm_data = wqe->wr.imm_data;
+                        hwords += 1;
+                        if (wqe->wr.send_flags & IB_SEND_SOLICITED)
+                                bth0 |= 1 << 23;
+                }
+                bth2 |= 1 << 31;        /* Request ACK. */
+                qp->s_cur++;
+                if (qp->s_cur >= qp->s_size)
+                        qp->s_cur = 0;
+                break;
+
+        case OP(RDMA_READ_RESPONSE_MIDDLE):
+                /*
+                 * This case can only happen if a RDMA read is restarted.
+                 * See ipath_restart_rc().
+                 */
+                ipath_init_restart(qp, wqe);
+                len = ((qp->s_psn - wqe->psn) & IPS_PSN_MASK) * pmtu;
+                ohdr->u.rc.reth.vaddr =
+                        cpu_to_be64(wqe->wr.wr.rdma.remote_addr + len);
+                ohdr->u.rc.reth.rkey =
+                        cpu_to_be32(wqe->wr.wr.rdma.rkey);
+                ohdr->u.rc.reth.length = cpu_to_be32(qp->s_len);
+                qp->s_state = OP(RDMA_READ_REQUEST);
+                hwords += sizeof(ohdr->u.rc.reth) / 4;
+                bth2 = qp->s_psn++ & IPS_PSN_MASK;
+                if ((int)(qp->s_psn - qp->s_next_psn) > 0)
+                        qp->s_next_psn = qp->s_psn;
+                ss = NULL;
+                len = 0;
+                qp->s_cur++;
+                if (qp->s_cur == qp->s_size)
+                        qp->s_cur = 0;
+                break;
+
+        case OP(RDMA_READ_REQUEST):
+        case OP(COMPARE_SWAP):
+        case OP(FETCH_ADD):
+                /*
+                 * We shouldn't start anything new until this request is
+                 * finished.  The ACK will handle rescheduling us.  XXX The
+                 * number of outstanding ones is negotiated at connection
+                 * setup time (see pg. 258,289)?  XXX Also, if we support
+                 * multiple outstanding requests, we need to check the WQE
+                 * IB_SEND_FENCE flag and not send a new request if a RDMA
+                 * read or atomic is pending.
+                 */
+                goto done;
+        }
+        qp->s_len -= len;
+        qp->s_hdrwords = hwords;
+        qp->s_cur_sge = ss;
+        qp->s_cur_size = len;
+        *bth0p = bth0 | (qp->s_state << 24);
+        *bth2p = bth2;
+        return 1;
+
+done:
+        return 0;
+}
+
+static inline void ipath_make_rc_grh(struct ipath_qp *qp,
+                                     struct ib_global_route *grh,
+                                     u32 nwords)
+{
+        struct ipath_ibdev *dev = to_idev(qp->ibqp.device);
+
+        /* GRH header size in 32-bit words. */
+        qp->s_hdrwords += 10;
+        qp->s_hdr.u.l.grh.version_tclass_flow =
+                cpu_to_be32((6 << 28) |
+                            (grh->traffic_class << 20) |
+                            grh->flow_label);
+        qp->s_hdr.u.l.grh.paylen =
+                cpu_to_be16(((qp->s_hdrwords - 12) + nwords +
+                             SIZE_OF_CRC) << 2);
+        /* next_hdr is defined by C8-7 in ch. 8.4.1 */
+        qp->s_hdr.u.l.grh.next_hdr = 0x1B;
+        qp->s_hdr.u.l.grh.hop_limit = grh->hop_limit;
+        /* The SGID is 32-bit aligned. */
+        qp->s_hdr.u.l.grh.sgid.global.subnet_prefix = dev->gid_prefix;
+        qp->s_hdr.u.l.grh.sgid.global.interface_id =
+                ipath_layer_get_guid(dev->dd);
+        qp->s_hdr.u.l.grh.dgid = grh->dgid;
+}
+
+/**
+ * ipath_do_rc_send - perform a send on an RC QP
+ * @data: contains a pointer to the QP
+ *
+ * Process entries in the send work queue until credit or queue is
+ * exhausted.  Only allow one CPU to send a packet per QP (tasklet).
+ * Otherwise, after we drop the QP s_lock, two threads could send
+ * packets out of order.
+ */
+void ipath_do_rc_send(unsigned long data)
+{
+        struct ipath_qp *qp = (struct ipath_qp *)data;
+        struct ipath_ibdev *dev = to_idev(qp->ibqp.device);
+        unsigned long flags;
+        u16 lrh0;
+        u32 nwords;
+        u32 extra_bytes;
+        u32 bth0;
+        u32 bth2;
+        u32 pmtu = ib_mtu_enum_to_int(qp->path_mtu);
+        struct ipath_other_headers *ohdr;
+
+        if (test_and_set_bit(IPATH_S_BUSY, &qp->s_flags))
+                goto bail;
+
+        if (unlikely(qp->remote_ah_attr.dlid ==
+                     ipath_layer_get_lid(dev->dd))) {
+                struct ib_wc wc;
+
+                /*
+                 * Pass in an uninitialized ib_wc to be consistent with
+                 * other places where ipath_ruc_loopback() is called.
+                 */
+                ipath_ruc_loopback(qp, &wc);
+                goto clear;
+        }
+
+        ohdr = &qp->s_hdr.u.oth;
+        if (qp->remote_ah_attr.ah_flags & IB_AH_GRH)
+                ohdr = &qp->s_hdr.u.l.oth;
+
+again:
+        /* Check for a constructed packet to be sent. */
+        if (qp->s_hdrwords != 0) {
+                /*
+                 * If no PIO bufs are available, return.  An interrupt will
+                 * call ipath_ib_piobufavail() when one is available.
+                 */
+                _VERBS_INFO("h %u %p\n", qp->s_hdrwords, &qp->s_hdr);
+                _VERBS_INFO("d %u %p %u %p %u %u %u %u\n", qp->s_cur_size,
+                            qp->s_cur_sge->sg_list,
+                            qp->s_cur_sge->num_sge,
+                            qp->s_cur_sge->sge.vaddr,
+                            qp->s_cur_sge->sge.sge_length,
+                            qp->s_cur_sge->sge.length,
+                            qp->s_cur_sge->sge.m,
+                            qp->s_cur_sge->sge.n);
+                if (ipath_verbs_send(dev->dd, qp->s_hdrwords,
+                                     (u32 *) &qp->s_hdr, qp->s_cur_size,
+                                     qp->s_cur_sge)) {
+                        ipath_no_bufs_available(qp, dev);
+                        goto bail;
+                }
+                dev->n_unicast_xmit++;
+                /* Record that we sent the packet and s_hdr is empty. */
+                qp->s_hdrwords = 0;
+        }
+
+        /*
+         * The lock is needed to synchronize between setting
+         * qp->s_ack_state, resend timer, and post_send().
+         */
+        spin_lock_irqsave(&qp->s_lock, flags);
+
+        /* Sending responses has higher priority over sending requests. */
+        if (qp->s_ack_state != OP(ACKNOWLEDGE) &&
+            (bth0 = ipath_make_rc_ack(qp, ohdr, pmtu)) != 0)
+                bth2 = qp->s_ack_psn++ & IPS_PSN_MASK;
+        else if (!ipath_make_rc_req(qp, ohdr, pmtu, &bth0, &bth2))
+                goto done;
+
+        spin_unlock_irqrestore(&qp->s_lock, flags);
+
+        /* Construct the header. */
+        extra_bytes = (4 - qp->s_cur_size) & 3;
+        nwords = (qp->s_cur_size + extra_bytes) >> 2;
+        lrh0 = IPS_LRH_BTH;
+        if (unlikely(qp->remote_ah_attr.ah_flags & IB_AH_GRH)) {
+                ipath_make_rc_grh(qp, &qp->remote_ah_attr.grh, nwords);
+                lrh0 = IPS_LRH_GRH;
+        }
+        lrh0 |= qp->remote_ah_attr.sl << 4;
+        qp->s_hdr.lrh[0] = cpu_to_be16(lrh0);
+        qp->s_hdr.lrh[1] = cpu_to_be16(qp->remote_ah_attr.dlid);
+        qp->s_hdr.lrh[2] = cpu_to_be16(qp->s_hdrwords + nwords +
+                                       SIZE_OF_CRC);
+        qp->s_hdr.lrh[3] = cpu_to_be16(ipath_layer_get_lid(dev->dd));
+        bth0 |= ipath_layer_get_pkey(dev->dd, qp->s_pkey_index);
+        bth0 |= extra_bytes << 20;
+        ohdr->bth[0] = cpu_to_be32(bth0);
+        ohdr->bth[1] = cpu_to_be32(qp->remote_qpn);
+        ohdr->bth[2] = cpu_to_be32(bth2);
+
+        /* Check for more work to do. */
+        goto again;
+
+done:
+        spin_unlock_irqrestore(&qp->s_lock, flags);
+clear:
+        clear_bit(IPATH_S_BUSY, &qp->s_flags);
+bail:
+        return;
+}
+
+static void send_rc_ack(struct ipath_qp *qp)
+{
+        struct ipath_ibdev *dev = to_idev(qp->ibqp.device);
+        u16 lrh0;
+        u32 bth0;
+        struct ipath_other_headers *ohdr;
+
+        /* Construct the header. */
+        ohdr = &qp->s_hdr.u.oth;
+        lrh0 = IPS_LRH_BTH;
+        /* header size in 32-bit words LRH+BTH+AETH = (8+12+4)/4. */
+        qp->s_hdrwords = 6;
+        if (unlikely(qp->remote_ah_attr.ah_flags & IB_AH_GRH)) {
+                ipath_make_rc_grh(qp, &qp->remote_ah_attr.grh, 0);
+                ohdr = &qp->s_hdr.u.l.oth;
+                lrh0 = IPS_LRH_GRH;
+        }
+        bth0 = ipath_layer_get_pkey(dev->dd, qp->s_pkey_index);
+        ohdr->u.aeth = ipath_compute_aeth(qp);
+        if (qp->s_ack_state >= OP(COMPARE_SWAP)) {
+                bth0 |= IB_OPCODE_ATOMIC_ACKNOWLEDGE << 24;
+                ohdr->u.at.atomic_ack_eth = cpu_to_be64(qp->s_ack_atomic);
+                qp->s_hdrwords += sizeof(ohdr->u.at.atomic_ack_eth) / 4;
+        }
+        else
+                bth0 |= OP(ACKNOWLEDGE) << 24;
+        lrh0 |= qp->remote_ah_attr.sl << 4;
+        qp->s_hdr.lrh[0] = cpu_to_be16(lrh0);
+        qp->s_hdr.lrh[1] = cpu_to_be16(qp->remote_ah_attr.dlid);
+        qp->s_hdr.lrh[2] = cpu_to_be16(qp->s_hdrwords + SIZE_OF_CRC);
+        qp->s_hdr.lrh[3] = cpu_to_be16(ipath_layer_get_lid(dev->dd));
+        ohdr->bth[0] = cpu_to_be32(bth0);
+        ohdr->bth[1] = cpu_to_be32(qp->remote_qpn);
+        ohdr->bth[2] = cpu_to_be32(qp->s_ack_psn & IPS_PSN_MASK);
+
+        /*
+         * If we can send the ACK, clear the ACK state.
+         */
+        if (ipath_verbs_send(dev->dd, qp->s_hdrwords, (u32 *) &qp->s_hdr,
+                             0, NULL) == 0) {
+                qp->s_ack_state = OP(ACKNOWLEDGE);
+                dev->n_rc_qacks++;
+                dev->n_unicast_xmit++;
+        }
+}
+
+/**
+ * ipath_restart_rc - back up requester to resend the last un-ACKed request
+ * @qp: the QP to restart
+ * @psn: packet sequence number for the request
+ * @wc: the work completion request
+ *
+ * The QP s_lock should be held.
+ */
+void ipath_restart_rc(struct ipath_qp *qp, u32 psn, struct ib_wc *wc)
+{
+        struct ipath_swqe *wqe = get_swqe_ptr(qp, qp->s_last);
+        struct ipath_ibdev *dev;
+        u32 n;
+
+        /*
+         * If there are no requests pending, we are done.
+         */
+        if (ipath_cmp24(psn, qp->s_next_psn) >= 0 ||
+            qp->s_last == qp->s_tail)
+                goto done;
+
+        if (qp->s_retry == 0) {
+                wc->wr_id = wqe->wr.wr_id;
+                wc->status = IB_WC_RETRY_EXC_ERR;
+                wc->opcode = ib_ipath_wc_opcode[wqe->wr.opcode];
+                wc->vendor_err = 0;
+                wc->byte_len = 0;
+                wc->qp_num = qp->ibqp.qp_num;
+                wc->src_qp = qp->remote_qpn;
+                wc->pkey_index = 0;
+                wc->slid = qp->remote_ah_attr.dlid;
+                wc->sl = qp->remote_ah_attr.sl;
+                wc->dlid_path_bits = 0;
+                wc->port_num = 0;
+                ipath_sqerror_qp(qp, wc);
+                goto bail;
+        }
+        qp->s_retry--;
+
+        /*
+         * Remove the QP from the timeout queue.
+         * Note: it may already have been removed by ipath_ib_timer().
+         */
+        dev = to_idev(qp->ibqp.device);
+        spin_lock(&dev->pending_lock);
+        if (qp->timerwait.next != LIST_POISON1)
+                list_del(&qp->timerwait);
+        spin_unlock(&dev->pending_lock);
+
+        if (wqe->wr.opcode == IB_WR_RDMA_READ)
+                dev->n_rc_resends++;
+        else
+                dev->n_rc_resends += (int)qp->s_psn - (int)psn;
+
+        /*
+         * If we are starting the request from the beginning, let the normal
+         * send code handle initialization.
+         */
+        qp->s_cur = qp->s_last;
+        if (ipath_cmp24(psn, wqe->psn) <= 0) {
+                qp->s_state = OP(SEND_LAST);
+                qp->s_psn = wqe->psn;
+        } else {
+                n = qp->s_cur;
+                for (;;) {
+                        if (++n == qp->s_size)
+                                n = 0;
+                        if (n == qp->s_tail) {
+                                if (ipath_cmp24(psn, qp->s_next_psn) >= 0) {
+                                        qp->s_cur = n;
+                                        wqe = get_swqe_ptr(qp, n);
+                                }
+                                break;
+                        }
+                        wqe = get_swqe_ptr(qp, n);
+                        if (ipath_cmp24(psn, wqe->psn) < 0)
+                                break;
+                        qp->s_cur = n;
+                }
+                qp->s_psn = psn;
+
+                /*
+                 * Reset the state to restart in the middle of a request.
+                 * Don't change the s_sge, s_cur_sge, or s_cur_size.
+                 * See ipath_do_rc_send().
+                 */
+                switch (wqe->wr.opcode) {
+                case IB_WR_SEND:
+                case IB_WR_SEND_WITH_IMM:
+                        qp->s_state = OP(RDMA_READ_RESPONSE_FIRST);
+                        break;
+
+                case IB_WR_RDMA_WRITE:
+                case IB_WR_RDMA_WRITE_WITH_IMM:
+                        qp->s_state = OP(RDMA_READ_RESPONSE_LAST);
+                        break;
+
+                case IB_WR_RDMA_READ:
+                        qp->s_state =
+                                OP(RDMA_READ_RESPONSE_MIDDLE);
+                        break;
+
+                default:
+                        /*
+                         * This case shouldn't happen since its only
+                         * one PSN per req.
+                         */
+                        qp->s_state = OP(SEND_LAST);
+                }
+        }
+
+done:
+        tasklet_hi_schedule(&qp->s_task);
+
+bail:
+        return;
+}
+
+/**
+ * reset_psn - reset the QP state to send starting from PSN
+ * @qp: the QP
+ * @psn: the packet sequence number to restart at
+ *
+ * This is called from ipath_rc_rcv() to process an incoming RC ACK
+ * for the given QP.
+ * Called at interrupt level with the QP s_lock held.
+ */
+static void reset_psn(struct ipath_qp *qp, u32 psn)
+{
+        struct ipath_swqe *wqe;
+        u32 n;
+
+        n = qp->s_cur;
+        wqe = get_swqe_ptr(qp, n);
+        for (;;) {
+                if (++n == qp->s_size)
+                        n = 0;
+                if (n == qp->s_tail) {
+                        if (ipath_cmp24(psn, qp->s_next_psn) >= 0) {
+                                qp->s_cur = n;
+                                wqe = get_swqe_ptr(qp, n);
+                        }
+                        break;
+                }
+                wqe = get_swqe_ptr(qp, n);
+                if (ipath_cmp24(psn, wqe->psn) < 0)
+                        break;
+                qp->s_cur = n;
+        }
+        qp->s_psn = psn;
+
+        /*
+         * Set the state to restart in the middle of a
+         * request.  Don't change the s_sge, s_cur_sge, or
+         * s_cur_size.  See ipath_do_rc_send().
+         */
+        switch (wqe->wr.opcode) {
+        case IB_WR_SEND:
+        case IB_WR_SEND_WITH_IMM:
+                qp->s_state = OP(RDMA_READ_RESPONSE_FIRST);
+                break;
+
+        case IB_WR_RDMA_WRITE:
+        case IB_WR_RDMA_WRITE_WITH_IMM:
+                qp->s_state = OP(RDMA_READ_RESPONSE_LAST);
+                break;
+
+        case IB_WR_RDMA_READ:
+                qp->s_state = OP(RDMA_READ_RESPONSE_MIDDLE);
+                break;
+
+        default:
+                /*
+                 * This case shouldn't happen since its only
+                 * one PSN per req.
+                 */
+                qp->s_state = OP(SEND_LAST);
+        }
+}
+
+/**
+ * do_rc_ack - process an incoming RC ACK
+ * @qp: the QP the ACK came in on
+ * @psn: the packet sequence number of the ACK
+ * @opcode: the opcode of the request that resulted in the ACK
+ *
+ * This is called from ipath_rc_rcv() to process an incoming RC ACK
+ * for the given QP.
+ * Called at interrupt level with the QP s_lock held.
+ * Returns 1 if OK, 0 if current operation should be aborted (NAK).
+ */
+static int do_rc_ack(struct ipath_qp *qp, u32 aeth, u32 psn, int opcode)
+{
+        struct ipath_ibdev *dev = to_idev(qp->ibqp.device);
+        struct ib_wc wc;
+        struct ipath_swqe *wqe;
+        int ret = 0;
+
+        /*
+         * Remove the QP from the timeout queue (or RNR timeout queue).
+         * If ipath_ib_timer() has already removed it,
+         * it's OK since we hold the QP s_lock and ipath_restart_rc()
+         * just won't find anything to restart if we ACK everything.
+         */
+        spin_lock(&dev->pending_lock);
+        if (qp->timerwait.next != LIST_POISON1)
+                list_del(&qp->timerwait);
+        spin_unlock(&dev->pending_lock);
+
+        /*
+         * Note that NAKs implicitly ACK outstanding SEND and RDMA write
+         * requests and implicitly NAK RDMA read and atomic requests issued
+         * before the NAK'ed request.  The MSN won't include the NAK'ed
+         * request but will include an ACK'ed request(s).
+         */
+        wqe = get_swqe_ptr(qp, qp->s_last);
+
+        /* Nothing is pending to ACK/NAK. */
+        if (qp->s_last == qp->s_tail)
+                goto bail;
+
+        /*
+         * The MSN might be for a later WQE than the PSN indicates so
+         * only complete WQEs that the PSN finishes.
+         */
+        while (ipath_cmp24(psn, wqe->lpsn) >= 0) {
+                /* If we are ACKing a WQE, the MSN should be >= the SSN. */
+                if (ipath_cmp24(aeth, wqe->ssn) < 0)
+                        break;
+                /*
+                 * If this request is a RDMA read or atomic, and the ACK is
+                 * for a later operation, this ACK NAKs the RDMA read or
+                 * atomic.  In other words, only a RDMA_READ_LAST or ONLY
+                 * can ACK a RDMA read and likewise for atomic ops.  Note
+                 * that the NAK case can only happen if relaxed ordering is
+                 * used and requests are sent after an RDMA read or atomic
+                 * is sent but before the response is received.
+                 */
+                if ((wqe->wr.opcode == IB_WR_RDMA_READ &&
+                     opcode != OP(RDMA_READ_RESPONSE_LAST)) ||
+                    ((wqe->wr.opcode == IB_WR_ATOMIC_CMP_AND_SWP ||
+                      wqe->wr.opcode == IB_WR_ATOMIC_FETCH_AND_ADD) &&
+                     (opcode != OP(ATOMIC_ACKNOWLEDGE) ||
+                      ipath_cmp24(wqe->psn, psn) != 0))) {
+                        /*
+                         * The last valid PSN seen is the previous
+                         * request's.
+                         */
+                        qp->s_last_psn = wqe->psn - 1;
+                        /* Retry this request. */
+                        ipath_restart_rc(qp, wqe->psn, &wc);
+                        /*
+                         * No need to process the ACK/NAK since we are
+                         * restarting an earlier request.
+                         */
+                        goto bail;
+                }
+                /* Post a send completion queue entry if requested. */
+                if (!test_bit(IPATH_S_SIGNAL_REQ_WR, &qp->s_flags) ||
+                    (wqe->wr.send_flags & IB_SEND_SIGNALED)) {
+                        wc.wr_id = wqe->wr.wr_id;
+                        wc.status = IB_WC_SUCCESS;
+                        wc.opcode = ib_ipath_wc_opcode[wqe->wr.opcode];
+                        wc.vendor_err = 0;
+                        wc.byte_len = wqe->length;
+                        wc.qp_num = qp->ibqp.qp_num;
+                        wc.src_qp = qp->remote_qpn;
+                        wc.pkey_index = 0;
+                        wc.slid = qp->remote_ah_attr.dlid;
+                        wc.sl = qp->remote_ah_attr.sl;
+                        wc.dlid_path_bits = 0;
+                        wc.port_num = 0;
+                        ipath_cq_enter(to_icq(qp->ibqp.send_cq), &wc, 0);
+                }
+                qp->s_retry = qp->s_retry_cnt;
+                /*
+                 * If we are completing a request which is in the process of
+                 * being resent, we can stop resending it since we know the
+                 * responder has already seen it.
+                 */
+                if (qp->s_last == qp->s_cur) {
+                        if (++qp->s_cur >= qp->s_size)
+                                qp->s_cur = 0;
+                        wqe = get_swqe_ptr(qp, qp->s_cur);
+                        qp->s_state = OP(SEND_LAST);
+                        qp->s_psn = wqe->psn;
+                }
+                if (++qp->s_last >= qp->s_size)
+                        qp->s_last = 0;
+                wqe = get_swqe_ptr(qp, qp->s_last);
+                if (qp->s_last == qp->s_tail)
+                        break;
+        }
+
+        switch (aeth >> 29) {
+        case 0:         /* ACK */
+                dev->n_rc_acks++;
+                /* If this is a partial ACK, reset the retransmit timer. */
+                if (qp->s_last != qp->s_tail) {
+                        spin_lock(&dev->pending_lock);
+                        list_add_tail(&qp->timerwait,
+                                      &dev->pending[dev->pending_index]);
+                        spin_unlock(&dev->pending_lock);
+                }
+                ipath_get_credit(qp, aeth);
+                qp->s_rnr_retry = qp->s_rnr_retry_cnt;
+                qp->s_retry = qp->s_retry_cnt;
+                qp->s_last_psn = psn;
+                ret = 1;
+                goto bail;
+
+        case 1:         /* RNR NAK */
+                dev->n_rnr_naks++;
+                if (qp->s_rnr_retry == 0) {
+                        if (qp->s_last == qp->s_tail)
+                                goto bail;
+
+                        wc.status = IB_WC_RNR_RETRY_EXC_ERR;
+                        goto class_b;
+                }
+                if (qp->s_rnr_retry_cnt < 7)
+                        qp->s_rnr_retry--;
+                if (qp->s_last == qp->s_tail)
+                        goto bail;
+
+                /* The last valid PSN seen is the previous request's. */
+                qp->s_last_psn = wqe->psn - 1;
+
+                dev->n_rc_resends += (int)qp->s_psn - (int)psn;
+
+                /*
+                 * If we are starting the request from the beginning, let
+                 * the normal send code handle initialization.
+                 */
+                qp->s_cur = qp->s_last;
+                wqe = get_swqe_ptr(qp, qp->s_cur);
+                if (ipath_cmp24(psn, wqe->psn) <= 0) {
+                        qp->s_state = OP(SEND_LAST);
+                        qp->s_psn = wqe->psn;
+                } else
+                        reset_psn(qp, psn);
+
+                qp->s_rnr_timeout =
+                        ib_ipath_rnr_table[(aeth >> IPS_AETH_CREDIT_SHIFT) &
+                                           IPS_AETH_CREDIT_MASK];
+                ipath_insert_rnr_queue(qp);
+                goto bail;
+
+        case 3:         /* NAK */
+                /* The last valid PSN seen is the previous request's. */
+                if (qp->s_last != qp->s_tail)
+                        qp->s_last_psn = wqe->psn - 1;
+                switch ((aeth >> IPS_AETH_CREDIT_SHIFT) &
+                        IPS_AETH_CREDIT_MASK) {
+                case 0: /* PSN sequence error */
+                        dev->n_seq_naks++;
+                        /*
+                         * Back up to the responder's expected PSN.  XXX
+                         * Note that we might get a NAK in the middle of an
+                         * RDMA READ response which terminates the RDMA
+                         * READ.
+                         */
+                        if (qp->s_last == qp->s_tail)
+                                break;
+
+                        if (ipath_cmp24(psn, wqe->psn) < 0)
+                                break;
+
+                        /* Retry the request. */
+                        ipath_restart_rc(qp, psn, &wc);
+                        break;
+
+                case 1: /* Invalid Request */
+                        wc.status = IB_WC_REM_INV_REQ_ERR;
+                        dev->n_other_naks++;
+                        goto class_b;
+
+                case 2: /* Remote Access Error */
+                        wc.status = IB_WC_REM_ACCESS_ERR;
+                        dev->n_other_naks++;
+                        goto class_b;
+
+                case 3: /* Remote Operation Error */
+                        wc.status = IB_WC_REM_OP_ERR;
+                        dev->n_other_naks++;
+                class_b:
+                        wc.wr_id = wqe->wr.wr_id;
+                        wc.opcode = ib_ipath_wc_opcode[wqe->wr.opcode];
+                        wc.vendor_err = 0;
+                        wc.byte_len = 0;
+                        wc.qp_num = qp->ibqp.qp_num;
+                        wc.src_qp = qp->remote_qpn;
+                        wc.pkey_index = 0;
+                        wc.slid = qp->remote_ah_attr.dlid;
+                        wc.sl = qp->remote_ah_attr.sl;
+                        wc.dlid_path_bits = 0;
+                        wc.port_num = 0;
+                        ipath_sqerror_qp(qp, &wc);
+                        break;
+
+                default:
+                        /* Ignore other reserved NAK error codes */
+                        goto reserved;
+                }
+                qp->s_rnr_retry = qp->s_rnr_retry_cnt;
+                goto bail;
+
+        default:                /* 2: reserved */
+        reserved:
+                /* Ignore reserved NAK codes. */
+                goto bail;
+        }
+
+bail:
+        return ret;
+}
+
+/**
+ * ipath_rc_rcv_resp - process an incoming RC response packet
+ * @dev: the device this packet came in on
+ * @ohdr: the other headers for this packet
+ * @data: the packet data
+ * @tlen: the packet length
+ * @qp: the QP for this packet
+ * @opcode: the opcode for this packet
+ * @psn: the packet sequence number for this packet
+ * @hdrsize: the header length
+ * @pmtu: the path MTU
+ * @header_in_data: true if part of the header data is in the data buffer
+ *
+ * This is called from ipath_rc_rcv() to process an incoming RC response
+ * packet for the given QP.
+ * Called at interrupt level.
+ */
+static inline void ipath_rc_rcv_resp(struct ipath_ibdev *dev,
+                                     struct ipath_other_headers *ohdr,
+                                     void *data, u32 tlen,
+                                     struct ipath_qp *qp,
+                                     u32 opcode,
+                                     u32 psn, u32 hdrsize, u32 pmtu,
+                                     int header_in_data)
+{
+        unsigned long flags;
+        struct ib_wc wc;
+        int diff;
+        u32 pad;
+        u32 aeth;
+
+        spin_lock_irqsave(&qp->s_lock, flags);
+
+        /* Ignore invalid responses. */
+        if (ipath_cmp24(psn, qp->s_next_psn) >= 0)
+                goto ack_done;
+
+        /* Ignore duplicate responses. */
+        diff = ipath_cmp24(psn, qp->s_last_psn);
+        if (unlikely(diff <= 0)) {
+                /* Update credits for "ghost" ACKs */
+                if (diff == 0 && opcode == OP(ACKNOWLEDGE)) {
+                        if (!header_in_data)
+                                aeth = be32_to_cpu(ohdr->u.aeth);
+                        else {
+                                aeth = be32_to_cpu(((__be32 *) data)[0]);
+                                data += sizeof(__be32);
+                        }
+                        if ((aeth >> 29) == 0)
+                                ipath_get_credit(qp, aeth);
+                }
+                goto ack_done;
+        }
+
+        switch (opcode) {
+        case OP(ACKNOWLEDGE):
+        case OP(ATOMIC_ACKNOWLEDGE):
+        case OP(RDMA_READ_RESPONSE_FIRST):
+                if (!header_in_data)
+                        aeth = be32_to_cpu(ohdr->u.aeth);
+                else {
+                        aeth = be32_to_cpu(((__be32 *) data)[0]);
+                        data += sizeof(__be32);
+                }
+                if (opcode == OP(ATOMIC_ACKNOWLEDGE))
+                        *(u64 *) qp->s_sge.sge.vaddr = *(u64 *) data;
+                if (!do_rc_ack(qp, aeth, psn, opcode) ||
+                    opcode != OP(RDMA_READ_RESPONSE_FIRST))
+                        goto ack_done;
+                hdrsize += 4;
+                /*
+                 * do_rc_ack() has already checked the PSN so skip
+                 * the sequence check.
+                 */
+                goto rdma_read;
+
+        case OP(RDMA_READ_RESPONSE_MIDDLE):
+                /* no AETH, no ACK */
+                if (unlikely(ipath_cmp24(psn, qp->s_last_psn + 1))) {
+                        dev->n_rdma_seq++;
+                        ipath_restart_rc(qp, qp->s_last_psn + 1, &wc);
+                        goto ack_done;
+                }
+        rdma_read:
+        if (unlikely(qp->s_state != OP(RDMA_READ_REQUEST)))
+                goto ack_done;
+        if (unlikely(tlen != (hdrsize + pmtu + 4)))
+                goto ack_done;
+        if (unlikely(pmtu >= qp->s_len))
+                goto ack_done;
+        /* We got a response so update the timeout. */
+        if (unlikely(qp->s_last == qp->s_tail ||
+                     get_swqe_ptr(qp, qp->s_last)->wr.opcode !=
+                     IB_WR_RDMA_READ))
+                goto ack_done;
+        spin_lock(&dev->pending_lock);
+        if (qp->s_rnr_timeout == 0 &&
+            qp->timerwait.next != LIST_POISON1)
+                list_move_tail(&qp->timerwait,
+                               &dev->pending[dev->pending_index]);
+        spin_unlock(&dev->pending_lock);
+        /*
+         * Update the RDMA receive state but do the copy w/o holding the
+         * locks and blocking interrupts.  XXX Yet another place that
+         * affects relaxed RDMA order since we don't want s_sge modified.
+         */
+        qp->s_len -= pmtu;
+        qp->s_last_psn = psn;
+        spin_unlock_irqrestore(&qp->s_lock, flags);
+        ipath_copy_sge(&qp->s_sge, data, pmtu);
+        goto bail;
+
+        case OP(RDMA_READ_RESPONSE_LAST):
+                /* ACKs READ req. */
+                if (unlikely(ipath_cmp24(psn, qp->s_last_psn + 1))) {
+                        dev->n_rdma_seq++;
+                        ipath_restart_rc(qp, qp->s_last_psn + 1, &wc);
+                        goto ack_done;
+                }
+                /* FALLTHROUGH */
+        case OP(RDMA_READ_RESPONSE_ONLY):
+                if (unlikely(qp->s_state != OP(RDMA_READ_REQUEST)))
+                        goto ack_done;
+                /*
+                 * Get the number of bytes the message was padded by.
+                 */
+                pad = (be32_to_cpu(ohdr->bth[0]) >> 20) & 3;
+                /*
+                 * Check that the data size is >= 1 && <= pmtu.
+                 * Remember to account for the AETH header (4) and
+                 * ICRC (4).
+                 */
+                if (unlikely(tlen <= (hdrsize + pad + 8))) {
+                        /*
+                         * XXX Need to generate an error CQ
+                         * entry.
+                         */
+                        goto ack_done;
+                }
+                tlen -= hdrsize + pad + 8;
+                if (unlikely(tlen != qp->s_len)) {
+                        /*
+                         * XXX Need to generate an error CQ
+                         * entry.
+                         */
+                        goto ack_done;
+                }
+                if (!header_in_data)
+                        aeth = be32_to_cpu(ohdr->u.aeth);
+                else {
+                        aeth = be32_to_cpu(((__be32 *) data)[0]);
+                        data += sizeof(__be32);
+                }
+                ipath_copy_sge(&qp->s_sge, data, tlen);
+                if (do_rc_ack(qp, aeth, psn, OP(RDMA_READ_RESPONSE_LAST))) {
+                        /*
+                         * Change the state so we contimue
+                         * processing new requests.
+                         */
+                        qp->s_state = OP(SEND_LAST);
+                }
+                goto ack_done;
+        }
+
+ack_done:
+        spin_unlock_irqrestore(&qp->s_lock, flags);
+bail:
+        return;
+}
+
+/**
+ * ipath_rc_rcv_error - process an incoming duplicate or error RC packet
+ * @dev: the device this packet came in on
+ * @ohdr: the other headers for this packet
+ * @data: the packet data
+ * @qp: the QP for this packet
+ * @opcode: the opcode for this packet
+ * @psn: the packet sequence number for this packet
+ * @diff: the difference between the PSN and the expected PSN
+ * @header_in_data: true if part of the header data is in the data buffer
+ *
+ * This is called from ipath_rc_rcv() to process an unexpected
+ * incoming RC packet for the given QP.
+ * Called at interrupt level.
+ * Return 1 if no more processing is needed; otherwise return 0 to
+ * schedule a response to be sent and the s_lock unlocked.
+ */
+static inline int ipath_rc_rcv_error(struct ipath_ibdev *dev,
+                                     struct ipath_other_headers *ohdr,
+                                     void *data,
+                                     struct ipath_qp *qp,
+                                     u32 opcode,
+                                     u32 psn,
+                                     int diff,
+                                     int header_in_data)
+{
+        struct ib_reth *reth;
+
+        if (diff > 0) {
+                /*
+                 * Packet sequence error.
+                 * A NAK will ACK earlier sends and RDMA writes.
+                 * Don't queue the NAK if a RDMA read, atomic, or
+                 * NAK is pending though.
+                 */
+                spin_lock(&qp->s_lock);
+                if ((qp->s_ack_state >= OP(RDMA_READ_REQUEST) &&
+                     qp->s_ack_state != IB_OPCODE_ACKNOWLEDGE) ||
+                    qp->s_nak_state != 0) {
+                        spin_unlock(&qp->s_lock);
+                        goto done;
+                }
+                qp->s_ack_state = OP(SEND_ONLY);
+                qp->s_nak_state = IB_NAK_PSN_ERROR;
+                /* Use the expected PSN. */
+                qp->s_ack_psn = qp->r_psn;
+                goto resched;
+        }
+
+        /*
+         * Handle a duplicate request.  Don't re-execute SEND, RDMA
+         * write or atomic op.  Don't NAK errors, just silently drop
+         * the duplicate request.  Note that r_sge, r_len, and
+         * r_rcv_len may be in use so don't modify them.
+         *
+         * We are supposed to ACK the earliest duplicate PSN but we
+         * can coalesce an outstanding duplicate ACK.  We have to
+         * send the earliest so that RDMA reads can be restarted at
+         * the requester's expected PSN.
+         */
+        spin_lock(&qp->s_lock);
+        if (qp->s_ack_state != IB_OPCODE_ACKNOWLEDGE &&
+            ipath_cmp24(psn, qp->s_ack_psn) >= 0) {
+                if (qp->s_ack_state < IB_OPCODE_RDMA_READ_REQUEST)
+                        qp->s_ack_psn = psn;
+                spin_unlock(&qp->s_lock);
+                goto done;
+        }
+        switch (opcode) {
+        case OP(RDMA_READ_REQUEST):
+                /*
+                 * We have to be careful to not change s_rdma_sge
+                 * while ipath_do_rc_send() is using it and not
+                 * holding the s_lock.
+                 */
+                if (qp->s_ack_state != OP(ACKNOWLEDGE) &&
+                    qp->s_ack_state >= IB_OPCODE_RDMA_READ_REQUEST) {
+                        spin_unlock(&qp->s_lock);
+                        dev->n_rdma_dup_busy++;
+                        goto done;
+                }
+                /* RETH comes after BTH */
+                if (!header_in_data)
+                        reth = &ohdr->u.rc.reth;
+                else {
+                        reth = (struct ib_reth *)data;
+                        data += sizeof(*reth);
+                }
+                qp->s_rdma_len = be32_to_cpu(reth->length);
+                if (qp->s_rdma_len != 0) {
+                        u32 rkey = be32_to_cpu(reth->rkey);
+                        u64 vaddr = be64_to_cpu(reth->vaddr);
+                        int ok;
+
+                        /*
+                         * Address range must be a subset of the original
+                         * request and start on pmtu boundaries.
+                         */
+                        ok = ipath_rkey_ok(dev, &qp->s_rdma_sge,
+                                           qp->s_rdma_len, vaddr, rkey,
+                                           IB_ACCESS_REMOTE_READ);
+                        if (unlikely(!ok))
+                                goto done;
+                } else {
+                        qp->s_rdma_sge.sg_list = NULL;
+                        qp->s_rdma_sge.num_sge = 0;
+                        qp->s_rdma_sge.sge.mr = NULL;
+                        qp->s_rdma_sge.sge.vaddr = NULL;
+                        qp->s_rdma_sge.sge.length = 0;
+                        qp->s_rdma_sge.sge.sge_length = 0;
+                }
+                break;
+
+        case OP(COMPARE_SWAP):
+        case OP(FETCH_ADD):
+                /*
+                 * Check for the PSN of the last atomic operations
+                 * performed and resend the result if found.
+                 */
+                if ((psn & IPS_PSN_MASK) != qp->r_atomic_psn) {
+                        spin_unlock(&qp->s_lock);
+                        goto done;
+                }
+                qp->s_ack_atomic = qp->r_atomic_data;
+                break;
+        }
+        qp->s_ack_state = opcode;
+        qp->s_nak_state = 0;
+        qp->s_ack_psn = psn;
+resched:
+        return 0;
+
+done:
+        return 1;
+}
+
+/**
+ * ipath_rc_rcv - process an incoming RC packet
+ * @dev: the device this packet came in on
+ * @hdr: the header of this packet
+ * @has_grh: true if the header has a GRH
+ * @data: the packet data
+ * @tlen: the packet length
+ * @qp: the QP for this packet
+ *
+ * This is called from ipath_qp_rcv() to process an incoming RC packet
+ * for the given QP.
+ * Called at interrupt level.
+ */
+void ipath_rc_rcv(struct ipath_ibdev *dev, struct ipath_ib_header *hdr,
+                  int has_grh, void *data, u32 tlen, struct ipath_qp *qp)
+{
+        struct ipath_other_headers *ohdr;
+        u32 opcode;
+        u32 hdrsize;
+        u32 psn;
+        u32 pad;
+        unsigned long flags;
+        struct ib_wc wc;
+        u32 pmtu = ib_mtu_enum_to_int(qp->path_mtu);
+        int diff;
+        struct ib_reth *reth;
+        int header_in_data;
+
+        /* Check for GRH */
+        if (!has_grh) {
+                ohdr = &hdr->u.oth;
+                hdrsize = 8 + 12;       /* LRH + BTH */
+                psn = be32_to_cpu(ohdr->bth[2]);
+                header_in_data = 0;
+        } else {
+                ohdr = &hdr->u.l.oth;
+                hdrsize = 8 + 40 + 12;  /* LRH + GRH + BTH */
+                /*
+                 * The header with GRH is 60 bytes and the core driver sets
+                 * the eager header buffer size to 56 bytes so the last 4
+                 * bytes of the BTH header (PSN) is in the data buffer.
+                 */
+                header_in_data =
+                        ipath_layer_get_rcvhdrentsize(dev->dd) == 16;
+                if (header_in_data) {
+                        psn = be32_to_cpu(((__be32 *) data)[0]);
+                        data += sizeof(__be32);
+                } else
+                        psn = be32_to_cpu(ohdr->bth[2]);
+        }
+        /*
+         * The opcode is in the low byte when its in network order
+         * (top byte when in host order).
+         */
+        opcode = be32_to_cpu(ohdr->bth[0]) >> 24;
+
+        /*
+         * Process responses (ACKs) before anything else.  Note that the
+         * packet sequence number will be for something in the send work
+         * queue rather than the expected receive packet sequence number.
+         * In other words, this QP is the requester.
+         */
+        if (opcode >= OP(RDMA_READ_RESPONSE_FIRST) &&
+            opcode <= OP(ATOMIC_ACKNOWLEDGE)) {
+                ipath_rc_rcv_resp(dev, ohdr, data, tlen, qp, opcode, psn,
+                                  hdrsize, pmtu, header_in_data);
+                goto bail;
+        }
+
+        spin_lock_irqsave(&qp->r_rq.lock, flags);
+
+        /* Compute 24 bits worth of difference. */
+        diff = ipath_cmp24(psn, qp->r_psn);
+        if (unlikely(diff)) {
+                if (ipath_rc_rcv_error(dev, ohdr, data, qp, opcode,
+                                       psn, diff, header_in_data))
+                        goto done;
+                goto resched;
+        }
+
+        /* Check for opcode sequence errors. */
+        switch (qp->r_state) {
+        case OP(SEND_FIRST):
+        case OP(SEND_MIDDLE):
+                if (opcode == OP(SEND_MIDDLE) ||
+                    opcode == OP(SEND_LAST) ||
+                    opcode == OP(SEND_LAST_WITH_IMMEDIATE))
+                        break;
+        nack_inv:
+        /*
+         * A NAK will ACK earlier sends and RDMA writes.  Don't queue the
+         * NAK if a RDMA read, atomic, or NAK is pending though.
+         */
+        spin_lock(&qp->s_lock);
+        if (qp->s_ack_state >= OP(RDMA_READ_REQUEST) &&
+            qp->s_ack_state != IB_OPCODE_ACKNOWLEDGE) {
+                spin_unlock(&qp->s_lock);
+                goto done;
+        }
+        /* XXX Flush WQEs */
+        qp->state = IB_QPS_ERR;
+        qp->s_ack_state = OP(SEND_ONLY);
+        qp->s_nak_state = IB_NAK_INVALID_REQUEST;
+        qp->s_ack_psn = qp->r_psn;
+        goto resched;
+
+        case OP(RDMA_WRITE_FIRST):
+        case OP(RDMA_WRITE_MIDDLE):
+                if (opcode == OP(RDMA_WRITE_MIDDLE) ||
+                    opcode == OP(RDMA_WRITE_LAST) ||
+                    opcode == OP(RDMA_WRITE_LAST_WITH_IMMEDIATE))
+                        break;
+                goto nack_inv;
+
+        case OP(RDMA_READ_REQUEST):
+        case OP(COMPARE_SWAP):
+        case OP(FETCH_ADD):
+                /*
+                 * Drop all new requests until a response has been sent.  A
+                 * new request then ACKs the RDMA response we sent.  Relaxed
+                 * ordering would allow new requests to be processed but we
+                 * would need to keep a queue of rwqe's for all that are in
+                 * progress.  Note that we can't RNR NAK this request since
+                 * the RDMA READ or atomic response is already queued to be
+                 * sent (unless we implement a response send queue).
+                 */
+                goto done;
+
+        default:
+                if (opcode == OP(SEND_MIDDLE) ||
+                    opcode == OP(SEND_LAST) ||
+                    opcode == OP(SEND_LAST_WITH_IMMEDIATE) ||
+                    opcode == OP(RDMA_WRITE_MIDDLE) ||
+                    opcode == OP(RDMA_WRITE_LAST) ||
+                    opcode == OP(RDMA_WRITE_LAST_WITH_IMMEDIATE))
+                        goto nack_inv;
+                break;
+        }
+
+        wc.imm_data = 0;
+        wc.wc_flags = 0;
+
+        /* OK, process the packet. */
+        switch (opcode) {
+        case OP(SEND_FIRST):
+                if (!ipath_get_rwqe(qp, 0)) {
+                rnr_nak:
+                        /*
+                         * A RNR NAK will ACK earlier sends and RDMA writes.
+                         * Don't queue the NAK if a RDMA read or atomic
+                         * is pending though.
+                         */
+                        spin_lock(&qp->s_lock);
+                        if (qp->s_ack_state >=
+                            OP(RDMA_READ_REQUEST) &&
+                            qp->s_ack_state != IB_OPCODE_ACKNOWLEDGE) {
+                                spin_unlock(&qp->s_lock);
+                                goto done;
+                        }
+                        qp->s_ack_state = OP(SEND_ONLY);
+                        qp->s_nak_state = IB_RNR_NAK | qp->s_min_rnr_timer;
+                        qp->s_ack_psn = qp->r_psn;
+                        goto resched;
+                }
+                qp->r_rcv_len = 0;
+                /* FALLTHROUGH */
+        case OP(SEND_MIDDLE):
+        case OP(RDMA_WRITE_MIDDLE):
+        send_middle:
+                /* Check for invalid length PMTU or posted rwqe len. */
+                if (unlikely(tlen != (hdrsize + pmtu + 4)))
+                        goto nack_inv;
+                qp->r_rcv_len += pmtu;
+                if (unlikely(qp->r_rcv_len > qp->r_len))
+                        goto nack_inv;
+                ipath_copy_sge(&qp->r_sge, data, pmtu);
+                break;
+
+        case OP(RDMA_WRITE_LAST_WITH_IMMEDIATE):
+                /* consume RWQE */
+                if (!ipath_get_rwqe(qp, 1))
+                        goto rnr_nak;
+                goto send_last_imm;
+
+        case OP(SEND_ONLY):
+        case OP(SEND_ONLY_WITH_IMMEDIATE):
+                if (!ipath_get_rwqe(qp, 0))
+                        goto rnr_nak;
+                qp->r_rcv_len = 0;
+                if (opcode == OP(SEND_ONLY))
+                        goto send_last;
+                /* FALLTHROUGH */
+        case OP(SEND_LAST_WITH_IMMEDIATE):
+        send_last_imm:
+                if (header_in_data) {
+                        wc.imm_data = *(__be32 *) data;
+                        data += sizeof(__be32);
+                } else {
+                        /* Immediate data comes after BTH */
+                        wc.imm_data = ohdr->u.imm_data;
+                }
+                hdrsize += 4;
+                wc.wc_flags = IB_WC_WITH_IMM;
+                /* FALLTHROUGH */
+        case OP(SEND_LAST):
+        case OP(RDMA_WRITE_LAST):
+        send_last:
+                /* Get the number of bytes the message was padded by. */
+                pad = (be32_to_cpu(ohdr->bth[0]) >> 20) & 3;
+                /* Check for invalid length. */
+                /* XXX LAST len should be >= 1 */
+                if (unlikely(tlen < (hdrsize + pad + 4)))
+                        goto nack_inv;
+                /* Don't count the CRC. */
+                tlen -= (hdrsize + pad + 4);
+                wc.byte_len = tlen + qp->r_rcv_len;
+                if (unlikely(wc.byte_len > qp->r_len))
+                        goto nack_inv;
+                ipath_copy_sge(&qp->r_sge, data, tlen);
+                atomic_inc(&qp->msn);
+                if (opcode == OP(RDMA_WRITE_LAST) ||
+                    opcode == OP(RDMA_WRITE_ONLY))
+                        break;
+                wc.wr_id = qp->r_wr_id;
+                wc.status = IB_WC_SUCCESS;
+                wc.opcode = IB_WC_RECV;
+                wc.vendor_err = 0;
+                wc.qp_num = qp->ibqp.qp_num;
+                wc.src_qp = qp->remote_qpn;
+                wc.pkey_index = 0;
+                wc.slid = qp->remote_ah_attr.dlid;
+                wc.sl = qp->remote_ah_attr.sl;
+                wc.dlid_path_bits = 0;
+                wc.port_num = 0;
+                /* Signal completion event if the solicited bit is set. */
+                ipath_cq_enter(to_icq(qp->ibqp.recv_cq), &wc,
+                               (ohdr->bth[0] &
+                                __constant_cpu_to_be32(1 << 23)) != 0);
+                break;
+
+        case OP(RDMA_WRITE_FIRST):
+        case OP(RDMA_WRITE_ONLY):
+        case OP(RDMA_WRITE_ONLY_WITH_IMMEDIATE):
+                /* consume RWQE */
+                /* RETH comes after BTH */
+                if (!header_in_data)
+                        reth = &ohdr->u.rc.reth;
+                else {
+                        reth = (struct ib_reth *)data;
+                        data += sizeof(*reth);
+                }
+                hdrsize += sizeof(*reth);
+                qp->r_len = be32_to_cpu(reth->length);
+                qp->r_rcv_len = 0;
+                if (qp->r_len != 0) {
+                        u32 rkey = be32_to_cpu(reth->rkey);
+                        u64 vaddr = be64_to_cpu(reth->vaddr);
+                        int ok;
+
+                        /* Check rkey & NAK */
+                        ok = ipath_rkey_ok(dev, &qp->r_sge,
+                                           qp->r_len, vaddr, rkey,
+                                           IB_ACCESS_REMOTE_WRITE);
+                        if (unlikely(!ok)) {
+                        nack_acc:
+                                /*
+                                 * A NAK will ACK earlier sends and RDMA
+                                 * writes.  Don't queue the NAK if a RDMA
+                                 * read, atomic, or NAK is pending though.
+                                 */
+                                spin_lock(&qp->s_lock);
+                                if (qp->s_ack_state >=
+                                    OP(RDMA_READ_REQUEST) &&
+                                    qp->s_ack_state !=
+                                    IB_OPCODE_ACKNOWLEDGE) {
+                                        spin_unlock(&qp->s_lock);
+                                        goto done;
+                                }
+                                /* XXX Flush WQEs */
+                                qp->state = IB_QPS_ERR;
+                                qp->s_ack_state = OP(RDMA_WRITE_ONLY);
+                                qp->s_nak_state =
+                                        IB_NAK_REMOTE_ACCESS_ERROR;
+                                qp->s_ack_psn = qp->r_psn;
+                                goto resched;
+                        }
+                } else {
+                        qp->r_sge.sg_list = NULL;
+                        qp->r_sge.sge.mr = NULL;
+                        qp->r_sge.sge.vaddr = NULL;
+                        qp->r_sge.sge.length = 0;
+                        qp->r_sge.sge.sge_length = 0;
+                }
+                if (unlikely(!(qp->qp_access_flags &
+                               IB_ACCESS_REMOTE_WRITE)))
+                        goto nack_acc;
+                if (opcode == OP(RDMA_WRITE_FIRST))
+                        goto send_middle;
+                else if (opcode == OP(RDMA_WRITE_ONLY))
+                        goto send_last;
+                if (!ipath_get_rwqe(qp, 1))
+                        goto rnr_nak;
+                goto send_last_imm;
+
+        case OP(RDMA_READ_REQUEST):
+                /* RETH comes after BTH */
+                if (!header_in_data)
+                        reth = &ohdr->u.rc.reth;
+                else {
+                        reth = (struct ib_reth *)data;
+                        data += sizeof(*reth);
+                }
+                spin_lock(&qp->s_lock);
+                if (qp->s_ack_state != OP(ACKNOWLEDGE) &&
+                    qp->s_ack_state >= IB_OPCODE_RDMA_READ_REQUEST) {
+                        spin_unlock(&qp->s_lock);
+                        goto done;
+                }
+                qp->s_rdma_len = be32_to_cpu(reth->length);
+                if (qp->s_rdma_len != 0) {
+                        u32 rkey = be32_to_cpu(reth->rkey);
+                        u64 vaddr = be64_to_cpu(reth->vaddr);
+                        int ok;
+
+                        /* Check rkey & NAK */
+                        ok = ipath_rkey_ok(dev, &qp->s_rdma_sge,
+                                           qp->s_rdma_len, vaddr, rkey,
+                                           IB_ACCESS_REMOTE_READ);
+                        if (unlikely(!ok)) {
+                                spin_unlock(&qp->s_lock);
+                                goto nack_acc;
+                        }
+                        /*
+                         * Update the next expected PSN.  We add 1 later
+                         * below, so only add the remainder here.
+                         */
+                        if (qp->s_rdma_len > pmtu)
+                                qp->r_psn += (qp->s_rdma_len - 1) / pmtu;
+                } else {
+                        qp->s_rdma_sge.sg_list = NULL;
+                        qp->s_rdma_sge.num_sge = 0;
+                        qp->s_rdma_sge.sge.mr = NULL;
+                        qp->s_rdma_sge.sge.vaddr = NULL;
+                        qp->s_rdma_sge.sge.length = 0;
+                        qp->s_rdma_sge.sge.sge_length = 0;
+                }
+                if (unlikely(!(qp->qp_access_flags &
+                               IB_ACCESS_REMOTE_READ)))
+                        goto nack_acc;
+                /*
+                 * We need to increment the MSN here instead of when we
+                 * finish sending the result since a duplicate request would
+                 * increment it more than once.
+                 */
+                atomic_inc(&qp->msn);
+                qp->s_ack_state = opcode;
+                qp->s_nak_state = 0;
+                qp->s_ack_psn = psn;
+                qp->r_psn++;
+                qp->r_state = opcode;
+                goto rdmadone;
+
+        case OP(COMPARE_SWAP):
+        case OP(FETCH_ADD): {
+                struct ib_atomic_eth *ateth;
+                u64 vaddr;
+                u64 sdata;
+                u32 rkey;
+
+                if (!header_in_data)
+                        ateth = &ohdr->u.atomic_eth;
+                else {
+                        ateth = (struct ib_atomic_eth *)data;
+                        data += sizeof(*ateth);
+                }
+                vaddr = be64_to_cpu(ateth->vaddr);
+                if (unlikely(vaddr & (sizeof(u64) - 1)))
+                        goto nack_inv;
+                rkey = be32_to_cpu(ateth->rkey);
+                /* Check rkey & NAK */
+                if (unlikely(!ipath_rkey_ok(dev, &qp->r_sge,
+                                            sizeof(u64), vaddr, rkey,
+                                            IB_ACCESS_REMOTE_ATOMIC)))
+                        goto nack_acc;
+                if (unlikely(!(qp->qp_access_flags &
+                               IB_ACCESS_REMOTE_ATOMIC)))
+                        goto nack_acc;
+                /* Perform atomic OP and save result. */
+                sdata = be64_to_cpu(ateth->swap_data);
+                spin_lock(&dev->pending_lock);
+                qp->r_atomic_data = *(u64 *) qp->r_sge.sge.vaddr;
+                if (opcode == OP(FETCH_ADD))
+                        *(u64 *) qp->r_sge.sge.vaddr =
+                                qp->r_atomic_data + sdata;
+                else if (qp->r_atomic_data ==
+                         be64_to_cpu(ateth->compare_data))
+                        *(u64 *) qp->r_sge.sge.vaddr = sdata;
+                spin_unlock(&dev->pending_lock);
+                atomic_inc(&qp->msn);
+                qp->r_atomic_psn = psn & IPS_PSN_MASK;
+                psn |= 1 << 31;
+                break;
+        }
+
+        default:
+                /* Drop packet for unknown opcodes. */
+                goto done;
+        }
+        qp->r_psn++;
+        qp->r_state = opcode;
+        /* Send an ACK if requested or required. */
+        if (psn & (1 << 31)) {
+                /*
+                 * Coalesce ACKs unless there is a RDMA READ or
+                 * ATOMIC pending.
+                 */
+                spin_lock(&qp->s_lock);
+                if (qp->s_ack_state == OP(ACKNOWLEDGE) ||
+                    qp->s_ack_state < IB_OPCODE_RDMA_READ_REQUEST) {
+                        qp->s_ack_state = opcode;
+                        qp->s_nak_state = 0;
+                        qp->s_ack_psn = psn;
+                        qp->s_ack_atomic = qp->r_atomic_data;
+                        goto resched;
+                }
+                spin_unlock(&qp->s_lock);
+        }
+done:
+        spin_unlock_irqrestore(&qp->r_rq.lock, flags);
+        goto bail;
+
+resched:
+        /*
+         * Try to send ACK right away but not if ipath_do_rc_send() is
+         * active.
+         */
+        if (qp->s_hdrwords == 0 &&
+            (qp->s_ack_state < IB_OPCODE_RDMA_READ_REQUEST ||
+             qp->s_ack_state >= IB_OPCODE_COMPARE_SWAP))
+                send_rc_ack(qp);
+
+rdmadone:
+        spin_unlock(&qp->s_lock);
+        spin_unlock_irqrestore(&qp->r_rq.lock, flags);
+
+        /* Call ipath_do_rc_send() in another thread. */
+        tasklet_hi_schedule(&qp->s_task);
+
+bail:
+        return;
+}
diff --git a/drivers/infiniband/hw/ipath/ipath_registers.h b/drivers/infiniband/hw/ipath/ipath_registers.h
new file mode 100644
index 000000000000..1e59750c5f63
--- /dev/null
+++ b/drivers/infiniband/hw/ipath/ipath_registers.h
@@ -0,0 +1,446 @@
+/*
+ * Copyright (c) 2003, 2004, 2005, 2006 PathScale, Inc. All rights reserved.
+ *
+ * This software is available to you under a choice of one of two
+ * licenses.  You may choose to be licensed under the terms of the GNU
+ * General Public License (GPL) Version 2, available from the file
+ * COPYING in the main directory of this source tree, or the
+ * OpenIB.org BSD license below:
+ *
+ *     Redistribution and use in source and binary forms, with or
+ *     without modification, are permitted provided that the following
+ *     conditions are met:
+ *
+ *      - Redistributions of source code must retain the above
+ *        copyright notice, this list of conditions and the following
+ *        disclaimer.
+ *
+ *      - Redistributions in binary form must reproduce the above
+ *        copyright notice, this list of conditions and the following
+ *        disclaimer in the documentation and/or other materials
+ *        provided with the distribution.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+ * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+ * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+ * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
+ * BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
+ * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
+ * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+ * SOFTWARE.
+ */
+
+#ifndef _IPATH_REGISTERS_H
+#define _IPATH_REGISTERS_H
+
+/*
+ * This file should only be included by kernel source, and by the diags.
+ * It defines the registers, and their contents, for the InfiniPath HT-400 chip
+ */
+
+/*
+ * These are the InfiniPath register and buffer bit definitions,
+ * that are visible to software, and needed only by the kernel
+ * and diag code.  A few, that are visible to protocol and user
+ * code are in ipath_common.h.  Some bits are specific
+ * to a given chip implementation, and have been moved to the
+ * chip-specific source file
+ */
+
+/* kr_revision bits */
+#define INFINIPATH_R_CHIPREVMINOR_MASK 0xFF
+#define INFINIPATH_R_CHIPREVMINOR_SHIFT 0
+#define INFINIPATH_R_CHIPREVMAJOR_MASK 0xFF
+#define INFINIPATH_R_CHIPREVMAJOR_SHIFT 8
+#define INFINIPATH_R_ARCH_MASK 0xFF
+#define INFINIPATH_R_ARCH_SHIFT 16
+#define INFINIPATH_R_SOFTWARE_MASK 0xFF
+#define INFINIPATH_R_SOFTWARE_SHIFT 24
+#define INFINIPATH_R_BOARDID_MASK 0xFF
+#define INFINIPATH_R_BOARDID_SHIFT 32
+
+/* kr_control bits */
+#define INFINIPATH_C_FREEZEMODE 0x00000002
+#define INFINIPATH_C_LINKENABLE 0x00000004
+#define INFINIPATH_C_RESET 0x00000001
+
+/* kr_sendctrl bits */
+#define INFINIPATH_S_DISARMPIOBUF_SHIFT 16
+
+#define IPATH_S_ABORT           0
+#define IPATH_S_PIOINTBUFAVAIL  1
+#define IPATH_S_PIOBUFAVAILUPD  2
+#define IPATH_S_PIOENABLE       3
+#define IPATH_S_DISARM          31
+
+#define INFINIPATH_S_ABORT              (1U << IPATH_S_ABORT)
+#define INFINIPATH_S_PIOINTBUFAVAIL     (1U << IPATH_S_PIOINTBUFAVAIL)
+#define INFINIPATH_S_PIOBUFAVAILUPD     (1U << IPATH_S_PIOBUFAVAILUPD)
+#define INFINIPATH_S_PIOENABLE          (1U << IPATH_S_PIOENABLE)
+#define INFINIPATH_S_DISARM             (1U << IPATH_S_DISARM)
+
+/* kr_rcvctrl bits */
+#define INFINIPATH_R_PORTENABLE_SHIFT 0
+#define INFINIPATH_R_INTRAVAIL_SHIFT 16
+#define INFINIPATH_R_TAILUPD   0x80000000
+
+/* kr_intstatus, kr_intclear, kr_intmask bits */
+#define INFINIPATH_I_RCVURG_SHIFT 0
+#define INFINIPATH_I_RCVAVAIL_SHIFT 12
+#define INFINIPATH_I_ERROR        0x80000000
+#define INFINIPATH_I_SPIOSENT     0x40000000
+#define INFINIPATH_I_SPIOBUFAVAIL 0x20000000
+#define INFINIPATH_I_GPIO         0x10000000
+
+/* kr_errorstatus, kr_errorclear, kr_errormask bits */
+#define INFINIPATH_E_RFORMATERR      0x0000000000000001ULL
+#define INFINIPATH_E_RVCRC           0x0000000000000002ULL
+#define INFINIPATH_E_RICRC           0x0000000000000004ULL
+#define INFINIPATH_E_RMINPKTLEN      0x0000000000000008ULL
+#define INFINIPATH_E_RMAXPKTLEN      0x0000000000000010ULL
+#define INFINIPATH_E_RLONGPKTLEN     0x0000000000000020ULL
+#define INFINIPATH_E_RSHORTPKTLEN    0x0000000000000040ULL
+#define INFINIPATH_E_RUNEXPCHAR      0x0000000000000080ULL
+#define INFINIPATH_E_RUNSUPVL        0x0000000000000100ULL
+#define INFINIPATH_E_REBP            0x0000000000000200ULL
+#define INFINIPATH_E_RIBFLOW         0x0000000000000400ULL
+#define INFINIPATH_E_RBADVERSION     0x0000000000000800ULL
+#define INFINIPATH_E_RRCVEGRFULL     0x0000000000001000ULL
+#define INFINIPATH_E_RRCVHDRFULL     0x0000000000002000ULL
+#define INFINIPATH_E_RBADTID         0x0000000000004000ULL
+#define INFINIPATH_E_RHDRLEN         0x0000000000008000ULL
+#define INFINIPATH_E_RHDR            0x0000000000010000ULL
+#define INFINIPATH_E_RIBLOSTLINK     0x0000000000020000ULL
+#define INFINIPATH_E_SMINPKTLEN      0x0000000020000000ULL
+#define INFINIPATH_E_SMAXPKTLEN      0x0000000040000000ULL
+#define INFINIPATH_E_SUNDERRUN       0x0000000080000000ULL
+#define INFINIPATH_E_SPKTLEN         0x0000000100000000ULL
+#define INFINIPATH_E_SDROPPEDSMPPKT  0x0000000200000000ULL
+#define INFINIPATH_E_SDROPPEDDATAPKT 0x0000000400000000ULL
+#define INFINIPATH_E_SPIOARMLAUNCH   0x0000000800000000ULL
+#define INFINIPATH_E_SUNEXPERRPKTNUM 0x0000001000000000ULL
+#define INFINIPATH_E_SUNSUPVL        0x0000002000000000ULL
+#define INFINIPATH_E_IBSTATUSCHANGED 0x0001000000000000ULL
+#define INFINIPATH_E_INVALIDADDR     0x0002000000000000ULL
+#define INFINIPATH_E_RESET           0x0004000000000000ULL
+#define INFINIPATH_E_HARDWARE        0x0008000000000000ULL
+
+/* kr_hwerrclear, kr_hwerrmask, kr_hwerrstatus, bits */
+/* TXEMEMPARITYERR bit 0: PIObuf, 1: PIOpbc, 2: launchfifo
+ * RXEMEMPARITYERR bit 0: rcvbuf, 1: lookupq, 2: eagerTID, 3: expTID
+ *              bit 4: flag buffer, 5: datainfo, 6: header info */
+#define INFINIPATH_HWE_TXEMEMPARITYERR_MASK 0xFULL
+#define INFINIPATH_HWE_TXEMEMPARITYERR_SHIFT 40
+#define INFINIPATH_HWE_RXEMEMPARITYERR_MASK 0x7FULL
+#define INFINIPATH_HWE_RXEMEMPARITYERR_SHIFT 44
+#define INFINIPATH_HWE_RXDSYNCMEMPARITYERR  0x0000000400000000ULL
+#define INFINIPATH_HWE_MEMBISTFAILED        0x0040000000000000ULL
+#define INFINIPATH_HWE_IBCBUSTOSPCPARITYERR 0x4000000000000000ULL
+#define INFINIPATH_HWE_IBCBUSFRSPCPARITYERR 0x8000000000000000ULL
+
+/* kr_hwdiagctrl bits */
+#define INFINIPATH_DC_FORCETXEMEMPARITYERR_MASK 0xFULL
+#define INFINIPATH_DC_FORCETXEMEMPARITYERR_SHIFT 40
+#define INFINIPATH_DC_FORCERXEMEMPARITYERR_MASK 0x7FULL
+#define INFINIPATH_DC_FORCERXEMEMPARITYERR_SHIFT 44
+#define INFINIPATH_DC_FORCERXDSYNCMEMPARITYERR  0x0000000400000000ULL
+#define INFINIPATH_DC_COUNTERDISABLE            0x1000000000000000ULL
+#define INFINIPATH_DC_COUNTERWREN               0x2000000000000000ULL
+#define INFINIPATH_DC_FORCEIBCBUSTOSPCPARITYERR 0x4000000000000000ULL
+#define INFINIPATH_DC_FORCEIBCBUSFRSPCPARITYERR 0x8000000000000000ULL
+
+/* kr_ibcctrl bits */
+#define INFINIPATH_IBCC_FLOWCTRLPERIOD_MASK 0xFFULL
+#define INFINIPATH_IBCC_FLOWCTRLPERIOD_SHIFT 0
+#define INFINIPATH_IBCC_FLOWCTRLWATERMARK_MASK 0xFFULL
+#define INFINIPATH_IBCC_FLOWCTRLWATERMARK_SHIFT 8
+#define INFINIPATH_IBCC_LINKINITCMD_MASK 0x3ULL
+#define INFINIPATH_IBCC_LINKINITCMD_DISABLE 1
+#define INFINIPATH_IBCC_LINKINITCMD_POLL 2      /* cycle through TS1/TS2 till OK */
+#define INFINIPATH_IBCC_LINKINITCMD_SLEEP 3     /* wait for TS1, then go on */
+#define INFINIPATH_IBCC_LINKINITCMD_SHIFT 16
+#define INFINIPATH_IBCC_LINKCMD_MASK 0x3ULL
+#define INFINIPATH_IBCC_LINKCMD_INIT 1  /* move to 0x11 */
+#define INFINIPATH_IBCC_LINKCMD_ARMED 2 /* move to 0x21 */
+#define INFINIPATH_IBCC_LINKCMD_ACTIVE 3        /* move to 0x31 */
+#define INFINIPATH_IBCC_LINKCMD_SHIFT 18
+#define INFINIPATH_IBCC_MAXPKTLEN_MASK 0x7FFULL
+#define INFINIPATH_IBCC_MAXPKTLEN_SHIFT 20
+#define INFINIPATH_IBCC_PHYERRTHRESHOLD_MASK 0xFULL
+#define INFINIPATH_IBCC_PHYERRTHRESHOLD_SHIFT 32
+#define INFINIPATH_IBCC_OVERRUNTHRESHOLD_MASK 0xFULL
+#define INFINIPATH_IBCC_OVERRUNTHRESHOLD_SHIFT 36
+#define INFINIPATH_IBCC_CREDITSCALE_MASK 0x7ULL
+#define INFINIPATH_IBCC_CREDITSCALE_SHIFT 40
+#define INFINIPATH_IBCC_LOOPBACK             0x8000000000000000ULL
+#define INFINIPATH_IBCC_LINKDOWNDEFAULTSTATE 0x4000000000000000ULL
+
+/* kr_ibcstatus bits */
+#define INFINIPATH_IBCS_LINKTRAININGSTATE_MASK 0xF
+#define INFINIPATH_IBCS_LINKTRAININGSTATE_SHIFT 0
+#define INFINIPATH_IBCS_LINKSTATE_MASK 0x7
+#define INFINIPATH_IBCS_LINKSTATE_SHIFT 4
+#define INFINIPATH_IBCS_TXREADY       0x40000000
+#define INFINIPATH_IBCS_TXCREDITOK    0x80000000
+/* link training states (shift by INFINIPATH_IBCS_LINKTRAININGSTATE_SHIFT) */
+#define INFINIPATH_IBCS_LT_STATE_DISABLED       0x00
+#define INFINIPATH_IBCS_LT_STATE_LINKUP         0x01
+#define INFINIPATH_IBCS_LT_STATE_POLLACTIVE     0x02
+#define INFINIPATH_IBCS_LT_STATE_POLLQUIET      0x03
+#define INFINIPATH_IBCS_LT_STATE_SLEEPDELAY     0x04
+#define INFINIPATH_IBCS_LT_STATE_SLEEPQUIET     0x05
+#define INFINIPATH_IBCS_LT_STATE_CFGDEBOUNCE    0x08
+#define INFINIPATH_IBCS_LT_STATE_CFGRCVFCFG     0x09
+#define INFINIPATH_IBCS_LT_STATE_CFGWAITRMT     0x0a
+#define INFINIPATH_IBCS_LT_STATE_CFGIDLE        0x0b
+#define INFINIPATH_IBCS_LT_STATE_RECOVERRETRAIN 0x0c
+#define INFINIPATH_IBCS_LT_STATE_RECOVERWAITRMT 0x0e
+#define INFINIPATH_IBCS_LT_STATE_RECOVERIDLE    0x0f
+/* link state machine states (shift by INFINIPATH_IBCS_LINKSTATE_SHIFT) */
+#define INFINIPATH_IBCS_L_STATE_DOWN            0x0
+#define INFINIPATH_IBCS_L_STATE_INIT            0x1
+#define INFINIPATH_IBCS_L_STATE_ARM             0x2
+#define INFINIPATH_IBCS_L_STATE_ACTIVE          0x3
+#define INFINIPATH_IBCS_L_STATE_ACT_DEFER       0x4
+
+/* combination link status states that we use with some frequency */
+#define IPATH_IBSTATE_MASK ((INFINIPATH_IBCS_LINKTRAININGSTATE_MASK \
+                << INFINIPATH_IBCS_LINKSTATE_SHIFT) | \
+                (INFINIPATH_IBCS_LINKSTATE_MASK \
+                <<INFINIPATH_IBCS_LINKTRAININGSTATE_SHIFT))
+#define IPATH_IBSTATE_INIT ((INFINIPATH_IBCS_L_STATE_INIT \
+                << INFINIPATH_IBCS_LINKSTATE_SHIFT) | \
+                (INFINIPATH_IBCS_LT_STATE_LINKUP \
+                <<INFINIPATH_IBCS_LINKTRAININGSTATE_SHIFT))
+#define IPATH_IBSTATE_ARM ((INFINIPATH_IBCS_L_STATE_ARM \
+                << INFINIPATH_IBCS_LINKSTATE_SHIFT) | \
+                (INFINIPATH_IBCS_LT_STATE_LINKUP \
+                <<INFINIPATH_IBCS_LINKTRAININGSTATE_SHIFT))
+#define IPATH_IBSTATE_ACTIVE ((INFINIPATH_IBCS_L_STATE_ACTIVE \
+                << INFINIPATH_IBCS_LINKSTATE_SHIFT) | \
+                (INFINIPATH_IBCS_LT_STATE_LINKUP \
+                <<INFINIPATH_IBCS_LINKTRAININGSTATE_SHIFT))
+
+/* kr_extstatus bits */
+#define INFINIPATH_EXTS_SERDESPLLLOCK 0x1
+#define INFINIPATH_EXTS_GPIOIN_MASK 0xFFFFULL
+#define INFINIPATH_EXTS_GPIOIN_SHIFT 48
+
+/* kr_extctrl bits */
+#define INFINIPATH_EXTC_GPIOINVERT_MASK 0xFFFFULL
+#define INFINIPATH_EXTC_GPIOINVERT_SHIFT 32
+#define INFINIPATH_EXTC_GPIOOE_MASK 0xFFFFULL
+#define INFINIPATH_EXTC_GPIOOE_SHIFT 48
+#define INFINIPATH_EXTC_SERDESENABLE         0x80000000ULL
+#define INFINIPATH_EXTC_SERDESCONNECT        0x40000000ULL
+#define INFINIPATH_EXTC_SERDESENTRUNKING     0x20000000ULL
+#define INFINIPATH_EXTC_SERDESDISRXFIFO      0x10000000ULL
+#define INFINIPATH_EXTC_SERDESENPLPBK1       0x08000000ULL
+#define INFINIPATH_EXTC_SERDESENPLPBK2       0x04000000ULL
+#define INFINIPATH_EXTC_SERDESENENCDEC       0x02000000ULL
+#define INFINIPATH_EXTC_LED1SECPORT_ON       0x00000020ULL
+#define INFINIPATH_EXTC_LED2SECPORT_ON       0x00000010ULL
+#define INFINIPATH_EXTC_LED1PRIPORT_ON       0x00000008ULL
+#define INFINIPATH_EXTC_LED2PRIPORT_ON       0x00000004ULL
+#define INFINIPATH_EXTC_LEDGBLOK_ON          0x00000002ULL
+#define INFINIPATH_EXTC_LEDGBLERR_OFF        0x00000001ULL
+
+/* kr_mdio bits */
+#define INFINIPATH_MDIO_CLKDIV_MASK 0x7FULL
+#define INFINIPATH_MDIO_CLKDIV_SHIFT 32
+#define INFINIPATH_MDIO_COMMAND_MASK 0x7ULL
+#define INFINIPATH_MDIO_COMMAND_SHIFT 26
+#define INFINIPATH_MDIO_DEVADDR_MASK 0x1FULL
+#define INFINIPATH_MDIO_DEVADDR_SHIFT 21
+#define INFINIPATH_MDIO_REGADDR_MASK 0x1FULL
+#define INFINIPATH_MDIO_REGADDR_SHIFT 16
+#define INFINIPATH_MDIO_DATA_MASK 0xFFFFULL
+#define INFINIPATH_MDIO_DATA_SHIFT 0
+#define INFINIPATH_MDIO_CMDVALID    0x0000000040000000ULL
+#define INFINIPATH_MDIO_RDDATAVALID 0x0000000080000000ULL
+
+/* kr_partitionkey bits */
+#define INFINIPATH_PKEY_SIZE 16
+#define INFINIPATH_PKEY_MASK 0xFFFF
+#define INFINIPATH_PKEY_DEFAULT_PKEY 0xFFFF
+
+/* kr_serdesconfig0 bits */
+#define INFINIPATH_SERDC0_RESET_MASK  0xfULL    /* overal reset bits */
+#define INFINIPATH_SERDC0_RESET_PLL   0x10000000ULL     /* pll reset */
+#define INFINIPATH_SERDC0_TXIDLE      0xF000ULL /* tx idle enables (per lane) */
+#define INFINIPATH_SERDC0_RXDETECT_EN 0xF0000ULL        /* rx detect enables (per lane) */
+#define INFINIPATH_SERDC0_L1PWR_DN       0xF0ULL        /* L1 Power down; use with RXDETECT,
+                                                           Otherwise not used on IB side */
+
+/* kr_xgxsconfig bits */
+#define INFINIPATH_XGXS_RESET          0x7ULL
+#define INFINIPATH_XGXS_MDIOADDR_MASK  0xfULL
+#define INFINIPATH_XGXS_MDIOADDR_SHIFT 4
+
+#define INFINIPATH_RT_ADDR_MASK 0xFFFFFFFFFFULL /* 40 bits valid */
+
+/* TID entries (memory), HT400-only */
+#define INFINIPATH_RT_VALID 0x8000000000000000ULL
+#define INFINIPATH_RT_ADDR_SHIFT 0
+#define INFINIPATH_RT_BUFSIZE_MASK 0x3FFF
+#define INFINIPATH_RT_BUFSIZE_SHIFT 48
+
+/*
+ * IPATH_PIO_MAXIBHDR is the max IB header size allowed for in our
+ * PIO send buffers.  This is well beyond anything currently
+ * defined in the InfiniBand spec.
+ */
+#define IPATH_PIO_MAXIBHDR 128
+
+typedef u64 ipath_err_t;
+
+/* mask of defined bits for various registers */
+extern u64 infinipath_i_bitsextant;
+extern ipath_err_t infinipath_e_bitsextant, infinipath_hwe_bitsextant;
+
+/* masks that are different in various chips, or only exist in some chips */
+extern u32 infinipath_i_rcvavail_mask, infinipath_i_rcvurg_mask;
+
+/*
+ * register bits for selecting i2c direction and values, used for I2C serial
+ * flash
+ */
+extern u16 ipath_gpio_sda_num, ipath_gpio_scl_num;
+extern u64 ipath_gpio_sda, ipath_gpio_scl;
+
+/*
+ * These are the infinipath general register numbers (not offsets).
+ * The kernel registers are used directly, those beyond the kernel
+ * registers are calculated from one of the base registers.  The use of
+ * an integer type doesn't allow type-checking as thorough as, say,
+ * an enum but allows for better hiding of chip differences.
+ */
+typedef const u16 ipath_kreg,   /* infinipath general registers */
+ ipath_creg,                    /* infinipath counter registers */
+ ipath_sreg;                    /* kernel-only, infinipath send registers */
+
+/*
+ * These are the chip registers common to all infinipath chips, and
+ * used both by the kernel and the diagnostics or other user code.
+ * They are all implemented such that 64 bit accesses work.
+ * Some implement no more than 32 bits.  Because 64 bit reads
+ * require 2 HT cmds on opteron, we access those with 32 bit
+ * reads for efficiency (they are written as 64 bits, since
+ * the extra 32 bits are nearly free on writes, and it slightly reduces
+ * complexity).  The rest are all accessed as 64 bits.
+ */
+struct ipath_kregs {
+        /* These are the 32 bit group */
+        ipath_kreg kr_control;
+        ipath_kreg kr_counterregbase;
+        ipath_kreg kr_intmask;
+        ipath_kreg kr_intstatus;
+        ipath_kreg kr_pagealign;
+        ipath_kreg kr_portcnt;
+        ipath_kreg kr_rcvtidbase;
+        ipath_kreg kr_rcvtidcnt;
+        ipath_kreg kr_rcvegrbase;
+        ipath_kreg kr_rcvegrcnt;
+        ipath_kreg kr_scratch;
+        ipath_kreg kr_sendctrl;
+        ipath_kreg kr_sendpiobufbase;
+        ipath_kreg kr_sendpiobufcnt;
+        ipath_kreg kr_sendpiosize;
+        ipath_kreg kr_sendregbase;
+        ipath_kreg kr_userregbase;
+        /* These are the 64 bit group */
+        ipath_kreg kr_debugport;
+        ipath_kreg kr_debugportselect;
+        ipath_kreg kr_errorclear;
+        ipath_kreg kr_errormask;
+        ipath_kreg kr_errorstatus;
+        ipath_kreg kr_extctrl;
+        ipath_kreg kr_extstatus;
+        ipath_kreg kr_gpio_clear;
+        ipath_kreg kr_gpio_mask;
+        ipath_kreg kr_gpio_out;
+        ipath_kreg kr_gpio_status;
+        ipath_kreg kr_hwdiagctrl;
+        ipath_kreg kr_hwerrclear;
+        ipath_kreg kr_hwerrmask;
+        ipath_kreg kr_hwerrstatus;
+        ipath_kreg kr_ibcctrl;
+        ipath_kreg kr_ibcstatus;
+        ipath_kreg kr_intblocked;
+        ipath_kreg kr_intclear;
+        ipath_kreg kr_interruptconfig;
+        ipath_kreg kr_mdio;
+        ipath_kreg kr_partitionkey;
+        ipath_kreg kr_rcvbthqp;
+        ipath_kreg kr_rcvbufbase;
+        ipath_kreg kr_rcvbufsize;
+        ipath_kreg kr_rcvctrl;
+        ipath_kreg kr_rcvhdrcnt;
+        ipath_kreg kr_rcvhdrentsize;
+        ipath_kreg kr_rcvhdrsize;
+        ipath_kreg kr_rcvintmembase;
+        ipath_kreg kr_rcvintmemsize;
+        ipath_kreg kr_revision;
+        ipath_kreg kr_sendbuffererror;
+        ipath_kreg kr_sendpioavailaddr;
+        ipath_kreg kr_serdesconfig0;
+        ipath_kreg kr_serdesconfig1;
+        ipath_kreg kr_serdesstatus;
+        ipath_kreg kr_txintmembase;
+        ipath_kreg kr_txintmemsize;
+        ipath_kreg kr_xgxsconfig;
+        ipath_kreg kr_ibpllcfg;
+        /* use these two (and the following N ports) only with ipath_k*_kreg64_port();
+         * not *kreg64() */
+        ipath_kreg kr_rcvhdraddr;
+        ipath_kreg kr_rcvhdrtailaddr;
+
+        /* remaining registers are not present on all types of infinipath chips  */
+        ipath_kreg kr_rcvpktledcnt;
+        ipath_kreg kr_pcierbuftestreg0;
+        ipath_kreg kr_pcierbuftestreg1;
+        ipath_kreg kr_pcieq0serdesconfig0;
+        ipath_kreg kr_pcieq0serdesconfig1;
+        ipath_kreg kr_pcieq0serdesstatus;
+        ipath_kreg kr_pcieq1serdesconfig0;
+        ipath_kreg kr_pcieq1serdesconfig1;
+        ipath_kreg kr_pcieq1serdesstatus;
+};
+
+struct ipath_cregs {
+        ipath_creg cr_badformatcnt;
+        ipath_creg cr_erricrccnt;
+        ipath_creg cr_errlinkcnt;
+        ipath_creg cr_errlpcrccnt;
+        ipath_creg cr_errpkey;
+        ipath_creg cr_errrcvflowctrlcnt;
+        ipath_creg cr_err_rlencnt;
+        ipath_creg cr_errslencnt;
+        ipath_creg cr_errtidfull;
+        ipath_creg cr_errtidvalid;
+        ipath_creg cr_errvcrccnt;
+        ipath_creg cr_ibstatuschange;
+        ipath_creg cr_intcnt;
+        ipath_creg cr_invalidrlencnt;
+        ipath_creg cr_invalidslencnt;
+        ipath_creg cr_lbflowstallcnt;
+        ipath_creg cr_iblinkdowncnt;
+        ipath_creg cr_iblinkerrrecovcnt;
+        ipath_creg cr_ibsymbolerrcnt;
+        ipath_creg cr_pktrcvcnt;
+        ipath_creg cr_pktrcvflowctrlcnt;
+        ipath_creg cr_pktsendcnt;
+        ipath_creg cr_pktsendflowcnt;
+        ipath_creg cr_portovflcnt;
+        ipath_creg cr_rcvebpcnt;
+        ipath_creg cr_rcvovflcnt;
+        ipath_creg cr_rxdroppktcnt;
+        ipath_creg cr_senddropped;
+        ipath_creg cr_sendstallcnt;
+        ipath_creg cr_sendunderruncnt;
+        ipath_creg cr_unsupvlcnt;
+        ipath_creg cr_wordrcvcnt;
+        ipath_creg cr_wordsendcnt;
+};
+
+#endif                          /* _IPATH_REGISTERS_H */
diff --git a/drivers/infiniband/hw/ipath/ipath_ruc.c b/drivers/infiniband/hw/ipath/ipath_ruc.c
new file mode 100644
index 000000000000..f232e77b78ee
--- /dev/null
+++ b/drivers/infiniband/hw/ipath/ipath_ruc.c
@@ -0,0 +1,552 @@
+/*
+ * Copyright (c) 2005, 2006 PathScale, Inc. All rights reserved.
+ *
+ * This software is available to you under a choice of one of two
+ * licenses.  You may choose to be licensed under the terms of the GNU
+ * General Public License (GPL) Version 2, available from the file
+ * COPYING in the main directory of this source tree, or the
+ * OpenIB.org BSD license below:
+ *
+ *     Redistribution and use in source and binary forms, with or
+ *     without modification, are permitted provided that the following
+ *     conditions are met:
+ *
+ *      - Redistributions of source code must retain the above
+ *        copyright notice, this list of conditions and the following
+ *        disclaimer.
+ *
+ *      - Redistributions in binary form must reproduce the above
+ *        copyright notice, this list of conditions and the following
+ *        disclaimer in the documentation and/or other materials
+ *        provided with the distribution.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+ * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+ * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+ * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
+ * BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
+ * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
+ * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+ * SOFTWARE.
+ */
+
+#include "ipath_verbs.h"
+
+/*
+ * Convert the AETH RNR timeout code into the number of milliseconds.
+ */
+const u32 ib_ipath_rnr_table[32] = {
+        656,                    /* 0 */
+        1,                      /* 1 */
+        1,                      /* 2 */
+        1,                      /* 3 */
+        1,                      /* 4 */
+        1,                      /* 5 */
+        1,                      /* 6 */
+        1,                      /* 7 */
+        1,                      /* 8 */
+        1,                      /* 9 */
+        1,                      /* A */
+        1,                      /* B */
+        1,                      /* C */
+        1,                      /* D */
+        2,                      /* E */
+        2,                      /* F */
+        3,                      /* 10 */
+        4,                      /* 11 */
+        6,                      /* 12 */
+        8,                      /* 13 */
+        11,                     /* 14 */
+        16,                     /* 15 */
+        21,                     /* 16 */
+        31,                     /* 17 */
+        41,                     /* 18 */
+        62,                     /* 19 */
+        82,                     /* 1A */
+        123,                    /* 1B */
+        164,                    /* 1C */
+        246,                    /* 1D */
+        328,                    /* 1E */
+        492                     /* 1F */
+};
+
+/**
+ * ipath_insert_rnr_queue - put QP on the RNR timeout list for the device
+ * @qp: the QP
+ *
+ * XXX Use a simple list for now.  We might need a priority
+ * queue if we have lots of QPs waiting for RNR timeouts
+ * but that should be rare.
+ */
+void ipath_insert_rnr_queue(struct ipath_qp *qp)
+{
+        struct ipath_ibdev *dev = to_idev(qp->ibqp.device);
+        unsigned long flags;
+
+        spin_lock_irqsave(&dev->pending_lock, flags);
+        if (list_empty(&dev->rnrwait))
+                list_add(&qp->timerwait, &dev->rnrwait);
+        else {
+                struct list_head *l = &dev->rnrwait;
+                struct ipath_qp *nqp = list_entry(l->next, struct ipath_qp,
+                                                  timerwait);
+
+                while (qp->s_rnr_timeout >= nqp->s_rnr_timeout) {
+                        qp->s_rnr_timeout -= nqp->s_rnr_timeout;
+                        l = l->next;
+                        if (l->next == &dev->rnrwait)
+                                break;
+                        nqp = list_entry(l->next, struct ipath_qp,
+                                         timerwait);
+                }
+                list_add(&qp->timerwait, l);
+        }
+        spin_unlock_irqrestore(&dev->pending_lock, flags);
+}
+
+/**
+ * ipath_get_rwqe - copy the next RWQE into the QP's RWQE
+ * @qp: the QP
+ * @wr_id_only: update wr_id only, not SGEs
+ *
+ * Return 0 if no RWQE is available, otherwise return 1.
+ *
+ * Called at interrupt level with the QP r_rq.lock held.
+ */
+int ipath_get_rwqe(struct ipath_qp *qp, int wr_id_only)
+{
+        struct ipath_rq *rq;
+        struct ipath_srq *srq;
+        struct ipath_rwqe *wqe;
+        int ret;
+
+        if (!qp->ibqp.srq) {
+                rq = &qp->r_rq;
+                if (unlikely(rq->tail == rq->head)) {
+                        ret = 0;
+                        goto bail;
+                }
+                wqe = get_rwqe_ptr(rq, rq->tail);
+                qp->r_wr_id = wqe->wr_id;
+                if (!wr_id_only) {
+                        qp->r_sge.sge = wqe->sg_list[0];
+                        qp->r_sge.sg_list = wqe->sg_list + 1;
+                        qp->r_sge.num_sge = wqe->num_sge;
+                        qp->r_len = wqe->length;
+                }
+                if (++rq->tail >= rq->size)
+                        rq->tail = 0;
+                ret = 1;
+                goto bail;
+        }
+
+        srq = to_isrq(qp->ibqp.srq);
+        rq = &srq->rq;
+        spin_lock(&rq->lock);
+        if (unlikely(rq->tail == rq->head)) {
+                spin_unlock(&rq->lock);
+                ret = 0;
+                goto bail;
+        }
+        wqe = get_rwqe_ptr(rq, rq->tail);
+        qp->r_wr_id = wqe->wr_id;
+        if (!wr_id_only) {
+                qp->r_sge.sge = wqe->sg_list[0];
+                qp->r_sge.sg_list = wqe->sg_list + 1;
+                qp->r_sge.num_sge = wqe->num_sge;
+                qp->r_len = wqe->length;
+        }
+        if (++rq->tail >= rq->size)
+                rq->tail = 0;
+        if (srq->ibsrq.event_handler) {
+                struct ib_event ev;
+                u32 n;
+
+                if (rq->head < rq->tail)
+                        n = rq->size + rq->head - rq->tail;
+                else
+                        n = rq->head - rq->tail;
+                if (n < srq->limit) {
+                        srq->limit = 0;
+                        spin_unlock(&rq->lock);
+                        ev.device = qp->ibqp.device;
+                        ev.element.srq = qp->ibqp.srq;
+                        ev.event = IB_EVENT_SRQ_LIMIT_REACHED;
+                        srq->ibsrq.event_handler(&ev,
+                                                 srq->ibsrq.srq_context);
+                } else
+                        spin_unlock(&rq->lock);
+        } else
+                spin_unlock(&rq->lock);
+        ret = 1;
+
+bail:
+        return ret;
+}
+
+/**
+ * ipath_ruc_loopback - handle UC and RC lookback requests
+ * @sqp: the loopback QP
+ * @wc: the work completion entry
+ *
+ * This is called from ipath_do_uc_send() or ipath_do_rc_send() to
+ * forward a WQE addressed to the same HCA.
+ * Note that although we are single threaded due to the tasklet, we still
+ * have to protect against post_send().  We don't have to worry about
+ * receive interrupts since this is a connected protocol and all packets
+ * will pass through here.
+ */
+void ipath_ruc_loopback(struct ipath_qp *sqp, struct ib_wc *wc)
+{
+        struct ipath_ibdev *dev = to_idev(sqp->ibqp.device);
+        struct ipath_qp *qp;
+        struct ipath_swqe *wqe;
+        struct ipath_sge *sge;
+        unsigned long flags;
+        u64 sdata;
+
+        qp = ipath_lookup_qpn(&dev->qp_table, sqp->remote_qpn);
+        if (!qp) {
+                dev->n_pkt_drops++;
+                return;
+        }
+
+again:
+        spin_lock_irqsave(&sqp->s_lock, flags);
+
+        if (!(ib_ipath_state_ops[sqp->state] & IPATH_PROCESS_SEND_OK)) {
+                spin_unlock_irqrestore(&sqp->s_lock, flags);
+                goto done;
+        }
+
+        /* Get the next send request. */
+        if (sqp->s_last == sqp->s_head) {
+                /* Send work queue is empty. */
+                spin_unlock_irqrestore(&sqp->s_lock, flags);
+                goto done;
+        }
+
+        /*
+         * We can rely on the entry not changing without the s_lock
+         * being held until we update s_last.
+         */
+        wqe = get_swqe_ptr(sqp, sqp->s_last);
+        spin_unlock_irqrestore(&sqp->s_lock, flags);
+
+        wc->wc_flags = 0;
+        wc->imm_data = 0;
+
+        sqp->s_sge.sge = wqe->sg_list[0];
+        sqp->s_sge.sg_list = wqe->sg_list + 1;
+        sqp->s_sge.num_sge = wqe->wr.num_sge;
+        sqp->s_len = wqe->length;
+        switch (wqe->wr.opcode) {
+        case IB_WR_SEND_WITH_IMM:
+                wc->wc_flags = IB_WC_WITH_IMM;
+                wc->imm_data = wqe->wr.imm_data;
+                /* FALLTHROUGH */
+        case IB_WR_SEND:
+                spin_lock_irqsave(&qp->r_rq.lock, flags);
+                if (!ipath_get_rwqe(qp, 0)) {
+                rnr_nak:
+                        spin_unlock_irqrestore(&qp->r_rq.lock, flags);
+                        /* Handle RNR NAK */
+                        if (qp->ibqp.qp_type == IB_QPT_UC)
+                                goto send_comp;
+                        if (sqp->s_rnr_retry == 0) {
+                                wc->status = IB_WC_RNR_RETRY_EXC_ERR;
+                                goto err;
+                        }
+                        if (sqp->s_rnr_retry_cnt < 7)
+                                sqp->s_rnr_retry--;
+                        dev->n_rnr_naks++;
+                        sqp->s_rnr_timeout =
+                                ib_ipath_rnr_table[sqp->s_min_rnr_timer];
+                        ipath_insert_rnr_queue(sqp);
+                        goto done;
+                }
+                spin_unlock_irqrestore(&qp->r_rq.lock, flags);
+                break;
+
+        case IB_WR_RDMA_WRITE_WITH_IMM:
+                wc->wc_flags = IB_WC_WITH_IMM;
+                wc->imm_data = wqe->wr.imm_data;
+                spin_lock_irqsave(&qp->r_rq.lock, flags);
+                if (!ipath_get_rwqe(qp, 1))
+                        goto rnr_nak;
+                spin_unlock_irqrestore(&qp->r_rq.lock, flags);
+                /* FALLTHROUGH */
+        case IB_WR_RDMA_WRITE:
+                if (wqe->length == 0)
+                        break;
+                if (unlikely(!ipath_rkey_ok(dev, &qp->r_sge, wqe->length,
+                                            wqe->wr.wr.rdma.remote_addr,
+                                            wqe->wr.wr.rdma.rkey,
+                                            IB_ACCESS_REMOTE_WRITE))) {
+                acc_err:
+                        wc->status = IB_WC_REM_ACCESS_ERR;
+                err:
+                        wc->wr_id = wqe->wr.wr_id;
+                        wc->opcode = ib_ipath_wc_opcode[wqe->wr.opcode];
+                        wc->vendor_err = 0;
+                        wc->byte_len = 0;
+                        wc->qp_num = sqp->ibqp.qp_num;
+                        wc->src_qp = sqp->remote_qpn;
+                        wc->pkey_index = 0;
+                        wc->slid = sqp->remote_ah_attr.dlid;
+                        wc->sl = sqp->remote_ah_attr.sl;
+                        wc->dlid_path_bits = 0;
+                        wc->port_num = 0;
+                        ipath_sqerror_qp(sqp, wc);
+                        goto done;
+                }
+                break;
+
+        case IB_WR_RDMA_READ:
+                if (unlikely(!ipath_rkey_ok(dev, &sqp->s_sge, wqe->length,
+                                            wqe->wr.wr.rdma.remote_addr,
+                                            wqe->wr.wr.rdma.rkey,
+                                            IB_ACCESS_REMOTE_READ)))
+                        goto acc_err;
+                if (unlikely(!(qp->qp_access_flags &
+                               IB_ACCESS_REMOTE_READ)))
+                        goto acc_err;
+                qp->r_sge.sge = wqe->sg_list[0];
+                qp->r_sge.sg_list = wqe->sg_list + 1;
+                qp->r_sge.num_sge = wqe->wr.num_sge;
+                break;
+
+        case IB_WR_ATOMIC_CMP_AND_SWP:
+        case IB_WR_ATOMIC_FETCH_AND_ADD:
+                if (unlikely(!ipath_rkey_ok(dev, &qp->r_sge, sizeof(u64),
+                                            wqe->wr.wr.rdma.remote_addr,
+                                            wqe->wr.wr.rdma.rkey,
+                                            IB_ACCESS_REMOTE_ATOMIC)))
+                        goto acc_err;
+                /* Perform atomic OP and save result. */
+                sdata = wqe->wr.wr.atomic.swap;
+                spin_lock_irqsave(&dev->pending_lock, flags);
+                qp->r_atomic_data = *(u64 *) qp->r_sge.sge.vaddr;
+                if (wqe->wr.opcode == IB_WR_ATOMIC_FETCH_AND_ADD)
+                        *(u64 *) qp->r_sge.sge.vaddr =
+                                qp->r_atomic_data + sdata;
+                else if (qp->r_atomic_data == wqe->wr.wr.atomic.compare_add)
+                        *(u64 *) qp->r_sge.sge.vaddr = sdata;
+                spin_unlock_irqrestore(&dev->pending_lock, flags);
+                *(u64 *) sqp->s_sge.sge.vaddr = qp->r_atomic_data;
+                goto send_comp;
+
+        default:
+                goto done;
+        }
+
+        sge = &sqp->s_sge.sge;
+        while (sqp->s_len) {
+                u32 len = sqp->s_len;
+
+                if (len > sge->length)
+                        len = sge->length;
+                BUG_ON(len == 0);
+                ipath_copy_sge(&qp->r_sge, sge->vaddr, len);
+                sge->vaddr += len;
+                sge->length -= len;
+                sge->sge_length -= len;
+                if (sge->sge_length == 0) {
+                        if (--sqp->s_sge.num_sge)
+                                *sge = *sqp->s_sge.sg_list++;
+                } else if (sge->length == 0 && sge->mr != NULL) {
+                        if (++sge->n >= IPATH_SEGSZ) {
+                                if (++sge->m >= sge->mr->mapsz)
+                                        break;
+                                sge->n = 0;
+                        }
+                        sge->vaddr =
+                                sge->mr->map[sge->m]->segs[sge->n].vaddr;
+                        sge->length =
+                                sge->mr->map[sge->m]->segs[sge->n].length;
+                }
+                sqp->s_len -= len;
+        }
+
+        if (wqe->wr.opcode == IB_WR_RDMA_WRITE ||
+            wqe->wr.opcode == IB_WR_RDMA_READ)
+                goto send_comp;
+
+        if (wqe->wr.opcode == IB_WR_RDMA_WRITE_WITH_IMM)
+                wc->opcode = IB_WC_RECV_RDMA_WITH_IMM;
+        else
+                wc->opcode = IB_WC_RECV;
+        wc->wr_id = qp->r_wr_id;
+        wc->status = IB_WC_SUCCESS;
+        wc->vendor_err = 0;
+        wc->byte_len = wqe->length;
+        wc->qp_num = qp->ibqp.qp_num;
+        wc->src_qp = qp->remote_qpn;
+        /* XXX do we know which pkey matched? Only needed for GSI. */
+        wc->pkey_index = 0;
+        wc->slid = qp->remote_ah_attr.dlid;
+        wc->sl = qp->remote_ah_attr.sl;
+        wc->dlid_path_bits = 0;
+        /* Signal completion event if the solicited bit is set. */
+        ipath_cq_enter(to_icq(qp->ibqp.recv_cq), wc,
+                       wqe->wr.send_flags & IB_SEND_SOLICITED);
+
+send_comp:
+        sqp->s_rnr_retry = sqp->s_rnr_retry_cnt;
+
+        if (!test_bit(IPATH_S_SIGNAL_REQ_WR, &sqp->s_flags) ||
+            (wqe->wr.send_flags & IB_SEND_SIGNALED)) {
+                wc->wr_id = wqe->wr.wr_id;
+                wc->status = IB_WC_SUCCESS;
+                wc->opcode = ib_ipath_wc_opcode[wqe->wr.opcode];
+                wc->vendor_err = 0;
+                wc->byte_len = wqe->length;
+                wc->qp_num = sqp->ibqp.qp_num;
+                wc->src_qp = 0;
+                wc->pkey_index = 0;
+                wc->slid = 0;
+                wc->sl = 0;
+                wc->dlid_path_bits = 0;
+                wc->port_num = 0;
+                ipath_cq_enter(to_icq(sqp->ibqp.send_cq), wc, 0);
+        }
+
+        /* Update s_last now that we are finished with the SWQE */
+        spin_lock_irqsave(&sqp->s_lock, flags);
+        if (++sqp->s_last >= sqp->s_size)
+                sqp->s_last = 0;
+        spin_unlock_irqrestore(&sqp->s_lock, flags);
+        goto again;
+
+done:
+        if (atomic_dec_and_test(&qp->refcount))
+                wake_up(&qp->wait);
+}
+
+/**
+ * ipath_no_bufs_available - tell the layer driver we need buffers
+ * @qp: the QP that caused the problem
+ * @dev: the device we ran out of buffers on
+ *
+ * Called when we run out of PIO buffers.
+ */
+void ipath_no_bufs_available(struct ipath_qp *qp, struct ipath_ibdev *dev)
+{
+        unsigned long flags;
+
+        spin_lock_irqsave(&dev->pending_lock, flags);
+        if (qp->piowait.next == LIST_POISON1)
+                list_add_tail(&qp->piowait, &dev->piowait);
+        spin_unlock_irqrestore(&dev->pending_lock, flags);
+        /*
+         * Note that as soon as ipath_layer_want_buffer() is called and
+         * possibly before it returns, ipath_ib_piobufavail()
+         * could be called.  If we are still in the tasklet function,
+         * tasklet_hi_schedule() will not call us until the next time
+         * tasklet_hi_schedule() is called.
+         * We clear the tasklet flag now since we are committing to return
+         * from the tasklet function.
+         */
+        clear_bit(IPATH_S_BUSY, &qp->s_flags);
+        tasklet_unlock(&qp->s_task);
+        ipath_layer_want_buffer(dev->dd);
+        dev->n_piowait++;
+}
+
+/**
+ * ipath_post_rc_send - post RC and UC sends
+ * @qp: the QP to post on
+ * @wr: the work request to send
+ */
+int ipath_post_rc_send(struct ipath_qp *qp, struct ib_send_wr *wr)
+{
+        struct ipath_swqe *wqe;
+        unsigned long flags;
+        u32 next;
+        int i, j;
+        int acc;
+        int ret;
+
+        /*
+         * Don't allow RDMA reads or atomic operations on UC or
+         * undefined operations.
+         * Make sure buffer is large enough to hold the result for atomics.
+         */
+        if (qp->ibqp.qp_type == IB_QPT_UC) {
+                if ((unsigned) wr->opcode >= IB_WR_RDMA_READ) {
+                        ret = -EINVAL;
+                        goto bail;
+                }
+        } else if ((unsigned) wr->opcode > IB_WR_ATOMIC_FETCH_AND_ADD) {
+                ret = -EINVAL;
+                goto bail;
+        } else if (wr->opcode >= IB_WR_ATOMIC_CMP_AND_SWP &&
+                   (wr->num_sge == 0 ||
+                    wr->sg_list[0].length < sizeof(u64) ||
+                    wr->sg_list[0].addr & (sizeof(u64) - 1))) {
+                ret = -EINVAL;
+                goto bail;
+        }
+        /* IB spec says that num_sge == 0 is OK. */
+        if (wr->num_sge > qp->s_max_sge) {
+                ret = -ENOMEM;
+                goto bail;
+        }
+        spin_lock_irqsave(&qp->s_lock, flags);
+        next = qp->s_head + 1;
+        if (next >= qp->s_size)
+                next = 0;
+        if (next == qp->s_last) {
+                spin_unlock_irqrestore(&qp->s_lock, flags);
+                ret = -EINVAL;
+                goto bail;
+        }
+
+        wqe = get_swqe_ptr(qp, qp->s_head);
+        wqe->wr = *wr;
+        wqe->ssn = qp->s_ssn++;
+        wqe->sg_list[0].mr = NULL;
+        wqe->sg_list[0].vaddr = NULL;
+        wqe->sg_list[0].length = 0;
+        wqe->sg_list[0].sge_length = 0;
+        wqe->length = 0;
+        acc = wr->opcode >= IB_WR_RDMA_READ ? IB_ACCESS_LOCAL_WRITE : 0;
+        for (i = 0, j = 0; i < wr->num_sge; i++) {
+                if (to_ipd(qp->ibqp.pd)->user && wr->sg_list[i].lkey == 0) {
+                        spin_unlock_irqrestore(&qp->s_lock, flags);
+                        ret = -EINVAL;
+                        goto bail;
+                }
+                if (wr->sg_list[i].length == 0)
+                        continue;
+                if (!ipath_lkey_ok(&to_idev(qp->ibqp.device)->lk_table,
+                                   &wqe->sg_list[j], &wr->sg_list[i],
+                                   acc)) {
+                        spin_unlock_irqrestore(&qp->s_lock, flags);
+                        ret = -EINVAL;
+                        goto bail;
+                }
+                wqe->length += wr->sg_list[i].length;
+                j++;
+        }
+        wqe->wr.num_sge = j;
+        qp->s_head = next;
+        /*
+         * Wake up the send tasklet if the QP is not waiting
+         * for an RNR timeout.
+         */
+        next = qp->s_rnr_timeout;
+        spin_unlock_irqrestore(&qp->s_lock, flags);
+
+        if (next == 0) {
+                if (qp->ibqp.qp_type == IB_QPT_UC)
+                        ipath_do_uc_send((unsigned long) qp);
+                else
+                        ipath_do_rc_send((unsigned long) qp);
+        }
+
+        ret = 0;
+
+bail:
+        return ret;
+}
diff --git a/drivers/infiniband/hw/ipath/ipath_srq.c b/drivers/infiniband/hw/ipath/ipath_srq.c
new file mode 100644
index 000000000000..01c4c6c56118
--- /dev/null
+++ b/drivers/infiniband/hw/ipath/ipath_srq.c
@@ -0,0 +1,273 @@
+/*
+ * Copyright (c) 2005, 2006 PathScale, Inc. All rights reserved.
+ *
+ * This software is available to you under a choice of one of two
+ * licenses.  You may choose to be licensed under the terms of the GNU
+ * General Public License (GPL) Version 2, available from the file
+ * COPYING in the main directory of this source tree, or the
+ * OpenIB.org BSD license below:
+ *
+ *     Redistribution and use in source and binary forms, with or
+ *     without modification, are permitted provided that the following
+ *     conditions are met:
+ *
+ *      - Redistributions of source code must retain the above
+ *        copyright notice, this list of conditions and the following
+ *        disclaimer.
+ *
+ *      - Redistributions in binary form must reproduce the above
+ *        copyright notice, this list of conditions and the following
+ *        disclaimer in the documentation and/or other materials
+ *        provided with the distribution.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+ * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+ * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+ * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
+ * BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
+ * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
+ * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+ * SOFTWARE.
+ */
+
+#include <linux/err.h>
+#include <linux/vmalloc.h>
+
+#include "ipath_verbs.h"
+
+/**
+ * ipath_post_srq_receive - post a receive on a shared receive queue
+ * @ibsrq: the SRQ to post the receive on
+ * @wr: the list of work requests to post
+ * @bad_wr: the first WR to cause a problem is put here
+ *
+ * This may be called from interrupt context.
+ */
+int ipath_post_srq_receive(struct ib_srq *ibsrq, struct ib_recv_wr *wr,
+                           struct ib_recv_wr **bad_wr)
+{
+        struct ipath_srq *srq = to_isrq(ibsrq);
+        struct ipath_ibdev *dev = to_idev(ibsrq->device);
+        unsigned long flags;
+        int ret;
+
+        for (; wr; wr = wr->next) {
+                struct ipath_rwqe *wqe;
+                u32 next;
+                int i, j;
+
+                if (wr->num_sge > srq->rq.max_sge) {
+                        *bad_wr = wr;
+                        ret = -ENOMEM;
+                        goto bail;
+                }
+
+                spin_lock_irqsave(&srq->rq.lock, flags);
+                next = srq->rq.head + 1;
+                if (next >= srq->rq.size)
+                        next = 0;
+                if (next == srq->rq.tail) {
+                        spin_unlock_irqrestore(&srq->rq.lock, flags);
+                        *bad_wr = wr;
+                        ret = -ENOMEM;
+                        goto bail;
+                }
+
+                wqe = get_rwqe_ptr(&srq->rq, srq->rq.head);
+                wqe->wr_id = wr->wr_id;
+                wqe->sg_list[0].mr = NULL;
+                wqe->sg_list[0].vaddr = NULL;
+                wqe->sg_list[0].length = 0;
+                wqe->sg_list[0].sge_length = 0;
+                wqe->length = 0;
+                for (i = 0, j = 0; i < wr->num_sge; i++) {
+                        /* Check LKEY */
+                        if (to_ipd(srq->ibsrq.pd)->user &&
+                            wr->sg_list[i].lkey == 0) {
+                                spin_unlock_irqrestore(&srq->rq.lock,
+                                                       flags);
+                                *bad_wr = wr;
+                                ret = -EINVAL;
+                                goto bail;
+                        }
+                        if (wr->sg_list[i].length == 0)
+                                continue;
+                        if (!ipath_lkey_ok(&dev->lk_table,
+                                           &wqe->sg_list[j],
+                                           &wr->sg_list[i],
+                                           IB_ACCESS_LOCAL_WRITE)) {
+                                spin_unlock_irqrestore(&srq->rq.lock,
+                                                       flags);
+                                *bad_wr = wr;
+                                ret = -EINVAL;
+                                goto bail;
+                        }
+                        wqe->length += wr->sg_list[i].length;
+                        j++;
+                }
+                wqe->num_sge = j;
+                srq->rq.head = next;
+                spin_unlock_irqrestore(&srq->rq.lock, flags);
+        }
+        ret = 0;
+
+bail:
+        return ret;
+}
+
+/**
+ * ipath_create_srq - create a shared receive queue
+ * @ibpd: the protection domain of the SRQ to create
+ * @attr: the attributes of the SRQ
+ * @udata: not used by the InfiniPath verbs driver
+ */
+struct ib_srq *ipath_create_srq(struct ib_pd *ibpd,
+                                struct ib_srq_init_attr *srq_init_attr,
+                                struct ib_udata *udata)
+{
+        struct ipath_srq *srq;
+        u32 sz;
+        struct ib_srq *ret;
+
+        if (srq_init_attr->attr.max_sge < 1) {
+                ret = ERR_PTR(-EINVAL);
+                goto bail;
+        }
+
+        srq = kmalloc(sizeof(*srq), GFP_KERNEL);
+        if (!srq) {
+                ret = ERR_PTR(-ENOMEM);
+                goto bail;
+        }
+
+        /*
+         * Need to use vmalloc() if we want to support large #s of entries.
+         */
+        srq->rq.size = srq_init_attr->attr.max_wr + 1;
+        sz = sizeof(struct ipath_sge) * srq_init_attr->attr.max_sge +
+                sizeof(struct ipath_rwqe);
+        srq->rq.wq = vmalloc(srq->rq.size * sz);
+        if (!srq->rq.wq) {
+                kfree(srq);
+                ret = ERR_PTR(-ENOMEM);
+                goto bail;
+        }
+
+        /*
+         * ib_create_srq() will initialize srq->ibsrq.
+         */
+        spin_lock_init(&srq->rq.lock);
+        srq->rq.head = 0;
+        srq->rq.tail = 0;
+        srq->rq.max_sge = srq_init_attr->attr.max_sge;
+        srq->limit = srq_init_attr->attr.srq_limit;
+
+        ret = &srq->ibsrq;
+
+bail:
+        return ret;
+}
+
+/**
+ * ipath_modify_srq - modify a shared receive queue
+ * @ibsrq: the SRQ to modify
+ * @attr: the new attributes of the SRQ
+ * @attr_mask: indicates which attributes to modify
+ */
+int ipath_modify_srq(struct ib_srq *ibsrq, struct ib_srq_attr *attr,
+                     enum ib_srq_attr_mask attr_mask)
+{
+        struct ipath_srq *srq = to_isrq(ibsrq);
+        unsigned long flags;
+        int ret;
+
+        if (attr_mask & IB_SRQ_LIMIT) {
+                spin_lock_irqsave(&srq->rq.lock, flags);
+                srq->limit = attr->srq_limit;
+                spin_unlock_irqrestore(&srq->rq.lock, flags);
+        }
+        if (attr_mask & IB_SRQ_MAX_WR) {
+                u32 size = attr->max_wr + 1;
+                struct ipath_rwqe *wq, *p;
+                u32 n;
+                u32 sz;
+
+                if (attr->max_sge < srq->rq.max_sge) {
+                        ret = -EINVAL;
+                        goto bail;
+                }
+
+                sz = sizeof(struct ipath_rwqe) +
+                        attr->max_sge * sizeof(struct ipath_sge);
+                wq = vmalloc(size * sz);
+                if (!wq) {
+                        ret = -ENOMEM;
+                        goto bail;
+                }
+
+                spin_lock_irqsave(&srq->rq.lock, flags);
+                if (srq->rq.head < srq->rq.tail)
+                        n = srq->rq.size + srq->rq.head - srq->rq.tail;
+                else
+                        n = srq->rq.head - srq->rq.tail;
+                if (size <= n || size <= srq->limit) {
+                        spin_unlock_irqrestore(&srq->rq.lock, flags);
+                        vfree(wq);
+                        ret = -EINVAL;
+                        goto bail;
+                }
+                n = 0;
+                p = wq;
+                while (srq->rq.tail != srq->rq.head) {
+                        struct ipath_rwqe *wqe;
+                        int i;
+
+                        wqe = get_rwqe_ptr(&srq->rq, srq->rq.tail);
+                        p->wr_id = wqe->wr_id;
+                        p->length = wqe->length;
+                        p->num_sge = wqe->num_sge;
+                        for (i = 0; i < wqe->num_sge; i++)
+                                p->sg_list[i] = wqe->sg_list[i];
+                        n++;
+                        p = (struct ipath_rwqe *)((char *) p + sz);
+                        if (++srq->rq.tail >= srq->rq.size)
+                                srq->rq.tail = 0;
+                }
+                vfree(srq->rq.wq);
+                srq->rq.wq = wq;
+                srq->rq.size = size;
+                srq->rq.head = n;
+                srq->rq.tail = 0;
+                srq->rq.max_sge = attr->max_sge;
+                spin_unlock_irqrestore(&srq->rq.lock, flags);
+        }
+
+        ret = 0;
+
+bail:
+        return ret;
+}
+
+int ipath_query_srq(struct ib_srq *ibsrq, struct ib_srq_attr *attr)
+{
+        struct ipath_srq *srq = to_isrq(ibsrq);
+
+        attr->max_wr = srq->rq.size - 1;
+        attr->max_sge = srq->rq.max_sge;
+        attr->srq_limit = srq->limit;
+        return 0;
+}
+
+/**
+ * ipath_destroy_srq - destroy a shared receive queue
+ * @ibsrq: the SRQ to destroy
+ */
+int ipath_destroy_srq(struct ib_srq *ibsrq)
+{
+        struct ipath_srq *srq = to_isrq(ibsrq);
+
+        vfree(srq->rq.wq);
+        kfree(srq);
+
+        return 0;
+}
diff --git a/drivers/infiniband/hw/ipath/ipath_stats.c b/drivers/infiniband/hw/ipath/ipath_stats.c
new file mode 100644
index 000000000000..fe209137ee74
--- /dev/null
+++ b/drivers/infiniband/hw/ipath/ipath_stats.c
@@ -0,0 +1,303 @@
+/*
+ * Copyright (c) 2003, 2004, 2005, 2006 PathScale, Inc. All rights reserved.
+ *
+ * This software is available to you under a choice of one of two
+ * licenses.  You may choose to be licensed under the terms of the GNU
+ * General Public License (GPL) Version 2, available from the file
+ * COPYING in the main directory of this source tree, or the
+ * OpenIB.org BSD license below:
+ *
+ *     Redistribution and use in source and binary forms, with or
+ *     without modification, are permitted provided that the following
+ *     conditions are met:
+ *
+ *      - Redistributions of source code must retain the above
+ *        copyright notice, this list of conditions and the following
+ *        disclaimer.
+ *
+ *      - Redistributions in binary form must reproduce the above
+ *        copyright notice, this list of conditions and the following
+ *        disclaimer in the documentation and/or other materials
+ *        provided with the distribution.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+ * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+ * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+ * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
+ * BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
+ * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
+ * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+ * SOFTWARE.
+ */
+
+#include <linux/pci.h>
+
+#include "ipath_kernel.h"
+
+struct infinipath_stats ipath_stats;
+
+/**
+ * ipath_snap_cntr - snapshot a chip counter
+ * @dd: the infinipath device
+ * @creg: the counter to snapshot
+ *
+ * called from add_timer and user counter read calls, to deal with
+ * counters that wrap in "human time".  The words sent and received, and
+ * the packets sent and received are all that we worry about.  For now,
+ * at least, we don't worry about error counters, because if they wrap
+ * that quickly, we probably don't care.  We may eventually just make this
+ * handle all the counters.  word counters can wrap in about 20 seconds
+ * of full bandwidth traffic, packet counters in a few hours.
+ */
+
+u64 ipath_snap_cntr(struct ipath_devdata *dd, ipath_creg creg)
+{
+        u32 val, reg64 = 0;
+        u64 val64;
+        unsigned long t0, t1;
+        u64 ret;
+
+        t0 = jiffies;
+        /* If fast increment counters are only 32 bits, snapshot them,
+         * and maintain them as 64bit values in the driver */
+        if (!(dd->ipath_flags & IPATH_32BITCOUNTERS) &&
+            (creg == dd->ipath_cregs->cr_wordsendcnt ||
+             creg == dd->ipath_cregs->cr_wordrcvcnt ||
+             creg == dd->ipath_cregs->cr_pktsendcnt ||
+             creg == dd->ipath_cregs->cr_pktrcvcnt)) {
+                val64 = ipath_read_creg(dd, creg);
+                val = val64 == ~0ULL ? ~0U : 0;
+                reg64 = 1;
+        } else                  /* val64 just to keep gcc quiet... */
+                val64 = val = ipath_read_creg32(dd, creg);
+        /*
+         * See if a second has passed.  This is just a way to detect things
+         * that are quite broken.  Normally this should take just a few
+         * cycles (the check is for long enough that we don't care if we get
+         * pre-empted.)  An Opteron HT O read timeout is 4 seconds with
+         * normal NB values
+         */
+        t1 = jiffies;
+        if (time_before(t0 + HZ, t1) && val == -1) {
+                ipath_dev_err(dd, "Error!  Read counter 0x%x timed out\n",
+                              creg);
+                ret = 0ULL;
+                goto bail;
+        }
+        if (reg64) {
+                ret = val64;
+                goto bail;
+        }
+
+        if (creg == dd->ipath_cregs->cr_wordsendcnt) {
+                if (val != dd->ipath_lastsword) {
+                        dd->ipath_sword += val - dd->ipath_lastsword;
+                        dd->ipath_lastsword = val;
+                }
+                val64 = dd->ipath_sword;
+        } else if (creg == dd->ipath_cregs->cr_wordrcvcnt) {
+                if (val != dd->ipath_lastrword) {
+                        dd->ipath_rword += val - dd->ipath_lastrword;
+                        dd->ipath_lastrword = val;
+                }
+                val64 = dd->ipath_rword;
+        } else if (creg == dd->ipath_cregs->cr_pktsendcnt) {
+                if (val != dd->ipath_lastspkts) {
+                        dd->ipath_spkts += val - dd->ipath_lastspkts;
+                        dd->ipath_lastspkts = val;
+                }
+                val64 = dd->ipath_spkts;
+        } else if (creg == dd->ipath_cregs->cr_pktrcvcnt) {
+                if (val != dd->ipath_lastrpkts) {
+                        dd->ipath_rpkts += val - dd->ipath_lastrpkts;
+                        dd->ipath_lastrpkts = val;
+                }
+                val64 = dd->ipath_rpkts;
+        } else
+                val64 = (u64) val;
+
+        ret = val64;
+
+bail:
+        return ret;
+}
+
+/**
+ * ipath_qcheck - print delta of egrfull/hdrqfull errors for kernel ports
+ * @dd: the infinipath device
+ *
+ * print the delta of egrfull/hdrqfull errors for kernel ports no more than
+ * every 5 seconds.  User processes are printed at close, but kernel doesn't
+ * close, so...  Separate routine so may call from other places someday, and
+ * so function name when printed by _IPATH_INFO is meaningfull
+ */
+static void ipath_qcheck(struct ipath_devdata *dd)
+{
+        static u64 last_tot_hdrqfull;
+        size_t blen = 0;
+        char buf[128];
+
+        *buf = 0;
+        if (dd->ipath_pd[0]->port_hdrqfull != dd->ipath_p0_hdrqfull) {
+                blen = snprintf(buf, sizeof buf, "port 0 hdrqfull %u",
+                                dd->ipath_pd[0]->port_hdrqfull -
+                                dd->ipath_p0_hdrqfull);
+                dd->ipath_p0_hdrqfull = dd->ipath_pd[0]->port_hdrqfull;
+        }
+        if (ipath_stats.sps_etidfull != dd->ipath_last_tidfull) {
+                blen += snprintf(buf + blen, sizeof buf - blen,
+                                 "%srcvegrfull %llu",
+                                 blen ? ", " : "",
+                                 (unsigned long long)
+                                 (ipath_stats.sps_etidfull -
+                                  dd->ipath_last_tidfull));
+                dd->ipath_last_tidfull = ipath_stats.sps_etidfull;
+        }
+
+        /*
+         * this is actually the number of hdrq full interrupts, not actual
+         * events, but at the moment that's mostly what I'm interested in.
+         * Actual count, etc. is in the counters, if needed.  For production
+         * users this won't ordinarily be printed.
+         */
+
+        if ((ipath_debug & (__IPATH_PKTDBG | __IPATH_DBG)) &&
+            ipath_stats.sps_hdrqfull != last_tot_hdrqfull) {
+                blen += snprintf(buf + blen, sizeof buf - blen,
+                                 "%shdrqfull %llu (all ports)",
+                                 blen ? ", " : "",
+                                 (unsigned long long)
+                                 (ipath_stats.sps_hdrqfull -
+                                  last_tot_hdrqfull));
+                last_tot_hdrqfull = ipath_stats.sps_hdrqfull;
+        }
+        if (blen)
+                ipath_dbg("%s\n", buf);
+
+        if (dd->ipath_port0head != (u32)
+            le64_to_cpu(*dd->ipath_hdrqtailptr)) {
+                if (dd->ipath_lastport0rcv_cnt ==
+                    ipath_stats.sps_port0pkts) {
+                        ipath_cdbg(PKT, "missing rcv interrupts? "
+                                   "port0 hd=%llx tl=%x; port0pkts %llx\n",
+                                   (unsigned long long)
+                                   le64_to_cpu(*dd->ipath_hdrqtailptr),
+                                   dd->ipath_port0head,
+                                   (unsigned long long)
+                                   ipath_stats.sps_port0pkts);
+                        ipath_kreceive(dd);
+                }
+                dd->ipath_lastport0rcv_cnt = ipath_stats.sps_port0pkts;
+        }
+}
+
+/**
+ * ipath_get_faststats - get word counters from chip before they overflow
+ * @opaque - contains a pointer to the infinipath device ipath_devdata
+ *
+ * called from add_timer
+ */
+void ipath_get_faststats(unsigned long opaque)
+{
+        struct ipath_devdata *dd = (struct ipath_devdata *) opaque;
+        u32 val;
+        static unsigned cnt;
+
+        /*
+         * don't access the chip while running diags, or memory diags can
+         * fail
+         */
+        if (!dd->ipath_kregbase || !(dd->ipath_flags & IPATH_PRESENT) ||
+            ipath_diag_inuse)
+                /* but re-arm the timer, for diags case; won't hurt other */
+                goto done;
+
+        if (dd->ipath_flags & IPATH_32BITCOUNTERS) {
+                ipath_snap_cntr(dd, dd->ipath_cregs->cr_wordsendcnt);
+                ipath_snap_cntr(dd, dd->ipath_cregs->cr_wordrcvcnt);
+                ipath_snap_cntr(dd, dd->ipath_cregs->cr_pktsendcnt);
+                ipath_snap_cntr(dd, dd->ipath_cregs->cr_pktrcvcnt);
+        }
+
+        ipath_qcheck(dd);
+
+        /*
+         * deal with repeat error suppression.  Doesn't really matter if
+         * last error was almost a full interval ago, or just a few usecs
+         * ago; still won't get more than 2 per interval.  We may want
+         * longer intervals for this eventually, could do with mod, counter
+         * or separate timer.  Also see code in ipath_handle_errors() and
+         * ipath_handle_hwerrors().
+         */
+
+        if (dd->ipath_lasterror)
+                dd->ipath_lasterror = 0;
+        if (dd->ipath_lasthwerror)
+                dd->ipath_lasthwerror = 0;
+        if ((dd->ipath_maskederrs & ~dd->ipath_ignorederrs)
+            && time_after(jiffies, dd->ipath_unmasktime)) {
+                char ebuf[256];
+                ipath_decode_err(ebuf, sizeof ebuf,
+                                 (dd->ipath_maskederrs & ~dd->
+                                  ipath_ignorederrs));
+                if ((dd->ipath_maskederrs & ~dd->ipath_ignorederrs) &
+                    ~(INFINIPATH_E_RRCVEGRFULL | INFINIPATH_E_RRCVHDRFULL))
+                        ipath_dev_err(dd, "Re-enabling masked errors "
+                                      "(%s)\n", ebuf);
+                else {
+                        /*
+                         * rcvegrfull and rcvhdrqfull are "normal", for some
+                         * types of processes (mostly benchmarks) that send
+                         * huge numbers of messages, while not processing
+                         * them.  So only complain about these at debug
+                         * level.
+                         */
+                        ipath_dbg("Disabling frequent queue full errors "
+                                  "(%s)\n", ebuf);
+                }
+                dd->ipath_maskederrs = dd->ipath_ignorederrs;
+                ipath_write_kreg(dd, dd->ipath_kregs->kr_errormask,
+                                 ~dd->ipath_maskederrs);
+        }
+
+        /* limit qfull messages to ~one per minute per port */
+        if ((++cnt & 0x10)) {
+                for (val = dd->ipath_cfgports - 1; ((int)val) >= 0;
+                     val--) {
+                        if (dd->ipath_lastegrheads[val] != -1)
+                                dd->ipath_lastegrheads[val] = -1;
+                        if (dd->ipath_lastrcvhdrqtails[val] != -1)
+                                dd->ipath_lastrcvhdrqtails[val] = -1;
+                }
+        }
+
+        if (dd->ipath_nosma_bufs) {
+                dd->ipath_nosma_secs += 5;
+                if (dd->ipath_nosma_secs >= 30) {
+                        ipath_cdbg(SMA, "No SMA bufs avail %u seconds; "
+                                   "cancelling pending sends\n",
+                                   dd->ipath_nosma_secs);
+                        /*
+                         * issue an abort as well, in case we have a packet
+                         * stuck in launch fifo.  This could corrupt an
+                         * outgoing user packet in the worst case,
+                         * but this is a pretty catastrophic, anyway.
+                         */
+                        ipath_write_kreg(dd, dd->ipath_kregs->kr_sendctrl,
+                                         INFINIPATH_S_ABORT);
+                        ipath_disarm_piobufs(dd, dd->ipath_lastport_piobuf,
+                                             dd->ipath_piobcnt2k +
+                                             dd->ipath_piobcnt4k -
+                                             dd->ipath_lastport_piobuf);
+                        /* start again, if necessary */
+                        dd->ipath_nosma_secs = 0;
+                } else
+                        ipath_cdbg(SMA, "No SMA bufs avail %u tries, "
+                                   "after %u seconds\n",
+                                   dd->ipath_nosma_bufs,
+                                   dd->ipath_nosma_secs);
+        }
+
+done:
+        mod_timer(&dd->ipath_stats_timer, jiffies + HZ * 5);
+}
diff --git a/drivers/infiniband/hw/ipath/ipath_sysfs.c b/drivers/infiniband/hw/ipath/ipath_sysfs.c
new file mode 100644
index 000000000000..32acd8048b49
--- /dev/null
+++ b/drivers/infiniband/hw/ipath/ipath_sysfs.c
@@ -0,0 +1,778 @@
+/*
+ * Copyright (c) 2006 PathScale, Inc. All rights reserved.
+ *
+ * This software is available to you under a choice of one of two
+ * licenses.  You may choose to be licensed under the terms of the GNU
+ * General Public License (GPL) Version 2, available from the file
+ * COPYING in the main directory of this source tree, or the
+ * OpenIB.org BSD license below:
+ *
+ *     Redistribution and use in source and binary forms, with or
+ *     without modification, are permitted provided that the following
+ *     conditions are met:
+ *
+ *      - Redistributions of source code must retain the above
+ *        copyright notice, this list of conditions and the following
+ *        disclaimer.
+ *
+ *      - Redistributions in binary form must reproduce the above
+ *        copyright notice, this list of conditions and the following
+ *        disclaimer in the documentation and/or other materials
+ *        provided with the distribution.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+ * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+ * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+ * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
+ * BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
+ * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
+ * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+ * SOFTWARE.
+ */
+
+#include <linux/ctype.h>
+#include <linux/pci.h>
+
+#include "ipath_kernel.h"
+#include "ips_common.h"
+#include "ipath_layer.h"
+
+/**
+ * ipath_parse_ushort - parse an unsigned short value in an arbitrary base
+ * @str: the string containing the number
+ * @valp: where to put the result
+ *
+ * returns the number of bytes consumed, or negative value on error
+ */
+int ipath_parse_ushort(const char *str, unsigned short *valp)
+{
+        unsigned long val;
+        char *end;
+        int ret;
+
+        if (!isdigit(str[0])) {
+                ret = -EINVAL;
+                goto bail;
+        }
+
+        val = simple_strtoul(str, &end, 0);
+
+        if (val > 0xffff) {
+                ret = -EINVAL;
+                goto bail;
+        }
+
+        *valp = val;
+
+        ret = end + 1 - str;
+        if (ret == 0)
+                ret = -EINVAL;
+
+bail:
+        return ret;
+}
+
+static ssize_t show_version(struct device_driver *dev, char *buf)
+{
+        /* The string printed here is already newline-terminated. */
+        return scnprintf(buf, PAGE_SIZE, "%s", ipath_core_version);
+}
+
+static ssize_t show_num_units(struct device_driver *dev, char *buf)
+{
+        return scnprintf(buf, PAGE_SIZE, "%d\n",
+                         ipath_count_units(NULL, NULL, NULL));
+}
+
+#define DRIVER_STAT(name, attr) \
+        static ssize_t show_stat_##name(struct device_driver *dev, \
+                                        char *buf) \
+        { \
+                return scnprintf( \
+                        buf, PAGE_SIZE, "%llu\n", \
+                        (unsigned long long) ipath_stats.sps_ ##attr); \
+        } \
+        static DRIVER_ATTR(name, S_IRUGO, show_stat_##name, NULL)
+
+DRIVER_STAT(intrs, ints);
+DRIVER_STAT(err_intrs, errints);
+DRIVER_STAT(errs, errs);
+DRIVER_STAT(pkt_errs, pkterrs);
+DRIVER_STAT(crc_errs, crcerrs);
+DRIVER_STAT(hw_errs, hwerrs);
+DRIVER_STAT(ib_link, iblink);
+DRIVER_STAT(port0_pkts, port0pkts);
+DRIVER_STAT(ether_spkts, ether_spkts);
+DRIVER_STAT(ether_rpkts, ether_rpkts);
+DRIVER_STAT(sma_spkts, sma_spkts);
+DRIVER_STAT(sma_rpkts, sma_rpkts);
+DRIVER_STAT(hdrq_full, hdrqfull);
+DRIVER_STAT(etid_full, etidfull);
+DRIVER_STAT(no_piobufs, nopiobufs);
+DRIVER_STAT(ports, ports);
+DRIVER_STAT(pkey0, pkeys[0]);
+DRIVER_STAT(pkey1, pkeys[1]);
+DRIVER_STAT(pkey2, pkeys[2]);
+DRIVER_STAT(pkey3, pkeys[3]);
+/* XXX fix the following when dynamic table of devices used */
+DRIVER_STAT(lid0, lid[0]);
+DRIVER_STAT(lid1, lid[1]);
+DRIVER_STAT(lid2, lid[2]);
+DRIVER_STAT(lid3, lid[3]);
+
+DRIVER_STAT(nports, nports);
+DRIVER_STAT(null_intr, nullintr);
+DRIVER_STAT(max_pkts_call, maxpkts_call);
+DRIVER_STAT(avg_pkts_call, avgpkts_call);
+DRIVER_STAT(page_locks, pagelocks);
+DRIVER_STAT(page_unlocks, pageunlocks);
+DRIVER_STAT(krdrops, krdrops);
+/* XXX fix the following when dynamic table of devices used */
+DRIVER_STAT(mlid0, mlid[0]);
+DRIVER_STAT(mlid1, mlid[1]);
+DRIVER_STAT(mlid2, mlid[2]);
+DRIVER_STAT(mlid3, mlid[3]);
+
+static struct attribute *driver_stat_attributes[] = {
+        &driver_attr_intrs.attr,
+        &driver_attr_err_intrs.attr,
+        &driver_attr_errs.attr,
+        &driver_attr_pkt_errs.attr,
+        &driver_attr_crc_errs.attr,
+        &driver_attr_hw_errs.attr,
+        &driver_attr_ib_link.attr,
+        &driver_attr_port0_pkts.attr,
+        &driver_attr_ether_spkts.attr,
+        &driver_attr_ether_rpkts.attr,
+        &driver_attr_sma_spkts.attr,
+        &driver_attr_sma_rpkts.attr,
+        &driver_attr_hdrq_full.attr,
+        &driver_attr_etid_full.attr,
+        &driver_attr_no_piobufs.attr,
+        &driver_attr_ports.attr,
+        &driver_attr_pkey0.attr,
+        &driver_attr_pkey1.attr,
+        &driver_attr_pkey2.attr,
+        &driver_attr_pkey3.attr,
+        &driver_attr_lid0.attr,
+        &driver_attr_lid1.attr,
+        &driver_attr_lid2.attr,
+        &driver_attr_lid3.attr,
+        &driver_attr_nports.attr,
+        &driver_attr_null_intr.attr,
+        &driver_attr_max_pkts_call.attr,
+        &driver_attr_avg_pkts_call.attr,
+        &driver_attr_page_locks.attr,
+        &driver_attr_page_unlocks.attr,
+        &driver_attr_krdrops.attr,
+        &driver_attr_mlid0.attr,
+        &driver_attr_mlid1.attr,
+        &driver_attr_mlid2.attr,
+        &driver_attr_mlid3.attr,
+        NULL
+};
+
+static struct attribute_group driver_stat_attr_group = {
+        .name = "stats",
+        .attrs = driver_stat_attributes
+};
+
+static ssize_t show_status(struct device *dev,
+                           struct device_attribute *attr,
+                           char *buf)
+{
+        struct ipath_devdata *dd = dev_get_drvdata(dev);
+        ssize_t ret;
+
+        if (!dd->ipath_statusp) {
+                ret = -EINVAL;
+                goto bail;
+        }
+
+        ret = scnprintf(buf, PAGE_SIZE, "0x%llx\n",
+                        (unsigned long long) *(dd->ipath_statusp));
+
+bail:
+        return ret;
+}
+
+static const char *ipath_status_str[] = {
+        "Initted",
+        "Disabled",
+        "Admin_Disabled",
+        "OIB_SMA",
+        "SMA",
+        "Present",
+        "IB_link_up",
+        "IB_configured",
+        "NoIBcable",
+        "Fatal_Hardware_Error",
+        NULL,
+};
+
+static ssize_t show_status_str(struct device *dev,
+                               struct device_attribute *attr,
+                               char *buf)
+{
+        struct ipath_devdata *dd = dev_get_drvdata(dev);
+        int i, any;
+        u64 s;
+        ssize_t ret;
+
+        if (!dd->ipath_statusp) {
+                ret = -EINVAL;
+                goto bail;
+        }
+
+        s = *(dd->ipath_statusp);
+        *buf = '\0';
+        for (any = i = 0; s && ipath_status_str[i]; i++) {
+                if (s & 1) {
+                        if (any && strlcat(buf, " ", PAGE_SIZE) >=
+                            PAGE_SIZE)
+                                /* overflow */
+                                break;
+                        if (strlcat(buf, ipath_status_str[i],
+                                    PAGE_SIZE) >= PAGE_SIZE)
+                                break;
+                        any = 1;
+                }
+                s >>= 1;
+        }
+        if (any)
+                strlcat(buf, "\n", PAGE_SIZE);
+
+        ret = strlen(buf);
+
+bail:
+        return ret;
+}
+
+static ssize_t show_boardversion(struct device *dev,
+                               struct device_attribute *attr,
+                               char *buf)
+{
+        struct ipath_devdata *dd = dev_get_drvdata(dev);
+        /* The string printed here is already newline-terminated. */
+        return scnprintf(buf, PAGE_SIZE, "%s", dd->ipath_boardversion);
+}
+
+static ssize_t show_lid(struct device *dev,
+                        struct device_attribute *attr,
+                        char *buf)
+{
+        struct ipath_devdata *dd = dev_get_drvdata(dev);
+
+        return scnprintf(buf, PAGE_SIZE, "0x%x\n", dd->ipath_lid);
+}
+
+static ssize_t store_lid(struct device *dev,
+                         struct device_attribute *attr,
+                          const char *buf,
+                          size_t count)
+{
+        struct ipath_devdata *dd = dev_get_drvdata(dev);
+        u16 lid;
+        int ret;
+
+        ret = ipath_parse_ushort(buf, &lid);
+        if (ret < 0)
+                goto invalid;
+
+        if (lid == 0 || lid >= 0xc000) {
+                ret = -EINVAL;
+                goto invalid;
+        }
+
+        ipath_set_sps_lid(dd, lid, 0);
+
+        goto bail;
+invalid:
+        ipath_dev_err(dd, "attempt to set invalid LID\n");
+bail:
+        return ret;
+}
+
+static ssize_t show_mlid(struct device *dev,
+                         struct device_attribute *attr,
+                         char *buf)
+{
+        struct ipath_devdata *dd = dev_get_drvdata(dev);
+
+        return scnprintf(buf, PAGE_SIZE, "0x%x\n", dd->ipath_mlid);
+}
+
+static ssize_t store_mlid(struct device *dev,
+                         struct device_attribute *attr,
+                          const char *buf,
+                          size_t count)
+{
+        struct ipath_devdata *dd = dev_get_drvdata(dev);
+        int unit;
+        u16 mlid;
+        int ret;
+
+        ret = ipath_parse_ushort(buf, &mlid);
+        if (ret < 0)
+                goto invalid;
+
+        unit = dd->ipath_unit;
+
+        dd->ipath_mlid = mlid;
+        ipath_stats.sps_mlid[unit] = mlid;
+        ipath_layer_intr(dd, IPATH_LAYER_INT_BCAST);
+
+        goto bail;
+invalid:
+        ipath_dev_err(dd, "attempt to set invalid MLID\n");
+bail:
+        return ret;
+}
+
+static ssize_t show_guid(struct device *dev,
+                         struct device_attribute *attr,
+                         char *buf)
+{
+        struct ipath_devdata *dd = dev_get_drvdata(dev);
+        u8 *guid;
+
+        guid = (u8 *) & (dd->ipath_guid);
+
+        return scnprintf(buf, PAGE_SIZE,
+                         "%02x:%02x:%02x:%02x:%02x:%02x:%02x:%02x\n",
+                         guid[0], guid[1], guid[2], guid[3],
+                         guid[4], guid[5], guid[6], guid[7]);
+}
+
+static ssize_t store_guid(struct device *dev,
+                         struct device_attribute *attr,
+                          const char *buf,
+                          size_t count)
+{
+        struct ipath_devdata *dd = dev_get_drvdata(dev);
+        ssize_t ret;
+        unsigned short guid[8];
+        __be64 nguid;
+        u8 *ng;
+        int i;
+
+        if (sscanf(buf, "%hx:%hx:%hx:%hx:%hx:%hx:%hx:%hx",
+                   &guid[0], &guid[1], &guid[2], &guid[3],
+                   &guid[4], &guid[5], &guid[6], &guid[7]) != 8)
+                goto invalid;
+
+        ng = (u8 *) &nguid;
+
+        for (i = 0; i < 8; i++) {
+                if (guid[i] > 0xff)
+                        goto invalid;
+                ng[i] = guid[i];
+        }
+
+        dd->ipath_guid = nguid;
+        dd->ipath_nguid = 1;
+
+        ret = strlen(buf);
+        goto bail;
+
+invalid:
+        ipath_dev_err(dd, "attempt to set invalid GUID\n");
+        ret = -EINVAL;
+
+bail:
+        return ret;
+}
+
+static ssize_t show_nguid(struct device *dev,
+                          struct device_attribute *attr,
+                          char *buf)
+{
+        struct ipath_devdata *dd = dev_get_drvdata(dev);
+
+        return scnprintf(buf, PAGE_SIZE, "%u\n", dd->ipath_nguid);
+}
+
+static ssize_t show_serial(struct device *dev,
+                           struct device_attribute *attr,
+                           char *buf)
+{
+        struct ipath_devdata *dd = dev_get_drvdata(dev);
+
+        buf[sizeof dd->ipath_serial] = '\0';
+        memcpy(buf, dd->ipath_serial, sizeof dd->ipath_serial);
+        strcat(buf, "\n");
+        return strlen(buf);
+}
+
+static ssize_t show_unit(struct device *dev,
+                         struct device_attribute *attr,
+                         char *buf)
+{
+        struct ipath_devdata *dd = dev_get_drvdata(dev);
+
+        return scnprintf(buf, PAGE_SIZE, "%u\n", dd->ipath_unit);
+}
+
+#define DEVICE_COUNTER(name, attr) \
+        static ssize_t show_counter_##name(struct device *dev, \
+                                           struct device_attribute *attr, \
+                                           char *buf) \
+        { \
+                struct ipath_devdata *dd = dev_get_drvdata(dev); \
+                return scnprintf(\
+                        buf, PAGE_SIZE, "%llu\n", (unsigned long long) \
+                        ipath_snap_cntr( \
+                                dd, offsetof(struct infinipath_counters, \
+                                             attr) / sizeof(u64)));     \
+        } \
+        static DEVICE_ATTR(name, S_IRUGO, show_counter_##name, NULL);
+
+DEVICE_COUNTER(ib_link_downeds, IBLinkDownedCnt);
+DEVICE_COUNTER(ib_link_err_recoveries, IBLinkErrRecoveryCnt);
+DEVICE_COUNTER(ib_status_changes, IBStatusChangeCnt);
+DEVICE_COUNTER(ib_symbol_errs, IBSymbolErrCnt);
+DEVICE_COUNTER(lb_flow_stalls, LBFlowStallCnt);
+DEVICE_COUNTER(lb_ints, LBIntCnt);
+DEVICE_COUNTER(rx_bad_formats, RxBadFormatCnt);
+DEVICE_COUNTER(rx_buf_ovfls, RxBufOvflCnt);
+DEVICE_COUNTER(rx_data_pkts, RxDataPktCnt);
+DEVICE_COUNTER(rx_dropped_pkts, RxDroppedPktCnt);
+DEVICE_COUNTER(rx_dwords, RxDwordCnt);
+DEVICE_COUNTER(rx_ebps, RxEBPCnt);
+DEVICE_COUNTER(rx_flow_ctrl_errs, RxFlowCtrlErrCnt);
+DEVICE_COUNTER(rx_flow_pkts, RxFlowPktCnt);
+DEVICE_COUNTER(rx_icrc_errs, RxICRCErrCnt);
+DEVICE_COUNTER(rx_len_errs, RxLenErrCnt);
+DEVICE_COUNTER(rx_link_problems, RxLinkProblemCnt);
+DEVICE_COUNTER(rx_lpcrc_errs, RxLPCRCErrCnt);
+DEVICE_COUNTER(rx_max_min_len_errs, RxMaxMinLenErrCnt);
+DEVICE_COUNTER(rx_p0_hdr_egr_ovfls, RxP0HdrEgrOvflCnt);
+DEVICE_COUNTER(rx_p1_hdr_egr_ovfls, RxP1HdrEgrOvflCnt);
+DEVICE_COUNTER(rx_p2_hdr_egr_ovfls, RxP2HdrEgrOvflCnt);
+DEVICE_COUNTER(rx_p3_hdr_egr_ovfls, RxP3HdrEgrOvflCnt);
+DEVICE_COUNTER(rx_p4_hdr_egr_ovfls, RxP4HdrEgrOvflCnt);
+DEVICE_COUNTER(rx_p5_hdr_egr_ovfls, RxP5HdrEgrOvflCnt);
+DEVICE_COUNTER(rx_p6_hdr_egr_ovfls, RxP6HdrEgrOvflCnt);
+DEVICE_COUNTER(rx_p7_hdr_egr_ovfls, RxP7HdrEgrOvflCnt);
+DEVICE_COUNTER(rx_p8_hdr_egr_ovfls, RxP8HdrEgrOvflCnt);
+DEVICE_COUNTER(rx_pkey_mismatches, RxPKeyMismatchCnt);
+DEVICE_COUNTER(rx_tid_full_errs, RxTIDFullErrCnt);
+DEVICE_COUNTER(rx_tid_valid_errs, RxTIDValidErrCnt);
+DEVICE_COUNTER(rx_vcrc_errs, RxVCRCErrCnt);
+DEVICE_COUNTER(tx_data_pkts, TxDataPktCnt);
+DEVICE_COUNTER(tx_dropped_pkts, TxDroppedPktCnt);
+DEVICE_COUNTER(tx_dwords, TxDwordCnt);
+DEVICE_COUNTER(tx_flow_pkts, TxFlowPktCnt);
+DEVICE_COUNTER(tx_flow_stalls, TxFlowStallCnt);
+DEVICE_COUNTER(tx_len_errs, TxLenErrCnt);
+DEVICE_COUNTER(tx_max_min_len_errs, TxMaxMinLenErrCnt);
+DEVICE_COUNTER(tx_underruns, TxUnderrunCnt);
+DEVICE_COUNTER(tx_unsup_vl_errs, TxUnsupVLErrCnt);
+
+static struct attribute *dev_counter_attributes[] = {
+        &dev_attr_ib_link_downeds.attr,
+        &dev_attr_ib_link_err_recoveries.attr,
+        &dev_attr_ib_status_changes.attr,
+        &dev_attr_ib_symbol_errs.attr,
+        &dev_attr_lb_flow_stalls.attr,
+        &dev_attr_lb_ints.attr,
+        &dev_attr_rx_bad_formats.attr,
+        &dev_attr_rx_buf_ovfls.attr,
+        &dev_attr_rx_data_pkts.attr,
+        &dev_attr_rx_dropped_pkts.attr,
+        &dev_attr_rx_dwords.attr,
+        &dev_attr_rx_ebps.attr,
+        &dev_attr_rx_flow_ctrl_errs.attr,
+        &dev_attr_rx_flow_pkts.attr,
+        &dev_attr_rx_icrc_errs.attr,
+        &dev_attr_rx_len_errs.attr,
+        &dev_attr_rx_link_problems.attr,
+        &dev_attr_rx_lpcrc_errs.attr,
+        &dev_attr_rx_max_min_len_errs.attr,
+        &dev_attr_rx_p0_hdr_egr_ovfls.attr,
+        &dev_attr_rx_p1_hdr_egr_ovfls.attr,
+        &dev_attr_rx_p2_hdr_egr_ovfls.attr,
+        &dev_attr_rx_p3_hdr_egr_ovfls.attr,
+        &dev_attr_rx_p4_hdr_egr_ovfls.attr,
+        &dev_attr_rx_p5_hdr_egr_ovfls.attr,
+        &dev_attr_rx_p6_hdr_egr_ovfls.attr,
+        &dev_attr_rx_p7_hdr_egr_ovfls.attr,
+        &dev_attr_rx_p8_hdr_egr_ovfls.attr,
+        &dev_attr_rx_pkey_mismatches.attr,
+        &dev_attr_rx_tid_full_errs.attr,
+        &dev_attr_rx_tid_valid_errs.attr,
+        &dev_attr_rx_vcrc_errs.attr,
+        &dev_attr_tx_data_pkts.attr,
+        &dev_attr_tx_dropped_pkts.attr,
+        &dev_attr_tx_dwords.attr,
+        &dev_attr_tx_flow_pkts.attr,
+        &dev_attr_tx_flow_stalls.attr,
+        &dev_attr_tx_len_errs.attr,
+        &dev_attr_tx_max_min_len_errs.attr,
+        &dev_attr_tx_underruns.attr,
+        &dev_attr_tx_unsup_vl_errs.attr,
+        NULL
+};
+
+static struct attribute_group dev_counter_attr_group = {
+        .name = "counters",
+        .attrs = dev_counter_attributes
+};
+
+static ssize_t store_reset(struct device *dev,
+                         struct device_attribute *attr,
+                          const char *buf,
+                          size_t count)
+{
+        struct ipath_devdata *dd = dev_get_drvdata(dev);
+        int ret;
+
+        if (count < 5 || memcmp(buf, "reset", 5)) {
+                ret = -EINVAL;
+                goto bail;
+        }
+
+        if (dd->ipath_flags & IPATH_DISABLED) {
+                /*
+                 * post-reset init would re-enable interrupts, etc.
+                 * so don't allow reset on disabled devices.  Not
+                 * perfect error, but about the best choice.
+                 */
+                dev_info(dev,"Unit %d is disabled, can't reset\n",
+                         dd->ipath_unit);
+                ret = -EINVAL;
+        }
+        ret = ipath_reset_device(dd->ipath_unit);
+bail:
+        return ret<0 ? ret : count;
+}
+
+static ssize_t store_link_state(struct device *dev,
+                         struct device_attribute *attr,
+                          const char *buf,
+                          size_t count)
+{
+        struct ipath_devdata *dd = dev_get_drvdata(dev);
+        int ret, r;
+        u16 state;
+
+        ret = ipath_parse_ushort(buf, &state);
+        if (ret < 0)
+                goto invalid;
+
+        r = ipath_layer_set_linkstate(dd, state);
+        if (r < 0) {
+                ret = r;
+                goto bail;
+        }
+
+        goto bail;
+invalid:
+        ipath_dev_err(dd, "attempt to set invalid link state\n");
+bail:
+        return ret;
+}
+
+static ssize_t show_mtu(struct device *dev,
+                         struct device_attribute *attr,
+                         char *buf)
+{
+        struct ipath_devdata *dd = dev_get_drvdata(dev);
+        return scnprintf(buf, PAGE_SIZE, "%u\n", dd->ipath_ibmtu);
+}
+
+static ssize_t store_mtu(struct device *dev,
+                         struct device_attribute *attr,
+                          const char *buf,
+                          size_t count)
+{
+        struct ipath_devdata *dd = dev_get_drvdata(dev);
+        ssize_t ret;
+        u16 mtu = 0;
+        int r;
+
+        ret = ipath_parse_ushort(buf, &mtu);
+        if (ret < 0)
+                goto invalid;
+
+        r = ipath_layer_set_mtu(dd, mtu);
+        if (r < 0)
+                ret = r;
+
+        goto bail;
+invalid:
+        ipath_dev_err(dd, "attempt to set invalid MTU\n");
+bail:
+        return ret;
+}
+
+static ssize_t show_enabled(struct device *dev,
+                         struct device_attribute *attr,
+                         char *buf)
+{
+        struct ipath_devdata *dd = dev_get_drvdata(dev);
+        return scnprintf(buf, PAGE_SIZE, "%u\n",
+                         (dd->ipath_flags & IPATH_DISABLED) ? 0 : 1);
+}
+
+static ssize_t store_enabled(struct device *dev,
+                         struct device_attribute *attr,
+                          const char *buf,
+                          size_t count)
+{
+        struct ipath_devdata *dd = dev_get_drvdata(dev);
+        ssize_t ret;
+        u16 enable = 0;
+
+        ret = ipath_parse_ushort(buf, &enable);
+        if (ret < 0) {
+                ipath_dev_err(dd, "attempt to use non-numeric on enable\n");
+                goto bail;
+        }
+
+        if (enable) {
+                if (!(dd->ipath_flags & IPATH_DISABLED))
+                        goto bail;
+
+                dev_info(dev, "Enabling unit %d\n", dd->ipath_unit);
+                /* same as post-reset */
+                ret = ipath_init_chip(dd, 1);
+                if (ret)
+                        ipath_dev_err(dd, "Failed to enable unit %d\n",
+                                      dd->ipath_unit);
+                else {
+                        dd->ipath_flags &= ~IPATH_DISABLED;
+                        *dd->ipath_statusp &= ~IPATH_STATUS_ADMIN_DISABLED;
+                }
+        }
+        else if (!(dd->ipath_flags & IPATH_DISABLED)) {
+                dev_info(dev, "Disabling unit %d\n", dd->ipath_unit);
+                ipath_shutdown_device(dd);
+                dd->ipath_flags |= IPATH_DISABLED;
+                *dd->ipath_statusp |= IPATH_STATUS_ADMIN_DISABLED;
+        }
+
+bail:
+        return ret;
+}
+
+static DRIVER_ATTR(num_units, S_IRUGO, show_num_units, NULL);
+static DRIVER_ATTR(version, S_IRUGO, show_version, NULL);
+
+static struct attribute *driver_attributes[] = {
+        &driver_attr_num_units.attr,
+        &driver_attr_version.attr,
+        NULL
+};
+
+static struct attribute_group driver_attr_group = {
+        .attrs = driver_attributes
+};
+
+static DEVICE_ATTR(guid, S_IWUSR | S_IRUGO, show_guid, store_guid);
+static DEVICE_ATTR(lid, S_IWUSR | S_IRUGO, show_lid, store_lid);
+static DEVICE_ATTR(link_state, S_IWUSR, NULL, store_link_state);
+static DEVICE_ATTR(mlid, S_IWUSR | S_IRUGO, show_mlid, store_mlid);
+static DEVICE_ATTR(mtu, S_IWUSR | S_IRUGO, show_mtu, store_mtu);
+static DEVICE_ATTR(enabled, S_IWUSR | S_IRUGO, show_enabled, store_enabled);
+static DEVICE_ATTR(nguid, S_IRUGO, show_nguid, NULL);
+static DEVICE_ATTR(reset, S_IWUSR, NULL, store_reset);
+static DEVICE_ATTR(serial, S_IRUGO, show_serial, NULL);
+static DEVICE_ATTR(status, S_IRUGO, show_status, NULL);
+static DEVICE_ATTR(status_str, S_IRUGO, show_status_str, NULL);
+static DEVICE_ATTR(boardversion, S_IRUGO, show_boardversion, NULL);
+static DEVICE_ATTR(unit, S_IRUGO, show_unit, NULL);
+
+static struct attribute *dev_attributes[] = {
+        &dev_attr_guid.attr,
+        &dev_attr_lid.attr,
+        &dev_attr_link_state.attr,
+        &dev_attr_mlid.attr,
+        &dev_attr_mtu.attr,
+        &dev_attr_nguid.attr,
+        &dev_attr_serial.attr,
+        &dev_attr_status.attr,
+        &dev_attr_status_str.attr,
+        &dev_attr_boardversion.attr,
+        &dev_attr_unit.attr,
+        &dev_attr_enabled.attr,
+        NULL
+};
+
+static struct attribute_group dev_attr_group = {
+        .attrs = dev_attributes
+};
+
+/**
+ * ipath_expose_reset - create a device reset file
+ * @dev: the device structure
+ *
+ * Only expose a file that lets us reset the device after someone
+ * enters diag mode.  A device reset is quite likely to crash the
+ * machine entirely, so we don't want to normally make it
+ * available.
+ */
+int ipath_expose_reset(struct device *dev)
+{
+        return device_create_file(dev, &dev_attr_reset);
+}
+
+int ipath_driver_create_group(struct device_driver *drv)
+{
+        int ret;
+
+        ret = sysfs_create_group(&drv->kobj, &driver_attr_group);
+        if (ret)
+                goto bail;
+
+        ret = sysfs_create_group(&drv->kobj, &driver_stat_attr_group);
+        if (ret)
+                sysfs_remove_group(&drv->kobj, &driver_attr_group);
+
+bail:
+        return ret;
+}
+
+void ipath_driver_remove_group(struct device_driver *drv)
+{
+        sysfs_remove_group(&drv->kobj, &driver_stat_attr_group);
+        sysfs_remove_group(&drv->kobj, &driver_attr_group);
+}
+
+int ipath_device_create_group(struct device *dev, struct ipath_devdata *dd)
+{
+        int ret;
+        char unit[5];
+
+        ret = sysfs_create_group(&dev->kobj, &dev_attr_group);
+        if (ret)
+                goto bail;
+
+        ret = sysfs_create_group(&dev->kobj, &dev_counter_attr_group);
+        if (ret)
+                goto bail_attrs;
+
+        snprintf(unit, sizeof(unit), "%02d", dd->ipath_unit);
+        ret = sysfs_create_link(&dev->driver->kobj, &dev->kobj, unit);
+        if (ret == 0)
+                goto bail;
+
+        sysfs_remove_group(&dev->kobj, &dev_counter_attr_group);
+bail_attrs:
+        sysfs_remove_group(&dev->kobj, &dev_attr_group);
+bail:
+        return ret;
+}
+
+void ipath_device_remove_group(struct device *dev, struct ipath_devdata *dd)
+{
+        char unit[5];
+
+        snprintf(unit, sizeof(unit), "%02d", dd->ipath_unit);
+        sysfs_remove_link(&dev->driver->kobj, unit);
+
+        sysfs_remove_group(&dev->kobj, &dev_counter_attr_group);
+        sysfs_remove_group(&dev->kobj, &dev_attr_group);
+
+        device_remove_file(dev, &dev_attr_reset);
+}
diff --git a/drivers/infiniband/hw/ipath/ipath_uc.c b/drivers/infiniband/hw/ipath/ipath_uc.c
new file mode 100644
index 000000000000..0d6dbc0a541e
--- /dev/null
+++ b/drivers/infiniband/hw/ipath/ipath_uc.c
@@ -0,0 +1,645 @@
+/*
+ * Copyright (c) 2005, 2006 PathScale, Inc. All rights reserved.
+ *
+ * This software is available to you under a choice of one of two
+ * licenses.  You may choose to be licensed under the terms of the GNU
+ * General Public License (GPL) Version 2, available from the file
+ * COPYING in the main directory of this source tree, or the
+ * OpenIB.org BSD license below:
+ *
+ *     Redistribution and use in source and binary forms, with or
+ *     without modification, are permitted provided that the following
+ *     conditions are met:
+ *
+ *      - Redistributions of source code must retain the above
+ *        copyright notice, this list of conditions and the following
+ *        disclaimer.
+ *
+ *      - Redistributions in binary form must reproduce the above
+ *        copyright notice, this list of conditions and the following
+ *        disclaimer in the documentation and/or other materials
+ *        provided with the distribution.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+ * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+ * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+ * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
+ * BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
+ * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
+ * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+ * SOFTWARE.
+ */
+
+#include "ipath_verbs.h"
+#include "ips_common.h"
+
+/* cut down ridiculously long IB macro names */
+#define OP(x) IB_OPCODE_UC_##x
+
+static void complete_last_send(struct ipath_qp *qp, struct ipath_swqe *wqe,
+                               struct ib_wc *wc)
+{
+        if (++qp->s_last == qp->s_size)
+                qp->s_last = 0;
+        if (!test_bit(IPATH_S_SIGNAL_REQ_WR, &qp->s_flags) ||
+            (wqe->wr.send_flags & IB_SEND_SIGNALED)) {
+                wc->wr_id = wqe->wr.wr_id;
+                wc->status = IB_WC_SUCCESS;
+                wc->opcode = ib_ipath_wc_opcode[wqe->wr.opcode];
+                wc->vendor_err = 0;
+                wc->byte_len = wqe->length;
+                wc->qp_num = qp->ibqp.qp_num;
+                wc->src_qp = qp->remote_qpn;
+                wc->pkey_index = 0;
+                wc->slid = qp->remote_ah_attr.dlid;
+                wc->sl = qp->remote_ah_attr.sl;
+                wc->dlid_path_bits = 0;
+                wc->port_num = 0;
+                ipath_cq_enter(to_icq(qp->ibqp.send_cq), wc, 0);
+        }
+        wqe = get_swqe_ptr(qp, qp->s_last);
+}
+
+/**
+ * ipath_do_uc_send - do a send on a UC queue
+ * @data: contains a pointer to the QP to send on
+ *
+ * Process entries in the send work queue until the queue is exhausted.
+ * Only allow one CPU to send a packet per QP (tasklet).
+ * Otherwise, after we drop the QP lock, two threads could send
+ * packets out of order.
+ * This is similar to ipath_do_rc_send() below except we don't have
+ * timeouts or resends.
+ */
+void ipath_do_uc_send(unsigned long data)
+{
+        struct ipath_qp *qp = (struct ipath_qp *)data;
+        struct ipath_ibdev *dev = to_idev(qp->ibqp.device);
+        struct ipath_swqe *wqe;
+        unsigned long flags;
+        u16 lrh0;
+        u32 hwords;
+        u32 nwords;
+        u32 extra_bytes;
+        u32 bth0;
+        u32 bth2;
+        u32 pmtu = ib_mtu_enum_to_int(qp->path_mtu);
+        u32 len;
+        struct ipath_other_headers *ohdr;
+        struct ib_wc wc;
+
+        if (test_and_set_bit(IPATH_S_BUSY, &qp->s_flags))
+                goto bail;
+
+        if (unlikely(qp->remote_ah_attr.dlid ==
+                     ipath_layer_get_lid(dev->dd))) {
+                /* Pass in an uninitialized ib_wc to save stack space. */
+                ipath_ruc_loopback(qp, &wc);
+                clear_bit(IPATH_S_BUSY, &qp->s_flags);
+                goto bail;
+        }
+
+        ohdr = &qp->s_hdr.u.oth;
+        if (qp->remote_ah_attr.ah_flags & IB_AH_GRH)
+                ohdr = &qp->s_hdr.u.l.oth;
+
+again:
+        /* Check for a constructed packet to be sent. */
+        if (qp->s_hdrwords != 0) {
+                        /*
+                         * If no PIO bufs are available, return.
+                         * An interrupt will call ipath_ib_piobufavail()
+                         * when one is available.
+                         */
+                        if (ipath_verbs_send(dev->dd, qp->s_hdrwords,
+                                             (u32 *) &qp->s_hdr,
+                                             qp->s_cur_size,
+                                             qp->s_cur_sge)) {
+                                ipath_no_bufs_available(qp, dev);
+                                goto bail;
+                        }
+                        dev->n_unicast_xmit++;
+                /* Record that we sent the packet and s_hdr is empty. */
+                qp->s_hdrwords = 0;
+        }
+
+        lrh0 = IPS_LRH_BTH;
+        /* header size in 32-bit words LRH+BTH = (8+12)/4. */
+        hwords = 5;
+
+        /*
+         * The lock is needed to synchronize between
+         * setting qp->s_ack_state and post_send().
+         */
+        spin_lock_irqsave(&qp->s_lock, flags);
+
+        if (!(ib_ipath_state_ops[qp->state] & IPATH_PROCESS_SEND_OK))
+                goto done;
+
+        bth0 = ipath_layer_get_pkey(dev->dd, qp->s_pkey_index);
+
+        /* Send a request. */
+        wqe = get_swqe_ptr(qp, qp->s_last);
+        switch (qp->s_state) {
+        default:
+                /*
+                 * Signal the completion of the last send (if there is
+                 * one).
+                 */
+                if (qp->s_last != qp->s_tail)
+                        complete_last_send(qp, wqe, &wc);
+
+                /* Check if send work queue is empty. */
+                if (qp->s_tail == qp->s_head)
+                        goto done;
+                /*
+                 * Start a new request.
+                 */
+                qp->s_psn = wqe->psn = qp->s_next_psn;
+                qp->s_sge.sge = wqe->sg_list[0];
+                qp->s_sge.sg_list = wqe->sg_list + 1;
+                qp->s_sge.num_sge = wqe->wr.num_sge;
+                qp->s_len = len = wqe->length;
+                switch (wqe->wr.opcode) {
+                case IB_WR_SEND:
+                case IB_WR_SEND_WITH_IMM:
+                        if (len > pmtu) {
+                                qp->s_state = OP(SEND_FIRST);
+                                len = pmtu;
+                                break;
+                        }
+                        if (wqe->wr.opcode == IB_WR_SEND)
+                                qp->s_state = OP(SEND_ONLY);
+                        else {
+                                qp->s_state =
+                                        OP(SEND_ONLY_WITH_IMMEDIATE);
+                                /* Immediate data comes after the BTH */
+                                ohdr->u.imm_data = wqe->wr.imm_data;
+                                hwords += 1;
+                        }
+                        if (wqe->wr.send_flags & IB_SEND_SOLICITED)
+                                bth0 |= 1 << 23;
+                        break;
+
+                case IB_WR_RDMA_WRITE:
+                case IB_WR_RDMA_WRITE_WITH_IMM:
+                        ohdr->u.rc.reth.vaddr =
+                                cpu_to_be64(wqe->wr.wr.rdma.remote_addr);
+                        ohdr->u.rc.reth.rkey =
+                                cpu_to_be32(wqe->wr.wr.rdma.rkey);
+                        ohdr->u.rc.reth.length = cpu_to_be32(len);
+                        hwords += sizeof(struct ib_reth) / 4;
+                        if (len > pmtu) {
+                                qp->s_state = OP(RDMA_WRITE_FIRST);
+                                len = pmtu;
+                                break;
+                        }
+                        if (wqe->wr.opcode == IB_WR_RDMA_WRITE)
+                                qp->s_state = OP(RDMA_WRITE_ONLY);
+                        else {
+                                qp->s_state =
+                                        OP(RDMA_WRITE_ONLY_WITH_IMMEDIATE);
+                                /* Immediate data comes after the RETH */
+                                ohdr->u.rc.imm_data = wqe->wr.imm_data;
+                                hwords += 1;
+                                if (wqe->wr.send_flags & IB_SEND_SOLICITED)
+                                        bth0 |= 1 << 23;
+                        }
+                        break;
+
+                default:
+                        goto done;
+                }
+                if (++qp->s_tail >= qp->s_size)
+                        qp->s_tail = 0;
+                break;
+
+        case OP(SEND_FIRST):
+                qp->s_state = OP(SEND_MIDDLE);
+                /* FALLTHROUGH */
+        case OP(SEND_MIDDLE):
+                len = qp->s_len;
+                if (len > pmtu) {
+                        len = pmtu;
+                        break;
+                }
+                if (wqe->wr.opcode == IB_WR_SEND)
+                        qp->s_state = OP(SEND_LAST);
+                else {
+                        qp->s_state = OP(SEND_LAST_WITH_IMMEDIATE);
+                        /* Immediate data comes after the BTH */
+                        ohdr->u.imm_data = wqe->wr.imm_data;
+                        hwords += 1;
+                }
+                if (wqe->wr.send_flags & IB_SEND_SOLICITED)
+                        bth0 |= 1 << 23;
+                break;
+
+        case OP(RDMA_WRITE_FIRST):
+                qp->s_state = OP(RDMA_WRITE_MIDDLE);
+                /* FALLTHROUGH */
+        case OP(RDMA_WRITE_MIDDLE):
+                len = qp->s_len;
+                if (len > pmtu) {
+                        len = pmtu;
+                        break;
+                }
+                if (wqe->wr.opcode == IB_WR_RDMA_WRITE)
+                        qp->s_state = OP(RDMA_WRITE_LAST);
+                else {
+                        qp->s_state =
+                                OP(RDMA_WRITE_LAST_WITH_IMMEDIATE);
+                        /* Immediate data comes after the BTH */
+                        ohdr->u.imm_data = wqe->wr.imm_data;
+                        hwords += 1;
+                        if (wqe->wr.send_flags & IB_SEND_SOLICITED)
+                                bth0 |= 1 << 23;
+                }
+                break;
+        }
+        bth2 = qp->s_next_psn++ & IPS_PSN_MASK;
+        qp->s_len -= len;
+        bth0 |= qp->s_state << 24;
+
+        spin_unlock_irqrestore(&qp->s_lock, flags);
+
+        /* Construct the header. */
+        extra_bytes = (4 - len) & 3;
+        nwords = (len + extra_bytes) >> 2;
+        if (unlikely(qp->remote_ah_attr.ah_flags & IB_AH_GRH)) {
+                /* Header size in 32-bit words. */
+                hwords += 10;
+                lrh0 = IPS_LRH_GRH;
+                qp->s_hdr.u.l.grh.version_tclass_flow =
+                        cpu_to_be32((6 << 28) |
+                                    (qp->remote_ah_attr.grh.traffic_class
+                                     << 20) |
+                                    qp->remote_ah_attr.grh.flow_label);
+                qp->s_hdr.u.l.grh.paylen =
+                        cpu_to_be16(((hwords - 12) + nwords +
+                                     SIZE_OF_CRC) << 2);
+                /* next_hdr is defined by C8-7 in ch. 8.4.1 */
+                qp->s_hdr.u.l.grh.next_hdr = 0x1B;
+                qp->s_hdr.u.l.grh.hop_limit =
+                        qp->remote_ah_attr.grh.hop_limit;
+                /* The SGID is 32-bit aligned. */
+                qp->s_hdr.u.l.grh.sgid.global.subnet_prefix =
+                        dev->gid_prefix;
+                qp->s_hdr.u.l.grh.sgid.global.interface_id =
+                        ipath_layer_get_guid(dev->dd);
+                qp->s_hdr.u.l.grh.dgid = qp->remote_ah_attr.grh.dgid;
+        }
+        qp->s_hdrwords = hwords;
+        qp->s_cur_sge = &qp->s_sge;
+        qp->s_cur_size = len;
+        lrh0 |= qp->remote_ah_attr.sl << 4;
+        qp->s_hdr.lrh[0] = cpu_to_be16(lrh0);
+        /* DEST LID */
+        qp->s_hdr.lrh[1] = cpu_to_be16(qp->remote_ah_attr.dlid);
+        qp->s_hdr.lrh[2] = cpu_to_be16(hwords + nwords + SIZE_OF_CRC);
+        qp->s_hdr.lrh[3] = cpu_to_be16(ipath_layer_get_lid(dev->dd));
+        bth0 |= extra_bytes << 20;
+        ohdr->bth[0] = cpu_to_be32(bth0);
+        ohdr->bth[1] = cpu_to_be32(qp->remote_qpn);
+        ohdr->bth[2] = cpu_to_be32(bth2);
+
+        /* Check for more work to do. */
+        goto again;
+
+done:
+        spin_unlock_irqrestore(&qp->s_lock, flags);
+        clear_bit(IPATH_S_BUSY, &qp->s_flags);
+
+bail:
+        return;
+}
+
+/**
+ * ipath_uc_rcv - handle an incoming UC packet
+ * @dev: the device the packet came in on
+ * @hdr: the header of the packet
+ * @has_grh: true if the packet has a GRH
+ * @data: the packet data
+ * @tlen: the length of the packet
+ * @qp: the QP for this packet.
+ *
+ * This is called from ipath_qp_rcv() to process an incoming UC packet
+ * for the given QP.
+ * Called at interrupt level.
+ */
+void ipath_uc_rcv(struct ipath_ibdev *dev, struct ipath_ib_header *hdr,
+                  int has_grh, void *data, u32 tlen, struct ipath_qp *qp)
+{
+        struct ipath_other_headers *ohdr;
+        int opcode;
+        u32 hdrsize;
+        u32 psn;
+        u32 pad;
+        unsigned long flags;
+        struct ib_wc wc;
+        u32 pmtu = ib_mtu_enum_to_int(qp->path_mtu);
+        struct ib_reth *reth;
+        int header_in_data;
+
+        /* Check for GRH */
+        if (!has_grh) {
+                ohdr = &hdr->u.oth;
+                hdrsize = 8 + 12;       /* LRH + BTH */
+                psn = be32_to_cpu(ohdr->bth[2]);
+                header_in_data = 0;
+        } else {
+                ohdr = &hdr->u.l.oth;
+                hdrsize = 8 + 40 + 12;  /* LRH + GRH + BTH */
+                /*
+                 * The header with GRH is 60 bytes and the
+                 * core driver sets the eager header buffer
+                 * size to 56 bytes so the last 4 bytes of
+                 * the BTH header (PSN) is in the data buffer.
+                 */
+                header_in_data =
+                        ipath_layer_get_rcvhdrentsize(dev->dd) == 16;
+                if (header_in_data) {
+                        psn = be32_to_cpu(((__be32 *) data)[0]);
+                        data += sizeof(__be32);
+                } else
+                        psn = be32_to_cpu(ohdr->bth[2]);
+        }
+        /*
+         * The opcode is in the low byte when its in network order
+         * (top byte when in host order).
+         */
+        opcode = be32_to_cpu(ohdr->bth[0]) >> 24;
+
+        wc.imm_data = 0;
+        wc.wc_flags = 0;
+
+        spin_lock_irqsave(&qp->r_rq.lock, flags);
+
+        /* Compare the PSN verses the expected PSN. */
+        if (unlikely(ipath_cmp24(psn, qp->r_psn) != 0)) {
+                /*
+                 * Handle a sequence error.
+                 * Silently drop any current message.
+                 */
+                qp->r_psn = psn;
+        inv:
+                qp->r_state = OP(SEND_LAST);
+                switch (opcode) {
+                case OP(SEND_FIRST):
+                case OP(SEND_ONLY):
+                case OP(SEND_ONLY_WITH_IMMEDIATE):
+                        goto send_first;
+
+                case OP(RDMA_WRITE_FIRST):
+                case OP(RDMA_WRITE_ONLY):
+                case OP(RDMA_WRITE_ONLY_WITH_IMMEDIATE):
+                        goto rdma_first;
+
+                default:
+                        dev->n_pkt_drops++;
+                        goto done;
+                }
+        }
+
+        /* Check for opcode sequence errors. */
+        switch (qp->r_state) {
+        case OP(SEND_FIRST):
+        case OP(SEND_MIDDLE):
+                if (opcode == OP(SEND_MIDDLE) ||
+                    opcode == OP(SEND_LAST) ||
+                    opcode == OP(SEND_LAST_WITH_IMMEDIATE))
+                        break;
+                goto inv;
+
+        case OP(RDMA_WRITE_FIRST):
+        case OP(RDMA_WRITE_MIDDLE):
+                if (opcode == OP(RDMA_WRITE_MIDDLE) ||
+                    opcode == OP(RDMA_WRITE_LAST) ||
+                    opcode == OP(RDMA_WRITE_LAST_WITH_IMMEDIATE))
+                        break;
+                goto inv;
+
+        default:
+                if (opcode == OP(SEND_FIRST) ||
+                    opcode == OP(SEND_ONLY) ||
+                    opcode == OP(SEND_ONLY_WITH_IMMEDIATE) ||
+                    opcode == OP(RDMA_WRITE_FIRST) ||
+                    opcode == OP(RDMA_WRITE_ONLY) ||
+                    opcode == OP(RDMA_WRITE_ONLY_WITH_IMMEDIATE))
+                        break;
+                goto inv;
+        }
+
+        /* OK, process the packet. */
+        switch (opcode) {
+        case OP(SEND_FIRST):
+        case OP(SEND_ONLY):
+        case OP(SEND_ONLY_WITH_IMMEDIATE):
+        send_first:
+                if (qp->r_reuse_sge) {
+                        qp->r_reuse_sge = 0;
+                        qp->r_sge = qp->s_rdma_sge;
+                } else if (!ipath_get_rwqe(qp, 0)) {
+                        dev->n_pkt_drops++;
+                        goto done;
+                }
+                /* Save the WQE so we can reuse it in case of an error. */
+                qp->s_rdma_sge = qp->r_sge;
+                qp->r_rcv_len = 0;
+                if (opcode == OP(SEND_ONLY))
+                        goto send_last;
+                else if (opcode == OP(SEND_ONLY_WITH_IMMEDIATE))
+                        goto send_last_imm;
+                /* FALLTHROUGH */
+        case OP(SEND_MIDDLE):
+                /* Check for invalid length PMTU or posted rwqe len. */
+                if (unlikely(tlen != (hdrsize + pmtu + 4))) {
+                        qp->r_reuse_sge = 1;
+                        dev->n_pkt_drops++;
+                        goto done;
+                }
+                qp->r_rcv_len += pmtu;
+                if (unlikely(qp->r_rcv_len > qp->r_len)) {
+                        qp->r_reuse_sge = 1;
+                        dev->n_pkt_drops++;
+                        goto done;
+                }
+                ipath_copy_sge(&qp->r_sge, data, pmtu);
+                break;
+
+        case OP(SEND_LAST_WITH_IMMEDIATE):
+        send_last_imm:
+                if (header_in_data) {
+                        wc.imm_data = *(__be32 *) data;
+                        data += sizeof(__be32);
+                } else {
+                        /* Immediate data comes after BTH */
+                        wc.imm_data = ohdr->u.imm_data;
+                }
+                hdrsize += 4;
+                wc.wc_flags = IB_WC_WITH_IMM;
+                /* FALLTHROUGH */
+        case OP(SEND_LAST):
+        send_last:
+                /* Get the number of bytes the message was padded by. */
+                pad = (be32_to_cpu(ohdr->bth[0]) >> 20) & 3;
+                /* Check for invalid length. */
+                /* XXX LAST len should be >= 1 */
+                if (unlikely(tlen < (hdrsize + pad + 4))) {
+                        qp->r_reuse_sge = 1;
+                        dev->n_pkt_drops++;
+                        goto done;
+                }
+                /* Don't count the CRC. */
+                tlen -= (hdrsize + pad + 4);
+                wc.byte_len = tlen + qp->r_rcv_len;
+                if (unlikely(wc.byte_len > qp->r_len)) {
+                        qp->r_reuse_sge = 1;
+                        dev->n_pkt_drops++;
+                        goto done;
+                }
+                /* XXX Need to free SGEs */
+        last_imm:
+                ipath_copy_sge(&qp->r_sge, data, tlen);
+                wc.wr_id = qp->r_wr_id;
+                wc.status = IB_WC_SUCCESS;
+                wc.opcode = IB_WC_RECV;
+                wc.vendor_err = 0;
+                wc.qp_num = qp->ibqp.qp_num;
+                wc.src_qp = qp->remote_qpn;
+                wc.pkey_index = 0;
+                wc.slid = qp->remote_ah_attr.dlid;
+                wc.sl = qp->remote_ah_attr.sl;
+                wc.dlid_path_bits = 0;
+                wc.port_num = 0;
+                /* Signal completion event if the solicited bit is set. */
+                ipath_cq_enter(to_icq(qp->ibqp.recv_cq), &wc,
+                               (ohdr->bth[0] &
+                                __constant_cpu_to_be32(1 << 23)) != 0);
+                break;
+
+        case OP(RDMA_WRITE_FIRST):
+        case OP(RDMA_WRITE_ONLY):
+        case OP(RDMA_WRITE_ONLY_WITH_IMMEDIATE): /* consume RWQE */
+        rdma_first:
+                /* RETH comes after BTH */
+                if (!header_in_data)
+                        reth = &ohdr->u.rc.reth;
+                else {
+                        reth = (struct ib_reth *)data;
+                        data += sizeof(*reth);
+                }
+                hdrsize += sizeof(*reth);
+                qp->r_len = be32_to_cpu(reth->length);
+                qp->r_rcv_len = 0;
+                if (qp->r_len != 0) {
+                        u32 rkey = be32_to_cpu(reth->rkey);
+                        u64 vaddr = be64_to_cpu(reth->vaddr);
+
+                        /* Check rkey */
+                        if (unlikely(!ipath_rkey_ok(
+                                             dev, &qp->r_sge, qp->r_len,
+                                             vaddr, rkey,
+                                             IB_ACCESS_REMOTE_WRITE))) {
+                                dev->n_pkt_drops++;
+                                goto done;
+                        }
+                } else {
+                        qp->r_sge.sg_list = NULL;
+                        qp->r_sge.sge.mr = NULL;
+                        qp->r_sge.sge.vaddr = NULL;
+                        qp->r_sge.sge.length = 0;
+                        qp->r_sge.sge.sge_length = 0;
+                }
+                if (unlikely(!(qp->qp_access_flags &
+                               IB_ACCESS_REMOTE_WRITE))) {
+                        dev->n_pkt_drops++;
+                        goto done;
+                }
+                if (opcode == OP(RDMA_WRITE_ONLY))
+                        goto rdma_last;
+                else if (opcode ==
+                         OP(RDMA_WRITE_ONLY_WITH_IMMEDIATE))
+                        goto rdma_last_imm;
+                /* FALLTHROUGH */
+        case OP(RDMA_WRITE_MIDDLE):
+                /* Check for invalid length PMTU or posted rwqe len. */
+                if (unlikely(tlen != (hdrsize + pmtu + 4))) {
+                        dev->n_pkt_drops++;
+                        goto done;
+                }
+                qp->r_rcv_len += pmtu;
+                if (unlikely(qp->r_rcv_len > qp->r_len)) {
+                        dev->n_pkt_drops++;
+                        goto done;
+                }
+                ipath_copy_sge(&qp->r_sge, data, pmtu);
+                break;
+
+        case OP(RDMA_WRITE_LAST_WITH_IMMEDIATE):
+        rdma_last_imm:
+                /* Get the number of bytes the message was padded by. */
+                pad = (be32_to_cpu(ohdr->bth[0]) >> 20) & 3;
+                /* Check for invalid length. */
+                /* XXX LAST len should be >= 1 */
+                if (unlikely(tlen < (hdrsize + pad + 4))) {
+                        dev->n_pkt_drops++;
+                        goto done;
+                }
+                /* Don't count the CRC. */
+                tlen -= (hdrsize + pad + 4);
+                if (unlikely(tlen + qp->r_rcv_len != qp->r_len)) {
+                        dev->n_pkt_drops++;
+                        goto done;
+                }
+                if (qp->r_reuse_sge) {
+                        qp->r_reuse_sge = 0;
+                } else if (!ipath_get_rwqe(qp, 1)) {
+                        dev->n_pkt_drops++;
+                        goto done;
+                }
+                if (header_in_data) {
+                        wc.imm_data = *(__be32 *) data;
+                        data += sizeof(__be32);
+                } else {
+                        /* Immediate data comes after BTH */
+                        wc.imm_data = ohdr->u.imm_data;
+                }
+                hdrsize += 4;
+                wc.wc_flags = IB_WC_WITH_IMM;
+                wc.byte_len = 0;
+                goto last_imm;
+
+        case OP(RDMA_WRITE_LAST):
+        rdma_last:
+                /* Get the number of bytes the message was padded by. */
+                pad = (be32_to_cpu(ohdr->bth[0]) >> 20) & 3;
+                /* Check for invalid length. */
+                /* XXX LAST len should be >= 1 */
+                if (unlikely(tlen < (hdrsize + pad + 4))) {
+                        dev->n_pkt_drops++;
+                        goto done;
+                }
+                /* Don't count the CRC. */
+                tlen -= (hdrsize + pad + 4);
+                if (unlikely(tlen + qp->r_rcv_len != qp->r_len)) {
+                        dev->n_pkt_drops++;
+                        goto done;
+                }
+                ipath_copy_sge(&qp->r_sge, data, tlen);
+                break;
+
+        default:
+                /* Drop packet for unknown opcodes. */
+                spin_unlock_irqrestore(&qp->r_rq.lock, flags);
+                dev->n_pkt_drops++;
+                goto bail;
+        }
+        qp->r_psn++;
+        qp->r_state = opcode;
+done:
+        spin_unlock_irqrestore(&qp->r_rq.lock, flags);
+
+bail:
+        return;
+}
diff --git a/drivers/infiniband/hw/ipath/ipath_ud.c b/drivers/infiniband/hw/ipath/ipath_ud.c
new file mode 100644
index 000000000000..5ff3de6128b2
--- /dev/null
+++ b/drivers/infiniband/hw/ipath/ipath_ud.c
@@ -0,0 +1,621 @@
+/*
+ * Copyright (c) 2005, 2006 PathScale, Inc. All rights reserved.
+ *
+ * This software is available to you under a choice of one of two
+ * licenses.  You may choose to be licensed under the terms of the GNU
+ * General Public License (GPL) Version 2, available from the file
+ * COPYING in the main directory of this source tree, or the
+ * OpenIB.org BSD license below:
+ *
+ *     Redistribution and use in source and binary forms, with or
+ *     without modification, are permitted provided that the following
+ *     conditions are met:
+ *
+ *      - Redistributions of source code must retain the above
+ *        copyright notice, this list of conditions and the following
+ *        disclaimer.
+ *
+ *      - Redistributions in binary form must reproduce the above
+ *        copyright notice, this list of conditions and the following
+ *        disclaimer in the documentation and/or other materials
+ *        provided with the distribution.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+ * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+ * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+ * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
+ * BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
+ * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
+ * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+ * SOFTWARE.
+ */
+
+#include <rdma/ib_smi.h>
+
+#include "ipath_verbs.h"
+#include "ips_common.h"
+
+/**
+ * ipath_ud_loopback - handle send on loopback QPs
+ * @sqp: the QP
+ * @ss: the SGE state
+ * @length: the length of the data to send
+ * @wr: the work request
+ * @wc: the work completion entry
+ *
+ * This is called from ipath_post_ud_send() to forward a WQE addressed
+ * to the same HCA.
+ */
+void ipath_ud_loopback(struct ipath_qp *sqp, struct ipath_sge_state *ss,
+                       u32 length, struct ib_send_wr *wr, struct ib_wc *wc)
+{
+        struct ipath_ibdev *dev = to_idev(sqp->ibqp.device);
+        struct ipath_qp *qp;
+        struct ib_ah_attr *ah_attr;
+        unsigned long flags;
+        struct ipath_rq *rq;
+        struct ipath_srq *srq;
+        struct ipath_sge_state rsge;
+        struct ipath_sge *sge;
+        struct ipath_rwqe *wqe;
+
+        qp = ipath_lookup_qpn(&dev->qp_table, wr->wr.ud.remote_qpn);
+        if (!qp)
+                return;
+
+        /*
+         * Check that the qkey matches (except for QP0, see 9.6.1.4.1).
+         * Qkeys with the high order bit set mean use the
+         * qkey from the QP context instead of the WR (see 10.2.5).
+         */
+        if (unlikely(qp->ibqp.qp_num &&
+                     ((int) wr->wr.ud.remote_qkey < 0
+                      ? qp->qkey : wr->wr.ud.remote_qkey) != qp->qkey)) {
+                /* XXX OK to lose a count once in a while. */
+                dev->qkey_violations++;
+                dev->n_pkt_drops++;
+                goto done;
+        }
+
+        /*
+         * A GRH is expected to preceed the data even if not
+         * present on the wire.
+         */
+        wc->byte_len = length + sizeof(struct ib_grh);
+
+        if (wr->opcode == IB_WR_SEND_WITH_IMM) {
+                wc->wc_flags = IB_WC_WITH_IMM;
+                wc->imm_data = wr->imm_data;
+        } else {
+                wc->wc_flags = 0;
+                wc->imm_data = 0;
+        }
+
+        /*
+         * Get the next work request entry to find where to put the data.
+         * Note that it is safe to drop the lock after changing rq->tail
+         * since ipath_post_receive() won't fill the empty slot.
+         */
+        if (qp->ibqp.srq) {
+                srq = to_isrq(qp->ibqp.srq);
+                rq = &srq->rq;
+        } else {
+                srq = NULL;
+                rq = &qp->r_rq;
+        }
+        spin_lock_irqsave(&rq->lock, flags);
+        if (rq->tail == rq->head) {
+                spin_unlock_irqrestore(&rq->lock, flags);
+                dev->n_pkt_drops++;
+                goto done;
+        }
+        /* Silently drop packets which are too big. */
+        wqe = get_rwqe_ptr(rq, rq->tail);
+        if (wc->byte_len > wqe->length) {
+                spin_unlock_irqrestore(&rq->lock, flags);
+                dev->n_pkt_drops++;
+                goto done;
+        }
+        wc->wr_id = wqe->wr_id;
+        rsge.sge = wqe->sg_list[0];
+        rsge.sg_list = wqe->sg_list + 1;
+        rsge.num_sge = wqe->num_sge;
+        if (++rq->tail >= rq->size)
+                rq->tail = 0;
+        if (srq && srq->ibsrq.event_handler) {
+                u32 n;
+
+                if (rq->head < rq->tail)
+                        n = rq->size + rq->head - rq->tail;
+                else
+                        n = rq->head - rq->tail;
+                if (n < srq->limit) {
+                        struct ib_event ev;
+
+                        srq->limit = 0;
+                        spin_unlock_irqrestore(&rq->lock, flags);
+                        ev.device = qp->ibqp.device;
+                        ev.element.srq = qp->ibqp.srq;
+                        ev.event = IB_EVENT_SRQ_LIMIT_REACHED;
+                        srq->ibsrq.event_handler(&ev,
+                                                 srq->ibsrq.srq_context);
+                } else
+                        spin_unlock_irqrestore(&rq->lock, flags);
+        } else
+                spin_unlock_irqrestore(&rq->lock, flags);
+        ah_attr = &to_iah(wr->wr.ud.ah)->attr;
+        if (ah_attr->ah_flags & IB_AH_GRH) {
+                ipath_copy_sge(&rsge, &ah_attr->grh, sizeof(struct ib_grh));
+                wc->wc_flags |= IB_WC_GRH;
+        } else
+                ipath_skip_sge(&rsge, sizeof(struct ib_grh));
+        sge = &ss->sge;
+        while (length) {
+                u32 len = sge->length;
+
+                if (len > length)
+                        len = length;
+                BUG_ON(len == 0);
+                ipath_copy_sge(&rsge, sge->vaddr, len);
+                sge->vaddr += len;
+                sge->length -= len;
+                sge->sge_length -= len;
+                if (sge->sge_length == 0) {
+                        if (--ss->num_sge)
+                                *sge = *ss->sg_list++;
+                } else if (sge->length == 0 && sge->mr != NULL) {
+                        if (++sge->n >= IPATH_SEGSZ) {
+                                if (++sge->m >= sge->mr->mapsz)
+                                        break;
+                                sge->n = 0;
+                        }
+                        sge->vaddr =
+                                sge->mr->map[sge->m]->segs[sge->n].vaddr;
+                        sge->length =
+                                sge->mr->map[sge->m]->segs[sge->n].length;
+                }
+                length -= len;
+        }
+        wc->status = IB_WC_SUCCESS;
+        wc->opcode = IB_WC_RECV;
+        wc->vendor_err = 0;
+        wc->qp_num = qp->ibqp.qp_num;
+        wc->src_qp = sqp->ibqp.qp_num;
+        /* XXX do we know which pkey matched? Only needed for GSI. */
+        wc->pkey_index = 0;
+        wc->slid = ipath_layer_get_lid(dev->dd) |
+                (ah_attr->src_path_bits &
+                 ((1 << (dev->mkeyprot_resv_lmc & 7)) - 1));
+        wc->sl = ah_attr->sl;
+        wc->dlid_path_bits =
+                ah_attr->dlid & ((1 << (dev->mkeyprot_resv_lmc & 7)) - 1);
+        /* Signal completion event if the solicited bit is set. */
+        ipath_cq_enter(to_icq(qp->ibqp.recv_cq), wc,
+                       wr->send_flags & IB_SEND_SOLICITED);
+
+done:
+        if (atomic_dec_and_test(&qp->refcount))
+                wake_up(&qp->wait);
+}
+
+/**
+ * ipath_post_ud_send - post a UD send on QP
+ * @qp: the QP
+ * @wr: the work request
+ *
+ * Note that we actually send the data as it is posted instead of putting
+ * the request into a ring buffer.  If we wanted to use a ring buffer,
+ * we would need to save a reference to the destination address in the SWQE.
+ */
+int ipath_post_ud_send(struct ipath_qp *qp, struct ib_send_wr *wr)
+{
+        struct ipath_ibdev *dev = to_idev(qp->ibqp.device);
+        struct ipath_other_headers *ohdr;
+        struct ib_ah_attr *ah_attr;
+        struct ipath_sge_state ss;
+        struct ipath_sge *sg_list;
+        struct ib_wc wc;
+        u32 hwords;
+        u32 nwords;
+        u32 len;
+        u32 extra_bytes;
+        u32 bth0;
+        u16 lrh0;
+        u16 lid;
+        int i;
+        int ret;
+
+        if (!(ib_ipath_state_ops[qp->state] & IPATH_PROCESS_SEND_OK)) {
+                ret = 0;
+                goto bail;
+        }
+
+        /* IB spec says that num_sge == 0 is OK. */
+        if (wr->num_sge > qp->s_max_sge) {
+                ret = -EINVAL;
+                goto bail;
+        }
+
+        if (wr->num_sge > 1) {
+                sg_list = kmalloc((qp->s_max_sge - 1) * sizeof(*sg_list),
+                                  GFP_ATOMIC);
+                if (!sg_list) {
+                        ret = -ENOMEM;
+                        goto bail;
+                }
+        } else
+                sg_list = NULL;
+
+        /* Check the buffer to send. */
+        ss.sg_list = sg_list;
+        ss.sge.mr = NULL;
+        ss.sge.vaddr = NULL;
+        ss.sge.length = 0;
+        ss.sge.sge_length = 0;
+        ss.num_sge = 0;
+        len = 0;
+        for (i = 0; i < wr->num_sge; i++) {
+                /* Check LKEY */
+                if (to_ipd(qp->ibqp.pd)->user && wr->sg_list[i].lkey == 0) {
+                        ret = -EINVAL;
+                        goto bail;
+                }
+
+                if (wr->sg_list[i].length == 0)
+                        continue;
+                if (!ipath_lkey_ok(&dev->lk_table, ss.num_sge ?
+                                   sg_list + ss.num_sge - 1 : &ss.sge,
+                                   &wr->sg_list[i], 0)) {
+                        ret = -EINVAL;
+                        goto bail;
+                }
+                len += wr->sg_list[i].length;
+                ss.num_sge++;
+        }
+        extra_bytes = (4 - len) & 3;
+        nwords = (len + extra_bytes) >> 2;
+
+        /* Construct the header. */
+        ah_attr = &to_iah(wr->wr.ud.ah)->attr;
+        if (ah_attr->dlid == 0) {
+                ret = -EINVAL;
+                goto bail;
+        }
+        if (ah_attr->dlid >= IPS_MULTICAST_LID_BASE) {
+                if (ah_attr->dlid != IPS_PERMISSIVE_LID)
+                        dev->n_multicast_xmit++;
+                else
+                        dev->n_unicast_xmit++;
+        } else {
+                dev->n_unicast_xmit++;
+                lid = ah_attr->dlid &
+                        ~((1 << (dev->mkeyprot_resv_lmc & 7)) - 1);
+                if (unlikely(lid == ipath_layer_get_lid(dev->dd))) {
+                        /*
+                         * Pass in an uninitialized ib_wc to save stack
+                         * space.
+                         */
+                        ipath_ud_loopback(qp, &ss, len, wr, &wc);
+                        goto done;
+                }
+        }
+        if (ah_attr->ah_flags & IB_AH_GRH) {
+                /* Header size in 32-bit words. */
+                hwords = 17;
+                lrh0 = IPS_LRH_GRH;
+                ohdr = &qp->s_hdr.u.l.oth;
+                qp->s_hdr.u.l.grh.version_tclass_flow =
+                        cpu_to_be32((6 << 28) |
+                                    (ah_attr->grh.traffic_class << 20) |
+                                    ah_attr->grh.flow_label);
+                qp->s_hdr.u.l.grh.paylen =
+                        cpu_to_be16(((wr->opcode ==
+                                      IB_WR_SEND_WITH_IMM ? 6 : 5) +
+                                     nwords + SIZE_OF_CRC) << 2);
+                /* next_hdr is defined by C8-7 in ch. 8.4.1 */
+                qp->s_hdr.u.l.grh.next_hdr = 0x1B;
+                qp->s_hdr.u.l.grh.hop_limit = ah_attr->grh.hop_limit;
+                /* The SGID is 32-bit aligned. */
+                qp->s_hdr.u.l.grh.sgid.global.subnet_prefix =
+                        dev->gid_prefix;
+                qp->s_hdr.u.l.grh.sgid.global.interface_id =
+                        ipath_layer_get_guid(dev->dd);
+                qp->s_hdr.u.l.grh.dgid = ah_attr->grh.dgid;
+                /*
+                 * Don't worry about sending to locally attached multicast
+                 * QPs.  It is unspecified by the spec. what happens.
+                 */
+        } else {
+                /* Header size in 32-bit words. */
+                hwords = 7;
+                lrh0 = IPS_LRH_BTH;
+                ohdr = &qp->s_hdr.u.oth;
+        }
+        if (wr->opcode == IB_WR_SEND_WITH_IMM) {
+                ohdr->u.ud.imm_data = wr->imm_data;
+                wc.imm_data = wr->imm_data;
+                hwords += 1;
+                bth0 = IB_OPCODE_UD_SEND_ONLY_WITH_IMMEDIATE << 24;
+        } else if (wr->opcode == IB_WR_SEND) {
+                wc.imm_data = 0;
+                bth0 = IB_OPCODE_UD_SEND_ONLY << 24;
+        } else {
+                ret = -EINVAL;
+                goto bail;
+        }
+        lrh0 |= ah_attr->sl << 4;
+        if (qp->ibqp.qp_type == IB_QPT_SMI)
+                lrh0 |= 0xF000; /* Set VL (see ch. 13.5.3.1) */
+        qp->s_hdr.lrh[0] = cpu_to_be16(lrh0);
+        qp->s_hdr.lrh[1] = cpu_to_be16(ah_attr->dlid);  /* DEST LID */
+        qp->s_hdr.lrh[2] = cpu_to_be16(hwords + nwords + SIZE_OF_CRC);
+        lid = ipath_layer_get_lid(dev->dd);
+        if (lid) {
+                lid |= ah_attr->src_path_bits &
+                        ((1 << (dev->mkeyprot_resv_lmc & 7)) - 1);
+                qp->s_hdr.lrh[3] = cpu_to_be16(lid);
+        } else
+                qp->s_hdr.lrh[3] = IB_LID_PERMISSIVE;
+        if (wr->send_flags & IB_SEND_SOLICITED)
+                bth0 |= 1 << 23;
+        bth0 |= extra_bytes << 20;
+        bth0 |= qp->ibqp.qp_type == IB_QPT_SMI ? IPS_DEFAULT_P_KEY :
+                ipath_layer_get_pkey(dev->dd, qp->s_pkey_index);
+        ohdr->bth[0] = cpu_to_be32(bth0);
+        /*
+         * Use the multicast QP if the destination LID is a multicast LID.
+         */
+        ohdr->bth[1] = ah_attr->dlid >= IPS_MULTICAST_LID_BASE &&
+                ah_attr->dlid != IPS_PERMISSIVE_LID ?
+                __constant_cpu_to_be32(IPS_MULTICAST_QPN) :
+                cpu_to_be32(wr->wr.ud.remote_qpn);
+        /* XXX Could lose a PSN count but not worth locking */
+        ohdr->bth[2] = cpu_to_be32(qp->s_next_psn++ & IPS_PSN_MASK);
+        /*
+         * Qkeys with the high order bit set mean use the
+         * qkey from the QP context instead of the WR (see 10.2.5).
+         */
+        ohdr->u.ud.deth[0] = cpu_to_be32((int)wr->wr.ud.remote_qkey < 0 ?
+                                         qp->qkey : wr->wr.ud.remote_qkey);
+        ohdr->u.ud.deth[1] = cpu_to_be32(qp->ibqp.qp_num);
+        if (ipath_verbs_send(dev->dd, hwords, (u32 *) &qp->s_hdr,
+                             len, &ss))
+                dev->n_no_piobuf++;
+
+done:
+        /* Queue the completion status entry. */
+        if (!test_bit(IPATH_S_SIGNAL_REQ_WR, &qp->s_flags) ||
+            (wr->send_flags & IB_SEND_SIGNALED)) {
+                wc.wr_id = wr->wr_id;
+                wc.status = IB_WC_SUCCESS;
+                wc.vendor_err = 0;
+                wc.opcode = IB_WC_SEND;
+                wc.byte_len = len;
+                wc.qp_num = qp->ibqp.qp_num;
+                wc.src_qp = 0;
+                wc.wc_flags = 0;
+                /* XXX initialize other fields? */
+                ipath_cq_enter(to_icq(qp->ibqp.send_cq), &wc, 0);
+        }
+        kfree(sg_list);
+
+        ret = 0;
+
+bail:
+        return ret;
+}
+
+/**
+ * ipath_ud_rcv - receive an incoming UD packet
+ * @dev: the device the packet came in on
+ * @hdr: the packet header
+ * @has_grh: true if the packet has a GRH
+ * @data: the packet data
+ * @tlen: the packet length
+ * @qp: the QP the packet came on
+ *
+ * This is called from ipath_qp_rcv() to process an incoming UD packet
+ * for the given QP.
+ * Called at interrupt level.
+ */
+void ipath_ud_rcv(struct ipath_ibdev *dev, struct ipath_ib_header *hdr,
+                  int has_grh, void *data, u32 tlen, struct ipath_qp *qp)
+{
+        struct ipath_other_headers *ohdr;
+        int opcode;
+        u32 hdrsize;
+        u32 pad;
+        unsigned long flags;
+        struct ib_wc wc;
+        u32 qkey;
+        u32 src_qp;
+        struct ipath_rq *rq;
+        struct ipath_srq *srq;
+        struct ipath_rwqe *wqe;
+        u16 dlid;
+        int header_in_data;
+
+        /* Check for GRH */
+        if (!has_grh) {
+                ohdr = &hdr->u.oth;
+                hdrsize = 8 + 12 + 8;   /* LRH + BTH + DETH */
+                qkey = be32_to_cpu(ohdr->u.ud.deth[0]);
+                src_qp = be32_to_cpu(ohdr->u.ud.deth[1]);
+                header_in_data = 0;
+        } else {
+                ohdr = &hdr->u.l.oth;
+                hdrsize = 8 + 40 + 12 + 8; /* LRH + GRH + BTH + DETH */
+                /*
+                 * The header with GRH is 68 bytes and the core driver sets
+                 * the eager header buffer size to 56 bytes so the last 12
+                 * bytes of the IB header is in the data buffer.
+                 */
+                header_in_data =
+                        ipath_layer_get_rcvhdrentsize(dev->dd) == 16;
+                if (header_in_data) {
+                        qkey = be32_to_cpu(((__be32 *) data)[1]);
+                        src_qp = be32_to_cpu(((__be32 *) data)[2]);
+                        data += 12;
+                } else {
+                        qkey = be32_to_cpu(ohdr->u.ud.deth[0]);
+                        src_qp = be32_to_cpu(ohdr->u.ud.deth[1]);
+                }
+        }
+        src_qp &= IPS_QPN_MASK;
+
+        /*
+         * Check that the permissive LID is only used on QP0
+         * and the QKEY matches (see 9.6.1.4.1 and 9.6.1.5.1).
+         */
+        if (qp->ibqp.qp_num) {
+                if (unlikely(hdr->lrh[1] == IB_LID_PERMISSIVE ||
+                             hdr->lrh[3] == IB_LID_PERMISSIVE)) {
+                        dev->n_pkt_drops++;
+                        goto bail;
+                }
+                if (unlikely(qkey != qp->qkey)) {
+                        /* XXX OK to lose a count once in a while. */
+                        dev->qkey_violations++;
+                        dev->n_pkt_drops++;
+                        goto bail;
+                }
+        } else if (hdr->lrh[1] == IB_LID_PERMISSIVE ||
+                   hdr->lrh[3] == IB_LID_PERMISSIVE) {
+                struct ib_smp *smp = (struct ib_smp *) data;
+
+                if (smp->mgmt_class != IB_MGMT_CLASS_SUBN_DIRECTED_ROUTE) {
+                        dev->n_pkt_drops++;
+                        goto bail;
+                }
+        }
+
+        /* Get the number of bytes the message was padded by. */
+        pad = (be32_to_cpu(ohdr->bth[0]) >> 20) & 3;
+        if (unlikely(tlen < (hdrsize + pad + 4))) {
+                /* Drop incomplete packets. */
+                dev->n_pkt_drops++;
+                goto bail;
+        }
+        tlen -= hdrsize + pad + 4;
+
+        /* Drop invalid MAD packets (see 13.5.3.1). */
+        if (unlikely((qp->ibqp.qp_num == 0 &&
+                      (tlen != 256 ||
+                       (be16_to_cpu(hdr->lrh[0]) >> 12) != 15)) ||
+                     (qp->ibqp.qp_num == 1 &&
+                      (tlen != 256 ||
+                       (be16_to_cpu(hdr->lrh[0]) >> 12) == 15)))) {
+                dev->n_pkt_drops++;
+                goto bail;
+        }
+
+        /*
+         * A GRH is expected to preceed the data even if not
+         * present on the wire.
+         */
+        wc.byte_len = tlen + sizeof(struct ib_grh);
+
+        /*
+         * The opcode is in the low byte when its in network order
+         * (top byte when in host order).
+         */
+        opcode = be32_to_cpu(ohdr->bth[0]) >> 24;
+        if (qp->ibqp.qp_num > 1 &&
+            opcode == IB_OPCODE_UD_SEND_ONLY_WITH_IMMEDIATE) {
+                if (header_in_data) {
+                        wc.imm_data = *(__be32 *) data;
+                        data += sizeof(__be32);
+                } else
+                        wc.imm_data = ohdr->u.ud.imm_data;
+                wc.wc_flags = IB_WC_WITH_IMM;
+                hdrsize += sizeof(u32);
+        } else if (opcode == IB_OPCODE_UD_SEND_ONLY) {
+                wc.imm_data = 0;
+                wc.wc_flags = 0;
+        } else {
+                dev->n_pkt_drops++;
+                goto bail;
+        }
+
+        /*
+         * Get the next work request entry to find where to put the data.
+         * Note that it is safe to drop the lock after changing rq->tail
+         * since ipath_post_receive() won't fill the empty slot.
+         */
+        if (qp->ibqp.srq) {
+                srq = to_isrq(qp->ibqp.srq);
+                rq = &srq->rq;
+        } else {
+                srq = NULL;
+                rq = &qp->r_rq;
+        }
+        spin_lock_irqsave(&rq->lock, flags);
+        if (rq->tail == rq->head) {
+                spin_unlock_irqrestore(&rq->lock, flags);
+                dev->n_pkt_drops++;
+                goto bail;
+        }
+        /* Silently drop packets which are too big. */
+        wqe = get_rwqe_ptr(rq, rq->tail);
+        if (wc.byte_len > wqe->length) {
+                spin_unlock_irqrestore(&rq->lock, flags);
+                dev->n_pkt_drops++;
+                goto bail;
+        }
+        wc.wr_id = wqe->wr_id;
+        qp->r_sge.sge = wqe->sg_list[0];
+        qp->r_sge.sg_list = wqe->sg_list + 1;
+        qp->r_sge.num_sge = wqe->num_sge;
+        if (++rq->tail >= rq->size)
+                rq->tail = 0;
+        if (srq && srq->ibsrq.event_handler) {
+                u32 n;
+
+                if (rq->head < rq->tail)
+                        n = rq->size + rq->head - rq->tail;
+                else
+                        n = rq->head - rq->tail;
+                if (n < srq->limit) {
+                        struct ib_event ev;
+
+                        srq->limit = 0;
+                        spin_unlock_irqrestore(&rq->lock, flags);
+                        ev.device = qp->ibqp.device;
+                        ev.element.srq = qp->ibqp.srq;
+                        ev.event = IB_EVENT_SRQ_LIMIT_REACHED;
+                        srq->ibsrq.event_handler(&ev,
+                                                 srq->ibsrq.srq_context);
+                } else
+                        spin_unlock_irqrestore(&rq->lock, flags);
+        } else
+                spin_unlock_irqrestore(&rq->lock, flags);
+        if (has_grh) {
+                ipath_copy_sge(&qp->r_sge, &hdr->u.l.grh,
+                               sizeof(struct ib_grh));
+                wc.wc_flags |= IB_WC_GRH;
+        } else
+                ipath_skip_sge(&qp->r_sge, sizeof(struct ib_grh));
+        ipath_copy_sge(&qp->r_sge, data,
+                       wc.byte_len - sizeof(struct ib_grh));
+        wc.status = IB_WC_SUCCESS;
+        wc.opcode = IB_WC_RECV;
+        wc.vendor_err = 0;
+        wc.qp_num = qp->ibqp.qp_num;
+        wc.src_qp = src_qp;
+        /* XXX do we know which pkey matched? Only needed for GSI. */
+        wc.pkey_index = 0;
+        wc.slid = be16_to_cpu(hdr->lrh[3]);
+        wc.sl = (be16_to_cpu(hdr->lrh[0]) >> 4) & 0xF;
+        dlid = be16_to_cpu(hdr->lrh[1]);
+        /*
+         * Save the LMC lower bits if the destination LID is a unicast LID.
+         */
+        wc.dlid_path_bits = dlid >= IPS_MULTICAST_LID_BASE ? 0 :
+                dlid & ((1 << (dev->mkeyprot_resv_lmc & 7)) - 1);
+        /* Signal completion event if the solicited bit is set. */
+        ipath_cq_enter(to_icq(qp->ibqp.recv_cq), &wc,
+                       (ohdr->bth[0] &
+                        __constant_cpu_to_be32(1 << 23)) != 0);
+
+bail:;
+}
diff --git a/drivers/infiniband/hw/ipath/ipath_user_pages.c b/drivers/infiniband/hw/ipath/ipath_user_pages.c
new file mode 100644
index 000000000000..2bb08afc86d0
--- /dev/null
+++ b/drivers/infiniband/hw/ipath/ipath_user_pages.c
@@ -0,0 +1,207 @@
+/*
+ * Copyright (c) 2003, 2004, 2005, 2006 PathScale, Inc. All rights reserved.
+ *
+ * This software is available to you under a choice of one of two
+ * licenses.  You may choose to be licensed under the terms of the GNU
+ * General Public License (GPL) Version 2, available from the file
+ * COPYING in the main directory of this source tree, or the
+ * OpenIB.org BSD license below:
+ *
+ *     Redistribution and use in source and binary forms, with or
+ *     without modification, are permitted provided that the following
+ *     conditions are met:
+ *
+ *      - Redistributions of source code must retain the above
+ *        copyright notice, this list of conditions and the following
+ *        disclaimer.
+ *
+ *      - Redistributions in binary form must reproduce the above
+ *        copyright notice, this list of conditions and the following
+ *        disclaimer in the documentation and/or other materials
+ *        provided with the distribution.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+ * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+ * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+ * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
+ * BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
+ * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
+ * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+ * SOFTWARE.
+ */
+
+#include <linux/mm.h>
+#include <linux/device.h>
+
+#include "ipath_kernel.h"
+
+static void __ipath_release_user_pages(struct page **p, size_t num_pages,
+                                   int dirty)
+{
+        size_t i;
+
+        for (i = 0; i < num_pages; i++) {
+                ipath_cdbg(MM, "%lu/%lu put_page %p\n", (unsigned long) i,
+                           (unsigned long) num_pages, p[i]);
+                if (dirty)
+                        set_page_dirty_lock(p[i]);
+                put_page(p[i]);
+        }
+}
+
+/* call with current->mm->mmap_sem held */
+static int __get_user_pages(unsigned long start_page, size_t num_pages,
+                        struct page **p, struct vm_area_struct **vma)
+{
+        unsigned long lock_limit;
+        size_t got;
+        int ret;
+
+#if 0
+        /*
+         * XXX - causes MPI programs to fail, haven't had time to check
+         * yet
+         */
+        if (!capable(CAP_IPC_LOCK)) {
+                ret = -EPERM;
+                goto bail;
+        }
+#endif
+
+        lock_limit = current->signal->rlim[RLIMIT_MEMLOCK].rlim_cur >>
+                PAGE_SHIFT;
+
+        if (num_pages > lock_limit) {
+                ret = -ENOMEM;
+                goto bail;
+        }
+
+        ipath_cdbg(VERBOSE, "pin %lx pages from vaddr %lx\n",
+                   (unsigned long) num_pages, start_page);
+
+        for (got = 0; got < num_pages; got += ret) {
+                ret = get_user_pages(current, current->mm,
+                                     start_page + got * PAGE_SIZE,
+                                     num_pages - got, 1, 1,
+                                     p + got, vma);
+                if (ret < 0)
+                        goto bail_release;
+        }
+
+        current->mm->locked_vm += num_pages;
+
+        ret = 0;
+        goto bail;
+
+bail_release:
+        __ipath_release_user_pages(p, got, 0);
+bail:
+        return ret;
+}
+
+/**
+ * ipath_get_user_pages - lock user pages into memory
+ * @start_page: the start page
+ * @num_pages: the number of pages
+ * @p: the output page structures
+ *
+ * This function takes a given start page (page aligned user virtual
+ * address) and pins it and the following specified number of pages.  For
+ * now, num_pages is always 1, but that will probably change at some point
+ * (because caller is doing expected sends on a single virtually contiguous
+ * buffer, so we can do all pages at once).
+ */
+int ipath_get_user_pages(unsigned long start_page, size_t num_pages,
+                         struct page **p)
+{
+        int ret;
+
+        down_write(&current->mm->mmap_sem);
+
+        ret = __get_user_pages(start_page, num_pages, p, NULL);
+
+        up_write(&current->mm->mmap_sem);
+
+        return ret;
+}
+
+/**
+ * ipath_get_user_pages_nocopy - lock a single page for I/O and mark shared
+ * @start_page: the page to lock
+ * @p: the output page structure
+ *
+ * This is similar to ipath_get_user_pages, but it's always one page, and we
+ * mark the page as locked for I/O, and shared.  This is used for the user
+ * process page that contains the destination address for the rcvhdrq tail
+ * update, so we need to have the vma. If we don't do this, the page can be
+ * taken away from us on fork, even if the child never touches it, and then
+ * the user process never sees the tail register updates.
+ */
+int ipath_get_user_pages_nocopy(unsigned long page, struct page **p)
+{
+        struct vm_area_struct *vma;
+        int ret;
+
+        down_write(&current->mm->mmap_sem);
+
+        ret = __get_user_pages(page, 1, p, &vma);
+
+        up_write(&current->mm->mmap_sem);
+
+        return ret;
+}
+
+void ipath_release_user_pages(struct page **p, size_t num_pages)
+{
+        down_write(&current->mm->mmap_sem);
+
+        __ipath_release_user_pages(p, num_pages, 1);
+
+        current->mm->locked_vm -= num_pages;
+
+        up_write(&current->mm->mmap_sem);
+}
+
+struct ipath_user_pages_work {
+        struct work_struct work;
+        struct mm_struct *mm;
+        unsigned long num_pages;
+};
+
+static void user_pages_account(void *ptr)
+{
+        struct ipath_user_pages_work *work = ptr;
+
+        down_write(&work->mm->mmap_sem);
+        work->mm->locked_vm -= work->num_pages;
+        up_write(&work->mm->mmap_sem);
+        mmput(work->mm);
+        kfree(work);
+}
+
+void ipath_release_user_pages_on_close(struct page **p, size_t num_pages)
+{
+        struct ipath_user_pages_work *work;
+        struct mm_struct *mm;
+
+        __ipath_release_user_pages(p, num_pages, 1);
+
+        mm = get_task_mm(current);
+        if (!mm)
+                goto bail;
+
+        work = kmalloc(sizeof(*work), GFP_KERNEL);
+        if (!work)
+                goto bail_mm;
+
+        goto bail;
+
+        INIT_WORK(&work->work, user_pages_account, work);
+        work->mm = mm;
+        work->num_pages = num_pages;
+
+bail_mm:
+        mmput(mm);
+bail:
+        return;
+}
diff --git a/drivers/infiniband/hw/ipath/ipath_verbs.c b/drivers/infiniband/hw/ipath/ipath_verbs.c
new file mode 100644
index 000000000000..9f27fd35cdbb
--- /dev/null
+++ b/drivers/infiniband/hw/ipath/ipath_verbs.c
@@ -0,0 +1,1222 @@
+/*
+ * Copyright (c) 2005, 2006 PathScale, Inc. All rights reserved.
+ *
+ * This software is available to you under a choice of one of two
+ * licenses.  You may choose to be licensed under the terms of the GNU
+ * General Public License (GPL) Version 2, available from the file
+ * COPYING in the main directory of this source tree, or the
+ * OpenIB.org BSD license below:
+ *
+ *     Redistribution and use in source and binary forms, with or
+ *     without modification, are permitted provided that the following
+ *     conditions are met:
+ *
+ *      - Redistributions of source code must retain the above
+ *        copyright notice, this list of conditions and the following
+ *        disclaimer.
+ *
+ *      - Redistributions in binary form must reproduce the above
+ *        copyright notice, this list of conditions and the following
+ *        disclaimer in the documentation and/or other materials
+ *        provided with the distribution.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+ * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+ * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+ * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
+ * BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
+ * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
+ * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+ * SOFTWARE.
+ */
+
+#include <rdma/ib_mad.h>
+#include <rdma/ib_user_verbs.h>
+#include <linux/utsname.h>
+
+#include "ipath_kernel.h"
+#include "ipath_verbs.h"
+#include "ips_common.h"
+
+/* Not static, because we don't want the compiler removing it */
+const char ipath_verbs_version[] = "ipath_verbs " IPATH_IDSTR;
+
+unsigned int ib_ipath_qp_table_size = 251;
+module_param_named(qp_table_size, ib_ipath_qp_table_size, uint, S_IRUGO);
+MODULE_PARM_DESC(qp_table_size, "QP table size");
+
+unsigned int ib_ipath_lkey_table_size = 12;
+module_param_named(lkey_table_size, ib_ipath_lkey_table_size, uint,
+                   S_IRUGO);
+MODULE_PARM_DESC(lkey_table_size,
+                 "LKEY table size in bits (2^n, 1 <= n <= 23)");
+
+unsigned int ib_ipath_debug;    /* debug mask */
+module_param_named(debug, ib_ipath_debug, uint, S_IWUSR | S_IRUGO);
+MODULE_PARM_DESC(debug, "Verbs debug mask");
+
+MODULE_LICENSE("GPL");
+MODULE_AUTHOR("PathScale <support@pathscale.com>");
+MODULE_DESCRIPTION("Pathscale InfiniPath driver");
+
+const int ib_ipath_state_ops[IB_QPS_ERR + 1] = {
+        [IB_QPS_RESET] = 0,
+        [IB_QPS_INIT] = IPATH_POST_RECV_OK,
+        [IB_QPS_RTR] = IPATH_POST_RECV_OK | IPATH_PROCESS_RECV_OK,
+        [IB_QPS_RTS] = IPATH_POST_RECV_OK | IPATH_PROCESS_RECV_OK |
+            IPATH_POST_SEND_OK | IPATH_PROCESS_SEND_OK,
+        [IB_QPS_SQD] = IPATH_POST_RECV_OK | IPATH_PROCESS_RECV_OK |
+            IPATH_POST_SEND_OK,
+        [IB_QPS_SQE] = IPATH_POST_RECV_OK | IPATH_PROCESS_RECV_OK,
+        [IB_QPS_ERR] = 0,
+};
+
+/*
+ * Translate ib_wr_opcode into ib_wc_opcode.
+ */
+const enum ib_wc_opcode ib_ipath_wc_opcode[] = {
+        [IB_WR_RDMA_WRITE] = IB_WC_RDMA_WRITE,
+        [IB_WR_RDMA_WRITE_WITH_IMM] = IB_WC_RDMA_WRITE,
+        [IB_WR_SEND] = IB_WC_SEND,
+        [IB_WR_SEND_WITH_IMM] = IB_WC_SEND,
+        [IB_WR_RDMA_READ] = IB_WC_RDMA_READ,
+        [IB_WR_ATOMIC_CMP_AND_SWP] = IB_WC_COMP_SWAP,
+        [IB_WR_ATOMIC_FETCH_AND_ADD] = IB_WC_FETCH_ADD
+};
+
+/*
+ * System image GUID.
+ */
+__be64 sys_image_guid;
+
+/**
+ * ipath_copy_sge - copy data to SGE memory
+ * @ss: the SGE state
+ * @data: the data to copy
+ * @length: the length of the data
+ */
+void ipath_copy_sge(struct ipath_sge_state *ss, void *data, u32 length)
+{
+        struct ipath_sge *sge = &ss->sge;
+
+        while (length) {
+                u32 len = sge->length;
+
+                BUG_ON(len == 0);
+                if (len > length)
+                        len = length;
+                memcpy(sge->vaddr, data, len);
+                sge->vaddr += len;
+                sge->length -= len;
+                sge->sge_length -= len;
+                if (sge->sge_length == 0) {
+                        if (--ss->num_sge)
+                                *sge = *ss->sg_list++;
+                } else if (sge->length == 0 && sge->mr != NULL) {
+                        if (++sge->n >= IPATH_SEGSZ) {
+                                if (++sge->m >= sge->mr->mapsz)
+                                        break;
+                                sge->n = 0;
+                        }
+                        sge->vaddr =
+                                sge->mr->map[sge->m]->segs[sge->n].vaddr;
+                        sge->length =
+                                sge->mr->map[sge->m]->segs[sge->n].length;
+                }
+                data += len;
+                length -= len;
+        }
+}
+
+/**
+ * ipath_skip_sge - skip over SGE memory - XXX almost dup of prev func
+ * @ss: the SGE state
+ * @length: the number of bytes to skip
+ */
+void ipath_skip_sge(struct ipath_sge_state *ss, u32 length)
+{
+        struct ipath_sge *sge = &ss->sge;
+
+        while (length > sge->sge_length) {
+                length -= sge->sge_length;
+                ss->sge = *ss->sg_list++;
+        }
+        while (length) {
+                u32 len = sge->length;
+
+                BUG_ON(len == 0);
+                if (len > length)
+                        len = length;
+                sge->vaddr += len;
+                sge->length -= len;
+                sge->sge_length -= len;
+                if (sge->sge_length == 0) {
+                        if (--ss->num_sge)
+                                *sge = *ss->sg_list++;
+                } else if (sge->length == 0 && sge->mr != NULL) {
+                        if (++sge->n >= IPATH_SEGSZ) {
+                                if (++sge->m >= sge->mr->mapsz)
+                                        break;
+                                sge->n = 0;
+                        }
+                        sge->vaddr =
+                                sge->mr->map[sge->m]->segs[sge->n].vaddr;
+                        sge->length =
+                                sge->mr->map[sge->m]->segs[sge->n].length;
+                }
+                length -= len;
+        }
+}
+
+/**
+ * ipath_post_send - post a send on a QP
+ * @ibqp: the QP to post the send on
+ * @wr: the list of work requests to post
+ * @bad_wr: the first bad WR is put here
+ *
+ * This may be called from interrupt context.
+ */
+static int ipath_post_send(struct ib_qp *ibqp, struct ib_send_wr *wr,
+                           struct ib_send_wr **bad_wr)
+{
+        struct ipath_qp *qp = to_iqp(ibqp);
+        int err = 0;
+
+        /* Check that state is OK to post send. */
+        if (!(ib_ipath_state_ops[qp->state] & IPATH_POST_SEND_OK)) {
+                *bad_wr = wr;
+                err = -EINVAL;
+                goto bail;
+        }
+
+        for (; wr; wr = wr->next) {
+                switch (qp->ibqp.qp_type) {
+                case IB_QPT_UC:
+                case IB_QPT_RC:
+                        err = ipath_post_rc_send(qp, wr);
+                        break;
+
+                case IB_QPT_SMI:
+                case IB_QPT_GSI:
+                case IB_QPT_UD:
+                        err = ipath_post_ud_send(qp, wr);
+                        break;
+
+                default:
+                        err = -EINVAL;
+                }
+                if (err) {
+                        *bad_wr = wr;
+                        break;
+                }
+        }
+
+bail:
+        return err;
+}
+
+/**
+ * ipath_post_receive - post a receive on a QP
+ * @ibqp: the QP to post the receive on
+ * @wr: the WR to post
+ * @bad_wr: the first bad WR is put here
+ *
+ * This may be called from interrupt context.
+ */
+static int ipath_post_receive(struct ib_qp *ibqp, struct ib_recv_wr *wr,
+                              struct ib_recv_wr **bad_wr)
+{
+        struct ipath_qp *qp = to_iqp(ibqp);
+        unsigned long flags;
+        int ret;
+
+        /* Check that state is OK to post receive. */
+        if (!(ib_ipath_state_ops[qp->state] & IPATH_POST_RECV_OK)) {
+                *bad_wr = wr;
+                ret = -EINVAL;
+                goto bail;
+        }
+
+        for (; wr; wr = wr->next) {
+                struct ipath_rwqe *wqe;
+                u32 next;
+                int i, j;
+
+                if (wr->num_sge > qp->r_rq.max_sge) {
+                        *bad_wr = wr;
+                        ret = -ENOMEM;
+                        goto bail;
+                }
+
+                spin_lock_irqsave(&qp->r_rq.lock, flags);
+                next = qp->r_rq.head + 1;
+                if (next >= qp->r_rq.size)
+                        next = 0;
+                if (next == qp->r_rq.tail) {
+                        spin_unlock_irqrestore(&qp->r_rq.lock, flags);
+                        *bad_wr = wr;
+                        ret = -ENOMEM;
+                        goto bail;
+                }
+
+                wqe = get_rwqe_ptr(&qp->r_rq, qp->r_rq.head);
+                wqe->wr_id = wr->wr_id;
+                wqe->sg_list[0].mr = NULL;
+                wqe->sg_list[0].vaddr = NULL;
+                wqe->sg_list[0].length = 0;
+                wqe->sg_list[0].sge_length = 0;
+                wqe->length = 0;
+                for (i = 0, j = 0; i < wr->num_sge; i++) {
+                        /* Check LKEY */
+                        if (to_ipd(qp->ibqp.pd)->user &&
+                            wr->sg_list[i].lkey == 0) {
+                                spin_unlock_irqrestore(&qp->r_rq.lock,
+                                                       flags);
+                                *bad_wr = wr;
+                                ret = -EINVAL;
+                                goto bail;
+                        }
+                        if (wr->sg_list[i].length == 0)
+                                continue;
+                        if (!ipath_lkey_ok(
+                                    &to_idev(qp->ibqp.device)->lk_table,
+                                    &wqe->sg_list[j], &wr->sg_list[i],
+                                    IB_ACCESS_LOCAL_WRITE)) {
+                                spin_unlock_irqrestore(&qp->r_rq.lock,
+                                                       flags);
+                                *bad_wr = wr;
+                                ret = -EINVAL;
+                                goto bail;
+                        }
+                        wqe->length += wr->sg_list[i].length;
+                        j++;
+                }
+                wqe->num_sge = j;
+                qp->r_rq.head = next;
+                spin_unlock_irqrestore(&qp->r_rq.lock, flags);
+        }
+        ret = 0;
+
+bail:
+        return ret;
+}
+
+/**
+ * ipath_qp_rcv - processing an incoming packet on a QP
+ * @dev: the device the packet came on
+ * @hdr: the packet header
+ * @has_grh: true if the packet has a GRH
+ * @data: the packet data
+ * @tlen: the packet length
+ * @qp: the QP the packet came on
+ *
+ * This is called from ipath_ib_rcv() to process an incoming packet
+ * for the given QP.
+ * Called at interrupt level.
+ */
+static void ipath_qp_rcv(struct ipath_ibdev *dev,
+                         struct ipath_ib_header *hdr, int has_grh,
+                         void *data, u32 tlen, struct ipath_qp *qp)
+{
+        /* Check for valid receive state. */
+        if (!(ib_ipath_state_ops[qp->state] & IPATH_PROCESS_RECV_OK)) {
+                dev->n_pkt_drops++;
+                return;
+        }
+
+        switch (qp->ibqp.qp_type) {
+        case IB_QPT_SMI:
+        case IB_QPT_GSI:
+        case IB_QPT_UD:
+                ipath_ud_rcv(dev, hdr, has_grh, data, tlen, qp);
+                break;
+
+        case IB_QPT_RC:
+                ipath_rc_rcv(dev, hdr, has_grh, data, tlen, qp);
+                break;
+
+        case IB_QPT_UC:
+                ipath_uc_rcv(dev, hdr, has_grh, data, tlen, qp);
+                break;
+
+        default:
+                break;
+        }
+}
+
+/**
+ * ipath_ib_rcv - process and incoming packet
+ * @arg: the device pointer
+ * @rhdr: the header of the packet
+ * @data: the packet data
+ * @tlen: the packet length
+ *
+ * This is called from ipath_kreceive() to process an incoming packet at
+ * interrupt level. Tlen is the length of the header + data + CRC in bytes.
+ */
+static void ipath_ib_rcv(void *arg, void *rhdr, void *data, u32 tlen)
+{
+        struct ipath_ibdev *dev = (struct ipath_ibdev *) arg;
+        struct ipath_ib_header *hdr = rhdr;
+        struct ipath_other_headers *ohdr;
+        struct ipath_qp *qp;
+        u32 qp_num;
+        int lnh;
+        u8 opcode;
+        u16 lid;
+
+        if (unlikely(dev == NULL))
+                goto bail;
+
+        if (unlikely(tlen < 24)) {      /* LRH+BTH+CRC */
+                dev->rcv_errors++;
+                goto bail;
+        }
+
+        /* Check for a valid destination LID (see ch. 7.11.1). */
+        lid = be16_to_cpu(hdr->lrh[1]);
+        if (lid < IPS_MULTICAST_LID_BASE) {
+                lid &= ~((1 << (dev->mkeyprot_resv_lmc & 7)) - 1);
+                if (unlikely(lid != ipath_layer_get_lid(dev->dd))) {
+                        dev->rcv_errors++;
+                        goto bail;
+                }
+        }
+
+        /* Check for GRH */
+        lnh = be16_to_cpu(hdr->lrh[0]) & 3;
+        if (lnh == IPS_LRH_BTH)
+                ohdr = &hdr->u.oth;
+        else if (lnh == IPS_LRH_GRH)
+                ohdr = &hdr->u.l.oth;
+        else {
+                dev->rcv_errors++;
+                goto bail;
+        }
+
+        opcode = be32_to_cpu(ohdr->bth[0]) >> 24;
+        dev->opstats[opcode].n_bytes += tlen;
+        dev->opstats[opcode].n_packets++;
+
+        /* Get the destination QP number. */
+        qp_num = be32_to_cpu(ohdr->bth[1]) & IPS_QPN_MASK;
+        if (qp_num == IPS_MULTICAST_QPN) {
+                struct ipath_mcast *mcast;
+                struct ipath_mcast_qp *p;
+
+                mcast = ipath_mcast_find(&hdr->u.l.grh.dgid);
+                if (mcast == NULL) {
+                        dev->n_pkt_drops++;
+                        goto bail;
+                }
+                dev->n_multicast_rcv++;
+                list_for_each_entry_rcu(p, &mcast->qp_list, list)
+                        ipath_qp_rcv(dev, hdr, lnh == IPS_LRH_GRH, data,
+                                     tlen, p->qp);
+                /*
+                 * Notify ipath_multicast_detach() if it is waiting for us
+                 * to finish.
+                 */
+                if (atomic_dec_return(&mcast->refcount) <= 1)
+                        wake_up(&mcast->wait);
+        } else {
+                qp = ipath_lookup_qpn(&dev->qp_table, qp_num);
+                if (qp) {
+                        dev->n_unicast_rcv++;
+                        ipath_qp_rcv(dev, hdr, lnh == IPS_LRH_GRH, data,
+                                     tlen, qp);
+                        /*
+                         * Notify ipath_destroy_qp() if it is waiting
+                         * for us to finish.
+                         */
+                        if (atomic_dec_and_test(&qp->refcount))
+                                wake_up(&qp->wait);
+                } else
+                        dev->n_pkt_drops++;
+        }
+
+bail:;
+}
+
+/**
+ * ipath_ib_timer - verbs timer
+ * @arg: the device pointer
+ *
+ * This is called from ipath_do_rcv_timer() at interrupt level to check for
+ * QPs which need retransmits and to collect performance numbers.
+ */
+static void ipath_ib_timer(void *arg)
+{
+        struct ipath_ibdev *dev = (struct ipath_ibdev *) arg;
+        struct ipath_qp *resend = NULL;
+        struct ipath_qp *rnr = NULL;
+        struct list_head *last;
+        struct ipath_qp *qp;
+        unsigned long flags;
+
+        if (dev == NULL)
+                return;
+
+        spin_lock_irqsave(&dev->pending_lock, flags);
+        /* Start filling the next pending queue. */
+        if (++dev->pending_index >= ARRAY_SIZE(dev->pending))
+                dev->pending_index = 0;
+        /* Save any requests still in the new queue, they have timed out. */
+        last = &dev->pending[dev->pending_index];
+        while (!list_empty(last)) {
+                qp = list_entry(last->next, struct ipath_qp, timerwait);
+                if (last->next == LIST_POISON1 ||
+                    last->next != &qp->timerwait ||
+                    qp->timerwait.prev != last) {
+                        INIT_LIST_HEAD(last);
+                } else {
+                        list_del(&qp->timerwait);
+                        qp->timerwait.prev = (struct list_head *) resend;
+                        resend = qp;
+                        atomic_inc(&qp->refcount);
+                }
+        }
+        last = &dev->rnrwait;
+        if (!list_empty(last)) {
+                qp = list_entry(last->next, struct ipath_qp, timerwait);
+                if (--qp->s_rnr_timeout == 0) {
+                        do {
+                                if (last->next == LIST_POISON1 ||
+                                    last->next != &qp->timerwait ||
+                                    qp->timerwait.prev != last) {
+                                        INIT_LIST_HEAD(last);
+                                        break;
+                                }
+                                list_del(&qp->timerwait);
+                                qp->timerwait.prev =
+                                        (struct list_head *) rnr;
+                                rnr = qp;
+                                if (list_empty(last))
+                                        break;
+                                qp = list_entry(last->next, struct ipath_qp,
+                                                timerwait);
+                        } while (qp->s_rnr_timeout == 0);
+                }
+        }
+        /*
+         * We should only be in the started state if pma_sample_start != 0
+         */
+        if (dev->pma_sample_status == IB_PMA_SAMPLE_STATUS_STARTED &&
+            --dev->pma_sample_start == 0) {
+                dev->pma_sample_status = IB_PMA_SAMPLE_STATUS_RUNNING;
+                ipath_layer_snapshot_counters(dev->dd, &dev->ipath_sword,
+                                              &dev->ipath_rword,
+                                              &dev->ipath_spkts,
+                                              &dev->ipath_rpkts,
+                                              &dev->ipath_xmit_wait);
+        }
+        if (dev->pma_sample_status == IB_PMA_SAMPLE_STATUS_RUNNING) {
+                if (dev->pma_sample_interval == 0) {
+                        u64 ta, tb, tc, td, te;
+
+                        dev->pma_sample_status = IB_PMA_SAMPLE_STATUS_DONE;
+                        ipath_layer_snapshot_counters(dev->dd, &ta, &tb,
+                                                      &tc, &td, &te);
+
+                        dev->ipath_sword = ta - dev->ipath_sword;
+                        dev->ipath_rword = tb - dev->ipath_rword;
+                        dev->ipath_spkts = tc - dev->ipath_spkts;
+                        dev->ipath_rpkts = td - dev->ipath_rpkts;
+                        dev->ipath_xmit_wait = te - dev->ipath_xmit_wait;
+                }
+                else
+                        dev->pma_sample_interval--;
+        }
+        spin_unlock_irqrestore(&dev->pending_lock, flags);
+
+        /* XXX What if timer fires again while this is running? */
+        for (qp = resend; qp != NULL;
+             qp = (struct ipath_qp *) qp->timerwait.prev) {
+                struct ib_wc wc;
+
+                spin_lock_irqsave(&qp->s_lock, flags);
+                if (qp->s_last != qp->s_tail && qp->state == IB_QPS_RTS) {
+                        dev->n_timeouts++;
+                        ipath_restart_rc(qp, qp->s_last_psn + 1, &wc);
+                }
+                spin_unlock_irqrestore(&qp->s_lock, flags);
+
+                /* Notify ipath_destroy_qp() if it is waiting. */
+                if (atomic_dec_and_test(&qp->refcount))
+                        wake_up(&qp->wait);
+        }
+        for (qp = rnr; qp != NULL;
+             qp = (struct ipath_qp *) qp->timerwait.prev)
+                tasklet_hi_schedule(&qp->s_task);
+}
+
+/**
+ * ipath_ib_piobufavail - callback when a PIO buffer is available
+ * @arg: the device pointer
+ *
+ * This is called from ipath_intr() at interrupt level when a PIO buffer is
+ * available after ipath_verbs_send() returned an error that no buffers were
+ * available.  Return 0 if we consumed all the PIO buffers and we still have
+ * QPs waiting for buffers (for now, just do a tasklet_hi_schedule and
+ * return one).
+ */
+static int ipath_ib_piobufavail(void *arg)
+{
+        struct ipath_ibdev *dev = (struct ipath_ibdev *) arg;
+        struct ipath_qp *qp;
+        unsigned long flags;
+
+        if (dev == NULL)
+                goto bail;
+
+        spin_lock_irqsave(&dev->pending_lock, flags);
+        while (!list_empty(&dev->piowait)) {
+                qp = list_entry(dev->piowait.next, struct ipath_qp,
+                                piowait);
+                list_del(&qp->piowait);
+                tasklet_hi_schedule(&qp->s_task);
+        }
+        spin_unlock_irqrestore(&dev->pending_lock, flags);
+
+bail:
+        return 1;
+}
+
+static int ipath_query_device(struct ib_device *ibdev,
+                              struct ib_device_attr *props)
+{
+        struct ipath_ibdev *dev = to_idev(ibdev);
+        u32 vendor, boardrev, majrev, minrev;
+
+        memset(props, 0, sizeof(*props));
+
+        props->device_cap_flags = IB_DEVICE_BAD_PKEY_CNTR |
+                IB_DEVICE_BAD_QKEY_CNTR | IB_DEVICE_SHUTDOWN_PORT |
+                IB_DEVICE_SYS_IMAGE_GUID;
+        ipath_layer_query_device(dev->dd, &vendor, &boardrev,
+                                 &majrev, &minrev);
+        props->vendor_id = vendor;
+        props->vendor_part_id = boardrev;
+        props->hw_ver = boardrev << 16 | majrev << 8 | minrev;
+
+        props->sys_image_guid = dev->sys_image_guid;
+
+        props->max_mr_size = ~0ull;
+        props->max_qp = 0xffff;
+        props->max_qp_wr = 0xffff;
+        props->max_sge = 255;
+        props->max_cq = 0xffff;
+        props->max_cqe = 0xffff;
+        props->max_mr = 0xffff;
+        props->max_pd = 0xffff;
+        props->max_qp_rd_atom = 1;
+        props->max_qp_init_rd_atom = 1;
+        /* props->max_res_rd_atom */
+        props->max_srq = 0xffff;
+        props->max_srq_wr = 0xffff;
+        props->max_srq_sge = 255;
+        /* props->local_ca_ack_delay */
+        props->atomic_cap = IB_ATOMIC_HCA;
+        props->max_pkeys = ipath_layer_get_npkeys(dev->dd);
+        props->max_mcast_grp = 0xffff;
+        props->max_mcast_qp_attach = 0xffff;
+        props->max_total_mcast_qp_attach = props->max_mcast_qp_attach *
+                props->max_mcast_grp;
+
+        return 0;
+}
+
+const u8 ipath_cvt_physportstate[16] = {
+        [INFINIPATH_IBCS_LT_STATE_DISABLED] = 3,
+        [INFINIPATH_IBCS_LT_STATE_LINKUP] = 5,
+        [INFINIPATH_IBCS_LT_STATE_POLLACTIVE] = 2,
+        [INFINIPATH_IBCS_LT_STATE_POLLQUIET] = 2,
+        [INFINIPATH_IBCS_LT_STATE_SLEEPDELAY] = 1,
+        [INFINIPATH_IBCS_LT_STATE_SLEEPQUIET] = 1,
+        [INFINIPATH_IBCS_LT_STATE_CFGDEBOUNCE] = 4,
+        [INFINIPATH_IBCS_LT_STATE_CFGRCVFCFG] = 4,
+        [INFINIPATH_IBCS_LT_STATE_CFGWAITRMT] = 4,
+        [INFINIPATH_IBCS_LT_STATE_CFGIDLE] = 4,
+        [INFINIPATH_IBCS_LT_STATE_RECOVERRETRAIN] = 6,
+        [INFINIPATH_IBCS_LT_STATE_RECOVERWAITRMT] = 6,
+        [INFINIPATH_IBCS_LT_STATE_RECOVERIDLE] = 6,
+};
+
+static int ipath_query_port(struct ib_device *ibdev,
+                            u8 port, struct ib_port_attr *props)
+{
+        struct ipath_ibdev *dev = to_idev(ibdev);
+        enum ib_mtu mtu;
+        u16 lid = ipath_layer_get_lid(dev->dd);
+        u64 ibcstat;
+
+        memset(props, 0, sizeof(*props));
+        props->lid = lid ? lid : __constant_be16_to_cpu(IB_LID_PERMISSIVE);
+        props->lmc = dev->mkeyprot_resv_lmc & 7;
+        props->sm_lid = dev->sm_lid;
+        props->sm_sl = dev->sm_sl;
+        ibcstat = ipath_layer_get_lastibcstat(dev->dd);
+        props->state = ((ibcstat >> 4) & 0x3) + 1;
+        /* See phys_state_show() */
+        props->phys_state = ipath_cvt_physportstate[
+                ipath_layer_get_lastibcstat(dev->dd) & 0xf];
+        props->port_cap_flags = dev->port_cap_flags;
+        props->gid_tbl_len = 1;
+        props->max_msg_sz = 4096;
+        props->pkey_tbl_len = ipath_layer_get_npkeys(dev->dd);
+        props->bad_pkey_cntr = ipath_layer_get_cr_errpkey(dev->dd) -
+                dev->n_pkey_violations;
+        props->qkey_viol_cntr = dev->qkey_violations;
+        props->active_width = IB_WIDTH_4X;
+        /* See rate_show() */
+        props->active_speed = 1;        /* Regular 10Mbs speed. */
+        props->max_vl_num = 1;          /* VLCap = VL0 */
+        props->init_type_reply = 0;
+
+        props->max_mtu = IB_MTU_4096;
+        switch (ipath_layer_get_ibmtu(dev->dd)) {
+        case 4096:
+                mtu = IB_MTU_4096;
+                break;
+        case 2048:
+                mtu = IB_MTU_2048;
+                break;
+        case 1024:
+                mtu = IB_MTU_1024;
+                break;
+        case 512:
+                mtu = IB_MTU_512;
+                break;
+        case 256:
+                mtu = IB_MTU_256;
+                break;
+        default:
+                mtu = IB_MTU_2048;
+        }
+        props->active_mtu = mtu;
+        props->subnet_timeout = dev->subnet_timeout;
+
+        return 0;
+}
+
+static int ipath_modify_device(struct ib_device *device,
+                               int device_modify_mask,
+                               struct ib_device_modify *device_modify)
+{
+        int ret;
+
+        if (device_modify_mask & ~(IB_DEVICE_MODIFY_SYS_IMAGE_GUID |
+                                   IB_DEVICE_MODIFY_NODE_DESC)) {
+                ret = -EOPNOTSUPP;
+                goto bail;
+        }
+
+        if (device_modify_mask & IB_DEVICE_MODIFY_NODE_DESC)
+                memcpy(device->node_desc, device_modify->node_desc, 64);
+
+        if (device_modify_mask & IB_DEVICE_MODIFY_SYS_IMAGE_GUID)
+                to_idev(device)->sys_image_guid =
+                        cpu_to_be64(device_modify->sys_image_guid);
+
+        ret = 0;
+
+bail:
+        return ret;
+}
+
+static int ipath_modify_port(struct ib_device *ibdev,
+                             u8 port, int port_modify_mask,
+                             struct ib_port_modify *props)
+{
+        struct ipath_ibdev *dev = to_idev(ibdev);
+
+        dev->port_cap_flags |= props->set_port_cap_mask;
+        dev->port_cap_flags &= ~props->clr_port_cap_mask;
+        if (port_modify_mask & IB_PORT_SHUTDOWN)
+                ipath_layer_set_linkstate(dev->dd, IPATH_IB_LINKDOWN);
+        if (port_modify_mask & IB_PORT_RESET_QKEY_CNTR)
+                dev->qkey_violations = 0;
+        return 0;
+}
+
+static int ipath_query_gid(struct ib_device *ibdev, u8 port,
+                           int index, union ib_gid *gid)
+{
+        struct ipath_ibdev *dev = to_idev(ibdev);
+        int ret;
+
+        if (index >= 1) {
+                ret = -EINVAL;
+                goto bail;
+        }
+        gid->global.subnet_prefix = dev->gid_prefix;
+        gid->global.interface_id = ipath_layer_get_guid(dev->dd);
+
+        ret = 0;
+
+bail:
+        return ret;
+}
+
+static struct ib_pd *ipath_alloc_pd(struct ib_device *ibdev,
+                                    struct ib_ucontext *context,
+                                    struct ib_udata *udata)
+{
+        struct ipath_pd *pd;
+        struct ib_pd *ret;
+
+        pd = kmalloc(sizeof *pd, GFP_KERNEL);
+        if (!pd) {
+                ret = ERR_PTR(-ENOMEM);
+                goto bail;
+        }
+
+        /* ib_alloc_pd() will initialize pd->ibpd. */
+        pd->user = udata != NULL;
+
+        ret = &pd->ibpd;
+
+bail:
+        return ret;
+}
+
+static int ipath_dealloc_pd(struct ib_pd *ibpd)
+{
+        struct ipath_pd *pd = to_ipd(ibpd);
+
+        kfree(pd);
+
+        return 0;
+}
+
+/**
+ * ipath_create_ah - create an address handle
+ * @pd: the protection domain
+ * @ah_attr: the attributes of the AH
+ *
+ * This may be called from interrupt context.
+ */
+static struct ib_ah *ipath_create_ah(struct ib_pd *pd,
+                                     struct ib_ah_attr *ah_attr)
+{
+        struct ipath_ah *ah;
+        struct ib_ah *ret;
+
+        /* A multicast address requires a GRH (see ch. 8.4.1). */
+        if (ah_attr->dlid >= IPS_MULTICAST_LID_BASE &&
+            ah_attr->dlid != IPS_PERMISSIVE_LID &&
+            !(ah_attr->ah_flags & IB_AH_GRH)) {
+                ret = ERR_PTR(-EINVAL);
+                goto bail;
+        }
+
+        ah = kmalloc(sizeof *ah, GFP_ATOMIC);
+        if (!ah) {
+                ret = ERR_PTR(-ENOMEM);
+                goto bail;
+        }
+
+        /* ib_create_ah() will initialize ah->ibah. */
+        ah->attr = *ah_attr;
+
+        ret = &ah->ibah;
+
+bail:
+        return ret;
+}
+
+/**
+ * ipath_destroy_ah - destroy an address handle
+ * @ibah: the AH to destroy
+ *
+ * This may be called from interrupt context.
+ */
+static int ipath_destroy_ah(struct ib_ah *ibah)
+{
+        struct ipath_ah *ah = to_iah(ibah);
+
+        kfree(ah);
+
+        return 0;
+}
+
+static int ipath_query_ah(struct ib_ah *ibah, struct ib_ah_attr *ah_attr)
+{
+        struct ipath_ah *ah = to_iah(ibah);
+
+        *ah_attr = ah->attr;
+
+        return 0;
+}
+
+static int ipath_query_pkey(struct ib_device *ibdev, u8 port, u16 index,
+                            u16 *pkey)
+{
+        struct ipath_ibdev *dev = to_idev(ibdev);
+        int ret;
+
+        if (index >= ipath_layer_get_npkeys(dev->dd)) {
+                ret = -EINVAL;
+                goto bail;
+        }
+
+        *pkey = ipath_layer_get_pkey(dev->dd, index);
+        ret = 0;
+
+bail:
+        return ret;
+}
+
+
+/**
+ * ipath_alloc_ucontext - allocate a ucontest
+ * @ibdev: the infiniband device
+ * @udata: not used by the InfiniPath driver
+ */
+
+static struct ib_ucontext *ipath_alloc_ucontext(struct ib_device *ibdev,
+                                                struct ib_udata *udata)
+{
+        struct ipath_ucontext *context;
+        struct ib_ucontext *ret;
+
+        context = kmalloc(sizeof *context, GFP_KERNEL);
+        if (!context) {
+                ret = ERR_PTR(-ENOMEM);
+                goto bail;
+        }
+
+        ret = &context->ibucontext;
+
+bail:
+        return ret;
+}
+
+static int ipath_dealloc_ucontext(struct ib_ucontext *context)
+{
+        kfree(to_iucontext(context));
+        return 0;
+}
+
+static int ipath_verbs_register_sysfs(struct ib_device *dev);
+
+/**
+ * ipath_register_ib_device - register our device with the infiniband core
+ * @unit: the device number to register
+ * @dd: the device data structure
+ * Return the allocated ipath_ibdev pointer or NULL on error.
+ */
+static void *ipath_register_ib_device(int unit, struct ipath_devdata *dd)
+{
+        struct ipath_ibdev *idev;
+        struct ib_device *dev;
+        int ret;
+
+        idev = (struct ipath_ibdev *)ib_alloc_device(sizeof *idev);
+        if (idev == NULL)
+                goto bail;
+
+        dev = &idev->ibdev;
+
+        /* Only need to initialize non-zero fields. */
+        spin_lock_init(&idev->qp_table.lock);
+        spin_lock_init(&idev->lk_table.lock);
+        idev->sm_lid = __constant_be16_to_cpu(IB_LID_PERMISSIVE);
+        /* Set the prefix to the default value (see ch. 4.1.1) */
+        idev->gid_prefix = __constant_cpu_to_be64(0xfe80000000000000ULL);
+
+        ret = ipath_init_qp_table(idev, ib_ipath_qp_table_size);
+        if (ret)
+                goto err_qp;
+
+        /*
+         * The top ib_ipath_lkey_table_size bits are used to index the
+         * table.  The lower 8 bits can be owned by the user (copied from
+         * the LKEY).  The remaining bits act as a generation number or tag.
+         */
+        idev->lk_table.max = 1 << ib_ipath_lkey_table_size;
+        idev->lk_table.table = kzalloc(idev->lk_table.max *
+                                       sizeof(*idev->lk_table.table),
+                                       GFP_KERNEL);
+        if (idev->lk_table.table == NULL) {
+                ret = -ENOMEM;
+                goto err_lk;
+        }
+        spin_lock_init(&idev->pending_lock);
+        INIT_LIST_HEAD(&idev->pending[0]);
+        INIT_LIST_HEAD(&idev->pending[1]);
+        INIT_LIST_HEAD(&idev->pending[2]);
+        INIT_LIST_HEAD(&idev->piowait);
+        INIT_LIST_HEAD(&idev->rnrwait);
+        idev->pending_index = 0;
+        idev->port_cap_flags =
+                IB_PORT_SYS_IMAGE_GUID_SUP | IB_PORT_CLIENT_REG_SUP;
+        idev->pma_counter_select[0] = IB_PMA_PORT_XMIT_DATA;
+        idev->pma_counter_select[1] = IB_PMA_PORT_RCV_DATA;
+        idev->pma_counter_select[2] = IB_PMA_PORT_XMIT_PKTS;
+        idev->pma_counter_select[3] = IB_PMA_PORT_RCV_PKTS;
+        idev->pma_counter_select[5] = IB_PMA_PORT_XMIT_WAIT;
+        idev->link_width_enabled = 3;   /* 1x or 4x */
+
+        /*
+         * The system image GUID is supposed to be the same for all
+         * IB HCAs in a single system but since there can be other
+         * device types in the system, we can't be sure this is unique.
+         */
+        if (!sys_image_guid)
+                sys_image_guid = ipath_layer_get_guid(dd);
+        idev->sys_image_guid = sys_image_guid;
+        idev->ib_unit = unit;
+        idev->dd = dd;
+
+        strlcpy(dev->name, "ipath%d", IB_DEVICE_NAME_MAX);
+        dev->node_guid = ipath_layer_get_guid(dd);
+        dev->uverbs_abi_ver = IPATH_UVERBS_ABI_VERSION;
+        dev->uverbs_cmd_mask =
+                (1ull << IB_USER_VERBS_CMD_GET_CONTEXT)         |
+                (1ull << IB_USER_VERBS_CMD_QUERY_DEVICE)        |
+                (1ull << IB_USER_VERBS_CMD_QUERY_PORT)          |
+                (1ull << IB_USER_VERBS_CMD_ALLOC_PD)            |
+                (1ull << IB_USER_VERBS_CMD_DEALLOC_PD)          |
+                (1ull << IB_USER_VERBS_CMD_CREATE_AH)           |
+                (1ull << IB_USER_VERBS_CMD_DESTROY_AH)          |
+                (1ull << IB_USER_VERBS_CMD_QUERY_AH)            |
+                (1ull << IB_USER_VERBS_CMD_REG_MR)              |
+                (1ull << IB_USER_VERBS_CMD_DEREG_MR)            |
+                (1ull << IB_USER_VERBS_CMD_CREATE_COMP_CHANNEL) |
+                (1ull << IB_USER_VERBS_CMD_CREATE_CQ)           |
+                (1ull << IB_USER_VERBS_CMD_RESIZE_CQ)           |
+                (1ull << IB_USER_VERBS_CMD_DESTROY_CQ)          |
+                (1ull << IB_USER_VERBS_CMD_POLL_CQ)             |
+                (1ull << IB_USER_VERBS_CMD_REQ_NOTIFY_CQ)       |
+                (1ull << IB_USER_VERBS_CMD_CREATE_QP)           |
+                (1ull << IB_USER_VERBS_CMD_QUERY_QP)            |
+                (1ull << IB_USER_VERBS_CMD_MODIFY_QP)           |
+                (1ull << IB_USER_VERBS_CMD_DESTROY_QP)          |
+                (1ull << IB_USER_VERBS_CMD_POST_SEND)           |
+                (1ull << IB_USER_VERBS_CMD_POST_RECV)           |
+                (1ull << IB_USER_VERBS_CMD_ATTACH_MCAST)        |
+                (1ull << IB_USER_VERBS_CMD_DETACH_MCAST)        |
+                (1ull << IB_USER_VERBS_CMD_CREATE_SRQ)          |
+                (1ull << IB_USER_VERBS_CMD_MODIFY_SRQ)          |
+                (1ull << IB_USER_VERBS_CMD_QUERY_SRQ)           |
+                (1ull << IB_USER_VERBS_CMD_DESTROY_SRQ)         |
+                (1ull << IB_USER_VERBS_CMD_POST_SRQ_RECV);
+        dev->node_type = IB_NODE_CA;
+        dev->phys_port_cnt = 1;
+        dev->dma_device = ipath_layer_get_device(dd);
+        dev->class_dev.dev = dev->dma_device;
+        dev->query_device = ipath_query_device;
+        dev->modify_device = ipath_modify_device;
+        dev->query_port = ipath_query_port;
+        dev->modify_port = ipath_modify_port;
+        dev->query_pkey = ipath_query_pkey;
+        dev->query_gid = ipath_query_gid;
+        dev->alloc_ucontext = ipath_alloc_ucontext;
+        dev->dealloc_ucontext = ipath_dealloc_ucontext;
+        dev->alloc_pd = ipath_alloc_pd;
+        dev->dealloc_pd = ipath_dealloc_pd;
+        dev->create_ah = ipath_create_ah;
+        dev->destroy_ah = ipath_destroy_ah;
+        dev->query_ah = ipath_query_ah;
+        dev->create_srq = ipath_create_srq;
+        dev->modify_srq = ipath_modify_srq;
+        dev->query_srq = ipath_query_srq;
+        dev->destroy_srq = ipath_destroy_srq;
+        dev->create_qp = ipath_create_qp;
+        dev->modify_qp = ipath_modify_qp;
+        dev->query_qp = ipath_query_qp;
+        dev->destroy_qp = ipath_destroy_qp;
+        dev->post_send = ipath_post_send;
+        dev->post_recv = ipath_post_receive;
+        dev->post_srq_recv = ipath_post_srq_receive;
+        dev->create_cq = ipath_create_cq;
+        dev->destroy_cq = ipath_destroy_cq;
+        dev->resize_cq = ipath_resize_cq;
+        dev->poll_cq = ipath_poll_cq;
+        dev->req_notify_cq = ipath_req_notify_cq;
+        dev->get_dma_mr = ipath_get_dma_mr;
+        dev->reg_phys_mr = ipath_reg_phys_mr;
+        dev->reg_user_mr = ipath_reg_user_mr;
+        dev->dereg_mr = ipath_dereg_mr;
+        dev->alloc_fmr = ipath_alloc_fmr;
+        dev->map_phys_fmr = ipath_map_phys_fmr;
+        dev->unmap_fmr = ipath_unmap_fmr;
+        dev->dealloc_fmr = ipath_dealloc_fmr;
+        dev->attach_mcast = ipath_multicast_attach;
+        dev->detach_mcast = ipath_multicast_detach;
+        dev->process_mad = ipath_process_mad;
+
+        snprintf(dev->node_desc, sizeof(dev->node_desc),
+                 IPATH_IDSTR " %s kernel_SMA", system_utsname.nodename);
+
+        ret = ib_register_device(dev);
+        if (ret)
+                goto err_reg;
+
+        if (ipath_verbs_register_sysfs(dev))
+                goto err_class;
+
+        ipath_layer_enable_timer(dd);
+
+        goto bail;
+
+err_class:
+        ib_unregister_device(dev);
+err_reg:
+        kfree(idev->lk_table.table);
+err_lk:
+        kfree(idev->qp_table.table);
+err_qp:
+        ib_dealloc_device(dev);
+        _VERBS_ERROR("ib_ipath%d cannot register verbs (%d)!\n",
+                     unit, -ret);
+        idev = NULL;
+
+bail:
+        return idev;
+}
+
+static void ipath_unregister_ib_device(void *arg)
+{
+        struct ipath_ibdev *dev = (struct ipath_ibdev *) arg;
+        struct ib_device *ibdev = &dev->ibdev;
+
+        ipath_layer_disable_timer(dev->dd);
+
+        ib_unregister_device(ibdev);
+
+        if (!list_empty(&dev->pending[0]) ||
+            !list_empty(&dev->pending[1]) ||
+            !list_empty(&dev->pending[2]))
+                _VERBS_ERROR("ipath%d pending list not empty!\n",
+                             dev->ib_unit);
+        if (!list_empty(&dev->piowait))
+                _VERBS_ERROR("ipath%d piowait list not empty!\n",
+                             dev->ib_unit);
+        if (!list_empty(&dev->rnrwait))
+                _VERBS_ERROR("ipath%d rnrwait list not empty!\n",
+                             dev->ib_unit);
+        if (!ipath_mcast_tree_empty())
+                _VERBS_ERROR("ipath%d multicast table memory leak!\n",
+                             dev->ib_unit);
+        /*
+         * Note that ipath_unregister_ib_device() can be called before all
+         * the QPs are destroyed!
+         */
+        ipath_free_all_qps(&dev->qp_table);
+        kfree(dev->qp_table.table);
+        kfree(dev->lk_table.table);
+        ib_dealloc_device(ibdev);
+}
+
+int __init ipath_verbs_init(void)
+{
+        return ipath_verbs_register(ipath_register_ib_device,
+                                    ipath_unregister_ib_device,
+                                    ipath_ib_piobufavail, ipath_ib_rcv,
+                                    ipath_ib_timer);
+}
+
+void __exit ipath_verbs_cleanup(void)
+{
+        ipath_verbs_unregister();
+}
+
+static ssize_t show_rev(struct class_device *cdev, char *buf)
+{
+        struct ipath_ibdev *dev =
+                container_of(cdev, struct ipath_ibdev, ibdev.class_dev);
+        int vendor, boardrev, majrev, minrev;
+
+        ipath_layer_query_device(dev->dd, &vendor, &boardrev,
+                                 &majrev, &minrev);
+        return sprintf(buf, "%d.%d\n", majrev, minrev);
+}
+
+static ssize_t show_hca(struct class_device *cdev, char *buf)
+{
+        struct ipath_ibdev *dev =
+                container_of(cdev, struct ipath_ibdev, ibdev.class_dev);
+        int ret;
+
+        ret = ipath_layer_get_boardname(dev->dd, buf, 128);
+        if (ret < 0)
+                goto bail;
+        strcat(buf, "\n");
+        ret = strlen(buf);
+
+bail:
+        return ret;
+}
+
+static ssize_t show_stats(struct class_device *cdev, char *buf)
+{
+        struct ipath_ibdev *dev =
+                container_of(cdev, struct ipath_ibdev, ibdev.class_dev);
+        int i;
+        int len;
+
+        len = sprintf(buf,
+                      "RC resends  %d\n"
+                      "RC QACKs    %d\n"
+                      "RC ACKs     %d\n"
+                      "RC SEQ NAKs %d\n"
+                      "RC RDMA seq %d\n"
+                      "RC RNR NAKs %d\n"
+                      "RC OTH NAKs %d\n"
+                      "RC timeouts %d\n"
+                      "RC RDMA dup %d\n"
+                      "piobuf wait %d\n"
+                      "no piobuf   %d\n"
+                      "PKT drops   %d\n"
+                      "WQE errs    %d\n",
+                      dev->n_rc_resends, dev->n_rc_qacks, dev->n_rc_acks,
+                      dev->n_seq_naks, dev->n_rdma_seq, dev->n_rnr_naks,
+                      dev->n_other_naks, dev->n_timeouts,
+                      dev->n_rdma_dup_busy, dev->n_piowait,
+                      dev->n_no_piobuf, dev->n_pkt_drops, dev->n_wqe_errs);
+        for (i = 0; i < ARRAY_SIZE(dev->opstats); i++) {
+                const struct ipath_opcode_stats *si = &dev->opstats[i];
+
+                if (!si->n_packets && !si->n_bytes)
+                        continue;
+                len += sprintf(buf + len, "%02x %llu/%llu\n", i,
+                               (unsigned long long) si->n_packets,
+                               (unsigned long long) si->n_bytes);
+        }
+        return len;
+}
+
+static CLASS_DEVICE_ATTR(hw_rev, S_IRUGO, show_rev, NULL);
+static CLASS_DEVICE_ATTR(hca_type, S_IRUGO, show_hca, NULL);
+static CLASS_DEVICE_ATTR(board_id, S_IRUGO, show_hca, NULL);
+static CLASS_DEVICE_ATTR(stats, S_IRUGO, show_stats, NULL);
+
+static struct class_device_attribute *ipath_class_attributes[] = {
+        &class_device_attr_hw_rev,
+        &class_device_attr_hca_type,
+        &class_device_attr_board_id,
+        &class_device_attr_stats
+};
+
+static int ipath_verbs_register_sysfs(struct ib_device *dev)
+{
+        int i;
+        int ret;
+
+        for (i = 0; i < ARRAY_SIZE(ipath_class_attributes); ++i)
+                if (class_device_create_file(&dev->class_dev,
+                                             ipath_class_attributes[i])) {
+                        ret = 1;
+                        goto bail;
+                }
+
+        ret = 0;
+
+bail:
+        return ret;
+}
+
+module_init(ipath_verbs_init);
+module_exit(ipath_verbs_cleanup);
diff --git a/drivers/infiniband/hw/ipath/ipath_verbs.h b/drivers/infiniband/hw/ipath/ipath_verbs.h
new file mode 100644
index 000000000000..b824632b2a8c
--- /dev/null
+++ b/drivers/infiniband/hw/ipath/ipath_verbs.h
@@ -0,0 +1,697 @@
+/*
+ * Copyright (c) 2005, 2006 PathScale, Inc. All rights reserved.
+ *
+ * This software is available to you under a choice of one of two
+ * licenses.  You may choose to be licensed under the terms of the GNU
+ * General Public License (GPL) Version 2, available from the file
+ * COPYING in the main directory of this source tree, or the
+ * OpenIB.org BSD license below:
+ *
+ *     Redistribution and use in source and binary forms, with or
+ *     without modification, are permitted provided that the following
+ *     conditions are met:
+ *
+ *      - Redistributions of source code must retain the above
+ *        copyright notice, this list of conditions and the following
+ *        disclaimer.
+ *
+ *      - Redistributions in binary form must reproduce the above
+ *        copyright notice, this list of conditions and the following
+ *        disclaimer in the documentation and/or other materials
+ *        provided with the distribution.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+ * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+ * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+ * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
+ * BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
+ * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
+ * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+ * SOFTWARE.
+ */
+
+#ifndef IPATH_VERBS_H
+#define IPATH_VERBS_H
+
+#include <linux/types.h>
+#include <linux/spinlock.h>
+#include <linux/kernel.h>
+#include <linux/interrupt.h>
+#include <rdma/ib_pack.h>
+
+#include "ipath_layer.h"
+#include "verbs_debug.h"
+
+#define QPN_MAX                 (1 << 24)
+#define QPNMAP_ENTRIES          (QPN_MAX / PAGE_SIZE / BITS_PER_BYTE)
+
+/*
+ * Increment this value if any changes that break userspace ABI
+ * compatibility are made.
+ */
+#define IPATH_UVERBS_ABI_VERSION       1
+
+/*
+ * Define an ib_cq_notify value that is not valid so we know when CQ
+ * notifications are armed.
+ */
+#define IB_CQ_NONE      (IB_CQ_NEXT_COMP + 1)
+
+#define IB_RNR_NAK                      0x20
+#define IB_NAK_PSN_ERROR                0x60
+#define IB_NAK_INVALID_REQUEST          0x61
+#define IB_NAK_REMOTE_ACCESS_ERROR      0x62
+#define IB_NAK_REMOTE_OPERATIONAL_ERROR 0x63
+#define IB_NAK_INVALID_RD_REQUEST       0x64
+
+#define IPATH_POST_SEND_OK              0x01
+#define IPATH_POST_RECV_OK              0x02
+#define IPATH_PROCESS_RECV_OK           0x04
+#define IPATH_PROCESS_SEND_OK           0x08
+
+/* IB Performance Manager status values */
+#define IB_PMA_SAMPLE_STATUS_DONE       0x00
+#define IB_PMA_SAMPLE_STATUS_STARTED    0x01
+#define IB_PMA_SAMPLE_STATUS_RUNNING    0x02
+
+/* Mandatory IB performance counter select values. */
+#define IB_PMA_PORT_XMIT_DATA   __constant_htons(0x0001)
+#define IB_PMA_PORT_RCV_DATA    __constant_htons(0x0002)
+#define IB_PMA_PORT_XMIT_PKTS   __constant_htons(0x0003)
+#define IB_PMA_PORT_RCV_PKTS    __constant_htons(0x0004)
+#define IB_PMA_PORT_XMIT_WAIT   __constant_htons(0x0005)
+
+struct ib_reth {
+        __be64 vaddr;
+        __be32 rkey;
+        __be32 length;
+} __attribute__ ((packed));
+
+struct ib_atomic_eth {
+        __be64 vaddr;
+        __be32 rkey;
+        __be64 swap_data;
+        __be64 compare_data;
+} __attribute__ ((packed));
+
+struct ipath_other_headers {
+        __be32 bth[3];
+        union {
+                struct {
+                        __be32 deth[2];
+                        __be32 imm_data;
+                } ud;
+                struct {
+                        struct ib_reth reth;
+                        __be32 imm_data;
+                } rc;
+                struct {
+                        __be32 aeth;
+                        __be64 atomic_ack_eth;
+                } at;
+                __be32 imm_data;
+                __be32 aeth;
+                struct ib_atomic_eth atomic_eth;
+        } u;
+} __attribute__ ((packed));
+
+/*
+ * Note that UD packets with a GRH header are 8+40+12+8 = 68 bytes
+ * long (72 w/ imm_data).  Only the first 56 bytes of the IB header
+ * will be in the eager header buffer.  The remaining 12 or 16 bytes
+ * are in the data buffer.
+ */
+struct ipath_ib_header {
+        __be16 lrh[4];
+        union {
+                struct {
+                        struct ib_grh grh;
+                        struct ipath_other_headers oth;
+                } l;
+                struct ipath_other_headers oth;
+        } u;
+} __attribute__ ((packed));
+
+/*
+ * There is one struct ipath_mcast for each multicast GID.
+ * All attached QPs are then stored as a list of
+ * struct ipath_mcast_qp.
+ */
+struct ipath_mcast_qp {
+        struct list_head list;
+        struct ipath_qp *qp;
+};
+
+struct ipath_mcast {
+        struct rb_node rb_node;
+        union ib_gid mgid;
+        struct list_head qp_list;
+        wait_queue_head_t wait;
+        atomic_t refcount;
+};
+
+/* Memory region */
+struct ipath_mr {
+        struct ib_mr ibmr;
+        struct ipath_mregion mr;        /* must be last */
+};
+
+/* Fast memory region */
+struct ipath_fmr {
+        struct ib_fmr ibfmr;
+        u8 page_shift;
+        struct ipath_mregion mr;        /* must be last */
+};
+
+/* Protection domain */
+struct ipath_pd {
+        struct ib_pd ibpd;
+        int user;               /* non-zero if created from user space */
+};
+
+/* Address Handle */
+struct ipath_ah {
+        struct ib_ah ibah;
+        struct ib_ah_attr attr;
+};
+
+/*
+ * Quick description of our CQ/QP locking scheme:
+ *
+ * We have one global lock that protects dev->cq/qp_table.  Each
+ * struct ipath_cq/qp also has its own lock.  An individual qp lock
+ * may be taken inside of an individual cq lock.  Both cqs attached to
+ * a qp may be locked, with the send cq locked first.  No other
+ * nesting should be done.
+ *
+ * Each struct ipath_cq/qp also has an atomic_t ref count.  The
+ * pointer from the cq/qp_table to the struct counts as one reference.
+ * This reference also is good for access through the consumer API, so
+ * modifying the CQ/QP etc doesn't need to take another reference.
+ * Access because of a completion being polled does need a reference.
+ *
+ * Finally, each struct ipath_cq/qp has a wait_queue_head_t for the
+ * destroy function to sleep on.
+ *
+ * This means that access from the consumer API requires nothing but
+ * taking the struct's lock.
+ *
+ * Access because of a completion event should go as follows:
+ * - lock cq/qp_table and look up struct
+ * - increment ref count in struct
+ * - drop cq/qp_table lock
+ * - lock struct, do your thing, and unlock struct
+ * - decrement ref count; if zero, wake up waiters
+ *
+ * To destroy a CQ/QP, we can do the following:
+ * - lock cq/qp_table, remove pointer, unlock cq/qp_table lock
+ * - decrement ref count
+ * - wait_event until ref count is zero
+ *
+ * It is the consumer's responsibilty to make sure that no QP
+ * operations (WQE posting or state modification) are pending when the
+ * QP is destroyed.  Also, the consumer must make sure that calls to
+ * qp_modify are serialized.
+ *
+ * Possible optimizations (wait for profile data to see if/where we
+ * have locks bouncing between CPUs):
+ * - split cq/qp table lock into n separate (cache-aligned) locks,
+ *   indexed (say) by the page in the table
+ */
+
+struct ipath_cq {
+        struct ib_cq ibcq;
+        struct tasklet_struct comptask;
+        spinlock_t lock;
+        u8 notify;
+        u8 triggered;
+        u32 head;               /* new records added to the head */
+        u32 tail;               /* poll_cq() reads from here. */
+        struct ib_wc *queue;    /* this is actually ibcq.cqe + 1 */
+};
+
+/*
+ * Send work request queue entry.
+ * The size of the sg_list is determined when the QP is created and stored
+ * in qp->s_max_sge.
+ */
+struct ipath_swqe {
+        struct ib_send_wr wr;   /* don't use wr.sg_list */
+        u32 psn;                /* first packet sequence number */
+        u32 lpsn;               /* last packet sequence number */
+        u32 ssn;                /* send sequence number */
+        u32 length;             /* total length of data in sg_list */
+        struct ipath_sge sg_list[0];
+};
+
+/*
+ * Receive work request queue entry.
+ * The size of the sg_list is determined when the QP is created and stored
+ * in qp->r_max_sge.
+ */
+struct ipath_rwqe {
+        u64 wr_id;
+        u32 length;             /* total length of data in sg_list */
+        u8 num_sge;
+        struct ipath_sge sg_list[0];
+};
+
+struct ipath_rq {
+        spinlock_t lock;
+        u32 head;               /* new work requests posted to the head */
+        u32 tail;               /* receives pull requests from here. */
+        u32 size;               /* size of RWQE array */
+        u8 max_sge;
+        struct ipath_rwqe *wq;  /* RWQE array */
+};
+
+struct ipath_srq {
+        struct ib_srq ibsrq;
+        struct ipath_rq rq;
+        /* send signal when number of RWQEs < limit */
+        u32 limit;
+};
+
+/*
+ * Variables prefixed with s_ are for the requester (sender).
+ * Variables prefixed with r_ are for the responder (receiver).
+ * Variables prefixed with ack_ are for responder replies.
+ *
+ * Common variables are protected by both r_rq.lock and s_lock in that order
+ * which only happens in modify_qp() or changing the QP 'state'.
+ */
+struct ipath_qp {
+        struct ib_qp ibqp;
+        struct ipath_qp *next;  /* link list for QPN hash table */
+        struct list_head piowait;       /* link for wait PIO buf */
+        struct list_head timerwait;     /* link for waiting for timeouts */
+        struct ib_ah_attr remote_ah_attr;
+        struct ipath_ib_header s_hdr;   /* next packet header to send */
+        atomic_t refcount;
+        wait_queue_head_t wait;
+        struct tasklet_struct s_task;
+        struct ipath_sge_state *s_cur_sge;
+        struct ipath_sge_state s_sge;   /* current send request data */
+        /* current RDMA read send data */
+        struct ipath_sge_state s_rdma_sge;
+        struct ipath_sge_state r_sge;   /* current receive data */
+        spinlock_t s_lock;
+        unsigned long s_flags;
+        u32 s_hdrwords;         /* size of s_hdr in 32 bit words */
+        u32 s_cur_size;         /* size of send packet in bytes */
+        u32 s_len;              /* total length of s_sge */
+        u32 s_rdma_len;         /* total length of s_rdma_sge */
+        u32 s_next_psn;         /* PSN for next request */
+        u32 s_last_psn;         /* last response PSN processed */
+        u32 s_psn;              /* current packet sequence number */
+        u32 s_rnr_timeout;      /* number of milliseconds for RNR timeout */
+        u32 s_ack_psn;          /* PSN for next ACK or RDMA_READ */
+        u64 s_ack_atomic;       /* data for atomic ACK */
+        u64 r_wr_id;            /* ID for current receive WQE */
+        u64 r_atomic_data;      /* data for last atomic op */
+        u32 r_atomic_psn;       /* PSN of last atomic op */
+        u32 r_len;              /* total length of r_sge */
+        u32 r_rcv_len;          /* receive data len processed */
+        u32 r_psn;              /* expected rcv packet sequence number */
+        u8 state;               /* QP state */
+        u8 s_state;             /* opcode of last packet sent */
+        u8 s_ack_state;         /* opcode of packet to ACK */
+        u8 s_nak_state;         /* non-zero if NAK is pending */
+        u8 r_state;             /* opcode of last packet received */
+        u8 r_reuse_sge;         /* for UC receive errors */
+        u8 r_sge_inx;           /* current index into sg_list */
+        u8 s_max_sge;           /* size of s_wq->sg_list */
+        u8 qp_access_flags;
+        u8 s_retry_cnt;         /* number of times to retry */
+        u8 s_rnr_retry_cnt;
+        u8 s_min_rnr_timer;
+        u8 s_retry;             /* requester retry counter */
+        u8 s_rnr_retry;         /* requester RNR retry counter */
+        u8 s_pkey_index;        /* PKEY index to use */
+        enum ib_mtu path_mtu;
+        atomic_t msn;           /* message sequence number */
+        u32 remote_qpn;
+        u32 qkey;               /* QKEY for this QP (for UD or RD) */
+        u32 s_size;             /* send work queue size */
+        u32 s_head;             /* new entries added here */
+        u32 s_tail;             /* next entry to process */
+        u32 s_cur;              /* current work queue entry */
+        u32 s_last;             /* last un-ACK'ed entry */
+        u32 s_ssn;              /* SSN of tail entry */
+        u32 s_lsn;              /* limit sequence number (credit) */
+        struct ipath_swqe *s_wq;        /* send work queue */
+        struct ipath_rq r_rq;   /* receive work queue */
+};
+
+/*
+ * Bit definitions for s_flags.
+ */
+#define IPATH_S_BUSY            0
+#define IPATH_S_SIGNAL_REQ_WR   1
+
+/*
+ * Since struct ipath_swqe is not a fixed size, we can't simply index into
+ * struct ipath_qp.s_wq.  This function does the array index computation.
+ */
+static inline struct ipath_swqe *get_swqe_ptr(struct ipath_qp *qp,
+                                              unsigned n)
+{
+        return (struct ipath_swqe *)((char *)qp->s_wq +
+                                     (sizeof(struct ipath_swqe) +
+                                      qp->s_max_sge *
+                                      sizeof(struct ipath_sge)) * n);
+}
+
+/*
+ * Since struct ipath_rwqe is not a fixed size, we can't simply index into
+ * struct ipath_rq.wq.  This function does the array index computation.
+ */
+static inline struct ipath_rwqe *get_rwqe_ptr(struct ipath_rq *rq,
+                                              unsigned n)
+{
+        return (struct ipath_rwqe *)
+                ((char *) rq->wq +
+                 (sizeof(struct ipath_rwqe) +
+                  rq->max_sge * sizeof(struct ipath_sge)) * n);
+}
+
+/*
+ * QPN-map pages start out as NULL, they get allocated upon
+ * first use and are never deallocated. This way,
+ * large bitmaps are not allocated unless large numbers of QPs are used.
+ */
+struct qpn_map {
+        atomic_t n_free;
+        void *page;
+};
+
+struct ipath_qp_table {
+        spinlock_t lock;
+        u32 last;               /* last QP number allocated */
+        u32 max;                /* size of the hash table */
+        u32 nmaps;              /* size of the map table */
+        struct ipath_qp **table;
+        /* bit map of free numbers */
+        struct qpn_map map[QPNMAP_ENTRIES];
+};
+
+struct ipath_lkey_table {
+        spinlock_t lock;
+        u32 next;               /* next unused index (speeds search) */
+        u32 gen;                /* generation count */
+        u32 max;                /* size of the table */
+        struct ipath_mregion **table;
+};
+
+struct ipath_opcode_stats {
+        u64 n_packets;          /* number of packets */
+        u64 n_bytes;            /* total number of bytes */
+};
+
+struct ipath_ibdev {
+        struct ib_device ibdev;
+        struct list_head dev_list;
+        struct ipath_devdata *dd;
+        int ib_unit;            /* This is the device number */
+        u16 sm_lid;             /* in host order */
+        u8 sm_sl;
+        u8 mkeyprot_resv_lmc;
+        /* non-zero when timer is set */
+        unsigned long mkey_lease_timeout;
+
+        /* The following fields are really per port. */
+        struct ipath_qp_table qp_table;
+        struct ipath_lkey_table lk_table;
+        struct list_head pending[3];    /* FIFO of QPs waiting for ACKs */
+        struct list_head piowait;       /* list for wait PIO buf */
+        /* list of QPs waiting for RNR timer */
+        struct list_head rnrwait;
+        spinlock_t pending_lock;
+        __be64 sys_image_guid;  /* in network order */
+        __be64 gid_prefix;      /* in network order */
+        __be64 mkey;
+        u64 ipath_sword;        /* total dwords sent (sample result) */
+        u64 ipath_rword;        /* total dwords received (sample result) */
+        u64 ipath_spkts;        /* total packets sent (sample result) */
+        u64 ipath_rpkts;        /* total packets received (sample result) */
+        /* # of ticks no data sent (sample result) */
+        u64 ipath_xmit_wait;
+        u64 rcv_errors;         /* # of packets with SW detected rcv errs */
+        u64 n_unicast_xmit;     /* total unicast packets sent */
+        u64 n_unicast_rcv;      /* total unicast packets received */
+        u64 n_multicast_xmit;   /* total multicast packets sent */
+        u64 n_multicast_rcv;    /* total multicast packets received */
+        u64 n_symbol_error_counter;     /* starting count for PMA */
+        u64 n_link_error_recovery_counter;      /* starting count for PMA */
+        u64 n_link_downed_counter;      /* starting count for PMA */
+        u64 n_port_rcv_errors;  /* starting count for PMA */
+        u64 n_port_rcv_remphys_errors;  /* starting count for PMA */
+        u64 n_port_xmit_discards;       /* starting count for PMA */
+        u64 n_port_xmit_data;   /* starting count for PMA */
+        u64 n_port_rcv_data;    /* starting count for PMA */
+        u64 n_port_xmit_packets;        /* starting count for PMA */
+        u64 n_port_rcv_packets; /* starting count for PMA */
+        u32 n_pkey_violations;  /* starting count for PMA */
+        u32 n_rc_resends;
+        u32 n_rc_acks;
+        u32 n_rc_qacks;
+        u32 n_seq_naks;
+        u32 n_rdma_seq;
+        u32 n_rnr_naks;
+        u32 n_other_naks;
+        u32 n_timeouts;
+        u32 n_pkt_drops;
+        u32 n_wqe_errs;
+        u32 n_rdma_dup_busy;
+        u32 n_piowait;
+        u32 n_no_piobuf;
+        u32 port_cap_flags;
+        u32 pma_sample_start;
+        u32 pma_sample_interval;
+        __be16 pma_counter_select[5];
+        u16 pma_tag;
+        u16 qkey_violations;
+        u16 mkey_violations;
+        u16 mkey_lease_period;
+        u16 pending_index;      /* which pending queue is active */
+        u8 pma_sample_status;
+        u8 subnet_timeout;
+        u8 link_width_enabled;
+        u8 vl_high_limit;
+        struct ipath_opcode_stats opstats[128];
+};
+
+struct ipath_ucontext {
+        struct ib_ucontext ibucontext;
+};
+
+static inline struct ipath_mr *to_imr(struct ib_mr *ibmr)
+{
+        return container_of(ibmr, struct ipath_mr, ibmr);
+}
+
+static inline struct ipath_fmr *to_ifmr(struct ib_fmr *ibfmr)
+{
+        return container_of(ibfmr, struct ipath_fmr, ibfmr);
+}
+
+static inline struct ipath_pd *to_ipd(struct ib_pd *ibpd)
+{
+        return container_of(ibpd, struct ipath_pd, ibpd);
+}
+
+static inline struct ipath_ah *to_iah(struct ib_ah *ibah)
+{
+        return container_of(ibah, struct ipath_ah, ibah);
+}
+
+static inline struct ipath_cq *to_icq(struct ib_cq *ibcq)
+{
+        return container_of(ibcq, struct ipath_cq, ibcq);
+}
+
+static inline struct ipath_srq *to_isrq(struct ib_srq *ibsrq)
+{
+        return container_of(ibsrq, struct ipath_srq, ibsrq);
+}
+
+static inline struct ipath_qp *to_iqp(struct ib_qp *ibqp)
+{
+        return container_of(ibqp, struct ipath_qp, ibqp);
+}
+
+static inline struct ipath_ibdev *to_idev(struct ib_device *ibdev)
+{
+        return container_of(ibdev, struct ipath_ibdev, ibdev);
+}
+
+int ipath_process_mad(struct ib_device *ibdev,
+                      int mad_flags,
+                      u8 port_num,
+                      struct ib_wc *in_wc,
+                      struct ib_grh *in_grh,
+                      struct ib_mad *in_mad, struct ib_mad *out_mad);
+
+static inline struct ipath_ucontext *to_iucontext(struct ib_ucontext
+                                                  *ibucontext)
+{
+        return container_of(ibucontext, struct ipath_ucontext, ibucontext);
+}
+
+/*
+ * Compare the lower 24 bits of the two values.
+ * Returns an integer <, ==, or > than zero.
+ */
+static inline int ipath_cmp24(u32 a, u32 b)
+{
+        return (((int) a) - ((int) b)) << 8;
+}
+
+struct ipath_mcast *ipath_mcast_find(union ib_gid *mgid);
+
+int ipath_multicast_attach(struct ib_qp *ibqp, union ib_gid *gid, u16 lid);
+
+int ipath_multicast_detach(struct ib_qp *ibqp, union ib_gid *gid, u16 lid);
+
+int ipath_mcast_tree_empty(void);
+
+__be32 ipath_compute_aeth(struct ipath_qp *qp);
+
+struct ipath_qp *ipath_lookup_qpn(struct ipath_qp_table *qpt, u32 qpn);
+
+struct ib_qp *ipath_create_qp(struct ib_pd *ibpd,
+                              struct ib_qp_init_attr *init_attr,
+                              struct ib_udata *udata);
+
+int ipath_destroy_qp(struct ib_qp *ibqp);
+
+int ipath_modify_qp(struct ib_qp *ibqp, struct ib_qp_attr *attr,
+                    int attr_mask);
+
+int ipath_query_qp(struct ib_qp *ibqp, struct ib_qp_attr *attr,
+                   int attr_mask, struct ib_qp_init_attr *init_attr);
+
+void ipath_free_all_qps(struct ipath_qp_table *qpt);
+
+int ipath_init_qp_table(struct ipath_ibdev *idev, int size);
+
+void ipath_sqerror_qp(struct ipath_qp *qp, struct ib_wc *wc);
+
+void ipath_error_qp(struct ipath_qp *qp);
+
+void ipath_get_credit(struct ipath_qp *qp, u32 aeth);
+
+void ipath_do_rc_send(unsigned long data);
+
+void ipath_do_uc_send(unsigned long data);
+
+void ipath_cq_enter(struct ipath_cq *cq, struct ib_wc *entry, int sig);
+
+int ipath_rkey_ok(struct ipath_ibdev *dev, struct ipath_sge_state *ss,
+                  u32 len, u64 vaddr, u32 rkey, int acc);
+
+int ipath_lkey_ok(struct ipath_lkey_table *rkt, struct ipath_sge *isge,
+                  struct ib_sge *sge, int acc);
+
+void ipath_copy_sge(struct ipath_sge_state *ss, void *data, u32 length);
+
+void ipath_skip_sge(struct ipath_sge_state *ss, u32 length);
+
+int ipath_post_rc_send(struct ipath_qp *qp, struct ib_send_wr *wr);
+
+void ipath_uc_rcv(struct ipath_ibdev *dev, struct ipath_ib_header *hdr,
+                  int has_grh, void *data, u32 tlen, struct ipath_qp *qp);
+
+void ipath_rc_rcv(struct ipath_ibdev *dev, struct ipath_ib_header *hdr,
+                  int has_grh, void *data, u32 tlen, struct ipath_qp *qp);
+
+void ipath_restart_rc(struct ipath_qp *qp, u32 psn, struct ib_wc *wc);
+
+void ipath_ud_loopback(struct ipath_qp *sqp, struct ipath_sge_state *ss,
+                       u32 length, struct ib_send_wr *wr, struct ib_wc *wc);
+
+int ipath_post_ud_send(struct ipath_qp *qp, struct ib_send_wr *wr);
+
+void ipath_ud_rcv(struct ipath_ibdev *dev, struct ipath_ib_header *hdr,
+                  int has_grh, void *data, u32 tlen, struct ipath_qp *qp);
+
+int ipath_alloc_lkey(struct ipath_lkey_table *rkt,
+                     struct ipath_mregion *mr);
+
+void ipath_free_lkey(struct ipath_lkey_table *rkt, u32 lkey);
+
+int ipath_lkey_ok(struct ipath_lkey_table *rkt, struct ipath_sge *isge,
+                  struct ib_sge *sge, int acc);
+
+int ipath_rkey_ok(struct ipath_ibdev *dev, struct ipath_sge_state *ss,
+                  u32 len, u64 vaddr, u32 rkey, int acc);
+
+int ipath_post_srq_receive(struct ib_srq *ibsrq, struct ib_recv_wr *wr,
+                           struct ib_recv_wr **bad_wr);
+
+struct ib_srq *ipath_create_srq(struct ib_pd *ibpd,
+                                struct ib_srq_init_attr *srq_init_attr,
+                                struct ib_udata *udata);
+
+int ipath_modify_srq(struct ib_srq *ibsrq, struct ib_srq_attr *attr,
+                     enum ib_srq_attr_mask attr_mask);
+
+int ipath_query_srq(struct ib_srq *ibsrq, struct ib_srq_attr *attr);
+
+int ipath_destroy_srq(struct ib_srq *ibsrq);
+
+void ipath_cq_enter(struct ipath_cq *cq, struct ib_wc *entry, int sig);
+
+int ipath_poll_cq(struct ib_cq *ibcq, int num_entries, struct ib_wc *entry);
+
+struct ib_cq *ipath_create_cq(struct ib_device *ibdev, int entries,
+                              struct ib_ucontext *context,
+                              struct ib_udata *udata);
+
+int ipath_destroy_cq(struct ib_cq *ibcq);
+
+int ipath_req_notify_cq(struct ib_cq *ibcq, enum ib_cq_notify notify);
+
+int ipath_resize_cq(struct ib_cq *ibcq, int cqe, struct ib_udata *udata);
+
+struct ib_mr *ipath_get_dma_mr(struct ib_pd *pd, int acc);
+
+struct ib_mr *ipath_reg_phys_mr(struct ib_pd *pd,
+                                struct ib_phys_buf *buffer_list,
+                                int num_phys_buf, int acc, u64 *iova_start);
+
+struct ib_mr *ipath_reg_user_mr(struct ib_pd *pd, struct ib_umem *region,
+                                int mr_access_flags,
+                                struct ib_udata *udata);
+
+int ipath_dereg_mr(struct ib_mr *ibmr);
+
+struct ib_fmr *ipath_alloc_fmr(struct ib_pd *pd, int mr_access_flags,
+                               struct ib_fmr_attr *fmr_attr);
+
+int ipath_map_phys_fmr(struct ib_fmr *ibfmr, u64 * page_list,
+                       int list_len, u64 iova);
+
+int ipath_unmap_fmr(struct list_head *fmr_list);
+
+int ipath_dealloc_fmr(struct ib_fmr *ibfmr);
+
+void ipath_no_bufs_available(struct ipath_qp *qp, struct ipath_ibdev *dev);
+
+void ipath_insert_rnr_queue(struct ipath_qp *qp);
+
+int ipath_get_rwqe(struct ipath_qp *qp, int wr_id_only);
+
+void ipath_ruc_loopback(struct ipath_qp *sqp, struct ib_wc *wc);
+
+extern const enum ib_wc_opcode ib_ipath_wc_opcode[];
+
+extern const u8 ipath_cvt_physportstate[];
+
+extern const int ib_ipath_state_ops[];
+
+extern unsigned int ib_ipath_lkey_table_size;
+
+extern const u32 ib_ipath_rnr_table[];
+
+#endif                          /* IPATH_VERBS_H */
diff --git a/drivers/infiniband/hw/ipath/ipath_verbs_mcast.c b/drivers/infiniband/hw/ipath/ipath_verbs_mcast.c
new file mode 100644
index 000000000000..10b31d2c4f20
--- /dev/null
+++ b/drivers/infiniband/hw/ipath/ipath_verbs_mcast.c
@@ -0,0 +1,333 @@
+/*
+ * Copyright (c) 2005, 2006 PathScale, Inc. All rights reserved.
+ *
+ * This software is available to you under a choice of one of two
+ * licenses.  You may choose to be licensed under the terms of the GNU
+ * General Public License (GPL) Version 2, available from the file
+ * COPYING in the main directory of this source tree, or the
+ * OpenIB.org BSD license below:
+ *
+ *     Redistribution and use in source and binary forms, with or
+ *     without modification, are permitted provided that the following
+ *     conditions are met:
+ *
+ *      - Redistributions of source code must retain the above
+ *        copyright notice, this list of conditions and the following
+ *        disclaimer.
+ *
+ *      - Redistributions in binary form must reproduce the above
+ *        copyright notice, this list of conditions and the following
+ *        disclaimer in the documentation and/or other materials
+ *        provided with the distribution.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+ * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+ * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+ * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
+ * BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
+ * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
+ * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+ * SOFTWARE.
+ */
+
+#include <linux/list.h>
+#include <linux/rcupdate.h>
+
+#include "ipath_verbs.h"
+
+/*
+ * Global table of GID to attached QPs.
+ * The table is global to all ipath devices since a send from one QP/device
+ * needs to be locally routed to any locally attached QPs on the same
+ * or different device.
+ */
+static struct rb_root mcast_tree;
+static DEFINE_SPINLOCK(mcast_lock);
+
+/**
+ * ipath_mcast_qp_alloc - alloc a struct to link a QP to mcast GID struct
+ * @qp: the QP to link
+ */
+static struct ipath_mcast_qp *ipath_mcast_qp_alloc(struct ipath_qp *qp)
+{
+        struct ipath_mcast_qp *mqp;
+
+        mqp = kmalloc(sizeof *mqp, GFP_KERNEL);
+        if (!mqp)
+                goto bail;
+
+        mqp->qp = qp;
+        atomic_inc(&qp->refcount);
+
+bail:
+        return mqp;
+}
+
+static void ipath_mcast_qp_free(struct ipath_mcast_qp *mqp)
+{
+        struct ipath_qp *qp = mqp->qp;
+
+        /* Notify ipath_destroy_qp() if it is waiting. */
+        if (atomic_dec_and_test(&qp->refcount))
+                wake_up(&qp->wait);
+
+        kfree(mqp);
+}
+
+/**
+ * ipath_mcast_alloc - allocate the multicast GID structure
+ * @mgid: the multicast GID
+ *
+ * A list of QPs will be attached to this structure.
+ */
+static struct ipath_mcast *ipath_mcast_alloc(union ib_gid *mgid)
+{
+        struct ipath_mcast *mcast;
+
+        mcast = kmalloc(sizeof *mcast, GFP_KERNEL);
+        if (!mcast)
+                goto bail;
+
+        mcast->mgid = *mgid;
+        INIT_LIST_HEAD(&mcast->qp_list);
+        init_waitqueue_head(&mcast->wait);
+        atomic_set(&mcast->refcount, 0);
+
+bail:
+        return mcast;
+}
+
+static void ipath_mcast_free(struct ipath_mcast *mcast)
+{
+        struct ipath_mcast_qp *p, *tmp;
+
+        list_for_each_entry_safe(p, tmp, &mcast->qp_list, list)
+                ipath_mcast_qp_free(p);
+
+        kfree(mcast);
+}
+
+/**
+ * ipath_mcast_find - search the global table for the given multicast GID
+ * @mgid: the multicast GID to search for
+ *
+ * Returns NULL if not found.
+ *
+ * The caller is responsible for decrementing the reference count if found.
+ */
+struct ipath_mcast *ipath_mcast_find(union ib_gid *mgid)
+{
+        struct rb_node *n;
+        unsigned long flags;
+        struct ipath_mcast *mcast;
+
+        spin_lock_irqsave(&mcast_lock, flags);
+        n = mcast_tree.rb_node;
+        while (n) {
+                int ret;
+
+                mcast = rb_entry(n, struct ipath_mcast, rb_node);
+
+                ret = memcmp(mgid->raw, mcast->mgid.raw,
+                             sizeof(union ib_gid));
+                if (ret < 0)
+                        n = n->rb_left;
+                else if (ret > 0)
+                        n = n->rb_right;
+                else {
+                        atomic_inc(&mcast->refcount);
+                        spin_unlock_irqrestore(&mcast_lock, flags);
+                        goto bail;
+                }
+        }
+        spin_unlock_irqrestore(&mcast_lock, flags);
+
+        mcast = NULL;
+
+bail:
+        return mcast;
+}
+
+/**
+ * ipath_mcast_add - insert mcast GID into table and attach QP struct
+ * @mcast: the mcast GID table
+ * @mqp: the QP to attach
+ *
+ * Return zero if both were added.  Return EEXIST if the GID was already in
+ * the table but the QP was added.  Return ESRCH if the QP was already
+ * attached and neither structure was added.
+ */
+static int ipath_mcast_add(struct ipath_mcast *mcast,
+                           struct ipath_mcast_qp *mqp)
+{
+        struct rb_node **n = &mcast_tree.rb_node;
+        struct rb_node *pn = NULL;
+        unsigned long flags;
+        int ret;
+
+        spin_lock_irqsave(&mcast_lock, flags);
+
+        while (*n) {
+                struct ipath_mcast *tmcast;
+                struct ipath_mcast_qp *p;
+
+                pn = *n;
+                tmcast = rb_entry(pn, struct ipath_mcast, rb_node);
+
+                ret = memcmp(mcast->mgid.raw, tmcast->mgid.raw,
+                             sizeof(union ib_gid));
+                if (ret < 0) {
+                        n = &pn->rb_left;
+                        continue;
+                }
+                if (ret > 0) {
+                        n = &pn->rb_right;
+                        continue;
+                }
+
+                /* Search the QP list to see if this is already there. */
+                list_for_each_entry_rcu(p, &tmcast->qp_list, list) {
+                        if (p->qp == mqp->qp) {
+                                spin_unlock_irqrestore(&mcast_lock, flags);
+                                ret = ESRCH;
+                                goto bail;
+                        }
+                }
+                list_add_tail_rcu(&mqp->list, &tmcast->qp_list);
+                spin_unlock_irqrestore(&mcast_lock, flags);
+                ret = EEXIST;
+                goto bail;
+        }
+
+        list_add_tail_rcu(&mqp->list, &mcast->qp_list);
+
+        atomic_inc(&mcast->refcount);
+        rb_link_node(&mcast->rb_node, pn, n);
+        rb_insert_color(&mcast->rb_node, &mcast_tree);
+
+        spin_unlock_irqrestore(&mcast_lock, flags);
+
+        ret = 0;
+
+bail:
+        return ret;
+}
+
+int ipath_multicast_attach(struct ib_qp *ibqp, union ib_gid *gid, u16 lid)
+{
+        struct ipath_qp *qp = to_iqp(ibqp);
+        struct ipath_mcast *mcast;
+        struct ipath_mcast_qp *mqp;
+        int ret;
+
+        /*
+         * Allocate data structures since its better to do this outside of
+         * spin locks and it will most likely be needed.
+         */
+        mcast = ipath_mcast_alloc(gid);
+        if (mcast == NULL) {
+                ret = -ENOMEM;
+                goto bail;
+        }
+        mqp = ipath_mcast_qp_alloc(qp);
+        if (mqp == NULL) {
+                ipath_mcast_free(mcast);
+                ret = -ENOMEM;
+                goto bail;
+        }
+        switch (ipath_mcast_add(mcast, mqp)) {
+        case ESRCH:
+                /* Neither was used: can't attach the same QP twice. */
+                ipath_mcast_qp_free(mqp);
+                ipath_mcast_free(mcast);
+                ret = -EINVAL;
+                goto bail;
+        case EEXIST:            /* The mcast wasn't used */
+                ipath_mcast_free(mcast);
+                break;
+        default:
+                break;
+        }
+
+        ret = 0;
+
+bail:
+        return ret;
+}
+
+int ipath_multicast_detach(struct ib_qp *ibqp, union ib_gid *gid, u16 lid)
+{
+        struct ipath_qp *qp = to_iqp(ibqp);
+        struct ipath_mcast *mcast = NULL;
+        struct ipath_mcast_qp *p, *tmp;
+        struct rb_node *n;
+        unsigned long flags;
+        int last = 0;
+        int ret;
+
+        spin_lock_irqsave(&mcast_lock, flags);
+
+        /* Find the GID in the mcast table. */
+        n = mcast_tree.rb_node;
+        while (1) {
+                if (n == NULL) {
+                        spin_unlock_irqrestore(&mcast_lock, flags);
+                        ret = 0;
+                        goto bail;
+                }
+
+                mcast = rb_entry(n, struct ipath_mcast, rb_node);
+                ret = memcmp(gid->raw, mcast->mgid.raw,
+                             sizeof(union ib_gid));
+                if (ret < 0)
+                        n = n->rb_left;
+                else if (ret > 0)
+                        n = n->rb_right;
+                else
+                        break;
+        }
+
+        /* Search the QP list. */
+        list_for_each_entry_safe(p, tmp, &mcast->qp_list, list) {
+                if (p->qp != qp)
+                        continue;
+                /*
+                 * We found it, so remove it, but don't poison the forward
+                 * link until we are sure there are no list walkers.
+                 */
+                list_del_rcu(&p->list);
+
+                /* If this was the last attached QP, remove the GID too. */
+                if (list_empty(&mcast->qp_list)) {
+                        rb_erase(&mcast->rb_node, &mcast_tree);
+                        last = 1;
+                }
+                break;
+        }
+
+        spin_unlock_irqrestore(&mcast_lock, flags);
+
+        if (p) {
+                /*
+                 * Wait for any list walkers to finish before freeing the
+                 * list element.
+                 */
+                wait_event(mcast->wait, atomic_read(&mcast->refcount) <= 1);
+                ipath_mcast_qp_free(p);
+        }
+        if (last) {
+                atomic_dec(&mcast->refcount);
+                wait_event(mcast->wait, !atomic_read(&mcast->refcount));
+                ipath_mcast_free(mcast);
+        }
+
+        ret = 0;
+
+bail:
+        return ret;
+}
+
+int ipath_mcast_tree_empty(void)
+{
+        return mcast_tree.rb_node == NULL;
+}
diff --git a/drivers/infiniband/hw/ipath/ipath_wc_x86_64.c b/drivers/infiniband/hw/ipath/ipath_wc_x86_64.c
new file mode 100644
index 000000000000..adc5322f15c1
--- /dev/null
+++ b/drivers/infiniband/hw/ipath/ipath_wc_x86_64.c
@@ -0,0 +1,157 @@
+/*
+ * Copyright (c) 2003, 2004, 2005, 2006 PathScale, Inc. All rights reserved.
+ *
+ * This software is available to you under a choice of one of two
+ * licenses.  You may choose to be licensed under the terms of the GNU
+ * General Public License (GPL) Version 2, available from the file
+ * COPYING in the main directory of this source tree, or the
+ * OpenIB.org BSD license below:
+ *
+ *     Redistribution and use in source and binary forms, with or
+ *     without modification, are permitted provided that the following
+ *     conditions are met:
+ *
+ *      - Redistributions of source code must retain the above
+ *        copyright notice, this list of conditions and the following
+ *        disclaimer.
+ *
+ *      - Redistributions in binary form must reproduce the above
+ *        copyright notice, this list of conditions and the following
+ *        disclaimer in the documentation and/or other materials
+ *        provided with the distribution.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+ * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+ * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+ * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
+ * BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
+ * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
+ * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+ * SOFTWARE.
+ */
+
+/*
+ * This file is conditionally built on x86_64 only.  Otherwise weak symbol
+ * versions of the functions exported from here are used.
+ */
+
+#include <linux/pci.h>
+#include <asm/mtrr.h>
+#include <asm/processor.h>
+
+#include "ipath_kernel.h"
+
+/**
+ * ipath_enable_wc - enable write combining for MMIO writes to the device
+ * @dd: infinipath device
+ *
+ * This routine is x86_64-specific; it twiddles the CPU's MTRRs to enable
+ * write combining.
+ */
+int ipath_enable_wc(struct ipath_devdata *dd)
+{
+        int ret = 0;
+        u64 pioaddr, piolen;
+        unsigned bits;
+        const unsigned long addr = pci_resource_start(dd->pcidev, 0);
+        const size_t len = pci_resource_len(dd->pcidev, 0);
+
+        /*
+         * Set the PIO buffers to be WCCOMB, so we get HT bursts to the
+         * chip.  Linux (possibly the hardware) requires it to be on a power
+         * of 2 address matching the length (which has to be a power of 2).
+         * For rev1, that means the base address, for rev2, it will be just
+         * the PIO buffers themselves.
+         */
+        pioaddr = addr + dd->ipath_piobufbase;
+        piolen = (dd->ipath_piobcnt2k +
+                  dd->ipath_piobcnt4k) *
+                ALIGN(dd->ipath_piobcnt2k +
+                      dd->ipath_piobcnt4k, dd->ipath_palign);
+
+        for (bits = 0; !(piolen & (1ULL << bits)); bits++)
+                /* do nothing */ ;
+
+        if (piolen != (1ULL << bits)) {
+                piolen >>= bits;
+                while (piolen >>= 1)
+                        bits++;
+                piolen = 1ULL << (bits + 1);
+        }
+        if (pioaddr & (piolen - 1)) {
+                u64 atmp;
+                ipath_dbg("pioaddr %llx not on right boundary for size "
+                          "%llx, fixing\n",
+                          (unsigned long long) pioaddr,
+                          (unsigned long long) piolen);
+                atmp = pioaddr & ~(piolen - 1);
+                if (atmp < addr || (atmp + piolen) > (addr + len)) {
+                        ipath_dev_err(dd, "No way to align address/size "
+                                      "(%llx/%llx), no WC mtrr\n",
+                                      (unsigned long long) atmp,
+                                      (unsigned long long) piolen << 1);
+                        ret = -ENODEV;
+                } else {
+                        ipath_dbg("changing WC base from %llx to %llx, "
+                                  "len from %llx to %llx\n",
+                                  (unsigned long long) pioaddr,
+                                  (unsigned long long) atmp,
+                                  (unsigned long long) piolen,
+                                  (unsigned long long) piolen << 1);
+                        pioaddr = atmp;
+                        piolen <<= 1;
+                }
+        }
+
+        if (!ret) {
+                int cookie;
+                ipath_cdbg(VERBOSE, "Setting mtrr for chip to WC "
+                           "(addr %llx, len=0x%llx)\n",
+                           (unsigned long long) pioaddr,
+                           (unsigned long long) piolen);
+                cookie = mtrr_add(pioaddr, piolen, MTRR_TYPE_WRCOMB, 0);
+                if (cookie < 0) {
+                        {
+                                dev_info(&dd->pcidev->dev,
+                                         "mtrr_add()  WC for PIO bufs "
+                                         "failed (%d)\n",
+                                         cookie);
+                                ret = -EINVAL;
+                        }
+                } else {
+                        ipath_cdbg(VERBOSE, "Set mtrr for chip to WC, "
+                                   "cookie is %d\n", cookie);
+                        dd->ipath_wc_cookie = cookie;
+                }
+        }
+
+        return ret;
+}
+
+/**
+ * ipath_disable_wc - disable write combining for MMIO writes to the device
+ * @dd: infinipath device
+ */
+void ipath_disable_wc(struct ipath_devdata *dd)
+{
+        if (dd->ipath_wc_cookie) {
+                ipath_cdbg(VERBOSE, "undoing WCCOMB on pio buffers\n");
+                mtrr_del(dd->ipath_wc_cookie, 0, 0);
+                dd->ipath_wc_cookie = 0;
+        }
+}
+
+/**
+ * ipath_unordered_wc - indicate whether write combining is ordered
+ *
+ * Because our performance depends on our ability to do write combining mmio
+ * writes in the most efficient way, we need to know if we are on an Intel
+ * or AMD x86_64 processor.  AMD x86_64 processors flush WC buffers out in
+ * the order completed, and so no special flushing is required to get
+ * correct ordering.  Intel processors, however, will flush write buffers
+ * out in "random" orders, and so explicit ordering is needed at times.
+ */
+int ipath_unordered_wc(void)
+{
+        return boot_cpu_data.x86_vendor != X86_VENDOR_AMD;
+}
diff --git a/drivers/infiniband/hw/ipath/ips_common.h b/drivers/infiniband/hw/ipath/ips_common.h
new file mode 100644
index 000000000000..410a764dfcef
--- /dev/null
+++ b/drivers/infiniband/hw/ipath/ips_common.h
@@ -0,0 +1,263 @@
+#ifndef IPS_COMMON_H
+#define IPS_COMMON_H
+/*
+ * Copyright (c) 2003, 2004, 2005, 2006 PathScale, Inc. All rights reserved.
+ *
+ * This software is available to you under a choice of one of two
+ * licenses.  You may choose to be licensed under the terms of the GNU
+ * General Public License (GPL) Version 2, available from the file
+ * COPYING in the main directory of this source tree, or the
+ * OpenIB.org BSD license below:
+ *
+ *     Redistribution and use in source and binary forms, with or
+ *     without modification, are permitted provided that the following
+ *     conditions are met:
+ *
+ *      - Redistributions of source code must retain the above
+ *        copyright notice, this list of conditions and the following
+ *        disclaimer.
+ *
+ *      - Redistributions in binary form must reproduce the above
+ *        copyright notice, this list of conditions and the following
+ *        disclaimer in the documentation and/or other materials
+ *        provided with the distribution.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+ * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+ * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+ * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
+ * BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
+ * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
+ * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+ * SOFTWARE.
+ */
+
+#include "ipath_common.h"
+
+struct ipath_header {
+        /*
+         * Version - 4 bits, Port - 4 bits, TID - 10 bits and Offset -
+         * 14 bits before ECO change ~28 Dec 03.  After that, Vers 4,
+         * Port 3, TID 11, offset 14.
+         */
+        __le32 ver_port_tid_offset;
+        __le16 chksum;
+        __le16 pkt_flags;
+};
+
+struct ips_message_header {
+        __be16 lrh[4];
+        __be32 bth[3];
+        /* fields below this point are in host byte order */
+        struct ipath_header iph;
+        __u8 sub_opcode;
+        __u8 flags;
+        __u16 src_rank;
+        /* 24 bits. The upper 8 bit is available for other use */
+        union {
+                struct {
+                        unsigned ack_seq_num:24;
+                        unsigned port:4;
+                        unsigned unused:4;
+                };
+                __u32 ack_seq_num_org;
+        };
+        __u8 expected_tid_session_id;
+        __u8 tinylen;           /* to aid MPI */
+        union {
+            __u16 tag;          /* to aid MPI */
+            __u16 mqhdr;        /* for PSM MQ */
+        };
+        union {
+                __u32 mpi[4];   /* to aid MPI */
+                __u32 data[4];
+                __u64 mq[2];    /* for PSM MQ */
+                struct {
+                        __u16 mtu;
+                        __u8 major_ver;
+                        __u8 minor_ver;
+                        __u32 not_used; //free
+                        __u32 run_id;
+                        __u32 client_ver;
+                };
+        };
+};
+
+struct ether_header {
+        __be16 lrh[4];
+        __be32 bth[3];
+        struct ipath_header iph;
+        __u8 sub_opcode;
+        __u8 cmd;
+        __be16 lid;
+        __u16 mac[3];
+        __u8 frag_num;
+        __u8 seq_num;
+        __le32 len;
+        /* MUST be of word size due to PIO write requirements */
+        __u32 csum;
+        __le16 csum_offset;
+        __le16 flags;
+        __u16 first_2_bytes;
+        __u8 unused[2];         /* currently unused */
+};
+
+/*
+ * The PIO buffer used for sending infinipath messages must only be written
+ * in 32-bit words, all the data must be written, and no writes can occur
+ * after the last word is written (which transfers "ownership" of the buffer
+ * to the chip and triggers the message to be sent).
+ * Since the Linux sk_buff structure can be recursive, non-aligned, and
+ * any number of bytes in each segment, we use the following structure
+ * to keep information about the overall state of the copy operation.
+ * This is used to save the information needed to store the checksum
+ * in the right place before sending the last word to the hardware and
+ * to buffer the last 0-3 bytes of non-word sized segments.
+ */
+struct copy_data_s {
+        struct ether_header *hdr;
+        /* addr of PIO buf to write csum to */
+        __u32 __iomem *csum_pio;
+        __u32 __iomem *to;      /* addr of PIO buf to write data to */
+        __u32 device;           /* which device to allocate PIO bufs from */
+        __s32 error;            /* set if there is an error. */
+        __s32 extra;            /* amount of data saved in u.buf below */
+        __u32 len;              /* total length to send in bytes */
+        __u32 flen;             /* frament length in words */
+        __u32 csum;             /* partial IP checksum */
+        __u32 pos;              /* position for partial checksum */
+        __u32 offset;           /* offset to where data currently starts */
+        __s32 checksum_calc;    /* set to 1 when csum has been calculated */
+        struct sk_buff *skb;
+        union {
+                __u32 w;
+                __u8 buf[4];
+        } u;
+};
+
+/* IB - LRH header consts */
+#define IPS_LRH_GRH 0x0003      /* 1. word of IB LRH - next header: GRH */
+#define IPS_LRH_BTH 0x0002      /* 1. word of IB LRH - next header: BTH */
+
+#define IPS_OFFSET  0
+
+/*
+ * defines the cut-off point between the header queue and eager/expected
+ * TID queue
+ */
+#define NUM_OF_EXTRA_WORDS_IN_HEADER_QUEUE \
+        ((sizeof(struct ips_message_header) - \
+          offsetof(struct ips_message_header, iph)) >> 2)
+
+/* OpCodes  */
+#define OPCODE_IPS 0xC0
+#define OPCODE_ITH4X 0xC1
+
+/* OpCode 30 is use by stand-alone test programs  */
+#define OPCODE_RAW_DATA 0xDE
+/* last OpCode (31) is reserved for test  */
+#define OPCODE_TEST 0xDF
+
+/* sub OpCodes - ips  */
+#define OPCODE_SEQ_DATA 0x01
+#define OPCODE_SEQ_CTRL 0x02
+
+#define OPCODE_SEQ_MQ_DATA 0x03
+#define OPCODE_SEQ_MQ_CTRL 0x04
+
+#define OPCODE_ACK 0x10
+#define OPCODE_NAK 0x11
+
+#define OPCODE_ERR_CHK 0x20
+#define OPCODE_ERR_CHK_PLS 0x21
+
+#define OPCODE_STARTUP 0x30
+#define OPCODE_STARTUP_ACK 0x31
+#define OPCODE_STARTUP_NAK 0x32
+
+#define OPCODE_STARTUP_EXT 0x34
+#define OPCODE_STARTUP_ACK_EXT 0x35
+#define OPCODE_STARTUP_NAK_EXT 0x36
+
+#define OPCODE_TIDS_RELEASE 0x40
+#define OPCODE_TIDS_RELEASE_CONFIRM 0x41
+
+#define OPCODE_CLOSE 0x50
+#define OPCODE_CLOSE_ACK 0x51
+/*
+ * like OPCODE_CLOSE, but no complaint if other side has already closed.
+ * Used when doing abort(), MPI_Abort(), etc.
+ */
+#define OPCODE_ABORT 0x52
+
+/* sub OpCodes - ith4x  */
+#define OPCODE_ENCAP 0x81
+#define OPCODE_LID_ARP 0x82
+
+/* Receive Header Queue: receive type (from infinipath) */
+#define RCVHQ_RCV_TYPE_EXPECTED  0
+#define RCVHQ_RCV_TYPE_EAGER     1
+#define RCVHQ_RCV_TYPE_NON_KD    2
+#define RCVHQ_RCV_TYPE_ERROR     3
+
+/* misc. */
+#define SIZE_OF_CRC 1
+
+#define EAGER_TID_ID INFINIPATH_I_TID_MASK
+
+#define IPS_DEFAULT_P_KEY 0xFFFF
+
+#define IPS_PERMISSIVE_LID 0xFFFF
+#define IPS_MULTICAST_LID_BASE 0xC000
+
+#define IPS_AETH_CREDIT_SHIFT 24
+#define IPS_AETH_CREDIT_MASK 0x1F
+#define IPS_AETH_CREDIT_INVAL 0x1F
+
+#define IPS_PSN_MASK 0xFFFFFF
+#define IPS_MSN_MASK 0xFFFFFF
+#define IPS_QPN_MASK 0xFFFFFF
+#define IPS_MULTICAST_QPN 0xFFFFFF
+
+/* functions for extracting fields from rcvhdrq entries */
+static inline __u32 ips_get_hdr_err_flags(const __le32 * rbuf)
+{
+        return __le32_to_cpu(rbuf[1]);
+}
+
+static inline __u32 ips_get_index(const __le32 * rbuf)
+{
+        return (__le32_to_cpu(rbuf[0]) >> INFINIPATH_RHF_EGRINDEX_SHIFT)
+            & INFINIPATH_RHF_EGRINDEX_MASK;
+}
+
+static inline __u32 ips_get_rcv_type(const __le32 * rbuf)
+{
+        return (__le32_to_cpu(rbuf[0]) >> INFINIPATH_RHF_RCVTYPE_SHIFT)
+            & INFINIPATH_RHF_RCVTYPE_MASK;
+}
+
+static inline __u32 ips_get_length_in_bytes(const __le32 * rbuf)
+{
+        return ((__le32_to_cpu(rbuf[0]) >> INFINIPATH_RHF_LENGTH_SHIFT)
+                & INFINIPATH_RHF_LENGTH_MASK) << 2;
+}
+
+static inline void *ips_get_first_protocol_header(const __u32 * rbuf)
+{
+        return (void *)&rbuf[2];
+}
+
+static inline struct ips_message_header *ips_get_ips_header(const __u32 *
+                                                            rbuf)
+{
+        return (struct ips_message_header *)&rbuf[2];
+}
+
+static inline __u32 ips_get_ipath_ver(__le32 hdrword)
+{
+        return (__le32_to_cpu(hdrword) >> INFINIPATH_I_VERS_SHIFT)
+            & INFINIPATH_I_VERS_MASK;
+}
+
+#endif                          /* IPS_COMMON_H */
diff --git a/drivers/infiniband/hw/ipath/verbs_debug.h b/drivers/infiniband/hw/ipath/verbs_debug.h
new file mode 100644
index 000000000000..40d693cf3f94
--- /dev/null
+++ b/drivers/infiniband/hw/ipath/verbs_debug.h
@@ -0,0 +1,107 @@
+/*
+ * Copyright (c) 2003, 2004, 2005, 2006 PathScale, Inc. All rights reserved.
+ *
+ * This software is available to you under a choice of one of two
+ * licenses.  You may choose to be licensed under the terms of the GNU
+ * General Public License (GPL) Version 2, available from the file
+ * COPYING in the main directory of this source tree, or the
+ * OpenIB.org BSD license below:
+ *
+ *     Redistribution and use in source and binary forms, with or
+ *     without modification, are permitted provided that the following
+ *     conditions are met:
+ *
+ *      - Redistributions of source code must retain the above
+ *        copyright notice, this list of conditions and the following
+ *        disclaimer.
+ *
+ *      - Redistributions in binary form must reproduce the above
+ *        copyright notice, this list of conditions and the following
+ *        disclaimer in the documentation and/or other materials
+ *        provided with the distribution.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+ * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+ * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+ * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
+ * BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
+ * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
+ * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+ * SOFTWARE.
+ */
+
+#ifndef _VERBS_DEBUG_H
+#define _VERBS_DEBUG_H
+
+/*
+ * This file contains tracing code for the ib_ipath kernel module.
+ */
+#ifndef _VERBS_DEBUGGING        /* tracing enabled or not */
+#define _VERBS_DEBUGGING 1
+#endif
+
+extern unsigned ib_ipath_debug;
+
+#define _VERBS_ERROR(fmt,...) \
+        do { \
+                printk(KERN_ERR "%s: " fmt, "ib_ipath", ##__VA_ARGS__); \
+        } while(0)
+
+#define _VERBS_UNIT_ERROR(unit,fmt,...) \
+        do { \
+                printk(KERN_ERR "%s: " fmt, "ib_ipath", ##__VA_ARGS__); \
+        } while(0)
+
+#if _VERBS_DEBUGGING
+
+/*
+ * Mask values for debugging.  The scheme allows us to compile out any
+ * of the debug tracing stuff, and if compiled in, to enable or
+ * disable dynamically.
+ * This can be set at modprobe time also:
+ *      modprobe ib_path ib_ipath_debug=3
+ */
+
+#define __VERBS_INFO        0x1 /* generic low verbosity stuff */
+#define __VERBS_DBG         0x2 /* generic debug */
+#define __VERBS_VDBG        0x4 /* verbose debug */
+#define __VERBS_SMADBG      0x8000      /* sma packet debug */
+
+#define _VERBS_INFO(fmt,...) \
+        do { \
+                if (unlikely(ib_ipath_debug&__VERBS_INFO)) \
+                        printk(KERN_INFO "%s: " fmt,"ib_ipath", \
+                               ##__VA_ARGS__); \
+        } while(0)
+
+#define _VERBS_DBG(fmt,...) \
+        do { \
+                if (unlikely(ib_ipath_debug&__VERBS_DBG)) \
+                        printk(KERN_DEBUG "%s: " fmt, __func__, \
+                               ##__VA_ARGS__); \
+        } while(0)
+
+#define _VERBS_VDBG(fmt,...) \
+        do { \
+                if (unlikely(ib_ipath_debug&__VERBS_VDBG)) \
+                        printk(KERN_DEBUG "%s: " fmt, __func__, \
+                               ##__VA_ARGS__); \
+        } while(0)
+
+#define _VERBS_SMADBG(fmt,...) \
+        do { \
+                if (unlikely(ib_ipath_debug&__VERBS_SMADBG)) \
+                        printk(KERN_DEBUG "%s: " fmt, __func__, \
+                               ##__VA_ARGS__); \
+        } while(0)
+
+#else /* ! _VERBS_DEBUGGING */
+
+#define _VERBS_INFO(fmt,...)
+#define _VERBS_DBG(fmt,...)
+#define _VERBS_VDBG(fmt,...)
+#define _VERBS_SMADBG(fmt,...)
+
+#endif /* _VERBS_DEBUGGING */
+
+#endif /* _VERBS_DEBUG_H */
diff --git a/drivers/input/evbug.c b/drivers/input/evbug.c
index d7828936fd8f..07358fb51b82 100644
--- a/drivers/input/evbug.c
+++ b/drivers/input/evbug.c
@@ -49,9 +49,8 @@ static struct input_handle *evbug_connect(struct input_handler *handler, struct
 {
         struct input_handle *handle;
 
-        if (!(handle = kmalloc(sizeof(struct input_handle), GFP_KERNEL)))
+        if (!(handle = kzalloc(sizeof(struct input_handle), GFP_KERNEL)))
                 return NULL;
-        memset(handle, 0, sizeof(struct input_handle));
 
         handle->dev = dev;
         handle->handler = handler;
diff --git a/drivers/input/evdev.c b/drivers/input/evdev.c
index 745979f33dc2..a34e3d91d9ed 100644
--- a/drivers/input/evdev.c
+++ b/drivers/input/evdev.c
@@ -130,9 +130,8 @@ static int evdev_open(struct inode * inode, struct file * file)
         if ((accept_err = input_accept_process(&(evdev_table[i]->handle), file)))
                 return accept_err;
 
-        if (!(list = kmalloc(sizeof(struct evdev_list), GFP_KERNEL)))
+        if (!(list = kzalloc(sizeof(struct evdev_list), GFP_KERNEL)))
                 return -ENOMEM;
-        memset(list, 0, sizeof(struct evdev_list));
 
         list->evdev = evdev_table[i];
         list_add_tail(&list->node, &evdev_table[i]->list);
@@ -609,9 +608,8 @@ static struct input_handle *evdev_connect(struct input_handler *handler, struct
                 return NULL;
         }
 
-        if (!(evdev = kmalloc(sizeof(struct evdev), GFP_KERNEL)))
+        if (!(evdev = kzalloc(sizeof(struct evdev), GFP_KERNEL)))
                 return NULL;
-        memset(evdev, 0, sizeof(struct evdev));
 
         INIT_LIST_HEAD(&evdev->list);
         init_waitqueue_head(&evdev->wait);
diff --git a/drivers/input/gameport/gameport.c b/drivers/input/gameport/gameport.c
index b765a155c008..36644bff379d 100644
--- a/drivers/input/gameport/gameport.c
+++ b/drivers/input/gameport/gameport.c
@@ -22,6 +22,7 @@
 #include <linux/delay.h>
 #include <linux/kthread.h>
 #include <linux/sched.h>        /* HZ */
+#include <linux/mutex.h>
 
 /*#include <asm/io.h>*/
 
@@ -43,10 +44,10 @@ EXPORT_SYMBOL(gameport_start_polling);
 EXPORT_SYMBOL(gameport_stop_polling);
 
 /*
- * gameport_sem protects entire gameport subsystem and is taken
+ * gameport_mutex protects entire gameport subsystem and is taken
  * every time gameport port or driver registrered or unregistered.
  */
-static DECLARE_MUTEX(gameport_sem);
+static DEFINE_MUTEX(gameport_mutex);
 
 static LIST_HEAD(gameport_list);
 
@@ -265,6 +266,7 @@ static void gameport_queue_event(void *object, struct module *owner,
         if ((event = kmalloc(sizeof(struct gameport_event), GFP_ATOMIC))) {
                 if (!try_module_get(owner)) {
                         printk(KERN_WARNING "gameport: Can't get module reference, dropping event %d\n", event_type);
+                        kfree(event);
                         goto out;
                 }
 
@@ -342,7 +344,7 @@ static void gameport_handle_event(void)
         struct gameport_event *event;
         struct gameport_driver *gameport_drv;
 
-        down(&gameport_sem);
+        mutex_lock(&gameport_mutex);
 
         /*
          * Note that we handle only one event here to give swsusp
@@ -379,7 +381,7 @@ static void gameport_handle_event(void)
                 gameport_free_event(event);
         }
 
-        up(&gameport_sem);
+        mutex_unlock(&gameport_mutex);
 }
 
 /*
@@ -464,7 +466,7 @@ static ssize_t gameport_rebind_driver(struct device *dev, struct device_attribut
         struct device_driver *drv;
         int retval;
 
-        retval = down_interruptible(&gameport_sem);
+        retval = mutex_lock_interruptible(&gameport_mutex);
         if (retval)
                 return retval;
 
@@ -484,7 +486,7 @@ static ssize_t gameport_rebind_driver(struct device *dev, struct device_attribut
                 retval = -EINVAL;
         }
 
-        up(&gameport_sem);
+        mutex_unlock(&gameport_mutex);
 
         return retval;
 }
@@ -521,7 +523,7 @@ static void gameport_init_port(struct gameport *gameport)
 
         __module_get(THIS_MODULE);
 
-        init_MUTEX(&gameport->drv_sem);
+        mutex_init(&gameport->drv_mutex);
         device_initialize(&gameport->dev);
         snprintf(gameport->dev.bus_id, sizeof(gameport->dev.bus_id),
                  "gameport%lu", (unsigned long)atomic_inc_return(&gameport_no) - 1);
@@ -661,10 +663,10 @@ void __gameport_register_port(struct gameport *gameport, struct module *owner)
  */
 void gameport_unregister_port(struct gameport *gameport)
 {
-        down(&gameport_sem);
+        mutex_lock(&gameport_mutex);
         gameport_disconnect_port(gameport);
         gameport_destroy_port(gameport);
-        up(&gameport_sem);
+        mutex_unlock(&gameport_mutex);
 }
 
 
@@ -717,7 +719,7 @@ void gameport_unregister_driver(struct gameport_driver *drv)
 {
         struct gameport *gameport;
 
-        down(&gameport_sem);
+        mutex_lock(&gameport_mutex);
         drv->ignore = 1;        /* so gameport_find_driver ignores it */
 
 start_over:
@@ -731,7 +733,7 @@ start_over:
         }
 
         driver_unregister(&drv->driver);
-        up(&gameport_sem);
+        mutex_unlock(&gameport_mutex);
 }
 
 static int gameport_bus_match(struct device *dev, struct device_driver *drv)
@@ -743,9 +745,9 @@ static int gameport_bus_match(struct device *dev, struct device_driver *drv)
 
 static void gameport_set_drv(struct gameport *gameport, struct gameport_driver *drv)
 {
-        down(&gameport->drv_sem);
+        mutex_lock(&gameport->drv_mutex);
         gameport->drv = drv;
-        up(&gameport->drv_sem);
+        mutex_unlock(&gameport->drv_mutex);
 }
 
 int gameport_open(struct gameport *gameport, struct gameport_driver *drv, int mode)
@@ -796,5 +798,5 @@ static void __exit gameport_exit(void)
         kthread_stop(gameport_task);
 }
 
-module_init(gameport_init);
+subsys_initcall(gameport_init);
 module_exit(gameport_exit);
diff --git a/drivers/input/gameport/ns558.c b/drivers/input/gameport/ns558.c
index d2e55dc956ba..3e2d28f263e9 100644
--- a/drivers/input/gameport/ns558.c
+++ b/drivers/input/gameport/ns558.c
@@ -252,14 +252,14 @@ static struct pnp_driver ns558_pnp_driver;
 
 #endif
 
-static int pnp_registered = 0;
-
 static int __init ns558_init(void)
 {
         int i = 0;
+        int error;
 
-        if (pnp_register_driver(&ns558_pnp_driver) >= 0)
-                pnp_registered = 1;
+        error = pnp_register_driver(&ns558_pnp_driver);
+        if (error && error != -ENODEV)  /* should be ENOSYS really */
+                return error;
 
 /*
  * Probe ISA ports after PnP, so that PnP ports that are already
@@ -270,7 +270,7 @@ static int __init ns558_init(void)
         while (ns558_isa_portlist[i])
                 ns558_isa_probe(ns558_isa_portlist[i++]);
 
-        return (list_empty(&ns558_list) && !pnp_registered) ? -ENODEV : 0;
+        return list_empty(&ns558_list) && error ? -ENODEV : 0;
 }
 
 static void __exit ns558_exit(void)
@@ -283,8 +283,7 @@ static void __exit ns558_exit(void)
                 kfree(ns558);
         }
 
-        if (pnp_registered)
-                pnp_unregister_driver(&ns558_pnp_driver);
+        pnp_unregister_driver(&ns558_pnp_driver);
 }
 
 module_init(ns558_init);
diff --git a/drivers/input/input.c b/drivers/input/input.c
index f8af0945964e..a935abeffffc 100644
--- a/drivers/input/input.c
+++ b/drivers/input/input.c
@@ -18,9 +18,11 @@
 #include <linux/random.h>
 #include <linux/major.h>
 #include <linux/proc_fs.h>
+#include <linux/seq_file.h>
 #include <linux/interrupt.h>
 #include <linux/poll.h>
 #include <linux/device.h>
+#include <linux/mutex.h>
 
 MODULE_AUTHOR("Vojtech Pavlik <vojtech@suse.cz>");
 MODULE_DESCRIPTION("Input core");
@@ -224,7 +226,7 @@ int input_open_device(struct input_handle *handle)
         struct input_dev *dev = handle->dev;
         int err;
 
-        err = down_interruptible(&dev->sem);
+        err = mutex_lock_interruptible(&dev->mutex);
         if (err)
                 return err;
 
@@ -236,7 +238,7 @@ int input_open_device(struct input_handle *handle)
         if (err)
                 handle->open--;
 
-        up(&dev->sem);
+        mutex_unlock(&dev->mutex);
 
         return err;
 }
@@ -255,13 +257,13 @@ void input_close_device(struct input_handle *handle)
 
         input_release_device(handle);
 
-        down(&dev->sem);
+        mutex_lock(&dev->mutex);
 
         if (!--dev->users && dev->close)
                 dev->close(dev);
         handle->open--;
 
-        up(&dev->sem);
+        mutex_unlock(&dev->mutex);
 }
 
 static void input_link_handle(struct input_handle *handle)
@@ -315,21 +317,6 @@ static struct input_device_id *input_match_device(struct input_device_id *id, st
         return NULL;
 }
 
-static int input_print_bitmap(char *buf, int buf_size, unsigned long *bitmap, int max)
-{
-        int i;
-        int len = 0;
-
-        for (i = NBITS(max) - 1; i > 0; i--)
-                if (bitmap[i])
-                        break;
-
-        for (; i >= 0; i--)
-                len += snprintf(buf + len, max(buf_size - len, 0),
-                                "%lx%s", bitmap[i], i > 0 ? " " : "");
-        return len;
-}
-
 #ifdef CONFIG_PROC_FS
 
 static struct proc_dir_entry *proc_bus_input_dir;
@@ -342,7 +329,7 @@ static inline void input_wakeup_procfs_readers(void)
         wake_up(&input_devices_poll_wait);
 }
 
-static unsigned int input_devices_poll(struct file *file, poll_table *wait)
+static unsigned int input_proc_devices_poll(struct file *file, poll_table *wait)
 {
         int state = input_devices_state;
         poll_wait(file, &input_devices_poll_wait, wait);
@@ -351,115 +338,171 @@ static unsigned int input_devices_poll(struct file *file, poll_table *wait)
         return 0;
 }
 
-#define SPRINTF_BIT(ev, bm)                                             \
-        do {                                                            \
-                len += sprintf(buf + len, "B: %s=", #ev);               \
-                len += input_print_bitmap(buf + len, INT_MAX,           \
-                                        dev->bm##bit, ev##_MAX);        \
-                len += sprintf(buf + len, "\n");                        \
-        } while (0)
+static struct list_head *list_get_nth_element(struct list_head *list, loff_t *pos)
+{
+        struct list_head *node;
+        loff_t i = 0;
 
-#define TEST_AND_SPRINTF_BIT(ev, bm)                                    \
-        do {                                                            \
-                if (test_bit(EV_##ev, dev->evbit))                      \
-                        SPRINTF_BIT(ev, bm);                            \
-        } while (0)
+        list_for_each(node, list)
+                if (i++ == *pos)
+                        return node;
+
+        return NULL;
+}
 
-static int input_devices_read(char *buf, char **start, off_t pos, int count, int *eof, void *data)
+static struct list_head *list_get_next_element(struct list_head *list, struct list_head *element, loff_t *pos)
 {
-        struct input_dev *dev;
-        struct input_handle *handle;
-        const char *path;
+        if (element->next == list)
+                return NULL;
+
+        ++(*pos);
+        return element->next;
+}
+
+static void *input_devices_seq_start(struct seq_file *seq, loff_t *pos)
+{
+        /* acquire lock here ... Yes, we do need locking, I knowi, I know... */
+
+        return list_get_nth_element(&input_dev_list, pos);
+}
 
-        off_t at = 0;
-        int len, cnt = 0;
+static void *input_devices_seq_next(struct seq_file *seq, void *v, loff_t *pos)
+{
+        return list_get_next_element(&input_dev_list, v, pos);
+}
 
-        list_for_each_entry(dev, &input_dev_list, node) {
+static void input_devices_seq_stop(struct seq_file *seq, void *v)
+{
+        /* release lock here */
+}
 
-                path = kobject_get_path(&dev->cdev.kobj, GFP_KERNEL);
+static void input_seq_print_bitmap(struct seq_file *seq, const char *name,
+                                   unsigned long *bitmap, int max)
+{
+        int i;
 
-                len = sprintf(buf, "I: Bus=%04x Vendor=%04x Product=%04x Version=%04x\n",
-                        dev->id.bustype, dev->id.vendor, dev->id.product, dev->id.version);
+        for (i = NBITS(max) - 1; i > 0; i--)
+                if (bitmap[i])
+                        break;
 
-                len += sprintf(buf + len, "N: Name=\"%s\"\n", dev->name ? dev->name : "");
-                len += sprintf(buf + len, "P: Phys=%s\n", dev->phys ? dev->phys : "");
-                len += sprintf(buf + len, "S: Sysfs=%s\n", path ? path : "");
-                len += sprintf(buf + len, "H: Handlers=");
+        seq_printf(seq, "B: %s=", name);
+        for (; i >= 0; i--)
+                seq_printf(seq, "%lx%s", bitmap[i], i > 0 ? " " : "");
+        seq_putc(seq, '\n');
+}
 
-                list_for_each_entry(handle, &dev->h_list, d_node)
-                        len += sprintf(buf + len, "%s ", handle->name);
-
-                len += sprintf(buf + len, "\n");
-
-                SPRINTF_BIT(EV, ev);
-                TEST_AND_SPRINTF_BIT(KEY, key);
-                TEST_AND_SPRINTF_BIT(REL, rel);
-                TEST_AND_SPRINTF_BIT(ABS, abs);
-                TEST_AND_SPRINTF_BIT(MSC, msc);
-                TEST_AND_SPRINTF_BIT(LED, led);
-                TEST_AND_SPRINTF_BIT(SND, snd);
-                TEST_AND_SPRINTF_BIT(FF, ff);
-                TEST_AND_SPRINTF_BIT(SW, sw);
-
-                len += sprintf(buf + len, "\n");
-
-                at += len;
-
-                if (at >= pos) {
-                        if (!*start) {
-                                *start = buf + (pos - (at - len));
-                                cnt = at - pos;
-                        } else  cnt += len;
-                        buf += len;
-                        if (cnt >= count)
-                                break;
-                }
+static int input_devices_seq_show(struct seq_file *seq, void *v)
+{
+        struct input_dev *dev = container_of(v, struct input_dev, node);
+        const char *path = kobject_get_path(&dev->cdev.kobj, GFP_KERNEL);
+        struct input_handle *handle;
 
-                kfree(path);
-        }
+        seq_printf(seq, "I: Bus=%04x Vendor=%04x Product=%04x Version=%04x\n",
+                   dev->id.bustype, dev->id.vendor, dev->id.product, dev->id.version);
 
-        if (&dev->node == &input_dev_list)
-                *eof = 1;
+        seq_printf(seq, "N: Name=\"%s\"\n", dev->name ? dev->name : "");
+        seq_printf(seq, "P: Phys=%s\n", dev->phys ? dev->phys : "");
+        seq_printf(seq, "S: Sysfs=%s\n", path ? path : "");
+        seq_printf(seq, "H: Handlers=");
 
-        return (count > cnt) ? cnt : count;
+        list_for_each_entry(handle, &dev->h_list, d_node)
+                seq_printf(seq, "%s ", handle->name);
+        seq_putc(seq, '\n');
+
+        input_seq_print_bitmap(seq, "EV", dev->evbit, EV_MAX);
+        if (test_bit(EV_KEY, dev->evbit))
+                input_seq_print_bitmap(seq, "KEY", dev->keybit, KEY_MAX);
+        if (test_bit(EV_REL, dev->evbit))
+                input_seq_print_bitmap(seq, "REL", dev->relbit, REL_MAX);
+        if (test_bit(EV_ABS, dev->evbit))
+                input_seq_print_bitmap(seq, "ABS", dev->absbit, ABS_MAX);
+        if (test_bit(EV_MSC, dev->evbit))
+                input_seq_print_bitmap(seq, "MSC", dev->mscbit, MSC_MAX);
+        if (test_bit(EV_LED, dev->evbit))
+                input_seq_print_bitmap(seq, "LED", dev->ledbit, LED_MAX);
+        if (test_bit(EV_SND, dev->evbit))
+                input_seq_print_bitmap(seq, "SND", dev->sndbit, SND_MAX);
+        if (test_bit(EV_FF, dev->evbit))
+                input_seq_print_bitmap(seq, "FF", dev->ffbit, FF_MAX);
+        if (test_bit(EV_SW, dev->evbit))
+                input_seq_print_bitmap(seq, "SW", dev->swbit, SW_MAX);
+
+        seq_putc(seq, '\n');
+
+        kfree(path);
+        return 0;
 }
 
-static int input_handlers_read(char *buf, char **start, off_t pos, int count, int *eof, void *data)
+static struct seq_operations input_devices_seq_ops = {
+        .start  = input_devices_seq_start,
+        .next   = input_devices_seq_next,
+        .stop   = input_devices_seq_stop,
+        .show   = input_devices_seq_show,
+};
+
+static int input_proc_devices_open(struct inode *inode, struct file *file)
 {
-        struct input_handler *handler;
+        return seq_open(file, &input_devices_seq_ops);
+}
 
-        off_t at = 0;
-        int len = 0, cnt = 0;
-        int i = 0;
+static struct file_operations input_devices_fileops = {
+        .owner          = THIS_MODULE,
+        .open           = input_proc_devices_open,
+        .poll           = input_proc_devices_poll,
+        .read           = seq_read,
+        .llseek         = seq_lseek,
+        .release        = seq_release,
+};
 
-        list_for_each_entry(handler, &input_handler_list, node) {
+static void *input_handlers_seq_start(struct seq_file *seq, loff_t *pos)
+{
+        /* acquire lock here ... Yes, we do need locking, I knowi, I know... */
+        seq->private = (void *)(unsigned long)*pos;
+        return list_get_nth_element(&input_handler_list, pos);
+}
+
+static void *input_handlers_seq_next(struct seq_file *seq, void *v, loff_t *pos)
+{
+        seq->private = (void *)(unsigned long)(*pos + 1);
+        return list_get_next_element(&input_handler_list, v, pos);
+}
 
-                if (handler->fops)
-                        len = sprintf(buf, "N: Number=%d Name=%s Minor=%d\n",
-                                i++, handler->name, handler->minor);
-                else
-                        len = sprintf(buf, "N: Number=%d Name=%s\n",
-                                i++, handler->name);
+static void input_handlers_seq_stop(struct seq_file *seq, void *v)
+{
+        /* release lock here */
+}
 
-                at += len;
+static int input_handlers_seq_show(struct seq_file *seq, void *v)
+{
+        struct input_handler *handler = container_of(v, struct input_handler, node);
 
-                if (at >= pos) {
-                        if (!*start) {
-                                *start = buf + (pos - (at - len));
-                                cnt = at - pos;
-                        } else  cnt += len;
-                        buf += len;
-                        if (cnt >= count)
-                                break;
-                }
-        }
-        if (&handler->node == &input_handler_list)
-                *eof = 1;
+        seq_printf(seq, "N: Number=%ld Name=%s",
+                   (unsigned long)seq->private, handler->name);
+        if (handler->fops)
+                seq_printf(seq, " Minor=%d", handler->minor);
+        seq_putc(seq, '\n');
 
-        return (count > cnt) ? cnt : count;
+        return 0;
 }
+static struct seq_operations input_handlers_seq_ops = {
+        .start  = input_handlers_seq_start,
+        .next   = input_handlers_seq_next,
+        .stop   = input_handlers_seq_stop,
+        .show   = input_handlers_seq_show,
+};
 
-static struct file_operations input_fileops;
+static int input_proc_handlers_open(struct inode *inode, struct file *file)
+{
+        return seq_open(file, &input_handlers_seq_ops);
+}
+
+static struct file_operations input_handlers_fileops = {
+        .owner          = THIS_MODULE,
+        .open           = input_proc_handlers_open,
+        .read           = seq_read,
+        .llseek         = seq_lseek,
+        .release        = seq_release,
+};
 
 static int __init input_proc_init(void)
 {
@@ -471,20 +514,19 @@ static int __init input_proc_init(void)
 
         proc_bus_input_dir->owner = THIS_MODULE;
 
-        entry = create_proc_read_entry("devices", 0, proc_bus_input_dir, input_devices_read, NULL);
+        entry = create_proc_entry("devices", 0, proc_bus_input_dir);
         if (!entry)
                 goto fail1;
 
         entry->owner = THIS_MODULE;
-        input_fileops = *entry->proc_fops;
-        input_fileops.poll = input_devices_poll;
-        entry->proc_fops = &input_fileops;
+        entry->proc_fops = &input_devices_fileops;
 
-        entry = create_proc_read_entry("handlers", 0, proc_bus_input_dir, input_handlers_read, NULL);
+        entry = create_proc_entry("handlers", 0, proc_bus_input_dir);
         if (!entry)
                 goto fail2;
 
         entry->owner = THIS_MODULE;
+        entry->proc_fops = &input_handlers_fileops;
 
         return 0;
 
@@ -512,13 +554,14 @@ static ssize_t input_dev_show_##name(struct class_device *dev, char *buf)	\
         struct input_dev *input_dev = to_input_dev(dev);                        \
         int retval;                                                             \
                                                                                 \
-        retval = down_interruptible(&input_dev->sem);                           \
+        retval = mutex_lock_interruptible(&input_dev->mutex);                   \
         if (retval)                                                             \
                 return retval;                                                  \
                                                                                 \
-        retval = sprintf(buf, "%s\n", input_dev->name ? input_dev->name : "");  \
+        retval = scnprintf(buf, PAGE_SIZE,                                      \
+                           "%s\n", input_dev->name ? input_dev->name : "");     \
                                                                                 \
-        up(&input_dev->sem);                                                    \
+        mutex_unlock(&input_dev->mutex);                                        \
                                                                                 \
         return retval;                                                          \
 }                                                                               \
@@ -528,46 +571,51 @@ INPUT_DEV_STRING_ATTR_SHOW(name);
 INPUT_DEV_STRING_ATTR_SHOW(phys);
 INPUT_DEV_STRING_ATTR_SHOW(uniq);
 
-static int print_modalias_bits(char *buf, int size, char prefix, unsigned long *arr,
-                               unsigned int min, unsigned int max)
+static int input_print_modalias_bits(char *buf, int size,
+                                     char name, unsigned long *bm,
+                                     unsigned int min_bit, unsigned int max_bit)
 {
-        int len, i;
+        int len = 0, i;
 
-        len = snprintf(buf, size, "%c", prefix);
-        for (i = min; i < max; i++)
-                if (arr[LONG(i)] & BIT(i))
-                        len += snprintf(buf + len, size - len, "%X,", i);
+        len += snprintf(buf, max(size, 0), "%c", name);
+        for (i = min_bit; i < max_bit; i++)
+                if (bm[LONG(i)] & BIT(i))
+                        len += snprintf(buf + len, max(size - len, 0), "%X,", i);
         return len;
 }
 
-static int print_modalias(char *buf, int size, struct input_dev *id)
+static int input_print_modalias(char *buf, int size, struct input_dev *id,
+                                int add_cr)
 {
         int len;
 
-        len = snprintf(buf, size, "input:b%04Xv%04Xp%04Xe%04X-",
-                       id->id.bustype,
-                       id->id.vendor,
-                       id->id.product,
-                       id->id.version);
-
-        len += print_modalias_bits(buf + len, size - len, 'e', id->evbit,
-                                   0, EV_MAX);
-        len += print_modalias_bits(buf + len, size - len, 'k', id->keybit,
-                                   KEY_MIN_INTERESTING, KEY_MAX);
-        len += print_modalias_bits(buf + len, size - len, 'r', id->relbit,
-                                   0, REL_MAX);
-        len += print_modalias_bits(buf + len, size - len, 'a', id->absbit,
-                                   0, ABS_MAX);
-        len += print_modalias_bits(buf + len, size - len, 'm', id->mscbit,
-                                   0, MSC_MAX);
-        len += print_modalias_bits(buf + len, size - len, 'l', id->ledbit,
-                                   0, LED_MAX);
-        len += print_modalias_bits(buf + len, size - len, 's', id->sndbit,
-                                   0, SND_MAX);
-        len += print_modalias_bits(buf + len, size - len, 'f', id->ffbit,
-                                   0, FF_MAX);
-        len += print_modalias_bits(buf + len, size - len, 'w', id->swbit,
-                                   0, SW_MAX);
+        len = snprintf(buf, max(size, 0),
+                       "input:b%04Xv%04Xp%04Xe%04X-",
+                       id->id.bustype, id->id.vendor,
+                       id->id.product, id->id.version);
+
+        len += input_print_modalias_bits(buf + len, size - len,
+                                'e', id->evbit, 0, EV_MAX);
+        len += input_print_modalias_bits(buf + len, size - len,
+                                'k', id->keybit, KEY_MIN_INTERESTING, KEY_MAX);
+        len += input_print_modalias_bits(buf + len, size - len,
+                                'r', id->relbit, 0, REL_MAX);
+        len += input_print_modalias_bits(buf + len, size - len,
+                                'a', id->absbit, 0, ABS_MAX);
+        len += input_print_modalias_bits(buf + len, size - len,
+                                'm', id->mscbit, 0, MSC_MAX);
+        len += input_print_modalias_bits(buf + len, size - len,
+                                'l', id->ledbit, 0, LED_MAX);
+        len += input_print_modalias_bits(buf + len, size - len,
+                                's', id->sndbit, 0, SND_MAX);
+        len += input_print_modalias_bits(buf + len, size - len,
+                                'f', id->ffbit, 0, FF_MAX);
+        len += input_print_modalias_bits(buf + len, size - len,
+                                'w', id->swbit, 0, SW_MAX);
+
+        if (add_cr)
+                len += snprintf(buf + len, max(size - len, 0), "\n");
+
         return len;
 }
 
@@ -576,9 +624,9 @@ static ssize_t input_dev_show_modalias(struct class_device *dev, char *buf)
         struct input_dev *id = to_input_dev(dev);
         ssize_t len;
 
-        len = print_modalias(buf, PAGE_SIZE, id);
-        len += snprintf(buf + len, PAGE_SIZE-len, "\n");
-        return len;
+        len = input_print_modalias(buf, PAGE_SIZE, id, 1);
+
+        return max_t(int, len, PAGE_SIZE);
 }
 static CLASS_DEVICE_ATTR(modalias, S_IRUGO, input_dev_show_modalias, NULL);
 
@@ -598,7 +646,7 @@ static struct attribute_group input_dev_attr_group = {
 static ssize_t input_dev_show_id_##name(struct class_device *dev, char *buf)    \
 {                                                                               \
         struct input_dev *input_dev = to_input_dev(dev);                        \
-        return sprintf(buf, "%04x\n", input_dev->id.name);                      \
+        return scnprintf(buf, PAGE_SIZE, "%04x\n", input_dev->id.name);         \
 }                                                                               \
 static CLASS_DEVICE_ATTR(name, S_IRUGO, input_dev_show_id_##name, NULL);
 
@@ -620,11 +668,33 @@ static struct attribute_group input_dev_id_attr_group = {
         .attrs  = input_dev_id_attrs,
 };
 
+static int input_print_bitmap(char *buf, int buf_size, unsigned long *bitmap,
+                              int max, int add_cr)
+{
+        int i;
+        int len = 0;
+
+        for (i = NBITS(max) - 1; i > 0; i--)
+                if (bitmap[i])
+                        break;
+
+        for (; i >= 0; i--)
+                len += snprintf(buf + len, max(buf_size - len, 0),
+                                "%lx%s", bitmap[i], i > 0 ? " " : "");
+
+        if (add_cr)
+                len += snprintf(buf + len, max(buf_size - len, 0), "\n");
+
+        return len;
+}
+
 #define INPUT_DEV_CAP_ATTR(ev, bm)                                              \
 static ssize_t input_dev_show_cap_##bm(struct class_device *dev, char *buf)     \
 {                                                                               \
         struct input_dev *input_dev = to_input_dev(dev);                        \
-        return input_print_bitmap(buf, PAGE_SIZE, input_dev->bm##bit, ev##_MAX);\
+        int len = input_print_bitmap(buf, PAGE_SIZE,                            \
+                                     input_dev->bm##bit, ev##_MAX, 1);          \
+        return min_t(int, len, PAGE_SIZE);                                      \
 }                                                                               \
 static CLASS_DEVICE_ATTR(bm, S_IRUGO, input_dev_show_cap_##bm, NULL);
 
@@ -669,8 +739,8 @@ static void input_dev_release(struct class_device *class_dev)
  * device bitfields.
  */
 static int input_add_uevent_bm_var(char **envp, int num_envp, int *cur_index,
-                                    char *buffer, int buffer_size, int *cur_len,
-                                    const char *name, unsigned long *bitmap, int max)
+                                   char *buffer, int buffer_size, int *cur_len,
+                                   const char *name, unsigned long *bitmap, int max)
 {
         if (*cur_index >= num_envp - 1)
                 return -ENOMEM;
@@ -678,12 +748,36 @@ static int input_add_uevent_bm_var(char **envp, int num_envp, int *cur_index,
         envp[*cur_index] = buffer + *cur_len;
 
         *cur_len += snprintf(buffer + *cur_len, max(buffer_size - *cur_len, 0), name);
-        if (*cur_len > buffer_size)
+        if (*cur_len >= buffer_size)
                 return -ENOMEM;
 
         *cur_len += input_print_bitmap(buffer + *cur_len,
                                         max(buffer_size - *cur_len, 0),
-                                        bitmap, max) + 1;
+                                        bitmap, max, 0) + 1;
+        if (*cur_len > buffer_size)
+                return -ENOMEM;
+
+        (*cur_index)++;
+        return 0;
+}
+
+static int input_add_uevent_modalias_var(char **envp, int num_envp, int *cur_index,
+                                         char *buffer, int buffer_size, int *cur_len,
+                                         struct input_dev *dev)
+{
+        if (*cur_index >= num_envp - 1)
+                return -ENOMEM;
+
+        envp[*cur_index] = buffer + *cur_len;
+
+        *cur_len += snprintf(buffer + *cur_len, max(buffer_size - *cur_len, 0),
+                             "MODALIAS=");
+        if (*cur_len >= buffer_size)
+                return -ENOMEM;
+
+        *cur_len += input_print_modalias(buffer + *cur_len,
+                                         max(buffer_size - *cur_len, 0),
+                                         dev, 0) + 1;
         if (*cur_len > buffer_size)
                 return -ENOMEM;
 
@@ -693,7 +787,7 @@ static int input_add_uevent_bm_var(char **envp, int num_envp, int *cur_index,
 
 #define INPUT_ADD_HOTPLUG_VAR(fmt, val...)                              \
         do {                                                            \
-                int err = add_uevent_var(envp, num_envp, &i,    \
+                int err = add_uevent_var(envp, num_envp, &i,            \
                                         buffer, buffer_size, &len,      \
                                         fmt, val);                      \
                 if (err)                                                \
@@ -709,6 +803,16 @@ static int input_add_uevent_bm_var(char **envp, int num_envp, int *cur_index,
                         return err;                                     \
         } while (0)
 
+#define INPUT_ADD_HOTPLUG_MODALIAS_VAR(dev)                             \
+        do {                                                            \
+                int err = input_add_uevent_modalias_var(envp,           \
+                                        num_envp, &i,                   \
+                                        buffer, buffer_size, &len,      \
+                                        dev);                           \
+                if (err)                                                \
+                        return err;                                     \
+        } while (0)
+
 static int input_dev_uevent(struct class_device *cdev, char **envp,
                             int num_envp, char *buffer, int buffer_size)
 {
@@ -744,9 +848,7 @@ static int input_dev_uevent(struct class_device *cdev, char **envp,
         if (test_bit(EV_SW, dev->evbit))
                 INPUT_ADD_HOTPLUG_BM_VAR("SW=", dev->swbit, SW_MAX);
 
-        envp[i++] = buffer + len;
-        len += snprintf(buffer + len, buffer_size - len, "MODALIAS=");
-        len += print_modalias(buffer + len, buffer_size - len, dev) + 1;
+        INPUT_ADD_HOTPLUG_MODALIAS_VAR(dev);
 
         envp[i] = NULL;
         return 0;
@@ -790,7 +892,7 @@ int input_register_device(struct input_dev *dev)
                 return -EINVAL;
         }
 
-        init_MUTEX(&dev->sem);
+        mutex_init(&dev->mutex);
         set_bit(EV_SYN, dev->evbit);
 
         /*
diff --git a/drivers/input/joydev.c b/drivers/input/joydev.c
index 20e2972b9204..949bdcef8c2b 100644
--- a/drivers/input/joydev.c
+++ b/drivers/input/joydev.c
@@ -171,9 +171,8 @@ static int joydev_open(struct inode *inode, struct file *file)
         if (i >= JOYDEV_MINORS || !joydev_table[i])
                 return -ENODEV;
 
-        if (!(list = kmalloc(sizeof(struct joydev_list), GFP_KERNEL)))
+        if (!(list = kzalloc(sizeof(struct joydev_list), GFP_KERNEL)))
                 return -ENOMEM;
-        memset(list, 0, sizeof(struct joydev_list));
 
         list->joydev = joydev_table[i];
         list_add_tail(&list->node, &joydev_table[i]->list);
@@ -457,9 +456,8 @@ static struct input_handle *joydev_connect(struct input_handler *handler, struct
                 return NULL;
         }
 
-        if (!(joydev = kmalloc(sizeof(struct joydev), GFP_KERNEL)))
+        if (!(joydev = kzalloc(sizeof(struct joydev), GFP_KERNEL)))
                 return NULL;
-        memset(joydev, 0, sizeof(struct joydev));
 
         INIT_LIST_HEAD(&joydev->list);
         init_waitqueue_head(&joydev->wait);
diff --git a/drivers/input/joystick/amijoy.c b/drivers/input/joystick/amijoy.c
index ec55a29fc861..7249d324297b 100644
--- a/drivers/input/joystick/amijoy.c
+++ b/drivers/input/joystick/amijoy.c
@@ -36,6 +36,7 @@
 #include <linux/init.h>
 #include <linux/input.h>
 #include <linux/interrupt.h>
+#include <linux/mutex.h>
 
 #include <asm/system.h>
 #include <asm/amigahw.h>
@@ -52,7 +53,7 @@ MODULE_PARM_DESC(map, "Map of attached joysticks in form of <a>,<b> (default is
 __obsolete_setup("amijoy=");
 
 static int amijoy_used;
-static DECLARE_MUTEX(amijoy_sem);
+static DEFINE_MUTEX(amijoy_mutex);
 static struct input_dev *amijoy_dev[2];
 static char *amijoy_phys[2] = { "amijoy/input0", "amijoy/input1" };
 
@@ -85,7 +86,7 @@ static int amijoy_open(struct input_dev *dev)
 {
         int err;
 
-        err = down_interruptible(&amijoy_sem);
+        err = mutex_lock_interruptible(&amijoy_mutex);
         if (err)
                 return err;
 
@@ -97,16 +98,16 @@ static int amijoy_open(struct input_dev *dev)
 
         amijoy_used++;
 out:
-        up(&amijoy_sem);
+        mutex_unlock(&amijoy_mutex);
         return err;
 }
 
 static void amijoy_close(struct input_dev *dev)
 {
-        down(&amijoy_sem);
+        mutex_lock(&amijoy_mutex);
         if (!--amijoy_used)
                 free_irq(IRQ_AMIGA_VERTB, amijoy_interrupt);
-        up(&amijoy_sem);
+        mutex_unlock(&amijoy_mutex);
 }
 
 static int __init amijoy_init(void)
diff --git a/drivers/input/joystick/db9.c b/drivers/input/joystick/db9.c
index dcffc34f30c3..e61894685cb1 100644
--- a/drivers/input/joystick/db9.c
+++ b/drivers/input/joystick/db9.c
@@ -38,6 +38,7 @@
 #include <linux/init.h>
 #include <linux/parport.h>
 #include <linux/input.h>
+#include <linux/mutex.h>
 
 MODULE_AUTHOR("Vojtech Pavlik <vojtech@ucw.cz>");
 MODULE_DESCRIPTION("Atari, Amstrad, Commodore, Amiga, Sega, etc. joystick driver");
@@ -111,7 +112,7 @@ struct db9 {
         struct pardevice *pd;
         int mode;
         int used;
-        struct semaphore sem;
+        struct mutex mutex;
         char phys[DB9_MAX_DEVICES][32];
 };
 
@@ -525,7 +526,7 @@ static int db9_open(struct input_dev *dev)
         struct parport *port = db9->pd->port;
         int err;
 
-        err = down_interruptible(&db9->sem);
+        err = mutex_lock_interruptible(&db9->mutex);
         if (err)
                 return err;
 
@@ -539,7 +540,7 @@ static int db9_open(struct input_dev *dev)
                 mod_timer(&db9->timer, jiffies + DB9_REFRESH_TIME);
         }
 
-        up(&db9->sem);
+        mutex_unlock(&db9->mutex);
         return 0;
 }
 
@@ -548,14 +549,14 @@ static void db9_close(struct input_dev *dev)
         struct db9 *db9 = dev->private;
         struct parport *port = db9->pd->port;
 
-        down(&db9->sem);
+        mutex_lock(&db9->mutex);
         if (!--db9->used) {
                 del_timer_sync(&db9->timer);
                 parport_write_control(port, 0x00);
                 parport_data_forward(port);
                 parport_release(db9->pd);
         }
-        up(&db9->sem);
+        mutex_unlock(&db9->mutex);
 }
 
 static struct db9 __init *db9_probe(int parport, int mode)
@@ -603,7 +604,7 @@ static struct db9 __init *db9_probe(int parport, int mode)
                 goto err_unreg_pardev;
         }
 
-        init_MUTEX(&db9->sem);
+        mutex_init(&db9->mutex);
         db9->pd = pd;
         db9->mode = mode;
         init_timer(&db9->timer);
diff --git a/drivers/input/joystick/gamecon.c b/drivers/input/joystick/gamecon.c
index 900587acdb47..ecbdb6b9bbd6 100644
--- a/drivers/input/joystick/gamecon.c
+++ b/drivers/input/joystick/gamecon.c
@@ -7,6 +7,7 @@
  *  Based on the work of:
  *      Andree Borrmann         John Dahlstrom
  *      David Kuder             Nathan Hand
+ *      Raphael Assenat
  */
 
 /*
@@ -36,6 +37,7 @@
 #include <linux/init.h>
 #include <linux/parport.h>
 #include <linux/input.h>
+#include <linux/mutex.h>
 
 MODULE_AUTHOR("Vojtech Pavlik <vojtech@ucw.cz>");
 MODULE_DESCRIPTION("NES, SNES, N64, MultiSystem, PSX gamepad driver");
@@ -72,8 +74,9 @@ __obsolete_setup("gc_3=");
 #define GC_N64          6
 #define GC_PSX          7
 #define GC_DDR          8
+#define GC_SNESMOUSE    9
 
-#define GC_MAX          8
+#define GC_MAX          9
 
 #define GC_REFRESH_TIME HZ/100
 
@@ -83,7 +86,7 @@ struct gc {
         struct timer_list timer;
         unsigned char pads[GC_MAX + 1];
         int used;
-        struct semaphore sem;
+        struct mutex mutex;
         char phys[GC_MAX_DEVICES][32];
 };
 
@@ -93,7 +96,7 @@ static int gc_status_bit[] = { 0x40, 0x80, 0x20, 0x10, 0x08 };
 
 static char *gc_names[] = { NULL, "SNES pad", "NES pad", "NES FourPort", "Multisystem joystick",
                                 "Multisystem 2-button joystick", "N64 controller", "PSX controller",
-                                "PSX DDR controller" };
+                                "PSX DDR controller", "SNES mouse" };
 /*
  * N64 support.
  */
@@ -205,9 +208,12 @@ static void gc_n64_process_packet(struct gc *gc)
  * NES/SNES support.
  */
 
-#define GC_NES_DELAY    6       /* Delay between bits - 6us */
-#define GC_NES_LENGTH   8       /* The NES pads use 8 bits of data */
-#define GC_SNES_LENGTH  12      /* The SNES true length is 16, but the last 4 bits are unused */
+#define GC_NES_DELAY            6       /* Delay between bits - 6us */
+#define GC_NES_LENGTH           8       /* The NES pads use 8 bits of data */
+#define GC_SNES_LENGTH          12      /* The SNES true length is 16, but the
+                                           last 4 bits are unused */
+#define GC_SNESMOUSE_LENGTH     32      /* The SNES mouse uses 32 bits, the first
+                                           16 bits are equivalent to a gamepad */
 
 #define GC_NES_POWER    0xfc
 #define GC_NES_CLOCK    0x01
@@ -242,11 +248,15 @@ static void gc_nes_read_packet(struct gc *gc, int length, unsigned char *data)
 
 static void gc_nes_process_packet(struct gc *gc)
 {
-        unsigned char data[GC_SNES_LENGTH];
+        unsigned char data[GC_SNESMOUSE_LENGTH];
         struct input_dev *dev;
-        int i, j, s;
+        int i, j, s, len;
+        char x_rel, y_rel;
+
+        len = gc->pads[GC_SNESMOUSE] ? GC_SNESMOUSE_LENGTH :
+                        (gc->pads[GC_SNES] ? GC_SNES_LENGTH : GC_NES_LENGTH);
 
-        gc_nes_read_packet(gc, gc->pads[GC_SNES] ? GC_SNES_LENGTH : GC_NES_LENGTH, data);
+        gc_nes_read_packet(gc, len, data);
 
         for (i = 0; i < GC_MAX_DEVICES; i++) {
 
@@ -269,6 +279,44 @@ static void gc_nes_process_packet(struct gc *gc)
                         for (j = 0; j < 8; j++)
                                 input_report_key(dev, gc_snes_btn[j], s & data[gc_snes_bytes[j]]);
 
+                if (s & gc->pads[GC_SNESMOUSE]) {
+                        /*
+                         * The 4 unused bits from SNES controllers appear to be ID bits
+                         * so use them to make sure iwe are dealing with a mouse.
+                         * gamepad is connected. This is important since
+                         * my SNES gamepad sends 1's for bits 16-31, which
+                         * cause the mouse pointer to quickly move to the
+                         * upper left corner of the screen.
+                         */
+                        if (!(s & data[12]) && !(s & data[13]) &&
+                            !(s & data[14]) && (s & data[15])) {
+                                input_report_key(dev, BTN_LEFT, s & data[9]);
+                                input_report_key(dev, BTN_RIGHT, s & data[8]);
+
+                                x_rel = y_rel = 0;
+                                for (j = 0; j < 7; j++) {
+                                        x_rel <<= 1;
+                                        if (data[25 + j] & s)
+                                                x_rel |= 1;
+
+                                        y_rel <<= 1;
+                                        if (data[17 + j] & s)
+                                                y_rel |= 1;
+                                }
+
+                                if (x_rel) {
+                                        if (data[24] & s)
+                                                x_rel = -x_rel;
+                                        input_report_rel(dev, REL_X, x_rel);
+                                }
+
+                                if (y_rel) {
+                                        if (data[16] & s)
+                                                y_rel = -y_rel;
+                                        input_report_rel(dev, REL_Y, y_rel);
+                                }
+                        }
+                }
                 input_sync(dev);
         }
 }
@@ -524,10 +572,10 @@ static void gc_timer(unsigned long private)
                 gc_n64_process_packet(gc);
 
 /*
- * NES and SNES pads
+ * NES and SNES pads or mouse
  */
 
-        if (gc->pads[GC_NES] || gc->pads[GC_SNES])
+        if (gc->pads[GC_NES] || gc->pads[GC_SNES] || gc->pads[GC_SNESMOUSE])
                 gc_nes_process_packet(gc);
 
 /*
@@ -552,7 +600,7 @@ static int gc_open(struct input_dev *dev)
         struct gc *gc = dev->private;
         int err;
 
-        err = down_interruptible(&gc->sem);
+        err = mutex_lock_interruptible(&gc->mutex);
         if (err)
                 return err;
 
@@ -562,7 +610,7 @@ static int gc_open(struct input_dev *dev)
                 mod_timer(&gc->timer, jiffies + GC_REFRESH_TIME);
         }
 
-        up(&gc->sem);
+        mutex_unlock(&gc->mutex);
         return 0;
 }
 
@@ -570,13 +618,13 @@ static void gc_close(struct input_dev *dev)
 {
         struct gc *gc = dev->private;
 
-        down(&gc->sem);
+        mutex_lock(&gc->mutex);
         if (!--gc->used) {
                 del_timer_sync(&gc->timer);
                 parport_write_control(gc->pd->port, 0x00);
                 parport_release(gc->pd);
         }
-        up(&gc->sem);
+        mutex_unlock(&gc->mutex);
 }
 
 static int __init gc_setup_pad(struct gc *gc, int idx, int pad_type)
@@ -609,10 +657,13 @@ static int __init gc_setup_pad(struct gc *gc, int idx, int pad_type)
         input_dev->open = gc_open;
         input_dev->close = gc_close;
 
-        input_dev->evbit[0] = BIT(EV_KEY) | BIT(EV_ABS);
+        if (pad_type != GC_SNESMOUSE) {
+                input_dev->evbit[0] = BIT(EV_KEY) | BIT(EV_ABS);
 
-        for (i = 0; i < 2; i++)
-                input_set_abs_params(input_dev, ABS_X + i, -1, 1, 0, 0);
+                for (i = 0; i < 2; i++)
+                        input_set_abs_params(input_dev, ABS_X + i, -1, 1, 0, 0);
+        } else
+                input_dev->evbit[0] = BIT(EV_KEY) | BIT(EV_REL);
 
         gc->pads[0] |= gc_status_bit[idx];
         gc->pads[pad_type] |= gc_status_bit[idx];
@@ -630,6 +681,13 @@ static int __init gc_setup_pad(struct gc *gc, int idx, int pad_type)
 
                         break;
 
+                case GC_SNESMOUSE:
+                        set_bit(BTN_LEFT, input_dev->keybit);
+                        set_bit(BTN_RIGHT, input_dev->keybit);
+                        set_bit(REL_X, input_dev->relbit);
+                        set_bit(REL_Y, input_dev->relbit);
+                        break;
+
                 case GC_SNES:
                         for (i = 4; i < 8; i++)
                                 set_bit(gc_snes_btn[i], input_dev->keybit);
@@ -693,7 +751,7 @@ static struct gc __init *gc_probe(int parport, int *pads, int n_pads)
                 goto err_unreg_pardev;
         }
 
-        init_MUTEX(&gc->sem);
+        mutex_init(&gc->mutex);
         gc->pd = pd;
         init_timer(&gc->timer);
         gc->timer.data = (long) gc;
diff --git a/drivers/input/joystick/iforce/iforce-ff.c b/drivers/input/joystick/iforce/iforce-ff.c
index 4678b6dab43b..2b8e8456c9fa 100644
--- a/drivers/input/joystick/iforce/iforce-ff.c
+++ b/drivers/input/joystick/iforce/iforce-ff.c
@@ -42,14 +42,14 @@ static int make_magnitude_modifier(struct iforce* iforce,
         unsigned char data[3];
 
         if (!no_alloc) {
-                down(&iforce->mem_mutex);
+                mutex_lock(&iforce->mem_mutex);
                 if (allocate_resource(&(iforce->device_memory), mod_chunk, 2,
                         iforce->device_memory.start, iforce->device_memory.end, 2L,
                         NULL, NULL)) {
-                        up(&iforce->mem_mutex);
+                        mutex_unlock(&iforce->mem_mutex);
                         return -ENOMEM;
                 }
-                up(&iforce->mem_mutex);
+                mutex_unlock(&iforce->mem_mutex);
         }
 
         data[0] = LO(mod_chunk->start);
@@ -75,14 +75,14 @@ static int make_period_modifier(struct iforce* iforce,
         period = TIME_SCALE(period);
 
         if (!no_alloc) {
-                down(&iforce->mem_mutex);
+                mutex_lock(&iforce->mem_mutex);
                 if (allocate_resource(&(iforce->device_memory), mod_chunk, 0x0c,
                         iforce->device_memory.start, iforce->device_memory.end, 2L,
                         NULL, NULL)) {
-                        up(&iforce->mem_mutex);
+                        mutex_unlock(&iforce->mem_mutex);
                         return -ENOMEM;
                 }
-                up(&iforce->mem_mutex);
+                mutex_unlock(&iforce->mem_mutex);
         }
 
         data[0] = LO(mod_chunk->start);
@@ -115,14 +115,14 @@ static int make_envelope_modifier(struct iforce* iforce,
         fade_duration = TIME_SCALE(fade_duration);
 
         if (!no_alloc) {
-                down(&iforce->mem_mutex);
+                mutex_lock(&iforce->mem_mutex);
                 if (allocate_resource(&(iforce->device_memory), mod_chunk, 0x0e,
                         iforce->device_memory.start, iforce->device_memory.end, 2L,
                         NULL, NULL)) {
-                        up(&iforce->mem_mutex);
+                        mutex_unlock(&iforce->mem_mutex);
                         return -ENOMEM;
                 }
-                up(&iforce->mem_mutex);
+                mutex_unlock(&iforce->mem_mutex);
         }
 
         data[0] = LO(mod_chunk->start);
@@ -152,14 +152,14 @@ static int make_condition_modifier(struct iforce* iforce,
         unsigned char data[10];
 
         if (!no_alloc) {
-                down(&iforce->mem_mutex);
+                mutex_lock(&iforce->mem_mutex);
                 if (allocate_resource(&(iforce->device_memory), mod_chunk, 8,
                         iforce->device_memory.start, iforce->device_memory.end, 2L,
                         NULL, NULL)) {
-                        up(&iforce->mem_mutex);
+                        mutex_unlock(&iforce->mem_mutex);
                         return -ENOMEM;
                 }
-                up(&iforce->mem_mutex);
+                mutex_unlock(&iforce->mem_mutex);
         }
 
         data[0] = LO(mod_chunk->start);
diff --git a/drivers/input/joystick/iforce/iforce-main.c b/drivers/input/joystick/iforce/iforce-main.c
index b6bc04998047..ab0a26b924ca 100644
--- a/drivers/input/joystick/iforce/iforce-main.c
+++ b/drivers/input/joystick/iforce/iforce-main.c
@@ -350,7 +350,7 @@ int iforce_init_device(struct iforce *iforce)
 
         init_waitqueue_head(&iforce->wait);
         spin_lock_init(&iforce->xmit_lock);
-        init_MUTEX(&iforce->mem_mutex);
+        mutex_init(&iforce->mem_mutex);
         iforce->xmit.buf = iforce->xmit_data;
         iforce->dev = input_dev;
 
diff --git a/drivers/input/joystick/iforce/iforce.h b/drivers/input/joystick/iforce/iforce.h
index 146f406b8f8a..668f24535ba0 100644
--- a/drivers/input/joystick/iforce/iforce.h
+++ b/drivers/input/joystick/iforce/iforce.h
@@ -37,7 +37,7 @@
 #include <linux/serio.h>
 #include <linux/config.h>
 #include <linux/circ_buf.h>
-#include <asm/semaphore.h>
+#include <linux/mutex.h>
 
 /* This module provides arbitrary resource management routines.
  * I use it to manage the device's memory.
@@ -45,6 +45,7 @@
  */
 #include <linux/ioport.h>
 
+
 #define IFORCE_MAX_LENGTH       16
 
 /* iforce::bus */
@@ -146,7 +147,7 @@ struct iforce {
         wait_queue_head_t wait;
         struct resource device_memory;
         struct iforce_core_effect core_effects[FF_EFFECTS_MAX];
-        struct semaphore mem_mutex;
+        struct mutex mem_mutex;
 };
 
 /* Get hi and low bytes of a 16-bits int */
diff --git a/drivers/input/joystick/turbografx.c b/drivers/input/joystick/turbografx.c
index b154938e88a4..5570fd5487c7 100644
--- a/drivers/input/joystick/turbografx.c
+++ b/drivers/input/joystick/turbografx.c
@@ -37,6 +37,7 @@
 #include <linux/module.h>
 #include <linux/moduleparam.h>
 #include <linux/init.h>
+#include <linux/mutex.h>
 
 MODULE_AUTHOR("Vojtech Pavlik <vojtech@ucw.cz>");
 MODULE_DESCRIPTION("TurboGraFX parallel port interface driver");
@@ -86,7 +87,7 @@ static struct tgfx {
         char phys[TGFX_MAX_DEVICES][32];
         int sticks;
         int used;
-        struct semaphore sem;
+        struct mutex sem;
 } *tgfx_base[TGFX_MAX_PORTS];
 
 /*
@@ -128,7 +129,7 @@ static int tgfx_open(struct input_dev *dev)
         struct tgfx *tgfx = dev->private;
         int err;
 
-        err = down_interruptible(&tgfx->sem);
+        err = mutex_lock_interruptible(&tgfx->sem);
         if (err)
                 return err;
 
@@ -138,7 +139,7 @@ static int tgfx_open(struct input_dev *dev)
                 mod_timer(&tgfx->timer, jiffies + TGFX_REFRESH_TIME);
         }
 
-        up(&tgfx->sem);
+        mutex_unlock(&tgfx->sem);
         return 0;
 }
 
@@ -146,13 +147,13 @@ static void tgfx_close(struct input_dev *dev)
 {
         struct tgfx *tgfx = dev->private;
 
-        down(&tgfx->sem);
+        mutex_lock(&tgfx->sem);
         if (!--tgfx->used) {
                 del_timer_sync(&tgfx->timer);
                 parport_write_control(tgfx->pd->port, 0x00);
                 parport_release(tgfx->pd);
         }
-        up(&tgfx->sem);
+        mutex_unlock(&tgfx->sem);
 }
 
 
@@ -191,7 +192,7 @@ static struct tgfx __init *tgfx_probe(int parport, int *n_buttons, int n_devs)
                 goto err_unreg_pardev;
         }
 
-        init_MUTEX(&tgfx->sem);
+        mutex_init(&tgfx->sem);
         tgfx->pd = pd;
         init_timer(&tgfx->timer);
         tgfx->timer.data = (long) tgfx;
diff --git a/drivers/input/keyboard/Kconfig b/drivers/input/keyboard/Kconfig
index 3b0ac3b43c54..a9dda56f62c4 100644
--- a/drivers/input/keyboard/Kconfig
+++ b/drivers/input/keyboard/Kconfig
@@ -13,7 +13,7 @@ menuconfig INPUT_KEYBOARD
 if INPUT_KEYBOARD
 
 config KEYBOARD_ATKBD
-        tristate "AT keyboard" if !X86_PC
+        tristate "AT keyboard" if EMBEDDED || !X86_PC
         default y
         select SERIO
         select SERIO_LIBPS2
diff --git a/drivers/input/keyboard/atkbd.c b/drivers/input/keyboard/atkbd.c
index ffacf6eca5f5..fad04b66d268 100644
--- a/drivers/input/keyboard/atkbd.c
+++ b/drivers/input/keyboard/atkbd.c
@@ -27,6 +27,7 @@
 #include <linux/serio.h>
 #include <linux/workqueue.h>
 #include <linux/libps2.h>
+#include <linux/mutex.h>
 
 #define DRIVER_DESC     "AT and PS/2 keyboard driver"
 
@@ -216,7 +217,7 @@ struct atkbd {
         unsigned long time;
 
         struct work_struct event_work;
-        struct semaphore event_sem;
+        struct mutex event_mutex;
         unsigned long event_mask;
 };
 
@@ -302,19 +303,19 @@ static irqreturn_t atkbd_interrupt(struct serio *serio, unsigned char data,
         if (atkbd->translated) {
 
                 if (atkbd->emul ||
-                    !(code == ATKBD_RET_EMUL0 || code == ATKBD_RET_EMUL1 ||
-                      code == ATKBD_RET_HANGUEL || code == ATKBD_RET_HANJA ||
-                     (code == ATKBD_RET_ERR && !atkbd->err_xl) ||
-                     (code == ATKBD_RET_BAT && !atkbd->bat_xl))) {
+                    (code != ATKBD_RET_EMUL0 && code != ATKBD_RET_EMUL1 &&
+                     code != ATKBD_RET_HANGUEL && code != ATKBD_RET_HANJA &&
+                     (code != ATKBD_RET_ERR || atkbd->err_xl) &&
+                     (code != ATKBD_RET_BAT || atkbd->bat_xl))) {
                         atkbd->release = code >> 7;
                         code &= 0x7f;
                 }
 
                 if (!atkbd->emul) {
                      if ((code & 0x7f) == (ATKBD_RET_BAT & 0x7f))
-                        atkbd->bat_xl = !atkbd->release;
+                        atkbd->bat_xl = !(data >> 7);
                      if ((code & 0x7f) == (ATKBD_RET_ERR & 0x7f))
-                        atkbd->err_xl = !atkbd->release;
+                        atkbd->err_xl = !(data >> 7);
                 }
         }
 
@@ -449,7 +450,7 @@ static void atkbd_event_work(void *data)
         unsigned char param[2];
         int i, j;
 
-        down(&atkbd->event_sem);
+        mutex_lock(&atkbd->event_mutex);
 
         if (test_and_clear_bit(ATKBD_LED_EVENT_BIT, &atkbd->event_mask)) {
                 param[0] = (test_bit(LED_SCROLLL, dev->led) ? 1 : 0)
@@ -480,7 +481,7 @@ static void atkbd_event_work(void *data)
                 ps2_command(&atkbd->ps2dev, param, ATKBD_CMD_SETREP);
         }
 
-        up(&atkbd->event_sem);
+        mutex_unlock(&atkbd->event_mutex);
 }
 
 /*
@@ -846,7 +847,7 @@ static int atkbd_connect(struct serio *serio, struct serio_driver *drv)
         atkbd->dev = dev;
         ps2_init(&atkbd->ps2dev, serio);
         INIT_WORK(&atkbd->event_work, atkbd_event_work, atkbd);
-        init_MUTEX(&atkbd->event_sem);
+        mutex_init(&atkbd->event_mutex);
 
         switch (serio->id.type) {
 
@@ -862,9 +863,6 @@ static int atkbd_connect(struct serio *serio, struct serio_driver *drv)
         atkbd->softrepeat = atkbd_softrepeat;
         atkbd->scroll = atkbd_scroll;
 
-        if (!atkbd->write)
-                atkbd->softrepeat = 1;
-
         if (atkbd->softrepeat)
                 atkbd->softraw = 1;
 
diff --git a/drivers/input/keyboard/corgikbd.c b/drivers/input/keyboard/corgikbd.c
index e301ee4ca264..96c6bf77248a 100644
--- a/drivers/input/keyboard/corgikbd.c
+++ b/drivers/input/keyboard/corgikbd.c
@@ -29,11 +29,11 @@
 #define KB_COLS                         12
 #define KB_ROWMASK(r)           (1 << (r))
 #define SCANCODE(r,c)           ( ((r)<<4) + (c) + 1 )
-/* zero code, 124 scancodes + 3 hinge combinations */
-#define NR_SCANCODES            ( SCANCODE(KB_ROWS-1,KB_COLS-1) +1 +1 +3 )
-#define SCAN_INTERVAL           (HZ/10)
+/* zero code, 124 scancodes */
+#define NR_SCANCODES            ( SCANCODE(KB_ROWS-1,KB_COLS-1) +1 +1 )
 
-#define HINGE_SCAN_INTERVAL             (HZ/4)
+#define SCAN_INTERVAL           (50) /* ms */
+#define HINGE_SCAN_INTERVAL     (250) /* ms */
 
 #define CORGI_KEY_CALENDER      KEY_F1
 #define CORGI_KEY_ADDRESS       KEY_F2
@@ -49,9 +49,6 @@
 #define CORGI_KEY_MAIL          KEY_F10
 #define CORGI_KEY_OK            KEY_F11
 #define CORGI_KEY_MENU          KEY_F12
-#define CORGI_HINGE_0           KEY_KP0
-#define CORGI_HINGE_1           KEY_KP1
-#define CORGI_HINGE_2           KEY_KP2
 
 static unsigned char corgikbd_keycode[NR_SCANCODES] = {
         0,                                                                                                                /* 0 */
@@ -63,7 +60,6 @@ static unsigned char corgikbd_keycode[NR_SCANCODES] = {
         CORGI_KEY_MAIL, KEY_Z, KEY_X, KEY_MINUS, KEY_SPACE, KEY_COMMA, 0, KEY_UP, 0, 0, 0, CORGI_KEY_FN, 0, 0, 0, 0,            /* 81-96 */
         KEY_SYSRQ, CORGI_KEY_JAP1, CORGI_KEY_JAP2, CORGI_KEY_CANCEL, CORGI_KEY_OK, CORGI_KEY_MENU, KEY_LEFT, KEY_DOWN, KEY_RIGHT, 0, 0, 0, 0, 0, 0, 0,  /* 97-112 */
         CORGI_KEY_OFF, CORGI_KEY_EXOK, CORGI_KEY_EXCANCEL, CORGI_KEY_EXJOGDOWN, CORGI_KEY_EXJOGUP, 0, 0, 0, 0, 0, 0, 0,   /* 113-124 */
-        CORGI_HINGE_0, CORGI_HINGE_1, CORGI_HINGE_2       /* 125-127 */
 };
 
 
@@ -187,7 +183,7 @@ static void corgikbd_scankeyboard(struct corgikbd *corgikbd_data, struct pt_regs
 
         /* if any keys are pressed, enable the timer */
         if (num_pressed)
-                mod_timer(&corgikbd_data->timer, jiffies + SCAN_INTERVAL);
+                mod_timer(&corgikbd_data->timer, jiffies + msecs_to_jiffies(SCAN_INTERVAL));
 
         spin_unlock_irqrestore(&corgikbd_data->lock, flags);
 }
@@ -228,6 +224,7 @@ static void corgikbd_timer_callback(unsigned long data)
  *          0x0c - Keyboard and Screen Closed
  */
 
+#define READ_GPIO_BIT(x)    (GPLR(x) & GPIO_bit(x))
 #define HINGE_STABLE_COUNT 2
 static int sharpsl_hinge_state;
 static int hinge_count;
@@ -239,6 +236,7 @@ static void corgikbd_hinge_timer(unsigned long data)
         unsigned long flags;
 
         gprr = read_scoop_reg(&corgiscoop_device.dev, SCOOP_GPRR) & (CORGI_SCP_SWA | CORGI_SCP_SWB);
+        gprr |= (READ_GPIO_BIT(CORGI_GPIO_AK_INT) != 0);
         if (gprr != sharpsl_hinge_state) {
                 hinge_count = 0;
                 sharpsl_hinge_state = gprr;
@@ -249,27 +247,38 @@ static void corgikbd_hinge_timer(unsigned long data)
 
                         input_report_switch(corgikbd_data->input, SW_0, ((sharpsl_hinge_state & CORGI_SCP_SWA) != 0));
                         input_report_switch(corgikbd_data->input, SW_1, ((sharpsl_hinge_state & CORGI_SCP_SWB) != 0));
+                        input_report_switch(corgikbd_data->input, SW_2, (READ_GPIO_BIT(CORGI_GPIO_AK_INT) != 0));
                         input_sync(corgikbd_data->input);
 
                         spin_unlock_irqrestore(&corgikbd_data->lock, flags);
                 }
         }
-        mod_timer(&corgikbd_data->htimer, jiffies + HINGE_SCAN_INTERVAL);
+        mod_timer(&corgikbd_data->htimer, jiffies + msecs_to_jiffies(HINGE_SCAN_INTERVAL));
 }
 
 #ifdef CONFIG_PM
 static int corgikbd_suspend(struct platform_device *dev, pm_message_t state)
 {
+        int i;
         struct corgikbd *corgikbd = platform_get_drvdata(dev);
+
         corgikbd->suspended = 1;
+        /* strobe 0 is the power key so this can't be made an input for
+           powersaving therefore i = 1 */
+        for (i = 1; i < CORGI_KEY_STROBE_NUM; i++)
+                pxa_gpio_mode(CORGI_GPIO_KEY_STROBE(i) | GPIO_IN);
 
         return 0;
 }
 
 static int corgikbd_resume(struct platform_device *dev)
 {
+        int i;
         struct corgikbd *corgikbd = platform_get_drvdata(dev);
 
+        for (i = 1; i < CORGI_KEY_STROBE_NUM; i++)
+                pxa_gpio_mode(CORGI_GPIO_KEY_STROBE(i) | GPIO_OUT | GPIO_DFLT_HIGH);
+
         /* Upon resume, ignore the suspend key for a short while */
         corgikbd->suspend_jiffies=jiffies;
         corgikbd->suspended = 0;
@@ -333,10 +342,11 @@ static int __init corgikbd_probe(struct platform_device *pdev)
         clear_bit(0, input_dev->keybit);
         set_bit(SW_0, input_dev->swbit);
         set_bit(SW_1, input_dev->swbit);
+        set_bit(SW_2, input_dev->swbit);
 
         input_register_device(corgikbd->input);
 
-        mod_timer(&corgikbd->htimer, jiffies + HINGE_SCAN_INTERVAL);
+        mod_timer(&corgikbd->htimer, jiffies + msecs_to_jiffies(HINGE_SCAN_INTERVAL));
 
         /* Setup sense interrupts - RisingEdge Detect, sense lines as inputs */
         for (i = 0; i < CORGI_KEY_SENSE_NUM; i++) {
@@ -351,6 +361,9 @@ static int __init corgikbd_probe(struct platform_device *pdev)
         for (i = 0; i < CORGI_KEY_STROBE_NUM; i++)
                 pxa_gpio_mode(CORGI_GPIO_KEY_STROBE(i) | GPIO_OUT | GPIO_DFLT_HIGH);
 
+        /* Setup the headphone jack as an input */
+        pxa_gpio_mode(CORGI_GPIO_AK_INT | GPIO_IN);
+
         return 0;
 }
 
diff --git a/drivers/input/keyboard/hil_kbd.c b/drivers/input/keyboard/hil_kbd.c
index 63f387e4b783..1dca3cf42a54 100644
--- a/drivers/input/keyboard/hil_kbd.c
+++ b/drivers/input/keyboard/hil_kbd.c
@@ -250,16 +250,19 @@ static int hil_kbd_connect(struct serio *serio, struct serio_driver *drv)
         struct hil_kbd  *kbd;
         uint8_t         did, *idd;
         int             i;
-        
+
         kbd = kzalloc(sizeof(*kbd), GFP_KERNEL);
         if (!kbd)
                 return -ENOMEM;
 
         kbd->dev = input_allocate_device();
-        if (!kbd->dev) goto bail1;
+        if (!kbd->dev)
+                goto bail0;
+
         kbd->dev->private = kbd;
 
-        if (serio_open(serio, drv)) goto bail0;
+        if (serio_open(serio, drv))
+                goto bail1;
 
         serio_set_drvdata(serio, kbd);
         kbd->serio = serio;
diff --git a/drivers/input/keyboard/spitzkbd.c b/drivers/input/keyboard/spitzkbd.c
index 83999d583122..bc61cf8cfc65 100644
--- a/drivers/input/keyboard/spitzkbd.c
+++ b/drivers/input/keyboard/spitzkbd.c
@@ -30,6 +30,7 @@
 #define SCANCODE(r,c)           (((r)<<4) + (c) + 1)
 #define NR_SCANCODES            ((KB_ROWS<<4) + 1)
 
+#define SCAN_INTERVAL           (50) /* ms */
 #define HINGE_SCAN_INTERVAL     (150) /* ms */
 
 #define SPITZ_KEY_CALENDER      KEY_F1
@@ -230,7 +231,7 @@ static void spitzkbd_scankeyboard(struct spitzkbd *spitzkbd_data, struct pt_regs
 
         /* if any keys are pressed, enable the timer */
         if (num_pressed)
-                mod_timer(&spitzkbd_data->timer, jiffies + msecs_to_jiffies(100));
+                mod_timer(&spitzkbd_data->timer, jiffies + msecs_to_jiffies(SCAN_INTERVAL));
 
         spin_unlock_irqrestore(&spitzkbd_data->lock, flags);
 }
@@ -287,6 +288,7 @@ static void spitzkbd_hinge_timer(unsigned long data)
         unsigned long flags;
 
         state = GPLR(SPITZ_GPIO_SWA) & (GPIO_bit(SPITZ_GPIO_SWA)|GPIO_bit(SPITZ_GPIO_SWB));
+        state |= (GPLR(SPITZ_GPIO_AK_INT) & GPIO_bit(SPITZ_GPIO_AK_INT));
         if (state != sharpsl_hinge_state) {
                 hinge_count = 0;
                 sharpsl_hinge_state = state;
@@ -299,6 +301,7 @@ static void spitzkbd_hinge_timer(unsigned long data)
 
                 input_report_switch(spitzkbd_data->input, SW_0, ((GPLR(SPITZ_GPIO_SWA) & GPIO_bit(SPITZ_GPIO_SWA)) != 0));
                 input_report_switch(spitzkbd_data->input, SW_1, ((GPLR(SPITZ_GPIO_SWB) & GPIO_bit(SPITZ_GPIO_SWB)) != 0));
+                input_report_switch(spitzkbd_data->input, SW_2, ((GPLR(SPITZ_GPIO_AK_INT) & GPIO_bit(SPITZ_GPIO_AK_INT)) != 0));
                 input_sync(spitzkbd_data->input);
 
                 spin_unlock_irqrestore(&spitzkbd_data->lock, flags);
@@ -397,6 +400,7 @@ static int __init spitzkbd_probe(struct platform_device *dev)
         clear_bit(0, input_dev->keybit);
         set_bit(SW_0, input_dev->swbit);
         set_bit(SW_1, input_dev->swbit);
+        set_bit(SW_2, input_dev->swbit);
 
         input_register_device(input_dev);
 
@@ -432,6 +436,9 @@ static int __init spitzkbd_probe(struct platform_device *dev)
         request_irq(SPITZ_IRQ_GPIO_SWB, spitzkbd_hinge_isr,
                     SA_INTERRUPT | SA_TRIGGER_RISING | SA_TRIGGER_FALLING,
                     "Spitzkbd SWB", spitzkbd);
+        request_irq(SPITZ_IRQ_GPIO_AK_INT, spitzkbd_hinge_isr,
+                    SA_INTERRUPT | SA_TRIGGER_RISING | SA_TRIGGER_FALLING,
+                    "Spitzkbd HP", spitzkbd);
 
         printk(KERN_INFO "input: Spitz Keyboard Registered\n");
 
@@ -450,6 +457,7 @@ static int spitzkbd_remove(struct platform_device *dev)
         free_irq(SPITZ_IRQ_GPIO_ON_KEY, spitzkbd);
         free_irq(SPITZ_IRQ_GPIO_SWA, spitzkbd);
         free_irq(SPITZ_IRQ_GPIO_SWB, spitzkbd);
+        free_irq(SPITZ_IRQ_GPIO_AK_INT, spitzkbd);
 
         del_timer_sync(&spitzkbd->htimer);
         del_timer_sync(&spitzkbd->timer);
diff --git a/drivers/input/misc/pcspkr.c b/drivers/input/misc/pcspkr.c
index 1ef477f4469c..afd322185bbf 100644
--- a/drivers/input/misc/pcspkr.c
+++ b/drivers/input/misc/pcspkr.c
@@ -24,7 +24,6 @@ MODULE_AUTHOR("Vojtech Pavlik <vojtech@ucw.cz>");
 MODULE_DESCRIPTION("PC Speaker beeper driver");
 MODULE_LICENSE("GPL");
 
-static struct platform_device *pcspkr_platform_device;
 static DEFINE_SPINLOCK(i8253_beep_lock);
 
 static int pcspkr_event(struct input_dev *dev, unsigned int type, unsigned int code, int value)
@@ -135,35 +134,11 @@ static struct platform_driver pcspkr_platform_driver = {
 
 static int __init pcspkr_init(void)
 {
-        int err;
-
-        err = platform_driver_register(&pcspkr_platform_driver);
-        if (err)
-                return err;
-
-        pcspkr_platform_device = platform_device_alloc("pcspkr", -1);
-        if (!pcspkr_platform_device) {
-                err = -ENOMEM;
-                goto err_unregister_driver;
-        }
-
-        err = platform_device_add(pcspkr_platform_device);
-        if (err)
-                goto err_free_device;
-
-        return 0;
-
- err_free_device:
-        platform_device_put(pcspkr_platform_device);
- err_unregister_driver:
-        platform_driver_unregister(&pcspkr_platform_driver);
-
-        return err;
+        return platform_driver_register(&pcspkr_platform_driver);
 }
 
 static void __exit pcspkr_exit(void)
 {
-        platform_device_unregister(pcspkr_platform_device);
         platform_driver_unregister(&pcspkr_platform_driver);
 }
 
diff --git a/drivers/input/misc/uinput.c b/drivers/input/misc/uinput.c
index 546ed9b4901d..d723e9ad7c41 100644
--- a/drivers/input/misc/uinput.c
+++ b/drivers/input/misc/uinput.c
@@ -194,7 +194,7 @@ static int uinput_open(struct inode *inode, struct file *file)
         if (!newdev)
                 return -ENOMEM;
 
-        init_MUTEX(&newdev->sem);
+        mutex_init(&newdev->mutex);
         spin_lock_init(&newdev->requests_lock);
         init_waitqueue_head(&newdev->requests_waitq);
         init_waitqueue_head(&newdev->waitq);
@@ -340,7 +340,7 @@ static ssize_t uinput_write(struct file *file, const char __user *buffer, size_t
         struct uinput_device *udev = file->private_data;
         int retval;
 
-        retval = down_interruptible(&udev->sem);
+        retval = mutex_lock_interruptible(&udev->mutex);
         if (retval)
                 return retval;
 
@@ -348,7 +348,7 @@ static ssize_t uinput_write(struct file *file, const char __user *buffer, size_t
                         uinput_inject_event(udev, buffer, count) :
                         uinput_setup_device(udev, buffer, count);
 
-        up(&udev->sem);
+        mutex_unlock(&udev->mutex);
 
         return retval;
 }
@@ -369,7 +369,7 @@ static ssize_t uinput_read(struct file *file, char __user *buffer, size_t count,
         if (retval)
                 return retval;
 
-        retval = down_interruptible(&udev->sem);
+        retval = mutex_lock_interruptible(&udev->mutex);
         if (retval)
                 return retval;
 
@@ -388,7 +388,7 @@ static ssize_t uinput_read(struct file *file, char __user *buffer, size_t count,
         }
 
  out:
-        up(&udev->sem);
+        mutex_unlock(&udev->mutex);
 
         return retval;
 }
@@ -439,7 +439,7 @@ static long uinput_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
 
         udev = file->private_data;
 
-        retval = down_interruptible(&udev->sem);
+        retval = mutex_lock_interruptible(&udev->mutex);
         if (retval)
                 return retval;
 
@@ -589,7 +589,7 @@ static long uinput_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
         }
 
  out:
-        up(&udev->sem);
+        mutex_unlock(&udev->mutex);
         return retval;
 }
 
diff --git a/drivers/input/mouse/hil_ptr.c b/drivers/input/mouse/hil_ptr.c
index bfb564fd8fe2..69f02178c528 100644
--- a/drivers/input/mouse/hil_ptr.c
+++ b/drivers/input/mouse/hil_ptr.c
@@ -249,10 +249,13 @@ static int hil_ptr_connect(struct serio *serio, struct serio_driver *driver)
                 return -ENOMEM;
 
         ptr->dev = input_allocate_device();
-        if (!ptr->dev) goto bail0;
+        if (!ptr->dev)
+                goto bail0;
+
         ptr->dev->private = ptr;
 
-        if (serio_open(serio, driver)) goto bail1;
+        if (serio_open(serio, driver))
+                goto bail1;
 
         serio_set_drvdata(serio, ptr);
         ptr->serio = serio;
diff --git a/drivers/input/mouse/psmouse-base.c b/drivers/input/mouse/psmouse-base.c
index ad6217467676..32d70ed8f41d 100644
--- a/drivers/input/mouse/psmouse-base.c
+++ b/drivers/input/mouse/psmouse-base.c
@@ -20,6 +20,8 @@
 #include <linux/serio.h>
 #include <linux/init.h>
 #include <linux/libps2.h>
+#include <linux/mutex.h>
+
 #include "psmouse.h"
 #include "synaptics.h"
 #include "logips2pp.h"
@@ -98,13 +100,13 @@ __obsolete_setup("psmouse_resetafter=");
 __obsolete_setup("psmouse_rate=");
 
 /*
- * psmouse_sem protects all operations changing state of mouse
+ * psmouse_mutex protects all operations changing state of mouse
  * (connecting, disconnecting, changing rate or resolution via
  * sysfs). We could use a per-device semaphore but since there
  * rarely more than one PS/2 mouse connected and since semaphore
  * is taken in "slow" paths it is not worth it.
  */
-static DECLARE_MUTEX(psmouse_sem);
+static DEFINE_MUTEX(psmouse_mutex);
 
 static struct workqueue_struct *kpsmoused_wq;
 
@@ -868,7 +870,7 @@ static void psmouse_resync(void *p)
         int failed = 0, enabled = 0;
         int i;
 
-        down(&psmouse_sem);
+        mutex_lock(&psmouse_mutex);
 
         if (psmouse->state != PSMOUSE_RESYNCING)
                 goto out;
@@ -948,7 +950,7 @@ static void psmouse_resync(void *p)
         if (parent)
                 psmouse_activate(parent);
  out:
-        up(&psmouse_sem);
+        mutex_unlock(&psmouse_mutex);
 }
 
 /*
@@ -974,14 +976,14 @@ static void psmouse_disconnect(struct serio *serio)
 
         sysfs_remove_group(&serio->dev.kobj, &psmouse_attribute_group);
 
-        down(&psmouse_sem);
+        mutex_lock(&psmouse_mutex);
 
         psmouse_set_state(psmouse, PSMOUSE_CMD_MODE);
 
         /* make sure we don't have a resync in progress */
-        up(&psmouse_sem);
+        mutex_unlock(&psmouse_mutex);
         flush_workqueue(kpsmoused_wq);
-        down(&psmouse_sem);
+        mutex_lock(&psmouse_mutex);
 
         if (serio->parent && serio->id.type == SERIO_PS_PSTHRU) {
                 parent = serio_get_drvdata(serio->parent);
@@ -1004,7 +1006,7 @@ static void psmouse_disconnect(struct serio *serio)
         if (parent)
                 psmouse_activate(parent);
 
-        up(&psmouse_sem);
+        mutex_unlock(&psmouse_mutex);
 }
 
 static int psmouse_switch_protocol(struct psmouse *psmouse, struct psmouse_protocol *proto)
@@ -1076,7 +1078,7 @@ static int psmouse_connect(struct serio *serio, struct serio_driver *drv)
         struct input_dev *input_dev;
         int retval = -ENOMEM;
 
-        down(&psmouse_sem);
+        mutex_lock(&psmouse_mutex);
 
         /*
          * If this is a pass-through port deactivate parent so the device
@@ -1144,7 +1146,7 @@ out:
         if (parent)
                 psmouse_activate(parent);
 
-        up(&psmouse_sem);
+        mutex_unlock(&psmouse_mutex);
         return retval;
 }
 
@@ -1161,7 +1163,7 @@ static int psmouse_reconnect(struct serio *serio)
                 return -1;
         }
 
-        down(&psmouse_sem);
+        mutex_lock(&psmouse_mutex);
 
         if (serio->parent && serio->id.type == SERIO_PS_PSTHRU) {
                 parent = serio_get_drvdata(serio->parent);
@@ -1195,7 +1197,7 @@ out:
         if (parent)
                 psmouse_activate(parent);
 
-        up(&psmouse_sem);
+        mutex_unlock(&psmouse_mutex);
         return rc;
 }
 
@@ -1273,7 +1275,7 @@ ssize_t psmouse_attr_set_helper(struct device *dev, struct device_attribute *dev
                 goto out_unpin;
         }
 
-        retval = down_interruptible(&psmouse_sem);
+        retval = mutex_lock_interruptible(&psmouse_mutex);
         if (retval)
                 goto out_unpin;
 
@@ -1281,7 +1283,7 @@ ssize_t psmouse_attr_set_helper(struct device *dev, struct device_attribute *dev
 
         if (psmouse->state == PSMOUSE_IGNORE) {
                 retval = -ENODEV;
-                goto out_up;
+                goto out_unlock;
         }
 
         if (serio->parent && serio->id.type == SERIO_PS_PSTHRU) {
@@ -1299,8 +1301,8 @@ ssize_t psmouse_attr_set_helper(struct device *dev, struct device_attribute *dev
         if (parent)
                 psmouse_activate(parent);
 
- out_up:
-        up(&psmouse_sem);
+ out_unlock:
+        mutex_unlock(&psmouse_mutex);
  out_unpin:
         serio_unpin_driver(serio);
         return retval;
@@ -1357,11 +1359,11 @@ static ssize_t psmouse_attr_set_protocol(struct psmouse *psmouse, void *data, co
                         return -EIO;
                 }
 
-                up(&psmouse_sem);
+                mutex_unlock(&psmouse_mutex);
                 serio_unpin_driver(serio);
                 serio_unregister_child_port(serio);
                 serio_pin_driver_uninterruptible(serio);
-                down(&psmouse_sem);
+                mutex_lock(&psmouse_mutex);
 
                 if (serio->drv != &psmouse_drv) {
                         input_free_device(new_dev);
diff --git a/drivers/input/mouse/synaptics.c b/drivers/input/mouse/synaptics.c
index 2051bec2c394..ad5d0a85e960 100644
--- a/drivers/input/mouse/synaptics.c
+++ b/drivers/input/mouse/synaptics.c
@@ -247,14 +247,12 @@ static void synaptics_pt_create(struct psmouse *psmouse)
 {
         struct serio *serio;
 
-        serio = kmalloc(sizeof(struct serio), GFP_KERNEL);
+        serio = kzalloc(sizeof(struct serio), GFP_KERNEL);
         if (!serio) {
                 printk(KERN_ERR "synaptics: not enough memory to allocate pass-through port\n");
                 return;
         }
 
-        memset(serio, 0, sizeof(struct serio));
-
         serio->id.type = SERIO_PS_PSTHRU;
         strlcpy(serio->name, "Synaptics pass-through", sizeof(serio->name));
         strlcpy(serio->phys, "synaptics-pt/serio0", sizeof(serio->name));
@@ -605,14 +603,21 @@ static struct dmi_system_id toshiba_dmi_table[] = {
                 .ident = "Toshiba Satellite",
                 .matches = {
                         DMI_MATCH(DMI_SYS_VENDOR, "TOSHIBA"),
-                        DMI_MATCH(DMI_PRODUCT_NAME , "Satellite"),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "Satellite"),
                 },
         },
         {
                 .ident = "Toshiba Dynabook",
                 .matches = {
                         DMI_MATCH(DMI_SYS_VENDOR, "TOSHIBA"),
-                        DMI_MATCH(DMI_PRODUCT_NAME , "dynabook"),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "dynabook"),
+                },
+        },
+        {
+                .ident = "Toshiba Portege M300",
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "TOSHIBA"),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "PORTEGE M300"),
                 },
         },
         { }
@@ -623,10 +628,9 @@ int synaptics_init(struct psmouse *psmouse)
 {
         struct synaptics_data *priv;
 
-        psmouse->private = priv = kmalloc(sizeof(struct synaptics_data), GFP_KERNEL);
+        psmouse->private = priv = kzalloc(sizeof(struct synaptics_data), GFP_KERNEL);
         if (!priv)
                 return -1;
-        memset(priv, 0, sizeof(struct synaptics_data));
 
         if (synaptics_query_hardware(psmouse)) {
                 printk(KERN_ERR "Unable to query Synaptics hardware.\n");
diff --git a/drivers/input/mousedev.c b/drivers/input/mousedev.c
index 9abed18d2ecf..b685a507955d 100644
--- a/drivers/input/mousedev.c
+++ b/drivers/input/mousedev.c
@@ -412,9 +412,8 @@ static int mousedev_open(struct inode * inode, struct file * file)
         if (i >= MOUSEDEV_MINORS || !mousedev_table[i])
                 return -ENODEV;
 
-        if (!(list = kmalloc(sizeof(struct mousedev_list), GFP_KERNEL)))
+        if (!(list = kzalloc(sizeof(struct mousedev_list), GFP_KERNEL)))
                 return -ENOMEM;
-        memset(list, 0, sizeof(struct mousedev_list));
 
         spin_lock_init(&list->packet_lock);
         list->pos_x = xres / 2;
@@ -626,9 +625,8 @@ static struct input_handle *mousedev_connect(struct input_handler *handler, stru
                 return NULL;
         }
 
-        if (!(mousedev = kmalloc(sizeof(struct mousedev), GFP_KERNEL)))
+        if (!(mousedev = kzalloc(sizeof(struct mousedev), GFP_KERNEL)))
                 return NULL;
-        memset(mousedev, 0, sizeof(struct mousedev));
 
         INIT_LIST_HEAD(&mousedev->list);
         init_waitqueue_head(&mousedev->wait);
diff --git a/drivers/input/power.c b/drivers/input/power.c
index bfc5c63ebffe..526e6070600c 100644
--- a/drivers/input/power.c
+++ b/drivers/input/power.c
@@ -103,9 +103,8 @@ static struct input_handle *power_connect(struct input_handler *handler,
 {
         struct input_handle *handle;
 
-        if (!(handle = kmalloc(sizeof(struct input_handle), GFP_KERNEL)))
+        if (!(handle = kzalloc(sizeof(struct input_handle), GFP_KERNEL)))
                 return NULL;
-        memset(handle, 0, sizeof(struct input_handle));
 
         handle->dev = dev;
         handle->handler = handler;
diff --git a/drivers/input/serio/hil_mlc.c b/drivers/input/serio/hil_mlc.c
index ea499783fb12..bbbe15e21904 100644
--- a/drivers/input/serio/hil_mlc.c
+++ b/drivers/input/serio/hil_mlc.c
@@ -872,9 +872,8 @@ int hil_mlc_register(hil_mlc *mlc) {
         for (i = 0; i < HIL_MLC_DEVMEM; i++) {
                 struct serio *mlc_serio;
                 hil_mlc_copy_di_scratch(mlc, i);
-                mlc_serio = kmalloc(sizeof(*mlc_serio), GFP_KERNEL);
+                mlc_serio = kzalloc(sizeof(*mlc_serio), GFP_KERNEL);
                 mlc->serio[i] = mlc_serio;
-                memset(mlc_serio, 0, sizeof(*mlc_serio));
                 mlc_serio->id                   = hil_mlc_serio_id;
                 mlc_serio->write                = hil_mlc_serio_write;
                 mlc_serio->open                 = hil_mlc_serio_open;
diff --git a/drivers/input/serio/i8042-x86ia64io.h b/drivers/input/serio/i8042-x86ia64io.h
index a4c6f3522723..f606e96bc2f4 100644
--- a/drivers/input/serio/i8042-x86ia64io.h
+++ b/drivers/input/serio/i8042-x86ia64io.h
@@ -192,7 +192,9 @@ static struct dmi_system_id __initdata i8042_dmi_nomux_table[] = {
 #include <linux/pnp.h>
 
 static int i8042_pnp_kbd_registered;
+static unsigned int i8042_pnp_kbd_devices;
 static int i8042_pnp_aux_registered;
+static unsigned int i8042_pnp_aux_devices;
 
 static int i8042_pnp_command_reg;
 static int i8042_pnp_data_reg;
@@ -219,6 +221,7 @@ static int i8042_pnp_kbd_probe(struct pnp_dev *dev, const struct pnp_device_id *
                 strncat(i8042_pnp_kbd_name, pnp_dev_name(dev), sizeof(i8042_pnp_kbd_name));
         }
 
+        i8042_pnp_kbd_devices++;
         return 0;
 }
 
@@ -239,6 +242,7 @@ static int i8042_pnp_aux_probe(struct pnp_dev *dev, const struct pnp_device_id *
                 strncat(i8042_pnp_aux_name, pnp_dev_name(dev), sizeof(i8042_pnp_aux_name));
         }
 
+        i8042_pnp_aux_devices++;
         return 0;
 }
 
@@ -287,21 +291,23 @@ static void i8042_pnp_exit(void)
 
 static int __init i8042_pnp_init(void)
 {
-        int result_kbd = 0, result_aux = 0;
         char kbd_irq_str[4] = { 0 }, aux_irq_str[4] = { 0 };
+        int err;
 
         if (i8042_nopnp) {
                 printk(KERN_INFO "i8042: PNP detection disabled\n");
                 return 0;
         }
 
-        if ((result_kbd = pnp_register_driver(&i8042_pnp_kbd_driver)) >= 0)
+        err = pnp_register_driver(&i8042_pnp_kbd_driver);
+        if (!err)
                 i8042_pnp_kbd_registered = 1;
 
-        if ((result_aux = pnp_register_driver(&i8042_pnp_aux_driver)) >= 0)
+        err = pnp_register_driver(&i8042_pnp_aux_driver);
+        if (!err)
                 i8042_pnp_aux_registered = 1;
 
-        if (result_kbd <= 0 && result_aux <= 0) {
+        if (!i8042_pnp_kbd_devices && !i8042_pnp_aux_devices) {
                 i8042_pnp_exit();
 #if defined(__ia64__)
                 return -ENODEV;
@@ -311,24 +317,24 @@ static int __init i8042_pnp_init(void)
 #endif
         }
 
-        if (result_kbd > 0)
+        if (i8042_pnp_kbd_devices)
                 snprintf(kbd_irq_str, sizeof(kbd_irq_str),
                         "%d", i8042_pnp_kbd_irq);
-        if (result_aux > 0)
+        if (i8042_pnp_aux_devices)
                 snprintf(aux_irq_str, sizeof(aux_irq_str),
                         "%d", i8042_pnp_aux_irq);
 
         printk(KERN_INFO "PNP: PS/2 Controller [%s%s%s] at %#x,%#x irq %s%s%s\n",
-                i8042_pnp_kbd_name, (result_kbd > 0 && result_aux > 0) ? "," : "",
+                i8042_pnp_kbd_name, (i8042_pnp_kbd_devices && i8042_pnp_aux_devices) ? "," : "",
                 i8042_pnp_aux_name,
                 i8042_pnp_data_reg, i8042_pnp_command_reg,
-                kbd_irq_str, (result_kbd > 0 && result_aux > 0) ? "," : "",
+                kbd_irq_str, (i8042_pnp_kbd_devices && i8042_pnp_aux_devices) ? "," : "",
                 aux_irq_str);
 
 #if defined(__ia64__)
-        if (result_kbd <= 0)
+        if (!i8042_pnp_kbd_devices)
                 i8042_nokbd = 1;
-        if (result_aux <= 0)
+        if (!i8042_pnp_aux_devices)
                 i8042_noaux = 1;
 #endif
 
diff --git a/drivers/input/serio/libps2.c b/drivers/input/serio/libps2.c
index d4c990f7c85e..79c97f94bcbd 100644
--- a/drivers/input/serio/libps2.c
+++ b/drivers/input/serio/libps2.c
@@ -84,7 +84,7 @@ void ps2_drain(struct ps2dev *ps2dev, int maxbytes, int timeout)
                 maxbytes = sizeof(ps2dev->cmdbuf);
         }
 
-        down(&ps2dev->cmd_sem);
+        mutex_lock(&ps2dev->cmd_mutex);
 
         serio_pause_rx(ps2dev->serio);
         ps2dev->flags = PS2_FLAG_CMD;
@@ -94,7 +94,7 @@ void ps2_drain(struct ps2dev *ps2dev, int maxbytes, int timeout)
         wait_event_timeout(ps2dev->wait,
                            !(ps2dev->flags & PS2_FLAG_CMD),
                            msecs_to_jiffies(timeout));
-        up(&ps2dev->cmd_sem);
+        mutex_unlock(&ps2dev->cmd_mutex);
 }
 
 /*
@@ -177,7 +177,7 @@ int ps2_command(struct ps2dev *ps2dev, unsigned char *param, int command)
                 return -1;
         }
 
-        down(&ps2dev->cmd_sem);
+        mutex_lock(&ps2dev->cmd_mutex);
 
         serio_pause_rx(ps2dev->serio);
         ps2dev->flags = command == PS2_CMD_GETID ? PS2_FLAG_WAITID : 0;
@@ -229,7 +229,7 @@ int ps2_command(struct ps2dev *ps2dev, unsigned char *param, int command)
         ps2dev->flags = 0;
         serio_continue_rx(ps2dev->serio);
 
-        up(&ps2dev->cmd_sem);
+        mutex_unlock(&ps2dev->cmd_mutex);
         return rc;
 }
 
@@ -281,7 +281,7 @@ int ps2_schedule_command(struct ps2dev *ps2dev, unsigned char *param, int comman
 
 void ps2_init(struct ps2dev *ps2dev, struct serio *serio)
 {
-        init_MUTEX(&ps2dev->cmd_sem);
+        mutex_init(&ps2dev->cmd_mutex);
         init_waitqueue_head(&ps2dev->wait);
         ps2dev->serio = serio;
 }
diff --git a/drivers/input/serio/parkbd.c b/drivers/input/serio/parkbd.c
index 1d15c2819818..a5c1fb3a4a51 100644
--- a/drivers/input/serio/parkbd.c
+++ b/drivers/input/serio/parkbd.c
@@ -171,9 +171,8 @@ static struct serio * __init parkbd_allocate_serio(void)
 {
         struct serio *serio;
 
-        serio = kmalloc(sizeof(struct serio), GFP_KERNEL);
+        serio = kzalloc(sizeof(struct serio), GFP_KERNEL);
         if (serio) {
-                memset(serio, 0, sizeof(struct serio));
                 serio->id.type = parkbd_mode;
                 serio->write = parkbd_write,
                 strlcpy(serio->name, "PARKBD AT/XT keyboard adapter", sizeof(serio->name));
diff --git a/drivers/input/serio/rpckbd.c b/drivers/input/serio/rpckbd.c
index a3bd11589bc3..513d37fc1acf 100644
--- a/drivers/input/serio/rpckbd.c
+++ b/drivers/input/serio/rpckbd.c
@@ -111,11 +111,10 @@ static int __devinit rpckbd_probe(struct platform_device *dev)
 {
         struct serio *serio;
 
-        serio = kmalloc(sizeof(struct serio), GFP_KERNEL);
+        serio = kzalloc(sizeof(struct serio), GFP_KERNEL);
         if (!serio)
                 return -ENOMEM;
 
-        memset(serio, 0, sizeof(struct serio));
         serio->id.type          = SERIO_8042;
         serio->write            = rpckbd_write;
         serio->open             = rpckbd_open;
diff --git a/drivers/input/serio/serio.c b/drivers/input/serio/serio.c
index 2f76813c3a64..6521034bc933 100644
--- a/drivers/input/serio/serio.c
+++ b/drivers/input/serio/serio.c
@@ -34,6 +34,7 @@
 #include <linux/sched.h>
 #include <linux/slab.h>
 #include <linux/kthread.h>
+#include <linux/mutex.h>
 
 MODULE_AUTHOR("Vojtech Pavlik <vojtech@ucw.cz>");
 MODULE_DESCRIPTION("Serio abstraction core");
@@ -52,10 +53,10 @@ EXPORT_SYMBOL(serio_rescan);
 EXPORT_SYMBOL(serio_reconnect);
 
 /*
- * serio_sem protects entire serio subsystem and is taken every time
+ * serio_mutex protects entire serio subsystem and is taken every time
  * serio port or driver registrered or unregistered.
  */
-static DECLARE_MUTEX(serio_sem);
+static DEFINE_MUTEX(serio_mutex);
 
 static LIST_HEAD(serio_list);
 
@@ -70,9 +71,9 @@ static int serio_connect_driver(struct serio *serio, struct serio_driver *drv)
 {
         int retval;
 
-        down(&serio->drv_sem);
+        mutex_lock(&serio->drv_mutex);
         retval = drv->connect(serio, drv);
-        up(&serio->drv_sem);
+        mutex_unlock(&serio->drv_mutex);
 
         return retval;
 }
@@ -81,20 +82,20 @@ static int serio_reconnect_driver(struct serio *serio)
 {
         int retval = -1;
 
-        down(&serio->drv_sem);
+        mutex_lock(&serio->drv_mutex);
         if (serio->drv && serio->drv->reconnect)
                 retval = serio->drv->reconnect(serio);
-        up(&serio->drv_sem);
+        mutex_unlock(&serio->drv_mutex);
 
         return retval;
 }
 
 static void serio_disconnect_driver(struct serio *serio)
 {
-        down(&serio->drv_sem);
+        mutex_lock(&serio->drv_mutex);
         if (serio->drv)
                 serio->drv->disconnect(serio);
-        up(&serio->drv_sem);
+        mutex_unlock(&serio->drv_mutex);
 }
 
 static int serio_match_port(const struct serio_device_id *ids, struct serio *serio)
@@ -195,6 +196,7 @@ static void serio_queue_event(void *object, struct module *owner,
         if ((event = kmalloc(sizeof(struct serio_event), GFP_ATOMIC))) {
                 if (!try_module_get(owner)) {
                         printk(KERN_WARNING "serio: Can't get module reference, dropping event %d\n", event_type);
+                        kfree(event);
                         goto out;
                 }
 
@@ -272,7 +274,7 @@ static void serio_handle_event(void)
         struct serio_event *event;
         struct serio_driver *serio_drv;
 
-        down(&serio_sem);
+        mutex_lock(&serio_mutex);
 
         /*
          * Note that we handle only one event here to give swsusp
@@ -314,7 +316,7 @@ static void serio_handle_event(void)
                 serio_free_event(event);
         }
 
-        up(&serio_sem);
+        mutex_unlock(&serio_mutex);
 }
 
 /*
@@ -449,7 +451,7 @@ static ssize_t serio_rebind_driver(struct device *dev, struct device_attribute *
         struct device_driver *drv;
         int retval;
 
-        retval = down_interruptible(&serio_sem);
+        retval = mutex_lock_interruptible(&serio_mutex);
         if (retval)
                 return retval;
 
@@ -469,7 +471,7 @@ static ssize_t serio_rebind_driver(struct device *dev, struct device_attribute *
                 retval = -EINVAL;
         }
 
-        up(&serio_sem);
+        mutex_unlock(&serio_mutex);
 
         return retval;
 }
@@ -524,7 +526,7 @@ static void serio_init_port(struct serio *serio)
         __module_get(THIS_MODULE);
 
         spin_lock_init(&serio->lock);
-        init_MUTEX(&serio->drv_sem);
+        mutex_init(&serio->drv_mutex);
         device_initialize(&serio->dev);
         snprintf(serio->dev.bus_id, sizeof(serio->dev.bus_id),
                  "serio%ld", (long)atomic_inc_return(&serio_no) - 1);
@@ -661,10 +663,10 @@ void __serio_register_port(struct serio *serio, struct module *owner)
  */
 void serio_unregister_port(struct serio *serio)
 {
-        down(&serio_sem);
+        mutex_lock(&serio_mutex);
         serio_disconnect_port(serio);
         serio_destroy_port(serio);
-        up(&serio_sem);
+        mutex_unlock(&serio_mutex);
 }
 
 /*
@@ -672,17 +674,17 @@ void serio_unregister_port(struct serio *serio)
  */
 void serio_unregister_child_port(struct serio *serio)
 {
-        down(&serio_sem);
+        mutex_lock(&serio_mutex);
         if (serio->child) {
                 serio_disconnect_port(serio->child);
                 serio_destroy_port(serio->child);
         }
-        up(&serio_sem);
+        mutex_unlock(&serio_mutex);
 }
 
 /*
  * Submits register request to kseriod for subsequent execution.
- * Can be used when it is not obvious whether the serio_sem is
+ * Can be used when it is not obvious whether the serio_mutex is
  * taken or not and when delayed execution is feasible.
  */
 void __serio_unregister_port_delayed(struct serio *serio, struct module *owner)
@@ -765,7 +767,7 @@ void serio_unregister_driver(struct serio_driver *drv)
 {
         struct serio *serio;
 
-        down(&serio_sem);
+        mutex_lock(&serio_mutex);
         drv->manual_bind = 1;   /* so serio_find_driver ignores it */
 
 start_over:
@@ -779,7 +781,7 @@ start_over:
         }
 
         driver_unregister(&drv->driver);
-        up(&serio_sem);
+        mutex_unlock(&serio_mutex);
 }
 
 static void serio_set_drv(struct serio *serio, struct serio_driver *drv)
@@ -858,7 +860,7 @@ static int serio_resume(struct device *dev)
         return 0;
 }
 
-/* called from serio_driver->connect/disconnect methods under serio_sem */
+/* called from serio_driver->connect/disconnect methods under serio_mutex */
 int serio_open(struct serio *serio, struct serio_driver *drv)
 {
         serio_set_drv(serio, drv);
@@ -870,7 +872,7 @@ int serio_open(struct serio *serio, struct serio_driver *drv)
         return 0;
 }
 
-/* called from serio_driver->connect/disconnect methods under serio_sem */
+/* called from serio_driver->connect/disconnect methods under serio_mutex */
 void serio_close(struct serio *serio)
 {
         if (serio->close)
@@ -923,5 +925,5 @@ static void __exit serio_exit(void)
         kthread_stop(serio_task);
 }
 
-module_init(serio_init);
+subsys_initcall(serio_init);
 module_exit(serio_exit);
diff --git a/drivers/input/serio/serio_raw.c b/drivers/input/serio/serio_raw.c
index 47e08de18d07..5a2703b536dc 100644
--- a/drivers/input/serio/serio_raw.c
+++ b/drivers/input/serio/serio_raw.c
@@ -19,6 +19,7 @@
 #include <linux/devfs_fs_kernel.h>
 #include <linux/miscdevice.h>
 #include <linux/wait.h>
+#include <linux/mutex.h>
 
 #define DRIVER_DESC     "Raw serio driver"
 
@@ -46,7 +47,7 @@ struct serio_raw_list {
         struct list_head node;
 };
 
-static DECLARE_MUTEX(serio_raw_sem);
+static DEFINE_MUTEX(serio_raw_mutex);
 static LIST_HEAD(serio_raw_list);
 static unsigned int serio_raw_no;
 
@@ -81,7 +82,7 @@ static int serio_raw_open(struct inode *inode, struct file *file)
         struct serio_raw_list *list;
         int retval = 0;
 
-        retval = down_interruptible(&serio_raw_sem);
+        retval = mutex_lock_interruptible(&serio_raw_mutex);
         if (retval)
                 return retval;
 
@@ -95,12 +96,11 @@ static int serio_raw_open(struct inode *inode, struct file *file)
                 goto out;
         }
 
-        if (!(list = kmalloc(sizeof(struct serio_raw_list), GFP_KERNEL))) {
+        if (!(list = kzalloc(sizeof(struct serio_raw_list), GFP_KERNEL))) {
                 retval = -ENOMEM;
                 goto out;
         }
 
-        memset(list, 0, sizeof(struct serio_raw_list));
         list->serio_raw = serio_raw;
         file->private_data = list;
 
@@ -108,7 +108,7 @@ static int serio_raw_open(struct inode *inode, struct file *file)
         list_add_tail(&list->node, &serio_raw->list);
 
 out:
-        up(&serio_raw_sem);
+        mutex_unlock(&serio_raw_mutex);
         return retval;
 }
 
@@ -130,12 +130,12 @@ static int serio_raw_release(struct inode *inode, struct file *file)
         struct serio_raw_list *list = file->private_data;
         struct serio_raw *serio_raw = list->serio_raw;
 
-        down(&serio_raw_sem);
+        mutex_lock(&serio_raw_mutex);
 
         serio_raw_fasync(-1, file, 0);
         serio_raw_cleanup(serio_raw);
 
-        up(&serio_raw_sem);
+        mutex_unlock(&serio_raw_mutex);
         return 0;
 }
 
@@ -194,7 +194,7 @@ static ssize_t serio_raw_write(struct file *file, const char __user *buffer, siz
         int retval;
         unsigned char c;
 
-        retval = down_interruptible(&serio_raw_sem);
+        retval = mutex_lock_interruptible(&serio_raw_mutex);
         if (retval)
                 return retval;
 
@@ -219,7 +219,7 @@ static ssize_t serio_raw_write(struct file *file, const char __user *buffer, siz
         };
 
 out:
-        up(&serio_raw_sem);
+        mutex_unlock(&serio_raw_mutex);
         return written;
 }
 
@@ -275,14 +275,13 @@ static int serio_raw_connect(struct serio *serio, struct serio_driver *drv)
         struct serio_raw *serio_raw;
         int err;
 
-        if (!(serio_raw = kmalloc(sizeof(struct serio_raw), GFP_KERNEL))) {
+        if (!(serio_raw = kzalloc(sizeof(struct serio_raw), GFP_KERNEL))) {
                 printk(KERN_ERR "serio_raw.c: can't allocate memory for a device\n");
                 return -ENOMEM;
         }
 
-        down(&serio_raw_sem);
+        mutex_lock(&serio_raw_mutex);
 
-        memset(serio_raw, 0, sizeof(struct serio_raw));
         snprintf(serio_raw->name, sizeof(serio_raw->name), "serio_raw%d", serio_raw_no++);
         serio_raw->refcnt = 1;
         serio_raw->serio = serio;
@@ -325,7 +324,7 @@ out_free:
         serio_set_drvdata(serio, NULL);
         kfree(serio_raw);
 out:
-        up(&serio_raw_sem);
+        mutex_unlock(&serio_raw_mutex);
         return err;
 }
 
@@ -350,7 +349,7 @@ static void serio_raw_disconnect(struct serio *serio)
 {
         struct serio_raw *serio_raw;
 
-        down(&serio_raw_sem);
+        mutex_lock(&serio_raw_mutex);
 
         serio_raw = serio_get_drvdata(serio);
 
@@ -361,7 +360,7 @@ static void serio_raw_disconnect(struct serio *serio)
         if (!serio_raw_cleanup(serio_raw))
                 wake_up_interruptible(&serio_raw->wait);
 
-        up(&serio_raw_sem);
+        mutex_unlock(&serio_raw_mutex);
 }
 
 static struct serio_device_id serio_raw_serio_ids[] = {
diff --git a/drivers/input/tsdev.c b/drivers/input/tsdev.c
index ca1547929d62..d678d144bbf8 100644
--- a/drivers/input/tsdev.c
+++ b/drivers/input/tsdev.c
@@ -157,9 +157,8 @@ static int tsdev_open(struct inode *inode, struct file *file)
         if (i >= TSDEV_MINORS || !tsdev_table[i & TSDEV_MINOR_MASK])
                 return -ENODEV;
 
-        if (!(list = kmalloc(sizeof(struct tsdev_list), GFP_KERNEL)))
+        if (!(list = kzalloc(sizeof(struct tsdev_list), GFP_KERNEL)))
                 return -ENOMEM;
-        memset(list, 0, sizeof(struct tsdev_list));
 
         list->raw = (i >= TSDEV_MINORS/2) ? 1 : 0;
 
@@ -379,9 +378,8 @@ static struct input_handle *tsdev_connect(struct input_handler *handler,
                 return NULL;
         }
 
-        if (!(tsdev = kmalloc(sizeof(struct tsdev), GFP_KERNEL)))
+        if (!(tsdev = kzalloc(sizeof(struct tsdev), GFP_KERNEL)))
                 return NULL;
-        memset(tsdev, 0, sizeof(struct tsdev));
 
         INIT_LIST_HEAD(&tsdev->list);
         init_waitqueue_head(&tsdev->wait);
diff --git a/drivers/isdn/gigaset/Kconfig b/drivers/isdn/gigaset/Kconfig
index 53c4fb62ed85..5b203fe21dcd 100644
--- a/drivers/isdn/gigaset/Kconfig
+++ b/drivers/isdn/gigaset/Kconfig
@@ -3,8 +3,8 @@ menu "Siemens Gigaset"
 
 config ISDN_DRV_GIGASET
         tristate "Siemens Gigaset support (isdn)"
-        depends on ISDN_I4L && m
-#       depends on ISDN_I4L && MODULES
+        depends on ISDN_I4L
+        select CRC_CCITT
         help
           Say m here if you have a Gigaset or Sinus isdn device.
 
diff --git a/drivers/isdn/gigaset/asyncdata.c b/drivers/isdn/gigaset/asyncdata.c
index 171f8b703d61..ce3cd77094b3 100644
--- a/drivers/isdn/gigaset/asyncdata.c
+++ b/drivers/isdn/gigaset/asyncdata.c
@@ -3,7 +3,7 @@
  *
  * Copyright (c) 2005 by Tilman Schmidt <tilman@imap.cc>,
  *                       Hansjoerg Lipp <hjlipp@web.de>,
- *                       Stefan Eilers <Eilers.Stefan@epost.de>.
+ *                       Stefan Eilers.
  *
  * =====================================================================
  *      This program is free software; you can redistribute it and/or
@@ -11,10 +11,6 @@
  *      published by the Free Software Foundation; either version 2 of
  *      the License, or (at your option) any later version.
  * =====================================================================
- * ToDo: ...
- * =====================================================================
- * Version: $Id: asyncdata.c,v 1.2.2.7 2005/11/13 23:05:18 hjlipp Exp $
- * =====================================================================
  */
 
 #include "gigaset.h"
@@ -45,7 +41,7 @@ static inline int muststuff(unsigned char c)
  *      number of processed bytes
  */
 static inline int cmd_loop(unsigned char c, unsigned char *src, int numbytes,
-                           struct inbuf_t *inbuf)
+                           struct inbuf_t *inbuf)
 {
         struct cardstate *cs = inbuf->cs;
         unsigned cbytes      = cs->cbytes;
@@ -55,10 +51,11 @@ static inline int cmd_loop(unsigned char c, unsigned char *src, int numbytes,
         for (;;) {
                 cs->respdata[cbytes] = c;
                 if (c == 10 || c == 13) {
-                        dbg(DEBUG_TRANSCMD, "%s: End of Command (%d Bytes)",
-                            __func__, cbytes);
+                        gig_dbg(DEBUG_TRANSCMD, "%s: End of Command (%d Bytes)",
+                                __func__, cbytes);
                         cs->cbytes = cbytes;
-                        gigaset_handle_modem_response(cs); /* can change cs->dle */
+                        gigaset_handle_modem_response(cs); /* can change
+                                                              cs->dle */
                         cbytes = 0;
 
                         if (cs->dle &&
@@ -71,7 +68,7 @@ static inline int cmd_loop(unsigned char c, unsigned char *src, int numbytes,
                         if (cbytes < MAX_RESP_SIZE - 1)
                                 cbytes++;
                         else
-                                warn("response too large");
+                                dev_warn(cs->dev, "response too large\n");
                 }
 
                 if (!numbytes)
@@ -96,11 +93,12 @@ static inline int cmd_loop(unsigned char c, unsigned char *src, int numbytes,
  *      number of processed bytes
  */
 static inline int lock_loop(unsigned char *src, int numbytes,
-                            struct inbuf_t *inbuf)
+                            struct inbuf_t *inbuf)
 {
         struct cardstate *cs = inbuf->cs;
 
-        gigaset_dbg_buffer(DEBUG_LOCKCMD, "received response", numbytes, src, 0);
+        gigaset_dbg_buffer(DEBUG_LOCKCMD, "received response",
+                           numbytes, src);
         gigaset_if_receive(cs, src, numbytes);
 
         return numbytes;
@@ -115,24 +113,18 @@ static inline int lock_loop(unsigned char *src, int numbytes,
  *      numbytes (all bytes processed) on error --FIXME
  */
 static inline int hdlc_loop(unsigned char c, unsigned char *src, int numbytes,
-                            struct inbuf_t *inbuf)
+                            struct inbuf_t *inbuf)
 {
         struct cardstate *cs = inbuf->cs;
         struct bc_state *bcs = inbuf->bcs;
-        int inputstate;
-        __u16 fcs;
-        struct sk_buff *skb;
+        int inputstate = bcs->inputstate;
+        __u16 fcs = bcs->fcs;
+        struct sk_buff *skb = bcs->skb;
         unsigned char error;
         struct sk_buff *compskb;
         int startbytes = numbytes;
         int l;
 
-        IFNULLRETVAL(bcs, numbytes);
-        inputstate = bcs->inputstate;
-        fcs = bcs->fcs;
-        skb = bcs->skb;
-        IFNULLRETVAL(skb, numbytes);
-
         if (unlikely(inputstate & INS_byte_stuff)) {
                 inputstate &= ~INS_byte_stuff;
                 goto byte_stuff;
@@ -156,39 +148,37 @@ byte_stuff:
                         c ^= PPP_TRANS;
 #ifdef CONFIG_GIGASET_DEBUG
                         if (unlikely(!muststuff(c)))
-                                dbg(DEBUG_HDLC,
-                                    "byte stuffed: 0x%02x", c);
+                                gig_dbg(DEBUG_HDLC, "byte stuffed: 0x%02x", c);
 #endif
                 } else if (unlikely(c == PPP_FLAG)) {
                         if (unlikely(inputstate & INS_skip_frame)) {
                                 if (!(inputstate & INS_have_data)) { /* 7E 7E */
-                                        //dbg(DEBUG_HDLC, "(7e)7e------------------------");
 #ifdef CONFIG_GIGASET_DEBUG
                                         ++bcs->emptycount;
 #endif
                                 } else
-                                        dbg(DEBUG_HDLC,
+                                        gig_dbg(DEBUG_HDLC,
                                             "7e----------------------------");
 
                                 /* end of frame */
                                 error = 1;
                                 gigaset_rcv_error(NULL, cs, bcs);
                         } else if (!(inputstate & INS_have_data)) { /* 7E 7E */
-                                //dbg(DEBUG_HDLC, "(7e)7e------------------------");
 #ifdef CONFIG_GIGASET_DEBUG
                                 ++bcs->emptycount;
 #endif
                                 break;
                         } else {
-                                dbg(DEBUG_HDLC,
-                                    "7e----------------------------");
+                                gig_dbg(DEBUG_HDLC,
+                                        "7e----------------------------");
 
                                 /* end of frame */
                                 error = 0;
 
                                 if (unlikely(fcs != PPP_GOODFCS)) {
-                                        err("Packet checksum at %lu failed, "
-                                            "packet is corrupted (%u bytes)!",
+                                        dev_err(cs->dev,
+                                            "Packet checksum at %lu failed, "
+                                            "packet is corrupted (%u bytes)!\n",
                                             bcs->rcvbytes, skb->len);
                                         compskb = NULL;
                                         gigaset_rcv_error(compskb, cs, bcs);
@@ -202,9 +192,11 @@ byte_stuff:
                                                 skb = NULL;
                                                 inputstate |= INS_skip_frame;
                                                 if (l == 1) {
-                                                        err("invalid packet size (1)!");
+                                                        dev_err(cs->dev,
+                                                  "invalid packet size (1)!\n");
                                                         error = 1;
-                                                        gigaset_rcv_error(NULL, cs, bcs);
+                                                        gigaset_rcv_error(NULL,
+                                                                cs, bcs);
                                                 }
                                         }
                                         if (likely(!(error ||
@@ -227,7 +219,8 @@ byte_stuff:
                         } else if (likely((skb = dev_alloc_skb(SBUFSIZE + HW_HDR_LEN)) != NULL)) {
                                 skb_reserve(skb, HW_HDR_LEN);
                         } else {
-                                warn("could not allocate new skb");
+                                dev_warn(cs->dev,
+                                         "could not allocate new skb\n");
                                 inputstate |= INS_skip_frame;
                         }
 
@@ -235,7 +228,7 @@ byte_stuff:
 #ifdef CONFIG_GIGASET_DEBUG
                 } else if (unlikely(muststuff(c))) {
                         /* Should not happen. Possible after ZDLE=1<CR><LF>. */
-                        dbg(DEBUG_HDLC, "not byte stuffed: 0x%02x", c);
+                        gig_dbg(DEBUG_HDLC, "not byte stuffed: 0x%02x", c);
 #endif
                 }
 
@@ -243,8 +236,8 @@ byte_stuff:
 
 #ifdef CONFIG_GIGASET_DEBUG
                 if (unlikely(!(inputstate & INS_have_data))) {
-                        dbg(DEBUG_HDLC,
-                            "7e (%d x) ================", bcs->emptycount);
+                        gig_dbg(DEBUG_HDLC, "7e (%d x) ================",
+                                bcs->emptycount);
                         bcs->emptycount = 0;
                 }
 #endif
@@ -253,14 +246,13 @@ byte_stuff:
 
                 if (likely(!(inputstate & INS_skip_frame))) {
                         if (unlikely(skb->len == SBUFSIZE)) {
-                                warn("received packet too long");
+                                dev_warn(cs->dev, "received packet too long\n");
                                 dev_kfree_skb_any(skb);
                                 skb = NULL;
                                 inputstate |= INS_skip_frame;
                                 break;
                         }
-                        *gigaset_skb_put_quick(skb, 1) = c;
-                        /* *__skb_put (skb, 1) = c; */
+                        *__skb_put(skb, 1) = c;
                         fcs = crc_ccitt_byte(fcs, c);
                 }
 
@@ -289,19 +281,14 @@ byte_stuff:
  *      numbytes (all bytes processed) on error --FIXME
  */
 static inline int iraw_loop(unsigned char c, unsigned char *src, int numbytes,
-                            struct inbuf_t *inbuf)
+                            struct inbuf_t *inbuf)
 {
         struct cardstate *cs = inbuf->cs;
         struct bc_state *bcs = inbuf->bcs;
-        int inputstate;
-        struct sk_buff *skb;
+        int inputstate = bcs->inputstate;
+        struct sk_buff *skb = bcs->skb;
         int startbytes = numbytes;
 
-        IFNULLRETVAL(bcs, numbytes);
-        inputstate = bcs->inputstate;
-        skb = bcs->skb;
-        IFNULLRETVAL(skb, numbytes);
-
         for (;;) {
                 /* add character */
                 inputstate |= INS_have_data;
@@ -309,13 +296,13 @@ static inline int iraw_loop(unsigned char c, unsigned char *src, int numbytes,
                 if (likely(!(inputstate & INS_skip_frame))) {
                         if (unlikely(skb->len == SBUFSIZE)) {
                                 //FIXME just pass skb up and allocate a new one
-                                warn("received packet too long");
+                                dev_warn(cs->dev, "received packet too long\n");
                                 dev_kfree_skb_any(skb);
                                 skb = NULL;
                                 inputstate |= INS_skip_frame;
                                 break;
                         }
-                        *gigaset_skb_put_quick(skb, 1) = gigaset_invtab[c];
+                        *__skb_put(skb, 1) = gigaset_invtab[c];
                 }
 
                 if (unlikely(!numbytes))
@@ -343,7 +330,7 @@ static inline int iraw_loop(unsigned char c, unsigned char *src, int numbytes,
                                   != NULL)) {
                         skb_reserve(skb, HW_HDR_LEN);
                 } else {
-                        warn("could not allocate new skb");
+                        dev_warn(cs->dev, "could not allocate new skb\n");
                         inputstate |= INS_skip_frame;
                 }
         }
@@ -364,13 +351,13 @@ void gigaset_m10x_input(struct inbuf_t *inbuf)
 
         head = atomic_read(&inbuf->head);
         tail = atomic_read(&inbuf->tail);
-        dbg(DEBUG_INTR, "buffer state: %u -> %u", head, tail);
+        gig_dbg(DEBUG_INTR, "buffer state: %u -> %u", head, tail);
 
         if (head != tail) {
                 cs = inbuf->cs;
                 src = inbuf->data + head;
                 numbytes = (head > tail ? RBUFSIZE : tail) - head;
-                dbg(DEBUG_INTR, "processing %u bytes", numbytes);
+                gig_dbg(DEBUG_INTR, "processing %u bytes", numbytes);
 
                 while (numbytes) {
                         if (atomic_read(&cs->mstate) == MS_LOCKED) {
@@ -392,8 +379,7 @@ void gigaset_m10x_input(struct inbuf_t *inbuf)
 
                                 if (!(inbuf->inputstate & INS_DLE_char)) {
 
-                                        /* FIXME Einfach je nach Modus Funktionszeiger in cs setzen [hier+hdlc_loop]?  */
-                                        /* FIXME Spart folgendes "if" und ermoeglicht andere Protokolle */
+                                        /* FIXME use function pointers?  */
                                         if (inbuf->inputstate & INS_command)
                                                 procbytes = cmd_loop(c, src, numbytes, inbuf);
                                         else if (inbuf->bcs->proto2 == ISDN_PROTO_L2_HDLC)
@@ -403,13 +389,14 @@ void gigaset_m10x_input(struct inbuf_t *inbuf)
 
                                         src += procbytes;
                                         numbytes -= procbytes;
-                                } else {  /* DLE-char */
+                                } else {  /* DLE char */
                                         inbuf->inputstate &= ~INS_DLE_char;
                                         switch (c) {
                                         case 'X': /*begin of command*/
 #ifdef CONFIG_GIGASET_DEBUG
                                                 if (inbuf->inputstate & INS_command)
-                                                        err("received <DLE> 'X' in command mode");
+                                                        dev_err(cs->dev,
+                                        "received <DLE> 'X' in command mode\n");
 #endif
                                                 inbuf->inputstate |=
                                                         INS_command | INS_DLE_command;
@@ -417,7 +404,8 @@ void gigaset_m10x_input(struct inbuf_t *inbuf)
                                         case '.': /*end of command*/
 #ifdef CONFIG_GIGASET_DEBUG
                                                 if (!(inbuf->inputstate & INS_command))
-                                                        err("received <DLE> '.' in hdlc mode");
+                                                        dev_err(cs->dev,
+                                        "received <DLE> '.' in hdlc mode\n");
 #endif
                                                 inbuf->inputstate &= cs->dle ?
                                                         ~(INS_DLE_command|INS_command)
@@ -425,7 +413,9 @@ void gigaset_m10x_input(struct inbuf_t *inbuf)
                                                 break;
                                         //case DLE_FLAG: /*DLE_FLAG in data stream*/ /* schon oben behandelt! */
                                         default:
-                                                err("received 0x10 0x%02x!", (int) c);
+                                                dev_err(cs->dev,
+                                                      "received 0x10 0x%02x!\n",
+                                                        (int) c);
                                                 /* FIXME: reset driver?? */
                                         }
                                 }
@@ -444,7 +434,7 @@ nextbyte:
                         }
                 }
 
-                dbg(DEBUG_INTR, "setting head to %u", head);
+                gig_dbg(DEBUG_INTR, "setting head to %u", head);
                 atomic_set(&inbuf->head, head);
         }
 }
@@ -479,14 +469,13 @@ static struct sk_buff *HDLC_Encode(struct sk_buff *skb, int head, int tail)
                         stuf_cnt++;
                 fcs = crc_ccitt_byte(fcs, *cp++);
         }
-        fcs ^= 0xffff;                 /* complement */
+        fcs ^= 0xffff;                  /* complement */
 
         /* size of new buffer: original size + number of stuffing bytes
          * + 2 bytes FCS + 2 stuffing bytes for FCS (if needed) + 2 flag bytes
          */
         hdlc_skb = dev_alloc_skb(skb->len + stuf_cnt + 6 + tail + head);
         if (!hdlc_skb) {
-                err("unable to allocate memory for HDLC encoding!");
                 dev_kfree_skb(skb);
                 return NULL;
         }
@@ -508,7 +497,7 @@ static struct sk_buff *HDLC_Encode(struct sk_buff *skb, int head, int tail)
         }
 
         /* Finally add FCS (byte stuffed) and flag sequence */
-        c = (fcs & 0x00ff);      /* least significant byte first */
+        c = (fcs & 0x00ff);     /* least significant byte first */
         if (muststuff(c)) {
                 *(skb_put(hdlc_skb, 1)) = PPP_ESCAPE;
                 c ^= PPP_TRANS;
@@ -546,7 +535,6 @@ static struct sk_buff *iraw_encode(struct sk_buff *skb, int head, int tail)
         /* worst case: every byte must be stuffed */
         iraw_skb = dev_alloc_skb(2*skb->len + tail + head);
         if (!iraw_skb) {
-                err("unable to allocate memory for HDLC encoding!");
                 dev_kfree_skb(skb);
                 return NULL;
         }
@@ -577,21 +565,23 @@ static struct sk_buff *iraw_encode(struct sk_buff *skb, int head, int tail)
  */
 int gigaset_m10x_send_skb(struct bc_state *bcs, struct sk_buff *skb)
 {
-        unsigned len;
-
-        IFNULLRETVAL(bcs, -EFAULT);
-        IFNULLRETVAL(skb, -EFAULT);
-        len = skb->len;
+        unsigned len = skb->len;
+        unsigned long flags;
 
         if (bcs->proto2 == ISDN_PROTO_L2_HDLC)
                 skb = HDLC_Encode(skb, HW_HDR_LEN, 0);
         else
                 skb = iraw_encode(skb, HW_HDR_LEN, 0);
-        if (!skb)
+        if (!skb) {
+                err("unable to allocate memory for encoding!\n");
                 return -ENOMEM;
+        }
 
         skb_queue_tail(&bcs->squeue, skb);
-        tasklet_schedule(&bcs->cs->write_tasklet);
+        spin_lock_irqsave(&bcs->cs->lock, flags);
+        if (bcs->cs->connected)
+                tasklet_schedule(&bcs->cs->write_tasklet);
+        spin_unlock_irqrestore(&bcs->cs->lock, flags);
 
         return len;     /* ok so far */
 }
diff --git a/drivers/isdn/gigaset/bas-gigaset.c b/drivers/isdn/gigaset/bas-gigaset.c
index 31f0f07832bc..f86ed6af3aa2 100644
--- a/drivers/isdn/gigaset/bas-gigaset.c
+++ b/drivers/isdn/gigaset/bas-gigaset.c
@@ -3,7 +3,7 @@
  *
  * Copyright (c) 2001 by Hansjoerg Lipp <hjlipp@web.de>,
  *                       Tilman Schmidt <tilman@imap.cc>,
- *                       Stefan Eilers <Eilers.Stefan@epost.de>.
+ *                       Stefan Eilers.
  *
  * Based on usb-gigaset.c.
  *
@@ -13,10 +13,6 @@
  *      published by the Free Software Foundation; either version 2 of
  *      the License, or (at your option) any later version.
  * =====================================================================
- * ToDo: ...
- * =====================================================================
- * Version: $Id: bas-gigaset.c,v 1.52.4.19 2006/02/04 18:28:16 hjlipp Exp $
- * =====================================================================
  */
 
 #include "gigaset.h"
@@ -30,7 +26,7 @@
 #include <linux/moduleparam.h>
 
 /* Version Information */
-#define DRIVER_AUTHOR "Tilman Schmidt <tilman@imap.cc>, Hansjoerg Lipp <hjlipp@web.de>, Stefan Eilers <Eilers.Stefan@epost.de>"
+#define DRIVER_AUTHOR "Tilman Schmidt <tilman@imap.cc>, Hansjoerg Lipp <hjlipp@web.de>, Stefan Eilers"
 #define DRIVER_DESC "USB Driver for Gigaset 307x"
 
 
@@ -70,9 +66,6 @@ static struct usb_device_id gigaset_table [] = {
 
 MODULE_DEVICE_TABLE(usb, gigaset_table);
 
-/* Get a minor range for your devices from the usb maintainer */
-#define USB_SKEL_MINOR_BASE     200
-
 /*======================= local function prototypes =============================*/
 
 /* This function is called if a new device is connected to the USB port. It
@@ -88,25 +81,25 @@ static void gigaset_disconnect(struct usb_interface *interface);
 /*==============================================================================*/
 
 struct bas_cardstate {
-        struct usb_device       *udev;          /* USB device pointer */
-        struct usb_interface    *interface;     /* interface for this device */
+        struct usb_device       *udev;          /* USB device pointer */
+        struct usb_interface    *interface;     /* interface for this device */
         unsigned char           minor;          /* starting minor number */
 
-        struct urb              *urb_ctrl;      /* control pipe default URB */
+        struct urb              *urb_ctrl;      /* control pipe default URB */
         struct usb_ctrlrequest  dr_ctrl;
         struct timer_list       timer_ctrl;     /* control request timeout */
 
         struct timer_list       timer_atrdy;    /* AT command ready timeout */
-        struct urb              *urb_cmd_out;   /* for sending AT commands */
+        struct urb              *urb_cmd_out;   /* for sending AT commands */
         struct usb_ctrlrequest  dr_cmd_out;
         int                     retry_cmd_out;
 
-        struct urb              *urb_cmd_in;    /* for receiving AT replies */
+        struct urb              *urb_cmd_in;    /* for receiving AT replies */
         struct usb_ctrlrequest  dr_cmd_in;
         struct timer_list       timer_cmd_in;   /* receive request timeout */
-        unsigned char           *rcvbuf;        /* AT reply receive buffer */
+        unsigned char           *rcvbuf;        /* AT reply receive buffer */
 
-        struct urb              *urb_int_in;    /* URB for interrupt pipe */
+        struct urb              *urb_int_in;    /* URB for interrupt pipe */
         unsigned char           int_in_buf[3];
 
         spinlock_t              lock;           /* locks all following */
@@ -208,53 +201,54 @@ static inline char *usb_pipetype_str(int pipe)
  * write content of URB to syslog for debugging
  */
 static inline void dump_urb(enum debuglevel level, const char *tag,
-                            struct urb *urb)
+                            struct urb *urb)
 {
 #ifdef CONFIG_GIGASET_DEBUG
         int i;
-        IFNULLRET(tag);
-        dbg(level, "%s urb(0x%08lx)->{", tag, (unsigned long) urb);
+        gig_dbg(level, "%s urb(0x%08lx)->{", tag, (unsigned long) urb);
         if (urb) {
-                dbg(level,
-                    "  dev=0x%08lx, pipe=%s:EP%d/DV%d:%s, "
-                    "status=%d, hcpriv=0x%08lx, transfer_flags=0x%x,",
-                    (unsigned long) urb->dev,
-                    usb_pipetype_str(urb->pipe),
-                    usb_pipeendpoint(urb->pipe), usb_pipedevice(urb->pipe),
-                    usb_pipein(urb->pipe) ? "in" : "out",
-                    urb->status, (unsigned long) urb->hcpriv,
-                    urb->transfer_flags);
-                dbg(level,
-                    "  transfer_buffer=0x%08lx[%d], actual_length=%d, "
-                    "bandwidth=%d, setup_packet=0x%08lx,",
-                    (unsigned long) urb->transfer_buffer,
-                    urb->transfer_buffer_length, urb->actual_length,
-                    urb->bandwidth, (unsigned long) urb->setup_packet);
-                dbg(level,
-                    "  start_frame=%d, number_of_packets=%d, interval=%d, "
-                    "error_count=%d,",
-                    urb->start_frame, urb->number_of_packets, urb->interval,
-                    urb->error_count);
-                dbg(level,
-                    "  context=0x%08lx, complete=0x%08lx, iso_frame_desc[]={",
-                    (unsigned long) urb->context,
-                    (unsigned long) urb->complete);
+                gig_dbg(level,
+                        "  dev=0x%08lx, pipe=%s:EP%d/DV%d:%s, "
+                        "status=%d, hcpriv=0x%08lx, transfer_flags=0x%x,",
+                        (unsigned long) urb->dev,
+                        usb_pipetype_str(urb->pipe),
+                        usb_pipeendpoint(urb->pipe), usb_pipedevice(urb->pipe),
+                        usb_pipein(urb->pipe) ? "in" : "out",
+                        urb->status, (unsigned long) urb->hcpriv,
+                        urb->transfer_flags);
+                gig_dbg(level,
+                        "  transfer_buffer=0x%08lx[%d], actual_length=%d, "
+                        "bandwidth=%d, setup_packet=0x%08lx,",
+                        (unsigned long) urb->transfer_buffer,
+                        urb->transfer_buffer_length, urb->actual_length,
+                        urb->bandwidth, (unsigned long) urb->setup_packet);
+                gig_dbg(level,
+                        "  start_frame=%d, number_of_packets=%d, interval=%d, "
+                        "error_count=%d,",
+                        urb->start_frame, urb->number_of_packets, urb->interval,
+                        urb->error_count);
+                gig_dbg(level,
+                        "  context=0x%08lx, complete=0x%08lx, "
+                        "iso_frame_desc[]={",
+                        (unsigned long) urb->context,
+                        (unsigned long) urb->complete);
                 for (i = 0; i < urb->number_of_packets; i++) {
-                        struct usb_iso_packet_descriptor *pifd = &urb->iso_frame_desc[i];
-                        dbg(level,
-                            "    {offset=%u, length=%u, actual_length=%u, "
-                            "status=%u}",
-                            pifd->offset, pifd->length, pifd->actual_length,
-                            pifd->status);
+                        struct usb_iso_packet_descriptor *pifd
+                                = &urb->iso_frame_desc[i];
+                        gig_dbg(level,
+                                "    {offset=%u, length=%u, actual_length=%u, "
+                                "status=%u}",
+                                pifd->offset, pifd->length, pifd->actual_length,
+                                pifd->status);
                 }
         }
-        dbg(level, "}}");
+        gig_dbg(level, "}}");
 #endif
 }
 
 /* read/set modem control bits etc. (m10x only) */
 static int gigaset_set_modem_ctrl(struct cardstate *cs, unsigned old_state,
-                                  unsigned new_state)
+                                  unsigned new_state)
 {
         return -EINVAL;
 }
@@ -280,8 +274,8 @@ static inline void error_hangup(struct bc_state *bcs)
 {
         struct cardstate *cs = bcs->cs;
 
-        dbg(DEBUG_ANY,
-            "%s: scheduling HUP for channel %d", __func__, bcs->channel);
+        gig_dbg(DEBUG_ANY, "%s: scheduling HUP for channel %d",
+                __func__, bcs->channel);
 
         if (!gigaset_add_event(cs, &bcs->at_state, EV_HUP, NULL, 0, NULL)) {
                 //FIXME what should we do?
@@ -301,22 +295,19 @@ static inline void error_hangup(struct bc_state *bcs)
 static inline void error_reset(struct cardstate *cs)
 {
         //FIXME try to recover without bothering the user
-        err("unrecoverable error - please disconnect the Gigaset base to reset");
+        dev_err(cs->dev,
+            "unrecoverable error - please disconnect Gigaset base to reset\n");
 }
 
 /* check_pending
  * check for completion of pending control request
  * parameter:
- *      urb     USB request block of completed request
- *              urb->context = hardware specific controller state structure
+ *      ucs     hardware specific controller state structure
  */
 static void check_pending(struct bas_cardstate *ucs)
 {
         unsigned long flags;
 
-        IFNULLRET(ucs);
-        IFNULLRET(cardstate);
-
         spin_lock_irqsave(&ucs->lock, flags);
         switch (ucs->pending) {
         case 0:
@@ -336,8 +327,6 @@ static void check_pending(struct bas_cardstate *ucs)
         case HD_CLOSE_ATCHANNEL:
                 if (!(atomic_read(&ucs->basstate) & BS_ATOPEN))
                         ucs->pending = 0;
-                //wake_up_interruptible(cs->initwait);
-                //FIXME need own wait queue?
                 break;
         case HD_CLOSE_B1CHANNEL:
                 if (!(atomic_read(&ucs->basstate) & BS_B1OPEN))
@@ -354,7 +343,9 @@ static void check_pending(struct bas_cardstate *ucs)
          * are handled separately and should never end up here
          */
         default:
-                warn("unknown pending request 0x%02x cleared", ucs->pending);
+                dev_warn(&ucs->interface->dev,
+                         "unknown pending request 0x%02x cleared\n",
+                         ucs->pending);
                 ucs->pending = 0;
         }
 
@@ -372,27 +363,23 @@ static void check_pending(struct bas_cardstate *ucs)
 static void cmd_in_timeout(unsigned long data)
 {
         struct cardstate *cs = (struct cardstate *) data;
-        struct bas_cardstate *ucs;
+        struct bas_cardstate *ucs = cs->hw.bas;
         unsigned long flags;
 
-        IFNULLRET(cs);
-        ucs = cs->hw.bas;
-        IFNULLRET(ucs);
-
         spin_lock_irqsave(&cs->lock, flags);
-        if (!atomic_read(&cs->connected)) {
-                dbg(DEBUG_USBREQ, "%s: disconnected", __func__);
+        if (unlikely(!cs->connected)) {
+                gig_dbg(DEBUG_USBREQ, "%s: disconnected", __func__);
                 spin_unlock_irqrestore(&cs->lock, flags);
                 return;
         }
         if (!ucs->rcvbuf_size) {
-                dbg(DEBUG_USBREQ, "%s: no receive in progress", __func__);
+                gig_dbg(DEBUG_USBREQ, "%s: no receive in progress", __func__);
                 spin_unlock_irqrestore(&cs->lock, flags);
                 return;
         }
         spin_unlock_irqrestore(&cs->lock, flags);
 
-        err("timeout reading AT response");
+        dev_err(cs->dev, "timeout reading AT response\n");
         error_reset(cs);        //FIXME retry?
 }
 
@@ -412,18 +399,15 @@ static void read_ctrl_callback(struct urb *urb, struct pt_regs *regs);
  */
 static int atread_submit(struct cardstate *cs, int timeout)
 {
-        struct bas_cardstate *ucs;
+        struct bas_cardstate *ucs = cs->hw.bas;
         int ret;
 
-        IFNULLRETVAL(cs, -EINVAL);
-        ucs = cs->hw.bas;
-        IFNULLRETVAL(ucs, -EINVAL);
-        IFNULLRETVAL(ucs->urb_cmd_in, -EINVAL);
-
-        dbg(DEBUG_USBREQ, "-------> HD_READ_ATMESSAGE (%d)", ucs->rcvbuf_size);
+        gig_dbg(DEBUG_USBREQ, "-------> HD_READ_ATMESSAGE (%d)",
+                ucs->rcvbuf_size);
 
         if (ucs->urb_cmd_in->status == -EINPROGRESS) {
-                err("could not submit HD_READ_ATMESSAGE: URB busy");
+                dev_err(cs->dev,
+                        "could not submit HD_READ_ATMESSAGE: URB busy\n");
                 return -EBUSY;
         }
 
@@ -433,19 +417,19 @@ static int atread_submit(struct cardstate *cs, int timeout)
         ucs->dr_cmd_in.wIndex = 0;
         ucs->dr_cmd_in.wLength = cpu_to_le16(ucs->rcvbuf_size);
         usb_fill_control_urb(ucs->urb_cmd_in, ucs->udev,
-                             usb_rcvctrlpipe(ucs->udev, 0),
-                             (unsigned char*) & ucs->dr_cmd_in,
-                             ucs->rcvbuf, ucs->rcvbuf_size,
-                             read_ctrl_callback, cs->inbuf);
+                             usb_rcvctrlpipe(ucs->udev, 0),
+                             (unsigned char*) & ucs->dr_cmd_in,
+                             ucs->rcvbuf, ucs->rcvbuf_size,
+                             read_ctrl_callback, cs->inbuf);
 
         if ((ret = usb_submit_urb(ucs->urb_cmd_in, SLAB_ATOMIC)) != 0) {
-                err("could not submit HD_READ_ATMESSAGE: %s",
-                    get_usb_statmsg(ret));
+                dev_err(cs->dev, "could not submit HD_READ_ATMESSAGE: %s\n",
+                        get_usb_statmsg(ret));
                 return ret;
         }
 
         if (timeout > 0) {
-                dbg(DEBUG_USBREQ, "setting timeout of %d/10 secs", timeout);
+                gig_dbg(DEBUG_USBREQ, "setting timeout of %d/10 secs", timeout);
                 ucs->timer_cmd_in.expires = jiffies + timeout * HZ / 10;
                 ucs->timer_cmd_in.data = (unsigned long) cs;
                 ucs->timer_cmd_in.function = cmd_in_timeout;
@@ -483,25 +467,14 @@ inline static void update_basstate(struct bas_cardstate *ucs,
  */
 static void read_int_callback(struct urb *urb, struct pt_regs *regs)
 {
-        struct cardstate *cs;
-        struct bas_cardstate *ucs;
+        struct cardstate *cs = urb->context;
+        struct bas_cardstate *ucs = cs->hw.bas;
         struct bc_state *bcs;
         unsigned long flags;
         int status;
         unsigned l;
         int channel;
 
-        IFNULLRET(urb);
-        cs = (struct cardstate *) urb->context;
-        IFNULLRET(cs);
-        ucs = cs->hw.bas;
-        IFNULLRET(ucs);
-
-        if (unlikely(!atomic_read(&cs->connected))) {
-                warn("%s: disconnected", __func__);
-                return;
-        }
-
         switch (urb->status) {
         case 0:                 /* success */
                 break;
@@ -509,11 +482,12 @@ static void read_int_callback(struct urb *urb, struct pt_regs *regs)
         case -ECONNRESET:               /* canceled (async) */
         case -EINPROGRESS:              /* pending */
                 /* ignore silently */
-                dbg(DEBUG_USBREQ,
-                    "%s: %s", __func__, get_usb_statmsg(urb->status));
+                gig_dbg(DEBUG_USBREQ, "%s: %s",
+                        __func__, get_usb_statmsg(urb->status));
                 return;
         default:                /* severe trouble */
-                warn("interrupt read: %s", get_usb_statmsg(urb->status));
+                dev_warn(cs->dev, "interrupt read: %s\n",
+                         get_usb_statmsg(urb->status));
                 //FIXME corrective action? resubmission always ok?
                 goto resubmit;
         }
@@ -521,10 +495,9 @@ static void read_int_callback(struct urb *urb, struct pt_regs *regs)
         l = (unsigned) ucs->int_in_buf[1] +
             (((unsigned) ucs->int_in_buf[2]) << 8);
 
-        dbg(DEBUG_USBREQ,
-            "<-------%d: 0x%02x (%u [0x%02x 0x%02x])", urb->actual_length,
-            (int)ucs->int_in_buf[0], l,
-            (int)ucs->int_in_buf[1], (int)ucs->int_in_buf[2]);
+        gig_dbg(DEBUG_USBREQ, "<-------%d: 0x%02x (%u [0x%02x 0x%02x])",
+                urb->actual_length, (int)ucs->int_in_buf[0], l,
+                (int)ucs->int_in_buf[1], (int)ucs->int_in_buf[2]);
 
         channel = 0;
 
@@ -570,28 +543,30 @@ static void read_int_callback(struct urb *urb, struct pt_regs *regs)
         case HD_B1_FLOW_CONTROL:
                 bcs = cs->bcs + channel;
                 atomic_add((l - BAS_NORMFRAME) * BAS_CORRFRAMES,
-                           &bcs->hw.bas->corrbytes);
-                dbg(DEBUG_ISO,
-                    "Flow control (channel %d, sub %d): 0x%02x => %d",
-                    channel, bcs->hw.bas->numsub, l,
-                    atomic_read(&bcs->hw.bas->corrbytes));
+                           &bcs->hw.bas->corrbytes);
+                gig_dbg(DEBUG_ISO,
+                        "Flow control (channel %d, sub %d): 0x%02x => %d",
+                        channel, bcs->hw.bas->numsub, l,
+                        atomic_read(&bcs->hw.bas->corrbytes));
                 break;
 
         case HD_RECEIVEATDATA_ACK:      /* AT response ready to be received */
                 if (!l) {
-                        warn("HD_RECEIVEATDATA_ACK with length 0 ignored");
+                        dev_warn(cs->dev,
+                                "HD_RECEIVEATDATA_ACK with length 0 ignored\n");
                         break;
                 }
                 spin_lock_irqsave(&cs->lock, flags);
                 if (ucs->rcvbuf_size) {
                         spin_unlock_irqrestore(&cs->lock, flags);
-                        err("receive AT data overrun, %d bytes lost", l);
+                        dev_err(cs->dev,
+                                "receive AT data overrun, %d bytes lost\n", l);
                         error_reset(cs);        //FIXME reschedule
                         break;
                 }
                 if ((ucs->rcvbuf = kmalloc(l, GFP_ATOMIC)) == NULL) {
                         spin_unlock_irqrestore(&cs->lock, flags);
-                        err("%s: out of memory, %d bytes lost", __func__, l);
+                        dev_err(cs->dev, "out of memory, %d bytes lost\n", l);
                         error_reset(cs);        //FIXME reschedule
                         break;
                 }
@@ -607,25 +582,28 @@ static void read_int_callback(struct urb *urb, struct pt_regs *regs)
                 break;
 
         case HD_RESET_INTERRUPT_PIPE_ACK:
-                dbg(DEBUG_USBREQ, "HD_RESET_INTERRUPT_PIPE_ACK");
+                gig_dbg(DEBUG_USBREQ, "HD_RESET_INTERRUPT_PIPE_ACK");
                 break;
 
         case HD_SUSPEND_END:
-                dbg(DEBUG_USBREQ, "HD_SUSPEND_END");
+                gig_dbg(DEBUG_USBREQ, "HD_SUSPEND_END");
                 break;
 
         default:
-                warn("unknown Gigaset signal 0x%02x (%u) ignored",
-                     (int) ucs->int_in_buf[0], l);
+                dev_warn(cs->dev,
+                         "unknown Gigaset signal 0x%02x (%u) ignored\n",
+                         (int) ucs->int_in_buf[0], l);
         }
 
         check_pending(ucs);
 
 resubmit:
-        status = usb_submit_urb(urb, SLAB_ATOMIC);
+        spin_lock_irqsave(&cs->lock, flags);
+        status = cs->connected ? usb_submit_urb(urb, SLAB_ATOMIC) : -ENODEV;
+        spin_unlock_irqrestore(&cs->lock, flags);
         if (unlikely(status)) {
-                err("could not resubmit interrupt URB: %s",
-                    get_usb_statmsg(status));
+                dev_err(cs->dev, "could not resubmit interrupt URB: %s\n",
+                        get_usb_statmsg(status));
                 error_reset(cs);
         }
 }
@@ -639,30 +617,22 @@ resubmit:
  */
 static void read_ctrl_callback(struct urb *urb, struct pt_regs *regs)
 {
-        struct cardstate *cs;
-        struct bas_cardstate *ucs;
+        struct inbuf_t *inbuf = urb->context;
+        struct cardstate *cs = inbuf->cs;
+        struct bas_cardstate *ucs = cs->hw.bas;
+        int have_data = 0;
         unsigned numbytes;
         unsigned long flags;
-        struct inbuf_t *inbuf;
-        int have_data = 0;
-
-        IFNULLRET(urb);
-        inbuf = (struct inbuf_t *) urb->context;
-        IFNULLRET(inbuf);
-        cs = inbuf->cs;
-        IFNULLRET(cs);
-        ucs = cs->hw.bas;
-        IFNULLRET(ucs);
 
         spin_lock_irqsave(&cs->lock, flags);
-        if (!atomic_read(&cs->connected)) {
+        if (unlikely(!cs->connected)) {
                 warn("%s: disconnected", __func__);
                 spin_unlock_irqrestore(&cs->lock, flags);
                 return;
         }
 
         if (!ucs->rcvbuf_size) {
-                warn("%s: no receive in progress", __func__);
+                dev_warn(cs->dev, "%s: no receive in progress\n", __func__);
                 spin_unlock_irqrestore(&cs->lock, flags);
                 return;
         }
@@ -673,12 +643,14 @@ static void read_ctrl_callback(struct urb *urb, struct pt_regs *regs)
         case 0:                         /* normal completion */
                 numbytes = urb->actual_length;
                 if (unlikely(numbytes == 0)) {
-                        warn("control read: empty block received");
+                        dev_warn(cs->dev,
+                                 "control read: empty block received\n");
                         goto retry;
                 }
                 if (unlikely(numbytes != ucs->rcvbuf_size)) {
-                        warn("control read: received %d chars, expected %d",
-                             numbytes, ucs->rcvbuf_size);
+                        dev_warn(cs->dev,
+                               "control read: received %d chars, expected %d\n",
+                                 numbytes, ucs->rcvbuf_size);
                         if (numbytes > ucs->rcvbuf_size)
                                 numbytes = ucs->rcvbuf_size;
                 }
@@ -698,23 +670,26 @@ static void read_ctrl_callback(struct urb *urb, struct pt_regs *regs)
         case -ECONNRESET:               /* canceled (async) */
         case -EINPROGRESS:              /* pending */
                 /* no action necessary */
-                dbg(DEBUG_USBREQ,
-                    "%s: %s", __func__, get_usb_statmsg(urb->status));
+                gig_dbg(DEBUG_USBREQ, "%s: %s",
+                        __func__, get_usb_statmsg(urb->status));
                 break;
 
         default:                        /* severe trouble */
-                warn("control read: %s", get_usb_statmsg(urb->status));
+                dev_warn(cs->dev, "control read: %s\n",
+                         get_usb_statmsg(urb->status));
         retry:
                 if (ucs->retry_cmd_in++ < BAS_RETRY) {
-                        notice("control read: retry %d", ucs->retry_cmd_in);
+                        dev_notice(cs->dev, "control read: retry %d\n",
+                                   ucs->retry_cmd_in);
                         if (atread_submit(cs, BAS_TIMEOUT) >= 0) {
                                 /* resubmitted - bypass regular exit block */
                                 spin_unlock_irqrestore(&cs->lock, flags);
                                 return;
                         }
                 } else {
-                        err("control read: giving up after %d tries",
-                            ucs->retry_cmd_in);
+                        dev_err(cs->dev,
+                                "control read: giving up after %d tries\n",
+                                ucs->retry_cmd_in);
                 }
                 error_reset(cs);
         }
@@ -724,7 +699,7 @@ static void read_ctrl_callback(struct urb *urb, struct pt_regs *regs)
         ucs->rcvbuf_size = 0;
         spin_unlock_irqrestore(&cs->lock, flags);
         if (have_data) {
-                dbg(DEBUG_INTR, "%s-->BH", __func__);
+                gig_dbg(DEBUG_INTR, "%s-->BH", __func__);
                 gigaset_schedule_event(cs);
         }
 }
@@ -743,21 +718,16 @@ static void read_iso_callback(struct urb *urb, struct pt_regs *regs)
         unsigned long flags;
         int i, rc;
 
-        IFNULLRET(urb);
-        IFNULLRET(urb->context);
-        IFNULLRET(cardstate);
-
         /* status codes not worth bothering the tasklet with */
         if (unlikely(urb->status == -ENOENT || urb->status == -ECONNRESET ||
-                     urb->status == -EINPROGRESS)) {
-                dbg(DEBUG_ISO,
-                    "%s: %s", __func__, get_usb_statmsg(urb->status));
+                     urb->status == -EINPROGRESS)) {
+                gig_dbg(DEBUG_ISO, "%s: %s",
+                        __func__, get_usb_statmsg(urb->status));
                 return;
         }
 
-        bcs = (struct bc_state *) urb->context;
+        bcs = urb->context;
         ubc = bcs->hw.bas;
-        IFNULLRET(ubc);
 
         spin_lock_irqsave(&ubc->isoinlock, flags);
         if (likely(ubc->isoindone == NULL)) {
@@ -777,14 +747,17 @@ static void read_iso_callback(struct urb *urb, struct pt_regs *regs)
                         urb->iso_frame_desc[i].actual_length = 0;
                 }
                 if (likely(atomic_read(&ubc->running))) {
-                        urb->dev = bcs->cs->hw.bas->udev;       /* clobbered by USB subsystem */
+                        /* urb->dev is clobbered by USB subsystem */
+                        urb->dev = bcs->cs->hw.bas->udev;
                         urb->transfer_flags = URB_ISO_ASAP;
                         urb->number_of_packets = BAS_NUMFRAMES;
-                        dbg(DEBUG_ISO, "%s: isoc read overrun/resubmit", __func__);
+                        gig_dbg(DEBUG_ISO, "%s: isoc read overrun/resubmit",
+                                __func__);
                         rc = usb_submit_urb(urb, SLAB_ATOMIC);
                         if (unlikely(rc != 0)) {
-                                err("could not resubmit isochronous read URB: %s",
-                                    get_usb_statmsg(rc));
+                                dev_err(bcs->cs->dev,
+                                        "could not resubmit isochronous read "
+                                        "URB: %s\n", get_usb_statmsg(rc));
                                 dump_urb(DEBUG_ISO, "isoc read", urb);
                                 error_hangup(bcs);
                         }
@@ -806,23 +779,17 @@ static void write_iso_callback(struct urb *urb, struct pt_regs *regs)
         struct bas_bc_state *ubc;
         unsigned long flags;
 
-        IFNULLRET(urb);
-        IFNULLRET(urb->context);
-        IFNULLRET(cardstate);
-
         /* status codes not worth bothering the tasklet with */
         if (unlikely(urb->status == -ENOENT || urb->status == -ECONNRESET ||
-                     urb->status == -EINPROGRESS)) {
-                dbg(DEBUG_ISO,
-                    "%s: %s", __func__, get_usb_statmsg(urb->status));
+                     urb->status == -EINPROGRESS)) {
+                gig_dbg(DEBUG_ISO, "%s: %s",
+                        __func__, get_usb_statmsg(urb->status));
                 return;
         }
 
         /* pass URB context to tasklet */
-        ucx = (struct isow_urbctx_t *) urb->context;
-        IFNULLRET(ucx->bcs);
+        ucx = urb->context;
         ubc = ucx->bcs->hw.bas;
-        IFNULLRET(ubc);
 
         spin_lock_irqsave(&ubc->isooutlock, flags);
         ubc->isooutovfl = ubc->isooutdone;
@@ -841,15 +808,11 @@ static void write_iso_callback(struct urb *urb, struct pt_regs *regs)
  */
 static int starturbs(struct bc_state *bcs)
 {
+        struct bas_bc_state *ubc = bcs->hw.bas;
         struct urb *urb;
-        struct bas_bc_state *ubc;
         int j, k;
         int rc;
 
-        IFNULLRETVAL(bcs, -EFAULT);
-        ubc = bcs->hw.bas;
-        IFNULLRETVAL(ubc, -EFAULT);
-
         /* initialize L2 reception */
         if (bcs->proto2 == ISDN_PROTO_L2_HDLC)
                 bcs->inputstate |= INS_flag_hunt;
@@ -859,7 +822,7 @@ static int starturbs(struct bc_state *bcs)
         for (k = 0; k < BAS_INURBS; k++) {
                 urb = ubc->isoinurbs[k];
                 if (!urb) {
-                        err("isoinurbs[%d]==NULL", k);
+                        dev_err(bcs->cs->dev, "isoinurbs[%d]==NULL\n", k);
                         rc = -EFAULT;
                         goto error;
                 }
@@ -882,8 +845,9 @@ static int starturbs(struct bc_state *bcs)
 
                 dump_urb(DEBUG_ISO, "Initial isoc read", urb);
                 if ((rc = usb_submit_urb(urb, SLAB_ATOMIC)) != 0) {
-                        err("could not submit isochronous read URB %d: %s",
-                            k, get_usb_statmsg(rc));
+                        dev_err(bcs->cs->dev,
+                               "could not submit isochronous read URB %d: %s\n",
+                                k, get_usb_statmsg(rc));
                         goto error;
                 }
         }
@@ -895,7 +859,7 @@ static int starturbs(struct bc_state *bcs)
         for (k = 0; k < BAS_OUTURBS; ++k) {
                 urb = ubc->isoouturbs[k].urb;
                 if (!urb) {
-                        err("isoouturbs[%d].urb==NULL", k);
+                        dev_err(bcs->cs->dev, "isoouturbs[%d].urb==NULL\n", k);
                         rc = -EFAULT;
                         goto error;
                 }
@@ -922,8 +886,9 @@ static int starturbs(struct bc_state *bcs)
                 dump_urb(DEBUG_ISO, "Initial isoc write", urb);
                 rc = usb_submit_urb(ubc->isoouturbs[k].urb, SLAB_ATOMIC);
                 if (rc != 0) {
-                        err("could not submit isochronous write URB %d: %s",
-                            k, get_usb_statmsg(rc));
+                        dev_err(bcs->cs->dev,
+                              "could not submit isochronous write URB %d: %s\n",
+                                k, get_usb_statmsg(rc));
                         goto error;
                 }
         }
@@ -946,20 +911,20 @@ static void stopurbs(struct bas_bc_state *ubc)
 {
         int k, rc;
 
-        IFNULLRET(ubc);
-
         atomic_set(&ubc->running, 0);
 
         for (k = 0; k < BAS_INURBS; ++k) {
                 rc = usb_unlink_urb(ubc->isoinurbs[k]);
-                dbg(DEBUG_ISO, "%s: isoc input URB %d unlinked, result = %d",
-                    __func__, k, rc);
+                gig_dbg(DEBUG_ISO,
+                        "%s: isoc input URB %d unlinked, result = %d",
+                        __func__, k, rc);
         }
 
         for (k = 0; k < BAS_OUTURBS; ++k) {
                 rc = usb_unlink_urb(ubc->isoouturbs[k].urb);
-                dbg(DEBUG_ISO, "%s: isoc output URB %d unlinked, result = %d",
-                    __func__, k, rc);
+                gig_dbg(DEBUG_ISO,
+                        "%s: isoc output URB %d unlinked, result = %d",
+                        __func__, k, rc);
         }
 }
 
@@ -977,19 +942,14 @@ static void stopurbs(struct bas_bc_state *ubc)
  */
 static int submit_iso_write_urb(struct isow_urbctx_t *ucx)
 {
-        struct urb *urb;
-        struct bas_bc_state *ubc;
+        struct urb *urb = ucx->urb;
+        struct bas_bc_state *ubc = ucx->bcs->hw.bas;
         struct usb_iso_packet_descriptor *ifd;
         int corrbytes, nframe, rc;
+        unsigned long flags;
 
-        IFNULLRETVAL(ucx, -EFAULT);
-        urb = ucx->urb;
-        IFNULLRETVAL(urb, -EFAULT);
-        IFNULLRETVAL(ucx->bcs, -EFAULT);
-        ubc = ucx->bcs->hw.bas;
-        IFNULLRETVAL(ubc, -EFAULT);
-
-        urb->dev = ucx->bcs->cs->hw.bas->udev;  /* clobbered by USB subsystem */
+        /* urb->dev is clobbered by USB subsystem */
+        urb->dev = ucx->bcs->cs->hw.bas->udev;
         urb->transfer_flags = URB_ISO_ASAP;
         urb->transfer_buffer = ubc->isooutbuf->data;
         urb->transfer_buffer_length = sizeof(ubc->isooutbuf->data);
@@ -1000,7 +960,8 @@ static int submit_iso_write_urb(struct isow_urbctx_t *ucx)
                 /* compute frame length according to flow control */
                 ifd->length = BAS_NORMFRAME;
                 if ((corrbytes = atomic_read(&ubc->corrbytes)) != 0) {
-                        dbg(DEBUG_ISO, "%s: corrbytes=%d", __func__, corrbytes);
+                        gig_dbg(DEBUG_ISO, "%s: corrbytes=%d",
+                                __func__, corrbytes);
                         if (corrbytes > BAS_HIGHFRAME - BAS_NORMFRAME)
                                 corrbytes = BAS_HIGHFRAME - BAS_NORMFRAME;
                         else if (corrbytes < BAS_LOWFRAME - BAS_NORMFRAME)
@@ -1008,18 +969,21 @@ static int submit_iso_write_urb(struct isow_urbctx_t *ucx)
                         ifd->length += corrbytes;
                         atomic_add(-corrbytes, &ubc->corrbytes);
                 }
-                //dbg(DEBUG_ISO, "%s: frame %d length=%d", __func__, nframe, ifd->length);
 
                 /* retrieve block of data to send */
-                ifd->offset = gigaset_isowbuf_getbytes(ubc->isooutbuf, ifd->length);
+                ifd->offset = gigaset_isowbuf_getbytes(ubc->isooutbuf,
+                                                       ifd->length);
                 if (ifd->offset < 0) {
                         if (ifd->offset == -EBUSY) {
-                                dbg(DEBUG_ISO, "%s: buffer busy at frame %d",
-                                    __func__, nframe);
-                                /* tasklet will be restarted from gigaset_send_skb() */
+                                gig_dbg(DEBUG_ISO,
+                                        "%s: buffer busy at frame %d",
+                                        __func__, nframe);
+                                /* tasklet will be restarted from
+                                   gigaset_send_skb() */
                         } else {
-                                err("%s: buffer error %d at frame %d",
-                                    __func__, ifd->offset, nframe);
+                                dev_err(ucx->bcs->cs->dev,
+                                        "%s: buffer error %d at frame %d\n",
+                                        __func__, ifd->offset, nframe);
                                 return ifd->offset;
                         }
                         break;
@@ -1029,9 +993,14 @@ static int submit_iso_write_urb(struct isow_urbctx_t *ucx)
                 ifd->actual_length = 0;
         }
         if ((urb->number_of_packets = nframe) > 0) {
-                if ((rc = usb_submit_urb(urb, SLAB_ATOMIC)) != 0) {
-                        err("could not submit isochronous write URB: %s",
-                            get_usb_statmsg(rc));
+                spin_lock_irqsave(&ucx->bcs->cs->lock, flags);
+                rc = ucx->bcs->cs->connected ? usb_submit_urb(urb, SLAB_ATOMIC) : -ENODEV;
+                spin_unlock_irqrestore(&ucx->bcs->cs->lock, flags);
+
+                if (rc) {
+                        dev_err(ucx->bcs->cs->dev,
+                                "could not submit isochronous write URB: %s\n",
+                                get_usb_statmsg(rc));
                         dump_urb(DEBUG_ISO, "isoc write", urb);
                         return rc;
                 }
@@ -1048,9 +1017,9 @@ static int submit_iso_write_urb(struct isow_urbctx_t *ucx)
  */
 static void write_iso_tasklet(unsigned long data)
 {
-        struct bc_state *bcs;
-        struct bas_bc_state *ubc;
-        struct cardstate *cs;
+        struct bc_state *bcs = (struct bc_state *) data;
+        struct bas_bc_state *ubc = bcs->hw.bas;
+        struct cardstate *cs = bcs->cs;
         struct isow_urbctx_t *done, *next, *ovfl;
         struct urb *urb;
         struct usb_iso_packet_descriptor *ifd;
@@ -1060,22 +1029,10 @@ static void write_iso_tasklet(unsigned long data)
         struct sk_buff *skb;
         int len;
 
-        bcs = (struct bc_state *) data;
-        IFNULLRET(bcs);
-        ubc = bcs->hw.bas;
-        IFNULLRET(ubc);
-        cs = bcs->cs;
-        IFNULLRET(cs);
-
         /* loop while completed URBs arrive in time */
         for (;;) {
-                if (unlikely(!atomic_read(&cs->connected))) {
-                        warn("%s: disconnected", __func__);
-                        return;
-                }
-
                 if (unlikely(!(atomic_read(&ubc->running)))) {
-                        dbg(DEBUG_ISO, "%s: not running", __func__);
+                        gig_dbg(DEBUG_ISO, "%s: not running", __func__);
                         return;
                 }
 
@@ -1087,7 +1044,7 @@ static void write_iso_tasklet(unsigned long data)
                 ubc->isooutovfl = NULL;
                 spin_unlock_irqrestore(&ubc->isooutlock, flags);
                 if (ovfl) {
-                        err("isochronous write buffer underrun - buy a faster machine :-)");
+                        dev_err(cs->dev, "isochronous write buffer underrun\n");
                         error_hangup(bcs);
                         break;
                 }
@@ -1110,7 +1067,8 @@ static void write_iso_tasklet(unsigned long data)
                                 spin_unlock_irqrestore(&ubc->isooutlock, flags);
                                 if (next) {
                                         /* couldn't put it back */
-                                        err("losing isochronous write URB");
+                                        dev_err(cs->dev,
+                                              "losing isochronous write URB\n");
                                         error_hangup(bcs);
                                 }
                         }
@@ -1123,22 +1081,25 @@ static void write_iso_tasklet(unsigned long data)
                         break;
                 case -EXDEV:                    /* inspect individual frames */
                         /* assumptions (for lack of documentation):
-                         * - actual_length bytes of the frame in error are successfully sent
+                         * - actual_length bytes of the frame in error are
+                         *   successfully sent
                          * - all following frames are not sent at all
                          */
-                        dbg(DEBUG_ISO, "%s: URB partially completed", __func__);
+                        gig_dbg(DEBUG_ISO, "%s: URB partially completed",
+                                __func__);
                         offset = done->limit;   /* just in case */
                         for (i = 0; i < BAS_NUMFRAMES; i++) {
                                 ifd = &urb->iso_frame_desc[i];
                                 if (ifd->status ||
                                     ifd->actual_length != ifd->length) {
-                                        warn("isochronous write: frame %d: %s, "
-                                             "only %d of %d bytes sent",
+                                        dev_warn(cs->dev,
+                                             "isochronous write: frame %d: %s, "
+                                             "only %d of %d bytes sent\n",
                                              i, get_usb_statmsg(ifd->status),
                                              ifd->actual_length, ifd->length);
                                         offset = (ifd->offset +
-                                                  ifd->actual_length)
-                                                 % BAS_OUTBUFSIZE;
+                                                  ifd->actual_length)
+                                                 % BAS_OUTBUFSIZE;
                                         break;
                                 }
                         }
@@ -1148,25 +1109,26 @@ static void write_iso_tasklet(unsigned long data)
                                 ifd = &urb->iso_frame_desc[i];
                                 if (ifd->status != -EINPROGRESS
                                     || ifd->actual_length != 0) {
-                                        warn("isochronous write: frame %d: %s, "
-                                             "%d of %d bytes sent",
+                                        dev_warn(cs->dev,
+                                             "isochronous write: frame %d: %s, "
+                                             "%d of %d bytes sent\n",
                                              i, get_usb_statmsg(ifd->status),
                                              ifd->actual_length, ifd->length);
                                         offset = (ifd->offset +
-                                                  ifd->actual_length)
-                                                 % BAS_OUTBUFSIZE;
+                                                  ifd->actual_length)
+                                                 % BAS_OUTBUFSIZE;
                                         break;
                                 }
                         }
 #endif
                         break;
-                case -EPIPE:                    //FIXME is this the code for "underrun"?
-                        err("isochronous write stalled");
+                case -EPIPE:            //FIXME is this the code for "underrun"?
+                        dev_err(cs->dev, "isochronous write stalled\n");
                         error_hangup(bcs);
                         break;
                 default:                        /* severe trouble */
-                        warn("isochronous write: %s",
-                             get_usb_statmsg(urb->status));
+                        dev_warn(cs->dev, "isochronous write: %s\n",
+                                 get_usb_statmsg(urb->status));
                 }
 
                 /* mark the write buffer area covered by this URB as free */
@@ -1194,8 +1156,8 @@ static void write_iso_tasklet(unsigned long data)
                 if (gigaset_isoc_buildframe(bcs, skb->data, len) == -EAGAIN) {
                         /* insufficient buffer space, push back onto queue */
                         skb_queue_head(&bcs->squeue, skb);
-                        dbg(DEBUG_ISO, "%s: skb requeued, qlen=%d",
-                            __func__, skb_queue_len(&bcs->squeue));
+                        gig_dbg(DEBUG_ISO, "%s: skb requeued, qlen=%d",
+                                __func__, skb_queue_len(&bcs->squeue));
                         break;
                 }
                 skb_pull(skb, len);
@@ -1215,28 +1177,16 @@ static void write_iso_tasklet(unsigned long data)
  */
 static void read_iso_tasklet(unsigned long data)
 {
-        struct bc_state *bcs;
-        struct bas_bc_state *ubc;
-        struct cardstate *cs;
+        struct bc_state *bcs = (struct bc_state *) data;
+        struct bas_bc_state *ubc = bcs->hw.bas;
+        struct cardstate *cs = bcs->cs;
         struct urb *urb;
         char *rcvbuf;
         unsigned long flags;
         int totleft, numbytes, offset, frame, rc;
 
-        bcs = (struct bc_state *) data;
-        IFNULLRET(bcs);
-        ubc = bcs->hw.bas;
-        IFNULLRET(ubc);
-        cs = bcs->cs;
-        IFNULLRET(cs);
-
         /* loop while more completed URBs arrive in the meantime */
         for (;;) {
-                if (!atomic_read(&cs->connected)) {
-                        warn("%s: disconnected", __func__);
-                        return;
-                }
-
                 /* retrieve URB */
                 spin_lock_irqsave(&ubc->isoinlock, flags);
                 if (!(urb = ubc->isoindone)) {
@@ -1245,38 +1195,45 @@ static void read_iso_tasklet(unsigned long data)
                 }
                 ubc->isoindone = NULL;
                 if (unlikely(ubc->loststatus != -EINPROGRESS)) {
-                        warn("isochronous read overrun, dropped URB with status: %s, %d bytes lost",
-                             get_usb_statmsg(ubc->loststatus), ubc->isoinlost);
+                        dev_warn(cs->dev,
+                                 "isochronous read overrun, "
+                                 "dropped URB with status: %s, %d bytes lost\n",
+                                 get_usb_statmsg(ubc->loststatus),
+                                 ubc->isoinlost);
                         ubc->loststatus = -EINPROGRESS;
                 }
                 spin_unlock_irqrestore(&ubc->isoinlock, flags);
 
                 if (unlikely(!(atomic_read(&ubc->running)))) {
-                        dbg(DEBUG_ISO, "%s: channel not running, dropped URB with status: %s",
-                            __func__, get_usb_statmsg(urb->status));
+                        gig_dbg(DEBUG_ISO,
+                                "%s: channel not running, "
+                                "dropped URB with status: %s",
+                                __func__, get_usb_statmsg(urb->status));
                         return;
                 }
 
                 switch (urb->status) {
                 case 0:                         /* normal completion */
                         break;
-                case -EXDEV:                    /* inspect individual frames (we do that anyway) */
-                        dbg(DEBUG_ISO, "%s: URB partially completed", __func__);
+                case -EXDEV:                    /* inspect individual frames
+                                                   (we do that anyway) */
+                        gig_dbg(DEBUG_ISO, "%s: URB partially completed",
+                                __func__);
                         break;
                 case -ENOENT:
                 case -ECONNRESET:
-                        dbg(DEBUG_ISO, "%s: URB canceled", __func__);
+                        gig_dbg(DEBUG_ISO, "%s: URB canceled", __func__);
                         continue;               /* -> skip */
                 case -EINPROGRESS:              /* huh? */
-                        dbg(DEBUG_ISO, "%s: URB still pending", __func__);
+                        gig_dbg(DEBUG_ISO, "%s: URB still pending", __func__);
                         continue;               /* -> skip */
                 case -EPIPE:
-                        err("isochronous read stalled");
+                        dev_err(cs->dev, "isochronous read stalled\n");
                         error_hangup(bcs);
                         continue;               /* -> skip */
                 default:                        /* severe trouble */
-                        warn("isochronous read: %s",
-                             get_usb_statmsg(urb->status));
+                        dev_warn(cs->dev, "isochronous read: %s\n",
+                                 get_usb_statmsg(urb->status));
                         goto error;
                 }
 
@@ -1284,33 +1241,44 @@ static void read_iso_tasklet(unsigned long data)
                 totleft = urb->actual_length;
                 for (frame = 0; totleft > 0 && frame < BAS_NUMFRAMES; frame++) {
                         if (unlikely(urb->iso_frame_desc[frame].status)) {
-                                warn("isochronous read: frame %d: %s",
-                                     frame, get_usb_statmsg(urb->iso_frame_desc[frame].status));
+                                dev_warn(cs->dev,
+                                         "isochronous read: frame %d: %s\n",
+                                         frame,
+                                         get_usb_statmsg(
+                                            urb->iso_frame_desc[frame].status));
                                 break;
                         }
                         numbytes = urb->iso_frame_desc[frame].actual_length;
                         if (unlikely(numbytes > BAS_MAXFRAME)) {
-                                warn("isochronous read: frame %d: numbytes (%d) > BAS_MAXFRAME",
-                                     frame, numbytes);
+                                dev_warn(cs->dev,
+                                         "isochronous read: frame %d: "
+                                         "numbytes (%d) > BAS_MAXFRAME\n",
+                                         frame, numbytes);
                                 break;
                         }
                         if (unlikely(numbytes > totleft)) {
-                                warn("isochronous read: frame %d: numbytes (%d) > totleft (%d)",
-                                     frame, numbytes, totleft);
+                                dev_warn(cs->dev,
+                                         "isochronous read: frame %d: "
+                                         "numbytes (%d) > totleft (%d)\n",
+                                         frame, numbytes, totleft);
                                 break;
                         }
                         offset = urb->iso_frame_desc[frame].offset;
                         if (unlikely(offset + numbytes > BAS_INBUFSIZE)) {
-                                warn("isochronous read: frame %d: offset (%d) + numbytes (%d) > BAS_INBUFSIZE",
-                                     frame, offset, numbytes);
+                                dev_warn(cs->dev,
+                                         "isochronous read: frame %d: "
+                                         "offset (%d) + numbytes (%d) "
+                                         "> BAS_INBUFSIZE\n",
+                                         frame, offset, numbytes);
                                 break;
                         }
                         gigaset_isoc_receive(rcvbuf + offset, numbytes, bcs);
                         totleft -= numbytes;
                 }
                 if (unlikely(totleft > 0))
-                        warn("isochronous read: %d data bytes missing",
-                             totleft);
+                        dev_warn(cs->dev,
+                                 "isochronous read: %d data bytes missing\n",
+                                 totleft);
 
         error:
                 /* URB processed, resubmit */
@@ -1318,12 +1286,17 @@ static void read_iso_tasklet(unsigned long data)
                         urb->iso_frame_desc[frame].status = 0;
                         urb->iso_frame_desc[frame].actual_length = 0;
                 }
-                urb->dev = bcs->cs->hw.bas->udev;       /* clobbered by USB subsystem */
+                /* urb->dev is clobbered by USB subsystem */
+                urb->dev = bcs->cs->hw.bas->udev;
                 urb->transfer_flags = URB_ISO_ASAP;
                 urb->number_of_packets = BAS_NUMFRAMES;
-                if ((rc = usb_submit_urb(urb, SLAB_ATOMIC)) != 0) {
-                        err("could not resubmit isochronous read URB: %s",
-                            get_usb_statmsg(rc));
+                spin_lock_irqsave(&cs->lock, flags);
+                rc = cs->connected ? usb_submit_urb(urb, SLAB_ATOMIC) : -ENODEV;
+                spin_unlock_irqrestore(&cs->lock, flags);
+                if (rc) {
+                        dev_err(cs->dev,
+                                "could not resubmit isochronous read URB: %s\n",
+                                get_usb_statmsg(rc));
                         dump_urb(DEBUG_ISO, "resubmit iso read", urb);
                         error_hangup(bcs);
                 }
@@ -1341,15 +1314,10 @@ static void read_iso_tasklet(unsigned long data)
 static void req_timeout(unsigned long data)
 {
         struct bc_state *bcs = (struct bc_state *) data;
-        struct bas_cardstate *ucs;
+        struct bas_cardstate *ucs = bcs->cs->hw.bas;
         int pending;
         unsigned long flags;
 
-        IFNULLRET(bcs);
-        IFNULLRET(bcs->cs);
-        ucs = bcs->cs->hw.bas;
-        IFNULLRET(ucs);
-
         check_pending(ucs);
 
         spin_lock_irqsave(&ucs->lock, flags);
@@ -1359,33 +1327,34 @@ static void req_timeout(unsigned long data)
 
         switch (pending) {
         case 0:                                 /* no pending request */
-                dbg(DEBUG_USBREQ, "%s: no request pending", __func__);
+                gig_dbg(DEBUG_USBREQ, "%s: no request pending", __func__);
                 break;
 
         case HD_OPEN_ATCHANNEL:
-                err("timeout opening AT channel");
+                dev_err(bcs->cs->dev, "timeout opening AT channel\n");
                 error_reset(bcs->cs);
                 break;
 
         case HD_OPEN_B2CHANNEL:
         case HD_OPEN_B1CHANNEL:
-                err("timeout opening channel %d", bcs->channel + 1);
+                dev_err(bcs->cs->dev, "timeout opening channel %d\n",
+                        bcs->channel + 1);
                 error_hangup(bcs);
                 break;
 
         case HD_CLOSE_ATCHANNEL:
-                err("timeout closing AT channel");
-                //wake_up_interruptible(cs->initwait);
-                //FIXME need own wait queue?
+                dev_err(bcs->cs->dev, "timeout closing AT channel\n");
                 break;
 
         case HD_CLOSE_B2CHANNEL:
         case HD_CLOSE_B1CHANNEL:
-                err("timeout closing channel %d", bcs->channel + 1);
+                dev_err(bcs->cs->dev, "timeout closing channel %d\n",
+                        bcs->channel + 1);
                 break;
 
         default:
-                warn("request 0x%02x timed out, clearing", pending);
+                dev_warn(bcs->cs->dev, "request 0x%02x timed out, clearing\n",
+                         pending);
         }
 }
 
@@ -1398,18 +1367,14 @@ static void req_timeout(unsigned long data)
  */
 static void write_ctrl_callback(struct urb *urb, struct pt_regs *regs)
 {
-        struct bas_cardstate *ucs;
+        struct bas_cardstate *ucs = urb->context;
         unsigned long flags;
 
-        IFNULLRET(urb);
-        IFNULLRET(urb->context);
-        IFNULLRET(cardstate);
-
-        ucs = (struct bas_cardstate *) urb->context;
         spin_lock_irqsave(&ucs->lock, flags);
         if (urb->status && ucs->pending) {
-                err("control request 0x%02x failed: %s",
-                    ucs->pending, get_usb_statmsg(urb->status));
+                dev_err(&ucs->interface->dev,
+                        "control request 0x%02x failed: %s\n",
+                        ucs->pending, get_usb_statmsg(urb->status));
                 del_timer(&ucs->timer_ctrl);
                 ucs->pending = 0;
         }
@@ -1438,28 +1403,25 @@ static void write_ctrl_callback(struct urb *urb, struct pt_regs *regs)
  */
 static int req_submit(struct bc_state *bcs, int req, int val, int timeout)
 {
-        struct bas_cardstate *ucs;
+        struct bas_cardstate *ucs = bcs->cs->hw.bas;
         int ret;
         unsigned long flags;
 
-        IFNULLRETVAL(bcs, -EINVAL);
-        IFNULLRETVAL(bcs->cs, -EINVAL);
-        ucs = bcs->cs->hw.bas;
-        IFNULLRETVAL(ucs, -EINVAL);
-        IFNULLRETVAL(ucs->urb_ctrl, -EINVAL);
-
-        dbg(DEBUG_USBREQ, "-------> 0x%02x (%d)", req, val);
+        gig_dbg(DEBUG_USBREQ, "-------> 0x%02x (%d)", req, val);
 
         spin_lock_irqsave(&ucs->lock, flags);
         if (ucs->pending) {
                 spin_unlock_irqrestore(&ucs->lock, flags);
-                err("submission of request 0x%02x failed: request 0x%02x still pending",
-                    req, ucs->pending);
+                dev_err(bcs->cs->dev,
+                        "submission of request 0x%02x failed: "
+                        "request 0x%02x still pending\n",
+                        req, ucs->pending);
                 return -EBUSY;
         }
         if (ucs->urb_ctrl->status == -EINPROGRESS) {
                 spin_unlock_irqrestore(&ucs->lock, flags);
-                err("could not submit request 0x%02x: URB busy", req);
+                dev_err(bcs->cs->dev,
+                        "could not submit request 0x%02x: URB busy\n", req);
                 return -EBUSY;
         }
 
@@ -1469,19 +1431,19 @@ static int req_submit(struct bc_state *bcs, int req, int val, int timeout)
         ucs->dr_ctrl.wIndex = 0;
         ucs->dr_ctrl.wLength = 0;
         usb_fill_control_urb(ucs->urb_ctrl, ucs->udev,
-                             usb_sndctrlpipe(ucs->udev, 0),
-                             (unsigned char*) &ucs->dr_ctrl, NULL, 0,
-                             write_ctrl_callback, ucs);
+                             usb_sndctrlpipe(ucs->udev, 0),
+                             (unsigned char*) &ucs->dr_ctrl, NULL, 0,
+                             write_ctrl_callback, ucs);
         if ((ret = usb_submit_urb(ucs->urb_ctrl, SLAB_ATOMIC)) != 0) {
-                err("could not submit request 0x%02x: %s",
-                    req, get_usb_statmsg(ret));
+                dev_err(bcs->cs->dev, "could not submit request 0x%02x: %s\n",
+                        req, get_usb_statmsg(ret));
                 spin_unlock_irqrestore(&ucs->lock, flags);
                 return ret;
         }
         ucs->pending = req;
 
         if (timeout > 0) {
-                dbg(DEBUG_USBREQ, "setting timeout of %d/10 secs", timeout);
+                gig_dbg(DEBUG_USBREQ, "setting timeout of %d/10 secs", timeout);
                 ucs->timer_ctrl.expires = jiffies + timeout * HZ / 10;
                 ucs->timer_ctrl.data = (unsigned long) bcs;
                 ucs->timer_ctrl.function = req_timeout;
@@ -1504,19 +1466,18 @@ static int gigaset_init_bchannel(struct bc_state *bcs)
 {
         int req, ret;
 
-        IFNULLRETVAL(bcs, -EINVAL);
-
         if ((ret = starturbs(bcs)) < 0) {
-                err("could not start isochronous I/O for channel %d",
-                    bcs->channel + 1);
+                dev_err(bcs->cs->dev,
+                        "could not start isochronous I/O for channel %d\n",
+                        bcs->channel + 1);
                 error_hangup(bcs);
                 return ret;
         }
 
         req = bcs->channel ? HD_OPEN_B2CHANNEL : HD_OPEN_B1CHANNEL;
         if ((ret = req_submit(bcs, req, 0, BAS_TIMEOUT)) < 0) {
-                err("could not open channel %d: %s",
-                    bcs->channel + 1, get_usb_statmsg(ret));
+                dev_err(bcs->cs->dev, "could not open channel %d: %s\n",
+                        bcs->channel + 1, get_usb_statmsg(ret));
                 stopurbs(bcs->hw.bas);
                 error_hangup(bcs);
         }
@@ -1537,8 +1498,6 @@ static int gigaset_close_bchannel(struct bc_state *bcs)
 {
         int req, ret;
 
-        IFNULLRETVAL(bcs, -EINVAL);
-
         if (!(atomic_read(&bcs->cs->hw.bas->basstate) &
               (bcs->channel ? BS_B2OPEN : BS_B1OPEN))) {
                 /* channel not running: just signal common.c */
@@ -1548,8 +1507,9 @@ static int gigaset_close_bchannel(struct bc_state *bcs)
 
         req = bcs->channel ? HD_CLOSE_B2CHANNEL : HD_CLOSE_B1CHANNEL;
         if ((ret = req_submit(bcs, req, 0, BAS_TIMEOUT)) < 0)
-                err("could not submit HD_CLOSE_BxCHANNEL request: %s",
-                    get_usb_statmsg(ret));
+                dev_err(bcs->cs->dev,
+                        "could not submit HD_CLOSE_BxCHANNEL request: %s\n",
+                        get_usb_statmsg(ret));
         return ret;
 }
 
@@ -1564,17 +1524,13 @@ static int gigaset_close_bchannel(struct bc_state *bcs)
  */
 static void complete_cb(struct cardstate *cs)
 {
-        struct cmdbuf_t *cb;
-
-        IFNULLRET(cs);
-        cb = cs->cmdbuf;
-        IFNULLRET(cb);
+        struct cmdbuf_t *cb = cs->cmdbuf;
 
         /* unqueue completed buffer */
         cs->cmdbytes -= cs->curlen;
-        dbg(DEBUG_TRANSCMD | DEBUG_LOCKCMD,
-            "write_command: sent %u bytes, %u left",
-            cs->curlen, cs->cmdbytes);
+        gig_dbg(DEBUG_TRANSCMD|DEBUG_LOCKCMD,
+                "write_command: sent %u bytes, %u left",
+                cs->curlen, cs->cmdbytes);
         if ((cs->cmdbuf = cb->next) != NULL) {
                 cs->cmdbuf->prev = NULL;
                 cs->curlen = cs->cmdbuf->len;
@@ -1600,15 +1556,9 @@ static int atwrite_submit(struct cardstate *cs, unsigned char *buf, int len);
  */
 static void write_command_callback(struct urb *urb, struct pt_regs *regs)
 {
-        struct cardstate *cs;
+        struct cardstate *cs = urb->context;
+        struct bas_cardstate *ucs = cs->hw.bas;
         unsigned long flags;
-        struct bas_cardstate *ucs;
-
-        IFNULLRET(urb);
-        cs = (struct cardstate *) urb->context;
-        IFNULLRET(cs);
-        ucs = cs->hw.bas;
-        IFNULLRET(ucs);
 
         /* check status */
         switch (urb->status) {
@@ -1618,22 +1568,27 @@ static void write_command_callback(struct urb *urb, struct pt_regs *regs)
         case -ECONNRESET:               /* canceled (async) */
         case -EINPROGRESS:              /* pending */
                 /* ignore silently */
-                dbg(DEBUG_USBREQ,
-                    "%s: %s", __func__, get_usb_statmsg(urb->status));
+                gig_dbg(DEBUG_USBREQ, "%s: %s",
+                        __func__, get_usb_statmsg(urb->status));
                 return;
         default:                                /* any failure */
                 if (++ucs->retry_cmd_out > BAS_RETRY) {
-                        warn("command write: %s, giving up after %d retries",
-                             get_usb_statmsg(urb->status), ucs->retry_cmd_out);
+                        dev_warn(cs->dev,
+                                 "command write: %s, "
+                                 "giving up after %d retries\n",
+                                 get_usb_statmsg(urb->status),
+                                 ucs->retry_cmd_out);
                         break;
                 }
                 if (cs->cmdbuf == NULL) {
-                        warn("command write: %s, cannot retry - cmdbuf gone",
-                             get_usb_statmsg(urb->status));
+                        dev_warn(cs->dev,
+                                 "command write: %s, "
+                                 "cannot retry - cmdbuf gone\n",
+                                 get_usb_statmsg(urb->status));
                         break;
                 }
-                notice("command write: %s, retry %d",
-                       get_usb_statmsg(urb->status), ucs->retry_cmd_out);
+                dev_notice(cs->dev, "command write: %s, retry %d\n",
+                           get_usb_statmsg(urb->status), ucs->retry_cmd_out);
                 if (atwrite_submit(cs, cs->cmdbuf->buf, cs->cmdbuf->len) >= 0)
                         /* resubmitted - bypass regular exit block */
                         return;
@@ -1655,13 +1610,9 @@ static void write_command_callback(struct urb *urb, struct pt_regs *regs)
 static void atrdy_timeout(unsigned long data)
 {
         struct cardstate *cs = (struct cardstate *) data;
-        struct bas_cardstate *ucs;
-
-        IFNULLRET(cs);
-        ucs = cs->hw.bas;
-        IFNULLRET(ucs);
+        struct bas_cardstate *ucs = cs->hw.bas;
 
-        warn("timeout waiting for HD_READY_SEND_ATDATA");
+        dev_warn(cs->dev, "timeout waiting for HD_READY_SEND_ATDATA\n");
 
         /* fake the missing signal - what else can I do? */
         update_basstate(ucs, BS_ATREADY, BS_ATTIMER);
@@ -1682,18 +1633,15 @@ static void atrdy_timeout(unsigned long data)
  */
 static int atwrite_submit(struct cardstate *cs, unsigned char *buf, int len)
 {
-        struct bas_cardstate *ucs;
+        struct bas_cardstate *ucs = cs->hw.bas;
+        unsigned long flags;
         int ret;
 
-        IFNULLRETVAL(cs, -EFAULT);
-        ucs = cs->hw.bas;
-        IFNULLRETVAL(ucs, -EFAULT);
-        IFNULLRETVAL(ucs->urb_cmd_out, -EFAULT);
-
-        dbg(DEBUG_USBREQ, "-------> HD_WRITE_ATMESSAGE (%d)", len);
+        gig_dbg(DEBUG_USBREQ, "-------> HD_WRITE_ATMESSAGE (%d)", len);
 
         if (ucs->urb_cmd_out->status == -EINPROGRESS) {
-                err("could not submit HD_WRITE_ATMESSAGE: URB busy");
+                dev_err(cs->dev,
+                        "could not submit HD_WRITE_ATMESSAGE: URB busy\n");
                 return -EBUSY;
         }
 
@@ -1707,9 +1655,13 @@ static int atwrite_submit(struct cardstate *cs, unsigned char *buf, int len)
                              (unsigned char*) &ucs->dr_cmd_out, buf, len,
                              write_command_callback, cs);
 
-        if ((ret = usb_submit_urb(ucs->urb_cmd_out, SLAB_ATOMIC)) != 0) {
-                err("could not submit HD_WRITE_ATMESSAGE: %s",
-                    get_usb_statmsg(ret));
+        spin_lock_irqsave(&cs->lock, flags);
+        ret = cs->connected ? usb_submit_urb(ucs->urb_cmd_out, SLAB_ATOMIC) : -ENODEV;
+        spin_unlock_irqrestore(&cs->lock, flags);
+
+        if (ret) {
+                dev_err(cs->dev, "could not submit HD_WRITE_ATMESSAGE: %s\n",
+                        get_usb_statmsg(ret));
                 return ret;
         }
 
@@ -1718,8 +1670,8 @@ static int atwrite_submit(struct cardstate *cs, unsigned char *buf, int len)
 
         /* start timeout if necessary */
         if (!(atomic_read(&ucs->basstate) & BS_ATTIMER)) {
-                dbg(DEBUG_OUTPUT,
-                    "setting ATREADY timeout of %d/10 secs", ATRDY_TIMEOUT);
+                gig_dbg(DEBUG_OUTPUT, "setting ATREADY timeout of %d/10 secs",
+                        ATRDY_TIMEOUT);
                 ucs->timer_atrdy.expires = jiffies + ATRDY_TIMEOUT * HZ / 10;
                 ucs->timer_atrdy.data = (unsigned long) cs;
                 ucs->timer_atrdy.function = atrdy_timeout;
@@ -1740,21 +1692,17 @@ static int atwrite_submit(struct cardstate *cs, unsigned char *buf, int len)
 static int start_cbsend(struct cardstate *cs)
 {
         struct cmdbuf_t *cb;
-        struct bas_cardstate *ucs;
+        struct bas_cardstate *ucs = cs->hw.bas;
         unsigned long flags;
         int rc;
         int retval = 0;
 
-        IFNULLRETVAL(cs, -EFAULT);
-        ucs = cs->hw.bas;
-        IFNULLRETVAL(ucs, -EFAULT);
-
         /* check if AT channel is open */
         if (!(atomic_read(&ucs->basstate) & BS_ATOPEN)) {
-                dbg(DEBUG_TRANSCMD | DEBUG_LOCKCMD, "AT channel not open");
+                gig_dbg(DEBUG_TRANSCMD|DEBUG_LOCKCMD, "AT channel not open");
                 rc = req_submit(cs->bcs, HD_OPEN_ATCHANNEL, 0, BAS_TIMEOUT);
                 if (rc < 0) {
-                        err("could not open AT channel");
+                        dev_err(cs->dev, "could not open AT channel\n");
                         /* flush command queue */
                         spin_lock_irqsave(&cs->cmdlock, flags);
                         while (cs->cmdbuf != NULL)
@@ -1792,27 +1740,23 @@ static int start_cbsend(struct cardstate *cs)
  *      cs              controller state structure
  *      buf             command string to send
  *      len             number of bytes to send (max. IF_WRITEBUF)
- *      wake_tasklet    tasklet to run when transmission is completed (NULL if none)
+ *      wake_tasklet    tasklet to run when transmission is completed
+ *                      (NULL if none)
  * return value:
  *      number of bytes queued on success
  *      error code < 0 on error
  */
 static int gigaset_write_cmd(struct cardstate *cs,
-                             const unsigned char *buf, int len,
-                             struct tasklet_struct *wake_tasklet)
+                             const unsigned char *buf, int len,
+                             struct tasklet_struct *wake_tasklet)
 {
         struct cmdbuf_t *cb;
         unsigned long flags;
         int status;
 
         gigaset_dbg_buffer(atomic_read(&cs->mstate) != MS_LOCKED ?
-                             DEBUG_TRANSCMD : DEBUG_LOCKCMD,
-                           "CMD Transmit", len, buf, 0);
-
-        if (!atomic_read(&cs->connected)) {
-                err("%s: not connected", __func__);
-                return -ENODEV;
-        }
+                             DEBUG_TRANSCMD : DEBUG_LOCKCMD,
+                           "CMD Transmit", len, buf);
 
         if (len <= 0)
                 return 0;                       /* nothing to do */
@@ -1820,7 +1764,7 @@ static int gigaset_write_cmd(struct cardstate *cs,
         if (len > IF_WRITEBUF)
                 len = IF_WRITEBUF;
         if (!(cb = kmalloc(sizeof(struct cmdbuf_t) + len, GFP_ATOMIC))) {
-                err("%s: out of memory", __func__);
+                dev_err(cs->dev, "%s: out of memory\n", __func__);
                 return -ENOMEM;
         }
 
@@ -1849,7 +1793,8 @@ static int gigaset_write_cmd(struct cardstate *cs,
 
 /* gigaset_write_room
  * tty_driver.write_room interface routine
- * return number of characters the driver will accept to be written via gigaset_write_cmd
+ * return number of characters the driver will accept to be written via
+ * gigaset_write_cmd
  * parameter:
  *      controller state structure
  * return value:
@@ -1947,7 +1892,7 @@ static int gigaset_initbcshw(struct bc_state *bcs)
                 return 0;
         }
         tasklet_init(&ubc->sent_tasklet,
-                     &write_iso_tasklet, (unsigned long) bcs);
+                     &write_iso_tasklet, (unsigned long) bcs);
 
         spin_lock_init(&ubc->isoinlock);
         for (i = 0; i < BAS_INURBS; ++i)
@@ -1968,7 +1913,7 @@ static int gigaset_initbcshw(struct bc_state *bcs)
         ubc->shared0s = 0;
         ubc->stolen0s = 0;
         tasklet_init(&ubc->rcvd_tasklet,
-                     &read_iso_tasklet, (unsigned long) bcs);
+                     &read_iso_tasklet, (unsigned long) bcs);
         return 1;
 }
 
@@ -2027,57 +1972,56 @@ static int gigaset_initcshw(struct cardstate *cs)
  */
 static void freeurbs(struct cardstate *cs)
 {
-        struct bas_cardstate *ucs;
+        struct bas_cardstate *ucs = cs->hw.bas;
         struct bas_bc_state *ubc;
         int i, j;
 
-        IFNULLRET(cs);
-        ucs = cs->hw.bas;
-        IFNULLRET(ucs);
-
         for (j = 0; j < 2; ++j) {
                 ubc = cs->bcs[j].hw.bas;
-                IFNULLCONT(ubc);
                 for (i = 0; i < BAS_OUTURBS; ++i)
                         if (ubc->isoouturbs[i].urb) {
                                 usb_kill_urb(ubc->isoouturbs[i].urb);
-                                dbg(DEBUG_INIT,
-                                    "%s: isoc output URB %d/%d unlinked",
-                                    __func__, j, i);
+                                gig_dbg(DEBUG_INIT,
+                                        "%s: isoc output URB %d/%d unlinked",
+                                        __func__, j, i);
                                 usb_free_urb(ubc->isoouturbs[i].urb);
                                 ubc->isoouturbs[i].urb = NULL;
                         }
                 for (i = 0; i < BAS_INURBS; ++i)
                         if (ubc->isoinurbs[i]) {
                                 usb_kill_urb(ubc->isoinurbs[i]);
-                                dbg(DEBUG_INIT,
-                                    "%s: isoc input URB %d/%d unlinked",
-                                    __func__, j, i);
+                                gig_dbg(DEBUG_INIT,
+                                        "%s: isoc input URB %d/%d unlinked",
+                                        __func__, j, i);
                                 usb_free_urb(ubc->isoinurbs[i]);
                                 ubc->isoinurbs[i] = NULL;
                         }
         }
         if (ucs->urb_int_in) {
                 usb_kill_urb(ucs->urb_int_in);
-                dbg(DEBUG_INIT, "%s: interrupt input URB unlinked", __func__);
+                gig_dbg(DEBUG_INIT, "%s: interrupt input URB unlinked",
+                        __func__);
                 usb_free_urb(ucs->urb_int_in);
                 ucs->urb_int_in = NULL;
         }
         if (ucs->urb_cmd_out) {
                 usb_kill_urb(ucs->urb_cmd_out);
-                dbg(DEBUG_INIT, "%s: command output URB unlinked", __func__);
+                gig_dbg(DEBUG_INIT, "%s: command output URB unlinked",
+                        __func__);
                 usb_free_urb(ucs->urb_cmd_out);
                 ucs->urb_cmd_out = NULL;
         }
         if (ucs->urb_cmd_in) {
                 usb_kill_urb(ucs->urb_cmd_in);
-                dbg(DEBUG_INIT, "%s: command input URB unlinked", __func__);
+                gig_dbg(DEBUG_INIT, "%s: command input URB unlinked",
+                        __func__);
                 usb_free_urb(ucs->urb_cmd_in);
                 ucs->urb_cmd_in = NULL;
         }
         if (ucs->urb_ctrl) {
                 usb_kill_urb(ucs->urb_ctrl);
-                dbg(DEBUG_INIT, "%s: control output URB unlinked", __func__);
+                gig_dbg(DEBUG_INIT, "%s: control output URB unlinked",
+                        __func__);
                 usb_free_urb(ucs->urb_ctrl);
                 ucs->urb_ctrl = NULL;
         }
@@ -2099,12 +2043,10 @@ static int gigaset_probe(struct usb_interface *interface,
         int i, j;
         int ret;
 
-        IFNULLRETVAL(udev, -ENODEV);
-
-        dbg(DEBUG_ANY,
-            "%s: Check if device matches .. (Vendor: 0x%x, Product: 0x%x)",
-            __func__, le16_to_cpu(udev->descriptor.idVendor),
-            le16_to_cpu(udev->descriptor.idProduct));
+        gig_dbg(DEBUG_ANY,
+                "%s: Check if device matches .. (Vendor: 0x%x, Product: 0x%x)",
+                __func__, le16_to_cpu(udev->descriptor.idVendor),
+                le16_to_cpu(udev->descriptor.idProduct));
 
         /* See if the device offered us matches what we can accept */
         if ((le16_to_cpu(udev->descriptor.idVendor)  != USB_GIGA_VENDOR_ID) ||
@@ -2112,20 +2054,21 @@ static int gigaset_probe(struct usb_interface *interface,
              le16_to_cpu(udev->descriptor.idProduct) != USB_4175_PRODUCT_ID &&
              le16_to_cpu(udev->descriptor.idProduct) != USB_SX303_PRODUCT_ID &&
              le16_to_cpu(udev->descriptor.idProduct) != USB_SX353_PRODUCT_ID)) {
-                dbg(DEBUG_ANY, "%s: unmatched ID - exiting", __func__);
+                gig_dbg(DEBUG_ANY, "%s: unmatched ID - exiting", __func__);
                 return -ENODEV;
         }
 
         /* set required alternate setting */
         hostif = interface->cur_altsetting;
         if (hostif->desc.bAlternateSetting != 3) {
-                dbg(DEBUG_ANY,
-                    "%s: wrong alternate setting %d - trying to switch",
-                    __func__, hostif->desc.bAlternateSetting);
+                gig_dbg(DEBUG_ANY,
+                        "%s: wrong alternate setting %d - trying to switch",
+                        __func__, hostif->desc.bAlternateSetting);
                 if (usb_set_interface(udev, hostif->desc.bInterfaceNumber, 3) < 0) {
-                        warn("usb_set_interface failed, device %d interface %d altsetting %d",
-                             udev->devnum, hostif->desc.bInterfaceNumber,
-                             hostif->desc.bAlternateSetting);
+                        dev_warn(&udev->dev, "usb_set_interface failed, "
+                                 "device %d interface %d altsetting %d\n",
+                                 udev->devnum, hostif->desc.bInterfaceNumber,
+                                 hostif->desc.bAlternateSetting);
                         return -ENODEV;
                 }
                 hostif = interface->cur_altsetting;
@@ -2134,23 +2077,28 @@ static int gigaset_probe(struct usb_interface *interface,
         /* Reject application specific interfaces
          */
         if (hostif->desc.bInterfaceClass != 255) {
-                warn("%s: bInterfaceClass == %d",
-                     __func__, hostif->desc.bInterfaceClass);
+                dev_warn(&udev->dev, "%s: bInterfaceClass == %d\n",
+                         __func__, hostif->desc.bInterfaceClass);
                 return -ENODEV;
         }
 
-        info("%s: Device matched (Vendor: 0x%x, Product: 0x%x)",
-             __func__, le16_to_cpu(udev->descriptor.idVendor),
-             le16_to_cpu(udev->descriptor.idProduct));
+        dev_info(&udev->dev,
+                 "%s: Device matched (Vendor: 0x%x, Product: 0x%x)\n",
+                 __func__, le16_to_cpu(udev->descriptor.idVendor),
+                 le16_to_cpu(udev->descriptor.idProduct));
 
         cs = gigaset_getunassignedcs(driver);
         if (!cs) {
-                err("%s: no free cardstate", __func__);
+                dev_err(&udev->dev, "no free cardstate\n");
                 return -ENODEV;
         }
         ucs = cs->hw.bas;
+
+        /* save off device structure ptrs for later use */
+        usb_get_dev(udev);
         ucs->udev = udev;
         ucs->interface = interface;
+        cs->dev = &interface->dev;
 
         /* allocate URBs:
          * - one for the interrupt pipe
@@ -2159,22 +2107,22 @@ static int gigaset_probe(struct usb_interface *interface,
          */
         ucs->urb_int_in = usb_alloc_urb(0, SLAB_KERNEL);
         if (!ucs->urb_int_in) {
-                err("No free urbs available");
+                dev_err(cs->dev, "no free urbs available\n");
                 goto error;
         }
         ucs->urb_cmd_in = usb_alloc_urb(0, SLAB_KERNEL);
         if (!ucs->urb_cmd_in) {
-                err("No free urbs available");
+                dev_err(cs->dev, "no free urbs available\n");
                 goto error;
         }
         ucs->urb_cmd_out = usb_alloc_urb(0, SLAB_KERNEL);
         if (!ucs->urb_cmd_out) {
-                err("No free urbs available");
+                dev_err(cs->dev, "no free urbs available\n");
                 goto error;
         }
         ucs->urb_ctrl = usb_alloc_urb(0, SLAB_KERNEL);
         if (!ucs->urb_ctrl) {
-                err("No free urbs available");
+                dev_err(cs->dev, "no free urbs available\n");
                 goto error;
         }
 
@@ -2184,7 +2132,7 @@ static int gigaset_probe(struct usb_interface *interface,
                         ubc->isoouturbs[i].urb =
                                 usb_alloc_urb(BAS_NUMFRAMES, SLAB_KERNEL);
                         if (!ubc->isoouturbs[i].urb) {
-                                err("No free urbs available");
+                                dev_err(cs->dev, "no free urbs available\n");
                                 goto error;
                         }
                 }
@@ -2192,7 +2140,7 @@ static int gigaset_probe(struct usb_interface *interface,
                         ubc->isoinurbs[i] =
                                 usb_alloc_urb(BAS_NUMFRAMES, SLAB_KERNEL);
                         if (!ubc->isoinurbs[i]) {
-                                err("No free urbs available");
+                                dev_err(cs->dev, "no free urbs available\n");
                                 goto error;
                         }
                 }
@@ -2204,13 +2152,14 @@ static int gigaset_probe(struct usb_interface *interface,
         /* Fill the interrupt urb and send it to the core */
         endpoint = &hostif->endpoint[0].desc;
         usb_fill_int_urb(ucs->urb_int_in, udev,
-                         usb_rcvintpipe(udev,
-                                        (endpoint->bEndpointAddress) & 0x0f),
-                         ucs->int_in_buf, 3, read_int_callback, cs,
-                         endpoint->bInterval);
+                         usb_rcvintpipe(udev,
+                                        (endpoint->bEndpointAddress) & 0x0f),
+                         ucs->int_in_buf, 3, read_int_callback, cs,
+                         endpoint->bInterval);
         ret = usb_submit_urb(ucs->urb_int_in, SLAB_KERNEL);
         if (ret) {
-                err("could not submit interrupt URB: %s", get_usb_statmsg(ret));
+                dev_err(cs->dev, "could not submit interrupt URB: %s\n",
+                        get_usb_statmsg(ret));
                 goto error;
         }
 
@@ -2221,18 +2170,18 @@ static int gigaset_probe(struct usb_interface *interface,
         /* tell common part that the device is ready */
         if (startmode == SM_LOCKED)
                 atomic_set(&cs->mstate, MS_LOCKED);
-        if (!gigaset_start(cs))
-                goto error;
 
         /* save address of controller structure */
         usb_set_intfdata(interface, cs);
 
-        /* set up device sysfs */
-        gigaset_init_dev_sysfs(interface);
+        if (!gigaset_start(cs))
+                goto error;
+
         return 0;
 
 error:
         freeurbs(cs);
+        usb_set_intfdata(interface, NULL);
         gigaset_unassign(cs);
         return -ENODEV;
 }
@@ -2245,23 +2194,22 @@ static void gigaset_disconnect(struct usb_interface *interface)
         struct cardstate *cs;
         struct bas_cardstate *ucs;
 
-        /* clear device sysfs */
-        gigaset_free_dev_sysfs(interface);
-
         cs = usb_get_intfdata(interface);
-        usb_set_intfdata(interface, NULL);
 
-        IFNULLRET(cs);
         ucs = cs->hw.bas;
-        IFNULLRET(ucs);
 
-        info("disconnecting GigaSet base");
+        dev_info(cs->dev, "disconnecting Gigaset base\n");
         gigaset_stop(cs);
         freeurbs(cs);
+        usb_set_intfdata(interface, NULL);
         kfree(ucs->rcvbuf);
         ucs->rcvbuf = NULL;
         ucs->rcvbuf_size = 0;
         atomic_set(&ucs->basstate, 0);
+        usb_put_dev(ucs->udev);
+        ucs->interface = NULL;
+        ucs->udev = NULL;
+        cs->dev = NULL;
         gigaset_unassign(cs);
 }
 
@@ -2293,13 +2241,14 @@ static int __init bas_gigaset_init(void)
 
         /* allocate memory for our driver state and intialize it */
         if ((driver = gigaset_initdriver(GIGASET_MINOR, GIGASET_MINORS,
-                                       GIGASET_MODULENAME, GIGASET_DEVNAME,
-                                       GIGASET_DEVFSNAME, &gigops,
-                                       THIS_MODULE)) == NULL)
+                                       GIGASET_MODULENAME, GIGASET_DEVNAME,
+                                       GIGASET_DEVFSNAME, &gigops,
+                                       THIS_MODULE)) == NULL)
                 goto error;
 
         /* allocate memory for our device state and intialize it */
-        cardstate = gigaset_initcs(driver, 2, 0, 0, cidmode, GIGASET_MODULENAME);
+        cardstate = gigaset_initcs(driver, 2, 0, 0, cidmode,
+                                   GIGASET_MODULENAME);
         if (!cardstate)
                 goto error;
 
@@ -2329,19 +2278,18 @@ error:	if (cardstate)
 static void __exit bas_gigaset_exit(void)
 {
         gigaset_blockdriver(driver); /* => probe will fail
-                                      * => no gigaset_start any more
-                                      */
+                                      * => no gigaset_start any more
+                                      */
 
         gigaset_shutdown(cardstate);
         /* from now on, no isdn callback should be possible */
 
         if (atomic_read(&cardstate->hw.bas->basstate) & BS_ATOPEN) {
-                dbg(DEBUG_ANY, "closing AT channel");
+                gig_dbg(DEBUG_ANY, "closing AT channel");
                 if (req_submit(cardstate->bcs,
-                               HD_CLOSE_ATCHANNEL, 0, BAS_TIMEOUT) >= 0) {
-                        /* successfully submitted - wait for completion */
-                        //wait_event_interruptible(cs->initwait, !cs->hw.bas->pending);
-                        //FIXME need own wait queue? wakeup?
+                               HD_CLOSE_ATCHANNEL, 0, BAS_TIMEOUT) >= 0) {
+                        /* successfully submitted */
+                        //FIXME wait for completion?
                 }
         }
 
diff --git a/drivers/isdn/gigaset/common.c b/drivers/isdn/gigaset/common.c
index 64371995c1a9..749b3da1236e 100644
--- a/drivers/isdn/gigaset/common.c
+++ b/drivers/isdn/gigaset/common.c
@@ -1,7 +1,7 @@
 /*
  * Stuff used by all variants of the driver
  *
- * Copyright (c) 2001 by Stefan Eilers <Eilers.Stefan@epost.de>,
+ * Copyright (c) 2001 by Stefan Eilers,
  *                       Hansjoerg Lipp <hjlipp@web.de>,
  *                       Tilman Schmidt <tilman@imap.cc>.
  *
@@ -11,10 +11,6 @@
  *      published by the Free Software Foundation; either version 2 of
  *      the License, or (at your option) any later version.
  * =====================================================================
- * ToDo: ...
- * =====================================================================
- * Version: $Id: common.c,v 1.104.4.22 2006/02/04 18:28:16 hjlipp Exp $
- * =====================================================================
  */
 
 #include "gigaset.h"
@@ -23,7 +19,7 @@
 #include <linux/moduleparam.h>
 
 /* Version Information */
-#define DRIVER_AUTHOR "Hansjoerg Lipp <hjlipp@web.de>, Tilman Schmidt <tilman@imap.cc>, Stefan Eilers <Eilers.Stefan@epost.de>"
+#define DRIVER_AUTHOR "Hansjoerg Lipp <hjlipp@web.de>, Tilman Schmidt <tilman@imap.cc>, Stefan Eilers"
 #define DRIVER_DESC "Driver for Gigaset 307x"
 
 /* Module parameters */
@@ -32,21 +28,10 @@ EXPORT_SYMBOL_GPL(gigaset_debuglevel);
 module_param_named(debug, gigaset_debuglevel, int, S_IRUGO|S_IWUSR);
 MODULE_PARM_DESC(debug, "debug level");
 
-/*======================================================================
-  Prototypes of internal functions
- */
-
-//static void gigaset_process_response(int resp_code, int parameter,
-//                                     struct at_state_t *at_state,
-//                                     unsigned char ** pstring);
-static struct cardstate *alloc_cs(struct gigaset_driver *drv);
-static void free_cs(struct cardstate *cs);
-static void make_valid(struct cardstate *cs, unsigned mask);
-static void make_invalid(struct cardstate *cs, unsigned mask);
-
-#define VALID_MINOR       0x01
-#define VALID_ID          0x02
-#define ASSIGNED          0x04
+/* driver state flags */
+#define VALID_MINOR     0x01
+#define VALID_ID        0x02
+#define ASSIGNED        0x04
 
 /* bitwise byte inversion table */
 __u8 gigaset_invtab[256] = {
@@ -86,42 +71,40 @@ __u8 gigaset_invtab[256] = {
 EXPORT_SYMBOL_GPL(gigaset_invtab);
 
 void gigaset_dbg_buffer(enum debuglevel level, const unsigned char *msg,
-                        size_t len, const unsigned char *buf, int from_user)
+                        size_t len, const unsigned char *buf)
 {
         unsigned char outbuf[80];
-        unsigned char inbuf[80 - 1];
-        size_t numin;
-        const unsigned char *in;
+        unsigned char c;
         size_t space = sizeof outbuf - 1;
         unsigned char *out = outbuf;
+        size_t numin = len;
 
-        if (!from_user) {
-                in = buf;
-                numin = len;
-        } else {
-                numin = len < sizeof inbuf ? len : sizeof inbuf;
-                in = inbuf;
-                if (copy_from_user(inbuf, (const unsigned char __user *) buf, numin)) {
-                        strncpy(inbuf, "<FAULT>", sizeof inbuf);
-                        numin = sizeof "<FAULT>" - 1;
+        while (numin--) {
+                c = *buf++;
+                if (c == '~' || c == '^' || c == '\\') {
+                        if (!space--)
+                                break;
+                        *out++ = '\\';
                 }
-        }
-
-        for (; numin && space; --numin, ++in) {
-                --space;
-                if (*in >= 32)
-                        *out++ = *in;
-                else {
+                if (c & 0x80) {
+                        if (!space--)
+                                break;
+                        *out++ = '~';
+                        c ^= 0x80;
+                }
+                if (c < 0x20 || c == 0x7f) {
+                        if (!space--)
+                                break;
                         *out++ = '^';
-                        if (space) {
-                                *out++ = '@' + *in;
-                                --space;
-                        }
+                        c ^= 0x40;
                 }
+                if (!space--)
+                        break;
+                *out++ = c;
         }
         *out = 0;
 
-        dbg(level, "%s (%u bytes): %s", msg, (unsigned) len, outbuf);
+        gig_dbg(level, "%s (%u bytes): %s", msg, (unsigned) len, outbuf);
 }
 EXPORT_SYMBOL_GPL(gigaset_dbg_buffer);
 
@@ -146,11 +129,6 @@ int gigaset_enterconfigmode(struct cardstate *cs)
 {
         int i, r;
 
-        if (!atomic_read(&cs->connected)) {
-                err("not connected!");
-                return -1;
-        }
-
         cs->control_state = TIOCM_RTS; //FIXME
 
         r = setflags(cs, TIOCM_DTR, 200);
@@ -174,7 +152,7 @@ int gigaset_enterconfigmode(struct cardstate *cs)
         return 0;
 
 error:
-        err("error %d on setuartbits!\n", -r);
+        dev_err(cs->dev, "error %d on setuartbits\n", -r);
         cs->control_state = TIOCM_RTS|TIOCM_DTR; // FIXME is this a good value?
         cs->ops->set_modem_ctrl(cs, 0, TIOCM_RTS|TIOCM_DTR);
 
@@ -187,13 +165,13 @@ static int test_timeout(struct at_state_t *at_state)
                 return 0;
 
         if (--at_state->timer_expires) {
-                dbg(DEBUG_MCMD, "decreased timer of %p to %lu",
-                    at_state, at_state->timer_expires);
+                gig_dbg(DEBUG_MCMD, "decreased timer of %p to %lu",
+                        at_state, at_state->timer_expires);
                 return 0;
         }
 
         if (!gigaset_add_event(at_state->cs, at_state, EV_TIMEOUT, NULL,
-                               atomic_read(&at_state->timer_index), NULL)) {
+                               at_state->timer_index, NULL)) {
                 //FIXME what should we do?
         }
 
@@ -221,10 +199,10 @@ static void timer_tick(unsigned long data)
                 if (test_timeout(at_state))
                         timeout = 1;
 
-        if (atomic_read(&cs->running)) {
-                mod_timer(&cs->timer, jiffies + GIG_TICK);
+        if (cs->running) {
+                mod_timer(&cs->timer, jiffies + msecs_to_jiffies(GIG_TICK));
                 if (timeout) {
-                        dbg(DEBUG_CMD, "scheduling timeout");
+                        gig_dbg(DEBUG_CMD, "scheduling timeout");
                         tasklet_schedule(&cs->event_tasklet);
                 }
         }
@@ -238,13 +216,14 @@ int gigaset_get_channel(struct bc_state *bcs)
 
         spin_lock_irqsave(&bcs->cs->lock, flags);
         if (bcs->use_count) {
-                dbg(DEBUG_ANY, "could not allocate channel %d", bcs->channel);
+                gig_dbg(DEBUG_ANY, "could not allocate channel %d",
+                        bcs->channel);
                 spin_unlock_irqrestore(&bcs->cs->lock, flags);
                 return 0;
         }
         ++bcs->use_count;
         bcs->busy = 1;
-        dbg(DEBUG_ANY, "allocated channel %d", bcs->channel);
+        gig_dbg(DEBUG_ANY, "allocated channel %d", bcs->channel);
         spin_unlock_irqrestore(&bcs->cs->lock, flags);
         return 1;
 }
@@ -255,13 +234,13 @@ void gigaset_free_channel(struct bc_state *bcs)
 
         spin_lock_irqsave(&bcs->cs->lock, flags);
         if (!bcs->busy) {
-                dbg(DEBUG_ANY, "could not free channel %d", bcs->channel);
+                gig_dbg(DEBUG_ANY, "could not free channel %d", bcs->channel);
                 spin_unlock_irqrestore(&bcs->cs->lock, flags);
                 return;
         }
         --bcs->use_count;
         bcs->busy = 0;
-        dbg(DEBUG_ANY, "freed channel %d", bcs->channel);
+        gig_dbg(DEBUG_ANY, "freed channel %d", bcs->channel);
         spin_unlock_irqrestore(&bcs->cs->lock, flags);
 }
 
@@ -274,14 +253,14 @@ int gigaset_get_channels(struct cardstate *cs)
         for (i = 0; i < cs->channels; ++i)
                 if (cs->bcs[i].use_count) {
                         spin_unlock_irqrestore(&cs->lock, flags);
-                        dbg(DEBUG_ANY, "could not allocated all channels");
+                        gig_dbg(DEBUG_ANY, "could not allocate all channels");
                         return 0;
                 }
         for (i = 0; i < cs->channels; ++i)
                 ++cs->bcs[i].use_count;
         spin_unlock_irqrestore(&cs->lock, flags);
 
-        dbg(DEBUG_ANY, "allocated all channels");
+        gig_dbg(DEBUG_ANY, "allocated all channels");
 
         return 1;
 }
@@ -291,7 +270,7 @@ void gigaset_free_channels(struct cardstate *cs)
         unsigned long flags;
         int i;
 
-        dbg(DEBUG_ANY, "unblocking all channels");
+        gig_dbg(DEBUG_ANY, "unblocking all channels");
         spin_lock_irqsave(&cs->lock, flags);
         for (i = 0; i < cs->channels; ++i)
                 --cs->bcs[i].use_count;
@@ -303,7 +282,7 @@ void gigaset_block_channels(struct cardstate *cs)
         unsigned long flags;
         int i;
 
-        dbg(DEBUG_ANY, "blocking all channels");
+        gig_dbg(DEBUG_ANY, "blocking all channels");
         spin_lock_irqsave(&cs->lock, flags);
         for (i = 0; i < cs->channels; ++i)
                 ++cs->bcs[i].use_count;
@@ -314,25 +293,27 @@ static void clear_events(struct cardstate *cs)
 {
         struct event_t *ev;
         unsigned head, tail;
+        unsigned long flags;
 
-        /* no locking needed (no reader/writer allowed) */
+        spin_lock_irqsave(&cs->ev_lock, flags);
 
-        head = atomic_read(&cs->ev_head);
-        tail = atomic_read(&cs->ev_tail);
+        head = cs->ev_head;
+        tail = cs->ev_tail;
 
         while (tail != head) {
                 ev = cs->events + head;
                 kfree(ev->ptr);
-
                 head = (head + 1) % MAX_EVENTS;
         }
 
-        atomic_set(&cs->ev_head, tail);
+        cs->ev_head = tail;
+
+        spin_unlock_irqrestore(&cs->ev_lock, flags);
 }
 
 struct event_t *gigaset_add_event(struct cardstate *cs,
-                                  struct at_state_t *at_state, int type,
-                                  void *ptr, int parameter, void *arg)
+                                  struct at_state_t *at_state, int type,
+                                  void *ptr, int parameter, void *arg)
 {
         unsigned long flags;
         unsigned next, tail;
@@ -340,9 +321,9 @@ struct event_t *gigaset_add_event(struct cardstate *cs,
 
         spin_lock_irqsave(&cs->ev_lock, flags);
 
-        tail = atomic_read(&cs->ev_tail);
+        tail = cs->ev_tail;
         next = (tail + 1) % MAX_EVENTS;
-        if (unlikely(next == atomic_read(&cs->ev_head)))
+        if (unlikely(next == cs->ev_head))
                 err("event queue full");
         else {
                 event = cs->events + tail;
@@ -352,7 +333,7 @@ struct event_t *gigaset_add_event(struct cardstate *cs,
                 event->ptr = ptr;
                 event->arg = arg;
                 event->parameter = parameter;
-                atomic_set(&cs->ev_tail, next);
+                cs->ev_tail = next;
         }
 
         spin_unlock_irqrestore(&cs->ev_lock, flags);
@@ -391,14 +372,14 @@ static void gigaset_freebcs(struct bc_state *bcs)
 {
         int i;
 
-        dbg(DEBUG_INIT, "freeing bcs[%d]->hw", bcs->channel);
+        gig_dbg(DEBUG_INIT, "freeing bcs[%d]->hw", bcs->channel);
         if (!bcs->cs->ops->freebcshw(bcs)) {
-                dbg(DEBUG_INIT, "failed");
+                gig_dbg(DEBUG_INIT, "failed");
         }
 
-        dbg(DEBUG_INIT, "clearing bcs[%d]->at_state", bcs->channel);
+        gig_dbg(DEBUG_INIT, "clearing bcs[%d]->at_state", bcs->channel);
         clear_at_state(&bcs->at_state);
-        dbg(DEBUG_INIT, "freeing bcs[%d]->skb", bcs->channel);
+        gig_dbg(DEBUG_INIT, "freeing bcs[%d]->skb", bcs->channel);
 
         if (bcs->skb)
                 dev_kfree_skb(bcs->skb);
@@ -408,6 +389,52 @@ static void gigaset_freebcs(struct bc_state *bcs)
         }
 }
 
+static struct cardstate *alloc_cs(struct gigaset_driver *drv)
+{
+        unsigned long flags;
+        unsigned i;
+        static struct cardstate *ret = NULL;
+
+        spin_lock_irqsave(&drv->lock, flags);
+        for (i = 0; i < drv->minors; ++i) {
+                if (!(drv->flags[i] & VALID_MINOR)) {
+                        drv->flags[i] = VALID_MINOR;
+                        ret = drv->cs + i;
+                }
+                if (ret)
+                        break;
+        }
+        spin_unlock_irqrestore(&drv->lock, flags);
+        return ret;
+}
+
+static void free_cs(struct cardstate *cs)
+{
+        unsigned long flags;
+        struct gigaset_driver *drv = cs->driver;
+        spin_lock_irqsave(&drv->lock, flags);
+        drv->flags[cs->minor_index] = 0;
+        spin_unlock_irqrestore(&drv->lock, flags);
+}
+
+static void make_valid(struct cardstate *cs, unsigned mask)
+{
+        unsigned long flags;
+        struct gigaset_driver *drv = cs->driver;
+        spin_lock_irqsave(&drv->lock, flags);
+        drv->flags[cs->minor_index] |= mask;
+        spin_unlock_irqrestore(&drv->lock, flags);
+}
+
+static void make_invalid(struct cardstate *cs, unsigned mask)
+{
+        unsigned long flags;
+        struct gigaset_driver *drv = cs->driver;
+        spin_lock_irqsave(&drv->lock, flags);
+        drv->flags[cs->minor_index] &= ~mask;
+        spin_unlock_irqrestore(&drv->lock, flags);
+}
+
 void gigaset_freecs(struct cardstate *cs)
 {
         int i;
@@ -416,7 +443,7 @@ void gigaset_freecs(struct cardstate *cs)
         if (!cs)
                 return;
 
-        down(&cs->sem);
+        mutex_lock(&cs->mutex);
 
         if (!cs->bcs)
                 goto f_cs;
@@ -424,8 +451,9 @@ void gigaset_freecs(struct cardstate *cs)
                 goto f_bcs;
 
         spin_lock_irqsave(&cs->lock, flags);
-        atomic_set(&cs->running, 0);
-        spin_unlock_irqrestore(&cs->lock, flags); /* event handler and timer are not rescheduled below */
+        cs->running = 0;
+        spin_unlock_irqrestore(&cs->lock, flags); /* event handler and timer are
+                                                     not rescheduled below */
 
         tasklet_kill(&cs->event_tasklet);
         del_timer_sync(&cs->timer);
@@ -434,7 +462,7 @@ void gigaset_freecs(struct cardstate *cs)
         default:
                 gigaset_if_free(cs);
 
-                dbg(DEBUG_INIT, "clearing hw");
+                gig_dbg(DEBUG_INIT, "clearing hw");
                 cs->ops->freecshw(cs);
 
                 //FIXME cmdbuf
@@ -443,36 +471,36 @@ void gigaset_freecs(struct cardstate *cs)
         case 2: /* error in initcshw */
                 /* Deregister from LL */
                 make_invalid(cs, VALID_ID);
-                dbg(DEBUG_INIT, "clearing iif");
+                gig_dbg(DEBUG_INIT, "clearing iif");
                 gigaset_i4l_cmd(cs, ISDN_STAT_UNLOAD);
 
                 /* fall through */
         case 1: /* error when regestering to LL */
-                dbg(DEBUG_INIT, "clearing at_state");
+                gig_dbg(DEBUG_INIT, "clearing at_state");
                 clear_at_state(&cs->at_state);
                 dealloc_at_states(cs);
 
                 /* fall through */
         case 0: /* error in one call to initbcs */
                 for (i = 0; i < cs->channels; ++i) {
-                        dbg(DEBUG_INIT, "clearing bcs[%d]", i);
+                        gig_dbg(DEBUG_INIT, "clearing bcs[%d]", i);
                         gigaset_freebcs(cs->bcs + i);
                 }
 
                 clear_events(cs);
-                dbg(DEBUG_INIT, "freeing inbuf");
+                gig_dbg(DEBUG_INIT, "freeing inbuf");
                 kfree(cs->inbuf);
         }
-f_bcs:  dbg(DEBUG_INIT, "freeing bcs[]");
+f_bcs:  gig_dbg(DEBUG_INIT, "freeing bcs[]");
         kfree(cs->bcs);
-f_cs:   dbg(DEBUG_INIT, "freeing cs");
-        up(&cs->sem);
+f_cs:   gig_dbg(DEBUG_INIT, "freeing cs");
+        mutex_unlock(&cs->mutex);
         free_cs(cs);
 }
 EXPORT_SYMBOL_GPL(gigaset_freecs);
 
 void gigaset_at_init(struct at_state_t *at_state, struct bc_state *bcs,
-                     struct cardstate *cs, int cid)
+                     struct cardstate *cs, int cid)
 {
         int i;
 
@@ -482,8 +510,8 @@ void gigaset_at_init(struct at_state_t *at_state, struct bc_state *bcs,
         at_state->pending_commands = 0;
         at_state->timer_expires = 0;
         at_state->timer_active = 0;
-        atomic_set(&at_state->timer_index, 0);
-        atomic_set(&at_state->seq_index, 0);
+        at_state->timer_index = 0;
+        at_state->seq_index = 0;
         at_state->ConState = 0;
         for (i = 0; i < STR_NUM; ++i)
                 at_state->str_var[i] = NULL;
@@ -501,7 +529,7 @@ void gigaset_at_init(struct at_state_t *at_state, struct bc_state *bcs,
 
 
 static void gigaset_inbuf_init(struct inbuf_t *inbuf, struct bc_state *bcs,
-                               struct cardstate *cs, int inputstate)
+                               struct cardstate *cs, int inputstate)
 /* inbuf->read must be allocated before! */
 {
         atomic_set(&inbuf->head, 0);
@@ -512,9 +540,50 @@ static void gigaset_inbuf_init(struct inbuf_t *inbuf, struct bc_state *bcs,
         inbuf->inputstate = inputstate;
 }
 
+/* append received bytes to inbuf */
+int gigaset_fill_inbuf(struct inbuf_t *inbuf, const unsigned char *src,
+                       unsigned numbytes)
+{
+        unsigned n, head, tail, bytesleft;
+
+        gig_dbg(DEBUG_INTR, "received %u bytes", numbytes);
+
+        if (!numbytes)
+                return 0;
+
+        bytesleft = numbytes;
+        tail = atomic_read(&inbuf->tail);
+        head = atomic_read(&inbuf->head);
+        gig_dbg(DEBUG_INTR, "buffer state: %u -> %u", head, tail);
+
+        while (bytesleft) {
+                if (head > tail)
+                        n = head - 1 - tail;
+                else if (head == 0)
+                        n = (RBUFSIZE-1) - tail;
+                else
+                        n = RBUFSIZE - tail;
+                if (!n) {
+                        dev_err(inbuf->cs->dev,
+                                "buffer overflow (%u bytes lost)", bytesleft);
+                        break;
+                }
+                if (n > bytesleft)
+                        n = bytesleft;
+                memcpy(inbuf->data + tail, src, n);
+                bytesleft -= n;
+                tail = (tail + n) % RBUFSIZE;
+                src += n;
+        }
+        gig_dbg(DEBUG_INTR, "setting tail to %u", tail);
+        atomic_set(&inbuf->tail, tail);
+        return numbytes != bytesleft;
+}
+EXPORT_SYMBOL_GPL(gigaset_fill_inbuf);
+
 /* Initialize the b-channel structure */
 static struct bc_state *gigaset_initbcs(struct bc_state *bcs,
-                                        struct cardstate *cs, int channel)
+                                        struct cardstate *cs, int channel)
 {
         int i;
 
@@ -526,7 +595,7 @@ static struct bc_state *gigaset_initbcs(struct bc_state *bcs,
         bcs->trans_down = 0;
         bcs->trans_up = 0;
 
-        dbg(DEBUG_INIT, "setting up bcs[%d]->at_state", channel);
+        gig_dbg(DEBUG_INIT, "setting up bcs[%d]->at_state", channel);
         gigaset_at_init(&bcs->at_state, bcs, cs, -1);
 
         bcs->rcvbytes = 0;
@@ -535,7 +604,7 @@ static struct bc_state *gigaset_initbcs(struct bc_state *bcs,
         bcs->emptycount = 0;
 #endif
 
-        dbg(DEBUG_INIT, "allocating bcs[%d]->skb", channel);
+        gig_dbg(DEBUG_INIT, "allocating bcs[%d]->skb", channel);
         bcs->fcs = PPP_INITFCS;
         bcs->inputstate = 0;
         if (cs->ignoreframes) {
@@ -544,7 +613,7 @@ static struct bc_state *gigaset_initbcs(struct bc_state *bcs,
         } else if ((bcs->skb = dev_alloc_skb(SBUFSIZE + HW_HDR_LEN)) != NULL)
                 skb_reserve(bcs->skb, HW_HDR_LEN);
         else {
-                warn("could not allocate skb");
+                dev_warn(cs->dev, "could not allocate skb\n");
                 bcs->inputstate |= INS_skip_frame;
         }
 
@@ -559,14 +628,13 @@ static struct bc_state *gigaset_initbcs(struct bc_state *bcs,
         for (i = 0; i < AT_NUM; ++i)
                 bcs->commands[i] = NULL;
 
-        dbg(DEBUG_INIT, "  setting up bcs[%d]->hw", channel);
+        gig_dbg(DEBUG_INIT, "  setting up bcs[%d]->hw", channel);
         if (cs->ops->initbcshw(bcs))
                 return bcs;
 
-//error:
-        dbg(DEBUG_INIT, "  failed");
+        gig_dbg(DEBUG_INIT, "  failed");
 
-        dbg(DEBUG_INIT, "  freeing bcs[%d]->skb", channel);
+        gig_dbg(DEBUG_INIT, "  freeing bcs[%d]->skb", channel);
         if (bcs->skb)
                 dev_kfree_skb(bcs->skb);
 
@@ -578,9 +646,10 @@ static struct bc_state *gigaset_initbcs(struct bc_state *bcs,
  * Calls hardware dependent gigaset_initcshw() function
  * Calls B channel initialization function gigaset_initbcs() for each B channel
  * parameters:
- *      drv             hardware driver the device belongs to
+ *      drv             hardware driver the device belongs to
  *      channels        number of B channels supported by device
- *      onechannel      !=0: B channel data and AT commands share one communication channel
+ *      onechannel      !=0: B channel data and AT commands share one
+ *                           communication channel
  *                      ==0: B channels have separate communication channels
  *      ignoreframes    number of frames to ignore after setting up B channel
  *      cidmode         !=0: start in CallID mode
@@ -593,17 +662,18 @@ struct cardstate *gigaset_initcs(struct gigaset_driver *drv, int channels,
                                  int cidmode, const char *modulename)
 {
         struct cardstate *cs = NULL;
+        unsigned long flags;
         int i;
 
-        dbg(DEBUG_INIT, "allocating cs");
+        gig_dbg(DEBUG_INIT, "allocating cs");
         cs = alloc_cs(drv);
         if (!cs)
                 goto error;
-        dbg(DEBUG_INIT, "allocating bcs[0..%d]", channels - 1);
+        gig_dbg(DEBUG_INIT, "allocating bcs[0..%d]", channels - 1);
         cs->bcs = kmalloc(channels * sizeof(struct bc_state), GFP_KERNEL);
         if (!cs->bcs)
                 goto error;
-        dbg(DEBUG_INIT, "allocating inbuf");
+        gig_dbg(DEBUG_INIT, "allocating inbuf");
         cs->inbuf = kmalloc(sizeof(struct inbuf_t), GFP_KERNEL);
         if (!cs->inbuf)
                 goto error;
@@ -613,19 +683,23 @@ struct cardstate *gigaset_initcs(struct gigaset_driver *drv, int channels,
         cs->onechannel = onechannel;
         cs->ignoreframes = ignoreframes;
         INIT_LIST_HEAD(&cs->temp_at_states);
-        atomic_set(&cs->running, 0);
+        cs->running = 0;
         init_timer(&cs->timer); /* clear next & prev */
         spin_lock_init(&cs->ev_lock);
-        atomic_set(&cs->ev_tail, 0);
-        atomic_set(&cs->ev_head, 0);
-        init_MUTEX_LOCKED(&cs->sem);
-        tasklet_init(&cs->event_tasklet, &gigaset_handle_event, (unsigned long) cs);
+        cs->ev_tail = 0;
+        cs->ev_head = 0;
+        mutex_init(&cs->mutex);
+        mutex_lock(&cs->mutex);
+
+        tasklet_init(&cs->event_tasklet, &gigaset_handle_event,
+                     (unsigned long) cs);
         atomic_set(&cs->commands_pending, 0);
         cs->cur_at_seq = 0;
         cs->gotfwver = -1;
         cs->open_count = 0;
+        cs->dev = NULL;
         cs->tty = NULL;
-        atomic_set(&cs->cidmode, cidmode != 0);
+        cs->cidmode = cidmode != 0;
 
         //if(onechannel) { //FIXME
                 cs->tabnocid = gigaset_tab_nocid_m10x;
@@ -642,50 +716,43 @@ struct cardstate *gigaset_initcs(struct gigaset_driver *drv, int channels,
         atomic_set(&cs->mstate, MS_UNINITIALIZED);
 
         for (i = 0; i < channels; ++i) {
-                dbg(DEBUG_INIT, "setting up bcs[%d].read", i);
+                gig_dbg(DEBUG_INIT, "setting up bcs[%d].read", i);
                 if (!gigaset_initbcs(cs->bcs + i, cs, i))
                         goto error;
         }
 
         ++cs->cs_init;
 
-        dbg(DEBUG_INIT, "setting up at_state");
+        gig_dbg(DEBUG_INIT, "setting up at_state");
         spin_lock_init(&cs->lock);
         gigaset_at_init(&cs->at_state, NULL, cs, 0);
         cs->dle = 0;
         cs->cbytes = 0;
 
-        dbg(DEBUG_INIT, "setting up inbuf");
+        gig_dbg(DEBUG_INIT, "setting up inbuf");
         if (onechannel) {                       //FIXME distinction necessary?
                 gigaset_inbuf_init(cs->inbuf, cs->bcs, cs, INS_command);
         } else
                 gigaset_inbuf_init(cs->inbuf, NULL,    cs, INS_command);
 
-        atomic_set(&cs->connected, 0);
+        cs->connected = 0;
+        cs->isdn_up = 0;
 
-        dbg(DEBUG_INIT, "setting up cmdbuf");
+        gig_dbg(DEBUG_INIT, "setting up cmdbuf");
         cs->cmdbuf = cs->lastcmdbuf = NULL;
         spin_lock_init(&cs->cmdlock);
         cs->curlen = 0;
         cs->cmdbytes = 0;
 
-        /*
-         * Tell the ISDN4Linux subsystem (the LL) that
-         * a driver for a USB-Device is available !
-         * If this is done, "isdnctrl" is able to bind a device for this driver even
-         * if no physical usb-device is currently connected.
-         * But this device will just be accessable if a physical USB device is connected
-         * (via "gigaset_probe") .
-         */
-        dbg(DEBUG_INIT, "setting up iif");
+        gig_dbg(DEBUG_INIT, "setting up iif");
         if (!gigaset_register_to_LL(cs, modulename)) {
-                err("register_isdn=>error");
+                err("register_isdn failed");
                 goto error;
         }
 
         make_valid(cs, VALID_ID);
         ++cs->cs_init;
-        dbg(DEBUG_INIT, "setting up hw");
+        gig_dbg(DEBUG_INIT, "setting up hw");
         if (!cs->ops->initcshw(cs))
                 goto error;
 
@@ -693,27 +760,29 @@ struct cardstate *gigaset_initcs(struct gigaset_driver *drv, int channels,
 
         gigaset_if_init(cs);
 
-        atomic_set(&cs->running, 1);
-        cs->timer.data = (unsigned long) cs;
-        cs->timer.function = timer_tick;
-        cs->timer.expires = jiffies + GIG_TICK;
+        spin_lock_irqsave(&cs->lock, flags);
+        cs->running = 1;
+        spin_unlock_irqrestore(&cs->lock, flags);
+        setup_timer(&cs->timer, timer_tick, (unsigned long) cs);
+        cs->timer.expires = jiffies + msecs_to_jiffies(GIG_TICK);
         /* FIXME: can jiffies increase too much until the timer is added?
          * Same problem(?) with mod_timer() in timer_tick(). */
         add_timer(&cs->timer);
 
-        dbg(DEBUG_INIT, "cs initialized!");
-        up(&cs->sem);
+        gig_dbg(DEBUG_INIT, "cs initialized");
+        mutex_unlock(&cs->mutex);
         return cs;
 
 error:  if (cs)
-                up(&cs->sem);
-        dbg(DEBUG_INIT, "failed");
+                mutex_unlock(&cs->mutex);
+        gig_dbg(DEBUG_INIT, "failed");
         gigaset_freecs(cs);
         return NULL;
 }
 EXPORT_SYMBOL_GPL(gigaset_initcs);
 
-/* ReInitialize the b-channel structure */ /* e.g. called on hangup, disconnect */
+/* ReInitialize the b-channel structure */
+/* e.g. called on hangup, disconnect */
 void gigaset_bcs_reinit(struct bc_state *bcs)
 {
         struct sk_buff *skb;
@@ -723,12 +792,12 @@ void gigaset_bcs_reinit(struct bc_state *bcs)
         while ((skb = skb_dequeue(&bcs->squeue)) != NULL)
                 dev_kfree_skb(skb);
 
-        spin_lock_irqsave(&cs->lock, flags); //FIXME
+        spin_lock_irqsave(&cs->lock, flags);
         clear_at_state(&bcs->at_state);
         bcs->at_state.ConState = 0;
         bcs->at_state.timer_active = 0;
         bcs->at_state.timer_expires = 0;
-        bcs->at_state.cid = -1;                     /* No CID defined */
+        bcs->at_state.cid = -1;                 /* No CID defined */
         spin_unlock_irqrestore(&cs->lock, flags);
 
         bcs->inputstate = 0;
@@ -803,11 +872,14 @@ static void cleanup_cs(struct cardstate *cs)
 
 int gigaset_start(struct cardstate *cs)
 {
-        if (down_interruptible(&cs->sem))
+        unsigned long flags;
+
+        if (mutex_lock_interruptible(&cs->mutex))
                 return 0;
-        //info("USB device for Gigaset 307x now attached to Dev %d", ucs->minor);
 
-        atomic_set(&cs->connected, 1);
+        spin_lock_irqsave(&cs->lock, flags);
+        cs->connected = 1;
+        spin_unlock_irqrestore(&cs->lock, flags);
 
         if (atomic_read(&cs->mstate) != MS_LOCKED) {
                 cs->ops->set_modem_ctrl(cs, 0, TIOCM_DTR|TIOCM_RTS);
@@ -826,23 +898,26 @@ int gigaset_start(struct cardstate *cs)
                 goto error;
         }
 
-        dbg(DEBUG_CMD, "scheduling START");
+        gig_dbg(DEBUG_CMD, "scheduling START");
         gigaset_schedule_event(cs);
 
         wait_event(cs->waitqueue, !cs->waiting);
 
-        up(&cs->sem);
+        /* set up device sysfs */
+        gigaset_init_dev_sysfs(cs);
+
+        mutex_unlock(&cs->mutex);
         return 1;
 
 error:
-        up(&cs->sem);
+        mutex_unlock(&cs->mutex);
         return 0;
 }
 EXPORT_SYMBOL_GPL(gigaset_start);
 
 void gigaset_shutdown(struct cardstate *cs)
 {
-        down(&cs->sem);
+        mutex_lock(&cs->mutex);
 
         cs->waiting = 1;
 
@@ -851,11 +926,11 @@ void gigaset_shutdown(struct cardstate *cs)
                 goto exit;
         }
 
-        dbg(DEBUG_CMD, "scheduling SHUTDOWN");
+        gig_dbg(DEBUG_CMD, "scheduling SHUTDOWN");
         gigaset_schedule_event(cs);
 
         if (wait_event_interruptible(cs->waitqueue, !cs->waiting)) {
-                warn("aborted");
+                warn("%s: aborted", __func__);
                 //FIXME
         }
 
@@ -872,15 +947,13 @@ void gigaset_shutdown(struct cardstate *cs)
         cleanup_cs(cs);
 
 exit:
-        up(&cs->sem);
+        mutex_unlock(&cs->mutex);
 }
 EXPORT_SYMBOL_GPL(gigaset_shutdown);
 
 void gigaset_stop(struct cardstate *cs)
 {
-        down(&cs->sem);
-
-        atomic_set(&cs->connected, 0);
+        mutex_lock(&cs->mutex);
 
         cs->waiting = 1;
 
@@ -889,21 +962,21 @@ void gigaset_stop(struct cardstate *cs)
                 goto exit;
         }
 
-        dbg(DEBUG_CMD, "scheduling STOP");
+        gig_dbg(DEBUG_CMD, "scheduling STOP");
         gigaset_schedule_event(cs);
 
         if (wait_event_interruptible(cs->waitqueue, !cs->waiting)) {
-                warn("aborted");
+                warn("%s: aborted", __func__);
                 //FIXME
         }
 
-        /* Tell the LL that the device is not available .. */
-        gigaset_i4l_cmd(cs, ISDN_STAT_STOP); // FIXME move to event layer?
+        /* clear device sysfs */
+        gigaset_free_dev_sysfs(cs);
 
         cleanup_cs(cs);
 
 exit:
-        up(&cs->sem);
+        mutex_unlock(&cs->mutex);
 }
 EXPORT_SYMBOL_GPL(gigaset_stop);
 
@@ -947,31 +1020,25 @@ void gigaset_debugdrivers(void)
 
         spin_lock_irqsave(&driver_lock, flags);
         list_for_each_entry(drv, &drivers, list) {
-                dbg(DEBUG_DRIVER, "driver %p", drv);
+                gig_dbg(DEBUG_DRIVER, "driver %p", drv);
                 spin_lock(&drv->lock);
                 for (i = 0; i < drv->minors; ++i) {
-                        dbg(DEBUG_DRIVER, "  index %u", i);
-                        dbg(DEBUG_DRIVER, "    flags 0x%02x", drv->flags[i]);
+                        gig_dbg(DEBUG_DRIVER, "  index %u", i);
+                        gig_dbg(DEBUG_DRIVER, "    flags 0x%02x",
+                                drv->flags[i]);
                         cs = drv->cs + i;
-                        dbg(DEBUG_DRIVER, "    cardstate %p", cs);
-                        dbg(DEBUG_DRIVER, "    minor_index %u", cs->minor_index);
-                        dbg(DEBUG_DRIVER, "    driver %p", cs->driver);
-                        dbg(DEBUG_DRIVER, "    i4l id %d", cs->myid);
+                        gig_dbg(DEBUG_DRIVER, "    cardstate %p", cs);
+                        gig_dbg(DEBUG_DRIVER, "    minor_index %u",
+                                cs->minor_index);
+                        gig_dbg(DEBUG_DRIVER, "    driver %p", cs->driver);
+                        gig_dbg(DEBUG_DRIVER, "    i4l id %d", cs->myid);
                 }
                 spin_unlock(&drv->lock);
         }
         spin_unlock_irqrestore(&driver_lock, flags);
 }
-EXPORT_SYMBOL_GPL(gigaset_debugdrivers);
-
-struct cardstate *gigaset_get_cs_by_tty(struct tty_struct *tty)
-{
-        if (tty->index < 0 || tty->index >= tty->driver->num)
-                return NULL;
-        return gigaset_get_cs_by_minor(tty->index + tty->driver->minor_start);
-}
 
-struct cardstate *gigaset_get_cs_by_minor(unsigned minor)
+static struct cardstate *gigaset_get_cs_by_minor(unsigned minor)
 {
         unsigned long flags;
         static struct cardstate *ret = NULL;
@@ -994,6 +1061,13 @@ struct cardstate *gigaset_get_cs_by_minor(unsigned minor)
         return ret;
 }
 
+struct cardstate *gigaset_get_cs_by_tty(struct tty_struct *tty)
+{
+        if (tty->index < 0 || tty->index >= tty->driver->num)
+                return NULL;
+        return gigaset_get_cs_by_minor(tty->index + tty->driver->minor_start);
+}
+
 void gigaset_freedriver(struct gigaset_driver *drv)
 {
         unsigned long flags;
@@ -1014,20 +1088,20 @@ EXPORT_SYMBOL_GPL(gigaset_freedriver);
 /* gigaset_initdriver
  * Allocate and initialize gigaset_driver structure. Initialize interface.
  * parameters:
- *      minor           First minor number
- *      minors          Number of minors this driver can handle
- *      procname        Name of the driver (e.g. for /proc/tty/drivers, path in /proc/driver)
- *      devname         Name of the device files (prefix without minor number)
- *      devfsname       Devfs name of the device files without %d
+ *      minor           First minor number
+ *      minors          Number of minors this driver can handle
+ *      procname        Name of the driver
+ *      devname         Name of the device files (prefix without minor number)
+ *      devfsname       Devfs name of the device files without %d
  * return value:
- *      Pointer to the gigaset_driver structure on success, NULL on failure.
+ *      Pointer to the gigaset_driver structure on success, NULL on failure.
  */
 struct gigaset_driver *gigaset_initdriver(unsigned minor, unsigned minors,
-                                          const char *procname,
-                                          const char *devname,
-                                          const char *devfsname,
-                                          const struct gigaset_ops *ops,
-                                          struct module *owner)
+                                          const char *procname,
+                                          const char *devname,
+                                          const char *devfsname,
+                                          const struct gigaset_ops *ops,
+                                          struct module *owner)
 {
         struct gigaset_driver *drv;
         unsigned long flags;
@@ -1036,8 +1110,9 @@ struct gigaset_driver *gigaset_initdriver(unsigned minor, unsigned minors,
         drv = kmalloc(sizeof *drv, GFP_KERNEL);
         if (!drv)
                 return NULL;
+
         if (!try_module_get(owner))
-                return NULL;
+                goto out1;
 
         drv->cs = NULL;
         drv->have_tty = 0;
@@ -1051,10 +1126,11 @@ struct gigaset_driver *gigaset_initdriver(unsigned minor, unsigned minors,
 
         drv->cs = kmalloc(minors * sizeof *drv->cs, GFP_KERNEL);
         if (!drv->cs)
-                goto out1;
+                goto out2;
+
         drv->flags = kmalloc(minors * sizeof *drv->flags, GFP_KERNEL);
         if (!drv->flags)
-                goto out2;
+                goto out3;
 
         for (i = 0; i < minors; ++i) {
                 drv->flags[i] = 0;
@@ -1071,61 +1147,16 @@ struct gigaset_driver *gigaset_initdriver(unsigned minor, unsigned minors,
 
         return drv;
 
-out2:
+out3:
         kfree(drv->cs);
+out2:
+        module_put(owner);
 out1:
         kfree(drv);
-        module_put(owner);
         return NULL;
 }
 EXPORT_SYMBOL_GPL(gigaset_initdriver);
 
-static struct cardstate *alloc_cs(struct gigaset_driver *drv)
-{
-        unsigned long flags;
-        unsigned i;
-        static struct cardstate *ret = NULL;
-
-        spin_lock_irqsave(&drv->lock, flags);
-        for (i = 0; i < drv->minors; ++i) {
-                if (!(drv->flags[i] & VALID_MINOR)) {
-                        drv->flags[i] = VALID_MINOR;
-                        ret = drv->cs + i;
-                }
-                if (ret)
-                        break;
-        }
-        spin_unlock_irqrestore(&drv->lock, flags);
-        return ret;
-}
-
-static void free_cs(struct cardstate *cs)
-{
-        unsigned long flags;
-        struct gigaset_driver *drv = cs->driver;
-        spin_lock_irqsave(&drv->lock, flags);
-        drv->flags[cs->minor_index] = 0;
-        spin_unlock_irqrestore(&drv->lock, flags);
-}
-
-static void make_valid(struct cardstate *cs, unsigned mask)
-{
-        unsigned long flags;
-        struct gigaset_driver *drv = cs->driver;
-        spin_lock_irqsave(&drv->lock, flags);
-        drv->flags[cs->minor_index] |= mask;
-        spin_unlock_irqrestore(&drv->lock, flags);
-}
-
-static void make_invalid(struct cardstate *cs, unsigned mask)
-{
-        unsigned long flags;
-        struct gigaset_driver *drv = cs->driver;
-        spin_lock_irqsave(&drv->lock, flags);
-        drv->flags[cs->minor_index] &= ~mask;
-        spin_unlock_irqrestore(&drv->lock, flags);
-}
-
 /* For drivers without fixed assignment device<->cardstate (usb) */
 struct cardstate *gigaset_getunassignedcs(struct gigaset_driver *drv)
 {
diff --git a/drivers/isdn/gigaset/ev-layer.c b/drivers/isdn/gigaset/ev-layer.c
index fdcb80bb21c7..1ba3424a286b 100644
--- a/drivers/isdn/gigaset/ev-layer.c
+++ b/drivers/isdn/gigaset/ev-layer.c
@@ -1,7 +1,7 @@
 /*
  * Stuff used by all variants of the driver
  *
- * Copyright (c) 2001 by Stefan Eilers <Eilers.Stefan@epost.de>,
+ * Copyright (c) 2001 by Stefan Eilers,
  *                       Hansjoerg Lipp <hjlipp@web.de>,
  *                       Tilman Schmidt <tilman@imap.cc>.
  *
@@ -11,82 +11,78 @@
  *      published by the Free Software Foundation; either version 2 of
  *      the License, or (at your option) any later version.
  * =====================================================================
- * ToDo: ...
- * =====================================================================
- * Version: $Id: ev-layer.c,v 1.4.2.18 2006/02/04 18:28:16 hjlipp Exp $
- * =====================================================================
  */
 
 #include "gigaset.h"
 
 /* ========================================================== */
 /* bit masks for pending commands */
-#define PC_INIT       0x004
-#define PC_DLE0       0x008
-#define PC_DLE1       0x010
-#define PC_CID        0x080
-#define PC_NOCID      0x100
-#define PC_HUP        0x002
-#define PC_DIAL       0x001
-#define PC_ACCEPT     0x040
-#define PC_SHUTDOWN   0x020
-#define PC_CIDMODE    0x200
-#define PC_UMMODE     0x400
+#define PC_DIAL         0x001
+#define PC_HUP          0x002
+#define PC_INIT         0x004
+#define PC_DLE0         0x008
+#define PC_DLE1         0x010
+#define PC_SHUTDOWN     0x020
+#define PC_ACCEPT       0x040
+#define PC_CID          0x080
+#define PC_NOCID        0x100
+#define PC_CIDMODE      0x200
+#define PC_UMMODE       0x400
 
 /* types of modem responses */
-#define RT_NOTHING 0
-#define RT_ZSAU    1
-#define RT_RING    2
-#define RT_NUMBER  3
-#define RT_STRING  4
-#define RT_HEX     5
-#define RT_ZCAU    6
+#define RT_NOTHING      0
+#define RT_ZSAU         1
+#define RT_RING         2
+#define RT_NUMBER       3
+#define RT_STRING       4
+#define RT_HEX          5
+#define RT_ZCAU         6
 
 /* Possible ASCII responses */
-#define RSP_OK           0
-//#define RSP_BUSY       1
-//#define RSP_CONNECT    2
-#define RSP_ZGCI         3
-#define RSP_RING         4
-#define RSP_ZAOC         5
-#define RSP_ZCSTR        6
-#define RSP_ZCFGT        7
-#define RSP_ZCFG         8
-#define RSP_ZCCR         9
-#define RSP_EMPTY        10
-#define RSP_ZLOG         11
-#define RSP_ZCAU         12
-#define RSP_ZMWI         13
-#define RSP_ZABINFO      14
-#define RSP_ZSMLSTCHG    15
-#define RSP_VAR          100
-#define RSP_ZSAU         (RSP_VAR + VAR_ZSAU)
-#define RSP_ZDLE         (RSP_VAR + VAR_ZDLE)
-#define RSP_ZVLS         (RSP_VAR + VAR_ZVLS)
-#define RSP_ZCTP         (RSP_VAR + VAR_ZCTP)
-#define RSP_STR          (RSP_VAR + VAR_NUM)
-#define RSP_NMBR         (RSP_STR + STR_NMBR)
-#define RSP_ZCPN         (RSP_STR + STR_ZCPN)
-#define RSP_ZCON         (RSP_STR + STR_ZCON)
-#define RSP_ZBC          (RSP_STR + STR_ZBC)
-#define RSP_ZHLC         (RSP_STR + STR_ZHLC)
-#define RSP_ERROR       -1       /* ERROR              */
-#define RSP_WRONG_CID   -2       /* unknown cid in cmd */
-//#define RSP_EMPTY     -3
-#define RSP_UNKNOWN     -4       /* unknown response   */
-#define RSP_FAIL        -5       /* internal error     */
-#define RSP_INVAL       -6       /* invalid response   */
-
-#define RSP_NONE        -19
-#define RSP_STRING      -20
-#define RSP_NULL        -21
-//#define RSP_RETRYFAIL -22
-//#define RSP_RETRY     -23
-//#define RSP_SKIP      -24
-#define RSP_INIT        -27
-#define RSP_ANY         -26
-#define RSP_LAST        -28
-#define RSP_NODEV       -9
+#define RSP_OK          0
+//#define RSP_BUSY      1
+//#define RSP_CONNECT   2
+#define RSP_ZGCI        3
+#define RSP_RING        4
+#define RSP_ZAOC        5
+#define RSP_ZCSTR       6
+#define RSP_ZCFGT       7
+#define RSP_ZCFG        8
+#define RSP_ZCCR        9
+#define RSP_EMPTY       10
+#define RSP_ZLOG        11
+#define RSP_ZCAU        12
+#define RSP_ZMWI        13
+#define RSP_ZABINFO     14
+#define RSP_ZSMLSTCHG   15
+#define RSP_VAR         100
+#define RSP_ZSAU        (RSP_VAR + VAR_ZSAU)
+#define RSP_ZDLE        (RSP_VAR + VAR_ZDLE)
+#define RSP_ZVLS        (RSP_VAR + VAR_ZVLS)
+#define RSP_ZCTP        (RSP_VAR + VAR_ZCTP)
+#define RSP_STR         (RSP_VAR + VAR_NUM)
+#define RSP_NMBR        (RSP_STR + STR_NMBR)
+#define RSP_ZCPN        (RSP_STR + STR_ZCPN)
+#define RSP_ZCON        (RSP_STR + STR_ZCON)
+#define RSP_ZBC         (RSP_STR + STR_ZBC)
+#define RSP_ZHLC        (RSP_STR + STR_ZHLC)
+#define RSP_ERROR       -1      /* ERROR              */
+#define RSP_WRONG_CID   -2      /* unknown cid in cmd */
+//#define RSP_EMPTY     -3
+#define RSP_UNKNOWN     -4      /* unknown response   */
+#define RSP_FAIL        -5      /* internal error     */
+#define RSP_INVAL       -6      /* invalid response   */
+
+#define RSP_NONE        -19
+#define RSP_STRING      -20
+#define RSP_NULL        -21
+//#define RSP_RETRYFAIL -22
+//#define RSP_RETRY     -23
+//#define RSP_SKIP      -24
+#define RSP_INIT        -27
+#define RSP_ANY         -26
+#define RSP_LAST        -28
+#define RSP_NODEV       -9
 
 /* actions for process_response */
 #define ACT_NOTHING             0
@@ -112,7 +108,7 @@
 #define ACT_DISCONNECT          20
 #define ACT_CONNECT             21
 #define ACT_REMOTEREJECT        22
-#define ACT_CONNTIMEOUT         23
+#define ACT_CONNTIMEOUT         23
 #define ACT_REMOTEHUP           24
 #define ACT_ABORTHUP            25
 #define ACT_ICALL               26
@@ -127,40 +123,40 @@
 #define ACT_ERROR               35
 #define ACT_ABORTCID            36
 #define ACT_ZCAU                37
-#define ACT_NOTIFY_BC_DOWN      38
-#define ACT_NOTIFY_BC_UP        39
-#define ACT_DIAL                40
-#define ACT_ACCEPT              41
-#define ACT_PROTO_L2            42
-#define ACT_HUP                 43
-#define ACT_IF_LOCK             44
-#define ACT_START               45
-#define ACT_STOP                46
-#define ACT_FAKEDLE0            47
-#define ACT_FAKEHUP             48
-#define ACT_FAKESDOWN           49
-#define ACT_SHUTDOWN            50
-#define ACT_PROC_CIDMODE        51
-#define ACT_UMODESET            52
-#define ACT_FAILUMODE           53
-#define ACT_CMODESET            54
-#define ACT_FAILCMODE           55
-#define ACT_IF_VER              56
+#define ACT_NOTIFY_BC_DOWN      38
+#define ACT_NOTIFY_BC_UP        39
+#define ACT_DIAL                40
+#define ACT_ACCEPT              41
+#define ACT_PROTO_L2            42
+#define ACT_HUP                 43
+#define ACT_IF_LOCK             44
+#define ACT_START               45
+#define ACT_STOP                46
+#define ACT_FAKEDLE0            47
+#define ACT_FAKEHUP             48
+#define ACT_FAKESDOWN           49
+#define ACT_SHUTDOWN            50
+#define ACT_PROC_CIDMODE        51
+#define ACT_UMODESET            52
+#define ACT_FAILUMODE           53
+#define ACT_CMODESET            54
+#define ACT_FAILCMODE           55
+#define ACT_IF_VER              56
 #define ACT_CMD                 100
 
 /* at command sequences */
-#define SEQ_NONE      0
-#define SEQ_INIT      100
-#define SEQ_DLE0      200
-#define SEQ_DLE1      250
-#define SEQ_CID       300
-#define SEQ_NOCID     350
-#define SEQ_HUP       400
-#define SEQ_DIAL      600
-#define SEQ_ACCEPT    720
-#define SEQ_SHUTDOWN  500
-#define SEQ_CIDMODE   10
-#define SEQ_UMMODE    11
+#define SEQ_NONE        0
+#define SEQ_INIT        100
+#define SEQ_DLE0        200
+#define SEQ_DLE1        250
+#define SEQ_CID         300
+#define SEQ_NOCID       350
+#define SEQ_HUP         400
+#define SEQ_DIAL        600
+#define SEQ_ACCEPT      720
+#define SEQ_SHUTDOWN    500
+#define SEQ_CIDMODE     10
+#define SEQ_UMMODE      11
 
 
 // 100: init, 200: dle0, 250:dle1, 300: get cid (dial), 350: "hup" (no cid), 400: hup, 500: reset, 600: dial, 700: ring
@@ -175,7 +171,7 @@ struct reply_t gigaset_tab_nocid_m10x[]= /* with dle mode */
         //                                                  {ACT_TIMEOUT}},
 
         {RSP_INIT,     -1, -1,SEQ_INIT,           100, INIT_TIMEOUT,
-                                                          {ACT_TIMEOUT}},                /* wait until device is ready */
+                                                          {ACT_TIMEOUT}},                /* wait until device is ready */
 
         {EV_TIMEOUT,  100,100, -1,                101, 3, {0},             "Z\r"},       /* device in transparent mode? try to initialize it. */
         {RSP_OK,      101,103, -1,                120, 5, {ACT_GETSTRING}, "+GMR\r"},    /* get version */
@@ -190,8 +186,8 @@ struct reply_t gigaset_tab_nocid_m10x[]= /* with dle mode */
         {RSP_ERROR,   108,108, -1,                  0, 0, {ACT_FAILINIT}},
 
         {EV_TIMEOUT,  108,108, -1,                105, 2, {ACT_SETDLE0,
-                                                           ACT_HUPMODEM,
-                                                           ACT_TIMEOUT}},                /* still timeout => connection in unimodem mode? */
+                                                           ACT_HUPMODEM,
+                                                           ACT_TIMEOUT}},                /* still timeout => connection in unimodem mode? */
         {EV_TIMEOUT,  105,105, -1,                103, 5, {0},             "Z\r"},
 
         {RSP_ERROR,   102,102, -1,                107, 5, {0},             "^GETPRE\r"}, /* ERROR on ATZ => maybe in config mode? */
@@ -393,7 +389,7 @@ struct reply_t gigaset_tab_cid_m10x[] = /* for M10x */
 
 
 #if 0
-static struct reply_t tab_nocid[]= /* no dle mode */ //FIXME aenderungen uebernehmen
+static struct reply_t tab_nocid[]= /* no dle mode */ //FIXME
 {
         /* resp_code, min_ConState, max_ConState, parameter, new_ConState, timeout, action, command */
 
@@ -401,7 +397,7 @@ static struct reply_t tab_nocid[]= /* no dle mode */ //FIXME aenderungen ueberne
         {RSP_LAST,0,0,0,0,0,0}
 };
 
-static struct reply_t tab_cid[] = /* no dle mode */ //FIXME aenderungen uebernehmen
+static struct reply_t tab_cid[] = /* no dle mode */ //FIXME
 {
         /* resp_code, min_ConState, max_ConState, parameter, new_ConState, timeout, action, command */
 
@@ -412,30 +408,30 @@ static struct reply_t tab_cid[] = /* no dle mode */ //FIXME aenderungen ueberneh
 
 static struct resp_type_t resp_type[]=
 {
-        /*{"",          RSP_EMPTY,  RT_NOTHING},*/
-        {"OK",        RSP_OK,     RT_NOTHING},
-        {"ERROR",     RSP_ERROR,  RT_NOTHING},
-        {"ZSAU",      RSP_ZSAU,   RT_ZSAU},
-        {"ZCAU",      RSP_ZCAU,   RT_ZCAU},
-        {"RING",      RSP_RING,   RT_RING},
-        {"ZGCI",      RSP_ZGCI,   RT_NUMBER},
-        {"ZVLS",      RSP_ZVLS,   RT_NUMBER},
-        {"ZCTP",      RSP_ZCTP,   RT_NUMBER},
-        {"ZDLE",      RSP_ZDLE,   RT_NUMBER},
-        {"ZCFGT",     RSP_ZCFGT,  RT_NUMBER},
-        {"ZCCR",      RSP_ZCCR,   RT_NUMBER},
-        {"ZMWI",      RSP_ZMWI,   RT_NUMBER},
-        {"ZHLC",      RSP_ZHLC,   RT_STRING},
-        {"ZBC",       RSP_ZBC,    RT_STRING},
-        {"NMBR",      RSP_NMBR,   RT_STRING},
-        {"ZCPN",      RSP_ZCPN,   RT_STRING},
-        {"ZCON",      RSP_ZCON,   RT_STRING},
-        {"ZAOC",      RSP_ZAOC,   RT_STRING},
-        {"ZCSTR",     RSP_ZCSTR,  RT_STRING},
-        {"ZCFG",      RSP_ZCFG,   RT_HEX},
-        {"ZLOG",      RSP_ZLOG,   RT_NOTHING},
-        {"ZABINFO",   RSP_ZABINFO, RT_NOTHING},
-        {"ZSMLSTCHG", RSP_ZSMLSTCHG, RT_NOTHING},
+        /*{"",          RSP_EMPTY,      RT_NOTHING},*/
+        {"OK",          RSP_OK,         RT_NOTHING},
+        {"ERROR",       RSP_ERROR,      RT_NOTHING},
+        {"ZSAU",        RSP_ZSAU,       RT_ZSAU},
+        {"ZCAU",        RSP_ZCAU,       RT_ZCAU},
+        {"RING",        RSP_RING,       RT_RING},
+        {"ZGCI",        RSP_ZGCI,       RT_NUMBER},
+        {"ZVLS",        RSP_ZVLS,       RT_NUMBER},
+        {"ZCTP",        RSP_ZCTP,       RT_NUMBER},
+        {"ZDLE",        RSP_ZDLE,       RT_NUMBER},
+        {"ZCFGT",       RSP_ZCFGT,      RT_NUMBER},
+        {"ZCCR",        RSP_ZCCR,       RT_NUMBER},
+        {"ZMWI",        RSP_ZMWI,       RT_NUMBER},
+        {"ZHLC",        RSP_ZHLC,       RT_STRING},
+        {"ZBC",         RSP_ZBC,        RT_STRING},
+        {"NMBR",        RSP_NMBR,       RT_STRING},
+        {"ZCPN",        RSP_ZCPN,       RT_STRING},
+        {"ZCON",        RSP_ZCON,       RT_STRING},
+        {"ZAOC",        RSP_ZAOC,       RT_STRING},
+        {"ZCSTR",       RSP_ZCSTR,      RT_STRING},
+        {"ZCFG",        RSP_ZCFG,       RT_HEX},
+        {"ZLOG",        RSP_ZLOG,       RT_NOTHING},
+        {"ZABINFO",     RSP_ZABINFO,    RT_NOTHING},
+        {"ZSMLSTCHG",   RSP_ZSMLSTCHG,  RT_NOTHING},
         {NULL,0,0}
 };
 
@@ -446,9 +442,7 @@ static int isdn_getnum(char *p)
 {
         int v = -1;
 
-        IFNULLRETVAL(p, -1);
-
-        dbg(DEBUG_TRANSCMD, "string: %s", p);
+        gig_dbg(DEBUG_TRANSCMD, "string: %s", p);
 
         while (*p >= '0' && *p <= '9')
                 v = ((v < 0) ? 0 : (v * 10)) + (int) ((*p++) - '0');
@@ -465,9 +459,7 @@ static int isdn_gethex(char *p)
         int v = 0;
         int c;
 
-        IFNULLRETVAL(p, -1);
-
-        dbg(DEBUG_TRANSCMD, "string: %s", p);
+        gig_dbg(DEBUG_TRANSCMD, "string: %s", p);
 
         if (!*p)
                 return -1;
@@ -490,14 +482,6 @@ static int isdn_gethex(char *p)
         return v;
 }
 
-static inline void new_index(atomic_t *index, int max)
-{
-        if (atomic_read(index) == max)  //FIXME race?
-                atomic_set(index, 0);
-        else
-                atomic_inc(index);
-}
-
 /* retrieve CID from parsed response
  * returns 0 if no CID, -1 if invalid CID, or CID value 1..65535
  */
@@ -536,16 +520,14 @@ void gigaset_handle_modem_response(struct cardstate *cs)
         int cid;
         int rawstring;
 
-        IFNULLRET(cs);
-
         len = cs->cbytes;
         if (!len) {
                 /* ignore additional LFs/CRs (M10x config mode or cx100) */
-                dbg(DEBUG_MCMD, "skipped EOL [%02X]", cs->respdata[len]);
+                gig_dbg(DEBUG_MCMD, "skipped EOL [%02X]", cs->respdata[len]);
                 return;
         }
         cs->respdata[len] = 0;
-        dbg(DEBUG_TRANSCMD, "raw string: '%s'", cs->respdata);
+        gig_dbg(DEBUG_TRANSCMD, "raw string: '%s'", cs->respdata);
         argv[0] = cs->respdata;
         params = 1;
         if (cs->at_state.getstring) {
@@ -561,7 +543,8 @@ void gigaset_handle_modem_response(struct cardstate *cs)
                         case ',':
                         case '=':
                                 if (params > MAX_REC_PARAMS) {
-                                        warn("too many parameters in response");
+                                        dev_warn(cs->dev,
+                                           "too many parameters in response\n");
                                         /* need last parameter (might be CID) */
                                         params--;
                                 }
@@ -572,33 +555,33 @@ void gigaset_handle_modem_response(struct cardstate *cs)
                 cid = params > 1 ? cid_of_response(argv[params-1]) : 0;
                 if (cid < 0) {
                         gigaset_add_event(cs, &cs->at_state, RSP_INVAL,
-                                          NULL, 0, NULL);
+                                          NULL, 0, NULL);
                         return;
                 }
 
                 for (j = 1; j < params; ++j)
                         argv[j][-1] = 0;
 
-                dbg(DEBUG_TRANSCMD, "CMD received: %s", argv[0]);
+                gig_dbg(DEBUG_TRANSCMD, "CMD received: %s", argv[0]);
                 if (cid) {
                         --params;
-                        dbg(DEBUG_TRANSCMD, "CID: %s", argv[params]);
+                        gig_dbg(DEBUG_TRANSCMD, "CID: %s", argv[params]);
                 }
-                dbg(DEBUG_TRANSCMD, "available params: %d", params - 1);
+                gig_dbg(DEBUG_TRANSCMD, "available params: %d", params - 1);
                 for (j = 1; j < params; j++)
-                        dbg(DEBUG_TRANSCMD, "param %d: %s", j, argv[j]);
+                        gig_dbg(DEBUG_TRANSCMD, "param %d: %s", j, argv[j]);
         }
 
         spin_lock_irqsave(&cs->ev_lock, flags);
-        head = atomic_read(&cs->ev_head);
-        tail = atomic_read(&cs->ev_tail);
+        head = cs->ev_head;
+        tail = cs->ev_tail;
 
         abort = 1;
         curarg = 0;
         while (curarg < params) {
                 next = (tail + 1) % MAX_EVENTS;
                 if (unlikely(next == head)) {
-                        err("event queue full");
+                        dev_err(cs->dev, "event queue full\n");
                         break;
                 }
 
@@ -619,8 +602,9 @@ void gigaset_handle_modem_response(struct cardstate *cs)
 
                         if (!rt->response) {
                                 event->type = RSP_UNKNOWN;
-                                warn("unknown modem response: %s",
-                                     argv[curarg]);
+                                dev_warn(cs->dev,
+                                         "unknown modem response: %s\n",
+                                         argv[curarg]);
                                 break;
                         }
 
@@ -636,7 +620,8 @@ void gigaset_handle_modem_response(struct cardstate *cs)
                         break;
                 case RT_RING:
                         if (!cid) {
-                                err("received RING without CID!");
+                                dev_err(cs->dev,
+                                        "received RING without CID!\n");
                                 event->type = RSP_INVAL;
                                 abort = 1;
                         } else {
@@ -664,27 +649,25 @@ void gigaset_handle_modem_response(struct cardstate *cs)
                                 event->parameter = ZSAU_DISCONNECT_REQ;
                         else {
                                 event->parameter = ZSAU_UNKNOWN;
-                                warn("%s: unknown parameter %s after ZSAU",
-                                     __func__, argv[curarg]);
+                                dev_warn(cs->dev,
+                                        "%s: unknown parameter %s after ZSAU\n",
+                                         __func__, argv[curarg]);
                         }
                         ++curarg;
                         break;
                 case RT_STRING:
                         if (curarg < params) {
-                                len = strlen(argv[curarg]) + 1;
-                                event->ptr = kmalloc(len, GFP_ATOMIC);
-                                if (event->ptr)
-                                        memcpy(event->ptr, argv[curarg], len);
-                                else
-                                        err("no memory for string!");
+                                event->ptr = kstrdup(argv[curarg], GFP_ATOMIC);
+                                if (!event->ptr)
+                                        dev_err(cs->dev, "out of memory\n");
                                 ++curarg;
                         }
 #ifdef CONFIG_GIGASET_DEBUG
                         if (!event->ptr)
-                                dbg(DEBUG_CMD, "string==NULL");
+                                gig_dbg(DEBUG_CMD, "string==NULL");
                         else
-                                dbg(DEBUG_CMD,
-                                    "string==%s", (char *) event->ptr);
+                                gig_dbg(DEBUG_CMD, "string==%s",
+                                        (char *) event->ptr);
 #endif
                         break;
                 case RT_ZCAU:
@@ -694,7 +677,7 @@ void gigaset_handle_modem_response(struct cardstate *cs)
                                 j = isdn_gethex(argv[curarg + 1]);
                                 if (i >= 0 && i < 256 && j >= 0 && j < 256)
                                         event->parameter = (unsigned) i << 8
-                                                           | j;
+                                                           | j;
                                 curarg += 2;
                         } else
                                 curarg = params - 1;
@@ -712,7 +695,7 @@ void gigaset_handle_modem_response(struct cardstate *cs)
                         } else
                                 event->parameter = -1;
 #ifdef CONFIG_GIGASET_DEBUG
-                        dbg(DEBUG_CMD, "parameter==%d", event->parameter);
+                        gig_dbg(DEBUG_CMD, "parameter==%d", event->parameter);
 #endif
                         break;
                 }
@@ -724,12 +707,13 @@ void gigaset_handle_modem_response(struct cardstate *cs)
                         break;
         }
 
-        atomic_set(&cs->ev_tail, tail);
+        cs->ev_tail = tail;
         spin_unlock_irqrestore(&cs->ev_lock, flags);
 
         if (curarg != params)
-                dbg(DEBUG_ANY, "invalid number of processed parameters: %d/%d",
-                    curarg, params);
+                gig_dbg(DEBUG_ANY,
+                        "invalid number of processed parameters: %d/%d",
+                        curarg, params);
 }
 EXPORT_SYMBOL_GPL(gigaset_handle_modem_response);
 
@@ -739,23 +723,19 @@ EXPORT_SYMBOL_GPL(gigaset_handle_modem_response);
 static void disconnect(struct at_state_t **at_state_p)
 {
         unsigned long flags;
-        struct bc_state *bcs;
-        struct cardstate *cs;
+        struct bc_state *bcs = (*at_state_p)->bcs;
+        struct cardstate *cs = (*at_state_p)->cs;
 
-        IFNULLRET(at_state_p);
-        IFNULLRET(*at_state_p);
-        bcs = (*at_state_p)->bcs;
-        cs = (*at_state_p)->cs;
-        IFNULLRET(cs);
-
-        new_index(&(*at_state_p)->seq_index, MAX_SEQ_INDEX);
+        spin_lock_irqsave(&cs->lock, flags);
+        ++(*at_state_p)->seq_index;
 
         /* revert to selected idle mode */
-        if (!atomic_read(&cs->cidmode)) {
+        if (!cs->cidmode) {
                 cs->at_state.pending_commands |= PC_UMMODE;
                 atomic_set(&cs->commands_pending, 1); //FIXME
-                dbg(DEBUG_CMD, "Scheduling PC_UMMODE");
+                gig_dbg(DEBUG_CMD, "Scheduling PC_UMMODE");
         }
+        spin_unlock_irqrestore(&cs->lock, flags);
 
         if (bcs) {
                 /* B channel assigned: invoke hardware specific handler */
@@ -777,7 +757,7 @@ static void disconnect(struct at_state_t **at_state_p)
  * The structure should be freed by calling disconnect() after use.
  */
 static inline struct at_state_t *get_free_channel(struct cardstate *cs,
-                                                  int cid)
+                                                  int cid)
 /* cids: >0: siemens-cid
           0: without cid
          -1: no cid assigned yet
@@ -826,7 +806,7 @@ static void init_failed(struct cardstate *cs, int mode)
 static void schedule_init(struct cardstate *cs, int state)
 {
         if (cs->at_state.pending_commands & PC_INIT) {
-                dbg(DEBUG_CMD, "not scheduling PC_INIT again");
+                gig_dbg(DEBUG_CMD, "not scheduling PC_INIT again");
                 return;
         }
         atomic_set(&cs->mstate, state);
@@ -834,52 +814,56 @@ static void schedule_init(struct cardstate *cs, int state)
         gigaset_block_channels(cs);
         cs->at_state.pending_commands |= PC_INIT;
         atomic_set(&cs->commands_pending, 1);
-        dbg(DEBUG_CMD, "Scheduling PC_INIT");
+        gig_dbg(DEBUG_CMD, "Scheduling PC_INIT");
 }
 
-/* Add "AT" to a command, add the cid, dle encode it, send the result to the hardware. */
+/* Add "AT" to a command, add the cid, dle encode it, send the result to the
+   hardware. */
 static void send_command(struct cardstate *cs, const char *cmd, int cid,
-                         int dle, gfp_t kmallocflags)
+                         int dle, gfp_t kmallocflags)
 {
         size_t cmdlen, buflen;
         char *cmdpos, *cmdbuf, *cmdtail;
 
         cmdlen = strlen(cmd);
         buflen = 11 + cmdlen;
+        if (unlikely(buflen <= cmdlen)) {
+                dev_err(cs->dev, "integer overflow in buflen\n");
+                return;
+        }
 
-        if (likely(buflen > cmdlen)) {
-                cmdbuf = kmalloc(buflen, kmallocflags);
-                if (likely(cmdbuf != NULL)) {
-                        cmdpos = cmdbuf + 9;
-                        cmdtail = cmdpos + cmdlen;
-                        memcpy(cmdpos, cmd, cmdlen);
-
-                        if (cid > 0 && cid <= 65535) {
-                                do {
-                                        *--cmdpos = '0' + cid % 10;
-                                        cid /= 10;
-                                        ++cmdlen;
-                                } while (cid);
-                        }
+        cmdbuf = kmalloc(buflen, kmallocflags);
+        if (unlikely(!cmdbuf)) {
+                dev_err(cs->dev, "out of memory\n");
+                return;
+        }
 
-                        cmdlen += 2;
-                        *--cmdpos = 'T';
-                        *--cmdpos = 'A';
+        cmdpos = cmdbuf + 9;
+        cmdtail = cmdpos + cmdlen;
+        memcpy(cmdpos, cmd, cmdlen);
 
-                        if (dle) {
-                                cmdlen += 4;
-                                *--cmdpos = '(';
-                                *--cmdpos = 0x10;
-                                *cmdtail++ = 0x10;
-                                *cmdtail++ = ')';
-                        }
+        if (cid > 0 && cid <= 65535) {
+                do {
+                        *--cmdpos = '0' + cid % 10;
+                        cid /= 10;
+                        ++cmdlen;
+                } while (cid);
+        }
 
-                        cs->ops->write_cmd(cs, cmdpos, cmdlen, NULL);
-                        kfree(cmdbuf);
-                } else
-                        err("no memory for command buffer");
-        } else
-                err("overflow in buflen");
+        cmdlen += 2;
+        *--cmdpos = 'T';
+        *--cmdpos = 'A';
+
+        if (dle) {
+                cmdlen += 4;
+                *--cmdpos = '(';
+                *--cmdpos = 0x10;
+                *cmdtail++ = 0x10;
+                *cmdtail++ = ')';
+        }
+
+        cs->ops->write_cmd(cs, cmdpos, cmdlen, NULL);
+        kfree(cmdbuf);
 }
 
 static struct at_state_t *at_state_from_cid(struct cardstate *cs, int cid)
@@ -910,9 +894,6 @@ static struct at_state_t *at_state_from_cid(struct cardstate *cs, int cid)
 
 static void bchannel_down(struct bc_state *bcs)
 {
-        IFNULLRET(bcs);
-        IFNULLRET(bcs->cs);
-
         if (bcs->chstate & CHS_B_UP) {
                 bcs->chstate &= ~CHS_B_UP;
                 gigaset_i4l_channel_cmd(bcs, ISDN_STAT_BHUP);
@@ -930,16 +911,15 @@ static void bchannel_down(struct bc_state *bcs)
 
 static void bchannel_up(struct bc_state *bcs)
 {
-        IFNULLRET(bcs);
-
         if (!(bcs->chstate & CHS_D_UP)) {
-                notice("%s: D channel not up", __func__);
+                dev_notice(bcs->cs->dev, "%s: D channel not up\n", __func__);
                 bcs->chstate |= CHS_D_UP;
                 gigaset_i4l_channel_cmd(bcs, ISDN_STAT_DCONN);
         }
 
         if (bcs->chstate & CHS_B_UP) {
-                notice("%s: B channel already up", __func__);
+                dev_notice(bcs->cs->dev, "%s: B channel already up\n",
+                           __func__);
                 return;
         }
 
@@ -947,17 +927,21 @@ static void bchannel_up(struct bc_state *bcs)
         gigaset_i4l_channel_cmd(bcs, ISDN_STAT_BCONN);
 }
 
-static void start_dial(struct at_state_t *at_state, void *data, int seq_index)
+static void start_dial(struct at_state_t *at_state, void *data, unsigned seq_index)
 {
         struct bc_state *bcs = at_state->bcs;
         struct cardstate *cs = at_state->cs;
         int retval;
+        unsigned long flags;
 
         bcs->chstate |= CHS_NOTIFY_LL;
-        //atomic_set(&bcs->status, BCS_INIT);
 
-        if (atomic_read(&at_state->seq_index) != seq_index)
+        spin_lock_irqsave(&cs->lock, flags);
+        if (at_state->seq_index != seq_index) {
+                spin_unlock_irqrestore(&cs->lock, flags);
                 goto error;
+        }
+        spin_unlock_irqrestore(&cs->lock, flags);
 
         retval = gigaset_isdn_setup_dial(at_state, data);
         if (retval != 0)
@@ -965,20 +949,14 @@ static void start_dial(struct at_state_t *at_state, void *data, int seq_index)
 
 
         at_state->pending_commands |= PC_CID;
-        dbg(DEBUG_CMD, "Scheduling PC_CID");
-//#ifdef GIG_MAYINITONDIAL
-//      if (atomic_read(&cs->MState) == MS_UNKNOWN) {
-//              cs->at_state.pending_commands |= PC_INIT;
-//              dbg(DEBUG_CMD, "Scheduling PC_INIT");
-//      }
-//#endif
-        atomic_set(&cs->commands_pending, 1); //FIXME
+        gig_dbg(DEBUG_CMD, "Scheduling PC_CID");
+        atomic_set(&cs->commands_pending, 1);
         return;
 
 error:
         at_state->pending_commands |= PC_NOCID;
-        dbg(DEBUG_CMD, "Scheduling PC_NOCID");
-        atomic_set(&cs->commands_pending, 1); //FIXME
+        gig_dbg(DEBUG_CMD, "Scheduling PC_NOCID");
+        atomic_set(&cs->commands_pending, 1);
         return;
 }
 
@@ -991,13 +969,13 @@ static void start_accept(struct at_state_t *at_state)
 
         if (retval == 0) {
                 at_state->pending_commands |= PC_ACCEPT;
-                dbg(DEBUG_CMD, "Scheduling PC_ACCEPT");
-                atomic_set(&cs->commands_pending, 1); //FIXME
+                gig_dbg(DEBUG_CMD, "Scheduling PC_ACCEPT");
+                atomic_set(&cs->commands_pending, 1);
         } else {
                 //FIXME
                 at_state->pending_commands |= PC_HUP;
-                dbg(DEBUG_CMD, "Scheduling PC_HUP");
-                atomic_set(&cs->commands_pending, 1); //FIXME
+                gig_dbg(DEBUG_CMD, "Scheduling PC_HUP");
+                atomic_set(&cs->commands_pending, 1);
         }
 }
 
@@ -1008,9 +986,10 @@ static void do_start(struct cardstate *cs)
         if (atomic_read(&cs->mstate) != MS_LOCKED)
                 schedule_init(cs, MS_INIT);
 
+        cs->isdn_up = 1;
         gigaset_i4l_cmd(cs, ISDN_STAT_RUN);
-                                        // FIXME: not in locked mode
-                                        // FIXME 2: only after init sequence
+                                        // FIXME: not in locked mode
+                                        // FIXME 2: only after init sequence
 
         cs->waiting = 0;
         wake_up(&cs->waitqueue);
@@ -1023,6 +1002,12 @@ static void finish_shutdown(struct cardstate *cs)
                 atomic_set(&cs->mode, M_UNKNOWN);
         }
 
+        /* Tell the LL that the device is not available .. */
+        if (cs->isdn_up) {
+                cs->isdn_up = 0;
+                gigaset_i4l_cmd(cs, ISDN_STAT_STOP);
+        }
+
         /* The rest is done by cleanup_cs () in user mode. */
 
         cs->cmd_result = -ENODEV;
@@ -1037,15 +1022,20 @@ static void do_shutdown(struct cardstate *cs)
         if (atomic_read(&cs->mstate) == MS_READY) {
                 atomic_set(&cs->mstate, MS_SHUTDOWN);
                 cs->at_state.pending_commands |= PC_SHUTDOWN;
-                atomic_set(&cs->commands_pending, 1); //FIXME
-                dbg(DEBUG_CMD, "Scheduling PC_SHUTDOWN"); //FIXME
-                //gigaset_schedule_event(cs); //FIXME
+                atomic_set(&cs->commands_pending, 1);
+                gig_dbg(DEBUG_CMD, "Scheduling PC_SHUTDOWN");
         } else
                 finish_shutdown(cs);
 }
 
 static void do_stop(struct cardstate *cs)
 {
+        unsigned long flags;
+
+        spin_lock_irqsave(&cs->lock, flags);
+        cs->connected = 0;
+        spin_unlock_irqrestore(&cs->lock, flags);
+
         do_shutdown(cs);
 }
 
@@ -1069,9 +1059,11 @@ static int reinit_and_retry(struct cardstate *cs, int channel)
                         return 0;
 
         if (channel < 0)
-                warn("Could not enter cid mode. Reinit device and try again.");
+                dev_warn(cs->dev,
+                    "Could not enter cid mode. Reinit device and try again.\n");
         else {
-                warn("Could not get a call id. Reinit device and try again.");
+                dev_warn(cs->dev,
+                    "Could not get a call id. Reinit device and try again.\n");
                 cs->bcs[channel].at_state.pending_commands |= PC_CID;
         }
         schedule_init(cs, MS_INIT);
@@ -1079,7 +1071,7 @@ static int reinit_and_retry(struct cardstate *cs, int channel)
 }
 
 static int at_state_invalid(struct cardstate *cs,
-                            struct at_state_t *test_ptr)
+                            struct at_state_t *test_ptr)
 {
         unsigned long flags;
         unsigned channel;
@@ -1116,7 +1108,7 @@ static void handle_icall(struct cardstate *cs, struct bc_state *bcs,
         case ICALL_ACCEPT:
                 break;
         default:
-                err("internal error: disposition=%d", retval);
+                dev_err(cs->dev, "internal error: disposition=%d\n", retval);
                 /* --v-- fall through --v-- */
         case ICALL_IGNORE:
         case ICALL_REJECT:
@@ -1160,7 +1152,6 @@ static int do_lock(struct cardstate *cs)
         mode = atomic_read(&cs->mode);
         atomic_set(&cs->mstate, MS_LOCKED);
         atomic_set(&cs->mode, M_UNKNOWN);
-        //FIXME reset card state / at states / bcs states
 
         return mode;
 }
@@ -1173,8 +1164,7 @@ static int do_unlock(struct cardstate *cs)
         atomic_set(&cs->mstate, MS_UNINITIALIZED);
         atomic_set(&cs->mode, M_UNKNOWN);
         gigaset_free_channels(cs);
-        //FIXME reset card state / at states / bcs states
-        if (atomic_read(&cs->connected))
+        if (cs->connected)
                 schedule_init(cs, MS_INIT);
 
         return 0;
@@ -1203,21 +1193,23 @@ static void do_action(int action, struct cardstate *cs,
                 at_state->waiting = 1;
                 break;
         case ACT_INIT:
-                //FIXME setup everything
                 cs->at_state.pending_commands &= ~PC_INIT;
                 cs->cur_at_seq = SEQ_NONE;
                 atomic_set(&cs->mode, M_UNIMODEM);
-                if (!atomic_read(&cs->cidmode)) {
+                spin_lock_irqsave(&cs->lock, flags);
+                if (!cs->cidmode) {
+                        spin_unlock_irqrestore(&cs->lock, flags);
                         gigaset_free_channels(cs);
                         atomic_set(&cs->mstate, MS_READY);
                         break;
                 }
+                spin_unlock_irqrestore(&cs->lock, flags);
                 cs->at_state.pending_commands |= PC_CIDMODE;
-                atomic_set(&cs->commands_pending, 1); //FIXME
-                dbg(DEBUG_CMD, "Scheduling PC_CIDMODE");
+                atomic_set(&cs->commands_pending, 1);
+                gig_dbg(DEBUG_CMD, "Scheduling PC_CIDMODE");
                 break;
         case ACT_FAILINIT:
-                warn("Could not initialize the device.");
+                dev_warn(cs->dev, "Could not initialize the device.\n");
                 cs->dle = 0;
                 init_failed(cs, M_UNKNOWN);
                 cs->cur_at_seq = SEQ_NONE;
@@ -1273,8 +1265,8 @@ static void do_action(int action, struct cardstate *cs,
                 /* get fresh AT state structure for new CID */
                 at_state2 = get_free_channel(cs, ev->parameter);
                 if (!at_state2) {
-                        warn("RING ignored: "
-                             "could not allocate channel structure");
+                        dev_warn(cs->dev,
+                        "RING ignored: could not allocate channel structure\n");
                         break;
                 }
 
@@ -1302,7 +1294,7 @@ static void do_action(int action, struct cardstate *cs,
                 at_state = *p_at_state;
                 break;
         case ACT_FAILSDOWN:
-                warn("Could not shut down the device.");
+                dev_warn(cs->dev, "Could not shut down the device.\n");
                 /* fall through */
         case ACT_FAKESDOWN:
         case ACT_SDOWN:
@@ -1355,7 +1347,7 @@ static void do_action(int action, struct cardstate *cs,
                 break;
         case ACT_ABORTHUP:
                 cs->cur_at_seq = SEQ_NONE;
-                warn("Could not hang up.");
+                dev_warn(cs->dev, "Could not hang up.\n");
                 at_state->cid = -1;
                 if (bcs && cs->onechannel)
                         at_state->pending_commands |= PC_DLE0;
@@ -1367,14 +1359,15 @@ static void do_action(int action, struct cardstate *cs,
                 break;
         case ACT_FAILDLE0:
                 cs->cur_at_seq = SEQ_NONE;
-                warn("Could not leave DLE mode.");
+                dev_warn(cs->dev, "Could not leave DLE mode.\n");
                 at_state2 = &cs->bcs[cs->curchannel].at_state;
                 disconnect(&at_state2);
                 schedule_init(cs, MS_RECOVER);
                 break;
         case ACT_FAILDLE1:
                 cs->cur_at_seq = SEQ_NONE;
-                warn("Could not enter DLE mode. Try to hang up.");
+                dev_warn(cs->dev,
+                         "Could not enter DLE mode. Trying to hang up.\n");
                 channel = cs->curchannel;
                 cs->bcs[channel].at_state.pending_commands |= PC_HUP;
                 atomic_set(&cs->commands_pending, 1);
@@ -1395,7 +1388,8 @@ static void do_action(int action, struct cardstate *cs,
                 cs->cur_at_seq = SEQ_NONE;
                 channel = cs->curchannel;
                 if (!reinit_and_retry(cs, channel)) {
-                        warn("Could not get a call id. Dialing not possible");
+                        dev_warn(cs->dev,
+                                 "Could not get a call ID. Cannot dial.\n");
                         at_state2 = &cs->bcs[channel].at_state;
                         disconnect(&at_state2);
                 }
@@ -1428,7 +1422,8 @@ static void do_action(int action, struct cardstate *cs,
                 at_state->pending_commands |= PC_HUP;
                 atomic_set(&cs->commands_pending, 1);
                 break;
-        case ACT_GETSTRING: /* warning: RING, ZDLE, ... are not handled properly any more */
+        case ACT_GETSTRING: /* warning: RING, ZDLE, ...
+                               are not handled properly anymore */
                 at_state->getstring = 1;
                 break;
         case ACT_SETVER:
@@ -1469,16 +1464,16 @@ static void do_action(int action, struct cardstate *cs,
         case ACT_GOTVER:
                 if (cs->gotfwver == 0) {
                         cs->gotfwver = 1;
-                        dbg(DEBUG_ANY,
-                            "firmware version %02d.%03d.%02d.%02d",
-                            cs->fwver[0], cs->fwver[1],
-                            cs->fwver[2], cs->fwver[3]);
+                        gig_dbg(DEBUG_ANY,
+                                "firmware version %02d.%03d.%02d.%02d",
+                                cs->fwver[0], cs->fwver[1],
+                                cs->fwver[2], cs->fwver[3]);
                         break;
                 }
                 /* fall through */
         case ACT_FAILVER:
                 cs->gotfwver = -1;
-                err("could not read firmware version.");
+                dev_err(cs->dev, "could not read firmware version.\n");
                 break;
 #ifdef CONFIG_GIGASET_DEBUG
         case ACT_ERROR:
@@ -1496,16 +1491,16 @@ static void do_action(int action, struct cardstate *cs,
                 break;
 #endif
         case ACT_DEBUG:
-                dbg(DEBUG_ANY, "%s: resp_code %d in ConState %d",
+                gig_dbg(DEBUG_ANY, "%s: resp_code %d in ConState %d",
                         __func__, ev->type, at_state->ConState);
                 break;
         case ACT_WARN:
-                warn("%s: resp_code %d in ConState %d!",
-                        __func__, ev->type, at_state->ConState);
+                dev_warn(cs->dev, "%s: resp_code %d in ConState %d!\n",
+                         __func__, ev->type, at_state->ConState);
                 break;
         case ACT_ZCAU:
-                warn("cause code %04x in connection state %d.",
-                     ev->parameter, at_state->ConState);
+                dev_warn(cs->dev, "cause code %04x in connection state %d.\n",
+                         ev->parameter, at_state->ConState);
                 break;
 
         /* events from the LL */
@@ -1516,14 +1511,14 @@ static void do_action(int action, struct cardstate *cs,
                 start_accept(at_state);
                 break;
         case ACT_PROTO_L2:
-                dbg(DEBUG_CMD,
-                    "set protocol to %u", (unsigned) ev->parameter);
+                gig_dbg(DEBUG_CMD, "set protocol to %u",
+                        (unsigned) ev->parameter);
                 at_state->bcs->proto2 = ev->parameter;
                 break;
         case ACT_HUP:
                 at_state->pending_commands |= PC_HUP;
-                atomic_set(&cs->commands_pending, 1); //FIXME
-                dbg(DEBUG_CMD, "Scheduling PC_HUP");
+                atomic_set(&cs->commands_pending, 1);
+                gig_dbg(DEBUG_CMD, "Scheduling PC_HUP");
                 break;
 
         /* hotplug events */
@@ -1555,17 +1550,19 @@ static void do_action(int action, struct cardstate *cs,
 
         /* events from the proc file system */ // FIXME without ACT_xxxx?
         case ACT_PROC_CIDMODE:
-                if (ev->parameter != atomic_read(&cs->cidmode)) {
-                        atomic_set(&cs->cidmode, ev->parameter);
+                spin_lock_irqsave(&cs->lock, flags);
+                if (ev->parameter != cs->cidmode) {
+                        cs->cidmode = ev->parameter;
                         if (ev->parameter) {
                                 cs->at_state.pending_commands |= PC_CIDMODE;
-                                dbg(DEBUG_CMD, "Scheduling PC_CIDMODE");
+                                gig_dbg(DEBUG_CMD, "Scheduling PC_CIDMODE");
                         } else {
                                 cs->at_state.pending_commands |= PC_UMMODE;
-                                dbg(DEBUG_CMD, "Scheduling PC_UMMODE");
+                                gig_dbg(DEBUG_CMD, "Scheduling PC_UMMODE");
                         }
                         atomic_set(&cs->commands_pending, 1);
                 }
+                spin_unlock_irqrestore(&cs->lock, flags);
                 cs->waiting = 0;
                 wake_up(&cs->waitqueue);
                 break;
@@ -1590,7 +1587,7 @@ static void do_action(int action, struct cardstate *cs,
                                 *p_resp_code = RSP_NULL;
                         }
                 } else
-                        err("%s: action==%d!", __func__, action);
+                        dev_err(cs->dev, "%s: action==%d!\n", __func__, action);
         }
 }
 
@@ -1609,47 +1606,46 @@ static void process_event(struct cardstate *cs, struct event_t *ev)
         int curact;
         unsigned long flags;
 
-        IFNULLRET(cs);
-        IFNULLRET(ev);
-
         if (ev->cid >= 0) {
                 at_state = at_state_from_cid(cs, ev->cid);
                 if (!at_state) {
                         gigaset_add_event(cs, &cs->at_state, RSP_WRONG_CID,
-                                          NULL, 0, NULL);
+                                          NULL, 0, NULL);
                         return;
                 }
         } else {
                 at_state = ev->at_state;
                 if (at_state_invalid(cs, at_state)) {
-                        dbg(DEBUG_ANY,
-                            "event for invalid at_state %p", at_state);
+                        gig_dbg(DEBUG_ANY, "event for invalid at_state %p",
+                                at_state);
                         return;
                 }
         }
 
-        dbg(DEBUG_CMD,
-            "connection state %d, event %d", at_state->ConState, ev->type);
+        gig_dbg(DEBUG_CMD, "connection state %d, event %d",
+                at_state->ConState, ev->type);
 
         bcs = at_state->bcs;
         sendcid = at_state->cid;
 
         /* Setting the pointer to the dial array */
         rep = at_state->replystruct;
-        IFNULLRET(rep);
 
+        spin_lock_irqsave(&cs->lock, flags);
         if (ev->type == EV_TIMEOUT) {
-                if (ev->parameter != atomic_read(&at_state->timer_index)
+                if (ev->parameter != at_state->timer_index
                     || !at_state->timer_active) {
                         ev->type = RSP_NONE; /* old timeout */
-                        dbg(DEBUG_ANY, "old timeout");
+                        gig_dbg(DEBUG_ANY, "old timeout");
                 } else if (!at_state->waiting)
-                        dbg(DEBUG_ANY, "timeout occured");
+                        gig_dbg(DEBUG_ANY, "timeout occurred");
                 else
-                        dbg(DEBUG_ANY, "stopped waiting");
+                        gig_dbg(DEBUG_ANY, "stopped waiting");
         }
+        spin_unlock_irqrestore(&cs->lock, flags);
 
-        /* if the response belongs to a variable in at_state->int_var[VAR_XXXX] or at_state->str_var[STR_XXXX], set it */
+        /* if the response belongs to a variable in at_state->int_var[VAR_XXXX]
+           or at_state->str_var[STR_XXXX], set it */
         if (ev->type >= RSP_VAR && ev->type < RSP_VAR + VAR_NUM) {
                 index = ev->type - RSP_VAR;
                 at_state->int_var[index] = ev->parameter;
@@ -1657,20 +1653,22 @@ static void process_event(struct cardstate *cs, struct event_t *ev)
                 index = ev->type - RSP_STR;
                 kfree(at_state->str_var[index]);
                 at_state->str_var[index] = ev->ptr;
-                ev->ptr = NULL; /* prevent process_events() from deallocating ptr */
+                ev->ptr = NULL; /* prevent process_events() from
+                                   deallocating ptr */
         }
 
         if (ev->type == EV_TIMEOUT || ev->type == RSP_STRING)
                 at_state->getstring = 0;
 
-        /* Search row in dial array which matches modem response and current constate */
+        /* Search row in dial array which matches modem response and current
+           constate */
         for (;; rep++) {
                 rcode = rep->resp_code;
-                /* dbg (DEBUG_ANY, "rcode %d", rcode); */
                 if (rcode == RSP_LAST) {
                         /* found nothing...*/
-                        warn("%s: rcode=RSP_LAST: resp_code %d in ConState %d!",
-                                __func__, ev->type, at_state->ConState);
+                        dev_warn(cs->dev, "%s: rcode=RSP_LAST: "
+                                        "resp_code %d in ConState %d!\n",
+                                 __func__, ev->type, at_state->ConState);
                         return;
                 }
                 if ((rcode == RSP_ANY || rcode == ev->type)
@@ -1706,14 +1704,14 @@ static void process_event(struct cardstate *cs, struct event_t *ev)
                 } else {
                         /* Send command to modem if not NULL... */
                         if (p_command/*rep->command*/) {
-                                if (atomic_read(&cs->connected))
+                                if (cs->connected)
                                         send_command(cs, p_command,
-                                                     sendcid, cs->dle,
-                                                     GFP_ATOMIC);
+                                                     sendcid, cs->dle,
+                                                     GFP_ATOMIC);
                                 else
                                         gigaset_add_event(cs, at_state,
-                                                          RSP_NODEV,
-                                                          NULL, 0, NULL);
+                                                          RSP_NODEV,
+                                                          NULL, 0, NULL);
                         }
 
                         spin_lock_irqsave(&cs->lock, flags);
@@ -1723,8 +1721,7 @@ static void process_event(struct cardstate *cs, struct event_t *ev)
                         } else if (rep->timeout > 0) { /* new timeout */
                                 at_state->timer_expires = rep->timeout * 10;
                                 at_state->timer_active = 1;
-                                new_index(&at_state->timer_index,
-                                          MAX_TIMER_INDEX);
+                                ++at_state->timer_index;
                         }
                         spin_unlock_irqrestore(&cs->lock, flags);
                 }
@@ -1744,17 +1741,16 @@ static void process_command_flags(struct cardstate *cs)
         struct bc_state *bcs;
         int i;
         int sequence;
-
-        IFNULLRET(cs);
+        unsigned long flags;
 
         atomic_set(&cs->commands_pending, 0);
 
         if (cs->cur_at_seq) {
-                dbg(DEBUG_CMD, "not searching scheduled commands: busy");
+                gig_dbg(DEBUG_CMD, "not searching scheduled commands: busy");
                 return;
         }
 
-        dbg(DEBUG_CMD, "searching scheduled commands");
+        gig_dbg(DEBUG_CMD, "searching scheduled commands");
 
         sequence = SEQ_NONE;
 
@@ -1795,8 +1791,9 @@ static void process_command_flags(struct cardstate *cs)
         }
 
         /* only switch back to unimodem mode, if no commands are pending and no channels are up */
+        spin_lock_irqsave(&cs->lock, flags);
         if (cs->at_state.pending_commands == PC_UMMODE
-            && !atomic_read(&cs->cidmode)
+            && !cs->cidmode
             && list_empty(&cs->temp_at_states)
             && atomic_read(&cs->mode) == M_CID) {
                 sequence = SEQ_UMMODE;
@@ -1810,6 +1807,7 @@ static void process_command_flags(struct cardstate *cs)
                         }
                 }
         }
+        spin_unlock_irqrestore(&cs->lock, flags);
         cs->at_state.pending_commands &= ~PC_UMMODE;
         if (sequence != SEQ_NONE) {
                 schedule_sequence(cs, at_state, sequence);
@@ -1865,11 +1863,7 @@ static void process_command_flags(struct cardstate *cs)
         if (cs->at_state.pending_commands & PC_CIDMODE) {
                 cs->at_state.pending_commands &= ~PC_CIDMODE;
                 if (atomic_read(&cs->mode) == M_UNIMODEM) {
-#if 0
-                        cs->retry_count = 2;
-#else
                         cs->retry_count = 1;
-#endif
                         schedule_sequence(cs, &cs->at_state, SEQ_CIDMODE);
                         return;
                 }
@@ -1897,7 +1891,7 @@ static void process_command_flags(struct cardstate *cs)
                         switch (atomic_read(&cs->mode)) {
                         case M_UNIMODEM:
                                 cs->at_state.pending_commands |= PC_CIDMODE;
-                                dbg(DEBUG_CMD, "Scheduling PC_CIDMODE");
+                                gig_dbg(DEBUG_CMD, "Scheduling PC_CIDMODE");
                                 atomic_set(&cs->commands_pending, 1);
                                 return;
 #ifdef GIG_MAYINITONDIAL
@@ -1926,18 +1920,21 @@ static void process_events(struct cardstate *cs)
         int i;
         int check_flags = 0;
         int was_busy;
+        unsigned long flags;
 
-        /* no locking needed (only one reader) */
-        head = atomic_read(&cs->ev_head);
+        spin_lock_irqsave(&cs->ev_lock, flags);
+        head = cs->ev_head;
 
         for (i = 0; i < 2 * MAX_EVENTS; ++i) {
-                tail = atomic_read(&cs->ev_tail);
+                tail = cs->ev_tail;
                 if (tail == head) {
                         if (!check_flags && !atomic_read(&cs->commands_pending))
                                 break;
                         check_flags = 0;
+                        spin_unlock_irqrestore(&cs->ev_lock, flags);
                         process_command_flags(cs);
-                        tail = atomic_read(&cs->ev_tail);
+                        spin_lock_irqsave(&cs->ev_lock, flags);
+                        tail = cs->ev_tail;
                         if (tail == head) {
                                 if (!atomic_read(&cs->commands_pending))
                                         break;
@@ -1947,18 +1944,23 @@ static void process_events(struct cardstate *cs)
 
                 ev = cs->events + head;
                 was_busy = cs->cur_at_seq != SEQ_NONE;
+                spin_unlock_irqrestore(&cs->ev_lock, flags);
                 process_event(cs, ev);
+                spin_lock_irqsave(&cs->ev_lock, flags);
                 kfree(ev->ptr);
                 ev->ptr = NULL;
                 if (was_busy && cs->cur_at_seq == SEQ_NONE)
                         check_flags = 1;
 
                 head = (head + 1) % MAX_EVENTS;
-                atomic_set(&cs->ev_head, head);
+                cs->ev_head = head;
         }
 
+        spin_unlock_irqrestore(&cs->ev_lock, flags);
+
         if (i == 2 * MAX_EVENTS) {
-                err("infinite loop in process_events; aborting.");
+                dev_err(cs->dev,
+                        "infinite loop in process_events; aborting.\n");
         }
 }
 
@@ -1970,12 +1972,9 @@ void gigaset_handle_event(unsigned long data)
 {
         struct cardstate *cs = (struct cardstate *) data;
 
-        IFNULLRET(cs);
-        IFNULLRET(cs->inbuf);
-
         /* handle incoming data on control/common channel */
         if (atomic_read(&cs->inbuf->head) != atomic_read(&cs->inbuf->tail)) {
-                dbg(DEBUG_INTR, "processing new data");
+                gig_dbg(DEBUG_INTR, "processing new data");
                 cs->ops->handle_input(cs->inbuf);
         }
 
diff --git a/drivers/isdn/gigaset/gigaset.h b/drivers/isdn/gigaset/gigaset.h
index 729edcdb6dac..9d21ba8757b0 100644
--- a/drivers/isdn/gigaset/gigaset.h
+++ b/drivers/isdn/gigaset/gigaset.h
@@ -1,11 +1,16 @@
-/* Siemens Gigaset 307x driver
+/*
+ * Siemens Gigaset 307x driver
  * Common header file for all connection variants
  *
- * Written by Stefan Eilers <Eilers.Stefan@epost.de>
+ * Written by Stefan Eilers
  *        and Hansjoerg Lipp <hjlipp@web.de>
  *
- * Version: $Id: gigaset.h,v 1.97.4.26 2006/02/04 18:28:16 hjlipp Exp $
- * ===========================================================================
+ * =====================================================================
+ *      This program is free software; you can redistribute it and/or
+ *      modify it under the terms of the GNU General Public License as
+ *      published by the Free Software Foundation; either version 2 of
+ *      the License, or (at your option) any later version.
+ * =====================================================================
  */
 
 #ifndef GIGASET_H
@@ -15,7 +20,6 @@
 #include <linux/kernel.h>
 #include <linux/compiler.h>
 #include <linux/types.h>
-#include <asm/atomic.h>
 #include <linux/spinlock.h>
 #include <linux/isdnif.h>
 #include <linux/usb.h>
@@ -27,21 +31,22 @@
 #include <linux/tty.h>
 #include <linux/tty_driver.h>
 #include <linux/list.h>
+#include <asm/atomic.h>
 
 #define GIG_VERSION {0,5,0,0}
 #define GIG_COMPAT  {0,4,0,0}
 
-#define MAX_REC_PARAMS 10                         /* Max. number of params in response string */
-#define MAX_RESP_SIZE 512                         /* Max. size of a response string */
-#define HW_HDR_LEN 2                              /* Header size used to store ack info */
+#define MAX_REC_PARAMS 10       /* Max. number of params in response string */
+#define MAX_RESP_SIZE 512       /* Max. size of a response string */
+#define HW_HDR_LEN 2            /* Header size used to store ack info */
 
-#define MAX_EVENTS 64                          /* size of event queue */
+#define MAX_EVENTS 64           /* size of event queue */
 
 #define RBUFSIZE 8192
-#define SBUFSIZE 4096                           /* sk_buff payload size */
+#define SBUFSIZE 4096           /* sk_buff payload size */
 
-#define MAX_BUF_SIZE (SBUFSIZE - 2)             /* Max. size of a data packet from LL */
-#define TRANSBUFSIZE 768                        /* bytes per skb for transparent receive */
+#define TRANSBUFSIZE 768        /* bytes per skb for transparent receive */
+#define MAX_BUF_SIZE (SBUFSIZE - 2)     /* Max. size of a data packet from LL */
 
 /* compile time options */
 #define GIG_MAJOR 0
@@ -50,10 +55,7 @@
 #define GIG_RETRYCID
 #define GIG_X75
 
-#define MAX_TIMER_INDEX 1000
-#define MAX_SEQ_INDEX   1000
-
-#define GIG_TICK (HZ / 10)
+#define GIG_TICK 100            /* in milliseconds */
 
 /* timeout values (unit: 1 sec) */
 #define INIT_TIMEOUT 1
@@ -67,74 +69,89 @@
 
 #define MAXACT 3
 
-#define IFNULL(a)         if (unlikely(!(a)))
-#define IFNULLRET(a)      if (unlikely(!(a))) {err("%s==NULL at %s:%d!", #a, __FILE__, __LINE__); return; }
-#define IFNULLRETVAL(a,b) if (unlikely(!(a))) {err("%s==NULL at %s:%d!", #a, __FILE__, __LINE__); return (b); }
-#define IFNULLCONT(a)     if (unlikely(!(a))) {err("%s==NULL at %s:%d!", #a, __FILE__, __LINE__); continue; }
-#define IFNULLGOTO(a,b)   if (unlikely(!(a))) {err("%s==NULL at %s:%d!", #a, __FILE__, __LINE__); goto b; }
-
 extern int gigaset_debuglevel;  /* "needs" cast to (enum debuglevel) */
 
-/* any combination of these can be given with the 'debug=' parameter to insmod, e.g.
- * 'insmod usb_gigaset.o debug=0x2c' will set DEBUG_OPEN, DEBUG_CMD and DEBUG_INTR. */
+/* any combination of these can be given with the 'debug=' parameter to insmod,
+ * e.g. 'insmod usb_gigaset.o debug=0x2c' will set DEBUG_OPEN, DEBUG_CMD and
+ * DEBUG_INTR.
+ */
 enum debuglevel { /* up to 24 bits (atomic_t) */
         DEBUG_REG         = 0x0002, /* serial port I/O register operations */
         DEBUG_OPEN        = 0x0004, /* open/close serial port */
         DEBUG_INTR        = 0x0008, /* interrupt processing */
-        DEBUG_INTR_DUMP   = 0x0010, /* Activating hexdump debug output on interrupt
-                                      requests, not available as run-time option */
+        DEBUG_INTR_DUMP   = 0x0010, /* Activating hexdump debug output on
+                                       interrupt requests, not available as
+                                       run-time option */
         DEBUG_CMD         = 0x00020, /* sent/received LL commands */
         DEBUG_STREAM      = 0x00040, /* application data stream I/O events */
         DEBUG_STREAM_DUMP = 0x00080, /* application data stream content */
         DEBUG_LLDATA      = 0x00100, /* sent/received LL data */
-        DEBUG_INTR_0      = 0x00200, /* serial port output interrupt processing */
+        DEBUG_INTR_0      = 0x00200, /* serial port interrupt processing */
         DEBUG_DRIVER      = 0x00400, /* driver structure */
         DEBUG_HDLC        = 0x00800, /* M10x HDLC processing */
         DEBUG_WRITE       = 0x01000, /* M105 data write */
-        DEBUG_TRANSCMD    = 0x02000, /*AT-COMMANDS+RESPONSES*/
-        DEBUG_MCMD        = 0x04000, /*COMMANDS THAT ARE SENT VERY OFTEN*/
-        DEBUG_INIT        = 0x08000, /* (de)allocation+initialization of data structures */
+        DEBUG_TRANSCMD    = 0x02000, /* AT-COMMANDS+RESPONSES */
+        DEBUG_MCMD        = 0x04000, /* COMMANDS THAT ARE SENT VERY OFTEN */
+        DEBUG_INIT        = 0x08000, /* (de)allocation+initialization of data
+                                        structures */
         DEBUG_LOCK        = 0x10000, /* semaphore operations */
         DEBUG_OUTPUT      = 0x20000, /* output to device */
-        DEBUG_ISO         = 0x40000, /* isochronous transfers */
+        DEBUG_ISO         = 0x40000, /* isochronous transfers */
         DEBUG_IF          = 0x80000, /* character device operations */
-        DEBUG_USBREQ      = 0x100000, /* USB communication (except payload data) */
-        DEBUG_LOCKCMD     = 0x200000, /* AT commands and responses when MS_LOCKED */
+        DEBUG_USBREQ      = 0x100000, /* USB communication (except payload
+                                         data) */
+        DEBUG_LOCKCMD     = 0x200000, /* AT commands and responses when
+                                         MS_LOCKED */
 
-        DEBUG_ANY         = 0x3fffff, /* print message if any of the others is activated */
+        DEBUG_ANY         = 0x3fffff, /* print message if any of the others is
+                                         activated */
 };
 
-#ifdef CONFIG_GIGASET_DEBUG
-#define DEBUG_DEFAULT (DEBUG_INIT | DEBUG_TRANSCMD | DEBUG_CMD | DEBUG_USBREQ)
-//#define DEBUG_DEFAULT (DEBUG_LOCK | DEBUG_INIT | DEBUG_TRANSCMD | DEBUG_CMD | DEBUF_IF | DEBUG_DRIVER | DEBUG_OUTPUT | DEBUG_INTR)
-#else
-#define DEBUG_DEFAULT 0
+/* missing from linux/device.h ... */
+#ifndef dev_notice
+#define dev_notice(dev, format, arg...)         \
+        dev_printk(KERN_NOTICE , dev , format , ## arg)
 #endif
 
-/* redefine syslog macros to prepend module name instead of entire source path */
-/* The space before the comma in ", ##" is needed by gcc 2.95 */
+/* Kernel message macros for situations where dev_printk and friends cannot be
+ * used for lack of reliable access to a device structure.
+ * linux/usb.h already contains these but in an obsolete form which clutters
+ * the log needlessly, and according to the USB maintainer those should be
+ * removed rather than fixed anyway.
+ */
+#undef err
 #undef info
-#define info(format, arg...) printk(KERN_INFO "%s: " format "\n", THIS_MODULE ? THIS_MODULE->name : "gigaset_hw" , ## arg)
-
-#undef notice
-#define notice(format, arg...) printk(KERN_NOTICE "%s: " format "\n", THIS_MODULE ? THIS_MODULE->name : "gigaset_hw" , ## arg)
-
 #undef warn
-#define warn(format, arg...) printk(KERN_WARNING "%s: " format "\n", THIS_MODULE ? THIS_MODULE->name : "gigaset_hw" , ## arg)
+#undef notice
 
-#undef err
-#define err(format, arg...) printk(KERN_ERR "%s: " format "\n", THIS_MODULE ? THIS_MODULE->name : "gigaset_hw" , ## arg)
+#define err(format, arg...) printk(KERN_ERR KBUILD_MODNAME ": " \
+        format "\n" , ## arg)
+#define info(format, arg...) printk(KERN_INFO KBUILD_MODNAME ": " \
+        format "\n" , ## arg)
+#define warn(format, arg...) printk(KERN_WARNING KBUILD_MODNAME ": " \
+        format "\n" , ## arg)
+#define notice(format, arg...) printk(KERN_NOTICE KBUILD_MODNAME ": " \
+        format "\n" , ## arg)
 
-#undef dbg
 #ifdef CONFIG_GIGASET_DEBUG
-#define dbg(level, format, arg...) do { if (unlikely(((enum debuglevel)gigaset_debuglevel) & (level))) \
-        printk(KERN_DEBUG "%s: " format "\n", THIS_MODULE ? THIS_MODULE->name : "gigaset_hw" , ## arg); } while (0)
+
+#define gig_dbg(level, format, arg...) \
+        do { \
+                if (unlikely(((enum debuglevel)gigaset_debuglevel) & (level))) \
+                        printk(KERN_DEBUG KBUILD_MODNAME ": " format "\n", \
+                               ## arg); \
+        } while (0)
+#define DEBUG_DEFAULT (DEBUG_INIT | DEBUG_TRANSCMD | DEBUG_CMD | DEBUG_USBREQ)
+
 #else
-#define dbg(level, format, arg...) do {} while (0)
+
+#define gig_dbg(level, format, arg...) do {} while (0)
+#define DEBUG_DEFAULT 0
+
 #endif
 
 void gigaset_dbg_buffer(enum debuglevel level, const unsigned char *msg,
-                        size_t len, const unsigned char *buf, int from_user);
+                        size_t len, const unsigned char *buf);
 
 /* connection state */
 #define ZSAU_NONE                       0
@@ -148,13 +165,14 @@ void gigaset_dbg_buffer(enum debuglevel level, const unsigned char *msg,
 #define ZSAU_UNKNOWN                    -1
 
 /* USB control transfer requests */
-#define OUT_VENDOR_REQ                  (USB_DIR_OUT | USB_TYPE_VENDOR | USB_RECIP_ENDPOINT)
-#define IN_VENDOR_REQ                   (USB_DIR_IN | USB_TYPE_VENDOR | USB_RECIP_ENDPOINT)
+#define OUT_VENDOR_REQ  (USB_DIR_OUT | USB_TYPE_VENDOR | USB_RECIP_ENDPOINT)
+#define IN_VENDOR_REQ   (USB_DIR_IN | USB_TYPE_VENDOR | USB_RECIP_ENDPOINT)
 
 /* int-in-events 3070 */
 #define HD_B1_FLOW_CONTROL              0x80
 #define HD_B2_FLOW_CONTROL              0x81
-#define HD_RECEIVEATDATA_ACK            (0x35)          // 3070         // att: HD_RECEIVE>>AT<<DATA_ACK
+#define HD_RECEIVEATDATA_ACK            (0x35)          // 3070
+                                                // att: HD_RECEIVE>>AT<<DATA_ACK
 #define HD_READY_SEND_ATDATA            (0x36)          // 3070
 #define HD_OPEN_ATCHANNEL_ACK           (0x37)          // 3070
 #define HD_CLOSE_ATCHANNEL_ACK          (0x38)          // 3070
@@ -181,17 +199,18 @@ void gigaset_dbg_buffer(enum debuglevel level, const unsigned char *msg,
 #define HD_CLOSE_ATCHANNEL              (0x29)          // 3070
 
 /* USB frames for isochronous transfer */
-#define BAS_FRAMETIME   1               /* number of milliseconds between frames */
-#define BAS_NUMFRAMES   8               /* number of frames per URB */
-#define BAS_MAXFRAME    16              /* allocated bytes per frame */
-#define BAS_NORMFRAME   8               /* send size without flow control */
-#define BAS_HIGHFRAME   10              /* "    "    with positive flow control */
-#define BAS_LOWFRAME    5               /* "    "    with negative flow control */
-#define BAS_CORRFRAMES  4               /* flow control multiplicator */
-
-#define BAS_INBUFSIZE   (BAS_MAXFRAME * BAS_NUMFRAMES) /* size of isochronous input buffer per URB */
-#define BAS_OUTBUFSIZE  4096            /* size of common isochronous output buffer */
-#define BAS_OUTBUFPAD   BAS_MAXFRAME    /* size of pad area for isochronous output buffer */
+#define BAS_FRAMETIME   1       /* number of milliseconds between frames */
+#define BAS_NUMFRAMES   8       /* number of frames per URB */
+#define BAS_MAXFRAME    16      /* allocated bytes per frame */
+#define BAS_NORMFRAME   8       /* send size without flow control */
+#define BAS_HIGHFRAME   10      /* "    "    with positive flow control */
+#define BAS_LOWFRAME    5       /* "    "    with negative flow control */
+#define BAS_CORRFRAMES  4       /* flow control multiplicator */
+
+#define BAS_INBUFSIZE   (BAS_MAXFRAME * BAS_NUMFRAMES)
+                                        /* size of isoc in buf per URB */
+#define BAS_OUTBUFSIZE  4096            /* size of common isoc out buffer */
+#define BAS_OUTBUFPAD   BAS_MAXFRAME    /* size of pad area for isoc out buf */
 
 #define BAS_INURBS      3
 #define BAS_OUTURBS     3
@@ -207,40 +226,40 @@ void gigaset_dbg_buffer(enum debuglevel level, const unsigned char *msg,
 #define AT_NUM          7
 
 /* variables in struct at_state_t */
-#define VAR_ZSAU   0
-#define VAR_ZDLE   1
-#define VAR_ZVLS   2
-#define VAR_ZCTP   3
-#define VAR_NUM    4
-
-#define STR_NMBR   0
-#define STR_ZCPN   1
-#define STR_ZCON   2
-#define STR_ZBC    3
-#define STR_ZHLC   4
-#define STR_NUM    5
-
-#define EV_TIMEOUT      -105
-#define EV_IF_VER       -106
-#define EV_PROC_CIDMODE -107
-#define EV_SHUTDOWN     -108
-#define EV_START        -110
-#define EV_STOP         -111
-#define EV_IF_LOCK      -112
-#define EV_PROTO_L2     -113
-#define EV_ACCEPT       -114
-#define EV_DIAL         -115
-#define EV_HUP          -116
-#define EV_BC_OPEN      -117
-#define EV_BC_CLOSED    -118
+#define VAR_ZSAU        0
+#define VAR_ZDLE        1
+#define VAR_ZVLS        2
+#define VAR_ZCTP        3
+#define VAR_NUM         4
+
+#define STR_NMBR        0
+#define STR_ZCPN        1
+#define STR_ZCON        2
+#define STR_ZBC         3
+#define STR_ZHLC        4
+#define STR_NUM         5
+
+#define EV_TIMEOUT      -105
+#define EV_IF_VER       -106
+#define EV_PROC_CIDMODE -107
+#define EV_SHUTDOWN     -108
+#define EV_START        -110
+#define EV_STOP         -111
+#define EV_IF_LOCK      -112
+#define EV_PROTO_L2     -113
+#define EV_ACCEPT       -114
+#define EV_DIAL         -115
+#define EV_HUP          -116
+#define EV_BC_OPEN      -117
+#define EV_BC_CLOSED    -118
 
 /* input state */
-#define INS_command     0x0001
-#define INS_DLE_char    0x0002
-#define INS_byte_stuff  0x0004
-#define INS_have_data   0x0008
-#define INS_skip_frame  0x0010
-#define INS_DLE_command 0x0020
+#define INS_command     0x0001
+#define INS_DLE_char    0x0002
+#define INS_byte_stuff  0x0004
+#define INS_have_data   0x0008
+#define INS_skip_frame  0x0010
+#define INS_DLE_command 0x0020
 #define INS_flag_hunt   0x0040
 
 /* channel state */
@@ -248,27 +267,27 @@ void gigaset_dbg_buffer(enum debuglevel level, const unsigned char *msg,
 #define CHS_B_UP        0x02
 #define CHS_NOTIFY_LL   0x04
 
-#define ICALL_REJECT  0
-#define ICALL_ACCEPT  1
-#define ICALL_IGNORE  2
+#define ICALL_REJECT    0
+#define ICALL_ACCEPT    1
+#define ICALL_IGNORE    2
 
 /* device state */
-#define MS_UNINITIALIZED        0
-#define MS_INIT                 1
-#define MS_LOCKED               2
-#define MS_SHUTDOWN             3
-#define MS_RECOVER              4
-#define MS_READY                5
+#define MS_UNINITIALIZED        0
+#define MS_INIT                 1
+#define MS_LOCKED               2
+#define MS_SHUTDOWN             3
+#define MS_RECOVER              4
+#define MS_READY                5
 
 /* mode */
-#define M_UNKNOWN       0
-#define M_CONFIG        1
-#define M_UNIMODEM      2
-#define M_CID           3
+#define M_UNKNOWN       0
+#define M_CONFIG        1
+#define M_UNIMODEM      2
+#define M_CID           3
 
 /* start mode */
-#define SM_LOCKED       0
-#define SM_ISDN         1 /* default */
+#define SM_LOCKED       0
+#define SM_ISDN         1 /* default */
 
 struct gigaset_ops;
 struct gigaset_driver;
@@ -283,27 +302,26 @@ struct ser_bc_state;
 struct bas_bc_state;
 
 struct reply_t {
-        int     resp_code;      /* RSP_XXXX */
-        int     min_ConState;   /* <0 => ignore */
-        int     max_ConState;   /* <0 => ignore */
-        int     parameter;      /* e.g. ZSAU_XXXX <0: ignore*/
-        int     new_ConState;   /* <0 => ignore */
-        int     timeout;        /* >0 => *HZ; <=0 => TOUT_XXXX*/
-        int     action[MAXACT]; /* ACT_XXXX */
-        char *command;        /* NULL==none */
+        int     resp_code;      /* RSP_XXXX */
+        int     min_ConState;   /* <0 => ignore */
+        int     max_ConState;   /* <0 => ignore */
+        int     parameter;      /* e.g. ZSAU_XXXX <0: ignore*/
+        int     new_ConState;   /* <0 => ignore */
+        int     timeout;        /* >0 => *HZ; <=0 => TOUT_XXXX*/
+        int     action[MAXACT]; /* ACT_XXXX */
+        char    *command;       /* NULL==none */
 };
 
 extern struct reply_t gigaset_tab_cid_m10x[];
 extern struct reply_t gigaset_tab_nocid_m10x[];
 
 struct inbuf_t {
-        unsigned char           *rcvbuf;                /* usb-gigaset receive buffer */
+        unsigned char           *rcvbuf;        /* usb-gigaset receive buffer */
         struct bc_state         *bcs;
-        struct cardstate *cs;
-        int inputstate;
-
-        atomic_t head, tail;
-        unsigned char data[RBUFSIZE];
+        struct cardstate        *cs;
+        int                     inputstate;
+        atomic_t                head, tail;
+        unsigned char           data[RBUFSIZE];
 };
 
 /* isochronous write buffer structure
@@ -319,16 +337,9 @@ struct inbuf_t {
  *   if writesem <= 0, data[write..read-1] is currently being written to
  * - idle contains the byte value to repeat when the end of valid data is
  *   reached; if nextread==write (buffer contains no data to send), either the
- *   BAS_OUTBUFPAD bytes immediately before data[write] (if write>=BAS_OUTBUFPAD)
- *   or those of the pad area (if write<BAS_OUTBUFPAD) are also filled with that
- *   value
- * - optionally, the following statistics on the buffer's usage can be collected:
- *   maxfill: maximum number of bytes occupied
- *   idlefills: number of times a frame of idle bytes is prepared
- *   emptygets: number of times the buffer was empty when a data frame was requested
- *   backtoback: number of times two data packets were entered into the buffer
- *    without intervening idle flags
- *   nakedback: set if no idle flags have been inserted since the last data packet
+ *   BAS_OUTBUFPAD bytes immediately before data[write] (if
+ *   write>=BAS_OUTBUFPAD) or those of the pad area (if write<BAS_OUTBUFPAD)
+ *   are also filled with that value
  */
 struct isowbuf_t {
         atomic_t        read;
@@ -358,34 +369,28 @@ struct isow_urbctx_t {
  * it is currently assigned a B channel
  */
 struct at_state_t {
-        struct list_head        list;
-        int                     waiting;
-        int                     getstring;
-        atomic_t                timer_index;
+        struct list_head        list;
+        int                     waiting;
+        int                     getstring;
+        unsigned                timer_index;
         unsigned long           timer_expires;
         int                     timer_active;
-        unsigned int            ConState;                           /* State of connection */
-        struct reply_t          *replystruct;
-        int                     cid;
-        int                     int_var[VAR_NUM];   /* see VAR_XXXX */
-        char                    *str_var[STR_NUM];  /* see STR_XXXX */
-        unsigned                pending_commands;   /* see PC_XXXX */
-        atomic_t                seq_index;
-
-        struct cardstate    *cs;
-        struct bc_state         *bcs;
+        unsigned int            ConState;       /* State of connection */
+        struct reply_t          *replystruct;
+        int                     cid;
+        int                     int_var[VAR_NUM];       /* see VAR_XXXX */
+        char                    *str_var[STR_NUM];      /* see STR_XXXX */
+        unsigned                pending_commands;       /* see PC_XXXX */
+        unsigned                seq_index;
+
+        struct cardstate        *cs;
+        struct bc_state         *bcs;
 };
 
 struct resp_type_t {
         unsigned char   *response;
-        int             resp_code;           /* RSP_XXXX */
-        int             type;                /* RT_XXXX */
-};
-
-struct prot_skb {
-        atomic_t                empty;
-        struct semaphore        *sem;
-        struct sk_buff          *skb;
+        int             resp_code;      /* RSP_XXXX */
+        int             type;           /* RT_XXXX */
 };
 
 struct event_t {
@@ -398,29 +403,29 @@ struct event_t {
 
 /* This buffer holds all information about the used B-Channel */
 struct bc_state {
-        struct sk_buff *tx_skb;                        /* Current transfer buffer to modem */
-        struct sk_buff_head squeue;                    /* B-Channel send Queue */
+        struct sk_buff *tx_skb;         /* Current transfer buffer to modem */
+        struct sk_buff_head squeue;     /* B-Channel send Queue */
 
         /* Variables for debugging .. */
-        int corrupted;                                   /* Counter for corrupted packages */
-        int trans_down;                                  /* Counter of packages (downstream) */
-        int trans_up;                                    /* Counter of packages (upstream) */
+        int corrupted;                  /* Counter for corrupted packages */
+        int trans_down;                 /* Counter of packages (downstream) */
+        int trans_up;                   /* Counter of packages (upstream) */
 
         struct at_state_t at_state;
         unsigned long rcvbytes;
 
         __u16 fcs;
         struct sk_buff *skb;
-        int inputstate; /* see INS_XXXX */
+        int inputstate;                 /* see INS_XXXX */
 
         int channel;
 
         struct cardstate *cs;
 
-        unsigned chstate;                       /* bitmap (CHS_*) */
+        unsigned chstate;               /* bitmap (CHS_*) */
         int ignore;
-        unsigned        proto2;                 /* Layer 2 protocol (ISDN_PROTO_L2_*) */
-        char            *commands[AT_NUM]; /* see AT_XXXX */
+        unsigned proto2;                /* Layer 2 protocol (ISDN_PROTO_L2_*) */
+        char *commands[AT_NUM];         /* see AT_XXXX */
 
 #ifdef CONFIG_GIGASET_DEBUG
         int emptycount;
@@ -428,37 +433,39 @@ struct bc_state {
         int busy;
         int use_count;
 
-        /* hardware drivers */
+        /* private data of hardware drivers */
         union {
-                struct ser_bc_state *ser;                /* private data of serial hardware driver */
-                struct usb_bc_state *usb;                /* private data of usb hardware driver */
-                struct bas_bc_state *bas;
+                struct ser_bc_state *ser;       /* serial hardware driver */
+                struct usb_bc_state *usb;       /* usb hardware driver (m105) */
+                struct bas_bc_state *bas;       /* usb hardware driver (base) */
         } hw;
 };
 
 struct cardstate {
         struct gigaset_driver *driver;
         unsigned minor_index;
+        struct device *dev;
 
         const struct gigaset_ops *ops;
 
         /* Stuff to handle communication */
-        //wait_queue_head_t initwait;
         wait_queue_head_t waitqueue;
         int waiting;
-        atomic_t mode;                       /* see M_XXXX */
-        atomic_t mstate;                     /* Modem state: see MS_XXXX */
-                                             /* only changed by the event layer */
+        atomic_t mode;                  /* see M_XXXX */
+        atomic_t mstate;                /* Modem state: see MS_XXXX */
+                                        /* only changed by the event layer */
         int cmd_result;
 
         int channels;
-        struct bc_state *bcs;                /* Array of struct bc_state */
+        struct bc_state *bcs;           /* Array of struct bc_state */
 
-        int onechannel;                      /* data and commands transmitted in one stream (M10x) */
+        int onechannel;                 /* data and commands transmitted in one
+                                           stream (M10x) */
 
         spinlock_t lock;
-        struct at_state_t at_state;          /* at_state_t for cid == 0 */
-        struct list_head temp_at_states;     /* list of temporary "struct at_state_t"s without B channel */
+        struct at_state_t at_state;     /* at_state_t for cid == 0 */
+        struct list_head temp_at_states;/* list of temporary "struct
+                                           at_state_t"s without B channel */
 
         struct inbuf_t *inbuf;
 
@@ -474,58 +481,69 @@ struct cardstate {
         unsigned fwver[4];
         int gotfwver;
 
-        atomic_t running;                    /* !=0 if events are handled */
-        atomic_t connected;                  /* !=0 if hardware is connected */
+        unsigned running;               /* !=0 if events are handled */
+        unsigned connected;             /* !=0 if hardware is connected */
+        unsigned isdn_up;               /* !=0 after ISDN_STAT_RUN */
 
-        atomic_t cidmode;
+        unsigned cidmode;
 
-        int myid;                            /* id for communication with LL */
+        int myid;                       /* id for communication with LL */
         isdn_if iif;
 
         struct reply_t *tabnocid;
         struct reply_t *tabcid;
         int cs_init;
-        int ignoreframes;                    /* frames to ignore after setting up the B channel */
-        struct semaphore sem;                /* locks this structure: */
-                                             /*   connected is not changed, */
-                                             /*   hardware_up is not changed, */
-                                             /*   MState is not changed to or from MS_LOCKED */
+        int ignoreframes;               /* frames to ignore after setting up the
+                                           B channel */
+        struct mutex mutex;             /* locks this structure:
+                                         *   connected is not changed,
+                                         *   hardware_up is not changed,
+                                         *   MState is not changed to or from
+                                         *   MS_LOCKED */
 
         struct timer_list timer;
         int retry_count;
-        int dle;                             /* !=0 if modem commands/responses are dle encoded */
-        int cur_at_seq;                      /* sequence of AT commands being processed */
-        int curchannel;                      /* channel, those commands are meant for */
-        atomic_t commands_pending;           /* flag(s) in xxx.commands_pending have been set */
-        struct tasklet_struct event_tasklet; /* tasklet for serializing AT commands. Scheduled
-                                              *   -> for modem reponses (and incomming data for M10x)
-                                              *   -> on timeout
-                                              *   -> after setting bits in xxx.at_state.pending_command
-                                              *      (e.g. command from LL) */
-        struct tasklet_struct write_tasklet; /* tasklet for serial output
-                                              * (not used in base driver) */
+        int dle;                        /* !=0 if modem commands/responses are
+                                           dle encoded */
+        int cur_at_seq;                 /* sequence of AT commands being
+                                           processed */
+        int curchannel;                 /* channel those commands are meant
+                                           for */
+        atomic_t commands_pending;      /* flag(s) in xxx.commands_pending have
+                                           been set */
+        struct tasklet_struct event_tasklet;
+                                        /* tasklet for serializing AT commands.
+                                         * Scheduled
+                                         *   -> for modem reponses (and
+                                         *      incoming data for M10x)
+                                         *   -> on timeout
+                                         *   -> after setting bits in
+                                         *      xxx.at_state.pending_command
+                                         *      (e.g. command from LL) */
+        struct tasklet_struct write_tasklet;
+                                        /* tasklet for serial output
+                                         * (not used in base driver) */
 
         /* event queue */
         struct event_t events[MAX_EVENTS];
-        atomic_t ev_tail, ev_head;
+        unsigned ev_tail, ev_head;
         spinlock_t ev_lock;
 
         /* current modem response */
         unsigned char respdata[MAX_RESP_SIZE];
         unsigned cbytes;
 
-        /* hardware drivers */
+        /* private data of hardware drivers */
         union {
-                struct usb_cardstate *usb; /* private data of USB hardware driver */
-                struct ser_cardstate *ser; /* private data of serial hardware driver */
-                struct bas_cardstate *bas; /* private data of base hardware driver */
+                struct usb_cardstate *usb; /* USB hardware driver (m105) */
+                struct ser_cardstate *ser; /* serial hardware driver */
+                struct bas_cardstate *bas; /* USB hardware driver (base) */
         } hw;
 };
 
 struct gigaset_driver {
         struct list_head list;
-        spinlock_t lock;                       /* locks minor tables and blocked */
-        //struct semaphore sem;                /* locks this structure */
+        spinlock_t lock;                /* locks minor tables and blocked */
         struct tty_driver *tty;
         unsigned have_tty;
         unsigned minor;
@@ -553,37 +571,42 @@ struct bas_bc_state {
         struct isow_urbctx_t    isoouturbs[BAS_OUTURBS];
         struct isow_urbctx_t    *isooutdone, *isooutfree, *isooutovfl;
         struct isowbuf_t        *isooutbuf;
-        unsigned numsub;                        /* submitted URB counter (for diagnostic messages only) */
+        unsigned numsub;                /* submitted URB counter
+                                           (for diagnostic messages only) */
         struct tasklet_struct   sent_tasklet;
 
         /* isochronous input state */
         spinlock_t isoinlock;
         struct urb *isoinurbs[BAS_INURBS];
         unsigned char isoinbuf[BAS_INBUFSIZE * BAS_INURBS];
-        struct urb *isoindone;                  /* completed isoc read URB */
-        int loststatus;                         /* status of dropped URB */
-        unsigned isoinlost;                     /* number of bytes lost */
-        /* state of bit unstuffing algorithm (in addition to BC_state.inputstate) */
-        unsigned seqlen;                        /* number of '1' bits not yet unstuffed */
-        unsigned inbyte, inbits;                /* collected bits for next byte */
+        struct urb *isoindone;          /* completed isoc read URB */
+        int loststatus;                 /* status of dropped URB */
+        unsigned isoinlost;             /* number of bytes lost */
+        /* state of bit unstuffing algorithm
+           (in addition to BC_state.inputstate) */
+        unsigned seqlen;                /* number of '1' bits not yet
+                                           unstuffed */
+        unsigned inbyte, inbits;        /* collected bits for next byte */
         /* statistics */
-        unsigned goodbytes;                     /* bytes correctly received */
-        unsigned alignerrs;                     /* frames with incomplete byte at end */
-        unsigned fcserrs;                       /* FCS errors */
-        unsigned frameerrs;                     /* framing errors */
-        unsigned giants;                        /* long frames */
-        unsigned runts;                         /* short frames */
-        unsigned aborts;                        /* HDLC aborts */
-        unsigned shared0s;                      /* '0' bits shared between flags */
-        unsigned stolen0s;                      /* '0' stuff bits also serving as leading flag bits */
+        unsigned goodbytes;             /* bytes correctly received */
+        unsigned alignerrs;             /* frames with incomplete byte at end */
+        unsigned fcserrs;               /* FCS errors */
+        unsigned frameerrs;             /* framing errors */
+        unsigned giants;                /* long frames */
+        unsigned runts;                 /* short frames */
+        unsigned aborts;                /* HDLC aborts */
+        unsigned shared0s;              /* '0' bits shared between flags */
+        unsigned stolen0s;              /* '0' stuff bits also serving as
+                                           leading flag bits */
         struct tasklet_struct rcvd_tasklet;
 };
 
 struct gigaset_ops {
-        /* Called from ev-layer.c/interface.c for sending AT commands to the device */
+        /* Called from ev-layer.c/interface.c for sending AT commands to the
+           device */
         int (*write_cmd)(struct cardstate *cs,
-                         const unsigned char *buf, int len,
-                         struct tasklet_struct *wake_tasklet);
+                         const unsigned char *buf, int len,
+                         struct tasklet_struct *wake_tasklet);
 
         /* Called from interface.c for additional device control */
         int (*write_room)(struct cardstate *cs);
@@ -604,7 +627,8 @@ struct gigaset_ops {
         /* Called by gigaset_freecs() for freeing bcs->hw.xxx */
         int (*freebcshw)(struct bc_state *bcs);
 
-        /* Called by gigaset_stop() or gigaset_bchannel_down() for resetting bcs->hw.xxx */
+        /* Called by gigaset_stop() or gigaset_bchannel_down() for resetting
+           bcs->hw.xxx */
         void (*reinitbcshw)(struct bc_state *bcs);
 
         /* Called by gigaset_initcs() for setting up cs->hw.xxx */
@@ -613,13 +637,10 @@ struct gigaset_ops {
         /* Called by gigaset_freecs() for freeing cs->hw.xxx */
         void (*freecshw)(struct cardstate *cs);
 
-        ///* Called by gigaset_stop() for killing URBs, shutting down the device, ...
-        //   hardwareup: ==0: don't try to shut down the device, hardware is really not accessible
-        //             !=0: hardware still up */
-        //void (*stophw)(struct cardstate *cs, int hardwareup);
-
-        /* Called from common.c/interface.c for additional serial port control */
-        int (*set_modem_ctrl)(struct cardstate *cs, unsigned old_state, unsigned new_state);
+        /* Called from common.c/interface.c for additional serial port
+           control */
+        int (*set_modem_ctrl)(struct cardstate *cs, unsigned old_state,
+                              unsigned new_state);
         int (*baud_rate)(struct cardstate *cs, unsigned cflag);
         int (*set_line_ctrl)(struct cardstate *cs, unsigned cflag);
 
@@ -639,7 +660,7 @@ struct gigaset_ops {
  * <DLE_FLAG>:  0x10
  * <EVENT>:     ((a-z)* | (A-Z)* | (0-10)*)+
  */
-#define DLE_FLAG       0x10
+#define DLE_FLAG        0x10
 
 /* ===========================================================================
  *  Functions implemented in asyncdata.c
@@ -667,7 +688,8 @@ void gigaset_isoc_input(struct inbuf_t *inbuf);
 
 /* Called from bas-gigaset.c to process a block of data
  * received through the isochronous channel */
-void gigaset_isoc_receive(unsigned char *src, unsigned count, struct bc_state *bcs);
+void gigaset_isoc_receive(unsigned char *src, unsigned count,
+                          struct bc_state *bcs);
 
 /* Called from bas-gigaset.c to put a block of data
  * into the isochronous output buffer */
@@ -703,7 +725,7 @@ static inline void gigaset_isdn_rcv_err(struct bc_state *bcs)
         isdn_ctrl response;
 
         /* error -> LL */
-        dbg(DEBUG_CMD, "sending L1ERR");
+        gig_dbg(DEBUG_CMD, "sending L1ERR");
         response.driver = bcs->cs->myid;
         response.command = ISDN_STAT_L1ERR;
         response.arg = bcs->channel;
@@ -727,8 +749,8 @@ void gigaset_handle_modem_response(struct cardstate *cs);
  */
 
 /* initialize sysfs for device */
-void gigaset_init_dev_sysfs(struct usb_interface *interface);
-void gigaset_free_dev_sysfs(struct usb_interface *interface);
+void gigaset_init_dev_sysfs(struct cardstate *cs);
+void gigaset_free_dev_sysfs(struct cardstate *cs);
 
 /* ===========================================================================
  *  Functions implemented in common.c/gigaset.h
@@ -736,7 +758,7 @@ void gigaset_free_dev_sysfs(struct usb_interface *interface);
 
 void gigaset_bcs_reinit(struct bc_state *bcs);
 void gigaset_at_init(struct at_state_t *at_state, struct bc_state *bcs,
-                     struct cardstate *cs, int cid);
+                     struct cardstate *cs, int cid);
 int gigaset_get_channel(struct bc_state *bcs);
 void gigaset_free_channel(struct bc_state *bcs);
 int gigaset_get_channels(struct cardstate *cs);
@@ -745,16 +767,15 @@ void gigaset_block_channels(struct cardstate *cs);
 
 /* Allocate and initialize driver structure. */
 struct gigaset_driver *gigaset_initdriver(unsigned minor, unsigned minors,
-                                          const char *procname,
-                                          const char *devname,
-                                          const char *devfsname,
-                                          const struct gigaset_ops *ops,
-                                          struct module *owner);
+                                          const char *procname,
+                                          const char *devname,
+                                          const char *devfsname,
+                                          const struct gigaset_ops *ops,
+                                          struct module *owner);
 
 /* Deallocate driver structure. */
 void gigaset_freedriver(struct gigaset_driver *drv);
 void gigaset_debugdrivers(void);
-struct cardstate *gigaset_get_cs_by_minor(unsigned minor);
 struct cardstate *gigaset_get_cs_by_tty(struct tty_struct *tty);
 struct cardstate *gigaset_get_cs_by_id(int id);
 
@@ -763,7 +784,8 @@ struct cardstate *gigaset_getunassignedcs(struct gigaset_driver *drv);
 void gigaset_unassign(struct cardstate *cs);
 void gigaset_blockdriver(struct gigaset_driver *drv);
 
-/* Allocate and initialize card state. Calls hardware dependent gigaset_init[b]cs(). */
+/* Allocate and initialize card state. Calls hardware dependent
+   gigaset_init[b]cs(). */
 struct cardstate *gigaset_initcs(struct gigaset_driver *drv, int channels,
                                  int onechannel, int ignoreframes,
                                  int cidmode, const char *modulename);
@@ -788,8 +810,8 @@ void gigaset_skb_sent(struct bc_state *bcs, struct sk_buff *skb);
  * ptr must be kmalloc()ed (and not be freed by the caller).
  */
 struct event_t *gigaset_add_event(struct cardstate *cs,
-                                  struct at_state_t *at_state, int type,
-                                  void *ptr, int parameter, void *arg);
+                                  struct at_state_t *at_state, int type,
+                                  void *ptr, int parameter, void *arg);
 
 /* Called on CONFIG1 command from frontend. */
 int gigaset_enterconfigmode(struct cardstate *cs); //0: success <0: errorcode
@@ -799,7 +821,7 @@ static inline void gigaset_schedule_event(struct cardstate *cs)
 {
         unsigned long flags;
         spin_lock_irqsave(&cs->lock, flags);
-        if (atomic_read(&cs->running))
+        if (cs->running)
                 tasklet_schedule(&cs->event_tasklet);
         spin_unlock_irqrestore(&cs->lock, flags);
 }
@@ -810,7 +832,7 @@ static inline void gigaset_bchannel_down(struct bc_state *bcs)
 {
         gigaset_add_event(bcs->cs, &bcs->at_state, EV_BC_CLOSED, NULL, 0, NULL);
 
-        dbg(DEBUG_CMD, "scheduling BC_CLOSED");
+        gig_dbg(DEBUG_CMD, "scheduling BC_CLOSED");
         gigaset_schedule_event(bcs->cs);
 }
 
@@ -820,36 +842,19 @@ static inline void gigaset_bchannel_up(struct bc_state *bcs)
 {
         gigaset_add_event(bcs->cs, &bcs->at_state, EV_BC_OPEN, NULL, 0, NULL);
 
-        dbg(DEBUG_CMD, "scheduling BC_OPEN");
+        gig_dbg(DEBUG_CMD, "scheduling BC_OPEN");
         gigaset_schedule_event(bcs->cs);
 }
 
 /* handling routines for sk_buff */
 /* ============================= */
 
-/* private version of __skb_put()
- * append 'len' bytes to the content of 'skb', already knowing that the
- * existing buffer can accomodate them
- * returns a pointer to the location where the new bytes should be copied to
- * This function does not take any locks so it must be called with the
- * appropriate locks held only.
- */
-static inline unsigned char *gigaset_skb_put_quick(struct sk_buff *skb,
-                                                   unsigned int len)
-{
-        unsigned char *tmp = skb->tail;
-        /*SKB_LINEAR_ASSERT(skb);*/             /* not needed here */
-        skb->tail += len;
-        skb->len += len;
-        return tmp;
-}
-
 /* pass received skb to LL
  * Warning: skb must not be accessed anymore!
  */
 static inline void gigaset_rcv_skb(struct sk_buff *skb,
-                                   struct cardstate *cs,
-                                   struct bc_state *bcs)
+                                   struct cardstate *cs,
+                                   struct bc_state *bcs)
 {
         cs->iif.rcvcallb_skb(cs->myid, bcs->channel, skb);
         bcs->trans_down++;
@@ -859,8 +864,8 @@ static inline void gigaset_rcv_skb(struct sk_buff *skb,
  * Warning: skb must not be accessed anymore!
  */
 static inline void gigaset_rcv_error(struct sk_buff *procskb,
-                                     struct cardstate *cs,
-                                     struct bc_state *bcs)
+                                     struct cardstate *cs,
+                                     struct bc_state *bcs)
 {
         if (procskb)
                 dev_kfree_skb(procskb);
@@ -877,46 +882,9 @@ static inline void gigaset_rcv_error(struct sk_buff *procskb,
 /* bitwise byte inversion table */
 extern __u8 gigaset_invtab[];   /* in common.c */
 
-
 /* append received bytes to inbuf */
-static inline int gigaset_fill_inbuf(struct inbuf_t *inbuf,
-                                     const unsigned char *src,
-                                     unsigned numbytes)
-{
-        unsigned n, head, tail, bytesleft;
-
-        dbg(DEBUG_INTR, "received %u bytes", numbytes);
-
-        if (!numbytes)
-                return 0;
-
-        bytesleft = numbytes;
-        tail = atomic_read(&inbuf->tail);
-        head = atomic_read(&inbuf->head);
-        dbg(DEBUG_INTR, "buffer state: %u -> %u", head, tail);
-
-        while (bytesleft) {
-                if (head > tail)
-                        n = head - 1 - tail;
-                else if (head == 0)
-                        n = (RBUFSIZE-1) - tail;
-                else
-                        n = RBUFSIZE - tail;
-                if (!n) {
-                        err("buffer overflow (%u bytes lost)", bytesleft);
-                        break;
-                }
-                if (n > bytesleft)
-                        n = bytesleft;
-                memcpy(inbuf->data + tail, src, n);
-                bytesleft -= n;
-                tail = (tail + n) % RBUFSIZE;
-                src += n;
-        }
-        dbg(DEBUG_INTR, "setting tail to %u", tail);
-        atomic_set(&inbuf->tail, tail);
-        return numbytes != bytesleft;
-}
+int gigaset_fill_inbuf(struct inbuf_t *inbuf, const unsigned char *src,
+                       unsigned numbytes);
 
 /* ===========================================================================
  *  Functions implemented in interface.c
@@ -924,7 +892,7 @@ static inline int gigaset_fill_inbuf(struct inbuf_t *inbuf,
 
 /* initialize interface */
 void gigaset_if_initdriver(struct gigaset_driver *drv, const char *procname,
-                           const char *devname, const char *devfsname);
+                           const char *devname, const char *devfsname);
 /* release interface */
 void gigaset_if_freedriver(struct gigaset_driver *drv);
 /* add minor */
@@ -933,6 +901,6 @@ void gigaset_if_init(struct cardstate *cs);
 void gigaset_if_free(struct cardstate *cs);
 /* device received data */
 void gigaset_if_receive(struct cardstate *cs,
-                        unsigned char *buffer, size_t len);
+                        unsigned char *buffer, size_t len);
 
 #endif
diff --git a/drivers/isdn/gigaset/i4l.c b/drivers/isdn/gigaset/i4l.c
index 731a675f21b0..0815dbfb8291 100644
--- a/drivers/isdn/gigaset/i4l.c
+++ b/drivers/isdn/gigaset/i4l.c
@@ -1,9 +1,9 @@
 /*
  * Stuff used by all variants of the driver
  *
- * Copyright (c) 2001 by Stefan Eilers (Eilers.Stefan@epost.de),
- *                       Hansjoerg Lipp (hjlipp@web.de),
- *                       Tilman Schmidt (tilman@imap.cc).
+ * Copyright (c) 2001 by Stefan Eilers,
+ *                       Hansjoerg Lipp <hjlipp@web.de>,
+ *                       Tilman Schmidt <tilman@imap.cc>.
  *
  * =====================================================================
  *      This program is free software; you can redistribute it and/or
@@ -11,15 +11,11 @@
  *      published by the Free Software Foundation; either version 2 of
  *      the License, or (at your option) any later version.
  * =====================================================================
- * ToDo: ...
- * =====================================================================
- * Version: $Id: i4l.c,v 1.3.2.9 2006/02/04 18:28:16 hjlipp Exp $
- * =====================================================================
  */
 
 #include "gigaset.h"
 
-/* == Handling of I4L IO ============================================================================*/
+/* == Handling of I4L IO =====================================================*/
 
 /* writebuf_from_LL
  * called by LL to transmit data on an open channel
@@ -29,14 +25,16 @@
  * parameters:
  *      driverID        driver ID as assigned by LL
  *      channel         channel number
- *      ack             if != 0 LL wants to be notified on completion via statcallb(ISDN_STAT_BSENT)
+ *      ack             if != 0 LL wants to be notified on completion via
+ *                      statcallb(ISDN_STAT_BSENT)
  *      skb             skb containing data to send
  * return value:
  *      number of accepted bytes
  *      0 if temporarily unable to accept data (out of buffer space)
  *      <0 on error (eg. -EINVAL)
  */
-static int writebuf_from_LL(int driverID, int channel, int ack, struct sk_buff *skb)
+static int writebuf_from_LL(int driverID, int channel, int ack,
+                            struct sk_buff *skb)
 {
         struct cardstate *cs;
         struct bc_state *bcs;
@@ -54,31 +52,28 @@ static int writebuf_from_LL(int driverID, int channel, int ack, struct sk_buff *
         bcs = &cs->bcs[channel];
         len = skb->len;
 
-        dbg(DEBUG_LLDATA,
-            "Receiving data from LL (id: %d, channel: %d, ack: %d, size: %d)",
-            driverID, channel, ack, len);
+        gig_dbg(DEBUG_LLDATA,
+                "Receiving data from LL (id: %d, ch: %d, ack: %d, sz: %d)",
+                driverID, channel, ack, len);
 
         if (!len) {
                 if (ack)
-                        warn("not ACKing empty packet from LL");
+                        notice("%s: not ACKing empty packet", __func__);
                 return 0;
         }
         if (len > MAX_BUF_SIZE) {
-                err("%s: packet too large (%d bytes)", __func__, channel);
+                err("%s: packet too large (%d bytes)", __func__, len);
                 return -EINVAL;
         }
 
-        if (!atomic_read(&cs->connected))
-                return -ENODEV;
-
         skblen = ack ? len : 0;
         skb->head[0] = skblen & 0xff;
         skb->head[1] = skblen >> 8;
-        dbg(DEBUG_MCMD, "skb: len=%u, skblen=%u: %02x %02x", len, skblen,
-             (unsigned) skb->head[0], (unsigned) skb->head[1]);
+        gig_dbg(DEBUG_MCMD, "skb: len=%u, skblen=%u: %02x %02x",
+                len, skblen, (unsigned) skb->head[0], (unsigned) skb->head[1]);
 
         /* pass to device-specific module */
-        return cs->ops->send_skb(bcs, skb);
+        return cs->ops->send_skb(bcs, skb); //FIXME cs->ops->send_skb() must handle !cs->connected correctly
 }
 
 void gigaset_skb_sent(struct bc_state *bcs, struct sk_buff *skb)
@@ -89,14 +84,14 @@ void gigaset_skb_sent(struct bc_state *bcs, struct sk_buff *skb)
         ++bcs->trans_up;
 
         if (skb->len)
-                warn("%s: skb->len==%d", __func__, skb->len);
+                dev_warn(bcs->cs->dev, "%s: skb->len==%d\n",
+                         __func__, skb->len);
 
         len = (unsigned char) skb->head[0] |
               (unsigned) (unsigned char) skb->head[1] << 8;
         if (len) {
-                dbg(DEBUG_MCMD,
-                    "Acknowledge sending to LL (id: %d, channel: %d size: %u)",
-                    bcs->cs->myid, bcs->channel, len);
+                gig_dbg(DEBUG_MCMD, "ACKing to LL (id: %d, ch: %d, sz: %u)",
+                        bcs->cs->myid, bcs->channel, len);
 
                 response.driver = bcs->cs->myid;
                 response.command = ISDN_STAT_BSENT;
@@ -119,15 +114,12 @@ static int command_from_LL(isdn_ctrl *cntrl)
         struct bc_state *bcs;
         int retval = 0;
         struct setup_parm *sp;
+        unsigned param;
+        unsigned long flags;
 
-        //dbg(DEBUG_ANY, "Gigaset_HW: Receiving command");
         gigaset_debugdrivers();
 
-        /* Terminate this call if no device is present. Bt if the command is "ISDN_CMD_LOCK" or
-         * "ISDN_CMD_UNLOCK" then execute it due to the fact that they are device independent !
-         */
-        //FIXME "remove test for &connected"
-        if ((!cs || !atomic_read(&cs->connected))) {
+        if (!cs) {
                 warn("LL tried to access unknown device with nr. %d",
                      cntrl->driver);
                 return -ENODEV;
@@ -135,29 +127,30 @@ static int command_from_LL(isdn_ctrl *cntrl)
 
         switch (cntrl->command) {
         case ISDN_CMD_IOCTL:
-
-                dbg(DEBUG_ANY, "ISDN_CMD_IOCTL (driver:%d,arg: %ld)",
-                    cntrl->driver, cntrl->arg);
+                gig_dbg(DEBUG_ANY, "ISDN_CMD_IOCTL (driver: %d, arg: %ld)",
+                        cntrl->driver, cntrl->arg);
 
                 warn("ISDN_CMD_IOCTL is not supported.");
                 return -EINVAL;
 
         case ISDN_CMD_DIAL:
-                dbg(DEBUG_ANY, "ISDN_CMD_DIAL (driver: %d, channel: %ld, "
-                    "phone: %s,ownmsn: %s, si1: %d, si2: %d)",
-                    cntrl->driver, cntrl->arg,
-                    cntrl->parm.setup.phone, cntrl->parm.setup.eazmsn,
-                    cntrl->parm.setup.si1, cntrl->parm.setup.si2);
+                gig_dbg(DEBUG_ANY,
+                        "ISDN_CMD_DIAL (driver: %d, ch: %ld, "
+                        "phone: %s, ownmsn: %s, si1: %d, si2: %d)",
+                        cntrl->driver, cntrl->arg,
+                        cntrl->parm.setup.phone, cntrl->parm.setup.eazmsn,
+                        cntrl->parm.setup.si1, cntrl->parm.setup.si2);
 
                 if (cntrl->arg >= cs->channels) {
-                        err("invalid channel (%d)", (int) cntrl->arg);
+                        err("ISDN_CMD_DIAL: invalid channel (%d)",
+                            (int) cntrl->arg);
                         return -EINVAL;
                 }
 
                 bcs = cs->bcs + cntrl->arg;
 
                 if (!gigaset_get_channel(bcs)) {
-                        err("channel not free");
+                        err("ISDN_CMD_DIAL: channel not free");
                         return -EBUSY;
                 }
 
@@ -169,42 +162,46 @@ static int command_from_LL(isdn_ctrl *cntrl)
                 }
                 *sp = cntrl->parm.setup;
 
-                if (!gigaset_add_event(cs, &bcs->at_state, EV_DIAL, sp,
-                                       atomic_read(&bcs->at_state.seq_index),
-                                       NULL)) {
+                spin_lock_irqsave(&cs->lock, flags);
+                param = bcs->at_state.seq_index;
+                spin_unlock_irqrestore(&cs->lock, flags);
+
+                if (!gigaset_add_event(cs, &bcs->at_state, EV_DIAL, sp, param,
+                                       NULL)) {
                         //FIXME what should we do?
                         kfree(sp);
                         gigaset_free_channel(bcs);
                         return -ENOMEM;
                 }
 
-                dbg(DEBUG_CMD, "scheduling DIAL");
+                gig_dbg(DEBUG_CMD, "scheduling DIAL");
                 gigaset_schedule_event(cs);
                 break;
         case ISDN_CMD_ACCEPTD: //FIXME
-                dbg(DEBUG_ANY, "ISDN_CMD_ACCEPTD");
+                gig_dbg(DEBUG_ANY, "ISDN_CMD_ACCEPTD");
 
                 if (cntrl->arg >= cs->channels) {
-                        err("invalid channel (%d)", (int) cntrl->arg);
+                        err("ISDN_CMD_ACCEPTD: invalid channel (%d)",
+                            (int) cntrl->arg);
                         return -EINVAL;
                 }
 
                 if (!gigaset_add_event(cs, &cs->bcs[cntrl->arg].at_state,
-                                       EV_ACCEPT, NULL, 0, NULL)) {
+                                       EV_ACCEPT, NULL, 0, NULL)) {
                         //FIXME what should we do?
                         return -ENOMEM;
                 }
 
-                dbg(DEBUG_CMD, "scheduling ACCEPT");
+                gig_dbg(DEBUG_CMD, "scheduling ACCEPT");
                 gigaset_schedule_event(cs);
 
                 break;
         case ISDN_CMD_ACCEPTB:
-                dbg(DEBUG_ANY, "ISDN_CMD_ACCEPTB");
+                gig_dbg(DEBUG_ANY, "ISDN_CMD_ACCEPTB");
                 break;
         case ISDN_CMD_HANGUP:
-                dbg(DEBUG_ANY,
-                    "ISDN_CMD_HANGUP (channel: %d)", (int) cntrl->arg);
+                gig_dbg(DEBUG_ANY, "ISDN_CMD_HANGUP (ch: %d)",
+                        (int) cntrl->arg);
 
                 if (cntrl->arg >= cs->channels) {
                         err("ISDN_CMD_HANGUP: invalid channel (%u)",
@@ -213,66 +210,68 @@ static int command_from_LL(isdn_ctrl *cntrl)
                 }
 
                 if (!gigaset_add_event(cs, &cs->bcs[cntrl->arg].at_state,
-                                       EV_HUP, NULL, 0, NULL)) {
+                                       EV_HUP, NULL, 0, NULL)) {
                         //FIXME what should we do?
                         return -ENOMEM;
                 }
 
-                dbg(DEBUG_CMD, "scheduling HUP");
+                gig_dbg(DEBUG_CMD, "scheduling HUP");
                 gigaset_schedule_event(cs);
 
                 break;
-        case ISDN_CMD_CLREAZ:               /* Do not signal incoming signals */ //FIXME
-                dbg(DEBUG_ANY, "ISDN_CMD_CLREAZ");
+        case ISDN_CMD_CLREAZ: /* Do not signal incoming signals */ //FIXME
+                gig_dbg(DEBUG_ANY, "ISDN_CMD_CLREAZ");
                 break;
-        case ISDN_CMD_SETEAZ:               /* Signal incoming calls for given MSN */ //FIXME
-                dbg(DEBUG_ANY,
-                    "ISDN_CMD_SETEAZ (id:%d, channel: %ld, number: %s)",
-                    cntrl->driver, cntrl->arg, cntrl->parm.num);
+        case ISDN_CMD_SETEAZ: /* Signal incoming calls for given MSN */ //FIXME
+                gig_dbg(DEBUG_ANY,
+                        "ISDN_CMD_SETEAZ (id: %d, ch: %ld, number: %s)",
+                        cntrl->driver, cntrl->arg, cntrl->parm.num);
                 break;
-        case ISDN_CMD_SETL2:                /* Set L2 to given protocol */
-                dbg(DEBUG_ANY, "ISDN_CMD_SETL2 (Channel: %ld, Proto: %lx)",
-                     cntrl->arg & 0xff, (cntrl->arg >> 8));
+        case ISDN_CMD_SETL2: /* Set L2 to given protocol */
+                gig_dbg(DEBUG_ANY, "ISDN_CMD_SETL2 (ch: %ld, proto: %lx)",
+                        cntrl->arg & 0xff, (cntrl->arg >> 8));
 
                 if ((cntrl->arg & 0xff) >= cs->channels) {
-                        err("invalid channel (%u)",
+                        err("ISDN_CMD_SETL2: invalid channel (%u)",
                             (unsigned) cntrl->arg & 0xff);
                         return -EINVAL;
                 }
 
                 if (!gigaset_add_event(cs, &cs->bcs[cntrl->arg & 0xff].at_state,
-                                       EV_PROTO_L2, NULL, cntrl->arg >> 8,
-                                       NULL)) {
+                                       EV_PROTO_L2, NULL, cntrl->arg >> 8,
+                                       NULL)) {
                         //FIXME what should we do?
                         return -ENOMEM;
                 }
 
-                dbg(DEBUG_CMD, "scheduling PROTO_L2");
+                gig_dbg(DEBUG_CMD, "scheduling PROTO_L2");
                 gigaset_schedule_event(cs);
                 break;
-        case ISDN_CMD_SETL3:              /* Set L3 to given protocol */
-                dbg(DEBUG_ANY, "ISDN_CMD_SETL3 (Channel: %ld, Proto: %lx)",
-                     cntrl->arg & 0xff, (cntrl->arg >> 8));
+        case ISDN_CMD_SETL3: /* Set L3 to given protocol */
+                gig_dbg(DEBUG_ANY, "ISDN_CMD_SETL3 (ch: %ld, proto: %lx)",
+                        cntrl->arg & 0xff, (cntrl->arg >> 8));
 
                 if ((cntrl->arg & 0xff) >= cs->channels) {
-                        err("invalid channel (%u)",
+                        err("ISDN_CMD_SETL3: invalid channel (%u)",
                             (unsigned) cntrl->arg & 0xff);
                         return -EINVAL;
                 }
 
                 if (cntrl->arg >> 8 != ISDN_PROTO_L3_TRANS) {
-                        err("invalid protocol %lu", cntrl->arg >> 8);
+                        err("ISDN_CMD_SETL3: invalid protocol %lu",
+                            cntrl->arg >> 8);
                         return -EINVAL;
                 }
 
                 break;
         case ISDN_CMD_PROCEED:
-                dbg(DEBUG_ANY, "ISDN_CMD_PROCEED"); //FIXME
+                gig_dbg(DEBUG_ANY, "ISDN_CMD_PROCEED"); //FIXME
                 break;
         case ISDN_CMD_ALERT:
-                dbg(DEBUG_ANY, "ISDN_CMD_ALERT"); //FIXME
+                gig_dbg(DEBUG_ANY, "ISDN_CMD_ALERT"); //FIXME
                 if (cntrl->arg >= cs->channels) {
-                        err("invalid channel (%d)", (int) cntrl->arg);
+                        err("ISDN_CMD_ALERT: invalid channel (%d)",
+                            (int) cntrl->arg);
                         return -EINVAL;
                 }
                 //bcs = cs->bcs + cntrl->arg;
@@ -280,32 +279,31 @@ static int command_from_LL(isdn_ctrl *cntrl)
                 // FIXME
                 break;
         case ISDN_CMD_REDIR:
-                dbg(DEBUG_ANY, "ISDN_CMD_REDIR"); //FIXME
+                gig_dbg(DEBUG_ANY, "ISDN_CMD_REDIR"); //FIXME
                 break;
         case ISDN_CMD_PROT_IO:
-                dbg(DEBUG_ANY, "ISDN_CMD_PROT_IO");
+                gig_dbg(DEBUG_ANY, "ISDN_CMD_PROT_IO");
                 break;
         case ISDN_CMD_FAXCMD:
-                dbg(DEBUG_ANY, "ISDN_CMD_FAXCMD");
+                gig_dbg(DEBUG_ANY, "ISDN_CMD_FAXCMD");
                 break;
         case ISDN_CMD_GETL2:
-                dbg(DEBUG_ANY, "ISDN_CMD_GETL2");
+                gig_dbg(DEBUG_ANY, "ISDN_CMD_GETL2");
                 break;
         case ISDN_CMD_GETL3:
-                dbg(DEBUG_ANY, "ISDN_CMD_GETL3");
+                gig_dbg(DEBUG_ANY, "ISDN_CMD_GETL3");
                 break;
         case ISDN_CMD_GETEAZ:
-                dbg(DEBUG_ANY, "ISDN_CMD_GETEAZ");
+                gig_dbg(DEBUG_ANY, "ISDN_CMD_GETEAZ");
                 break;
         case ISDN_CMD_SETSIL:
-                dbg(DEBUG_ANY, "ISDN_CMD_SETSIL");
+                gig_dbg(DEBUG_ANY, "ISDN_CMD_SETSIL");
                 break;
         case ISDN_CMD_GETSIL:
-                dbg(DEBUG_ANY, "ISDN_CMD_GETSIL");
+                gig_dbg(DEBUG_ANY, "ISDN_CMD_GETSIL");
                 break;
         default:
-                err("unknown command %d from LL",
-                     cntrl->command);
+                err("unknown command %d from LL", cntrl->command);
                 return -EINVAL;
         }
 
@@ -350,7 +348,8 @@ int gigaset_isdn_setup_dial(struct at_state_t *at_state, void *data)
                 proto = 2; /* 0: Bitsynchron, 1: HDLC, 2: voice */
                 break;
         default:
-                err("invalid protocol: %u", bcs->proto2);
+                dev_err(bcs->cs->dev, "%s: invalid L2 protocol: %u\n",
+                        __func__, bcs->proto2);
                 return -EINVAL;
         }
 
@@ -378,7 +377,7 @@ int gigaset_isdn_setup_dial(struct at_state_t *at_state, void *data)
                 bcs->commands[i] = NULL;
                 if (length[i] &&
                     !(bcs->commands[i] = kmalloc(length[i], GFP_ATOMIC))) {
-                        err("out of memory");
+                        dev_err(bcs->cs->dev, "out of memory\n");
                         return -ENOMEM;
                 }
         }
@@ -396,10 +395,14 @@ int gigaset_isdn_setup_dial(struct at_state_t *at_state, void *data)
         }
 
         if (bcs->commands[AT_MSN])
-                snprintf(bcs->commands[AT_MSN], length[AT_MSN], "^SMSN=%s\r", sp->eazmsn);
-        snprintf(bcs->commands[AT_BC   ], length[AT_BC   ], "^SBC=%s\r", bc);
-        snprintf(bcs->commands[AT_PROTO], length[AT_PROTO], "^SBPR=%u\r", proto);
-        snprintf(bcs->commands[AT_ISO  ], length[AT_ISO  ], "^SISO=%u\r", (unsigned)bcs->channel + 1);
+                snprintf(bcs->commands[AT_MSN], length[AT_MSN],
+                         "^SMSN=%s\r", sp->eazmsn);
+        snprintf(bcs->commands[AT_BC   ], length[AT_BC   ],
+                 "^SBC=%s\r", bc);
+        snprintf(bcs->commands[AT_PROTO], length[AT_PROTO],
+                 "^SBPR=%u\r", proto);
+        snprintf(bcs->commands[AT_ISO  ], length[AT_ISO  ],
+                 "^SISO=%u\r", (unsigned)bcs->channel + 1);
 
         return 0;
 }
@@ -419,7 +422,8 @@ int gigaset_isdn_setup_accept(struct at_state_t *at_state)
                 proto = 2; /* 0: Bitsynchron, 1: HDLC, 2: voice */
                 break;
         default:
-                err("invalid protocol: %u", bcs->proto2);
+                dev_err(at_state->cs->dev, "%s: invalid protocol: %u\n",
+                        __func__, bcs->proto2);
                 return -EINVAL;
         }
 
@@ -436,13 +440,15 @@ int gigaset_isdn_setup_accept(struct at_state_t *at_state)
                 bcs->commands[i] = NULL;
                 if (length[i] &&
                     !(bcs->commands[i] = kmalloc(length[i], GFP_ATOMIC))) {
-                        err("out of memory");
+                        dev_err(at_state->cs->dev, "out of memory\n");
                         return -ENOMEM;
                 }
         }
 
-        snprintf(bcs->commands[AT_PROTO], length[AT_PROTO], "^SBPR=%u\r", proto);
-        snprintf(bcs->commands[AT_ISO  ], length[AT_ISO  ], "^SISO=%u\r", (unsigned) bcs->channel + 1);
+        snprintf(bcs->commands[AT_PROTO], length[AT_PROTO],
+                 "^SBPR=%u\r", proto);
+        snprintf(bcs->commands[AT_ISO  ], length[AT_ISO  ],
+                 "^SISO=%u\r", (unsigned) bcs->channel + 1);
 
         return 0;
 }
@@ -473,7 +479,7 @@ int gigaset_isdn_icall(struct at_state_t *at_state)
                 response.parm.setup.si1 = 1;
                 response.parm.setup.si2 = 2;
         } else {
-                warn("RING ignored - unsupported BC %s",
+                dev_warn(cs->dev, "RING ignored - unsupported BC %s\n",
                      at_state->str_var[STR_ZBC]);
                 return ICALL_IGNORE;
         }
@@ -491,18 +497,17 @@ int gigaset_isdn_icall(struct at_state_t *at_state)
                 response.parm.setup.eazmsn[0] = 0;
 
         if (!bcs) {
-                notice("no channel for incoming call");
-                dbg(DEBUG_CMD, "Sending ICALLW");
+                dev_notice(cs->dev, "no channel for incoming call\n");
                 response.command = ISDN_STAT_ICALLW;
                 response.arg = 0; //FIXME
         } else {
-                dbg(DEBUG_CMD, "Sending ICALL");
+                gig_dbg(DEBUG_CMD, "Sending ICALL");
                 response.command = ISDN_STAT_ICALL;
                 response.arg = bcs->channel; //FIXME
         }
         response.driver = cs->myid;
         retval = cs->iif.statcallb(&response);
-        dbg(DEBUG_CMD, "Response: %d", retval);
+        gig_dbg(DEBUG_CMD, "Response: %d", retval);
         switch (retval) {
         case 0: /* no takers */
                 return ICALL_IGNORE;
@@ -512,7 +517,8 @@ int gigaset_isdn_icall(struct at_state_t *at_state)
         case 2: /* reject */
                 return ICALL_REJECT;
         case 3: /* incomplete */
-                warn("LL requested unsupported feature: Incomplete Number");
+                dev_warn(cs->dev,
+                       "LL requested unsupported feature: Incomplete Number\n");
                 return ICALL_IGNORE;
         case 4: /* proceeding */
                 /* Gigaset will send ALERTING anyway.
@@ -520,10 +526,11 @@ int gigaset_isdn_icall(struct at_state_t *at_state)
                  */
                 return ICALL_ACCEPT;
         case 5: /* deflect */
-                warn("LL requested unsupported feature: Call Deflection");
+                dev_warn(cs->dev,
+                         "LL requested unsupported feature: Call Deflection\n");
                 return ICALL_IGNORE;
         default:
-                err("LL error %d on ICALL", retval);
+                dev_err(cs->dev, "LL error %d on ICALL\n", retval);
                 return ICALL_IGNORE;
         }
 }
@@ -533,7 +540,7 @@ int gigaset_register_to_LL(struct cardstate *cs, const char *isdnid)
 {
         isdn_if *iif = &cs->iif;
 
-        dbg(DEBUG_ANY, "Register driver capabilities to LL");
+        gig_dbg(DEBUG_ANY, "Register driver capabilities to LL");
 
         //iif->id[sizeof(iif->id) - 1]=0;
         //strncpy(iif->id, isdnid, sizeof(iif->id) - 1);
@@ -542,26 +549,26 @@ int gigaset_register_to_LL(struct cardstate *cs, const char *isdnid)
                 return -ENOMEM; //FIXME EINVAL/...??
 
         iif->owner = THIS_MODULE;
-        iif->channels = cs->channels;                        /* I am supporting just one channel *//* I was supporting...*/
+        iif->channels = cs->channels;
         iif->maxbufsize = MAX_BUF_SIZE;
-        iif->features = ISDN_FEATURE_L2_TRANS |   /* Our device is very advanced, therefore */
+        iif->features = ISDN_FEATURE_L2_TRANS |
                 ISDN_FEATURE_L2_HDLC |
 #ifdef GIG_X75
                 ISDN_FEATURE_L2_X75I |
 #endif
                 ISDN_FEATURE_L3_TRANS |
                 ISDN_FEATURE_P_EURO;
-        iif->hl_hdrlen = HW_HDR_LEN;              /* Area for storing ack */
+        iif->hl_hdrlen = HW_HDR_LEN;            /* Area for storing ack */
         iif->command = command_from_LL;
         iif->writebuf_skb = writebuf_from_LL;
-        iif->writecmd = NULL;                     /* Don't support isdnctrl */
-        iif->readstat = NULL;                     /* Don't support isdnctrl */
-        iif->rcvcallb_skb = NULL;                 /* Will be set by LL */
-        iif->statcallb = NULL;                    /* Will be set by LL */
+        iif->writecmd = NULL;                   /* Don't support isdnctrl */
+        iif->readstat = NULL;                   /* Don't support isdnctrl */
+        iif->rcvcallb_skb = NULL;               /* Will be set by LL */
+        iif->statcallb = NULL;                  /* Will be set by LL */
 
         if (!register_isdn(iif))
                 return 0;
 
-        cs->myid = iif->channels;                 /* Set my device id */
+        cs->myid = iif->channels;               /* Set my device id */
         return 1;
 }
diff --git a/drivers/isdn/gigaset/interface.c b/drivers/isdn/gigaset/interface.c
index 3a81d9c65141..08e4c4eea14d 100644
--- a/drivers/isdn/gigaset/interface.c
+++ b/drivers/isdn/gigaset/interface.c
@@ -9,8 +9,6 @@
  *    published by the Free Software Foundation; either version 2 of
  *    the License, or (at your option) any later version.
  * =====================================================================
- * Version: $Id: interface.c,v 1.14.4.15 2006/02/04 18:28:16 hjlipp Exp $
- * =====================================================================
  */
 
 #include "gigaset.h"
@@ -24,7 +22,7 @@ static int if_lock(struct cardstate *cs, int *arg)
 {
         int cmd = *arg;
 
-        dbg(DEBUG_IF, "%u: if_lock (%d)", cs->minor_index, cmd);
+        gig_dbg(DEBUG_IF, "%u: if_lock (%d)", cs->minor_index, cmd);
 
         if (cmd > 1)
                 return -EINVAL;
@@ -35,7 +33,7 @@ static int if_lock(struct cardstate *cs, int *arg)
         }
 
         if (!cmd && atomic_read(&cs->mstate) == MS_LOCKED
-            && atomic_read(&cs->connected)) {
+            && cs->connected) {
                 cs->ops->set_modem_ctrl(cs, 0, TIOCM_DTR|TIOCM_RTS);
                 cs->ops->baud_rate(cs, B115200);
                 cs->ops->set_line_ctrl(cs, CS8);
@@ -44,12 +42,12 @@ static int if_lock(struct cardstate *cs, int *arg)
 
         cs->waiting = 1;
         if (!gigaset_add_event(cs, &cs->at_state, EV_IF_LOCK,
-                               NULL, cmd, NULL)) {
+                               NULL, cmd, NULL)) {
                 cs->waiting = 0;
                 return -ENOMEM;
         }
 
-        dbg(DEBUG_CMD, "scheduling IF_LOCK");
+        gig_dbg(DEBUG_CMD, "scheduling IF_LOCK");
         gigaset_schedule_event(cs);
 
         wait_event(cs->waitqueue, !cs->waiting);
@@ -68,7 +66,7 @@ static int if_version(struct cardstate *cs, unsigned arg[4])
         static const unsigned compat[4] = GIG_COMPAT;
         unsigned cmd = arg[0];
 
-        dbg(DEBUG_IF, "%u: if_version (%d)", cs->minor_index, cmd);
+        gig_dbg(DEBUG_IF, "%u: if_version (%d)", cs->minor_index, cmd);
 
         switch (cmd) {
         case GIGVER_DRIVER:
@@ -80,12 +78,12 @@ static int if_version(struct cardstate *cs, unsigned arg[4])
         case GIGVER_FWBASE:
                 cs->waiting = 1;
                 if (!gigaset_add_event(cs, &cs->at_state, EV_IF_VER,
-                                       NULL, 0, arg)) {
+                                       NULL, 0, arg)) {
                         cs->waiting = 0;
                         return -ENOMEM;
                 }
 
-                dbg(DEBUG_CMD, "scheduling IF_VER");
+                gig_dbg(DEBUG_CMD, "scheduling IF_VER");
                 gigaset_schedule_event(cs);
 
                 wait_event(cs->waitqueue, !cs->waiting);
@@ -101,7 +99,7 @@ static int if_version(struct cardstate *cs, unsigned arg[4])
 
 static int if_config(struct cardstate *cs, int *arg)
 {
-        dbg(DEBUG_IF, "%u: if_config (%d)", cs->minor_index, *arg);
+        gig_dbg(DEBUG_IF, "%u: if_config (%d)", cs->minor_index, *arg);
 
         if (*arg != 1)
                 return -EINVAL;
@@ -109,6 +107,11 @@ static int if_config(struct cardstate *cs, int *arg)
         if (atomic_read(&cs->mstate) != MS_LOCKED)
                 return -EBUSY;
 
+        if (!cs->connected) {
+                err("not connected!");
+                return -ENODEV;
+        }
+
         *arg = 0;
         return gigaset_enterconfigmode(cs);
 }
@@ -119,7 +122,7 @@ static int if_config(struct cardstate *cs, int *arg)
 static int  if_open(struct tty_struct *tty, struct file *filp);
 static void if_close(struct tty_struct *tty, struct file *filp);
 static int  if_ioctl(struct tty_struct *tty, struct file *file,
-                     unsigned int cmd, unsigned long arg);
+                     unsigned int cmd, unsigned long arg);
 static int  if_write_room(struct tty_struct *tty);
 static int  if_chars_in_buffer(struct tty_struct *tty);
 static void if_throttle(struct tty_struct *tty);
@@ -127,9 +130,9 @@ static void if_unthrottle(struct tty_struct *tty);
 static void if_set_termios(struct tty_struct *tty, struct termios *old);
 static int  if_tiocmget(struct tty_struct *tty, struct file *file);
 static int  if_tiocmset(struct tty_struct *tty, struct file *file,
-                        unsigned int set, unsigned int clear);
+                        unsigned int set, unsigned int clear);
 static int  if_write(struct tty_struct *tty,
-                     const unsigned char *buf, int count);
+                     const unsigned char *buf, int count);
 
 static struct tty_operations if_ops = {
         .open =                 if_open,
@@ -153,8 +156,8 @@ static int if_open(struct tty_struct *tty, struct file *filp)
         struct cardstate *cs;
         unsigned long flags;
 
-        dbg(DEBUG_IF, "%d+%d: %s()", tty->driver->minor_start, tty->index,
-            __FUNCTION__);
+        gig_dbg(DEBUG_IF, "%d+%d: %s()",
+                tty->driver->minor_start, tty->index, __func__);
 
         tty->driver_data = NULL;
 
@@ -162,7 +165,7 @@ static int if_open(struct tty_struct *tty, struct file *filp)
         if (!cs)
                 return -ENODEV;
 
-        if (down_interruptible(&cs->sem))
+        if (mutex_lock_interruptible(&cs->mutex))
                 return -ERESTARTSYS; // FIXME -EINTR?
         tty->driver_data = cs;
 
@@ -173,10 +176,9 @@ static int if_open(struct tty_struct *tty, struct file *filp)
                 cs->tty = tty;
                 spin_unlock_irqrestore(&cs->lock, flags);
                 tty->low_latency = 1; //FIXME test
-                //FIXME
         }
 
-        up(&cs->sem);
+        mutex_unlock(&cs->mutex);
         return 0;
 }
 
@@ -187,30 +189,29 @@ static void if_close(struct tty_struct *tty, struct file *filp)
 
         cs = (struct cardstate *) tty->driver_data;
         if (!cs) {
-                err("cs==NULL in %s", __FUNCTION__);
+                err("cs==NULL in %s", __func__);
                 return;
         }
 
-        dbg(DEBUG_IF, "%u: %s()", cs->minor_index, __FUNCTION__);
+        gig_dbg(DEBUG_IF, "%u: %s()", cs->minor_index, __func__);
 
-        down(&cs->sem);
+        mutex_lock(&cs->mutex);
 
         if (!cs->open_count)
-                warn("%s: device not opened", __FUNCTION__);
+                warn("%s: device not opened", __func__);
         else {
                 if (!--cs->open_count) {
                         spin_lock_irqsave(&cs->lock, flags);
                         cs->tty = NULL;
                         spin_unlock_irqrestore(&cs->lock, flags);
-                        //FIXME
                 }
         }
 
-        up(&cs->sem);
+        mutex_unlock(&cs->mutex);
 }
 
 static int if_ioctl(struct tty_struct *tty, struct file *file,
-                    unsigned int cmd, unsigned long arg)
+                    unsigned int cmd, unsigned long arg)
 {
         struct cardstate *cs;
         int retval = -ENODEV;
@@ -220,17 +221,17 @@ static int if_ioctl(struct tty_struct *tty, struct file *file,
 
         cs = (struct cardstate *) tty->driver_data;
         if (!cs) {
-                err("cs==NULL in %s", __FUNCTION__);
+                err("cs==NULL in %s", __func__);
                 return -ENODEV;
         }
 
-        dbg(DEBUG_IF, "%u: %s(0x%x)", cs->minor_index, __FUNCTION__, cmd);
+        gig_dbg(DEBUG_IF, "%u: %s(0x%x)", cs->minor_index, __func__, cmd);
 
-        if (down_interruptible(&cs->sem))
+        if (mutex_lock_interruptible(&cs->mutex))
                 return -ERESTARTSYS; // FIXME -EINTR?
 
         if (!cs->open_count)
-                warn("%s: device not opened", __FUNCTION__);
+                warn("%s: device not opened", __func__);
         else {
                 retval = 0;
                 switch (cmd) {
@@ -250,37 +251,40 @@ static int if_ioctl(struct tty_struct *tty, struct file *file,
                         break;
                 case GIGASET_BRKCHARS:
                         //FIXME test if MS_LOCKED
-                        gigaset_dbg_buffer(DEBUG_IF, "GIGASET_BRKCHARS",
-                                           6, (const unsigned char *) arg, 1);
-                        if (!atomic_read(&cs->connected)) {
-                                dbg(DEBUG_ANY, "can't communicate with unplugged device");
+                        if (!cs->connected) {
+                                gig_dbg(DEBUG_ANY,
+                                    "can't communicate with unplugged device");
                                 retval = -ENODEV;
                                 break;
                         }
                         retval = copy_from_user(&buf,
-                                                (const unsigned char __user *) arg, 6)
-                                 ? -EFAULT : 0;
-                        if (retval >= 0)
+                                        (const unsigned char __user *) arg, 6)
+                                ? -EFAULT : 0;
+                        if (retval >= 0) {
+                                gigaset_dbg_buffer(DEBUG_IF, "GIGASET_BRKCHARS",
+                                                6, (const unsigned char *) arg);
                                 retval = cs->ops->brkchars(cs, buf);
+                        }
                         break;
                 case GIGASET_VERSION:
-                        retval = copy_from_user(version, (unsigned __user *) arg,
-                                                sizeof version) ? -EFAULT : 0;
+                        retval = copy_from_user(version,
+                                        (unsigned __user *) arg, sizeof version)
+                                ? -EFAULT : 0;
                         if (retval >= 0)
                                 retval = if_version(cs, version);
                         if (retval >= 0)
-                                retval = copy_to_user((unsigned __user *) arg, version,
-                                                      sizeof version)
-                                         ? -EFAULT : 0;
+                                retval = copy_to_user((unsigned __user *) arg,
+                                                      version, sizeof version)
+                                        ? -EFAULT : 0;
                         break;
-                default:
-                        dbg(DEBUG_ANY, "%s: arg not supported - 0x%04x",
-                            __FUNCTION__, cmd);
+                default:
+                        gig_dbg(DEBUG_ANY, "%s: arg not supported - 0x%04x",
+                                __func__, cmd);
                         retval = -ENOIOCTLCMD;
                 }
         }
 
-        up(&cs->sem);
+        mutex_unlock(&cs->mutex);
 
         return retval;
 }
@@ -292,25 +296,25 @@ static int if_tiocmget(struct tty_struct *tty, struct file *file)
 
         cs = (struct cardstate *) tty->driver_data;
         if (!cs) {
-                err("cs==NULL in %s", __FUNCTION__);
+                err("cs==NULL in %s", __func__);
                 return -ENODEV;
         }
 
-        dbg(DEBUG_IF, "%u: %s()", cs->minor_index, __FUNCTION__);
+        gig_dbg(DEBUG_IF, "%u: %s()", cs->minor_index, __func__);
 
-        if (down_interruptible(&cs->sem))
+        if (mutex_lock_interruptible(&cs->mutex))
                 return -ERESTARTSYS; // FIXME -EINTR?
 
         // FIXME read from device?
         retval = cs->control_state & (TIOCM_RTS|TIOCM_DTR);
 
-        up(&cs->sem);
+        mutex_unlock(&cs->mutex);
 
         return retval;
 }
 
 static int if_tiocmset(struct tty_struct *tty, struct file *file,
-                       unsigned int set, unsigned int clear)
+                       unsigned int set, unsigned int clear)
 {
         struct cardstate *cs;
         int retval;
@@ -318,18 +322,18 @@ static int if_tiocmset(struct tty_struct *tty, struct file *file,
 
         cs = (struct cardstate *) tty->driver_data;
         if (!cs) {
-                err("cs==NULL in %s", __FUNCTION__);
+                err("cs==NULL in %s", __func__);
                 return -ENODEV;
         }
 
-        dbg(DEBUG_IF,
-            "%u: %s(0x%x, 0x%x)", cs->minor_index, __FUNCTION__, set, clear);
+        gig_dbg(DEBUG_IF, "%u: %s(0x%x, 0x%x)",
+                cs->minor_index, __func__, set, clear);
 
-        if (down_interruptible(&cs->sem))
+        if (mutex_lock_interruptible(&cs->mutex))
                 return -ERESTARTSYS; // FIXME -EINTR?
 
-        if (!atomic_read(&cs->connected)) {
-                dbg(DEBUG_ANY, "can't communicate with unplugged device");
+        if (!cs->connected) {
+                gig_dbg(DEBUG_ANY, "can't communicate with unplugged device");
                 retval = -ENODEV;
         } else {
                 mc = (cs->control_state | set) & ~clear & (TIOCM_RTS|TIOCM_DTR);
@@ -337,7 +341,7 @@ static int if_tiocmset(struct tty_struct *tty, struct file *file,
                 cs->control_state = mc;
         }
 
-        up(&cs->sem);
+        mutex_unlock(&cs->mutex);
 
         return retval;
 }
@@ -349,29 +353,29 @@ static int if_write(struct tty_struct *tty, const unsigned char *buf, int count)
 
         cs = (struct cardstate *) tty->driver_data;
         if (!cs) {
-                err("cs==NULL in %s", __FUNCTION__);
+                err("cs==NULL in %s", __func__);
                 return -ENODEV;
         }
 
-        dbg(DEBUG_IF, "%u: %s()", cs->minor_index, __FUNCTION__);
+        gig_dbg(DEBUG_IF, "%u: %s()", cs->minor_index, __func__);
 
-        if (down_interruptible(&cs->sem))
+        if (mutex_lock_interruptible(&cs->mutex))
                 return -ERESTARTSYS; // FIXME -EINTR?
 
         if (!cs->open_count)
-                warn("%s: device not opened", __FUNCTION__);
+                warn("%s: device not opened", __func__);
         else if (atomic_read(&cs->mstate) != MS_LOCKED) {
                 warn("can't write to unlocked device");
                 retval = -EBUSY;
-        } else if (!atomic_read(&cs->connected)) {
-                dbg(DEBUG_ANY, "can't write to unplugged device");
+        } else if (!cs->connected) {
+                gig_dbg(DEBUG_ANY, "can't write to unplugged device");
                 retval = -EBUSY; //FIXME
         } else {
                 retval = cs->ops->write_cmd(cs, buf, count,
-                                            &cs->if_wake_tasklet);
+                                            &cs->if_wake_tasklet);
         }
 
-        up(&cs->sem);
+        mutex_unlock(&cs->mutex);
 
         return retval;
 }
@@ -383,27 +387,27 @@ static int if_write_room(struct tty_struct *tty)
 
         cs = (struct cardstate *) tty->driver_data;
         if (!cs) {
-                err("cs==NULL in %s", __FUNCTION__);
+                err("cs==NULL in %s", __func__);
                 return -ENODEV;
         }
 
-        dbg(DEBUG_IF, "%u: %s()", cs->minor_index, __FUNCTION__);
+        gig_dbg(DEBUG_IF, "%u: %s()", cs->minor_index, __func__);
 
-        if (down_interruptible(&cs->sem))
+        if (mutex_lock_interruptible(&cs->mutex))
                 return -ERESTARTSYS; // FIXME -EINTR?
 
         if (!cs->open_count)
-                warn("%s: device not opened", __FUNCTION__);
+                warn("%s: device not opened", __func__);
         else if (atomic_read(&cs->mstate) != MS_LOCKED) {
                 warn("can't write to unlocked device");
                 retval = -EBUSY; //FIXME
-        } else if (!atomic_read(&cs->connected)) {
-                dbg(DEBUG_ANY, "can't write to unplugged device");
+        } else if (!cs->connected) {
+                gig_dbg(DEBUG_ANY, "can't write to unplugged device");
                 retval = -EBUSY; //FIXME
         } else
                 retval = cs->ops->write_room(cs);
 
-        up(&cs->sem);
+        mutex_unlock(&cs->mutex);
 
         return retval;
 }
@@ -415,27 +419,27 @@ static int if_chars_in_buffer(struct tty_struct *tty)
 
         cs = (struct cardstate *) tty->driver_data;
         if (!cs) {
-                err("cs==NULL in %s", __FUNCTION__);
+                err("cs==NULL in %s", __func__);
                 return -ENODEV;
         }
 
-        dbg(DEBUG_IF, "%u: %s()", cs->minor_index, __FUNCTION__);
+        gig_dbg(DEBUG_IF, "%u: %s()", cs->minor_index, __func__);
 
-        if (down_interruptible(&cs->sem))
+        if (mutex_lock_interruptible(&cs->mutex))
                 return -ERESTARTSYS; // FIXME -EINTR?
 
         if (!cs->open_count)
-                warn("%s: device not opened", __FUNCTION__);
+                warn("%s: device not opened", __func__);
         else if (atomic_read(&cs->mstate) != MS_LOCKED) {
                 warn("can't write to unlocked device");
                 retval = -EBUSY;
-        } else if (!atomic_read(&cs->connected)) {
-                dbg(DEBUG_ANY, "can't write to unplugged device");
+        } else if (!cs->connected) {
+                gig_dbg(DEBUG_ANY, "can't write to unplugged device");
                 retval = -EBUSY; //FIXME
         } else
                 retval = cs->ops->chars_in_buffer(cs);
 
-        up(&cs->sem);
+        mutex_unlock(&cs->mutex);
 
         return retval;
 }
@@ -446,21 +450,21 @@ static void if_throttle(struct tty_struct *tty)
 
         cs = (struct cardstate *) tty->driver_data;
         if (!cs) {
-                err("cs==NULL in %s", __FUNCTION__);
+                err("cs==NULL in %s", __func__);
                 return;
         }
 
-        dbg(DEBUG_IF, "%u: %s()", cs->minor_index, __FUNCTION__);
+        gig_dbg(DEBUG_IF, "%u: %s()", cs->minor_index, __func__);
 
-        down(&cs->sem);
+        mutex_lock(&cs->mutex);
 
         if (!cs->open_count)
-                warn("%s: device not opened", __FUNCTION__);
+                warn("%s: device not opened", __func__);
         else {
                 //FIXME
         }
 
-        up(&cs->sem);
+        mutex_unlock(&cs->mutex);
 }
 
 static void if_unthrottle(struct tty_struct *tty)
@@ -469,21 +473,21 @@ static void if_unthrottle(struct tty_struct *tty)
 
         cs = (struct cardstate *) tty->driver_data;
         if (!cs) {
-                err("cs==NULL in %s", __FUNCTION__);
+                err("cs==NULL in %s", __func__);
                 return;
         }
 
-        dbg(DEBUG_IF, "%u: %s()", cs->minor_index, __FUNCTION__);
+        gig_dbg(DEBUG_IF, "%u: %s()", cs->minor_index, __func__);
 
-        down(&cs->sem);
+        mutex_lock(&cs->mutex);
 
         if (!cs->open_count)
-                warn("%s: device not opened", __FUNCTION__);
+                warn("%s: device not opened", __func__);
         else {
                 //FIXME
         }
 
-        up(&cs->sem);
+        mutex_unlock(&cs->mutex);
 }
 
 static void if_set_termios(struct tty_struct *tty, struct termios *old)
@@ -496,21 +500,21 @@ static void if_set_termios(struct tty_struct *tty, struct termios *old)
 
         cs = (struct cardstate *) tty->driver_data;
         if (!cs) {
-                err("cs==NULL in %s", __FUNCTION__);
+                err("cs==NULL in %s", __func__);
                 return;
         }
 
-        dbg(DEBUG_IF, "%u: %s()", cs->minor_index, __FUNCTION__);
+        gig_dbg(DEBUG_IF, "%u: %s()", cs->minor_index, __func__);
 
-        down(&cs->sem);
+        mutex_lock(&cs->mutex);
 
         if (!cs->open_count) {
-                warn("%s: device not opened", __FUNCTION__);
+                warn("%s: device not opened", __func__);
                 goto out;
         }
 
-        if (!atomic_read(&cs->connected)) {
-                dbg(DEBUG_ANY, "can't communicate with unplugged device");
+        if (!cs->connected) {
+                gig_dbg(DEBUG_ANY, "can't communicate with unplugged device");
                 goto out;
         }
 
@@ -518,8 +522,8 @@ static void if_set_termios(struct tty_struct *tty, struct termios *old)
         iflag = tty->termios->c_iflag;
         cflag = tty->termios->c_cflag;
         old_cflag = old ? old->c_cflag : cflag; //FIXME?
-        dbg(DEBUG_IF, "%u: iflag %x cflag %x old %x", cs->minor_index,
-            iflag, cflag, old_cflag);
+        gig_dbg(DEBUG_IF, "%u: iflag %x cflag %x old %x",
+                cs->minor_index, iflag, cflag, old_cflag);
 
         /* get a local copy of the current port settings */
         control_state = cs->control_state;
@@ -531,14 +535,15 @@ static void if_set_termios(struct tty_struct *tty, struct termios *old)
          * Premature optimization is the root of all evil.
          */
 
-        /* reassert DTR and (maybe) RTS on transition from B0 */
+        /* reassert DTR and (maybe) RTS on transition from B0 */
         if ((old_cflag & CBAUD) == B0) {
                 new_state = control_state | TIOCM_DTR;
                 /* don't set RTS if using hardware flow control */
                 if (!(old_cflag & CRTSCTS))
                         new_state |= TIOCM_RTS;
-                dbg(DEBUG_IF, "%u: from B0 - set DTR%s", cs->minor_index,
-                    (new_state & TIOCM_RTS) ? " only" : "/RTS");
+                gig_dbg(DEBUG_IF, "%u: from B0 - set DTR%s",
+                        cs->minor_index,
+                        (new_state & TIOCM_RTS) ? " only" : "/RTS");
                 cs->ops->set_modem_ctrl(cs, control_state, new_state);
                 control_state = new_state;
         }
@@ -547,7 +552,7 @@ static void if_set_termios(struct tty_struct *tty, struct termios *old)
 
         if ((cflag & CBAUD) == B0) {
                 /* Drop RTS and DTR */
-                dbg(DEBUG_IF, "%u: to B0 - drop DTR/RTS", cs->minor_index);
+                gig_dbg(DEBUG_IF, "%u: to B0 - drop DTR/RTS", cs->minor_index);
                 new_state = control_state & ~(TIOCM_DTR | TIOCM_RTS);
                 cs->ops->set_modem_ctrl(cs, control_state, new_state);
                 control_state = new_state;
@@ -567,15 +572,17 @@ static void if_set_termios(struct tty_struct *tty, struct termios *old)
          * Just do what we have seen with SniffUSB on Win98.
          */
         /* Drop DTR/RTS if no flow control otherwise assert */
-        dbg(DEBUG_IF, "%u: control_state %x", cs->minor_index, control_state);
+        gig_dbg(DEBUG_IF, "%u: control_state %x",
+                cs->minor_index, control_state);
         new_state = control_state;
         if ((iflag & IXOFF) || (iflag & IXON) || (cflag & CRTSCTS))
                 new_state |= TIOCM_DTR | TIOCM_RTS;
         else
                 new_state &= ~(TIOCM_DTR | TIOCM_RTS);
         if (new_state != control_state) {
-                dbg(DEBUG_IF, "%u: new_state %x", cs->minor_index, new_state);
-                gigaset_set_modem_ctrl(cs, control_state, new_state); // FIXME: mct_u232.c sets the old state here. is this a bug?
+                gig_dbg(DEBUG_IF, "%u: new_state %x",
+                        cs->minor_index, new_state);
+                gigaset_set_modem_ctrl(cs, control_state, new_state);
                 control_state = new_state;
         }
 #endif
@@ -584,7 +591,7 @@ static void if_set_termios(struct tty_struct *tty, struct termios *old)
         cs->control_state = control_state;
 
 out:
-        up(&cs->sem);
+        mutex_unlock(&cs->mutex);
 }
 
 
@@ -600,7 +607,7 @@ static void if_wake(unsigned long data)
 
         if ((tty->flags & (1 << TTY_DO_WRITE_WAKEUP)) &&
             tty->ldisc.write_wakeup) {
-                dbg(DEBUG_IF, "write wakeup call");
+                gig_dbg(DEBUG_IF, "write wakeup call");
                 tty->ldisc.write_wakeup(tty);
         }
 
@@ -635,14 +642,14 @@ void gigaset_if_free(struct cardstate *cs)
 }
 
 void gigaset_if_receive(struct cardstate *cs,
-                        unsigned char *buffer, size_t len)
+                        unsigned char *buffer, size_t len)
 {
         unsigned long flags;
         struct tty_struct *tty;
 
         spin_lock_irqsave(&cs->lock, flags);
         if ((tty = cs->tty) == NULL)
-                dbg(DEBUG_ANY, "receive on closed device");
+                gig_dbg(DEBUG_ANY, "receive on closed device");
         else {
                 tty_buffer_request_room(tty, len);
                 tty_insert_flip_string(tty, buffer, len);
@@ -655,13 +662,13 @@ EXPORT_SYMBOL_GPL(gigaset_if_receive);
 /* gigaset_if_initdriver
  * Initialize tty interface.
  * parameters:
- *      drv             Driver
- *      procname        Name of the driver (e.g. for /proc/tty/drivers)
- *      devname         Name of the device files (prefix without minor number)
- *      devfsname       Devfs name of the device files without %d
+ *      drv             Driver
+ *      procname        Name of the driver (e.g. for /proc/tty/drivers)
+ *      devname         Name of the device files (prefix without minor number)
+ *      devfsname       Devfs name of the device files without %d
  */
 void gigaset_if_initdriver(struct gigaset_driver *drv, const char *procname,
-                           const char *devname, const char *devfsname)
+                           const char *devname, const char *devfsname)
 {
         unsigned minors = drv->minors;
         int ret;
@@ -696,7 +703,7 @@ void gigaset_if_initdriver(struct gigaset_driver *drv, const char *procname,
                 warn("failed to register tty driver (error %d)", ret);
                 goto error;
         }
-        dbg(DEBUG_IF, "tty driver initialized");
+        gig_dbg(DEBUG_IF, "tty driver initialized");
         drv->have_tty = 1;
         return;
 
diff --git a/drivers/isdn/gigaset/isocdata.c b/drivers/isdn/gigaset/isocdata.c
index 5744eb91b315..45f017ed6e8c 100644
--- a/drivers/isdn/gigaset/isocdata.c
+++ b/drivers/isdn/gigaset/isocdata.c
@@ -10,10 +10,6 @@
  *      published by the Free Software Foundation; either version 2 of
  *      the License, or (at your option) any later version.
  * =====================================================================
- * ToDo: ...
- * =====================================================================
- * Version: $Id: isocdata.c,v 1.2.2.5 2005/11/13 23:05:19 hjlipp Exp $
- * =====================================================================
  */
 
 #include "gigaset.h"
@@ -87,14 +83,14 @@ static inline int isowbuf_startwrite(struct isowbuf_t *iwb)
 {
         if (!atomic_dec_and_test(&iwb->writesem)) {
                 atomic_inc(&iwb->writesem);
-                dbg(DEBUG_ISO,
-                    "%s: couldn't acquire iso write semaphore", __func__);
+                gig_dbg(DEBUG_ISO, "%s: couldn't acquire iso write semaphore",
+                        __func__);
                 return 0;
         }
 #ifdef CONFIG_GIGASET_DEBUG
-        dbg(DEBUG_ISO,
-            "%s: acquired iso write semaphore, data[write]=%02x, nbits=%d",
-            __func__, iwb->data[atomic_read(&iwb->write)], iwb->wbits);
+        gig_dbg(DEBUG_ISO,
+                "%s: acquired iso write semaphore, data[write]=%02x, nbits=%d",
+                __func__, iwb->data[atomic_read(&iwb->write)], iwb->wbits);
 #endif
         return 1;
 }
@@ -147,7 +143,7 @@ static inline void isowbuf_putflag(struct isowbuf_t *iwb)
         /* recover the idle flag byte */
         write = atomic_read(&iwb->write);
         iwb->idle = iwb->data[write];
-        dbg(DEBUG_ISO, "idle fill byte %02x", iwb->idle);
+        gig_dbg(DEBUG_ISO, "idle fill byte %02x", iwb->idle);
         /* mask extraneous bits in buffer */
         iwb->data[write] &= (1 << iwb->wbits) - 1;
 }
@@ -166,15 +162,14 @@ int gigaset_isowbuf_getbytes(struct isowbuf_t *iwb, int size)
         read = atomic_read(&iwb->nextread);
         write = atomic_read(&iwb->write);
         if (likely(read == write)) {
-                //dbg(DEBUG_STREAM, "%s: send buffer empty", __func__);
                 /* return idle frame */
                 return read < BAS_OUTBUFPAD ?
-                        BAS_OUTBUFSIZE : read - BAS_OUTBUFPAD;
+                        BAS_OUTBUFSIZE : read - BAS_OUTBUFPAD;
         }
 
         limit = read + size;
-        dbg(DEBUG_STREAM,
-            "%s: read=%d write=%d limit=%d", __func__, read, write, limit);
+        gig_dbg(DEBUG_STREAM, "%s: read=%d write=%d limit=%d",
+                __func__, read, write, limit);
 #ifdef CONFIG_GIGASET_DEBUG
         if (unlikely(size < 0 || size > BAS_OUTBUFPAD)) {
                 err("invalid size %d", size);
@@ -196,11 +191,12 @@ int gigaset_isowbuf_getbytes(struct isowbuf_t *iwb, int size)
                                 return -EBUSY;
                         /* write position could have changed */
                         if (limit >= (write = atomic_read(&iwb->write))) {
-                                pbyte = iwb->data[write]; /* save partial byte */
+                                pbyte = iwb->data[write]; /* save
+                                                             partial byte */
                                 limit = write + BAS_OUTBUFPAD;
-                                dbg(DEBUG_STREAM,
-                                    "%s: filling %d->%d with %02x",
-                                    __func__, write, limit, iwb->idle);
+                                gig_dbg(DEBUG_STREAM,
+                                        "%s: filling %d->%d with %02x",
+                                        __func__, write, limit, iwb->idle);
                                 if (write + BAS_OUTBUFPAD < BAS_OUTBUFSIZE)
                                         memset(iwb->data + write, iwb->idle,
                                                BAS_OUTBUFPAD);
@@ -211,9 +207,11 @@ int gigaset_isowbuf_getbytes(struct isowbuf_t *iwb, int size)
                                                - write);
                                         limit = 0;
                                 }
-                                dbg(DEBUG_STREAM, "%s: restoring %02x at %d",
-                                    __func__, pbyte, limit);
-                                iwb->data[limit] = pbyte; /* restore partial byte */
+                                gig_dbg(DEBUG_STREAM,
+                                        "%s: restoring %02x at %d",
+                                        __func__, pbyte, limit);
+                                iwb->data[limit] = pbyte; /* restore
+                                                             partial byte */
                                 atomic_set(&iwb->write, limit);
                         }
                         isowbuf_donewrite(iwb);
@@ -242,19 +240,17 @@ int gigaset_isowbuf_getbytes(struct isowbuf_t *iwb, int size)
  * write hex bytes to syslog for debugging
  */
 static inline void dump_bytes(enum debuglevel level, const char *tag,
-                              unsigned char *bytes, int count)
+                              unsigned char *bytes, int count)
 {
 #ifdef CONFIG_GIGASET_DEBUG
         unsigned char c;
         static char dbgline[3 * 32 + 1];
         static const char hexdigit[] = "0123456789abcdef";
         int i = 0;
-        IFNULLRET(tag);
-        IFNULLRET(bytes);
         while (count-- > 0) {
                 if (i > sizeof(dbgline) - 4) {
                         dbgline[i] = '\0';
-                        dbg(level, "%s:%s", tag, dbgline);
+                        gig_dbg(level, "%s:%s", tag, dbgline);
                         i = 0;
                 }
                 c = *bytes++;
@@ -264,7 +260,7 @@ static inline void dump_bytes(enum debuglevel level, const char *tag,
                 dbgline[i++] = hexdigit[c & 0x0f];
         }
         dbgline[i] = '\0';
-        dbg(level, "%s:%s", tag, dbgline);
+        gig_dbg(level, "%s:%s", tag, dbgline);
 #endif
 }
 
@@ -380,7 +376,7 @@ static u16 stufftab[5 * 256] = {
  */
 
 static inline int hdlc_bitstuff_byte(struct isowbuf_t *iwb, unsigned char cin,
-                                     int ones)
+                                     int ones)
 {
         u16 stuff;
         int shiftinc, newones;
@@ -422,7 +418,7 @@ static inline int hdlc_bitstuff_byte(struct isowbuf_t *iwb, unsigned char cin,
  */
 
 static inline int hdlc_buildframe(struct isowbuf_t *iwb,
-                                  unsigned char *in, int count)
+                                  unsigned char *in, int count)
 {
         int ones;
         u16 fcs;
@@ -431,8 +427,8 @@ static inline int hdlc_buildframe(struct isowbuf_t *iwb,
 
         if (isowbuf_freebytes(iwb) < count + count / 5 + 6 ||
             !isowbuf_startwrite(iwb)) {
-                dbg(DEBUG_ISO, "%s: %d bytes free -> -EAGAIN",
-                    __func__, isowbuf_freebytes(iwb));
+                gig_dbg(DEBUG_ISO, "%s: %d bytes free -> -EAGAIN",
+                        __func__, isowbuf_freebytes(iwb));
                 return -EAGAIN;
         }
 
@@ -484,11 +480,11 @@ static inline int trans_buildframe(struct isowbuf_t *iwb,
 
         if (isowbuf_freebytes(iwb) < count ||
             !isowbuf_startwrite(iwb)) {
-                dbg(DEBUG_ISO, "can't put %d bytes", count);
+                gig_dbg(DEBUG_ISO, "can't put %d bytes", count);
                 return -EAGAIN;
         }
 
-        dbg(DEBUG_STREAM, "put %d bytes", count);
+        gig_dbg(DEBUG_STREAM, "put %d bytes", count);
         write = atomic_read(&iwb->write);
         do {
                 c = gigaset_invtab[*in++];
@@ -508,11 +504,13 @@ int gigaset_isoc_buildframe(struct bc_state *bcs, unsigned char *in, int len)
         switch (bcs->proto2) {
         case ISDN_PROTO_L2_HDLC:
                 result = hdlc_buildframe(bcs->hw.bas->isooutbuf, in, len);
-                dbg(DEBUG_ISO, "%s: %d bytes HDLC -> %d", __func__, len, result);
+                gig_dbg(DEBUG_ISO, "%s: %d bytes HDLC -> %d",
+                        __func__, len, result);
                 break;
         default:                        /* assume transparent */
                 result = trans_buildframe(bcs->hw.bas->isooutbuf, in, len);
-                dbg(DEBUG_ISO, "%s: %d bytes trans -> %d", __func__, len, result);
+                gig_dbg(DEBUG_ISO, "%s: %d bytes trans -> %d",
+                        __func__, len, result);
         }
         return result;
 }
@@ -528,13 +526,13 @@ static inline void hdlc_putbyte(unsigned char c, struct bc_state *bcs)
                 return;
         }
         if (unlikely(bcs->skb->len == SBUFSIZE)) {
-                warn("received oversized packet discarded");
+                dev_warn(bcs->cs->dev, "received oversized packet discarded\n");
                 bcs->hw.bas->giants++;
                 dev_kfree_skb_any(bcs->skb);
                 bcs->skb = NULL;
                 return;
         }
-        *gigaset_skb_put_quick(bcs->skb, 1) = c;
+        *__skb_put(bcs->skb, 1) = c;
 }
 
 /* hdlc_flush
@@ -549,7 +547,7 @@ static inline void hdlc_flush(struct bc_state *bcs)
                 if ((bcs->skb = dev_alloc_skb(SBUFSIZE + HW_HDR_LEN)) != NULL)
                         skb_reserve(bcs->skb, HW_HDR_LEN);
                 else
-                        err("could not allocate skb");
+                        dev_err(bcs->cs->dev, "could not allocate skb\n");
         }
 
         /* reset packet state */
@@ -571,23 +569,25 @@ static inline void hdlc_done(struct bc_state *bcs)
 
         if ((procskb = bcs->skb) == NULL) {
                 /* previous error */
-                dbg(DEBUG_ISO, "%s: skb=NULL", __func__);
+                gig_dbg(DEBUG_ISO, "%s: skb=NULL", __func__);
                 gigaset_rcv_error(NULL, bcs->cs, bcs);
         } else if (procskb->len < 2) {
-                notice("received short frame (%d octets)", procskb->len);
+                dev_notice(bcs->cs->dev, "received short frame (%d octets)\n",
+                           procskb->len);
                 bcs->hw.bas->runts++;
                 gigaset_rcv_error(procskb, bcs->cs, bcs);
         } else if (bcs->fcs != PPP_GOODFCS) {
-                notice("frame check error (0x%04x)", bcs->fcs);
+                dev_notice(bcs->cs->dev, "frame check error (0x%04x)\n",
+                           bcs->fcs);
                 bcs->hw.bas->fcserrs++;
                 gigaset_rcv_error(procskb, bcs->cs, bcs);
         } else {
                 procskb->len -= 2;              /* subtract FCS */
                 procskb->tail -= 2;
-                dbg(DEBUG_ISO,
-                    "%s: good frame (%d octets)", __func__, procskb->len);
+                gig_dbg(DEBUG_ISO, "%s: good frame (%d octets)",
+                        __func__, procskb->len);
                 dump_bytes(DEBUG_STREAM,
-                           "rcv data", procskb->data, procskb->len);
+                           "rcv data", procskb->data, procskb->len);
                 bcs->hw.bas->goodbytes += procskb->len;
                 gigaset_rcv_skb(procskb, bcs->cs, bcs);
         }
@@ -595,7 +595,7 @@ static inline void hdlc_done(struct bc_state *bcs)
         if ((bcs->skb = dev_alloc_skb(SBUFSIZE + HW_HDR_LEN)) != NULL)
                 skb_reserve(bcs->skb, HW_HDR_LEN);
         else
-                err("could not allocate skb");
+                dev_err(bcs->cs->dev, "could not allocate skb\n");
         bcs->fcs = PPP_INITFCS;
 }
 
@@ -610,14 +610,14 @@ static inline void hdlc_frag(struct bc_state *bcs, unsigned inbits)
                 return;
         }
 
-        notice("received partial byte (%d bits)", inbits);
+        dev_notice(bcs->cs->dev, "received partial byte (%d bits)\n", inbits);
         bcs->hw.bas->alignerrs++;
         gigaset_rcv_error(bcs->skb, bcs->cs, bcs);
 
         if ((bcs->skb = dev_alloc_skb(SBUFSIZE + HW_HDR_LEN)) != NULL)
                 skb_reserve(bcs->skb, HW_HDR_LEN);
         else
-                err("could not allocate skb");
+                dev_err(bcs->cs->dev, "could not allocate skb\n");
         bcs->fcs = PPP_INITFCS;
 }
 
@@ -659,16 +659,12 @@ static unsigned char bitcounts[256] = {
  *      bcs     receiving B channel structure
  */
 static inline void hdlc_unpack(unsigned char *src, unsigned count,
-                               struct bc_state *bcs)
+                               struct bc_state *bcs)
 {
-        struct bas_bc_state *ubc;
+        struct bas_bc_state *ubc = bcs->hw.bas;
         int inputstate;
         unsigned seqlen, inbyte, inbits;
 
-        IFNULLRET(bcs);
-        ubc = bcs->hw.bas;
-        IFNULLRET(ubc);
-
         /* load previous state:
          * inputstate = set of flag bits:
          * - INS_flag_hunt: no complete opening flag received since connection setup or last abort
@@ -856,7 +852,7 @@ static inline void hdlc_unpack(unsigned char *src, unsigned count,
  *      bcs     receiving B channel structure
  */
 static inline void trans_receive(unsigned char *src, unsigned count,
-                                 struct bc_state *bcs)
+                                 struct bc_state *bcs)
 {
         struct sk_buff *skb;
         int dobytes;
@@ -870,7 +866,7 @@ static inline void trans_receive(unsigned char *src, unsigned count,
         if (unlikely((skb = bcs->skb) == NULL)) {
                 bcs->skb = skb = dev_alloc_skb(SBUFSIZE + HW_HDR_LEN);
                 if (!skb) {
-                        err("could not allocate skb");
+                        dev_err(bcs->cs->dev, "could not allocate skb\n");
                         return;
                 }
                 skb_reserve(skb, HW_HDR_LEN);
@@ -888,7 +884,8 @@ static inline void trans_receive(unsigned char *src, unsigned count,
                         gigaset_rcv_skb(skb, bcs->cs, bcs);
                         bcs->skb = skb = dev_alloc_skb(SBUFSIZE + HW_HDR_LEN);
                         if (!skb) {
-                                err("could not allocate skb");
+                                dev_err(bcs->cs->dev,
+                                        "could not allocate skb\n");
                                 return;
                         }
                         skb_reserve(bcs->skb, HW_HDR_LEN);
@@ -921,8 +918,8 @@ static void cmd_loop(unsigned char *src, int numbytes, struct inbuf_t *inbuf)
                 case '\r':
                 case '\n':
                         /* end of line */
-                        dbg(DEBUG_TRANSCMD, "%s: End of Command (%d Bytes)",
-                            __func__, cbytes);
+                        gig_dbg(DEBUG_TRANSCMD, "%s: End of Command (%d Bytes)",
+                                __func__, cbytes);
                         cs->cbytes = cbytes;
                         gigaset_handle_modem_response(cs);
                         cbytes = 0;
@@ -932,7 +929,7 @@ static void cmd_loop(unsigned char *src, int numbytes, struct inbuf_t *inbuf)
                         if (cbytes < MAX_RESP_SIZE - 1)
                                 cbytes++;
                         else
-                                warn("response too large");
+                                dev_warn(cs->dev, "response too large\n");
                 }
         }
 
@@ -951,27 +948,27 @@ void gigaset_isoc_input(struct inbuf_t *inbuf)
 
         head = atomic_read(&inbuf->head);
         while (head != (tail = atomic_read(&inbuf->tail))) {
-                dbg(DEBUG_INTR, "buffer state: %u -> %u", head, tail);
+                gig_dbg(DEBUG_INTR, "buffer state: %u -> %u", head, tail);
                 if (head > tail)
                         tail = RBUFSIZE;
                 src = inbuf->data + head;
                 numbytes = tail - head;
-                dbg(DEBUG_INTR, "processing %u bytes", numbytes);
+                gig_dbg(DEBUG_INTR, "processing %u bytes", numbytes);
 
                 if (atomic_read(&cs->mstate) == MS_LOCKED) {
                         gigaset_dbg_buffer(DEBUG_LOCKCMD, "received response",
-                                           numbytes, src, 0);
+                                           numbytes, src);
                         gigaset_if_receive(inbuf->cs, src, numbytes);
                 } else {
                         gigaset_dbg_buffer(DEBUG_CMD, "received response",
-                                           numbytes, src, 0);
+                                           numbytes, src);
                         cmd_loop(src, numbytes, inbuf);
                 }
 
                 head += numbytes;
                 if (head == RBUFSIZE)
                         head = 0;
-                dbg(DEBUG_INTR, "setting head to %u", head);
+                gig_dbg(DEBUG_INTR, "setting head to %u", head);
                 atomic_set(&inbuf->head, head);
         }
 }
@@ -992,18 +989,18 @@ void gigaset_isoc_input(struct inbuf_t *inbuf)
  */
 int gigaset_isoc_send_skb(struct bc_state *bcs, struct sk_buff *skb)
 {
-        int len;
-
-        IFNULLRETVAL(bcs, -EFAULT);
-        IFNULLRETVAL(skb, -EFAULT);
-        len = skb->len;
+        int len = skb->len;
+        unsigned long flags;
 
         skb_queue_tail(&bcs->squeue, skb);
-        dbg(DEBUG_ISO,
-            "%s: skb queued, qlen=%d", __func__, skb_queue_len(&bcs->squeue));
+        gig_dbg(DEBUG_ISO, "%s: skb queued, qlen=%d",
+                __func__, skb_queue_len(&bcs->squeue));
 
         /* tasklet submits URB if necessary */
-        tasklet_schedule(&bcs->hw.bas->sent_tasklet);
+        spin_lock_irqsave(&bcs->cs->lock, flags);
+        if (bcs->cs->connected)
+                tasklet_schedule(&bcs->hw.bas->sent_tasklet);
+        spin_unlock_irqrestore(&bcs->cs->lock, flags);
 
         return len;     /* ok so far */
 }
diff --git a/drivers/isdn/gigaset/proc.c b/drivers/isdn/gigaset/proc.c
index c6915fa2be6c..d267a636b53c 100644
--- a/drivers/isdn/gigaset/proc.c
+++ b/drivers/isdn/gigaset/proc.c
@@ -1,7 +1,7 @@
 /*
  * Stuff used by all variants of the driver
  *
- * Copyright (c) 2001 by Stefan Eilers <Eilers.Stefan@epost.de>,
+ * Copyright (c) 2001 by Stefan Eilers,
  *                       Hansjoerg Lipp <hjlipp@web.de>,
  *                       Tilman Schmidt <tilman@imap.cc>.
  *
@@ -11,26 +11,29 @@
  *      published by the Free Software Foundation; either version 2 of
  *      the License, or (at your option) any later version.
  * =====================================================================
- * ToDo: ...
- * =====================================================================
- * Version: $Id: proc.c,v 1.5.2.13 2006/02/04 18:28:16 hjlipp Exp $
- * =====================================================================
  */
 
 #include "gigaset.h"
 #include <linux/ctype.h>
 
-static ssize_t show_cidmode(struct device *dev, struct device_attribute *attr, char *buf)
+static ssize_t show_cidmode(struct device *dev, struct device_attribute *attr,
+                            char *buf)
 {
-        struct usb_interface *intf = to_usb_interface(dev);
-        struct cardstate *cs = usb_get_intfdata(intf);
-        return sprintf(buf, "%d\n", atomic_read(&cs->cidmode)); // FIXME use scnprintf for 13607 bit architectures (if PAGE_SIZE==4096)
+        int ret;
+        unsigned long flags;
+        struct cardstate *cs = dev_get_drvdata(dev);
+
+        spin_lock_irqsave(&cs->lock, flags);
+        ret = sprintf(buf, "%u\n", cs->cidmode);
+        spin_unlock_irqrestore(&cs->lock, flags);
+
+        return ret;
 }
 
-static ssize_t set_cidmode(struct device *dev, struct device_attribute *attr, const char *buf, size_t count)
+static ssize_t set_cidmode(struct device *dev, struct device_attribute *attr,
+                           const char *buf, size_t count)
 {
-        struct usb_interface *intf = to_usb_interface(dev);
-        struct cardstate *cs = usb_get_intfdata(intf);
+        struct cardstate *cs = dev_get_drvdata(dev);
         long int value;
         char *end;
 
@@ -41,23 +44,23 @@ static ssize_t set_cidmode(struct device *dev, struct device_attribute *attr, co
         if (value < 0 || value > 1)
                         return -EINVAL;
 
-        if (down_interruptible(&cs->sem))
+        if (mutex_lock_interruptible(&cs->mutex))
                 return -ERESTARTSYS; // FIXME -EINTR?
 
         cs->waiting = 1;
         if (!gigaset_add_event(cs, &cs->at_state, EV_PROC_CIDMODE,
-                               NULL, value, NULL)) {
+                               NULL, value, NULL)) {
                 cs->waiting = 0;
-                up(&cs->sem);
+                mutex_unlock(&cs->mutex);
                 return -ENOMEM;
         }
 
-        dbg(DEBUG_CMD, "scheduling PROC_CIDMODE");
+        gig_dbg(DEBUG_CMD, "scheduling PROC_CIDMODE");
         gigaset_schedule_event(cs);
 
         wait_event(cs->waitqueue, !cs->waiting);
 
-        up(&cs->sem);
+        mutex_unlock(&cs->mutex);
 
         return count;
 }
@@ -65,17 +68,15 @@ static ssize_t set_cidmode(struct device *dev, struct device_attribute *attr, co
 static DEVICE_ATTR(cidmode, S_IRUGO|S_IWUSR, show_cidmode, set_cidmode);
 
 /* free sysfs for device */
-void gigaset_free_dev_sysfs(struct usb_interface *interface)
+void gigaset_free_dev_sysfs(struct cardstate *cs)
 {
-        dbg(DEBUG_INIT, "removing sysfs entries");
-        device_remove_file(&interface->dev, &dev_attr_cidmode);
+        gig_dbg(DEBUG_INIT, "removing sysfs entries");
+        device_remove_file(cs->dev, &dev_attr_cidmode);
 }
-EXPORT_SYMBOL_GPL(gigaset_free_dev_sysfs);
 
 /* initialize sysfs for device */
-void gigaset_init_dev_sysfs(struct usb_interface *interface)
+void gigaset_init_dev_sysfs(struct cardstate *cs)
 {
-        dbg(DEBUG_INIT, "setting up sysfs");
-        device_create_file(&interface->dev, &dev_attr_cidmode);
+        gig_dbg(DEBUG_INIT, "setting up sysfs");
+        device_create_file(cs->dev, &dev_attr_cidmode);
 }
-EXPORT_SYMBOL_GPL(gigaset_init_dev_sysfs);
diff --git a/drivers/isdn/gigaset/usb-gigaset.c b/drivers/isdn/gigaset/usb-gigaset.c
index 323fc7349dec..bfb73fd5077e 100644
--- a/drivers/isdn/gigaset/usb-gigaset.c
+++ b/drivers/isdn/gigaset/usb-gigaset.c
@@ -1,7 +1,7 @@
 /*
  * USB driver for Gigaset 307x directly or using M105 Data.
  *
- * Copyright (c) 2001 by Stefan Eilers <Eilers.Stefan@epost.de>
+ * Copyright (c) 2001 by Stefan Eilers
  *                   and Hansjoerg Lipp <hjlipp@web.de>.
  *
  * This driver was derived from the USB skeleton driver by
@@ -13,10 +13,6 @@
  *      published by the Free Software Foundation; either version 2 of
  *      the License, or (at your option) any later version.
  * =====================================================================
- * ToDo: ...
- * =====================================================================
- * Version: $Id: usb-gigaset.c,v 1.85.4.18 2006/02/04 18:28:16 hjlipp Exp $
- * =====================================================================
  */
 
 #include "gigaset.h"
@@ -29,7 +25,7 @@
 #include <linux/moduleparam.h>
 
 /* Version Information */
-#define DRIVER_AUTHOR "Hansjoerg Lipp <hjlipp@web.de>, Stefan Eilers <Eilers.Stefan@epost.de>"
+#define DRIVER_AUTHOR "Hansjoerg Lipp <hjlipp@web.de>, Stefan Eilers"
 #define DRIVER_DESC "USB Driver for Gigaset 307x using M105"
 
 /* Module parameters */
@@ -62,10 +58,6 @@ static struct usb_device_id gigaset_table [] = {
 
 MODULE_DEVICE_TABLE(usb, gigaset_table);
 
-/* Get a minor range for your devices from the usb maintainer */
-#define USB_SKEL_MINOR_BASE     200
-
-
 /*
  * Control requests (empty fields: 00)
  *
@@ -114,7 +106,7 @@ MODULE_DEVICE_TABLE(usb, gigaset_table);
  */
 
 static int gigaset_probe(struct usb_interface *interface,
-                         const struct usb_device_id *id);
+                         const struct usb_device_id *id);
 static void gigaset_disconnect(struct usb_interface *interface);
 
 static struct gigaset_driver *driver = NULL;
@@ -122,29 +114,29 @@ static struct cardstate *cardstate = NULL;
 
 /* usb specific object needed to register this driver with the usb subsystem */
 static struct usb_driver gigaset_usb_driver = {
-        .name =         GIGASET_MODULENAME,
-        .probe =        gigaset_probe,
-        .disconnect =   gigaset_disconnect,
-        .id_table =     gigaset_table,
+        .name =         GIGASET_MODULENAME,
+        .probe =        gigaset_probe,
+        .disconnect =   gigaset_disconnect,
+        .id_table =     gigaset_table,
 };
 
 struct usb_cardstate {
-        struct usb_device       *udev;                  /* save off the usb device pointer */
-        struct usb_interface    *interface;             /* the interface for this device */
-        atomic_t                busy;                   /* bulk output in progress */
-
-        /* Output buffer for commands (M105: and data)*/
-        unsigned char           *bulk_out_buffer;       /* the buffer to send data */
-        int                     bulk_out_size;          /* the size of the send buffer */
-        __u8                    bulk_out_endpointAddr;  /* the address of the bulk out endpoint */
-        struct urb              *bulk_out_urb;          /* the urb used to transmit data */
-
-        /* Input buffer for command responses (M105: and data)*/
-        int                     rcvbuf_size;            /* the size of the receive buffer */
-        struct urb              *read_urb;              /* the urb used to receive data */
-        __u8                    int_in_endpointAddr;    /* the address of the bulk in endpoint */
-
-        char                    bchars[6];              /* req. 0x19 */
+        struct usb_device       *udev;          /* usb device pointer */
+        struct usb_interface    *interface;     /* interface for this device */
+        atomic_t                busy;           /* bulk output in progress */
+
+        /* Output buffer */
+        unsigned char           *bulk_out_buffer;
+        int                     bulk_out_size;
+        __u8                    bulk_out_endpointAddr;
+        struct urb              *bulk_out_urb;
+
+        /* Input buffer */
+        int                     rcvbuf_size;
+        struct urb              *read_urb;
+        __u8                    int_in_endpointAddr;
+
+        char                    bchars[6];              /* for request 0x19 */
 };
 
 struct usb_bc_state {};
@@ -157,19 +149,20 @@ static inline unsigned tiocm_to_gigaset(unsigned state)
 #ifdef CONFIG_GIGASET_UNDOCREQ
 /* WARNING: EXPERIMENTAL! */
 static int gigaset_set_modem_ctrl(struct cardstate *cs, unsigned old_state,
-                                  unsigned new_state)
+                                  unsigned new_state)
 {
+        struct usb_device *udev = cs->hw.usb->udev;
         unsigned mask, val;
         int r;
 
         mask = tiocm_to_gigaset(old_state ^ new_state);
         val = tiocm_to_gigaset(new_state);
 
-        dbg(DEBUG_USBREQ, "set flags 0x%02x with mask 0x%02x", val, mask);
-        r = usb_control_msg(cs->hw.usb->udev,
-                            usb_sndctrlpipe(cs->hw.usb->udev, 0), 7, 0x41,
-                            (val & 0xff) | ((mask & 0xff) << 8), 0,
-                            NULL, 0, 2000 /*timeout??*/); // don't use this in an interrupt/BH
+        gig_dbg(DEBUG_USBREQ, "set flags 0x%02x with mask 0x%02x", val, mask);
+        // don't use this in an interrupt/BH
+        r = usb_control_msg(udev, usb_sndctrlpipe(udev, 0), 7, 0x41,
+                            (val & 0xff) | ((mask & 0xff) << 8), 0,
+                            NULL, 0, 2000 /* timeout? */);
         if (r < 0)
                 return r;
         //..
@@ -178,30 +171,29 @@ static int gigaset_set_modem_ctrl(struct cardstate *cs, unsigned old_state,
 
 static int set_value(struct cardstate *cs, u8 req, u16 val)
 {
+        struct usb_device *udev = cs->hw.usb->udev;
         int r, r2;
 
-        dbg(DEBUG_USBREQ, "request %02x (%04x)", (unsigned)req, (unsigned)val);
-        r = usb_control_msg(cs->hw.usb->udev,
-                            usb_sndctrlpipe(cs->hw.usb->udev, 0), 0x12, 0x41,
-                            0xf /*?*/, 0,
-                            NULL, 0, 2000 /*?*/); /* no idea, what this does */
+        gig_dbg(DEBUG_USBREQ, "request %02x (%04x)",
+                (unsigned)req, (unsigned)val);
+        r = usb_control_msg(udev, usb_sndctrlpipe(udev, 0), 0x12, 0x41,
+                            0xf /*?*/, 0, NULL, 0, 2000 /*?*/);
+                            /* no idea what this does */
         if (r < 0) {
-                err("error %d on request 0x12", -r);
+                dev_err(&udev->dev, "error %d on request 0x12\n", -r);
                 return r;
         }
 
-        r = usb_control_msg(cs->hw.usb->udev,
-                            usb_sndctrlpipe(cs->hw.usb->udev, 0), req, 0x41,
-                            val, 0,
-                            NULL, 0, 2000 /*?*/);
+        r = usb_control_msg(udev, usb_sndctrlpipe(udev, 0), req, 0x41,
+                            val, 0, NULL, 0, 2000 /*?*/);
         if (r < 0)
-                err("error %d on request 0x%02x", -r, (unsigned)req);
+                dev_err(&udev->dev, "error %d on request 0x%02x\n",
+                        -r, (unsigned)req);
 
-        r2 = usb_control_msg(cs->hw.usb->udev,
-                             usb_sndctrlpipe(cs->hw.usb->udev, 0), 0x19, 0x41,
-                             0, 0, cs->hw.usb->bchars, 6, 2000 /*?*/);
+        r2 = usb_control_msg(udev, usb_sndctrlpipe(udev, 0), 0x19, 0x41,
+                             0, 0, cs->hw.usb->bchars, 6, 2000 /*?*/);
         if (r2 < 0)
-                err("error %d on request 0x19", -r2);
+                dev_err(&udev->dev, "error %d on request 0x19\n", -r2);
 
         return r < 0 ? r : (r2 < 0 ? r2 : 0);
 }
@@ -229,8 +221,8 @@ static int gigaset_baud_rate(struct cardstate *cs, unsigned cflag)
         case B115200: rate =  115200; break;
         default:
                 rate =  9600;
-                err("unsupported baudrate request 0x%x,"
-                    " using default of B9600", cflag);
+                dev_err(cs->dev, "unsupported baudrate request 0x%x,"
+                        " using default of B9600\n", cflag);
         }
 
         val = 0x383fff / rate + 1;
@@ -259,7 +251,7 @@ static int gigaset_set_line_ctrl(struct cardstate *cs, unsigned cflag)
         case CS8:
                 val |= 8 << 8; break;
         default:
-                err("CSIZE was not CS5-CS8, using default of 8");
+                dev_err(cs->dev, "CSIZE was not CS5-CS8, using default of 8\n");
                 val |= 8 << 8;
                 break;
         }
@@ -277,7 +269,7 @@ static int gigaset_set_line_ctrl(struct cardstate *cs, unsigned cflag)
 
 #else
 static int gigaset_set_modem_ctrl(struct cardstate *cs, unsigned old_state,
-                                  unsigned new_state)
+                                  unsigned new_state)
 {
         return -EINVAL;
 }
@@ -309,15 +301,12 @@ static int gigaset_close_bchannel(struct bc_state *bcs)
         return 0;
 }
 
-//void send_ack_to_LL(void *data);
 static int write_modem(struct cardstate *cs);
 static int send_cb(struct cardstate *cs, struct cmdbuf_t *cb);
 
 
-/* Handling of send queue. If there is already a skb opened, put data to
- * the transfer buffer by calling "write_modem". Otherwise take a new skb out of the queue.
- * This function will be called by the ISR via "transmit_chars" (USB: B-Channel Bulk callback handler
- * via immediate task queue) or by writebuf_from_LL if the LL wants to transmit data.
+/* Write tasklet handler: Continue sending current skb, or send command, or
+ * start sending an skb from the send queue.
  */
 static void gigaset_modem_fill(unsigned long data)
 {
@@ -327,10 +316,10 @@ static void gigaset_modem_fill(unsigned long data)
         unsigned long flags;
         int again;
 
-        dbg(DEBUG_OUTPUT, "modem_fill");
+        gig_dbg(DEBUG_OUTPUT, "modem_fill");
 
         if (atomic_read(&cs->hw.usb->busy)) {
-                dbg(DEBUG_OUTPUT, "modem_fill: busy");
+                gig_dbg(DEBUG_OUTPUT, "modem_fill: busy");
                 return;
         }
 
@@ -341,26 +330,27 @@ static void gigaset_modem_fill(unsigned long data)
                         cb = cs->cmdbuf;
                         spin_unlock_irqrestore(&cs->cmdlock, flags);
                         if (cb) { /* commands to send? */
-                                dbg(DEBUG_OUTPUT, "modem_fill: cb");
+                                gig_dbg(DEBUG_OUTPUT, "modem_fill: cb");
                                 if (send_cb(cs, cb) < 0) {
-                                        dbg(DEBUG_OUTPUT,
-                                            "modem_fill: send_cb failed");
-                                        again = 1; /* no callback will be called! */
+                                        gig_dbg(DEBUG_OUTPUT,
+                                                "modem_fill: send_cb failed");
+                                        again = 1; /* no callback will be
+                                                      called! */
                                 }
                         } else { /* skbs to send? */
                                 bcs->tx_skb = skb_dequeue(&bcs->squeue);
                                 if (bcs->tx_skb)
-                                        dbg(DEBUG_INTR,
-                                            "Dequeued skb (Adr: %lx)!",
-                                            (unsigned long) bcs->tx_skb);
+                                        gig_dbg(DEBUG_INTR,
+                                                "Dequeued skb (Adr: %lx)!",
+                                                (unsigned long) bcs->tx_skb);
                         }
                 }
 
                 if (bcs->tx_skb) {
-                        dbg(DEBUG_OUTPUT, "modem_fill: tx_skb");
+                        gig_dbg(DEBUG_OUTPUT, "modem_fill: tx_skb");
                         if (write_modem(cs) < 0) {
-                                dbg(DEBUG_OUTPUT,
-                                    "modem_fill: write_modem failed");
+                                gig_dbg(DEBUG_OUTPUT,
+                                        "modem_fill: write_modem failed");
                                 // FIXME should we tell the LL?
                                 again = 1; /* no callback will be called! */
                         }
@@ -371,88 +361,85 @@ static void gigaset_modem_fill(unsigned long data)
 /**
  *      gigaset_read_int_callback
  *
- *      It is called if the data was received from the device. This is almost similiar to
- *      the interrupt service routine in the serial device.
+ *      It is called if the data was received from the device.
  */
 static void gigaset_read_int_callback(struct urb *urb, struct pt_regs *regs)
 {
+        struct inbuf_t *inbuf = urb->context;
+        struct cardstate *cs = inbuf->cs;
         int resubmit = 0;
         int r;
-        struct cardstate *cs;
         unsigned numbytes;
         unsigned char *src;
-        //unsigned long flags;
-        struct inbuf_t *inbuf;
-
-        IFNULLRET(urb);
-        inbuf = (struct inbuf_t *) urb->context;
-        IFNULLRET(inbuf);
-        //spin_lock_irqsave(&inbuf->lock, flags);
-        cs = inbuf->cs;
-        IFNULLGOTO(cs, exit);
-        IFNULLGOTO(cardstate, exit);
-
-        if (!atomic_read(&cs->connected)) {
-                err("%s: disconnected", __func__);
-                goto exit;
-        }
+        unsigned long flags;
 
         if (!urb->status) {
+                if (!cs->connected) {
+                        err("%s: disconnected", __func__); /* should never happen */
+                        return;
+                }
+
                 numbytes = urb->actual_length;
 
                 if (numbytes) {
                         src = inbuf->rcvbuf;
                         if (unlikely(*src))
-                                warn("%s: There was no leading 0, but 0x%02x!",
-                                     __func__, (unsigned) *src);
+                                dev_warn(cs->dev,
+                                    "%s: There was no leading 0, but 0x%02x!\n",
+                                         __func__, (unsigned) *src);
                         ++src; /* skip leading 0x00 */
                         --numbytes;
                         if (gigaset_fill_inbuf(inbuf, src, numbytes)) {
-                                dbg(DEBUG_INTR, "%s-->BH", __func__);
+                                gig_dbg(DEBUG_INTR, "%s-->BH", __func__);
                                 gigaset_schedule_event(inbuf->cs);
                         }
                 } else
-                        dbg(DEBUG_INTR, "Received zero block length");
+                        gig_dbg(DEBUG_INTR, "Received zero block length");
                 resubmit = 1;
         } else {
                 /* The urb might have been killed. */
-                dbg(DEBUG_ANY, "%s - nonzero read bulk status received: %d",
-                    __func__, urb->status);
-                if (urb->status != -ENOENT) /* not killed */
+                gig_dbg(DEBUG_ANY, "%s - nonzero read bulk status received: %d",
+                        __func__, urb->status);
+                if (urb->status != -ENOENT) { /* not killed */
+                        if (!cs->connected) {
+                                err("%s: disconnected", __func__); /* should never happen */
+                                return;
+                        }
                         resubmit = 1;
+                }
         }
-exit:
-        //spin_unlock_irqrestore(&inbuf->lock, flags);
+
         if (resubmit) {
-                r = usb_submit_urb(urb, SLAB_ATOMIC);
+                spin_lock_irqsave(&cs->lock, flags);
+                r = cs->connected ? usb_submit_urb(urb, SLAB_ATOMIC) : -ENODEV;
+                spin_unlock_irqrestore(&cs->lock, flags);
                 if (r)
-                        err("error %d when resubmitting urb.", -r);
+                        dev_err(cs->dev, "error %d when resubmitting urb.\n",
+                                -r);
         }
 }
 
 
-/* This callback routine is called when data was transmitted to a B-Channel.
- * Therefore it has to check if there is still data to transmit. This
- * happens by calling modem_fill via task queue.
- *
- */
+/* This callback routine is called when data was transmitted to the device. */
 static void gigaset_write_bulk_callback(struct urb *urb, struct pt_regs *regs)
 {
-        struct cardstate *cs = (struct cardstate *) urb->context;
+        struct cardstate *cs = urb->context;
+        unsigned long flags;
 
-        IFNULLRET(cs);
-#ifdef CONFIG_GIGASET_DEBUG
-        if (!atomic_read(&cs->connected)) {
-                err("%s:not connected", __func__);
-                return;
-        }
-#endif
         if (urb->status)
-                err("bulk transfer failed (status %d)", -urb->status); /* That's all we can do. Communication problems
-                                                                           are handeled by timeouts or network protocols */
+                dev_err(cs->dev, "bulk transfer failed (status %d)\n",
+                        -urb->status);
+                /* That's all we can do. Communication problems
+                   are handled by timeouts or network protocols. */
 
-        atomic_set(&cs->hw.usb->busy, 0);
-        tasklet_schedule(&cs->write_tasklet);
+        spin_lock_irqsave(&cs->lock, flags);
+        if (!cs->connected) {
+                err("%s: not connected", __func__);
+        } else {
+                atomic_set(&cs->hw.usb->busy, 0);
+                tasklet_schedule(&cs->write_tasklet);
+        }
+        spin_unlock_irqrestore(&cs->lock, flags);
 }
 
 static int send_cb(struct cardstate *cs, struct cmdbuf_t *cb)
@@ -469,8 +456,8 @@ static int send_cb(struct cardstate *cs, struct cmdbuf_t *cb)
 
                         spin_lock_irqsave(&cs->cmdlock, flags);
                         cs->cmdbytes -= cs->curlen;
-                        dbg(DEBUG_OUTPUT, "send_cb: sent %u bytes, %u left",
-                            cs->curlen, cs->cmdbytes);
+                        gig_dbg(DEBUG_OUTPUT, "send_cb: sent %u bytes, %u left",
+                                cs->curlen, cs->cmdbytes);
                         cs->cmdbuf = cb = cb->next;
                         if (cb) {
                                 cb->prev = NULL;
@@ -487,52 +474,51 @@ static int send_cb(struct cardstate *cs, struct cmdbuf_t *cb)
                 }
                 if (cb) {
                         count = min(cb->len, ucs->bulk_out_size);
+                        gig_dbg(DEBUG_OUTPUT, "send_cb: send %d bytes", count);
+
                         usb_fill_bulk_urb(ucs->bulk_out_urb, ucs->udev,
-                                          usb_sndbulkpipe(ucs->udev,
-                                             ucs->bulk_out_endpointAddr & 0x0f),
-                                          cb->buf + cb->offset, count,
-                                          gigaset_write_bulk_callback, cs);
+                                          usb_sndbulkpipe(ucs->udev,
+                                             ucs->bulk_out_endpointAddr & 0x0f),
+                                          cb->buf + cb->offset, count,
+                                          gigaset_write_bulk_callback, cs);
 
                         cb->offset += count;
                         cb->len -= count;
                         atomic_set(&ucs->busy, 1);
-                        dbg(DEBUG_OUTPUT, "send_cb: send %d bytes", count);
 
-                        status = usb_submit_urb(ucs->bulk_out_urb, SLAB_ATOMIC);
+                        spin_lock_irqsave(&cs->lock, flags);
+                        status = cs->connected ? usb_submit_urb(ucs->bulk_out_urb, SLAB_ATOMIC) : -ENODEV;
+                        spin_unlock_irqrestore(&cs->lock, flags);
+
                         if (status) {
                                 atomic_set(&ucs->busy, 0);
-                                err("could not submit urb (error %d).",
+                                err("could not submit urb (error %d)\n",
                                     -status);
-                                cb->len = 0; /* skip urb => remove cb+wakeup in next loop cycle */
+                                cb->len = 0; /* skip urb => remove cb+wakeup
+                                                in next loop cycle */
                         }
                 }
-        } while (cb && status); /* bei Fehler naechster Befehl //FIXME: ist das OK? */
+        } while (cb && status); /* next command on error */
 
         return status;
 }
 
-/* Write string into transbuf and send it to modem.
- */
+/* Send command to device. */
 static int gigaset_write_cmd(struct cardstate *cs, const unsigned char *buf,
-                             int len, struct tasklet_struct *wake_tasklet)
+                             int len, struct tasklet_struct *wake_tasklet)
 {
         struct cmdbuf_t *cb;
         unsigned long flags;
 
         gigaset_dbg_buffer(atomic_read(&cs->mstate) != MS_LOCKED ?
-                             DEBUG_TRANSCMD : DEBUG_LOCKCMD,
-                           "CMD Transmit", len, buf, 0);
-
-        if (!atomic_read(&cs->connected)) {
-                err("%s: not connected", __func__);
-                return -ENODEV;
-        }
+                             DEBUG_TRANSCMD : DEBUG_LOCKCMD,
+                           "CMD Transmit", len, buf);
 
         if (len <= 0)
                 return 0;
 
         if (!(cb = kmalloc(sizeof(struct cmdbuf_t) + len, GFP_ATOMIC))) {
-                err("%s: out of memory", __func__);
+                dev_err(cs->dev, "%s: out of memory\n", __func__);
                 return -ENOMEM;
         }
 
@@ -554,7 +540,10 @@ static int gigaset_write_cmd(struct cardstate *cs, const unsigned char *buf,
         cs->lastcmdbuf = cb;
         spin_unlock_irqrestore(&cs->cmdlock, flags);
 
-        tasklet_schedule(&cs->write_tasklet);
+        spin_lock_irqsave(&cs->lock, flags);
+        if (cs->connected)
+                tasklet_schedule(&cs->write_tasklet);
+        spin_unlock_irqrestore(&cs->lock, flags);
         return len;
 }
 
@@ -578,11 +567,12 @@ static int gigaset_chars_in_buffer(struct cardstate *cs)
 static int gigaset_brkchars(struct cardstate *cs, const unsigned char buf[6])
 {
 #ifdef CONFIG_GIGASET_UNDOCREQ
-        gigaset_dbg_buffer(DEBUG_USBREQ, "brkchars", 6, buf, 0);
+        struct usb_device *udev = cs->hw.usb->udev;
+
+        gigaset_dbg_buffer(DEBUG_USBREQ, "brkchars", 6, buf);
         memcpy(cs->hw.usb->bchars, buf, 6);
-        return usb_control_msg(cs->hw.usb->udev,
-                               usb_sndctrlpipe(cs->hw.usb->udev, 0), 0x19, 0x41,
-                               0, 0, &buf, 6, 2000);
+        return usb_control_msg(udev, usb_sndctrlpipe(udev, 0), 0x19, 0x41,
+                               0, 0, &buf, 6, 2000);
 #else
         return -EINVAL;
 #endif
@@ -604,7 +594,6 @@ static int gigaset_initbcshw(struct bc_state *bcs)
         if (!bcs->hw.usb)
                 return 0;
 
-        //bcs->hw.usb->trans_flg = READY_TO_TRNSMIT; /* B-Channel ready to transmit */
         return 1;
 }
 
@@ -614,7 +603,6 @@ static void gigaset_reinitbcshw(struct bc_state *bcs)
 
 static void gigaset_freecshw(struct cardstate *cs)
 {
-        //FIXME
         tasklet_kill(&cs->write_tasklet);
         kfree(cs->hw.usb);
 }
@@ -639,33 +627,21 @@ static int gigaset_initcshw(struct cardstate *cs)
         //ucs->urb_cmd_out = NULL;
         ucs->read_urb = NULL;
         tasklet_init(&cs->write_tasklet,
-                     &gigaset_modem_fill, (unsigned long) cs);
+                     &gigaset_modem_fill, (unsigned long) cs);
 
         return 1;
 }
 
-/* Writes the data of the current open skb into the modem.
- * We have to protect against multiple calls until the
- * callback handler () is called , due to the fact that we
- * are just allowed to send data once to an endpoint. Therefore
- * we using "trans_flg" to synchonize ...
- */
+/* Send data from current skb to the device. */
 static int write_modem(struct cardstate *cs)
 {
-        int ret;
+        int ret = 0;
         int count;
         struct bc_state *bcs = &cs->bcs[0]; /* only one channel */
         struct usb_cardstate *ucs = cs->hw.usb;
-        //unsigned long flags;
-
-        IFNULLRETVAL(bcs->tx_skb, -EINVAL);
-
-        dbg(DEBUG_WRITE, "len: %d...", bcs->tx_skb->len);
+        unsigned long flags;
 
-        ret = -ENODEV;
-        IFNULLGOTO(ucs->bulk_out_buffer, error);
-        IFNULLGOTO(ucs->bulk_out_urb, error);
-        ret = 0;
+        gig_dbg(DEBUG_WRITE, "len: %d...", bcs->tx_skb->len);
 
         if (!bcs->tx_skb->len) {
                 dev_kfree_skb_any(bcs->tx_skb);
@@ -679,40 +655,42 @@ static int write_modem(struct cardstate *cs)
         count = min(bcs->tx_skb->len, (unsigned) ucs->bulk_out_size);
         memcpy(ucs->bulk_out_buffer, bcs->tx_skb->data, count);
         skb_pull(bcs->tx_skb, count);
-
-        usb_fill_bulk_urb(ucs->bulk_out_urb, ucs->udev,
-                          usb_sndbulkpipe(ucs->udev,
-                                          ucs->bulk_out_endpointAddr & 0x0f),
-                          ucs->bulk_out_buffer, count,
-                          gigaset_write_bulk_callback, cs);
         atomic_set(&ucs->busy, 1);
-        dbg(DEBUG_OUTPUT, "write_modem: send %d bytes", count);
+        gig_dbg(DEBUG_OUTPUT, "write_modem: send %d bytes", count);
+
+        spin_lock_irqsave(&cs->lock, flags);
+        if (cs->connected) {
+                usb_fill_bulk_urb(ucs->bulk_out_urb, ucs->udev,
+                                  usb_sndbulkpipe(ucs->udev,
+                                                  ucs->bulk_out_endpointAddr & 0x0f),
+                                  ucs->bulk_out_buffer, count,
+                                  gigaset_write_bulk_callback, cs);
+                ret = usb_submit_urb(ucs->bulk_out_urb, SLAB_ATOMIC);
+        } else {
+                ret = -ENODEV;
+        }
+        spin_unlock_irqrestore(&cs->lock, flags);
 
-        ret = usb_submit_urb(ucs->bulk_out_urb, SLAB_ATOMIC);
         if (ret) {
-                err("could not submit urb (error %d).", -ret);
+                err("could not submit urb (error %d)\n", -ret);
                 atomic_set(&ucs->busy, 0);
         }
+
         if (!bcs->tx_skb->len) {
                 /* skb sent completely */
                 gigaset_skb_sent(bcs, bcs->tx_skb); //FIXME also, when ret<0?
 
-                dbg(DEBUG_INTR,
-                    "kfree skb (Adr: %lx)!", (unsigned long) bcs->tx_skb);
+                gig_dbg(DEBUG_INTR, "kfree skb (Adr: %lx)!",
+                        (unsigned long) bcs->tx_skb);
                 dev_kfree_skb_any(bcs->tx_skb);
                 bcs->tx_skb = NULL;
         }
 
         return ret;
-error:
-        dev_kfree_skb_any(bcs->tx_skb);
-        bcs->tx_skb = NULL;
-        return ret;
-
 }
 
 static int gigaset_probe(struct usb_interface *interface,
-                         const struct usb_device_id *id)
+                         const struct usb_device_id *id)
 {
         int retval;
         struct usb_device *udev = interface_to_usbdev(interface);
@@ -720,16 +698,14 @@ static int gigaset_probe(struct usb_interface *interface,
         struct usb_host_interface *hostif;
         struct cardstate *cs = NULL;
         struct usb_cardstate *ucs = NULL;
-        //struct usb_interface_descriptor *iface_desc;
         struct usb_endpoint_descriptor *endpoint;
-        //isdn_ctrl command;
         int buffer_size;
         int alt;
-        //unsigned long flags;
 
-        info("%s: Check if device matches .. (Vendor: 0x%x, Product: 0x%x)",
-            __func__, le16_to_cpu(udev->descriptor.idVendor),
-            le16_to_cpu(udev->descriptor.idProduct));
+        gig_dbg(DEBUG_ANY,
+                "%s: Check if device matches .. (Vendor: 0x%x, Product: 0x%x)",
+                __func__, le16_to_cpu(udev->descriptor.idVendor),
+                le16_to_cpu(udev->descriptor.idProduct));
 
         retval = -ENODEV; //FIXME
 
@@ -744,7 +720,7 @@ static int gigaset_probe(struct usb_interface *interface,
         ifnum = hostif->desc.bInterfaceNumber; // FIXME ?
 
         if (alt != 0 || ifnum != 0) {
-                warn("ifnum %d, alt %d", ifnum, alt);
+                dev_warn(&udev->dev, "ifnum %d, alt %d\n", ifnum, alt);
                 return -ENODEV;
         }
 
@@ -752,42 +728,29 @@ static int gigaset_probe(struct usb_interface *interface,
          *
          */
         if (hostif->desc.bInterfaceClass != 255) {
-                info("%s: Device matched, but iface_desc[%d]->bInterfaceClass==%d !",
-                       __func__, ifnum, hostif->desc.bInterfaceClass);
+                dev_info(&udev->dev,
+                "%s: Device matched but iface_desc[%d]->bInterfaceClass==%d!\n",
+                         __func__, ifnum, hostif->desc.bInterfaceClass);
                 return -ENODEV;
         }
 
-        info("%s: Device matched ... !", __func__);
+        dev_info(&udev->dev, "%s: Device matched ... !\n", __func__);
 
         cs = gigaset_getunassignedcs(driver);
         if (!cs) {
-                warn("No free cardstate!");
+                dev_warn(&udev->dev, "no free cardstate\n");
                 return -ENODEV;
         }
         ucs = cs->hw.usb;
 
-#if 0
-        if (usb_set_configuration(udev, udev->config[0].desc.bConfigurationValue) < 0) {
-                warn("set_configuration failed");
-                goto error;
-        }
-
-
-        if (usb_set_interface(udev, ifnum/*==0*/, alt/*==0*/) < 0) {
-                warn("usb_set_interface failed, device %d interface %d altsetting %d",
-                     udev->devnum, ifnum, alt);
-                goto error;
-        }
-#endif
+        /* save off device structure ptrs for later use */
+        usb_get_dev(udev);
+        ucs->udev = udev;
+        ucs->interface = interface;
+        cs->dev = &interface->dev;
 
-        /* set up the endpoint information */
-        /* check out the endpoints */
-        /* We will get 2 endpoints: One for sending commands to the device (bulk out) and one to
-         * poll messages from the device(int in).
-         * Therefore we will have an almost similiar situation as with our serial port handler.
-         * If an connection will be established, we will have to create data in/out pipes
-         * dynamically...
-         */
+        /* save address of controller structure */
+        usb_set_intfdata(interface, cs); // dev_set_drvdata(&interface->dev, cs);
 
         endpoint = &hostif->endpoint[0].desc;
 
@@ -796,14 +759,14 @@ static int gigaset_probe(struct usb_interface *interface,
         ucs->bulk_out_endpointAddr = endpoint->bEndpointAddress;
         ucs->bulk_out_buffer = kmalloc(buffer_size, GFP_KERNEL);
         if (!ucs->bulk_out_buffer) {
-                err("Couldn't allocate bulk_out_buffer");
+                dev_err(cs->dev, "Couldn't allocate bulk_out_buffer\n");
                 retval = -ENOMEM;
                 goto error;
         }
 
         ucs->bulk_out_urb = usb_alloc_urb(0, SLAB_KERNEL);
         if (!ucs->bulk_out_urb) {
-                err("Couldn't allocate bulk_out_buffer");
+                dev_err(cs->dev, "Couldn't allocate bulk_out_urb\n");
                 retval = -ENOMEM;
                 goto error;
         }
@@ -811,12 +774,10 @@ static int gigaset_probe(struct usb_interface *interface,
         endpoint = &hostif->endpoint[1].desc;
 
         atomic_set(&ucs->busy, 0);
-        ucs->udev = udev;
-        ucs->interface = interface;
 
         ucs->read_urb = usb_alloc_urb(0, SLAB_KERNEL);
         if (!ucs->read_urb) {
-                err("No free urbs available");
+                dev_err(cs->dev, "No free urbs available\n");
                 retval = -ENOMEM;
                 goto error;
         }
@@ -825,38 +786,33 @@ static int gigaset_probe(struct usb_interface *interface,
         ucs->int_in_endpointAddr = endpoint->bEndpointAddress;
         cs->inbuf[0].rcvbuf = kmalloc(buffer_size, GFP_KERNEL);
         if (!cs->inbuf[0].rcvbuf) {
-                err("Couldn't allocate rcvbuf");
+                dev_err(cs->dev, "Couldn't allocate rcvbuf\n");
                 retval = -ENOMEM;
                 goto error;
         }
         /* Fill the interrupt urb and send it to the core */
         usb_fill_int_urb(ucs->read_urb, udev,
-                         usb_rcvintpipe(udev,
-                                        endpoint->bEndpointAddress & 0x0f),
-                         cs->inbuf[0].rcvbuf, buffer_size,
-                         gigaset_read_int_callback,
-                         cs->inbuf + 0, endpoint->bInterval);
+                         usb_rcvintpipe(udev,
+                                        endpoint->bEndpointAddress & 0x0f),
+                         cs->inbuf[0].rcvbuf, buffer_size,
+                         gigaset_read_int_callback,
+                         cs->inbuf + 0, endpoint->bInterval);
 
         retval = usb_submit_urb(ucs->read_urb, SLAB_KERNEL);
         if (retval) {
-                err("Could not submit URB!");
+                dev_err(cs->dev, "Could not submit URB (error %d)\n", -retval);
                 goto error;
         }
 
         /* tell common part that the device is ready */
         if (startmode == SM_LOCKED)
                 atomic_set(&cs->mstate, MS_LOCKED);
+
         if (!gigaset_start(cs)) {
                 tasklet_kill(&cs->write_tasklet);
                 retval = -ENODEV; //FIXME
                 goto error;
         }
-
-        /* save address of controller structure */
-        usb_set_intfdata(interface, cs);
-
-        /* set up device sysfs */
-        gigaset_init_dev_sysfs(interface);
         return 0;
 
 error:
@@ -868,48 +824,45 @@ error:
         kfree(cs->inbuf[0].rcvbuf);
         if (ucs->read_urb != NULL)
                 usb_free_urb(ucs->read_urb);
+        usb_set_intfdata(interface, NULL);
         ucs->read_urb = ucs->bulk_out_urb = NULL;
         cs->inbuf[0].rcvbuf = ucs->bulk_out_buffer = NULL;
+        usb_put_dev(ucs->udev);
+        ucs->udev = NULL;
+        ucs->interface = NULL;
         gigaset_unassign(cs);
         return retval;
 }
 
-/**
- *      skel_disconnect
- */
 static void gigaset_disconnect(struct usb_interface *interface)
 {
         struct cardstate *cs;
         struct usb_cardstate *ucs;
 
         cs = usb_get_intfdata(interface);
-
-        /* clear device sysfs */
-        gigaset_free_dev_sysfs(interface);
-
-        usb_set_intfdata(interface, NULL);
         ucs = cs->hw.usb;
         usb_kill_urb(ucs->read_urb);
-        //info("GigaSet USB device #%d will be disconnected", minor);
 
         gigaset_stop(cs);
 
+        usb_set_intfdata(interface, NULL);
         tasklet_kill(&cs->write_tasklet);
 
-        usb_kill_urb(ucs->bulk_out_urb);  /* FIXME: nur, wenn noetig */
-        //usb_kill_urb(ucs->urb_cmd_out);  /* FIXME: nur, wenn noetig */
+        usb_kill_urb(ucs->bulk_out_urb);        /* FIXME: only if active? */
 
         kfree(ucs->bulk_out_buffer);
         if (ucs->bulk_out_urb != NULL)
                 usb_free_urb(ucs->bulk_out_urb);
-        //if(ucs->urb_cmd_out != NULL)
-        //      usb_free_urb(ucs->urb_cmd_out);
         kfree(cs->inbuf[0].rcvbuf);
         if (ucs->read_urb != NULL)
                 usb_free_urb(ucs->read_urb);
-        ucs->read_urb = ucs->bulk_out_urb/*=ucs->urb_cmd_out*/=NULL;
+        ucs->read_urb = ucs->bulk_out_urb = NULL;
         cs->inbuf[0].rcvbuf = ucs->bulk_out_buffer = NULL;
 
+        usb_put_dev(ucs->udev);
+        ucs->interface = NULL;
+        ucs->udev = NULL;
+        cs->dev = NULL;
         gigaset_unassign(cs);
 }
 
@@ -942,9 +895,9 @@ static int __init usb_gigaset_init(void)
 
         /* allocate memory for our driver state and intialize it */
         if ((driver = gigaset_initdriver(GIGASET_MINOR, GIGASET_MINORS,
-                                       GIGASET_MODULENAME, GIGASET_DEVNAME,
-                                       GIGASET_DEVFSNAME, &ops,
-                                       THIS_MODULE)) == NULL)
+                                       GIGASET_MODULENAME, GIGASET_DEVNAME,
+                                       GIGASET_DEVFSNAME, &ops,
+                                       THIS_MODULE)) == NULL)
                 goto error;
 
         /* allocate memory for our device state and intialize it */
@@ -981,8 +934,8 @@ error:	if (cardstate)
 static void __exit usb_gigaset_exit(void)
 {
         gigaset_blockdriver(driver); /* => probe will fail
-                                      * => no gigaset_start any more
-                                      */
+                                      * => no gigaset_start any more
+                                      */
 
         gigaset_shutdown(cardstate);
         /* from now on, no isdn callback should be possible */
diff --git a/drivers/isdn/hardware/avm/avm_cs.c b/drivers/isdn/hardware/avm/avm_cs.c
index 2a2b03ff096b..7bbfd85ab793 100644
--- a/drivers/isdn/hardware/avm/avm_cs.c
+++ b/drivers/isdn/hardware/avm/avm_cs.c
@@ -51,8 +51,8 @@ MODULE_LICENSE("GPL");
    handler.
 */
 
-static void avmcs_config(dev_link_t *link);
-static void avmcs_release(dev_link_t *link);
+static int avmcs_config(struct pcmcia_device *link);
+static void avmcs_release(struct pcmcia_device *link);
 
 /*
    The attach() and detach() entry points are used to create and destroy
@@ -65,10 +65,10 @@ static void avmcs_detach(struct pcmcia_device *p_dev);
 /*
    A linked list of "instances" of the skeleton device.  Each actual
    PCMCIA card corresponds to one device instance, and is described
-   by one dev_link_t structure (defined in ds.h).
+   by one struct pcmcia_device structure (defined in ds.h).
 
    You may not want to use a linked list for this -- for example, the
-   memory card driver uses an array of dev_link_t pointers, where minor
+   memory card driver uses an array of struct pcmcia_device pointers, where minor
    device numbers are used to derive the corresponding array index.
 */
 
@@ -78,7 +78,7 @@ static void avmcs_detach(struct pcmcia_device *p_dev);
    example, ethernet cards, modems).  In other cases, there may be
    many actual or logical devices (SCSI adapters, memory cards with
    multiple partitions).  The dev_node_t structures need to be kept
-   in a linked list starting at the 'dev' field of a dev_link_t
+   in a linked list starting at the 'dev' field of a struct pcmcia_device
    structure.  We allocate them in the card's private data structure,
    because they generally can't be allocated dynamically.
 */
@@ -99,54 +99,38 @@ typedef struct local_info_t {
     
 ======================================================================*/
 
-static int avmcs_attach(struct pcmcia_device *p_dev)
+static int avmcs_probe(struct pcmcia_device *p_dev)
 {
-    dev_link_t *link;
     local_info_t *local;
 
-    /* Initialize the dev_link_t structure */
-    link = kmalloc(sizeof(struct dev_link_t), GFP_KERNEL);
-    if (!link)
-        goto err;
-    memset(link, 0, sizeof(struct dev_link_t));
-
     /* The io structure describes IO port mapping */
-    link->io.NumPorts1 = 16;
-    link->io.Attributes1 = IO_DATA_PATH_WIDTH_8;
-    link->io.NumPorts2 = 0;
+    p_dev->io.NumPorts1 = 16;
+    p_dev->io.Attributes1 = IO_DATA_PATH_WIDTH_8;
+    p_dev->io.NumPorts2 = 0;
 
     /* Interrupt setup */
-    link->irq.Attributes = IRQ_TYPE_EXCLUSIVE;
-    link->irq.Attributes = IRQ_TYPE_DYNAMIC_SHARING|IRQ_FIRST_SHARED;
+    p_dev->irq.Attributes = IRQ_TYPE_EXCLUSIVE;
+    p_dev->irq.Attributes = IRQ_TYPE_DYNAMIC_SHARING|IRQ_FIRST_SHARED;
+
+    p_dev->irq.IRQInfo1 = IRQ_LEVEL_ID;
 
-    link->irq.IRQInfo1 = IRQ_LEVEL_ID;
-    
     /* General socket configuration */
-    link->conf.Attributes = CONF_ENABLE_IRQ;
-    link->conf.Vcc = 50;
-    link->conf.IntType = INT_MEMORY_AND_IO;
-    link->conf.ConfigIndex = 1;
-    link->conf.Present = PRESENT_OPTION;
+    p_dev->conf.Attributes = CONF_ENABLE_IRQ;
+    p_dev->conf.IntType = INT_MEMORY_AND_IO;
+    p_dev->conf.ConfigIndex = 1;
+    p_dev->conf.Present = PRESENT_OPTION;
 
     /* Allocate space for private device-specific data */
     local = kmalloc(sizeof(local_info_t), GFP_KERNEL);
     if (!local)
-        goto err_kfree;
+        goto err;
     memset(local, 0, sizeof(local_info_t));
-    link->priv = local;
+    p_dev->priv = local;
 
-    link->handle = p_dev;
-    p_dev->instance = link;
+    return avmcs_config(p_dev);
 
-    link->state |= DEV_PRESENT | DEV_CONFIG_PENDING;
-    avmcs_config(link);
-
-    return 0;
-
- err_kfree:
-    kfree(link);
  err:
-    return -EINVAL;
+    return -ENOMEM;
 } /* avmcs_attach */
 
 /*======================================================================
@@ -158,15 +142,10 @@ static int avmcs_attach(struct pcmcia_device *p_dev)
 
 ======================================================================*/
 
-static void avmcs_detach(struct pcmcia_device *p_dev)
+static void avmcs_detach(struct pcmcia_device *link)
 {
-    dev_link_t *link = dev_to_instance(p_dev);
-
-    if (link->state & DEV_CONFIG)
         avmcs_release(link);
-
-    kfree(link->priv);
-    kfree(link);
+        kfree(link->priv);
 } /* avmcs_detach */
 
 /*======================================================================
@@ -177,7 +156,7 @@ static void avmcs_detach(struct pcmcia_device *p_dev)
     
 ======================================================================*/
 
-static int get_tuple(client_handle_t handle, tuple_t *tuple,
+static int get_tuple(struct pcmcia_device *handle, tuple_t *tuple,
                      cisparse_t *parse)
 {
     int i = pcmcia_get_tuple_data(handle, tuple);
@@ -185,7 +164,7 @@ static int get_tuple(client_handle_t handle, tuple_t *tuple,
     return pcmcia_parse_tuple(handle, tuple, parse);
 }
 
-static int first_tuple(client_handle_t handle, tuple_t *tuple,
+static int first_tuple(struct pcmcia_device *handle, tuple_t *tuple,
                      cisparse_t *parse)
 {
     int i = pcmcia_get_first_tuple(handle, tuple);
@@ -193,7 +172,7 @@ static int first_tuple(client_handle_t handle, tuple_t *tuple,
     return get_tuple(handle, tuple, parse);
 }
 
-static int next_tuple(client_handle_t handle, tuple_t *tuple,
+static int next_tuple(struct pcmcia_device *handle, tuple_t *tuple,
                      cisparse_t *parse)
 {
     int i = pcmcia_get_next_tuple(handle, tuple);
@@ -201,9 +180,8 @@ static int next_tuple(client_handle_t handle, tuple_t *tuple,
     return get_tuple(handle, tuple, parse);
 }
 
-static void avmcs_config(dev_link_t *link)
+static int avmcs_config(struct pcmcia_device *link)
 {
-    client_handle_t handle;
     tuple_t tuple;
     cisparse_t parse;
     cistpl_cftable_entry_t *cf = &parse.cftable_entry;
@@ -213,8 +191,7 @@ static void avmcs_config(dev_link_t *link)
     char devname[128];
     int cardtype;
     int (*addcard)(unsigned int port, unsigned irq);
-    
-    handle = link->handle;
+
     dev = link->priv;
 
     /*
@@ -223,25 +200,21 @@ static void avmcs_config(dev_link_t *link)
     */
     do {
         tuple.DesiredTuple = CISTPL_CONFIG;
-        i = pcmcia_get_first_tuple(handle, &tuple);
+        i = pcmcia_get_first_tuple(link, &tuple);
         if (i != CS_SUCCESS) break;
         tuple.TupleData = buf;
         tuple.TupleDataMax = 64;
         tuple.TupleOffset = 0;
-        i = pcmcia_get_tuple_data(handle, &tuple);
+        i = pcmcia_get_tuple_data(link, &tuple);
         if (i != CS_SUCCESS) break;
-        i = pcmcia_parse_tuple(handle, &tuple, &parse);
+        i = pcmcia_parse_tuple(link, &tuple, &parse);
         if (i != CS_SUCCESS) break;
         link->conf.ConfigBase = parse.config.base;
     } while (0);
     if (i != CS_SUCCESS) {
-        cs_error(link->handle, ParseTuple, i);
-        link->state &= ~DEV_CONFIG_PENDING;
-        return;
+        cs_error(link, ParseTuple, i);
+        return -ENODEV;
     }
-    
-    /* Configure card */
-    link->state |= DEV_CONFIG;
 
     do {
 
@@ -252,7 +225,7 @@ static void avmcs_config(dev_link_t *link)
         tuple.DesiredTuple = CISTPL_VERS_1;
 
         devname[0] = 0;
-        if( !first_tuple(handle, &tuple, &parse) && parse.version_1.ns > 1 ) {
+        if( !first_tuple(link, &tuple, &parse) && parse.version_1.ns > 1 ) {
             strlcpy(devname,parse.version_1.str + parse.version_1.ofs[1], 
                         sizeof(devname));
         }
@@ -263,7 +236,7 @@ static void avmcs_config(dev_link_t *link)
         tuple.TupleOffset = 0; tuple.TupleDataMax = 255;
         tuple.Attributes = 0;
         tuple.DesiredTuple = CISTPL_CFTABLE_ENTRY;
-        i = first_tuple(handle, &tuple, &parse);
+        i = first_tuple(link, &tuple, &parse);
         while (i == CS_SUCCESS) {
             if (cf->io.nwin > 0) {
                 link->conf.ConfigIndex = cf->index;
@@ -273,36 +246,36 @@ static void avmcs_config(dev_link_t *link)
                 printk(KERN_INFO "avm_cs: testing i/o %#x-%#x\n",
                         link->io.BasePort1,
                         link->io.BasePort1+link->io.NumPorts1-1);
-                i = pcmcia_request_io(link->handle, &link->io);
+                i = pcmcia_request_io(link, &link->io);
                 if (i == CS_SUCCESS) goto found_port;
             }
-            i = next_tuple(handle, &tuple, &parse);
+            i = next_tuple(link, &tuple, &parse);
         }
 
 found_port:
         if (i != CS_SUCCESS) {
-            cs_error(link->handle, RequestIO, i);
+            cs_error(link, RequestIO, i);
             break;
         }
-        
+
         /*
          * allocate an interrupt line
          */
-        i = pcmcia_request_irq(link->handle, &link->irq);
+        i = pcmcia_request_irq(link, &link->irq);
         if (i != CS_SUCCESS) {
-            cs_error(link->handle, RequestIRQ, i);
-            pcmcia_release_io(link->handle, &link->io);
+            cs_error(link, RequestIRQ, i);
+            /* undo */
+            pcmcia_disable_device(link);
             break;
         }
-        
+
         /*
          * configure the PCMCIA socket
           */
-        i = pcmcia_request_configuration(link->handle, &link->conf);
+        i = pcmcia_request_configuration(link, &link->conf);
         if (i != CS_SUCCESS) {
-            cs_error(link->handle, RequestConfiguration, i);
-            pcmcia_release_io(link->handle, &link->io);
-            pcmcia_release_irq(link->handle, &link->irq);
+            cs_error(link, RequestConfiguration, i);
+            pcmcia_disable_device(link);
             break;
         }
 
@@ -331,13 +304,12 @@ found_port:
 
     dev->node.major = 64;
     dev->node.minor = 0;
-    link->dev = &dev->node;
-    
-    link->state &= ~DEV_CONFIG_PENDING;
+    link->dev_node = &dev->node;
+
     /* If any step failed, release any partially configured state */
     if (i != 0) {
         avmcs_release(link);
-        return;
+        return -ENODEV;
     }
 
 
@@ -351,9 +323,10 @@ found_port:
         printk(KERN_ERR "avm_cs: failed to add AVM-%s-Controller at i/o %#x, irq %d\n",
                 dev->node.dev_name, link->io.BasePort1, link->irq.AssignedIRQ);
         avmcs_release(link);
-        return;
+        return -ENODEV;
     }
     dev->node.minor = i;
+    return 0;
 
 } /* avmcs_config */
 
@@ -365,56 +338,12 @@ found_port:
     
 ======================================================================*/
 
-static void avmcs_release(dev_link_t *link)
+static void avmcs_release(struct pcmcia_device *link)
 {
-    b1pcmcia_delcard(link->io.BasePort1, link->irq.AssignedIRQ);
-
-    /* Unlink the device chain */
-    link->dev = NULL;
-    
-    /* Don't bother checking to see if these succeed or not */
-    pcmcia_release_configuration(link->handle);
-    pcmcia_release_io(link->handle, &link->io);
-    pcmcia_release_irq(link->handle, &link->irq);
-    link->state &= ~DEV_CONFIG;
+        b1pcmcia_delcard(link->io.BasePort1, link->irq.AssignedIRQ);
+        pcmcia_disable_device(link);
 } /* avmcs_release */
 
-static int avmcs_suspend(struct pcmcia_device *dev)
-{
-        dev_link_t *link = dev_to_instance(dev);
-
-        link->state |= DEV_SUSPEND;
-        if (link->state & DEV_CONFIG)
-                pcmcia_release_configuration(link->handle);
-
-        return 0;
-}
-
-static int avmcs_resume(struct pcmcia_device *dev)
-{
-        dev_link_t *link = dev_to_instance(dev);
-
-        link->state &= ~DEV_SUSPEND;
-        if (link->state & DEV_CONFIG)
-                pcmcia_request_configuration(link->handle, &link->conf);
-
-        return 0;
-}
-
-/*======================================================================
-
-    The card status event handler.  Mostly, this schedules other
-    stuff to run after an event is received.  A CARD_REMOVAL event
-    also sets some flags to discourage the net drivers from trying
-    to talk to the card any more.
-
-    When a CARD_REMOVAL event is received, we immediately set a flag
-    to block future accesses to this device.  All the functions that
-    actually access the device should check this flag to make sure
-    the card is still present.
-    
-======================================================================*/
-
 
 static struct pcmcia_device_id avmcs_ids[] = {
         PCMCIA_DEVICE_PROD_ID12("AVM", "ISDN-Controller B1", 0x95d42008, 0x845dc335),
@@ -429,11 +358,9 @@ static struct pcmcia_driver avmcs_driver = {
         .drv    = {
                 .name   = "avm_cs",
         },
-        .probe = avmcs_attach,
+        .probe = avmcs_probe,
         .remove = avmcs_detach,
         .id_table = avmcs_ids,
-        .suspend= avmcs_suspend,
-        .resume = avmcs_resume,
 };
 
 static int __init avmcs_init(void)
diff --git a/drivers/isdn/hisax/avma1_cs.c b/drivers/isdn/hisax/avma1_cs.c
index 969da40c4248..ac28e3278ad9 100644
--- a/drivers/isdn/hisax/avma1_cs.c
+++ b/drivers/isdn/hisax/avma1_cs.c
@@ -67,8 +67,8 @@ module_param(isdnprot, int, 0);
    handler.
 */
 
-static void avma1cs_config(dev_link_t *link);
-static void avma1cs_release(dev_link_t *link);
+static int avma1cs_config(struct pcmcia_device *link);
+static void avma1cs_release(struct pcmcia_device *link);
 
 /*
    The attach() and detach() entry points are used to create and destroy
@@ -82,10 +82,10 @@ static void avma1cs_detach(struct pcmcia_device *p_dev);
 /*
    A linked list of "instances" of the skeleton device.  Each actual
    PCMCIA card corresponds to one device instance, and is described
-   by one dev_link_t structure (defined in ds.h).
+   by one struct pcmcia_device structure (defined in ds.h).
 
    You may not want to use a linked list for this -- for example, the
-   memory card driver uses an array of dev_link_t pointers, where minor
+   memory card driver uses an array of struct pcmcia_device pointers, where minor
    device numbers are used to derive the corresponding array index.
 */
 
@@ -95,7 +95,7 @@ static void avma1cs_detach(struct pcmcia_device *p_dev);
    example, ethernet cards, modems).  In other cases, there may be
    many actual or logical devices (SCSI adapters, memory cards with
    multiple partitions).  The dev_node_t structures need to be kept
-   in a linked list starting at the 'dev' field of a dev_link_t
+   in a linked list starting at the 'dev' field of a struct pcmcia_device
    structure.  We allocate them in the card's private data structure,
    because they generally can't be allocated dynamically.
 */
@@ -116,55 +116,40 @@ typedef struct local_info_t {
     
 ======================================================================*/
 
-static int avma1cs_attach(struct pcmcia_device *p_dev)
+static int avma1cs_probe(struct pcmcia_device *p_dev)
 {
-    dev_link_t *link;
     local_info_t *local;
 
     DEBUG(0, "avma1cs_attach()\n");
 
-    /* Initialize the dev_link_t structure */
-    link = kmalloc(sizeof(struct dev_link_t), GFP_KERNEL);
-    if (!link)
-        return -ENOMEM;
-    memset(link, 0, sizeof(struct dev_link_t));
-
     /* Allocate space for private device-specific data */
     local = kmalloc(sizeof(local_info_t), GFP_KERNEL);
-    if (!local) {
-        kfree(link);
+    if (!local)
         return -ENOMEM;
-    }
+
     memset(local, 0, sizeof(local_info_t));
-    link->priv = local;
+    p_dev->priv = local;
 
     /* The io structure describes IO port mapping */
-    link->io.NumPorts1 = 16;
-    link->io.Attributes1 = IO_DATA_PATH_WIDTH_8;
-    link->io.NumPorts2 = 16;
-    link->io.Attributes2 = IO_DATA_PATH_WIDTH_16;
-    link->io.IOAddrLines = 5;
+    p_dev->io.NumPorts1 = 16;
+    p_dev->io.Attributes1 = IO_DATA_PATH_WIDTH_8;
+    p_dev->io.NumPorts2 = 16;
+    p_dev->io.Attributes2 = IO_DATA_PATH_WIDTH_16;
+    p_dev->io.IOAddrLines = 5;
 
     /* Interrupt setup */
-    link->irq.Attributes = IRQ_TYPE_EXCLUSIVE;
-    link->irq.Attributes = IRQ_TYPE_DYNAMIC_SHARING|IRQ_FIRST_SHARED;
+    p_dev->irq.Attributes = IRQ_TYPE_EXCLUSIVE;
+    p_dev->irq.Attributes = IRQ_TYPE_DYNAMIC_SHARING|IRQ_FIRST_SHARED;
 
-    link->irq.IRQInfo1 = IRQ_LEVEL_ID;
+    p_dev->irq.IRQInfo1 = IRQ_LEVEL_ID;
 
     /* General socket configuration */
-    link->conf.Attributes = CONF_ENABLE_IRQ;
-    link->conf.Vcc = 50;
-    link->conf.IntType = INT_MEMORY_AND_IO;
-    link->conf.ConfigIndex = 1;
-    link->conf.Present = PRESENT_OPTION;
+    p_dev->conf.Attributes = CONF_ENABLE_IRQ;
+    p_dev->conf.IntType = INT_MEMORY_AND_IO;
+    p_dev->conf.ConfigIndex = 1;
+    p_dev->conf.Present = PRESENT_OPTION;
 
-    link->handle = p_dev;
-    p_dev->instance = link;
-
-    link->state |= DEV_PRESENT | DEV_CONFIG_PENDING;
-    avma1cs_config(link);
-
-    return 0;
+    return avma1cs_config(p_dev);
 } /* avma1cs_attach */
 
 /*======================================================================
@@ -176,17 +161,11 @@ static int avma1cs_attach(struct pcmcia_device *p_dev)
 
 ======================================================================*/
 
-static void avma1cs_detach(struct pcmcia_device *p_dev)
+static void avma1cs_detach(struct pcmcia_device *link)
 {
-    dev_link_t *link = dev_to_instance(p_dev);
-
-    DEBUG(0, "avma1cs_detach(0x%p)\n", link);
-
-    if (link->state & DEV_CONFIG)
-            avma1cs_release(link);
-
-    kfree(link->priv);
-    kfree(link);
+        DEBUG(0, "avma1cs_detach(0x%p)\n", link);
+        avma1cs_release(link);
+        kfree(link->priv);
 } /* avma1cs_detach */
 
 /*======================================================================
@@ -197,7 +176,7 @@ static void avma1cs_detach(struct pcmcia_device *p_dev)
     
 ======================================================================*/
 
-static int get_tuple(client_handle_t handle, tuple_t *tuple,
+static int get_tuple(struct pcmcia_device *handle, tuple_t *tuple,
                      cisparse_t *parse)
 {
     int i = pcmcia_get_tuple_data(handle, tuple);
@@ -205,7 +184,7 @@ static int get_tuple(client_handle_t handle, tuple_t *tuple,
     return pcmcia_parse_tuple(handle, tuple, parse);
 }
 
-static int first_tuple(client_handle_t handle, tuple_t *tuple,
+static int first_tuple(struct pcmcia_device *handle, tuple_t *tuple,
                      cisparse_t *parse)
 {
     int i = pcmcia_get_first_tuple(handle, tuple);
@@ -213,7 +192,7 @@ static int first_tuple(client_handle_t handle, tuple_t *tuple,
     return get_tuple(handle, tuple, parse);
 }
 
-static int next_tuple(client_handle_t handle, tuple_t *tuple,
+static int next_tuple(struct pcmcia_device *handle, tuple_t *tuple,
                      cisparse_t *parse)
 {
     int i = pcmcia_get_next_tuple(handle, tuple);
@@ -221,9 +200,8 @@ static int next_tuple(client_handle_t handle, tuple_t *tuple,
     return get_tuple(handle, tuple, parse);
 }
 
-static void avma1cs_config(dev_link_t *link)
+static int avma1cs_config(struct pcmcia_device *link)
 {
-    client_handle_t handle;
     tuple_t tuple;
     cisparse_t parse;
     cistpl_cftable_entry_t *cf = &parse.cftable_entry;
@@ -233,8 +211,7 @@ static void avma1cs_config(dev_link_t *link)
     char devname[128];
     IsdnCard_t  icard;
     int busy = 0;
-    
-    handle = link->handle;
+
     dev = link->priv;
 
     DEBUG(0, "avma1cs_config(0x%p)\n", link);
@@ -245,25 +222,21 @@ static void avma1cs_config(dev_link_t *link)
     */
     do {
         tuple.DesiredTuple = CISTPL_CONFIG;
-        i = pcmcia_get_first_tuple(handle, &tuple);
+        i = pcmcia_get_first_tuple(link, &tuple);
         if (i != CS_SUCCESS) break;
         tuple.TupleData = buf;
         tuple.TupleDataMax = 64;
         tuple.TupleOffset = 0;
-        i = pcmcia_get_tuple_data(handle, &tuple);
+        i = pcmcia_get_tuple_data(link, &tuple);
         if (i != CS_SUCCESS) break;
-        i = pcmcia_parse_tuple(handle, &tuple, &parse);
+        i = pcmcia_parse_tuple(link, &tuple, &parse);
         if (i != CS_SUCCESS) break;
         link->conf.ConfigBase = parse.config.base;
     } while (0);
     if (i != CS_SUCCESS) {
-        cs_error(link->handle, ParseTuple, i);
-        link->state &= ~DEV_CONFIG_PENDING;
-        return;
+        cs_error(link, ParseTuple, i);
+        return -ENODEV;
     }
-    
-    /* Configure card */
-    link->state |= DEV_CONFIG;
 
     do {
 
@@ -274,7 +247,7 @@ static void avma1cs_config(dev_link_t *link)
         tuple.DesiredTuple = CISTPL_VERS_1;
 
         devname[0] = 0;
-        if( !first_tuple(handle, &tuple, &parse) && parse.version_1.ns > 1 ) {
+        if( !first_tuple(link, &tuple, &parse) && parse.version_1.ns > 1 ) {
             strlcpy(devname,parse.version_1.str + parse.version_1.ofs[1], 
                         sizeof(devname));
         }
@@ -285,7 +258,7 @@ static void avma1cs_config(dev_link_t *link)
         tuple.TupleOffset = 0; tuple.TupleDataMax = 255;
         tuple.Attributes = 0;
         tuple.DesiredTuple = CISTPL_CFTABLE_ENTRY;
-        i = first_tuple(handle, &tuple, &parse);
+        i = first_tuple(link, &tuple, &parse);
         while (i == CS_SUCCESS) {
             if (cf->io.nwin > 0) {
                 link->conf.ConfigIndex = cf->index;
@@ -295,36 +268,36 @@ static void avma1cs_config(dev_link_t *link)
                 printk(KERN_INFO "avma1_cs: testing i/o %#x-%#x\n",
                         link->io.BasePort1,
                         link->io.BasePort1+link->io.NumPorts1 - 1);
-                i = pcmcia_request_io(link->handle, &link->io);
+                i = pcmcia_request_io(link, &link->io);
                 if (i == CS_SUCCESS) goto found_port;
             }
-            i = next_tuple(handle, &tuple, &parse);
+            i = next_tuple(link, &tuple, &parse);
         }
 
 found_port:
         if (i != CS_SUCCESS) {
-            cs_error(link->handle, RequestIO, i);
+            cs_error(link, RequestIO, i);
             break;
         }
         
         /*
          * allocate an interrupt line
          */
-        i = pcmcia_request_irq(link->handle, &link->irq);
+        i = pcmcia_request_irq(link, &link->irq);
         if (i != CS_SUCCESS) {
-            cs_error(link->handle, RequestIRQ, i);
-            pcmcia_release_io(link->handle, &link->io);
+            cs_error(link, RequestIRQ, i);
+            /* undo */
+            pcmcia_disable_device(link);
             break;
         }
-        
+
         /*
          * configure the PCMCIA socket
          */
-        i = pcmcia_request_configuration(link->handle, &link->conf);
+        i = pcmcia_request_configuration(link, &link->conf);
         if (i != CS_SUCCESS) {
-            cs_error(link->handle, RequestConfiguration, i);
-            pcmcia_release_io(link->handle, &link->io);
-            pcmcia_release_irq(link->handle, &link->irq);
+            cs_error(link, RequestConfiguration, i);
+            pcmcia_disable_device(link);
             break;
         }
 
@@ -336,13 +309,12 @@ found_port:
     strcpy(dev->node.dev_name, "A1");
     dev->node.major = 45;
     dev->node.minor = 0;
-    link->dev = &dev->node;
-    
-    link->state &= ~DEV_CONFIG_PENDING;
+    link->dev_node = &dev->node;
+
     /* If any step failed, release any partially configured state */
     if (i != 0) {
         avma1cs_release(link);
-        return;
+        return -ENODEV;
     }
 
     printk(KERN_NOTICE "avma1_cs: checking at i/o %#x, irq %d\n",
@@ -357,10 +329,11 @@ found_port:
     if (i < 0) {
         printk(KERN_ERR "avma1_cs: failed to initialize AVM A1 PCMCIA %d at i/o %#x\n", i, link->io.BasePort1);
         avma1cs_release(link);
-        return;
+        return -ENODEV;
     }
     dev->node.minor = i;
 
+    return 0;
 } /* avma1cs_config */
 
 /*======================================================================
@@ -371,47 +344,18 @@ found_port:
     
 ======================================================================*/
 
-static void avma1cs_release(dev_link_t *link)
+static void avma1cs_release(struct pcmcia_device *link)
 {
-    local_info_t *local = link->priv;
+        local_info_t *local = link->priv;
 
-    DEBUG(0, "avma1cs_release(0x%p)\n", link);
+        DEBUG(0, "avma1cs_release(0x%p)\n", link);
 
-    /* no unregister function with hisax */
-    HiSax_closecard(local->node.minor);
+        /* now unregister function with hisax */
+        HiSax_closecard(local->node.minor);
 
-    /* Unlink the device chain */
-    link->dev = NULL;
-    
-    /* Don't bother checking to see if these succeed or not */
-    pcmcia_release_configuration(link->handle);
-    pcmcia_release_io(link->handle, &link->io);
-    pcmcia_release_irq(link->handle, &link->irq);
-    link->state &= ~DEV_CONFIG;
+        pcmcia_disable_device(link);
 } /* avma1cs_release */
 
-static int avma1cs_suspend(struct pcmcia_device *dev)
-{
-        dev_link_t *link = dev_to_instance(dev);
-
-        link->state |= DEV_SUSPEND;
-        if (link->state & DEV_CONFIG)
-                pcmcia_release_configuration(link->handle);
-
-        return 0;
-}
-
-static int avma1cs_resume(struct pcmcia_device *dev)
-{
-        dev_link_t *link = dev_to_instance(dev);
-
-        link->state &= ~DEV_SUSPEND;
-        if (link->state & DEV_CONFIG)
-                pcmcia_request_configuration(link->handle, &link->conf);
-
-        return 0;
-}
-
 
 static struct pcmcia_device_id avma1cs_ids[] = {
         PCMCIA_DEVICE_PROD_ID12("AVM", "ISDN A", 0x95d42008, 0xadc9d4bb),
@@ -425,13 +369,11 @@ static struct pcmcia_driver avma1cs_driver = {
         .drv            = {
                 .name   = "avma1_cs",
         },
-        .probe          = avma1cs_attach,
+        .probe          = avma1cs_probe,
         .remove         = avma1cs_detach,
         .id_table       = avma1cs_ids,
-        .suspend        = avma1cs_suspend,
-        .resume         = avma1cs_resume,
 };
- 
+
 /*====================================================================*/
 
 static int __init init_avma1_cs(void)
diff --git a/drivers/isdn/hisax/elsa_cs.c b/drivers/isdn/hisax/elsa_cs.c
index 062fb8f0739f..e18e75be8ed3 100644
--- a/drivers/isdn/hisax/elsa_cs.c
+++ b/drivers/isdn/hisax/elsa_cs.c
@@ -94,8 +94,8 @@ module_param(protocol, int, 0);
    handler.
 */
 
-static void elsa_cs_config(dev_link_t *link);
-static void elsa_cs_release(dev_link_t *link);
+static int elsa_cs_config(struct pcmcia_device *link);
+static void elsa_cs_release(struct pcmcia_device *link);
 
 /*
    The attach() and detach() entry points are used to create and destroy
@@ -111,7 +111,7 @@ static void elsa_cs_detach(struct pcmcia_device *p_dev);
    example, ethernet cards, modems).  In other cases, there may be
    many actual or logical devices (SCSI adapters, memory cards with
    multiple partitions).  The dev_node_t structures need to be kept
-   in a linked list starting at the 'dev' field of a dev_link_t
+   in a linked list starting at the 'dev' field of a struct pcmcia_device
    structure.  We allocate them in the card's private data structure,
    because they generally shouldn't be allocated dynamically.
    In this case, we also provide a flag to indicate if a device is
@@ -121,7 +121,7 @@ static void elsa_cs_detach(struct pcmcia_device *p_dev);
 */
 
 typedef struct local_info_t {
-    dev_link_t          link;
+        struct pcmcia_device    *p_dev;
     dev_node_t          node;
     int                 busy;
     int                 cardnr;
@@ -139,9 +139,8 @@ typedef struct local_info_t {
 
 ======================================================================*/
 
-static int elsa_cs_attach(struct pcmcia_device *p_dev)
+static int elsa_cs_probe(struct pcmcia_device *link)
 {
-    dev_link_t *link;
     local_info_t *local;
 
     DEBUG(0, "elsa_cs_attach()\n");
@@ -150,8 +149,11 @@ static int elsa_cs_attach(struct pcmcia_device *p_dev)
     local = kmalloc(sizeof(local_info_t), GFP_KERNEL);
     if (!local) return -ENOMEM;
     memset(local, 0, sizeof(local_info_t));
+
+    local->p_dev = link;
+    link->priv = local;
+
     local->cardnr = -1;
-    link = &local->link; link->priv = local;
 
     /* Interrupt setup */
     link->irq.Attributes = IRQ_TYPE_DYNAMIC_SHARING|IRQ_FIRST_SHARED;
@@ -170,16 +172,9 @@ static int elsa_cs_attach(struct pcmcia_device *p_dev)
     link->io.IOAddrLines = 3;
 
     link->conf.Attributes = CONF_ENABLE_IRQ;
-    link->conf.Vcc = 50;
     link->conf.IntType = INT_MEMORY_AND_IO;
 
-    link->handle = p_dev;
-    p_dev->instance = link;
-
-    link->state |= DEV_PRESENT | DEV_CONFIG_PENDING;
-    elsa_cs_config(link);
-
-    return 0;
+    return elsa_cs_config(link);
 } /* elsa_cs_attach */
 
 /*======================================================================
@@ -191,20 +186,16 @@ static int elsa_cs_attach(struct pcmcia_device *p_dev)
 
 ======================================================================*/
 
-static void elsa_cs_detach(struct pcmcia_device *p_dev)
+static void elsa_cs_detach(struct pcmcia_device *link)
 {
-    dev_link_t *link = dev_to_instance(p_dev);
-    local_info_t *info = link->priv;
+        local_info_t *info = link->priv;
 
-    DEBUG(0, "elsa_cs_detach(0x%p)\n", link);
+        DEBUG(0, "elsa_cs_detach(0x%p)\n", link);
 
-    if (link->state & DEV_CONFIG) {
-            info->busy = 1;
-            elsa_cs_release(link);
-    }
-
-    kfree(info);
+        info->busy = 1;
+        elsa_cs_release(link);
 
+        kfree(info);
 } /* elsa_cs_detach */
 
 /*======================================================================
@@ -214,7 +205,7 @@ static void elsa_cs_detach(struct pcmcia_device *p_dev)
     device available to the system.
 
 ======================================================================*/
-static int get_tuple(client_handle_t handle, tuple_t *tuple,
+static int get_tuple(struct pcmcia_device *handle, tuple_t *tuple,
                      cisparse_t *parse)
 {
     int i = pcmcia_get_tuple_data(handle, tuple);
@@ -222,7 +213,7 @@ static int get_tuple(client_handle_t handle, tuple_t *tuple,
     return pcmcia_parse_tuple(handle, tuple, parse);
 }
 
-static int first_tuple(client_handle_t handle, tuple_t *tuple,
+static int first_tuple(struct pcmcia_device *handle, tuple_t *tuple,
                      cisparse_t *parse)
 {
     int i = pcmcia_get_first_tuple(handle, tuple);
@@ -230,7 +221,7 @@ static int first_tuple(client_handle_t handle, tuple_t *tuple,
     return get_tuple(handle, tuple, parse);
 }
 
-static int next_tuple(client_handle_t handle, tuple_t *tuple,
+static int next_tuple(struct pcmcia_device *handle, tuple_t *tuple,
                      cisparse_t *parse)
 {
     int i = pcmcia_get_next_tuple(handle, tuple);
@@ -238,9 +229,8 @@ static int next_tuple(client_handle_t handle, tuple_t *tuple,
     return get_tuple(handle, tuple, parse);
 }
 
-static void elsa_cs_config(dev_link_t *link)
+static int elsa_cs_config(struct pcmcia_device *link)
 {
-    client_handle_t handle;
     tuple_t tuple;
     cisparse_t parse;
     local_info_t *dev;
@@ -250,7 +240,6 @@ static void elsa_cs_config(dev_link_t *link)
     IsdnCard_t icard;
 
     DEBUG(0, "elsa_config(0x%p)\n", link);
-    handle = link->handle;
     dev = link->priv;
 
     /*
@@ -262,7 +251,7 @@ static void elsa_cs_config(dev_link_t *link)
     tuple.TupleDataMax = 255;
     tuple.TupleOffset = 0;
     tuple.Attributes = 0;
-    i = first_tuple(handle, &tuple, &parse);
+    i = first_tuple(link, &tuple, &parse);
     if (i != CS_SUCCESS) {
         last_fn = ParseTuple;
         goto cs_failed;
@@ -270,32 +259,29 @@ static void elsa_cs_config(dev_link_t *link)
     link->conf.ConfigBase = parse.config.base;
     link->conf.Present = parse.config.rmask[0];
 
-    /* Configure card */
-    link->state |= DEV_CONFIG;
-
     tuple.TupleData = (cisdata_t *)buf;
     tuple.TupleOffset = 0; tuple.TupleDataMax = 255;
     tuple.Attributes = 0;
     tuple.DesiredTuple = CISTPL_CFTABLE_ENTRY;
-    i = first_tuple(handle, &tuple, &parse);
+    i = first_tuple(link, &tuple, &parse);
     while (i == CS_SUCCESS) {
         if ( (cf->io.nwin > 0) && cf->io.win[0].base) {
             printk(KERN_INFO "(elsa_cs: looks like the 96 model)\n");
             link->conf.ConfigIndex = cf->index;
             link->io.BasePort1 = cf->io.win[0].base;
-            i = pcmcia_request_io(link->handle, &link->io);
+            i = pcmcia_request_io(link, &link->io);
             if (i == CS_SUCCESS) break;
         } else {
           printk(KERN_INFO "(elsa_cs: looks like the 97 model)\n");
           link->conf.ConfigIndex = cf->index;
           for (i = 0, j = 0x2f0; j > 0x100; j -= 0x10) {
             link->io.BasePort1 = j;
-            i = pcmcia_request_io(link->handle, &link->io);
+            i = pcmcia_request_io(link, &link->io);
             if (i == CS_SUCCESS) break;
           }
           break;
         }
-        i = next_tuple(handle, &tuple, &parse);
+        i = next_tuple(link, &tuple, &parse);
     }
 
     if (i != CS_SUCCESS) {
@@ -303,14 +289,14 @@ static void elsa_cs_config(dev_link_t *link)
         goto cs_failed;
     }
 
-    i = pcmcia_request_irq(link->handle, &link->irq);
+    i = pcmcia_request_irq(link, &link->irq);
     if (i != CS_SUCCESS) {
         link->irq.AssignedIRQ = 0;
         last_fn = RequestIRQ;
         goto cs_failed;
     }
 
-    i = pcmcia_request_configuration(link->handle, &link->conf);
+    i = pcmcia_request_configuration(link, &link->conf);
     if (i != CS_SUCCESS) {
       last_fn = RequestConfiguration;
       goto cs_failed;
@@ -321,14 +307,11 @@ static void elsa_cs_config(dev_link_t *link)
     sprintf(dev->node.dev_name, "elsa");
     dev->node.major = dev->node.minor = 0x0;
 
-    link->dev = &dev->node;
+    link->dev_node = &dev->node;
 
     /* Finally, report what we've done */
-    printk(KERN_INFO "%s: index 0x%02x: Vcc %d.%d",
-           dev->node.dev_name, link->conf.ConfigIndex,
-           link->conf.Vcc/10, link->conf.Vcc%10);
-    if (link->conf.Vpp1)
-        printk(", Vpp %d.%d", link->conf.Vpp1/10, link->conf.Vpp1%10);
+    printk(KERN_INFO "%s: index 0x%02x: ",
+           dev->node.dev_name, link->conf.ConfigIndex);
     if (link->conf.Attributes & CONF_ENABLE_IRQ)
         printk(", irq %d", link->irq.AssignedIRQ);
     if (link->io.NumPorts1)
@@ -339,8 +322,6 @@ static void elsa_cs_config(dev_link_t *link)
                link->io.BasePort2+link->io.NumPorts2-1);
     printk("\n");
 
-    link->state &= ~DEV_CONFIG_PENDING;
-
     icard.para[0] = link->irq.AssignedIRQ;
     icard.para[1] = link->io.BasePort1;
     icard.protocol = protocol;
@@ -354,10 +335,11 @@ static void elsa_cs_config(dev_link_t *link)
     } else
         ((local_info_t*)link->priv)->cardnr = i;
 
-    return;
+    return 0;
 cs_failed:
-    cs_error(link->handle, last_fn, i);
+    cs_error(link, last_fn, i);
     elsa_cs_release(link);
+    return -ENODEV;
 } /* elsa_cs_config */
 
 /*======================================================================
@@ -368,7 +350,7 @@ cs_failed:
 
 ======================================================================*/
 
-static void elsa_cs_release(dev_link_t *link)
+static void elsa_cs_release(struct pcmcia_device *link)
 {
     local_info_t *local = link->priv;
 
@@ -380,39 +362,23 @@ static void elsa_cs_release(dev_link_t *link)
             HiSax_closecard(local->cardnr);
         }
     }
-    /* Unlink the device chain */
-    link->dev = NULL;
-
-    /* Don't bother checking to see if these succeed or not */
-    if (link->win)
-        pcmcia_release_window(link->win);
-    pcmcia_release_configuration(link->handle);
-    pcmcia_release_io(link->handle, &link->io);
-    pcmcia_release_irq(link->handle, &link->irq);
-    link->state &= ~DEV_CONFIG;
+
+    pcmcia_disable_device(link);
 } /* elsa_cs_release */
 
-static int elsa_suspend(struct pcmcia_device *p_dev)
+static int elsa_suspend(struct pcmcia_device *link)
 {
-        dev_link_t *link = dev_to_instance(p_dev);
         local_info_t *dev = link->priv;
 
-        link->state |= DEV_SUSPEND;
         dev->busy = 1;
-        if (link->state & DEV_CONFIG)
-                pcmcia_release_configuration(link->handle);
 
         return 0;
 }
 
-static int elsa_resume(struct pcmcia_device *p_dev)
+static int elsa_resume(struct pcmcia_device *link)
 {
-        dev_link_t *link = dev_to_instance(p_dev);
         local_info_t *dev = link->priv;
 
-        link->state &= ~DEV_SUSPEND;
-        if (link->state & DEV_CONFIG)
-                pcmcia_request_configuration(link->handle, &link->conf);
         dev->busy = 0;
 
         return 0;
@@ -430,7 +396,7 @@ static struct pcmcia_driver elsa_cs_driver = {
         .drv            = {
                 .name   = "elsa_cs",
         },
-        .probe          = elsa_cs_attach,
+        .probe          = elsa_cs_probe,
         .remove         = elsa_cs_detach,
         .id_table       = elsa_ids,
         .suspend        = elsa_suspend,
diff --git a/drivers/isdn/hisax/sedlbauer_cs.c b/drivers/isdn/hisax/sedlbauer_cs.c
index 6f5213a18a8d..9bb18f3f7829 100644
--- a/drivers/isdn/hisax/sedlbauer_cs.c
+++ b/drivers/isdn/hisax/sedlbauer_cs.c
@@ -95,8 +95,8 @@ module_param(protocol, int, 0);
    event handler. 
 */
 
-static void sedlbauer_config(dev_link_t *link);
-static void sedlbauer_release(dev_link_t *link);
+static int sedlbauer_config(struct pcmcia_device *link);
+static void sedlbauer_release(struct pcmcia_device *link);
 
 /*
    The attach() and detach() entry points are used to create and destroy
@@ -119,7 +119,7 @@ static void sedlbauer_detach(struct pcmcia_device *p_dev);
    example, ethernet cards, modems).  In other cases, there may be
    many actual or logical devices (SCSI adapters, memory cards with
    multiple partitions).  The dev_node_t structures need to be kept
-   in a linked list starting at the 'dev' field of a dev_link_t
+   in a linked list starting at the 'dev' field of a struct pcmcia_device
    structure.  We allocate them in the card's private data structure,
    because they generally shouldn't be allocated dynamically.
 
@@ -130,7 +130,7 @@ static void sedlbauer_detach(struct pcmcia_device *p_dev);
 */
    
 typedef struct local_info_t {
-    dev_link_t          link;
+        struct pcmcia_device    *p_dev;
     dev_node_t          node;
     int                 stop;
     int                 cardnr;
@@ -148,11 +148,10 @@ typedef struct local_info_t {
     
 ======================================================================*/
 
-static int sedlbauer_attach(struct pcmcia_device *p_dev)
+static int sedlbauer_probe(struct pcmcia_device *link)
 {
     local_info_t *local;
-    dev_link_t *link;
-    
+
     DEBUG(0, "sedlbauer_attach()\n");
 
     /* Allocate space for private device-specific data */
@@ -160,8 +159,10 @@ static int sedlbauer_attach(struct pcmcia_device *p_dev)
     if (!local) return -ENOMEM;
     memset(local, 0, sizeof(local_info_t));
     local->cardnr = -1;
-    link = &local->link; link->priv = local;
-    
+
+    local->p_dev = link;
+    link->priv = local;
+
     /* Interrupt setup */
     link->irq.Attributes = IRQ_TYPE_EXCLUSIVE;
     link->irq.IRQInfo1 = IRQ_LEVEL_ID;
@@ -182,18 +183,10 @@ static int sedlbauer_attach(struct pcmcia_device *p_dev)
     link->io.Attributes1 = IO_DATA_PATH_WIDTH_8;
     link->io.IOAddrLines = 3;
 
-
     link->conf.Attributes = 0;
-    link->conf.Vcc = 50;
     link->conf.IntType = INT_MEMORY_AND_IO;
 
-    link->handle = p_dev;
-    p_dev->instance = link;
-
-    link->state |= DEV_PRESENT | DEV_CONFIG_PENDING;
-    sedlbauer_config(link);
-
-    return 0;
+    return sedlbauer_config(link);
 } /* sedlbauer_attach */
 
 /*======================================================================
@@ -205,19 +198,15 @@ static int sedlbauer_attach(struct pcmcia_device *p_dev)
 
 ======================================================================*/
 
-static void sedlbauer_detach(struct pcmcia_device *p_dev)
+static void sedlbauer_detach(struct pcmcia_device *link)
 {
-    dev_link_t *link = dev_to_instance(p_dev);
-
-    DEBUG(0, "sedlbauer_detach(0x%p)\n", link);
+        DEBUG(0, "sedlbauer_detach(0x%p)\n", link);
 
-    if (link->state & DEV_CONFIG) {
-            ((local_info_t *)link->priv)->stop = 1;
-            sedlbauer_release(link);
-    }
+        ((local_info_t *)link->priv)->stop = 1;
+        sedlbauer_release(link);
 
-    /* This points to the parent local_info_t struct */
-    kfree(link->priv);
+        /* This points to the parent local_info_t struct */
+        kfree(link->priv);
 } /* sedlbauer_detach */
 
 /*======================================================================
@@ -230,9 +219,8 @@ static void sedlbauer_detach(struct pcmcia_device *p_dev)
 #define CS_CHECK(fn, ret) \
 do { last_fn = (fn); if ((last_ret = (ret)) != 0) goto cs_failed; } while (0)
 
-static void sedlbauer_config(dev_link_t *link)
+static int sedlbauer_config(struct pcmcia_device *link)
 {
-    client_handle_t handle = link->handle;
     local_info_t *dev = link->priv;
     tuple_t tuple;
     cisparse_t parse;
@@ -254,18 +242,13 @@ static void sedlbauer_config(dev_link_t *link)
     tuple.TupleData = buf;
     tuple.TupleDataMax = sizeof(buf);
     tuple.TupleOffset = 0;
-    CS_CHECK(GetFirstTuple, pcmcia_get_first_tuple(handle, &tuple));
-    CS_CHECK(GetTupleData, pcmcia_get_tuple_data(handle, &tuple));
-    CS_CHECK(ParseTuple, pcmcia_parse_tuple(handle, &tuple, &parse));
+    CS_CHECK(GetFirstTuple, pcmcia_get_first_tuple(link, &tuple));
+    CS_CHECK(GetTupleData, pcmcia_get_tuple_data(link, &tuple));
+    CS_CHECK(ParseTuple, pcmcia_parse_tuple(link, &tuple, &parse));
     link->conf.ConfigBase = parse.config.base;
     link->conf.Present = parse.config.rmask[0];
-    
-    /* Configure card */
-    link->state |= DEV_CONFIG;
 
-    /* Look up the current Vcc */
-    CS_CHECK(GetConfigurationInfo, pcmcia_get_configuration_info(handle, &conf));
-    link->conf.Vcc = conf.Vcc;
+    CS_CHECK(GetConfigurationInfo, pcmcia_get_configuration_info(link, &conf));
 
     /*
       In this loop, we scan the CIS for configuration table entries,
@@ -280,12 +263,12 @@ static void sedlbauer_config(dev_link_t *link)
       will only use the CIS to fill in implementation-defined details.
     */
     tuple.DesiredTuple = CISTPL_CFTABLE_ENTRY;
-    CS_CHECK(GetFirstTuple, pcmcia_get_first_tuple(handle, &tuple));
+    CS_CHECK(GetFirstTuple, pcmcia_get_first_tuple(link, &tuple));
     while (1) {
         cistpl_cftable_entry_t dflt = { 0 };
         cistpl_cftable_entry_t *cfg = &(parse.cftable_entry);
-        if (pcmcia_get_tuple_data(handle, &tuple) != 0 ||
-                pcmcia_parse_tuple(handle, &tuple, &parse) != 0)
+        if (pcmcia_get_tuple_data(link, &tuple) != 0 ||
+                pcmcia_parse_tuple(link, &tuple, &parse) != 0)
             goto next_entry;
 
         if (cfg->flags & CISTPL_CFTABLE_DEFAULT) dflt = *cfg;
@@ -309,10 +292,10 @@ static void sedlbauer_config(dev_link_t *link)
         }
             
         if (cfg->vpp1.present & (1<<CISTPL_POWER_VNOM))
-            link->conf.Vpp1 = link->conf.Vpp2 =
+            link->conf.Vpp =
                 cfg->vpp1.param[CISTPL_POWER_VNOM]/10000;
         else if (dflt.vpp1.present & (1<<CISTPL_POWER_VNOM))
-            link->conf.Vpp1 = link->conf.Vpp2 =
+            link->conf.Vpp =
                 dflt.vpp1.param[CISTPL_POWER_VNOM]/10000;
         
         /* Do we need to allocate an interrupt? */
@@ -339,13 +322,13 @@ static void sedlbauer_config(dev_link_t *link)
                 link->io.NumPorts2 = io->win[1].len;
             }
             /* This reserves IO space but doesn't actually enable it */
-            if (pcmcia_request_io(link->handle, &link->io) != 0)
+            if (pcmcia_request_io(link, &link->io) != 0)
                 goto next_entry;
         }
 
         /*
           Now set up a common memory window, if needed.  There is room
-          in the dev_link_t structure for one memory window handle,
+          in the struct pcmcia_device structure for one memory window handle,
           but if the base addresses need to be saved, or if multiple
           windows are needed, the info should go in the private data
           structure for this device.
@@ -366,7 +349,7 @@ static void sedlbauer_config(dev_link_t *link)
                 req.Size = 0x1000;
 */
             req.AccessSpeed = 0;
-            if (pcmcia_request_window(&link->handle, &req, &link->win) != 0)
+            if (pcmcia_request_window(&link, &req, &link->win) != 0)
                 goto next_entry;
             map.Page = 0; map.CardOffset = mem->win[0].card_addr;
             if (pcmcia_map_mem_page(link->win, &map) != 0)
@@ -374,29 +357,25 @@ static void sedlbauer_config(dev_link_t *link)
         }
         /* If we got this far, we're cool! */
         break;
-        
+
     next_entry:
-/* new in dummy.cs 2001/01/28 MN 
-        if (link->io.NumPorts1)
-           pcmcia_release_io(link->handle, &link->io);
-*/
-        CS_CHECK(GetNextTuple, pcmcia_get_next_tuple(handle, &tuple));
+        CS_CHECK(GetNextTuple, pcmcia_get_next_tuple(link, &tuple));
     }
-    
+
     /*
        Allocate an interrupt line.  Note that this does not assign a
        handler to the interrupt, unless the 'Handler' member of the
        irq structure is initialized.
     */
     if (link->conf.Attributes & CONF_ENABLE_IRQ)
-        CS_CHECK(RequestIRQ, pcmcia_request_irq(link->handle, &link->irq));
+        CS_CHECK(RequestIRQ, pcmcia_request_irq(link, &link->irq));
         
     /*
        This actually configures the PCMCIA socket -- setting up
        the I/O windows and the interrupt mapping, and putting the
        card and host interface into "Memory and IO" mode.
     */
-    CS_CHECK(RequestConfiguration, pcmcia_request_configuration(link->handle, &link->conf));
+    CS_CHECK(RequestConfiguration, pcmcia_request_configuration(link, &link->conf));
 
     /*
       At this point, the dev_node_t structure(s) need to be
@@ -404,14 +383,13 @@ static void sedlbauer_config(dev_link_t *link)
     */
     sprintf(dev->node.dev_name, "sedlbauer");
     dev->node.major = dev->node.minor = 0;
-    link->dev = &dev->node;
+    link->dev_node = &dev->node;
 
     /* Finally, report what we've done */
-    printk(KERN_INFO "%s: index 0x%02x: Vcc %d.%d",
-           dev->node.dev_name, link->conf.ConfigIndex,
-           link->conf.Vcc/10, link->conf.Vcc%10);
-    if (link->conf.Vpp1)
-        printk(", Vpp %d.%d", link->conf.Vpp1/10, link->conf.Vpp1%10);
+    printk(KERN_INFO "%s: index 0x%02x:",
+           dev->node.dev_name, link->conf.ConfigIndex);
+    if (link->conf.Vpp)
+        printk(", Vpp %d.%d", link->conf.Vpp/10, link->conf.Vpp%10);
     if (link->conf.Attributes & CONF_ENABLE_IRQ)
         printk(", irq %d", link->irq.AssignedIRQ);
     if (link->io.NumPorts1)
@@ -424,8 +402,6 @@ static void sedlbauer_config(dev_link_t *link)
         printk(", mem 0x%06lx-0x%06lx", req.Base,
                req.Base+req.Size-1);
     printk("\n");
-    
-    link->state &= ~DEV_CONFIG_PENDING;
 
     icard.para[0] = link->irq.AssignedIRQ;
     icard.para[1] = link->io.BasePort1;
@@ -437,14 +413,16 @@ static void sedlbauer_config(dev_link_t *link)
         printk(KERN_ERR "sedlbauer_cs: failed to initialize SEDLBAUER PCMCIA %d at i/o %#x\n",
                 last_ret, link->io.BasePort1);
         sedlbauer_release(link);
+        return -ENODEV;
     } else
         ((local_info_t*)link->priv)->cardnr = last_ret;
 
-    return;
+    return 0;
 
 cs_failed:
-    cs_error(link->handle, last_fn, last_ret);
+    cs_error(link, last_fn, last_ret);
     sedlbauer_release(link);
+    return -ENODEV;
 
 } /* sedlbauer_config */
 
@@ -456,7 +434,7 @@ cs_failed:
     
 ======================================================================*/
 
-static void sedlbauer_release(dev_link_t *link)
+static void sedlbauer_release(struct pcmcia_device *link)
 {
     local_info_t *local = link->priv;
     DEBUG(0, "sedlbauer_release(0x%p)\n", link);
@@ -467,46 +445,23 @@ static void sedlbauer_release(dev_link_t *link)
             HiSax_closecard(local->cardnr);
         }
     }
-    /* Unlink the device chain */
-    link->dev = NULL;
 
-    /*
-      In a normal driver, additional code may be needed to release
-      other kernel data structures associated with this device. 
-    */
-    
-    /* Don't bother checking to see if these succeed or not */
-    if (link->win)
-        pcmcia_release_window(link->win);
-    pcmcia_release_configuration(link->handle);
-    if (link->io.NumPorts1)
-        pcmcia_release_io(link->handle, &link->io);
-    if (link->irq.AssignedIRQ)
-        pcmcia_release_irq(link->handle, &link->irq);
-    link->state &= ~DEV_CONFIG;
+    pcmcia_disable_device(link);
 } /* sedlbauer_release */
 
-static int sedlbauer_suspend(struct pcmcia_device *p_dev)
+static int sedlbauer_suspend(struct pcmcia_device *link)
 {
-        dev_link_t *link = dev_to_instance(p_dev);
         local_info_t *dev = link->priv;
 
-        link->state |= DEV_SUSPEND;
         dev->stop = 1;
-        if (link->state & DEV_CONFIG)
-                pcmcia_release_configuration(link->handle);
 
         return 0;
 }
 
-static int sedlbauer_resume(struct pcmcia_device *p_dev)
+static int sedlbauer_resume(struct pcmcia_device *link)
 {
-        dev_link_t *link = dev_to_instance(p_dev);
         local_info_t *dev = link->priv;
 
-        link->state &= ~DEV_SUSPEND;
-        if (link->state & DEV_CONFIG)
-                pcmcia_request_configuration(link->handle, &link->conf);
         dev->stop = 0;
 
         return 0;
@@ -530,7 +485,7 @@ static struct pcmcia_driver sedlbauer_driver = {
         .drv            = {
                 .name   = "sedlbauer_cs",
         },
-        .probe          = sedlbauer_attach,
+        .probe          = sedlbauer_probe,
         .remove         = sedlbauer_detach,
         .id_table       = sedlbauer_ids,
         .suspend        = sedlbauer_suspend,
diff --git a/drivers/isdn/hisax/teles_cs.c b/drivers/isdn/hisax/teles_cs.c
index 4e5c14c7240e..afcc2aeadb34 100644
--- a/drivers/isdn/hisax/teles_cs.c
+++ b/drivers/isdn/hisax/teles_cs.c
@@ -75,8 +75,8 @@ module_param(protocol, int, 0);
    handler.
 */
 
-static void teles_cs_config(dev_link_t *link);
-static void teles_cs_release(dev_link_t *link);
+static int teles_cs_config(struct pcmcia_device *link);
+static void teles_cs_release(struct pcmcia_device *link);
 
 /*
    The attach() and detach() entry points are used to create and destroy
@@ -89,10 +89,10 @@ static void teles_detach(struct pcmcia_device *p_dev);
 /*
    A linked list of "instances" of the teles_cs device.  Each actual
    PCMCIA card corresponds to one device instance, and is described
-   by one dev_link_t structure (defined in ds.h).
+   by one struct pcmcia_device structure (defined in ds.h).
 
    You may not want to use a linked list for this -- for example, the
-   memory card driver uses an array of dev_link_t pointers, where minor
+   memory card driver uses an array of struct pcmcia_device pointers, where minor
    device numbers are used to derive the corresponding array index.
 */
 
@@ -102,7 +102,7 @@ static void teles_detach(struct pcmcia_device *p_dev);
    example, ethernet cards, modems).  In other cases, there may be
    many actual or logical devices (SCSI adapters, memory cards with
    multiple partitions).  The dev_node_t structures need to be kept
-   in a linked list starting at the 'dev' field of a dev_link_t
+   in a linked list starting at the 'dev' field of a struct pcmcia_device
    structure.  We allocate them in the card's private data structure,
    because they generally shouldn't be allocated dynamically.
    In this case, we also provide a flag to indicate if a device is
@@ -112,7 +112,7 @@ static void teles_detach(struct pcmcia_device *p_dev);
 */
 
 typedef struct local_info_t {
-    dev_link_t          link;
+        struct pcmcia_device    *p_dev;
     dev_node_t          node;
     int                 busy;
     int                 cardnr;
@@ -130,9 +130,8 @@ typedef struct local_info_t {
 
 ======================================================================*/
 
-static int teles_attach(struct pcmcia_device *p_dev)
+static int teles_probe(struct pcmcia_device *link)
 {
-    dev_link_t *link;
     local_info_t *local;
 
     DEBUG(0, "teles_attach()\n");
@@ -142,7 +141,9 @@ static int teles_attach(struct pcmcia_device *p_dev)
     if (!local) return -ENOMEM;
     memset(local, 0, sizeof(local_info_t));
     local->cardnr = -1;
-    link = &local->link; link->priv = local;
+
+    local->p_dev = link;
+    link->priv = local;
 
     /* Interrupt setup */
     link->irq.Attributes = IRQ_TYPE_DYNAMIC_SHARING|IRQ_FIRST_SHARED;
@@ -161,16 +162,9 @@ static int teles_attach(struct pcmcia_device *p_dev)
     link->io.IOAddrLines = 5;
 
     link->conf.Attributes = CONF_ENABLE_IRQ;
-    link->conf.Vcc = 50;
     link->conf.IntType = INT_MEMORY_AND_IO;
 
-    link->handle = p_dev;
-    p_dev->instance = link;
-
-    link->state |= DEV_PRESENT | DEV_CONFIG_PENDING;
-    teles_cs_config(link);
-
-    return 0;
+    return teles_cs_config(link);
 } /* teles_attach */
 
 /*======================================================================
@@ -182,20 +176,16 @@ static int teles_attach(struct pcmcia_device *p_dev)
 
 ======================================================================*/
 
-static void teles_detach(struct pcmcia_device *p_dev)
+static void teles_detach(struct pcmcia_device *link)
 {
-    dev_link_t *link = dev_to_instance(p_dev);
-    local_info_t *info = link->priv;
-
-    DEBUG(0, "teles_detach(0x%p)\n", link);
+        local_info_t *info = link->priv;
 
-    if (link->state & DEV_CONFIG) {
-            info->busy = 1;
-            teles_cs_release(link);
-    }
+        DEBUG(0, "teles_detach(0x%p)\n", link);
 
-    kfree(info);
+        info->busy = 1;
+        teles_cs_release(link);
 
+        kfree(info);
 } /* teles_detach */
 
 /*======================================================================
@@ -205,7 +195,7 @@ static void teles_detach(struct pcmcia_device *p_dev)
     device available to the system.
 
 ======================================================================*/
-static int get_tuple(client_handle_t handle, tuple_t *tuple,
+static int get_tuple(struct pcmcia_device *handle, tuple_t *tuple,
                      cisparse_t *parse)
 {
     int i = pcmcia_get_tuple_data(handle, tuple);
@@ -213,7 +203,7 @@ static int get_tuple(client_handle_t handle, tuple_t *tuple,
     return pcmcia_parse_tuple(handle, tuple, parse);
 }
 
-static int first_tuple(client_handle_t handle, tuple_t *tuple,
+static int first_tuple(struct pcmcia_device *handle, tuple_t *tuple,
                      cisparse_t *parse)
 {
     int i = pcmcia_get_first_tuple(handle, tuple);
@@ -221,7 +211,7 @@ static int first_tuple(client_handle_t handle, tuple_t *tuple,
     return get_tuple(handle, tuple, parse);
 }
 
-static int next_tuple(client_handle_t handle, tuple_t *tuple,
+static int next_tuple(struct pcmcia_device *handle, tuple_t *tuple,
                      cisparse_t *parse)
 {
     int i = pcmcia_get_next_tuple(handle, tuple);
@@ -229,9 +219,8 @@ static int next_tuple(client_handle_t handle, tuple_t *tuple,
     return get_tuple(handle, tuple, parse);
 }
 
-static void teles_cs_config(dev_link_t *link)
+static int teles_cs_config(struct pcmcia_device *link)
 {
-    client_handle_t handle;
     tuple_t tuple;
     cisparse_t parse;
     local_info_t *dev;
@@ -241,7 +230,6 @@ static void teles_cs_config(dev_link_t *link)
     IsdnCard_t icard;
 
     DEBUG(0, "teles_config(0x%p)\n", link);
-    handle = link->handle;
     dev = link->priv;
 
     /*
@@ -253,7 +241,7 @@ static void teles_cs_config(dev_link_t *link)
     tuple.TupleDataMax = 255;
     tuple.TupleOffset = 0;
     tuple.Attributes = 0;
-    i = first_tuple(handle, &tuple, &parse);
+    i = first_tuple(link, &tuple, &parse);
     if (i != CS_SUCCESS) {
         last_fn = ParseTuple;
         goto cs_failed;
@@ -261,32 +249,29 @@ static void teles_cs_config(dev_link_t *link)
     link->conf.ConfigBase = parse.config.base;
     link->conf.Present = parse.config.rmask[0];
 
-    /* Configure card */
-    link->state |= DEV_CONFIG;
-
     tuple.TupleData = (cisdata_t *)buf;
     tuple.TupleOffset = 0; tuple.TupleDataMax = 255;
     tuple.Attributes = 0;
     tuple.DesiredTuple = CISTPL_CFTABLE_ENTRY;
-    i = first_tuple(handle, &tuple, &parse);
+    i = first_tuple(link, &tuple, &parse);
     while (i == CS_SUCCESS) {
         if ( (cf->io.nwin > 0) && cf->io.win[0].base) {
             printk(KERN_INFO "(teles_cs: looks like the 96 model)\n");
             link->conf.ConfigIndex = cf->index;
             link->io.BasePort1 = cf->io.win[0].base;
-            i = pcmcia_request_io(link->handle, &link->io);
+            i = pcmcia_request_io(link, &link->io);
             if (i == CS_SUCCESS) break;
         } else {
           printk(KERN_INFO "(teles_cs: looks like the 97 model)\n");
           link->conf.ConfigIndex = cf->index;
           for (i = 0, j = 0x2f0; j > 0x100; j -= 0x10) {
             link->io.BasePort1 = j;
-            i = pcmcia_request_io(link->handle, &link->io);
+            i = pcmcia_request_io(link, &link->io);
             if (i == CS_SUCCESS) break;
           }
           break;
         }
-        i = next_tuple(handle, &tuple, &parse);
+        i = next_tuple(link, &tuple, &parse);
     }
 
     if (i != CS_SUCCESS) {
@@ -294,14 +279,14 @@ static void teles_cs_config(dev_link_t *link)
         goto cs_failed;
     }
 
-    i = pcmcia_request_irq(link->handle, &link->irq);
+    i = pcmcia_request_irq(link, &link->irq);
     if (i != CS_SUCCESS) {
         link->irq.AssignedIRQ = 0;
         last_fn = RequestIRQ;
         goto cs_failed;
     }
 
-    i = pcmcia_request_configuration(link->handle, &link->conf);
+    i = pcmcia_request_configuration(link, &link->conf);
     if (i != CS_SUCCESS) {
       last_fn = RequestConfiguration;
       goto cs_failed;
@@ -312,14 +297,11 @@ static void teles_cs_config(dev_link_t *link)
     sprintf(dev->node.dev_name, "teles");
     dev->node.major = dev->node.minor = 0x0;
 
-    link->dev = &dev->node;
+    link->dev_node = &dev->node;
 
     /* Finally, report what we've done */
-    printk(KERN_INFO "%s: index 0x%02x: Vcc %d.%d",
-           dev->node.dev_name, link->conf.ConfigIndex,
-           link->conf.Vcc/10, link->conf.Vcc%10);
-    if (link->conf.Vpp1)
-        printk(", Vpp %d.%d", link->conf.Vpp1/10, link->conf.Vpp1%10);
+    printk(KERN_INFO "%s: index 0x%02x:",
+           dev->node.dev_name, link->conf.ConfigIndex);
     if (link->conf.Attributes & CONF_ENABLE_IRQ)
         printk(", irq %d", link->irq.AssignedIRQ);
     if (link->io.NumPorts1)
@@ -330,8 +312,6 @@ static void teles_cs_config(dev_link_t *link)
                link->io.BasePort2+link->io.NumPorts2-1);
     printk("\n");
 
-    link->state &= ~DEV_CONFIG_PENDING;
-
     icard.para[0] = link->irq.AssignedIRQ;
     icard.para[1] = link->io.BasePort1;
     icard.protocol = protocol;
@@ -342,13 +322,16 @@ static void teles_cs_config(dev_link_t *link)
         printk(KERN_ERR "teles_cs: failed to initialize Teles PCMCIA %d at i/o %#x\n",
                 i, link->io.BasePort1);
         teles_cs_release(link);
-    } else
-        ((local_info_t*)link->priv)->cardnr = i;
+        return -ENODEV;
+    }
+
+    ((local_info_t*)link->priv)->cardnr = i;
+    return 0;
 
-    return;
 cs_failed:
-    cs_error(link->handle, last_fn, i);
+    cs_error(link, last_fn, i);
     teles_cs_release(link);
+    return -ENODEV;
 } /* teles_cs_config */
 
 /*======================================================================
@@ -359,7 +342,7 @@ cs_failed:
 
 ======================================================================*/
 
-static void teles_cs_release(dev_link_t *link)
+static void teles_cs_release(struct pcmcia_device *link)
 {
     local_info_t *local = link->priv;
 
@@ -371,39 +354,23 @@ static void teles_cs_release(dev_link_t *link)
             HiSax_closecard(local->cardnr);
         }
     }
-    /* Unlink the device chain */
-    link->dev = NULL;
-
-    /* Don't bother checking to see if these succeed or not */
-    if (link->win)
-        pcmcia_release_window(link->win);
-    pcmcia_release_configuration(link->handle);
-    pcmcia_release_io(link->handle, &link->io);
-    pcmcia_release_irq(link->handle, &link->irq);
-    link->state &= ~DEV_CONFIG;
+
+    pcmcia_disable_device(link);
 } /* teles_cs_release */
 
-static int teles_suspend(struct pcmcia_device *p_dev)
+static int teles_suspend(struct pcmcia_device *link)
 {
-        dev_link_t *link = dev_to_instance(p_dev);
         local_info_t *dev = link->priv;
 
-        link->state |= DEV_SUSPEND;
         dev->busy = 1;
-        if (link->state & DEV_CONFIG)
-                pcmcia_release_configuration(link->handle);
 
         return 0;
 }
 
-static int teles_resume(struct pcmcia_device *p_dev)
+static int teles_resume(struct pcmcia_device *link)
 {
-        dev_link_t *link = dev_to_instance(p_dev);
         local_info_t *dev = link->priv;
 
-        link->state &= ~DEV_SUSPEND;
-        if (link->state & DEV_CONFIG)
-                pcmcia_request_configuration(link->handle, &link->conf);
         dev->busy = 0;
 
         return 0;
@@ -421,7 +388,7 @@ static struct pcmcia_driver teles_cs_driver = {
         .drv            = {
                 .name   = "teles_cs",
         },
-        .probe          = teles_attach,
+        .probe          = teles_probe,
         .remove         = teles_detach,
         .id_table       = teles_ids,
         .suspend        = teles_suspend,
diff --git a/drivers/leds/Kconfig b/drivers/leds/Kconfig
index 2c4f20b7f021..3f5b64794542 100644
--- a/drivers/leds/Kconfig
+++ b/drivers/leds/Kconfig
@@ -14,13 +14,7 @@ config LEDS_CLASS
           This option enables the led sysfs class in /sys/class/leds.  You'll
           need this to do anything useful with LEDs.  If unsure, say N.
 
-config LEDS_TRIGGERS
-        bool "LED Trigger support"
-        depends NEW_LEDS
-        help
-          This option enables trigger support for the leds class.
-          These triggers allow kernel events to drive the LEDs and can
-          be configured via sysfs. If unsure, say Y.
+comment "LED drivers"
 
 config LEDS_CORGI
         tristate "LED Support for the Sharp SL-C7x0 series"
@@ -59,6 +53,23 @@ config LEDS_TOSA
           This option enables support for the LEDs on Sharp Zaurus
           SL-6000 series.
 
+config LEDS_S3C24XX
+        tristate "LED Support for Samsung S3C24XX GPIO LEDs"
+        depends on LEDS_CLASS && ARCH_S3C2410
+        help
+          This option enables support for LEDs connected to GPIO lines
+          on Samsung S3C24XX series CPUs, such as the S3C2410 and S3C2440.
+
+comment "LED Triggers"
+
+config LEDS_TRIGGERS
+        bool "LED Trigger support"
+        depends NEW_LEDS
+        help
+          This option enables trigger support for the leds class.
+          These triggers allow kernel events to drive the LEDs and can
+          be configured via sysfs. If unsure, say Y.
+
 config LEDS_TRIGGER_TIMER
         tristate "LED Timer Trigger"
         depends LEDS_TRIGGERS
@@ -67,7 +78,7 @@ config LEDS_TRIGGER_TIMER
           via sysfs. If unsure, say Y.
 
 config LEDS_TRIGGER_IDE_DISK
-        bool "LED Timer Trigger"
+        bool "LED IDE Disk Trigger"
         depends LEDS_TRIGGERS && BLK_DEV_IDEDISK
         help
           This allows LEDs to be controlled by IDE disk activity.
diff --git a/drivers/leds/Makefile b/drivers/leds/Makefile
index 40699d3cabbf..40f042633bf5 100644
--- a/drivers/leds/Makefile
+++ b/drivers/leds/Makefile
@@ -10,6 +10,7 @@ obj-$(CONFIG_LEDS_LOCOMO)		+= leds-locomo.o
 obj-$(CONFIG_LEDS_SPITZ)                += leds-spitz.o
 obj-$(CONFIG_LEDS_IXP4XX)               += leds-ixp4xx-gpio.o
 obj-$(CONFIG_LEDS_TOSA)                 += leds-tosa.o
+obj-$(CONFIG_LEDS_S3C24XX)              += leds-s3c24xx.o
 
 # LED Triggers
 obj-$(CONFIG_LEDS_TRIGGER_TIMER)        += ledtrig-timer.o
diff --git a/drivers/leds/leds-s3c24xx.c b/drivers/leds/leds-s3c24xx.c
new file mode 100644
index 000000000000..650cf72dc675
--- /dev/null
+++ b/drivers/leds/leds-s3c24xx.c
@@ -0,0 +1,163 @@
+/* drivers/leds/leds-s3c24xx.c
+ *
+ * (c) 2006 Simtec Electronics
+ *      http://armlinux.simtec.co.uk/
+ *      Ben Dooks <ben@simtec.co.uk>
+ *
+ * S3C24XX - LEDs GPIO driver
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+*/
+
+#include <linux/config.h>
+#include <linux/kernel.h>
+#include <linux/init.h>
+#include <linux/platform_device.h>
+#include <linux/leds.h>
+
+#include <asm/arch/hardware.h>
+#include <asm/arch/regs-gpio.h>
+#include <asm/arch/leds-gpio.h>
+
+/* our context */
+
+struct s3c24xx_gpio_led {
+        struct led_classdev              cdev;
+        struct s3c24xx_led_platdata     *pdata;
+};
+
+static inline struct s3c24xx_gpio_led *pdev_to_gpio(struct platform_device *dev)
+{
+        return platform_get_drvdata(dev);
+}
+
+static inline struct s3c24xx_gpio_led *to_gpio(struct led_classdev *led_cdev)
+{
+        return container_of(led_cdev, struct s3c24xx_gpio_led, cdev);
+}
+
+static void s3c24xx_led_set(struct led_classdev *led_cdev,
+                            enum led_brightness value)
+{
+        struct s3c24xx_gpio_led *led = to_gpio(led_cdev);
+        struct s3c24xx_led_platdata *pd = led->pdata;
+
+        /* there will be a sort delay between setting the output and
+         * going from output to input when using tristate. */
+
+        s3c2410_gpio_setpin(pd->gpio, (value ? 1 : 0) ^
+                            (pd->flags & S3C24XX_LEDF_ACTLOW));
+
+        if (pd->flags & S3C24XX_LEDF_TRISTATE)
+                s3c2410_gpio_cfgpin(pd->gpio,
+                                    value ? S3C2410_GPIO_OUTPUT : S3C2410_GPIO_INPUT);
+
+}
+
+static int s3c24xx_led_remove(struct platform_device *dev)
+{
+        struct s3c24xx_gpio_led *led = pdev_to_gpio(dev);
+
+        led_classdev_unregister(&led->cdev);
+        kfree(led);
+
+        return 0;
+}
+
+static int s3c24xx_led_probe(struct platform_device *dev)
+{
+        struct s3c24xx_led_platdata *pdata = dev->dev.platform_data;
+        struct s3c24xx_gpio_led *led;
+        int ret;
+
+        led = kzalloc(sizeof(struct s3c24xx_gpio_led), GFP_KERNEL);
+        if (led == NULL) {
+                dev_err(&dev->dev, "No memory for device\n");
+                return -ENOMEM;
+        }
+
+        platform_set_drvdata(dev, led);
+
+        led->cdev.brightness_set = s3c24xx_led_set;
+        led->cdev.default_trigger = pdata->def_trigger;
+        led->cdev.name = pdata->name;
+
+        led->pdata = pdata;
+
+        /* no point in having a pull-up if we are always driving */
+
+        if (pdata->flags & S3C24XX_LEDF_TRISTATE) {
+                s3c2410_gpio_setpin(pdata->gpio, 0);
+                s3c2410_gpio_cfgpin(pdata->gpio, S3C2410_GPIO_INPUT);
+        } else {
+                s3c2410_gpio_pullup(pdata->gpio, 0);
+                s3c2410_gpio_setpin(pdata->gpio, 0);
+                s3c2410_gpio_cfgpin(pdata->gpio, S3C2410_GPIO_OUTPUT);
+        }
+
+        /* register our new led device */
+
+        ret = led_classdev_register(&dev->dev, &led->cdev);
+        if (ret < 0) {
+                dev_err(&dev->dev, "led_classdev_register failed\n");
+                goto exit_err1;
+        }
+
+        return 0;
+
+ exit_err1:
+        kfree(led);
+        return ret;
+}
+
+
+#ifdef CONFIG_PM
+static int s3c24xx_led_suspend(struct platform_device *dev, pm_message_t state)
+{
+        struct s3c24xx_gpio_led *led = pdev_to_gpio(dev);
+
+        led_classdev_suspend(&led->cdev);
+        return 0;
+}
+
+static int s3c24xx_led_resume(struct platform_device *dev)
+{
+        struct s3c24xx_gpio_led *led = pdev_to_gpio(dev);
+
+        led_classdev_resume(&led->cdev);
+        return 0;
+}
+#else
+#define s3c24xx_led_suspend NULL
+#define s3c24xx_led_resume NULL
+#endif
+
+static struct platform_driver s3c24xx_led_driver = {
+        .probe          = s3c24xx_led_probe,
+        .remove         = s3c24xx_led_remove,
+        .suspend        = s3c24xx_led_suspend,
+        .resume         = s3c24xx_led_resume,
+        .driver         = {
+                .name           = "s3c24xx_led",
+                .owner          = THIS_MODULE,
+        },
+};
+
+static int __init s3c24xx_led_init(void)
+{
+        return platform_driver_register(&s3c24xx_led_driver);
+}
+
+static void __exit s3c24xx_led_exit(void)
+{
+        platform_driver_unregister(&s3c24xx_led_driver);
+}
+
+module_init(s3c24xx_led_init);
+module_exit(s3c24xx_led_exit);
+
+MODULE_AUTHOR("Ben Dooks <ben@simtec.co.uk>");
+MODULE_DESCRIPTION("S3C24XX LED driver");
+MODULE_LICENSE("GPL");
diff --git a/drivers/md/Kconfig b/drivers/md/Kconfig
index fd2aae150ccc..ac25a48362ac 100644
--- a/drivers/md/Kconfig
+++ b/drivers/md/Kconfig
@@ -139,11 +139,12 @@ config MD_RAID5_RESHAPE
           is online.  However it is still EXPERIMENTAL code.  It should
           work, but please be sure that you have backups.
 
-          You will need a version of mdadm newer than 2.3.1.   During the
-          early stage of reshape there is a critical section where live data
-          is being over-written.  A crash during this time needs extra care
-          for recovery.  The newer mdadm takes a copy of the data in the
-          critical section and will restore it, if necessary, after a crash.
+          You will need mdadm verion 2.4.1 or later to use this
+          feature safely.  During the early stage of reshape there is
+          a critical section where live data is being over-written.  A
+          crash during this time needs extra care for recovery.  The
+          newer mdadm takes a copy of the data in the critical section
+          and will restore it, if necessary, after a crash.
 
           The mdadm usage is e.g.
                mdadm --grow /dev/md1 --raid-disks=6
diff --git a/drivers/md/dm-target.c b/drivers/md/dm-target.c
index aecd9e0c2616..64fd8e79ea4c 100644
--- a/drivers/md/dm-target.c
+++ b/drivers/md/dm-target.c
@@ -78,8 +78,7 @@ void dm_put_target_type(struct target_type *t)
         if (--ti->use == 0)
                 module_put(ti->tt.module);
 
-        if (ti->use < 0)
-                BUG();
+        BUG_ON(ti->use < 0);
         up_read(&_lock);
 
         return;
diff --git a/drivers/md/raid1.c b/drivers/md/raid1.c
index 9b374c91db66..6081941de1b3 100644
--- a/drivers/md/raid1.c
+++ b/drivers/md/raid1.c
@@ -1558,8 +1558,7 @@ static int init_resync(conf_t *conf)
         int buffs;
 
         buffs = RESYNC_WINDOW / RESYNC_BLOCK_SIZE;
-        if (conf->r1buf_pool)
-                BUG();
+        BUG_ON(conf->r1buf_pool);
         conf->r1buf_pool = mempool_create(buffs, r1buf_pool_alloc, r1buf_pool_free,
                                           conf->poolinfo);
         if (!conf->r1buf_pool)
@@ -1732,8 +1731,7 @@ static sector_t sync_request(mddev_t *mddev, sector_t sector_nr, int *skipped, i
                             !conf->fullsync &&
                             !test_bit(MD_RECOVERY_REQUESTED, &mddev->recovery))
                                 break;
-                        if (sync_blocks < (PAGE_SIZE>>9))
-                                BUG();
+                        BUG_ON(sync_blocks < (PAGE_SIZE>>9));
                         if (len > (sync_blocks<<9))
                                 len = sync_blocks<<9;
                 }
diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c
index ab90a6d12020..617012bc107a 100644
--- a/drivers/md/raid10.c
+++ b/drivers/md/raid10.c
@@ -1117,8 +1117,7 @@ static int end_sync_read(struct bio *bio, unsigned int bytes_done, int error)
         for (i=0; i<conf->copies; i++)
                 if (r10_bio->devs[i].bio == bio)
                         break;
-        if (i == conf->copies)
-                BUG();
+        BUG_ON(i == conf->copies);
         update_head_pos(i, r10_bio);
         d = r10_bio->devs[i].devnum;
 
@@ -1518,8 +1517,7 @@ static int init_resync(conf_t *conf)
         int buffs;
 
         buffs = RESYNC_WINDOW / RESYNC_BLOCK_SIZE;
-        if (conf->r10buf_pool)
-                BUG();
+        BUG_ON(conf->r10buf_pool);
         conf->r10buf_pool = mempool_create(buffs, r10buf_pool_alloc, r10buf_pool_free, conf);
         if (!conf->r10buf_pool)
                 return -ENOMEM;
diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c
index dae740adaf65..31843604049c 100644
--- a/drivers/md/raid5.c
+++ b/drivers/md/raid5.c
@@ -73,10 +73,8 @@ static void print_raid5_conf (raid5_conf_t *conf);
 static void __release_stripe(raid5_conf_t *conf, struct stripe_head *sh)
 {
         if (atomic_dec_and_test(&sh->count)) {
-                if (!list_empty(&sh->lru))
-                        BUG();
-                if (atomic_read(&conf->active_stripes)==0)
-                        BUG();
+                BUG_ON(!list_empty(&sh->lru));
+                BUG_ON(atomic_read(&conf->active_stripes)==0);
                 if (test_bit(STRIPE_HANDLE, &sh->state)) {
                         if (test_bit(STRIPE_DELAYED, &sh->state))
                                 list_add_tail(&sh->lru, &conf->delayed_list);
@@ -184,10 +182,8 @@ static void init_stripe(struct stripe_head *sh, sector_t sector, int pd_idx, int
         raid5_conf_t *conf = sh->raid_conf;
         int i;
 
-        if (atomic_read(&sh->count) != 0)
-                BUG();
-        if (test_bit(STRIPE_HANDLE, &sh->state))
-                BUG();
+        BUG_ON(atomic_read(&sh->count) != 0);
+        BUG_ON(test_bit(STRIPE_HANDLE, &sh->state));
         
         CHECK_DEVLOCK();
         PRINTK("init_stripe called, stripe %llu\n", 
@@ -269,8 +265,7 @@ static struct stripe_head *get_active_stripe(raid5_conf_t *conf, sector_t sector
                                 init_stripe(sh, sector, pd_idx, disks);
                 } else {
                         if (atomic_read(&sh->count)) {
-                                if (!list_empty(&sh->lru))
-                                        BUG();
+                          BUG_ON(!list_empty(&sh->lru));
                         } else {
                                 if (!test_bit(STRIPE_HANDLE, &sh->state))
                                         atomic_inc(&conf->active_stripes);
@@ -465,8 +460,7 @@ static int drop_one_stripe(raid5_conf_t *conf)
         spin_unlock_irq(&conf->device_lock);
         if (!sh)
                 return 0;
-        if (atomic_read(&sh->count))
-                BUG();
+        BUG_ON(atomic_read(&sh->count));
         shrink_buffers(sh, conf->pool_size);
         kmem_cache_free(conf->slab_cache, sh);
         atomic_dec(&conf->active_stripes);
@@ -882,8 +876,7 @@ static void compute_parity(struct stripe_head *sh, int method)
         ptr[0] = page_address(sh->dev[pd_idx].page);
         switch(method) {
         case READ_MODIFY_WRITE:
-                if (!test_bit(R5_UPTODATE, &sh->dev[pd_idx].flags))
-                        BUG();
+                BUG_ON(!test_bit(R5_UPTODATE, &sh->dev[pd_idx].flags));
                 for (i=disks ; i-- ;) {
                         if (i==pd_idx)
                                 continue;
@@ -896,7 +889,7 @@ static void compute_parity(struct stripe_head *sh, int method)
                                 if (test_and_clear_bit(R5_Overlap, &sh->dev[i].flags))
                                         wake_up(&conf->wait_for_overlap);
 
-                                if (sh->dev[i].written) BUG();
+                                BUG_ON(sh->dev[i].written);
                                 sh->dev[i].written = chosen;
                                 check_xor();
                         }
@@ -912,7 +905,7 @@ static void compute_parity(struct stripe_head *sh, int method)
                                 if (test_and_clear_bit(R5_Overlap, &sh->dev[i].flags))
                                         wake_up(&conf->wait_for_overlap);
 
-                                if (sh->dev[i].written) BUG();
+                                BUG_ON(sh->dev[i].written);
                                 sh->dev[i].written = chosen;
                         }
                 break;
@@ -995,8 +988,7 @@ static int add_stripe_bio(struct stripe_head *sh, struct bio *bi, int dd_idx, in
         if (*bip && (*bip)->bi_sector < bi->bi_sector + ((bi->bi_size)>>9))
                 goto overlap;
 
-        if (*bip && bi->bi_next && (*bip) != bi->bi_next)
-                BUG();
+        BUG_ON(*bip && bi->bi_next && (*bip) != bi->bi_next);
         if (*bip)
                 bi->bi_next = *bip;
         *bip = bi;
@@ -1430,8 +1422,7 @@ static void handle_stripe(struct stripe_head *sh)
                 set_bit(STRIPE_HANDLE, &sh->state);
                 if (failed == 0) {
                         char *pagea;
-                        if (uptodate != disks)
-                                BUG();
+                        BUG_ON(uptodate != disks);
                         compute_parity(sh, CHECK_PARITY);
                         uptodate--;
                         pagea = page_address(sh->dev[sh->pd_idx].page);
@@ -2096,8 +2087,7 @@ static void raid5d (mddev_t *mddev)
 
                 list_del_init(first);
                 atomic_inc(&sh->count);
-                if (atomic_read(&sh->count)!= 1)
-                        BUG();
+                BUG_ON(atomic_read(&sh->count)!= 1);
                 spin_unlock_irq(&conf->device_lock);
                 
                 handled++;
diff --git a/drivers/md/raid6main.c b/drivers/md/raid6main.c
index ab64b37e4996..bc69355e0100 100644
--- a/drivers/md/raid6main.c
+++ b/drivers/md/raid6main.c
@@ -91,10 +91,8 @@ static void print_raid6_conf (raid6_conf_t *conf);
 static void __release_stripe(raid6_conf_t *conf, struct stripe_head *sh)
 {
         if (atomic_dec_and_test(&sh->count)) {
-                if (!list_empty(&sh->lru))
-                        BUG();
-                if (atomic_read(&conf->active_stripes)==0)
-                        BUG();
+                BUG_ON(!list_empty(&sh->lru));
+                BUG_ON(atomic_read(&conf->active_stripes)==0);
                 if (test_bit(STRIPE_HANDLE, &sh->state)) {
                         if (test_bit(STRIPE_DELAYED, &sh->state))
                                 list_add_tail(&sh->lru, &conf->delayed_list);
@@ -202,10 +200,8 @@ static void init_stripe(struct stripe_head *sh, sector_t sector, int pd_idx)
         raid6_conf_t *conf = sh->raid_conf;
         int disks = conf->raid_disks, i;
 
-        if (atomic_read(&sh->count) != 0)
-                BUG();
-        if (test_bit(STRIPE_HANDLE, &sh->state))
-                BUG();
+        BUG_ON(atomic_read(&sh->count) != 0);
+        BUG_ON(test_bit(STRIPE_HANDLE, &sh->state));
 
         CHECK_DEVLOCK();
         PRINTK("init_stripe called, stripe %llu\n",
@@ -284,13 +280,11 @@ static struct stripe_head *get_active_stripe(raid6_conf_t *conf, sector_t sector
                                 init_stripe(sh, sector, pd_idx);
                 } else {
                         if (atomic_read(&sh->count)) {
-                                if (!list_empty(&sh->lru))
-                                        BUG();
+                                BUG_ON(!list_empty(&sh->lru));
                         } else {
                                 if (!test_bit(STRIPE_HANDLE, &sh->state))
                                         atomic_inc(&conf->active_stripes);
-                                if (list_empty(&sh->lru))
-                                        BUG();
+                                BUG_ON(list_empty(&sh->lru));
                                 list_del_init(&sh->lru);
                         }
                 }
@@ -353,8 +347,7 @@ static int drop_one_stripe(raid6_conf_t *conf)
         spin_unlock_irq(&conf->device_lock);
         if (!sh)
                 return 0;
-        if (atomic_read(&sh->count))
-                BUG();
+        BUG_ON(atomic_read(&sh->count));
         shrink_buffers(sh, conf->raid_disks);
         kmem_cache_free(conf->slab_cache, sh);
         atomic_dec(&conf->active_stripes);
@@ -780,7 +773,7 @@ static void compute_parity(struct stripe_head *sh, int method)
                                 if (test_and_clear_bit(R5_Overlap, &sh->dev[i].flags))
                                         wake_up(&conf->wait_for_overlap);
 
-                                if (sh->dev[i].written) BUG();
+                                BUG_ON(sh->dev[i].written);
                                 sh->dev[i].written = chosen;
                         }
                 break;
@@ -970,8 +963,7 @@ static int add_stripe_bio(struct stripe_head *sh, struct bio *bi, int dd_idx, in
         if (*bip && (*bip)->bi_sector < bi->bi_sector + ((bi->bi_size)>>9))
                 goto overlap;
 
-        if (*bip && bi->bi_next && (*bip) != bi->bi_next)
-                BUG();
+        BUG_ON(*bip && bi->bi_next && (*bip) != bi->bi_next);
         if (*bip)
                 bi->bi_next = *bip;
         *bip = bi;
@@ -1906,8 +1898,7 @@ static void raid6d (mddev_t *mddev)
 
                 list_del_init(first);
                 atomic_inc(&sh->count);
-                if (atomic_read(&sh->count)!= 1)
-                        BUG();
+                BUG_ON(atomic_read(&sh->count)!= 1);
                 spin_unlock_irq(&conf->device_lock);
 
                 handled++;
diff --git a/drivers/media/Kconfig b/drivers/media/Kconfig
index baa9f58beffc..fffc711c260c 100644
--- a/drivers/media/Kconfig
+++ b/drivers/media/Kconfig
@@ -51,18 +51,18 @@ config VIDEO_TVEEPROM
         tristate
 
 config USB_DABUSB
-        tristate "DABUSB driver"
-        depends on USB
-        ---help---
-          A Digital Audio Broadcasting (DAB) Receiver for USB and Linux
-          brought to you by the DAB-Team
-          <http://wwwbode.cs.tum.edu/Par/arch/dab/>.  This driver can be taken
-          as an example for URB-based bulk, control, and isochronous
-          transactions. URB's are explained in
-          <Documentation/usb/URB.txt>.
-
-          To compile this driver as a module, choose M here: the
-          module will be called dabusb.
+        tristate "DABUSB driver"
+        depends on USB
+        ---help---
+          A Digital Audio Broadcasting (DAB) Receiver for USB and Linux
+          brought to you by the DAB-Team
+          <http://wwwbode.cs.tum.edu/Par/arch/dab/>.  This driver can be taken
+          as an example for URB-based bulk, control, and isochronous
+          transactions. URB's are explained in
+          <Documentation/usb/URB.txt>.
+
+          To compile this driver as a module, choose M here: the
+          module will be called dabusb.
 
 endmenu
 
diff --git a/drivers/media/dvb/bt8xx/Kconfig b/drivers/media/dvb/bt8xx/Kconfig
index 2337b41714e0..376ca48f1d1d 100644
--- a/drivers/media/dvb/bt8xx/Kconfig
+++ b/drivers/media/dvb/bt8xx/Kconfig
@@ -7,6 +7,7 @@ config DVB_BT8XX
         select DVB_CX24110
         select DVB_OR51211
         select DVB_LGDT330X
+        select FW_LOADER
         help
           Support for PCI cards based on the Bt8xx PCI bridge. Examples are
           the Nebula cards, the Pinnacle PCTV cards, the Twinhan DST cards,
diff --git a/drivers/media/dvb/dvb-core/dmxdev.c b/drivers/media/dvb/dvb-core/dmxdev.c
index 09e96e9ddbdf..04578df3f249 100644
--- a/drivers/media/dvb/dvb-core/dmxdev.c
+++ b/drivers/media/dvb/dvb-core/dmxdev.c
@@ -141,12 +141,18 @@ static int dvb_dvr_open(struct inode *inode, struct file *file)
         }
 
         if ((file->f_flags & O_ACCMODE) == O_RDONLY) {
-                void *mem = vmalloc(DVR_BUFFER_SIZE);
+                void *mem;
+                if (!dvbdev->readers) {
+                        mutex_unlock(&dmxdev->mutex);
+                        return -EBUSY;
+                }
+                mem = vmalloc(DVR_BUFFER_SIZE);
                 if (!mem) {
                         mutex_unlock(&dmxdev->mutex);
                         return -ENOMEM;
                 }
                 dvb_ringbuffer_init(&dmxdev->dvr_buffer, mem, DVR_BUFFER_SIZE);
+                dvbdev->readers--;
         }
 
         if ((file->f_flags & O_ACCMODE) == O_WRONLY) {
@@ -184,6 +190,7 @@ static int dvb_dvr_release(struct inode *inode, struct file *file)
                                                 dmxdev->dvr_orig_fe);
         }
         if ((file->f_flags & O_ACCMODE) == O_RDONLY) {
+                dvbdev->readers++;
                 if (dmxdev->dvr_buffer.data) {
                         void *mem = dmxdev->dvr_buffer.data;
                         mb();
@@ -1029,8 +1036,7 @@ static struct file_operations dvb_dvr_fops = {
 
 static struct dvb_device dvbdev_dvr = {
         .priv = NULL,
-        .users = 1,
-        .writers = 1,
+        .readers = 1,
         .fops = &dvb_dvr_fops
 };
 
diff --git a/drivers/media/dvb/dvb-core/dvb_frontend.c b/drivers/media/dvb/dvb-core/dvb_frontend.c
index 2c3ea8f95dcd..4f8f257e6795 100644
--- a/drivers/media/dvb/dvb-core/dvb_frontend.c
+++ b/drivers/media/dvb/dvb-core/dvb_frontend.c
@@ -105,6 +105,7 @@ struct dvb_frontend_private {
         fe_status_t status;
         unsigned long tune_mode_flags;
         unsigned int delay;
+        unsigned int reinitialise;
 
         /* swzigzag values */
         unsigned int state;
@@ -121,6 +122,7 @@ struct dvb_frontend_private {
         unsigned int check_wrapped;
 };
 
+static void dvb_frontend_wakeup(struct dvb_frontend *fe);
 
 static void dvb_frontend_add_event(struct dvb_frontend *fe, fe_status_t status)
 {
@@ -213,6 +215,15 @@ static void dvb_frontend_init(struct dvb_frontend *fe)
                 fe->ops->init(fe);
 }
 
+void dvb_frontend_reinitialise(struct dvb_frontend *fe)
+{
+        struct dvb_frontend_private *fepriv = fe->frontend_priv;
+
+        fepriv->reinitialise = 1;
+        dvb_frontend_wakeup(fe);
+}
+EXPORT_SYMBOL(dvb_frontend_reinitialise);
+
 static void dvb_frontend_swzigzag_update_delay(struct dvb_frontend_private *fepriv, int locked)
 {
         int q2;
@@ -505,8 +516,8 @@ static int dvb_frontend_thread(void *data)
         fepriv->quality = 0;
         fepriv->delay = 3*HZ;
         fepriv->status = 0;
-        dvb_frontend_init(fe);
         fepriv->wakeup = 0;
+        fepriv->reinitialise = 1;
 
         while (1) {
                 up(&fepriv->sem);           /* is locked when we enter the thread... */
@@ -524,6 +535,11 @@ static int dvb_frontend_thread(void *data)
                 if (down_interruptible(&fepriv->sem))
                         break;
 
+                if (fepriv->reinitialise) {
+                        dvb_frontend_init(fe);
+                        fepriv->reinitialise = 0;
+                }
+
                 /* do an iteration of the tuning loop */
                 if (fe->ops->tune) {
                         /* have we been asked to retune? */
diff --git a/drivers/media/dvb/dvb-core/dvb_frontend.h b/drivers/media/dvb/dvb-core/dvb_frontend.h
index d5aee5ad67a0..5926a3b745c9 100644
--- a/drivers/media/dvb/dvb-core/dvb_frontend.h
+++ b/drivers/media/dvb/dvb-core/dvb_frontend.h
@@ -112,6 +112,8 @@ extern int dvb_register_frontend(struct dvb_adapter* dvb,
 
 extern int dvb_unregister_frontend(struct dvb_frontend* fe);
 
+extern void dvb_frontend_reinitialise(struct dvb_frontend *fe);
+
 extern void dvb_frontend_sleep_until(struct timeval *waketime, u32 add_usec);
 extern s32 timeval_usec_diff(struct timeval lasttime, struct timeval curtime);
 
diff --git a/drivers/media/dvb/dvb-usb/cxusb.c b/drivers/media/dvb/dvb-usb/cxusb.c
index a14e737ec848..7edd6362b9cc 100644
--- a/drivers/media/dvb/dvb-usb/cxusb.c
+++ b/drivers/media/dvb/dvb-usb/cxusb.c
@@ -233,6 +233,45 @@ static struct dvb_usb_rc_key dvico_mce_rc_keys[] = {
         { 0xfe, 0x4e, KEY_POWER },
 };
 
+static struct dvb_usb_rc_key dvico_portable_rc_keys[] = {
+        { 0xfc, 0x02, KEY_SETUP },       /* Profile */
+        { 0xfc, 0x43, KEY_POWER2 },
+        { 0xfc, 0x06, KEY_EPG },
+        { 0xfc, 0x5a, KEY_BACK },
+        { 0xfc, 0x05, KEY_MENU },
+        { 0xfc, 0x47, KEY_INFO },
+        { 0xfc, 0x01, KEY_TAB },
+        { 0xfc, 0x42, KEY_PREVIOUSSONG },/* Replay */
+        { 0xfc, 0x49, KEY_VOLUMEUP },
+        { 0xfc, 0x09, KEY_VOLUMEDOWN },
+        { 0xfc, 0x54, KEY_CHANNELUP },
+        { 0xfc, 0x0b, KEY_CHANNELDOWN },
+        { 0xfc, 0x16, KEY_CAMERA },
+        { 0xfc, 0x40, KEY_TUNER },      /* ATV/DTV */
+        { 0xfc, 0x45, KEY_OPEN },
+        { 0xfc, 0x19, KEY_1 },
+        { 0xfc, 0x18, KEY_2 },
+        { 0xfc, 0x1b, KEY_3 },
+        { 0xfc, 0x1a, KEY_4 },
+        { 0xfc, 0x58, KEY_5 },
+        { 0xfc, 0x59, KEY_6 },
+        { 0xfc, 0x15, KEY_7 },
+        { 0xfc, 0x14, KEY_8 },
+        { 0xfc, 0x17, KEY_9 },
+        { 0xfc, 0x44, KEY_ANGLE },      /* Aspect */
+        { 0xfc, 0x55, KEY_0 },
+        { 0xfc, 0x07, KEY_ZOOM },
+        { 0xfc, 0x0a, KEY_REWIND },
+        { 0xfc, 0x08, KEY_PLAYPAUSE },
+        { 0xfc, 0x4b, KEY_FASTFORWARD },
+        { 0xfc, 0x5b, KEY_MUTE },
+        { 0xfc, 0x04, KEY_STOP },
+        { 0xfc, 0x56, KEY_RECORD },
+        { 0xfc, 0x57, KEY_POWER },
+        { 0xfc, 0x41, KEY_UNKNOWN },    /* INPUT */
+        { 0xfc, 0x00, KEY_UNKNOWN },    /* HD */
+};
+
 static int cxusb_dee1601_demod_init(struct dvb_frontend* fe)
 {
         static u8 clock_config []  = { CLOCK_CTL,  0x38, 0x28 };
@@ -511,6 +550,11 @@ static struct dvb_usb_properties cxusb_bluebird_lgh064f_properties = {
 
         .i2c_algo         = &cxusb_i2c_algo,
 
+        .rc_interval      = 100,
+        .rc_key_map       = dvico_portable_rc_keys,
+        .rc_key_map_size  = ARRAY_SIZE(dvico_portable_rc_keys),
+        .rc_query         = cxusb_rc_query,
+
         .generic_bulk_ctrl_endpoint = 0x01,
         /* parameter for the MPEG2-data transfer */
         .urb = {
@@ -600,6 +644,11 @@ static struct dvb_usb_properties cxusb_bluebird_lgz201_properties = {
 
         .i2c_algo         = &cxusb_i2c_algo,
 
+        .rc_interval      = 100,
+        .rc_key_map       = dvico_portable_rc_keys,
+        .rc_key_map_size  = ARRAY_SIZE(dvico_portable_rc_keys),
+        .rc_query         = cxusb_rc_query,
+
         .generic_bulk_ctrl_endpoint = 0x01,
         /* parameter for the MPEG2-data transfer */
         .urb = {
@@ -640,6 +689,11 @@ static struct dvb_usb_properties cxusb_bluebird_dtt7579_properties = {
 
         .i2c_algo         = &cxusb_i2c_algo,
 
+        .rc_interval      = 100,
+        .rc_key_map       = dvico_portable_rc_keys,
+        .rc_key_map_size  = ARRAY_SIZE(dvico_portable_rc_keys),
+        .rc_query         = cxusb_rc_query,
+
         .generic_bulk_ctrl_endpoint = 0x01,
         /* parameter for the MPEG2-data transfer */
         .urb = {
diff --git a/drivers/media/dvb/dvb-usb/dtt200u.c b/drivers/media/dvb/dvb-usb/dtt200u.c
index 12ebaf8bddca..70afcfd141ca 100644
--- a/drivers/media/dvb/dvb-usb/dtt200u.c
+++ b/drivers/media/dvb/dvb-usb/dtt200u.c
@@ -94,12 +94,14 @@ static int dtt200u_frontend_attach(struct dvb_usb_device *d)
 
 static struct dvb_usb_properties dtt200u_properties;
 static struct dvb_usb_properties wt220u_properties;
+static struct dvb_usb_properties wt220u_zl0353_properties;
 
 static int dtt200u_usb_probe(struct usb_interface *intf,
                 const struct usb_device_id *id)
 {
         if (dvb_usb_device_init(intf,&dtt200u_properties,THIS_MODULE,NULL) == 0 ||
-                dvb_usb_device_init(intf,&wt220u_properties,THIS_MODULE,NULL) == 0)
+                dvb_usb_device_init(intf,&wt220u_properties,THIS_MODULE,NULL) == 0 ||
+                dvb_usb_device_init(intf,&wt220u_zl0353_properties,THIS_MODULE,NULL) == 0)
                 return 0;
 
         return -ENODEV;
@@ -110,6 +112,8 @@ static struct usb_device_id dtt200u_usb_table [] = {
         { USB_DEVICE(USB_VID_WIDEVIEW, USB_PID_DTT200U_WARM) },
         { USB_DEVICE(USB_VID_WIDEVIEW, USB_PID_WT220U_COLD)  },
         { USB_DEVICE(USB_VID_WIDEVIEW, USB_PID_WT220U_WARM)  },
+        { USB_DEVICE(USB_VID_WIDEVIEW, USB_PID_WT220U_ZL0353_COLD)  },
+        { USB_DEVICE(USB_VID_WIDEVIEW, USB_PID_WT220U_ZL0353_WARM)  },
         { 0 },
 };
 MODULE_DEVICE_TABLE(usb, dtt200u_usb_table);
@@ -196,6 +200,47 @@ static struct dvb_usb_properties wt220u_properties = {
         }
 };
 
+static struct dvb_usb_properties wt220u_zl0353_properties = {
+        .caps = DVB_USB_HAS_PID_FILTER | DVB_USB_NEED_PID_FILTERING,
+        .pid_filter_count = 15,
+
+        .usb_ctrl = CYPRESS_FX2,
+        .firmware = "dvb-usb-wt220u-zl0353-01.fw",
+
+        .power_ctrl      = dtt200u_power_ctrl,
+        .streaming_ctrl  = dtt200u_streaming_ctrl,
+        .pid_filter      = dtt200u_pid_filter,
+        .frontend_attach = dtt200u_frontend_attach,
+
+        .rc_interval     = 300,
+        .rc_key_map      = dtt200u_rc_keys,
+        .rc_key_map_size = ARRAY_SIZE(dtt200u_rc_keys),
+        .rc_query        = dtt200u_rc_query,
+
+        .generic_bulk_ctrl_endpoint = 0x01,
+
+        /* parameter for the MPEG2-data transfer */
+        .urb = {
+                .type = DVB_USB_BULK,
+                .count = 7,
+                .endpoint = 0x02,
+                .u = {
+                        .bulk = {
+                                .buffersize = 4096,
+                        }
+                }
+        },
+
+        .num_device_descs = 1,
+        .devices = {
+                { .name = "WideView WT-220U PenType Receiver (based on ZL353)",
+                  .cold_ids = { &dtt200u_usb_table[4], NULL },
+                  .warm_ids = { &dtt200u_usb_table[5], NULL },
+                },
+                { NULL },
+        }
+};
+
 /* usb specific object needed to register this driver with the usb subsystem */
 static struct usb_driver dtt200u_usb_driver = {
         .name           = "dvb_usb_dtt200u",
diff --git a/drivers/media/dvb/dvb-usb/dvb-usb-ids.h b/drivers/media/dvb/dvb-usb/dvb-usb-ids.h
index 4a1b9e77e339..cb239049b098 100644
--- a/drivers/media/dvb/dvb-usb/dvb-usb-ids.h
+++ b/drivers/media/dvb/dvb-usb/dvb-usb-ids.h
@@ -83,6 +83,8 @@
 #define USB_PID_DTT200U_WARM                            0x0301
 #define USB_PID_WT220U_COLD                                     0x0222
 #define USB_PID_WT220U_WARM                                     0x0221
+#define USB_PID_WT220U_ZL0353_COLD                      0x022a
+#define USB_PID_WT220U_ZL0353_WARM                      0x022b
 #define USB_PID_WINTV_NOVA_T_USB2_COLD          0x9300
 #define USB_PID_WINTV_NOVA_T_USB2_WARM          0x9301
 #define USB_PID_NEBULA_DIGITV                           0x0201
diff --git a/drivers/media/dvb/dvb-usb/vp702x-fe.c b/drivers/media/dvb/dvb-usb/vp702x-fe.c
index b6d95e1c9c52..2a89f8c5da99 100644
--- a/drivers/media/dvb/dvb-usb/vp702x-fe.c
+++ b/drivers/media/dvb/dvb-usb/vp702x-fe.c
@@ -147,8 +147,9 @@ static int vp702x_fe_set_frontend(struct dvb_frontend* fe,
         cmd[4] = (sr >> 4)  & 0xff;
         cmd[5] = (sr << 4)  & 0xf0;
 
-        deb_fe("setting frontend to: %u -> %u (%x) LNB-based GHz, symbolrate: %d -> %Lu (%Lx)\n",
-                        fep->frequency,freq,freq, fep->u.qpsk.symbol_rate, sr, sr);
+        deb_fe("setting frontend to: %u -> %u (%x) LNB-based GHz, symbolrate: %d -> %lu (%lx)\n",
+                        fep->frequency,freq,freq, fep->u.qpsk.symbol_rate,
+                        (unsigned long) sr, (unsigned long) sr);
 
 /*      if (fep->inversion == INVERSION_ON)
                 cmd[6] |= 0x80; */
diff --git a/drivers/media/dvb/frontends/Kconfig b/drivers/media/dvb/frontends/Kconfig
index 94233168d241..37d5e0af1683 100644
--- a/drivers/media/dvb/frontends/Kconfig
+++ b/drivers/media/dvb/frontends/Kconfig
@@ -181,6 +181,11 @@ config DVB_OR51211
         help
           An ATSC 8VSB tuner module. Say Y when you want to support this frontend.
 
+          This driver needs external firmware. Please use the command
+          "<kerneldir>/Documentation/dvb/get_dvb_firmware or51211" to
+          download it, and then copy it to /usr/lib/hotplug/firmware
+          or /lib/firmware (depending on configuration of firmware hotplug).
+
 config DVB_OR51132
         tristate "Oren OR51132 based"
         depends on DVB_CORE
@@ -189,6 +194,13 @@ config DVB_OR51132
           An ATSC 8VSB and QAM64/256 tuner module. Say Y when you want
           to support this frontend.
 
+          This driver needs external firmware. Please use the commands
+          "<kerneldir>/Documentation/dvb/get_dvb_firmware or51132_vsb" and/or
+          "<kerneldir>/Documentation/dvb/get_dvb_firmware or51132_qam" to
+          download firmwares for 8VSB and QAM64/256, respectively. Copy them to
+          /usr/lib/hotplug/firmware or /lib/firmware (depending on
+          configuration of firmware hotplug).
+
 config DVB_BCM3510
         tristate "Broadcom BCM3510"
         depends on DVB_CORE
diff --git a/drivers/media/dvb/frontends/tda1004x.c b/drivers/media/dvb/frontends/tda1004x.c
index 8e8df7b4ca0e..b83dafa4e12c 100644
--- a/drivers/media/dvb/frontends/tda1004x.c
+++ b/drivers/media/dvb/frontends/tda1004x.c
@@ -52,7 +52,6 @@ struct tda1004x_state {
         struct dvb_frontend frontend;
 
         /* private demod data */
-        u8 initialised;
         enum tda1004x_demod demod_type;
 };
 
@@ -594,9 +593,6 @@ static int tda10045_init(struct dvb_frontend* fe)
 
         dprintk("%s\n", __FUNCTION__);
 
-        if (state->initialised)
-                return 0;
-
         if (tda10045_fwupload(fe)) {
                 printk("tda1004x: firmware upload failed\n");
                 return -EIO;
@@ -626,7 +622,6 @@ static int tda10045_init(struct dvb_frontend* fe)
 
         tda1004x_write_mask(state, 0x1f, 0x01, state->config->invert_oclk);
 
-        state->initialised = 1;
         return 0;
 }
 
@@ -635,9 +630,6 @@ static int tda10046_init(struct dvb_frontend* fe)
         struct tda1004x_state* state = fe->demodulator_priv;
         dprintk("%s\n", __FUNCTION__);
 
-        if (state->initialised)
-                return 0;
-
         if (tda10046_fwupload(fe)) {
                 printk("tda1004x: firmware upload failed\n");
                         return -EIO;
@@ -697,7 +689,6 @@ static int tda10046_init(struct dvb_frontend* fe)
         // tda1004x_write_mask(state, 0x50, 0x80, 0x80);         // handle out of guard echoes
         tda1004x_write_mask(state, 0x3a, 0x80, state->config->invert_oclk << 7);
 
-        state->initialised = 1;
         return 0;
 }
 
@@ -1207,7 +1198,6 @@ static int tda1004x_sleep(struct dvb_frontend* fe)
                 tda1004x_write_mask(state, TDA1004X_CONFC4, 1, 1);
                 break;
         }
-        state->initialised = 0;
 
         return 0;
 }
@@ -1271,7 +1261,6 @@ struct dvb_frontend* tda10045_attach(const struct tda1004x_config* config,
         state->config = config;
         state->i2c = i2c;
         memcpy(&state->ops, &tda10045_ops, sizeof(struct dvb_frontend_ops));
-        state->initialised = 0;
         state->demod_type = TDA1004X_DEMOD_TDA10045;
 
         /* check if the demod is there */
@@ -1330,7 +1319,6 @@ struct dvb_frontend* tda10046_attach(const struct tda1004x_config* config,
         state->config = config;
         state->i2c = i2c;
         memcpy(&state->ops, &tda10046_ops, sizeof(struct dvb_frontend_ops));
-        state->initialised = 0;
         state->demod_type = TDA1004X_DEMOD_TDA10046;
 
         /* check if the demod is there */
diff --git a/drivers/media/dvb/ttpci/av7110.c b/drivers/media/dvb/ttpci/av7110.c
index 840efec32cb6..d028245c8eed 100644
--- a/drivers/media/dvb/ttpci/av7110.c
+++ b/drivers/media/dvb/ttpci/av7110.c
@@ -87,6 +87,7 @@ static int volume = 255;
 static int budgetpatch;
 static int wss_cfg_4_3 = 0x4008;
 static int wss_cfg_16_9 = 0x0007;
+static int tv_standard;
 
 module_param_named(debug, av7110_debug, int, 0644);
 MODULE_PARM_DESC(debug, "debug level (bitmask, default 0)");
@@ -109,6 +110,8 @@ module_param(wss_cfg_4_3, int, 0444);
 MODULE_PARM_DESC(wss_cfg_4_3, "WSS 4:3 - default 0x4008 - bit 15: disable, 14: burst mode, 13..0: wss data");
 module_param(wss_cfg_16_9, int, 0444);
 MODULE_PARM_DESC(wss_cfg_16_9, "WSS 16:9 - default 0x0007 - bit 15: disable, 14: burst mode, 13..0: wss data");
+module_param(tv_standard, int, 0444);
+MODULE_PARM_DESC(tv_standard, "TV standard: 0 PAL (default), 1 NTSC");
 
 static void restart_feeds(struct av7110 *av7110);
 
@@ -2123,7 +2126,7 @@ static int frontend_init(struct av7110 *av7110)
                                                         read_pwm(av7110));
                                 break;
                         case 0x0003:
-                                /* Haupauge DVB-C 2.1 VES1820/ALPS TDBE2 */
+                                /* Hauppauge DVB-C 2.1 VES1820/ALPS TDBE2 */
                                 av7110->fe = ves1820_attach(&alps_tdbe2_config, &av7110->i2c_adap,
                                                         read_pwm(av7110));
                                 break;
@@ -2543,6 +2546,9 @@ static int __devinit av7110_attach(struct saa7146_dev* dev,
         av7110->osdwin = 1;
         mutex_init(&av7110->osd_mutex);
 
+        /* TV standard */
+        av7110->vidmode = tv_standard == 1 ? VIDEO_MODE_NTSC : VIDEO_MODE_PAL;
+
         /* ARM "watchdog" */
         init_waitqueue_head(&av7110->arm_wait);
         av7110->arm_thread = NULL;
diff --git a/drivers/media/dvb/ttpci/av7110_av.c b/drivers/media/dvb/ttpci/av7110_av.c
index 400facec7407..2eff09f638d3 100644
--- a/drivers/media/dvb/ttpci/av7110_av.c
+++ b/drivers/media/dvb/ttpci/av7110_av.c
@@ -1479,8 +1479,6 @@ int av7110_av_init(struct av7110 *av7110)
         void (*play[])(u8 *, int, void *) = { play_audio_cb, play_video_cb };
         int i, ret;
 
-        av7110->vidmode = VIDEO_MODE_PAL;
-
         for (i = 0; i < 2; i++) {
                 struct ipack *ipack = av7110->ipack + i;
 
diff --git a/drivers/media/dvb/ttpci/budget-av.c b/drivers/media/dvb/ttpci/budget-av.c
index 9dd4745f5312..8efe3ce5f66c 100644
--- a/drivers/media/dvb/ttpci/budget-av.c
+++ b/drivers/media/dvb/ttpci/budget-av.c
@@ -60,11 +60,11 @@ struct budget_av {
         struct dvb_ca_en50221 ca;
 };
 
-/* GPIO CI Connections:
- * 0 - Vcc/Reset (Reset is controlled by capacitor)
- * 1 - Attribute Memory
- * 2 - Card Enable (Active Low)
- * 3 - Card Detect
+/* GPIO Connections:
+ * 0 - Vcc/Reset (Reset is controlled by capacitor). Resets the frontend *AS WELL*!
+ * 1 - CI memory select 0=>IO memory, 1=>Attribute Memory
+ * 2 - CI Card Enable (Active Low)
+ * 3 - CI Card Detect
  */
 
 /****************************************************************************
@@ -214,6 +214,9 @@ static int ciintf_slot_reset(struct dvb_ca_en50221 *ca, int slot)
         while (--timeout > 0 && ciintf_read_attribute_mem(ca, slot, 0) != 0x1d)
                 msleep(100);
 
+        /* reinitialise the frontend */
+        dvb_frontend_reinitialise(budget_av->budget.dvb_frontend);
+
         if (timeout <= 0)
         {
                 printk(KERN_ERR "budget-av: cam reset failed (timeout).\n");
diff --git a/drivers/media/dvb/ttpci/budget-core.c b/drivers/media/dvb/ttpci/budget-core.c
index 633e68c341c8..ea2066d461fc 100644
--- a/drivers/media/dvb/ttpci/budget-core.c
+++ b/drivers/media/dvb/ttpci/budget-core.c
@@ -39,9 +39,21 @@
 #include "budget.h"
 #include "ttpci-eeprom.h"
 
+#define TS_WIDTH                (2 * TS_SIZE)
+#define TS_WIDTH_ACTIVY         TS_SIZE
+#define TS_HEIGHT_MASK          0xf00
+#define TS_HEIGHT_MASK_ACTIVY   0xc00
+#define TS_MIN_BUFSIZE_K        188
+#define TS_MAX_BUFSIZE_K        1410
+#define TS_MAX_BUFSIZE_K_ACTIVY 564
+#define BUFFER_WARNING_WAIT     (30*HZ)
+
 int budget_debug;
+static int dma_buffer_size = TS_MIN_BUFSIZE_K;
 module_param_named(debug, budget_debug, int, 0644);
+module_param_named(bufsize, dma_buffer_size, int, 0444);
 MODULE_PARM_DESC(debug, "Turn on/off budget debugging (default:off).");
+MODULE_PARM_DESC(bufsize, "DMA buffer size in KB, default: 188, min: 188, max: 1410 (Activy: 564)");
 
 /****************************************************************************
  * TT budget / WinTV Nova
@@ -70,11 +82,10 @@ static int start_ts_capture(struct budget *budget)
 
         saa7146_write(dev, MC1, MASK_20);       // DMA3 off
 
-        memset(budget->grabbing, 0x00, TS_HEIGHT * TS_WIDTH);
+        memset(budget->grabbing, 0x00, budget->buffer_size);
 
         saa7146_write(dev, PCI_BT_V1, 0x001c0000 | (saa7146_read(dev, PCI_BT_V1) & ~0x001f0000));
 
-        budget->tsf = 0xff;
         budget->ttbp = 0;
 
         /*
@@ -115,16 +126,12 @@ static int start_ts_capture(struct budget *budget)
 
         saa7146_write(dev, BASE_ODD3, 0);
         saa7146_write(dev, BASE_EVEN3, 0);
-        saa7146_write(dev, PROT_ADDR3, TS_WIDTH * TS_HEIGHT);
+        saa7146_write(dev, PROT_ADDR3, budget->buffer_size);
         saa7146_write(dev, BASE_PAGE3, budget->pt.dma | ME1 | 0x90);
 
-        if (budget->card->type == BUDGET_FS_ACTIVY) {
-                saa7146_write(dev, PITCH3, TS_WIDTH / 2);
-                saa7146_write(dev, NUM_LINE_BYTE3, ((TS_HEIGHT * 2) << 16) | (TS_WIDTH / 2));
-        } else {
-                saa7146_write(dev, PITCH3, TS_WIDTH);
-                saa7146_write(dev, NUM_LINE_BYTE3, (TS_HEIGHT << 16) | TS_WIDTH);
-        }
+        saa7146_write(dev, PITCH3, budget->buffer_width);
+        saa7146_write(dev, NUM_LINE_BYTE3,
+                        (budget->buffer_height << 16) | budget->buffer_width);
 
         saa7146_write(dev, MC2, (MASK_04 | MASK_20));
 
@@ -141,11 +148,12 @@ static void vpeirq(unsigned long data)
         u8 *mem = (u8 *) (budget->grabbing);
         u32 olddma = budget->ttbp;
         u32 newdma = saa7146_read(budget->dev, PCI_VDP3);
+        u32 count;
 
         /* nearest lower position divisible by 188 */
         newdma -= newdma % 188;
 
-        if (newdma >= TS_BUFLEN)
+        if (newdma >= budget->buffer_size)
                 return;
 
         budget->ttbp = newdma;
@@ -154,11 +162,24 @@ static void vpeirq(unsigned long data)
                 return;
 
         if (newdma > olddma) {  /* no wraparound, dump olddma..newdma */
-                dvb_dmx_swfilter_packets(&budget->demux, mem + olddma, (newdma - olddma) / 188);
+                count = newdma - olddma;
+                dvb_dmx_swfilter_packets(&budget->demux, mem + olddma, count / 188);
         } else {                /* wraparound, dump olddma..buflen and 0..newdma */
-                dvb_dmx_swfilter_packets(&budget->demux, mem + olddma, (TS_BUFLEN - olddma) / 188);
+                count = budget->buffer_size - olddma;
+                dvb_dmx_swfilter_packets(&budget->demux, mem + olddma, count / 188);
+                count += newdma;
                 dvb_dmx_swfilter_packets(&budget->demux, mem, newdma / 188);
         }
+
+        if (count > budget->buffer_warning_threshold)
+                budget->buffer_warnings++;
+
+        if (budget->buffer_warnings && time_after(jiffies, budget->buffer_warning_time)) {
+                printk("%s %s: used %d times >80%% of buffer (%u bytes now)\n",
+                        budget->dev->name, __FUNCTION__, budget->buffer_warnings, count);
+                budget->buffer_warning_time = jiffies + BUFFER_WARNING_WAIT;
+                budget->buffer_warnings = 0;
+        }
 }
 
 
@@ -341,9 +362,10 @@ int ttpci_budget_init(struct budget *budget, struct saa7146_dev *dev,
                       struct saa7146_pci_extension_data *info,
                       struct module *owner)
 {
-        int length = TS_WIDTH * TS_HEIGHT;
         int ret = 0;
         struct budget_info *bi = info->ext_priv;
+        int max_bufsize;
+        int height_mask;
 
         memset(budget, 0, sizeof(struct budget));
 
@@ -352,6 +374,32 @@ int ttpci_budget_init(struct budget *budget, struct saa7146_dev *dev,
         budget->card = bi;
         budget->dev = (struct saa7146_dev *) dev;
 
+        if (budget->card->type == BUDGET_FS_ACTIVY) {
+                budget->buffer_width = TS_WIDTH_ACTIVY;
+                max_bufsize = TS_MAX_BUFSIZE_K_ACTIVY;
+                height_mask = TS_HEIGHT_MASK_ACTIVY;
+        } else {
+                budget->buffer_width = TS_WIDTH;
+                max_bufsize = TS_MAX_BUFSIZE_K;
+                height_mask = TS_HEIGHT_MASK;
+        }
+
+        if (dma_buffer_size < TS_MIN_BUFSIZE_K)
+                dma_buffer_size = TS_MIN_BUFSIZE_K;
+        else if (dma_buffer_size > max_bufsize)
+                dma_buffer_size = max_bufsize;
+
+        budget->buffer_height = dma_buffer_size * 1024 / budget->buffer_width;
+        budget->buffer_height &= height_mask;
+        budget->buffer_size = budget->buffer_height * budget->buffer_width;
+        budget->buffer_warning_threshold = budget->buffer_size * 80/100;
+        budget->buffer_warnings = 0;
+        budget->buffer_warning_time = jiffies;
+
+        dprintk(2, "%s: width = %d, height = %d\n",
+                budget->dev->name, budget->buffer_width, budget->buffer_height);
+        printk("%s: dma buffer size %u\n", budget->dev->name, budget->buffer_size);
+
         dvb_register_adapter(&budget->dvb_adapter, budget->card->name, owner);
 
         /* set dd1 stream a & b */
@@ -392,7 +440,7 @@ int ttpci_budget_init(struct budget *budget, struct saa7146_dev *dev,
         ttpci_eeprom_parse_mac(&budget->i2c_adap, budget->dvb_adapter.proposed_mac);
 
         if (NULL ==
-            (budget->grabbing = saa7146_vmalloc_build_pgtable(dev->pci, length, &budget->pt))) {
+            (budget->grabbing = saa7146_vmalloc_build_pgtable(dev->pci, budget->buffer_size, &budget->pt))) {
                 ret = -ENOMEM;
                 goto err;
         }
diff --git a/drivers/media/dvb/ttpci/budget-patch.c b/drivers/media/dvb/ttpci/budget-patch.c
index 9fc9185a8426..1b3aaac5e763 100644
--- a/drivers/media/dvb/ttpci/budget-patch.c
+++ b/drivers/media/dvb/ttpci/budget-patch.c
@@ -577,6 +577,17 @@ static int budget_patch_attach (struct saa7146_dev* dev, struct saa7146_pci_exte
         saa7146_setgpio(dev, 3, SAA7146_GPIO_OUTLO);
         // Set RPS1 Address register to point to RPS code               (r108 p42)
         saa7146_write(dev, RPS_ADDR1, dev->d_rps1.dma_handle);
+
+        if (!(budget = kmalloc (sizeof(struct budget_patch), GFP_KERNEL)))
+                return -ENOMEM;
+
+        dprintk(2, "budget: %p\n", budget);
+
+        if ((err = ttpci_budget_init (budget, dev, info, THIS_MODULE))) {
+                kfree (budget);
+                return err;
+        }
+
         // Set Source Line Counter Threshold, using BRS                 (rCC p43)
         // It generates HS event every TS_HEIGHT lines
         // this is related to TS_WIDTH set in register
@@ -585,24 +596,13 @@ static int budget_patch_attach (struct saa7146_dev* dev, struct saa7146_pci_exte
         //,then RPS_THRESH1
         // should be set to trigger every TS_HEIGHT (512) lines.
         //
-        saa7146_write(dev, RPS_THRESH1, (TS_HEIGHT*1) | MASK_12 );
+        saa7146_write(dev, RPS_THRESH1, budget->buffer_height | MASK_12 );
 
         // saa7146_write(dev, RPS_THRESH0, ((TS_HEIGHT/2)<<16) |MASK_28| (TS_HEIGHT/2) |MASK_12 );
         // Enable RPS1                                                  (rFC p33)
         saa7146_write(dev, MC1, (MASK_13 | MASK_29));
 
 
-        if (!(budget = kmalloc (sizeof(struct budget_patch), GFP_KERNEL)))
-                return -ENOMEM;
-
-        dprintk(2, "budget: %p\n", budget);
-
-        if ((err = ttpci_budget_init (budget, dev, info, THIS_MODULE))) {
-                kfree (budget);
-                return err;
-        }
-
-
         dev->ext_priv = budget;
 
         budget->dvb_adapter.priv = budget;
diff --git a/drivers/media/dvb/ttpci/budget.h b/drivers/media/dvb/ttpci/budget.h
index 4ac0f4d08025..ecea3a13030e 100644
--- a/drivers/media/dvb/ttpci/budget.h
+++ b/drivers/media/dvb/ttpci/budget.h
@@ -58,7 +58,13 @@ struct budget {
         int ci_present;
         int video_port;
 
-        u8 tsf;
+        u32 buffer_width;
+        u32 buffer_height;
+        u32 buffer_size;
+        u32 buffer_warning_threshold;
+        u32 buffer_warnings;
+        unsigned long buffer_warning_time;
+
         u32 ttbp;
         int feeding;
 
@@ -79,11 +85,6 @@ static struct saa7146_pci_extension_data x_var = { \
         .ext_priv = &x_var ## _info, \
         .ext = &budget_extension };
 
-#define TS_WIDTH  (376)
-#define TS_HEIGHT (512)
-#define TS_BUFLEN (TS_WIDTH*TS_HEIGHT)
-#define TS_MAX_PACKETS (TS_BUFLEN/TS_SIZE)
-
 #define BUDGET_TT                  0
 #define BUDGET_TT_HW_DISEQC        1
 #define BUDGET_PATCH               3
diff --git a/drivers/media/video/Kconfig b/drivers/media/video/Kconfig
index f31a19890b15..85888a8a93c9 100644
--- a/drivers/media/video/Kconfig
+++ b/drivers/media/video/Kconfig
@@ -300,7 +300,7 @@ config VIDEO_OVCAMCHIP
           camera drivers.
 
           To compile this driver as a module, choose M here: the
-          module will be called ovcamchip
+          module will be called ovcamchip.
 
 config VIDEO_M32R_AR
         tristate "AR devices"
@@ -316,6 +316,13 @@ config VIDEO_M32R_AR_M64278
           Say Y here to use the Renesas M64278E-800 camera module,
           which supports VGA(640x480 pixcels) size of images.
 
+#
+# Encoder / Decoder module configuration
+#
+
+menu "Encoders and Decoders"
+        depends on VIDEO_DEV
+
 config VIDEO_MSP3400
         tristate "Micronas MSP34xx audio decoders"
         depends on VIDEO_DEV && I2C
@@ -323,7 +330,7 @@ config VIDEO_MSP3400
           Support for the Micronas MSP34xx series of audio decoders.
 
           To compile this driver as a module, choose M here: the
-          module will be called msp3400
+          module will be called msp3400.
 
 config VIDEO_CS53L32A
         tristate "Cirrus Logic CS53L32A audio ADC"
@@ -333,17 +340,27 @@ config VIDEO_CS53L32A
           stereo A/D converter.
 
           To compile this driver as a module, choose M here: the
-          module will be called cs53l32a
+          module will be called cs53l32a.
 
 config VIDEO_WM8775
-        tristate "Wolfson Microelectronics WM8775 audio ADC"
+        tristate "Wolfson Microelectronics WM8775 audio ADC with input mixer"
         depends on VIDEO_DEV && I2C && EXPERIMENTAL
         ---help---
-          Support for the Wolfson Microelectronics WM8775
-          high performance stereo A/D Converter.
+          Support for the Wolfson Microelectronics WM8775 high
+          performance stereo A/D Converter with a 4 channel input mixer.
 
           To compile this driver as a module, choose M here: the
-          module will be called wm8775
+          module will be called wm8775.
+
+config VIDEO_WM8739
+        tristate "Wolfson Microelectronics WM8739 stereo audio ADC"
+        depends on VIDEO_DEV && I2C && EXPERIMENTAL
+        ---help---
+          Support for the Wolfson Microelectronics WM8739
+          stereo A/D Converter.
+
+          To compile this driver as a module, choose M here: the
+          module will be called wm8739.
 
 source "drivers/media/video/cx25840/Kconfig"
 
@@ -354,7 +371,7 @@ config VIDEO_SAA711X
           Support for the Philips SAA7113/4/5 video decoders.
 
           To compile this driver as a module, choose M here: the
-          module will be called saa7115
+          module will be called saa7115.
 
 config VIDEO_SAA7127
         tristate "Philips SAA7127/9 digital video encoders"
@@ -363,7 +380,32 @@ config VIDEO_SAA7127
           Support for the Philips SAA7127/9 digital video encoders.
 
           To compile this driver as a module, choose M here: the
-          module will be called saa7127
+          module will be called saa7127.
+
+config VIDEO_UPD64031A
+        tristate "NEC Electronics uPD64031A Ghost Reduction"
+        depends on VIDEO_DEV && I2C && EXPERIMENTAL
+        ---help---
+          Support for the NEC Electronics uPD64031A Ghost Reduction
+          video chip. It is most often found in NTSC TV cards made for
+          Japan and is used to reduce the 'ghosting' effect that can
+          be present in analog TV broadcasts.
+
+          To compile this driver as a module, choose M here: the
+          module will be called upd64031a.
+
+config VIDEO_UPD64083
+        tristate "NEC Electronics uPD64083 3-Dimensional Y/C separation"
+        depends on VIDEO_DEV && I2C && EXPERIMENTAL
+        ---help---
+          Support for the NEC Electronics uPD64083 3-Dimensional Y/C
+          separation video chip. It is used to improve the quality of
+          the colors of a composite signal.
+
+          To compile this driver as a module, choose M here: the
+          module will be called upd64083.
+
+endmenu # encoder / decoder chips
 
 #
 # USB Multimedia device configuration
@@ -374,20 +416,6 @@ menu "V4L USB devices"
 
 source "drivers/media/video/em28xx/Kconfig"
 
-config USB_VICAM
-        tristate "USB 3com HomeConnect (aka vicam) support (EXPERIMENTAL)"
-        depends on USB && VIDEO_DEV && EXPERIMENTAL
-        ---help---
-          Say Y here if you have 3com homeconnect camera (vicam).
-
-          This driver uses the Video For Linux API. You must say Y or M to
-          "Video For Linux" (under Multimedia Devices) to use this driver.
-          Information on this API and pointers to "v4l" programs may be found
-          at <file:Documentation/video4linux/API.html>.
-
-          To compile this driver as a module, choose M here: the
-          module will be called vicam.
-
 config USB_DSBR
         tristate "D-Link USB FM radio support (EXPERIMENTAL)"
         depends on USB && VIDEO_DEV && EXPERIMENTAL
@@ -397,79 +425,20 @@ config USB_DSBR
           you must connect the line out connector to a sound card or a
           set of speakers.
 
-          This driver uses the Video For Linux API.  You must enable
-          (Y or M in config) Video For Linux (under Character Devices)
-          to use this driver.  Information on this API and pointers to
-          "v4l" programs may be found at
-          <file:Documentation/video4linux/API.html>.
-
           To compile this driver as a module, choose M here: the
           module will be called dsbr100.
 
-config USB_ET61X251
-        tristate "USB ET61X[12]51 PC Camera Controller support"
-        depends on USB && VIDEO_DEV
-        ---help---
-          Say Y here if you want support for cameras based on Etoms ET61X151
-          or ET61X251 PC Camera Controllers.
-
-          See <file:Documentation/usb/et61x251.txt> for more informations.
-
-          This driver uses the Video For Linux API. You must say Y or M to
-          "Video For Linux" to use this driver.
-
-          To compile this driver as a module, choose M here: the
-          module will be called et61x251.
+source "drivers/media/video/usbvideo/Kconfig"
 
-config USB_IBMCAM
-        tristate "USB IBM (Xirlink) C-it Camera support"
-        depends on USB && VIDEO_DEV
-        ---help---
-          Say Y here if you want to connect a IBM "C-It" camera, also known as
-          "Xirlink PC Camera" to your computer's USB port.  For more
-          information, read <file:Documentation/usb/ibmcam.txt>.
-
-          This driver uses the Video For Linux API.  You must enable
-          (Y or M in config) Video For Linux (under Character Devices)
-          to use this driver.  Information on this API and pointers to
-          "v4l" programs may be found at
-          <file:Documentation/video4linux/API.html>.
-
-          To compile this driver as a module, choose M here: the
-          module will be called ibmcam.
-
-          This camera has several configuration options which
-          can be specified when you load the module. Read
-          <file:Documentation/usb/ibmcam.txt> to learn more.
-
-config USB_KONICAWC
-        tristate "USB Konica Webcam support"
-        depends on USB && VIDEO_DEV
-        ---help---
-          Say Y here if you want support for webcams based on a Konica
-          chipset. This is known to work with the Intel YC76 webcam.
-
-          This driver uses the Video For Linux API.  You must enable
-          (Y or M in config) Video For Linux (under Character Devices)
-          to use this driver.  Information on this API and pointers to
-          "v4l" programs may be found at
-          <file:Documentation/video4linux/API.html>.
-
-          To compile this driver as a module, choose M here: the
-          module will be called konicawc.
+source "drivers/media/video/et61x251/Kconfig"
 
 config USB_OV511
         tristate "USB OV511 Camera support"
         depends on USB && VIDEO_DEV
         ---help---
           Say Y here if you want to connect this type of camera to your
-          computer's USB port. See <file:Documentation/usb/ov511.txt> for more
-          information and for a list of supported cameras.
-
-          This driver uses the Video For Linux API. You must say Y or M to
-          "Video For Linux" (under Character Devices) to use this driver.
-          Information on this API and pointers to "v4l" programs may be found
-          at <file:Documentation/video4linux/API.html>.
+          computer's USB port. See <file:Documentation/video4linux/ov511.txt>
+          for more information and for a list of supported cameras.
 
           To compile this driver as a module, choose M here: the
           module will be called ov511.
@@ -479,31 +448,13 @@ config USB_SE401
         depends on USB && VIDEO_DEV
         ---help---
           Say Y here if you want to connect this type of camera to your
-          computer's USB port. See <file:Documentation/usb/se401.txt> for more
-          information and for a list of supported cameras.
-
-          This driver uses the Video For Linux API. You must say Y or M to
-          "Video For Linux" (under Multimedia Devices) to use this driver.
-          Information on this API and pointers to "v4l" programs may be found
-          at <file:Documentation/video4linux/API.html>.
+          computer's USB port. See <file:Documentation/video4linux/se401.txt>
+          for more information and for a list of supported cameras.
 
           To compile this driver as a module, choose M here: the
           module will be called se401.
 
-config USB_SN9C102
-        tristate "USB SN9C10x PC Camera Controller support"
-        depends on USB && VIDEO_DEV
-        ---help---
-          Say Y here if you want support for cameras based on SONiX SN9C101,
-          SN9C102 or SN9C103 PC Camera Controllers.
-
-          See <file:Documentation/usb/sn9c102.txt> for more informations.
-
-          This driver uses the Video For Linux API. You must say Y or M to
-          "Video For Linux" to use this driver.
-
-          To compile this driver as a module, choose M here: the
-          module will be called sn9c102.
+source "drivers/media/video/sn9c102/Kconfig"
 
 config USB_STV680
         tristate "USB STV680 (Pencam) Camera support"
@@ -511,20 +462,16 @@ config USB_STV680
         ---help---
           Say Y here if you want to connect this type of camera to your
           computer's USB port. This includes the Pencam line of cameras.
-          See <file:Documentation/usb/stv680.txt> for more information and for
-          a list of supported cameras.
-
-          This driver uses the Video For Linux API. You must say Y or M to
-          "Video For Linux" (under Multimedia Devices) to use this driver.
-          Information on this API and pointers to "v4l" programs may be found
-          at <file:Documentation/video4linux/API.html>.
+          See <file:Documentation/video4linux/stv680.txt> for more information
+          and for a list of supported cameras.
 
           To compile this driver as a module, choose M here: the
           module will be called stv680.
 
 config USB_W9968CF
         tristate "USB W996[87]CF JPEG Dual Mode Camera support"
-        depends on USB && VIDEO_DEV && I2C && VIDEO_OVCAMCHIP
+        depends on USB && VIDEO_DEV && I2C
+        select VIDEO_OVCAMCHIP
         ---help---
           Say Y here if you want support for cameras based on OV681 or
           Winbond W9967CF/W9968CF JPEG USB Dual Mode Camera Chips.
@@ -534,64 +481,14 @@ config USB_W9968CF
           resolutions and framerates, but cannot be included in the official
           Linux kernel for performance purposes.
 
-          See <file:Documentation/usb/w9968cf.txt> for more informations.
-
-          This driver uses the Video For Linux and the I2C APIs. It needs the
-          OmniVision Camera Chip support as well. You must say Y or M to
-          "Video For Linux", "I2C Support" and "OmniVision Camera Chip
-          support" to use this driver.
+          See <file:Documentation/video4linux/w9968cf.txt> for more info.
 
           To compile this driver as a module, choose M here: the
           module will be called w9968cf.
 
-config USB_ZC0301
-        tristate "USB ZC0301 Image Processor and Control Chip support"
-        depends on USB && VIDEO_DEV
-        ---help---
-          Say Y here if you want support for cameras based on the ZC0301
-          Image Processor and Control Chip.
-
-          See <file:Documentation/usb/zc0301.txt> for more informations.
-
-          This driver uses the Video For Linux API. You must say Y or M to
-          "Video For Linux" to use this driver.
-
-          To compile this driver as a module, choose M here: the
-          module will be called zc0301.
-
-config USB_PWC
-        tristate "USB Philips Cameras"
-        depends on USB && VIDEO_DEV
-        ---help---
-          Say Y or M here if you want to use one of these Philips & OEM
-          webcams:
-           * Philips PCA645, PCA646
-           * Philips PCVC675, PCVC680, PCVC690
-           * Philips PCVC720/40, PCVC730, PCVC740, PCVC750
-           * Askey VC010
-           * Logitech QuickCam Pro 3000, 4000, 'Zoom', 'Notebook Pro'
-             and 'Orbit'/'Sphere'
-           * Samsung MPC-C10, MPC-C30
-           * Creative Webcam 5, Pro Ex
-           * SOTEC Afina Eye
-           * Visionite VCS-UC300, VCS-UM100
-
-          The PCA635, PCVC665 and PCVC720/20 are not supported by this driver
-          and never will be, but the 665 and 720/20 are supported by other
-          drivers.
-
-          See <file:Documentation/usb/philips.txt> for more information and
-          installation instructions.
-
-          The built-in microphone is enabled by selecting USB Audio support.
-
-          This driver uses the Video For Linux API. You must say Y or M to
-          "Video For Linux" (under Character Devices) to use this driver.
-          Information on this API and pointers to "v4l" programs may be found
-          at <file:Documentation/video4linux/API.html>.
+source "drivers/media/video/zc0301/Kconfig"
 
-          To compile this driver as a module, choose M here: the
-          module will be called pwc.
+source "drivers/media/video/pwc/Kconfig"
 
 endmenu # V4L USB devices
 
diff --git a/drivers/media/video/Makefile b/drivers/media/video/Makefile
index 1c0e72e5a593..b3ea2d63db9b 100644
--- a/drivers/media/video/Makefile
+++ b/drivers/media/video/Makefile
@@ -45,6 +45,7 @@ obj-$(CONFIG_VIDEO_EM28XX) += tvp5150.o
 obj-$(CONFIG_VIDEO_MSP3400) += msp3400.o
 obj-$(CONFIG_VIDEO_CS53L32A) += cs53l32a.o
 obj-$(CONFIG_VIDEO_WM8775) += wm8775.o
+obj-$(CONFIG_VIDEO_WM8739) += wm8739.o
 obj-$(CONFIG_VIDEO_OVCAMCHIP) += ovcamchip/
 obj-$(CONFIG_VIDEO_CPIA2) += cpia2/
 obj-$(CONFIG_VIDEO_MXB) += saa7111.o tda9840.o tea6415c.o tea6420.o mxb.o
@@ -64,9 +65,8 @@ obj-$(CONFIG_VIDEO_M32R_AR_M64278) += arv.o
 obj-$(CONFIG_VIDEO_CX25840) += cx25840/
 obj-$(CONFIG_VIDEO_SAA711X) += saa7115.o
 obj-$(CONFIG_VIDEO_SAA7127) += saa7127.o
-
-et61x251-objs   := et61x251_core.o et61x251_tas5130d1b.o
-zc0301-objs     := zc0301_core.o zc0301_pas202bcb.o
+obj-$(CONFIG_VIDEO_UPD64031A) += upd64031a.o
+obj-$(CONFIG_VIDEO_UPD64083) += upd64083.o
 
 obj-$(CONFIG_USB_DABUSB)        += dabusb.o
 obj-$(CONFIG_USB_DSBR)          += dsbr100.o
@@ -84,4 +84,4 @@ obj-$(CONFIG_USB_IBMCAM)        += usbvideo/
 obj-$(CONFIG_USB_KONICAWC)      += usbvideo/
 obj-$(CONFIG_USB_VICAM)         += usbvideo/
 
-EXTRA_CFLAGS += -I$(srctree)/drivers/media/dvb/dvb-core
+EXTRA_CFLAGS += -Idrivers/media/dvb/dvb-core
diff --git a/drivers/media/video/bt8xx/Makefile b/drivers/media/video/bt8xx/Makefile
index 94350f21cdc0..db641a36b197 100644
--- a/drivers/media/video/bt8xx/Makefile
+++ b/drivers/media/video/bt8xx/Makefile
@@ -9,4 +9,4 @@ bttv-objs      :=      bttv-driver.o bttv-cards.o bttv-if.o \
 obj-$(CONFIG_VIDEO_BT848) += bttv.o
 
 EXTRA_CFLAGS += -I$(src)/..
-EXTRA_CFLAGS += -I$(srctree)/drivers/media/dvb/dvb-core
+EXTRA_CFLAGS += -Idrivers/media/dvb/dvb-core
diff --git a/drivers/media/video/bt8xx/bttv-driver.c b/drivers/media/video/bt8xx/bttv-driver.c
index 74def9c23952..423e954948be 100644
--- a/drivers/media/video/bt8xx/bttv-driver.c
+++ b/drivers/media/video/bt8xx/bttv-driver.c
@@ -973,12 +973,12 @@ audio_mux(struct bttv *btv, int input, int mute)
                    For now this is sufficient. */
                 switch (input) {
                 case TVAUDIO_INPUT_RADIO:
-                        route.input = MSP_INPUT(MSP_IN_SCART_2, MSP_IN_TUNER_1,
-                                    MSP_DSP_OUT_SCART, MSP_DSP_OUT_SCART);
+                        route.input = MSP_INPUT(MSP_IN_SCART2, MSP_IN_TUNER1,
+                                    MSP_DSP_IN_SCART, MSP_DSP_IN_SCART);
                         break;
                 case TVAUDIO_INPUT_EXTERN:
-                        route.input = MSP_INPUT(MSP_IN_SCART_1, MSP_IN_TUNER_1,
-                                    MSP_DSP_OUT_SCART, MSP_DSP_OUT_SCART);
+                        route.input = MSP_INPUT(MSP_IN_SCART1, MSP_IN_TUNER1,
+                                    MSP_DSP_IN_SCART, MSP_DSP_IN_SCART);
                         break;
                 case TVAUDIO_INPUT_INTERN:
                         /* Yes, this is the same input as for RADIO. I doubt
@@ -986,8 +986,8 @@ audio_mux(struct bttv *btv, int input, int mute)
                            input is the BTTV_BOARD_AVERMEDIA98. I wonder how
                            that was tested. My guess is that the whole INTERN
                            input does not work. */
-                        route.input = MSP_INPUT(MSP_IN_SCART_2, MSP_IN_TUNER_1,
-                                    MSP_DSP_OUT_SCART, MSP_DSP_OUT_SCART);
+                        route.input = MSP_INPUT(MSP_IN_SCART2, MSP_IN_TUNER1,
+                                    MSP_DSP_IN_SCART, MSP_DSP_IN_SCART);
                         break;
                 case TVAUDIO_INPUT_TUNER:
                 default:
@@ -1023,14 +1023,11 @@ audio_input(struct bttv *btv, int input)
 static void
 i2c_vidiocschan(struct bttv *btv)
 {
-        struct video_channel c;
+        v4l2_std_id std = bttv_tvnorms[btv->tvnorm].v4l2_id;
 
-        memset(&c,0,sizeof(c));
-        c.norm    = btv->tvnorm;
-        c.channel = btv->input;
-        bttv_call_i2c_clients(btv,VIDIOCSCHAN,&c);
+        bttv_call_i2c_clients(btv, VIDIOC_S_STD, &std);
         if (btv->c.type == BTTV_BOARD_VOODOOTV_FM)
-                bttv_tda9880_setnorm(btv,c.norm);
+                bttv_tda9880_setnorm(btv,btv->tvnorm);
 }
 
 static int
@@ -1184,11 +1181,27 @@ static int get_control(struct bttv *btv, struct v4l2_control *c)
                         break;
         if (i == BTTV_CTLS)
                 return -EINVAL;
-        if (i >= 4 && i <= 8) {
+        if (btv->audio_hook && i >= 4 && i <= 8) {
                 memset(&va,0,sizeof(va));
-                bttv_call_i2c_clients(btv, VIDIOCGAUDIO, &va);
-                if (btv->audio_hook)
-                        btv->audio_hook(btv,&va,0);
+                btv->audio_hook(btv,&va,0);
+                switch (c->id) {
+                case V4L2_CID_AUDIO_MUTE:
+                        c->value = (VIDEO_AUDIO_MUTE & va.flags) ? 1 : 0;
+                        break;
+                case V4L2_CID_AUDIO_VOLUME:
+                        c->value = va.volume;
+                        break;
+                case V4L2_CID_AUDIO_BALANCE:
+                        c->value = va.balance;
+                        break;
+                case V4L2_CID_AUDIO_BASS:
+                        c->value = va.bass;
+                        break;
+                case V4L2_CID_AUDIO_TREBLE:
+                        c->value = va.treble;
+                        break;
+                }
+                return 0;
         }
         switch (c->id) {
         case V4L2_CID_BRIGHTNESS:
@@ -1205,19 +1218,11 @@ static int get_control(struct bttv *btv, struct v4l2_control *c)
                 break;
 
         case V4L2_CID_AUDIO_MUTE:
-                c->value = (VIDEO_AUDIO_MUTE & va.flags) ? 1 : 0;
-                break;
         case V4L2_CID_AUDIO_VOLUME:
-                c->value = va.volume;
-                break;
         case V4L2_CID_AUDIO_BALANCE:
-                c->value = va.balance;
-                break;
         case V4L2_CID_AUDIO_BASS:
-                c->value = va.bass;
-                break;
         case V4L2_CID_AUDIO_TREBLE:
-                c->value = va.treble;
+                bttv_call_i2c_clients(btv,VIDIOC_G_CTRL,c);
                 break;
 
         case V4L2_CID_PRIVATE_CHROMA_AGC:
@@ -1269,11 +1274,35 @@ static int set_control(struct bttv *btv, struct v4l2_control *c)
                         break;
         if (i == BTTV_CTLS)
                 return -EINVAL;
-        if (i >= 4 && i <= 8) {
+        if (btv->audio_hook && i >= 4 && i <= 8) {
                 memset(&va,0,sizeof(va));
-                bttv_call_i2c_clients(btv, VIDIOCGAUDIO, &va);
-                if (btv->audio_hook)
-                        btv->audio_hook(btv,&va,0);
+                btv->audio_hook(btv,&va,0);
+                switch (c->id) {
+                case V4L2_CID_AUDIO_MUTE:
+                        if (c->value) {
+                                va.flags |= VIDEO_AUDIO_MUTE;
+                                audio_mute(btv, 1);
+                        } else {
+                                va.flags &= ~VIDEO_AUDIO_MUTE;
+                                audio_mute(btv, 0);
+                        }
+                        break;
+
+                case V4L2_CID_AUDIO_VOLUME:
+                        va.volume = c->value;
+                        break;
+                case V4L2_CID_AUDIO_BALANCE:
+                        va.balance = c->value;
+                        break;
+                case V4L2_CID_AUDIO_BASS:
+                        va.bass = c->value;
+                        break;
+                case V4L2_CID_AUDIO_TREBLE:
+                        va.treble = c->value;
+                        break;
+                }
+                btv->audio_hook(btv,&va,1);
+                return 0;
         }
         switch (c->id) {
         case V4L2_CID_BRIGHTNESS:
@@ -1289,26 +1318,13 @@ static int set_control(struct bttv *btv, struct v4l2_control *c)
                 bt848_sat(btv,c->value);
                 break;
         case V4L2_CID_AUDIO_MUTE:
-                if (c->value) {
-                        va.flags |= VIDEO_AUDIO_MUTE;
-                        audio_mute(btv, 1);
-                } else {
-                        va.flags &= ~VIDEO_AUDIO_MUTE;
-                        audio_mute(btv, 0);
-                }
-                break;
-
+                audio_mute(btv, c->value);
+                /* fall through */
         case V4L2_CID_AUDIO_VOLUME:
-                va.volume = c->value;
-                break;
         case V4L2_CID_AUDIO_BALANCE:
-                va.balance = c->value;
-                break;
         case V4L2_CID_AUDIO_BASS:
-                va.bass = c->value;
-                break;
         case V4L2_CID_AUDIO_TREBLE:
-                va.treble = c->value;
+                bttv_call_i2c_clients(btv,VIDIOC_S_CTRL,c);
                 break;
 
         case V4L2_CID_PRIVATE_CHROMA_AGC:
@@ -1364,11 +1380,6 @@ static int set_control(struct bttv *btv, struct v4l2_control *c)
         default:
                 return -EINVAL;
         }
-        if (i >= 4 && i <= 8) {
-                bttv_call_i2c_clients(btv, VIDIOCSAUDIO, &va);
-                if (btv->audio_hook)
-                        btv->audio_hook(btv,&va,1);
-        }
         return 0;
 }
 
@@ -1591,12 +1602,16 @@ static int bttv_common_ioctls(struct bttv *btv, unsigned int cmd, void *arg)
         }
         case VIDIOCSFREQ:
         {
-                unsigned long *freq = arg;
+                struct v4l2_frequency freq;
+
+                memset(&freq, 0, sizeof(freq));
+                freq.frequency = *(unsigned long *)arg;
                 mutex_lock(&btv->lock);
-                btv->freq=*freq;
-                bttv_call_i2c_clients(btv,VIDIOCSFREQ,freq);
+                freq.type = btv->radio_user ? V4L2_TUNER_RADIO : V4L2_TUNER_ANALOG_TV;
+                btv->freq = *(unsigned long *)arg;
+                bttv_call_i2c_clients(btv,VIDIOC_S_FREQUENCY,&freq);
                 if (btv->has_matchbox && btv->radio_user)
-                        tea5757_set_freq(btv,*freq);
+                        tea5757_set_freq(btv,*(unsigned long *)arg);
                 mutex_unlock(&btv->lock);
                 return 0;
         }
@@ -1827,33 +1842,26 @@ static int bttv_common_ioctls(struct bttv *btv, unsigned int cmd, void *arg)
                         return -EINVAL;
                 mutex_lock(&btv->lock);
                 memset(t,0,sizeof(*t));
+                t->rxsubchans = V4L2_TUNER_SUB_MONO;
+                bttv_call_i2c_clients(btv, VIDIOC_G_TUNER, t);
                 strcpy(t->name, "Television");
-                t->type       = V4L2_TUNER_ANALOG_TV;
                 t->capability = V4L2_TUNER_CAP_NORM;
-                t->rxsubchans = V4L2_TUNER_SUB_MONO;
+                t->type       = V4L2_TUNER_ANALOG_TV;
                 if (btread(BT848_DSTATUS)&BT848_DSTATUS_HLOC)
                         t->signal = 0xffff;
-                {
-                        struct video_tuner tuner;
-
-                        memset(&tuner, 0, sizeof (tuner));
-                        tuner.rangehigh = 0xffffffffUL;
-                        bttv_call_i2c_clients(btv, VIDIOCGTUNER, &tuner);
-                        t->rangelow = tuner.rangelow;
-                        t->rangehigh = tuner.rangehigh;
-                }
-                {
+
+                if (btv->audio_hook) {
                         /* Hmmm ... */
                         struct video_audio va;
                         memset(&va, 0, sizeof(struct video_audio));
-                        bttv_call_i2c_clients(btv, VIDIOCGAUDIO, &va);
-                        if (btv->audio_hook)
-                                btv->audio_hook(btv,&va,0);
+                        btv->audio_hook(btv,&va,0);
+                        t->audmode    = V4L2_TUNER_MODE_MONO;
+                        t->rxsubchans = V4L2_TUNER_SUB_MONO;
                         if(va.mode & VIDEO_SOUND_STEREO) {
-                                t->audmode     = V4L2_TUNER_MODE_STEREO;
-                                t->rxsubchans |= V4L2_TUNER_SUB_STEREO;
+                                t->audmode    = V4L2_TUNER_MODE_STEREO;
+                                t->rxsubchans = V4L2_TUNER_SUB_STEREO;
                         }
-                        if(va.mode & VIDEO_SOUND_LANG1) {
+                        if(va.mode & VIDEO_SOUND_LANG2) {
                                 t->audmode    = V4L2_TUNER_MODE_LANG1;
                                 t->rxsubchans = V4L2_TUNER_SUB_LANG1
                                         | V4L2_TUNER_SUB_LANG2;
@@ -1872,10 +1880,10 @@ static int bttv_common_ioctls(struct bttv *btv, unsigned int cmd, void *arg)
                 if (0 != t->index)
                         return -EINVAL;
                 mutex_lock(&btv->lock);
-                {
+                bttv_call_i2c_clients(btv, VIDIOC_S_TUNER, t);
+                if (btv->audio_hook) {
                         struct video_audio va;
                         memset(&va, 0, sizeof(struct video_audio));
-                        bttv_call_i2c_clients(btv, VIDIOCGAUDIO, &va);
                         if (t->audmode == V4L2_TUNER_MODE_MONO)
                                 va.mode = VIDEO_SOUND_MONO;
                         else if (t->audmode == V4L2_TUNER_MODE_STEREO ||
@@ -1885,9 +1893,7 @@ static int bttv_common_ioctls(struct bttv *btv, unsigned int cmd, void *arg)
                                 va.mode = VIDEO_SOUND_LANG1;
                         else if (t->audmode == V4L2_TUNER_MODE_LANG2)
                                 va.mode = VIDEO_SOUND_LANG2;
-                        bttv_call_i2c_clients(btv, VIDIOCSAUDIO, &va);
-                        if (btv->audio_hook)
-                                btv->audio_hook(btv,&va,1);
+                        btv->audio_hook(btv,&va,1);
                 }
                 mutex_unlock(&btv->lock);
                 return 0;
@@ -1912,7 +1918,7 @@ static int bttv_common_ioctls(struct bttv *btv, unsigned int cmd, void *arg)
                         return -EINVAL;
                 mutex_lock(&btv->lock);
                 btv->freq = f->frequency;
-                bttv_call_i2c_clients(btv,VIDIOCSFREQ,&btv->freq);
+                bttv_call_i2c_clients(btv,VIDIOC_S_FREQUENCY,f);
                 if (btv->has_matchbox && btv->radio_user)
                         tea5757_set_freq(btv,btv->freq);
                 mutex_unlock(&btv->lock);
@@ -1920,7 +1926,9 @@ static int bttv_common_ioctls(struct bttv *btv, unsigned int cmd, void *arg)
         }
         case VIDIOC_LOG_STATUS:
         {
+                printk(KERN_INFO "bttv%d: =================  START STATUS CARD #%d  =================\n", btv->c.nr, btv->c.nr);
                 bttv_call_i2c_clients(btv, VIDIOC_LOG_STATUS, NULL);
+                printk(KERN_INFO "bttv%d: ==================  END STATUS CARD #%d  ==================\n", btv->c.nr, btv->c.nr);
                 return 0;
         }
 
@@ -2870,12 +2878,10 @@ static int bttv_do_ioctl(struct inode *inode, struct file *file,
                         return 0;
                 }
                 *c = bttv_ctls[i];
-                if (i >= 4 && i <= 8) {
+                if (btv->audio_hook && i >= 4 && i <= 8) {
                         struct video_audio va;
                         memset(&va,0,sizeof(va));
-                        bttv_call_i2c_clients(btv, VIDIOCGAUDIO, &va);
-                        if (btv->audio_hook)
-                                btv->audio_hook(btv,&va,0);
+                        btv->audio_hook(btv,&va,0);
                         switch (bttv_ctls[i].id) {
                         case V4L2_CID_AUDIO_VOLUME:
                                 if (!(va.flags & VIDEO_AUDIO_VOLUME))
diff --git a/drivers/media/video/bt8xx/bttv-vbi.c b/drivers/media/video/bt8xx/bttv-vbi.c
index e20ff238e409..8c9f0f7cf467 100644
--- a/drivers/media/video/bt8xx/bttv-vbi.c
+++ b/drivers/media/video/bt8xx/bttv-vbi.c
@@ -184,7 +184,7 @@ void bttv_vbi_try_fmt(struct bttv_fh *fh, struct v4l2_format *f)
                 - tvnorm->vbistart[0];
         count1 = (s64) f->fmt.vbi.start[1] + f->fmt.vbi.count[1]
                 - tvnorm->vbistart[1];
-        count  = clamp (max (count0, count1), 1LL, (s64) VBI_MAXLINES);
+        count  = clamp (max (count0, count1), (s64) 1, (s64) VBI_MAXLINES);
 
         f->fmt.vbi.start[0] = tvnorm->vbistart[0];
         f->fmt.vbi.start[1] = tvnorm->vbistart[1];
diff --git a/drivers/media/video/cpia.c b/drivers/media/video/cpia.c
index 2227c5640c12..85d84e89d8f4 100644
--- a/drivers/media/video/cpia.c
+++ b/drivers/media/video/cpia.c
@@ -64,14 +64,13 @@ MODULE_LICENSE("GPL");
 MODULE_SUPPORTED_DEVICE("video");
 #endif
 
-static unsigned short colorspace_conv = 0;
+static unsigned short colorspace_conv;
 module_param(colorspace_conv, ushort, 0444);
 MODULE_PARM_DESC(colorspace_conv,
-                 "\n<n> Colorspace conversion:"
-                 "\n0 = disable"
-                 "\n1 = enable"
-                 "\nDefault value is 0"
-                 "\n");
+                 " Colorspace conversion:"
+                 "\n  0 = disable, 1 = enable"
+                 "\n  Default value is 0"
+                 );
 
 #define ABOUT "V4L-Driver for Vision CPiA based cameras"
 
@@ -4042,7 +4041,7 @@ static int __init cpia_init(void)
                "allowed, it is disabled by default now. Users should fix the "
                "applications in case they don't work without conversion "
                "reenabled by setting the 'colorspace_conv' module "
-               "parameter to 1");
+               "parameter to 1\n");
 
 #ifdef CONFIG_PROC_FS
         proc_cpia_create();
diff --git a/drivers/media/video/cpia2/cpia2.h b/drivers/media/video/cpia2/cpia2.h
index 8394283993f6..1764991b0ac9 100644
--- a/drivers/media/video/cpia2/cpia2.h
+++ b/drivers/media/video/cpia2/cpia2.h
@@ -456,7 +456,7 @@ int cpia2_init_camera(struct camera_data *cam);
 int cpia2_allocate_buffers(struct camera_data *cam);
 void cpia2_free_buffers(struct camera_data *cam);
 long cpia2_read(struct camera_data *cam,
-                char *buf, unsigned long count, int noblock);
+                char __user *buf, unsigned long count, int noblock);
 unsigned int cpia2_poll(struct camera_data *cam,
                         struct file *filp, poll_table *wait);
 int cpia2_remap_buffer(struct camera_data *cam, struct vm_area_struct *vma);
diff --git a/drivers/media/video/cx25840/Makefile b/drivers/media/video/cx25840/Makefile
index 32a896c23d1e..6e8665be8954 100644
--- a/drivers/media/video/cx25840/Makefile
+++ b/drivers/media/video/cx25840/Makefile
@@ -3,4 +3,4 @@ cx25840-objs    := cx25840-core.o cx25840-audio.o cx25840-firmware.o \
 
 obj-$(CONFIG_VIDEO_CX25840) += cx25840.o
 
-EXTRA_CFLAGS += -I$(src)/..
+EXTRA_CFLAGS += -Idrivers/media/video
diff --git a/drivers/media/video/cx25840/cx25840-audio.c b/drivers/media/video/cx25840/cx25840-audio.c
index a4540e858f21..9a4b813152e5 100644
--- a/drivers/media/video/cx25840/cx25840-audio.c
+++ b/drivers/media/video/cx25840/cx25840-audio.c
@@ -19,8 +19,9 @@
 #include <linux/videodev2.h>
 #include <linux/i2c.h>
 #include <media/v4l2-common.h>
+#include <media/cx25840.h>
 
-#include "cx25840.h"
+#include "cx25840-core.h"
 
 static int set_audclk_freq(struct i2c_client *client, u32 freq)
 {
diff --git a/drivers/media/video/cx25840/cx25840-core.c b/drivers/media/video/cx25840/cx25840-core.c
index a65b3cc4bf03..a961bb2ab0fd 100644
--- a/drivers/media/video/cx25840/cx25840-core.c
+++ b/drivers/media/video/cx25840/cx25840-core.c
@@ -32,8 +32,9 @@
 #include <linux/videodev2.h>
 #include <linux/i2c.h>
 #include <media/v4l2-common.h>
+#include <media/cx25840.h>
 
-#include "cx25840.h"
+#include "cx25840-core.h"
 
 MODULE_DESCRIPTION("Conexant CX25840 audio/video decoder driver");
 MODULE_AUTHOR("Ulf Eklund, Chris Kennedy, Hans Verkuil, Tyler Trafford");
@@ -668,6 +669,7 @@ static int cx25840_command(struct i2c_client *client, unsigned int cmd,
 {
         struct cx25840_state *state = i2c_get_clientdata(client);
         struct v4l2_tuner *vt = arg;
+        struct v4l2_routing *route = arg;
 
         switch (cmd) {
 #ifdef CONFIG_VIDEO_ADV_DEBUG
@@ -749,19 +751,21 @@ static int cx25840_command(struct i2c_client *client, unsigned int cmd,
                 state->radio = 1;
                 break;
 
-        case VIDIOC_G_INPUT:
-                *(int *)arg = state->vid_input;
+        case VIDIOC_INT_G_VIDEO_ROUTING:
+                route->input = state->vid_input;
+                route->output = 0;
                 break;
 
-        case VIDIOC_S_INPUT:
-                return set_input(client, *(enum cx25840_video_input *)arg, state->aud_input);
+        case VIDIOC_INT_S_VIDEO_ROUTING:
+                return set_input(client, route->input, state->aud_input);
 
-        case VIDIOC_S_AUDIO:
-        {
-                struct v4l2_audio *input = arg;
+        case VIDIOC_INT_G_AUDIO_ROUTING:
+                route->input = state->aud_input;
+                route->output = 0;
+                break;
 
-                return set_input(client, state->vid_input, input->index);
-        }
+        case VIDIOC_INT_S_AUDIO_ROUTING:
+                return set_input(client, state->vid_input, route->input);
 
         case VIDIOC_S_FREQUENCY:
                 input_change(client);
diff --git a/drivers/media/video/cx25840/cx25840.h b/drivers/media/video/cx25840/cx25840-core.h
index dd70664d1dd9..1736929fc204 100644
--- a/drivers/media/video/cx25840/cx25840.h
+++ b/drivers/media/video/cx25840/cx25840-core.h
@@ -1,4 +1,4 @@
-/* cx25840 API header
+/* cx25840 internal API header
  *
  * Copyright (C) 2003-2004 Chris Kennedy
  *
@@ -17,8 +17,8 @@
  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
  */
 
-#ifndef _CX25840_H_
-#define _CX25840_H_
+#ifndef _CX25840_CORE_H_
+#define _CX25840_CORE_H_
 
 
 #include <linux/videodev2.h>
@@ -32,46 +32,6 @@
    providing this information. */
 #define CX25840_CID_ENABLE_PVR150_WORKAROUND (V4L2_CID_PRIVATE_BASE+0)
 
-enum cx25840_video_input {
-        /* Composite video inputs In1-In8 */
-        CX25840_COMPOSITE1 = 1,
-        CX25840_COMPOSITE2,
-        CX25840_COMPOSITE3,
-        CX25840_COMPOSITE4,
-        CX25840_COMPOSITE5,
-        CX25840_COMPOSITE6,
-        CX25840_COMPOSITE7,
-        CX25840_COMPOSITE8,
-
-        /* S-Video inputs consist of one luma input (In1-In4) ORed with one
-           chroma input (In5-In8) */
-        CX25840_SVIDEO_LUMA1 = 0x10,
-        CX25840_SVIDEO_LUMA2 = 0x20,
-        CX25840_SVIDEO_LUMA3 = 0x30,
-        CX25840_SVIDEO_LUMA4 = 0x40,
-        CX25840_SVIDEO_CHROMA4 = 0x400,
-        CX25840_SVIDEO_CHROMA5 = 0x500,
-        CX25840_SVIDEO_CHROMA6 = 0x600,
-        CX25840_SVIDEO_CHROMA7 = 0x700,
-        CX25840_SVIDEO_CHROMA8 = 0x800,
-
-        /* S-Video aliases for common luma/chroma combinations */
-        CX25840_SVIDEO1 = 0x510,
-        CX25840_SVIDEO2 = 0x620,
-        CX25840_SVIDEO3 = 0x730,
-        CX25840_SVIDEO4 = 0x840,
-};
-
-enum cx25840_audio_input {
-        /* Audio inputs: serial or In4-In8 */
-        CX25840_AUDIO_SERIAL,
-        CX25840_AUDIO4 = 4,
-        CX25840_AUDIO5,
-        CX25840_AUDIO6,
-        CX25840_AUDIO7,
-        CX25840_AUDIO8,
-};
-
 struct cx25840_state {
         int pvr150_workaround;
         int radio;
diff --git a/drivers/media/video/cx25840/cx25840-firmware.c b/drivers/media/video/cx25840/cx25840-firmware.c
index e1a7823d82cd..f59ced181c55 100644
--- a/drivers/media/video/cx25840/cx25840-firmware.c
+++ b/drivers/media/video/cx25840/cx25840-firmware.c
@@ -20,11 +20,22 @@
 #include <linux/i2c-algo-bit.h>
 #include <linux/firmware.h>
 #include <media/v4l2-common.h>
+#include <media/cx25840.h>
 
-#include "cx25840.h"
+#include "cx25840-core.h"
 
 #define FWFILE "v4l-cx25840.fw"
-#define FWSEND 1024
+
+/*
+ * Mike Isely <isely@pobox.com> - The FWSEND parameter controls the
+ * size of the firmware chunks sent down the I2C bus to the chip.
+ * Previously this had been set to 1024 but unfortunately some I2C
+ * implementations can't transfer data in such big gulps.
+ * Specifically, the pvrusb2 driver has a hard limit of around 60
+ * bytes, due to the encapsulation there of I2C traffic into USB
+ * messages.  So we have to significantly reduce this parameter.
+ */
+#define FWSEND 48
 
 #define FWDEV(x) &((x)->adapter->dev)
 
diff --git a/drivers/media/video/cx25840/cx25840-vbi.c b/drivers/media/video/cx25840/cx25840-vbi.c
index e96fd1f1d6dc..57feca288d2b 100644
--- a/drivers/media/video/cx25840/cx25840-vbi.c
+++ b/drivers/media/video/cx25840/cx25840-vbi.c
@@ -19,8 +19,9 @@
 #include <linux/videodev2.h>
 #include <linux/i2c.h>
 #include <media/v4l2-common.h>
+#include <media/cx25840.h>
 
-#include "cx25840.h"
+#include "cx25840-core.h"
 
 static int odd_parity(u8 c)
 {
@@ -151,7 +152,7 @@ int cx25840_vbi(struct i2c_client *client, unsigned int cmd, void *arg)
         case VIDIOC_G_FMT:
         {
                 static u16 lcr2vbi[] = {
-                        0, V4L2_SLICED_TELETEXT_PAL_B, 0,       /* 1 */
+                        0, V4L2_SLICED_TELETEXT_B, 0,   /* 1 */
                         0, V4L2_SLICED_WSS_625, 0,      /* 4 */
                         V4L2_SLICED_CAPTION_525,        /* 6 */
                         0, 0, V4L2_SLICED_VPS, 0, 0,    /* 9 */
@@ -231,7 +232,7 @@ int cx25840_vbi(struct i2c_client *client, unsigned int cmd, void *arg)
                 for (i = 7; i <= 23; i++) {
                         for (x = 0; x <= 1; x++) {
                                 switch (svbi->service_lines[1-x][i]) {
-                                case V4L2_SLICED_TELETEXT_PAL_B:
+                                case V4L2_SLICED_TELETEXT_B:
                                         lcr[i] |= 1 << (4 * x);
                                         break;
                                 case V4L2_SLICED_WSS_625:
@@ -282,7 +283,7 @@ int cx25840_vbi(struct i2c_client *client, unsigned int cmd, void *arg)
 
                 switch (id2) {
                 case 1:
-                        id2 = V4L2_SLICED_TELETEXT_PAL_B;
+                        id2 = V4L2_SLICED_TELETEXT_B;
                         break;
                 case 4:
                         id2 = V4L2_SLICED_WSS_625;
diff --git a/drivers/media/video/cx88/Kconfig b/drivers/media/video/cx88/Kconfig
index ff0f72340d69..630273992a41 100644
--- a/drivers/media/video/cx88/Kconfig
+++ b/drivers/media/video/cx88/Kconfig
@@ -1,3 +1,7 @@
+config VIDEO_CX88_VP3054
+        tristate
+        depends on VIDEO_CX88_DVB && DVB_MT352
+
 config VIDEO_CX88
         tristate "Conexant 2388x (bt878 successor) support"
         depends on VIDEO_DEV && PCI && I2C
@@ -25,7 +29,7 @@ config VIDEO_CX88_ALSA
 
           It only works with boards with function 01 enabled.
           To check if your board supports, use lspci -n.
-          If supported, you should see 1471:8801 or 1471:8811
+          If supported, you should see 14f1:8801 or 14f1:8811
           PCI device.
 
           To compile this driver as a module, choose M here: the
@@ -73,10 +77,11 @@ config VIDEO_CX88_DVB_MT352
           This adds DVB-T support for cards based on the
           Connexant 2388x chip and the MT352 demodulator.
 
-config VIDEO_CX88_VP3054
-        tristate "VP-3054 Secondary I2C Bus Support"
-        default m
-        depends on DVB_MT352
+config VIDEO_CX88_DVB_VP3054
+        bool "VP-3054 Secondary I2C Bus Support"
+        default y
+        depends on VIDEO_CX88_DVB_MT352
+        select VIDEO_CX88_VP3054
         ---help---
           This adds DVB-T support for cards based on the
           Connexant 2388x chip and the MT352 demodulator,
diff --git a/drivers/media/video/cx88/Makefile b/drivers/media/video/cx88/Makefile
index 6482b9aa6a1f..0dcd09b9b727 100644
--- a/drivers/media/video/cx88/Makefile
+++ b/drivers/media/video/cx88/Makefile
@@ -8,9 +8,9 @@ obj-$(CONFIG_VIDEO_CX88_DVB) += cx88-dvb.o
 obj-$(CONFIG_VIDEO_CX88_ALSA) += cx88-alsa.o
 obj-$(CONFIG_VIDEO_CX88_VP3054) += cx88-vp3054-i2c.o
 
-EXTRA_CFLAGS += -I$(src)/..
-EXTRA_CFLAGS += -I$(srctree)/drivers/media/dvb/dvb-core
-EXTRA_CFLAGS += -I$(srctree)/drivers/media/dvb/frontends
+EXTRA_CFLAGS += -Idrivers/media/video
+EXTRA_CFLAGS += -Idrivers/media/dvb/dvb-core
+EXTRA_CFLAGS += -Idrivers/media/dvb/frontends
 
 extra-cflags-$(CONFIG_VIDEO_BUF_DVB) += -DHAVE_VIDEO_BUF_DVB=1
 extra-cflags-$(CONFIG_DVB_CX22702)   += -DHAVE_CX22702=1
diff --git a/drivers/media/video/em28xx/Makefile b/drivers/media/video/em28xx/Makefile
index da457a05b0dd..826d0e340753 100644
--- a/drivers/media/video/em28xx/Makefile
+++ b/drivers/media/video/em28xx/Makefile
@@ -3,4 +3,4 @@ em28xx-objs     := em28xx-video.o em28xx-i2c.o em28xx-cards.o em28xx-core.o \
 
 obj-$(CONFIG_VIDEO_EM28XX) += em28xx.o
 
-EXTRA_CFLAGS += -I$(src)/..
+EXTRA_CFLAGS += -Idrivers/media/video
diff --git a/drivers/media/video/em28xx/em28xx-cards.c b/drivers/media/video/em28xx/em28xx-cards.c
index f62fd706b45a..3ba3439db580 100644
--- a/drivers/media/video/em28xx/em28xx-cards.c
+++ b/drivers/media/video/em28xx/em28xx-cards.c
@@ -151,8 +151,8 @@ struct em28xx_board em28xx_boards[] = {
                 },{
                         .type     = EM28XX_VMUX_SVIDEO,
                         .vmux     = 2,
-                        .amux     = MSP_INPUT(MSP_IN_SCART_1, MSP_IN_TUNER_1,
-                                        MSP_DSP_OUT_SCART, MSP_DSP_OUT_SCART),
+                        .amux     = MSP_INPUT(MSP_IN_SCART1, MSP_IN_TUNER1,
+                                        MSP_DSP_IN_SCART, MSP_DSP_IN_SCART),
                 }},
         },
         [EM2820_BOARD_MSI_VOX_USB_2] = {
diff --git a/drivers/media/video/em28xx/em28xx-video.c b/drivers/media/video/em28xx/em28xx-video.c
index dfba33d0fa61..ddc92cbb5276 100644
--- a/drivers/media/video/em28xx/em28xx-video.c
+++ b/drivers/media/video/em28xx/em28xx-video.c
@@ -222,7 +222,7 @@ static void video_mux(struct em28xx *dev, int index)
                 if (dev->i2s_speed)
                         em28xx_i2c_call_clients(dev, VIDIOC_INT_I2S_CLOCK_FREQ, &dev->i2s_speed);
                 route.input = dev->ctl_ainput;
-                route.output = MSP_OUTPUT(MSP_OUT_SCART1_DA);
+                route.output = MSP_OUTPUT(MSP_SC_IN_DSP_SCART1);
                 /* Note: this is msp3400 specific */
                 em28xx_i2c_call_clients(dev, VIDIOC_INT_S_AUDIO_ROUTING, &route);
                 ainput = EM28XX_AUDIO_SRC_TUNER;
@@ -1141,26 +1141,16 @@ static int em28xx_do_ioctl(struct inode *inode, struct file *filp,
         case VIDIOC_G_TUNER:
         {
                 struct v4l2_tuner *t = arg;
-                int status = 0;
 
                 if (0 != t->index)
                         return -EINVAL;
 
                 memset(t, 0, sizeof(*t));
                 strcpy(t->name, "Tuner");
-                t->type = V4L2_TUNER_ANALOG_TV;
-                t->capability = V4L2_TUNER_CAP_NORM;
-                t->rangehigh = 0xffffffffUL;    /* FIXME: set correct range */
-/*              t->signal = 0xffff;*/
-/*              em28xx_i2c_call_clients(dev,VIDIOC_G_TUNER,t);*/
-                /* No way to get signal strength? */
                 mutex_lock(&dev->lock);
-                em28xx_i2c_call_clients(dev, DECODER_GET_STATUS,
-                                        &status);
+                /* let clients fill in the remainder of this struct */
+                em28xx_i2c_call_clients(dev, cmd, t);
                 mutex_unlock(&dev->lock);
-                t->signal =
-                        (status & DECODER_STATUS_GOOD) != 0 ? 0xffff : 0;
-
                 em28xx_videodbg("VIDIO_G_TUNER: signal=%x, afc=%x\n", t->signal,
                                 t->afc);
                 return 0;
@@ -1168,26 +1158,13 @@ static int em28xx_do_ioctl(struct inode *inode, struct file *filp,
         case VIDIOC_S_TUNER:
         {
                 struct v4l2_tuner *t = arg;
-                int status = 0;
 
                 if (0 != t->index)
                         return -EINVAL;
-                memset(t, 0, sizeof(*t));
-                strcpy(t->name, "Tuner");
-                t->type = V4L2_TUNER_ANALOG_TV;
-                t->capability = V4L2_TUNER_CAP_NORM;
-                t->rangehigh = 0xffffffffUL;    /* FIXME: set correct range */
-/*              t->signal = 0xffff; */
-                /* No way to get signal strength? */
                 mutex_lock(&dev->lock);
-                em28xx_i2c_call_clients(dev, DECODER_GET_STATUS,
-                                        &status);
+                /* let clients handle this */
+                em28xx_i2c_call_clients(dev, cmd, t);
                 mutex_unlock(&dev->lock);
-                t->signal =
-                        (status & DECODER_STATUS_GOOD) != 0 ? 0xffff : 0;
-
-                em28xx_videodbg("VIDIO_S_TUNER: signal=%x, afc=%x\n",
-                                t->signal, t->afc);
                 return 0;
         }
         case VIDIOC_G_FREQUENCY:
diff --git a/drivers/media/video/et61x251/Kconfig b/drivers/media/video/et61x251/Kconfig
new file mode 100644
index 000000000000..6c43a90c6569
--- /dev/null
+++ b/drivers/media/video/et61x251/Kconfig
@@ -0,0 +1,14 @@
+config USB_ET61X251
+        tristate "USB ET61X[12]51 PC Camera Controller support"
+        depends on USB && VIDEO_DEV
+        ---help---
+          Say Y here if you want support for cameras based on Etoms ET61X151
+          or ET61X251 PC Camera Controllers.
+
+          See <file:Documentation/video4linux/et61x251.txt> for more info.
+
+          This driver uses the Video For Linux API. You must say Y or M to
+          "Video For Linux" to use this driver.
+
+          To compile this driver as a module, choose M here: the
+          module will be called et61x251.
diff --git a/drivers/media/video/ir-kbd-i2c.c b/drivers/media/video/ir-kbd-i2c.c
index 95bacf435414..7e66d83fe0ce 100644
--- a/drivers/media/video/ir-kbd-i2c.c
+++ b/drivers/media/video/ir-kbd-i2c.c
@@ -411,6 +411,9 @@ static int ir_probe(struct i2c_adapter *adap)
         case I2C_HW_B_BT848:
                 probe = probe_bttv;
                 break;
+        case I2C_HW_B_CX2341X:
+                probe = probe_bttv;
+                break;
         case I2C_HW_SAA7134:
                 probe = probe_saa7134;
                 break;
diff --git a/drivers/media/video/msp3400-driver.c b/drivers/media/video/msp3400-driver.c
index c40e8ba9a2ea..b806999d6e0f 100644
--- a/drivers/media/video/msp3400-driver.c
+++ b/drivers/media/video/msp3400-driver.c
@@ -279,20 +279,8 @@ void msp_set_scart(struct i2c_client *client, int in, int out)
         msp_write_dsp(client, 0x13, state->acb);
 
         /* Sets I2S speed 0 = 1.024 Mbps, 1 = 2.048 Mbps */
-        msp_write_dem(client, 0x40, state->i2s_mode);
-}
-
-void msp_set_mute(struct i2c_client *client)
-{
-        struct msp_state *state = i2c_get_clientdata(client);
-
-        v4l_dbg(1, msp_debug, client, "mute audio\n");
-        msp_write_dsp(client, 0x0000, 0);
-        msp_write_dsp(client, 0x0007, 1);
-        if (state->has_scart2_out_volume)
-                msp_write_dsp(client, 0x0040, 1);
-        if (state->has_headphones)
-                msp_write_dsp(client, 0x0006, 0);
+        if (state->has_i2s_conf)
+                msp_write_dem(client, 0x40, state->i2s_mode);
 }
 
 void msp_set_audio(struct i2c_client *client)
@@ -300,17 +288,19 @@ void msp_set_audio(struct i2c_client *client)
         struct msp_state *state = i2c_get_clientdata(client);
         int bal = 0, bass, treble, loudness;
         int val = 0;
+        int reallymuted = state->muted | state->scan_in_progress;
 
-        if (!state->muted)
+        if (!reallymuted)
                 val = (state->volume * 0x7f / 65535) << 8;
 
-        v4l_dbg(1, msp_debug, client, "mute=%s volume=%d\n",
-                state->muted ? "on" : "off", state->volume);
+        v4l_dbg(1, msp_debug, client, "mute=%s scanning=%s volume=%d\n",
+                state->muted ? "on" : "off", state->scan_in_progress ? "yes" : "no",
+                state->volume);
 
         msp_write_dsp(client, 0x0000, val);
-        msp_write_dsp(client, 0x0007, state->muted ? 0x1 : (val | 0x1));
+        msp_write_dsp(client, 0x0007, reallymuted ? 0x1 : (val | 0x1));
         if (state->has_scart2_out_volume)
-                msp_write_dsp(client, 0x0040, state->muted ? 0x1 : (val | 0x1));
+                msp_write_dsp(client, 0x0040, reallymuted ? 0x1 : (val | 0x1));
         if (state->has_headphones)
                 msp_write_dsp(client, 0x0006, val);
         if (!state->has_sound_processing)
@@ -346,7 +336,6 @@ static void msp_wake_thread(struct i2c_client *client)
 
         if (NULL == state->kthread)
                 return;
-        msp_set_mute(client);
         state->watch_stereo = 0;
         state->restart = 1;
         wake_up_interruptible(&state->wq);
@@ -374,19 +363,15 @@ int msp_sleep(struct msp_state *state, int timeout)
 
 /* ------------------------------------------------------------------------ */
 
-static int msp_mode_v4l2_to_v4l1(int rxsubchans)
+static int msp_mode_v4l2_to_v4l1(int rxsubchans, int audmode)
 {
-        int mode = 0;
-
-        if (rxsubchans & V4L2_TUNER_SUB_STEREO)
-                mode |= VIDEO_SOUND_STEREO;
-        if (rxsubchans & V4L2_TUNER_SUB_LANG2)
-                mode |= VIDEO_SOUND_LANG2 | VIDEO_SOUND_STEREO;
-        if (rxsubchans & V4L2_TUNER_SUB_LANG1)
-                mode |= VIDEO_SOUND_LANG1 | VIDEO_SOUND_STEREO;
-        if (mode == 0)
-                mode |= VIDEO_SOUND_MONO;
-        return mode;
+        if (rxsubchans == V4L2_TUNER_SUB_MONO)
+                return VIDEO_SOUND_MONO;
+        if (rxsubchans == V4L2_TUNER_SUB_STEREO)
+                return VIDEO_SOUND_STEREO;
+        if (audmode == V4L2_TUNER_MODE_LANG2)
+                return VIDEO_SOUND_LANG2;
+        return VIDEO_SOUND_LANG1;
 }
 
 static int msp_mode_v4l1_to_v4l2(int mode)
@@ -605,7 +590,7 @@ static int msp_command(struct i2c_client *client, unsigned int cmd, void *arg)
                         break;
                 if (state->opmode == OPMODE_AUTOSELECT)
                         msp_detect_stereo(client);
-                va->mode = msp_mode_v4l2_to_v4l1(state->rxsubchans);
+                va->mode = msp_mode_v4l2_to_v4l1(state->rxsubchans, state->audmode);
                 break;
         }
 
@@ -620,7 +605,8 @@ static int msp_command(struct i2c_client *client, unsigned int cmd, void *arg)
                 state->treble = va->treble;
                 msp_set_audio(client);
 
-                if (va->mode != 0 && state->radio == 0) {
+                if (va->mode != 0 && state->radio == 0 &&
+                    state->audmode != msp_mode_v4l1_to_v4l2(va->mode)) {
                         state->audmode = msp_mode_v4l1_to_v4l2(va->mode);
                         msp_set_audmode(client);
                 }
@@ -687,21 +673,23 @@ static int msp_command(struct i2c_client *client, unsigned int cmd, void *arg)
                 int sc_in = rt->input & 0x7;
                 int sc1_out = rt->output & 0xf;
                 int sc2_out = (rt->output >> 4) & 0xf;
-                u16 val;
+                u16 val, reg;
 
+                if (state->routing.input == rt->input &&
+                    state->routing.output == rt->output)
+                        break;
                 state->routing = *rt;
-                if (state->opmode == OPMODE_AUTOSELECT) {
-                        val = msp_read_dem(client, 0x30) & ~0x100;
-                        msp_write_dem(client, 0x30, val | (tuner ? 0x100 : 0));
-                } else {
-                        val = msp_read_dem(client, 0xbb) & ~0x100;
-                        msp_write_dem(client, 0xbb, val | (tuner ? 0x100 : 0));
-                }
                 msp_set_scart(client, sc_in, 0);
                 msp_set_scart(client, sc1_out, 1);
                 msp_set_scart(client, sc2_out, 2);
                 msp_set_audmode(client);
-                msp_wake_thread(client);
+                reg = (state->opmode == OPMODE_AUTOSELECT) ? 0x30 : 0xbb;
+                val = msp_read_dem(client, reg);
+                if (tuner != ((val >> 8) & 1)) {
+                        msp_write_dem(client, reg, (val & ~0x100) | (tuner << 8));
+                        /* wake thread when a new tuner input is chosen */
+                        msp_wake_thread(client);
+                }
                 break;
         }
 
@@ -715,7 +703,7 @@ static int msp_command(struct i2c_client *client, unsigned int cmd, void *arg)
                         msp_detect_stereo(client);
                 vt->audmode    = state->audmode;
                 vt->rxsubchans = state->rxsubchans;
-                vt->capability = V4L2_TUNER_CAP_STEREO |
+                vt->capability |= V4L2_TUNER_CAP_STEREO |
                         V4L2_TUNER_CAP_LANG1 | V4L2_TUNER_CAP_LANG2;
                 break;
         }
@@ -726,6 +714,8 @@ static int msp_command(struct i2c_client *client, unsigned int cmd, void *arg)
 
                 if (state->radio)  /* TODO: add mono/stereo support for radio */
                         break;
+                if (state->audmode == vt->audmode)
+                        break;
                 state->audmode = vt->audmode;
                 /* only set audmode */
                 msp_set_audmode(client);
@@ -887,7 +877,7 @@ static int msp_attach(struct i2c_adapter *adapter, int address, int kind)
 
         memset(state, 0, sizeof(*state));
         state->v4l2_std = V4L2_STD_NTSC;
-        state->audmode = V4L2_TUNER_MODE_LANG1;
+        state->audmode = V4L2_TUNER_MODE_STEREO;
         state->volume = 58880;  /* 0db gain */
         state->balance = 32768; /* 0db gain */
         state->bass = 32768;
@@ -931,13 +921,16 @@ static int msp_attach(struct i2c_adapter *adapter, int address, int kind)
         state->has_radio = msp_revision >= 'G';
         /* Has headphones output: not for stripped down products */
         state->has_headphones = msp_prod_lo < 5;
+        /* Has scart2 input: not in stripped down products of the '3' family */
+        state->has_scart2 = msp_family >= 4 || msp_prod_lo < 7;
+        /* Has scart3 input: not in stripped down products of the '3' family */
+        state->has_scart3 = msp_family >= 4 || msp_prod_lo < 5;
         /* Has scart4 input: not in pre D revisions, not in stripped D revs */
         state->has_scart4 = msp_family >= 4 || (msp_revision >= 'D' && msp_prod_lo < 5);
-        /* Has scart2 and scart3 inputs and scart2 output: not in stripped
-           down products of the '3' family */
-        state->has_scart23_in_scart2_out = msp_family >= 4 || msp_prod_lo < 5;
+        /* Has scart2 output: not in stripped down products of the '3' family */
+        state->has_scart2_out = msp_family >= 4 || msp_prod_lo < 5;
         /* Has scart2 a volume control? Not in pre-D revisions. */
-        state->has_scart2_out_volume = msp_revision > 'C' && state->has_scart23_in_scart2_out;
+        state->has_scart2_out_volume = msp_revision > 'C' && state->has_scart2_out;
         /* Has a configurable i2s out? */
         state->has_i2s_conf = msp_revision >= 'G' && msp_prod_lo < 7;
         /* Has subwoofer output: not in pre-D revs and not in stripped down products */
diff --git a/drivers/media/video/msp3400-driver.h b/drivers/media/video/msp3400-driver.h
index 1940748bb633..4e451049013d 100644
--- a/drivers/media/video/msp3400-driver.h
+++ b/drivers/media/video/msp3400-driver.h
@@ -54,8 +54,10 @@ struct msp_state {
         u8 has_radio;
         u8 has_headphones;
         u8 has_ntsc_jp_d_k3;
+        u8 has_scart2;
+        u8 has_scart3;
         u8 has_scart4;
-        u8 has_scart23_in_scart2_out;
+        u8 has_scart2_out;
         u8 has_scart2_out_volume;
         u8 has_i2s_conf;
         u8 has_subwoofer;
@@ -83,6 +85,7 @@ struct msp_state {
         int volume, muted;
         int balance, loudness;
         int bass, treble;
+        int scan_in_progress;
 
         /* thread */
         struct task_struct   *kthread;
@@ -98,7 +101,6 @@ int msp_read_dem(struct i2c_client *client, int addr);
 int msp_read_dsp(struct i2c_client *client, int addr);
 int msp_reset(struct i2c_client *client);
 void msp_set_scart(struct i2c_client *client, int in, int out);
-void msp_set_mute(struct i2c_client *client);
 void msp_set_audio(struct i2c_client *client);
 int msp_sleep(struct msp_state *state, int timeout);
 
diff --git a/drivers/media/video/msp3400-kthreads.c b/drivers/media/video/msp3400-kthreads.c
index c3984ea9ca07..633a10213789 100644
--- a/drivers/media/video/msp3400-kthreads.c
+++ b/drivers/media/video/msp3400-kthreads.c
@@ -170,7 +170,7 @@ static void msp_set_source(struct i2c_client *client, u16 src)
         msp_write_dsp(client, 0x000a, src);
         msp_write_dsp(client, 0x000b, src);
         msp_write_dsp(client, 0x000c, src);
-        if (state->has_scart23_in_scart2_out)
+        if (state->has_scart2_out)
                 msp_write_dsp(client, 0x0041, src);
 }
 
@@ -228,6 +228,7 @@ static void msp3400c_set_audmode(struct i2c_client *client)
         char *modestr = (state->audmode >= 0 && state->audmode < 5) ?
                 strmode[state->audmode] : "unknown";
         int src = 0;    /* channel source: FM/AM, nicam or SCART */
+        int audmode = state->audmode;
 
         if (state->opmode == OPMODE_AUTOSELECT) {
                 /* this method would break everything, let's make sure
@@ -239,11 +240,29 @@ static void msp3400c_set_audmode(struct i2c_client *client)
                 return;
         }
 
+        /* Note: for the C and D revs no NTSC stereo + SAP is possible as
+           the hardware does not support SAP. So the rxsubchans combination
+           of STEREO | LANG2 does not occur. */
+
+        /* switch to mono if only mono is available */
+        if (state->rxsubchans == V4L2_TUNER_SUB_MONO)
+                audmode = V4L2_TUNER_MODE_MONO;
+        /* if bilingual */
+        else if (state->rxsubchans & V4L2_TUNER_SUB_LANG2) {
+                /* and mono or stereo, then fallback to lang1 */
+                if (audmode == V4L2_TUNER_MODE_MONO ||
+                    audmode == V4L2_TUNER_MODE_STEREO)
+                        audmode = V4L2_TUNER_MODE_LANG1;
+        }
+        /* if stereo, and audmode is not mono, then switch to stereo */
+        else if (audmode != V4L2_TUNER_MODE_MONO)
+                audmode = V4L2_TUNER_MODE_STEREO;
+
         /* switch demodulator */
         switch (state->mode) {
         case MSP_MODE_FM_TERRA:
                 v4l_dbg(1, msp_debug, client, "FM set_audmode: %s\n", modestr);
-                switch (state->audmode) {
+                switch (audmode) {
                 case V4L2_TUNER_MODE_STEREO:
                         msp_write_dsp(client, 0x000e, 0x3001);
                         break;
@@ -257,7 +276,7 @@ static void msp3400c_set_audmode(struct i2c_client *client)
                 break;
         case MSP_MODE_FM_SAT:
                 v4l_dbg(1, msp_debug, client, "SAT set_audmode: %s\n", modestr);
-                switch (state->audmode) {
+                switch (audmode) {
                 case V4L2_TUNER_MODE_MONO:
                         msp3400c_set_carrier(client, MSP_CARRIER(6.5), MSP_CARRIER(6.5));
                         break;
@@ -296,7 +315,8 @@ static void msp3400c_set_audmode(struct i2c_client *client)
         }
 
         /* switch audio */
-        switch (state->audmode) {
+        v4l_dbg(1, msp_debug, client, "set audmode %d\n", audmode);
+        switch (audmode) {
         case V4L2_TUNER_MODE_STEREO:
         case V4L2_TUNER_MODE_LANG1_LANG2:
                 src |= 0x0020;
@@ -314,10 +334,6 @@ static void msp3400c_set_audmode(struct i2c_client *client)
                         src = 0x0030;
                 break;
         case V4L2_TUNER_MODE_LANG1:
-                /* switch to stereo for stereo transmission, otherwise
-                   keep first language */
-                if (state->rxsubchans & V4L2_TUNER_SUB_STEREO)
-                        src |= 0x0020;
                 break;
         case V4L2_TUNER_MODE_LANG2:
                 src |= 0x0010;
@@ -367,7 +383,7 @@ static int msp3400c_detect_stereo(struct i2c_client *client)
                 if (val > 32767)
                         val -= 65536;
                 v4l_dbg(2, msp_debug, client, "stereo detect register: %d\n", val);
-                if (val > 4096) {
+                if (val > 8192) {
                         rxsubchans = V4L2_TUNER_SUB_STEREO;
                 } else if (val < -4096) {
                         rxsubchans = V4L2_TUNER_SUB_LANG1 | V4L2_TUNER_SUB_LANG2;
@@ -464,19 +480,22 @@ int msp3400c_thread(void *data)
                 if (state->radio || MSP_MODE_EXTERN == state->mode) {
                         /* no carrier scan, just unmute */
                         v4l_dbg(1, msp_debug, client, "thread: no carrier scan\n");
+                        state->scan_in_progress = 0;
                         msp_set_audio(client);
                         continue;
                 }
 
-                /* mute */
-                msp_set_mute(client);
+                /* mute audio */
+                state->scan_in_progress = 1;
+                msp_set_audio(client);
+
                 msp3400c_set_mode(client, MSP_MODE_AM_DETECT);
                 val1 = val2 = 0;
                 max1 = max2 = -1;
                 state->watch_stereo = 0;
                 state->nicam_on = 0;
 
-                /* some time for the tuner to sync */
+                /* wait for tuner to settle down after a channel change */
                 if (msp_sleep(state, 200))
                         goto restart;
 
@@ -552,7 +571,6 @@ int msp3400c_thread(void *data)
                                 /* B/G NICAM */
                                 state->second = msp3400c_carrier_detect_55[max2].cdo;
                                 msp3400c_set_mode(client, MSP_MODE_FM_NICAM1);
-                                msp3400c_set_carrier(client, state->second, state->main);
                                 state->nicam_on = 1;
                                 state->watch_stereo = 1;
                         } else {
@@ -563,7 +581,6 @@ int msp3400c_thread(void *data)
                         /* PAL I NICAM */
                         state->second = MSP_CARRIER(6.552);
                         msp3400c_set_mode(client, MSP_MODE_FM_NICAM2);
-                        msp3400c_set_carrier(client, state->second, state->main);
                         state->nicam_on = 1;
                         state->watch_stereo = 1;
                         break;
@@ -577,13 +594,11 @@ int msp3400c_thread(void *data)
                                 /* L NICAM or AM-mono */
                                 state->second = msp3400c_carrier_detect_65[max2].cdo;
                                 msp3400c_set_mode(client, MSP_MODE_AM_NICAM);
-                                msp3400c_set_carrier(client, state->second, state->main);
                                 state->watch_stereo = 1;
                         } else if (max2 == 0 && state->has_nicam) {
                                 /* D/K NICAM */
                                 state->second = msp3400c_carrier_detect_65[max2].cdo;
                                 msp3400c_set_mode(client, MSP_MODE_FM_NICAM1);
-                                msp3400c_set_carrier(client, state->second, state->main);
                                 state->nicam_on = 1;
                                 state->watch_stereo = 1;
                         } else {
@@ -595,25 +610,25 @@ int msp3400c_thread(void *data)
                 no_second:
                         state->second = msp3400c_carrier_detect_main[max1].cdo;
                         msp3400c_set_mode(client, MSP_MODE_FM_TERRA);
-                        msp3400c_set_carrier(client, state->second, state->main);
-                        state->rxsubchans = V4L2_TUNER_SUB_MONO;
                         break;
                 }
+                msp3400c_set_carrier(client, state->second, state->main);
 
                 /* unmute */
-                msp_set_audio(client);
+                state->scan_in_progress = 0;
                 msp3400c_set_audmode(client);
+                msp_set_audio(client);
 
                 if (msp_debug)
                         msp3400c_print_mode(client);
 
                 /* monitor tv audio mode, the first time don't wait
                    so long to get a quick stereo/bilingual result */
-                if (msp_sleep(state, 1000))
-                        goto restart;
+                count = 3;
                 while (state->watch_stereo) {
-                        if (msp_sleep(state, 5000))
+                        if (msp_sleep(state, count ? 1000 : 5000))
                                 goto restart;
+                        if (count) count--;
                         watch_stereo(client);
                 }
         }
@@ -626,7 +641,7 @@ int msp3410d_thread(void *data)
 {
         struct i2c_client *client = data;
         struct msp_state *state = i2c_get_clientdata(client);
-        int val, i, std;
+        int val, i, std, count;
 
         v4l_dbg(1, msp_debug, client, "msp3410 daemon started\n");
 
@@ -644,16 +659,14 @@ int msp3410d_thread(void *data)
                 if (state->mode == MSP_MODE_EXTERN) {
                         /* no carrier scan needed, just unmute */
                         v4l_dbg(1, msp_debug, client, "thread: no carrier scan\n");
+                        state->scan_in_progress = 0;
                         msp_set_audio(client);
                         continue;
                 }
 
-                /* put into sane state (and mute) */
-                msp_reset(client);
-
-                /* some time for the tuner to sync */
-                if (msp_sleep(state,200))
-                        goto restart;
+                /* mute audio */
+                state->scan_in_progress = 1;
+                msp_set_audio(client);
 
                 /* start autodetect. Note: autodetect is not supported for
                    NTSC-M and radio, hence we force the standard in those cases. */
@@ -664,6 +677,10 @@ int msp3410d_thread(void *data)
                 state->watch_stereo = 0;
                 state->nicam_on = 0;
 
+                /* wait for tuner to settle down after a channel change */
+                if (msp_sleep(state, 200))
+                        goto restart;
+
                 if (msp_debug)
                         v4l_dbg(2, msp_debug, client, "setting standard: %s (0x%04x)\n",
                                msp_standard_std_name(std), std);
@@ -693,6 +710,7 @@ int msp3410d_thread(void *data)
                 state->main   = msp_stdlist[i].main;
                 state->second = msp_stdlist[i].second;
                 state->std = val;
+                state->rxsubchans = V4L2_TUNER_SUB_MONO;
 
                 if (msp_amsound && !state->radio && (state->v4l2_std & V4L2_STD_SECAM) &&
                                 (val != 0x0009)) {
@@ -714,20 +732,17 @@ int msp3410d_thread(void *data)
                         else
                                 state->mode = MSP_MODE_FM_NICAM1;
                         /* just turn on stereo */
-                        state->rxsubchans = V4L2_TUNER_SUB_STEREO;
                         state->nicam_on = 1;
                         state->watch_stereo = 1;
                         break;
                 case 0x0009:
                         state->mode = MSP_MODE_AM_NICAM;
-                        state->rxsubchans = V4L2_TUNER_SUB_MONO;
                         state->nicam_on = 1;
                         state->watch_stereo = 1;
                         break;
                 case 0x0020: /* BTSC */
                         /* The pre-'G' models only have BTSC-mono */
                         state->mode = MSP_MODE_BTSC;
-                        state->rxsubchans = V4L2_TUNER_SUB_MONO;
                         break;
                 case 0x0040: /* FM radio */
                         state->mode = MSP_MODE_FM_RADIO;
@@ -737,15 +752,12 @@ int msp3410d_thread(void *data)
                         msp3400c_set_mode(client, MSP_MODE_FM_RADIO);
                         msp3400c_set_carrier(client, MSP_CARRIER(10.7),
                                             MSP_CARRIER(10.7));
-                        /* scart routing (this doesn't belong here I think) */
-                        msp_set_scart(client,SCART_IN2,0);
                         break;
                 case 0x0002:
                 case 0x0003:
                 case 0x0004:
                 case 0x0005:
                         state->mode = MSP_MODE_FM_TERRA;
-                        state->rxsubchans = V4L2_TUNER_SUB_MONO;
                         state->watch_stereo = 1;
                         break;
                 }
@@ -759,20 +771,19 @@ int msp3410d_thread(void *data)
                 if (state->has_i2s_conf)
                         msp_write_dem(client, 0x40, state->i2s_mode);
 
-                /* unmute, restore misc registers */
-                msp_set_audio(client);
-
-                msp_write_dsp(client, 0x13, state->acb);
+                /* unmute */
                 msp3400c_set_audmode(client);
+                state->scan_in_progress = 0;
+                msp_set_audio(client);
 
                 /* monitor tv audio mode, the first time don't wait
                    so long to get a quick stereo/bilingual result */
-                if (msp_sleep(state, 1000))
-                        goto restart;
+                count = 3;
                 while (state->watch_stereo) {
-                        watch_stereo(client);
-                        if (msp_sleep(state, 5000))
+                        if (msp_sleep(state, count ? 1000 : 5000))
                                 goto restart;
+                        if (count) count--;
+                        watch_stereo(client);
                 }
         }
         v4l_dbg(1, msp_debug, client, "thread: exit\n");
@@ -829,27 +840,27 @@ static void msp34xxg_set_source(struct i2c_client *client, u16 reg, int in)
                 source = 0; /* mono only */
                 matrix = 0x30;
                 break;
-        case V4L2_TUNER_MODE_LANG1:
-                source = 3; /* stereo or A */
-                matrix = 0x00;
-                break;
         case V4L2_TUNER_MODE_LANG2:
                 source = 4; /* stereo or B */
                 matrix = 0x10;
                 break;
-        case V4L2_TUNER_MODE_STEREO:
         case V4L2_TUNER_MODE_LANG1_LANG2:
-        default:
                 source = 1; /* stereo or A|B */
                 matrix = 0x20;
                 break;
+        case V4L2_TUNER_MODE_STEREO:
+        case V4L2_TUNER_MODE_LANG1:
+        default:
+                source = 3; /* stereo or A */
+                matrix = 0x00;
+                break;
         }
 
-        if (in == MSP_DSP_OUT_TUNER)
+        if (in == MSP_DSP_IN_TUNER)
                 source = (source << 8) | 0x20;
         /* the msp34x2g puts the MAIN_AVC, MAIN and AUX sources in 12, 13, 14
            instead of 11, 12, 13. So we add one for that msp version. */
-        else if (in >= MSP_DSP_OUT_MAIN_AVC && state->has_dolby_pro_logic)
+        else if (in >= MSP_DSP_IN_MAIN_AVC && state->has_dolby_pro_logic)
                 source = ((in + 1) << 8) | matrix;
         else
                 source = (in << 8) | matrix;
@@ -869,7 +880,7 @@ static void msp34xxg_set_sources(struct i2c_client *client)
         msp34xxg_set_source(client, 0x000c, (in >> 4) & 0xf);
         msp34xxg_set_source(client, 0x0009, (in >> 8) & 0xf);
         msp34xxg_set_source(client, 0x000a, (in >> 12) & 0xf);
-        if (state->has_scart23_in_scart2_out)
+        if (state->has_scart2_out)
                 msp34xxg_set_source(client, 0x0041, (in >> 16) & 0xf);
         msp34xxg_set_source(client, 0x000b, (in >> 20) & 0xf);
 }
@@ -887,10 +898,6 @@ static void msp34xxg_reset(struct i2c_client *client)
 
         msp_reset(client);
 
-        /* make sure that input/output is muted (paranoid mode) */
-        /* ACB, mute DSP input, mute SCART 1 */
-        msp_write_dsp(client, 0x13, 0x0f20);
-
         if (state->has_i2s_conf)
                 msp_write_dem(client, 0x40, state->i2s_mode);
 
@@ -1028,7 +1035,7 @@ static void msp34xxg_set_audmode(struct i2c_client *client)
 
         if (state->std == 0x20) {
                if ((state->rxsubchans & V4L2_TUNER_SUB_SAP) &&
-                   (state->audmode == V4L2_TUNER_MODE_STEREO ||
+                   (state->audmode == V4L2_TUNER_MODE_LANG1_LANG2 ||
                     state->audmode == V4L2_TUNER_MODE_LANG2)) {
                         msp_write_dem(client, 0x20, 0x21);
                } else {
diff --git a/drivers/media/video/pwc/Kconfig b/drivers/media/video/pwc/Kconfig
new file mode 100644
index 000000000000..86376556f108
--- /dev/null
+++ b/drivers/media/video/pwc/Kconfig
@@ -0,0 +1,28 @@
+config USB_PWC
+        tristate "USB Philips Cameras"
+        depends on USB && VIDEO_DEV
+        ---help---
+          Say Y or M here if you want to use one of these Philips & OEM
+          webcams:
+           * Philips PCA645, PCA646
+           * Philips PCVC675, PCVC680, PCVC690
+           * Philips PCVC720/40, PCVC730, PCVC740, PCVC750
+           * Askey VC010
+           * Logitech QuickCam Pro 3000, 4000, 'Zoom', 'Notebook Pro'
+             and 'Orbit'/'Sphere'
+           * Samsung MPC-C10, MPC-C30
+           * Creative Webcam 5, Pro Ex
+           * SOTEC Afina Eye
+           * Visionite VCS-UC300, VCS-UM100
+
+          The PCA635, PCVC665 and PCVC720/20 are not supported by this driver
+          and never will be, but the 665 and 720/20 are supported by other
+          drivers.
+
+          See <file:Documentation/usb/philips.txt> for more information and
+          installation instructions.
+
+          The built-in microphone is enabled by selecting USB Audio support.
+
+          To compile this driver as a module, choose M here: the
+          module will be called pwc.
diff --git a/drivers/media/video/saa7115.c b/drivers/media/video/saa7115.c
index b05015282601..dceebc0b1250 100644
--- a/drivers/media/video/saa7115.c
+++ b/drivers/media/video/saa7115.c
@@ -40,6 +40,7 @@
 #include <linux/i2c.h>
 #include <linux/videodev2.h>
 #include <media/v4l2-common.h>
+#include <media/saa7115.h>
 #include <asm/div64.h>
 
 MODULE_DESCRIPTION("Philips SAA7113/SAA7114/SAA7115 video decoder driver");
@@ -53,7 +54,7 @@ module_param(debug, bool, 0644);
 MODULE_PARM_DESC(debug, "Debug level (0-1)");
 
 static unsigned short normal_i2c[] = {
-                0x4a >>1, 0x48 >>1,     /* SAA7113 */
+                0x4a >> 1, 0x48 >> 1,   /* SAA7113 */
                 0x42 >> 1, 0x40 >> 1,   /* SAA7114 and SAA7115 */
                 I2C_CLIENT_END };
 
@@ -722,16 +723,16 @@ static void saa7115_set_v4lstd(struct i2c_client *client, v4l2_std_id std)
         100 reserved                    NTSC-Japan (3.58MHz)
         */
         if (state->ident == V4L2_IDENT_SAA7113) {
-                u8 reg =  saa7115_read(client, 0x0e) & 0x8f;
+                u8 reg = saa7115_read(client, 0x0e) & 0x8f;
 
                 if (std == V4L2_STD_PAL_M) {
-                        reg|=0x30;
+                        reg |= 0x30;
                 } else if (std == V4L2_STD_PAL_N) {
-                        reg|=0x20;
+                        reg |= 0x20;
                 } else if (std == V4L2_STD_PAL_60) {
-                        reg|=0x10;
+                        reg |= 0x10;
                 } else if (std == V4L2_STD_NTSC_M_JP) {
-                        reg|=0x40;
+                        reg |= 0x40;
                 }
                 saa7115_write(client, 0x0e, reg);
         }
@@ -811,7 +812,7 @@ static void saa7115_set_lcr(struct i2c_client *client, struct v4l2_sliced_vbi_fo
         u8 lcr[24];
         int i, x;
 
-        /* saa7113/71144 doesn't yet support VBI */
+        /* saa7113/7114 doesn't yet support VBI */
         if (state->ident != V4L2_IDENT_SAA7115)
                 return;
 
@@ -851,7 +852,7 @@ static void saa7115_set_lcr(struct i2c_client *client, struct v4l2_sliced_vbi_fo
                                         case 0:
                                                 lcr[i] |= 0xf << (4 * x);
                                                 break;
-                                        case V4L2_SLICED_TELETEXT_PAL_B:
+                                        case V4L2_SLICED_TELETEXT_B:
                                                 lcr[i] |= 1 << (4 * x);
                                                 break;
                                         case V4L2_SLICED_CAPTION_525:
@@ -880,7 +881,7 @@ static void saa7115_set_lcr(struct i2c_client *client, struct v4l2_sliced_vbi_fo
 static int saa7115_get_v4lfmt(struct i2c_client *client, struct v4l2_format *fmt)
 {
         static u16 lcr2vbi[] = {
-                0, V4L2_SLICED_TELETEXT_PAL_B, 0,       /* 1 */
+                0, V4L2_SLICED_TELETEXT_B, 0,   /* 1 */
                 0, V4L2_SLICED_CAPTION_525,     /* 4 */
                 V4L2_SLICED_WSS_625, 0,         /* 5 */
                 V4L2_SLICED_VPS, 0, 0, 0, 0,    /* 7 */
@@ -1045,7 +1046,7 @@ static void saa7115_decode_vbi_line(struct i2c_client *client,
         /* decode payloads */
         switch (id2) {
         case 1:
-                vbi->type = V4L2_SLICED_TELETEXT_PAL_B;
+                vbi->type = V4L2_SLICED_TELETEXT_B;
                 break;
         case 4:
                 if (!saa7115_odd_parity(p[0]) || !saa7115_odd_parity(p[1]))
@@ -1180,6 +1181,46 @@ static int saa7115_command(struct i2c_client *client, unsigned int cmd, void *ar
                 state->radio = 1;
                 break;
 
+        case VIDIOC_INT_G_VIDEO_ROUTING:
+        {
+                struct v4l2_routing *route = arg;
+
+                route->input = state->input;
+                route->output = 0;
+                break;
+        }
+
+        case VIDIOC_INT_S_VIDEO_ROUTING:
+        {
+                struct v4l2_routing *route = arg;
+
+                v4l_dbg(1, debug, client, "decoder set input %d\n", route->input);
+                /* saa7113 does not have these inputs */
+                if (state->ident == V4L2_IDENT_SAA7113 &&
+                    (route->input == SAA7115_COMPOSITE4 ||
+                     route->input == SAA7115_COMPOSITE5)) {
+                        return -EINVAL;
+                }
+                if (route->input > SAA7115_SVIDEO3)
+                        return -EINVAL;
+                if (state->input == route->input)
+                        break;
+                v4l_dbg(1, debug, client, "now setting %s input\n",
+                        (route->input >= SAA7115_SVIDEO0) ? "S-Video" : "Composite");
+                state->input = route->input;
+
+                /* select mode */
+                saa7115_write(client, 0x02,
+                              (saa7115_read(client, 0x02) & 0xf0) |
+                               state->input);
+
+                /* bypass chrominance trap for S-Video modes */
+                saa7115_write(client, 0x09,
+                              (saa7115_read(client, 0x09) & 0x7f) |
+                               (state->input >= SAA7115_SVIDEO0 ? 0x80 : 0x0));
+                break;
+        }
+
         case VIDIOC_G_INPUT:
                 *(int *)arg = state->input;
                 break;
@@ -1321,7 +1362,7 @@ static int saa7115_attach(struct i2c_adapter *adapter, int address, int kind)
 
         saa7115_write(client, 0, 5);
         chip_id = saa7115_read(client, 0) & 0x0f;
-        if (chip_id <3 && chip_id > 5) {
+        if (chip_id < 3 && chip_id > 5) {
                 v4l_dbg(1, debug, client, "saa7115 not found\n");
                 kfree(client);
                 return 0;
@@ -1360,7 +1401,7 @@ static int saa7115_attach(struct i2c_adapter *adapter, int address, int kind)
         v4l_dbg(1, debug, client, "writing init values\n");
 
         /* init to 60hz/48khz */
-        if (state->ident==V4L2_IDENT_SAA7113)
+        if (state->ident == V4L2_IDENT_SAA7113)
                 saa7115_writeregs(client, saa7113_init_auto_input);
         else
                 saa7115_writeregs(client, saa7115_init_auto_input);
diff --git a/drivers/media/video/saa7127.c b/drivers/media/video/saa7127.c
index 992c71774f30..133f9e5252fe 100644
--- a/drivers/media/video/saa7127.c
+++ b/drivers/media/video/saa7127.c
@@ -54,6 +54,7 @@
 #include <linux/i2c.h>
 #include <linux/videodev2.h>
 #include <media/v4l2-common.h>
+#include <media/saa7127.h>
 
 static int debug = 0;
 static int test_image = 0;
@@ -222,22 +223,6 @@ static struct i2c_reg_value saa7127_init_config_50hz[] = {
         { 0, 0 }
 };
 
-/* Enumeration for the Supported input types */
-enum saa7127_input_type {
-        SAA7127_INPUT_TYPE_NORMAL,
-        SAA7127_INPUT_TYPE_TEST_IMAGE
-};
-
-/* Enumeration for the Supported Output signal types */
-enum saa7127_output_type {
-        SAA7127_OUTPUT_TYPE_BOTH,
-        SAA7127_OUTPUT_TYPE_COMPOSITE,
-        SAA7127_OUTPUT_TYPE_SVIDEO,
-        SAA7127_OUTPUT_TYPE_RGB,
-        SAA7127_OUTPUT_TYPE_YUV_C,
-        SAA7127_OUTPUT_TYPE_YUV_V
-};
-
 /*
  **********************************************************************
  *
@@ -561,7 +546,7 @@ static int saa7127_command(struct i2c_client *client,
 {
         struct saa7127_state *state = i2c_get_clientdata(client);
         struct v4l2_format *fmt = arg;
-        int *iarg = arg;
+        struct v4l2_routing *route = arg;
 
         switch (cmd) {
         case VIDIOC_S_STD:
@@ -573,15 +558,23 @@ static int saa7127_command(struct i2c_client *client,
                 *(v4l2_std_id *)arg = state->std;
                 break;
 
-        case VIDIOC_S_INPUT:
-                if (state->input_type == *iarg)
-                        break;
-                return saa7127_set_input_type(client, *iarg);
+        case VIDIOC_INT_G_VIDEO_ROUTING:
+                route->input = state->input_type;
+                route->output = state->output_type;
+                break;
 
-        case VIDIOC_S_OUTPUT:
-                if (state->output_type == *iarg)
-                        break;
-                return saa7127_set_output_type(client, *iarg);
+        case VIDIOC_INT_S_VIDEO_ROUTING:
+        {
+                int rc = 0;
+
+                if (state->input_type != route->input) {
+                        rc = saa7127_set_input_type(client, route->input);
+                }
+                if (rc == 0 && state->output_type != route->output) {
+                        rc = saa7127_set_output_type(client, route->output);
+                }
+                return rc;
+        }
 
         case VIDIOC_STREAMON:
         case VIDIOC_STREAMOFF:
diff --git a/drivers/media/video/saa7134/Kconfig b/drivers/media/video/saa7134/Kconfig
index 86671a43e769..e1c1805df1fb 100644
--- a/drivers/media/video/saa7134/Kconfig
+++ b/drivers/media/video/saa7134/Kconfig
@@ -39,6 +39,7 @@ config VIDEO_SAA7134_DVB
         tristate "DVB/ATSC Support for saa7134 based TV cards"
         depends on VIDEO_SAA7134 && DVB_CORE
         select VIDEO_BUF_DVB
+        select FW_LOADER
         ---help---
           This adds support for DVB cards based on the
           Philips saa7134 chip.
diff --git a/drivers/media/video/saa7134/Makefile b/drivers/media/video/saa7134/Makefile
index 1ba998424bbd..be7b9ee697d6 100644
--- a/drivers/media/video/saa7134/Makefile
+++ b/drivers/media/video/saa7134/Makefile
@@ -11,9 +11,9 @@ obj-$(CONFIG_VIDEO_SAA7134_OSS) += saa7134-oss.o
 
 obj-$(CONFIG_VIDEO_SAA7134_DVB) += saa7134-dvb.o
 
-EXTRA_CFLAGS += -I$(src)/..
-EXTRA_CFLAGS += -I$(srctree)/drivers/media/dvb/dvb-core
-EXTRA_CFLAGS += -I$(srctree)/drivers/media/dvb/frontends
+EXTRA_CFLAGS += -Idrivers/media/video
+EXTRA_CFLAGS += -Idrivers/media/dvb/dvb-core
+EXTRA_CFLAGS += -Idrivers/media/dvb/frontends
 
 extra-cflags-$(CONFIG_VIDEO_BUF_DVB) += -DHAVE_VIDEO_BUF_DVB=1
 extra-cflags-$(CONFIG_DVB_MT352)     += -DHAVE_MT352=1
diff --git a/drivers/media/video/saa7134/saa7134-cards.c b/drivers/media/video/saa7134/saa7134-cards.c
index fdd7f48f3b76..e666a4465ca4 100644
--- a/drivers/media/video/saa7134/saa7134-cards.c
+++ b/drivers/media/video/saa7134/saa7134-cards.c
@@ -208,7 +208,7 @@ struct saa7134_board saa7134_boards[] = {
         [SAA7134_BOARD_FLYTVPLATINUM_FM] = {
                 /* LifeView FlyTV Platinum FM (LR214WF) */
                 /* "Peter Missel <peter.missel@onlinehome.de> */
-                .name           = "LifeView FlyTV Platinum FM",
+                .name           = "LifeView FlyTV Platinum FM / Gold",
                 .audio_clock    = 0x00200000,
                 .tuner_type     = TUNER_PHILIPS_TDA8290,
                 .radio_type     = UNSET,
@@ -2660,7 +2660,7 @@ struct saa7134_board saa7134_boards[] = {
                 .mpeg           = SAA7134_MPEG_DVB,
                 .inputs = {{
                         .name   = name_comp1,
-                        .vmux   = 0,
+                        .vmux   = 1,
                         .amux   = LINE1,
                 },{
                         .name   = name_svideo,
@@ -2671,7 +2671,7 @@ struct saa7134_board saa7134_boards[] = {
         [SAA7134_BOARD_FLYDVBT_LR301] = {
                 /* LifeView FlyDVB-T */
                 /* Giampiero Giancipoli <gianci@libero.it> */
-                .name           = "LifeView FlyDVB-T",
+                .name           = "LifeView FlyDVB-T / Genius VideoWonder DVB-T",
                 .audio_clock    = 0x00200000,
                 .tuner_type     = TUNER_ABSENT,
                 .radio_type     = UNSET,
@@ -2808,6 +2808,40 @@ struct saa7134_board saa7134_boards[] = {
                 .tuner_addr     = ADDR_UNSET,
                 .radio_addr     = ADDR_UNSET,
         },
+        [SAA7134_BOARD_FLYDVBT_HYBRID_CARDBUS] = {
+                .name           = "LifeView FlyDVB-T Hybrid Cardbus",
+                .audio_clock    = 0x00200000,
+                .tuner_type     = TUNER_PHILIPS_TDA8290,
+                .radio_type     = UNSET,
+                .tuner_addr     = ADDR_UNSET,
+                .radio_addr     = ADDR_UNSET,
+                .mpeg           = SAA7134_MPEG_DVB,
+                .gpiomask       = 0x00600000, /* Bit 21 0=Radio, Bit 22 0=TV */
+                .inputs         = {{
+                        .name = name_tv,
+                        .vmux = 1,
+                        .amux = TV,
+                        .gpio = 0x200000,       /* GPIO21=High for TV input */
+                        .tv   = 1,
+                },{
+                        .name = name_svideo,    /* S-Video signal on S-Video input */
+                        .vmux = 8,
+                        .amux = LINE2,
+                },{
+                        .name = name_comp1,     /* Composite signal on S-Video input */
+                        .vmux = 0,
+                        .amux = LINE2,
+                },{
+                        .name = name_comp2,     /* Composite input */
+                        .vmux = 3,
+                        .amux = LINE2,
+                }},
+                .radio = {
+                        .name = name_radio,
+                        .amux = TV,
+                        .gpio = 0x000000,       /* GPIO21=Low for FM radio antenna */
+                },
+        },
 };
 
 const unsigned int saa7134_bcount = ARRAY_SIZE(saa7134_boards);
@@ -3333,6 +3367,30 @@ struct pci_device_id saa7134_pci_tbl[] = {
                 .subdevice    = 0x0005,
                 .driver_data  = SAA7134_BOARD_MD7134_BRIDGE_2,
         },{
+                .vendor = PCI_VENDOR_ID_PHILIPS,
+                .device = PCI_DEVICE_ID_PHILIPS_SAA7134,
+                .subvendor = 0x1489,
+                .subdevice = 0x0301,
+                .driver_data = SAA7134_BOARD_FLYDVBT_LR301,
+        },{
+                .vendor = PCI_VENDOR_ID_PHILIPS,
+                .device = PCI_DEVICE_ID_PHILIPS_SAA7133,
+                .subvendor = 0x5168, /* Animation Technologies (LifeView) */
+                .subdevice = 0x0304,
+                .driver_data = SAA7134_BOARD_FLYTVPLATINUM_FM,
+        },{
+                .vendor       = PCI_VENDOR_ID_PHILIPS,
+                .device       = PCI_DEVICE_ID_PHILIPS_SAA7133,
+                .subvendor    = 0x5168,
+                .subdevice    = 0x3306,
+                .driver_data  = SAA7134_BOARD_FLYDVBT_HYBRID_CARDBUS,
+        },{
+                .vendor       = PCI_VENDOR_ID_PHILIPS,
+                .device       = PCI_DEVICE_ID_PHILIPS_SAA7133,
+                .subvendor    = 0x5168,
+                .subdevice    = 0x3502,  /* whats the difference to 0x3306 ?*/
+                .driver_data  = SAA7134_BOARD_FLYDVBT_HYBRID_CARDBUS,
+        },{
                 /* --- boards without eeprom + subsystem ID --- */
                 .vendor       = PCI_VENDOR_ID_PHILIPS,
                 .device       = PCI_DEVICE_ID_PHILIPS_SAA7134,
@@ -3462,6 +3520,7 @@ int saa7134_board_init1(struct saa7134_dev *dev)
                 saa_writeb(SAA7134_GPIO_GPSTATUS3, 0x06);
                 break;
         case SAA7134_BOARD_ADS_DUO_CARDBUS_PTV331:
+        case SAA7134_BOARD_FLYDVBT_HYBRID_CARDBUS:
                 saa_writeb(SAA7134_GPIO_GPMODE3, 0x08);
                 saa_writeb(SAA7134_GPIO_GPSTATUS3, 0x00);
                 break;
@@ -3633,6 +3692,7 @@ int saa7134_board_init2(struct saa7134_dev *dev)
                 }
                 break;
         case SAA7134_BOARD_ADS_DUO_CARDBUS_PTV331:
+        case SAA7134_BOARD_FLYDVBT_HYBRID_CARDBUS:
                 /* make the tda10046 find its eeprom */
                 {
                 u8 data[] = { 0x3c, 0x33, 0x62};
diff --git a/drivers/media/video/saa7134/saa7134-core.c b/drivers/media/video/saa7134/saa7134-core.c
index c98571c9d5a6..13de05532e0a 100644
--- a/drivers/media/video/saa7134/saa7134-core.c
+++ b/drivers/media/video/saa7134/saa7134-core.c
@@ -32,6 +32,7 @@
 #include <linux/interrupt.h>
 #include <linux/delay.h>
 #include <linux/mutex.h>
+#include <linux/dma-mapping.h>
 
 #include "saa7134-reg.h"
 #include "saa7134.h"
@@ -870,7 +871,7 @@ static int __devinit saa7134_initdev(struct pci_dev *pci_dev,
                pci_name(pci_dev), dev->pci_rev, pci_dev->irq,
                dev->pci_lat,pci_resource_start(pci_dev,0));
         pci_set_master(pci_dev);
-        if (!pci_dma_supported(pci_dev,0xffffffff)) {
+        if (!pci_dma_supported(pci_dev, DMA_32BIT_MASK)) {
                 printk("%s: Oops: no 32bit PCI DMA ???\n",dev->name);
                 err = -EIO;
                 goto fail1;
diff --git a/drivers/media/video/saa7134/saa7134-dvb.c b/drivers/media/video/saa7134/saa7134-dvb.c
index 86cfdb8514cb..222a36c38917 100644
--- a/drivers/media/video/saa7134/saa7134-dvb.c
+++ b/drivers/media/video/saa7134/saa7134-dvb.c
@@ -1064,6 +1064,10 @@ static int dvb_init(struct saa7134_dev *dev)
                 dev->dvb.frontend = tda10046_attach(&tevion_dvbt220rf_config,
                                                     &dev->i2c_adap);
                 break;
+        case SAA7134_BOARD_FLYDVBT_HYBRID_CARDBUS:
+                dev->dvb.frontend = tda10046_attach(&ads_tech_duo_config,
+                                                    &dev->i2c_adap);
+                break;
 #endif
 #ifdef HAVE_NXT200X
         case SAA7134_BOARD_AVERMEDIA_AVERTVHD_A180:
diff --git a/drivers/media/video/saa7134/saa7134.h b/drivers/media/video/saa7134/saa7134.h
index 31ba293854c1..353af3a8b766 100644
--- a/drivers/media/video/saa7134/saa7134.h
+++ b/drivers/media/video/saa7134/saa7134.h
@@ -220,6 +220,7 @@ struct saa7134_format {
 #define SAA7134_BOARD_AVERMEDIA_A169_B 91
 #define SAA7134_BOARD_AVERMEDIA_A169_B1 92
 #define SAA7134_BOARD_MD7134_BRIDGE_2     93
+#define SAA7134_BOARD_FLYDVBT_HYBRID_CARDBUS 94
 
 #define SAA7134_MAXBOARDS 8
 #define SAA7134_INPUT_MAX 8
diff --git a/drivers/media/video/sn9c102/Kconfig b/drivers/media/video/sn9c102/Kconfig
new file mode 100644
index 000000000000..55f2bc11964b
--- /dev/null
+++ b/drivers/media/video/sn9c102/Kconfig
@@ -0,0 +1,11 @@
+config USB_SN9C102
+        tristate "USB SN9C10x PC Camera Controller support"
+        depends on USB && VIDEO_DEV
+        ---help---
+          Say Y here if you want support for cameras based on SONiX SN9C101,
+          SN9C102 or SN9C103 PC Camera Controllers.
+
+          See <file:Documentation/video4linux/sn9c102.txt> for more info.
+
+          To compile this driver as a module, choose M here: the
+          module will be called sn9c102.
diff --git a/drivers/media/video/tuner-core.c b/drivers/media/video/tuner-core.c
index df195c905366..1013b4de89a2 100644
--- a/drivers/media/video/tuner-core.c
+++ b/drivers/media/video/tuner-core.c
@@ -401,7 +401,7 @@ static void tuner_status(struct i2c_client *client)
         }
         tuner_info("Tuner mode:      %s\n", p);
         tuner_info("Frequency:       %lu.%02lu MHz\n", freq, freq_fraction);
-        tuner_info("Standard:        0x%08llx\n", t->std);
+        tuner_info("Standard:        0x%08lx\n", (unsigned long)t->std);
         if (t->mode != V4L2_TUNER_RADIO)
                return;
         if (t->has_signal) {
@@ -558,10 +558,10 @@ static inline int set_mode(struct i2c_client *client, struct tuner *t, int mode,
 
 static inline int check_v4l2(struct tuner *t)
 {
-        if (t->using_v4l2) {
-                tuner_dbg ("ignore v4l1 call\n");
-                return EINVAL;
-        }
+        /* bttv still uses both v4l1 and v4l2 calls to the tuner (v4l2 for
+           TV, v4l1 for radio), until that is fixed this code is disabled.
+           Otherwise the radio (v4l1) wouldn't tune after using the TV (v4l2)
+           first. */
         return 0;
 }
 
@@ -744,6 +744,8 @@ static int tuner_command(struct i2c_client *client, unsigned int cmd, void *arg)
                         switch_v4l2();
 
                         tuner->type = t->mode;
+                        if (t->mode == V4L2_TUNER_ANALOG_TV)
+                                tuner->capability |= V4L2_TUNER_CAP_NORM;
                         if (t->mode != V4L2_TUNER_RADIO) {
                                 tuner->rangelow = tv_range[0] * 16;
                                 tuner->rangehigh = tv_range[1] * 16;
diff --git a/drivers/media/video/tvaudio.c b/drivers/media/video/tvaudio.c
index 356bff455ad1..c2b756107548 100644
--- a/drivers/media/video/tvaudio.c
+++ b/drivers/media/video/tvaudio.c
@@ -1706,21 +1706,6 @@ static int chip_command(struct i2c_client *client,
                 break;
         }
 
-        case VIDIOC_S_AUDIO:
-        {
-                struct v4l2_audio *sarg = arg;
-
-                if (!(desc->flags & CHIP_HAS_INPUTSEL) || sarg->index >= 4)
-                                return -EINVAL;
-                /* There are four inputs: tuner, radio, extern and intern. */
-                chip->input = sarg->index;
-                if (chip->muted)
-                        break;
-                chip_write_masked(chip, desc->inputreg,
-                                desc->inputmap[chip->input], desc->inputmask);
-                break;
-        }
-
         case VIDIOC_S_TUNER:
         {
                 struct v4l2_tuner *vt = arg;
diff --git a/drivers/media/video/tveeprom.c b/drivers/media/video/tveeprom.c
index e0d2ff83fc91..431c3e2f6c42 100644
--- a/drivers/media/video/tveeprom.c
+++ b/drivers/media/video/tveeprom.c
@@ -757,9 +757,9 @@ tveeprom_detect_client(struct i2c_adapter *adapter,
 static int
 tveeprom_attach_adapter (struct i2c_adapter *adapter)
 {
-        if (adapter->id != I2C_HW_B_BT848)
-                return 0;
-        return i2c_probe(adapter, &addr_data, tveeprom_detect_client);
+        if (adapter->class & I2C_CLASS_TV_ANALOG)
+                return i2c_probe(adapter, &addr_data, tveeprom_detect_client);
+        return 0;
 }
 
 static int
diff --git a/drivers/media/video/tvp5150.c b/drivers/media/video/tvp5150.c
index 69d0fe159f4d..dab4973bcf82 100644
--- a/drivers/media/video/tvp5150.c
+++ b/drivers/media/video/tvp5150.c
@@ -53,7 +53,7 @@ static struct v4l2_queryctrl tvp5150_qctrl[] = {
                 .minimum = 0,
                 .maximum = 255,
                 .step = 1,
-                .default_value = 0,
+                .default_value = 128,
                 .flags = 0,
         }, {
                 .id = V4L2_CID_CONTRAST,
@@ -62,7 +62,7 @@ static struct v4l2_queryctrl tvp5150_qctrl[] = {
                 .minimum = 0,
                 .maximum = 255,
                 .step = 0x1,
-                .default_value = 0x10,
+                .default_value = 128,
                 .flags = 0,
         }, {
                  .id = V4L2_CID_SATURATION,
@@ -71,7 +71,7 @@ static struct v4l2_queryctrl tvp5150_qctrl[] = {
                  .minimum = 0,
                  .maximum = 255,
                  .step = 0x1,
-                 .default_value = 0x10,
+                 .default_value = 128,
                  .flags = 0,
         }, {
                 .id = V4L2_CID_HUE,
@@ -80,7 +80,7 @@ static struct v4l2_queryctrl tvp5150_qctrl[] = {
                 .minimum = -128,
                 .maximum = 127,
                 .step = 0x1,
-                .default_value = 0x10,
+                .default_value = 0,
                 .flags = 0,
         }
 };
@@ -500,16 +500,21 @@ struct i2c_vbi_ram_value {
 
 static struct i2c_vbi_ram_value vbi_ram_default[] =
 {
+        /* FIXME: Current api doesn't handle all VBI types, those not
+           yet supported are placed under #if 0 */
+#if 0
         {0x010, /* Teletext, SECAM, WST System A */
                 {V4L2_SLICED_TELETEXT_SECAM,6,23,1},
                 { 0xaa, 0xaa, 0xff, 0xff, 0xe7, 0x2e, 0x20, 0x26,
                   0xe6, 0xb4, 0x0e, 0x00, 0x00, 0x00, 0x10, 0x00 }
         },
+#endif
         {0x030, /* Teletext, PAL, WST System B */
-                {V4L2_SLICED_TELETEXT_PAL_B,6,22,1},
+                {V4L2_SLICED_TELETEXT_B,6,22,1},
                 { 0xaa, 0xaa, 0xff, 0xff, 0x27, 0x2e, 0x20, 0x2b,
                   0xa6, 0x72, 0x10, 0x00, 0x00, 0x00, 0x10, 0x00 }
         },
+#if 0
         {0x050, /* Teletext, PAL, WST System C */
                 {V4L2_SLICED_TELETEXT_PAL_C,6,22,1},
                 { 0xaa, 0xaa, 0xff, 0xff, 0xe7, 0x2e, 0x20, 0x22,
@@ -535,6 +540,7 @@ static struct i2c_vbi_ram_value vbi_ram_default[] =
                 { 0xaa, 0x2a, 0xff, 0x3f, 0x04, 0x51, 0x6e, 0x02,
                   0xa6, 0x7b, 0x09, 0x00, 0x00, 0x00, 0x27, 0x00 }
         },
+#endif
         {0x0f0, /* Closed Caption, NTSC */
                 {V4L2_SLICED_CAPTION_525,21,21,1},
                 { 0xaa, 0x2a, 0xff, 0x3f, 0x04, 0x51, 0x6e, 0x02,
@@ -545,6 +551,7 @@ static struct i2c_vbi_ram_value vbi_ram_default[] =
                 { 0x5b, 0x55, 0xc5, 0xff, 0x00, 0x71, 0x6e, 0x42,
                   0xa6, 0xcd, 0x0f, 0x00, 0x00, 0x00, 0x3a, 0x00 }
         },
+#if 0
         {0x130, /* Wide Screen Signal, NTSC C */
                 {V4L2_SLICED_WSS_525,20,20,1},
                 { 0x38, 0x00, 0x3f, 0x00, 0x00, 0x71, 0x6e, 0x43,
@@ -560,6 +567,7 @@ static struct i2c_vbi_ram_value vbi_ram_default[] =
                 { 0x00, 0x00, 0x00, 0x00, 0x00, 0x8f, 0x6d, 0x49,
                   0x69, 0x94, 0x08, 0x00, 0x00, 0x00, 0x4c, 0x00 }
         },
+#endif
         {0x190, /* Video Program System (VPS), PAL */
                 {V4L2_SLICED_VPS,16,16,0},
                 { 0xaa, 0xaa, 0xff, 0xff, 0xba, 0xce, 0x2b, 0x0d,
@@ -850,7 +858,6 @@ static int tvp5150_command(struct i2c_client *c,
 
         case 0:
         case VIDIOC_INT_RESET:
-        case DECODER_INIT:
                 tvp5150_reset(c);
                 break;
         case VIDIOC_S_STD:
@@ -949,99 +956,15 @@ static int tvp5150_command(struct i2c_client *c,
 #endif
 
         case VIDIOC_LOG_STATUS:
-        case DECODER_DUMP:
                 dump_reg(c);
                 break;
 
-        case DECODER_GET_CAPABILITIES:
+        case VIDIOC_G_TUNER:
                 {
-                        struct video_decoder_capability *cap = arg;
-
-                        cap->flags = VIDEO_DECODER_PAL |
-                            VIDEO_DECODER_NTSC |
-                            VIDEO_DECODER_SECAM |
-                            VIDEO_DECODER_AUTO | VIDEO_DECODER_CCIR;
-                        cap->inputs = 3;
-                        cap->outputs = 1;
-                        break;
-                }
-        case DECODER_GET_STATUS:
-                {
-                        int *iarg = arg;
-                        int status;
-                        int res=0;
-                        status = tvp5150_read(c, 0x88);
-                        if(status&0x08){
-                                res |= DECODER_STATUS_COLOR;
-                        }
-                        if(status&0x04 && status&0x02){
-                                res |= DECODER_STATUS_GOOD;
-                        }
-                        *iarg=res;
-                        break;
-                }
-
-        case DECODER_SET_GPIO:
-                break;
-
-        case DECODER_SET_VBI_BYPASS:
-                break;
-
-        case DECODER_SET_NORM:
-                {
-                        int *iarg = arg;
-
-                        switch (*iarg) {
-
-                        case VIDEO_MODE_NTSC:
-                                break;
-
-                        case VIDEO_MODE_PAL:
-                                break;
-
-                        case VIDEO_MODE_SECAM:
-                                break;
-
-                        case VIDEO_MODE_AUTO:
-                                break;
-
-                        default:
-                                return -EINVAL;
-
-                        }
-                        decoder->norm = *iarg;
-                        break;
-                }
-        case DECODER_SET_INPUT:
-                {
-                        int *iarg = arg;
-                        if (*iarg < 0 || *iarg > 3) {
-                                return -EINVAL;
-                        }
-
-                        decoder->input = *iarg;
-                        tvp5150_selmux(c, decoder->input);
-
-                        break;
-                }
-        case DECODER_SET_OUTPUT:
-                {
-                        int *iarg = arg;
-
-                        /* not much choice of outputs */
-                        if (*iarg != 0) {
-                                return -EINVAL;
-                        }
-                        break;
-                }
-        case DECODER_ENABLE_OUTPUT:
-                {
-                        int *iarg = arg;
-
-                        decoder->enable = (*iarg != 0);
-
-                        tvp5150_selmux(c, decoder->input);
+                        struct v4l2_tuner *vt = arg;
+                        int status = tvp5150_read(c, 0x88);
 
+                        vt->signal = ((status & 0x04) && (status & 0x02)) ? 0xffff : 0x0;
                         break;
                 }
         case VIDIOC_QUERYCTRL:
@@ -1087,35 +1010,6 @@ static int tvp5150_command(struct i2c_client *c,
                         return -EINVAL;
                 }
 
-        case DECODER_SET_PICTURE:
-                {
-                        struct video_picture *pic = arg;
-                        if (decoder->bright != pic->brightness) {
-                                /* We want 0 to 255 we get 0-65535 */
-                                decoder->bright = pic->brightness;
-                                tvp5150_write(c, TVP5150_BRIGHT_CTL,
-                                              decoder->bright >> 8);
-                        }
-                        if (decoder->contrast != pic->contrast) {
-                                /* We want 0 to 255 we get 0-65535 */
-                                decoder->contrast = pic->contrast;
-                                tvp5150_write(c, TVP5150_CONTRAST_CTL,
-                                              decoder->contrast >> 8);
-                        }
-                        if (decoder->sat != pic->colour) {
-                                /* We want 0 to 255 we get 0-65535 */
-                                decoder->sat = pic->colour;
-                                tvp5150_write(c, TVP5150_SATURATION_CTL,
-                                              decoder->contrast >> 8);
-                        }
-                        if (decoder->hue != pic->hue) {
-                                /* We want -128 to 127 we get 0-65535 */
-                                decoder->hue = pic->hue;
-                                tvp5150_write(c, TVP5150_HUE_CTL,
-                                              (decoder->hue - 32768) >> 8);
-                        }
-                        break;
-                }
         default:
                 return -EINVAL;
         }
diff --git a/drivers/media/video/upd64031a.c b/drivers/media/video/upd64031a.c
new file mode 100644
index 000000000000..fc52201d607e
--- /dev/null
+++ b/drivers/media/video/upd64031a.c
@@ -0,0 +1,286 @@
+/*
+ * upd64031A - NEC Electronics Ghost Reduction for NTSC in Japan
+ *
+ * 2003 by T.Adachi <tadachi@tadachi-net.com>
+ * 2003 by Takeru KOMORIYA <komoriya@paken.org>
+ * 2006 by Hans Verkuil <hverkuil@xs4all.nl>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
+ */
+
+
+#include <linux/version.h>
+#include <linux/module.h>
+#include <linux/kernel.h>
+#include <linux/i2c.h>
+#include <linux/videodev2.h>
+#include <media/v4l2-common.h>
+#include <media/upd64031a.h>
+
+// --------------------- read registers functions define -----------------------
+
+/* bit masks */
+#define GR_MODE_MASK              0xc0
+#define DIRECT_3DYCS_CONNECT_MASK 0xc0
+#define SYNC_CIRCUIT_MASK         0xa0
+
+// -----------------------------------------------------------------------------
+
+MODULE_DESCRIPTION("uPD64031A driver");
+MODULE_AUTHOR("T. Adachi, Takeru KOMORIYA, Hans Verkuil");
+MODULE_LICENSE("GPL");
+
+static int debug = 0;
+module_param(debug, int, 0644);
+
+MODULE_PARM_DESC(debug, "Debug level (0-1)");
+
+static unsigned short normal_i2c[] = { 0x24 >> 1, 0x26 >> 1, I2C_CLIENT_END };
+
+
+I2C_CLIENT_INSMOD;
+
+enum {
+        R00 = 0, R01, R02, R03, R04,
+        R05, R06, R07, R08, R09,
+        R0A, R0B, R0C, R0D, R0E, R0F,
+        /* unused registers
+         R10, R11, R12, R13, R14,
+         R15, R16, R17,
+         */
+        TOT_REGS
+};
+
+struct upd64031a_state {
+        u8 regs[TOT_REGS];
+        u8 gr_mode;
+        u8 direct_3dycs_connect;
+        u8 ext_comp_sync;
+        u8 ext_vert_sync;
+};
+
+static u8 upd64031a_init[] = {
+        0x00, 0xb8, 0x48, 0xd2, 0xe6,
+        0x03, 0x10, 0x0b, 0xaf, 0x7f,
+        0x00, 0x00, 0x1d, 0x5e, 0x00,
+        0xd0
+};
+
+/* ------------------------------------------------------------------------ */
+
+static u8 upd64031a_read(struct i2c_client *client, u8 reg)
+{
+        u8 buf[2];
+
+        if (reg >= sizeof(buf))
+                return 0xff;
+        i2c_master_recv(client, buf, 2);
+        return buf[reg];
+}
+
+/* ------------------------------------------------------------------------ */
+
+static void upd64031a_write(struct i2c_client *client, u8 reg, u8 val)
+{
+        u8 buf[2];
+
+        buf[0] = reg;
+        buf[1] = val;
+        v4l_dbg(1, debug, client, "writing reg addr: %02X val: %02X\n", reg, val);
+        if (i2c_master_send(client, buf, 2) != 2)
+                v4l_err(client, "I/O error write 0x%02x/0x%02x\n", reg, val);
+}
+
+/* ------------------------------------------------------------------------ */
+
+/* The input changed due to new input or channel changed */
+static void upd64031a_change(struct i2c_client *client)
+{
+        struct upd64031a_state *state = i2c_get_clientdata(client);
+        u8 reg = state->regs[R00];
+
+        v4l_dbg(1, debug, client, "changed input or channel\n");
+        upd64031a_write(client, R00, reg | 0x10);
+        upd64031a_write(client, R00, reg & ~0x10);
+}
+
+/* ------------------------------------------------------------------------ */
+
+static int upd64031a_command(struct i2c_client *client, unsigned int cmd, void *arg)
+{
+        struct upd64031a_state *state = i2c_get_clientdata(client);
+        struct v4l2_routing *route = arg;
+
+        switch (cmd) {
+        case VIDIOC_S_FREQUENCY:
+                upd64031a_change(client);
+                break;
+
+        case VIDIOC_INT_G_VIDEO_ROUTING:
+                route->input = (state->gr_mode >> 6) |
+                        (state->direct_3dycs_connect >> 4) |
+                        (state->ext_comp_sync >> 1) |
+                        (state->ext_vert_sync >> 2);
+                route->output = 0;
+                break;
+
+        case VIDIOC_INT_S_VIDEO_ROUTING:
+        {
+                u8 r00, r05, r08;
+
+                state->gr_mode = (route->input & 3) << 6;
+                state->direct_3dycs_connect = (route->input & 0xc) << 4;
+                state->ext_comp_sync = (route->input & UPD64031A_COMPOSITE_EXTERNAL) << 1;
+                state->ext_vert_sync = (route->input & UPD64031A_VERTICAL_EXTERNAL) << 2;
+                r00 = (state->regs[R00] & ~GR_MODE_MASK) | state->gr_mode;
+                r05 = (state->regs[R00] & ~SYNC_CIRCUIT_MASK) |
+                        state->ext_comp_sync | state->ext_vert_sync;
+                r08 = (state->regs[R08] & ~DIRECT_3DYCS_CONNECT_MASK) |
+                        state->direct_3dycs_connect;
+                upd64031a_write(client, R00, r00);
+                upd64031a_write(client, R05, r05);
+                upd64031a_write(client, R08, r08);
+                upd64031a_change(client);
+                break;
+        }
+
+        case VIDIOC_LOG_STATUS:
+                v4l_info(client, "Status: SA00=0x%02x SA01=0x%02x\n",
+                        upd64031a_read(client, 0), upd64031a_read(client, 1));
+                break;
+
+#ifdef CONFIG_VIDEO_ADV_DEBUG
+        case VIDIOC_INT_G_REGISTER:
+        {
+                struct v4l2_register *reg = arg;
+
+                if (reg->i2c_id != I2C_DRIVERID_UPD64031A)
+                        return -EINVAL;
+                reg->val = upd64031a_read(client, reg->reg & 0xff);
+                break;
+        }
+
+        case VIDIOC_INT_S_REGISTER:
+        {
+                struct v4l2_register *reg = arg;
+                u8 addr = reg->reg & 0xff;
+                u8 val = reg->val & 0xff;
+
+                if (reg->i2c_id != I2C_DRIVERID_UPD64031A)
+                        return -EINVAL;
+                if (!capable(CAP_SYS_ADMIN))
+                        return -EPERM;
+                upd64031a_write(client, addr, val);
+                break;
+        }
+#endif
+
+        default:
+                break;
+        }
+        return 0;
+}
+
+/* ------------------------------------------------------------------------ */
+
+/* i2c implementation */
+
+static struct i2c_driver i2c_driver;
+
+static int upd64031a_attach(struct i2c_adapter *adapter, int address, int kind)
+{
+        struct i2c_client *client;
+        struct upd64031a_state *state;
+        int i;
+
+        if (!i2c_check_functionality(adapter, I2C_FUNC_SMBUS_BYTE_DATA))
+                return 0;
+
+        client = kzalloc(sizeof(struct i2c_client), GFP_KERNEL);
+        if (client == NULL) {
+                return -ENOMEM;
+        }
+
+        client->addr = address;
+        client->adapter = adapter;
+        client->driver = &i2c_driver;
+        snprintf(client->name, sizeof(client->name) - 1, "uPD64031A");
+
+        v4l_info(client, "chip found @ 0x%x (%s)\n", address << 1, adapter->name);
+
+        state = kmalloc(sizeof(struct upd64031a_state), GFP_KERNEL);
+        if (state == NULL) {
+                kfree(client);
+                return -ENOMEM;
+        }
+        i2c_set_clientdata(client, state);
+        memcpy(state->regs, upd64031a_init, sizeof(state->regs));
+        state->gr_mode = UPD64031A_GR_ON << 6;
+        state->direct_3dycs_connect = UPD64031A_3DYCS_COMPOSITE << 4;
+        state->ext_comp_sync = state->ext_vert_sync = 0;
+        for (i = 0; i < TOT_REGS; i++) {
+                upd64031a_write(client, i, state->regs[i]);
+        }
+
+        i2c_attach_client(client);
+
+        return 0;
+}
+
+static int upd64031a_probe(struct i2c_adapter *adapter)
+{
+        if (adapter->class & I2C_CLASS_TV_ANALOG)
+                return i2c_probe(adapter, &addr_data, upd64031a_attach);
+        return 0;
+}
+
+static int upd64031a_detach(struct i2c_client *client)
+{
+        int err;
+
+        err = i2c_detach_client(client);
+        if (err)
+                return err;
+
+        kfree(client);
+        return 0;
+}
+
+/* ----------------------------------------------------------------------- */
+
+/* i2c implementation */
+static struct i2c_driver i2c_driver = {
+        .driver = {
+                .name = "upd64031a",
+        },
+        .id = I2C_DRIVERID_UPD64031A,
+        .attach_adapter = upd64031a_probe,
+        .detach_client  = upd64031a_detach,
+        .command = upd64031a_command,
+};
+
+
+static int __init upd64031a_init_module(void)
+{
+        return i2c_add_driver(&i2c_driver);
+}
+
+static void __exit upd64031a_exit_module(void)
+{
+        i2c_del_driver(&i2c_driver);
+}
+
+module_init(upd64031a_init_module);
+module_exit(upd64031a_exit_module);
diff --git a/drivers/media/video/upd64083.c b/drivers/media/video/upd64083.c
new file mode 100644
index 000000000000..c3a7ffe5c267
--- /dev/null
+++ b/drivers/media/video/upd64083.c
@@ -0,0 +1,262 @@
+/*
+ * upd6408x - NEC Electronics 3-Dimensional Y/C separation driver
+ *
+ * 2003 by T.Adachi (tadachi@tadachi-net.com)
+ * 2003 by Takeru KOMORIYA <komoriya@paken.org>
+ * 2006 by Hans Verkuil <hverkuil@xs4all.nl>
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * as published by the Free Software Foundation; either version 2
+ * of the License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+ */
+
+#include <linux/version.h>
+#include <linux/module.h>
+#include <linux/kernel.h>
+#include <linux/i2c.h>
+#include <linux/videodev2.h>
+#include <media/v4l2-common.h>
+#include <media/upd64083.h>
+
+MODULE_DESCRIPTION("uPD64083 driver");
+MODULE_AUTHOR("T. Adachi, Takeru KOMORIYA, Hans Verkuil");
+MODULE_LICENSE("GPL");
+
+static int debug = 0;
+module_param(debug, bool, 0644);
+
+MODULE_PARM_DESC(debug, "Debug level (0-1)");
+
+static unsigned short normal_i2c[] = { 0xb8 >> 1, 0xba >> 1, I2C_CLIENT_END };
+
+
+I2C_CLIENT_INSMOD;
+
+enum {
+        R00 = 0, R01, R02, R03, R04,
+        R05, R06, R07, R08, R09,
+        R0A, R0B, R0C, R0D, R0E, R0F,
+        R10, R11, R12, R13, R14,
+        R15, R16,
+        TOT_REGS
+};
+
+struct upd64083_state {
+        u8 mode;
+        u8 ext_y_adc;
+        u8 regs[TOT_REGS];
+};
+
+/* Initial values when used in combination with the
+   NEC upd64031a ghost reduction chip. */
+static u8 upd64083_init[] = {
+        0x1f, 0x01, 0xa0, 0x2d, 0x29,  /* we use EXCSS=0 */
+        0x36, 0xdd, 0x05, 0x56, 0x48,
+        0x00, 0x3a, 0xa0, 0x05, 0x08,
+        0x44, 0x60, 0x08, 0x52, 0xf8,
+        0x53, 0x60, 0x10
+};
+
+/* ------------------------------------------------------------------------ */
+
+static void upd64083_log_status(struct i2c_client *client)
+{
+        u8 buf[7];
+
+        i2c_master_recv(client, buf, 7);
+        v4l_info(client, "Status: SA00=%02x SA01=%02x SA02=%02x SA03=%02x "
+                      "SA04=%02x SA05=%02x SA06=%02x\n",
+                buf[0], buf[1], buf[2], buf[3], buf[4], buf[5], buf[6]);
+}
+
+/* ------------------------------------------------------------------------ */
+
+static void upd64083_write(struct i2c_client *client, u8 reg, u8 val)
+{
+        u8 buf[2];
+
+        buf[0] = reg;
+        buf[1] = val;
+        v4l_dbg(1, debug, client, "writing reg addr: %02x val: %02x\n", reg, val);
+        if (i2c_master_send(client, buf, 2) != 2)
+                v4l_err(client, "I/O error write 0x%02x/0x%02x\n", reg, val);
+}
+
+/* ------------------------------------------------------------------------ */
+
+#ifdef CONFIG_VIDEO_ADV_DEBUG
+static u8 upd64083_read(struct i2c_client *client, u8 reg)
+{
+        u8 buf[7];
+
+        if (reg >= sizeof(buf))
+                return 0xff;
+        i2c_master_recv(client, buf, sizeof(buf));
+        return buf[reg];
+}
+#endif
+
+/* ------------------------------------------------------------------------ */
+
+static int upd64083_command(struct i2c_client *client, unsigned int cmd, void *arg)
+{
+        struct upd64083_state *state = i2c_get_clientdata(client);
+        struct v4l2_routing *route = arg;
+
+        switch (cmd) {
+        case VIDIOC_INT_G_VIDEO_ROUTING:
+                route->input = (state->mode >> 6) | (state->ext_y_adc >> 3);
+                route->output = 0;
+                break;
+
+        case VIDIOC_INT_S_VIDEO_ROUTING:
+        {
+                u8 r00, r02;
+
+                if (route->input > 7 || (route->input & 6) == 6)
+                        return -EINVAL;
+                state->mode = (route->input & 3) << 6;
+                state->ext_y_adc = (route->input & UPD64083_EXT_Y_ADC) << 3;
+                r00 = (state->regs[R00] & ~(3 << 6)) | state->mode;
+                r02 = (state->regs[R02] & ~(1 << 5)) | state->ext_y_adc;
+                upd64083_write(client, R00, r00);
+                upd64083_write(client, R02, r02);
+                break;
+        }
+
+        case VIDIOC_LOG_STATUS:
+                upd64083_log_status(client);
+                break;
+
+#ifdef CONFIG_VIDEO_ADV_DEBUG
+        case VIDIOC_INT_G_REGISTER:
+        {
+                struct v4l2_register *reg = arg;
+
+                if (reg->i2c_id != I2C_DRIVERID_UPD64083)
+                        return -EINVAL;
+                reg->val = upd64083_read(client, reg->reg & 0xff);
+                break;
+        }
+
+        case VIDIOC_INT_S_REGISTER:
+        {
+                struct v4l2_register *reg = arg;
+                u8 addr = reg->reg & 0xff;
+                u8 val = reg->val & 0xff;
+
+                if (reg->i2c_id != I2C_DRIVERID_UPD64083)
+                        return -EINVAL;
+                if (!capable(CAP_SYS_ADMIN))
+                        return -EPERM;
+                upd64083_write(client, addr, val);
+                break;
+        }
+#endif
+        default:
+                break;
+        }
+
+        return 0;
+}
+
+/* ------------------------------------------------------------------------ */
+
+/* i2c implementation */
+
+static struct i2c_driver i2c_driver;
+
+static int upd64083_attach(struct i2c_adapter *adapter, int address, int kind)
+{
+        struct i2c_client *client;
+        struct upd64083_state *state;
+        int i;
+
+        if (!i2c_check_functionality(adapter, I2C_FUNC_SMBUS_BYTE_DATA))
+                return 0;
+
+        client = kzalloc(sizeof(struct i2c_client), GFP_KERNEL);
+        if (client == NULL) {
+                return -ENOMEM;
+        }
+
+        client->addr = address;
+        client->adapter = adapter;
+        client->driver = &i2c_driver;
+        snprintf(client->name, sizeof(client->name) - 1, "uPD64083");
+
+        v4l_info(client, "chip found @ 0x%x (%s)\n", address << 1, adapter->name);
+
+        state = kmalloc(sizeof(struct upd64083_state), GFP_KERNEL);
+        if (state == NULL) {
+                kfree(client);
+                return -ENOMEM;
+        }
+        i2c_set_clientdata(client, state);
+        /* Initially assume that a ghost reduction chip is present */
+        state->mode = 0;  /* YCS mode */
+        state->ext_y_adc = (1 << 5);
+        memcpy(state->regs, upd64083_init, TOT_REGS);
+        for (i = 0; i < TOT_REGS; i++) {
+                upd64083_write(client, i, state->regs[i]);
+        }
+        i2c_attach_client(client);
+
+        return 0;
+}
+
+static int upd64083_probe(struct i2c_adapter *adapter)
+{
+        if (adapter->class & I2C_CLASS_TV_ANALOG)
+                return i2c_probe(adapter, &addr_data, upd64083_attach);
+        return 0;
+}
+
+static int upd64083_detach(struct i2c_client *client)
+{
+        int err;
+
+        err = i2c_detach_client(client);
+        if (err)
+                return err;
+
+        kfree(client);
+        return 0;
+}
+
+/* ----------------------------------------------------------------------- */
+
+/* i2c implementation */
+static struct i2c_driver i2c_driver = {
+        .driver = {
+                .name = "upd64083",
+        },
+        .id = I2C_DRIVERID_UPD64083,
+        .attach_adapter = upd64083_probe,
+        .detach_client  = upd64083_detach,
+        .command = upd64083_command,
+};
+
+
+static int __init upd64083_init_module(void)
+{
+        return i2c_add_driver(&i2c_driver);
+}
+
+static void __exit upd64083_exit_module(void)
+{
+        i2c_del_driver(&i2c_driver);
+}
+
+module_init(upd64083_init_module);
+module_exit(upd64083_exit_module);
diff --git a/drivers/media/video/usbvideo/Kconfig b/drivers/media/video/usbvideo/Kconfig
new file mode 100644
index 000000000000..08a5d20bb2c0
--- /dev/null
+++ b/drivers/media/video/usbvideo/Kconfig
@@ -0,0 +1,38 @@
+config VIDEO_USBVIDEO
+        tristate
+
+config USB_VICAM
+        tristate "USB 3com HomeConnect (aka vicam) support (EXPERIMENTAL)"
+        depends on USB && VIDEO_DEV && EXPERIMENTAL
+        select VIDEO_USBVIDEO
+        ---help---
+          Say Y here if you have 3com homeconnect camera (vicam).
+
+          To compile this driver as a module, choose M here: the
+          module will be called vicam.
+
+config USB_IBMCAM
+        tristate "USB IBM (Xirlink) C-it Camera support"
+        depends on USB && VIDEO_DEV
+        select VIDEO_USBVIDEO
+        ---help---
+          Say Y here if you want to connect a IBM "C-It" camera, also known as
+          "Xirlink PC Camera" to your computer's USB port.
+
+          To compile this driver as a module, choose M here: the
+          module will be called ibmcam.
+
+          This camera has several configuration options which
+          can be specified when you load the module. Read
+          <file:Documentation/video4linux/ibmcam.txt> to learn more.
+
+config USB_KONICAWC
+        tristate "USB Konica Webcam support"
+        depends on USB && VIDEO_DEV
+        select VIDEO_USBVIDEO
+        ---help---
+          Say Y here if you want support for webcams based on a Konica
+          chipset. This is known to work with the Intel YC76 webcam.
+
+          To compile this driver as a module, choose M here: the
+          module will be called konicawc.
diff --git a/drivers/media/video/usbvideo/Makefile b/drivers/media/video/usbvideo/Makefile
index ed410a5ee8c9..bb52eb8dc2f9 100644
--- a/drivers/media/video/usbvideo/Makefile
+++ b/drivers/media/video/usbvideo/Makefile
@@ -1,4 +1,4 @@
-obj-$(CONFIG_USB_IBMCAM)        += ibmcam.o usbvideo.o ultracam.o
-obj-$(CONFIG_USB_KONICAWC)      += konicawc.o usbvideo.o
-obj-$(CONFIG_USB_VICAM)         += vicam.o usbvideo.o
-
+obj-$(CONFIG_VIDEO_USBVIDEO)    += usbvideo.o
+obj-$(CONFIG_USB_IBMCAM)        += ibmcam.o ultracam.o
+obj-$(CONFIG_USB_KONICAWC)      += konicawc.o
+obj-$(CONFIG_USB_VICAM)         += vicam.o
diff --git a/drivers/media/video/v4l2-common.c b/drivers/media/video/v4l2-common.c
index 11a97f30b876..d330fa985bcc 100644
--- a/drivers/media/video/v4l2-common.c
+++ b/drivers/media/video/v4l2-common.c
@@ -317,6 +317,7 @@ static const char *v4l2_int_ioctls[] = {
         [_IOC_NR(TUNER_SET_STANDBY)]           = "TUNER_SET_STANDBY",
         [_IOC_NR(TDA9887_SET_CONFIG)]          = "TDA9887_SET_CONFIG",
 
+        [_IOC_NR(VIDIOC_INT_S_TUNER_MODE)]     = "VIDIOC_INT_S_TUNER_MODE",
         [_IOC_NR(VIDIOC_INT_S_REGISTER)]       = "VIDIOC_INT_S_REGISTER",
         [_IOC_NR(VIDIOC_INT_G_REGISTER)]       = "VIDIOC_INT_G_REGISTER",
         [_IOC_NR(VIDIOC_INT_RESET)]            = "VIDIOC_INT_RESET",
@@ -325,7 +326,12 @@ static const char *v4l2_int_ioctls[] = {
         [_IOC_NR(VIDIOC_INT_S_VBI_DATA)]       = "VIDIOC_INT_S_VBI_DATA",
         [_IOC_NR(VIDIOC_INT_G_VBI_DATA)]       = "VIDIOC_INT_G_VBI_DATA",
         [_IOC_NR(VIDIOC_INT_G_CHIP_IDENT)]     = "VIDIOC_INT_G_CHIP_IDENT",
-        [_IOC_NR(VIDIOC_INT_I2S_CLOCK_FREQ)]   = "VIDIOC_INT_I2S_CLOCK_FREQ"
+        [_IOC_NR(VIDIOC_INT_I2S_CLOCK_FREQ)]   = "VIDIOC_INT_I2S_CLOCK_FREQ",
+        [_IOC_NR(VIDIOC_INT_S_STANDBY)]        = "VIDIOC_INT_S_STANDBY",
+        [_IOC_NR(VIDIOC_INT_S_AUDIO_ROUTING)]  = "VIDIOC_INT_S_AUDIO_ROUTING",
+        [_IOC_NR(VIDIOC_INT_G_AUDIO_ROUTING)]  = "VIDIOC_INT_G_AUDIO_ROUTING",
+        [_IOC_NR(VIDIOC_INT_S_VIDEO_ROUTING)]  = "VIDIOC_INT_S_VIDEO_ROUTING",
+        [_IOC_NR(VIDIOC_INT_G_VIDEO_ROUTING)]  = "VIDIOC_INT_G_VIDEO_ROUTING"
 };
 #define V4L2_INT_IOCTLS ARRAY_SIZE(v4l2_int_ioctls)
 
diff --git a/drivers/media/video/video-buf.c b/drivers/media/video/video-buf.c
index d2ca0f08d0df..acc5ea936687 100644
--- a/drivers/media/video/video-buf.c
+++ b/drivers/media/video/video-buf.c
@@ -399,19 +399,25 @@ void videobuf_queue_pci(struct videobuf_queue* q)
 int videobuf_pci_dma_map(struct pci_dev *pci,struct videobuf_dmabuf *dma)
 {
         struct videobuf_queue q;
+        struct videobuf_queue_ops qops;
 
         q.dev=pci;
-        q.ops->vb_map_sg=(vb_map_sg_t *)pci_unmap_sg;
+        qops.vb_map_sg=(vb_map_sg_t *)pci_map_sg;
+        qops.vb_unmap_sg=(vb_map_sg_t *)pci_unmap_sg;
+        q.ops = &qops;
 
-        return (videobuf_dma_unmap(&q,dma));
+        return (videobuf_dma_map(&q,dma));
 }
 
 int videobuf_pci_dma_unmap(struct pci_dev *pci,struct videobuf_dmabuf *dma)
 {
         struct videobuf_queue q;
+        struct videobuf_queue_ops qops;
 
         q.dev=pci;
-        q.ops->vb_map_sg=(vb_map_sg_t *)pci_unmap_sg;
+        qops.vb_map_sg=(vb_map_sg_t *)pci_map_sg;
+        qops.vb_unmap_sg=(vb_map_sg_t *)pci_unmap_sg;
+        q.ops = &qops;
 
         return (videobuf_dma_unmap(&q,dma));
 }
@@ -923,7 +929,7 @@ ssize_t videobuf_read_one(struct videobuf_queue *q,
                 /* need to capture a new frame */
                 retval = -ENOMEM;
                 q->read_buf = videobuf_alloc(q->msize);
-                dprintk(1,"video alloc=0x%08x\n",(unsigned int) q->read_buf);
+                dprintk(1,"video alloc=0x%p\n", q->read_buf);
                 if (NULL == q->read_buf)
                         goto done;
                 q->read_buf->memory = V4L2_MEMORY_USERPTR;
diff --git a/drivers/media/video/wm8739.c b/drivers/media/video/wm8739.c
new file mode 100644
index 000000000000..a9b59c35cd67
--- /dev/null
+++ b/drivers/media/video/wm8739.c
@@ -0,0 +1,355 @@
+/*
+ * wm8739
+ *
+ * Copyright (C) 2005 T. Adachi <tadachi@tadachi-net.com>
+ *
+ * Copyright (C) 2005 Hans Verkuil <hverkuil@xs4all.nl>
+ * - Cleanup
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
+ */
+
+#include <linux/module.h>
+#include <linux/types.h>
+#include <linux/ioctl.h>
+#include <asm/uaccess.h>
+#include <linux/i2c.h>
+#include <linux/i2c-id.h>
+#include <linux/videodev.h>
+#include <media/v4l2-common.h>
+
+MODULE_DESCRIPTION("wm8739 driver");
+MODULE_AUTHOR("T. Adachi, Hans Verkuil");
+MODULE_LICENSE("GPL");
+
+static int debug = 0;
+static unsigned short normal_i2c[] = { 0x34 >> 1, 0x36 >> 1, I2C_CLIENT_END };
+
+module_param(debug, int, 0644);
+
+MODULE_PARM_DESC(debug, "Debug level (0-1)");
+
+
+I2C_CLIENT_INSMOD;
+
+/* ------------------------------------------------------------------------ */
+
+enum {
+        R0 = 0, R1,
+        R5 = 5, R6, R7, R8, R9, R15 = 15,
+        TOT_REGS
+};
+
+struct wm8739_state {
+        u32 clock_freq;
+        u8 muted;
+        u16 volume;
+        u16 balance;
+        u8 vol_l;               /* +12dB to -34.5dB 1.5dB step (5bit) def:0dB */
+        u8 vol_r;               /* +12dB to -34.5dB 1.5dB step (5bit) def:0dB */
+};
+
+/* ------------------------------------------------------------------------ */
+
+static int wm8739_write(struct i2c_client *client, int reg, u16 val)
+{
+        int i;
+
+        if (reg < 0 || reg >= TOT_REGS) {
+                v4l_err(client, "Invalid register R%d\n", reg);
+                return -1;
+        }
+
+        v4l_dbg(1, debug, client, "write: %02x %02x\n", reg, val);
+
+        for (i = 0; i < 3; i++) {
+                if (i2c_smbus_write_byte_data(client, (reg << 1) |
+                                        (val >> 8), val & 0xff) == 0) {
+                        return 0;
+                }
+        }
+        v4l_err(client, "I2C: cannot write %03x to register R%d\n", val, reg);
+        return -1;
+}
+
+/* write regs to set audio volume etc */
+static void wm8739_set_audio(struct i2c_client *client)
+{
+        struct wm8739_state *state = i2c_get_clientdata(client);
+        u16 mute = state->muted ? 0x80 : 0;
+
+        /* Volume setting: bits 0-4, 0x1f = 12 dB, 0x00 = -34.5 dB
+         * Default setting: 0x17 = 0 dB
+         */
+        wm8739_write(client, R0, (state->vol_l & 0x1f) | mute);
+        wm8739_write(client, R1, (state->vol_r & 0x1f) | mute);
+}
+
+static int wm8739_get_ctrl(struct i2c_client *client, struct v4l2_control *ctrl)
+{
+        struct wm8739_state *state = i2c_get_clientdata(client);
+
+        switch (ctrl->id) {
+        case V4L2_CID_AUDIO_MUTE:
+                ctrl->value = state->muted;
+                break;
+
+        case V4L2_CID_AUDIO_VOLUME:
+                ctrl->value = state->volume;
+                break;
+
+        case V4L2_CID_AUDIO_BALANCE:
+                ctrl->value = state->balance;
+                break;
+
+        default:
+                return -EINVAL;
+        }
+        return 0;
+}
+
+static int wm8739_set_ctrl(struct i2c_client *client, struct v4l2_control *ctrl)
+{
+        struct wm8739_state *state = i2c_get_clientdata(client);
+        unsigned int work_l, work_r;
+
+        switch (ctrl->id) {
+        case V4L2_CID_AUDIO_MUTE:
+                state->muted = ctrl->value;
+                break;
+
+        case V4L2_CID_AUDIO_VOLUME:
+                state->volume = ctrl->value;
+                break;
+
+        case V4L2_CID_AUDIO_BALANCE:
+                state->balance = ctrl->value;
+                break;
+
+        default:
+                return -EINVAL;
+        }
+
+        /* normalize ( 65535 to 0 -> 31 to 0 (12dB to -34.5dB) ) */
+        work_l = (min(65536 - state->balance, 32768) * state->volume) / 32768;
+        work_r = (min(state->balance, (u16)32768) * state->volume) / 32768;
+
+        state->vol_l = (long)work_l * 31 / 65535;
+        state->vol_r = (long)work_r * 31 / 65535;
+
+        /* set audio volume etc. */
+        wm8739_set_audio(client);
+        return 0;
+}
+
+/* ------------------------------------------------------------------------ */
+
+static struct v4l2_queryctrl wm8739_qctrl[] = {
+        {
+                .id            = V4L2_CID_AUDIO_VOLUME,
+                .name          = "Volume",
+                .minimum       = 0,
+                .maximum       = 65535,
+                .step          = 65535/100,
+                .default_value = 58880,
+                .flags         = 0,
+                .type          = V4L2_CTRL_TYPE_INTEGER,
+        },{
+                .id            = V4L2_CID_AUDIO_MUTE,
+                .name          = "Mute",
+                .minimum       = 0,
+                .maximum       = 1,
+                .step          = 1,
+                .default_value = 1,
+                .flags         = 0,
+                .type          = V4L2_CTRL_TYPE_BOOLEAN,
+        },{
+                .id            = V4L2_CID_AUDIO_BALANCE,
+                .name          = "Balance",
+                .minimum       = 0,
+                .maximum       = 65535,
+                .step          = 65535/100,
+                .default_value = 32768,
+                .flags         = 0,
+                .type          = V4L2_CTRL_TYPE_INTEGER,
+        }
+};
+
+/* ------------------------------------------------------------------------ */
+
+static int wm8739_command(struct i2c_client *client, unsigned int cmd, void *arg)
+{
+        struct wm8739_state *state = i2c_get_clientdata(client);
+
+        switch (cmd) {
+        case VIDIOC_INT_AUDIO_CLOCK_FREQ:
+        {
+                u32 audiofreq = *(u32 *)arg;
+
+                state->clock_freq = audiofreq;
+                wm8739_write(client, R9, 0x000);        /* de-activate */
+                switch (audiofreq) {
+                case 44100:
+                        wm8739_write(client, R8, 0x020); /* 256fps, fs=44.1k     */
+                        break;
+                case 48000:
+                        wm8739_write(client, R8, 0x000); /* 256fps, fs=48k       */
+                        break;
+                case 32000:
+                        wm8739_write(client, R8, 0x018); /* 256fps, fs=32k       */
+                        break;
+                default:
+                        break;
+                }
+                wm8739_write(client, R9, 0x001);        /* activate */
+                break;
+        }
+
+        case VIDIOC_G_CTRL:
+                return wm8739_get_ctrl(client, arg);
+
+        case VIDIOC_S_CTRL:
+                return wm8739_set_ctrl(client, arg);
+
+        case VIDIOC_QUERYCTRL:
+        {
+                struct v4l2_queryctrl *qc = arg;
+                int i;
+
+                for (i = 0; i < ARRAY_SIZE(wm8739_qctrl); i++)
+                        if (qc->id && qc->id == wm8739_qctrl[i].id) {
+                                memcpy(qc, &wm8739_qctrl[i], sizeof(*qc));
+                                return 0;
+                        }
+                return -EINVAL;
+        }
+
+        case VIDIOC_LOG_STATUS:
+                v4l_info(client, "Frequency: %u Hz\n", state->clock_freq);
+                v4l_info(client, "Volume L:  %02x%s\n", state->vol_l & 0x1f,
+                                state->muted ? " (muted)" : "");
+                v4l_info(client, "Volume R:  %02x%s\n", state->vol_r & 0x1f,
+                                state->muted ? " (muted)" : "");
+                break;
+
+        default:
+                return -EINVAL;
+        }
+
+        return 0;
+}
+
+/* ------------------------------------------------------------------------ */
+
+/* i2c implementation */
+
+static struct i2c_driver i2c_driver;
+
+static int wm8739_attach(struct i2c_adapter *adapter, int address, int kind)
+{
+        struct i2c_client *client;
+        struct wm8739_state *state;
+
+        /* Check if the adapter supports the needed features */
+        if (!i2c_check_functionality(adapter, I2C_FUNC_SMBUS_BYTE_DATA))
+                return 0;
+
+        client = kzalloc(sizeof(struct i2c_client), GFP_KERNEL);
+        if (client == NULL)
+                return -ENOMEM;
+
+        client->addr = address;
+        client->adapter = adapter;
+        client->driver = &i2c_driver;
+        snprintf(client->name, sizeof(client->name) - 1, "wm8739");
+
+        v4l_info(client, "chip found @ 0x%x (%s)\n", address << 1, adapter->name);
+
+        state = kmalloc(sizeof(struct wm8739_state), GFP_KERNEL);
+        if (state == NULL) {
+                kfree(client);
+                return -ENOMEM;
+        }
+        state->vol_l = 0x17; /* 0dB */
+        state->vol_r = 0x17; /* 0dB */
+        state->muted = 0;
+        state->balance = 32768;
+        /* normalize (12dB(31) to -34.5dB(0) [0dB(23)] -> 65535 to 0) */
+        state->volume = ((long)state->vol_l + 1) * 65535 / 31;
+        state->clock_freq = 48000;
+        i2c_set_clientdata(client, state);
+
+        /* initialize wm8739 */
+        wm8739_write(client, R15, 0x00); /* reset */
+        wm8739_write(client, R5, 0x000); /* filter setting, high path, offet clear */
+        wm8739_write(client, R6, 0x000); /* ADC, OSC, Power Off mode Disable */
+        wm8739_write(client, R7, 0x049); /* Digital Audio interface format */
+                                         /* Enable Master mode */
+                                         /* 24 bit, MSB first/left justified */
+        wm8739_write(client, R8, 0x000); /* sampling control */
+                                         /* normal, 256fs, 48KHz sampling rate */
+        wm8739_write(client, R9, 0x001); /* activate */
+        wm8739_set_audio(client);        /* set volume/mute */
+
+        i2c_attach_client(client);
+
+        return 0;
+}
+
+static int wm8739_probe(struct i2c_adapter *adapter)
+{
+        if (adapter->class & I2C_CLASS_TV_ANALOG)
+                return i2c_probe(adapter, &addr_data, wm8739_attach);
+        return 0;
+}
+
+static int wm8739_detach(struct i2c_client *client)
+{
+        int err;
+
+        err = i2c_detach_client(client);
+        if (err)
+                return err;
+
+        kfree(client);
+        return 0;
+}
+
+/* ----------------------------------------------------------------------- */
+
+/* i2c implementation */
+static struct i2c_driver i2c_driver = {
+        .driver = {
+                .name = "wm8739",
+        },
+        .id = I2C_DRIVERID_WM8739,
+        .attach_adapter = wm8739_probe,
+        .detach_client  = wm8739_detach,
+        .command = wm8739_command,
+};
+
+
+static int __init wm8739_init_module(void)
+{
+        return i2c_add_driver(&i2c_driver);
+}
+
+static void __exit wm8739_cleanup_module(void)
+{
+        i2c_del_driver(&i2c_driver);
+}
+
+module_init(wm8739_init_module);
+module_exit(wm8739_cleanup_module);
diff --git a/drivers/media/video/zc0301/Kconfig b/drivers/media/video/zc0301/Kconfig
new file mode 100644
index 000000000000..c3bf886b80cd
--- /dev/null
+++ b/drivers/media/video/zc0301/Kconfig
@@ -0,0 +1,11 @@
+config USB_ZC0301
+        tristate "USB ZC0301 Image Processor and Control Chip support"
+        depends on USB && VIDEO_DEV
+        ---help---
+          Say Y here if you want support for cameras based on the ZC0301
+          Image Processor and Control Chip.
+
+          See <file:Documentation/video4linux/zc0301.txt> for more info.
+
+          To compile this driver as a module, choose M here: the
+          module will be called zc0301.
diff --git a/drivers/mmc/Kconfig b/drivers/mmc/Kconfig
index 7cc162e8978b..003b077c2324 100644
--- a/drivers/mmc/Kconfig
+++ b/drivers/mmc/Kconfig
@@ -91,4 +91,22 @@ config MMC_AU1X
 
           If unsure, say N.
 
+config MMC_AT91RM9200
+        tristate "AT91RM9200 SD/MMC Card Interface support"
+        depends on ARCH_AT91RM9200 && MMC
+        help
+          This selects the AT91RM9200 MCI controller.
+
+          If unsure, say N.
+
+config MMC_IMX
+        tristate "Motorola i.MX Multimedia Card Interface support"
+        depends on ARCH_IMX && MMC
+        help
+          This selects the Motorola i.MX Multimedia card Interface.
+          If you have a i.MX platform with a Multimedia Card slot,
+          say Y or M here.
+
+          If unsure, say N.
+
 endmenu
diff --git a/drivers/mmc/Makefile b/drivers/mmc/Makefile
index c7c34aadfc92..d2957e35cc6f 100644
--- a/drivers/mmc/Makefile
+++ b/drivers/mmc/Makefile
@@ -17,10 +17,12 @@ obj-$(CONFIG_MMC_BLOCK)		+= mmc_block.o
 #
 obj-$(CONFIG_MMC_ARMMMCI)       += mmci.o
 obj-$(CONFIG_MMC_PXA)           += pxamci.o
+obj-$(CONFIG_MMC_IMX)           += imxmmc.o
 obj-$(CONFIG_MMC_SDHCI)         += sdhci.o
 obj-$(CONFIG_MMC_WBSD)          += wbsd.o
 obj-$(CONFIG_MMC_AU1X)          += au1xmmc.o
 obj-$(CONFIG_MMC_OMAP)          += omap.o
+obj-$(CONFIG_MMC_AT91RM9200)    += at91_mci.o
 
 mmc_core-y := mmc.o mmc_queue.o mmc_sysfs.o
 
diff --git a/drivers/mmc/at91_mci.c b/drivers/mmc/at91_mci.c
new file mode 100644
index 000000000000..6061c2d101a0
--- /dev/null
+++ b/drivers/mmc/at91_mci.c
@@ -0,0 +1,988 @@
+/*
+ *  linux/drivers/mmc/at91_mci.c - ATMEL AT91RM9200 MCI Driver
+ *
+ *  Copyright (C) 2005 Cougar Creek Computing Devices Ltd, All Rights Reserved
+ *
+ *  Copyright (C) 2006 Malcolm Noyes
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+
+/*
+   This is the AT91RM9200 MCI driver that has been tested with both MMC cards
+   and SD-cards.  Boards that support write protect are now supported.
+   The CCAT91SBC001 board does not support SD cards.
+
+   The three entry points are at91_mci_request, at91_mci_set_ios
+   and at91_mci_get_ro.
+
+   SET IOS
+     This configures the device to put it into the correct mode and clock speed
+     required.
+
+   MCI REQUEST
+     MCI request processes the commands sent in the mmc_request structure. This
+     can consist of a processing command and a stop command in the case of
+     multiple block transfers.
+
+     There are three main types of request, commands, reads and writes.
+
+     Commands are straight forward. The command is submitted to the controller and
+     the request function returns. When the controller generates an interrupt to indicate
+     the command is finished, the response to the command are read and the mmc_request_done
+     function called to end the request.
+
+     Reads and writes work in a similar manner to normal commands but involve the PDC (DMA)
+     controller to manage the transfers.
+
+     A read is done from the controller directly to the scatterlist passed in from the request.
+     Due to a bug in the controller, when a read is completed, all the words are byte
+     swapped in the scatterlist buffers.
+
+     The sequence of read interrupts is: ENDRX, RXBUFF, CMDRDY
+
+     A write is slightly different in that the bytes to write are read from the scatterlist
+     into a dma memory buffer (this is in case the source buffer should be read only). The
+     entire write buffer is then done from this single dma memory buffer.
+
+     The sequence of write interrupts is: ENDTX, TXBUFE, NOTBUSY, CMDRDY
+
+   GET RO
+     Gets the status of the write protect pin, if available.
+*/
+
+#include <linux/config.h>
+#include <linux/module.h>
+#include <linux/moduleparam.h>
+#include <linux/init.h>
+#include <linux/ioport.h>
+#include <linux/platform_device.h>
+#include <linux/interrupt.h>
+#include <linux/blkdev.h>
+#include <linux/delay.h>
+#include <linux/err.h>
+#include <linux/dma-mapping.h>
+#include <linux/clk.h>
+
+#include <linux/mmc/host.h>
+#include <linux/mmc/protocol.h>
+
+#include <asm/io.h>
+#include <asm/irq.h>
+#include <asm/mach/mmc.h>
+#include <asm/arch/board.h>
+#include <asm/arch/gpio.h>
+#include <asm/arch/at91rm9200_mci.h>
+#include <asm/arch/at91rm9200_pdc.h>
+
+#define DRIVER_NAME "at91_mci"
+
+#undef  SUPPORT_4WIRE
+
+#ifdef CONFIG_MMC_DEBUG
+#define DBG(fmt...)     \
+        printk(fmt)
+#else
+#define DBG(fmt...)     do { } while (0)
+#endif
+
+static struct clk *mci_clk;
+
+#define FL_SENT_COMMAND (1 << 0)
+#define FL_SENT_STOP (1 << 1)
+
+
+
+/*
+ * Read from a MCI register.
+ */
+static inline unsigned long at91_mci_read(unsigned int reg)
+{
+        void __iomem *mci_base = (void __iomem *)AT91_VA_BASE_MCI;
+
+        return __raw_readl(mci_base + reg);
+}
+
+/*
+ * Write to a MCI register.
+ */
+static inline void at91_mci_write(unsigned int reg, unsigned long value)
+{
+        void __iomem *mci_base = (void __iomem *)AT91_VA_BASE_MCI;
+
+        __raw_writel(value, mci_base + reg);
+}
+
+/*
+ * Low level type for this driver
+ */
+struct at91mci_host
+{
+        struct mmc_host *mmc;
+        struct mmc_command *cmd;
+        struct mmc_request *request;
+
+        struct at91_mmc_data *board;
+        int present;
+
+        /*
+         * Flag indicating when the command has been sent. This is used to
+         * work out whether or not to send the stop
+         */
+        unsigned int flags;
+        /* flag for current bus settings */
+        u32 bus_mode;
+
+        /* DMA buffer used for transmitting */
+        unsigned int* buffer;
+        dma_addr_t physical_address;
+        unsigned int total_length;
+
+        /* Latest in the scatterlist that has been enabled for transfer, but not freed */
+        int in_use_index;
+
+        /* Latest in the scatterlist that has been enabled for transfer */
+        int transfer_index;
+};
+
+/*
+ * Copy from sg to a dma block - used for transfers
+ */
+static inline void at91mci_sg_to_dma(struct at91mci_host *host, struct mmc_data *data)
+{
+        unsigned int len, i, size;
+        unsigned *dmabuf = host->buffer;
+
+        size = host->total_length;
+        len = data->sg_len;
+
+        /*
+         * Just loop through all entries. Size might not
+         * be the entire list though so make sure that
+         * we do not transfer too much.
+         */
+        for (i = 0; i < len; i++) {
+                struct scatterlist *sg;
+                int amount;
+                int index;
+                unsigned int *sgbuffer;
+
+                sg = &data->sg[i];
+
+                sgbuffer = kmap_atomic(sg->page, KM_BIO_SRC_IRQ) + sg->offset;
+                amount = min(size, sg->length);
+                size -= amount;
+                amount /= 4;
+
+                for (index = 0; index < amount; index++)
+                        *dmabuf++ = swab32(sgbuffer[index]);
+
+                kunmap_atomic(sgbuffer, KM_BIO_SRC_IRQ);
+
+                if (size == 0)
+                        break;
+        }
+
+        /*
+         * Check that we didn't get a request to transfer
+         * more data than can fit into the SG list.
+         */
+        BUG_ON(size != 0);
+}
+
+/*
+ * Prepare a dma read
+ */
+static void at91mci_pre_dma_read(struct at91mci_host *host)
+{
+        int i;
+        struct scatterlist *sg;
+        struct mmc_command *cmd;
+        struct mmc_data *data;
+
+        DBG("pre dma read\n");
+
+        cmd = host->cmd;
+        if (!cmd) {
+                DBG("no command\n");
+                return;
+        }
+
+        data = cmd->data;
+        if (!data) {
+                DBG("no data\n");
+                return;
+        }
+
+        for (i = 0; i < 2; i++) {
+                /* nothing left to transfer */
+                if (host->transfer_index >= data->sg_len) {
+                        DBG("Nothing left to transfer (index = %d)\n", host->transfer_index);
+                        break;
+                }
+
+                /* Check to see if this needs filling */
+                if (i == 0) {
+                        if (at91_mci_read(AT91_PDC_RCR) != 0) {
+                                DBG("Transfer active in current\n");
+                                continue;
+                        }
+                }
+                else {
+                        if (at91_mci_read(AT91_PDC_RNCR) != 0) {
+                                DBG("Transfer active in next\n");
+                                continue;
+                        }
+                }
+
+                /* Setup the next transfer */
+                DBG("Using transfer index %d\n", host->transfer_index);
+
+                sg = &data->sg[host->transfer_index++];
+                DBG("sg = %p\n", sg);
+
+                sg->dma_address = dma_map_page(NULL, sg->page, sg->offset, sg->length, DMA_FROM_DEVICE);
+
+                DBG("dma address = %08X, length = %d\n", sg->dma_address, sg->length);
+
+                if (i == 0) {
+                        at91_mci_write(AT91_PDC_RPR, sg->dma_address);
+                        at91_mci_write(AT91_PDC_RCR, sg->length / 4);
+                }
+                else {
+                        at91_mci_write(AT91_PDC_RNPR, sg->dma_address);
+                        at91_mci_write(AT91_PDC_RNCR, sg->length / 4);
+                }
+        }
+
+        DBG("pre dma read done\n");
+}
+
+/*
+ * Handle after a dma read
+ */
+static void at91mci_post_dma_read(struct at91mci_host *host)
+{
+        struct mmc_command *cmd;
+        struct mmc_data *data;
+
+        DBG("post dma read\n");
+
+        cmd = host->cmd;
+        if (!cmd) {
+                DBG("no command\n");
+                return;
+        }
+
+        data = cmd->data;
+        if (!data) {
+                DBG("no data\n");
+                return;
+        }
+
+        while (host->in_use_index < host->transfer_index) {
+                unsigned int *buffer;
+                int index;
+                int len;
+
+                struct scatterlist *sg;
+
+                DBG("finishing index %d\n", host->in_use_index);
+
+                sg = &data->sg[host->in_use_index++];
+
+                DBG("Unmapping page %08X\n", sg->dma_address);
+
+                dma_unmap_page(NULL, sg->dma_address, sg->length, DMA_FROM_DEVICE);
+
+                /* Swap the contents of the buffer */
+                buffer = kmap_atomic(sg->page, KM_BIO_SRC_IRQ) + sg->offset;
+                DBG("buffer = %p, length = %d\n", buffer, sg->length);
+
+                data->bytes_xfered += sg->length;
+
+                len = sg->length / 4;
+
+                for (index = 0; index < len; index++) {
+                        buffer[index] = swab32(buffer[index]);
+                }
+                kunmap_atomic(buffer, KM_BIO_SRC_IRQ);
+                flush_dcache_page(sg->page);
+        }
+
+        /* Is there another transfer to trigger? */
+        if (host->transfer_index < data->sg_len)
+                at91mci_pre_dma_read(host);
+        else {
+                at91_mci_write(AT91_MCI_IER, AT91_MCI_RXBUFF);
+                at91_mci_write(AT91_PDC_PTCR, AT91_PDC_RXTDIS | AT91_PDC_TXTDIS);
+        }
+
+        DBG("post dma read done\n");
+}
+
+/*
+ * Handle transmitted data
+ */
+static void at91_mci_handle_transmitted(struct at91mci_host *host)
+{
+        struct mmc_command *cmd;
+        struct mmc_data *data;
+
+        DBG("Handling the transmit\n");
+
+        /* Disable the transfer */
+        at91_mci_write(AT91_PDC_PTCR, AT91_PDC_RXTDIS | AT91_PDC_TXTDIS);
+
+        /* Now wait for cmd ready */
+        at91_mci_write(AT91_MCI_IDR, AT91_MCI_TXBUFE);
+        at91_mci_write(AT91_MCI_IER, AT91_MCI_NOTBUSY);
+
+        cmd = host->cmd;
+        if (!cmd) return;
+
+        data = cmd->data;
+        if (!data) return;
+
+        data->bytes_xfered = host->total_length;
+}
+
+/*
+ * Enable the controller
+ */
+static void at91_mci_enable(void)
+{
+        at91_mci_write(AT91_MCI_CR, AT91_MCI_MCIEN);
+        at91_mci_write(AT91_MCI_IDR, 0xFFFFFFFF);
+        at91_mci_write(AT91_MCI_DTOR, AT91_MCI_DTOMUL_1M | AT91_MCI_DTOCYC);
+        at91_mci_write(AT91_MCI_MR, 0x834A);
+        at91_mci_write(AT91_MCI_SDCR, 0x0);
+}
+
+/*
+ * Disable the controller
+ */
+static void at91_mci_disable(void)
+{
+        at91_mci_write(AT91_MCI_CR, AT91_MCI_MCIDIS | AT91_MCI_SWRST);
+}
+
+/*
+ * Send a command
+ * return the interrupts to enable
+ */
+static unsigned int at91_mci_send_command(struct at91mci_host *host, struct mmc_command *cmd)
+{
+        unsigned int cmdr, mr;
+        unsigned int block_length;
+        struct mmc_data *data = cmd->data;
+
+        unsigned int blocks;
+        unsigned int ier = 0;
+
+        host->cmd = cmd;
+
+        /* Not sure if this is needed */
+#if 0
+        if ((at91_mci_read(AT91_MCI_SR) & AT91_MCI_RTOE) && (cmd->opcode == 1)) {
+                DBG("Clearing timeout\n");
+                at91_mci_write(AT91_MCI_ARGR, 0);
+                at91_mci_write(AT91_MCI_CMDR, AT91_MCI_OPDCMD);
+                while (!(at91_mci_read(AT91_MCI_SR) & AT91_MCI_CMDRDY)) {
+                        /* spin */
+                        DBG("Clearing: SR = %08X\n", at91_mci_read(AT91_MCI_SR));
+                }
+        }
+#endif
+        cmdr = cmd->opcode;
+
+        if (mmc_resp_type(cmd) == MMC_RSP_NONE)
+                cmdr |= AT91_MCI_RSPTYP_NONE;
+        else {
+                /* if a response is expected then allow maximum response latancy */
+                cmdr |= AT91_MCI_MAXLAT;
+                /* set 136 bit response for R2, 48 bit response otherwise */
+                if (mmc_resp_type(cmd) == MMC_RSP_R2)
+                        cmdr |= AT91_MCI_RSPTYP_136;
+                else
+                        cmdr |= AT91_MCI_RSPTYP_48;
+        }
+
+        if (data) {
+                block_length = 1 << data->blksz_bits;
+                blocks = data->blocks;
+
+                /* always set data start - also set direction flag for read */
+                if (data->flags & MMC_DATA_READ)
+                        cmdr |= (AT91_MCI_TRDIR | AT91_MCI_TRCMD_START);
+                else if (data->flags & MMC_DATA_WRITE)
+                        cmdr |= AT91_MCI_TRCMD_START;
+
+                if (data->flags & MMC_DATA_STREAM)
+                        cmdr |= AT91_MCI_TRTYP_STREAM;
+                if (data->flags & MMC_DATA_MULTI)
+                        cmdr |= AT91_MCI_TRTYP_MULTIPLE;
+        }
+        else {
+                block_length = 0;
+                blocks = 0;
+        }
+
+        if (cmd->opcode == MMC_STOP_TRANSMISSION)
+                cmdr |= AT91_MCI_TRCMD_STOP;
+
+        if (host->bus_mode == MMC_BUSMODE_OPENDRAIN)
+                cmdr |= AT91_MCI_OPDCMD;
+
+        /*
+         * Set the arguments and send the command
+         */
+        DBG("Sending command %d as %08X, arg = %08X, blocks = %d, length = %d (MR = %08lX)\n",
+                cmd->opcode, cmdr, cmd->arg, blocks, block_length, at91_mci_read(AT91_MCI_MR));
+
+        if (!data) {
+                at91_mci_write(AT91_PDC_PTCR, AT91_PDC_TXTDIS | AT91_PDC_RXTDIS);
+                at91_mci_write(AT91_PDC_RPR, 0);
+                at91_mci_write(AT91_PDC_RCR, 0);
+                at91_mci_write(AT91_PDC_RNPR, 0);
+                at91_mci_write(AT91_PDC_RNCR, 0);
+                at91_mci_write(AT91_PDC_TPR, 0);
+                at91_mci_write(AT91_PDC_TCR, 0);
+                at91_mci_write(AT91_PDC_TNPR, 0);
+                at91_mci_write(AT91_PDC_TNCR, 0);
+
+                at91_mci_write(AT91_MCI_ARGR, cmd->arg);
+                at91_mci_write(AT91_MCI_CMDR, cmdr);
+                return AT91_MCI_CMDRDY;
+        }
+
+        mr = at91_mci_read(AT91_MCI_MR) & 0x7fff;       /* zero block length and PDC mode */
+        at91_mci_write(AT91_MCI_MR, mr | (block_length << 16) | AT91_MCI_PDCMODE);
+
+        /*
+         * Disable the PDC controller
+         */
+        at91_mci_write(AT91_PDC_PTCR, AT91_PDC_RXTDIS | AT91_PDC_TXTDIS);
+
+        if (cmdr & AT91_MCI_TRCMD_START) {
+                data->bytes_xfered = 0;
+                host->transfer_index = 0;
+                host->in_use_index = 0;
+                if (cmdr & AT91_MCI_TRDIR) {
+                        /*
+                         * Handle a read
+                         */
+                        host->buffer = NULL;
+                        host->total_length = 0;
+
+                        at91mci_pre_dma_read(host);
+                        ier = AT91_MCI_ENDRX /* | AT91_MCI_RXBUFF */;
+                }
+                else {
+                        /*
+                         * Handle a write
+                         */
+                        host->total_length = block_length * blocks;
+                        host->buffer = dma_alloc_coherent(NULL,
+                                                  host->total_length,
+                                                  &host->physical_address, GFP_KERNEL);
+
+                        at91mci_sg_to_dma(host, data);
+
+                        DBG("Transmitting %d bytes\n", host->total_length);
+
+                        at91_mci_write(AT91_PDC_TPR, host->physical_address);
+                        at91_mci_write(AT91_PDC_TCR, host->total_length / 4);
+                        ier = AT91_MCI_TXBUFE;
+                }
+        }
+
+        /*
+         * Send the command and then enable the PDC - not the other way round as
+         * the data sheet says
+         */
+
+        at91_mci_write(AT91_MCI_ARGR, cmd->arg);
+        at91_mci_write(AT91_MCI_CMDR, cmdr);
+
+        if (cmdr & AT91_MCI_TRCMD_START) {
+                if (cmdr & AT91_MCI_TRDIR)
+                        at91_mci_write(AT91_PDC_PTCR, AT91_PDC_RXTEN);
+                else
+                        at91_mci_write(AT91_PDC_PTCR, AT91_PDC_TXTEN);
+        }
+        return ier;
+}
+
+/*
+ * Wait for a command to complete
+ */
+static void at91mci_process_command(struct at91mci_host *host, struct mmc_command *cmd)
+{
+        unsigned int ier;
+
+        ier = at91_mci_send_command(host, cmd);
+
+        DBG("setting ier to %08X\n", ier);
+
+        /* Stop on errors or the required value */
+        at91_mci_write(AT91_MCI_IER, 0xffff0000 | ier);
+}
+
+/*
+ * Process the next step in the request
+ */
+static void at91mci_process_next(struct at91mci_host *host)
+{
+        if (!(host->flags & FL_SENT_COMMAND)) {
+                host->flags |= FL_SENT_COMMAND;
+                at91mci_process_command(host, host->request->cmd);
+        }
+        else if ((!(host->flags & FL_SENT_STOP)) && host->request->stop) {
+                host->flags |= FL_SENT_STOP;
+                at91mci_process_command(host, host->request->stop);
+        }
+        else
+                mmc_request_done(host->mmc, host->request);
+}
+
+/*
+ * Handle a command that has been completed
+ */
+static void at91mci_completed_command(struct at91mci_host *host)
+{
+        struct mmc_command *cmd = host->cmd;
+        unsigned int status;
+
+        at91_mci_write(AT91_MCI_IDR, 0xffffffff);
+
+        cmd->resp[0] = at91_mci_read(AT91_MCI_RSPR(0));
+        cmd->resp[1] = at91_mci_read(AT91_MCI_RSPR(1));
+        cmd->resp[2] = at91_mci_read(AT91_MCI_RSPR(2));
+        cmd->resp[3] = at91_mci_read(AT91_MCI_RSPR(3));
+
+        if (host->buffer) {
+                dma_free_coherent(NULL, host->total_length, host->buffer, host->physical_address);
+                host->buffer = NULL;
+        }
+
+        status = at91_mci_read(AT91_MCI_SR);
+
+        DBG("Status = %08X [%08X %08X %08X %08X]\n",
+                 status, cmd->resp[0], cmd->resp[1], cmd->resp[2], cmd->resp[3]);
+
+        if (status & (AT91_MCI_RINDE | AT91_MCI_RDIRE | AT91_MCI_RCRCE |
+                        AT91_MCI_RENDE | AT91_MCI_RTOE | AT91_MCI_DCRCE |
+                        AT91_MCI_DTOE | AT91_MCI_OVRE | AT91_MCI_UNRE)) {
+                if ((status & AT91_MCI_RCRCE) &&
+                        ((cmd->opcode == MMC_SEND_OP_COND) || (cmd->opcode == SD_APP_OP_COND))) {
+                        cmd->error = MMC_ERR_NONE;
+                }
+                else {
+                        if (status & (AT91_MCI_RTOE | AT91_MCI_DTOE))
+                                cmd->error = MMC_ERR_TIMEOUT;
+                        else if (status & (AT91_MCI_RCRCE | AT91_MCI_DCRCE))
+                                cmd->error = MMC_ERR_BADCRC;
+                        else if (status & (AT91_MCI_OVRE | AT91_MCI_UNRE))
+                                cmd->error = MMC_ERR_FIFO;
+                        else
+                                cmd->error = MMC_ERR_FAILED;
+
+                        DBG("Error detected and set to %d (cmd = %d, retries = %d)\n",
+                                 cmd->error, cmd->opcode, cmd->retries);
+                }
+        }
+        else
+                cmd->error = MMC_ERR_NONE;
+
+        at91mci_process_next(host);
+}
+
+/*
+ * Handle an MMC request
+ */
+static void at91_mci_request(struct mmc_host *mmc, struct mmc_request *mrq)
+{
+        struct at91mci_host *host = mmc_priv(mmc);
+        host->request = mrq;
+        host->flags = 0;
+
+        at91mci_process_next(host);
+}
+
+/*
+ * Set the IOS
+ */
+static void at91_mci_set_ios(struct mmc_host *mmc, struct mmc_ios *ios)
+{
+        int clkdiv;
+        struct at91mci_host *host = mmc_priv(mmc);
+        unsigned long at91_master_clock = clk_get_rate(mci_clk);
+
+        DBG("Clock %uHz, busmode %u, powermode %u, Vdd %u\n",
+                ios->clock, ios->bus_mode, ios->power_mode, ios->vdd);
+
+        if (host)
+                host->bus_mode = ios->bus_mode;
+        else
+                printk("MMC: No host for bus_mode\n");
+
+        if (ios->clock == 0) {
+                /* Disable the MCI controller */
+                at91_mci_write(AT91_MCI_CR, AT91_MCI_MCIDIS);
+                clkdiv = 0;
+        }
+        else {
+                /* Enable the MCI controller */
+                at91_mci_write(AT91_MCI_CR, AT91_MCI_MCIEN);
+
+                if ((at91_master_clock % (ios->clock * 2)) == 0)
+                        clkdiv = ((at91_master_clock / ios->clock) / 2) - 1;
+                else
+                        clkdiv = (at91_master_clock / ios->clock) / 2;
+
+                DBG("clkdiv = %d. mcck = %ld\n", clkdiv,
+                        at91_master_clock / (2 * (clkdiv + 1)));
+        }
+        if (ios->bus_width == MMC_BUS_WIDTH_4 && host->board->wire4) {
+                DBG("MMC: Setting controller bus width to 4\n");
+                at91_mci_write(AT91_MCI_SDCR, at91_mci_read(AT91_MCI_SDCR) | AT91_MCI_SDCBUS);
+        }
+        else {
+                DBG("MMC: Setting controller bus width to 1\n");
+                at91_mci_write(AT91_MCI_SDCR, at91_mci_read(AT91_MCI_SDCR) & ~AT91_MCI_SDCBUS);
+        }
+
+        /* Set the clock divider */
+        at91_mci_write(AT91_MCI_MR, (at91_mci_read(AT91_MCI_MR) & ~AT91_MCI_CLKDIV) | clkdiv);
+
+        /* maybe switch power to the card */
+        if (host && host->board->vcc_pin) {
+                switch (ios->power_mode) {
+                        case MMC_POWER_OFF:
+                                at91_set_gpio_output(host->board->vcc_pin, 0);
+                                break;
+                        case MMC_POWER_UP:
+                        case MMC_POWER_ON:
+                                at91_set_gpio_output(host->board->vcc_pin, 1);
+                                break;
+                }
+        }
+}
+
+/*
+ * Handle an interrupt
+ */
+static irqreturn_t at91_mci_irq(int irq, void *devid, struct pt_regs *regs)
+{
+        struct at91mci_host *host = devid;
+        int completed = 0;
+
+        unsigned int int_status;
+
+        if (host == NULL)
+                return IRQ_HANDLED;
+
+        int_status = at91_mci_read(AT91_MCI_SR);
+        DBG("MCI irq: status = %08X, %08lX, %08lX\n", int_status, at91_mci_read(AT91_MCI_IMR),
+                int_status & at91_mci_read(AT91_MCI_IMR));
+
+        if ((int_status & at91_mci_read(AT91_MCI_IMR)) & 0xffff0000)
+                completed = 1;
+
+        int_status &= at91_mci_read(AT91_MCI_IMR);
+
+        if (int_status & AT91_MCI_UNRE)
+                DBG("MMC: Underrun error\n");
+        if (int_status & AT91_MCI_OVRE)
+                DBG("MMC: Overrun error\n");
+        if (int_status & AT91_MCI_DTOE)
+                DBG("MMC: Data timeout\n");
+        if (int_status & AT91_MCI_DCRCE)
+                DBG("MMC: CRC error in data\n");
+        if (int_status & AT91_MCI_RTOE)
+                DBG("MMC: Response timeout\n");
+        if (int_status & AT91_MCI_RENDE)
+                DBG("MMC: Response end bit error\n");
+        if (int_status & AT91_MCI_RCRCE)
+                DBG("MMC: Response CRC error\n");
+        if (int_status & AT91_MCI_RDIRE)
+                DBG("MMC: Response direction error\n");
+        if (int_status & AT91_MCI_RINDE)
+                DBG("MMC: Response index error\n");
+
+        /* Only continue processing if no errors */
+        if (!completed) {
+                if (int_status & AT91_MCI_TXBUFE) {
+                        DBG("TX buffer empty\n");
+                        at91_mci_handle_transmitted(host);
+                }
+
+                if (int_status & AT91_MCI_RXBUFF) {
+                        DBG("RX buffer full\n");
+                        at91_mci_write(AT91_MCI_IER, AT91_MCI_CMDRDY);
+                }
+
+                if (int_status & AT91_MCI_ENDTX) {
+                        DBG("Transmit has ended\n");
+                }
+
+                if (int_status & AT91_MCI_ENDRX) {
+                        DBG("Receive has ended\n");
+                        at91mci_post_dma_read(host);
+                }
+
+                if (int_status & AT91_MCI_NOTBUSY) {
+                        DBG("Card is ready\n");
+                        at91_mci_write(AT91_MCI_IER, AT91_MCI_CMDRDY);
+                }
+
+                if (int_status & AT91_MCI_DTIP) {
+                        DBG("Data transfer in progress\n");
+                }
+
+                if (int_status & AT91_MCI_BLKE) {
+                        DBG("Block transfer has ended\n");
+                }
+
+                if (int_status & AT91_MCI_TXRDY) {
+                        DBG("Ready to transmit\n");
+                }
+
+                if (int_status & AT91_MCI_RXRDY) {
+                        DBG("Ready to receive\n");
+                }
+
+                if (int_status & AT91_MCI_CMDRDY) {
+                        DBG("Command ready\n");
+                        completed = 1;
+                }
+        }
+        at91_mci_write(AT91_MCI_IDR, int_status);
+
+        if (completed) {
+                DBG("Completed command\n");
+                at91_mci_write(AT91_MCI_IDR, 0xffffffff);
+                at91mci_completed_command(host);
+        }
+
+        return IRQ_HANDLED;
+}
+
+static irqreturn_t at91_mmc_det_irq(int irq, void *_host, struct pt_regs *regs)
+{
+        struct at91mci_host *host = _host;
+        int present = !at91_get_gpio_value(irq);
+
+        /*
+         * we expect this irq on both insert and remove,
+         * and use a short delay to debounce.
+         */
+        if (present != host->present) {
+                host->present = present;
+                DBG("%s: card %s\n", mmc_hostname(host->mmc),
+                        present ? "insert" : "remove");
+                if (!present) {
+                        DBG("****** Resetting SD-card bus width ******\n");
+                        at91_mci_write(AT91_MCI_SDCR, 0);
+                }
+                mmc_detect_change(host->mmc, msecs_to_jiffies(100));
+        }
+        return IRQ_HANDLED;
+}
+
+int at91_mci_get_ro(struct mmc_host *mmc)
+{
+        int read_only = 0;
+        struct at91mci_host *host = mmc_priv(mmc);
+
+        if (host->board->wp_pin) {
+                read_only = at91_get_gpio_value(host->board->wp_pin);
+                printk(KERN_WARNING "%s: card is %s\n", mmc_hostname(mmc),
+                                (read_only ? "read-only" : "read-write") );
+        }
+        else {
+                printk(KERN_WARNING "%s: host does not support reading read-only "
+                                "switch.  Assuming write-enable.\n", mmc_hostname(mmc));
+        }
+        return read_only;
+}
+
+static struct mmc_host_ops at91_mci_ops = {
+        .request        = at91_mci_request,
+        .set_ios        = at91_mci_set_ios,
+        .get_ro         = at91_mci_get_ro,
+};
+
+/*
+ * Probe for the device
+ */
+static int at91_mci_probe(struct platform_device *pdev)
+{
+        struct mmc_host *mmc;
+        struct at91mci_host *host;
+        int ret;
+
+        DBG("Probe MCI devices\n");
+        at91_mci_disable();
+        at91_mci_enable();
+
+        mmc = mmc_alloc_host(sizeof(struct at91mci_host), &pdev->dev);
+        if (!mmc) {
+                DBG("Failed to allocate mmc host\n");
+                return -ENOMEM;
+        }
+
+        mmc->ops = &at91_mci_ops;
+        mmc->f_min = 375000;
+        mmc->f_max = 25000000;
+        mmc->ocr_avail = MMC_VDD_32_33 | MMC_VDD_33_34;
+
+        host = mmc_priv(mmc);
+        host->mmc = mmc;
+        host->buffer = NULL;
+        host->bus_mode = 0;
+        host->board = pdev->dev.platform_data;
+        if (host->board->wire4) {
+#ifdef SUPPORT_4WIRE
+                mmc->caps |= MMC_CAP_4_BIT_DATA;
+#else
+                printk("MMC: 4 wire bus mode not supported by this driver - using 1 wire\n");
+#endif
+        }
+
+        /*
+         * Get Clock
+         */
+        mci_clk = clk_get(&pdev->dev, "mci_clk");
+        if (!mci_clk) {
+                printk(KERN_ERR "AT91 MMC: no clock defined.\n");
+                return -ENODEV;
+        }
+        clk_enable(mci_clk);                    /* Enable the peripheral clock */
+
+        /*
+         * Allocate the MCI interrupt
+         */
+        ret = request_irq(AT91_ID_MCI, at91_mci_irq, SA_SHIRQ, DRIVER_NAME, host);
+        if (ret) {
+                DBG("Failed to request MCI interrupt\n");
+                return ret;
+        }
+
+        platform_set_drvdata(pdev, mmc);
+
+        /*
+         * Add host to MMC layer
+         */
+        if (host->board->det_pin)
+                host->present = !at91_get_gpio_value(host->board->det_pin);
+        else
+                host->present = -1;
+
+        mmc_add_host(mmc);
+
+        /*
+         * monitor card insertion/removal if we can
+         */
+        if (host->board->det_pin) {
+                ret = request_irq(host->board->det_pin, at91_mmc_det_irq,
+                                SA_SAMPLE_RANDOM, DRIVER_NAME, host);
+                if (ret)
+                        DBG("couldn't allocate MMC detect irq\n");
+        }
+
+        DBG(KERN_INFO "Added MCI driver\n");
+
+        return 0;
+}
+
+/*
+ * Remove a device
+ */
+static int at91_mci_remove(struct platform_device *pdev)
+{
+        struct mmc_host *mmc = platform_get_drvdata(pdev);
+        struct at91mci_host *host;
+
+        if (!mmc)
+                return -1;
+
+        host = mmc_priv(mmc);
+
+        if (host->present != -1) {
+                free_irq(host->board->det_pin, host);
+                cancel_delayed_work(&host->mmc->detect);
+        }
+
+        mmc_remove_host(mmc);
+        at91_mci_disable();
+        free_irq(AT91_ID_MCI, host);
+        mmc_free_host(mmc);
+
+        clk_disable(mci_clk);                           /* Disable the peripheral clock */
+        clk_put(mci_clk);
+
+        platform_set_drvdata(pdev, NULL);
+
+        DBG("Removed\n");
+
+        return 0;
+}
+
+#ifdef CONFIG_PM
+static int at91_mci_suspend(struct platform_device *pdev, pm_message_t state)
+{
+        struct mmc_host *mmc = platform_get_drvdata(pdev);
+        int ret = 0;
+
+        if (mmc)
+                ret = mmc_suspend_host(mmc, state);
+
+        return ret;
+}
+
+static int at91_mci_resume(struct platform_device *pdev)
+{
+        struct mmc_host *mmc = platform_get_drvdata(pdev);
+        int ret = 0;
+
+        if (mmc)
+                ret = mmc_resume_host(mmc);
+
+        return ret;
+}
+#else
+#define at91_mci_suspend        NULL
+#define at91_mci_resume         NULL
+#endif
+
+static struct platform_driver at91_mci_driver = {
+        .probe          = at91_mci_probe,
+        .remove         = at91_mci_remove,
+        .suspend        = at91_mci_suspend,
+        .resume         = at91_mci_resume,
+        .driver         = {
+                .name   = DRIVER_NAME,
+                .owner  = THIS_MODULE,
+        },
+};
+
+static int __init at91_mci_init(void)
+{
+        return platform_driver_register(&at91_mci_driver);
+}
+
+static void __exit at91_mci_exit(void)
+{
+        platform_driver_unregister(&at91_mci_driver);
+}
+
+module_init(at91_mci_init);
+module_exit(at91_mci_exit);
+
+MODULE_DESCRIPTION("AT91 Multimedia Card Interface driver");
+MODULE_AUTHOR("Nick Randell");
+MODULE_LICENSE("GPL");
diff --git a/drivers/mmc/imxmmc.c b/drivers/mmc/imxmmc.c
new file mode 100644
index 000000000000..ffb7f55d3467
--- /dev/null
+++ b/drivers/mmc/imxmmc.c
@@ -0,0 +1,1096 @@
+/*
+ *  linux/drivers/mmc/imxmmc.c - Motorola i.MX MMCI driver
+ *
+ *  Copyright (C) 2004 Sascha Hauer, Pengutronix <sascha@saschahauer.de>
+ *  Copyright (C) 2006 Pavel Pisa, PiKRON <ppisa@pikron.com>
+ *
+ *  derived from pxamci.c by Russell King
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ *
+ *  2005-04-17 Pavel Pisa <pisa@cmp.felk.cvut.cz>
+ *             Changed to conform redesigned i.MX scatter gather DMA interface
+ *
+ *  2005-11-04 Pavel Pisa <pisa@cmp.felk.cvut.cz>
+ *             Updated for 2.6.14 kernel
+ *
+ *  2005-12-13 Jay Monkman <jtm@smoothsmoothie.com>
+ *             Found and corrected problems in the write path
+ *
+ *  2005-12-30 Pavel Pisa <pisa@cmp.felk.cvut.cz>
+ *             The event handling rewritten right way in softirq.
+ *             Added many ugly hacks and delays to overcome SDHC
+ *             deficiencies
+ *
+ */
+#include <linux/config.h>
+
+#ifdef CONFIG_MMC_DEBUG
+#define DEBUG
+#else
+#undef  DEBUG
+#endif
+
+#include <linux/module.h>
+#include <linux/init.h>
+#include <linux/ioport.h>
+#include <linux/platform_device.h>
+#include <linux/interrupt.h>
+#include <linux/blkdev.h>
+#include <linux/dma-mapping.h>
+#include <linux/mmc/host.h>
+#include <linux/mmc/card.h>
+#include <linux/mmc/protocol.h>
+#include <linux/delay.h>
+
+#include <asm/dma.h>
+#include <asm/io.h>
+#include <asm/irq.h>
+#include <asm/sizes.h>
+#include <asm/arch/mmc.h>
+#include <asm/arch/imx-dma.h>
+
+#include "imxmmc.h"
+
+#define DRIVER_NAME "imx-mmc"
+
+#define IMXMCI_INT_MASK_DEFAULT (INT_MASK_BUF_READY | INT_MASK_DATA_TRAN | \
+                      INT_MASK_WRITE_OP_DONE | INT_MASK_END_CMD_RES | \
+                      INT_MASK_AUTO_CARD_DETECT | INT_MASK_DAT0_EN | INT_MASK_SDIO)
+
+struct imxmci_host {
+        struct mmc_host         *mmc;
+        spinlock_t              lock;
+        struct resource         *res;
+        int                     irq;
+        imx_dmach_t             dma;
+        unsigned int            clkrt;
+        unsigned int            cmdat;
+        volatile unsigned int   imask;
+        unsigned int            power_mode;
+        unsigned int            present;
+        struct imxmmc_platform_data *pdata;
+
+        struct mmc_request      *req;
+        struct mmc_command      *cmd;
+        struct mmc_data         *data;
+
+        struct timer_list       timer;
+        struct tasklet_struct   tasklet;
+        unsigned int            status_reg;
+        unsigned long           pending_events;
+        /* Next to fields are there for CPU driven transfers to overcome SDHC deficiencies */
+        u16                     *data_ptr;
+        unsigned int            data_cnt;
+        atomic_t                stuck_timeout;
+
+        unsigned int            dma_nents;
+        unsigned int            dma_size;
+        unsigned int            dma_dir;
+        int                     dma_allocated;
+
+        unsigned char           actual_bus_width;
+};
+
+#define IMXMCI_PEND_IRQ_b       0
+#define IMXMCI_PEND_DMA_END_b   1
+#define IMXMCI_PEND_DMA_ERR_b   2
+#define IMXMCI_PEND_WAIT_RESP_b 3
+#define IMXMCI_PEND_DMA_DATA_b  4
+#define IMXMCI_PEND_CPU_DATA_b  5
+#define IMXMCI_PEND_CARD_XCHG_b 6
+#define IMXMCI_PEND_SET_INIT_b  7
+
+#define IMXMCI_PEND_IRQ_m       (1 << IMXMCI_PEND_IRQ_b)
+#define IMXMCI_PEND_DMA_END_m   (1 << IMXMCI_PEND_DMA_END_b)
+#define IMXMCI_PEND_DMA_ERR_m   (1 << IMXMCI_PEND_DMA_ERR_b)
+#define IMXMCI_PEND_WAIT_RESP_m (1 << IMXMCI_PEND_WAIT_RESP_b)
+#define IMXMCI_PEND_DMA_DATA_m  (1 << IMXMCI_PEND_DMA_DATA_b)
+#define IMXMCI_PEND_CPU_DATA_m  (1 << IMXMCI_PEND_CPU_DATA_b)
+#define IMXMCI_PEND_CARD_XCHG_m (1 << IMXMCI_PEND_CARD_XCHG_b)
+#define IMXMCI_PEND_SET_INIT_m  (1 << IMXMCI_PEND_SET_INIT_b)
+
+static void imxmci_stop_clock(struct imxmci_host *host)
+{
+        int i = 0;
+        MMC_STR_STP_CLK &= ~STR_STP_CLK_START_CLK;
+        while(i < 0x1000) {
+                if(!(i & 0x7f))
+                        MMC_STR_STP_CLK |= STR_STP_CLK_STOP_CLK;
+
+                if(!(MMC_STATUS & STATUS_CARD_BUS_CLK_RUN)) {
+                        /* Check twice before cut */
+                        if(!(MMC_STATUS & STATUS_CARD_BUS_CLK_RUN))
+                                return;
+                }
+
+                i++;
+        }
+        dev_dbg(mmc_dev(host->mmc), "imxmci_stop_clock blocked, no luck\n");
+}
+
+static void imxmci_start_clock(struct imxmci_host *host)
+{
+        int i = 0;
+        MMC_STR_STP_CLK &= ~STR_STP_CLK_STOP_CLK;
+        while(i < 0x1000) {
+                if(!(i & 0x7f))
+                        MMC_STR_STP_CLK |= STR_STP_CLK_START_CLK;
+
+                if(MMC_STATUS & STATUS_CARD_BUS_CLK_RUN) {
+                        /* Check twice before cut */
+                        if(MMC_STATUS & STATUS_CARD_BUS_CLK_RUN)
+                                return;
+                }
+
+                i++;
+        }
+        dev_dbg(mmc_dev(host->mmc), "imxmci_start_clock blocked, no luck\n");
+}
+
+static void imxmci_softreset(void)
+{
+        /* reset sequence */
+        MMC_STR_STP_CLK = 0x8;
+        MMC_STR_STP_CLK = 0xD;
+        MMC_STR_STP_CLK = 0x5;
+        MMC_STR_STP_CLK = 0x5;
+        MMC_STR_STP_CLK = 0x5;
+        MMC_STR_STP_CLK = 0x5;
+        MMC_STR_STP_CLK = 0x5;
+        MMC_STR_STP_CLK = 0x5;
+        MMC_STR_STP_CLK = 0x5;
+        MMC_STR_STP_CLK = 0x5;
+
+        MMC_RES_TO = 0xff;
+        MMC_BLK_LEN = 512;
+        MMC_NOB = 1;
+}
+
+static int imxmci_busy_wait_for_status(struct imxmci_host *host,
+                        unsigned int *pstat, unsigned int stat_mask,
+                        int timeout, const char *where)
+{
+        int loops=0;
+        while(!(*pstat & stat_mask)) {
+                loops+=2;
+                if(loops >= timeout) {
+                        dev_dbg(mmc_dev(host->mmc), "busy wait timeout in %s, STATUS = 0x%x (0x%x)\n",
+                                where, *pstat, stat_mask);
+                        return -1;
+                }
+                udelay(2);
+                *pstat |= MMC_STATUS;
+        }
+        if(!loops)
+                return 0;
+
+        dev_info(mmc_dev(host->mmc), "busy wait for %d usec in %s, STATUS = 0x%x (0x%x)\n",
+                loops, where, *pstat, stat_mask);
+        return loops;
+}
+
+static void imxmci_setup_data(struct imxmci_host *host, struct mmc_data *data)
+{
+        unsigned int nob = data->blocks;
+        unsigned int blksz = 1 << data->blksz_bits;
+        unsigned int datasz = nob * blksz;
+        int i;
+
+        if (data->flags & MMC_DATA_STREAM)
+                nob = 0xffff;
+
+        host->data = data;
+        data->bytes_xfered = 0;
+
+        MMC_NOB = nob;
+        MMC_BLK_LEN = blksz;
+
+        /*
+         * DMA cannot be used for small block sizes, we have to use CPU driven transfers otherwise.
+         * We are in big troubles for non-512 byte transfers according to note in the paragraph
+         * 20.6.7 of User Manual anyway, but we need to be able to transfer SCR at least.
+         * The situation is even more complex in reality. The SDHC in not able to handle wll
+         * partial FIFO fills and reads. The length has to be rounded up to burst size multiple.
+         * This is required for SCR read at least.
+         */
+        if (datasz < 64) {
+                host->dma_size = datasz;
+                if (data->flags & MMC_DATA_READ) {
+                        host->dma_dir = DMA_FROM_DEVICE;
+
+                        /* Hack to enable read SCR */
+                        if(datasz < 16) {
+                                MMC_NOB = 1;
+                                MMC_BLK_LEN = 16;
+                        }
+                } else {
+                        host->dma_dir = DMA_TO_DEVICE;
+                }
+
+                /* Convert back to virtual address */
+                host->data_ptr = (u16*)(page_address(data->sg->page) + data->sg->offset);
+                host->data_cnt = 0;
+
+                clear_bit(IMXMCI_PEND_DMA_DATA_b, &host->pending_events);
+                set_bit(IMXMCI_PEND_CPU_DATA_b, &host->pending_events);
+
+                return;
+        }
+
+        if (data->flags & MMC_DATA_READ) {
+                host->dma_dir = DMA_FROM_DEVICE;
+                host->dma_nents = dma_map_sg(mmc_dev(host->mmc), data->sg,
+                                                data->sg_len,  host->dma_dir);
+
+                imx_dma_setup_sg(host->dma, data->sg, data->sg_len, datasz,
+                        host->res->start + MMC_BUFFER_ACCESS_OFS, DMA_MODE_READ);
+
+                /*imx_dma_setup_mem2dev_ccr(host->dma, DMA_MODE_READ, IMX_DMA_WIDTH_16, CCR_REN);*/
+                CCR(host->dma) = CCR_DMOD_LINEAR | CCR_DSIZ_32 | CCR_SMOD_FIFO | CCR_SSIZ_16 | CCR_REN;
+        } else {
+                host->dma_dir = DMA_TO_DEVICE;
+
+                host->dma_nents = dma_map_sg(mmc_dev(host->mmc), data->sg,
+                                                data->sg_len,  host->dma_dir);
+
+                imx_dma_setup_sg(host->dma, data->sg, data->sg_len, datasz,
+                        host->res->start + MMC_BUFFER_ACCESS_OFS, DMA_MODE_WRITE);
+
+                /*imx_dma_setup_mem2dev_ccr(host->dma, DMA_MODE_WRITE, IMX_DMA_WIDTH_16, CCR_REN);*/
+                CCR(host->dma) = CCR_SMOD_LINEAR | CCR_SSIZ_32 | CCR_DMOD_FIFO | CCR_DSIZ_16 | CCR_REN;
+        }
+
+#if 1   /* This code is there only for consistency checking and can be disabled in future */
+        host->dma_size = 0;
+        for(i=0; i<host->dma_nents; i++)
+                host->dma_size+=data->sg[i].length;
+
+        if (datasz > host->dma_size) {
+                dev_err(mmc_dev(host->mmc), "imxmci_setup_data datasz 0x%x > 0x%x dm_size\n",
+                       datasz, host->dma_size);
+        }
+#endif
+
+        host->dma_size = datasz;
+
+        wmb();
+
+        if(host->actual_bus_width == MMC_BUS_WIDTH_4)
+                BLR(host->dma) = 0;     /* burst 64 byte read / 64 bytes write */
+        else
+                BLR(host->dma) = 16;    /* burst 16 byte read / 16 bytes write */
+
+        RSSR(host->dma) = DMA_REQ_SDHC;
+
+        set_bit(IMXMCI_PEND_DMA_DATA_b, &host->pending_events);
+        clear_bit(IMXMCI_PEND_CPU_DATA_b, &host->pending_events);
+
+        /* start DMA engine for read, write is delayed after initial response */
+        if (host->dma_dir == DMA_FROM_DEVICE) {
+                imx_dma_enable(host->dma);
+        }
+}
+
+static void imxmci_start_cmd(struct imxmci_host *host, struct mmc_command *cmd, unsigned int cmdat)
+{
+        unsigned long flags;
+        u32 imask;
+
+        WARN_ON(host->cmd != NULL);
+        host->cmd = cmd;
+
+        if (cmd->flags & MMC_RSP_BUSY)
+                cmdat |= CMD_DAT_CONT_BUSY;
+
+        switch (mmc_resp_type(cmd)) {
+        case MMC_RSP_R1: /* short CRC, OPCODE */
+        case MMC_RSP_R1B:/* short CRC, OPCODE, BUSY */
+                cmdat |= CMD_DAT_CONT_RESPONSE_FORMAT_R1;
+                break;
+        case MMC_RSP_R2: /* long 136 bit + CRC */
+                cmdat |= CMD_DAT_CONT_RESPONSE_FORMAT_R2;
+                break;
+        case MMC_RSP_R3: /* short */
+                cmdat |= CMD_DAT_CONT_RESPONSE_FORMAT_R3;
+                break;
+        case MMC_RSP_R6: /* short CRC */
+                cmdat |= CMD_DAT_CONT_RESPONSE_FORMAT_R6;
+                break;
+        default:
+                break;
+        }
+
+        if ( test_and_clear_bit(IMXMCI_PEND_SET_INIT_b, &host->pending_events) )
+                cmdat |= CMD_DAT_CONT_INIT; /* This command needs init */
+
+        if ( host->actual_bus_width == MMC_BUS_WIDTH_4 )
+                cmdat |= CMD_DAT_CONT_BUS_WIDTH_4;
+
+        MMC_CMD = cmd->opcode;
+        MMC_ARGH = cmd->arg >> 16;
+        MMC_ARGL = cmd->arg & 0xffff;
+        MMC_CMD_DAT_CONT = cmdat;
+
+        atomic_set(&host->stuck_timeout, 0);
+        set_bit(IMXMCI_PEND_WAIT_RESP_b, &host->pending_events);
+
+
+        imask = IMXMCI_INT_MASK_DEFAULT;
+        imask &= ~INT_MASK_END_CMD_RES;
+        if ( cmdat & CMD_DAT_CONT_DATA_ENABLE ) {
+                /*imask &= ~INT_MASK_BUF_READY;*/
+                imask &= ~INT_MASK_DATA_TRAN;
+                if ( cmdat & CMD_DAT_CONT_WRITE )
+                        imask &= ~INT_MASK_WRITE_OP_DONE;
+                if(test_bit(IMXMCI_PEND_CPU_DATA_b, &host->pending_events))
+                        imask &= ~INT_MASK_BUF_READY;
+        }
+
+        spin_lock_irqsave(&host->lock, flags);
+        host->imask = imask;
+        MMC_INT_MASK = host->imask;
+        spin_unlock_irqrestore(&host->lock, flags);
+
+        dev_dbg(mmc_dev(host->mmc), "CMD%02d (0x%02x) mask set to 0x%04x\n",
+                cmd->opcode, cmd->opcode, imask);
+
+        imxmci_start_clock(host);
+}
+
+static void imxmci_finish_request(struct imxmci_host *host, struct mmc_request *req)
+{
+        unsigned long flags;
+
+        spin_lock_irqsave(&host->lock, flags);
+
+        host->pending_events &= ~(IMXMCI_PEND_WAIT_RESP_m | IMXMCI_PEND_DMA_END_m |
+                        IMXMCI_PEND_DMA_DATA_m | IMXMCI_PEND_CPU_DATA_m);
+
+        host->imask = IMXMCI_INT_MASK_DEFAULT;
+        MMC_INT_MASK = host->imask;
+
+        spin_unlock_irqrestore(&host->lock, flags);
+
+        host->req = NULL;
+        host->cmd = NULL;
+        host->data = NULL;
+        mmc_request_done(host->mmc, req);
+}
+
+static int imxmci_finish_data(struct imxmci_host *host, unsigned int stat)
+{
+        struct mmc_data *data = host->data;
+        int data_error;
+
+        if(test_and_clear_bit(IMXMCI_PEND_DMA_DATA_b, &host->pending_events)){
+                imx_dma_disable(host->dma);
+                dma_unmap_sg(mmc_dev(host->mmc), data->sg, host->dma_nents,
+                             host->dma_dir);
+        }
+
+        if ( stat & STATUS_ERR_MASK ) {
+                dev_dbg(mmc_dev(host->mmc), "request failed. status: 0x%08x\n",stat);
+                if(stat & (STATUS_CRC_READ_ERR | STATUS_CRC_WRITE_ERR))
+                        data->error = MMC_ERR_BADCRC;
+                else if(stat & STATUS_TIME_OUT_READ)
+                        data->error = MMC_ERR_TIMEOUT;
+                else
+                        data->error = MMC_ERR_FAILED;
+        } else {
+                data->bytes_xfered = host->dma_size;
+        }
+
+        data_error = data->error;
+
+        host->data = NULL;
+
+        return data_error;
+}
+
+static int imxmci_cmd_done(struct imxmci_host *host, unsigned int stat)
+{
+        struct mmc_command *cmd = host->cmd;
+        int i;
+        u32 a,b,c;
+        struct mmc_data *data = host->data;
+
+        if (!cmd)
+                return 0;
+
+        host->cmd = NULL;
+
+        if (stat & STATUS_TIME_OUT_RESP) {
+                dev_dbg(mmc_dev(host->mmc), "CMD TIMEOUT\n");
+                cmd->error = MMC_ERR_TIMEOUT;
+        } else if (stat & STATUS_RESP_CRC_ERR && cmd->flags & MMC_RSP_CRC) {
+                dev_dbg(mmc_dev(host->mmc), "cmd crc error\n");
+                cmd->error = MMC_ERR_BADCRC;
+        }
+
+        if(cmd->flags & MMC_RSP_PRESENT) {
+                if(cmd->flags & MMC_RSP_136) {
+                        for (i = 0; i < 4; i++) {
+                                u32 a = MMC_RES_FIFO & 0xffff;
+                                u32 b = MMC_RES_FIFO & 0xffff;
+                                cmd->resp[i] = a<<16 | b;
+                        }
+                } else {
+                        a = MMC_RES_FIFO & 0xffff;
+                        b = MMC_RES_FIFO & 0xffff;
+                        c = MMC_RES_FIFO & 0xffff;
+                        cmd->resp[0] = a<<24 | b<<8 | c>>8;
+                }
+        }
+
+        dev_dbg(mmc_dev(host->mmc), "RESP 0x%08x, 0x%08x, 0x%08x, 0x%08x, error %d\n",
+                cmd->resp[0], cmd->resp[1], cmd->resp[2], cmd->resp[3], cmd->error);
+
+        if (data && (cmd->error == MMC_ERR_NONE) && !(stat & STATUS_ERR_MASK)) {
+                if (host->req->data->flags & MMC_DATA_WRITE) {
+
+                        /* Wait for FIFO to be empty before starting DMA write */
+
+                        stat = MMC_STATUS;
+                        if(imxmci_busy_wait_for_status(host, &stat,
+                                STATUS_APPL_BUFF_FE,
+                                40, "imxmci_cmd_done DMA WR") < 0) {
+                                cmd->error = MMC_ERR_FIFO;
+                                imxmci_finish_data(host, stat);
+                                if(host->req)
+                                        imxmci_finish_request(host, host->req);
+                                dev_warn(mmc_dev(host->mmc), "STATUS = 0x%04x\n",
+                                       stat);
+                                return 0;
+                        }
+
+                        if(test_bit(IMXMCI_PEND_DMA_DATA_b, &host->pending_events)) {
+                                imx_dma_enable(host->dma);
+                        }
+                }
+        } else {
+                struct mmc_request *req;
+                imxmci_stop_clock(host);
+                req = host->req;
+
+                if(data)
+                        imxmci_finish_data(host, stat);
+
+                if( req ) {
+                        imxmci_finish_request(host, req);
+                } else {
+                        dev_warn(mmc_dev(host->mmc), "imxmci_cmd_done: no request to finish\n");
+                }
+        }
+
+        return 1;
+}
+
+static int imxmci_data_done(struct imxmci_host *host, unsigned int stat)
+{
+        struct mmc_data *data = host->data;
+        int data_error;
+
+        if (!data)
+                return 0;
+
+        data_error = imxmci_finish_data(host, stat);
+
+        if (host->req->stop && (data_error == MMC_ERR_NONE)) {
+                imxmci_stop_clock(host);
+                imxmci_start_cmd(host, host->req->stop, 0);
+        } else {
+                struct mmc_request *req;
+                req = host->req;
+                if( req ) {
+                        imxmci_finish_request(host, req);
+                } else {
+                        dev_warn(mmc_dev(host->mmc), "imxmci_data_done: no request to finish\n");
+                }
+        }
+
+        return 1;
+}
+
+static int imxmci_cpu_driven_data(struct imxmci_host *host, unsigned int *pstat)
+{
+        int i;
+        int burst_len;
+        int flush_len;
+        int trans_done = 0;
+        unsigned int stat = *pstat;
+
+        if(host->actual_bus_width == MMC_BUS_WIDTH_4)
+                burst_len = 16;
+        else
+                burst_len = 64;
+
+        /* This is unfortunately required */
+        dev_dbg(mmc_dev(host->mmc), "imxmci_cpu_driven_data running STATUS = 0x%x\n",
+                stat);
+
+        if(host->dma_dir == DMA_FROM_DEVICE) {
+                imxmci_busy_wait_for_status(host, &stat,
+                                STATUS_APPL_BUFF_FF | STATUS_DATA_TRANS_DONE,
+                                20, "imxmci_cpu_driven_data read");
+
+                while((stat & (STATUS_APPL_BUFF_FF |  STATUS_DATA_TRANS_DONE)) &&
+                      (host->data_cnt < host->dma_size)) {
+                        if(burst_len >= host->dma_size - host->data_cnt) {
+                                flush_len = burst_len;
+                                burst_len = host->dma_size - host->data_cnt;
+                                flush_len -= burst_len;
+                                host->data_cnt = host->dma_size;
+                                trans_done = 1;
+                        } else {
+                                flush_len = 0;
+                                host->data_cnt += burst_len;
+                        }
+
+                        for(i = burst_len; i>=2 ; i-=2) {
+                                *(host->data_ptr++) = MMC_BUFFER_ACCESS;
+                                udelay(20);     /* required for clocks < 8MHz*/
+                        }
+
+                        if(i == 1)
+                                *(u8*)(host->data_ptr) = MMC_BUFFER_ACCESS;
+
+                        stat = MMC_STATUS;
+
+                        /* Flush extra bytes from FIFO */
+                        while(flush_len >= 2){
+                                flush_len -= 2;
+                                i = MMC_BUFFER_ACCESS;
+                                stat = MMC_STATUS;
+                                stat &= ~STATUS_CRC_READ_ERR; /* Stupid but required there */
+                        }
+
+                        dev_dbg(mmc_dev(host->mmc), "imxmci_cpu_driven_data read burst %d STATUS = 0x%x\n",
+                                burst_len, stat);
+                }
+        } else {
+                imxmci_busy_wait_for_status(host, &stat,
+                                STATUS_APPL_BUFF_FE,
+                                20, "imxmci_cpu_driven_data write");
+
+                while((stat & STATUS_APPL_BUFF_FE) &&
+                      (host->data_cnt < host->dma_size)) {
+                        if(burst_len >= host->dma_size - host->data_cnt) {
+                                burst_len = host->dma_size - host->data_cnt;
+                                host->data_cnt = host->dma_size;
+                                trans_done = 1;
+                        } else {
+                                host->data_cnt += burst_len;
+                        }
+
+                        for(i = burst_len; i>0 ; i-=2)
+                                MMC_BUFFER_ACCESS = *(host->data_ptr++);
+
+                        stat = MMC_STATUS;
+
+                        dev_dbg(mmc_dev(host->mmc), "imxmci_cpu_driven_data write burst %d STATUS = 0x%x\n",
+                                burst_len, stat);
+                }
+        }
+
+        *pstat = stat;
+
+        return trans_done;
+}
+
+static void imxmci_dma_irq(int dma, void *devid, struct pt_regs *regs)
+{
+        struct imxmci_host *host = devid;
+        uint32_t stat = MMC_STATUS;
+
+        atomic_set(&host->stuck_timeout, 0);
+        host->status_reg = stat;
+        set_bit(IMXMCI_PEND_DMA_END_b, &host->pending_events);
+        tasklet_schedule(&host->tasklet);
+}
+
+static irqreturn_t imxmci_irq(int irq, void *devid, struct pt_regs *regs)
+{
+        struct imxmci_host *host = devid;
+        uint32_t stat = MMC_STATUS;
+        int handled = 1;
+
+        MMC_INT_MASK = host->imask | INT_MASK_SDIO | INT_MASK_AUTO_CARD_DETECT;
+
+        atomic_set(&host->stuck_timeout, 0);
+        host->status_reg = stat;
+        set_bit(IMXMCI_PEND_IRQ_b, &host->pending_events);
+        tasklet_schedule(&host->tasklet);
+
+        return IRQ_RETVAL(handled);;
+}
+
+static void imxmci_tasklet_fnc(unsigned long data)
+{
+        struct imxmci_host *host = (struct imxmci_host *)data;
+        u32 stat;
+        unsigned int data_dir_mask = 0; /* STATUS_WR_CRC_ERROR_CODE_MASK */
+        int timeout = 0;
+
+        if(atomic_read(&host->stuck_timeout) > 4) {
+                char *what;
+                timeout = 1;
+                stat = MMC_STATUS;
+                host->status_reg = stat;
+                if (test_bit(IMXMCI_PEND_WAIT_RESP_b, &host->pending_events))
+                        if (test_bit(IMXMCI_PEND_DMA_DATA_b, &host->pending_events))
+                                what = "RESP+DMA";
+                        else
+                                what = "RESP";
+                else
+                        if (test_bit(IMXMCI_PEND_DMA_DATA_b, &host->pending_events))
+                                if(test_bit(IMXMCI_PEND_DMA_END_b, &host->pending_events))
+                                        what = "DATA";
+                                else
+                                        what = "DMA";
+                        else
+                                what = "???";
+
+                dev_err(mmc_dev(host->mmc), "%s TIMEOUT, hardware stucked STATUS = 0x%04x IMASK = 0x%04x\n",
+                       what, stat, MMC_INT_MASK);
+                dev_err(mmc_dev(host->mmc), "CMD_DAT_CONT = 0x%04x, MMC_BLK_LEN = 0x%04x, MMC_NOB = 0x%04x, DMA_CCR = 0x%08x\n",
+                       MMC_CMD_DAT_CONT, MMC_BLK_LEN, MMC_NOB, CCR(host->dma));
+                dev_err(mmc_dev(host->mmc), "CMD%d, bus %d-bit, dma_size = 0x%x\n",
+                       host->cmd?host->cmd->opcode:0, 1<<host->actual_bus_width, host->dma_size);
+        }
+
+        if(!host->present || timeout)
+                host->status_reg = STATUS_TIME_OUT_RESP | STATUS_TIME_OUT_READ |
+                                    STATUS_CRC_READ_ERR | STATUS_CRC_WRITE_ERR;
+
+        if(test_bit(IMXMCI_PEND_IRQ_b, &host->pending_events) || timeout) {
+                clear_bit(IMXMCI_PEND_IRQ_b, &host->pending_events);
+
+                stat = MMC_STATUS;
+                /*
+                 * This is not required in theory, but there is chance to miss some flag
+                 * which clears automatically by mask write, FreeScale original code keeps
+                 * stat from IRQ time so do I
+                 */
+                stat |= host->status_reg;
+
+                if(test_bit(IMXMCI_PEND_WAIT_RESP_b, &host->pending_events)) {
+                        imxmci_busy_wait_for_status(host, &stat,
+                                        STATUS_END_CMD_RESP | STATUS_ERR_MASK,
+                                        20, "imxmci_tasklet_fnc resp (ERRATUM #4)");
+                }
+
+                if(stat & (STATUS_END_CMD_RESP | STATUS_ERR_MASK)) {
+                        if(test_and_clear_bit(IMXMCI_PEND_WAIT_RESP_b, &host->pending_events))
+                                imxmci_cmd_done(host, stat);
+                        if(host->data && (stat & STATUS_ERR_MASK))
+                                imxmci_data_done(host, stat);
+                }
+
+                if(test_bit(IMXMCI_PEND_CPU_DATA_b, &host->pending_events)) {
+                        stat |= MMC_STATUS;
+                        if(imxmci_cpu_driven_data(host, &stat)){
+                                if(test_and_clear_bit(IMXMCI_PEND_WAIT_RESP_b, &host->pending_events))
+                                        imxmci_cmd_done(host, stat);
+                                atomic_clear_mask(IMXMCI_PEND_IRQ_m|IMXMCI_PEND_CPU_DATA_m,
+                                                        &host->pending_events);
+                                imxmci_data_done(host, stat);
+                        }
+                }
+        }
+
+        if(test_bit(IMXMCI_PEND_DMA_END_b, &host->pending_events) &&
+           !test_bit(IMXMCI_PEND_WAIT_RESP_b, &host->pending_events)) {
+
+                stat = MMC_STATUS;
+                /* Same as above */
+                stat |= host->status_reg;
+
+                if(host->dma_dir == DMA_TO_DEVICE) {
+                        data_dir_mask = STATUS_WRITE_OP_DONE;
+                } else {
+                        data_dir_mask = STATUS_DATA_TRANS_DONE;
+                }
+
+                imxmci_busy_wait_for_status(host, &stat,
+                                data_dir_mask,
+                                50, "imxmci_tasklet_fnc data");
+
+                if(stat & data_dir_mask) {
+                        clear_bit(IMXMCI_PEND_DMA_END_b, &host->pending_events);
+                        imxmci_data_done(host, stat);
+                }
+        }
+
+        if(test_and_clear_bit(IMXMCI_PEND_CARD_XCHG_b, &host->pending_events)) {
+
+                if(host->cmd)
+                        imxmci_cmd_done(host, STATUS_TIME_OUT_RESP);
+
+                if(host->data)
+                        imxmci_data_done(host, STATUS_TIME_OUT_READ |
+                                         STATUS_CRC_READ_ERR | STATUS_CRC_WRITE_ERR);
+
+                if(host->req)
+                        imxmci_finish_request(host, host->req);
+
+                mmc_detect_change(host->mmc, msecs_to_jiffies(100));
+
+        }
+}
+
+static void imxmci_request(struct mmc_host *mmc, struct mmc_request *req)
+{
+        struct imxmci_host *host = mmc_priv(mmc);
+        unsigned int cmdat;
+
+        WARN_ON(host->req != NULL);
+
+        host->req = req;
+
+        cmdat = 0;
+
+        if (req->data) {
+                imxmci_setup_data(host, req->data);
+
+                cmdat |= CMD_DAT_CONT_DATA_ENABLE;
+
+                if (req->data->flags & MMC_DATA_WRITE)
+                        cmdat |= CMD_DAT_CONT_WRITE;
+
+                if (req->data->flags & MMC_DATA_STREAM) {
+                        cmdat |= CMD_DAT_CONT_STREAM_BLOCK;
+                }
+        }
+
+        imxmci_start_cmd(host, req->cmd, cmdat);
+}
+
+#define CLK_RATE 19200000
+
+static void imxmci_set_ios(struct mmc_host *mmc, struct mmc_ios *ios)
+{
+        struct imxmci_host *host = mmc_priv(mmc);
+        int prescaler;
+
+        dev_dbg(mmc_dev(host->mmc), "clock %u power %u vdd %u width %u\n",
+                ios->clock, ios->power_mode, ios->vdd,
+                (ios->bus_width==MMC_BUS_WIDTH_4)?4:1);
+
+        if( ios->bus_width==MMC_BUS_WIDTH_4 ) {
+                host->actual_bus_width = MMC_BUS_WIDTH_4;
+                imx_gpio_mode(PB11_PF_SD_DAT3);
+        }else{
+                host->actual_bus_width = MMC_BUS_WIDTH_1;
+                imx_gpio_mode(GPIO_PORTB | GPIO_IN | GPIO_PUEN | 11);
+        }
+
+        if ( host->power_mode != ios->power_mode ) {
+                switch (ios->power_mode) {
+                case MMC_POWER_OFF:
+                        break;
+                case MMC_POWER_UP:
+                        set_bit(IMXMCI_PEND_SET_INIT_b, &host->pending_events);
+                        break;
+                case MMC_POWER_ON:
+                        break;
+                }
+                host->power_mode = ios->power_mode;
+        }
+
+        if ( ios->clock ) {
+                unsigned int clk;
+
+                /* The prescaler is 5 for PERCLK2 equal to 96MHz
+                 * then 96MHz / 5 = 19.2 MHz
+                 */
+                clk=imx_get_perclk2();
+                prescaler=(clk+(CLK_RATE*7)/8)/CLK_RATE;
+                switch(prescaler) {
+                case 0:
+                case 1: prescaler = 0;
+                        break;
+                case 2: prescaler = 1;
+                        break;
+                case 3: prescaler = 2;
+                        break;
+                case 4: prescaler = 4;
+                        break;
+                default:
+                case 5: prescaler = 5;
+                        break;
+                }
+
+                dev_dbg(mmc_dev(host->mmc), "PERCLK2 %d MHz -> prescaler %d\n",
+                        clk, prescaler);
+
+                for(clk=0; clk<8; clk++) {
+                        int x;
+                        x = CLK_RATE / (1<<clk);
+                        if( x <= ios->clock)
+                                break;
+                }
+
+                MMC_STR_STP_CLK |= STR_STP_CLK_ENABLE; /* enable controller */
+
+                imxmci_stop_clock(host);
+                MMC_CLK_RATE = (prescaler<<3) | clk;
+                imxmci_start_clock(host);
+
+                dev_dbg(mmc_dev(host->mmc), "MMC_CLK_RATE: 0x%08x\n", MMC_CLK_RATE);
+        } else {
+                imxmci_stop_clock(host);
+        }
+}
+
+static struct mmc_host_ops imxmci_ops = {
+        .request        = imxmci_request,
+        .set_ios        = imxmci_set_ios,
+};
+
+static struct resource *platform_device_resource(struct platform_device *dev, unsigned int mask, int nr)
+{
+        int i;
+
+        for (i = 0; i < dev->num_resources; i++)
+                if (dev->resource[i].flags == mask && nr-- == 0)
+                        return &dev->resource[i];
+        return NULL;
+}
+
+static int platform_device_irq(struct platform_device *dev, int nr)
+{
+        int i;
+
+        for (i = 0; i < dev->num_resources; i++)
+                if (dev->resource[i].flags == IORESOURCE_IRQ && nr-- == 0)
+                        return dev->resource[i].start;
+        return NO_IRQ;
+}
+
+static void imxmci_check_status(unsigned long data)
+{
+        struct imxmci_host *host = (struct imxmci_host *)data;
+
+        if( host->pdata->card_present() != host->present ) {
+                host->present ^= 1;
+                dev_info(mmc_dev(host->mmc), "card %s\n",
+                      host->present ? "inserted" : "removed");
+
+                set_bit(IMXMCI_PEND_CARD_XCHG_b, &host->pending_events);
+                tasklet_schedule(&host->tasklet);
+        }
+
+        if(test_bit(IMXMCI_PEND_WAIT_RESP_b, &host->pending_events) ||
+           test_bit(IMXMCI_PEND_DMA_DATA_b, &host->pending_events)) {
+                atomic_inc(&host->stuck_timeout);
+                if(atomic_read(&host->stuck_timeout) > 4)
+                        tasklet_schedule(&host->tasklet);
+        } else {
+                atomic_set(&host->stuck_timeout, 0);
+
+        }
+
+        mod_timer(&host->timer, jiffies + (HZ>>1));
+}
+
+static int imxmci_probe(struct platform_device *pdev)
+{
+        struct mmc_host *mmc;
+        struct imxmci_host *host = NULL;
+        struct resource *r;
+        int ret = 0, irq;
+
+        printk(KERN_INFO "i.MX mmc driver\n");
+
+        r = platform_device_resource(pdev, IORESOURCE_MEM, 0);
+        irq = platform_device_irq(pdev, 0);
+        if (!r || irq == NO_IRQ)
+                return -ENXIO;
+
+        r = request_mem_region(r->start, 0x100, "IMXMCI");
+        if (!r)
+                return -EBUSY;
+
+        mmc = mmc_alloc_host(sizeof(struct imxmci_host), &pdev->dev);
+        if (!mmc) {
+                ret = -ENOMEM;
+                goto out;
+        }
+
+        mmc->ops = &imxmci_ops;
+        mmc->f_min = 150000;
+        mmc->f_max = CLK_RATE/2;
+        mmc->ocr_avail = MMC_VDD_32_33;
+        mmc->caps |= MMC_CAP_4_BIT_DATA;
+
+        /* MMC core transfer sizes tunable parameters */
+        mmc->max_hw_segs = 64;
+        mmc->max_phys_segs = 64;
+        mmc->max_sectors = 64;          /* default 1 << (PAGE_CACHE_SHIFT - 9) */
+        mmc->max_seg_size = 64*512;     /* default PAGE_CACHE_SIZE */
+
+        host = mmc_priv(mmc);
+        host->mmc = mmc;
+        host->dma_allocated = 0;
+        host->pdata = pdev->dev.platform_data;
+
+        spin_lock_init(&host->lock);
+        host->res = r;
+        host->irq = irq;
+
+        imx_gpio_mode(PB8_PF_SD_DAT0);
+        imx_gpio_mode(PB9_PF_SD_DAT1);
+        imx_gpio_mode(PB10_PF_SD_DAT2);
+        /* Configured as GPIO with pull-up to ensure right MCC card mode */
+        /* Switched to PB11_PF_SD_DAT3 if 4 bit bus is configured */
+        imx_gpio_mode(GPIO_PORTB | GPIO_IN | GPIO_PUEN | 11);
+        /* imx_gpio_mode(PB11_PF_SD_DAT3); */
+        imx_gpio_mode(PB12_PF_SD_CLK);
+        imx_gpio_mode(PB13_PF_SD_CMD);
+
+        imxmci_softreset();
+
+        if ( MMC_REV_NO != 0x390 ) {
+                dev_err(mmc_dev(host->mmc), "wrong rev.no. 0x%08x. aborting.\n",
+                        MMC_REV_NO);
+                goto out;
+        }
+
+        MMC_READ_TO = 0x2db4; /* recommended in data sheet */
+
+        host->imask = IMXMCI_INT_MASK_DEFAULT;
+        MMC_INT_MASK = host->imask;
+
+
+        if(imx_dma_request_by_prio(&host->dma, DRIVER_NAME, DMA_PRIO_LOW)<0){
+                dev_err(mmc_dev(host->mmc), "imx_dma_request_by_prio failed\n");
+                ret = -EBUSY;
+                goto out;
+        }
+        host->dma_allocated=1;
+        imx_dma_setup_handlers(host->dma, imxmci_dma_irq, NULL, host);
+
+        tasklet_init(&host->tasklet, imxmci_tasklet_fnc, (unsigned long)host);
+        host->status_reg=0;
+        host->pending_events=0;
+
+        ret = request_irq(host->irq, imxmci_irq, 0, DRIVER_NAME, host);
+        if (ret)
+                goto out;
+
+        host->present = host->pdata->card_present();
+        init_timer(&host->timer);
+        host->timer.data = (unsigned long)host;
+        host->timer.function = imxmci_check_status;
+        add_timer(&host->timer);
+        mod_timer(&host->timer, jiffies + (HZ>>1));
+
+        platform_set_drvdata(pdev, mmc);
+
+        mmc_add_host(mmc);
+
+        return 0;
+
+out:
+        if (host) {
+                if(host->dma_allocated){
+                        imx_dma_free(host->dma);
+                        host->dma_allocated=0;
+                }
+        }
+        if (mmc)
+                mmc_free_host(mmc);
+        release_resource(r);
+        return ret;
+}
+
+static int imxmci_remove(struct platform_device *pdev)
+{
+        struct mmc_host *mmc = platform_get_drvdata(pdev);
+
+        platform_set_drvdata(pdev, NULL);
+
+        if (mmc) {
+                struct imxmci_host *host = mmc_priv(mmc);
+
+                tasklet_disable(&host->tasklet);
+
+                del_timer_sync(&host->timer);
+                mmc_remove_host(mmc);
+
+                free_irq(host->irq, host);
+                if(host->dma_allocated){
+                        imx_dma_free(host->dma);
+                        host->dma_allocated=0;
+                }
+
+                tasklet_kill(&host->tasklet);
+
+                release_resource(host->res);
+
+                mmc_free_host(mmc);
+        }
+        return 0;
+}
+
+#ifdef CONFIG_PM
+static int imxmci_suspend(struct platform_device *dev, pm_message_t state)
+{
+        struct mmc_host *mmc = platform_get_drvdata(dev);
+        int ret = 0;
+
+        if (mmc)
+                ret = mmc_suspend_host(mmc, state);
+
+        return ret;
+}
+
+static int imxmci_resume(struct platform_device *dev)
+{
+        struct mmc_host *mmc = platform_get_drvdata(dev);
+        struct imxmci_host *host;
+        int ret = 0;
+
+        if (mmc) {
+                host = mmc_priv(mmc);
+                if(host)
+                        set_bit(IMXMCI_PEND_SET_INIT_b, &host->pending_events);
+                ret = mmc_resume_host(mmc);
+        }
+
+        return ret;
+}
+#else
+#define imxmci_suspend  NULL
+#define imxmci_resume   NULL
+#endif /* CONFIG_PM */
+
+static struct platform_driver imxmci_driver = {
+        .probe          = imxmci_probe,
+        .remove         = imxmci_remove,
+        .suspend        = imxmci_suspend,
+        .resume         = imxmci_resume,
+        .driver         = {
+                .name           = DRIVER_NAME,
+        }
+};
+
+static int __init imxmci_init(void)
+{
+        return platform_driver_register(&imxmci_driver);
+}
+
+static void __exit imxmci_exit(void)
+{
+        platform_driver_unregister(&imxmci_driver);
+}
+
+module_init(imxmci_init);
+module_exit(imxmci_exit);
+
+MODULE_DESCRIPTION("i.MX Multimedia Card Interface Driver");
+MODULE_AUTHOR("Sascha Hauer, Pengutronix");
+MODULE_LICENSE("GPL");
diff --git a/drivers/mmc/imxmmc.h b/drivers/mmc/imxmmc.h
new file mode 100644
index 000000000000..e5339e334dbb
--- /dev/null
+++ b/drivers/mmc/imxmmc.h
@@ -0,0 +1,67 @@
+
+# define __REG16(x)     (*((volatile u16 *)IO_ADDRESS(x)))
+
+#define MMC_STR_STP_CLK  __REG16(IMX_MMC_BASE + 0x00)
+#define MMC_STATUS       __REG16(IMX_MMC_BASE + 0x04)
+#define MMC_CLK_RATE     __REG16(IMX_MMC_BASE + 0x08)
+#define MMC_CMD_DAT_CONT __REG16(IMX_MMC_BASE + 0x0C)
+#define MMC_RES_TO       __REG16(IMX_MMC_BASE + 0x10)
+#define MMC_READ_TO      __REG16(IMX_MMC_BASE + 0x14)
+#define MMC_BLK_LEN      __REG16(IMX_MMC_BASE + 0x18)
+#define MMC_NOB          __REG16(IMX_MMC_BASE + 0x1C)
+#define MMC_REV_NO       __REG16(IMX_MMC_BASE + 0x20)
+#define MMC_INT_MASK     __REG16(IMX_MMC_BASE + 0x24)
+#define MMC_CMD          __REG16(IMX_MMC_BASE + 0x28)
+#define MMC_ARGH         __REG16(IMX_MMC_BASE + 0x2C)
+#define MMC_ARGL         __REG16(IMX_MMC_BASE + 0x30)
+#define MMC_RES_FIFO     __REG16(IMX_MMC_BASE + 0x34)
+#define MMC_BUFFER_ACCESS __REG16(IMX_MMC_BASE + 0x38)
+#define MMC_BUFFER_ACCESS_OFS 0x38
+
+
+#define STR_STP_CLK_ENDIAN              (1<<5)
+#define STR_STP_CLK_RESET               (1<<3)
+#define STR_STP_CLK_ENABLE              (1<<2)
+#define STR_STP_CLK_START_CLK           (1<<1)
+#define STR_STP_CLK_STOP_CLK            (1<<0)
+#define STATUS_CARD_PRESENCE            (1<<15)
+#define STATUS_SDIO_INT_ACTIVE          (1<<14)
+#define STATUS_END_CMD_RESP             (1<<13)
+#define STATUS_WRITE_OP_DONE            (1<<12)
+#define STATUS_DATA_TRANS_DONE          (1<<11)
+#define STATUS_WR_CRC_ERROR_CODE_MASK   (3<<10)
+#define STATUS_CARD_BUS_CLK_RUN         (1<<8)
+#define STATUS_APPL_BUFF_FF             (1<<7)
+#define STATUS_APPL_BUFF_FE             (1<<6)
+#define STATUS_RESP_CRC_ERR             (1<<5)
+#define STATUS_CRC_READ_ERR             (1<<3)
+#define STATUS_CRC_WRITE_ERR            (1<<2)
+#define STATUS_TIME_OUT_RESP            (1<<1)
+#define STATUS_TIME_OUT_READ            (1<<0)
+#define STATUS_ERR_MASK                 0x2f
+#define CLK_RATE_PRESCALER(x)           ((x) & 0x7)
+#define CLK_RATE_CLK_RATE(x)            (((x) & 0x7) << 3)
+#define CMD_DAT_CONT_CMD_RESP_LONG_OFF  (1<<12)
+#define CMD_DAT_CONT_STOP_READWAIT      (1<<11)
+#define CMD_DAT_CONT_START_READWAIT     (1<<10)
+#define CMD_DAT_CONT_BUS_WIDTH_1        (0<<8)
+#define CMD_DAT_CONT_BUS_WIDTH_4        (2<<8)
+#define CMD_DAT_CONT_INIT               (1<<7)
+#define CMD_DAT_CONT_BUSY               (1<<6)
+#define CMD_DAT_CONT_STREAM_BLOCK       (1<<5)
+#define CMD_DAT_CONT_WRITE              (1<<4)
+#define CMD_DAT_CONT_DATA_ENABLE        (1<<3)
+#define CMD_DAT_CONT_RESPONSE_FORMAT_R1 (1)
+#define CMD_DAT_CONT_RESPONSE_FORMAT_R2 (2)
+#define CMD_DAT_CONT_RESPONSE_FORMAT_R3 (3)
+#define CMD_DAT_CONT_RESPONSE_FORMAT_R4 (4)
+#define CMD_DAT_CONT_RESPONSE_FORMAT_R5 (5)
+#define CMD_DAT_CONT_RESPONSE_FORMAT_R6 (6)
+#define INT_MASK_AUTO_CARD_DETECT       (1<<6)
+#define INT_MASK_DAT0_EN                (1<<5)
+#define INT_MASK_SDIO                   (1<<4)
+#define INT_MASK_BUF_READY              (1<<3)
+#define INT_MASK_END_CMD_RES            (1<<2)
+#define INT_MASK_WRITE_OP_DONE          (1<<1)
+#define INT_MASK_DATA_TRAN              (1<<0)
+#define INT_ALL                         (0x7f)
diff --git a/drivers/mtd/chips/Kconfig b/drivers/mtd/chips/Kconfig
index 0f6bb2e625d8..a7ec5954caf5 100644
--- a/drivers/mtd/chips/Kconfig
+++ b/drivers/mtd/chips/Kconfig
@@ -200,27 +200,6 @@ config MTD_CFI_AMDSTD
           provides support for one of those command sets, used on chips
           including the AMD Am29LV320.
 
-config MTD_CFI_AMDSTD_RETRY
-        int "Retry failed commands (erase/program)"
-        depends on MTD_CFI_AMDSTD
-        default "0"
-        help
-          Some chips, when attached to a shared bus, don't properly filter
-          bus traffic that is destined to other devices.  This broken
-          behavior causes erase and program sequences to be aborted when
-          the sequences are mixed with traffic for other devices.
-
-          SST49LF040 (and related) chips are know to be broken.
-
-config MTD_CFI_AMDSTD_RETRY_MAX
-        int "Max retries of failed commands (erase/program)"
-        depends on MTD_CFI_AMDSTD_RETRY
-        default "0"
-        help
-          If you have an SST49LF040 (or related chip) then this value should
-          be set to at least 1.  This can also be adjusted at driver load
-          time with the retry_cmd_max module parameter.
-
 config MTD_CFI_STAA
         tristate "Support for ST (Advanced Architecture) flash chips"
         depends on MTD_GEN_PROBE
diff --git a/drivers/mtd/devices/Kconfig b/drivers/mtd/devices/Kconfig
index dd628cb51e31..7fac438b5c32 100644
--- a/drivers/mtd/devices/Kconfig
+++ b/drivers/mtd/devices/Kconfig
@@ -129,8 +129,8 @@ config MTDRAM_ABS_POS
           allocating space from Linux's available memory. Otherwise, leave
           this set to zero. Most people will want to leave this as zero.
 
-config MTD_BLKMTD
-        tristate "MTD emulation using block device"
+config MTD_BLOCK2MTD
+        tristate "MTD using block device"
         depends on MTD
         help
           This driver allows a block device to appear as an MTD. It would
@@ -141,15 +141,6 @@ config MTD_BLKMTD
           Testing MTD users (eg JFFS2) on large media and media that might
           be removed during a write (using the floppy drive).
 
-config MTD_BLOCK2MTD
-        tristate "MTD using block device (rewrite)"
-        depends on MTD && EXPERIMENTAL
-        help
-          This driver is basically the same at MTD_BLKMTD above, but
-          experienced some interface changes plus serious speedups.  In
-          the long term, it should replace MTD_BLKMTD.  Right now, you
-          shouldn't entrust important data to it yet.
-
 comment "Disk-On-Chip Device Drivers"
 
 config MTD_DOC2000
diff --git a/drivers/mtd/devices/Makefile b/drivers/mtd/devices/Makefile
index 7c5ed2178380..b6573670316f 100644
--- a/drivers/mtd/devices/Makefile
+++ b/drivers/mtd/devices/Makefile
@@ -21,7 +21,6 @@ obj-$(CONFIG_MTD_PMC551)	+= pmc551.o
 obj-$(CONFIG_MTD_MS02NV)        += ms02-nv.o
 obj-$(CONFIG_MTD_MTDRAM)        += mtdram.o
 obj-$(CONFIG_MTD_LART)          += lart.o
-obj-$(CONFIG_MTD_BLKMTD)        += blkmtd.o
 obj-$(CONFIG_MTD_BLOCK2MTD)     += block2mtd.o
 obj-$(CONFIG_MTD_DATAFLASH)     += mtd_dataflash.o
 obj-$(CONFIG_MTD_M25P80)        += m25p80.o
diff --git a/drivers/mtd/devices/blkmtd.c b/drivers/mtd/devices/blkmtd.c
deleted file mode 100644
index 79f2e1f23ebd..000000000000
--- a/drivers/mtd/devices/blkmtd.c
+++ /dev/null
@@ -1,819 +0,0 @@
-/*
- * $Id: blkmtd.c,v 1.27 2005/11/07 11:14:24 gleixner Exp $
- *
- * blkmtd.c - use a block device as a fake MTD
- *
- * Author: Simon Evans <spse@secret.org.uk>
- *
- * Copyright (C) 2001,2002 Simon Evans
- *
- * Licence: GPL
- *
- * How it works:
- *      The driver uses raw/io to read/write the device and the page
- *      cache to cache access. Writes update the page cache with the
- *      new data and mark it dirty and add the page into a BIO which
- *      is then written out.
- *
- *      It can be loaded Read-Only to prevent erases and writes to the
- *      medium.
- *
- */
-
-#include <linux/config.h>
-#include <linux/module.h>
-#include <linux/fs.h>
-#include <linux/blkdev.h>
-#include <linux/bio.h>
-#include <linux/pagemap.h>
-#include <linux/list.h>
-#include <linux/init.h>
-#include <linux/mount.h>
-#include <linux/mtd/mtd.h>
-#include <linux/mutex.h>
-
-#define err(format, arg...) printk(KERN_ERR "blkmtd: " format "\n" , ## arg)
-#define info(format, arg...) printk(KERN_INFO "blkmtd: " format "\n" , ## arg)
-#define warn(format, arg...) printk(KERN_WARNING "blkmtd: " format "\n" , ## arg)
-#define crit(format, arg...) printk(KERN_CRIT "blkmtd: " format "\n" , ## arg)
-
-
-/* Default erase size in K, always make it a multiple of PAGE_SIZE */
-#define CONFIG_MTD_BLKDEV_ERASESIZE (128 << 10) /* 128KiB */
-#define VERSION "$Revision: 1.27 $"
-
-/* Info for the block device */
-struct blkmtd_dev {
-        struct list_head list;
-        struct block_device *blkdev;
-        struct mtd_info mtd_info;
-        struct mutex wrbuf_mutex;
-};
-
-
-/* Static info about the MTD, used in cleanup_module */
-static LIST_HEAD(blkmtd_device_list);
-
-
-static void blkmtd_sync(struct mtd_info *mtd);
-
-#define MAX_DEVICES 4
-
-/* Module parameters passed by insmod/modprobe */
-static char *device[MAX_DEVICES];    /* the block device to use */
-static int erasesz[MAX_DEVICES];     /* optional default erase size */
-static int ro[MAX_DEVICES];          /* optional read only flag */
-static int sync;
-
-
-MODULE_LICENSE("GPL");
-MODULE_AUTHOR("Simon Evans <spse@secret.org.uk>");
-MODULE_DESCRIPTION("Emulate an MTD using a block device");
-module_param_array(device, charp, NULL, 0);
-MODULE_PARM_DESC(device, "block device to use");
-module_param_array(erasesz, int, NULL, 0);
-MODULE_PARM_DESC(erasesz, "optional erase size to use in KiB. eg 4=4KiB.");
-module_param_array(ro, bool, NULL, 0);
-MODULE_PARM_DESC(ro, "1=Read only, writes and erases cause errors");
-module_param(sync, bool, 0);
-MODULE_PARM_DESC(sync, "1=Synchronous writes");
-
-
-/* completion handler for BIO reads */
-static int bi_read_complete(struct bio *bio, unsigned int bytes_done, int error)
-{
-        if (bio->bi_size)
-                return 1;
-
-        complete((struct completion*)bio->bi_private);
-        return 0;
-}
-
-
-/* completion handler for BIO writes */
-static int bi_write_complete(struct bio *bio, unsigned int bytes_done, int error)
-{
-        const int uptodate = test_bit(BIO_UPTODATE, &bio->bi_flags);
-        struct bio_vec *bvec = bio->bi_io_vec + bio->bi_vcnt - 1;
-
-        if (bio->bi_size)
-                return 1;
-
-        if(!uptodate)
-                err("bi_write_complete: not uptodate\n");
-
-        do {
-                struct page *page = bvec->bv_page;
-                DEBUG(3, "Cleaning up page %ld\n", page->index);
-                if (--bvec >= bio->bi_io_vec)
-                        prefetchw(&bvec->bv_page->flags);
-
-                if (uptodate) {
-                        SetPageUptodate(page);
-                } else {
-                        ClearPageUptodate(page);
-                        SetPageError(page);
-                }
-                clear_page_dirty(page);
-                unlock_page(page);
-                page_cache_release(page);
-        } while (bvec >= bio->bi_io_vec);
-
-        complete((struct completion*)bio->bi_private);
-        return 0;
-}
-
-
-/* read one page from the block device */
-static int blkmtd_readpage(struct blkmtd_dev *dev, struct page *page)
-{
-        struct bio *bio;
-        struct completion event;
-        int err = -ENOMEM;
-
-        if(PageUptodate(page)) {
-                DEBUG(2, "blkmtd: readpage page %ld is already upto date\n", page->index);
-                unlock_page(page);
-                return 0;
-        }
-
-        ClearPageUptodate(page);
-        ClearPageError(page);
-
-        bio = bio_alloc(GFP_KERNEL, 1);
-        if(bio) {
-                init_completion(&event);
-                bio->bi_bdev = dev->blkdev;
-                bio->bi_sector = page->index << (PAGE_SHIFT-9);
-                bio->bi_private = &event;
-                bio->bi_end_io = bi_read_complete;
-                if(bio_add_page(bio, page, PAGE_SIZE, 0) == PAGE_SIZE) {
-                        submit_bio(READ_SYNC, bio);
-                        wait_for_completion(&event);
-                        err = test_bit(BIO_UPTODATE, &bio->bi_flags) ? 0 : -EIO;
-                        bio_put(bio);
-                }
-        }
-
-        if(err)
-                SetPageError(page);
-        else
-                SetPageUptodate(page);
-        flush_dcache_page(page);
-        unlock_page(page);
-        return err;
-}
-
-
-/* write out the current BIO and wait for it to finish */
-static int blkmtd_write_out(struct bio *bio)
-{
-        struct completion event;
-        int err;
-
-        if(!bio->bi_vcnt) {
-                bio_put(bio);
-                return 0;
-        }
-
-        init_completion(&event);
-        bio->bi_private = &event;
-        bio->bi_end_io = bi_write_complete;
-        submit_bio(WRITE_SYNC, bio);
-        wait_for_completion(&event);
-        DEBUG(3, "submit_bio completed, bi_vcnt = %d\n", bio->bi_vcnt);
-        err = test_bit(BIO_UPTODATE, &bio->bi_flags) ? 0 : -EIO;
-        bio_put(bio);
-        return err;
-}
-
-
-/**
- * blkmtd_add_page - add a page to the current BIO
- * @bio: bio to add to (NULL to alloc initial bio)
- * @blkdev: block device
- * @page: page to add
- * @pagecnt: pages left to add
- *
- * Adds a page to the current bio, allocating it if necessary. If it cannot be
- * added, the current bio is written out and a new one is allocated. Returns
- * the new bio to add or NULL on error
- */
-static struct bio *blkmtd_add_page(struct bio *bio, struct block_device *blkdev,
-                                   struct page *page, int pagecnt)
-{
-
- retry:
-        if(!bio) {
-                bio = bio_alloc(GFP_KERNEL, pagecnt);
-                if(!bio)
-                        return NULL;
-                bio->bi_sector = page->index << (PAGE_SHIFT-9);
-                bio->bi_bdev = blkdev;
-        }
-
-        if(bio_add_page(bio, page, PAGE_SIZE, 0) != PAGE_SIZE) {
-                blkmtd_write_out(bio);
-                bio = NULL;
-                goto retry;
-        }
-        return bio;
-}
-
-
-/**
- * write_pages - write block of data to device via the page cache
- * @dev: device to write to
- * @buf: data source or NULL if erase (output is set to 0xff)
- * @to: offset into output device
- * @len: amount to data to write
- * @retlen: amount of data written
- *
- * Grab pages from the page cache and fill them with the source data.
- * Non page aligned start and end result in a readin of the page and
- * part of the page being modified. Pages are added to the bio and then written
- * out.
- */
-static int write_pages(struct blkmtd_dev *dev, const u_char *buf, loff_t to,
-                    size_t len, size_t *retlen)
-{
-        int pagenr, offset;
-        size_t start_len = 0, end_len;
-        int pagecnt = 0;
-        int err = 0;
-        struct bio *bio = NULL;
-        size_t thislen = 0;
-
-        pagenr = to >> PAGE_SHIFT;
-        offset = to & ~PAGE_MASK;
-
-        DEBUG(2, "blkmtd: write_pages: buf = %p to = %ld len = %zd pagenr = %d offset = %d\n",
-              buf, (long)to, len, pagenr, offset);
-
-        /* see if we have to do a partial write at the start */
-        if(offset) {
-                start_len = ((offset + len) > PAGE_SIZE) ? PAGE_SIZE - offset : len;
-                len -= start_len;
-        }
-
-        /* calculate the length of the other two regions */
-        end_len = len & ~PAGE_MASK;
-        len -= end_len;
-
-        if(start_len)
-                pagecnt++;
-
-        if(len)
-                pagecnt += len >> PAGE_SHIFT;
-
-        if(end_len)
-                pagecnt++;
-
-        mutex_lock(&dev->wrbuf_mutex);
-
-        DEBUG(3, "blkmtd: write: start_len = %zd len = %zd end_len = %zd pagecnt = %d\n",
-              start_len, len, end_len, pagecnt);
-
-        if(start_len) {
-                /* do partial start region */
-                struct page *page;
-
-                DEBUG(3, "blkmtd: write: doing partial start, page = %d len = %zd offset = %d\n",
-                      pagenr, start_len, offset);
-
-                BUG_ON(!buf);
-                page = read_cache_page(dev->blkdev->bd_inode->i_mapping, pagenr, (filler_t *)blkmtd_readpage, dev);
-                lock_page(page);
-                if(PageDirty(page)) {
-                        err("to = %lld start_len = %zd len = %zd end_len = %zd pagenr = %d\n",
-                            to, start_len, len, end_len, pagenr);
-                        BUG();
-                }
-                memcpy(page_address(page)+offset, buf, start_len);
-                set_page_dirty(page);
-                SetPageUptodate(page);
-                buf += start_len;
-                thislen = start_len;
-                bio = blkmtd_add_page(bio, dev->blkdev, page, pagecnt);
-                if(!bio) {
-                        err = -ENOMEM;
-                        err("bio_add_page failed\n");
-                        goto write_err;
-                }
-                pagecnt--;
-                pagenr++;
-        }
-
-        /* Now do the main loop to a page aligned, n page sized output */
-        if(len) {
-                int pagesc = len >> PAGE_SHIFT;
-                DEBUG(3, "blkmtd: write: whole pages start = %d, count = %d\n",
-                      pagenr, pagesc);
-                while(pagesc) {
-                        struct page *page;
-
-                        /* see if page is in the page cache */
-                        DEBUG(3, "blkmtd: write: grabbing page %d from page cache\n", pagenr);
-                        page = grab_cache_page(dev->blkdev->bd_inode->i_mapping, pagenr);
-                        if(PageDirty(page)) {
-                                BUG();
-                        }
-                        if(!page) {
-                                warn("write: cannot grab cache page %d", pagenr);
-                                err = -ENOMEM;
-                                goto write_err;
-                        }
-                        if(!buf) {
-                                memset(page_address(page), 0xff, PAGE_SIZE);
-                        } else {
-                                memcpy(page_address(page), buf, PAGE_SIZE);
-                                buf += PAGE_SIZE;
-                        }
-                        bio = blkmtd_add_page(bio, dev->blkdev, page, pagecnt);
-                        if(!bio) {
-                                err = -ENOMEM;
-                                err("bio_add_page failed\n");
-                                goto write_err;
-                        }
-                        pagenr++;
-                        pagecnt--;
-                        set_page_dirty(page);
-                        SetPageUptodate(page);
-                        pagesc--;
-                        thislen += PAGE_SIZE;
-                }
-        }
-
-        if(end_len) {
-                /* do the third region */
-                struct page *page;
-                DEBUG(3, "blkmtd: write: doing partial end, page = %d len = %zd\n",
-                      pagenr, end_len);
-                BUG_ON(!buf);
-                page = read_cache_page(dev->blkdev->bd_inode->i_mapping, pagenr, (filler_t *)blkmtd_readpage, dev);
-                lock_page(page);
-                if(PageDirty(page)) {
-                        err("to = %lld start_len = %zd len = %zd end_len = %zd pagenr = %d\n",
-                            to, start_len, len, end_len, pagenr);
-                        BUG();
-                }
-                memcpy(page_address(page), buf, end_len);
-                set_page_dirty(page);
-                SetPageUptodate(page);
-                DEBUG(3, "blkmtd: write: writing out partial end\n");
-                thislen += end_len;
-                bio = blkmtd_add_page(bio, dev->blkdev, page, pagecnt);
-                if(!bio) {
-                        err = -ENOMEM;
-                        err("bio_add_page failed\n");
-                        goto write_err;
-                }
-                pagenr++;
-        }
-
-        DEBUG(3, "blkmtd: write: got %d vectors to write\n", bio->bi_vcnt);
- write_err:
-        if(bio)
-                blkmtd_write_out(bio);
-
-        DEBUG(2, "blkmtd: write: end, retlen = %zd, err = %d\n", *retlen, err);
-        mutex_unlock(&dev->wrbuf_mutex);
-
-        if(retlen)
-                *retlen = thislen;
-        return err;
-}
-
-
-/* erase a specified part of the device */
-static int blkmtd_erase(struct mtd_info *mtd, struct erase_info *instr)
-{
-        struct blkmtd_dev *dev = mtd->priv;
-        struct mtd_erase_region_info *einfo = mtd->eraseregions;
-        int numregions = mtd->numeraseregions;
-        size_t from;
-        u_long len;
-        int err = -EIO;
-        size_t retlen;
-
-        instr->state = MTD_ERASING;
-        from = instr->addr;
-        len = instr->len;
-
-        /* check erase region has valid start and length */
-        DEBUG(2, "blkmtd: erase: dev = `%s' from = 0x%zx len = 0x%lx\n",
-              mtd->name+9, from, len);
-        while(numregions) {
-                DEBUG(3, "blkmtd: checking erase region = 0x%08X size = 0x%X num = 0x%x\n",
-                      einfo->offset, einfo->erasesize, einfo->numblocks);
-                if(from >= einfo->offset
-                   && from < einfo->offset + (einfo->erasesize * einfo->numblocks)) {
-                        if(len == einfo->erasesize
-                           && ( (from - einfo->offset) % einfo->erasesize == 0))
-                                break;
-                }
-                numregions--;
-                einfo++;
-        }
-
-        if(!numregions) {
-                /* Not a valid erase block */
-                err("erase: invalid erase request 0x%lX @ 0x%08zX", len, from);
-                instr->state = MTD_ERASE_FAILED;
-                err = -EIO;
-        }
-
-        if(instr->state != MTD_ERASE_FAILED) {
-                /* do the erase */
-                DEBUG(3, "Doing erase from = %zd len = %ld\n", from, len);
-                err = write_pages(dev, NULL, from, len, &retlen);
-                if(err || retlen != len) {
-                        err("erase failed err = %d", err);
-                        instr->state = MTD_ERASE_FAILED;
-                } else {
-                        instr->state = MTD_ERASE_DONE;
-                }
-        }
-
-        DEBUG(3, "blkmtd: erase: checking callback\n");
-        mtd_erase_callback(instr);
-        DEBUG(2, "blkmtd: erase: finished (err = %d)\n", err);
-        return err;
-}
-
-
-/* read a range of the data via the page cache */
-static int blkmtd_read(struct mtd_info *mtd, loff_t from, size_t len,
-                       size_t *retlen, u_char *buf)
-{
-        struct blkmtd_dev *dev = mtd->priv;
-        int err = 0;
-        int offset;
-        int pagenr, pages;
-        size_t thislen = 0;
-
-        DEBUG(2, "blkmtd: read: dev = `%s' from = %lld len = %zd buf = %p\n",
-              mtd->name+9, from, len, buf);
-
-        if(from > mtd->size)
-                return -EINVAL;
-        if(from + len > mtd->size)
-                len = mtd->size - from;
-
-        pagenr = from >> PAGE_SHIFT;
-        offset = from - (pagenr << PAGE_SHIFT);
-
-        pages = (offset+len+PAGE_SIZE-1) >> PAGE_SHIFT;
-        DEBUG(3, "blkmtd: read: pagenr = %d offset = %d, pages = %d\n",
-              pagenr, offset, pages);
-
-        while(pages) {
-                struct page *page;
-                int cpylen;
-
-                DEBUG(3, "blkmtd: read: looking for page: %d\n", pagenr);
-                page = read_cache_page(dev->blkdev->bd_inode->i_mapping, pagenr, (filler_t *)blkmtd_readpage, dev);
-                if(IS_ERR(page)) {
-                        err = -EIO;
-                        goto readerr;
-                }
-
-                cpylen = (PAGE_SIZE > len) ? len : PAGE_SIZE;
-                if(offset+cpylen > PAGE_SIZE)
-                        cpylen = PAGE_SIZE-offset;
-
-                memcpy(buf + thislen, page_address(page) + offset, cpylen);
-                offset = 0;
-                len -= cpylen;
-                thislen += cpylen;
-                pagenr++;
-                pages--;
-                if(!PageDirty(page))
-                        page_cache_release(page);
-        }
-
- readerr:
-        if(retlen)
-                *retlen = thislen;
-        DEBUG(2, "blkmtd: end read: retlen = %zd, err = %d\n", thislen, err);
-        return err;
-}
-
-
-/* write data to the underlying device */
-static int blkmtd_write(struct mtd_info *mtd, loff_t to, size_t len,
-                        size_t *retlen, const u_char *buf)
-{
-        struct blkmtd_dev *dev = mtd->priv;
-        int err;
-
-        if(!len)
-                return 0;
-
-        DEBUG(2, "blkmtd: write: dev = `%s' to = %lld len = %zd buf = %p\n",
-              mtd->name+9, to, len, buf);
-
-        if(to >= mtd->size) {
-                return -ENOSPC;
-        }
-
-        if(to + len > mtd->size) {
-                len = mtd->size - to;
-        }
-
-        err = write_pages(dev, buf, to, len, retlen);
-        if(err > 0)
-                err = 0;
-        DEBUG(2, "blkmtd: write: end, err = %d\n", err);
-        return err;
-}
-
-
-/* sync the device - wait until the write queue is empty */
-static void blkmtd_sync(struct mtd_info *mtd)
-{
-        /* Currently all writes are synchronous */
-}
-
-
-static void free_device(struct blkmtd_dev *dev)
-{
-        DEBUG(2, "blkmtd: free_device() dev = %p\n", dev);
-        if(dev) {
-                kfree(dev->mtd_info.eraseregions);
-                kfree(dev->mtd_info.name);
-                if(dev->blkdev) {
-                        invalidate_inode_pages(dev->blkdev->bd_inode->i_mapping);
-                        close_bdev_excl(dev->blkdev);
-                }
-                kfree(dev);
-        }
-}
-
-
-/* For a given size and initial erase size, calculate the number
- * and size of each erase region. Goes round the loop twice,
- * once to find out how many regions, then allocates space,
- * then round the loop again to fill it in.
- */
-static struct mtd_erase_region_info *calc_erase_regions(
-        size_t erase_size, size_t total_size, int *regions)
-{
-        struct mtd_erase_region_info *info = NULL;
-
-        DEBUG(2, "calc_erase_regions, es = %zd size = %zd regions = %d\n",
-              erase_size, total_size, *regions);
-        /* Make any user specified erasesize be a power of 2
-           and at least PAGE_SIZE */
-        if(erase_size) {
-                int es = erase_size;
-                erase_size = 1;
-                while(es != 1) {
-                        es >>= 1;
-                        erase_size <<= 1;
-                }
-                if(erase_size < PAGE_SIZE)
-                        erase_size = PAGE_SIZE;
-        } else {
-                erase_size = CONFIG_MTD_BLKDEV_ERASESIZE;
-        }
-
-        *regions = 0;
-
-        do {
-                int tot_size = total_size;
-                int er_size = erase_size;
-                int count = 0, offset = 0, regcnt = 0;
-
-                while(tot_size) {
-                        count = tot_size / er_size;
-                        if(count) {
-                                tot_size = tot_size % er_size;
-                                if(info) {
-                                        DEBUG(2, "adding to erase info off=%d er=%d cnt=%d\n",
-                                              offset, er_size, count);
-                                        (info+regcnt)->offset = offset;
-                                        (info+regcnt)->erasesize = er_size;
-                                        (info+regcnt)->numblocks = count;
-                                        (*regions)++;
-                                }
-                                regcnt++;
-                                offset += (count * er_size);
-                        }
-                        while(er_size > tot_size)
-                                er_size >>= 1;
-                }
-                if(info == NULL) {
-                        info = kmalloc(regcnt * sizeof(struct mtd_erase_region_info), GFP_KERNEL);
-                        if(!info)
-                                break;
-                }
-        } while(!(*regions));
-        DEBUG(2, "calc_erase_regions done, es = %zd size = %zd regions = %d\n",
-              erase_size, total_size, *regions);
-        return info;
-}
-
-
-static struct blkmtd_dev *add_device(char *devname, int readonly, int erase_size)
-{
-        struct block_device *bdev;
-        int mode;
-        struct blkmtd_dev *dev;
-
-        if(!devname)
-                return NULL;
-
-        /* Get a handle on the device */
-
-
-#ifdef MODULE
-        mode = (readonly) ? O_RDONLY : O_RDWR;
-        bdev = open_bdev_excl(devname, mode, NULL);
-#else
-        mode = (readonly) ? FMODE_READ : FMODE_WRITE;
-        bdev = open_by_devnum(name_to_dev_t(devname), mode);
-#endif
-        if(IS_ERR(bdev)) {
-                err("error: cannot open device %s", devname);
-                DEBUG(2, "blkmtd: opening bdev returned %ld\n", PTR_ERR(bdev));
-                return NULL;
-        }
-
-        DEBUG(1, "blkmtd: found a block device major = %d, minor = %d\n",
-              MAJOR(bdev->bd_dev), MINOR(bdev->bd_dev));
-
-        if(MAJOR(bdev->bd_dev) == MTD_BLOCK_MAJOR) {
-                err("attempting to use an MTD device as a block device");
-                blkdev_put(bdev);
-                return NULL;
-        }
-
-        dev = kmalloc(sizeof(struct blkmtd_dev), GFP_KERNEL);
-        if(dev == NULL) {
-                blkdev_put(bdev);
-                return NULL;
-        }
-
-        memset(dev, 0, sizeof(struct blkmtd_dev));
-        dev->blkdev = bdev;
-        if(!readonly) {
-                mutex_init(&dev->wrbuf_mutex);
-        }
-
-        dev->mtd_info.size = dev->blkdev->bd_inode->i_size & PAGE_MASK;
-
-        /* Setup the MTD structure */
-        /* make the name contain the block device in */
-        dev->mtd_info.name = kmalloc(sizeof("blkmtd: ") + strlen(devname), GFP_KERNEL);
-        if(dev->mtd_info.name == NULL)
-                goto devinit_err;
-
-        sprintf(dev->mtd_info.name, "blkmtd: %s", devname);
-        dev->mtd_info.eraseregions = calc_erase_regions(erase_size, dev->mtd_info.size,
-                                                        &dev->mtd_info.numeraseregions);
-        if(dev->mtd_info.eraseregions == NULL)
-                goto devinit_err;
-
-        dev->mtd_info.erasesize = dev->mtd_info.eraseregions->erasesize;
-        DEBUG(1, "blkmtd: init: found %d erase regions\n",
-              dev->mtd_info.numeraseregions);
-
-        if(readonly) {
-                dev->mtd_info.type = MTD_ROM;
-                dev->mtd_info.flags = MTD_CAP_ROM;
-        } else {
-                dev->mtd_info.type = MTD_RAM;
-                dev->mtd_info.flags = MTD_CAP_RAM;
-                dev->mtd_info.erase = blkmtd_erase;
-                dev->mtd_info.write = blkmtd_write;
-                dev->mtd_info.writev = default_mtd_writev;
-                dev->mtd_info.sync = blkmtd_sync;
-        }
-        dev->mtd_info.read = blkmtd_read;
-        dev->mtd_info.readv = default_mtd_readv;
-        dev->mtd_info.priv = dev;
-        dev->mtd_info.owner = THIS_MODULE;
-
-        list_add(&dev->list, &blkmtd_device_list);
-        if (add_mtd_device(&dev->mtd_info)) {
-                /* Device didnt get added, so free the entry */
-                list_del(&dev->list);
-                goto devinit_err;
-        } else {
-                info("mtd%d: [%s] erase_size = %dKiB %s",
-                     dev->mtd_info.index, dev->mtd_info.name + strlen("blkmtd: "),
-                     dev->mtd_info.erasesize >> 10,
-                     readonly ? "(read-only)" : "");
-        }
-
-        return dev;
-
- devinit_err:
-        free_device(dev);
-        return NULL;
-}
-
-
-/* Cleanup and exit - sync the device and kill of the kernel thread */
-static void __devexit cleanup_blkmtd(void)
-{
-        struct list_head *temp1, *temp2;
-
-        /* Remove the MTD devices */
-        list_for_each_safe(temp1, temp2, &blkmtd_device_list) {
-                struct blkmtd_dev *dev = list_entry(temp1, struct blkmtd_dev,
-                                                    list);
-                blkmtd_sync(&dev->mtd_info);
-                del_mtd_device(&dev->mtd_info);
-                info("mtd%d: [%s] removed", dev->mtd_info.index,
-                     dev->mtd_info.name + strlen("blkmtd: "));
-                list_del(&dev->list);
-                free_device(dev);
-        }
-}
-
-#ifndef MODULE
-
-/* Handle kernel boot params */
-
-
-static int __init param_blkmtd_device(char *str)
-{
-        int i;
-
-        for(i = 0; i < MAX_DEVICES; i++) {
-                device[i] = str;
-                DEBUG(2, "blkmtd: device setup: %d = %s\n", i, device[i]);
-                strsep(&str, ",");
-        }
-        return 1;
-}
-
-
-static int __init param_blkmtd_erasesz(char *str)
-{
-        int i;
-        for(i = 0; i < MAX_DEVICES; i++) {
-                char *val = strsep(&str, ",");
-                if(val)
-                        erasesz[i] = simple_strtoul(val, NULL, 0);
-                DEBUG(2, "blkmtd: erasesz setup: %d = %d\n", i, erasesz[i]);
-        }
-
-        return 1;
-}
-
-
-static int __init param_blkmtd_ro(char *str)
-{
-        int i;
-        for(i = 0; i < MAX_DEVICES; i++) {
-                char *val = strsep(&str, ",");
-                if(val)
-                        ro[i] = simple_strtoul(val, NULL, 0);
-                DEBUG(2, "blkmtd: ro setup: %d = %d\n", i, ro[i]);
-        }
-
-        return 1;
-}
-
-
-static int __init param_blkmtd_sync(char *str)
-{
-        if(str[0] == '1')
-                sync = 1;
-        return 1;
-}
-
-__setup("blkmtd_device=", param_blkmtd_device);
-__setup("blkmtd_erasesz=", param_blkmtd_erasesz);
-__setup("blkmtd_ro=", param_blkmtd_ro);
-__setup("blkmtd_sync=", param_blkmtd_sync);
-
-#endif
-
-
-/* Startup */
-static int __init init_blkmtd(void)
-{
-        int i;
-
-        info("version " VERSION);
-        /* Check args - device[0] is the bare minimum*/
-        if(!device[0]) {
-                err("error: missing `device' name\n");
-                return -EINVAL;
-        }
-
-        for(i = 0; i < MAX_DEVICES; i++)
-                add_device(device[i], ro[i], erasesz[i] << 10);
-
-        if(list_empty(&blkmtd_device_list))
-                return -EINVAL;
-
-        return 0;
-}
-
-module_init(init_blkmtd);
-module_exit(cleanup_blkmtd);
diff --git a/drivers/mtd/maps/pcmciamtd.c b/drivers/mtd/maps/pcmciamtd.c
index 8bbc751a6021..d27f4129afd3 100644
--- a/drivers/mtd/maps/pcmciamtd.c
+++ b/drivers/mtd/maps/pcmciamtd.c
@@ -54,7 +54,7 @@ static const int debug = 0;
 #define MAX_PCMCIA_ADDR 0x4000000
 
 struct pcmciamtd_dev {
-        dev_link_t      link;           /* PCMCIA link */
+        struct pcmcia_device    *p_dev;
         dev_node_t      node;           /* device node */
         caddr_t         win_base;       /* ioremapped address of PCMCIA window */
         unsigned int    win_size;       /* size of window */
@@ -111,8 +111,8 @@ static caddr_t remap_window(struct map_info *map, unsigned long to)
         memreq_t mrq;
         int ret;
 
-        if(!(dev->link.state & DEV_PRESENT)) {
-                DEBUG(1, "device removed state = 0x%4.4X", dev->link.state);
+        if (!pcmcia_dev_present(dev->p_dev)) {
+                DEBUG(1, "device removed");
                 return 0;
         }
 
@@ -122,7 +122,7 @@ static caddr_t remap_window(struct map_info *map, unsigned long to)
                       dev->offset, mrq.CardOffset);
                 mrq.Page = 0;
                 if( (ret = pcmcia_map_mem_page(win, &mrq)) != CS_SUCCESS) {
-                        cs_error(dev->link.handle, MapMemPage, ret);
+                        cs_error(dev->p_dev, MapMemPage, ret);
                         return NULL;
                 }
                 dev->offset = mrq.CardOffset;
@@ -238,7 +238,7 @@ static void pcmcia_copy_to_remap(struct map_info *map, unsigned long to, const v
 
 /* read/write{8,16} copy_{from,to} routines with direct access */
 
-#define DEV_REMOVED(x)  (!(*(u_int *)x->map_priv_1 & DEV_PRESENT))
+#define DEV_REMOVED(x)  (!(pcmcia_dev_present(((struct pcmciamtd_dev *)map->map_priv_1)->p_dev)))
 
 static map_word pcmcia_read8(struct map_info *map, unsigned long ofs)
 {
@@ -319,7 +319,7 @@ static void pcmcia_copy_to(struct map_info *map, unsigned long to, const void *f
 static void pcmciamtd_set_vpp(struct map_info *map, int on)
 {
         struct pcmciamtd_dev *dev = (struct pcmciamtd_dev *)map->map_priv_1;
-        dev_link_t *link = &dev->link;
+        struct pcmcia_device *link = dev->p_dev;
         modconf_t mod;
         int ret;
 
@@ -328,9 +328,9 @@ static void pcmciamtd_set_vpp(struct map_info *map, int on)
         mod.Vpp1 = mod.Vpp2 = on ? dev->vpp : 0;
 
         DEBUG(2, "dev = %p on = %d vpp = %d\n", dev, on, dev->vpp);
-        ret = pcmcia_modify_configuration(link->handle, &mod);
+        ret = pcmcia_modify_configuration(link, &mod);
         if(ret != CS_SUCCESS) {
-                cs_error(link->handle, ModifyConfiguration, ret);
+                cs_error(link, ModifyConfiguration, ret);
         }
 }
 
@@ -340,7 +340,7 @@ static void pcmciamtd_set_vpp(struct map_info *map, int on)
  * still open, this will be postponed until it is closed.
  */
 
-static void pcmciamtd_release(dev_link_t *link)
+static void pcmciamtd_release(struct pcmcia_device *link)
 {
         struct pcmciamtd_dev *dev = link->priv;
 
@@ -353,12 +353,11 @@ static void pcmciamtd_release(dev_link_t *link)
                 }
                 pcmcia_release_window(link->win);
         }
-        pcmcia_release_configuration(link->handle);
-        link->state &= ~DEV_CONFIG;
+        pcmcia_disable_device(link);
 }
 
 
-static void card_settings(struct pcmciamtd_dev *dev, dev_link_t *link, int *new_name)
+static void card_settings(struct pcmciamtd_dev *dev, struct pcmcia_device *link, int *new_name)
 {
         int rc;
         tuple_t tuple;
@@ -371,16 +370,16 @@ static void card_settings(struct pcmciamtd_dev *dev, dev_link_t *link, int *new_
         tuple.TupleOffset = 0;
         tuple.DesiredTuple = RETURN_FIRST_TUPLE;
 
-        rc = pcmcia_get_first_tuple(link->handle, &tuple);
+        rc = pcmcia_get_first_tuple(link, &tuple);
         while(rc == CS_SUCCESS) {
-                rc = pcmcia_get_tuple_data(link->handle, &tuple);
+                rc = pcmcia_get_tuple_data(link, &tuple);
                 if(rc != CS_SUCCESS) {
-                        cs_error(link->handle, GetTupleData, rc);
+                        cs_error(link, GetTupleData, rc);
                         break;
                 }
-                rc = pcmcia_parse_tuple(link->handle, &tuple, &parse);
+                rc = pcmcia_parse_tuple(link, &tuple, &parse);
                 if(rc != CS_SUCCESS) {
-                        cs_error(link->handle, ParseTuple, rc);
+                        cs_error(link, ParseTuple, rc);
                         break;
                 }
 
@@ -451,7 +450,7 @@ static void card_settings(struct pcmciamtd_dev *dev, dev_link_t *link, int *new_
                         DEBUG(2, "Unknown tuple code %d", tuple.TupleCode);
                 }
 
-                rc = pcmcia_get_next_tuple(link->handle, &tuple);
+                rc = pcmcia_get_next_tuple(link, &tuple);
         }
         if(!dev->pcmcia_map.size)
                 dev->pcmcia_map.size = MAX_PCMCIA_ADDR;
@@ -488,7 +487,7 @@ static void card_settings(struct pcmciamtd_dev *dev, dev_link_t *link, int *new_
 #define CS_CHECK(fn, ret) \
 do { last_fn = (fn); if ((last_ret = (ret)) != 0) goto cs_failed; } while (0)
 
-static void pcmciamtd_config(dev_link_t *link)
+static int pcmciamtd_config(struct pcmcia_device *link)
 {
         struct pcmciamtd_dev *dev = link->priv;
         struct mtd_info *mtd = NULL;
@@ -504,13 +503,10 @@ static void pcmciamtd_config(dev_link_t *link)
 
         DEBUG(3, "link=0x%p", link);
 
-        /* Configure card */
-        link->state |= DEV_CONFIG;
-
         DEBUG(2, "Validating CIS");
-        ret = pcmcia_validate_cis(link->handle, &cisinfo);
+        ret = pcmcia_validate_cis(link, &cisinfo);
         if(ret != CS_SUCCESS) {
-                cs_error(link->handle, GetTupleData, ret);
+                cs_error(link, GetTupleData, ret);
         } else {
                 DEBUG(2, "ValidateCIS found %d chains", cisinfo.Chains);
         }
@@ -538,7 +534,7 @@ static void pcmciamtd_config(dev_link_t *link)
         req.Attributes |= (dev->pcmcia_map.bankwidth == 1) ? WIN_DATA_WIDTH_8 : WIN_DATA_WIDTH_16;
         req.Base = 0;
         req.AccessSpeed = mem_speed;
-        link->win = (window_handle_t)link->handle;
+        link->win = (window_handle_t)link;
         req.Size = (force_size) ? force_size << 20 : MAX_PCMCIA_ADDR;
         dev->win_size = 0;
 
@@ -546,7 +542,7 @@ static void pcmciamtd_config(dev_link_t *link)
                 int ret;
                 DEBUG(2, "requesting window with size = %dKiB memspeed = %d",
                       req.Size >> 10, req.AccessSpeed);
-                ret = pcmcia_request_window(&link->handle, &req, &link->win);
+                ret = pcmcia_request_window(&link, &req, &link->win);
                 DEBUG(2, "ret = %d dev->win_size = %d", ret, dev->win_size);
                 if(ret) {
                         req.Size >>= 1;
@@ -562,19 +558,19 @@ static void pcmciamtd_config(dev_link_t *link)
         if(!dev->win_size) {
                 err("Cant allocate memory window");
                 pcmciamtd_release(link);
-                return;
+                return -ENODEV;
         }
         DEBUG(1, "Allocated a window of %dKiB", dev->win_size >> 10);
 
         /* Get write protect status */
-        CS_CHECK(GetStatus, pcmcia_get_status(link->handle, &status));
+        CS_CHECK(GetStatus, pcmcia_get_status(link, &status));
         DEBUG(2, "status value: 0x%x window handle = 0x%8.8lx",
               status.CardState, (unsigned long)link->win);
         dev->win_base = ioremap(req.Base, req.Size);
         if(!dev->win_base) {
                 err("ioremap(%lu, %u) failed", req.Base, req.Size);
                 pcmciamtd_release(link);
-                return;
+                return -ENODEV;
         }
         DEBUG(1, "mapped window dev = %p req.base = 0x%lx base = %p size = 0x%x",
               dev, req.Base, dev->win_base, req.Size);
@@ -584,17 +580,14 @@ static void pcmciamtd_config(dev_link_t *link)
         dev->pcmcia_map.map_priv_2 = (unsigned long)link->win;
 
         DEBUG(2, "Getting configuration");
-        CS_CHECK(GetConfigurationInfo, pcmcia_get_configuration_info(link->handle, &t));
+        CS_CHECK(GetConfigurationInfo, pcmcia_get_configuration_info(link, &t));
         DEBUG(2, "Vcc = %d Vpp1 = %d Vpp2 = %d", t.Vcc, t.Vpp1, t.Vpp2);
         dev->vpp = (vpp) ? vpp : t.Vpp1;
         link->conf.Attributes = 0;
-        link->conf.Vcc = t.Vcc;
         if(setvpp == 2) {
-                link->conf.Vpp1 = dev->vpp;
-                link->conf.Vpp2 = dev->vpp;
+                link->conf.Vpp = dev->vpp;
         } else {
-                link->conf.Vpp1 = 0;
-                link->conf.Vpp2 = 0;
+                link->conf.Vpp = 0;
         }
 
         link->conf.IntType = INT_MEMORY;
@@ -606,9 +599,10 @@ static void pcmciamtd_config(dev_link_t *link)
         link->conf.ConfigIndex = 0;
         link->conf.Present = t.Present;
         DEBUG(2, "Setting Configuration");
-        ret = pcmcia_request_configuration(link->handle, &link->conf);
+        ret = pcmcia_request_configuration(link, &link->conf);
         if(ret != CS_SUCCESS) {
-                cs_error(link->handle, RequestConfiguration, ret);
+                cs_error(link, RequestConfiguration, ret);
+                return -ENODEV;
         }
 
         if(mem_type == 1) {
@@ -629,7 +623,7 @@ static void pcmciamtd_config(dev_link_t *link)
         if(!mtd) {
                 DEBUG(1, "Cant find an MTD");
                 pcmciamtd_release(link);
-                return;
+                return -ENODEV;
         }
 
         dev->mtd_info = mtd;
@@ -654,7 +648,6 @@ static void pcmciamtd_config(dev_link_t *link)
            use the faster non-remapping read/write functions */
         if(mtd->size <= dev->win_size) {
                 DEBUG(1, "Using non remapping memory functions");
-                dev->pcmcia_map.map_priv_1 = (unsigned long)&(dev->link.state);
                 dev->pcmcia_map.map_priv_2 = (unsigned long)dev->win_base;
                 if (dev->pcmcia_map.bankwidth == 1) {
                         dev->pcmcia_map.read = pcmcia_read8;
@@ -672,19 +665,18 @@ static void pcmciamtd_config(dev_link_t *link)
                 dev->mtd_info = NULL;
                 err("Couldnt register MTD device");
                 pcmciamtd_release(link);
-                return;
+                return -ENODEV;
         }
         snprintf(dev->node.dev_name, sizeof(dev->node.dev_name), "mtd%d", mtd->index);
         info("mtd%d: %s", mtd->index, mtd->name);
-        link->state &= ~DEV_CONFIG_PENDING;
-        link->dev = &dev->node;
-        return;
+        link->dev_node = &dev->node;
+        return 0;
 
  cs_failed:
-        cs_error(link->handle, last_fn, last_ret);
+        cs_error(link, last_fn, last_ret);
         err("CS Error, exiting");
         pcmciamtd_release(link);
-        return;
+        return -ENODEV;
 }
 
 
@@ -713,21 +705,18 @@ static int pcmciamtd_resume(struct pcmcia_device *dev)
  * when the device is released.
  */
 
-static void pcmciamtd_detach(struct pcmcia_device *p_dev)
+static void pcmciamtd_detach(struct pcmcia_device *link)
 {
-        dev_link_t *link = dev_to_instance(p_dev);
+        struct pcmciamtd_dev *dev = link->priv;
 
         DEBUG(3, "link=0x%p", link);
 
-        if(link->state & DEV_CONFIG) {
-                struct pcmciamtd_dev *dev = link->priv;
-                if(dev->mtd_info) {
-                        del_mtd_device(dev->mtd_info);
-                        info("mtd%d: Removed", dev->mtd_info->index);
-                }
-
-                pcmciamtd_release(link);
+        if(dev->mtd_info) {
+                del_mtd_device(dev->mtd_info);
+                info("mtd%d: Removed", dev->mtd_info->index);
         }
+
+        pcmciamtd_release(link);
 }
 
 
@@ -736,10 +725,9 @@ static void pcmciamtd_detach(struct pcmcia_device *p_dev)
  * with Card Services.
  */
 
-static int pcmciamtd_attach(struct pcmcia_device *p_dev)
+static int pcmciamtd_probe(struct pcmcia_device *link)
 {
         struct pcmciamtd_dev *dev;
-        dev_link_t *link;
 
         /* Create new memory card device */
         dev = kmalloc(sizeof(*dev), GFP_KERNEL);
@@ -747,20 +735,13 @@ static int pcmciamtd_attach(struct pcmcia_device *p_dev)
         DEBUG(1, "dev=0x%p", dev);
 
         memset(dev, 0, sizeof(*dev));
-        link = &dev->link;
+        dev->p_dev = link;
         link->priv = dev;
 
         link->conf.Attributes = 0;
         link->conf.IntType = INT_MEMORY;
 
-        link->next = NULL;
-        link->handle = p_dev;
-        p_dev->instance = link;
-
-        link->state |= DEV_PRESENT | DEV_CONFIG_PENDING;
-        pcmciamtd_config(link);
-
-        return 0;
+        return pcmciamtd_config(link);
 }
 
 static struct pcmcia_device_id pcmciamtd_ids[] = {
@@ -794,7 +775,7 @@ static struct pcmcia_driver pcmciamtd_driver = {
         .drv            = {
                 .name   = "pcmciamtd"
         },
-        .probe          = pcmciamtd_attach,
+        .probe          = pcmciamtd_probe,
         .remove         = pcmciamtd_detach,
         .owner          = THIS_MODULE,
         .id_table       = pcmciamtd_ids,
diff --git a/drivers/net/8139cp.c b/drivers/net/8139cp.c
index ce99845d8266..066e22b01a94 100644
--- a/drivers/net/8139cp.c
+++ b/drivers/net/8139cp.c
@@ -539,8 +539,7 @@ rx_status_loop:
                 unsigned buflen;
 
                 skb = cp->rx_skb[rx_tail].skb;
-                if (!skb)
-                        BUG();
+                BUG_ON(!skb);
 
                 desc = &cp->rx_ring[rx_tail];
                 status = le32_to_cpu(desc->opts1);
@@ -723,8 +722,7 @@ static void cp_tx (struct cp_private *cp)
                         break;
 
                 skb = cp->tx_skb[tx_tail].skb;
-                if (!skb)
-                        BUG();
+                BUG_ON(!skb);
 
                 pci_unmap_single(cp->pdev, cp->tx_skb[tx_tail].mapping,
                                  cp->tx_skb[tx_tail].len, PCI_DMA_TODEVICE);
@@ -1550,8 +1548,7 @@ static void cp_get_ethtool_stats (struct net_device *dev,
         tmp_stats[i++] = le16_to_cpu(nic_stats->tx_abort);
         tmp_stats[i++] = le16_to_cpu(nic_stats->tx_underrun);
         tmp_stats[i++] = cp->cp_stats.rx_frags;
-        if (i != CP_NUM_STATS)
-                BUG();
+        BUG_ON(i != CP_NUM_STATS);
 
         pci_free_consistent(cp->pdev, sizeof(*nic_stats), nic_stats, dma);
 }
@@ -1856,8 +1853,7 @@ static void cp_remove_one (struct pci_dev *pdev)
         struct net_device *dev = pci_get_drvdata(pdev);
         struct cp_private *cp = netdev_priv(dev);
 
-        if (!dev)
-                BUG();
+        BUG_ON(!dev);
         unregister_netdev(dev);
         iounmap(cp->regs);
         if (cp->wol_enabled) pci_set_power_state (pdev, PCI_D0);
diff --git a/drivers/net/arcnet/arcnet.c b/drivers/net/arcnet/arcnet.c
index 64e2caf3083d..fabc0607b0f1 100644
--- a/drivers/net/arcnet/arcnet.c
+++ b/drivers/net/arcnet/arcnet.c
@@ -765,8 +765,7 @@ irqreturn_t arcnet_interrupt(int irq, void *dev_id, struct pt_regs *regs)
         BUGMSG(D_DURING, "in arcnet_interrupt\n");
         
         lp = dev->priv;
-        if (!lp)
-                BUG();
+        BUG_ON(!lp);
                 
         spin_lock(&lp->lock);
 
diff --git a/drivers/net/arcnet/com90xx.c b/drivers/net/arcnet/com90xx.c
index 43150b2bd13f..0d45553ff75c 100644
--- a/drivers/net/arcnet/com90xx.c
+++ b/drivers/net/arcnet/com90xx.c
@@ -125,11 +125,11 @@ static void __init com90xx_probe(void)
         if (!io && !irq && !shmem && !*device && com90xx_skip_probe)
                 return;
 
-        shmems = kzalloc(((0x10000-0xa0000) / 0x800) * sizeof(unsigned long),
+        shmems = kzalloc(((0x100000-0xa0000) / 0x800) * sizeof(unsigned long),
                          GFP_KERNEL);
         if (!shmems)
                 return;
-        iomem = kzalloc(((0x10000-0xa0000) / 0x800) * sizeof(void __iomem *),
+        iomem = kzalloc(((0x100000-0xa0000) / 0x800) * sizeof(void __iomem *),
                          GFP_KERNEL);
         if (!iomem) {
                 kfree(shmems);
diff --git a/drivers/net/b44.c b/drivers/net/b44.c
index 15032f2c7817..c4e12b5cbb92 100644
--- a/drivers/net/b44.c
+++ b/drivers/net/b44.c
@@ -608,8 +608,7 @@ static void b44_tx(struct b44 *bp)
                 struct ring_info *rp = &bp->tx_buffers[cons];
                 struct sk_buff *skb = rp->skb;
 
-                if (unlikely(skb == NULL))
-                        BUG();
+                BUG_ON(skb == NULL);
 
                 pci_unmap_single(bp->pdev,
                                  pci_unmap_addr(rp, mapping),
diff --git a/drivers/net/chelsio/Makefile b/drivers/net/chelsio/Makefile
index 91e927827c43..54c78d94f48b 100644
--- a/drivers/net/chelsio/Makefile
+++ b/drivers/net/chelsio/Makefile
@@ -4,7 +4,7 @@
 
 obj-$(CONFIG_CHELSIO_T1) += cxgb.o
 
-EXTRA_CFLAGS += -I$(TOPDIR)/drivers/net/chelsio $(DEBUG_FLAGS)
+EXTRA_CFLAGS += -Idrivers/net/chelsio $(DEBUG_FLAGS)
 
 
 cxgb-objs := cxgb2.o espi.o pm3393.o sge.o subr.o mv88x201x.o
diff --git a/drivers/net/chelsio/sge.c b/drivers/net/chelsio/sge.c
index 30ff8ea1a402..4391bf4bf573 100644
--- a/drivers/net/chelsio/sge.c
+++ b/drivers/net/chelsio/sge.c
@@ -1093,8 +1093,7 @@ static int process_responses(struct adapter *adapter, int budget)
                 if (likely(e->DataValid)) {
                         struct freelQ *fl = &sge->freelQ[e->FreelistQid];
 
-                        if (unlikely(!e->Sop || !e->Eop))
-                                BUG();
+                        BUG_ON(!e->Sop || !e->Eop);
                         if (unlikely(e->Offload))
                                 unexpected_offload(adapter, fl);
                         else
diff --git a/drivers/net/e1000/e1000_main.c b/drivers/net/e1000/e1000_main.c
index 49cd096a3c3d..add8dc4aa7b0 100644
--- a/drivers/net/e1000/e1000_main.c
+++ b/drivers/net/e1000/e1000_main.c
@@ -3308,8 +3308,7 @@ e1000_clean(struct net_device *poll_dev, int *budget)
 
         while (poll_dev != &adapter->polling_netdev[i]) {
                 i++;
-                if (unlikely(i == adapter->num_rx_queues))
-                        BUG();
+                BUG_ON(i == adapter->num_rx_queues);
         }
 
         if (likely(adapter->num_tx_queues == 1)) {
diff --git a/drivers/net/eql.c b/drivers/net/eql.c
index aa1569182fd6..815436c6170f 100644
--- a/drivers/net/eql.c
+++ b/drivers/net/eql.c
@@ -203,8 +203,7 @@ static int eql_open(struct net_device *dev)
         printk(KERN_INFO "%s: remember to turn off Van-Jacobson compression on "
                "your slave devices.\n", dev->name);
 
-        if (!list_empty(&eql->queue.all_slaves))
-                BUG();
+        BUG_ON(!list_empty(&eql->queue.all_slaves));
 
         eql->min_slaves = 1;
         eql->max_slaves = EQL_DEFAULT_MAX_SLAVES; /* 4 usually... */
diff --git a/drivers/net/ibmveth.c b/drivers/net/ibmveth.c
index ceb98fd398af..52d01027d9e7 100644
--- a/drivers/net/ibmveth.c
+++ b/drivers/net/ibmveth.c
@@ -235,7 +235,7 @@ static void ibmveth_replenish_buffer_pool(struct ibmveth_adapter *adapter, struc
 
                 lpar_rc = h_add_logical_lan_buffer(adapter->vdev->unit_address, desc.desc);
                     
-                if(lpar_rc != H_Success) {
+                if(lpar_rc != H_SUCCESS) {
                         pool->free_map[free_index] = index;
                         pool->skbuff[index] = NULL;
                         pool->consumer_index--;
@@ -373,7 +373,7 @@ static void ibmveth_rxq_recycle_buffer(struct ibmveth_adapter *adapter)
 
         lpar_rc = h_add_logical_lan_buffer(adapter->vdev->unit_address, desc.desc);
                     
-        if(lpar_rc != H_Success) {
+        if(lpar_rc != H_SUCCESS) {
                 ibmveth_debug_printk("h_add_logical_lan_buffer failed during recycle rc=%ld", lpar_rc);
                 ibmveth_remove_buffer_from_pool(adapter, adapter->rx_queue.queue_addr[adapter->rx_queue.index].correlator);
         }
@@ -511,7 +511,7 @@ static int ibmveth_open(struct net_device *netdev)
                                          adapter->filter_list_dma,
                                          mac_address);
 
-        if(lpar_rc != H_Success) {
+        if(lpar_rc != H_SUCCESS) {
                 ibmveth_error_printk("h_register_logical_lan failed with %ld\n", lpar_rc);
                 ibmveth_error_printk("buffer TCE:0x%lx filter TCE:0x%lx rxq desc:0x%lx MAC:0x%lx\n",
                                      adapter->buffer_list_dma,
@@ -527,7 +527,7 @@ static int ibmveth_open(struct net_device *netdev)
                 ibmveth_error_printk("unable to request irq 0x%x, rc %d\n", netdev->irq, rc);
                 do {
                         rc = h_free_logical_lan(adapter->vdev->unit_address);
-                } while (H_isLongBusy(rc) || (rc == H_Busy));
+                } while (H_IS_LONG_BUSY(rc) || (rc == H_BUSY));
 
                 ibmveth_cleanup(adapter);
                 return rc;
@@ -556,9 +556,9 @@ static int ibmveth_close(struct net_device *netdev)
 
         do {
                 lpar_rc = h_free_logical_lan(adapter->vdev->unit_address);
-        } while (H_isLongBusy(lpar_rc) || (lpar_rc == H_Busy));
+        } while (H_IS_LONG_BUSY(lpar_rc) || (lpar_rc == H_BUSY));
 
-        if(lpar_rc != H_Success)
+        if(lpar_rc != H_SUCCESS)
         {
                 ibmveth_error_printk("h_free_logical_lan failed with %lx, continuing with close\n",
                                      lpar_rc);
@@ -693,9 +693,9 @@ static int ibmveth_start_xmit(struct sk_buff *skb, struct net_device *netdev)
                                              desc[4].desc,
                                              desc[5].desc,
                                              correlator);
-        } while ((lpar_rc == H_Busy) && (retry_count--));
+        } while ((lpar_rc == H_BUSY) && (retry_count--));
     
-        if(lpar_rc != H_Success && lpar_rc != H_Dropped) {
+        if(lpar_rc != H_SUCCESS && lpar_rc != H_DROPPED) {
                 int i;
                 ibmveth_error_printk("tx: h_send_logical_lan failed with rc=%ld\n", lpar_rc);
                 for(i = 0; i < 6; i++) {
@@ -786,14 +786,14 @@ static int ibmveth_poll(struct net_device *netdev, int *budget)
         /* we think we are done - reenable interrupts, then check once more to make sure we are done */
         lpar_rc = h_vio_signal(adapter->vdev->unit_address, VIO_IRQ_ENABLE);
 
-        ibmveth_assert(lpar_rc == H_Success);
+        ibmveth_assert(lpar_rc == H_SUCCESS);
 
         netif_rx_complete(netdev);
 
         if(ibmveth_rxq_pending_buffer(adapter) && netif_rx_reschedule(netdev, frames_processed))
         {
                 lpar_rc = h_vio_signal(adapter->vdev->unit_address, VIO_IRQ_DISABLE);
-                ibmveth_assert(lpar_rc == H_Success);
+                ibmveth_assert(lpar_rc == H_SUCCESS);
                 more_work = 1;
                 goto restart_poll;
         }
@@ -813,7 +813,7 @@ static irqreturn_t ibmveth_interrupt(int irq, void *dev_instance, struct pt_regs
 
         if(netif_rx_schedule_prep(netdev)) {
                 lpar_rc = h_vio_signal(adapter->vdev->unit_address, VIO_IRQ_DISABLE);
-                ibmveth_assert(lpar_rc == H_Success);
+                ibmveth_assert(lpar_rc == H_SUCCESS);
                 __netif_rx_schedule(netdev);
         }
         return IRQ_HANDLED;
@@ -835,7 +835,7 @@ static void ibmveth_set_multicast_list(struct net_device *netdev)
                                            IbmVethMcastEnableRecv |
                                            IbmVethMcastDisableFiltering,
                                            0);
-                if(lpar_rc != H_Success) {
+                if(lpar_rc != H_SUCCESS) {
                         ibmveth_error_printk("h_multicast_ctrl rc=%ld when entering promisc mode\n", lpar_rc);
                 }
         } else {
@@ -847,7 +847,7 @@ static void ibmveth_set_multicast_list(struct net_device *netdev)
                                            IbmVethMcastDisableFiltering |
                                            IbmVethMcastClearFilterTable,
                                            0);
-                if(lpar_rc != H_Success) {
+                if(lpar_rc != H_SUCCESS) {
                         ibmveth_error_printk("h_multicast_ctrl rc=%ld when attempting to clear filter table\n", lpar_rc);
                 }
                 /* add the addresses to the filter table */
@@ -858,7 +858,7 @@ static void ibmveth_set_multicast_list(struct net_device *netdev)
                         lpar_rc = h_multicast_ctrl(adapter->vdev->unit_address,
                                                    IbmVethMcastAddFilter,
                                                    mcast_addr);
-                        if(lpar_rc != H_Success) {
+                        if(lpar_rc != H_SUCCESS) {
                                 ibmveth_error_printk("h_multicast_ctrl rc=%ld when adding an entry to the filter table\n", lpar_rc);
                         }
                 }
@@ -867,7 +867,7 @@ static void ibmveth_set_multicast_list(struct net_device *netdev)
                 lpar_rc = h_multicast_ctrl(adapter->vdev->unit_address,
                                            IbmVethMcastEnableFiltering,
                                            0);
-                if(lpar_rc != H_Success) {
+                if(lpar_rc != H_SUCCESS) {
                         ibmveth_error_printk("h_multicast_ctrl rc=%ld when enabling filtering\n", lpar_rc);
                 }
         }
diff --git a/drivers/net/irda/irda-usb.c b/drivers/net/irda/irda-usb.c
index 6e2ec56cde0b..606243d11793 100644
--- a/drivers/net/irda/irda-usb.c
+++ b/drivers/net/irda/irda-usb.c
@@ -1,7 +1,7 @@
 /*****************************************************************************
  *
  * Filename:      irda-usb.c
- * Version:       0.9b
+ * Version:       0.10
  * Description:   IrDA-USB Driver
  * Status:        Experimental 
  * Author:        Dag Brattli <dag@brattli.net>
@@ -9,6 +9,9 @@
  *      Copyright (C) 2000, Roman Weissgaerber <weissg@vienna.at>
  *      Copyright (C) 2001, Dag Brattli <dag@brattli.net>
  *      Copyright (C) 2001, Jean Tourrilhes <jt@hpl.hp.com>
+ *      Copyright (C) 2004, SigmaTel, Inc. <irquality@sigmatel.com>
+ *      Copyright (C) 2005, Milan Beno <beno@pobox.sk>
+ *      Copyright (C) 2006, Nick Fedchik <nick@fedchik.org.ua>
  *          
  *      This program is free software; you can redistribute it and/or modify
  *      it under the terms of the GNU General Public License as published by
@@ -61,6 +64,7 @@
 #include <linux/slab.h>
 #include <linux/rtnetlink.h>
 #include <linux/usb.h>
+#include <linux/firmware.h>
 
 #include "irda-usb.h"
 
@@ -78,8 +82,12 @@ static struct usb_device_id dongles[] = {
         { USB_DEVICE(0x50f, 0x180), .driver_info = IUC_SPEED_BUG | IUC_NO_WINDOW },
         /* Extended Systems, Inc.,  XTNDAccess IrDA USB (ESI-9685) */
         { USB_DEVICE(0x8e9, 0x100), .driver_info = IUC_SPEED_BUG | IUC_NO_WINDOW },
+        /* SigmaTel STIR4210/4220/4116 USB IrDA (VFIR) Bridge */
+        { USB_DEVICE(0x66f, 0x4210), .driver_info = IUC_STIR_4210 | IUC_SPEED_BUG },
+        { USB_DEVICE(0x66f, 0x4220), .driver_info = IUC_STIR_4210 | IUC_SPEED_BUG },
+        { USB_DEVICE(0x66f, 0x4116), .driver_info = IUC_STIR_4210 | IUC_SPEED_BUG },
         { .match_flags = USB_DEVICE_ID_MATCH_INT_CLASS |
-                       USB_DEVICE_ID_MATCH_INT_SUBCLASS,
+          USB_DEVICE_ID_MATCH_INT_SUBCLASS,
           .bInterfaceClass = USB_CLASS_APP_SPEC,
           .bInterfaceSubClass = USB_CLASS_IRDA,
           .driver_info = IUC_DEFAULT, },
@@ -99,6 +107,7 @@ MODULE_DEVICE_TABLE(usb, dongles);
 
 /*------------------------------------------------------------------*/
 
+static void irda_usb_init_qos(struct irda_usb_cb *self) ;
 static struct irda_class_desc *irda_usb_find_class_desc(struct usb_interface *intf);
 static void irda_usb_disconnect(struct usb_interface *intf);
 static void irda_usb_change_speed_xbofs(struct irda_usb_cb *self);
@@ -141,7 +150,24 @@ static void irda_usb_build_header(struct irda_usb_cb *self,
                                   __u8 *header,
                                   int   force)
 {
-        /* Set the negotiated link speed */
+        /* Here we check if we have an STIR421x chip,
+         * and if either speed or xbofs (or both) needs
+         * to be changed.
+         */
+        if (self->capability & IUC_STIR_4210 &&
+            ((self->new_speed != -1) || (self->new_xbofs != -1))) {
+
+                /* With STIR421x, speed and xBOFs must be set at the same
+                 * time, even if only one of them changes.
+                 */
+                if (self->new_speed == -1)
+                        self->new_speed = self->speed ;
+
+                if (self->new_xbofs == -1)
+                        self->new_xbofs = self->xbofs ;
+        }
+
+        /* Set the link speed */
         if (self->new_speed != -1) {
                 /* Hum... Ugly hack :-(
                  * Some device are not compliant with the spec and change
@@ -191,7 +217,11 @@ static void irda_usb_build_header(struct irda_usb_cb *self,
                         *header = SPEED_4000000;
                         self->new_xbofs = 0;
                         break;
-                }
+                case 16000000:
+                        *header = SPEED_16000000;
+                        self->new_xbofs = 0;
+                        break;
+                }
         } else
                 /* No change */
                 *header = 0;
@@ -235,6 +265,32 @@ static void irda_usb_build_header(struct irda_usb_cb *self,
         }
 }
 
+/*
+*   calculate turnaround time for SigmaTel header
+*/
+static __u8 get_turnaround_time(struct sk_buff *skb)
+{
+        int turnaround_time = irda_get_mtt(skb);
+
+        if ( turnaround_time == 0 )
+                return 0;
+        else if ( turnaround_time <= 10 )
+                return 1;
+        else if ( turnaround_time <= 50 )
+                return 2;
+        else if ( turnaround_time <= 100 )
+                return 3;
+        else if ( turnaround_time <= 500 )
+                return 4;
+        else if ( turnaround_time <= 1000 )
+                return 5;
+        else if ( turnaround_time <= 5000 )
+                return 6;
+        else
+                return 7;
+}
+
+
 /*------------------------------------------------------------------*/
 /*
  * Send a command to change the speed of the dongle
@@ -262,12 +318,18 @@ static void irda_usb_change_speed_xbofs(struct irda_usb_cb *self)
         /* Set the new speed and xbofs in this fake frame */
         irda_usb_build_header(self, frame, 1);
 
+        if ( self->capability & IUC_STIR_4210 ) {
+                if (frame[0] == 0) return ; // do nothing if no change
+                frame[1] = 0; // other parameters don't change here
+                frame[2] = 0;
+        }
+
         /* Submit the 0 length IrDA frame to trigger new speed settings */
         usb_fill_bulk_urb(urb, self->usbdev,
                       usb_sndbulkpipe(self->usbdev, self->bulk_out_ep),
                       frame, IRDA_USB_SPEED_MTU,
                       speed_bulk_callback, self);
-        urb->transfer_buffer_length = USB_IRDA_HEADER;
+        urb->transfer_buffer_length = self->header_length;
         urb->transfer_flags = 0;
 
         /* Irq disabled -> GFP_ATOMIC */
@@ -383,16 +445,35 @@ static int irda_usb_hard_xmit(struct sk_buff *skb, struct net_device *netdev)
          * allocation will be done lower in skb_push().
          * Also, we don't use directly skb_cow(), because it require
          * headroom >= 16, which force unnecessary copies - Jean II */
-        if (skb_headroom(skb) < USB_IRDA_HEADER) {
+        if (skb_headroom(skb) < self->header_length) {
                 IRDA_DEBUG(0, "%s(), Insuficient skb headroom.\n", __FUNCTION__);
-                if (skb_cow(skb, USB_IRDA_HEADER)) {
+                if (skb_cow(skb, self->header_length)) {
                         IRDA_WARNING("%s(), failed skb_cow() !!!\n", __FUNCTION__);
                         goto drop;
                 }
         }
 
         /* Change setting for next frame */
-        irda_usb_build_header(self, skb_push(skb, USB_IRDA_HEADER), 0);
+
+        if ( self->capability & IUC_STIR_4210 ) {
+                __u8 turnaround_time;
+                __u8* frame;
+                turnaround_time = get_turnaround_time( skb );
+                frame= skb_push(skb, self->header_length);
+                irda_usb_build_header(self, frame, 0);
+                frame[2] = turnaround_time;
+                if ((skb->len != 0) &&
+                    ((skb->len % 128) == 0) &&
+                    ((skb->len % 512) != 0)) {
+                        /* add extra byte for special SigmaTel feature */
+                        frame[1] = 1;
+                        skb_put(skb, 1);
+                } else {
+                        frame[1] = 0;
+                }
+        } else {
+                irda_usb_build_header(self, skb_push(skb, self->header_length), 0);
+        }
 
         /* FIXME: Make macro out of this one */
         ((struct irda_skb_cb *)skb->cb)->context = self;
@@ -795,7 +876,7 @@ static void irda_usb_receive(struct urb *urb, struct pt_regs *regs)
         }
         
         /* Check for empty frames */
-        if (urb->actual_length <= USB_IRDA_HEADER) {
+        if (urb->actual_length <= self->header_length) {
                 IRDA_WARNING("%s(), empty frame!\n", __FUNCTION__);
                 goto done;
         }
@@ -816,7 +897,11 @@ static void irda_usb_receive(struct urb *urb, struct pt_regs *regs)
         docopy = (urb->actual_length < IRDA_RX_COPY_THRESHOLD);
 
         /* Allocate a new skb */
-        newskb = dev_alloc_skb(docopy ? urb->actual_length : IRDA_SKB_MAX_MTU);
+        if ( self->capability & IUC_STIR_4210 )
+                newskb = dev_alloc_skb(docopy ? urb->actual_length : IRDA_SKB_MAX_MTU + USB_IRDA_SIGMATEL_HEADER);
+        else
+                newskb = dev_alloc_skb(docopy ? urb->actual_length : IRDA_SKB_MAX_MTU);
+
         if (!newskb)  {
                 self->stats.rx_dropped++;
                 /* We could deliver the current skb, but this would stall
@@ -845,7 +930,7 @@ static void irda_usb_receive(struct urb *urb, struct pt_regs *regs)
 
         /* Set proper length on skb & remove USB-IrDA header */
         skb_put(dataskb, urb->actual_length);
-        skb_pull(dataskb, USB_IRDA_HEADER);
+        skb_pull(dataskb, self->header_length);
 
         /* Ask the networking layer to queue the packet for the IrDA stack */
         dataskb->dev = self->netdev;
@@ -937,6 +1022,191 @@ static int irda_usb_is_receiving(struct irda_usb_cb *self)
         return 0; /* For now */
 }
 
+
+#define STIR421X_PATCH_PRODUCT_VERSION_STR       "Product Version: "
+#define STIR421X_PATCH_COMPONENT_VERSION_STR     "Component Version: "
+#define STIR421X_PATCH_DATA_TAG_STR              "STMP"
+#define STIR421X_PATCH_FILE_VERSION_MAX_OFFSET   512     /* version info is before here */
+#define STIR421X_PATCH_FILE_IMAGE_MAX_OFFSET     512     /* patch image starts before here */
+#define STIR421X_PATCH_FILE_END_OF_HEADER_TAG    0x1A    /* marks end of patch file header (PC DOS text file EOF character) */
+
+/*
+ * Known firmware patches for STIR421x dongles
+ */
+static char * stir421x_patches[] = {
+        "42101001.sb",
+        "42101002.sb",
+};
+
+static int stir421x_get_patch_version(unsigned char * patch, const unsigned long patch_len)
+{
+        unsigned int version_offset;
+        unsigned long version_major, version_minor, version_build;
+        unsigned char * version_start;
+        int version_found = 0;
+
+        for (version_offset = 0;
+             version_offset < STIR421X_PATCH_FILE_END_OF_HEADER_TAG;
+             version_offset++) {
+                if (!memcmp(patch + version_offset,
+                            STIR421X_PATCH_PRODUCT_VERSION_STR,
+                            sizeof(STIR421X_PATCH_PRODUCT_VERSION_STR) - 1)) {
+                                    version_found = 1;
+                                    version_start = patch +
+                                            version_offset +
+                                            sizeof(STIR421X_PATCH_PRODUCT_VERSION_STR) - 1;
+                                    break;
+                }
+        }
+
+        /* We couldn't find a product version on this patch */
+        if (!version_found)
+                return -EINVAL;
+
+        /* Let's check if the product version is dotted */
+        if (version_start[3] != '.' ||
+            version_start[7] != '.')
+                return -EINVAL;
+
+        version_major = simple_strtoul(version_start, NULL, 10);
+        version_minor = simple_strtoul(version_start + 4, NULL, 10);
+        version_build = simple_strtoul(version_start + 8, NULL, 10);
+
+        IRDA_DEBUG(2, "%s(), Major: %ld Minor: %ld Build: %ld\n",
+                   __FUNCTION__,
+                   version_major, version_minor, version_build);
+
+        return (((version_major) << 12) +
+                ((version_minor) << 8) +
+                ((version_build / 10) << 4) +
+                (version_build % 10));
+
+}
+
+
+static int stir421x_upload_patch (struct irda_usb_cb *self,
+                                  unsigned char * patch,
+                                  const unsigned int patch_len)
+{
+    int retval = 0;
+    int actual_len;
+    unsigned int i = 0, download_amount = 0;
+    unsigned char * patch_chunk;
+
+    IRDA_DEBUG (2, "%s(), Uploading STIR421x Patch\n", __FUNCTION__);
+
+    patch_chunk = kzalloc(STIR421X_MAX_PATCH_DOWNLOAD_SIZE, GFP_KERNEL);
+    if (patch_chunk == NULL)
+            return -ENOMEM;
+
+    /* break up patch into 1023-byte sections */
+    for (i = 0; retval >= 0 && i < patch_len; i += download_amount) {
+            download_amount = patch_len - i;
+            if (download_amount > STIR421X_MAX_PATCH_DOWNLOAD_SIZE)
+                    download_amount = STIR421X_MAX_PATCH_DOWNLOAD_SIZE;
+
+            /* download the patch section */
+            memcpy(patch_chunk, patch + i, download_amount);
+
+            retval = usb_bulk_msg (self->usbdev,
+                                   usb_sndbulkpipe (self->usbdev,
+                                                    self->bulk_out_ep),
+                                   patch_chunk, download_amount,
+                                   &actual_len, msecs_to_jiffies (500));
+            IRDA_DEBUG (2, "%s(), Sent %u bytes\n", __FUNCTION__,
+                        actual_len);
+            if (retval == 0)
+                    mdelay(10);
+    }
+
+    kfree(patch_chunk);
+
+    if (i != patch_len) {
+            IRDA_ERROR ("%s(), Pushed %d bytes (!= patch_len (%d))\n",
+                       __FUNCTION__, i, patch_len);
+            retval = -EIO;
+    }
+
+    if (retval < 0)
+            /* todo - mark device as not ready */
+            IRDA_ERROR ("%s(), STIR421x patch upload failed (%d)\n",
+                        __FUNCTION__, retval);
+
+    return retval;
+}
+
+
+static int stir421x_patch_device(struct irda_usb_cb *self)
+{
+        unsigned int i, patch_found = 0, data_found = 0, data_offset;
+        int patch_version, ret = 0;
+        const struct firmware *fw_entry;
+
+        for (i = 0; i < ARRAY_SIZE(stir421x_patches); i++) {
+                if(request_firmware(&fw_entry, stir421x_patches[i], &self->usbdev->dev) != 0) {
+                        IRDA_ERROR( "%s(), Patch %s is not available\n", __FUNCTION__, stir421x_patches[i]);
+                        continue;
+                }
+
+                /* We found a patch from userspace */
+                patch_version = stir421x_get_patch_version (fw_entry->data, fw_entry->size);
+
+                if (patch_version < 0) {
+                        /* Couldn't fetch a version, let's move on to the next file */
+                        IRDA_ERROR("%s(), version parsing failed\n", __FUNCTION__);
+                        ret = patch_version;
+                        release_firmware(fw_entry);
+                        continue;
+                }
+
+                if (patch_version != self->usbdev->descriptor.bcdDevice) {
+                        /* Patch version and device don't match */
+                        IRDA_ERROR ("%s(), wrong patch version (%d <-> %d)\n",
+                                    __FUNCTION__,
+                                    patch_version, self->usbdev->descriptor.bcdDevice);
+                        ret = -EINVAL;
+                        release_firmware(fw_entry);
+                        continue;
+                }
+
+                /* If we're here, we've found a correct patch */
+                patch_found = 1;
+                break;
+
+        }
+
+        /* We couldn't find a valid firmware, let's leave */
+        if (!patch_found)
+                return ret;
+
+        /* The actual image starts after the "STMP" keyword */
+        for (data_offset = 0; data_offset < STIR421X_PATCH_FILE_IMAGE_MAX_OFFSET; data_offset++) {
+                if (!memcmp(fw_entry->data + data_offset,
+                            STIR421X_PATCH_DATA_TAG_STR,
+                            sizeof(STIR421X_PATCH_FILE_IMAGE_MAX_OFFSET))) {
+                        IRDA_DEBUG(2, "%s(), found patch data for STIR421x at offset %d\n",
+                                   __FUNCTION__, data_offset);
+                        data_found = 1;
+                        break;
+                }
+        }
+
+        /* We couldn't find "STMP" from the header */
+        if (!data_found)
+                return -EINVAL;
+
+        /* Let's upload the patch to the target */
+        ret = stir421x_upload_patch(self,
+                                    &fw_entry->data[data_offset + sizeof(STIR421X_PATCH_FILE_IMAGE_MAX_OFFSET)],
+                                    fw_entry->size - (data_offset + sizeof(STIR421X_PATCH_FILE_IMAGE_MAX_OFFSET)));
+
+        release_firmware(fw_entry);
+
+        return ret;
+
+}
+
+
 /********************** IRDA DEVICE CALLBACKS **********************/
 /*
  * Main calls from the IrDA/Network subsystem.
@@ -972,6 +1242,11 @@ static int irda_usb_net_open(struct net_device *netdev)
                 return -1;
         }
 
+        if(self->needspatch) {
+                IRDA_WARNING("%s(), device needs patch\n", __FUNCTION__) ;
+                return -EIO ;
+        }
+
         /* Initialise default speed and xbofs value
          * (IrLAP will change that soon) */
         self->speed = -1;
@@ -1050,7 +1325,7 @@ static int irda_usb_net_close(struct net_device *netdev)
         del_timer(&self->rx_defer_timer);
 
         /* Deallocate all the Rx path buffers (URBs and skb) */
-        for (i = 0; i < IU_MAX_RX_URBS; i++) {
+        for (i = 0; i < self->max_rx_urb; i++) {
                 struct urb *urb = self->rx_urb[i];
                 struct sk_buff *skb = (struct sk_buff *) urb->context;
                 /* Cancel the receive command */
@@ -1426,8 +1701,22 @@ static int irda_usb_probe(struct usb_interface *intf,
         spin_lock_init(&self->lock);
         init_timer(&self->rx_defer_timer);
 
+        self->capability = id->driver_info;
+        self->needspatch = ((self->capability & IUC_STIR_4210) != 0) ;
+
         /* Create all of the needed urbs */
-        for (i = 0; i < IU_MAX_RX_URBS; i++) {
+        if (self->capability & IUC_STIR_4210) {
+                self->max_rx_urb = IU_SIGMATEL_MAX_RX_URBS;
+                self->header_length = USB_IRDA_SIGMATEL_HEADER;
+        } else {
+                self->max_rx_urb = IU_MAX_RX_URBS;
+                self->header_length = USB_IRDA_HEADER;
+        }
+
+        self->rx_urb = kzalloc(self->max_rx_urb * sizeof(struct urb *),
+                                GFP_KERNEL);
+
+        for (i = 0; i < self->max_rx_urb; i++) {
                 self->rx_urb[i] = usb_alloc_urb(0, GFP_KERNEL);
                 if (!self->rx_urb[i]) {
                         goto err_out_1;
@@ -1479,17 +1768,28 @@ static int irda_usb_probe(struct usb_interface *intf,
                 goto err_out_3;
         }
 
+        self->usbdev = dev;
+
         /* Find IrDA class descriptor */
         irda_desc = irda_usb_find_class_desc(intf);
         ret = -ENODEV;
         if (irda_desc == NULL)
                 goto err_out_3;
 
+        if (self->needspatch) {
+                ret = usb_control_msg (self->usbdev, usb_sndctrlpipe (self->usbdev, 0),
+                                       0x02, 0x40, 0, 0, 0, 0, msecs_to_jiffies(500));
+                if (ret < 0) {
+                        IRDA_DEBUG (0, "usb_control_msg failed %d\n", ret);
+                        goto err_out_3;
+                } else {
+                        mdelay(10);
+                }
+        }
+
         self->irda_desc =  irda_desc;
         self->present = 1;
         self->netopen = 0;
-        self->capability = id->driver_info;
-        self->usbdev = dev;
         self->usbintf = intf;
 
         /* Allocate the buffer for speed changes */
@@ -1508,6 +1808,28 @@ static int irda_usb_probe(struct usb_interface *intf,
 
         IRDA_MESSAGE("IrDA: Registered device %s\n", net->name);
         usb_set_intfdata(intf, self);
+
+        if (self->needspatch) {
+                /* Now we fetch and upload the firmware patch */
+                ret = stir421x_patch_device(self);
+                self->needspatch = (ret < 0);
+                if (ret < 0) {
+                        printk("patch_device failed\n");
+                        goto err_out_4;
+                }
+
+                /* replace IrDA class descriptor with what patched device is now reporting */
+                irda_desc = irda_usb_find_class_desc (self->usbintf);
+                if (irda_desc == NULL) {
+                        ret = -ENODEV;
+                        goto err_out_4;
+                }
+                if (self->irda_desc)
+                        kfree (self->irda_desc);
+                self->irda_desc = irda_desc;
+                irda_usb_init_qos(self);
+        }
+
         return 0;
 
 err_out_4:
@@ -1518,7 +1840,7 @@ err_out_3:
 err_out_2:
         usb_free_urb(self->tx_urb);
 err_out_1:
-        for (i = 0; i < IU_MAX_RX_URBS; i++) {
+        for (i = 0; i < self->max_rx_urb; i++) {
                 if (self->rx_urb[i])
                         usb_free_urb(self->rx_urb[i]);
         }
@@ -1571,7 +1893,7 @@ static void irda_usb_disconnect(struct usb_interface *intf)
                 /*netif_device_detach(self->netdev);*/
                 netif_stop_queue(self->netdev);
                 /* Stop all the receive URBs. Must be synchronous. */
-                for (i = 0; i < IU_MAX_RX_URBS; i++)
+                for (i = 0; i < self->max_rx_urb; i++)
                         usb_kill_urb(self->rx_urb[i]);
                 /* Cancel Tx and speed URB.
                  * Make sure it's synchronous to avoid races. */
@@ -1586,8 +1908,9 @@ static void irda_usb_disconnect(struct usb_interface *intf)
         self->usbintf = NULL;
 
         /* Clean up our urbs */
-        for (i = 0; i < IU_MAX_RX_URBS; i++)
+        for (i = 0; i < self->max_rx_urb; i++)
                 usb_free_urb(self->rx_urb[i]);
+        kfree(self->rx_urb);
         /* Clean up Tx and speed URB */
         usb_free_urb(self->tx_urb);
         usb_free_urb(self->speed_urb);
@@ -1648,6 +1971,6 @@ module_exit(usb_irda_cleanup);
  */
 module_param(qos_mtt_bits, int, 0);
 MODULE_PARM_DESC(qos_mtt_bits, "Minimum Turn Time");
-MODULE_AUTHOR("Roman Weissgaerber <weissg@vienna.at>, Dag Brattli <dag@brattli.net> and Jean Tourrilhes <jt@hpl.hp.com>");
-MODULE_DESCRIPTION("IrDA-USB Dongle Driver"); 
+MODULE_AUTHOR("Roman Weissgaerber <weissg@vienna.at>, Dag Brattli <dag@brattli.net>, Jean Tourrilhes <jt@hpl.hp.com> and Nick Fedchik <nick@fedchik.org.ua>");
+MODULE_DESCRIPTION("IrDA-USB Dongle Driver");
 MODULE_LICENSE("GPL");
diff --git a/drivers/net/irda/irda-usb.h b/drivers/net/irda/irda-usb.h
index 4026af42dd47..d833db52cebf 100644
--- a/drivers/net/irda/irda-usb.h
+++ b/drivers/net/irda/irda-usb.h
@@ -1,7 +1,7 @@
 /*****************************************************************************
  *
  * Filename:      irda-usb.h
- * Version:       0.9b
+ * Version:       0.10
  * Description:   IrDA-USB Driver
  * Status:        Experimental 
  * Author:        Dag Brattli <dag@brattli.net>
@@ -9,6 +9,9 @@
  *      Copyright (C) 2001, Roman Weissgaerber <weissg@vienna.at>
  *      Copyright (C) 2000, Dag Brattli <dag@brattli.net>
  *      Copyright (C) 2001, Jean Tourrilhes <jt@hpl.hp.com>
+ *      Copyright (C) 2004, SigmaTel, Inc. <irquality@sigmatel.com>
+ *      Copyright (C) 2005, Milan Beno <beno@pobox.sk>
+ *      Copyright (C) 2006, Nick FEdchik <nick@fedchik.org.ua>
  *          
  *      This program is free software; you can redistribute it and/or modify
  *      it under the terms of the GNU General Public License as published by
@@ -31,6 +34,9 @@
 #include <net/irda/irda.h>
 #include <net/irda/irda_device.h>      /* struct irlap_cb */
 
+#define PATCH_FILE_SIZE_MAX     65536
+#define PATCH_FILE_SIZE_MIN     80
+
 #define RX_COPY_THRESHOLD 200
 #define IRDA_USB_MAX_MTU 2051
 #define IRDA_USB_SPEED_MTU 64           /* Weird, but work like this */
@@ -79,15 +85,16 @@
 /* Inbound header */
 #define MEDIA_BUSY    0x80
 
-#define SPEED_2400    0x01
-#define SPEED_9600    0x02
-#define SPEED_19200   0x03
-#define SPEED_38400   0x04
-#define SPEED_57600   0x05
-#define SPEED_115200  0x06
-#define SPEED_576000  0x07
-#define SPEED_1152000 0x08
-#define SPEED_4000000 0x09
+#define SPEED_2400     0x01
+#define SPEED_9600     0x02
+#define SPEED_19200    0x03
+#define SPEED_38400    0x04
+#define SPEED_57600    0x05
+#define SPEED_115200   0x06
+#define SPEED_576000   0x07
+#define SPEED_1152000  0x08
+#define SPEED_4000000  0x09
+#define SPEED_16000000 0x0a
 
 /* Basic capabilities */
 #define IUC_DEFAULT     0x00    /* Basic device compliant with 1.0 spec */
@@ -100,11 +107,14 @@
 #define IUC_SMALL_PKT   0x10    /* Device doesn't behave with big Rx packets */
 #define IUC_MAX_WINDOW  0x20    /* Device underestimate the Rx window */
 #define IUC_MAX_XBOFS   0x40    /* Device need more xbofs than advertised */
+#define IUC_STIR_4210   0x80    /* SigmaTel 4210/4220/4116 VFIR */
 
 /* USB class definitions */
-#define USB_IRDA_HEADER   0x01
-#define USB_CLASS_IRDA    0x02 /* USB_CLASS_APP_SPEC subclass */ 
-#define USB_DT_IRDA       0x21
+#define USB_IRDA_HEADER            0x01
+#define USB_CLASS_IRDA             0x02 /* USB_CLASS_APP_SPEC subclass */
+#define USB_DT_IRDA                0x21
+#define USB_IRDA_SIGMATEL_HEADER   0x03
+#define IU_SIGMATEL_MAX_RX_URBS    (IU_MAX_ACTIVE_RX_URBS + USB_IRDA_SIGMATEL_HEADER)
 
 struct irda_class_desc {
         __u8  bLength;
@@ -123,6 +133,7 @@ struct irda_class_desc {
  * (6.2.5, USB-IrDA class spec 1.0) */
 
 #define IU_REQ_GET_CLASS_DESC   0x06
+#define STIR421X_MAX_PATCH_DOWNLOAD_SIZE 1023
 
 struct irda_usb_cb {
         struct irda_class_desc *irda_desc;
@@ -136,7 +147,8 @@ struct irda_usb_cb {
         __u16 bulk_out_mtu;             /* Max Tx packet size in bytes */
         __u8  bulk_int_ep;              /* Interrupt Endpoint assignments */
 
-        struct urb *rx_urb[IU_MAX_RX_URBS];     /* URBs used to receive data frames */
+        __u8  max_rx_urb;
+        struct urb **rx_urb;            /* URBs used to receive data frames */
         struct urb *idle_rx_urb;        /* Pointer to idle URB in Rx path */
         struct urb *tx_urb;             /* URB used to send data frames */
         struct urb *speed_urb;          /* URB used to send speed commands */
@@ -157,6 +169,9 @@ struct irda_usb_cb {
         __u32 speed;                    /* Current speed */
         __s32 new_speed;                /* speed we need to set */
 
+        __u8 header_length;             /* USB-IrDA frame header size */
+        int needspatch;                 /* device needs firmware patch */
+
         struct timer_list rx_defer_timer;       /* Wait for Rx error to clear */
 };
 
diff --git a/drivers/net/irda/sa1100_ir.c b/drivers/net/irda/sa1100_ir.c
index 63d38fbbd04e..f530686bd09f 100644
--- a/drivers/net/irda/sa1100_ir.c
+++ b/drivers/net/irda/sa1100_ir.c
@@ -695,8 +695,7 @@ static int sa1100_irda_hard_xmit(struct sk_buff *skb, struct net_device *dev)
                 /*
                  * We must not be transmitting...
                  */
-                if (si->txskb)
-                        BUG();
+                BUG_ON(si->txskb);
 
                 netif_stop_queue(dev);
 
diff --git a/drivers/net/irda/smsc-ircc2.c b/drivers/net/irda/smsc-ircc2.c
index ec94ecdb103d..bbcfc8ec35a1 100644
--- a/drivers/net/irda/smsc-ircc2.c
+++ b/drivers/net/irda/smsc-ircc2.c
@@ -11,6 +11,7 @@
  *     Copyright (c) 2002      Daniele Peri
  *     All Rights Reserved.
  *     Copyright (c) 2002      Jean Tourrilhes
+ *     Copyright (c) 2006      Linus Walleij
  *
  *
  * Based on smc-ircc.c:
@@ -61,6 +62,9 @@
 
 #include <linux/spinlock.h>
 #include <linux/pm.h>
+#ifdef CONFIG_PCI
+#include <linux/pci.h>
+#endif
 
 #include <net/irda/wrapper.h>
 #include <net/irda/irda.h>
@@ -100,6 +104,22 @@ MODULE_PARM_DESC(ircc_transceiver, "Transceiver type");
 
 /* Types */
 
+#ifdef CONFIG_PCI
+struct smsc_ircc_subsystem_configuration {
+        unsigned short vendor; /* PCI vendor ID */
+        unsigned short device; /* PCI vendor ID */
+        unsigned short subvendor; /* PCI subsystem vendor ID */
+        unsigned short subdevice; /* PCI sybsystem device ID */
+        unsigned short sir_io; /* I/O port for SIR */
+        unsigned short fir_io; /* I/O port for FIR */
+        unsigned char  fir_irq; /* FIR IRQ */
+        unsigned char  fir_dma; /* FIR DMA */
+        unsigned short cfg_base; /* I/O port for chip configuration */
+        int (*preconfigure)(struct pci_dev *dev, struct smsc_ircc_subsystem_configuration *conf); /* Preconfig function */
+        const char *name;       /* name shown as info */
+};
+#endif
+
 struct smsc_transceiver {
         char *name;
         void (*set_for_speed)(int fir_base, u32 speed);
@@ -202,6 +222,16 @@ static int __init smsc_superio_flat(const struct smsc_chip *chips, unsigned shor
 static int __init smsc_superio_paged(const struct smsc_chip *chips, unsigned short cfg_base, char *type);
 static int __init smsc_superio_fdc(unsigned short cfg_base);
 static int __init smsc_superio_lpc(unsigned short cfg_base);
+#ifdef CONFIG_PCI
+static int __init preconfigure_smsc_chip(struct smsc_ircc_subsystem_configuration *conf);
+static int __init preconfigure_through_82801(struct pci_dev *dev, struct smsc_ircc_subsystem_configuration *conf);
+static int __init preconfigure_through_ali(struct pci_dev *dev, struct smsc_ircc_subsystem_configuration *conf);
+static int __init smsc_ircc_preconfigure_subsystems(unsigned short ircc_cfg,
+                                                    unsigned short ircc_fir,
+                                                    unsigned short ircc_sir,
+                                                    unsigned char ircc_dma,
+                                                    unsigned char ircc_irq);
+#endif
 
 /* Transceivers specific functions */
 
@@ -353,6 +383,13 @@ static int __init smsc_ircc_init(void)
                 return ret;
         }
 
+#ifdef CONFIG_PCI
+        if (smsc_ircc_preconfigure_subsystems(ircc_cfg, ircc_fir, ircc_sir, ircc_dma, ircc_irq) < 0) {
+                /* Ignore errors from preconfiguration */
+                IRDA_ERROR("%s, Preconfiguration failed !\n", driver_name);
+        }
+#endif
+
         dev_count = 0;
 
         if (ircc_fir > 0 && ircc_sir > 0) {
@@ -2285,6 +2322,280 @@ static int __init smsc_superio_lpc(unsigned short cfg_base)
         return ret;
 }
 
+/*
+ * Look for some specific subsystem setups that need
+ * pre-configuration not properly done by the BIOS (especially laptops)
+ * This code is based in part on smcinit.c, tosh1800-smcinit.c
+ * and tosh2450-smcinit.c. The table lists the device entries
+ * for ISA bridges with an LPC (Local Peripheral Configurator)
+ * that are in turn used to configure the SMSC device with default
+ * SIR and FIR I/O ports, DMA and IRQ.
+ */
+#ifdef CONFIG_PCI
+#define PCIID_VENDOR_INTEL 0x8086
+#define PCIID_VENDOR_ALI 0x10b9
+static struct smsc_ircc_subsystem_configuration subsystem_configurations[] __devinitdata = {
+        {
+                .vendor = PCIID_VENDOR_INTEL, /* Intel 82801DBM LPC bridge */
+                .device = 0x24cc,
+                .subvendor = 0x103c,
+                .subdevice = 0x088c,
+                .sir_io = 0x02f8, /* Quite certain these are the same for nc8000 as for nc6000 */
+                .fir_io = 0x0130,
+                .fir_irq = 0x09,
+                .fir_dma = 0x03,
+                .cfg_base = 0x004e,
+                .preconfigure = preconfigure_through_82801,
+                .name = "HP nc8000",
+        },
+        {
+                .vendor = PCIID_VENDOR_INTEL, /* Intel 82801DBM LPC bridge */
+                .device = 0x24cc,
+                .subvendor = 0x103c,
+                .subdevice = 0x0890,
+                .sir_io = 0x02f8,
+                .fir_io = 0x0130,
+                .fir_irq = 0x09,
+                .fir_dma = 0x03,
+                .cfg_base = 0x004e,
+                .preconfigure = preconfigure_through_82801,
+                .name = "HP nc6000",
+        },
+        {
+                .vendor = PCIID_VENDOR_INTEL, /* Intel 82801DB/DBL (ICH4/ICH4-L) LPC Interface Bridge */
+                .device = 0x24c0,
+                .subvendor = 0x1179,
+                .subdevice = 0xffff, /* 0xffff is "any", Not sure, 0x0001 or 0x0002 */
+                .sir_io = 0x03f8,
+                .fir_io = 0x0130,
+                .fir_irq = 0x07,
+                .fir_dma = 0x01,
+                .cfg_base = 0x002e,
+                .preconfigure = preconfigure_through_82801,
+                .name = "Toshiba Satellite 2450",
+        },
+        {
+                .vendor = PCIID_VENDOR_INTEL, /* Intel 82801CAM ISA bridge */
+                .device = 0x248c, /* Some use 24cc? */
+                .subvendor = 0x1179,
+                .subdevice = 0xffff, /* 0xffff is "any", Not sure, 0x0001 or 0x0002 */
+                .sir_io = 0x03f8,
+                .fir_io = 0x0130,
+                .fir_irq = 0x03,
+                .fir_dma = 0x03,
+                .cfg_base = 0x002e,
+                .preconfigure = preconfigure_through_82801,
+                .name = "Toshiba Satellite 5100/5200, Tecra 9100",
+        },
+        {
+                .vendor = PCIID_VENDOR_ALI, /* ALi M1533/M1535 PCI to ISA Bridge [Aladdin IV/V/V+] */
+                .device = 0x1533,
+                .subvendor = 0x1179,
+                .subdevice = 0xffff, /* 0xffff is "any", Not sure, 0x0001 or 0x0002 */
+                .sir_io = 0x02e8,
+                .fir_io = 0x02f8,
+                .fir_irq = 0x07,
+                .fir_dma = 0x03,
+                .cfg_base = 0x002e,
+                .preconfigure = preconfigure_through_ali,
+                .name = "Toshiba Satellite 1800",
+        },
+        { } // Terminator
+};
+
+
+/*
+ * This sets up the basic SMSC parameters (FIR port, SIR port, FIR DMA, FIR IRQ)
+ * through the chip configuration port.
+ */
+static int __init preconfigure_smsc_chip(struct smsc_ircc_subsystem_configuration *conf)
+{
+        unsigned short iobase = conf->cfg_base;
+        unsigned char tmpbyte;
+
+        outb(LPC47N227_CFGACCESSKEY, iobase); // enter configuration state
+        outb(SMSCSIOFLAT_DEVICEID_REG, iobase); // set for device ID
+        tmpbyte = inb(iobase +1); // Read device ID
+        IRDA_DEBUG(0, "Detected Chip id: 0x%02x, setting up registers...\n",tmpbyte);
+
+        /* Disable UART1 and set up SIR I/O port */
+        outb(0x24, iobase);  // select CR24 - UART1 base addr
+        outb(0x00, iobase + 1); // disable UART1
+        outb(SMSCSIOFLAT_UART2BASEADDR_REG, iobase);  // select CR25 - UART2 base addr
+        outb( (conf->sir_io >> 2), iobase + 1); // bits 2-9 of 0x3f8
+        tmpbyte = inb(iobase + 1);
+        if (tmpbyte != (conf->sir_io >> 2) ) {
+                IRDA_WARNING("ERROR: could not configure SIR ioport.\n");
+                return -ENXIO;
+        }
+
+        /* Set up FIR IRQ channel for UART2 */
+        outb(SMSCSIOFLAT_UARTIRQSELECT_REG, iobase); // select CR28 - UART1,2 IRQ select
+        tmpbyte = inb(iobase + 1);
+        tmpbyte &= SMSCSIOFLAT_UART1IRQSELECT_MASK; // Do not touch the UART1 portion
+        tmpbyte |= (conf->fir_irq & SMSCSIOFLAT_UART2IRQSELECT_MASK);
+        outb(tmpbyte, iobase + 1);
+        tmpbyte = inb(iobase + 1) & SMSCSIOFLAT_UART2IRQSELECT_MASK;
+        if (tmpbyte != conf->fir_irq) {
+                IRDA_WARNING("ERROR: could not configure FIR IRQ channel.\n");
+                return -ENXIO;
+        }
+
+        /* Set up FIR I/O port */
+        outb(SMSCSIOFLAT_FIRBASEADDR_REG, iobase);  // CR2B - SCE (FIR) base addr
+        outb((conf->fir_io >> 3), iobase + 1);
+        tmpbyte = inb(iobase + 1);
+        if (tmpbyte != (conf->fir_io >> 3) ) {
+                IRDA_WARNING("ERROR: could not configure FIR I/O port.\n");
+                return -ENXIO;
+        }
+
+        /* Set up FIR DMA channel */
+        outb(SMSCSIOFLAT_FIRDMASELECT_REG, iobase);  // CR2C - SCE (FIR) DMA select
+        outb((conf->fir_dma & LPC47N227_FIRDMASELECT_MASK), iobase + 1); // DMA
+        tmpbyte = inb(iobase + 1) & LPC47N227_FIRDMASELECT_MASK;
+        if (tmpbyte != (conf->fir_dma & LPC47N227_FIRDMASELECT_MASK)) {
+                IRDA_WARNING("ERROR: could not configure FIR DMA channel.\n");
+                return -ENXIO;
+        }
+
+        outb(SMSCSIOFLAT_UARTMODE0C_REG, iobase);  // CR0C - UART mode
+        tmpbyte = inb(iobase + 1);
+        tmpbyte &= ~SMSCSIOFLAT_UART2MODE_MASK | SMSCSIOFLAT_UART2MODE_VAL_IRDA;
+        outb(tmpbyte, iobase + 1); // enable IrDA (HPSIR) mode, high speed
+
+        outb(LPC47N227_APMBOOTDRIVE_REG, iobase);  // CR07 - Auto Pwr Mgt/boot drive sel
+        tmpbyte = inb(iobase + 1);
+        outb(tmpbyte | LPC47N227_UART2AUTOPWRDOWN_MASK, iobase + 1); // enable UART2 autopower down
+
+        /* This one was not part of tosh1800 */
+        outb(0x0a, iobase);  // CR0a - ecp fifo / ir mux
+        tmpbyte = inb(iobase + 1);
+        outb(tmpbyte | 0x40, iobase + 1); // send active device to ir port
+
+        outb(LPC47N227_UART12POWER_REG, iobase);  // CR02 - UART 1,2 power
+        tmpbyte = inb(iobase + 1);
+        outb(tmpbyte | LPC47N227_UART2POWERDOWN_MASK, iobase + 1); // UART2 power up mode, UART1 power down
+
+        outb(LPC47N227_FDCPOWERVALIDCONF_REG, iobase);  // CR00 - FDC Power/valid config cycle
+        tmpbyte = inb(iobase + 1);
+        outb(tmpbyte | LPC47N227_VALID_MASK, iobase + 1); // valid config cycle done
+
+        outb(LPC47N227_CFGEXITKEY, iobase);  // Exit configuration
+
+        return 0;
+}
+
+/* 82801CAM registers */
+#define VID 0x00
+#define DID 0x02
+#define PIRQA_ROUT 0x60
+#define PCI_DMA_C 0x90
+#define COM_DEC 0xe0
+#define LPC_EN 0xe6
+#define GEN2_DEC 0xec
+/*
+ * Sets up the I/O range using the 82801CAM ISA bridge, 82801DBM LPC bridge or
+ * Intel 82801DB/DBL (ICH4/ICH4-L) LPC Interface Bridge. They all work the same way!
+ */
+static int __init preconfigure_through_82801(struct pci_dev *dev,
+                                  struct smsc_ircc_subsystem_configuration *conf)
+{
+        unsigned short tmpword;
+        int ret;
+
+        IRDA_MESSAGE("Setting up the SMSC device via the 82801 controller.\n");
+        pci_write_config_byte(dev, COM_DEC, 0x10);
+
+        /* Enable LPC */
+        pci_read_config_word(dev, LPC_EN, &tmpword); /* LPC_EN register */
+        tmpword &= 0xfffd; /* mask bit 1 */
+        tmpword |= 0x0001; /* set bit 0 : COMA addr range enable */
+        pci_write_config_word(dev, LPC_EN, tmpword);
+
+        /* Setup DMA */
+        pci_write_config_word(dev, PCI_DMA_C, 0xc0c0); /* LPC I/F DMA on, channel 3  -- rtm (?? PCI DMA ?) */
+        pci_write_config_word(dev, GEN2_DEC, 0x131); /* LPC I/F 2nd decode range */
+
+        /* Pre-configure chip */
+        ret = preconfigure_smsc_chip(conf);
+
+        /* Disable LPC */
+        pci_read_config_word(dev, LPC_EN, &tmpword); /* LPC_EN register */
+        tmpword &= 0xfffc; /* mask bit 1 and bit 0, COMA addr range disable */
+        pci_write_config_word(dev, LPC_EN, tmpword);
+        return ret;
+}
+
+static int __init preconfigure_through_ali(struct pci_dev *dev,
+                                  struct smsc_ircc_subsystem_configuration *conf)
+{
+        /* TODO: put in ALi 1533 configuration here. */
+        IRDA_MESSAGE("SORRY: %s has an unsupported bridge controller (ALi): not pre-configured.\n", conf->name);
+        return -ENODEV;
+}
+
+static int __init smsc_ircc_preconfigure_subsystems(unsigned short ircc_cfg,
+                                                    unsigned short ircc_fir,
+                                                    unsigned short ircc_sir,
+                                                    unsigned char ircc_dma,
+                                                    unsigned char ircc_irq)
+{
+        struct pci_dev *dev = NULL;
+        unsigned short ss_vendor = 0x0000;
+        unsigned short ss_device = 0x0000;
+        int ret = 0;
+
+        dev = pci_get_device(PCI_ANY_ID, PCI_ANY_ID, dev);
+
+        while (dev != NULL) {
+                struct smsc_ircc_subsystem_configuration *conf;
+
+                /*
+                 * Cache the subsystem vendor/device: some manufacturers fail to set
+                 * this for all components, so we save it in case there is just
+                 * 0x0000 0x0000 on the device we want to check.
+                 */
+                if (dev->subsystem_vendor != 0x0000U) {
+                        ss_vendor = dev->subsystem_vendor;
+                        ss_device = dev->subsystem_device;
+                }
+                conf = subsystem_configurations;
+                for( ; conf->subvendor; conf++) {
+                        if(conf->vendor == dev->vendor &&
+                           conf->device == dev->device &&
+                           conf->subvendor == ss_vendor && /* Sometimes these are cached values */
+                           (conf->subdevice == ss_device || conf->subdevice == 0xffff)) {
+                                struct smsc_ircc_subsystem_configuration tmpconf;
+
+                                memcpy(&tmpconf, conf, sizeof(struct smsc_ircc_subsystem_configuration));
+
+                                /* Override the default values with anything passed in as parameter */
+                                if (ircc_cfg != 0)
+                                        tmpconf.cfg_base = ircc_cfg;
+                                if (ircc_fir != 0)
+                                        tmpconf.fir_io = ircc_fir;
+                                if (ircc_sir != 0)
+                                        tmpconf.sir_io = ircc_sir;
+                                if (ircc_dma != 0xff)
+                                        tmpconf.fir_dma = ircc_dma;
+                                if (ircc_irq != 0xff)
+                                        tmpconf.fir_irq = ircc_irq;
+
+                                IRDA_MESSAGE("Detected unconfigured %s SMSC IrDA chip, pre-configuring device.\n", conf->name);
+                                if (conf->preconfigure)
+                                        ret = conf->preconfigure(dev, &tmpconf);
+                                else
+                                        ret = -ENODEV;
+                        }
+                }
+                dev = pci_get_device(PCI_ANY_ID, PCI_ANY_ID, dev);
+        }
+
+        return ret;
+}
+#endif // CONFIG_PCI
+
 /************************************************
  *
  * Transceivers specific functions
diff --git a/drivers/net/ne2k-pci.c b/drivers/net/ne2k-pci.c
index d11821dd86ed..ced9fdb8335c 100644
--- a/drivers/net/ne2k-pci.c
+++ b/drivers/net/ne2k-pci.c
@@ -645,9 +645,7 @@ static void __devexit ne2k_pci_remove_one (struct pci_dev *pdev)
 {
         struct net_device *dev = pci_get_drvdata(pdev);
 
-        if (!dev)
-                BUG();
-
+        BUG_ON(!dev);
         unregister_netdev(dev);
         release_region(dev->base_addr, NE_IO_EXTENT);
         free_netdev(dev);
diff --git a/drivers/net/netconsole.c b/drivers/net/netconsole.c
index 75b35ad760de..66e74f740261 100644
--- a/drivers/net/netconsole.c
+++ b/drivers/net/netconsole.c
@@ -87,6 +87,7 @@ static void write_msg(struct console *con, const char *msg, unsigned int len)
 }
 
 static struct console netconsole = {
+        .name = "netcon",
         .flags = CON_ENABLED | CON_PRINTBUFFER,
         .write = write_msg
 };
diff --git a/drivers/net/ns83820.c b/drivers/net/ns83820.c
index 8e9b1a537dee..706aed7d717f 100644
--- a/drivers/net/ns83820.c
+++ b/drivers/net/ns83820.c
@@ -568,8 +568,7 @@ static inline int ns83820_add_rx_skb(struct ns83820 *dev, struct sk_buff *skb)
 #endif
 
         sg = dev->rx_info.descs + (next_empty * DESC_SIZE);
-        if (unlikely(NULL != dev->rx_info.skbs[next_empty]))
-                BUG();
+        BUG_ON(NULL != dev->rx_info.skbs[next_empty]);
         dev->rx_info.skbs[next_empty] = skb;
 
         dev->rx_info.next_empty = (next_empty + 1) % NR_RX_DESC;
diff --git a/drivers/net/pcmcia/3c574_cs.c b/drivers/net/pcmcia/3c574_cs.c
index ce90becb8bdf..fab93360f017 100644
--- a/drivers/net/pcmcia/3c574_cs.c
+++ b/drivers/net/pcmcia/3c574_cs.c
@@ -204,7 +204,7 @@ enum Window4 {		/* Window 4: Xcvr/media bits. */
 #define MEDIA_TP        0x00C0  /* Enable link beat and jabber for 10baseT. */
 
 struct el3_private {
-        dev_link_t link;
+        struct pcmcia_device    *p_dev;
         dev_node_t node;
         struct net_device_stats stats;
         u16 advertising, partner;               /* NWay media advertisement */
@@ -225,8 +225,8 @@ static char mii_preamble_required = 0;
 
 /* Index of functions. */
 
-static void tc574_config(dev_link_t *link);
-static void tc574_release(dev_link_t *link);
+static int tc574_config(struct pcmcia_device *link);
+static void tc574_release(struct pcmcia_device *link);
 
 static void mdio_sync(kio_addr_t ioaddr, int bits);
 static int mdio_read(kio_addr_t ioaddr, int phy_id, int location);
@@ -256,10 +256,9 @@ static void tc574_detach(struct pcmcia_device *p_dev);
         with Card Services.
 */
 
-static int tc574_attach(struct pcmcia_device *p_dev)
+static int tc574_probe(struct pcmcia_device *link)
 {
         struct el3_private *lp;
-        dev_link_t *link;
         struct net_device *dev;
 
         DEBUG(0, "3c574_attach()\n");
@@ -269,8 +268,8 @@ static int tc574_attach(struct pcmcia_device *p_dev)
         if (!dev)
                 return -ENOMEM;
         lp = netdev_priv(dev);
-        link = &lp->link;
         link->priv = dev;
+        lp->p_dev = link;
 
         spin_lock_init(&lp->window_lock);
         link->io.NumPorts1 = 32;
@@ -280,7 +279,6 @@ static int tc574_attach(struct pcmcia_device *p_dev)
         link->irq.Handler = &el3_interrupt;
         link->irq.Instance = dev;
         link->conf.Attributes = CONF_ENABLE_IRQ;
-        link->conf.Vcc = 50;
         link->conf.IntType = INT_MEMORY_AND_IO;
         link->conf.ConfigIndex = 1;
         link->conf.Present = PRESENT_OPTION;
@@ -298,13 +296,7 @@ static int tc574_attach(struct pcmcia_device *p_dev)
         dev->watchdog_timeo = TX_TIMEOUT;
 #endif
 
-        link->handle = p_dev;
-        p_dev->instance = link;
-
-        link->state |= DEV_PRESENT | DEV_CONFIG_PENDING;
-        tc574_config(link);
-
-        return 0;
+        return tc574_config(link);
 } /* tc574_attach */
 
 /*
@@ -316,18 +308,16 @@ static int tc574_attach(struct pcmcia_device *p_dev)
 
 */
 
-static void tc574_detach(struct pcmcia_device *p_dev)
+static void tc574_detach(struct pcmcia_device *link)
 {
-        dev_link_t *link = dev_to_instance(p_dev);
         struct net_device *dev = link->priv;
 
         DEBUG(0, "3c574_detach(0x%p)\n", link);
 
-        if (link->dev)
+        if (link->dev_node)
                 unregister_netdev(dev);
 
-        if (link->state & DEV_CONFIG)
-                tc574_release(link);
+        tc574_release(link);
 
         free_netdev(dev);
 } /* tc574_detach */
@@ -343,9 +333,8 @@ static void tc574_detach(struct pcmcia_device *p_dev)
 
 static const char *ram_split[] = {"5:3", "3:1", "1:1", "3:5"};
 
-static void tc574_config(dev_link_t *link)
+static int tc574_config(struct pcmcia_device *link)
 {
-        client_handle_t handle = link->handle;
         struct net_device *dev = link->priv;
         struct el3_private *lp = netdev_priv(dev);
         tuple_t tuple;
@@ -363,30 +352,27 @@ static void tc574_config(dev_link_t *link)
 
         tuple.Attributes = 0;
         tuple.DesiredTuple = CISTPL_CONFIG;
-        CS_CHECK(GetFirstTuple, pcmcia_get_first_tuple(handle, &tuple));
+        CS_CHECK(GetFirstTuple, pcmcia_get_first_tuple(link, &tuple));
         tuple.TupleData = (cisdata_t *)buf;
         tuple.TupleDataMax = 64;
         tuple.TupleOffset = 0;
-        CS_CHECK(GetTupleData, pcmcia_get_tuple_data(handle, &tuple));
-        CS_CHECK(ParseTuple, pcmcia_parse_tuple(handle, &tuple, &parse));
+        CS_CHECK(GetTupleData, pcmcia_get_tuple_data(link, &tuple));
+        CS_CHECK(ParseTuple, pcmcia_parse_tuple(link, &tuple, &parse));
         link->conf.ConfigBase = parse.config.base;
         link->conf.Present = parse.config.rmask[0];
 
-        /* Configure card */
-        link->state |= DEV_CONFIG;
-
         link->io.IOAddrLines = 16;
         for (i = j = 0; j < 0x400; j += 0x20) {
                 link->io.BasePort1 = j ^ 0x300;
-                i = pcmcia_request_io(link->handle, &link->io);
+                i = pcmcia_request_io(link, &link->io);
                 if (i == CS_SUCCESS) break;
         }
         if (i != CS_SUCCESS) {
-                cs_error(link->handle, RequestIO, i);
+                cs_error(link, RequestIO, i);
                 goto failed;
         }
-        CS_CHECK(RequestIRQ, pcmcia_request_irq(link->handle, &link->irq));
-        CS_CHECK(RequestConfiguration, pcmcia_request_configuration(link->handle, &link->conf));
+        CS_CHECK(RequestIRQ, pcmcia_request_irq(link, &link->irq));
+        CS_CHECK(RequestConfiguration, pcmcia_request_configuration(link, &link->conf));
 
         dev->irq = link->irq.AssignedIRQ;
         dev->base_addr = link->io.BasePort1;
@@ -397,8 +383,8 @@ static void tc574_config(dev_link_t *link)
            the hardware address.  The future products may include a modem chip
            and put the address in the CIS. */
         tuple.DesiredTuple = 0x88;
-        if (pcmcia_get_first_tuple(handle, &tuple) == CS_SUCCESS) {
-                pcmcia_get_tuple_data(handle, &tuple);
+        if (pcmcia_get_first_tuple(link, &tuple) == CS_SUCCESS) {
+                pcmcia_get_tuple_data(link, &tuple);
                 for (i = 0; i < 3; i++)
                         phys_addr[i] = htons(buf[i]);
         } else {
@@ -412,9 +398,9 @@ static void tc574_config(dev_link_t *link)
                 }
         }
         tuple.DesiredTuple = CISTPL_VERS_1;
-        if (pcmcia_get_first_tuple(handle, &tuple) == CS_SUCCESS &&
-                pcmcia_get_tuple_data(handle, &tuple) == CS_SUCCESS &&
-                pcmcia_parse_tuple(handle, &tuple, &parse) == CS_SUCCESS) {
+        if (pcmcia_get_first_tuple(link, &tuple) == CS_SUCCESS &&
+                pcmcia_get_tuple_data(link, &tuple) == CS_SUCCESS &&
+                pcmcia_parse_tuple(link, &tuple, &parse) == CS_SUCCESS) {
                 cardname = parse.version_1.str + parse.version_1.ofs[1];
         } else
                 cardname = "3Com 3c574";
@@ -473,13 +459,12 @@ static void tc574_config(dev_link_t *link)
                 }
         }
 
-        link->state &= ~DEV_CONFIG_PENDING;
-        link->dev = &lp->node;
-        SET_NETDEV_DEV(dev, &handle_to_dev(handle));
+        link->dev_node = &lp->node;
+        SET_NETDEV_DEV(dev, &handle_to_dev(link));
 
         if (register_netdev(dev) != 0) {
                 printk(KERN_NOTICE "3c574_cs: register_netdev() failed\n");
-                link->dev = NULL;
+                link->dev_node = NULL;
                 goto failed;
         }
 
@@ -493,13 +478,13 @@ static void tc574_config(dev_link_t *link)
                    8 << config.u.ram_size, ram_split[config.u.ram_split],
                    config.u.autoselect ? "autoselect " : "");
 
-        return;
+        return 0;
 
 cs_failed:
-        cs_error(link->handle, last_fn, last_ret);
+        cs_error(link, last_fn, last_ret);
 failed:
         tc574_release(link);
-        return;
+        return -ENODEV;
 
 } /* tc574_config */
 
@@ -509,44 +494,28 @@ failed:
         still open, this will be postponed until it is closed.
 */
 
-static void tc574_release(dev_link_t *link)
+static void tc574_release(struct pcmcia_device *link)
 {
-        DEBUG(0, "3c574_release(0x%p)\n", link);
-
-        pcmcia_release_configuration(link->handle);
-        pcmcia_release_io(link->handle, &link->io);
-        pcmcia_release_irq(link->handle, &link->irq);
-
-        link->state &= ~DEV_CONFIG;
+        pcmcia_disable_device(link);
 }
 
-static int tc574_suspend(struct pcmcia_device *p_dev)
+static int tc574_suspend(struct pcmcia_device *link)
 {
-        dev_link_t *link = dev_to_instance(p_dev);
         struct net_device *dev = link->priv;
 
-        link->state |= DEV_SUSPEND;
-        if (link->state & DEV_CONFIG) {
-                if (link->open)
-                        netif_device_detach(dev);
-                pcmcia_release_configuration(link->handle);
-        }
+        if (link->open)
+                netif_device_detach(dev);
 
         return 0;
 }
 
-static int tc574_resume(struct pcmcia_device *p_dev)
+static int tc574_resume(struct pcmcia_device *link)
 {
-        dev_link_t *link = dev_to_instance(p_dev);
         struct net_device *dev = link->priv;
 
-        link->state &= ~DEV_SUSPEND;
-        if (link->state & DEV_CONFIG) {
-                pcmcia_request_configuration(link->handle, &link->conf);
-                if (link->open) {
-                        tc574_reset(dev);
-                        netif_device_attach(dev);
-                }
+        if (link->open) {
+                tc574_reset(dev);
+                netif_device_attach(dev);
         }
 
         return 0;
@@ -757,9 +726,9 @@ static void tc574_reset(struct net_device *dev)
 static int el3_open(struct net_device *dev)
 {
         struct el3_private *lp = netdev_priv(dev);
-        dev_link_t *link = &lp->link;
+        struct pcmcia_device *link = lp->p_dev;
 
-        if (!DEV_OK(link))
+        if (!pcmcia_dev_present(link))
                 return -ENODEV;
         
         link->open++;
@@ -1203,11 +1172,11 @@ static int el3_close(struct net_device *dev)
 {
         kio_addr_t ioaddr = dev->base_addr;
         struct el3_private *lp = netdev_priv(dev);
-        dev_link_t *link = &lp->link;
+        struct pcmcia_device *link = lp->p_dev;
 
         DEBUG(2, "%s: shutting down ethercard.\n", dev->name);
         
-        if (DEV_OK(link)) {
+        if (pcmcia_dev_present(link)) {
                 unsigned long flags;
 
                 /* Turn off statistics ASAP.  We update lp->stats below. */
@@ -1246,7 +1215,7 @@ static struct pcmcia_driver tc574_driver = {
         .drv            = {
                 .name   = "3c574_cs",
         },
-        .probe          = tc574_attach,
+        .probe          = tc574_probe,
         .remove         = tc574_detach,
         .id_table       = tc574_ids,
         .suspend        = tc574_suspend,
diff --git a/drivers/net/pcmcia/3c589_cs.c b/drivers/net/pcmcia/3c589_cs.c
index 3dba50849da7..875a0fe251e7 100644
--- a/drivers/net/pcmcia/3c589_cs.c
+++ b/drivers/net/pcmcia/3c589_cs.c
@@ -105,7 +105,7 @@ enum RxFilter {
 #define TX_TIMEOUT      ((400*HZ)/1000)
 
 struct el3_private {
-    dev_link_t          link;
+        struct pcmcia_device    *p_dev;
     dev_node_t          node;
     struct net_device_stats stats;
     /* For transceiver monitoring */
@@ -142,8 +142,8 @@ DRV_NAME ".c " DRV_VERSION " 2001/10/13 00:08:50 (David Hinds)";
 
 /*====================================================================*/
 
-static void tc589_config(dev_link_t *link);
-static void tc589_release(dev_link_t *link);
+static int tc589_config(struct pcmcia_device *link);
+static void tc589_release(struct pcmcia_device *link);
 
 static u16 read_eeprom(kio_addr_t ioaddr, int index);
 static void tc589_reset(struct net_device *dev);
@@ -170,10 +170,9 @@ static void tc589_detach(struct pcmcia_device *p_dev);
 
 ======================================================================*/
 
-static int tc589_attach(struct pcmcia_device *p_dev)
+static int tc589_probe(struct pcmcia_device *link)
 {
     struct el3_private *lp;
-    dev_link_t *link;
     struct net_device *dev;
 
     DEBUG(0, "3c589_attach()\n");
@@ -183,8 +182,8 @@ static int tc589_attach(struct pcmcia_device *p_dev)
     if (!dev)
          return -ENOMEM;
     lp = netdev_priv(dev);
-    link = &lp->link;
     link->priv = dev;
+    lp->p_dev = link;
 
     spin_lock_init(&lp->lock);
     link->io.NumPorts1 = 16;
@@ -194,7 +193,6 @@ static int tc589_attach(struct pcmcia_device *p_dev)
     link->irq.Handler = &el3_interrupt;
     link->irq.Instance = dev;
     link->conf.Attributes = CONF_ENABLE_IRQ;
-    link->conf.Vcc = 50;
     link->conf.IntType = INT_MEMORY_AND_IO;
     link->conf.ConfigIndex = 1;
     link->conf.Present = PRESENT_OPTION;
@@ -213,13 +211,7 @@ static int tc589_attach(struct pcmcia_device *p_dev)
 #endif
     SET_ETHTOOL_OPS(dev, &netdev_ethtool_ops);
 
-    link->handle = p_dev;
-    p_dev->instance = link;
-
-    link->state |= DEV_PRESENT | DEV_CONFIG_PENDING;
-    tc589_config(link);
-
-    return 0;
+    return tc589_config(link);
 } /* tc589_attach */
 
 /*======================================================================
@@ -231,18 +223,16 @@ static int tc589_attach(struct pcmcia_device *p_dev)
 
 ======================================================================*/
 
-static void tc589_detach(struct pcmcia_device *p_dev)
+static void tc589_detach(struct pcmcia_device *link)
 {
-    dev_link_t *link = dev_to_instance(p_dev);
     struct net_device *dev = link->priv;
 
     DEBUG(0, "3c589_detach(0x%p)\n", link);
 
-    if (link->dev)
+    if (link->dev_node)
         unregister_netdev(dev);
 
-    if (link->state & DEV_CONFIG)
-        tc589_release(link);
+    tc589_release(link);
 
     free_netdev(dev);
 } /* tc589_detach */
@@ -258,9 +248,8 @@ static void tc589_detach(struct pcmcia_device *p_dev)
 #define CS_CHECK(fn, ret) \
 do { last_fn = (fn); if ((last_ret = (ret)) != 0) goto cs_failed; } while (0)
 
-static void tc589_config(dev_link_t *link)
+static int tc589_config(struct pcmcia_device *link)
 {
-    client_handle_t handle = link->handle;
     struct net_device *dev = link->priv;
     struct el3_private *lp = netdev_priv(dev);
     tuple_t tuple;
@@ -275,43 +264,40 @@ static void tc589_config(dev_link_t *link)
     phys_addr = (u16 *)dev->dev_addr;
     tuple.Attributes = 0;
     tuple.DesiredTuple = CISTPL_CONFIG;
-    CS_CHECK(GetFirstTuple, pcmcia_get_first_tuple(handle, &tuple));
+    CS_CHECK(GetFirstTuple, pcmcia_get_first_tuple(link, &tuple));
     tuple.TupleData = (cisdata_t *)buf;
     tuple.TupleDataMax = sizeof(buf);
     tuple.TupleOffset = 0;
-    CS_CHECK(GetTupleData, pcmcia_get_tuple_data(handle, &tuple));
-    CS_CHECK(ParseTuple, pcmcia_parse_tuple(handle, &tuple, &parse));
+    CS_CHECK(GetTupleData, pcmcia_get_tuple_data(link, &tuple));
+    CS_CHECK(ParseTuple, pcmcia_parse_tuple(link, &tuple, &parse));
     link->conf.ConfigBase = parse.config.base;
     link->conf.Present = parse.config.rmask[0];
     
     /* Is this a 3c562? */
     tuple.DesiredTuple = CISTPL_MANFID;
     tuple.Attributes = TUPLE_RETURN_COMMON;
-    if ((pcmcia_get_first_tuple(handle, &tuple) == CS_SUCCESS) &&
-        (pcmcia_get_tuple_data(handle, &tuple) == CS_SUCCESS)) {
+    if ((pcmcia_get_first_tuple(link, &tuple) == CS_SUCCESS) &&
+        (pcmcia_get_tuple_data(link, &tuple) == CS_SUCCESS)) {
         if (le16_to_cpu(buf[0]) != MANFID_3COM)
             printk(KERN_INFO "3c589_cs: hmmm, is this really a "
                    "3Com card??\n");
         multi = (le16_to_cpu(buf[1]) == PRODID_3COM_3C562);
     }
-    
-    /* Configure card */
-    link->state |= DEV_CONFIG;
 
     /* For the 3c562, the base address must be xx00-xx7f */
     link->io.IOAddrLines = 16;
     for (i = j = 0; j < 0x400; j += 0x10) {
         if (multi && (j & 0x80)) continue;
         link->io.BasePort1 = j ^ 0x300;
-        i = pcmcia_request_io(link->handle, &link->io);
+        i = pcmcia_request_io(link, &link->io);
         if (i == CS_SUCCESS) break;
     }
     if (i != CS_SUCCESS) {
-        cs_error(link->handle, RequestIO, i);
+        cs_error(link, RequestIO, i);
         goto failed;
     }
-    CS_CHECK(RequestIRQ, pcmcia_request_irq(link->handle, &link->irq));
-    CS_CHECK(RequestConfiguration, pcmcia_request_configuration(link->handle, &link->conf));
+    CS_CHECK(RequestIRQ, pcmcia_request_irq(link, &link->irq));
+    CS_CHECK(RequestConfiguration, pcmcia_request_configuration(link, &link->conf));
         
     dev->irq = link->irq.AssignedIRQ;
     dev->base_addr = link->io.BasePort1;
@@ -321,8 +307,8 @@ static void tc589_config(dev_link_t *link)
     /* The 3c589 has an extra EEPROM for configuration info, including
        the hardware address.  The 3c562 puts the address in the CIS. */
     tuple.DesiredTuple = 0x88;
-    if (pcmcia_get_first_tuple(handle, &tuple) == CS_SUCCESS) {
-        pcmcia_get_tuple_data(handle, &tuple);
+    if (pcmcia_get_first_tuple(link, &tuple) == CS_SUCCESS) {
+        pcmcia_get_tuple_data(link, &tuple);
         for (i = 0; i < 3; i++)
             phys_addr[i] = htons(buf[i]);
     } else {
@@ -346,13 +332,12 @@ static void tc589_config(dev_link_t *link)
     else
         printk(KERN_ERR "3c589_cs: invalid if_port requested\n");
     
-    link->dev = &lp->node;
-    link->state &= ~DEV_CONFIG_PENDING;
-    SET_NETDEV_DEV(dev, &handle_to_dev(handle));
+    link->dev_node = &lp->node;
+    SET_NETDEV_DEV(dev, &handle_to_dev(link));
 
     if (register_netdev(dev) != 0) {
         printk(KERN_ERR "3c589_cs: register_netdev() failed\n");
-        link->dev = NULL;
+        link->dev_node = NULL;
         goto failed;
     }
 
@@ -366,14 +351,13 @@ static void tc589_config(dev_link_t *link)
     printk(KERN_INFO "  %dK FIFO split %s Rx:Tx, %s xcvr\n",
            (fifo & 7) ? 32 : 8, ram_split[(fifo >> 16) & 3],
            if_names[dev->if_port]);
-    return;
+    return 0;
 
 cs_failed:
-    cs_error(link->handle, last_fn, last_ret);
+    cs_error(link, last_fn, last_ret);
 failed:
     tc589_release(link);
-    return;
-    
+    return -ENODEV;
 } /* tc589_config */
 
 /*======================================================================
@@ -384,44 +368,28 @@ failed:
     
 ======================================================================*/
 
-static void tc589_release(dev_link_t *link)
+static void tc589_release(struct pcmcia_device *link)
 {
-    DEBUG(0, "3c589_release(0x%p)\n", link);
-    
-    pcmcia_release_configuration(link->handle);
-    pcmcia_release_io(link->handle, &link->io);
-    pcmcia_release_irq(link->handle, &link->irq);
-    
-    link->state &= ~DEV_CONFIG;
+        pcmcia_disable_device(link);
 }
 
-static int tc589_suspend(struct pcmcia_device *p_dev)
+static int tc589_suspend(struct pcmcia_device *link)
 {
-        dev_link_t *link = dev_to_instance(p_dev);
         struct net_device *dev = link->priv;
 
-        link->state |= DEV_SUSPEND;
-        if (link->state & DEV_CONFIG) {
-                if (link->open)
-                        netif_device_detach(dev);
-                pcmcia_release_configuration(link->handle);
-        }
+        if (link->open)
+                netif_device_detach(dev);
 
         return 0;
 }
 
-static int tc589_resume(struct pcmcia_device *p_dev)
+static int tc589_resume(struct pcmcia_device *link)
 {
-        dev_link_t *link = dev_to_instance(p_dev);
         struct net_device *dev = link->priv;
 
-        link->state &= ~DEV_SUSPEND;
-        if (link->state & DEV_CONFIG) {
-                pcmcia_request_configuration(link->handle, &link->conf);
-                if (link->open) {
-                        tc589_reset(dev);
-                        netif_device_attach(dev);
-                }
+        if (link->open) {
+                tc589_reset(dev);
+                netif_device_attach(dev);
         }
 
         return 0;
@@ -587,9 +555,9 @@ static int el3_config(struct net_device *dev, struct ifmap *map)
 static int el3_open(struct net_device *dev)
 {
     struct el3_private *lp = netdev_priv(dev);
-    dev_link_t *link = &lp->link;
+    struct pcmcia_device *link = lp->p_dev;
     
-    if (!DEV_OK(link))
+    if (!pcmcia_dev_present(link))
         return -ENODEV;
 
     link->open++;
@@ -848,9 +816,9 @@ static struct net_device_stats *el3_get_stats(struct net_device *dev)
 {
     struct el3_private *lp = netdev_priv(dev);
     unsigned long flags;
-    dev_link_t *link = &lp->link;
+    struct pcmcia_device *link = lp->p_dev;
 
-    if (DEV_OK(link)) {
+    if (pcmcia_dev_present(link)) {
         spin_lock_irqsave(&lp->lock, flags);
         update_stats(dev);
         spin_unlock_irqrestore(&lp->lock, flags);
@@ -950,11 +918,11 @@ static int el3_rx(struct net_device *dev)
 static void set_multicast_list(struct net_device *dev)
 {
     struct el3_private *lp = netdev_priv(dev);
-    dev_link_t *link = &lp->link;
+    struct pcmcia_device *link = lp->p_dev;
     kio_addr_t ioaddr = dev->base_addr;
     u16 opts = SetRxFilter | RxStation | RxBroadcast;
 
-    if (!(DEV_OK(link))) return;
+    if (!pcmcia_dev_present(link)) return;
     if (dev->flags & IFF_PROMISC)
         opts |= RxMulticast | RxProm;
     else if (dev->mc_count || (dev->flags & IFF_ALLMULTI))
@@ -965,12 +933,12 @@ static void set_multicast_list(struct net_device *dev)
 static int el3_close(struct net_device *dev)
 {
     struct el3_private *lp = netdev_priv(dev);
-    dev_link_t *link = &lp->link;
+    struct pcmcia_device *link = lp->p_dev;
     kio_addr_t ioaddr = dev->base_addr;
     
     DEBUG(1, "%s: shutting down ethercard.\n", dev->name);
 
-    if (DEV_OK(link)) {
+    if (pcmcia_dev_present(link)) {
         /* Turn off statistics ASAP.  We update lp->stats below. */
         outw(StatsDisable, ioaddr + EL3_CMD);
         
@@ -1020,7 +988,7 @@ static struct pcmcia_driver tc589_driver = {
         .drv            = {
                 .name   = "3c589_cs",
         },
-        .probe          = tc589_attach,
+        .probe          = tc589_probe,
         .remove         = tc589_detach,
         .id_table       = tc589_ids,
         .suspend        = tc589_suspend,
diff --git a/drivers/net/pcmcia/axnet_cs.c b/drivers/net/pcmcia/axnet_cs.c
index 1cc94b2d76c1..56233afcb2b3 100644
--- a/drivers/net/pcmcia/axnet_cs.c
+++ b/drivers/net/pcmcia/axnet_cs.c
@@ -86,8 +86,8 @@ static char *version =
 
 /*====================================================================*/
 
-static void axnet_config(dev_link_t *link);
-static void axnet_release(dev_link_t *link);
+static int axnet_config(struct pcmcia_device *link);
+static void axnet_release(struct pcmcia_device *link);
 static int axnet_open(struct net_device *dev);
 static int axnet_close(struct net_device *dev);
 static int axnet_ioctl(struct net_device *dev, struct ifreq *rq, int cmd);
@@ -117,7 +117,7 @@ static irqreturn_t ax_interrupt(int irq, void *dev_id, struct pt_regs *regs);
 /*====================================================================*/
 
 typedef struct axnet_dev_t {
-    dev_link_t          link;
+        struct pcmcia_device    *p_dev;
     dev_node_t          node;
     caddr_t             base;
     struct timer_list   watchdog;
@@ -142,10 +142,9 @@ static inline axnet_dev_t *PRIV(struct net_device *dev)
 
 ======================================================================*/
 
-static int axnet_attach(struct pcmcia_device *p_dev)
+static int axnet_probe(struct pcmcia_device *link)
 {
     axnet_dev_t *info;
-    dev_link_t *link;
     struct net_device *dev;
 
     DEBUG(0, "axnet_attach()\n");
@@ -157,7 +156,7 @@ static int axnet_attach(struct pcmcia_device *p_dev)
         return -ENOMEM;
 
     info = PRIV(dev);
-    link = &info->link;
+    info->p_dev = link;
     link->priv = dev;
     link->irq.Attributes = IRQ_TYPE_EXCLUSIVE;
     link->irq.IRQInfo1 = IRQ_LEVEL_ID;
@@ -169,13 +168,7 @@ static int axnet_attach(struct pcmcia_device *p_dev)
     dev->do_ioctl = &axnet_ioctl;
     SET_ETHTOOL_OPS(dev, &netdev_ethtool_ops);
 
-    link->handle = p_dev;
-    p_dev->instance = link;
-
-    link->state |= DEV_PRESENT | DEV_CONFIG_PENDING;
-    axnet_config(link);
-
-    return 0;
+    return axnet_config(link);
 } /* axnet_attach */
 
 /*======================================================================
@@ -187,18 +180,16 @@ static int axnet_attach(struct pcmcia_device *p_dev)
 
 ======================================================================*/
 
-static void axnet_detach(struct pcmcia_device *p_dev)
+static void axnet_detach(struct pcmcia_device *link)
 {
-    dev_link_t *link = dev_to_instance(p_dev);
     struct net_device *dev = link->priv;
 
     DEBUG(0, "axnet_detach(0x%p)\n", link);
 
-    if (link->dev)
+    if (link->dev_node)
         unregister_netdev(dev);
 
-    if (link->state & DEV_CONFIG)
-        axnet_release(link);
+    axnet_release(link);
 
     free_netdev(dev);
 } /* axnet_detach */
@@ -209,7 +200,7 @@ static void axnet_detach(struct pcmcia_device *p_dev)
 
 ======================================================================*/
 
-static int get_prom(dev_link_t *link)
+static int get_prom(struct pcmcia_device *link)
 {
     struct net_device *dev = link->priv;
     kio_addr_t ioaddr = dev->base_addr;
@@ -263,7 +254,7 @@ static int get_prom(dev_link_t *link)
 #define CS_CHECK(fn, ret) \
 do { last_fn = (fn); if ((last_ret = (ret)) != 0) goto cs_failed; } while (0)
 
-static int try_io_port(dev_link_t *link)
+static int try_io_port(struct pcmcia_device *link)
 {
     int j, ret;
     if (link->io.NumPorts1 == 32) {
@@ -284,25 +275,23 @@ static int try_io_port(dev_link_t *link)
         for (j = 0; j < 0x400; j += 0x20) {
             link->io.BasePort1 = j ^ 0x300;
             link->io.BasePort2 = (j ^ 0x300) + 0x10;
-            ret = pcmcia_request_io(link->handle, &link->io);
+            ret = pcmcia_request_io(link, &link->io);
             if (ret == CS_SUCCESS) return ret;
         }
         return ret;
     } else {
-        return pcmcia_request_io(link->handle, &link->io);
+        return pcmcia_request_io(link, &link->io);
     }
 }
 
-static void axnet_config(dev_link_t *link)
+static int axnet_config(struct pcmcia_device *link)
 {
-    client_handle_t handle = link->handle;
     struct net_device *dev = link->priv;
     axnet_dev_t *info = PRIV(dev);
     tuple_t tuple;
     cisparse_t parse;
     int i, j, last_ret, last_fn;
     u_short buf[64];
-    config_info_t conf;
 
     DEBUG(0, "axnet_config(0x%p)\n", link);
 
@@ -311,29 +300,22 @@ static void axnet_config(dev_link_t *link)
     tuple.TupleDataMax = sizeof(buf);
     tuple.TupleOffset = 0;
     tuple.DesiredTuple = CISTPL_CONFIG;
-    CS_CHECK(GetFirstTuple, pcmcia_get_first_tuple(handle, &tuple));
-    CS_CHECK(GetTupleData, pcmcia_get_tuple_data(handle, &tuple));
-    CS_CHECK(ParseTuple, pcmcia_parse_tuple(handle, &tuple, &parse));
+    CS_CHECK(GetFirstTuple, pcmcia_get_first_tuple(link, &tuple));
+    CS_CHECK(GetTupleData, pcmcia_get_tuple_data(link, &tuple));
+    CS_CHECK(ParseTuple, pcmcia_parse_tuple(link, &tuple, &parse));
     link->conf.ConfigBase = parse.config.base;
     /* don't trust the CIS on this; Linksys got it wrong */
     link->conf.Present = 0x63;
 
-    /* Configure card */
-    link->state |= DEV_CONFIG;
-
-    /* Look up current Vcc */
-    CS_CHECK(GetConfigurationInfo, pcmcia_get_configuration_info(handle, &conf));
-    link->conf.Vcc = conf.Vcc;
-
     tuple.DesiredTuple = CISTPL_CFTABLE_ENTRY;
     tuple.Attributes = 0;
-    CS_CHECK(GetFirstTuple, pcmcia_get_first_tuple(handle, &tuple));
+    CS_CHECK(GetFirstTuple, pcmcia_get_first_tuple(link, &tuple));
     while (last_ret == CS_SUCCESS) {
         cistpl_cftable_entry_t *cfg = &(parse.cftable_entry);
         cistpl_io_t *io = &(parse.cftable_entry.io);
         
-        if (pcmcia_get_tuple_data(handle, &tuple) != 0 ||
-                pcmcia_parse_tuple(handle, &tuple, &parse) != 0 ||
+        if (pcmcia_get_tuple_data(link, &tuple) != 0 ||
+                pcmcia_parse_tuple(link, &tuple, &parse) != 0 ||
                 cfg->index == 0 || cfg->io.nwin == 0)
             goto next_entry;
         
@@ -355,21 +337,21 @@ static void axnet_config(dev_link_t *link)
             if (last_ret == CS_SUCCESS) break;
         }
     next_entry:
-        last_ret = pcmcia_get_next_tuple(handle, &tuple);
+        last_ret = pcmcia_get_next_tuple(link, &tuple);
     }
     if (last_ret != CS_SUCCESS) {
-        cs_error(handle, RequestIO, last_ret);
+        cs_error(link, RequestIO, last_ret);
         goto failed;
     }
 
-    CS_CHECK(RequestIRQ, pcmcia_request_irq(handle, &link->irq));
+    CS_CHECK(RequestIRQ, pcmcia_request_irq(link, &link->irq));
     
     if (link->io.NumPorts2 == 8) {
         link->conf.Attributes |= CONF_ENABLE_SPKR;
         link->conf.Status = CCSR_AUDIO_ENA;
     }
     
-    CS_CHECK(RequestConfiguration, pcmcia_request_configuration(handle, &link->conf));
+    CS_CHECK(RequestConfiguration, pcmcia_request_configuration(link, &link->conf));
     dev->irq = link->irq.AssignedIRQ;
     dev->base_addr = link->io.BasePort1;
 
@@ -406,7 +388,7 @@ static void axnet_config(dev_link_t *link)
        Bit 2 of CCSR is active low. */ 
     if (i == 32) {
         conf_reg_t reg = { 0, CS_WRITE, CISREG_CCSR, 0x04 };
-        pcmcia_access_configuration_register(link->handle, &reg);
+        pcmcia_access_configuration_register(link, &reg);
         for (i = 0; i < 32; i++) {
             j = mdio_read(dev->base_addr + AXNET_MII_EEP, i, 1);
             if ((j != 0) && (j != 0xffff)) break;
@@ -414,13 +396,12 @@ static void axnet_config(dev_link_t *link)
     }
 
     info->phy_id = (i < 32) ? i : -1;
-    link->dev = &info->node;
-    link->state &= ~DEV_CONFIG_PENDING;
-    SET_NETDEV_DEV(dev, &handle_to_dev(handle));
+    link->dev_node = &info->node;
+    SET_NETDEV_DEV(dev, &handle_to_dev(link));
 
     if (register_netdev(dev) != 0) {
         printk(KERN_NOTICE "axnet_cs: register_netdev() failed\n");
-        link->dev = NULL;
+        link->dev_node = NULL;
         goto failed;
     }
 
@@ -436,14 +417,13 @@ static void axnet_config(dev_link_t *link)
     } else {
         printk(KERN_NOTICE "  No MII transceivers found!\n");
     }
-    return;
+    return 0;
 
 cs_failed:
-    cs_error(link->handle, last_fn, last_ret);
+    cs_error(link, last_fn, last_ret);
 failed:
     axnet_release(link);
-    link->state &= ~DEV_CONFIG_PENDING;
-    return;
+    return -ENODEV;
 } /* axnet_config */
 
 /*======================================================================
@@ -454,45 +434,29 @@ failed:
 
 ======================================================================*/
 
-static void axnet_release(dev_link_t *link)
+static void axnet_release(struct pcmcia_device *link)
 {
-    DEBUG(0, "axnet_release(0x%p)\n", link);
-
-    pcmcia_release_configuration(link->handle);
-    pcmcia_release_io(link->handle, &link->io);
-    pcmcia_release_irq(link->handle, &link->irq);
-
-    link->state &= ~DEV_CONFIG;
+        pcmcia_disable_device(link);
 }
 
-static int axnet_suspend(struct pcmcia_device *p_dev)
+static int axnet_suspend(struct pcmcia_device *link)
 {
-        dev_link_t *link = dev_to_instance(p_dev);
         struct net_device *dev = link->priv;
 
-        link->state |= DEV_SUSPEND;
-        if (link->state & DEV_CONFIG) {
-                if (link->open)
-                        netif_device_detach(dev);
-                pcmcia_release_configuration(link->handle);
-        }
+        if (link->open)
+                netif_device_detach(dev);
 
         return 0;
 }
 
-static int axnet_resume(struct pcmcia_device *p_dev)
+static int axnet_resume(struct pcmcia_device *link)
 {
-        dev_link_t *link = dev_to_instance(p_dev);
         struct net_device *dev = link->priv;
 
-        link->state &= ~DEV_SUSPEND;
-        if (link->state & DEV_CONFIG) {
-                pcmcia_request_configuration(link->handle, &link->conf);
-                if (link->open) {
-                        axnet_reset_8390(dev);
-                        AX88190_init(dev, 1);
-                        netif_device_attach(dev);
-                }
+        if (link->open) {
+                axnet_reset_8390(dev);
+                AX88190_init(dev, 1);
+                netif_device_attach(dev);
         }
 
         return 0;
@@ -562,11 +526,11 @@ static void mdio_write(kio_addr_t addr, int phy_id, int loc, int value)
 static int axnet_open(struct net_device *dev)
 {
     axnet_dev_t *info = PRIV(dev);
-    dev_link_t *link = &info->link;
+    struct pcmcia_device *link = info->p_dev;
     
     DEBUG(2, "axnet_open('%s')\n", dev->name);
 
-    if (!DEV_OK(link))
+    if (!pcmcia_dev_present(link))
         return -ENODEV;
 
     link->open++;
@@ -588,7 +552,7 @@ static int axnet_open(struct net_device *dev)
 static int axnet_close(struct net_device *dev)
 {
     axnet_dev_t *info = PRIV(dev);
-    dev_link_t *link = &info->link;
+    struct pcmcia_device *link = info->p_dev;
 
     DEBUG(2, "axnet_close('%s')\n", dev->name);
 
@@ -833,7 +797,7 @@ static struct pcmcia_driver axnet_cs_driver = {
         .drv            = {
                 .name   = "axnet_cs",
         },
-        .probe          = axnet_attach,
+        .probe          = axnet_probe,
         .remove         = axnet_detach,
         .id_table       = axnet_ids,
         .suspend        = axnet_suspend,
diff --git a/drivers/net/pcmcia/com20020_cs.c b/drivers/net/pcmcia/com20020_cs.c
index 2827a48ea37c..441de824ab6b 100644
--- a/drivers/net/pcmcia/com20020_cs.c
+++ b/drivers/net/pcmcia/com20020_cs.c
@@ -118,8 +118,8 @@ MODULE_LICENSE("GPL");
 
 /*====================================================================*/
 
-static void com20020_config(dev_link_t *link);
-static void com20020_release(dev_link_t *link);
+static int com20020_config(struct pcmcia_device *link);
+static void com20020_release(struct pcmcia_device *link);
 
 static void com20020_detach(struct pcmcia_device *p_dev);
 
@@ -138,9 +138,8 @@ typedef struct com20020_dev_t {
 
 ======================================================================*/
 
-static int com20020_attach(struct pcmcia_device *p_dev)
+static int com20020_probe(struct pcmcia_device *p_dev)
 {
-    dev_link_t *link;
     com20020_dev_t *info;
     struct net_device *dev;
     struct arcnet_local *lp;
@@ -148,10 +147,6 @@ static int com20020_attach(struct pcmcia_device *p_dev)
     DEBUG(0, "com20020_attach()\n");
 
     /* Create new network device */
-    link = kmalloc(sizeof(struct dev_link_t), GFP_KERNEL);
-    if (!link)
-        return -ENOMEM;
-
     info = kmalloc(sizeof(struct com20020_dev_t), GFP_KERNEL);
     if (!info)
         goto fail_alloc_info;
@@ -161,7 +156,6 @@ static int com20020_attach(struct pcmcia_device *p_dev)
         goto fail_alloc_dev;
 
     memset(info, 0, sizeof(struct com20020_dev_t));
-    memset(link, 0, sizeof(struct dev_link_t));
     lp = dev->priv;
     lp->timeout = timeout;
     lp->backplane = backplane;
@@ -172,28 +166,23 @@ static int com20020_attach(struct pcmcia_device *p_dev)
     /* fill in our module parameters as defaults */
     dev->dev_addr[0] = node;
 
-    link->io.Attributes1 = IO_DATA_PATH_WIDTH_8;
-    link->io.NumPorts1 = 16;
-    link->io.IOAddrLines = 16;
-    link->irq.Attributes = IRQ_TYPE_EXCLUSIVE;
-    link->irq.IRQInfo1 = IRQ_LEVEL_ID;
-    link->conf.Attributes = CONF_ENABLE_IRQ;
-    link->conf.Vcc = 50;
-    link->conf.IntType = INT_MEMORY_AND_IO;
-    link->conf.Present = PRESENT_OPTION;
-
-    link->irq.Instance = info->dev = dev;
-    link->priv = info;
+    p_dev->io.Attributes1 = IO_DATA_PATH_WIDTH_8;
+    p_dev->io.NumPorts1 = 16;
+    p_dev->io.IOAddrLines = 16;
+    p_dev->irq.Attributes = IRQ_TYPE_EXCLUSIVE;
+    p_dev->irq.IRQInfo1 = IRQ_LEVEL_ID;
+    p_dev->conf.Attributes = CONF_ENABLE_IRQ;
+    p_dev->conf.IntType = INT_MEMORY_AND_IO;
+    p_dev->conf.Present = PRESENT_OPTION;
 
-    link->state |= DEV_PRESENT;
-    com20020_config(link);
+    p_dev->irq.Instance = info->dev = dev;
+    p_dev->priv = info;
 
-    return 0;
+    return com20020_config(p_dev);
 
 fail_alloc_dev:
     kfree(info);
 fail_alloc_info:
-    kfree(link);
     return -ENOMEM;
 } /* com20020_attach */
 
@@ -206,9 +195,8 @@ fail_alloc_info:
 
 ======================================================================*/
 
-static void com20020_detach(struct pcmcia_device *p_dev)
+static void com20020_detach(struct pcmcia_device *link)
 {
-    dev_link_t *link = dev_to_instance(p_dev);
     struct com20020_dev_t *info = link->priv;
     struct net_device *dev = info->dev;
 
@@ -216,7 +204,7 @@ static void com20020_detach(struct pcmcia_device *p_dev)
 
     DEBUG(0, "com20020_detach(0x%p)\n", link);
 
-    if (link->dev) {
+    if (link->dev_node) {
         DEBUG(1,"unregister...\n");
 
         unregister_netdev(dev);
@@ -229,8 +217,7 @@ static void com20020_detach(struct pcmcia_device *p_dev)
             free_irq(dev->irq, dev);
     }
 
-    if (link->state & DEV_CONFIG)
-        com20020_release(link);
+    com20020_release(link);
 
     /* Unlink device structure, free bits */
     DEBUG(1,"unlinking...\n");
@@ -245,8 +232,6 @@ static void com20020_detach(struct pcmcia_device *p_dev)
         DEBUG(1,"kfree2...\n");
         kfree(info);
     }
-    DEBUG(1,"kfree3...\n");
-    kfree(link);
 
 } /* com20020_detach */
 
@@ -261,10 +246,9 @@ static void com20020_detach(struct pcmcia_device *p_dev)
 #define CS_CHECK(fn, ret) \
 do { last_fn = (fn); if ((last_ret = (ret)) != 0) goto cs_failed; } while (0)
 
-static void com20020_config(dev_link_t *link)
+static int com20020_config(struct pcmcia_device *link)
 {
     struct arcnet_local *lp;
-    client_handle_t handle;
     tuple_t tuple;
     cisparse_t parse;
     com20020_dev_t *info;
@@ -273,7 +257,6 @@ static void com20020_config(dev_link_t *link)
     u_char buf[64];
     int ioaddr;
 
-    handle = link->handle;
     info = link->priv;
     dev = info->dev;
 
@@ -286,14 +269,11 @@ static void com20020_config(dev_link_t *link)
     tuple.TupleDataMax = 64;
     tuple.TupleOffset = 0;
     tuple.DesiredTuple = CISTPL_CONFIG;
-    CS_CHECK(GetFirstTuple, pcmcia_get_first_tuple(handle, &tuple));
-    CS_CHECK(GetTupleData, pcmcia_get_tuple_data(handle, &tuple));
-    CS_CHECK(ParseTuple, pcmcia_parse_tuple(handle, &tuple, &parse));
+    CS_CHECK(GetFirstTuple, pcmcia_get_first_tuple(link, &tuple));
+    CS_CHECK(GetTupleData, pcmcia_get_tuple_data(link, &tuple));
+    CS_CHECK(ParseTuple, pcmcia_parse_tuple(link, &tuple, &parse));
     link->conf.ConfigBase = parse.config.base;
 
-    /* Configure card */
-    link->state |= DEV_CONFIG;
-
     DEBUG(1,"arcnet: baseport1 is %Xh\n", link->io.BasePort1);
     i = !CS_SUCCESS;
     if (!link->io.BasePort1)
@@ -301,13 +281,13 @@ static void com20020_config(dev_link_t *link)
         for (ioaddr = 0x100; ioaddr < 0x400; ioaddr += 0x10)
         {
             link->io.BasePort1 = ioaddr;
-            i = pcmcia_request_io(link->handle, &link->io);
+            i = pcmcia_request_io(link, &link->io);
             if (i == CS_SUCCESS)
                 break;
         }
     }
     else
-        i = pcmcia_request_io(link->handle, &link->io);
+        i = pcmcia_request_io(link, &link->io);
     
     if (i != CS_SUCCESS)
     {
@@ -321,7 +301,7 @@ static void com20020_config(dev_link_t *link)
     DEBUG(1,"arcnet: request IRQ %d (%Xh/%Xh)\n",
            link->irq.AssignedIRQ,
            link->irq.IRQInfo1, link->irq.IRQInfo2);
-    i = pcmcia_request_irq(link->handle, &link->irq);
+    i = pcmcia_request_irq(link, &link->irq);
     if (i != CS_SUCCESS)
     {
         DEBUG(1,"arcnet: requestIRQ failed totally!\n");
@@ -330,7 +310,7 @@ static void com20020_config(dev_link_t *link)
 
     dev->irq = link->irq.AssignedIRQ;
 
-    CS_CHECK(RequestConfiguration, pcmcia_request_configuration(link->handle, &link->conf));
+    CS_CHECK(RequestConfiguration, pcmcia_request_configuration(link, &link->conf));
 
     if (com20020_check(dev))
     {
@@ -342,15 +322,14 @@ static void com20020_config(dev_link_t *link)
     lp->card_name = "PCMCIA COM20020";
     lp->card_flags = ARC_CAN_10MBIT; /* pretend all of them can 10Mbit */
 
-    link->dev = &info->node;
-    link->state &= ~DEV_CONFIG_PENDING;
-    SET_NETDEV_DEV(dev, &handle_to_dev(handle));
+    link->dev_node = &info->node;
+    SET_NETDEV_DEV(dev, &handle_to_dev(link));
 
     i = com20020_found(dev, 0); /* calls register_netdev */
     
     if (i != 0) {
         DEBUG(1,KERN_NOTICE "com20020_cs: com20020_found() failed\n");
-        link->dev = NULL;
+        link->dev_node = NULL;
         goto failed;
     }
 
@@ -358,13 +337,14 @@ static void com20020_config(dev_link_t *link)
 
     DEBUG(1,KERN_INFO "%s: port %#3lx, irq %d\n",
            dev->name, dev->base_addr, dev->irq);
-    return;
+    return 0;
 
 cs_failed:
-    cs_error(link->handle, last_fn, last_ret);
+    cs_error(link, last_fn, last_ret);
 failed:
     DEBUG(1,"com20020_config failed...\n");
     com20020_release(link);
+    return -ENODEV;
 } /* com20020_config */
 
 /*======================================================================
@@ -375,52 +355,33 @@ failed:
 
 ======================================================================*/
 
-static void com20020_release(dev_link_t *link)
+static void com20020_release(struct pcmcia_device *link)
 {
-
-    DEBUG(1,"release...\n");
-
-    DEBUG(0, "com20020_release(0x%p)\n", link);
-
-    pcmcia_release_configuration(link->handle);
-    pcmcia_release_io(link->handle, &link->io);
-    pcmcia_release_irq(link->handle, &link->irq);
-
-    link->state &= ~(DEV_CONFIG | DEV_RELEASE_PENDING);
+        DEBUG(0, "com20020_release(0x%p)\n", link);
+        pcmcia_disable_device(link);
 }
 
-static int com20020_suspend(struct pcmcia_device *p_dev)
+static int com20020_suspend(struct pcmcia_device *link)
 {
-        dev_link_t *link = dev_to_instance(p_dev);
         com20020_dev_t *info = link->priv;
         struct net_device *dev = info->dev;
 
-        link->state |= DEV_SUSPEND;
-        if (link->state & DEV_CONFIG) {
-                if (link->open) {
-                        netif_device_detach(dev);
-                }
-                pcmcia_release_configuration(link->handle);
-        }
+        if (link->open)
+                netif_device_detach(dev);
 
         return 0;
 }
 
-static int com20020_resume(struct pcmcia_device *p_dev)
+static int com20020_resume(struct pcmcia_device *link)
 {
-        dev_link_t *link = dev_to_instance(p_dev);
         com20020_dev_t *info = link->priv;
         struct net_device *dev = info->dev;
 
-        link->state &= ~DEV_SUSPEND;
-        if (link->state & DEV_CONFIG) {
-                pcmcia_request_configuration(link->handle, &link->conf);
-                if (link->open) {
-                        int ioaddr = dev->base_addr;
-                        struct arcnet_local *lp = dev->priv;
-                        ARCRESET;
-                }
-        }
+        if (link->open) {
+                int ioaddr = dev->base_addr;
+                struct arcnet_local *lp = dev->priv;
+                ARCRESET;
+        }
 
         return 0;
 }
@@ -436,7 +397,7 @@ static struct pcmcia_driver com20020_cs_driver = {
         .drv            = {
                 .name   = "com20020_cs",
         },
-        .probe          = com20020_attach,
+        .probe          = com20020_probe,
         .remove         = com20020_detach,
         .id_table       = com20020_ids,
         .suspend        = com20020_suspend,
diff --git a/drivers/net/pcmcia/fmvj18x_cs.c b/drivers/net/pcmcia/fmvj18x_cs.c
index b7ac14ba8877..09b11761cdfa 100644
--- a/drivers/net/pcmcia/fmvj18x_cs.c
+++ b/drivers/net/pcmcia/fmvj18x_cs.c
@@ -84,10 +84,10 @@ static char *version = DRV_NAME ".c " DRV_VERSION " 2002/03/23";
 /*
     PCMCIA event handlers
  */
-static void fmvj18x_config(dev_link_t *link);
-static int fmvj18x_get_hwinfo(dev_link_t *link, u_char *node_id);
-static int fmvj18x_setup_mfc(dev_link_t *link);
-static void fmvj18x_release(dev_link_t *link);
+static int fmvj18x_config(struct pcmcia_device *link);
+static int fmvj18x_get_hwinfo(struct pcmcia_device *link, u_char *node_id);
+static int fmvj18x_setup_mfc(struct pcmcia_device *link);
+static void fmvj18x_release(struct pcmcia_device *link);
 static void fmvj18x_detach(struct pcmcia_device *p_dev);
 
 /*
@@ -116,7 +116,7 @@ typedef enum { MBH10302, MBH10304, TDK, CONTEC, LA501, UNGERMANN,
     driver specific data structure
 */
 typedef struct local_info_t {
-    dev_link_t link;
+        struct pcmcia_device    *p_dev;
     dev_node_t node;
     struct net_device_stats stats;
     long open_time;
@@ -228,10 +228,9 @@ typedef struct local_info_t {
 #define BANK_1U              0x24 /* bank 1 (CONFIG_1) */
 #define BANK_2U              0x28 /* bank 2 (CONFIG_1) */
 
-static int fmvj18x_attach(struct pcmcia_device *p_dev)
+static int fmvj18x_probe(struct pcmcia_device *link)
 {
     local_info_t *lp;
-    dev_link_t *link;
     struct net_device *dev;
 
     DEBUG(0, "fmvj18x_attach()\n");
@@ -241,8 +240,8 @@ static int fmvj18x_attach(struct pcmcia_device *p_dev)
     if (!dev)
         return -ENOMEM;
     lp = netdev_priv(dev);
-    link = &lp->link;
     link->priv = dev;
+    lp->p_dev = link;
 
     /* The io structure describes IO port mapping */
     link->io.NumPorts1 = 32;
@@ -257,7 +256,6 @@ static int fmvj18x_attach(struct pcmcia_device *p_dev)
 
     /* General socket configuration */
     link->conf.Attributes = CONF_ENABLE_IRQ;
-    link->conf.Vcc = 50;
     link->conf.IntType = INT_MEMORY_AND_IO;
 
     /* The FMVJ18x specific entries in the device structure. */
@@ -274,29 +272,21 @@ static int fmvj18x_attach(struct pcmcia_device *p_dev)
 #endif
     SET_ETHTOOL_OPS(dev, &netdev_ethtool_ops);
 
-    link->handle = p_dev;
-    p_dev->instance = link;
-
-    link->state |= DEV_PRESENT | DEV_CONFIG_PENDING;
-    fmvj18x_config(link);
-
-    return 0;
+    return fmvj18x_config(link);
 } /* fmvj18x_attach */
 
 /*====================================================================*/
 
-static void fmvj18x_detach(struct pcmcia_device *p_dev)
+static void fmvj18x_detach(struct pcmcia_device *link)
 {
-    dev_link_t *link = dev_to_instance(p_dev);
     struct net_device *dev = link->priv;
 
     DEBUG(0, "fmvj18x_detach(0x%p)\n", link);
 
-    if (link->dev)
+    if (link->dev_node)
         unregister_netdev(dev);
 
-    if (link->state & DEV_CONFIG)
-        fmvj18x_release(link);
+    fmvj18x_release(link);
 
     free_netdev(dev);
 } /* fmvj18x_detach */
@@ -306,7 +296,7 @@ static void fmvj18x_detach(struct pcmcia_device *p_dev)
 #define CS_CHECK(fn, ret) \
 do { last_fn = (fn); if ((last_ret = (ret)) != 0) goto cs_failed; } while (0)
 
-static int mfc_try_io_port(dev_link_t *link)
+static int mfc_try_io_port(struct pcmcia_device *link)
 {
     int i, ret;
     static const kio_addr_t serial_base[5] = { 0x3f8, 0x2f8, 0x3e8, 0x2e8, 0x0 };
@@ -318,13 +308,13 @@ static int mfc_try_io_port(dev_link_t *link)
             link->io.NumPorts2 = 0;
             printk(KERN_NOTICE "fmvj18x_cs: out of resource for serial\n");
         }
-        ret = pcmcia_request_io(link->handle, &link->io);
+        ret = pcmcia_request_io(link, &link->io);
         if (ret == CS_SUCCESS) return ret;
     }
     return ret;
 }
 
-static int ungermann_try_io_port(dev_link_t *link)
+static int ungermann_try_io_port(struct pcmcia_device *link)
 {
     int ret;
     kio_addr_t ioaddr;
@@ -334,7 +324,7 @@ static int ungermann_try_io_port(dev_link_t *link)
     */
     for (ioaddr = 0x300; ioaddr < 0x3e0; ioaddr += 0x20) {
         link->io.BasePort1 = ioaddr;
-        ret = pcmcia_request_io(link->handle, &link->io);
+        ret = pcmcia_request_io(link, &link->io);
         if (ret == CS_SUCCESS) {
             /* calculate ConfigIndex value */
             link->conf.ConfigIndex = 
@@ -345,9 +335,8 @@ static int ungermann_try_io_port(dev_link_t *link)
     return ret; /* RequestIO failed */
 }
 
-static void fmvj18x_config(dev_link_t *link)
+static int fmvj18x_config(struct pcmcia_device *link)
 {
-    client_handle_t handle = link->handle;
     struct net_device *dev = link->priv;
     local_info_t *lp = netdev_priv(dev);
     tuple_t tuple;
@@ -366,42 +355,34 @@ static void fmvj18x_config(dev_link_t *link)
        registers.
     */
     tuple.DesiredTuple = CISTPL_CONFIG;
-    CS_CHECK(GetFirstTuple, pcmcia_get_first_tuple(handle, &tuple));
+    CS_CHECK(GetFirstTuple, pcmcia_get_first_tuple(link, &tuple));
     tuple.TupleData = (u_char *)buf;
     tuple.TupleDataMax = 64;
     tuple.TupleOffset = 0;
-    CS_CHECK(GetTupleData, pcmcia_get_tuple_data(handle, &tuple));
-    CS_CHECK(ParseTuple, pcmcia_parse_tuple(handle, &tuple, &parse));
-    
-    /* Configure card */
-    link->state |= DEV_CONFIG;
+    CS_CHECK(GetTupleData, pcmcia_get_tuple_data(link, &tuple));
+    CS_CHECK(ParseTuple, pcmcia_parse_tuple(link, &tuple, &parse));
 
     link->conf.ConfigBase = parse.config.base; 
     link->conf.Present = parse.config.rmask[0];
 
     tuple.DesiredTuple = CISTPL_FUNCE;
     tuple.TupleOffset = 0;
-    if (pcmcia_get_first_tuple(handle, &tuple) == CS_SUCCESS) {
+    if (pcmcia_get_first_tuple(link, &tuple) == CS_SUCCESS) {
         /* Yes, I have CISTPL_FUNCE. Let's check CISTPL_MANFID */
         tuple.DesiredTuple = CISTPL_CFTABLE_ENTRY;
-        CS_CHECK(GetFirstTuple, pcmcia_get_first_tuple(handle, &tuple));
-        CS_CHECK(GetTupleData, pcmcia_get_tuple_data(handle, &tuple));
-        CS_CHECK(ParseTuple, pcmcia_parse_tuple(handle, &tuple, &parse));
+        CS_CHECK(GetFirstTuple, pcmcia_get_first_tuple(link, &tuple));
+        CS_CHECK(GetTupleData, pcmcia_get_tuple_data(link, &tuple));
+        CS_CHECK(ParseTuple, pcmcia_parse_tuple(link, &tuple, &parse));
         link->conf.ConfigIndex = parse.cftable_entry.index;
         tuple.DesiredTuple = CISTPL_MANFID;
-        if (pcmcia_get_first_tuple(handle, &tuple) == CS_SUCCESS)
-            CS_CHECK(GetTupleData, pcmcia_get_tuple_data(handle, &tuple));
+        if (pcmcia_get_first_tuple(link, &tuple) == CS_SUCCESS)
+            CS_CHECK(GetTupleData, pcmcia_get_tuple_data(link, &tuple));
         else
             buf[0] = 0xffff;
         switch (le16_to_cpu(buf[0])) {
         case MANFID_TDK:
             cardtype = TDK;
-            if (le16_to_cpu(buf[1]) == PRODID_TDK_CF010) {
-                cs_status_t status;
-                pcmcia_get_status(handle, &status);
-                if (status.CardState & CS_EVENT_3VCARD)
-                    link->conf.Vcc = 33; /* inserted in 3.3V slot */
-            } else if (le16_to_cpu(buf[1]) == PRODID_TDK_GN3410
+            if (le16_to_cpu(buf[1]) == PRODID_TDK_GN3410
                         || le16_to_cpu(buf[1]) == PRODID_TDK_NP9610
                         || le16_to_cpu(buf[1]) == PRODID_TDK_MN3200) {
                 /* MultiFunction Card */
@@ -429,8 +410,8 @@ static void fmvj18x_config(dev_link_t *link)
     } else {
         /* old type card */
         tuple.DesiredTuple = CISTPL_MANFID;
-        if (pcmcia_get_first_tuple(handle, &tuple) == CS_SUCCESS)
-            CS_CHECK(GetTupleData, pcmcia_get_tuple_data(handle, &tuple));
+        if (pcmcia_get_first_tuple(link, &tuple) == CS_SUCCESS)
+            CS_CHECK(GetTupleData, pcmcia_get_tuple_data(link, &tuple));
         else
             buf[0] = 0xffff;
         switch (le16_to_cpu(buf[0])) {
@@ -461,10 +442,10 @@ static void fmvj18x_config(dev_link_t *link)
         ret = ungermann_try_io_port(link);
         if (ret != CS_SUCCESS) goto cs_failed;
     } else { 
-        CS_CHECK(RequestIO, pcmcia_request_io(link->handle, &link->io));
+        CS_CHECK(RequestIO, pcmcia_request_io(link, &link->io));
     }
-    CS_CHECK(RequestIRQ, pcmcia_request_irq(link->handle, &link->irq));
-    CS_CHECK(RequestConfiguration, pcmcia_request_configuration(link->handle, &link->conf));
+    CS_CHECK(RequestIRQ, pcmcia_request_irq(link, &link->irq));
+    CS_CHECK(RequestConfiguration, pcmcia_request_configuration(link, &link->conf));
     dev->irq = link->irq.AssignedIRQ;
     dev->base_addr = link->io.BasePort1;
 
@@ -493,17 +474,17 @@ static void fmvj18x_config(dev_link_t *link)
     case CONTEC:
         tuple.DesiredTuple = CISTPL_FUNCE;
         tuple.TupleOffset = 0;
-        CS_CHECK(GetFirstTuple, pcmcia_get_first_tuple(handle, &tuple));
+        CS_CHECK(GetFirstTuple, pcmcia_get_first_tuple(link, &tuple));
         tuple.TupleOffset = 0;
-        CS_CHECK(GetTupleData, pcmcia_get_tuple_data(handle, &tuple));
+        CS_CHECK(GetTupleData, pcmcia_get_tuple_data(link, &tuple));
         if (cardtype == MBH10304) {
             /* MBH10304's CIS_FUNCE is corrupted */
             node_id = &(tuple.TupleData[5]);
             card_name = "FMV-J182";
         } else {
             while (tuple.TupleData[0] != CISTPL_FUNCE_LAN_NODE_ID ) {
-                CS_CHECK(GetNextTuple, pcmcia_get_next_tuple(handle, &tuple));
-                CS_CHECK(GetTupleData, pcmcia_get_tuple_data(handle, &tuple));
+                CS_CHECK(GetNextTuple, pcmcia_get_next_tuple(link, &tuple));
+                CS_CHECK(GetTupleData, pcmcia_get_tuple_data(link, &tuple));
             }
             node_id = &(tuple.TupleData[2]);
             if( cardtype == TDK ) {
@@ -545,13 +526,12 @@ static void fmvj18x_config(dev_link_t *link)
     }
 
     lp->cardtype = cardtype;
-    link->dev = &lp->node;
-    link->state &= ~DEV_CONFIG_PENDING;
-    SET_NETDEV_DEV(dev, &handle_to_dev(handle));
+    link->dev_node = &lp->node;
+    SET_NETDEV_DEV(dev, &handle_to_dev(link));
 
     if (register_netdev(dev) != 0) {
         printk(KERN_NOTICE "fmvj18x_cs: register_netdev() failed\n");
-        link->dev = NULL;
+        link->dev_node = NULL;
         goto failed;
     }
 
@@ -564,19 +544,18 @@ static void fmvj18x_config(dev_link_t *link)
     for (i = 0; i < 6; i++)
         printk("%02X%s", dev->dev_addr[i], ((i<5) ? ":" : "\n"));
 
-    return;
+    return 0;
     
 cs_failed:
     /* All Card Services errors end up here */
-    cs_error(link->handle, last_fn, last_ret);
+    cs_error(link, last_fn, last_ret);
 failed:
     fmvj18x_release(link);
-    link->state &= ~DEV_CONFIG_PENDING;
-
+    return -ENODEV;
 } /* fmvj18x_config */
 /*====================================================================*/
 
-static int fmvj18x_get_hwinfo(dev_link_t *link, u_char *node_id)
+static int fmvj18x_get_hwinfo(struct pcmcia_device *link, u_char *node_id)
 {
     win_req_t req;
     memreq_t mem;
@@ -587,9 +566,9 @@ static int fmvj18x_get_hwinfo(dev_link_t *link, u_char *node_id)
     req.Attributes = WIN_DATA_WIDTH_8|WIN_MEMORY_TYPE_AM|WIN_ENABLE;
     req.Base = 0; req.Size = 0;
     req.AccessSpeed = 0;
-    i = pcmcia_request_window(&link->handle, &req, &link->win);
+    i = pcmcia_request_window(&link, &req, &link->win);
     if (i != CS_SUCCESS) {
-        cs_error(link->handle, RequestWindow, i);
+        cs_error(link, RequestWindow, i);
         return -1;
     }
 
@@ -623,13 +602,13 @@ static int fmvj18x_get_hwinfo(dev_link_t *link, u_char *node_id)
     iounmap(base);
     j = pcmcia_release_window(link->win);
     if (j != CS_SUCCESS)
-        cs_error(link->handle, ReleaseWindow, j);
+        cs_error(link, ReleaseWindow, j);
     return (i != 0x200) ? 0 : -1;
 
 } /* fmvj18x_get_hwinfo */
 /*====================================================================*/
 
-static int fmvj18x_setup_mfc(dev_link_t *link)
+static int fmvj18x_setup_mfc(struct pcmcia_device *link)
 {
     win_req_t req;
     memreq_t mem;
@@ -642,9 +621,9 @@ static int fmvj18x_setup_mfc(dev_link_t *link)
     req.Attributes = WIN_DATA_WIDTH_8|WIN_MEMORY_TYPE_AM|WIN_ENABLE;
     req.Base = 0; req.Size = 0;
     req.AccessSpeed = 0;
-    i = pcmcia_request_window(&link->handle, &req, &link->win);
+    i = pcmcia_request_window(&link, &req, &link->win);
     if (i != CS_SUCCESS) {
-        cs_error(link->handle, RequestWindow, i);
+        cs_error(link, RequestWindow, i);
         return -1;
     }
 
@@ -666,54 +645,35 @@ static int fmvj18x_setup_mfc(dev_link_t *link)
     iounmap(base);
     j = pcmcia_release_window(link->win);
     if (j != CS_SUCCESS)
-        cs_error(link->handle, ReleaseWindow, j);
+        cs_error(link, ReleaseWindow, j);
     return 0;
 
 }
 /*====================================================================*/
 
-static void fmvj18x_release(dev_link_t *link)
+static void fmvj18x_release(struct pcmcia_device *link)
 {
-
-    DEBUG(0, "fmvj18x_release(0x%p)\n", link);
-
-    /* Don't bother checking to see if these succeed or not */
-    pcmcia_release_window(link->win);
-    pcmcia_release_configuration(link->handle);
-    pcmcia_release_io(link->handle, &link->io);
-    pcmcia_release_irq(link->handle, &link->irq);
-    
-    link->state &= ~DEV_CONFIG;
+        DEBUG(0, "fmvj18x_release(0x%p)\n", link);
+        pcmcia_disable_device(link);
 }
 
-static int fmvj18x_suspend(struct pcmcia_device *p_dev)
+static int fmvj18x_suspend(struct pcmcia_device *link)
 {
-        dev_link_t *link = dev_to_instance(p_dev);
         struct net_device *dev = link->priv;
 
-        link->state |= DEV_SUSPEND;
-        if (link->state & DEV_CONFIG) {
-                if (link->open)
-                        netif_device_detach(dev);
-                pcmcia_release_configuration(link->handle);
-        }
-
+        if (link->open)
+                netif_device_detach(dev);
 
         return 0;
 }
 
-static int fmvj18x_resume(struct pcmcia_device *p_dev)
+static int fmvj18x_resume(struct pcmcia_device *link)
 {
-        dev_link_t *link = dev_to_instance(p_dev);
         struct net_device *dev = link->priv;
 
-        link->state &= ~DEV_SUSPEND;
-        if (link->state & DEV_CONFIG) {
-                pcmcia_request_configuration(link->handle, &link->conf);
-                if (link->open) {
-                        fjn_reset(dev);
-                        netif_device_attach(dev);
-                }
+        if (link->open) {
+                fjn_reset(dev);
+                netif_device_attach(dev);
         }
 
         return 0;
@@ -751,7 +711,7 @@ static struct pcmcia_driver fmvj18x_cs_driver = {
         .drv            = {
                 .name   = "fmvj18x_cs",
         },
-        .probe          = fmvj18x_attach,
+        .probe          = fmvj18x_probe,
         .remove         = fmvj18x_detach,
         .id_table       = fmvj18x_ids,
         .suspend        = fmvj18x_suspend,
@@ -1148,11 +1108,11 @@ static int fjn_config(struct net_device *dev, struct ifmap *map){
 static int fjn_open(struct net_device *dev)
 {
     struct local_info_t *lp = netdev_priv(dev);
-    dev_link_t *link = &lp->link;
+    struct pcmcia_device *link = lp->p_dev;
 
     DEBUG(4, "fjn_open('%s').\n", dev->name);
 
-    if (!DEV_OK(link))
+    if (!pcmcia_dev_present(link))
         return -ENODEV;
     
     link->open++;
@@ -1173,7 +1133,7 @@ static int fjn_open(struct net_device *dev)
 static int fjn_close(struct net_device *dev)
 {
     struct local_info_t *lp = netdev_priv(dev);
-    dev_link_t *link = &lp->link;
+    struct pcmcia_device *link = lp->p_dev;
     kio_addr_t ioaddr = dev->base_addr;
 
     DEBUG(4, "fjn_close('%s').\n", dev->name);
diff --git a/drivers/net/pcmcia/ibmtr_cs.c b/drivers/net/pcmcia/ibmtr_cs.c
index b9c7e39576f5..b8fe70b85641 100644
--- a/drivers/net/pcmcia/ibmtr_cs.c
+++ b/drivers/net/pcmcia/ibmtr_cs.c
@@ -105,15 +105,15 @@ MODULE_LICENSE("GPL");
 
 /*====================================================================*/
 
-static void ibmtr_config(dev_link_t *link);
+static int ibmtr_config(struct pcmcia_device *link);
 static void ibmtr_hw_setup(struct net_device *dev, u_int mmiobase);
-static void ibmtr_release(dev_link_t *link);
+static void ibmtr_release(struct pcmcia_device *link);
 static void ibmtr_detach(struct pcmcia_device *p_dev);
 
 /*====================================================================*/
 
 typedef struct ibmtr_dev_t {
-    dev_link_t          link;
+        struct pcmcia_device    *p_dev;
     struct net_device   *dev;
     dev_node_t          node;
     window_handle_t     sram_win_handle;
@@ -138,12 +138,11 @@ static struct ethtool_ops netdev_ethtool_ops = {
 
 ======================================================================*/
 
-static int ibmtr_attach(struct pcmcia_device *p_dev)
+static int ibmtr_attach(struct pcmcia_device *link)
 {
     ibmtr_dev_t *info;
-    dev_link_t *link;
     struct net_device *dev;
-    
+
     DEBUG(0, "ibmtr_attach()\n");
 
     /* Create new token-ring device */
@@ -156,7 +155,7 @@ static int ibmtr_attach(struct pcmcia_device *p_dev)
         return -ENOMEM;
     }
 
-    link = &info->link;
+    info->p_dev = link;
     link->priv = info;
     info->ti = netdev_priv(dev);
 
@@ -167,21 +166,14 @@ static int ibmtr_attach(struct pcmcia_device *p_dev)
     link->irq.IRQInfo1 = IRQ_LEVEL_ID;
     link->irq.Handler = &tok_interrupt;
     link->conf.Attributes = CONF_ENABLE_IRQ;
-    link->conf.Vcc = 50;
     link->conf.IntType = INT_MEMORY_AND_IO;
     link->conf.Present = PRESENT_OPTION;
 
     link->irq.Instance = info->dev = dev;
-    
-    SET_ETHTOOL_OPS(dev, &netdev_ethtool_ops);
-
-    link->handle = p_dev;
-    p_dev->instance = link;
 
-    link->state |= DEV_PRESENT;
-    ibmtr_config(link);
+    SET_ETHTOOL_OPS(dev, &netdev_ethtool_ops);
 
-    return 0;
+    return ibmtr_config(link);
 } /* ibmtr_attach */
 
 /*======================================================================
@@ -193,23 +185,22 @@ static int ibmtr_attach(struct pcmcia_device *p_dev)
 
 ======================================================================*/
 
-static void ibmtr_detach(struct pcmcia_device *p_dev)
+static void ibmtr_detach(struct pcmcia_device *link)
 {
-    dev_link_t *link = dev_to_instance(p_dev);
     struct ibmtr_dev_t *info = link->priv;
     struct net_device *dev = info->dev;
 
     DEBUG(0, "ibmtr_detach(0x%p)\n", link);
 
-    if (link->dev)
+    if (link->dev_node)
         unregister_netdev(dev);
 
     {
         struct tok_info *ti = netdev_priv(dev);
         del_timer_sync(&(ti->tr_timer));
     }
-    if (link->state & DEV_CONFIG)
-        ibmtr_release(link);
+
+    ibmtr_release(link);
 
     free_netdev(dev);
     kfree(info);
@@ -226,9 +217,8 @@ static void ibmtr_detach(struct pcmcia_device *p_dev)
 #define CS_CHECK(fn, ret) \
 do { last_fn = (fn); if ((last_ret = (ret)) != 0) goto cs_failed; } while (0)
 
-static void ibmtr_config(dev_link_t *link)
+static int ibmtr_config(struct pcmcia_device *link)
 {
-    client_handle_t handle = link->handle;
     ibmtr_dev_t *info = link->priv;
     struct net_device *dev = info->dev;
     struct tok_info *ti = netdev_priv(dev);
@@ -246,29 +236,25 @@ static void ibmtr_config(dev_link_t *link)
     tuple.TupleDataMax = 64;
     tuple.TupleOffset = 0;
     tuple.DesiredTuple = CISTPL_CONFIG;
-    CS_CHECK(GetFirstTuple, pcmcia_get_first_tuple(handle, &tuple));
-    CS_CHECK(GetTupleData, pcmcia_get_tuple_data(handle, &tuple));
-    CS_CHECK(ParseTuple, pcmcia_parse_tuple(handle, &tuple, &parse));
+    CS_CHECK(GetFirstTuple, pcmcia_get_first_tuple(link, &tuple));
+    CS_CHECK(GetTupleData, pcmcia_get_tuple_data(link, &tuple));
+    CS_CHECK(ParseTuple, pcmcia_parse_tuple(link, &tuple, &parse));
     link->conf.ConfigBase = parse.config.base;
-
-    /* Configure card */
-    link->state |= DEV_CONFIG;
-
     link->conf.ConfigIndex = 0x61;
 
     /* Determine if this is PRIMARY or ALTERNATE. */
 
     /* Try PRIMARY card at 0xA20-0xA23 */
     link->io.BasePort1 = 0xA20;
-    i = pcmcia_request_io(link->handle, &link->io);
+    i = pcmcia_request_io(link, &link->io);
     if (i != CS_SUCCESS) {
         /* Couldn't get 0xA20-0xA23.  Try ALTERNATE at 0xA24-0xA27. */
         link->io.BasePort1 = 0xA24;
-        CS_CHECK(RequestIO, pcmcia_request_io(link->handle, &link->io));
+        CS_CHECK(RequestIO, pcmcia_request_io(link, &link->io));
     }
     dev->base_addr = link->io.BasePort1;
 
-    CS_CHECK(RequestIRQ, pcmcia_request_irq(link->handle, &link->irq));
+    CS_CHECK(RequestIRQ, pcmcia_request_irq(link, &link->irq));
     dev->irq = link->irq.AssignedIRQ;
     ti->irq = link->irq.AssignedIRQ;
     ti->global_int_enable=GLOBAL_INT_ENABLE+((dev->irq==9) ? 2 : dev->irq);
@@ -279,7 +265,7 @@ static void ibmtr_config(dev_link_t *link)
     req.Base = 0; 
     req.Size = 0x2000;
     req.AccessSpeed = 250;
-    CS_CHECK(RequestWindow, pcmcia_request_window(&link->handle, &req, &link->win));
+    CS_CHECK(RequestWindow, pcmcia_request_window(&link, &req, &link->win));
 
     mem.CardOffset = mmiobase;
     mem.Page = 0;
@@ -292,7 +278,7 @@ static void ibmtr_config(dev_link_t *link)
     req.Base = 0;
     req.Size = sramsize * 1024;
     req.AccessSpeed = 250;
-    CS_CHECK(RequestWindow, pcmcia_request_window(&link->handle, &req, &info->sram_win_handle));
+    CS_CHECK(RequestWindow, pcmcia_request_window(&link, &req, &info->sram_win_handle));
 
     mem.CardOffset = srambase;
     mem.Page = 0;
@@ -302,21 +288,20 @@ static void ibmtr_config(dev_link_t *link)
     ti->sram_virt = ioremap(req.Base, req.Size);
     ti->sram_phys = req.Base;
 
-    CS_CHECK(RequestConfiguration, pcmcia_request_configuration(link->handle, &link->conf));
+    CS_CHECK(RequestConfiguration, pcmcia_request_configuration(link, &link->conf));
 
     /*  Set up the Token-Ring Controller Configuration Register and
         turn on the card.  Check the "Local Area Network Credit Card
         Adapters Technical Reference"  SC30-3585 for this info.  */
     ibmtr_hw_setup(dev, mmiobase);
 
-    link->dev = &info->node;
-    link->state &= ~DEV_CONFIG_PENDING;
-    SET_NETDEV_DEV(dev, &handle_to_dev(handle));
+    link->dev_node = &info->node;
+    SET_NETDEV_DEV(dev, &handle_to_dev(link));
 
     i = ibmtr_probe_card(dev);
     if (i != 0) {
         printk(KERN_NOTICE "ibmtr_cs: register_netdev() failed\n");
-        link->dev = NULL;
+        link->dev_node = NULL;
         goto failed;
     }
 
@@ -330,12 +315,13 @@ static void ibmtr_config(dev_link_t *link)
     for (i = 0; i < TR_ALEN; i++)
         printk("%02X", dev->dev_addr[i]);
     printk("\n");
-    return;
+    return 0;
 
 cs_failed:
-    cs_error(link->handle, last_fn, last_ret);
+    cs_error(link, last_fn, last_ret);
 failed:
     ibmtr_release(link);
+    return -ENODEV;
 } /* ibmtr_config */
 
 /*======================================================================
@@ -346,56 +332,41 @@ failed:
 
 ======================================================================*/
 
-static void ibmtr_release(dev_link_t *link)
+static void ibmtr_release(struct pcmcia_device *link)
 {
-    ibmtr_dev_t *info = link->priv;
-    struct net_device *dev = info->dev;
-
-    DEBUG(0, "ibmtr_release(0x%p)\n", link);
+        ibmtr_dev_t *info = link->priv;
+        struct net_device *dev = info->dev;
 
-    pcmcia_release_configuration(link->handle);
-    pcmcia_release_io(link->handle, &link->io);
-    pcmcia_release_irq(link->handle, &link->irq);
-    if (link->win) {
-        struct tok_info *ti = netdev_priv(dev);
-        iounmap(ti->mmio);
-        pcmcia_release_window(link->win);
-        pcmcia_release_window(info->sram_win_handle);
-    }
+        DEBUG(0, "ibmtr_release(0x%p)\n", link);
 
-    link->state &= ~DEV_CONFIG;
+        if (link->win) {
+                struct tok_info *ti = netdev_priv(dev);
+                iounmap(ti->mmio);
+                pcmcia_release_window(info->sram_win_handle);
+        }
+        pcmcia_disable_device(link);
 }
 
-static int ibmtr_suspend(struct pcmcia_device *p_dev)
+static int ibmtr_suspend(struct pcmcia_device *link)
 {
-        dev_link_t *link = dev_to_instance(p_dev);
         ibmtr_dev_t *info = link->priv;
         struct net_device *dev = info->dev;
 
-        link->state |= DEV_SUSPEND;
-        if (link->state & DEV_CONFIG) {
-                if (link->open)
-                        netif_device_detach(dev);
-                pcmcia_release_configuration(link->handle);
-        }
+        if (link->open)
+                netif_device_detach(dev);
 
         return 0;
 }
 
-static int ibmtr_resume(struct pcmcia_device *p_dev)
+static int ibmtr_resume(struct pcmcia_device *link)
 {
-        dev_link_t *link = dev_to_instance(p_dev);
         ibmtr_dev_t *info = link->priv;
         struct net_device *dev = info->dev;
 
-        link->state &= ~DEV_SUSPEND;
-        if (link->state & DEV_CONFIG) {
-                pcmcia_request_configuration(link->handle, &link->conf);
-                if (link->open) {
-                        ibmtr_probe(dev);       /* really? */
-                        netif_device_attach(dev);
-                }
-        }
+        if (link->open) {
+                ibmtr_probe(dev);       /* really? */
+                netif_device_attach(dev);
+        }
 
         return 0;
 }
diff --git a/drivers/net/pcmcia/nmclan_cs.c b/drivers/net/pcmcia/nmclan_cs.c
index 787176c57fd9..4260c2128f47 100644
--- a/drivers/net/pcmcia/nmclan_cs.c
+++ b/drivers/net/pcmcia/nmclan_cs.c
@@ -362,7 +362,7 @@ typedef struct _mace_statistics {
 } mace_statistics;
 
 typedef struct _mace_private {
-    dev_link_t link;
+        struct pcmcia_device    *p_dev;
     dev_node_t node;
     struct net_device_stats linux_stats; /* Linux statistics counters */
     mace_statistics mace_stats; /* MACE chip statistics counters */
@@ -417,8 +417,8 @@ INT_MODULE_PARM(pc_debug, PCMCIA_DEBUG);
 Function Prototypes
 ---------------------------------------------------------------------------- */
 
-static void nmclan_config(dev_link_t *link);
-static void nmclan_release(dev_link_t *link);
+static int nmclan_config(struct pcmcia_device *link);
+static void nmclan_release(struct pcmcia_device *link);
 
 static void nmclan_reset(struct net_device *dev);
 static int mace_config(struct net_device *dev, struct ifmap *map);
@@ -443,10 +443,9 @@ nmclan_attach
         Services.
 ---------------------------------------------------------------------------- */
 
-static int nmclan_attach(struct pcmcia_device *p_dev)
+static int nmclan_probe(struct pcmcia_device *link)
 {
     mace_private *lp;
-    dev_link_t *link;
     struct net_device *dev;
 
     DEBUG(0, "nmclan_attach()\n");
@@ -457,7 +456,7 @@ static int nmclan_attach(struct pcmcia_device *p_dev)
     if (!dev)
             return -ENOMEM;
     lp = netdev_priv(dev);
-    link = &lp->link;
+    lp->p_dev = link;
     link->priv = dev;
     
     spin_lock_init(&lp->bank_lock);
@@ -469,7 +468,6 @@ static int nmclan_attach(struct pcmcia_device *p_dev)
     link->irq.Handler = &mace_interrupt;
     link->irq.Instance = dev;
     link->conf.Attributes = CONF_ENABLE_IRQ;
-    link->conf.Vcc = 50;
     link->conf.IntType = INT_MEMORY_AND_IO;
     link->conf.ConfigIndex = 1;
     link->conf.Present = PRESENT_OPTION;
@@ -489,13 +487,7 @@ static int nmclan_attach(struct pcmcia_device *p_dev)
     dev->watchdog_timeo = TX_TIMEOUT;
 #endif
 
-    link->handle = p_dev;
-    p_dev->instance = link;
-
-    link->state |= DEV_PRESENT | DEV_CONFIG_PENDING;
-    nmclan_config(link);
-
-    return 0;
+    return nmclan_config(link);
 } /* nmclan_attach */
 
 /* ----------------------------------------------------------------------------
@@ -506,18 +498,16 @@ nmclan_detach
         when the device is released.
 ---------------------------------------------------------------------------- */
 
-static void nmclan_detach(struct pcmcia_device *p_dev)
+static void nmclan_detach(struct pcmcia_device *link)
 {
-    dev_link_t *link = dev_to_instance(p_dev);
     struct net_device *dev = link->priv;
 
     DEBUG(0, "nmclan_detach(0x%p)\n", link);
 
-    if (link->dev)
+    if (link->dev_node)
         unregister_netdev(dev);
 
-    if (link->state & DEV_CONFIG)
-        nmclan_release(link);
+    nmclan_release(link);
 
     free_netdev(dev);
 } /* nmclan_detach */
@@ -661,9 +651,8 @@ nmclan_config
 #define CS_CHECK(fn, ret) \
   do { last_fn = (fn); if ((last_ret = (ret)) != 0) goto cs_failed; } while (0)
 
-static void nmclan_config(dev_link_t *link)
+static int nmclan_config(struct pcmcia_device *link)
 {
-  client_handle_t handle = link->handle;
   struct net_device *dev = link->priv;
   mace_private *lp = netdev_priv(dev);
   tuple_t tuple;
@@ -679,17 +668,14 @@ static void nmclan_config(dev_link_t *link)
   tuple.TupleDataMax = 64;
   tuple.TupleOffset = 0;
   tuple.DesiredTuple = CISTPL_CONFIG;
-  CS_CHECK(GetFirstTuple, pcmcia_get_first_tuple(handle, &tuple));
-  CS_CHECK(GetTupleData, pcmcia_get_tuple_data(handle, &tuple));
-  CS_CHECK(ParseTuple, pcmcia_parse_tuple(handle, &tuple, &parse));
+  CS_CHECK(GetFirstTuple, pcmcia_get_first_tuple(link, &tuple));
+  CS_CHECK(GetTupleData, pcmcia_get_tuple_data(link, &tuple));
+  CS_CHECK(ParseTuple, pcmcia_parse_tuple(link, &tuple, &parse));
   link->conf.ConfigBase = parse.config.base;
 
-  /* Configure card */
-  link->state |= DEV_CONFIG;
-
-  CS_CHECK(RequestIO, pcmcia_request_io(handle, &link->io));
-  CS_CHECK(RequestIRQ, pcmcia_request_irq(handle, &link->irq));
-  CS_CHECK(RequestConfiguration, pcmcia_request_configuration(handle, &link->conf));
+  CS_CHECK(RequestIO, pcmcia_request_io(link, &link->io));
+  CS_CHECK(RequestIRQ, pcmcia_request_irq(link, &link->irq));
+  CS_CHECK(RequestConfiguration, pcmcia_request_configuration(link, &link->conf));
   dev->irq = link->irq.AssignedIRQ;
   dev->base_addr = link->io.BasePort1;
 
@@ -700,8 +686,8 @@ static void nmclan_config(dev_link_t *link)
   tuple.TupleData = buf;
   tuple.TupleDataMax = 64;
   tuple.TupleOffset = 0;
-  CS_CHECK(GetFirstTuple, pcmcia_get_first_tuple(handle, &tuple));
-  CS_CHECK(GetTupleData, pcmcia_get_tuple_data(handle, &tuple));
+  CS_CHECK(GetFirstTuple, pcmcia_get_first_tuple(link, &tuple));
+  CS_CHECK(GetTupleData, pcmcia_get_tuple_data(link, &tuple));
   memcpy(dev->dev_addr, tuple.TupleData, ETHER_ADDR_LEN);
 
   /* Verify configuration by reading the MACE ID. */
@@ -716,8 +702,7 @@ static void nmclan_config(dev_link_t *link)
     } else {
       printk(KERN_NOTICE "nmclan_cs: mace id not found: %x %x should"
              " be 0x40 0x?9\n", sig[0], sig[1]);
-      link->state &= ~DEV_CONFIG_PENDING;
-      return;
+      return -ENODEV;
     }
   }
 
@@ -730,14 +715,13 @@ static void nmclan_config(dev_link_t *link)
   else
     printk(KERN_NOTICE "nmclan_cs: invalid if_port requested\n");
 
-  link->dev = &lp->node;
-  link->state &= ~DEV_CONFIG_PENDING;
-  SET_NETDEV_DEV(dev, &handle_to_dev(handle));
+  link->dev_node = &lp->node;
+  SET_NETDEV_DEV(dev, &handle_to_dev(link));
 
   i = register_netdev(dev);
   if (i != 0) {
     printk(KERN_NOTICE "nmclan_cs: register_netdev() failed\n");
-    link->dev = NULL;
+    link->dev_node = NULL;
     goto failed;
   }
 
@@ -747,14 +731,13 @@ static void nmclan_config(dev_link_t *link)
          dev->name, dev->base_addr, dev->irq, if_names[dev->if_port]);
   for (i = 0; i < 6; i++)
       printk("%02X%s", dev->dev_addr[i], ((i<5) ? ":" : "\n"));
-  return;
+  return 0;
 
 cs_failed:
-    cs_error(link->handle, last_fn, last_ret);
+        cs_error(link, last_fn, last_ret);
 failed:
-    nmclan_release(link);
-    return;
-
+        nmclan_release(link);
+        return -ENODEV;
 } /* nmclan_config */
 
 /* ----------------------------------------------------------------------------
@@ -763,46 +746,29 @@ nmclan_release
         net device, and release the PCMCIA configuration.  If the device
         is still open, this will be postponed until it is closed.
 ---------------------------------------------------------------------------- */
-static void nmclan_release(dev_link_t *link)
+static void nmclan_release(struct pcmcia_device *link)
 {
-
-  DEBUG(0, "nmclan_release(0x%p)\n", link);
-
-  pcmcia_release_configuration(link->handle);
-  pcmcia_release_io(link->handle, &link->io);
-  pcmcia_release_irq(link->handle, &link->irq);
-
-  link->state &= ~DEV_CONFIG;
+        DEBUG(0, "nmclan_release(0x%p)\n", link);
+        pcmcia_disable_device(link);
 }
 
-static int nmclan_suspend(struct pcmcia_device *p_dev)
+static int nmclan_suspend(struct pcmcia_device *link)
 {
-        dev_link_t *link = dev_to_instance(p_dev);
         struct net_device *dev = link->priv;
 
-        link->state |= DEV_SUSPEND;
-        if (link->state & DEV_CONFIG) {
-                if (link->open)
-                        netif_device_detach(dev);
-                pcmcia_release_configuration(link->handle);
-        }
-
+        if (link->open)
+                netif_device_detach(dev);
 
         return 0;
 }
 
-static int nmclan_resume(struct pcmcia_device *p_dev)
+static int nmclan_resume(struct pcmcia_device *link)
 {
-        dev_link_t *link = dev_to_instance(p_dev);
         struct net_device *dev = link->priv;
 
-        link->state &= ~DEV_SUSPEND;
-        if (link->state & DEV_CONFIG) {
-                pcmcia_request_configuration(link->handle, &link->conf);
-                if (link->open) {
-                        nmclan_reset(dev);
-                        netif_device_attach(dev);
-                }
+        if (link->open) {
+                nmclan_reset(dev);
+                netif_device_attach(dev);
         }
 
         return 0;
@@ -818,7 +784,7 @@ static void nmclan_reset(struct net_device *dev)
   mace_private *lp = netdev_priv(dev);
 
 #if RESET_XILINX
-  dev_link_t *link = &lp->link;
+  struct pcmcia_device *link = &lp->link;
   conf_reg_t reg;
   u_long OrigCorValue; 
 
@@ -827,7 +793,7 @@ static void nmclan_reset(struct net_device *dev)
   reg.Action = CS_READ;
   reg.Offset = CISREG_COR;
   reg.Value = 0;
-  pcmcia_access_configuration_register(link->handle, &reg);
+  pcmcia_access_configuration_register(link, &reg);
   OrigCorValue = reg.Value;
 
   /* Reset Xilinx */
@@ -836,12 +802,12 @@ static void nmclan_reset(struct net_device *dev)
   DEBUG(1, "nmclan_reset: OrigCorValue=0x%lX, resetting...\n",
         OrigCorValue);
   reg.Value = COR_SOFT_RESET;
-  pcmcia_access_configuration_register(link->handle, &reg);
+  pcmcia_access_configuration_register(link, &reg);
   /* Need to wait for 20 ms for PCMCIA to finish reset. */
 
   /* Restore original COR configuration index */
   reg.Value = COR_LEVEL_REQ | (OrigCorValue & COR_CONFIG_MASK);
-  pcmcia_access_configuration_register(link->handle, &reg);
+  pcmcia_access_configuration_register(link, &reg);
   /* Xilinx is now completely reset along with the MACE chip. */
   lp->tx_free_frames=AM2150_MAX_TX_FRAMES;
 
@@ -885,9 +851,9 @@ static int mace_open(struct net_device *dev)
 {
   kio_addr_t ioaddr = dev->base_addr;
   mace_private *lp = netdev_priv(dev);
-  dev_link_t *link = &lp->link;
+  struct pcmcia_device *link = lp->p_dev;
 
-  if (!DEV_OK(link))
+  if (!pcmcia_dev_present(link))
     return -ENODEV;
 
   link->open++;
@@ -908,7 +874,7 @@ static int mace_close(struct net_device *dev)
 {
   kio_addr_t ioaddr = dev->base_addr;
   mace_private *lp = netdev_priv(dev);
-  dev_link_t *link = &lp->link;
+  struct pcmcia_device *link = lp->p_dev;
 
   DEBUG(2, "%s: shutting down ethercard.\n", dev->name);
 
@@ -963,12 +929,12 @@ mace_start_xmit
 static void mace_tx_timeout(struct net_device *dev)
 {
   mace_private *lp = netdev_priv(dev);
-  dev_link_t *link = &lp->link;
+  struct pcmcia_device *link = lp->p_dev;
 
   printk(KERN_NOTICE "%s: transmit timed out -- ", dev->name);
 #if RESET_ON_TIMEOUT
   printk("resetting card\n");
-  pcmcia_reset_card(link->handle, NULL);
+  pcmcia_reset_card(link, NULL);
 #else /* #if RESET_ON_TIMEOUT */
   printk("NOT resetting card\n");
 #endif /* #if RESET_ON_TIMEOUT */
@@ -1635,7 +1601,7 @@ static struct pcmcia_driver nmclan_cs_driver = {
         .drv            = {
                 .name   = "nmclan_cs",
         },
-        .probe          = nmclan_attach,
+        .probe          = nmclan_probe,
         .remove         = nmclan_detach,
         .id_table       = nmclan_ids,
         .suspend        = nmclan_suspend,
diff --git a/drivers/net/pcmcia/pcnet_cs.c b/drivers/net/pcmcia/pcnet_cs.c
index b46e5f703efa..506e777c5f06 100644
--- a/drivers/net/pcmcia/pcnet_cs.c
+++ b/drivers/net/pcmcia/pcnet_cs.c
@@ -103,8 +103,8 @@ module_param_array(hw_addr, int, NULL, 0);
 /*====================================================================*/
 
 static void mii_phy_probe(struct net_device *dev);
-static void pcnet_config(dev_link_t *link);
-static void pcnet_release(dev_link_t *link);
+static int pcnet_config(struct pcmcia_device *link);
+static void pcnet_release(struct pcmcia_device *link);
 static int pcnet_open(struct net_device *dev);
 static int pcnet_close(struct net_device *dev);
 static int ei_ioctl(struct net_device *dev, struct ifreq *rq, int cmd);
@@ -113,9 +113,9 @@ static irqreturn_t ei_irq_wrapper(int irq, void *dev_id, struct pt_regs *regs);
 static void ei_watchdog(u_long arg);
 static void pcnet_reset_8390(struct net_device *dev);
 static int set_config(struct net_device *dev, struct ifmap *map);
-static int setup_shmem_window(dev_link_t *link, int start_pg,
+static int setup_shmem_window(struct pcmcia_device *link, int start_pg,
                               int stop_pg, int cm_offset);
-static int setup_dma_config(dev_link_t *link, int start_pg,
+static int setup_dma_config(struct pcmcia_device *link, int start_pg,
                             int stop_pg);
 
 static void pcnet_detach(struct pcmcia_device *p_dev);
@@ -214,7 +214,7 @@ static hw_info_t dl10019_info = { 0, 0, 0, 0, IS_DL10019|HAS_MII };
 static hw_info_t dl10022_info = { 0, 0, 0, 0, IS_DL10022|HAS_MII };
 
 typedef struct pcnet_dev_t {
-    dev_link_t          link;
+        struct pcmcia_device    *p_dev;
     dev_node_t          node;
     u_int               flags;
     void                __iomem *base;
@@ -240,10 +240,9 @@ static inline pcnet_dev_t *PRIV(struct net_device *dev)
 
 ======================================================================*/
 
-static int pcnet_probe(struct pcmcia_device *p_dev)
+static int pcnet_probe(struct pcmcia_device *link)
 {
     pcnet_dev_t *info;
-    dev_link_t *link;
     struct net_device *dev;
 
     DEBUG(0, "pcnet_attach()\n");
@@ -252,7 +251,7 @@ static int pcnet_probe(struct pcmcia_device *p_dev)
     dev = __alloc_ei_netdev(sizeof(pcnet_dev_t));
     if (!dev) return -ENOMEM;
     info = PRIV(dev);
-    link = &info->link;
+    info->p_dev = link;
     link->priv = dev;
 
     link->irq.Attributes = IRQ_TYPE_EXCLUSIVE;
@@ -265,13 +264,7 @@ static int pcnet_probe(struct pcmcia_device *p_dev)
     dev->stop = &pcnet_close;
     dev->set_config = &set_config;
 
-    link->handle = p_dev;
-    p_dev->instance = link;
-
-    link->state |= DEV_PRESENT | DEV_CONFIG_PENDING;
-    pcnet_config(link);
-
-    return 0;
+    return pcnet_config(link);
 } /* pcnet_attach */
 
 /*======================================================================
@@ -283,18 +276,16 @@ static int pcnet_probe(struct pcmcia_device *p_dev)
 
 ======================================================================*/
 
-static void pcnet_detach(struct pcmcia_device *p_dev)
+static void pcnet_detach(struct pcmcia_device *link)
 {
-        dev_link_t *link = dev_to_instance(p_dev);
         struct net_device *dev = link->priv;
 
         DEBUG(0, "pcnet_detach(0x%p)\n", link);
 
-        if (link->dev)
+        if (link->dev_node)
                 unregister_netdev(dev);
 
-        if (link->state & DEV_CONFIG)
-                pcnet_release(link);
+        pcnet_release(link);
 
         free_netdev(dev);
 } /* pcnet_detach */
@@ -306,7 +297,7 @@ static void pcnet_detach(struct pcmcia_device *p_dev)
 
 ======================================================================*/
 
-static hw_info_t *get_hwinfo(dev_link_t *link)
+static hw_info_t *get_hwinfo(struct pcmcia_device *link)
 {
     struct net_device *dev = link->priv;
     win_req_t req;
@@ -318,9 +309,9 @@ static hw_info_t *get_hwinfo(dev_link_t *link)
     req.Attributes = WIN_DATA_WIDTH_8|WIN_MEMORY_TYPE_AM|WIN_ENABLE;
     req.Base = 0; req.Size = 0;
     req.AccessSpeed = 0;
-    i = pcmcia_request_window(&link->handle, &req, &link->win);
+    i = pcmcia_request_window(&link, &req, &link->win);
     if (i != CS_SUCCESS) {
-        cs_error(link->handle, RequestWindow, i);
+        cs_error(link, RequestWindow, i);
         return NULL;
     }
 
@@ -343,7 +334,7 @@ static hw_info_t *get_hwinfo(dev_link_t *link)
     iounmap(virt);
     j = pcmcia_release_window(link->win);
     if (j != CS_SUCCESS)
-        cs_error(link->handle, ReleaseWindow, j);
+        cs_error(link, ReleaseWindow, j);
     return (i < NR_INFO) ? hw_info+i : NULL;
 } /* get_hwinfo */
 
@@ -355,7 +346,7 @@ static hw_info_t *get_hwinfo(dev_link_t *link)
 
 ======================================================================*/
 
-static hw_info_t *get_prom(dev_link_t *link)
+static hw_info_t *get_prom(struct pcmcia_device *link)
 {
     struct net_device *dev = link->priv;
     kio_addr_t ioaddr = dev->base_addr;
@@ -409,7 +400,7 @@ static hw_info_t *get_prom(dev_link_t *link)
 
 ======================================================================*/
 
-static hw_info_t *get_dl10019(dev_link_t *link)
+static hw_info_t *get_dl10019(struct pcmcia_device *link)
 {
     struct net_device *dev = link->priv;
     int i;
@@ -431,7 +422,7 @@ static hw_info_t *get_dl10019(dev_link_t *link)
 
 ======================================================================*/
 
-static hw_info_t *get_ax88190(dev_link_t *link)
+static hw_info_t *get_ax88190(struct pcmcia_device *link)
 {
     struct net_device *dev = link->priv;
     kio_addr_t ioaddr = dev->base_addr;
@@ -464,7 +455,7 @@ static hw_info_t *get_ax88190(dev_link_t *link)
 
 ======================================================================*/
 
-static hw_info_t *get_hwired(dev_link_t *link)
+static hw_info_t *get_hwired(struct pcmcia_device *link)
 {
     struct net_device *dev = link->priv;
     int i;
@@ -491,7 +482,7 @@ static hw_info_t *get_hwired(dev_link_t *link)
 #define CS_CHECK(fn, ret) \
 do { last_fn = (fn); if ((last_ret = (ret)) != 0) goto cs_failed; } while (0)
 
-static int try_io_port(dev_link_t *link)
+static int try_io_port(struct pcmcia_device *link)
 {
     int j, ret;
     if (link->io.NumPorts1 == 32) {
@@ -512,18 +503,17 @@ static int try_io_port(dev_link_t *link)
         for (j = 0; j < 0x400; j += 0x20) {
             link->io.BasePort1 = j ^ 0x300;
             link->io.BasePort2 = (j ^ 0x300) + 0x10;
-            ret = pcmcia_request_io(link->handle, &link->io);
+            ret = pcmcia_request_io(link, &link->io);
             if (ret == CS_SUCCESS) return ret;
         }
         return ret;
     } else {
-        return pcmcia_request_io(link->handle, &link->io);
+        return pcmcia_request_io(link, &link->io);
     }
 }
 
-static void pcnet_config(dev_link_t *link)
+static int pcnet_config(struct pcmcia_device *link)
 {
-    client_handle_t handle = link->handle;
     struct net_device *dev = link->priv;
     pcnet_dev_t *info = PRIV(dev);
     tuple_t tuple;
@@ -531,7 +521,6 @@ static void pcnet_config(dev_link_t *link)
     int i, last_ret, last_fn, start_pg, stop_pg, cm_offset;
     int manfid = 0, prodid = 0, has_shmem = 0;
     u_short buf[64];
-    config_info_t conf;
     hw_info_t *hw_info;
 
     DEBUG(0, "pcnet_config(0x%p)\n", link);
@@ -541,36 +530,29 @@ static void pcnet_config(dev_link_t *link)
     tuple.TupleDataMax = sizeof(buf);
     tuple.TupleOffset = 0;
     tuple.DesiredTuple = CISTPL_CONFIG;
-    CS_CHECK(GetFirstTuple, pcmcia_get_first_tuple(handle, &tuple));
-    CS_CHECK(GetTupleData, pcmcia_get_tuple_data(handle, &tuple));
-    CS_CHECK(ParseTuple, pcmcia_parse_tuple(handle, &tuple, &parse));
+    CS_CHECK(GetFirstTuple, pcmcia_get_first_tuple(link, &tuple));
+    CS_CHECK(GetTupleData, pcmcia_get_tuple_data(link, &tuple));
+    CS_CHECK(ParseTuple, pcmcia_parse_tuple(link, &tuple, &parse));
     link->conf.ConfigBase = parse.config.base;
     link->conf.Present = parse.config.rmask[0];
 
-    /* Configure card */
-    link->state |= DEV_CONFIG;
-
-    /* Look up current Vcc */
-    CS_CHECK(GetConfigurationInfo, pcmcia_get_configuration_info(handle, &conf));
-    link->conf.Vcc = conf.Vcc;
-
     tuple.DesiredTuple = CISTPL_MANFID;
     tuple.Attributes = TUPLE_RETURN_COMMON;
-    if ((pcmcia_get_first_tuple(handle, &tuple) == CS_SUCCESS) &&
-        (pcmcia_get_tuple_data(handle, &tuple) == CS_SUCCESS)) {
+    if ((pcmcia_get_first_tuple(link, &tuple) == CS_SUCCESS) &&
+        (pcmcia_get_tuple_data(link, &tuple) == CS_SUCCESS)) {
         manfid = le16_to_cpu(buf[0]);
         prodid = le16_to_cpu(buf[1]);
     }
     
     tuple.DesiredTuple = CISTPL_CFTABLE_ENTRY;
     tuple.Attributes = 0;
-    CS_CHECK(GetFirstTuple, pcmcia_get_first_tuple(handle, &tuple));
+    CS_CHECK(GetFirstTuple, pcmcia_get_first_tuple(link, &tuple));
     while (last_ret == CS_SUCCESS) {
         cistpl_cftable_entry_t *cfg = &(parse.cftable_entry);
         cistpl_io_t *io = &(parse.cftable_entry.io);
         
-        if (pcmcia_get_tuple_data(handle, &tuple) != 0 ||
-                        pcmcia_parse_tuple(handle, &tuple, &parse) != 0 ||
+        if (pcmcia_get_tuple_data(link, &tuple) != 0 ||
+                        pcmcia_parse_tuple(link, &tuple, &parse) != 0 ||
                         cfg->index == 0 || cfg->io.nwin == 0)
                 goto next_entry;
         
@@ -594,14 +576,14 @@ static void pcnet_config(dev_link_t *link)
             if (last_ret == CS_SUCCESS) break;
         }
     next_entry:
-        last_ret = pcmcia_get_next_tuple(handle, &tuple);
+        last_ret = pcmcia_get_next_tuple(link, &tuple);
     }
     if (last_ret != CS_SUCCESS) {
-        cs_error(handle, RequestIO, last_ret);
+        cs_error(link, RequestIO, last_ret);
         goto failed;
     }
 
-    CS_CHECK(RequestIRQ, pcmcia_request_irq(handle, &link->irq));
+    CS_CHECK(RequestIRQ, pcmcia_request_irq(link, &link->irq));
     
     if (link->io.NumPorts2 == 8) {
         link->conf.Attributes |= CONF_ENABLE_SPKR;
@@ -611,7 +593,7 @@ static void pcnet_config(dev_link_t *link)
         (prodid == PRODID_IBM_HOME_AND_AWAY))
         link->conf.ConfigIndex |= 0x10;
     
-    CS_CHECK(RequestConfiguration, pcmcia_request_configuration(handle, &link->conf));
+    CS_CHECK(RequestConfiguration, pcmcia_request_configuration(link, &link->conf));
     dev->irq = link->irq.AssignedIRQ;
     dev->base_addr = link->io.BasePort1;
     if (info->flags & HAS_MISC_REG) {
@@ -679,9 +661,8 @@ static void pcnet_config(dev_link_t *link)
             info->eth_phy = 0;
     }
 
-    link->dev = &info->node;
-    link->state &= ~DEV_CONFIG_PENDING;
-    SET_NETDEV_DEV(dev, &handle_to_dev(handle));
+    link->dev_node = &info->node;
+    SET_NETDEV_DEV(dev, &handle_to_dev(link));
 
 #ifdef CONFIG_NET_POLL_CONTROLLER
     dev->poll_controller = ei_poll;
@@ -689,7 +670,7 @@ static void pcnet_config(dev_link_t *link)
 
     if (register_netdev(dev) != 0) {
         printk(KERN_NOTICE "pcnet_cs: register_netdev() failed\n");
-        link->dev = NULL;
+        link->dev_node = NULL;
         goto failed;
     }
 
@@ -712,14 +693,13 @@ static void pcnet_config(dev_link_t *link)
     printk(" hw_addr ");
     for (i = 0; i < 6; i++)
         printk("%02X%s", dev->dev_addr[i], ((i<5) ? ":" : "\n"));
-    return;
+    return 0;
 
 cs_failed:
-    cs_error(link->handle, last_fn, last_ret);
+    cs_error(link, last_fn, last_ret);
 failed:
     pcnet_release(link);
-    link->state &= ~DEV_CONFIG_PENDING;
-    return;
+    return -ENODEV;
 } /* pcnet_config */
 
 /*======================================================================
@@ -730,21 +710,16 @@ failed:
 
 ======================================================================*/
 
-static void pcnet_release(dev_link_t *link)
+static void pcnet_release(struct pcmcia_device *link)
 {
-    pcnet_dev_t *info = PRIV(link->priv);
+        pcnet_dev_t *info = PRIV(link->priv);
 
-    DEBUG(0, "pcnet_release(0x%p)\n", link);
+        DEBUG(0, "pcnet_release(0x%p)\n", link);
 
-    if (info->flags & USE_SHMEM) {
-        iounmap(info->base);
-        pcmcia_release_window(link->win);
-    }
-    pcmcia_release_configuration(link->handle);
-    pcmcia_release_io(link->handle, &link->io);
-    pcmcia_release_irq(link->handle, &link->irq);
+        if (info->flags & USE_SHMEM)
+                iounmap(info->base);
 
-    link->state &= ~DEV_CONFIG;
+        pcmcia_disable_device(link);
 }
 
 /*======================================================================
@@ -756,34 +731,24 @@ static void pcnet_release(dev_link_t *link)
 
 ======================================================================*/
 
-static int pcnet_suspend(struct pcmcia_device *p_dev)
+static int pcnet_suspend(struct pcmcia_device *link)
 {
-        dev_link_t *link = dev_to_instance(p_dev);
         struct net_device *dev = link->priv;
 
-        link->state |= DEV_SUSPEND;
-        if (link->state & DEV_CONFIG) {
-                if (link->open)
-                        netif_device_detach(dev);
-                pcmcia_release_configuration(link->handle);
-        }
+        if (link->open)
+                netif_device_detach(dev);
 
         return 0;
 }
 
-static int pcnet_resume(struct pcmcia_device *p_dev)
+static int pcnet_resume(struct pcmcia_device *link)
 {
-        dev_link_t *link = dev_to_instance(p_dev);
         struct net_device *dev = link->priv;
 
-        link->state &= ~DEV_SUSPEND;
-        if (link->state & DEV_CONFIG) {
-                pcmcia_request_configuration(link->handle, &link->conf);
-                if (link->open) {
-                        pcnet_reset_8390(dev);
-                        NS8390_init(dev, 1);
-                        netif_device_attach(dev);
-                }
+        if (link->open) {
+                pcnet_reset_8390(dev);
+                NS8390_init(dev, 1);
+                netif_device_attach(dev);
         }
 
         return 0;
@@ -1023,11 +988,11 @@ static void mii_phy_probe(struct net_device *dev)
 static int pcnet_open(struct net_device *dev)
 {
     pcnet_dev_t *info = PRIV(dev);
-    dev_link_t *link = &info->link;
-    
+    struct pcmcia_device *link = info->p_dev;
+
     DEBUG(2, "pcnet_open('%s')\n", dev->name);
 
-    if (!DEV_OK(link))
+    if (!pcmcia_dev_present(link))
         return -ENODEV;
 
     link->open++;
@@ -1051,7 +1016,7 @@ static int pcnet_open(struct net_device *dev)
 static int pcnet_close(struct net_device *dev)
 {
     pcnet_dev_t *info = PRIV(dev);
-    dev_link_t *link = &info->link;
+    struct pcmcia_device *link = info->p_dev;
 
     DEBUG(2, "pcnet_close('%s')\n", dev->name);
 
@@ -1429,7 +1394,7 @@ static void dma_block_output(struct net_device *dev, int count,
 
 /*====================================================================*/
 
-static int setup_dma_config(dev_link_t *link, int start_pg,
+static int setup_dma_config(struct pcmcia_device *link, int start_pg,
                             int stop_pg)
 {
     struct net_device *dev = link->priv;
@@ -1532,7 +1497,7 @@ static void shmem_block_output(struct net_device *dev, int count,
 
 /*====================================================================*/
 
-static int setup_shmem_window(dev_link_t *link, int start_pg,
+static int setup_shmem_window(struct pcmcia_device *link, int start_pg,
                               int stop_pg, int cm_offset)
 {
     struct net_device *dev = link->priv;
@@ -1554,7 +1519,7 @@ static int setup_shmem_window(dev_link_t *link, int start_pg,
     req.Attributes |= WIN_USE_WAIT;
     req.Base = 0; req.Size = window_size;
     req.AccessSpeed = mem_speed;
-    CS_CHECK(RequestWindow, pcmcia_request_window(&link->handle, &req, &link->win));
+    CS_CHECK(RequestWindow, pcmcia_request_window(&link, &req, &link->win));
 
     mem.CardOffset = (start_pg << 8) + cm_offset;
     offset = mem.CardOffset % window_size;
@@ -1595,7 +1560,7 @@ static int setup_shmem_window(dev_link_t *link, int start_pg,
     return 0;
 
 cs_failed:
-    cs_error(link->handle, last_fn, last_ret);
+    cs_error(link, last_fn, last_ret);
 failed:
     return 1;
 }
diff --git a/drivers/net/pcmcia/smc91c92_cs.c b/drivers/net/pcmcia/smc91c92_cs.c
index 8839c4faafd6..e74bf5014ef6 100644
--- a/drivers/net/pcmcia/smc91c92_cs.c
+++ b/drivers/net/pcmcia/smc91c92_cs.c
@@ -49,6 +49,7 @@
 #include <pcmcia/cisreg.h>
 #include <pcmcia/ciscode.h>
 #include <pcmcia/ds.h>
+#include <pcmcia/ss.h>
 
 #include <asm/io.h>
 #include <asm/system.h>
@@ -103,7 +104,7 @@ static const char *version =
 #define MEMORY_WAIT_TIME        8
 
 struct smc_private {
-    dev_link_t                  link;
+        struct pcmcia_device    *p_dev;
     spinlock_t                  lock;
     u_short                     manfid;
     u_short                     cardid;
@@ -278,8 +279,8 @@ enum RxCfg { RxAllMulti = 0x0004, RxPromisc = 0x0002,
 /*====================================================================*/
 
 static void smc91c92_detach(struct pcmcia_device *p_dev);
-static void smc91c92_config(dev_link_t *link);
-static void smc91c92_release(dev_link_t *link);
+static int smc91c92_config(struct pcmcia_device *link);
+static void smc91c92_release(struct pcmcia_device *link);
 
 static int smc_open(struct net_device *dev);
 static int smc_close(struct net_device *dev);
@@ -308,10 +309,9 @@ static struct ethtool_ops ethtool_ops;
 
 ======================================================================*/
 
-static int smc91c92_attach(struct pcmcia_device *p_dev)
+static int smc91c92_probe(struct pcmcia_device *link)
 {
     struct smc_private *smc;
-    dev_link_t *link;
     struct net_device *dev;
 
     DEBUG(0, "smc91c92_attach()\n");
@@ -321,7 +321,7 @@ static int smc91c92_attach(struct pcmcia_device *p_dev)
     if (!dev)
         return -ENOMEM;
     smc = netdev_priv(dev);
-    link = &smc->link;
+    smc->p_dev = link;
     link->priv = dev;
 
     spin_lock_init(&smc->lock);
@@ -333,7 +333,6 @@ static int smc91c92_attach(struct pcmcia_device *p_dev)
     link->irq.Handler = &smc_interrupt;
     link->irq.Instance = dev;
     link->conf.Attributes = CONF_ENABLE_IRQ;
-    link->conf.Vcc = 50;
     link->conf.IntType = INT_MEMORY_AND_IO;
 
     /* The SMC91c92-specific entries in the device structure. */
@@ -357,13 +356,7 @@ static int smc91c92_attach(struct pcmcia_device *p_dev)
     smc->mii_if.phy_id_mask = 0x1f;
     smc->mii_if.reg_num_mask = 0x1f;
 
-    link->handle = p_dev;
-    p_dev->instance = link;
-
-    link->state |= DEV_PRESENT | DEV_CONFIG_PENDING;
-    smc91c92_config(link);
-
-    return 0;
+    return smc91c92_config(link);
 } /* smc91c92_attach */
 
 /*======================================================================
@@ -375,18 +368,16 @@ static int smc91c92_attach(struct pcmcia_device *p_dev)
 
 ======================================================================*/
 
-static void smc91c92_detach(struct pcmcia_device *p_dev)
+static void smc91c92_detach(struct pcmcia_device *link)
 {
-    dev_link_t *link = dev_to_instance(p_dev);
     struct net_device *dev = link->priv;
 
     DEBUG(0, "smc91c92_detach(0x%p)\n", link);
 
-    if (link->dev)
+    if (link->dev_node)
         unregister_netdev(dev);
 
-    if (link->state & DEV_CONFIG)
-        smc91c92_release(link);
+    smc91c92_release(link);
 
     free_netdev(dev);
 } /* smc91c92_detach */
@@ -414,7 +405,7 @@ static int cvt_ascii_address(struct net_device *dev, char *s)
 
 /*====================================================================*/
 
-static int first_tuple(client_handle_t handle, tuple_t *tuple,
+static int first_tuple(struct pcmcia_device *handle, tuple_t *tuple,
                 cisparse_t *parse)
 {
         int i;
@@ -425,7 +416,7 @@ static int first_tuple(client_handle_t handle, tuple_t *tuple,
         return pcmcia_parse_tuple(handle, tuple, parse);
 }
 
-static int next_tuple(client_handle_t handle, tuple_t *tuple,
+static int next_tuple(struct pcmcia_device *handle, tuple_t *tuple,
                 cisparse_t *parse)
 {
         int i;
@@ -447,7 +438,7 @@ static int next_tuple(client_handle_t handle, tuple_t *tuple,
 
 ======================================================================*/
 
-static int mhz_3288_power(dev_link_t *link)
+static int mhz_3288_power(struct pcmcia_device *link)
 {
     struct net_device *dev = link->priv;
     struct smc_private *smc = netdev_priv(dev);
@@ -469,7 +460,7 @@ static int mhz_3288_power(dev_link_t *link)
     return 0;
 }
 
-static int mhz_mfc_config(dev_link_t *link)
+static int mhz_mfc_config(struct pcmcia_device *link)
 {
     struct net_device *dev = link->priv;
     struct smc_private *smc = netdev_priv(dev);
@@ -504,7 +495,7 @@ static int mhz_mfc_config(dev_link_t *link)
     tuple->TupleDataMax = 255;
     tuple->DesiredTuple = CISTPL_CFTABLE_ENTRY;
 
-    i = first_tuple(link->handle, tuple, parse);
+    i = first_tuple(link, tuple, parse);
     /* The Megahertz combo cards have modem-like CIS entries, so
        we have to explicitly try a bunch of port combinations. */
     while (i == CS_SUCCESS) {
@@ -513,11 +504,11 @@ static int mhz_mfc_config(dev_link_t *link)
         for (k = 0; k < 0x400; k += 0x10) {
             if (k & 0x80) continue;
             link->io.BasePort1 = k ^ 0x300;
-            i = pcmcia_request_io(link->handle, &link->io);
+            i = pcmcia_request_io(link, &link->io);
             if (i == CS_SUCCESS) break;
         }
         if (i == CS_SUCCESS) break;
-        i = next_tuple(link->handle, tuple, parse);
+        i = next_tuple(link, tuple, parse);
     }
     if (i != CS_SUCCESS)
         goto free_cfg_mem;
@@ -527,7 +518,7 @@ static int mhz_mfc_config(dev_link_t *link)
     req.Attributes = WIN_DATA_WIDTH_8|WIN_MEMORY_TYPE_AM|WIN_ENABLE;
     req.Base = req.Size = 0;
     req.AccessSpeed = 0;
-    i = pcmcia_request_window(&link->handle, &req, &link->win);
+    i = pcmcia_request_window(&link, &req, &link->win);
     if (i != CS_SUCCESS)
         goto free_cfg_mem;
     smc->base = ioremap(req.Base, req.Size);
@@ -546,9 +537,8 @@ free_cfg_mem:
     return i;
 }
 
-static int mhz_setup(dev_link_t *link)
+static int mhz_setup(struct pcmcia_device *link)
 {
-    client_handle_t handle = link->handle;
     struct net_device *dev = link->priv;
     struct smc_cfg_mem *cfg_mem;
     tuple_t *tuple;
@@ -571,13 +561,13 @@ static int mhz_setup(dev_link_t *link)
     /* Read the station address from the CIS.  It is stored as the last
        (fourth) string in the Version 1 Version/ID tuple. */
     tuple->DesiredTuple = CISTPL_VERS_1;
-    if (first_tuple(handle, tuple, parse) != CS_SUCCESS) {
+    if (first_tuple(link, tuple, parse) != CS_SUCCESS) {
         rc = -1;
         goto free_cfg_mem;
     }
     /* Ugh -- the EM1144 card has two VERS_1 tuples!?! */
-    if (next_tuple(handle, tuple, parse) != CS_SUCCESS)
-        first_tuple(handle, tuple, parse);
+    if (next_tuple(link, tuple, parse) != CS_SUCCESS)
+        first_tuple(link, tuple, parse);
     if (parse->version_1.ns > 3) {
         station_addr = parse->version_1.str + parse->version_1.ofs[3];
         if (cvt_ascii_address(dev, station_addr) == 0) {
@@ -588,11 +578,11 @@ static int mhz_setup(dev_link_t *link)
 
     /* Another possibility: for the EM3288, in a special tuple */
     tuple->DesiredTuple = 0x81;
-    if (pcmcia_get_first_tuple(handle, tuple) != CS_SUCCESS) {
+    if (pcmcia_get_first_tuple(link, tuple) != CS_SUCCESS) {
         rc = -1;
         goto free_cfg_mem;
     }
-    if (pcmcia_get_tuple_data(handle, tuple) != CS_SUCCESS) {
+    if (pcmcia_get_tuple_data(link, tuple) != CS_SUCCESS) {
         rc = -1;
         goto free_cfg_mem;
     }
@@ -616,7 +606,7 @@ free_cfg_mem:
 
 ======================================================================*/
 
-static void mot_config(dev_link_t *link)
+static void mot_config(struct pcmcia_device *link)
 {
     struct net_device *dev = link->priv;
     struct smc_private *smc = netdev_priv(dev);
@@ -637,7 +627,7 @@ static void mot_config(dev_link_t *link)
     mdelay(100);
 }
 
-static int mot_setup(dev_link_t *link)
+static int mot_setup(struct pcmcia_device *link)
 {
     struct net_device *dev = link->priv;
     kio_addr_t ioaddr = dev->base_addr;
@@ -671,7 +661,7 @@ static int mot_setup(dev_link_t *link)
 
 /*====================================================================*/
 
-static int smc_config(dev_link_t *link)
+static int smc_config(struct pcmcia_device *link)
 {
     struct net_device *dev = link->priv;
     struct smc_cfg_mem *cfg_mem;
@@ -696,16 +686,16 @@ static int smc_config(dev_link_t *link)
     tuple->DesiredTuple = CISTPL_CFTABLE_ENTRY;
 
     link->io.NumPorts1 = 16;
-    i = first_tuple(link->handle, tuple, parse);
+    i = first_tuple(link, tuple, parse);
     while (i != CS_NO_MORE_ITEMS) {
         if (i == CS_SUCCESS) {
             link->conf.ConfigIndex = cf->index;
             link->io.BasePort1 = cf->io.win[0].base;
             link->io.IOAddrLines = cf->io.flags & CISTPL_IO_LINES_MASK;
-            i = pcmcia_request_io(link->handle, &link->io);
+            i = pcmcia_request_io(link, &link->io);
             if (i == CS_SUCCESS) break;
         }
-        i = next_tuple(link->handle, tuple, parse);
+        i = next_tuple(link, tuple, parse);
     }
     if (i == CS_SUCCESS)
         dev->base_addr = link->io.BasePort1;
@@ -714,9 +704,8 @@ static int smc_config(dev_link_t *link)
     return i;
 }
 
-static int smc_setup(dev_link_t *link)
+static int smc_setup(struct pcmcia_device *link)
 {
-    client_handle_t handle = link->handle;
     struct net_device *dev = link->priv;
     struct smc_cfg_mem *cfg_mem;
     tuple_t *tuple;
@@ -739,11 +728,11 @@ static int smc_setup(dev_link_t *link)
 
     /* Check for a LAN function extension tuple */
     tuple->DesiredTuple = CISTPL_FUNCE;
-    i = first_tuple(handle, tuple, parse);
+    i = first_tuple(link, tuple, parse);
     while (i == CS_SUCCESS) {
         if (parse->funce.type == CISTPL_FUNCE_LAN_NODE_ID)
             break;
-        i = next_tuple(handle, tuple, parse);
+        i = next_tuple(link, tuple, parse);
     }
     if (i == CS_SUCCESS) {
         node_id = (cistpl_lan_node_id_t *)parse->funce.data;
@@ -756,7 +745,7 @@ static int smc_setup(dev_link_t *link)
     }
     /* Try the third string in the Version 1 Version/ID tuple. */
     tuple->DesiredTuple = CISTPL_VERS_1;
-    if (first_tuple(handle, tuple, parse) != CS_SUCCESS) {
+    if (first_tuple(link, tuple, parse) != CS_SUCCESS) {
         rc = -1;
         goto free_cfg_mem;
     }
@@ -774,7 +763,7 @@ free_cfg_mem:
 
 /*====================================================================*/
 
-static int osi_config(dev_link_t *link)
+static int osi_config(struct pcmcia_device *link)
 {
     struct net_device *dev = link->priv;
     static const kio_addr_t com[4] = { 0x3f8, 0x2f8, 0x3e8, 0x2e8 };
@@ -794,22 +783,21 @@ static int osi_config(dev_link_t *link)
 
     for (i = j = 0; j < 4; j++) {
         link->io.BasePort2 = com[j];
-        i = pcmcia_request_io(link->handle, &link->io);
+        i = pcmcia_request_io(link, &link->io);
         if (i == CS_SUCCESS) break;
     }
     if (i != CS_SUCCESS) {
         /* Fallback: turn off hard decode */
         link->conf.ConfigIndex = 0x03;
         link->io.NumPorts2 = 0;
-        i = pcmcia_request_io(link->handle, &link->io);
+        i = pcmcia_request_io(link, &link->io);
     }
     dev->base_addr = link->io.BasePort1 + 0x10;
     return i;
 }
 
-static int osi_setup(dev_link_t *link, u_short manfid, u_short cardid)
+static int osi_setup(struct pcmcia_device *link, u_short manfid, u_short cardid)
 {
-    client_handle_t handle = link->handle;
     struct net_device *dev = link->priv;
     struct smc_cfg_mem *cfg_mem;
     tuple_t *tuple;
@@ -830,12 +818,12 @@ static int osi_setup(dev_link_t *link, u_short manfid, u_short cardid)
 
     /* Read the station address from tuple 0x90, subtuple 0x04 */
     tuple->DesiredTuple = 0x90;
-    i = pcmcia_get_first_tuple(handle, tuple);
+    i = pcmcia_get_first_tuple(link, tuple);
     while (i == CS_SUCCESS) {
-        i = pcmcia_get_tuple_data(handle, tuple);
+        i = pcmcia_get_tuple_data(link, tuple);
         if ((i != CS_SUCCESS) || (buf[0] == 0x04))
             break;
-        i = pcmcia_get_next_tuple(handle, tuple);
+        i = pcmcia_get_next_tuple(link, tuple);
     }
     if (i != CS_SUCCESS) {
         rc = -1;
@@ -868,57 +856,47 @@ free_cfg_mem:
    return rc;
 }
 
-static int smc91c92_suspend(struct pcmcia_device *p_dev)
+static int smc91c92_suspend(struct pcmcia_device *link)
 {
-        dev_link_t *link = dev_to_instance(p_dev);
         struct net_device *dev = link->priv;
 
-        link->state |= DEV_SUSPEND;
-        if (link->state & DEV_CONFIG) {
-                if (link->open)
-                        netif_device_detach(dev);
-                pcmcia_release_configuration(link->handle);
-        }
+        if (link->open)
+                netif_device_detach(dev);
 
         return 0;
 }
 
-static int smc91c92_resume(struct pcmcia_device *p_dev)
+static int smc91c92_resume(struct pcmcia_device *link)
 {
-        dev_link_t *link = dev_to_instance(p_dev);
         struct net_device *dev = link->priv;
         struct smc_private *smc = netdev_priv(dev);
         int i;
 
-        link->state &= ~DEV_SUSPEND;
-        if (link->state & DEV_CONFIG) {
-                if ((smc->manfid == MANFID_MEGAHERTZ) &&
-                    (smc->cardid == PRODID_MEGAHERTZ_EM3288))
-                        mhz_3288_power(link);
-                pcmcia_request_configuration(link->handle, &link->conf);
-                if (smc->manfid == MANFID_MOTOROLA)
-                        mot_config(link);
-                if ((smc->manfid == MANFID_OSITECH) &&
-                    (smc->cardid != PRODID_OSITECH_SEVEN)) {
-                        /* Power up the card and enable interrupts */
-                        set_bits(0x0300, dev->base_addr-0x10+OSITECH_AUI_PWR);
-                        set_bits(0x0300, dev->base_addr-0x10+OSITECH_RESET_ISR);
-                }
-                if (((smc->manfid == MANFID_OSITECH) &&
-                     (smc->cardid == PRODID_OSITECH_SEVEN)) ||
-                    ((smc->manfid == MANFID_PSION) &&
-                     (smc->cardid == PRODID_PSION_NET100))) {
-                        /* Download the Seven of Diamonds firmware */
-                        for (i = 0; i < sizeof(__Xilinx7OD); i++) {
-                                outb(__Xilinx7OD[i], link->io.BasePort1+2);
-                                udelay(50);
-                        }
-                }
-                if (link->open) {
-                        smc_reset(dev);
-                        netif_device_attach(dev);
+        if ((smc->manfid == MANFID_MEGAHERTZ) &&
+            (smc->cardid == PRODID_MEGAHERTZ_EM3288))
+                mhz_3288_power(link);
+        if (smc->manfid == MANFID_MOTOROLA)
+                mot_config(link);
+        if ((smc->manfid == MANFID_OSITECH) &&
+            (smc->cardid != PRODID_OSITECH_SEVEN)) {
+                /* Power up the card and enable interrupts */
+                set_bits(0x0300, dev->base_addr-0x10+OSITECH_AUI_PWR);
+                set_bits(0x0300, dev->base_addr-0x10+OSITECH_RESET_ISR);
+        }
+        if (((smc->manfid == MANFID_OSITECH) &&
+             (smc->cardid == PRODID_OSITECH_SEVEN)) ||
+            ((smc->manfid == MANFID_PSION) &&
+             (smc->cardid == PRODID_PSION_NET100))) {
+                /* Download the Seven of Diamonds firmware */
+                for (i = 0; i < sizeof(__Xilinx7OD); i++) {
+                        outb(__Xilinx7OD[i], link->io.BasePort1+2);
+                        udelay(50);
                 }
         }
+        if (link->open) {
+                smc_reset(dev);
+                netif_device_attach(dev);
+        }
 
         return 0;
 }
@@ -931,7 +909,7 @@ static int smc91c92_resume(struct pcmcia_device *p_dev)
 
 ======================================================================*/
 
-static int check_sig(dev_link_t *link)
+static int check_sig(struct pcmcia_device *link)
 {
     struct net_device *dev = link->priv;
     kio_addr_t ioaddr = dev->base_addr;
@@ -964,13 +942,15 @@ static int check_sig(dev_link_t *link)
     }
 
     if (width) {
-        printk(KERN_INFO "smc91c92_cs: using 8-bit IO window.\n");
-        smc91c92_suspend(link->handle);
-        pcmcia_release_io(link->handle, &link->io);
-        link->io.Attributes1 = IO_DATA_PATH_WIDTH_8;
-        pcmcia_request_io(link->handle, &link->io);
-        smc91c92_resume(link->handle);
-        return check_sig(link);
+            modconf_t mod = {
+                    .Attributes = CONF_IO_CHANGE_WIDTH,
+            };
+            printk(KERN_INFO "smc91c92_cs: using 8-bit IO window.\n");
+
+            smc91c92_suspend(link);
+            pcmcia_modify_configuration(link, &mod);
+            smc91c92_resume(link);
+            return check_sig(link);
     }
     return -ENODEV;
 }
@@ -984,11 +964,10 @@ static int check_sig(dev_link_t *link)
 ======================================================================*/
 
 #define CS_EXIT_TEST(ret, svc, label) \
-if (ret != CS_SUCCESS) { cs_error(link->handle, svc, ret); goto label; }
+if (ret != CS_SUCCESS) { cs_error(link, svc, ret); goto label; }
 
-static void smc91c92_config(dev_link_t *link)
+static int smc91c92_config(struct pcmcia_device *link)
 {
-    client_handle_t handle = link->handle;
     struct net_device *dev = link->priv;
     struct smc_private *smc = netdev_priv(dev);
     struct smc_cfg_mem *cfg_mem;
@@ -1015,21 +994,18 @@ static void smc91c92_config(dev_link_t *link)
     tuple->TupleDataMax = 64;
 
     tuple->DesiredTuple = CISTPL_CONFIG;
-    i = first_tuple(handle, tuple, parse);
+    i = first_tuple(link, tuple, parse);
     CS_EXIT_TEST(i, ParseTuple, config_failed);
     link->conf.ConfigBase = parse->config.base;
     link->conf.Present = parse->config.rmask[0];
 
     tuple->DesiredTuple = CISTPL_MANFID;
     tuple->Attributes = TUPLE_RETURN_COMMON;
-    if (first_tuple(handle, tuple, parse) == CS_SUCCESS) {
+    if (first_tuple(link, tuple, parse) == CS_SUCCESS) {
         smc->manfid = parse->manfid.manf;
         smc->cardid = parse->manfid.card;
     }
 
-    /* Configure card */
-    link->state |= DEV_CONFIG;
-
     if ((smc->manfid == MANFID_OSITECH) &&
         (smc->cardid != PRODID_OSITECH_SEVEN)) {
         i = osi_config(link);
@@ -1043,9 +1019,9 @@ static void smc91c92_config(dev_link_t *link)
     }
     CS_EXIT_TEST(i, RequestIO, config_failed);
 
-    i = pcmcia_request_irq(link->handle, &link->irq);
+    i = pcmcia_request_irq(link, &link->irq);
     CS_EXIT_TEST(i, RequestIRQ, config_failed);
-    i = pcmcia_request_configuration(link->handle, &link->conf);
+    i = pcmcia_request_configuration(link, &link->conf);
     CS_EXIT_TEST(i, RequestConfiguration, config_failed);
 
     if (smc->manfid == MANFID_MOTOROLA)
@@ -1124,13 +1100,12 @@ static void smc91c92_config(dev_link_t *link)
         SMC_SELECT_BANK(0);
     }
 
-    link->dev = &smc->node;
-    link->state &= ~DEV_CONFIG_PENDING;
-    SET_NETDEV_DEV(dev, &handle_to_dev(handle));
+    link->dev_node = &smc->node;
+    SET_NETDEV_DEV(dev, &handle_to_dev(link));
 
     if (register_netdev(dev) != 0) {
         printk(KERN_ERR "smc91c92_cs: register_netdev() failed\n");
-        link->dev = NULL;
+        link->dev_node = NULL;
         goto config_undo;
     }
 
@@ -1160,15 +1135,14 @@ static void smc91c92_config(dev_link_t *link)
         }
     }
     kfree(cfg_mem);
-    return;
+    return 0;
 
 config_undo:
     unregister_netdev(dev);
 config_failed:                  /* CS_EXIT_TEST() calls jump to here... */
     smc91c92_release(link);
-    link->state &= ~DEV_CONFIG_PENDING;
     kfree(cfg_mem);
-
+    return -ENODEV;
 } /* smc91c92_config */
 
 /*======================================================================
@@ -1179,22 +1153,15 @@ config_failed:			/* CS_EXIT_TEST() calls jump to here... */
 
 ======================================================================*/
 
-static void smc91c92_release(dev_link_t *link)
+static void smc91c92_release(struct pcmcia_device *link)
 {
-
-    DEBUG(0, "smc91c92_release(0x%p)\n", link);
-
-    pcmcia_release_configuration(link->handle);
-    pcmcia_release_io(link->handle, &link->io);
-    pcmcia_release_irq(link->handle, &link->irq);
-    if (link->win) {
-        struct net_device *dev = link->priv;
-        struct smc_private *smc = netdev_priv(dev);
-        iounmap(smc->base);
-        pcmcia_release_window(link->win);
-    }
-
-    link->state &= ~DEV_CONFIG;
+        DEBUG(0, "smc91c92_release(0x%p)\n", link);
+        if (link->win) {
+                struct net_device *dev = link->priv;
+                struct smc_private *smc = netdev_priv(dev);
+                iounmap(smc->base);
+        }
+        pcmcia_disable_device(link);
 }
 
 /*======================================================================
@@ -1283,7 +1250,7 @@ static void smc_dump(struct net_device *dev)
 static int smc_open(struct net_device *dev)
 {
     struct smc_private *smc = netdev_priv(dev);
-    dev_link_t *link = &smc->link;
+    struct pcmcia_device *link = smc->p_dev;
 
 #ifdef PCMCIA_DEBUG
     DEBUG(0, "%s: smc_open(%p), ID/Window %4.4x.\n",
@@ -1292,7 +1259,7 @@ static int smc_open(struct net_device *dev)
 #endif
 
     /* Check that the PCMCIA card is still here. */
-    if (!DEV_OK(link))
+    if (!pcmcia_dev_present(link))
         return -ENODEV;
     /* Physical device present signature. */
     if (check_sig(link) < 0) {
@@ -1320,7 +1287,7 @@ static int smc_open(struct net_device *dev)
 static int smc_close(struct net_device *dev)
 {
     struct smc_private *smc = netdev_priv(dev);
-    dev_link_t *link = &smc->link;
+    struct pcmcia_device *link = smc->p_dev;
     kio_addr_t ioaddr = dev->base_addr;
 
     DEBUG(0, "%s: smc_close(), status %4.4x.\n",
@@ -2311,7 +2278,7 @@ static struct pcmcia_driver smc91c92_cs_driver = {
         .drv            = {
                 .name   = "smc91c92_cs",
         },
-        .probe          = smc91c92_attach,
+        .probe          = smc91c92_probe,
         .remove         = smc91c92_detach,
         .id_table       = smc91c92_ids,
         .suspend        = smc91c92_suspend,
diff --git a/drivers/net/pcmcia/xirc2ps_cs.c b/drivers/net/pcmcia/xirc2ps_cs.c
index e8f849e12976..71f45056a70c 100644
--- a/drivers/net/pcmcia/xirc2ps_cs.c
+++ b/drivers/net/pcmcia/xirc2ps_cs.c
@@ -289,9 +289,9 @@ static void mii_wr(kio_addr_t ioaddr, u_char phyaddr, u_char phyreg,
  * and ejection events.  They are invoked from the event handler.
  */
 
-static int has_ce2_string(dev_link_t * link);
-static void xirc2ps_config(dev_link_t * link);
-static void xirc2ps_release(dev_link_t * link);
+static int has_ce2_string(struct pcmcia_device * link);
+static int xirc2ps_config(struct pcmcia_device * link);
+static void xirc2ps_release(struct pcmcia_device * link);
 
 /****************
  * The attach() and detach() entry points are used to create and destroy
@@ -313,10 +313,10 @@ static irqreturn_t xirc2ps_interrupt(int irq, void *dev_id, struct pt_regs *regs
 /****************
  * A linked list of "instances" of the device.  Each actual
  * PCMCIA card corresponds to one device instance, and is described
- * by one dev_link_t structure (defined in ds.h).
+ * by one struct pcmcia_device structure (defined in ds.h).
  *
  * You may not want to use a linked list for this -- for example, the
- * memory card driver uses an array of dev_link_t pointers, where minor
+ * memory card driver uses an array of struct pcmcia_device pointers, where minor
  * device numbers are used to derive the corresponding array index.
  */
 
@@ -326,13 +326,13 @@ static irqreturn_t xirc2ps_interrupt(int irq, void *dev_id, struct pt_regs *regs
  * example, ethernet cards, modems).  In other cases, there may be
  * many actual or logical devices (SCSI adapters, memory cards with
  * multiple partitions).  The dev_node_t structures need to be kept
- * in a linked list starting at the 'dev' field of a dev_link_t
+ * in a linked list starting at the 'dev' field of a struct pcmcia_device
  * structure.  We allocate them in the card's private data structure,
  * because they generally can't be allocated dynamically.
  */
 
 typedef struct local_info_t {
-    dev_link_t link;
+        struct pcmcia_device    *p_dev;
     dev_node_t node;
     struct net_device_stats stats;
     int card_type;
@@ -355,7 +355,7 @@ static void do_tx_timeout(struct net_device *dev);
 static struct net_device_stats *do_get_stats(struct net_device *dev);
 static void set_addresses(struct net_device *dev);
 static void set_multicast_list(struct net_device *dev);
-static int set_card_type(dev_link_t *link, const void *s);
+static int set_card_type(struct pcmcia_device *link, const void *s);
 static int do_config(struct net_device *dev, struct ifmap *map);
 static int do_open(struct net_device *dev);
 static int do_ioctl(struct net_device *dev, struct ifreq *rq, int cmd);
@@ -368,7 +368,7 @@ static int do_stop(struct net_device *dev);
 
 /*=============== Helper functions =========================*/
 static int
-first_tuple(client_handle_t handle, tuple_t *tuple, cisparse_t *parse)
+first_tuple(struct pcmcia_device *handle, tuple_t *tuple, cisparse_t *parse)
 {
         int err;
 
@@ -379,7 +379,7 @@ first_tuple(client_handle_t handle, tuple_t *tuple, cisparse_t *parse)
 }
 
 static int
-next_tuple(client_handle_t handle, tuple_t *tuple, cisparse_t *parse)
+next_tuple(struct pcmcia_device *handle, tuple_t *tuple, cisparse_t *parse)
 {
         int err;
 
@@ -553,9 +553,8 @@ mii_wr(kio_addr_t ioaddr, u_char phyaddr, u_char phyreg, unsigned data, int len)
  */
 
 static int
-xirc2ps_attach(struct pcmcia_device *p_dev)
+xirc2ps_probe(struct pcmcia_device *link)
 {
-    dev_link_t *link;
     struct net_device *dev;
     local_info_t *local;
 
@@ -566,12 +565,11 @@ xirc2ps_attach(struct pcmcia_device *p_dev)
     if (!dev)
             return -ENOMEM;
     local = netdev_priv(dev);
-    link = &local->link;
+    local->p_dev = link;
     link->priv = dev;
 
     /* General socket configuration */
     link->conf.Attributes = CONF_ENABLE_IRQ;
-    link->conf.Vcc = 50;
     link->conf.IntType = INT_MEMORY_AND_IO;
     link->conf.ConfigIndex = 1;
     link->conf.Present = PRESENT_OPTION;
@@ -593,13 +591,7 @@ xirc2ps_attach(struct pcmcia_device *p_dev)
     dev->watchdog_timeo = TX_TIMEOUT;
 #endif
 
-    link->handle = p_dev;
-    p_dev->instance = link;
-
-    link->state |= DEV_PRESENT | DEV_CONFIG_PENDING;
-    xirc2ps_config(link);
-
-    return 0;
+    return xirc2ps_config(link);
 } /* xirc2ps_attach */
 
 /****************
@@ -610,18 +602,16 @@ xirc2ps_attach(struct pcmcia_device *p_dev)
  */
 
 static void
-xirc2ps_detach(struct pcmcia_device *p_dev)
+xirc2ps_detach(struct pcmcia_device *link)
 {
-    dev_link_t *link = dev_to_instance(p_dev);
     struct net_device *dev = link->priv;
 
     DEBUG(0, "detach(0x%p)\n", link);
 
-    if (link->dev)
+    if (link->dev_node)
         unregister_netdev(dev);
 
-    if (link->state & DEV_CONFIG)
-        xirc2ps_release(link);
+    xirc2ps_release(link);
 
     free_netdev(dev);
 } /* xirc2ps_detach */
@@ -645,7 +635,7 @@ xirc2ps_detach(struct pcmcia_device *p_dev)
  *
  */
 static int
-set_card_type(dev_link_t *link, const void *s)
+set_card_type(struct pcmcia_device *link, const void *s)
 {
     struct net_device *dev = link->priv;
     local_info_t *local = netdev_priv(dev);
@@ -714,9 +704,8 @@ set_card_type(dev_link_t *link, const void *s)
  * Returns: true if this is a CE2
  */
 static int
-has_ce2_string(dev_link_t * link)
+has_ce2_string(struct pcmcia_device * link)
 {
-    client_handle_t handle = link->handle;
     tuple_t tuple;
     cisparse_t parse;
     u_char buf[256];
@@ -726,7 +715,7 @@ has_ce2_string(dev_link_t * link)
     tuple.TupleDataMax = 254;
     tuple.TupleOffset = 0;
     tuple.DesiredTuple = CISTPL_VERS_1;
-    if (!first_tuple(handle, &tuple, &parse) && parse.version_1.ns > 2) {
+    if (!first_tuple(link, &tuple, &parse) && parse.version_1.ns > 2) {
         if (strstr(parse.version_1.str + parse.version_1.ofs[2], "CE2"))
             return 1;
     }
@@ -738,10 +727,9 @@ has_ce2_string(dev_link_t * link)
  * is received, to configure the PCMCIA socket, and to make the
  * ethernet device available to the system.
  */
-static void
-xirc2ps_config(dev_link_t * link)
+static int
+xirc2ps_config(struct pcmcia_device * link)
 {
-    client_handle_t handle = link->handle;
     struct net_device *dev = link->priv;
     local_info_t *local = netdev_priv(dev);
     tuple_t tuple;
@@ -767,7 +755,7 @@ xirc2ps_config(dev_link_t * link)
 
     /* Is this a valid  card */
     tuple.DesiredTuple = CISTPL_MANFID;
-    if ((err=first_tuple(handle, &tuple, &parse))) {
+    if ((err=first_tuple(link, &tuple, &parse))) {
         printk(KNOT_XIRC "manfid not found in CIS\n");
         goto failure;
     }
@@ -803,15 +791,15 @@ xirc2ps_config(dev_link_t * link)
 
     /* get configuration stuff */
     tuple.DesiredTuple = CISTPL_CONFIG;
-    if ((err=first_tuple(handle, &tuple, &parse)))
+    if ((err=first_tuple(link, &tuple, &parse)))
         goto cis_error;
     link->conf.ConfigBase = parse.config.base;
     link->conf.Present =    parse.config.rmask[0];
 
     /* get the ethernet address from the CIS */
     tuple.DesiredTuple = CISTPL_FUNCE;
-    for (err = first_tuple(handle, &tuple, &parse); !err;
-                             err = next_tuple(handle, &tuple, &parse)) {
+    for (err = first_tuple(link, &tuple, &parse); !err;
+                             err = next_tuple(link, &tuple, &parse)) {
         /* Once I saw two CISTPL_FUNCE_LAN_NODE_ID entries:
          * the first one with a length of zero the second correct -
          * so I skip all entries with length 0 */
@@ -821,8 +809,8 @@ xirc2ps_config(dev_link_t * link)
     }
     if (err) { /* not found: try to get the node-id from tuple 0x89 */
         tuple.DesiredTuple = 0x89;  /* data layout looks like tuple 0x22 */
-        if ((err = pcmcia_get_first_tuple(handle, &tuple)) == 0 &&
-                (err = pcmcia_get_tuple_data(handle, &tuple)) == 0) {
+        if ((err = pcmcia_get_first_tuple(link, &tuple)) == 0 &&
+                (err = pcmcia_get_tuple_data(link, &tuple)) == 0) {
             if (tuple.TupleDataLen == 8 && *buf == CISTPL_FUNCE_LAN_NODE_ID)
                 memcpy(&parse, buf, 8);
             else
@@ -831,8 +819,8 @@ xirc2ps_config(dev_link_t * link)
     }
     if (err) { /* another try   (James Lehmer's CE2 version 4.1)*/
         tuple.DesiredTuple = CISTPL_FUNCE;
-        for (err = first_tuple(handle, &tuple, &parse); !err;
-                                 err = next_tuple(handle, &tuple, &parse)) {
+        for (err = first_tuple(link, &tuple, &parse); !err;
+                                 err = next_tuple(link, &tuple, &parse)) {
             if (parse.funce.type == 0x02 && parse.funce.data[0] == 1
                 && parse.funce.data[1] == 6 && tuple.TupleDataLen == 13) {
                 buf[1] = 4;
@@ -853,9 +841,6 @@ xirc2ps_config(dev_link_t * link)
     for (i=0; i < 6; i++)
         dev->dev_addr[i] = node_id->id[i];
 
-    /* Configure card */
-    link->state |= DEV_CONFIG;
-
     link->io.IOAddrLines =10;
     link->io.Attributes1 = IO_DATA_PATH_WIDTH_16;
     link->irq.Attributes = IRQ_HANDLE_PRESENT;
@@ -875,14 +860,14 @@ xirc2ps_config(dev_link_t * link)
              * Ethernet port */
             link->io.NumPorts1 = 16; /* no Mako stuff anymore */
             tuple.DesiredTuple = CISTPL_CFTABLE_ENTRY;
-            for (err = first_tuple(handle, &tuple, &parse); !err;
-                                 err = next_tuple(handle, &tuple, &parse)) {
+            for (err = first_tuple(link, &tuple, &parse); !err;
+                                 err = next_tuple(link, &tuple, &parse)) {
                 if (cf->io.nwin > 0  &&  (cf->io.win[0].base & 0xf) == 8) {
                     for (ioaddr = 0x300; ioaddr < 0x400; ioaddr += 0x10) {
                         link->conf.ConfigIndex = cf->index ;
                         link->io.BasePort2 = cf->io.win[0].base;
                         link->io.BasePort1 = ioaddr;
-                        if (!(err=pcmcia_request_io(link->handle, &link->io)))
+                        if (!(err=pcmcia_request_io(link, &link->io)))
                             goto port_found;
                     }
                 }
@@ -896,15 +881,15 @@ xirc2ps_config(dev_link_t * link)
              */
             for (pass=0; pass < 2; pass++) {
                 tuple.DesiredTuple = CISTPL_CFTABLE_ENTRY;
-                for (err = first_tuple(handle, &tuple, &parse); !err;
-                                     err = next_tuple(handle, &tuple, &parse)){
+                for (err = first_tuple(link, &tuple, &parse); !err;
+                                     err = next_tuple(link, &tuple, &parse)){
                     if (cf->io.nwin > 0  &&  (cf->io.win[0].base & 0xf) == 8){
                         link->conf.ConfigIndex = cf->index ;
                         link->io.BasePort2 = cf->io.win[0].base;
                         link->io.BasePort1 = link->io.BasePort2
                                     + (pass ? (cf->index & 0x20 ? -24:8)
                                             : (cf->index & 0x20 ?   8:-24));
-                        if (!(err=pcmcia_request_io(link->handle, &link->io)))
+                        if (!(err=pcmcia_request_io(link, &link->io)))
                             goto port_found;
                     }
                 }
@@ -919,12 +904,12 @@ xirc2ps_config(dev_link_t * link)
         link->io.NumPorts1 = 16;
         for (ioaddr = 0x300; ioaddr < 0x400; ioaddr += 0x10) {
             link->io.BasePort1 = ioaddr;
-            if (!(err=pcmcia_request_io(link->handle, &link->io)))
+            if (!(err=pcmcia_request_io(link, &link->io)))
                 goto port_found;
         }
         link->io.BasePort1 = 0; /* let CS decide */
-        if ((err=pcmcia_request_io(link->handle, &link->io))) {
-            cs_error(link->handle, RequestIO, err);
+        if ((err=pcmcia_request_io(link, &link->io))) {
+            cs_error(link, RequestIO, err);
             goto config_error;
         }
     }
@@ -936,8 +921,8 @@ xirc2ps_config(dev_link_t * link)
      * Now allocate an interrupt line.  Note that this does not
      * actually assign a handler to the interrupt.
      */
-    if ((err=pcmcia_request_irq(link->handle, &link->irq))) {
-        cs_error(link->handle, RequestIRQ, err);
+    if ((err=pcmcia_request_irq(link, &link->irq))) {
+        cs_error(link, RequestIRQ, err);
         goto config_error;
     }
 
@@ -945,8 +930,8 @@ xirc2ps_config(dev_link_t * link)
      * This actually configures the PCMCIA socket -- setting up
      * the I/O windows and the interrupt mapping.
      */
-    if ((err=pcmcia_request_configuration(link->handle, &link->conf))) {
-        cs_error(link->handle, RequestConfiguration, err);
+    if ((err=pcmcia_request_configuration(link, &link->conf))) {
+        cs_error(link, RequestConfiguration, err);
         goto config_error;
     }
 
@@ -963,15 +948,15 @@ xirc2ps_config(dev_link_t * link)
         reg.Action = CS_WRITE;
         reg.Offset = CISREG_IOBASE_0;
         reg.Value = link->io.BasePort2 & 0xff;
-        if ((err = pcmcia_access_configuration_register(link->handle, &reg))) {
-            cs_error(link->handle, AccessConfigurationRegister, err);
+        if ((err = pcmcia_access_configuration_register(link, &reg))) {
+            cs_error(link, AccessConfigurationRegister, err);
             goto config_error;
         }
         reg.Action = CS_WRITE;
         reg.Offset = CISREG_IOBASE_1;
         reg.Value = (link->io.BasePort2 >> 8) & 0xff;
-        if ((err = pcmcia_access_configuration_register(link->handle, &reg))) {
-            cs_error(link->handle, AccessConfigurationRegister, err);
+        if ((err = pcmcia_access_configuration_register(link, &reg))) {
+            cs_error(link, AccessConfigurationRegister, err);
             goto config_error;
         }
 
@@ -982,15 +967,15 @@ xirc2ps_config(dev_link_t * link)
         req.Attributes = WIN_DATA_WIDTH_8|WIN_MEMORY_TYPE_AM|WIN_ENABLE;
         req.Base = req.Size = 0;
         req.AccessSpeed = 0;
-        if ((err = pcmcia_request_window(&link->handle, &req, &link->win))) {
-            cs_error(link->handle, RequestWindow, err);
+        if ((err = pcmcia_request_window(&link, &req, &link->win))) {
+            cs_error(link, RequestWindow, err);
             goto config_error;
         }
         local->dingo_ccr = ioremap(req.Base,0x1000) + 0x0800;
         mem.CardOffset = 0x0;
         mem.Page = 0;
         if ((err = pcmcia_map_mem_page(link->win, &mem))) {
-            cs_error(link->handle, MapMemPage, err);
+            cs_error(link, MapMemPage, err);
             goto config_error;
         }
 
@@ -1050,13 +1035,12 @@ xirc2ps_config(dev_link_t * link)
     if (local->dingo)
         do_reset(dev, 1); /* a kludge to make the cem56 work */
 
-    link->dev = &local->node;
-    link->state &= ~DEV_CONFIG_PENDING;
-    SET_NETDEV_DEV(dev, &handle_to_dev(handle));
+    link->dev_node = &local->node;
+    SET_NETDEV_DEV(dev, &handle_to_dev(link));
 
     if ((err=register_netdev(dev))) {
         printk(KNOT_XIRC "register_netdev() failed\n");
-        link->dev = NULL;
+        link->dev_node = NULL;
         goto config_error;
     }
 
@@ -1069,17 +1053,16 @@ xirc2ps_config(dev_link_t * link)
         printk("%c%02X", i?':':' ', dev->dev_addr[i]);
     printk("\n");
 
-    return;
+    return 0;
 
   config_error:
-    link->state &= ~DEV_CONFIG_PENDING;
     xirc2ps_release(link);
-    return;
+    return -ENODEV;
 
   cis_error:
     printk(KNOT_XIRC "unable to parse CIS\n");
   failure:
-    link->state &= ~DEV_CONFIG_PENDING;
+    return -ENODEV;
 } /* xirc2ps_config */
 
 /****************
@@ -1088,57 +1071,41 @@ xirc2ps_config(dev_link_t * link)
  * still open, this will be postponed until it is closed.
  */
 static void
-xirc2ps_release(dev_link_t *link)
+xirc2ps_release(struct pcmcia_device *link)
 {
+        DEBUG(0, "release(0x%p)\n", link);
 
-    DEBUG(0, "release(0x%p)\n", link);
-
-    if (link->win) {
-        struct net_device *dev = link->priv;
-        local_info_t *local = netdev_priv(dev);
-        if (local->dingo)
-            iounmap(local->dingo_ccr - 0x0800);
-        pcmcia_release_window(link->win);
-    }
-    pcmcia_release_configuration(link->handle);
-    pcmcia_release_io(link->handle, &link->io);
-    pcmcia_release_irq(link->handle, &link->irq);
-    link->state &= ~DEV_CONFIG;
-
+        if (link->win) {
+                struct net_device *dev = link->priv;
+                local_info_t *local = netdev_priv(dev);
+                if (local->dingo)
+                        iounmap(local->dingo_ccr - 0x0800);
+        }
+        pcmcia_disable_device(link);
 } /* xirc2ps_release */
 
 /*====================================================================*/
 
 
-static int xirc2ps_suspend(struct pcmcia_device *p_dev)
+static int xirc2ps_suspend(struct pcmcia_device *link)
 {
-        dev_link_t *link = dev_to_instance(p_dev);
         struct net_device *dev = link->priv;
 
-        link->state |= DEV_SUSPEND;
-        if (link->state & DEV_CONFIG) {
-                if (link->open) {
-                        netif_device_detach(dev);
-                        do_powerdown(dev);
-                }
-                pcmcia_release_configuration(link->handle);
+        if (link->open) {
+                netif_device_detach(dev);
+                do_powerdown(dev);
         }
 
         return 0;
 }
 
-static int xirc2ps_resume(struct pcmcia_device *p_dev)
+static int xirc2ps_resume(struct pcmcia_device *link)
 {
-        dev_link_t *link = dev_to_instance(p_dev);
         struct net_device *dev = link->priv;
 
-        link->state &= ~DEV_SUSPEND;
-        if (link->state & DEV_CONFIG) {
-                pcmcia_request_configuration(link->handle, &link->conf);
-                if (link->open) {
-                        do_reset(dev,1);
-                        netif_device_attach(dev);
-                }
+        if (link->open) {
+                do_reset(dev,1);
+                netif_device_attach(dev);
         }
 
         return 0;
@@ -1552,13 +1519,13 @@ static int
 do_open(struct net_device *dev)
 {
     local_info_t *lp = netdev_priv(dev);
-    dev_link_t *link = &lp->link;
+    struct pcmcia_device *link = lp->p_dev;
 
     DEBUG(0, "do_open(%p)\n", dev);
 
     /* Check that the PCMCIA card is still here. */
     /* Physical device present signature. */
-    if (!DEV_OK(link))
+    if (!pcmcia_dev_present(link))
         return -ENODEV;
 
     /* okay */
@@ -1882,7 +1849,7 @@ do_stop(struct net_device *dev)
 {
     kio_addr_t ioaddr = dev->base_addr;
     local_info_t *lp = netdev_priv(dev);
-    dev_link_t *link = &lp->link;
+    struct pcmcia_device *link = lp->p_dev;
 
     DEBUG(0, "do_stop(%p)\n", dev);
 
@@ -1935,7 +1902,7 @@ static struct pcmcia_driver xirc2ps_cs_driver = {
         .drv            = {
                 .name   = "xirc2ps_cs",
         },
-        .probe          = xirc2ps_attach,
+        .probe          = xirc2ps_probe,
         .remove         = xirc2ps_detach,
         .id_table       = xirc2ps_ids,
         .suspend        = xirc2ps_suspend,
diff --git a/drivers/net/starfire.c b/drivers/net/starfire.c
index 35b18057fbdd..45ad036733e2 100644
--- a/drivers/net/starfire.c
+++ b/drivers/net/starfire.c
@@ -2122,8 +2122,7 @@ static void __devexit starfire_remove_one (struct pci_dev *pdev)
         struct net_device *dev = pci_get_drvdata(pdev);
         struct netdev_private *np = netdev_priv(dev);
 
-        if (!dev)
-                BUG();
+        BUG_ON(!dev);
 
         unregister_netdev(dev);
 
diff --git a/drivers/net/tg3.c b/drivers/net/tg3.c
index 964c09644832..73e271e59c6a 100644
--- a/drivers/net/tg3.c
+++ b/drivers/net/tg3.c
@@ -69,8 +69,8 @@
 
 #define DRV_MODULE_NAME         "tg3"
 #define PFX DRV_MODULE_NAME     ": "
-#define DRV_MODULE_VERSION      "3.55"
-#define DRV_MODULE_RELDATE      "Mar 27, 2006"
+#define DRV_MODULE_VERSION      "3.56"
+#define DRV_MODULE_RELDATE      "Apr 1, 2006"
 
 #define TG3_DEF_MAC_MODE        0
 #define TG3_DEF_RX_MODE         0
@@ -497,18 +497,18 @@ static void tg3_write_mem(struct tg3 *tp, u32 off, u32 val)
         unsigned long flags;
 
         spin_lock_irqsave(&tp->indirect_lock, flags);
-        if (tp->write32 != tg3_write_indirect_reg32) {
-                tw32_f(TG3PCI_MEM_WIN_BASE_ADDR, off);
-                tw32_f(TG3PCI_MEM_WIN_DATA, val);
-
-                /* Always leave this as zero. */
-                tw32_f(TG3PCI_MEM_WIN_BASE_ADDR, 0);
-        } else {
+        if (tp->tg3_flags & TG3_FLAG_SRAM_USE_CONFIG) {
                 pci_write_config_dword(tp->pdev, TG3PCI_MEM_WIN_BASE_ADDR, off);
                 pci_write_config_dword(tp->pdev, TG3PCI_MEM_WIN_DATA, val);
 
                 /* Always leave this as zero. */
                 pci_write_config_dword(tp->pdev, TG3PCI_MEM_WIN_BASE_ADDR, 0);
+        } else {
+                tw32_f(TG3PCI_MEM_WIN_BASE_ADDR, off);
+                tw32_f(TG3PCI_MEM_WIN_DATA, val);
+
+                /* Always leave this as zero. */
+                tw32_f(TG3PCI_MEM_WIN_BASE_ADDR, 0);
         }
         spin_unlock_irqrestore(&tp->indirect_lock, flags);
 }
@@ -518,18 +518,18 @@ static void tg3_read_mem(struct tg3 *tp, u32 off, u32 *val)
         unsigned long flags;
 
         spin_lock_irqsave(&tp->indirect_lock, flags);
-        if (tp->write32 != tg3_write_indirect_reg32) {
-                tw32_f(TG3PCI_MEM_WIN_BASE_ADDR, off);
-                *val = tr32(TG3PCI_MEM_WIN_DATA);
-
-                /* Always leave this as zero. */
-                tw32_f(TG3PCI_MEM_WIN_BASE_ADDR, 0);
-        } else {
+        if (tp->tg3_flags & TG3_FLAG_SRAM_USE_CONFIG) {
                 pci_write_config_dword(tp->pdev, TG3PCI_MEM_WIN_BASE_ADDR, off);
                 pci_read_config_dword(tp->pdev, TG3PCI_MEM_WIN_DATA, val);
 
                 /* Always leave this as zero. */
                 pci_write_config_dword(tp->pdev, TG3PCI_MEM_WIN_BASE_ADDR, 0);
+        } else {
+                tw32_f(TG3PCI_MEM_WIN_BASE_ADDR, off);
+                *val = tr32(TG3PCI_MEM_WIN_DATA);
+
+                /* Always leave this as zero. */
+                tw32_f(TG3PCI_MEM_WIN_BASE_ADDR, 0);
         }
         spin_unlock_irqrestore(&tp->indirect_lock, flags);
 }
@@ -2966,9 +2966,7 @@ static void tg3_tx(struct tg3 *tp)
                 struct sk_buff *skb = ri->skb;
                 int i;
 
-                if (unlikely(skb == NULL))
-                        BUG();
-
+                BUG_ON(skb == NULL);
                 pci_unmap_single(tp->pdev,
                                  pci_unmap_addr(ri, mapping),
                                  skb_headlen(skb),
@@ -2979,12 +2977,10 @@ static void tg3_tx(struct tg3 *tp)
                 sw_idx = NEXT_TX(sw_idx);
 
                 for (i = 0; i < skb_shinfo(skb)->nr_frags; i++) {
-                        if (unlikely(sw_idx == hw_idx))
-                                BUG();
+                        BUG_ON(sw_idx == hw_idx);
 
                         ri = &tp->tx_buffers[sw_idx];
-                        if (unlikely(ri->skb != NULL))
-                                BUG();
+                        BUG_ON(ri->skb != NULL);
 
                         pci_unmap_page(tp->pdev,
                                        pci_unmap_addr(ri, mapping),
@@ -4935,9 +4931,8 @@ static int tg3_halt_cpu(struct tg3 *tp, u32 offset)
 {
         int i;
 
-        if (offset == TX_CPU_BASE &&
-            (tp->tg3_flags2 & TG3_FLG2_5705_PLUS))
-                BUG();
+        BUG_ON(offset == TX_CPU_BASE &&
+            (tp->tg3_flags2 & TG3_FLG2_5705_PLUS));
 
         if (offset == RX_CPU_BASE) {
                 for (i = 0; i < 10000; i++) {
@@ -5840,10 +5835,14 @@ static int tg3_reset_hw(struct tg3 *tp)
                           GRC_MODE_NO_TX_PHDR_CSUM |
                           GRC_MODE_NO_RX_PHDR_CSUM);
         tp->grc_mode |= GRC_MODE_HOST_SENDBDS;
-        if (tp->tg3_flags & TG3_FLAG_NO_TX_PSEUDO_CSUM)
-                tp->grc_mode |= GRC_MODE_NO_TX_PHDR_CSUM;
-        if (tp->tg3_flags & TG3_FLAG_NO_RX_PSEUDO_CSUM)
-                tp->grc_mode |= GRC_MODE_NO_RX_PHDR_CSUM;
+
+        /* Pseudo-header checksum is done by hardware logic and not
+         * the offload processers, so make the chip do the pseudo-
+         * header checksums on receive.  For transmit it is more
+         * convenient to do the pseudo-header checksum in software
+         * as Linux does that on transmit for us in all cases.
+         */
+        tp->grc_mode |= GRC_MODE_NO_TX_PHDR_CSUM;
 
         tw32(GRC_MODE,
              tp->grc_mode |
@@ -8046,9 +8045,13 @@ static int tg3_test_nvram(struct tg3 *tp)
                 for (i = 0; i < size; i++)
                         csum8 += buf8[i];
 
-                if (csum8 == 0)
-                        return 0;
-                return -EIO;
+                if (csum8 == 0) {
+                        err = 0;
+                        goto out;
+                }
+
+                err = -EIO;
+                goto out;
         }
 
         /* Bootstrap checksum at offset 0x10 */
@@ -9543,8 +9546,11 @@ static void __devinit tg3_get_eeprom_hw_cfg(struct tg3 *tp)
         tp->led_ctrl = LED_CTRL_MODE_PHY_1;
 
         /* Do not even try poking around in here on Sun parts.  */
-        if (tp->tg3_flags2 & TG3_FLG2_SUN_570X)
+        if (tp->tg3_flags2 & TG3_FLG2_SUN_570X) {
+                /* All SUN chips are built-in LOMs. */
+                tp->tg3_flags |= TG3_FLAG_EEPROM_WRITE_PROT;
                 return;
+        }
 
         tg3_read_mem(tp, NIC_SRAM_DATA_SIG, &val);
         if (val == NIC_SRAM_DATA_SIG_MAGIC) {
@@ -9642,9 +9648,7 @@ static void __devinit tg3_get_eeprom_hw_cfg(struct tg3 *tp)
                     tp->pdev->subsystem_vendor == PCI_VENDOR_ID_DELL)
                         tp->led_ctrl = LED_CTRL_MODE_PHY_2;
 
-                if ((GET_ASIC_REV(tp->pci_chip_rev_id) != ASIC_REV_5700) &&
-                    (GET_ASIC_REV(tp->pci_chip_rev_id) != ASIC_REV_5701) &&
-                    (nic_cfg & NIC_SRAM_DATA_CFG_EEPROM_WP))
+                if (nic_cfg & NIC_SRAM_DATA_CFG_EEPROM_WP)
                         tp->tg3_flags |= TG3_FLAG_EEPROM_WRITE_PROT;
 
                 if (nic_cfg & NIC_SRAM_DATA_CFG_ASF_ENABLE) {
@@ -10269,6 +10273,13 @@ static int __devinit tg3_get_invariants(struct tg3 *tp)
                 pci_write_config_word(tp->pdev, PCI_COMMAND, pci_cmd);
         }
 
+        if (tp->write32 == tg3_write_indirect_reg32 ||
+            ((tp->tg3_flags & TG3_FLAG_PCIX_MODE) &&
+             (GET_ASIC_REV(tp->pci_chip_rev_id) == ASIC_REV_5700 ||
+              GET_ASIC_REV(tp->pci_chip_rev_id) == ASIC_REV_5701)) ||
+            (tp->tg3_flags2 & TG3_FLG2_SUN_570X))
+                tp->tg3_flags |= TG3_FLAG_SRAM_USE_CONFIG;
+
         /* Get eeprom hw config before calling tg3_set_power_state().
          * In particular, the TG3_FLAG_EEPROM_WRITE_PROT flag must be
          * determined before calling tg3_set_power_state() so that
@@ -10311,15 +10322,6 @@ static int __devinit tg3_get_invariants(struct tg3 *tp)
         if (tp->pci_chip_rev_id == CHIPREV_ID_5700_B0)
                 tp->tg3_flags |= TG3_FLAG_BROKEN_CHECKSUMS;
 
-        /* Pseudo-header checksum is done by hardware logic and not
-         * the offload processers, so make the chip do the pseudo-
-         * header checksums on receive.  For transmit it is more
-         * convenient to do the pseudo-header checksum in software
-         * as Linux does that on transmit for us in all cases.
-         */
-        tp->tg3_flags |= TG3_FLAG_NO_TX_PSEUDO_CSUM;
-        tp->tg3_flags &= ~TG3_FLAG_NO_RX_PSEUDO_CSUM;
-
         /* Derive initial jumbo mode from MTU assigned in
          * ether_setup() via the alloc_etherdev() call
          */
diff --git a/drivers/net/tg3.h b/drivers/net/tg3.h
index c43cc3264202..8c8b987d1250 100644
--- a/drivers/net/tg3.h
+++ b/drivers/net/tg3.h
@@ -2171,8 +2171,7 @@ struct tg3 {
 #define TG3_FLAG_PCIX_MODE              0x00020000
 #define TG3_FLAG_PCI_HIGH_SPEED         0x00040000
 #define TG3_FLAG_PCI_32BIT              0x00080000
-#define TG3_FLAG_NO_TX_PSEUDO_CSUM      0x00100000
-#define TG3_FLAG_NO_RX_PSEUDO_CSUM      0x00200000
+#define TG3_FLAG_SRAM_USE_CONFIG        0x00100000
 #define TG3_FLAG_SERDES_WOL_CAP         0x00400000
 #define TG3_FLAG_JUMBO_RING_ENABLE      0x00800000
 #define TG3_FLAG_10_100_ONLY            0x01000000
diff --git a/drivers/net/tokenring/abyss.c b/drivers/net/tokenring/abyss.c
index 9345e68c451e..649d8ea354f5 100644
--- a/drivers/net/tokenring/abyss.c
+++ b/drivers/net/tokenring/abyss.c
@@ -438,8 +438,7 @@ static void __devexit abyss_detach (struct pci_dev *pdev)
 {
         struct net_device *dev = pci_get_drvdata(pdev);
         
-        if (!dev)
-                BUG();
+        BUG_ON(!dev);
         unregister_netdev(dev);
         release_region(dev->base_addr-0x10, ABYSS_IO_EXTENT);
         free_irq(dev->irq, dev);
diff --git a/drivers/net/tokenring/madgemc.c b/drivers/net/tokenring/madgemc.c
index 3a25d191ea4a..19e6f4dfd69c 100644
--- a/drivers/net/tokenring/madgemc.c
+++ b/drivers/net/tokenring/madgemc.c
@@ -735,8 +735,7 @@ static int __devexit madgemc_remove(struct device *device)
         struct net_local *tp;
         struct card_info *card;
 
-        if (!dev)
-                BUG();
+        BUG_ON(!dev);
 
         tp = dev->priv;
         card = tp->tmspriv;
diff --git a/drivers/net/wireless/airo_cs.c b/drivers/net/wireless/airo_cs.c
index a496460ce224..af0cbb6c5c0c 100644
--- a/drivers/net/wireless/airo_cs.c
+++ b/drivers/net/wireless/airo_cs.c
@@ -80,8 +80,8 @@ MODULE_SUPPORTED_DEVICE("Aironet 4500, 4800 and Cisco 340 PCMCIA cards");
    event handler. 
 */
 
-static void airo_config(dev_link_t *link);
-static void airo_release(dev_link_t *link);
+static int airo_config(struct pcmcia_device *link);
+static void airo_release(struct pcmcia_device *link);
 
 /*
    The attach() and detach() entry points are used to create and destroy
@@ -101,10 +101,10 @@ static void airo_detach(struct pcmcia_device *p_dev);
 /*
    A linked list of "instances" of the  aironet device.  Each actual
    PCMCIA card corresponds to one device instance, and is described
-   by one dev_link_t structure (defined in ds.h).
+   by one struct pcmcia_device structure (defined in ds.h).
 
    You may not want to use a linked list for this -- for example, the
-   memory card driver uses an array of dev_link_t pointers, where minor
+   memory card driver uses an array of struct pcmcia_device pointers, where minor
    device numbers are used to derive the corresponding array index.
 */
 
@@ -114,7 +114,7 @@ static void airo_detach(struct pcmcia_device *p_dev);
    example, ethernet cards, modems).  In other cases, there may be
    many actual or logical devices (SCSI adapters, memory cards with
    multiple partitions).  The dev_node_t structures need to be kept
-   in a linked list starting at the 'dev' field of a dev_link_t
+   in a linked list starting at the 'dev' field of a struct pcmcia_device
    structure.  We allocate them in the card's private data structure,
    because they generally shouldn't be allocated dynamically.
 
@@ -141,24 +141,16 @@ typedef struct local_info_t {
   
   ======================================================================*/
 
-static int airo_attach(struct pcmcia_device *p_dev)
+static int airo_probe(struct pcmcia_device *p_dev)
 {
-        dev_link_t *link;
         local_info_t *local;
 
         DEBUG(0, "airo_attach()\n");
 
-        /* Initialize the dev_link_t structure */
-        link = kzalloc(sizeof(struct dev_link_t), GFP_KERNEL);
-        if (!link) {
-                printk(KERN_ERR "airo_cs: no memory for new device\n");
-                return -ENOMEM;
-        }
-        
         /* Interrupt setup */
-        link->irq.Attributes = IRQ_TYPE_EXCLUSIVE;
-        link->irq.IRQInfo1 = IRQ_LEVEL_ID;
-        link->irq.Handler = NULL;
+        p_dev->irq.Attributes = IRQ_TYPE_EXCLUSIVE;
+        p_dev->irq.IRQInfo1 = IRQ_LEVEL_ID;
+        p_dev->irq.Handler = NULL;
         
         /*
           General socket configuration defaults can go here.  In this
@@ -167,26 +159,18 @@ static int airo_attach(struct pcmcia_device *p_dev)
           and attributes of IO windows) are fixed by the nature of the
           device, and can be hard-wired here.
         */
-        link->conf.Attributes = 0;
-        link->conf.Vcc = 50;
-        link->conf.IntType = INT_MEMORY_AND_IO;
+        p_dev->conf.Attributes = 0;
+        p_dev->conf.IntType = INT_MEMORY_AND_IO;
         
         /* Allocate space for private device-specific data */
         local = kzalloc(sizeof(local_info_t), GFP_KERNEL);
         if (!local) {
                 printk(KERN_ERR "airo_cs: no memory for new device\n");
-                kfree (link);
                 return -ENOMEM;
         }
-        link->priv = local;
+        p_dev->priv = local;
 
-        link->handle = p_dev;
-        p_dev->instance = link;
-
-        link->state |= DEV_PRESENT | DEV_CONFIG_PENDING;
-        airo_config(link);
-
-        return 0;
+        return airo_config(p_dev);
 } /* airo_attach */
 
 /*======================================================================
@@ -198,14 +182,11 @@ static int airo_attach(struct pcmcia_device *p_dev)
   
   ======================================================================*/
 
-static void airo_detach(struct pcmcia_device *p_dev)
+static void airo_detach(struct pcmcia_device *link)
 {
-        dev_link_t *link = dev_to_instance(p_dev);
-
         DEBUG(0, "airo_detach(0x%p)\n", link);
 
-        if (link->state & DEV_CONFIG)
-                airo_release(link);
+        airo_release(link);
 
         if ( ((local_info_t*)link->priv)->eth_dev ) {
                 stop_airo_card( ((local_info_t*)link->priv)->eth_dev, 0 );
@@ -213,7 +194,6 @@ static void airo_detach(struct pcmcia_device *p_dev)
         ((local_info_t*)link->priv)->eth_dev = NULL;
 
         kfree(link->priv);
-        kfree(link);
 } /* airo_detach */
 
 /*======================================================================
@@ -227,9 +207,8 @@ static void airo_detach(struct pcmcia_device *p_dev)
 #define CS_CHECK(fn, ret) \
 do { last_fn = (fn); if ((last_ret = (ret)) != 0) goto cs_failed; } while (0)
 
-static void airo_config(dev_link_t *link)
+static int airo_config(struct pcmcia_device *link)
 {
-        client_handle_t handle;
         tuple_t tuple;
         cisparse_t parse;
         local_info_t *dev;
@@ -237,8 +216,7 @@ static void airo_config(dev_link_t *link)
         u_char buf[64];
         win_req_t req;
         memreq_t map;
-        
-        handle = link->handle;
+
         dev = link->priv;
 
         DEBUG(0, "airo_config(0x%p)\n", link);
@@ -252,15 +230,12 @@ static void airo_config(dev_link_t *link)
         tuple.TupleData = buf;
         tuple.TupleDataMax = sizeof(buf);
         tuple.TupleOffset = 0;
-        CS_CHECK(GetFirstTuple, pcmcia_get_first_tuple(handle, &tuple));
-        CS_CHECK(GetTupleData, pcmcia_get_tuple_data(handle, &tuple));
-        CS_CHECK(ParseTuple, pcmcia_parse_tuple(handle, &tuple, &parse));
+        CS_CHECK(GetFirstTuple, pcmcia_get_first_tuple(link, &tuple));
+        CS_CHECK(GetTupleData, pcmcia_get_tuple_data(link, &tuple));
+        CS_CHECK(ParseTuple, pcmcia_parse_tuple(link, &tuple, &parse));
         link->conf.ConfigBase = parse.config.base;
         link->conf.Present = parse.config.rmask[0];
-        
-        /* Configure card */
-        link->state |= DEV_CONFIG;
-        
+
         /*
           In this loop, we scan the CIS for configuration table entries,
           each of which describes a valid card configuration, including
@@ -274,12 +249,12 @@ static void airo_config(dev_link_t *link)
           will only use the CIS to fill in implementation-defined details.
         */
         tuple.DesiredTuple = CISTPL_CFTABLE_ENTRY;
-        CS_CHECK(GetFirstTuple, pcmcia_get_first_tuple(handle, &tuple));
+        CS_CHECK(GetFirstTuple, pcmcia_get_first_tuple(link, &tuple));
         while (1) {
                 cistpl_cftable_entry_t dflt = { 0 };
                 cistpl_cftable_entry_t *cfg = &(parse.cftable_entry);
-                if (pcmcia_get_tuple_data(handle, &tuple) != 0 ||
-                                pcmcia_parse_tuple(handle, &tuple, &parse) != 0)
+                if (pcmcia_get_tuple_data(link, &tuple) != 0 ||
+                                pcmcia_parse_tuple(link, &tuple, &parse) != 0)
                         goto next_entry;
                 
                 if (cfg->flags & CISTPL_CFTABLE_DEFAULT) dflt = *cfg;
@@ -294,16 +269,11 @@ static void airo_config(dev_link_t *link)
                 
                 /* Use power settings for Vcc and Vpp if present */
                 /*  Note that the CIS values need to be rescaled */
-                if (cfg->vcc.present & (1<<CISTPL_POWER_VNOM))
-                        link->conf.Vcc = cfg->vcc.param[CISTPL_POWER_VNOM]/10000;
-                else if (dflt.vcc.present & (1<<CISTPL_POWER_VNOM))
-                        link->conf.Vcc = dflt.vcc.param[CISTPL_POWER_VNOM]/10000;
-                
                 if (cfg->vpp1.present & (1<<CISTPL_POWER_VNOM))
-                        link->conf.Vpp1 = link->conf.Vpp2 =
+                        link->conf.Vpp =
                                 cfg->vpp1.param[CISTPL_POWER_VNOM]/10000;
                 else if (dflt.vpp1.present & (1<<CISTPL_POWER_VNOM))
-                        link->conf.Vpp1 = link->conf.Vpp2 =
+                        link->conf.Vpp =
                                 dflt.vpp1.param[CISTPL_POWER_VNOM]/10000;
                 
                 /* Do we need to allocate an interrupt? */
@@ -329,12 +299,12 @@ static void airo_config(dev_link_t *link)
                 }
                 
                 /* This reserves IO space but doesn't actually enable it */
-                if (pcmcia_request_io(link->handle, &link->io) != 0)
+                if (pcmcia_request_io(link, &link->io) != 0)
                         goto next_entry;
                 
                 /*
                   Now set up a common memory window, if needed.  There is room
-                  in the dev_link_t structure for one memory window handle,
+                  in the struct pcmcia_device structure for one memory window handle,
                   but if the base addresses need to be saved, or if multiple
                   windows are needed, the info should go in the private data
                   structure for this device.
@@ -350,7 +320,7 @@ static void airo_config(dev_link_t *link)
                         req.Base = mem->win[0].host_addr;
                         req.Size = mem->win[0].len;
                         req.AccessSpeed = 0;
-                        if (pcmcia_request_window(&link->handle, &req, &link->win) != 0)
+                        if (pcmcia_request_window(&link, &req, &link->win) != 0)
                                 goto next_entry;
                         map.Page = 0; map.CardOffset = mem->win[0].card_addr;
                         if (pcmcia_map_mem_page(link->win, &map) != 0)
@@ -360,7 +330,7 @@ static void airo_config(dev_link_t *link)
                 break;
                 
         next_entry:
-                CS_CHECK(GetNextTuple, pcmcia_get_next_tuple(handle, &tuple));
+                CS_CHECK(GetNextTuple, pcmcia_get_next_tuple(link, &tuple));
         }
         
     /*
@@ -369,33 +339,32 @@ static void airo_config(dev_link_t *link)
       irq structure is initialized.
     */
         if (link->conf.Attributes & CONF_ENABLE_IRQ)
-                CS_CHECK(RequestIRQ, pcmcia_request_irq(link->handle, &link->irq));
+                CS_CHECK(RequestIRQ, pcmcia_request_irq(link, &link->irq));
         
         /*
           This actually configures the PCMCIA socket -- setting up
           the I/O windows and the interrupt mapping, and putting the
           card and host interface into "Memory and IO" mode.
         */
-        CS_CHECK(RequestConfiguration, pcmcia_request_configuration(link->handle, &link->conf));
+        CS_CHECK(RequestConfiguration, pcmcia_request_configuration(link, &link->conf));
         ((local_info_t*)link->priv)->eth_dev = 
                 init_airo_card( link->irq.AssignedIRQ,
-                                link->io.BasePort1, 1, &handle_to_dev(handle) );
+                                link->io.BasePort1, 1, &handle_to_dev(link) );
         if (!((local_info_t*)link->priv)->eth_dev) goto cs_failed;
         
         /*
           At this point, the dev_node_t structure(s) need to be
-          initialized and arranged in a linked list at link->dev.
+          initialized and arranged in a linked list at link->dev_node.
         */
         strcpy(dev->node.dev_name, ((local_info_t*)link->priv)->eth_dev->name );
         dev->node.major = dev->node.minor = 0;
-        link->dev = &dev->node;
+        link->dev_node = &dev->node;
         
         /* Finally, report what we've done */
-        printk(KERN_INFO "%s: index 0x%02x: Vcc %d.%d",
-               dev->node.dev_name, link->conf.ConfigIndex,
-               link->conf.Vcc/10, link->conf.Vcc%10);
-        if (link->conf.Vpp1)
-                printk(", Vpp %d.%d", link->conf.Vpp1/10, link->conf.Vpp1%10);
+        printk(KERN_INFO "%s: index 0x%02x: ",
+               dev->node.dev_name, link->conf.ConfigIndex);
+        if (link->conf.Vpp)
+                printk(", Vpp %d.%d", link->conf.Vpp/10, link->conf.Vpp%10);
         if (link->conf.Attributes & CONF_ENABLE_IRQ)
                 printk(", irq %d", link->irq.AssignedIRQ);
         if (link->io.NumPorts1)
@@ -408,14 +377,12 @@ static void airo_config(dev_link_t *link)
                 printk(", mem 0x%06lx-0x%06lx", req.Base,
                        req.Base+req.Size-1);
         printk("\n");
-        
-        link->state &= ~DEV_CONFIG_PENDING;
-        return;
-        
+        return 0;
+
  cs_failed:
-        cs_error(link->handle, last_fn, last_ret);
+        cs_error(link, last_fn, last_ret);
         airo_release(link);
-        
+        return -ENODEV;
 } /* airo_config */
 
 /*======================================================================
@@ -426,51 +393,26 @@ static void airo_config(dev_link_t *link)
   
   ======================================================================*/
 
-static void airo_release(dev_link_t *link)
+static void airo_release(struct pcmcia_device *link)
 {
         DEBUG(0, "airo_release(0x%p)\n", link);
-        
-        /* Unlink the device chain */
-        link->dev = NULL;
-        
-        /*
-          In a normal driver, additional code may be needed to release
-          other kernel data structures associated with this device. 
-        */
-        
-        /* Don't bother checking to see if these succeed or not */
-        if (link->win)
-                pcmcia_release_window(link->win);
-        pcmcia_release_configuration(link->handle);
-        if (link->io.NumPorts1)
-                pcmcia_release_io(link->handle, &link->io);
-        if (link->irq.AssignedIRQ)
-                pcmcia_release_irq(link->handle, &link->irq);
-        link->state &= ~DEV_CONFIG;
+        pcmcia_disable_device(link);
 }
 
-static int airo_suspend(struct pcmcia_device *p_dev)
+static int airo_suspend(struct pcmcia_device *link)
 {
-        dev_link_t *link = dev_to_instance(p_dev);
         local_info_t *local = link->priv;
 
-        link->state |= DEV_SUSPEND;
-        if (link->state & DEV_CONFIG) {
-                netif_device_detach(local->eth_dev);
-                pcmcia_release_configuration(link->handle);
-        }
+        netif_device_detach(local->eth_dev);
 
         return 0;
 }
 
-static int airo_resume(struct pcmcia_device *p_dev)
+static int airo_resume(struct pcmcia_device *link)
 {
-        dev_link_t *link = dev_to_instance(p_dev);
         local_info_t *local = link->priv;
 
-        link->state &= ~DEV_SUSPEND;
-        if (link->state & DEV_CONFIG) {
-                pcmcia_request_configuration(link->handle, &link->conf);
+        if (link->open) {
                 reset_airo_card(local->eth_dev);
                 netif_device_attach(local->eth_dev);
         }
@@ -492,7 +434,7 @@ static struct pcmcia_driver airo_driver = {
         .drv            = {
                 .name   = "airo_cs",
         },
-        .probe          = airo_attach,
+        .probe          = airo_probe,
         .remove         = airo_detach,
         .id_table       = airo_ids,
         .suspend        = airo_suspend,
diff --git a/drivers/net/wireless/atmel_cs.c b/drivers/net/wireless/atmel_cs.c
index d6f4a5a3e55a..26bf1127524d 100644
--- a/drivers/net/wireless/atmel_cs.c
+++ b/drivers/net/wireless/atmel_cs.c
@@ -91,8 +91,8 @@ MODULE_SUPPORTED_DEVICE("Atmel at76c50x PCMCIA cards");
    event handler. 
 */
 
-static void atmel_config(dev_link_t *link);
-static void atmel_release(dev_link_t *link);
+static int atmel_config(struct pcmcia_device *link);
+static void atmel_release(struct pcmcia_device *link);
 
 /*
    The attach() and detach() entry points are used to create and destroy
@@ -112,10 +112,10 @@ static void atmel_detach(struct pcmcia_device *p_dev);
 /*
    A linked list of "instances" of the  atmelnet device.  Each actual
    PCMCIA card corresponds to one device instance, and is described
-   by one dev_link_t structure (defined in ds.h).
+   by one struct pcmcia_device structure (defined in ds.h).
 
    You may not want to use a linked list for this -- for example, the
-   memory card driver uses an array of dev_link_t pointers, where minor
+   memory card driver uses an array of struct pcmcia_device pointers, where minor
    device numbers are used to derive the corresponding array index.
 */
 
@@ -125,7 +125,7 @@ static void atmel_detach(struct pcmcia_device *p_dev);
    example, ethernet cards, modems).  In other cases, there may be
    many actual or logical devices (SCSI adapters, memory cards with
    multiple partitions).  The dev_node_t structures need to be kept
-   in a linked list starting at the 'dev' field of a dev_link_t
+   in a linked list starting at the 'dev' field of a struct pcmcia_device
    structure.  We allocate them in the card's private data structure,
    because they generally shouldn't be allocated dynamically.
 
@@ -152,24 +152,16 @@ typedef struct local_info_t {
   
   ======================================================================*/
 
-static int atmel_attach(struct pcmcia_device *p_dev)
+static int atmel_probe(struct pcmcia_device *p_dev)
 {
-        dev_link_t *link;
         local_info_t *local;
 
         DEBUG(0, "atmel_attach()\n");
 
-        /* Initialize the dev_link_t structure */
-        link = kzalloc(sizeof(struct dev_link_t), GFP_KERNEL);
-        if (!link) {
-                printk(KERN_ERR "atmel_cs: no memory for new device\n");
-                return -ENOMEM;
-        }
-
         /* Interrupt setup */
-        link->irq.Attributes = IRQ_TYPE_EXCLUSIVE;
-        link->irq.IRQInfo1 = IRQ_LEVEL_ID;
-        link->irq.Handler = NULL;
+        p_dev->irq.Attributes = IRQ_TYPE_EXCLUSIVE;
+        p_dev->irq.IRQInfo1 = IRQ_LEVEL_ID;
+        p_dev->irq.Handler = NULL;
 
         /*
           General socket configuration defaults can go here.  In this
@@ -178,26 +170,18 @@ static int atmel_attach(struct pcmcia_device *p_dev)
           and attributes of IO windows) are fixed by the nature of the
           device, and can be hard-wired here.
         */
-        link->conf.Attributes = 0;
-        link->conf.Vcc = 50;
-        link->conf.IntType = INT_MEMORY_AND_IO;
+        p_dev->conf.Attributes = 0;
+        p_dev->conf.IntType = INT_MEMORY_AND_IO;
 
         /* Allocate space for private device-specific data */
         local = kzalloc(sizeof(local_info_t), GFP_KERNEL);
         if (!local) {
                 printk(KERN_ERR "atmel_cs: no memory for new device\n");
-                kfree (link);
                 return -ENOMEM;
         }
-        link->priv = local;
+        p_dev->priv = local;
 
-        link->handle = p_dev;
-        p_dev->instance = link;
-
-        link->state |= DEV_PRESENT | DEV_CONFIG_PENDING;
-        atmel_config(link);
-
-        return 0;
+        return atmel_config(p_dev);
 } /* atmel_attach */
 
 /*======================================================================
@@ -209,17 +193,13 @@ static int atmel_attach(struct pcmcia_device *p_dev)
   
   ======================================================================*/
 
-static void atmel_detach(struct pcmcia_device *p_dev)
+static void atmel_detach(struct pcmcia_device *link)
 {
-        dev_link_t *link = dev_to_instance(p_dev);
-
         DEBUG(0, "atmel_detach(0x%p)\n", link);
 
-        if (link->state & DEV_CONFIG)
-                atmel_release(link);
+        atmel_release(link);
 
         kfree(link->priv);
-        kfree(link);
 }
 
 /*======================================================================
@@ -236,19 +216,17 @@ do { last_fn = (fn); if ((last_ret = (ret)) != 0) goto cs_failed; } while (0)
 /* Call-back function to interrogate PCMCIA-specific information
    about the current existance of the card */
 static int card_present(void *arg)
-{ 
-        dev_link_t *link = (dev_link_t *)arg;
-        if (link->state & DEV_SUSPEND)
-                return 0;
-        else if (link->state & DEV_PRESENT)
+{
+        struct pcmcia_device *link = (struct pcmcia_device *)arg;
+
+        if (pcmcia_dev_present(link))
                 return 1;
-        
+
         return 0;
 }
 
-static void atmel_config(dev_link_t *link)
+static int atmel_config(struct pcmcia_device *link)
 {
-        client_handle_t handle;
         tuple_t tuple;
         cisparse_t parse;
         local_info_t *dev;
@@ -256,9 +234,8 @@ static void atmel_config(dev_link_t *link)
         u_char buf[64];
         struct pcmcia_device_id *did;
 
-        handle = link->handle;
         dev = link->priv;
-        did = handle_to_dev(handle).driver_data;
+        did = handle_to_dev(link).driver_data;
 
         DEBUG(0, "atmel_config(0x%p)\n", link);
         
@@ -272,15 +249,12 @@ static void atmel_config(dev_link_t *link)
           registers.
         */
         tuple.DesiredTuple = CISTPL_CONFIG;
-        CS_CHECK(GetFirstTuple, pcmcia_get_first_tuple(handle, &tuple));
-        CS_CHECK(GetTupleData, pcmcia_get_tuple_data(handle, &tuple));
-        CS_CHECK(ParseTuple, pcmcia_parse_tuple(handle, &tuple, &parse));
+        CS_CHECK(GetFirstTuple, pcmcia_get_first_tuple(link, &tuple));
+        CS_CHECK(GetTupleData, pcmcia_get_tuple_data(link, &tuple));
+        CS_CHECK(ParseTuple, pcmcia_parse_tuple(link, &tuple, &parse));
         link->conf.ConfigBase = parse.config.base;
         link->conf.Present = parse.config.rmask[0];
-        
-        /* Configure card */
-        link->state |= DEV_CONFIG;
-        
+
         /*
           In this loop, we scan the CIS for configuration table entries,
           each of which describes a valid card configuration, including
@@ -294,12 +268,12 @@ static void atmel_config(dev_link_t *link)
           will only use the CIS to fill in implementation-defined details.
         */
         tuple.DesiredTuple = CISTPL_CFTABLE_ENTRY;
-        CS_CHECK(GetFirstTuple, pcmcia_get_first_tuple(handle, &tuple));
+        CS_CHECK(GetFirstTuple, pcmcia_get_first_tuple(link, &tuple));
         while (1) {
                 cistpl_cftable_entry_t dflt = { 0 };
                 cistpl_cftable_entry_t *cfg = &(parse.cftable_entry);
-                if (pcmcia_get_tuple_data(handle, &tuple) != 0 ||
-                                pcmcia_parse_tuple(handle, &tuple, &parse) != 0)
+                if (pcmcia_get_tuple_data(link, &tuple) != 0 ||
+                                pcmcia_parse_tuple(link, &tuple, &parse) != 0)
                         goto next_entry;
                 
                 if (cfg->flags & CISTPL_CFTABLE_DEFAULT) dflt = *cfg;
@@ -314,16 +288,11 @@ static void atmel_config(dev_link_t *link)
                 
                 /* Use power settings for Vcc and Vpp if present */
                 /*  Note that the CIS values need to be rescaled */
-                if (cfg->vcc.present & (1<<CISTPL_POWER_VNOM))
-                        link->conf.Vcc = cfg->vcc.param[CISTPL_POWER_VNOM]/10000;
-                else if (dflt.vcc.present & (1<<CISTPL_POWER_VNOM))
-                        link->conf.Vcc = dflt.vcc.param[CISTPL_POWER_VNOM]/10000;
-                
                 if (cfg->vpp1.present & (1<<CISTPL_POWER_VNOM))
-                        link->conf.Vpp1 = link->conf.Vpp2 =
+                        link->conf.Vpp =
                                 cfg->vpp1.param[CISTPL_POWER_VNOM]/10000;
                 else if (dflt.vpp1.present & (1<<CISTPL_POWER_VNOM))
-                        link->conf.Vpp1 = link->conf.Vpp2 =
+                        link->conf.Vpp =
                                 dflt.vpp1.param[CISTPL_POWER_VNOM]/10000;
                 
                 /* Do we need to allocate an interrupt? */
@@ -349,14 +318,14 @@ static void atmel_config(dev_link_t *link)
                 }
                 
                 /* This reserves IO space but doesn't actually enable it */
-                if (pcmcia_request_io(link->handle, &link->io) != 0)
+                if (pcmcia_request_io(link, &link->io) != 0)
                         goto next_entry;
 
                 /* If we got this far, we're cool! */
                 break;
                 
         next_entry:
-                CS_CHECK(GetNextTuple, pcmcia_get_next_tuple(handle, &tuple));
+                CS_CHECK(GetNextTuple, pcmcia_get_next_tuple(link, &tuple));
         }
         
         /*
@@ -365,14 +334,14 @@ static void atmel_config(dev_link_t *link)
           irq structure is initialized.
         */
         if (link->conf.Attributes & CONF_ENABLE_IRQ)
-                CS_CHECK(RequestIRQ, pcmcia_request_irq(link->handle, &link->irq));
+                CS_CHECK(RequestIRQ, pcmcia_request_irq(link, &link->irq));
         
         /*
           This actually configures the PCMCIA socket -- setting up
           the I/O windows and the interrupt mapping, and putting the
           card and host interface into "Memory and IO" mode.
         */
-        CS_CHECK(RequestConfiguration, pcmcia_request_configuration(link->handle, &link->conf));
+        CS_CHECK(RequestConfiguration, pcmcia_request_configuration(link, &link->conf));
         
         if (link->irq.AssignedIRQ == 0) {
                 printk(KERN_ALERT 
@@ -384,7 +353,7 @@ static void atmel_config(dev_link_t *link)
                 init_atmel_card(link->irq.AssignedIRQ,
                                 link->io.BasePort1,
                                 did ? did->driver_info : ATMEL_FW_TYPE_NONE,
-                                &handle_to_dev(handle),
+                                &handle_to_dev(link),
                                 card_present, 
                                 link);
         if (!((local_info_t*)link->priv)->eth_dev) 
@@ -393,18 +362,18 @@ static void atmel_config(dev_link_t *link)
         
         /*
           At this point, the dev_node_t structure(s) need to be
-          initialized and arranged in a linked list at link->dev.
+          initialized and arranged in a linked list at link->dev_node.
         */
         strcpy(dev->node.dev_name, ((local_info_t*)link->priv)->eth_dev->name );
         dev->node.major = dev->node.minor = 0;
-        link->dev = &dev->node;
-                        
-        link->state &= ~DEV_CONFIG_PENDING;
-        return;
-        
+        link->dev_node = &dev->node;
+
+        return 0;
+
  cs_failed:
-        cs_error(link->handle, last_fn, last_ret);
+        cs_error(link, last_fn, last_ret);
         atmel_release(link);
+        return -ENODEV;
 }
 
 /*======================================================================
@@ -415,53 +384,34 @@ static void atmel_config(dev_link_t *link)
   
   ======================================================================*/
 
-static void atmel_release(dev_link_t *link)
+static void atmel_release(struct pcmcia_device *link)
 {
         struct net_device *dev = ((local_info_t*)link->priv)->eth_dev;
-                
+
         DEBUG(0, "atmel_release(0x%p)\n", link);
-        
-        /* Unlink the device chain */
-        link->dev = NULL;
-        
-        if (dev) 
+
+        if (dev)
                 stop_atmel_card(dev);
-        ((local_info_t*)link->priv)->eth_dev = NULL; 
-        
-        /* Don't bother checking to see if these succeed or not */
-        pcmcia_release_configuration(link->handle);
-        if (link->io.NumPorts1)
-                pcmcia_release_io(link->handle, &link->io);
-        if (link->irq.AssignedIRQ)
-                pcmcia_release_irq(link->handle, &link->irq);
-        link->state &= ~DEV_CONFIG;
+        ((local_info_t*)link->priv)->eth_dev = NULL;
+
+        pcmcia_disable_device(link);
 }
 
-static int atmel_suspend(struct pcmcia_device *dev)
+static int atmel_suspend(struct pcmcia_device *link)
 {
-        dev_link_t *link = dev_to_instance(dev);
         local_info_t *local = link->priv;
 
-        link->state |= DEV_SUSPEND;
-        if (link->state & DEV_CONFIG) {
-                netif_device_detach(local->eth_dev);
-                pcmcia_release_configuration(link->handle);
-        }
+        netif_device_detach(local->eth_dev);
 
         return 0;
 }
 
-static int atmel_resume(struct pcmcia_device *dev)
+static int atmel_resume(struct pcmcia_device *link)
 {
-        dev_link_t *link = dev_to_instance(dev);
         local_info_t *local = link->priv;
 
-        link->state &= ~DEV_SUSPEND;
-        if (link->state & DEV_CONFIG) {
-                pcmcia_request_configuration(link->handle, &link->conf);
-                atmel_open(local->eth_dev);
-                netif_device_attach(local->eth_dev);
-        }
+        atmel_open(local->eth_dev);
+        netif_device_attach(local->eth_dev);
 
         return 0;
 }
@@ -515,7 +465,7 @@ static struct pcmcia_driver atmel_driver = {
         .drv            = {
                 .name   = "atmel_cs",
         },
-        .probe          = atmel_attach,
+        .probe          = atmel_probe,
         .remove         = atmel_detach,
         .id_table       = atmel_ids,
         .suspend        = atmel_suspend,
diff --git a/drivers/net/wireless/hostap/hostap_cs.c b/drivers/net/wireless/hostap/hostap_cs.c
index d335b250923a..55bed923fbe9 100644
--- a/drivers/net/wireless/hostap/hostap_cs.c
+++ b/drivers/net/wireless/hostap/hostap_cs.c
@@ -42,7 +42,7 @@ MODULE_PARM_DESC(ignore_cis_vcc, "Ignore broken CIS VCC entry");
 /* struct local_info::hw_priv */
 struct hostap_cs_priv {
         dev_node_t node;
-        dev_link_t *link;
+        struct pcmcia_device *link;
         int sandisk_connectplus;
 };
 
@@ -204,15 +204,13 @@ static int hfa384x_to_bap(struct net_device *dev, u16 bap, void *buf, int len)
 
 static void prism2_detach(struct pcmcia_device *p_dev);
 static void prism2_release(u_long arg);
-static int prism2_config(dev_link_t *link);
+static int prism2_config(struct pcmcia_device *link);
 
 
 static int prism2_pccard_card_present(local_info_t *local)
 {
         struct hostap_cs_priv *hw_priv = local->hw_priv;
-        if (hw_priv != NULL && hw_priv->link != NULL &&
-            ((hw_priv->link->state & (DEV_PRESENT | DEV_CONFIG)) ==
-             (DEV_PRESENT | DEV_CONFIG)))
+        if (hw_priv != NULL && hw_priv->link != NULL && pcmcia_dev_present(hw_priv->link))
                 return 1;
         return 0;
 }
@@ -237,7 +235,7 @@ static void sandisk_set_iobase(local_info_t *local)
         reg.Action = CS_WRITE;
         reg.Offset = 0x10; /* 0x3f0 IO base 1 */
         reg.Value = hw_priv->link->io.BasePort1 & 0x00ff;
-        res = pcmcia_access_configuration_register(hw_priv->link->handle,
+        res = pcmcia_access_configuration_register(hw_priv->link,
                                                    &reg);
         if (res != CS_SUCCESS) {
                 printk(KERN_DEBUG "Prism3 SanDisk - failed to set I/O base 0 -"
@@ -249,7 +247,7 @@ static void sandisk_set_iobase(local_info_t *local)
         reg.Action = CS_WRITE;
         reg.Offset = 0x12; /* 0x3f2 IO base 2 */
         reg.Value = (hw_priv->link->io.BasePort1 & 0xff00) >> 8;
-        res = pcmcia_access_configuration_register(hw_priv->link->handle,
+        res = pcmcia_access_configuration_register(hw_priv->link,
                                                    &reg);
         if (res != CS_SUCCESS) {
                 printk(KERN_DEBUG "Prism3 SanDisk - failed to set I/O base 1 -"
@@ -301,9 +299,9 @@ static int sandisk_enable_wireless(struct net_device *dev)
         tuple.TupleData = buf;
         tuple.TupleDataMax = sizeof(buf);
         tuple.TupleOffset = 0;
-        if (pcmcia_get_first_tuple(hw_priv->link->handle, &tuple) ||
-            pcmcia_get_tuple_data(hw_priv->link->handle, &tuple) ||
-            pcmcia_parse_tuple(hw_priv->link->handle, &tuple, parse) ||
+        if (pcmcia_get_first_tuple(hw_priv->link, &tuple) ||
+            pcmcia_get_tuple_data(hw_priv->link, &tuple) ||
+            pcmcia_parse_tuple(hw_priv->link, &tuple, parse) ||
             parse->manfid.manf != 0xd601 || parse->manfid.card != 0x0101) {
                 /* No SanDisk manfid found */
                 ret = -ENODEV;
@@ -311,9 +309,9 @@ static int sandisk_enable_wireless(struct net_device *dev)
         }
 
         tuple.DesiredTuple = CISTPL_LONGLINK_MFC;
-        if (pcmcia_get_first_tuple(hw_priv->link->handle, &tuple) ||
-            pcmcia_get_tuple_data(hw_priv->link->handle, &tuple) ||
-            pcmcia_parse_tuple(hw_priv->link->handle, &tuple, parse) ||
+        if (pcmcia_get_first_tuple(hw_priv->link, &tuple) ||
+            pcmcia_get_tuple_data(hw_priv->link, &tuple) ||
+            pcmcia_parse_tuple(hw_priv->link, &tuple, parse) ||
                 parse->longlink_mfc.nfn < 2) {
                 /* No multi-function links found */
                 ret = -ENODEV;
@@ -328,7 +326,7 @@ static int sandisk_enable_wireless(struct net_device *dev)
         reg.Action = CS_WRITE;
         reg.Offset = CISREG_COR;
         reg.Value = COR_SOFT_RESET;
-        res = pcmcia_access_configuration_register(hw_priv->link->handle,
+        res = pcmcia_access_configuration_register(hw_priv->link,
                                                    &reg);
         if (res != CS_SUCCESS) {
                 printk(KERN_DEBUG "%s: SanDisk - COR sreset failed (%d)\n",
@@ -345,7 +343,7 @@ static int sandisk_enable_wireless(struct net_device *dev)
          * will be enabled during the first cor_sreset call.
          */
         reg.Value = COR_LEVEL_REQ | 0x8 | COR_ADDR_DECODE | COR_FUNC_ENA;
-        res = pcmcia_access_configuration_register(hw_priv->link->handle,
+        res = pcmcia_access_configuration_register(hw_priv->link,
                                                    &reg);
         if (res != CS_SUCCESS) {
                 printk(KERN_DEBUG "%s: SanDisk - COR sreset failed (%d)\n",
@@ -380,7 +378,7 @@ static void prism2_pccard_cor_sreset(local_info_t *local)
         reg.Action = CS_READ;
         reg.Offset = CISREG_COR;
         reg.Value = 0;
-        res = pcmcia_access_configuration_register(hw_priv->link->handle,
+        res = pcmcia_access_configuration_register(hw_priv->link,
                                                    &reg);
         if (res != CS_SUCCESS) {
                 printk(KERN_DEBUG "prism2_pccard_cor_sreset failed 1 (%d)\n",
@@ -392,7 +390,7 @@ static void prism2_pccard_cor_sreset(local_info_t *local)
 
         reg.Action = CS_WRITE;
         reg.Value |= COR_SOFT_RESET;
-        res = pcmcia_access_configuration_register(hw_priv->link->handle,
+        res = pcmcia_access_configuration_register(hw_priv->link,
                                                    &reg);
         if (res != CS_SUCCESS) {
                 printk(KERN_DEBUG "prism2_pccard_cor_sreset failed 2 (%d)\n",
@@ -405,7 +403,7 @@ static void prism2_pccard_cor_sreset(local_info_t *local)
         reg.Value &= ~COR_SOFT_RESET;
         if (hw_priv->sandisk_connectplus)
                 reg.Value |= COR_IREQ_ENA;
-        res = pcmcia_access_configuration_register(hw_priv->link->handle,
+        res = pcmcia_access_configuration_register(hw_priv->link,
                                                    &reg);
         if (res != CS_SUCCESS) {
                 printk(KERN_DEBUG "prism2_pccard_cor_sreset failed 3 (%d)\n",
@@ -439,7 +437,7 @@ static void prism2_pccard_genesis_reset(local_info_t *local, int hcr)
         reg.Action = CS_READ;
         reg.Offset = CISREG_COR;
         reg.Value = 0;
-        res = pcmcia_access_configuration_register(hw_priv->link->handle,
+        res = pcmcia_access_configuration_register(hw_priv->link,
                                                    &reg);
         if (res != CS_SUCCESS) {
                 printk(KERN_DEBUG "prism2_pccard_genesis_sreset failed 1 "
@@ -452,7 +450,7 @@ static void prism2_pccard_genesis_reset(local_info_t *local, int hcr)
 
         reg.Action = CS_WRITE;
         reg.Value |= COR_SOFT_RESET;
-        res = pcmcia_access_configuration_register(hw_priv->link->handle,
+        res = pcmcia_access_configuration_register(hw_priv->link,
                                                    &reg);
         if (res != CS_SUCCESS) {
                 printk(KERN_DEBUG "prism2_pccard_genesis_sreset failed 2 "
@@ -466,7 +464,7 @@ static void prism2_pccard_genesis_reset(local_info_t *local, int hcr)
         reg.Action = CS_WRITE;
         reg.Value = hcr;
         reg.Offset = CISREG_CCSR;
-        res = pcmcia_access_configuration_register(hw_priv->link->handle,
+        res = pcmcia_access_configuration_register(hw_priv->link,
                                                    &reg);
         if (res != CS_SUCCESS) {
                 printk(KERN_DEBUG "prism2_pccard_genesis_sreset failed 3 "
@@ -478,7 +476,7 @@ static void prism2_pccard_genesis_reset(local_info_t *local, int hcr)
         reg.Action = CS_WRITE;
         reg.Offset = CISREG_COR;
         reg.Value = old_cor & ~COR_SOFT_RESET;
-        res = pcmcia_access_configuration_register(hw_priv->link->handle,
+        res = pcmcia_access_configuration_register(hw_priv->link,
                                                    &reg);
         if (res != CS_SUCCESS) {
                 printk(KERN_DEBUG "prism2_pccard_genesis_sreset failed 4 "
@@ -501,40 +499,27 @@ static struct prism2_helper_functions prism2_pccard_funcs =
 
 /* allocate local data and register with CardServices
  * initialize dev_link structure, but do not configure the card yet */
-static int prism2_attach(struct pcmcia_device *p_dev)
+static int hostap_cs_probe(struct pcmcia_device *p_dev)
 {
-        dev_link_t *link;
-
-        link = kmalloc(sizeof(dev_link_t), GFP_KERNEL);
-        if (link == NULL)
-                return -ENOMEM;
-
-        memset(link, 0, sizeof(dev_link_t));
+        int ret;
 
         PDEBUG(DEBUG_HW, "%s: setting Vcc=33 (constant)\n", dev_info);
-        link->conf.Vcc = 33;
-        link->conf.IntType = INT_MEMORY_AND_IO;
-
-        link->handle = p_dev;
-        p_dev->instance = link;
+        p_dev->conf.IntType = INT_MEMORY_AND_IO;
 
-        link->state |= DEV_PRESENT | DEV_CONFIG_PENDING;
-        if (prism2_config(link))
+        ret = prism2_config(p_dev);
+        if (ret) {
                 PDEBUG(DEBUG_EXTRA, "prism2_config() failed\n");
+        }
 
-        return 0;
+        return ret;
 }
 
 
-static void prism2_detach(struct pcmcia_device *p_dev)
+static void prism2_detach(struct pcmcia_device *link)
 {
-        dev_link_t *link = dev_to_instance(p_dev);
-
         PDEBUG(DEBUG_FLOW, "prism2_detach\n");
 
-        if (link->state & DEV_CONFIG) {
-                prism2_release((u_long)link);
-        }
+        prism2_release((u_long)link);
 
         /* release net devices */
         if (link->priv) {
@@ -547,7 +532,6 @@ static void prism2_detach(struct pcmcia_device *p_dev)
                 prism2_free_local_data(dev);
                 kfree(hw_priv);
         }
-        kfree(link);
 }
 
 
@@ -558,7 +542,7 @@ do { last_fn = (fn); if ((last_ret = (ret)) != 0) goto cs_failed; } while (0)
 do { int ret = (retf); \
 if (ret != 0) { \
         PDEBUG(DEBUG_EXTRA, "CardServices(" #fn ") returned %d\n", ret); \
-        cs_error(link->handle, fn, ret); \
+        cs_error(link, fn, ret); \
         goto next_entry; \
 } \
 } while (0)
@@ -566,7 +550,7 @@ if (ret != 0) { \
 
 /* run after a CARD_INSERTION event is received to configure the PCMCIA
  * socket and make the device available to the system */
-static int prism2_config(dev_link_t *link)
+static int prism2_config(struct pcmcia_device *link)
 {
         struct net_device *dev;
         struct hostap_interface *iface;
@@ -595,27 +579,24 @@ static int prism2_config(dev_link_t *link)
         tuple.TupleData = buf;
         tuple.TupleDataMax = sizeof(buf);
         tuple.TupleOffset = 0;
-        CS_CHECK(GetFirstTuple, pcmcia_get_first_tuple(link->handle, &tuple));
-        CS_CHECK(GetTupleData, pcmcia_get_tuple_data(link->handle, &tuple));
-        CS_CHECK(ParseTuple, pcmcia_parse_tuple(link->handle, &tuple, parse));
+        CS_CHECK(GetFirstTuple, pcmcia_get_first_tuple(link, &tuple));
+        CS_CHECK(GetTupleData, pcmcia_get_tuple_data(link, &tuple));
+        CS_CHECK(ParseTuple, pcmcia_parse_tuple(link, &tuple, parse));
         link->conf.ConfigBase = parse->config.base;
         link->conf.Present = parse->config.rmask[0];
 
         CS_CHECK(GetConfigurationInfo,
-                 pcmcia_get_configuration_info(link->handle, &conf));
-        PDEBUG(DEBUG_HW, "%s: %s Vcc=%d (from config)\n", dev_info,
-               ignore_cis_vcc ? "ignoring" : "setting", conf.Vcc);
-        link->conf.Vcc = conf.Vcc;
+                 pcmcia_get_configuration_info(link, &conf));
 
         /* Look for an appropriate configuration table entry in the CIS */
         tuple.DesiredTuple = CISTPL_CFTABLE_ENTRY;
-        CS_CHECK(GetFirstTuple, pcmcia_get_first_tuple(link->handle, &tuple));
+        CS_CHECK(GetFirstTuple, pcmcia_get_first_tuple(link, &tuple));
         for (;;) {
                 cistpl_cftable_entry_t *cfg = &(parse->cftable_entry);
                 CFG_CHECK2(GetTupleData,
-                           pcmcia_get_tuple_data(link->handle, &tuple));
+                           pcmcia_get_tuple_data(link, &tuple));
                 CFG_CHECK2(ParseTuple,
-                           pcmcia_parse_tuple(link->handle, &tuple, parse));
+                           pcmcia_parse_tuple(link, &tuple, parse));
 
                 if (cfg->flags & CISTPL_CFTABLE_DEFAULT)
                         dflt = *cfg;
@@ -650,10 +631,10 @@ static int prism2_config(dev_link_t *link)
                 }
 
                 if (cfg->vpp1.present & (1 << CISTPL_POWER_VNOM))
-                        link->conf.Vpp1 = link->conf.Vpp2 =
+                        link->conf.Vpp =
                                 cfg->vpp1.param[CISTPL_POWER_VNOM] / 10000;
                 else if (dflt.vpp1.present & (1 << CISTPL_POWER_VNOM))
-                        link->conf.Vpp1 = link->conf.Vpp2 =
+                        link->conf.Vpp =
                                 dflt.vpp1.param[CISTPL_POWER_VNOM] / 10000;
 
                 /* Do we need to allocate an interrupt? */
@@ -695,19 +676,19 @@ static int prism2_config(dev_link_t *link)
 
                 /* This reserves IO space but doesn't actually enable it */
                 CFG_CHECK2(RequestIO,
-                           pcmcia_request_io(link->handle, &link->io));
+                           pcmcia_request_io(link, &link->io));
 
                 /* This configuration table entry is OK */
                 break;
 
         next_entry:
                 CS_CHECK(GetNextTuple,
-                         pcmcia_get_next_tuple(link->handle, &tuple));
+                         pcmcia_get_next_tuple(link, &tuple));
         }
 
         /* Need to allocate net_device before requesting IRQ handler */
         dev = prism2_init_local_data(&prism2_pccard_funcs, 0,
-                                     &handle_to_dev(link->handle));
+                                     &handle_to_dev(link));
         if (dev == NULL)
                 goto failed;
         link->priv = dev;
@@ -717,7 +698,7 @@ static int prism2_config(dev_link_t *link)
         local->hw_priv = hw_priv;
         hw_priv->link = link;
         strcpy(hw_priv->node.dev_name, dev->name);
-        link->dev = &hw_priv->node;
+        link->dev_node = &hw_priv->node;
 
         /*
          * Allocate an interrupt line.  Note that this does not assign a
@@ -730,7 +711,7 @@ static int prism2_config(dev_link_t *link)
                 link->irq.Handler = prism2_interrupt;
                 link->irq.Instance = dev;
                 CS_CHECK(RequestIRQ,
-                         pcmcia_request_irq(link->handle, &link->irq));
+                         pcmcia_request_irq(link, &link->irq));
         }
 
         /*
@@ -739,18 +720,17 @@ static int prism2_config(dev_link_t *link)
          * card and host interface into "Memory and IO" mode.
          */
         CS_CHECK(RequestConfiguration,
-                 pcmcia_request_configuration(link->handle, &link->conf));
+                 pcmcia_request_configuration(link, &link->conf));
 
         dev->irq = link->irq.AssignedIRQ;
         dev->base_addr = link->io.BasePort1;
 
         /* Finally, report what we've done */
-        printk(KERN_INFO "%s: index 0x%02x: Vcc %d.%d",
-               dev_info, link->conf.ConfigIndex,
-               link->conf.Vcc / 10, link->conf.Vcc % 10);
-        if (link->conf.Vpp1)
-                printk(", Vpp %d.%d", link->conf.Vpp1 / 10,
-                       link->conf.Vpp1 % 10);
+        printk(KERN_INFO "%s: index 0x%02x: ",
+               dev_info, link->conf.ConfigIndex);
+        if (link->conf.Vpp)
+                printk(", Vpp %d.%d", link->conf.Vpp / 10,
+                       link->conf.Vpp % 10);
         if (link->conf.Attributes & CONF_ENABLE_IRQ)
                 printk(", irq %d", link->irq.AssignedIRQ);
         if (link->io.NumPorts1)
@@ -761,9 +741,6 @@ static int prism2_config(dev_link_t *link)
                        link->io.BasePort2+link->io.NumPorts2-1);
         printk("\n");
 
-        link->state |= DEV_CONFIG;
-        link->state &= ~DEV_CONFIG_PENDING;
-
         local->shutdown = 0;
 
         sandisk_enable_wireless(dev);
@@ -778,7 +755,7 @@ static int prism2_config(dev_link_t *link)
         return ret;
 
  cs_failed:
-        cs_error(link->handle, last_fn, last_ret);
+        cs_error(link, last_fn, last_ret);
 
  failed:
         kfree(parse);
@@ -790,7 +767,7 @@ static int prism2_config(dev_link_t *link)
 
 static void prism2_release(u_long arg)
 {
-        dev_link_t *link = (dev_link_t *)arg;
+        struct pcmcia_device *link = (struct pcmcia_device *)arg;
 
         PDEBUG(DEBUG_FLOW, "prism2_release\n");
 
@@ -799,71 +776,54 @@ static void prism2_release(u_long arg)
                 struct hostap_interface *iface;
 
                 iface = netdev_priv(dev);
-                if (link->state & DEV_CONFIG)
-                        prism2_hw_shutdown(dev, 0);
+                prism2_hw_shutdown(dev, 0);
                 iface->local->shutdown = 1;
         }
 
-        if (link->win)
-                pcmcia_release_window(link->win);
-        pcmcia_release_configuration(link->handle);
-        if (link->io.NumPorts1)
-                pcmcia_release_io(link->handle, &link->io);
-        if (link->irq.AssignedIRQ)
-                pcmcia_release_irq(link->handle, &link->irq);
-
-        link->state &= ~DEV_CONFIG;
-
+        pcmcia_disable_device(link);
         PDEBUG(DEBUG_FLOW, "release - done\n");
 }
 
-static int hostap_cs_suspend(struct pcmcia_device *p_dev)
+static int hostap_cs_suspend(struct pcmcia_device *link)
 {
-        dev_link_t *link = dev_to_instance(p_dev);
         struct net_device *dev = (struct net_device *) link->priv;
         int dev_open = 0;
+        struct hostap_interface *iface = NULL;
 
-        PDEBUG(DEBUG_EXTRA, "%s: CS_EVENT_PM_SUSPEND\n", dev_info);
-
-        link->state |= DEV_SUSPEND;
+        if (dev)
+                iface = netdev_priv(dev);
 
-        if (link->state & DEV_CONFIG) {
-                struct hostap_interface *iface = netdev_priv(dev);
-                if (iface && iface->local)
-                        dev_open = iface->local->num_dev_open > 0;
-                if (dev_open) {
-                        netif_stop_queue(dev);
-                        netif_device_detach(dev);
-                }
-                prism2_suspend(dev);
-                pcmcia_release_configuration(link->handle);
+        PDEBUG(DEBUG_EXTRA, "%s: CS_EVENT_PM_SUSPEND\n", dev_info);
+        if (iface && iface->local)
+                dev_open = iface->local->num_dev_open > 0;
+        if (dev_open) {
+                netif_stop_queue(dev);
+                netif_device_detach(dev);
         }
+        prism2_suspend(dev);
 
         return 0;
 }
 
-static int hostap_cs_resume(struct pcmcia_device *p_dev)
+static int hostap_cs_resume(struct pcmcia_device *link)
 {
-        dev_link_t *link = dev_to_instance(p_dev);
         struct net_device *dev = (struct net_device *) link->priv;
         int dev_open = 0;
+        struct hostap_interface *iface = NULL;
 
-        PDEBUG(DEBUG_EXTRA, "%s: CS_EVENT_PM_RESUME\n", dev_info);
+        if (dev)
+                iface = netdev_priv(dev);
 
-        link->state &= ~DEV_SUSPEND;
-        if (link->state & DEV_CONFIG) {
-                struct hostap_interface *iface = netdev_priv(dev);
-                if (iface && iface->local)
-                        dev_open = iface->local->num_dev_open > 0;
+        PDEBUG(DEBUG_EXTRA, "%s: CS_EVENT_PM_RESUME\n", dev_info);
 
-                pcmcia_request_configuration(link->handle, &link->conf);
+        if (iface && iface->local)
+                dev_open = iface->local->num_dev_open > 0;
 
-                prism2_hw_shutdown(dev, 1);
-                prism2_hw_config(dev, dev_open ? 0 : 1);
-                if (dev_open) {
-                        netif_device_attach(dev);
-                        netif_start_queue(dev);
-                }
+        prism2_hw_shutdown(dev, 1);
+        prism2_hw_config(dev, dev_open ? 0 : 1);
+        if (dev_open) {
+                netif_device_attach(dev);
+                netif_start_queue(dev);
         }
 
         return 0;
@@ -930,7 +890,7 @@ static struct pcmcia_driver hostap_driver = {
         .drv            = {
                 .name   = "hostap_cs",
         },
-        .probe          = prism2_attach,
+        .probe          = hostap_cs_probe,
         .remove         = prism2_detach,
         .owner          = THIS_MODULE,
         .id_table       = hostap_cs_ids,
diff --git a/drivers/net/wireless/ipw2200.c b/drivers/net/wireless/ipw2200.c
index 9dce522526c5..bca89cff85a6 100644
--- a/drivers/net/wireless/ipw2200.c
+++ b/drivers/net/wireless/ipw2200.c
@@ -5573,8 +5573,7 @@ static void ipw_adhoc_create(struct ipw_priv *priv,
         case IEEE80211_52GHZ_BAND:
                 network->mode = IEEE_A;
                 i = ieee80211_channel_to_index(priv->ieee, priv->channel);
-                if (i == -1)
-                        BUG();
+                BUG_ON(i == -1);
                 if (geo->a[i].flags & IEEE80211_CH_PASSIVE_ONLY) {
                         IPW_WARNING("Overriding invalid channel\n");
                         priv->channel = geo->a[0].channel;
@@ -5587,8 +5586,7 @@ static void ipw_adhoc_create(struct ipw_priv *priv,
                 else
                         network->mode = IEEE_B;
                 i = ieee80211_channel_to_index(priv->ieee, priv->channel);
-                if (i == -1)
-                        BUG();
+                BUG_ON(i == -1);
                 if (geo->bg[i].flags & IEEE80211_CH_PASSIVE_ONLY) {
                         IPW_WARNING("Overriding invalid channel\n");
                         priv->channel = geo->bg[0].channel;
@@ -6715,8 +6713,7 @@ static int ipw_qos_association(struct ipw_priv *priv,
 
         switch (priv->ieee->iw_mode) {
         case IW_MODE_ADHOC:
-                if (!(network->capability & WLAN_CAPABILITY_IBSS))
-                        BUG();
+                BUG_ON(!(network->capability & WLAN_CAPABILITY_IBSS));
 
                 qos_data = &ibss_data;
                 break;
diff --git a/drivers/net/wireless/netwave_cs.c b/drivers/net/wireless/netwave_cs.c
index 75ce6ddb0cf5..9343d970537b 100644
--- a/drivers/net/wireless/netwave_cs.c
+++ b/drivers/net/wireless/netwave_cs.c
@@ -190,8 +190,8 @@ module_param(mem_speed, int, 0);
 /*====================================================================*/
 
 /* PCMCIA (Card Services) related functions */
-static void netwave_release(dev_link_t *link);     /* Card removal */
-static void netwave_pcmcia_config(dev_link_t *arg); /* Runs after card 
+static void netwave_release(struct pcmcia_device *link);     /* Card removal */
+static int netwave_pcmcia_config(struct pcmcia_device *arg); /* Runs after card
                                                                                                            insertion */
 static void netwave_detach(struct pcmcia_device *p_dev);    /* Destroy instance */
 
@@ -221,10 +221,10 @@ static struct iw_statistics* netwave_get_wireless_stats(struct net_device *dev);
 static void set_multicast_list(struct net_device *dev);
 
 /*
-   A dev_link_t structure has fields for most things that are needed
+   A struct pcmcia_device structure has fields for most things that are needed
    to keep track of a socket, but there will usually be some device
    specific information that also needs to be kept track of.  The
-   'priv' pointer in a dev_link_t structure can be used to point to
+   'priv' pointer in a struct pcmcia_device structure can be used to point to
    a device-specific private data structure, like this.
 
    A driver needs to provide a dev_node_t structure for each device
@@ -232,7 +232,7 @@ static void set_multicast_list(struct net_device *dev);
    example, ethernet cards, modems).  In other cases, there may be
    many actual or logical devices (SCSI adapters, memory cards with
    multiple partitions).  The dev_node_t structures need to be kept
-   in a linked list starting at the 'dev' field of a dev_link_t
+   in a linked list starting at the 'dev' field of a struct pcmcia_device
    structure.  We allocate them in the card's private data structure,
    because they generally can't be allocated dynamically.
 */
@@ -268,7 +268,7 @@ struct site_survey {
 };      
    
 typedef struct netwave_private {
-    dev_link_t link;
+        struct pcmcia_device    *p_dev;
     spinlock_t  spinlock;       /* Serialize access to the hardware (SMP) */
     dev_node_t node;
     u_char     __iomem *ramBase;
@@ -376,20 +376,19 @@ static struct iw_statistics *netwave_get_wireless_stats(struct net_device *dev)
  *     configure the card at this point -- we wait until we receive a
  *     card insertion event.
  */
-static int netwave_attach(struct pcmcia_device *p_dev)
+static int netwave_probe(struct pcmcia_device *link)
 {
-    dev_link_t *link;
     struct net_device *dev;
     netwave_private *priv;
 
     DEBUG(0, "netwave_attach()\n");
 
-    /* Initialize the dev_link_t structure */
+    /* Initialize the struct pcmcia_device structure */
     dev = alloc_etherdev(sizeof(netwave_private));
     if (!dev)
         return -ENOMEM;
     priv = netdev_priv(dev);
-    link = &priv->link;
+    priv->p_dev = link;
     link->priv = dev;
 
     /* The io structure describes IO port mapping */
@@ -406,7 +405,6 @@ static int netwave_attach(struct pcmcia_device *p_dev)
     
     /* General socket configuration */
     link->conf.Attributes = CONF_ENABLE_IRQ;
-    link->conf.Vcc = 50;
     link->conf.IntType = INT_MEMORY_AND_IO;
     link->conf.ConfigIndex = 1;
     link->conf.Present = PRESENT_OPTION;
@@ -430,13 +428,7 @@ static int netwave_attach(struct pcmcia_device *p_dev)
     dev->stop = &netwave_close;
     link->irq.Instance = dev;
 
-    link->handle = p_dev;
-    p_dev->instance = link;
-
-    link->state |= DEV_PRESENT | DEV_CONFIG_PENDING;
-    netwave_pcmcia_config( link);
-
-    return 0;
+    return netwave_pcmcia_config( link);
 } /* netwave_attach */
 
 /*
@@ -447,17 +439,15 @@ static int netwave_attach(struct pcmcia_device *p_dev)
  *    structures are freed.  Otherwise, the structures will be freed
  *    when the device is released.
  */
-static void netwave_detach(struct pcmcia_device *p_dev)
+static void netwave_detach(struct pcmcia_device *link)
 {
-        dev_link_t *link = dev_to_instance(p_dev);
         struct net_device *dev = link->priv;
 
         DEBUG(0, "netwave_detach(0x%p)\n", link);
 
-        if (link->state & DEV_CONFIG)
-                netwave_release(link);
+        netwave_release(link);
 
-        if (link->dev)
+        if (link->dev_node)
                 unregister_netdev(dev);
 
         free_netdev(dev);
@@ -743,8 +733,7 @@ static const struct iw_handler_def	netwave_handler_def =
 #define CS_CHECK(fn, ret) \
 do { last_fn = (fn); if ((last_ret = (ret)) != 0) goto cs_failed; } while (0)
 
-static void netwave_pcmcia_config(dev_link_t *link) {
-    client_handle_t handle = link->handle;
+static int netwave_pcmcia_config(struct pcmcia_device *link) {
     struct net_device *dev = link->priv;
     netwave_private *priv = netdev_priv(dev);
     tuple_t tuple;
@@ -766,15 +755,12 @@ static void netwave_pcmcia_config(dev_link_t *link) {
     tuple.TupleDataMax = 64;
     tuple.TupleOffset = 0;
     tuple.DesiredTuple = CISTPL_CONFIG;
-    CS_CHECK(GetFirstTuple, pcmcia_get_first_tuple(handle, &tuple));
-    CS_CHECK(GetTupleData, pcmcia_get_tuple_data(handle, &tuple));
-    CS_CHECK(ParseTuple, pcmcia_parse_tuple(handle, &tuple, &parse));
+    CS_CHECK(GetFirstTuple, pcmcia_get_first_tuple(link, &tuple));
+    CS_CHECK(GetTupleData, pcmcia_get_tuple_data(link, &tuple));
+    CS_CHECK(ParseTuple, pcmcia_parse_tuple(link, &tuple, &parse));
     link->conf.ConfigBase = parse.config.base;
     link->conf.Present = parse.config.rmask[0];
 
-    /* Configure card */
-    link->state |= DEV_CONFIG;
-
     /*
      *  Try allocating IO ports.  This tries a few fixed addresses.
      *  If you want, you can also read the card's config table to
@@ -782,11 +768,11 @@ static void netwave_pcmcia_config(dev_link_t *link) {
      */
     for (i = j = 0x0; j < 0x400; j += 0x20) {
         link->io.BasePort1 = j ^ 0x300;
-        i = pcmcia_request_io(link->handle, &link->io);
+        i = pcmcia_request_io(link, &link->io);
         if (i == CS_SUCCESS) break;
     }
     if (i != CS_SUCCESS) {
-        cs_error(link->handle, RequestIO, i);
+        cs_error(link, RequestIO, i);
         goto failed;
     }
 
@@ -794,16 +780,16 @@ static void netwave_pcmcia_config(dev_link_t *link) {
      *  Now allocate an interrupt line.  Note that this does not
      *  actually assign a handler to the interrupt.
      */
-    CS_CHECK(RequestIRQ, pcmcia_request_irq(handle, &link->irq));
+    CS_CHECK(RequestIRQ, pcmcia_request_irq(link, &link->irq));
 
     /*
      *  This actually configures the PCMCIA socket -- setting up
      *  the I/O windows and the interrupt mapping.
      */
-    CS_CHECK(RequestConfiguration, pcmcia_request_configuration(handle, &link->conf));
+    CS_CHECK(RequestConfiguration, pcmcia_request_configuration(link, &link->conf));
 
     /*
-     *  Allocate a 32K memory window.  Note that the dev_link_t
+     *  Allocate a 32K memory window.  Note that the struct pcmcia_device
      *  structure provides space for one window handle -- if your
      *  device needs several windows, you'll need to keep track of
      *  the handles in your private data structure, dev->priv.
@@ -813,7 +799,7 @@ static void netwave_pcmcia_config(dev_link_t *link) {
     req.Attributes = WIN_DATA_WIDTH_8|WIN_MEMORY_TYPE_CM|WIN_ENABLE;
     req.Base = 0; req.Size = 0x8000;
     req.AccessSpeed = mem_speed;
-    CS_CHECK(RequestWindow, pcmcia_request_window(&link->handle, &req, &link->win));
+    CS_CHECK(RequestWindow, pcmcia_request_window(&link, &req, &link->win));
     mem.CardOffset = 0x20000; mem.Page = 0; 
     CS_CHECK(MapMemPage, pcmcia_map_mem_page(link->win, &mem));
 
@@ -823,7 +809,7 @@ static void netwave_pcmcia_config(dev_link_t *link) {
 
     dev->irq = link->irq.AssignedIRQ;
     dev->base_addr = link->io.BasePort1;
-    SET_NETDEV_DEV(dev, &handle_to_dev(handle));
+    SET_NETDEV_DEV(dev, &handle_to_dev(link));
 
     if (register_netdev(dev) != 0) {
         printk(KERN_DEBUG "netwave_cs: register_netdev() failed\n");
@@ -831,8 +817,7 @@ static void netwave_pcmcia_config(dev_link_t *link) {
     }
 
     strcpy(priv->node.dev_name, dev->name);
-    link->dev = &priv->node;
-    link->state &= ~DEV_CONFIG_PENDING;
+    link->dev_node = &priv->node;
 
     /* Reset card before reading physical address */
     netwave_doreset(dev->base_addr, ramBase);
@@ -852,12 +837,13 @@ static void netwave_pcmcia_config(dev_link_t *link) {
     printk(KERN_DEBUG "Netwave_reset: revision %04x %04x\n", 
            get_uint16(ramBase + NETWAVE_EREG_ARW),
            get_uint16(ramBase + NETWAVE_EREG_ARW+2));
-    return;
+    return 0;
 
 cs_failed:
-    cs_error(link->handle, last_fn, last_ret);
+    cs_error(link, last_fn, last_ret);
 failed:
     netwave_release(link);
+    return -ENODEV;
 } /* netwave_pcmcia_config */
 
 /*
@@ -867,52 +853,35 @@ failed:
  *    device, and release the PCMCIA configuration.  If the device is
  *    still open, this will be postponed until it is closed.
  */
-static void netwave_release(dev_link_t *link)
+static void netwave_release(struct pcmcia_device *link)
 {
-    struct net_device *dev = link->priv;
-    netwave_private *priv = netdev_priv(dev);
-
-    DEBUG(0, "netwave_release(0x%p)\n", link);
+        struct net_device *dev = link->priv;
+        netwave_private *priv = netdev_priv(dev);
 
-    /* Don't bother checking to see if these succeed or not */
-    if (link->win) {
-        iounmap(priv->ramBase);
-        pcmcia_release_window(link->win);
-    }
-    pcmcia_release_configuration(link->handle);
-    pcmcia_release_io(link->handle, &link->io);
-    pcmcia_release_irq(link->handle, &link->irq);
+        DEBUG(0, "netwave_release(0x%p)\n", link);
 
-    link->state &= ~DEV_CONFIG;
+        pcmcia_disable_device(link);
+        if (link->win)
+                iounmap(priv->ramBase);
 }
 
-static int netwave_suspend(struct pcmcia_device *p_dev)
+static int netwave_suspend(struct pcmcia_device *link)
 {
-        dev_link_t *link = dev_to_instance(p_dev);
         struct net_device *dev = link->priv;
 
-        link->state |= DEV_SUSPEND;
-        if (link->state & DEV_CONFIG) {
-                if (link->open)
-                        netif_device_detach(dev);
-                pcmcia_release_configuration(link->handle);
-        }
+        if (link->open)
+                netif_device_detach(dev);
 
         return 0;
 }
 
-static int netwave_resume(struct pcmcia_device *p_dev)
+static int netwave_resume(struct pcmcia_device *link)
 {
-        dev_link_t *link = dev_to_instance(p_dev);
         struct net_device *dev = link->priv;
 
-        link->state &= ~DEV_SUSPEND;
-        if (link->state & DEV_CONFIG) {
-                pcmcia_request_configuration(link->handle, &link->conf);
-                if (link->open) {
-                        netwave_reset(dev);
-                        netif_device_attach(dev);
-                }
+        if (link->open) {
+                netwave_reset(dev);
+                netif_device_attach(dev);
         }
 
         return 0;
@@ -1119,7 +1088,7 @@ static irqreturn_t netwave_interrupt(int irq, void* dev_id, struct pt_regs *regs
     u_char __iomem *ramBase;
     struct net_device *dev = (struct net_device *)dev_id;
     struct netwave_private *priv = netdev_priv(dev);
-    dev_link_t *link = &priv->link;
+    struct pcmcia_device *link = priv->p_dev;
     int i;
     
     if (!netif_device_present(dev))
@@ -1138,7 +1107,7 @@ static irqreturn_t netwave_interrupt(int irq, void* dev_id, struct pt_regs *regs
         
         status = inb(iobase + NETWAVE_REG_ASR);
                 
-        if (!DEV_OK(link)) {
+        if (!pcmcia_dev_present(link)) {
             DEBUG(1, "netwave_interrupt: Interrupt with status 0x%x "
                   "from removed or suspended card!\n", status);
             break;
@@ -1373,11 +1342,11 @@ static int netwave_rx(struct net_device *dev)
 
 static int netwave_open(struct net_device *dev) {
     netwave_private *priv = netdev_priv(dev);
-    dev_link_t *link = &priv->link;
+    struct pcmcia_device *link = priv->p_dev;
 
     DEBUG(1, "netwave_open: starting.\n");
     
-    if (!DEV_OK(link))
+    if (!pcmcia_dev_present(link))
         return -ENODEV;
 
     link->open++;
@@ -1390,7 +1359,7 @@ static int netwave_open(struct net_device *dev) {
 
 static int netwave_close(struct net_device *dev) {
     netwave_private *priv = netdev_priv(dev);
-    dev_link_t *link = &priv->link;
+    struct pcmcia_device *link = priv->p_dev;
 
     DEBUG(1, "netwave_close: finishing.\n");
 
@@ -1411,7 +1380,7 @@ static struct pcmcia_driver netwave_driver = {
         .drv            = {
                 .name   = "netwave_cs",
         },
-        .probe          = netwave_attach,
+        .probe          = netwave_probe,
         .remove         = netwave_detach,
         .id_table       = netwave_ids,
         .suspend        = netwave_suspend,
diff --git a/drivers/net/wireless/orinoco_cs.c b/drivers/net/wireless/orinoco_cs.c
index ec6f2a48895b..434f7d7ad841 100644
--- a/drivers/net/wireless/orinoco_cs.c
+++ b/drivers/net/wireless/orinoco_cs.c
@@ -49,7 +49,7 @@ MODULE_PARM_DESC(ignore_cis_vcc, "Allow voltage mismatch between card and socket
 /* PCMCIA specific device information (goes in the card field of
  * struct orinoco_private */
 struct orinoco_pccard {
-        dev_link_t link;
+        struct pcmcia_device    *p_dev;
         dev_node_t node;
 
         /* Used to handle hard reset */
@@ -63,8 +63,8 @@ struct orinoco_pccard {
 /* Function prototypes                                              */
 /********************************************************************/
 
-static void orinoco_cs_config(dev_link_t *link);
-static void orinoco_cs_release(dev_link_t *link);
+static int orinoco_cs_config(struct pcmcia_device *link);
+static void orinoco_cs_release(struct pcmcia_device *link);
 static void orinoco_cs_detach(struct pcmcia_device *p_dev);
 
 /********************************************************************/
@@ -75,13 +75,13 @@ static int
 orinoco_cs_hard_reset(struct orinoco_private *priv)
 {
         struct orinoco_pccard *card = priv->card;
-        dev_link_t *link = &card->link;
+        struct pcmcia_device *link = card->p_dev;
         int err;
 
         /* We need atomic ops here, because we're not holding the lock */
         set_bit(0, &card->hard_reset_in_progress);
 
-        err = pcmcia_reset_card(link->handle, NULL);
+        err = pcmcia_reset_card(link, NULL);
         if (err)
                 return err;
 
@@ -104,12 +104,11 @@ orinoco_cs_hard_reset(struct orinoco_private *priv)
  * configure the card at this point -- we wait until we receive a card
  * insertion event.  */
 static int
-orinoco_cs_attach(struct pcmcia_device *p_dev)
+orinoco_cs_probe(struct pcmcia_device *link)
 {
         struct net_device *dev;
         struct orinoco_private *priv;
         struct orinoco_pccard *card;
-        dev_link_t *link;
 
         dev = alloc_orinocodev(sizeof(*card), orinoco_cs_hard_reset);
         if (! dev)
@@ -118,7 +117,7 @@ orinoco_cs_attach(struct pcmcia_device *p_dev)
         card = priv->card;
 
         /* Link both structures together */
-        link = &card->link;
+        card->p_dev = link;
         link->priv = dev;
 
         /* Interrupt setup */
@@ -135,16 +134,7 @@ orinoco_cs_attach(struct pcmcia_device *p_dev)
         link->conf.Attributes = 0;
         link->conf.IntType = INT_MEMORY_AND_IO;
 
-        /* Register with Card Services */
-        link->next = NULL;
-
-        link->handle = p_dev;
-        p_dev->instance = link;
-
-        link->state |= DEV_PRESENT | DEV_CONFIG_PENDING;
-        orinoco_cs_config(link);
-
-        return 0;
+        return orinoco_cs_config(link);
 }                               /* orinoco_cs_attach */
 
 /*
@@ -153,16 +143,14 @@ orinoco_cs_attach(struct pcmcia_device *p_dev)
  * are freed.  Otherwise, the structures will be freed when the device
  * is released.
  */
-static void orinoco_cs_detach(struct pcmcia_device *p_dev)
+static void orinoco_cs_detach(struct pcmcia_device *link)
 {
-        dev_link_t *link = dev_to_instance(p_dev);
         struct net_device *dev = link->priv;
 
-        if (link->state & DEV_CONFIG)
-                orinoco_cs_release(link);
+        orinoco_cs_release(link);
 
-        DEBUG(0, PFX "detach: link=%p link->dev=%p\n", link, link->dev);
-        if (link->dev) {
+        DEBUG(0, PFX "detach: link=%p link->dev_node=%p\n", link, link->dev_node);
+        if (link->dev_node) {
                 DEBUG(0, PFX "About to unregister net device %p\n",
                       dev);
                 unregister_netdev(dev);
@@ -180,11 +168,10 @@ static void orinoco_cs_detach(struct pcmcia_device *p_dev)
                 last_fn = (fn); if ((last_ret = (ret)) != 0) goto cs_failed; \
         } while (0)
 
-static void
-orinoco_cs_config(dev_link_t *link)
+static int
+orinoco_cs_config(struct pcmcia_device *link)
 {
         struct net_device *dev = link->priv;
-        client_handle_t handle = link->handle;
         struct orinoco_private *priv = netdev_priv(dev);
         struct orinoco_pccard *card = priv->card;
         hermes_t *hw = &priv->hw;
@@ -196,7 +183,7 @@ orinoco_cs_config(dev_link_t *link)
         cisparse_t parse;
         void __iomem *mem;
 
-        CS_CHECK(ValidateCIS, pcmcia_validate_cis(handle, &info));
+        CS_CHECK(ValidateCIS, pcmcia_validate_cis(link, &info));
 
         /*
          * This reads the card's CONFIG tuple to find its
@@ -207,19 +194,15 @@ orinoco_cs_config(dev_link_t *link)
         tuple.TupleData = buf;
         tuple.TupleDataMax = sizeof(buf);
         tuple.TupleOffset = 0;
-        CS_CHECK(GetFirstTuple, pcmcia_get_first_tuple(handle, &tuple));
-        CS_CHECK(GetTupleData, pcmcia_get_tuple_data(handle, &tuple));
-        CS_CHECK(ParseTuple, pcmcia_parse_tuple(handle, &tuple, &parse));
+        CS_CHECK(GetFirstTuple, pcmcia_get_first_tuple(link, &tuple));
+        CS_CHECK(GetTupleData, pcmcia_get_tuple_data(link, &tuple));
+        CS_CHECK(ParseTuple, pcmcia_parse_tuple(link, &tuple, &parse));
         link->conf.ConfigBase = parse.config.base;
         link->conf.Present = parse.config.rmask[0];
 
-        /* Configure card */
-        link->state |= DEV_CONFIG;
-
         /* Look up the current Vcc */
         CS_CHECK(GetConfigurationInfo,
-                 pcmcia_get_configuration_info(handle, &conf));
-        link->conf.Vcc = conf.Vcc;
+                 pcmcia_get_configuration_info(link, &conf));
 
         /*
          * In this loop, we scan the CIS for configuration table
@@ -236,13 +219,13 @@ orinoco_cs_config(dev_link_t *link)
          * implementation-defined details.
          */
         tuple.DesiredTuple = CISTPL_CFTABLE_ENTRY;
-        CS_CHECK(GetFirstTuple, pcmcia_get_first_tuple(handle, &tuple));
+        CS_CHECK(GetFirstTuple, pcmcia_get_first_tuple(link, &tuple));
         while (1) {
                 cistpl_cftable_entry_t *cfg = &(parse.cftable_entry);
                 cistpl_cftable_entry_t dflt = { .index = 0 };
 
-                if ( (pcmcia_get_tuple_data(handle, &tuple) != 0)
-                    || (pcmcia_parse_tuple(handle, &tuple, &parse) != 0))
+                if ( (pcmcia_get_tuple_data(link, &tuple) != 0)
+                    || (pcmcia_parse_tuple(link, &tuple, &parse) != 0))
                         goto next_entry;
 
                 if (cfg->flags & CISTPL_CFTABLE_DEFAULT)
@@ -274,10 +257,10 @@ orinoco_cs_config(dev_link_t *link)
                 }
 
                 if (cfg->vpp1.present & (1 << CISTPL_POWER_VNOM))
-                        link->conf.Vpp1 = link->conf.Vpp2 =
+                        link->conf.Vpp =
                             cfg->vpp1.param[CISTPL_POWER_VNOM] / 10000;
                 else if (dflt.vpp1.present & (1 << CISTPL_POWER_VNOM))
-                        link->conf.Vpp1 = link->conf.Vpp2 =
+                        link->conf.Vpp =
                             dflt.vpp1.param[CISTPL_POWER_VNOM] / 10000;
                 
                 /* Do we need to allocate an interrupt? */
@@ -307,7 +290,7 @@ orinoco_cs_config(dev_link_t *link)
                         }
 
                         /* This reserves IO space but doesn't actually enable it */
-                        if (pcmcia_request_io(link->handle, &link->io) != 0)
+                        if (pcmcia_request_io(link, &link->io) != 0)
                                 goto next_entry;
                 }
 
@@ -317,9 +300,8 @@ orinoco_cs_config(dev_link_t *link)
                 break;
                 
         next_entry:
-                if (link->io.NumPorts1)
-                        pcmcia_release_io(link->handle, &link->io);
-                last_ret = pcmcia_get_next_tuple(handle, &tuple);
+                pcmcia_disable_device(link);
+                last_ret = pcmcia_get_next_tuple(link, &tuple);
                 if (last_ret  == CS_NO_MORE_ITEMS) {
                         printk(KERN_ERR PFX "GetNextTuple(): No matching "
                                "CIS configuration.  Maybe you need the "
@@ -333,7 +315,7 @@ orinoco_cs_config(dev_link_t *link)
          * a handler to the interrupt, unless the 'Handler' member of
          * the irq structure is initialized.
          */
-        CS_CHECK(RequestIRQ, pcmcia_request_irq(link->handle, &link->irq));
+        CS_CHECK(RequestIRQ, pcmcia_request_irq(link, &link->irq));
 
         /* We initialize the hermes structure before completing PCMCIA
          * configuration just in case the interrupt handler gets
@@ -350,7 +332,7 @@ orinoco_cs_config(dev_link_t *link)
          * card and host interface into "Memory and IO" mode.
          */
         CS_CHECK(RequestConfiguration,
-                 pcmcia_request_configuration(link->handle, &link->conf));
+                 pcmcia_request_configuration(link, &link->conf));
 
         /* Ok, we have the configuration, prepare to register the netdev */
         dev->base_addr = link->io.BasePort1;
@@ -358,7 +340,7 @@ orinoco_cs_config(dev_link_t *link)
         SET_MODULE_OWNER(dev);
         card->node.major = card->node.minor = 0;
 
-        SET_NETDEV_DEV(dev, &handle_to_dev(handle));
+        SET_NETDEV_DEV(dev, &handle_to_dev(link));
         /* Tell the stack we exist */
         if (register_netdev(dev) != 0) {
                 printk(KERN_ERR PFX "register_netdev() failed\n");
@@ -366,20 +348,18 @@ orinoco_cs_config(dev_link_t *link)
         }
 
         /* At this point, the dev_node_t structure(s) needs to be
-         * initialized and arranged in a linked list at link->dev. */
+         * initialized and arranged in a linked list at link->dev_node. */
         strcpy(card->node.dev_name, dev->name);
-        link->dev = &card->node; /* link->dev being non-NULL is also
+        link->dev_node = &card->node; /* link->dev_node being non-NULL is also
                                     used to indicate that the
                                     net_device has been registered */
-        link->state &= ~DEV_CONFIG_PENDING;
 
         /* Finally, report what we've done */
-        printk(KERN_DEBUG "%s: index 0x%02x: Vcc %d.%d",
-               dev->name, link->conf.ConfigIndex,
-               link->conf.Vcc / 10, link->conf.Vcc % 10);
-        if (link->conf.Vpp1)
-                printk(", Vpp %d.%d", link->conf.Vpp1 / 10,
-                       link->conf.Vpp1 % 10);
+        printk(KERN_DEBUG "%s: index 0x%02x: ",
+               dev->name, link->conf.ConfigIndex);
+        if (link->conf.Vpp)
+                printk(", Vpp %d.%d", link->conf.Vpp / 10,
+                       link->conf.Vpp % 10);
         printk(", irq %d", link->irq.AssignedIRQ);
         if (link->io.NumPorts1)
                 printk(", io 0x%04x-0x%04x", link->io.BasePort1,
@@ -389,13 +369,14 @@ orinoco_cs_config(dev_link_t *link)
                        link->io.BasePort2 + link->io.NumPorts2 - 1);
         printk("\n");
 
-        return;
+        return 0;
 
  cs_failed:
-        cs_error(link->handle, last_fn, last_ret);
+        cs_error(link, last_fn, last_ret);
 
  failed:
         orinoco_cs_release(link);
+        return -ENODEV;
 }                               /* orinoco_cs_config */
 
 /*
@@ -404,7 +385,7 @@ orinoco_cs_config(dev_link_t *link)
  * still open, this will be postponed until it is closed.
  */
 static void
-orinoco_cs_release(dev_link_t *link)
+orinoco_cs_release(struct pcmcia_device *link)
 {
         struct net_device *dev = link->priv;
         struct orinoco_private *priv = netdev_priv(dev);
@@ -416,88 +397,68 @@ orinoco_cs_release(dev_link_t *link)
         priv->hw_unavailable++;
         spin_unlock_irqrestore(&priv->lock, flags);
 
-        /* Don't bother checking to see if these succeed or not */
-        pcmcia_release_configuration(link->handle);
-        if (link->io.NumPorts1)
-                pcmcia_release_io(link->handle, &link->io);
-        if (link->irq.AssignedIRQ)
-                pcmcia_release_irq(link->handle, &link->irq);
-        link->state &= ~DEV_CONFIG;
+        pcmcia_disable_device(link);
         if (priv->hw.iobase)
                 ioport_unmap(priv->hw.iobase);
 }                               /* orinoco_cs_release */
 
-static int orinoco_cs_suspend(struct pcmcia_device *p_dev)
+static int orinoco_cs_suspend(struct pcmcia_device *link)
 {
-        dev_link_t *link = dev_to_instance(p_dev);
         struct net_device *dev = link->priv;
         struct orinoco_private *priv = netdev_priv(dev);
         struct orinoco_pccard *card = priv->card;
         int err = 0;
         unsigned long flags;
 
-        link->state |= DEV_SUSPEND;
-        if (link->state & DEV_CONFIG) {
-                /* This is probably racy, but I can't think of
-                   a better way, short of rewriting the PCMCIA
-                   layer to not suck :-( */
-                if (! test_bit(0, &card->hard_reset_in_progress)) {
-                        spin_lock_irqsave(&priv->lock, flags);
+        /* This is probably racy, but I can't think of
+           a better way, short of rewriting the PCMCIA
+           layer to not suck :-( */
+        if (! test_bit(0, &card->hard_reset_in_progress)) {
+                spin_lock_irqsave(&priv->lock, flags);
 
-                        err = __orinoco_down(dev);
-                        if (err)
-                                printk(KERN_WARNING "%s: Error %d downing interface\n",
-                                       dev->name, err);
+                err = __orinoco_down(dev);
+                if (err)
+                        printk(KERN_WARNING "%s: Error %d downing interface\n",
+                               dev->name, err);
 
-                        netif_device_detach(dev);
-                        priv->hw_unavailable++;
+                netif_device_detach(dev);
+                priv->hw_unavailable++;
 
-                        spin_unlock_irqrestore(&priv->lock, flags);
-                }
-
-                pcmcia_release_configuration(link->handle);
+                spin_unlock_irqrestore(&priv->lock, flags);
         }
 
         return 0;
 }
 
-static int orinoco_cs_resume(struct pcmcia_device *p_dev)
+static int orinoco_cs_resume(struct pcmcia_device *link)
 {
-        dev_link_t *link = dev_to_instance(p_dev);
         struct net_device *dev = link->priv;
         struct orinoco_private *priv = netdev_priv(dev);
         struct orinoco_pccard *card = priv->card;
         int err = 0;
         unsigned long flags;
 
-        link->state &= ~DEV_SUSPEND;
-        if (link->state & DEV_CONFIG) {
-                /* FIXME: should we double check that this is
-                 * the same card as we had before */
-                pcmcia_request_configuration(link->handle, &link->conf);
-
-                if (! test_bit(0, &card->hard_reset_in_progress)) {
-                        err = orinoco_reinit_firmware(dev);
-                        if (err) {
-                                printk(KERN_ERR "%s: Error %d re-initializing firmware\n",
-                                       dev->name, err);
-                                return -EIO;
-                        }
-
-                        spin_lock_irqsave(&priv->lock, flags);
+        if (! test_bit(0, &card->hard_reset_in_progress)) {
+                err = orinoco_reinit_firmware(dev);
+                if (err) {
+                        printk(KERN_ERR "%s: Error %d re-initializing firmware\n",
+                               dev->name, err);
+                        return -EIO;
+                }
 
-                        netif_device_attach(dev);
-                        priv->hw_unavailable--;
+                spin_lock_irqsave(&priv->lock, flags);
 
-                        if (priv->open && ! priv->hw_unavailable) {
-                                err = __orinoco_up(dev);
-                                if (err)
-                                        printk(KERN_ERR "%s: Error %d restarting card\n",
-                                               dev->name, err);
-                        }
+                netif_device_attach(dev);
+                priv->hw_unavailable--;
 
-                        spin_unlock_irqrestore(&priv->lock, flags);
+                if (priv->open && ! priv->hw_unavailable) {
+                        err = __orinoco_up(dev);
+                        if (err)
+                                printk(KERN_ERR "%s: Error %d restarting card\n",
+                                       dev->name, err);
                 }
+
+                spin_unlock_irqrestore(&priv->lock, flags);
         }
 
         return 0;
@@ -604,7 +565,7 @@ static struct pcmcia_driver orinoco_driver = {
         .drv            = {
                 .name   = DRIVER_NAME,
         },
-        .probe          = orinoco_cs_attach,
+        .probe          = orinoco_cs_probe,
         .remove         = orinoco_cs_detach,
         .id_table       = orinoco_cs_ids,
         .suspend        = orinoco_cs_suspend,
diff --git a/drivers/net/wireless/ray_cs.c b/drivers/net/wireless/ray_cs.c
index 7880d8c31aad..879eb427607c 100644
--- a/drivers/net/wireless/ray_cs.c
+++ b/drivers/net/wireless/ray_cs.c
@@ -90,8 +90,8 @@ module_param(pc_debug, int, 0);
 #define DEBUG(n, args...)
 #endif
 /** Prototypes based on PCMCIA skeleton driver *******************************/
-static void ray_config(dev_link_t *link);
-static void ray_release(dev_link_t *link);
+static int ray_config(struct pcmcia_device *link);
+static void ray_release(struct pcmcia_device *link);
 static void ray_detach(struct pcmcia_device *p_dev);
 
 /***** Prototypes indicated by device structure ******************************/
@@ -190,20 +190,17 @@ static int bc;
 static char *phy_addr = NULL;
 
 
-/* A linked list of "instances" of the ray device.  Each actual
-   PCMCIA card corresponds to one device instance, and is described
-   by one dev_link_t structure (defined in ds.h).
-*/
-static dev_link_t *dev_list = NULL;
-
-/* A dev_link_t structure has fields for most things that are needed
+/* A struct pcmcia_device structure has fields for most things that are needed
    to keep track of a socket, but there will usually be some device
    specific information that also needs to be kept track of.  The
-   'priv' pointer in a dev_link_t structure can be used to point to
+   'priv' pointer in a struct pcmcia_device structure can be used to point to
    a device-specific private data structure, like this.
 */
 static unsigned int ray_mem_speed = 500;
 
+/* WARNING: THIS DRIVER IS NOT CAPABLE OF HANDLING MULTIPLE DEVICES! */
+static struct pcmcia_device *this_device = NULL;
+
 MODULE_AUTHOR("Corey Thomas <corey@world.std.com>");
 MODULE_DESCRIPTION("Raylink/WebGear wireless LAN driver");
 MODULE_LICENSE("GPL");
@@ -306,56 +303,46 @@ static char rcsid[] = "Raylink/WebGear wireless LAN - Corey <Thomas corey@world.
     configure the card at this point -- we wait until we receive a
     card insertion event.
 =============================================================================*/
-static int ray_attach(struct pcmcia_device *p_dev)
+static int ray_probe(struct pcmcia_device *p_dev)
 {
-    dev_link_t *link;
     ray_dev_t *local;
     struct net_device *dev;
-    
-    DEBUG(1, "ray_attach()\n");
 
-    /* Initialize the dev_link_t structure */
-    link = kmalloc(sizeof(struct dev_link_t), GFP_KERNEL);
-
-    if (!link)
-            return -ENOMEM;
+    DEBUG(1, "ray_attach()\n");
 
     /* Allocate space for private device-specific data */
     dev = alloc_etherdev(sizeof(ray_dev_t));
-
     if (!dev)
             goto fail_alloc_dev;
 
     local = dev->priv;
-
-    memset(link, 0, sizeof(struct dev_link_t));
+    local->finder = p_dev;
 
     /* The io structure describes IO port mapping. None used here */
-    link->io.NumPorts1 = 0;
-    link->io.Attributes1 = IO_DATA_PATH_WIDTH_8;
-    link->io.IOAddrLines = 5;
+    p_dev->io.NumPorts1 = 0;
+    p_dev->io.Attributes1 = IO_DATA_PATH_WIDTH_8;
+    p_dev->io.IOAddrLines = 5;
 
     /* Interrupt setup. For PCMCIA, driver takes what's given */
-    link->irq.Attributes = IRQ_TYPE_EXCLUSIVE | IRQ_HANDLE_PRESENT;
-    link->irq.IRQInfo1 = IRQ_LEVEL_ID;
-    link->irq.Handler = &ray_interrupt;
+    p_dev->irq.Attributes = IRQ_TYPE_EXCLUSIVE | IRQ_HANDLE_PRESENT;
+    p_dev->irq.IRQInfo1 = IRQ_LEVEL_ID;
+    p_dev->irq.Handler = &ray_interrupt;
 
     /* General socket configuration */
-    link->conf.Attributes = CONF_ENABLE_IRQ;
-    link->conf.Vcc = 50;
-    link->conf.IntType = INT_MEMORY_AND_IO;
-    link->conf.ConfigIndex = 1;
-    link->conf.Present = PRESENT_OPTION;
-
-    link->priv = dev;
-    link->irq.Instance = dev;
+    p_dev->conf.Attributes = CONF_ENABLE_IRQ;
+    p_dev->conf.IntType = INT_MEMORY_AND_IO;
+    p_dev->conf.ConfigIndex = 1;
+    p_dev->conf.Present = PRESENT_OPTION;
+
+    p_dev->priv = dev;
+    p_dev->irq.Instance = dev;
     
-    local->finder = link;
+    local->finder = p_dev;
     local->card_status = CARD_INSERTED;
     local->authentication_state = UNAUTHENTICATED;
     local->num_multi = 0;
-    DEBUG(2,"ray_attach link = %p,  dev = %p,  local = %p, intr = %p\n",
-          link,dev,local,&ray_interrupt);
+    DEBUG(2,"ray_attach p_dev = %p,  dev = %p,  local = %p, intr = %p\n",
+          p_dev,dev,local,&ray_interrupt);
 
     /* Raylink entries in the device structure */
     dev->hard_start_xmit = &ray_dev_start_xmit;
@@ -379,16 +366,10 @@ static int ray_attach(struct pcmcia_device *p_dev)
 
     init_timer(&local->timer);
 
-    link->handle = p_dev;
-    p_dev->instance = link;
-
-    link->state |= DEV_PRESENT | DEV_CONFIG_PENDING;
-    ray_config(link);
-
-    return 0;
+    this_device = p_dev;
+    return ray_config(p_dev);
 
 fail_alloc_dev:
-    kfree(link);
     return -ENOMEM;
 } /* ray_attach */
 /*=============================================================================
@@ -397,37 +378,25 @@ fail_alloc_dev:
     structures are freed.  Otherwise, the structures will be freed
     when the device is released.
 =============================================================================*/
-static void ray_detach(struct pcmcia_device *p_dev)
+static void ray_detach(struct pcmcia_device *link)
 {
-    dev_link_t *link = dev_to_instance(p_dev);
-    dev_link_t **linkp;
     struct net_device *dev;
     ray_dev_t *local;
 
     DEBUG(1, "ray_detach(0x%p)\n", link);
-    
-    /* Locate device structure */
-    for (linkp = &dev_list; *linkp; linkp = &(*linkp)->next)
-        if (*linkp == link) break;
-    if (*linkp == NULL)
-        return;
 
+    this_device = NULL;
     dev = link->priv;
 
-    if (link->state & DEV_CONFIG) {
-            ray_release(link);
+    ray_release(link);
 
-            local = (ray_dev_t *)dev->priv;
-            del_timer(&local->timer);
-    }
+    local = (ray_dev_t *)dev->priv;
+    del_timer(&local->timer);
 
-    /* Unlink device structure, free pieces */
-    *linkp = link->next;
     if (link->priv) {
-        if (link->dev) unregister_netdev(dev);
+        if (link->dev_node) unregister_netdev(dev);
         free_netdev(dev);
     }
-    kfree(link);
     DEBUG(2,"ray_cs ray_detach ending\n");
 } /* ray_detach */
 /*=============================================================================
@@ -438,9 +407,8 @@ static void ray_detach(struct pcmcia_device *p_dev)
 #define CS_CHECK(fn, ret) \
 do { last_fn = (fn); if ((last_ret = (ret)) != 0) goto cs_failed; } while (0)
 #define MAX_TUPLE_SIZE 128
-static void ray_config(dev_link_t *link)
+static int ray_config(struct pcmcia_device *link)
 {
-    client_handle_t handle = link->handle;
     tuple_t tuple;
     cisparse_t parse;
     int last_fn = 0, last_ret = 0;
@@ -455,48 +423,45 @@ static void ray_config(dev_link_t *link)
 
     /* This reads the card's CONFIG tuple to find its configuration regs */
     tuple.DesiredTuple = CISTPL_CONFIG;
-    CS_CHECK(GetFirstTuple, pcmcia_get_first_tuple(handle, &tuple));
+    CS_CHECK(GetFirstTuple, pcmcia_get_first_tuple(link, &tuple));
     tuple.TupleData = buf;
     tuple.TupleDataMax = MAX_TUPLE_SIZE;
     tuple.TupleOffset = 0;
-    CS_CHECK(GetTupleData, pcmcia_get_tuple_data(handle, &tuple));
-    CS_CHECK(ParseTuple, pcmcia_parse_tuple(handle, &tuple, &parse));
+    CS_CHECK(GetTupleData, pcmcia_get_tuple_data(link, &tuple));
+    CS_CHECK(ParseTuple, pcmcia_parse_tuple(link, &tuple, &parse));
     link->conf.ConfigBase = parse.config.base;
     link->conf.Present = parse.config.rmask[0];
 
     /* Determine card type and firmware version */
     buf[0] = buf[MAX_TUPLE_SIZE - 1] = 0;
     tuple.DesiredTuple = CISTPL_VERS_1;
-    CS_CHECK(GetFirstTuple, pcmcia_get_first_tuple(handle, &tuple));
+    CS_CHECK(GetFirstTuple, pcmcia_get_first_tuple(link, &tuple));
     tuple.TupleData = buf;
     tuple.TupleDataMax = MAX_TUPLE_SIZE;
     tuple.TupleOffset = 2;
-    CS_CHECK(GetTupleData, pcmcia_get_tuple_data(handle, &tuple));
+    CS_CHECK(GetTupleData, pcmcia_get_tuple_data(link, &tuple));
 
     for (i=0; i<tuple.TupleDataLen - 4; i++) 
         if (buf[i] == 0) buf[i] = ' ';
     printk(KERN_INFO "ray_cs Detected: %s\n",buf);
 
-    /* Configure card */
-    link->state |= DEV_CONFIG;
-
     /* Now allocate an interrupt line.  Note that this does not
        actually assign a handler to the interrupt.
     */
-    CS_CHECK(RequestIRQ, pcmcia_request_irq(link->handle, &link->irq));
+    CS_CHECK(RequestIRQ, pcmcia_request_irq(link, &link->irq));
     dev->irq = link->irq.AssignedIRQ;
     
     /* This actually configures the PCMCIA socket -- setting up
        the I/O windows and the interrupt mapping.
     */
-    CS_CHECK(RequestConfiguration, pcmcia_request_configuration(link->handle, &link->conf));
+    CS_CHECK(RequestConfiguration, pcmcia_request_configuration(link, &link->conf));
 
 /*** Set up 32k window for shared memory (transmit and control) ************/
     req.Attributes = WIN_DATA_WIDTH_8 | WIN_MEMORY_TYPE_CM | WIN_ENABLE | WIN_USE_WAIT;
     req.Base = 0;
     req.Size = 0x8000;
     req.AccessSpeed = ray_mem_speed;
-    CS_CHECK(RequestWindow, pcmcia_request_window(&link->handle, &req, &link->win));
+    CS_CHECK(RequestWindow, pcmcia_request_window(&link, &req, &link->win));
     mem.CardOffset = 0x0000; mem.Page = 0;
     CS_CHECK(MapMemPage, pcmcia_map_mem_page(link->win, &mem));
     local->sram = ioremap(req.Base,req.Size);
@@ -506,7 +471,7 @@ static void ray_config(dev_link_t *link)
     req.Base = 0;
     req.Size = 0x4000;
     req.AccessSpeed = ray_mem_speed;
-    CS_CHECK(RequestWindow, pcmcia_request_window(&link->handle, &req, &local->rmem_handle));
+    CS_CHECK(RequestWindow, pcmcia_request_window(&link, &req, &local->rmem_handle));
     mem.CardOffset = 0x8000; mem.Page = 0;
     CS_CHECK(MapMemPage, pcmcia_map_mem_page(local->rmem_handle, &mem));
     local->rmem = ioremap(req.Base,req.Size);
@@ -516,7 +481,7 @@ static void ray_config(dev_link_t *link)
     req.Base = 0;
     req.Size = 0x1000;
     req.AccessSpeed = ray_mem_speed;
-    CS_CHECK(RequestWindow, pcmcia_request_window(&link->handle, &req, &local->amem_handle));
+    CS_CHECK(RequestWindow, pcmcia_request_window(&link, &req, &local->amem_handle));
     mem.CardOffset = 0x0000; mem.Page = 0;
     CS_CHECK(MapMemPage, pcmcia_map_mem_page(local->amem_handle, &mem));
     local->amem = ioremap(req.Base,req.Size);
@@ -526,32 +491,32 @@ static void ray_config(dev_link_t *link)
     DEBUG(3,"ray_config amem=%p\n",local->amem);
     if (ray_init(dev) < 0) {
         ray_release(link);
-        return;
+        return -ENODEV;
     }
 
-    SET_NETDEV_DEV(dev, &handle_to_dev(handle));
+    SET_NETDEV_DEV(dev, &handle_to_dev(link));
     i = register_netdev(dev);
     if (i != 0) {
         printk("ray_config register_netdev() failed\n");
         ray_release(link);
-        return;
+        return i;
     }
 
     strcpy(local->node.dev_name, dev->name);
-    link->dev = &local->node;
+    link->dev_node = &local->node;
 
-    link->state &= ~DEV_CONFIG_PENDING;
     printk(KERN_INFO "%s: RayLink, irq %d, hw_addr ",
        dev->name, dev->irq);
     for (i = 0; i < 6; i++)
     printk("%02X%s", dev->dev_addr[i], ((i<5) ? ":" : "\n"));
 
-    return;
+    return 0;
 
 cs_failed:
-    cs_error(link->handle, last_fn, last_ret);
+    cs_error(link, last_fn, last_ret);
 
     ray_release(link);
+    return -ENODEV;
 } /* ray_config */
 
 static inline struct ccs __iomem *ccs_base(ray_dev_t *dev)
@@ -578,9 +543,9 @@ static int ray_init(struct net_device *dev)
     UCHAR *p;
     struct ccs __iomem *pccs;
     ray_dev_t *local = (ray_dev_t *)dev->priv;
-    dev_link_t *link = local->finder;
+    struct pcmcia_device *link = local->finder;
     DEBUG(1, "ray_init(0x%p)\n", dev);
-    if (!(link->state & DEV_PRESENT)) {
+    if (!(pcmcia_dev_present(link))) {
         DEBUG(0,"ray_init - device not present\n");
         return -1;
     }
@@ -640,10 +605,10 @@ static int dl_startup_params(struct net_device *dev)
     int ccsindex;
     ray_dev_t *local = (ray_dev_t *)dev->priv;
     struct ccs __iomem *pccs;
-    dev_link_t *link = local->finder;
+    struct pcmcia_device *link = local->finder;
 
     DEBUG(1,"dl_startup_params entered\n");
-    if (!(link->state & DEV_PRESENT)) {
+    if (!(pcmcia_dev_present(link))) {
         DEBUG(2,"ray_cs dl_startup_params - device not present\n");
         return -1;
     }
@@ -747,9 +712,9 @@ static void verify_dl_startup(u_long data)
     ray_dev_t *local = (ray_dev_t *)data;
     struct ccs __iomem *pccs = ccs_base(local) + local->dl_param_ccs;
     UCHAR status;
-    dev_link_t *link = local->finder;
+    struct pcmcia_device *link = local->finder;
 
-    if (!(link->state & DEV_PRESENT)) {
+    if (!(pcmcia_dev_present(link))) {
         DEBUG(2,"ray_cs verify_dl_startup - device not present\n");
         return;
     }
@@ -787,8 +752,8 @@ static void start_net(u_long data)
     ray_dev_t *local = (ray_dev_t *)data;
     struct ccs __iomem *pccs;
     int ccsindex;
-    dev_link_t *link = local->finder;
-    if (!(link->state & DEV_PRESENT)) {
+    struct pcmcia_device *link = local->finder;
+    if (!(pcmcia_dev_present(link))) {
         DEBUG(2,"ray_cs start_net - device not present\n");
         return;
     }
@@ -814,9 +779,9 @@ static void join_net(u_long data)
 
     struct ccs __iomem *pccs;
     int ccsindex;
-    dev_link_t *link = local->finder;
+    struct pcmcia_device *link = local->finder;
     
-    if (!(link->state & DEV_PRESENT)) {
+    if (!(pcmcia_dev_present(link))) {
         DEBUG(2,"ray_cs join_net - device not present\n");
         return;
     }
@@ -840,7 +805,7 @@ static void join_net(u_long data)
     device, and release the PCMCIA configuration.  If the device is
     still open, this will be postponed until it is closed.
 =============================================================================*/
-static void ray_release(dev_link_t *link)
+static void ray_release(struct pcmcia_device *link)
 {
     struct net_device *dev = link->priv; 
     ray_dev_t *local = dev->priv;
@@ -849,56 +814,38 @@ static void ray_release(dev_link_t *link)
     DEBUG(1, "ray_release(0x%p)\n", link);
 
     del_timer(&local->timer);
-    link->state &= ~DEV_CONFIG;
 
     iounmap(local->sram);
     iounmap(local->rmem);
     iounmap(local->amem);
     /* Do bother checking to see if these succeed or not */
-    i = pcmcia_release_window(link->win);
-    if ( i != CS_SUCCESS ) DEBUG(0,"ReleaseWindow(link->win) ret = %x\n",i);
     i = pcmcia_release_window(local->amem_handle);
     if ( i != CS_SUCCESS ) DEBUG(0,"ReleaseWindow(local->amem) ret = %x\n",i);
     i = pcmcia_release_window(local->rmem_handle);
     if ( i != CS_SUCCESS ) DEBUG(0,"ReleaseWindow(local->rmem) ret = %x\n",i);
-    i = pcmcia_release_configuration(link->handle);
-    if ( i != CS_SUCCESS ) DEBUG(0,"ReleaseConfiguration ret = %x\n",i);
-    i = pcmcia_release_irq(link->handle, &link->irq);
-    if ( i != CS_SUCCESS ) DEBUG(0,"ReleaseIRQ ret = %x\n",i);
+    pcmcia_disable_device(link);
 
     DEBUG(2,"ray_release ending\n");
 }
 
-static int ray_suspend(struct pcmcia_device *p_dev)
+static int ray_suspend(struct pcmcia_device *link)
 {
-        dev_link_t *link = dev_to_instance(p_dev);
         struct net_device *dev = link->priv;
 
-        link->state |= DEV_SUSPEND;
-        if (link->state & DEV_CONFIG) {
-                if (link->open)
-                        netif_device_detach(dev);
-
-                pcmcia_release_configuration(link->handle);
-        }
-
+        if (link->open)
+                netif_device_detach(dev);
 
         return 0;
 }
 
-static int ray_resume(struct pcmcia_device *p_dev)
+static int ray_resume(struct pcmcia_device *link)
 {
-        dev_link_t *link = dev_to_instance(p_dev);
         struct net_device *dev = link->priv;
 
-        link->state &= ~DEV_SUSPEND;
-        if (link->state & DEV_CONFIG) {
-                pcmcia_request_configuration(link->handle, &link->conf);
-                if (link->open) {
-                        ray_reset(dev);
-                        netif_device_attach(dev);
-                }
-        }
+        if (link->open) {
+                ray_reset(dev);
+                netif_device_attach(dev);
+        }
 
         return 0;
 }
@@ -910,10 +857,10 @@ int ray_dev_init(struct net_device *dev)
     int i;
 #endif  /* RAY_IMMEDIATE_INIT */
     ray_dev_t *local = dev->priv;
-    dev_link_t *link = local->finder;
+    struct pcmcia_device *link = local->finder;
 
     DEBUG(1,"ray_dev_init(dev=%p)\n",dev);
-    if (!(link->state & DEV_PRESENT)) {
+    if (!(pcmcia_dev_present(link))) {
         DEBUG(2,"ray_dev_init - device not present\n");
         return -1;
     }
@@ -944,10 +891,10 @@ int ray_dev_init(struct net_device *dev)
 static int ray_dev_config(struct net_device *dev, struct ifmap *map)
 {
     ray_dev_t *local = dev->priv;
-    dev_link_t *link = local->finder;
+    struct pcmcia_device *link = local->finder;
     /* Dummy routine to satisfy device structure */
     DEBUG(1,"ray_dev_config(dev=%p,ifmap=%p)\n",dev,map);
-    if (!(link->state & DEV_PRESENT)) {
+    if (!(pcmcia_dev_present(link))) {
         DEBUG(2,"ray_dev_config - device not present\n");
         return -1;
     }
@@ -958,10 +905,10 @@ static int ray_dev_config(struct net_device *dev, struct ifmap *map)
 static int ray_dev_start_xmit(struct sk_buff *skb, struct net_device *dev)
 {
     ray_dev_t *local = dev->priv;
-    dev_link_t *link = local->finder;
+    struct pcmcia_device *link = local->finder;
     short length = skb->len;
 
-    if (!(link->state & DEV_PRESENT)) {
+    if (!(pcmcia_dev_present(link))) {
         DEBUG(2,"ray_dev_start_xmit - device not present\n");
         return -1;
     }
@@ -1570,7 +1517,7 @@ static int ray_commit(struct net_device *dev,
 static iw_stats * ray_get_wireless_stats(struct net_device *    dev)
 {
   ray_dev_t *   local = (ray_dev_t *) dev->priv;
-  dev_link_t *link = local->finder;
+  struct pcmcia_device *link = local->finder;
   struct status __iomem *p = local->sram + STATUS_BASE;
 
   if(local == (ray_dev_t *) NULL)
@@ -1588,7 +1535,7 @@ static iw_stats * ray_get_wireless_stats(struct net_device *	dev)
     }
 #endif /* WIRELESS_SPY */
 
-  if((link->state & DEV_PRESENT)) {
+  if(pcmcia_dev_present(link)) {
     local->wstats.qual.noise = readb(&p->rxnoise);
     local->wstats.qual.updated |= 4;
   }
@@ -1657,18 +1604,14 @@ static const struct iw_handler_def	ray_handler_def =
 /*===========================================================================*/
 static int ray_open(struct net_device *dev)
 {
-    dev_link_t *link;
     ray_dev_t *local = (ray_dev_t *)dev->priv;
+    struct pcmcia_device *link;
+    link = local->finder;
     
     DEBUG(1, "ray_open('%s')\n", dev->name);
 
-    for (link = dev_list; link; link = link->next)
-        if (link->priv == dev) break;
-    if (!DEV_OK(link)) {
-        return -ENODEV;
-    }
-
-    if (link->open == 0) local->num_multi = 0;
+    if (link->open == 0)
+            local->num_multi = 0;
     link->open++;
 
     /* If the card is not started, time to start it ! - Jean II */
@@ -1695,15 +1638,12 @@ static int ray_open(struct net_device *dev)
 /*===========================================================================*/
 static int ray_dev_close(struct net_device *dev)
 {
-    dev_link_t *link;
+    ray_dev_t *local = (ray_dev_t *)dev->priv;
+    struct pcmcia_device *link;
+    link = local->finder;
 
     DEBUG(1, "ray_dev_close('%s')\n", dev->name);
 
-    for (link = dev_list; link; link = link->next)
-        if (link->priv == dev) break;
-    if (link == NULL)
-        return -ENODEV;
-
     link->open--;
     netif_stop_queue(dev);
 
@@ -1725,9 +1665,9 @@ static void ray_reset(struct net_device *dev) {
 static int interrupt_ecf(ray_dev_t *local, int ccs)
 {
     int i = 50;
-    dev_link_t *link = local->finder;
+    struct pcmcia_device *link = local->finder;
 
-    if (!(link->state & DEV_PRESENT)) {
+    if (!(pcmcia_dev_present(link))) {
         DEBUG(2,"ray_cs interrupt_ecf - device not present\n");
         return -1;
     }
@@ -1752,9 +1692,9 @@ static int get_free_tx_ccs(ray_dev_t *local)
 {
     int i;
     struct ccs __iomem *pccs = ccs_base(local);
-    dev_link_t *link = local->finder;
+    struct pcmcia_device *link = local->finder;
 
-    if (!(link->state & DEV_PRESENT)) {
+    if (!(pcmcia_dev_present(link))) {
         DEBUG(2,"ray_cs get_free_tx_ccs - device not present\n");
         return ECARDGONE;
     }
@@ -1783,9 +1723,9 @@ static int get_free_ccs(ray_dev_t *local)
 {
     int i;
     struct ccs __iomem *pccs = ccs_base(local);
-    dev_link_t *link = local->finder;
+    struct pcmcia_device *link = local->finder;
 
-    if (!(link->state & DEV_PRESENT)) {
+    if (!(pcmcia_dev_present(link))) {
         DEBUG(2,"ray_cs get_free_ccs - device not present\n");
         return ECARDGONE;
     }
@@ -1858,9 +1798,9 @@ static int parse_addr(char *in_str, UCHAR *out)
 static struct net_device_stats *ray_get_stats(struct net_device *dev)
 {
     ray_dev_t *local = (ray_dev_t *)dev->priv;
-    dev_link_t *link = local->finder;
+    struct pcmcia_device *link = local->finder;
     struct status __iomem *p = local->sram + STATUS_BASE;
-    if (!(link->state & DEV_PRESENT)) {
+    if (!(pcmcia_dev_present(link))) {
         DEBUG(2,"ray_cs net_device_stats - device not present\n");
         return &local->stats;
     }
@@ -1888,12 +1828,12 @@ static struct net_device_stats *ray_get_stats(struct net_device *dev)
 static void ray_update_parm(struct net_device *dev, UCHAR objid, UCHAR *value, int len)
 {
     ray_dev_t *local = (ray_dev_t *)dev->priv;
-    dev_link_t *link = local->finder;
+    struct pcmcia_device *link = local->finder;
     int ccsindex;
     int i;
     struct ccs __iomem *pccs;
 
-    if (!(link->state & DEV_PRESENT)) {
+    if (!(pcmcia_dev_present(link))) {
         DEBUG(2,"ray_update_parm - device not present\n");
         return;
     }
@@ -1925,10 +1865,10 @@ static void ray_update_multi_list(struct net_device *dev, int all)
     struct ccs __iomem *pccs;
     int i = 0;
     ray_dev_t *local = (ray_dev_t *)dev->priv;
-    dev_link_t *link = local->finder;
+    struct pcmcia_device *link = local->finder;
     void __iomem *p = local->sram + HOST_TO_ECF_BASE;
 
-    if (!(link->state & DEV_PRESENT)) {
+    if (!(pcmcia_dev_present(link))) {
         DEBUG(2,"ray_update_multi_list - device not present\n");
         return;
     }
@@ -2005,7 +1945,7 @@ static void set_multicast_list(struct net_device *dev)
 static irqreturn_t ray_interrupt(int irq, void *dev_id, struct pt_regs * regs)
 {
     struct net_device *dev = (struct net_device *)dev_id;
-    dev_link_t *link;
+    struct pcmcia_device *link;
     ray_dev_t *local;
     struct ccs __iomem *pccs;
     struct rcs __iomem *prcs;
@@ -2020,8 +1960,8 @@ static irqreturn_t ray_interrupt(int irq, void *dev_id, struct pt_regs * regs)
     DEBUG(4,"ray_cs: interrupt for *dev=%p\n",dev);
 
     local = (ray_dev_t *)dev->priv;
-    link = (dev_link_t *)local->finder;
-    if ( ! (link->state & DEV_PRESENT) || link->state & DEV_SUSPEND ) {
+    link = (struct pcmcia_device *)local->finder;
+    if (!pcmcia_dev_present(link)) {
         DEBUG(2,"ray_cs interrupt from device not present or suspended.\n");
         return IRQ_NONE;
     }
@@ -2540,9 +2480,9 @@ static void release_frag_chain(ray_dev_t *local, struct rcs __iomem * prcs)
 /*===========================================================================*/
 static void authenticate(ray_dev_t *local)
 {
-    dev_link_t *link = local->finder;
+    struct pcmcia_device *link = local->finder;
     DEBUG(0,"ray_cs Starting authentication.\n");
-    if (!(link->state & DEV_PRESENT)) {
+    if (!(pcmcia_dev_present(link))) {
         DEBUG(2,"ray_cs authenticate - device not present\n");
         return;
     }
@@ -2606,10 +2546,10 @@ static void rx_authenticate(ray_dev_t *local, struct rcs __iomem *prcs,
 static void associate(ray_dev_t *local)
 {
     struct ccs __iomem *pccs;
-    dev_link_t *link = local->finder;
+    struct pcmcia_device *link = local->finder;
     struct net_device *dev = link->priv;
     int ccsindex;
-    if (!(link->state & DEV_PRESENT)) {
+    if (!(pcmcia_dev_present(link))) {
         DEBUG(2,"ray_cs associate - device not present\n");
         return;
     }
@@ -2689,14 +2629,14 @@ static int ray_cs_proc_read(char *buf, char **start, off_t offset, int len)
  * eg ifconfig 
  */
     int i;
-    dev_link_t *link;
+    struct pcmcia_device *link;
     struct net_device *dev;
     ray_dev_t *local;
     UCHAR *p;
     struct freq_hop_element *pfh;
     UCHAR c[33];
 
-    link = dev_list;
+    link = this_device;
     if (!link)
         return 0;
     dev = (struct net_device *)link->priv;
@@ -2898,7 +2838,7 @@ static struct pcmcia_driver ray_driver = {
         .drv            = {
                 .name   = "ray_cs",
         },
-        .probe          = ray_attach,
+        .probe          = ray_probe,
         .remove         = ray_detach,
         .id_table       = ray_ids,
         .suspend        = ray_suspend,
@@ -2940,7 +2880,6 @@ static void __exit exit_ray_cs(void)
 #endif
 
     pcmcia_unregister_driver(&ray_driver);
-    BUG_ON(dev_list != NULL);
 } /* exit_ray_cs */
 
 module_init(init_ray_cs);
diff --git a/drivers/net/wireless/ray_cs.h b/drivers/net/wireless/ray_cs.h
index 42660fe64bfd..bd73ebf03340 100644
--- a/drivers/net/wireless/ray_cs.h
+++ b/drivers/net/wireless/ray_cs.h
@@ -31,7 +31,7 @@ typedef struct ray_dev_t {
     void __iomem *sram;            /* pointer to beginning of shared RAM     */
     void __iomem *amem;            /* pointer to attribute mem window        */
     void __iomem *rmem;            /* pointer to receive buffer window       */
-    dev_link_t *finder;            /* pointer back to dev_link_t for card    */
+    struct pcmcia_device *finder;            /* pointer back to struct pcmcia_device for card    */
     struct timer_list timer;
     long tx_ccs_lock;
     long ccs_lock;
diff --git a/drivers/net/wireless/spectrum_cs.c b/drivers/net/wireless/spectrum_cs.c
index 5fa6fbe35bb9..f7b77ce54d7b 100644
--- a/drivers/net/wireless/spectrum_cs.c
+++ b/drivers/net/wireless/spectrum_cs.c
@@ -63,7 +63,7 @@ MODULE_PARM_DESC(ignore_cis_vcc, "Allow voltage mismatch between card and socket
 /* PCMCIA specific device information (goes in the card field of
  * struct orinoco_private */
 struct orinoco_pccard {
-        dev_link_t link;
+        struct pcmcia_device    *p_dev;
         dev_node_t node;
 };
 
@@ -71,8 +71,8 @@ struct orinoco_pccard {
 /* Function prototypes                                              */
 /********************************************************************/
 
-static void spectrum_cs_config(dev_link_t *link);
-static void spectrum_cs_release(dev_link_t *link);
+static int spectrum_cs_config(struct pcmcia_device *link);
+static void spectrum_cs_release(struct pcmcia_device *link);
 
 /********************************************************************/
 /* Firmware downloader                                              */
@@ -238,14 +238,14 @@ spectrum_aux_open(hermes_t *hw)
  * If IDLE is 1, stop the firmware, so that it can be safely rewritten.
  */
 static int
-spectrum_reset(dev_link_t *link, int idle)
+spectrum_reset(struct pcmcia_device *link, int idle)
 {
         int last_ret, last_fn;
         conf_reg_t reg;
         u_int save_cor;
 
         /* Doing it if hardware is gone is guaranteed crash */
-        if (!(link->state & DEV_CONFIG))
+        if (pcmcia_dev_present(link))
                 return -ENODEV;
 
         /* Save original COR value */
@@ -253,7 +253,7 @@ spectrum_reset(dev_link_t *link, int idle)
         reg.Action = CS_READ;
         reg.Offset = CISREG_COR;
         CS_CHECK(AccessConfigurationRegister,
-                 pcmcia_access_configuration_register(link->handle, &reg));
+                 pcmcia_access_configuration_register(link, &reg));
         save_cor = reg.Value;
 
         /* Soft-Reset card */
@@ -261,14 +261,14 @@ spectrum_reset(dev_link_t *link, int idle)
         reg.Offset = CISREG_COR;
         reg.Value = (save_cor | COR_SOFT_RESET);
         CS_CHECK(AccessConfigurationRegister,
-                 pcmcia_access_configuration_register(link->handle, &reg));
+                 pcmcia_access_configuration_register(link, &reg));
         udelay(1000);
 
         /* Read CCSR */
         reg.Action = CS_READ;
         reg.Offset = CISREG_CCSR;
         CS_CHECK(AccessConfigurationRegister,
-                 pcmcia_access_configuration_register(link->handle, &reg));
+                 pcmcia_access_configuration_register(link, &reg));
 
         /*
          * Start or stop the firmware.  Memory width bit should be
@@ -278,7 +278,7 @@ spectrum_reset(dev_link_t *link, int idle)
         reg.Offset = CISREG_CCSR;
         reg.Value = (idle ? HCR_IDLE : HCR_RUN) | (reg.Value & HCR_MEM16);
         CS_CHECK(AccessConfigurationRegister,
-                 pcmcia_access_configuration_register(link->handle, &reg));
+                 pcmcia_access_configuration_register(link, &reg));
         udelay(1000);
 
         /* Restore original COR configuration index */
@@ -286,12 +286,12 @@ spectrum_reset(dev_link_t *link, int idle)
         reg.Offset = CISREG_COR;
         reg.Value = (save_cor & ~COR_SOFT_RESET);
         CS_CHECK(AccessConfigurationRegister,
-                 pcmcia_access_configuration_register(link->handle, &reg));
+                 pcmcia_access_configuration_register(link, &reg));
         udelay(1000);
         return 0;
 
       cs_failed:
-        cs_error(link->handle, last_fn, last_ret);
+        cs_error(link, last_fn, last_ret);
         return -ENODEV;
 }
 
@@ -441,7 +441,7 @@ spectrum_load_blocks(hermes_t *hw, const struct dblock *first_block)
  * care of the PDA - read it and then write it on top of the firmware.
  */
 static int
-spectrum_dl_image(hermes_t *hw, dev_link_t *link,
+spectrum_dl_image(hermes_t *hw, struct pcmcia_device *link,
                   const unsigned char *image)
 {
         int ret;
@@ -505,14 +505,13 @@ spectrum_dl_image(hermes_t *hw, dev_link_t *link,
  * reset on the card, to make sure it's in a sane state.
  */
 static int
-spectrum_dl_firmware(hermes_t *hw, dev_link_t *link)
+spectrum_dl_firmware(hermes_t *hw, struct pcmcia_device *link)
 {
         int ret;
-        client_handle_t handle = link->handle;
         const struct firmware *fw_entry;
 
         if (request_firmware(&fw_entry, primary_fw_name,
-                             &handle_to_dev(handle)) == 0) {
+                             &handle_to_dev(link)) == 0) {
                 primsym = fw_entry->data;
         } else {
                 printk(KERN_ERR PFX "Cannot find firmware: %s\n",
@@ -521,7 +520,7 @@ spectrum_dl_firmware(hermes_t *hw, dev_link_t *link)
         }
 
         if (request_firmware(&fw_entry, secondary_fw_name,
-                             &handle_to_dev(handle)) == 0) {
+                             &handle_to_dev(link)) == 0) {
                 secsym = fw_entry->data;
         } else {
                 printk(KERN_ERR PFX "Cannot find firmware: %s\n",
@@ -554,12 +553,12 @@ static int
 spectrum_cs_hard_reset(struct orinoco_private *priv)
 {
         struct orinoco_pccard *card = priv->card;
-        dev_link_t *link = &card->link;
+        struct pcmcia_device *link = card->p_dev;
         int err;
 
         if (!hermes_present(&priv->hw)) {
                 /* The firmware needs to be reloaded */
-                if (spectrum_dl_firmware(&priv->hw, &card->link) != 0) {
+                if (spectrum_dl_firmware(&priv->hw, link) != 0) {
                         printk(KERN_ERR PFX "Firmware download failed\n");
                         err = -ENODEV;
                 }
@@ -584,12 +583,11 @@ spectrum_cs_hard_reset(struct orinoco_private *priv)
  * configure the card at this point -- we wait until we receive a card
  * insertion event.  */
 static int
-spectrum_cs_attach(struct pcmcia_device *p_dev)
+spectrum_cs_probe(struct pcmcia_device *link)
 {
         struct net_device *dev;
         struct orinoco_private *priv;
         struct orinoco_pccard *card;
-        dev_link_t *link;
 
         dev = alloc_orinocodev(sizeof(*card), spectrum_cs_hard_reset);
         if (! dev)
@@ -598,7 +596,7 @@ spectrum_cs_attach(struct pcmcia_device *p_dev)
         card = priv->card;
 
         /* Link both structures together */
-        link = &card->link;
+        card->p_dev = link;
         link->priv = dev;
 
         /* Interrupt setup */
@@ -615,13 +613,7 @@ spectrum_cs_attach(struct pcmcia_device *p_dev)
         link->conf.Attributes = 0;
         link->conf.IntType = INT_MEMORY_AND_IO;
 
-        link->handle = p_dev;
-        p_dev->instance = link;
-
-        link->state |= DEV_PRESENT | DEV_CONFIG_PENDING;
-        spectrum_cs_config(link);
-
-        return 0;
+        return spectrum_cs_config(link);
 }                               /* spectrum_cs_attach */
 
 /*
@@ -630,16 +622,14 @@ spectrum_cs_attach(struct pcmcia_device *p_dev)
  * are freed.  Otherwise, the structures will be freed when the device
  * is released.
  */
-static void spectrum_cs_detach(struct pcmcia_device *p_dev)
+static void spectrum_cs_detach(struct pcmcia_device *link)
 {
-        dev_link_t *link = dev_to_instance(p_dev);
         struct net_device *dev = link->priv;
 
-        if (link->state & DEV_CONFIG)
-                spectrum_cs_release(link);
+        spectrum_cs_release(link);
 
-        DEBUG(0, PFX "detach: link=%p link->dev=%p\n", link, link->dev);
-        if (link->dev) {
+        DEBUG(0, PFX "detach: link=%p link->dev_node=%p\n", link, link->dev_node);
+        if (link->dev_node) {
                 DEBUG(0, PFX "About to unregister net device %p\n",
                       dev);
                 unregister_netdev(dev);
@@ -653,11 +643,10 @@ static void spectrum_cs_detach(struct pcmcia_device *p_dev)
  * device available to the system.
  */
 
-static void
-spectrum_cs_config(dev_link_t *link)
+static int
+spectrum_cs_config(struct pcmcia_device *link)
 {
         struct net_device *dev = link->priv;
-        client_handle_t handle = link->handle;
         struct orinoco_private *priv = netdev_priv(dev);
         struct orinoco_pccard *card = priv->card;
         hermes_t *hw = &priv->hw;
@@ -669,7 +658,7 @@ spectrum_cs_config(dev_link_t *link)
         cisparse_t parse;
         void __iomem *mem;
 
-        CS_CHECK(ValidateCIS, pcmcia_validate_cis(handle, &info));
+        CS_CHECK(ValidateCIS, pcmcia_validate_cis(link, &info));
 
         /*
          * This reads the card's CONFIG tuple to find its
@@ -680,19 +669,15 @@ spectrum_cs_config(dev_link_t *link)
         tuple.TupleData = buf;
         tuple.TupleDataMax = sizeof(buf);
         tuple.TupleOffset = 0;
-        CS_CHECK(GetFirstTuple, pcmcia_get_first_tuple(handle, &tuple));
-        CS_CHECK(GetTupleData, pcmcia_get_tuple_data(handle, &tuple));
-        CS_CHECK(ParseTuple, pcmcia_parse_tuple(handle, &tuple, &parse));
+        CS_CHECK(GetFirstTuple, pcmcia_get_first_tuple(link, &tuple));
+        CS_CHECK(GetTupleData, pcmcia_get_tuple_data(link, &tuple));
+        CS_CHECK(ParseTuple, pcmcia_parse_tuple(link, &tuple, &parse));
         link->conf.ConfigBase = parse.config.base;
         link->conf.Present = parse.config.rmask[0];
 
-        /* Configure card */
-        link->state |= DEV_CONFIG;
-
         /* Look up the current Vcc */
         CS_CHECK(GetConfigurationInfo,
-                 pcmcia_get_configuration_info(handle, &conf));
-        link->conf.Vcc = conf.Vcc;
+                 pcmcia_get_configuration_info(link, &conf));
 
         /*
          * In this loop, we scan the CIS for configuration table
@@ -709,13 +694,13 @@ spectrum_cs_config(dev_link_t *link)
          * implementation-defined details.
          */
         tuple.DesiredTuple = CISTPL_CFTABLE_ENTRY;
-        CS_CHECK(GetFirstTuple, pcmcia_get_first_tuple(handle, &tuple));
+        CS_CHECK(GetFirstTuple, pcmcia_get_first_tuple(link, &tuple));
         while (1) {
                 cistpl_cftable_entry_t *cfg = &(parse.cftable_entry);
                 cistpl_cftable_entry_t dflt = { .index = 0 };
 
-                if ( (pcmcia_get_tuple_data(handle, &tuple) != 0)
-                    || (pcmcia_parse_tuple(handle, &tuple, &parse) != 0))
+                if ( (pcmcia_get_tuple_data(link, &tuple) != 0)
+                    || (pcmcia_parse_tuple(link, &tuple, &parse) != 0))
                         goto next_entry;
 
                 if (cfg->flags & CISTPL_CFTABLE_DEFAULT)
@@ -747,10 +732,10 @@ spectrum_cs_config(dev_link_t *link)
                 }
 
                 if (cfg->vpp1.present & (1 << CISTPL_POWER_VNOM))
-                        link->conf.Vpp1 = link->conf.Vpp2 =
+                        link->conf.Vpp =
                             cfg->vpp1.param[CISTPL_POWER_VNOM] / 10000;
                 else if (dflt.vpp1.present & (1 << CISTPL_POWER_VNOM))
-                        link->conf.Vpp1 = link->conf.Vpp2 =
+                        link->conf.Vpp =
                             dflt.vpp1.param[CISTPL_POWER_VNOM] / 10000;
                 
                 /* Do we need to allocate an interrupt? */
@@ -780,7 +765,7 @@ spectrum_cs_config(dev_link_t *link)
                         }
 
                         /* This reserves IO space but doesn't actually enable it */
-                        if (pcmcia_request_io(link->handle, &link->io) != 0)
+                        if (pcmcia_request_io(link, &link->io) != 0)
                                 goto next_entry;
                 }
 
@@ -790,9 +775,8 @@ spectrum_cs_config(dev_link_t *link)
                 break;
                 
         next_entry:
-                if (link->io.NumPorts1)
-                        pcmcia_release_io(link->handle, &link->io);
-                last_ret = pcmcia_get_next_tuple(handle, &tuple);
+                pcmcia_disable_device(link);
+                last_ret = pcmcia_get_next_tuple(link, &tuple);
                 if (last_ret  == CS_NO_MORE_ITEMS) {
                         printk(KERN_ERR PFX "GetNextTuple(): No matching "
                                "CIS configuration.  Maybe you need the "
@@ -806,7 +790,7 @@ spectrum_cs_config(dev_link_t *link)
          * a handler to the interrupt, unless the 'Handler' member of
          * the irq structure is initialized.
          */
-        CS_CHECK(RequestIRQ, pcmcia_request_irq(link->handle, &link->irq));
+        CS_CHECK(RequestIRQ, pcmcia_request_irq(link, &link->irq));
 
         /* We initialize the hermes structure before completing PCMCIA
          * configuration just in case the interrupt handler gets
@@ -823,7 +807,7 @@ spectrum_cs_config(dev_link_t *link)
          * card and host interface into "Memory and IO" mode.
          */
         CS_CHECK(RequestConfiguration,
-                 pcmcia_request_configuration(link->handle, &link->conf));
+                 pcmcia_request_configuration(link, &link->conf));
 
         /* Ok, we have the configuration, prepare to register the netdev */
         dev->base_addr = link->io.BasePort1;
@@ -836,7 +820,7 @@ spectrum_cs_config(dev_link_t *link)
                 goto failed;
         }
 
-        SET_NETDEV_DEV(dev, &handle_to_dev(handle));
+        SET_NETDEV_DEV(dev, &handle_to_dev(link));
         /* Tell the stack we exist */
         if (register_netdev(dev) != 0) {
                 printk(KERN_ERR PFX "register_netdev() failed\n");
@@ -844,20 +828,18 @@ spectrum_cs_config(dev_link_t *link)
         }
 
         /* At this point, the dev_node_t structure(s) needs to be
-         * initialized and arranged in a linked list at link->dev. */
+         * initialized and arranged in a linked list at link->dev_node. */
         strcpy(card->node.dev_name, dev->name);
-        link->dev = &card->node; /* link->dev being non-NULL is also
+        link->dev_node = &card->node; /* link->dev_node being non-NULL is also
                                     used to indicate that the
                                     net_device has been registered */
-        link->state &= ~DEV_CONFIG_PENDING;
 
         /* Finally, report what we've done */
-        printk(KERN_DEBUG "%s: index 0x%02x: Vcc %d.%d",
-               dev->name, link->conf.ConfigIndex,
-               link->conf.Vcc / 10, link->conf.Vcc % 10);
-        if (link->conf.Vpp1)
-                printk(", Vpp %d.%d", link->conf.Vpp1 / 10,
-                       link->conf.Vpp1 % 10);
+        printk(KERN_DEBUG "%s: index 0x%02x: ",
+               dev->name, link->conf.ConfigIndex);
+        if (link->conf.Vpp)
+                printk(", Vpp %d.%d", link->conf.Vpp / 10,
+                       link->conf.Vpp % 10);
         printk(", irq %d", link->irq.AssignedIRQ);
         if (link->io.NumPorts1)
                 printk(", io 0x%04x-0x%04x", link->io.BasePort1,
@@ -867,13 +849,14 @@ spectrum_cs_config(dev_link_t *link)
                        link->io.BasePort2 + link->io.NumPorts2 - 1);
         printk("\n");
 
-        return;
+        return 0;
 
  cs_failed:
-        cs_error(link->handle, last_fn, last_ret);
+        cs_error(link, last_fn, last_ret);
 
  failed:
         spectrum_cs_release(link);
+        return -ENODEV;
 }                               /* spectrum_cs_config */
 
 /*
@@ -882,7 +865,7 @@ spectrum_cs_config(dev_link_t *link)
  * still open, this will be postponed until it is closed.
  */
 static void
-spectrum_cs_release(dev_link_t *link)
+spectrum_cs_release(struct pcmcia_device *link)
 {
         struct net_device *dev = link->priv;
         struct orinoco_private *priv = netdev_priv(dev);
@@ -894,64 +877,46 @@ spectrum_cs_release(dev_link_t *link)
         priv->hw_unavailable++;
         spin_unlock_irqrestore(&priv->lock, flags);
 
-        /* Don't bother checking to see if these succeed or not */
-        pcmcia_release_configuration(link->handle);
-        if (link->io.NumPorts1)
-                pcmcia_release_io(link->handle, &link->io);
-        if (link->irq.AssignedIRQ)
-                pcmcia_release_irq(link->handle, &link->irq);
-        link->state &= ~DEV_CONFIG;
+        pcmcia_disable_device(link);
         if (priv->hw.iobase)
                 ioport_unmap(priv->hw.iobase);
 }                               /* spectrum_cs_release */
 
 
 static int
-spectrum_cs_suspend(struct pcmcia_device *p_dev)
+spectrum_cs_suspend(struct pcmcia_device *link)
 {
-        dev_link_t *link = dev_to_instance(p_dev);
         struct net_device *dev = link->priv;
         struct orinoco_private *priv = netdev_priv(dev);
         unsigned long flags;
         int err = 0;
 
-        link->state |= DEV_SUSPEND;
         /* Mark the device as stopped, to block IO until later */
-        if (link->state & DEV_CONFIG) {
-                spin_lock_irqsave(&priv->lock, flags);
-
-                err = __orinoco_down(dev);
-                if (err)
-                        printk(KERN_WARNING "%s: Error %d downing interface\n",
-                               dev->name, err);
+        spin_lock_irqsave(&priv->lock, flags);
 
-                netif_device_detach(dev);
-                priv->hw_unavailable++;
+        err = __orinoco_down(dev);
+        if (err)
+                printk(KERN_WARNING "%s: Error %d downing interface\n",
+                       dev->name, err);
 
-                spin_unlock_irqrestore(&priv->lock, flags);
+        netif_device_detach(dev);
+        priv->hw_unavailable++;
 
-                pcmcia_release_configuration(link->handle);
-        }
+        spin_unlock_irqrestore(&priv->lock, flags);
 
         return 0;
 }
 
 static int
-spectrum_cs_resume(struct pcmcia_device *p_dev)
+spectrum_cs_resume(struct pcmcia_device *link)
 {
-        dev_link_t *link = dev_to_instance(p_dev);
         struct net_device *dev = link->priv;
         struct orinoco_private *priv = netdev_priv(dev);
 
-        link->state &= ~DEV_SUSPEND;
-        if (link->state & DEV_CONFIG) {
-                /* FIXME: should we double check that this is
-                 * the same card as we had before */
-                pcmcia_request_configuration(link->handle, &link->conf);
-                netif_device_attach(dev);
-                priv->hw_unavailable--;
-                schedule_work(&priv->reset_work);
-        }
+        netif_device_attach(dev);
+        priv->hw_unavailable--;
+        schedule_work(&priv->reset_work);
+
         return 0;
 }
 
@@ -979,7 +944,7 @@ static struct pcmcia_driver orinoco_driver = {
         .drv            = {
                 .name   = DRIVER_NAME,
         },
-        .probe          = spectrum_cs_attach,
+        .probe          = spectrum_cs_probe,
         .remove         = spectrum_cs_detach,
         .suspend        = spectrum_cs_suspend,
         .resume         = spectrum_cs_resume,
diff --git a/drivers/net/wireless/wavelan_cs.c b/drivers/net/wireless/wavelan_cs.c
index 98122f3a4bc2..f7724eb2fa7e 100644
--- a/drivers/net/wireless/wavelan_cs.c
+++ b/drivers/net/wireless/wavelan_cs.c
@@ -1005,7 +1005,7 @@ static inline void
 wv_82593_reconfig(struct net_device *   dev)
 {
   net_local *           lp = netdev_priv(dev);
-  dev_link_t *          link = lp->link;
+  struct pcmcia_device *                link = lp->link;
   unsigned long         flags;
 
   /* Arm the flag, will be cleard in wv_82593_config() */
@@ -3744,16 +3744,16 @@ wv_pcmcia_reset(struct net_device *	dev)
 {
   int           i;
   conf_reg_t    reg = { 0, CS_READ, CISREG_COR, 0 };
-  dev_link_t *  link = ((net_local *)netdev_priv(dev))->link;
+  struct pcmcia_device *        link = ((net_local *)netdev_priv(dev))->link;
 
 #ifdef DEBUG_CONFIG_TRACE
   printk(KERN_DEBUG "%s: ->wv_pcmcia_reset()\n", dev->name);
 #endif
 
-  i = pcmcia_access_configuration_register(link->handle, &reg);
+  i = pcmcia_access_configuration_register(link, &reg);
   if(i != CS_SUCCESS)
     {
-      cs_error(link->handle, AccessConfigurationRegister, i);
+      cs_error(link, AccessConfigurationRegister, i);
       return FALSE;
     }
       
@@ -3764,19 +3764,19 @@ wv_pcmcia_reset(struct net_device *	dev)
 
   reg.Action = CS_WRITE;
   reg.Value = reg.Value | COR_SW_RESET;
-  i = pcmcia_access_configuration_register(link->handle, &reg);
+  i = pcmcia_access_configuration_register(link, &reg);
   if(i != CS_SUCCESS)
     {
-      cs_error(link->handle, AccessConfigurationRegister, i);
+      cs_error(link, AccessConfigurationRegister, i);
       return FALSE;
     }
       
   reg.Action = CS_WRITE;
   reg.Value = COR_LEVEL_IRQ | COR_CONFIG;
-  i = pcmcia_access_configuration_register(link->handle, &reg);
+  i = pcmcia_access_configuration_register(link, &reg);
   if(i != CS_SUCCESS)
     {
-      cs_error(link->handle, AccessConfigurationRegister, i);
+      cs_error(link, AccessConfigurationRegister, i);
       return FALSE;
     }
 
@@ -3940,9 +3940,8 @@ wv_hw_reset(struct net_device *	dev)
  * (called by wavelan_event())
  */
 static inline int
-wv_pcmcia_config(dev_link_t *   link)
+wv_pcmcia_config(struct pcmcia_device * link)
 {
-  client_handle_t       handle = link->handle;
   tuple_t               tuple;
   cisparse_t            parse;
   struct net_device *   dev = (struct net_device *) link->priv;
@@ -3965,16 +3964,16 @@ wv_pcmcia_config(dev_link_t *	link)
     {
       tuple.Attributes = 0;
       tuple.DesiredTuple = CISTPL_CONFIG;
-      i = pcmcia_get_first_tuple(handle, &tuple);
+      i = pcmcia_get_first_tuple(link, &tuple);
       if(i != CS_SUCCESS)
         break;
       tuple.TupleData = (cisdata_t *)buf;
       tuple.TupleDataMax = 64;
       tuple.TupleOffset = 0;
-      i = pcmcia_get_tuple_data(handle, &tuple);
+      i = pcmcia_get_tuple_data(link, &tuple);
       if(i != CS_SUCCESS)
         break;
-      i = pcmcia_parse_tuple(handle, &tuple, &parse);
+      i = pcmcia_parse_tuple(link, &tuple, &parse);
       if(i != CS_SUCCESS)
         break;
       link->conf.ConfigBase = parse.config.base;
@@ -3983,19 +3982,16 @@ wv_pcmcia_config(dev_link_t *	link)
   while(0);
   if(i != CS_SUCCESS)
     {
-      cs_error(link->handle, ParseTuple, i);
-      link->state &= ~DEV_CONFIG_PENDING;
+      cs_error(link, ParseTuple, i);
       return FALSE;
     }
-    
-  /* Configure card */
-  link->state |= DEV_CONFIG;
+
   do
     {
-      i = pcmcia_request_io(link->handle, &link->io);
+      i = pcmcia_request_io(link, &link->io);
       if(i != CS_SUCCESS)
         {
-          cs_error(link->handle, RequestIO, i);
+          cs_error(link, RequestIO, i);
           break;
         }
 
@@ -4003,10 +3999,10 @@ wv_pcmcia_config(dev_link_t *	link)
        * Now allocate an interrupt line.  Note that this does not
        * actually assign a handler to the interrupt.
        */
-      i = pcmcia_request_irq(link->handle, &link->irq);
+      i = pcmcia_request_irq(link, &link->irq);
       if(i != CS_SUCCESS)
         {
-          cs_error(link->handle, RequestIRQ, i);
+          cs_error(link, RequestIRQ, i);
           break;
         }
 
@@ -4015,15 +4011,15 @@ wv_pcmcia_config(dev_link_t *	link)
        * the I/O windows and the interrupt mapping.
        */
       link->conf.ConfigIndex = 1;
-      i = pcmcia_request_configuration(link->handle, &link->conf);
+      i = pcmcia_request_configuration(link, &link->conf);
       if(i != CS_SUCCESS)
         {
-          cs_error(link->handle, RequestConfiguration, i);
+          cs_error(link, RequestConfiguration, i);
           break;
         }
 
       /*
-       * Allocate a small memory window.  Note that the dev_link_t
+       * Allocate a small memory window.  Note that the struct pcmcia_device
        * structure provides space for one window handle -- if your
        * device needs several windows, you'll need to keep track of
        * the handles in your private data structure, link->priv.
@@ -4031,10 +4027,10 @@ wv_pcmcia_config(dev_link_t *	link)
       req.Attributes = WIN_DATA_WIDTH_8|WIN_MEMORY_TYPE_AM|WIN_ENABLE;
       req.Base = req.Size = 0;
       req.AccessSpeed = mem_speed;
-      i = pcmcia_request_window(&link->handle, &req, &link->win);
+      i = pcmcia_request_window(&link, &req, &link->win);
       if(i != CS_SUCCESS)
         {
-          cs_error(link->handle, RequestWindow, i);
+          cs_error(link, RequestWindow, i);
           break;
         }
 
@@ -4046,7 +4042,7 @@ wv_pcmcia_config(dev_link_t *	link)
       i = pcmcia_map_mem_page(link->win, &mem);
       if(i != CS_SUCCESS)
         {
-          cs_error(link->handle, MapMemPage, i);
+          cs_error(link, MapMemPage, i);
           break;
         }
 
@@ -4060,7 +4056,7 @@ wv_pcmcia_config(dev_link_t *	link)
              lp->mem, dev->irq, (u_int) dev->base_addr);
 #endif
 
-      SET_NETDEV_DEV(dev, &handle_to_dev(handle));
+      SET_NETDEV_DEV(dev, &handle_to_dev(link));
       i = register_netdev(dev);
       if(i != 0)
         {
@@ -4072,7 +4068,6 @@ wv_pcmcia_config(dev_link_t *	link)
     }
   while(0);             /* Humm... Disguised goto !!! */
 
-  link->state &= ~DEV_CONFIG_PENDING;
   /* If any step failed, release any partially configured state */
   if(i != 0)
     {
@@ -4081,7 +4076,7 @@ wv_pcmcia_config(dev_link_t *	link)
     }
 
   strcpy(((net_local *) netdev_priv(dev))->node.dev_name, dev->name);
-  link->dev = &((net_local *) netdev_priv(dev))->node;
+  link->dev_node = &((net_local *) netdev_priv(dev))->node;
 
 #ifdef DEBUG_CONFIG_TRACE
   printk(KERN_DEBUG "<-wv_pcmcia_config()\n");
@@ -4096,26 +4091,20 @@ wv_pcmcia_config(dev_link_t *	link)
  * still open, this will be postponed until it is closed.
  */
 static void
-wv_pcmcia_release(dev_link_t *link)
+wv_pcmcia_release(struct pcmcia_device *link)
 {
-  struct net_device *   dev = (struct net_device *) link->priv;
-  net_local *           lp = netdev_priv(dev);
+        struct net_device *     dev = (struct net_device *) link->priv;
+        net_local *             lp = netdev_priv(dev);
 
 #ifdef DEBUG_CONFIG_TRACE
-  printk(KERN_DEBUG "%s: -> wv_pcmcia_release(0x%p)\n", dev->name, link);
+        printk(KERN_DEBUG "%s: -> wv_pcmcia_release(0x%p)\n", dev->name, link);
 #endif
 
-  /* Don't bother checking to see if these succeed or not */
-  iounmap(lp->mem);
-  pcmcia_release_window(link->win);
-  pcmcia_release_configuration(link->handle);
-  pcmcia_release_io(link->handle, &link->io);
-  pcmcia_release_irq(link->handle, &link->irq);
-
-  link->state &= ~DEV_CONFIG;
+        iounmap(lp->mem);
+        pcmcia_disable_device(link);
 
 #ifdef DEBUG_CONFIG_TRACE
-  printk(KERN_DEBUG "%s: <- wv_pcmcia_release()\n", dev->name);
+        printk(KERN_DEBUG "%s: <- wv_pcmcia_release()\n", dev->name);
 #endif
 }
 
@@ -4479,7 +4468,7 @@ static int
 wavelan_open(struct net_device *        dev)
 {
   net_local *   lp = netdev_priv(dev);
-  dev_link_t *  link = lp->link;
+  struct pcmcia_device *        link = lp->link;
   kio_addr_t    base = dev->base_addr;
 
 #ifdef DEBUG_CALLBACK_TRACE
@@ -4533,7 +4522,7 @@ wavelan_open(struct net_device *	dev)
 static int
 wavelan_close(struct net_device *       dev)
 {
-  dev_link_t *  link = ((net_local *)netdev_priv(dev))->link;
+  struct pcmcia_device *        link = ((net_local *)netdev_priv(dev))->link;
   kio_addr_t    base = dev->base_addr;
 
 #ifdef DEBUG_CALLBACK_TRACE
@@ -4587,45 +4576,36 @@ wavelan_close(struct net_device *	dev)
  * card insertion event.
  */
 static int
-wavelan_attach(struct pcmcia_device *p_dev)
+wavelan_probe(struct pcmcia_device *p_dev)
 {
-  dev_link_t *  link;           /* Info for cardmgr */
   struct net_device *   dev;            /* Interface generic data */
   net_local *   lp;             /* Interface specific data */
+  int ret;
 
 #ifdef DEBUG_CALLBACK_TRACE
   printk(KERN_DEBUG "-> wavelan_attach()\n");
 #endif
 
-  /* Initialize the dev_link_t structure */
-  link = kzalloc(sizeof(struct dev_link_t), GFP_KERNEL);
-  if (!link) return -ENOMEM;
-
   /* The io structure describes IO port mapping */
-  link->io.NumPorts1 = 8;
-  link->io.Attributes1 = IO_DATA_PATH_WIDTH_8;
-  link->io.IOAddrLines = 3;
+  p_dev->io.NumPorts1 = 8;
+  p_dev->io.Attributes1 = IO_DATA_PATH_WIDTH_8;
+  p_dev->io.IOAddrLines = 3;
 
   /* Interrupt setup */
-  link->irq.Attributes = IRQ_TYPE_EXCLUSIVE | IRQ_HANDLE_PRESENT;
-  link->irq.IRQInfo1 = IRQ_LEVEL_ID;
-  link->irq.Handler = wavelan_interrupt;
+  p_dev->irq.Attributes = IRQ_TYPE_EXCLUSIVE | IRQ_HANDLE_PRESENT;
+  p_dev->irq.IRQInfo1 = IRQ_LEVEL_ID;
+  p_dev->irq.Handler = wavelan_interrupt;
 
   /* General socket configuration */
-  link->conf.Attributes = CONF_ENABLE_IRQ;
-  link->conf.Vcc = 50;
-  link->conf.IntType = INT_MEMORY_AND_IO;
-
-  /* Chain drivers */
-  link->next = NULL;
+  p_dev->conf.Attributes = CONF_ENABLE_IRQ;
+  p_dev->conf.IntType = INT_MEMORY_AND_IO;
 
   /* Allocate the generic data structure */
   dev = alloc_etherdev(sizeof(net_local));
-  if (!dev) {
-      kfree(link);
+  if (!dev)
       return -ENOMEM;
-  }
-  link->priv = link->irq.Instance = dev;
+
+  p_dev->priv = p_dev->irq.Instance = dev;
 
   lp = netdev_priv(dev);
 
@@ -4642,7 +4622,6 @@ wavelan_attach(struct pcmcia_device *p_dev)
   spin_lock_init(&lp->spinlock);
 
   /* back links */
-  lp->link = link;
   lp->dev = dev;
 
   /* wavelan NET3 callbacks */
@@ -4668,15 +4647,18 @@ wavelan_attach(struct pcmcia_device *p_dev)
   /* Other specific data */
   dev->mtu = WAVELAN_MTU;
 
-  link->handle = p_dev;
-  p_dev->instance = link;
+  ret = wv_pcmcia_config(p_dev);
+  if (ret)
+          return ret;
 
-  link->state |= DEV_PRESENT | DEV_CONFIG_PENDING;
-  if(wv_pcmcia_config(link) &&
-     wv_hw_config(dev))
-          wv_init_info(dev);
-  else
+  ret = wv_hw_config(dev);
+  if (ret) {
           dev->irq = 0;
+          pcmcia_disable_device(p_dev);
+          return ret;
+  }
+
+  wv_init_info(dev);
 
 #ifdef DEBUG_CALLBACK_TRACE
   printk(KERN_DEBUG "<- wavelan_attach()\n");
@@ -4693,25 +4675,14 @@ wavelan_attach(struct pcmcia_device *p_dev)
  * is released.
  */
 static void
-wavelan_detach(struct pcmcia_device *p_dev)
+wavelan_detach(struct pcmcia_device *link)
 {
-   dev_link_t *link = dev_to_instance(p_dev);
-
 #ifdef DEBUG_CALLBACK_TRACE
   printk(KERN_DEBUG "-> wavelan_detach(0x%p)\n", link);
 #endif
 
-  /*
-   * If the device is currently configured and active, we won't
-   * actually delete it yet.  Instead, it is marked so that when the
-   * release() function is called, that will trigger a proper
-   * detach().
-   */
-  if(link->state & DEV_CONFIG)
-    {
-      /* Some others haven't done their job : give them another chance */
-      wv_pcmcia_release(link);
-    }
+  /* Some others haven't done their job : give them another chance */
+  wv_pcmcia_release(link);
 
   /* Free pieces */
   if(link->priv)
@@ -4720,23 +4691,21 @@ wavelan_detach(struct pcmcia_device *p_dev)
 
       /* Remove ourselves from the kernel list of ethernet devices */
       /* Warning : can't be called from interrupt, timer or wavelan_close() */
-      if (link->dev)
+      if (link->dev_node)
         unregister_netdev(dev);
-      link->dev = NULL;
+      link->dev_node = NULL;
       ((net_local *)netdev_priv(dev))->link = NULL;
       ((net_local *)netdev_priv(dev))->dev = NULL;
       free_netdev(dev);
     }
-  kfree(link);
 
 #ifdef DEBUG_CALLBACK_TRACE
   printk(KERN_DEBUG "<- wavelan_detach()\n");
 #endif
 }
 
-static int wavelan_suspend(struct pcmcia_device *p_dev)
+static int wavelan_suspend(struct pcmcia_device *link)
 {
-        dev_link_t *link = dev_to_instance(p_dev);
         struct net_device *     dev = (struct net_device *) link->priv;
 
         /* NB: wavelan_close will be called, but too late, so we are
@@ -4748,36 +4717,22 @@ static int wavelan_suspend(struct pcmcia_device *p_dev)
         /* Stop receiving new messages and wait end of transmission */
         wv_ru_stop(dev);
 
+        if (link->open)
+                netif_device_detach(dev);
+
         /* Power down the module */
         hacr_write(dev->base_addr, HACR_DEFAULT & (~HACR_PWR_STAT));
 
-        /* The card is now suspended */
-        link->state |= DEV_SUSPEND;
-
-        if(link->state & DEV_CONFIG)
-        {
-                if(link->open)
-                        netif_device_detach(dev);
-                pcmcia_release_configuration(link->handle);
-        }
-
         return 0;
 }
 
-static int wavelan_resume(struct pcmcia_device *p_dev)
+static int wavelan_resume(struct pcmcia_device *link)
 {
-        dev_link_t *link = dev_to_instance(p_dev);
         struct net_device *     dev = (struct net_device *) link->priv;
 
-        link->state &= ~DEV_SUSPEND;
-        if(link->state & DEV_CONFIG)
-        {
-                pcmcia_request_configuration(link->handle, &link->conf);
-                if(link->open)  /* If RESET -> True, If RESUME -> False ? */
-                {
-                        wv_hw_reset(dev);
-                        netif_device_attach(dev);
-                }
+        if (link->open) {
+                wv_hw_reset(dev);
+                netif_device_attach(dev);
         }
 
         return 0;
@@ -4798,7 +4753,7 @@ static struct pcmcia_driver wavelan_driver = {
         .drv            = {
                 .name   = "wavelan_cs",
         },
-        .probe          = wavelan_attach,
+        .probe          = wavelan_probe,
         .remove         = wavelan_detach,
         .id_table       = wavelan_ids,
         .suspend        = wavelan_suspend,
diff --git a/drivers/net/wireless/wavelan_cs.p.h b/drivers/net/wireless/wavelan_cs.p.h
index 451f6271dcbc..c65fe7a391ec 100644
--- a/drivers/net/wireless/wavelan_cs.p.h
+++ b/drivers/net/wireless/wavelan_cs.p.h
@@ -602,7 +602,7 @@ struct net_local
   dev_node_t    node;           /* ???? What is this stuff ???? */
   struct net_device *   dev;            /* Reverse link... */
   spinlock_t    spinlock;       /* Serialize access to the hardware (SMP) */
-  dev_link_t *  link;           /* pcmcia structure */
+  struct pcmcia_device *        link;           /* pcmcia structure */
   en_stats      stats;          /* Ethernet interface statistics */
   int           nresets;        /* Number of hw resets */
   u_char        configured;     /* If it is configured */
@@ -733,9 +733,9 @@ static int
 static inline void
         wv_hw_reset(struct net_device *);       /* Same, + start receiver unit */
 static inline int
-        wv_pcmcia_config(dev_link_t *); /* Configure the pcmcia interface */
+        wv_pcmcia_config(struct pcmcia_device *);       /* Configure the pcmcia interface */
 static void
-        wv_pcmcia_release(dev_link_t *);/* Remove a device */
+        wv_pcmcia_release(struct pcmcia_device *);/* Remove a device */
 /* ---------------------- INTERRUPT HANDLING ---------------------- */
 static irqreturn_t
         wavelan_interrupt(int,  /* Interrupt handler */
diff --git a/drivers/net/wireless/wl3501.h b/drivers/net/wireless/wl3501.h
index 4303c50c2ab6..65ceb088f700 100644
--- a/drivers/net/wireless/wl3501.h
+++ b/drivers/net/wireless/wl3501.h
@@ -611,5 +611,6 @@ struct wl3501_card {
         struct iw_spy_data              spy_data;
         struct iw_public_data           wireless_data;
         struct dev_node_t               node;
+        struct pcmcia_device            *p_dev;
 };
 #endif
diff --git a/drivers/net/wireless/wl3501_cs.c b/drivers/net/wireless/wl3501_cs.c
index 48e10b0c7e74..e52a650f6737 100644
--- a/drivers/net/wireless/wl3501_cs.c
+++ b/drivers/net/wireless/wl3501_cs.c
@@ -103,8 +103,8 @@ module_param(pc_debug, int, 0);
  * release a socket, in response to card insertion and ejection events.  They
  * are invoked from the wl24 event handler.
  */
-static void wl3501_config(dev_link_t *link);
-static void wl3501_release(dev_link_t *link);
+static int wl3501_config(struct pcmcia_device *link);
+static void wl3501_release(struct pcmcia_device *link);
 
 /*
  * The dev_info variable is the "key" that is used to match up this
@@ -226,17 +226,6 @@ static void iw_copy_mgmt_info_element(struct iw_mgmt_info_element *to,
         iw_set_mgmt_info_element(from->id, to, from->data, from->len);
 }
 
-/*
- * A linked list of "instances" of the wl24 device.  Each actual PCMCIA card
- * corresponds to one device instance, and is described by one dev_link_t
- * structure (defined in ds.h).
- *
- * You may not want to use a linked list for this -- for example, the memory
- * card driver uses an array of dev_link_t pointers, where minor device numbers
- * are used to derive the corresponding array index.
- */
-static dev_link_t *wl3501_dev_list;
-
 static inline void wl3501_switch_page(struct wl3501_card *this, u8 page)
 {
         wl3501_outb(page, this->base_addr + WL3501_NIC_BSS);
@@ -1281,15 +1270,10 @@ static int wl3501_close(struct net_device *dev)
         struct wl3501_card *this = dev->priv;
         int rc = -ENODEV;
         unsigned long flags;
-        dev_link_t *link;
+        struct pcmcia_device *link;
+        link = this->p_dev;
 
         spin_lock_irqsave(&this->lock, flags);
-        /* Check if the device is in wl3501_dev_list */
-        for (link = wl3501_dev_list; link; link = link->next)
-                if (link->priv == dev)
-                        break;
-        if (!link)
-                goto out;
         link->open--;
 
         /* Stop wl3501_hard_start_xmit() from now on */
@@ -1301,7 +1285,6 @@ static int wl3501_close(struct net_device *dev)
 
         rc = 0;
         printk(KERN_INFO "%s: WL3501 closed\n", dev->name);
-out:
         spin_unlock_irqrestore(&this->lock, flags);
         return rc;
 }
@@ -1400,14 +1383,11 @@ static int wl3501_open(struct net_device *dev)
         int rc = -ENODEV;
         struct wl3501_card *this = dev->priv;
         unsigned long flags;
-        dev_link_t *link;
+        struct pcmcia_device *link;
+        link = this->p_dev;
 
         spin_lock_irqsave(&this->lock, flags);
-        /* Check if the device is in wl3501_dev_list */
-        for (link = wl3501_dev_list; link; link = link->next)
-                if (link->priv == dev)
-                        break;
-        if (!DEV_OK(link))
+        if (!pcmcia_dev_present(link))
                 goto out;
         netif_device_attach(dev);
         link->open++;
@@ -1497,38 +1477,23 @@ static struct ethtool_ops ops = {
  * Services. If it has been released, all local data structures are freed.
  * Otherwise, the structures will be freed when the device is released.
  */
-static void wl3501_detach(struct pcmcia_device *p_dev)
+static void wl3501_detach(struct pcmcia_device *link)
 {
-        dev_link_t *link = dev_to_instance(p_dev);
-        dev_link_t **linkp;
         struct net_device *dev = link->priv;
 
-        /* Locate device structure */
-        for (linkp = &wl3501_dev_list; *linkp; linkp = &(*linkp)->next)
-                if (*linkp == link)
-                        break;
-        if (!*linkp)
-                goto out;
-
         /* If the device is currently configured and active, we won't actually
          * delete it yet.  Instead, it is marked so that when the release()
          * function is called, that will trigger a proper detach(). */
 
-        if (link->state & DEV_CONFIG) {
-                while (link->open > 0)
-                        wl3501_close(dev);
-
-                netif_device_detach(dev);
-                wl3501_release(link);
-        }
+        while (link->open > 0)
+                wl3501_close(dev);
 
-        /* Unlink device structure, free pieces */
-        *linkp = link->next;
+        netif_device_detach(dev);
+        wl3501_release(link);
 
         if (link->priv)
                 free_netdev(link->priv);
-        kfree(link);
-out:
+
         return;
 }
 
@@ -1953,33 +1918,26 @@ static const struct iw_handler_def wl3501_handler_def = {
  * The dev_link structure is initialized, but we don't actually configure the
  * card at this point -- we wait until we receive a card insertion event.
  */
-static int wl3501_attach(struct pcmcia_device *p_dev)
+static int wl3501_probe(struct pcmcia_device *p_dev)
 {
-        dev_link_t *link;
         struct net_device *dev;
         struct wl3501_card *this;
 
-        /* Initialize the dev_link_t structure */
-        link = kzalloc(sizeof(*link), GFP_KERNEL);
-        if (!link)
-                return -ENOMEM;
-
         /* The io structure describes IO port mapping */
-        link->io.NumPorts1      = 16;
-        link->io.Attributes1    = IO_DATA_PATH_WIDTH_8;
-        link->io.IOAddrLines    = 5;
+        p_dev->io.NumPorts1     = 16;
+        p_dev->io.Attributes1   = IO_DATA_PATH_WIDTH_8;
+        p_dev->io.IOAddrLines   = 5;
 
         /* Interrupt setup */
-        link->irq.Attributes    = IRQ_TYPE_EXCLUSIVE | IRQ_HANDLE_PRESENT;
-        link->irq.IRQInfo1      = IRQ_LEVEL_ID;
-        link->irq.Handler = wl3501_interrupt;
+        p_dev->irq.Attributes   = IRQ_TYPE_EXCLUSIVE | IRQ_HANDLE_PRESENT;
+        p_dev->irq.IRQInfo1     = IRQ_LEVEL_ID;
+        p_dev->irq.Handler = wl3501_interrupt;
 
         /* General socket configuration */
-        link->conf.Attributes   = CONF_ENABLE_IRQ;
-        link->conf.Vcc          = 50;
-        link->conf.IntType      = INT_MEMORY_AND_IO;
-        link->conf.ConfigIndex  = 1;
-        link->conf.Present      = PRESENT_OPTION;
+        p_dev->conf.Attributes  = CONF_ENABLE_IRQ;
+        p_dev->conf.IntType     = INT_MEMORY_AND_IO;
+        p_dev->conf.ConfigIndex = 1;
+        p_dev->conf.Present     = PRESENT_OPTION;
 
         dev = alloc_etherdev(sizeof(struct wl3501_card));
         if (!dev)
@@ -1992,22 +1950,15 @@ static int wl3501_attach(struct pcmcia_device *p_dev)
         dev->get_stats          = wl3501_get_stats;
         this = dev->priv;
         this->wireless_data.spy_data = &this->spy_data;
+        this->p_dev = p_dev;
         dev->wireless_data      = &this->wireless_data;
         dev->wireless_handlers  = (struct iw_handler_def *)&wl3501_handler_def;
         SET_ETHTOOL_OPS(dev, &ops);
         netif_stop_queue(dev);
-        link->priv = link->irq.Instance = dev;
-
-        link->handle = p_dev;
-        p_dev->instance = link;
-
-        link->state |= DEV_PRESENT | DEV_CONFIG_PENDING;
-        wl3501_config(link);
+        p_dev->priv = p_dev->irq.Instance = dev;
 
-        return 0;
+        return wl3501_config(p_dev);
 out_link:
-        kfree(link);
-        link = NULL;
         return -ENOMEM;
 }
 
@@ -2022,11 +1973,10 @@ do { last_fn = (fn); if ((last_ret = (ret)) != 0) goto cs_failed; } while (0)
  * received, to configure the PCMCIA socket, and to make the ethernet device
  * available to the system.
  */
-static void wl3501_config(dev_link_t *link)
+static int wl3501_config(struct pcmcia_device *link)
 {
         tuple_t tuple;
         cisparse_t parse;
-        client_handle_t handle = link->handle;
         struct net_device *dev = link->priv;
         int i = 0, j, last_fn, last_ret;
         unsigned char bf[64];
@@ -2035,18 +1985,15 @@ static void wl3501_config(dev_link_t *link)
         /* This reads the card's CONFIG tuple to find its config registers. */
         tuple.Attributes        = 0;
         tuple.DesiredTuple      = CISTPL_CONFIG;
-        CS_CHECK(GetFirstTuple, pcmcia_get_first_tuple(handle, &tuple));
+        CS_CHECK(GetFirstTuple, pcmcia_get_first_tuple(link, &tuple));
         tuple.TupleData         = bf;
         tuple.TupleDataMax      = sizeof(bf);
         tuple.TupleOffset       = 0;
-        CS_CHECK(GetTupleData, pcmcia_get_tuple_data(handle, &tuple));
-        CS_CHECK(ParseTuple, pcmcia_parse_tuple(handle, &tuple, &parse));
+        CS_CHECK(GetTupleData, pcmcia_get_tuple_data(link, &tuple));
+        CS_CHECK(ParseTuple, pcmcia_parse_tuple(link, &tuple, &parse));
         link->conf.ConfigBase   = parse.config.base;
         link->conf.Present      = parse.config.rmask[0];
 
-        /* Configure card */
-        link->state |= DEV_CONFIG;
-
         /* Try allocating IO ports.  This tries a few fixed addresses.  If you
          * want, you can also read the card's config table to pick addresses --
          * see the serial driver for an example. */
@@ -2056,28 +2003,28 @@ static void wl3501_config(dev_link_t *link)
                  * 0x200-0x2ff, and so on, because this seems safer */
                 link->io.BasePort1 = j;
                 link->io.BasePort2 = link->io.BasePort1 + 0x10;
-                i = pcmcia_request_io(link->handle, &link->io);
+                i = pcmcia_request_io(link, &link->io);
                 if (i == CS_SUCCESS)
                         break;
         }
         if (i != CS_SUCCESS) {
-                cs_error(link->handle, RequestIO, i);
+                cs_error(link, RequestIO, i);
                 goto failed;
         }
 
         /* Now allocate an interrupt line. Note that this does not actually
          * assign a handler to the interrupt. */
 
-        CS_CHECK(RequestIRQ, pcmcia_request_irq(link->handle, &link->irq));
+        CS_CHECK(RequestIRQ, pcmcia_request_irq(link, &link->irq));
 
         /* This actually configures the PCMCIA socket -- setting up the I/O
          * windows and the interrupt mapping.  */
 
-        CS_CHECK(RequestConfiguration, pcmcia_request_configuration(link->handle, &link->conf));
+        CS_CHECK(RequestConfiguration, pcmcia_request_configuration(link, &link->conf));
 
         dev->irq = link->irq.AssignedIRQ;
         dev->base_addr = link->io.BasePort1;
-        SET_NETDEV_DEV(dev, &handle_to_dev(handle));
+        SET_NETDEV_DEV(dev, &handle_to_dev(link));
         if (register_netdev(dev)) {
                 printk(KERN_NOTICE "wl3501_cs: register_netdev() failed\n");
                 goto failed;
@@ -2088,10 +2035,9 @@ static void wl3501_config(dev_link_t *link)
         this = dev->priv;
         /*
          * At this point, the dev_node_t structure(s) should be initialized and
-         * arranged in a linked list at link->dev.
+         * arranged in a linked list at link->dev_node.
          */
-        link->dev = &this->node;
-        link->state &= ~DEV_CONFIG_PENDING;
+        link->dev_node = &this->node;
 
         this->base_addr = dev->base_addr;
 
@@ -2127,13 +2073,13 @@ static void wl3501_config(dev_link_t *link)
         spin_lock_init(&this->lock);
         init_waitqueue_head(&this->wait);
         netif_start_queue(dev);
-        goto out;
+        return 0;
+
 cs_failed:
-        cs_error(link->handle, last_fn, last_ret);
+        cs_error(link, last_fn, last_ret);
 failed:
         wl3501_release(link);
-out:
-        return;
+        return -ENODEV;
 }
 
 /**
@@ -2144,52 +2090,36 @@ out:
  * and release the PCMCIA configuration.  If the device is still open, this
  * will be postponed until it is closed.
  */
-static void wl3501_release(dev_link_t *link)
+static void wl3501_release(struct pcmcia_device *link)
 {
         struct net_device *dev = link->priv;
 
         /* Unlink the device chain */
-        if (link->dev) {
+        if (link->dev_node)
                 unregister_netdev(dev);
-                link->dev = NULL;
-        }
 
-        /* Don't bother checking to see if these succeed or not */
-        pcmcia_release_configuration(link->handle);
-        pcmcia_release_io(link->handle, &link->io);
-        pcmcia_release_irq(link->handle, &link->irq);
-        link->state &= ~DEV_CONFIG;
+        pcmcia_disable_device(link);
 }
 
-static int wl3501_suspend(struct pcmcia_device *p_dev)
+static int wl3501_suspend(struct pcmcia_device *link)
 {
-        dev_link_t *link = dev_to_instance(p_dev);
         struct net_device *dev = link->priv;
 
-        link->state |= DEV_SUSPEND;
-
         wl3501_pwr_mgmt(dev->priv, WL3501_SUSPEND);
-        if (link->state & DEV_CONFIG) {
-                if (link->open)
-                        netif_device_detach(dev);
-                pcmcia_release_configuration(link->handle);
-        }
+        if (link->open)
+                netif_device_detach(dev);
 
         return 0;
 }
 
-static int wl3501_resume(struct pcmcia_device *p_dev)
+static int wl3501_resume(struct pcmcia_device *link)
 {
-        dev_link_t *link = dev_to_instance(p_dev);
         struct net_device *dev = link->priv;
 
         wl3501_pwr_mgmt(dev->priv, WL3501_RESUME);
-        if (link->state & DEV_CONFIG) {
-                pcmcia_request_configuration(link->handle, &link->conf);
-                if (link->open) {
-                        wl3501_reset(dev);
-                        netif_device_attach(dev);
-                }
+        if (link->open) {
+                wl3501_reset(dev);
+                netif_device_attach(dev);
         }
 
         return 0;
@@ -2207,7 +2137,7 @@ static struct pcmcia_driver wl3501_driver = {
         .drv            = {
                 .name   = "wl3501_cs",
         },
-        .probe          = wl3501_attach,
+        .probe          = wl3501_probe,
         .remove         = wl3501_detach,
         .id_table       = wl3501_ids,
         .suspend        = wl3501_suspend,
@@ -2221,9 +2151,7 @@ static int __init wl3501_init_module(void)
 
 static void __exit wl3501_exit_module(void)
 {
-        dprintk(0, ": unloading");
         pcmcia_unregister_driver(&wl3501_driver);
-        BUG_ON(wl3501_dev_list != NULL);
 }
 
 module_init(wl3501_init_module);
diff --git a/drivers/net/yellowfin.c b/drivers/net/yellowfin.c
index 75d56bfef0ee..fd0f43b7db5b 100644
--- a/drivers/net/yellowfin.c
+++ b/drivers/net/yellowfin.c
@@ -1441,8 +1441,7 @@ static void __devexit yellowfin_remove_one (struct pci_dev *pdev)
         struct net_device *dev = pci_get_drvdata(pdev);
         struct yellowfin_private *np;
 
-        if (!dev)
-                BUG();
+        BUG_ON(!dev);
         np = netdev_priv(dev);
 
         pci_free_consistent(pdev, STATUS_TOTAL_SIZE, np->tx_status, 
diff --git a/drivers/parport/parport_cs.c b/drivers/parport/parport_cs.c
index 158d92563259..b953d5907c05 100644
--- a/drivers/parport/parport_cs.c
+++ b/drivers/parport/parport_cs.c
@@ -81,15 +81,15 @@ static char *version =
 #define FORCE_EPP_MODE  0x08
 
 typedef struct parport_info_t {
-    dev_link_t          link;
+        struct pcmcia_device    *p_dev;
     int                 ndev;
     dev_node_t          node;
     struct parport      *port;
 } parport_info_t;
 
 static void parport_detach(struct pcmcia_device *p_dev);
-static void parport_config(dev_link_t *link);
-static void parport_cs_release(dev_link_t *);
+static int parport_config(struct pcmcia_device *link);
+static void parport_cs_release(struct pcmcia_device *);
 
 /*======================================================================
 
@@ -99,10 +99,9 @@ static void parport_cs_release(dev_link_t *);
 
 ======================================================================*/
 
-static int parport_attach(struct pcmcia_device *p_dev)
+static int parport_probe(struct pcmcia_device *link)
 {
     parport_info_t *info;
-    dev_link_t *link;
 
     DEBUG(0, "parport_attach()\n");
 
@@ -110,23 +109,17 @@ static int parport_attach(struct pcmcia_device *p_dev)
     info = kmalloc(sizeof(*info), GFP_KERNEL);
     if (!info) return -ENOMEM;
     memset(info, 0, sizeof(*info));
-    link = &info->link; link->priv = info;
+    link->priv = info;
+    info->p_dev = link;
 
     link->io.Attributes1 = IO_DATA_PATH_WIDTH_8;
     link->io.Attributes2 = IO_DATA_PATH_WIDTH_8;
     link->irq.Attributes = IRQ_TYPE_EXCLUSIVE;
     link->irq.IRQInfo1 = IRQ_LEVEL_ID;
     link->conf.Attributes = CONF_ENABLE_IRQ;
-    link->conf.Vcc = 50;
     link->conf.IntType = INT_MEMORY_AND_IO;
 
-    link->handle = p_dev;
-    p_dev->instance = link;
-
-    link->state |= DEV_PRESENT | DEV_CONFIG_PENDING;
-    parport_config(link);
-
-    return 0;
+    return parport_config(link);
 } /* parport_attach */
 
 /*======================================================================
@@ -138,14 +131,11 @@ static int parport_attach(struct pcmcia_device *p_dev)
 
 ======================================================================*/
 
-static void parport_detach(struct pcmcia_device *p_dev)
+static void parport_detach(struct pcmcia_device *link)
 {
-    dev_link_t *link = dev_to_instance(p_dev);
-
     DEBUG(0, "parport_detach(0x%p)\n", link);
 
-    if (link->state & DEV_CONFIG)
-        parport_cs_release(link);
+    parport_cs_release(link);
 
     kfree(link->priv);
 } /* parport_detach */
@@ -161,14 +151,12 @@ static void parport_detach(struct pcmcia_device *p_dev)
 #define CS_CHECK(fn, ret) \
 do { last_fn = (fn); if ((last_ret = (ret)) != 0) goto cs_failed; } while (0)
 
-void parport_config(dev_link_t *link)
+static int parport_config(struct pcmcia_device *link)
 {
-    client_handle_t handle = link->handle;
     parport_info_t *info = link->priv;
     tuple_t tuple;
     u_short buf[128];
     cisparse_t parse;
-    config_info_t conf;
     cistpl_cftable_entry_t *cfg = &parse.cftable_entry;
     cistpl_cftable_entry_t dflt = { 0 };
     struct parport *p;
@@ -180,24 +168,18 @@ void parport_config(dev_link_t *link)
     tuple.TupleOffset = 0; tuple.TupleDataMax = 255;
     tuple.Attributes = 0;
     tuple.DesiredTuple = CISTPL_CONFIG;
-    CS_CHECK(GetFirstTuple, pcmcia_get_first_tuple(handle, &tuple));
-    CS_CHECK(GetTupleData, pcmcia_get_tuple_data(handle, &tuple));
-    CS_CHECK(ParseTuple, pcmcia_parse_tuple(handle, &tuple, &parse));
+    CS_CHECK(GetFirstTuple, pcmcia_get_first_tuple(link, &tuple));
+    CS_CHECK(GetTupleData, pcmcia_get_tuple_data(link, &tuple));
+    CS_CHECK(ParseTuple, pcmcia_parse_tuple(link, &tuple, &parse));
     link->conf.ConfigBase = parse.config.base;
     link->conf.Present = parse.config.rmask[0];
-    
-    /* Configure card */
-    link->state |= DEV_CONFIG;
 
-    /* Not sure if this is right... look up the current Vcc */
-    CS_CHECK(GetConfigurationInfo, pcmcia_get_configuration_info(handle, &conf));
-    
     tuple.DesiredTuple = CISTPL_CFTABLE_ENTRY;
     tuple.Attributes = 0;
-    CS_CHECK(GetFirstTuple, pcmcia_get_first_tuple(handle, &tuple));
+    CS_CHECK(GetFirstTuple, pcmcia_get_first_tuple(link, &tuple));
     while (1) {
-        if (pcmcia_get_tuple_data(handle, &tuple) != 0 ||
-                pcmcia_parse_tuple(handle, &tuple, &parse) != 0)
+        if (pcmcia_get_tuple_data(link, &tuple) != 0 ||
+                pcmcia_parse_tuple(link, &tuple, &parse) != 0)
             goto next_entry;
 
         if ((cfg->io.nwin > 0) || (dflt.io.nwin > 0)) {
@@ -212,7 +194,7 @@ void parport_config(dev_link_t *link)
                 link->io.BasePort2 = io->win[1].base;
                 link->io.NumPorts2 = io->win[1].len;
             }
-            if (pcmcia_request_io(link->handle, &link->io) != 0)
+            if (pcmcia_request_io(link, &link->io) != 0)
                 goto next_entry;
             /* If we've got this far, we're done */
             break;
@@ -220,15 +202,12 @@ void parport_config(dev_link_t *link)
         
     next_entry:
         if (cfg->flags & CISTPL_CFTABLE_DEFAULT) dflt = *cfg;
-        CS_CHECK(GetNextTuple, pcmcia_get_next_tuple(handle, &tuple));
+        CS_CHECK(GetNextTuple, pcmcia_get_next_tuple(link, &tuple));
     }
     
-    CS_CHECK(RequestIRQ, pcmcia_request_irq(handle, &link->irq));
-    CS_CHECK(RequestConfiguration, pcmcia_request_configuration(handle, &link->conf));
+    CS_CHECK(RequestIRQ, pcmcia_request_irq(link, &link->irq));
+    CS_CHECK(RequestConfiguration, pcmcia_request_configuration(link, &link->conf));
 
-    release_region(link->io.BasePort1, link->io.NumPorts1);
-    if (link->io.NumPorts2)
-        release_region(link->io.BasePort2, link->io.NumPorts2);
     p = parport_pc_probe_port(link->io.BasePort1, link->io.BasePort2,
                               link->irq.AssignedIRQ, PARPORT_DMA_NONE,
                               NULL);
@@ -247,17 +226,15 @@ void parport_config(dev_link_t *link)
     info->node.minor = p->number;
     info->port = p;
     strcpy(info->node.dev_name, p->name);
-    link->dev = &info->node;
+    link->dev_node = &info->node;
+
+    return 0;
 
-    link->state &= ~DEV_CONFIG_PENDING;
-    return;
-    
 cs_failed:
-    cs_error(link->handle, last_fn, last_ret);
+    cs_error(link, last_fn, last_ret);
 failed:
     parport_cs_release(link);
-    link->state &= ~DEV_CONFIG_PENDING;
-
+    return -ENODEV;
 } /* parport_config */
 
 /*======================================================================
@@ -268,53 +245,21 @@ failed:
     
 ======================================================================*/
 
-void parport_cs_release(dev_link_t *link)
-{
-    parport_info_t *info = link->priv;
-    
-    DEBUG(0, "parport_release(0x%p)\n", link);
-
-    if (info->ndev) {
-        struct parport *p = info->port;
-        parport_pc_unregister_port(p);
-        request_region(link->io.BasePort1, link->io.NumPorts1,
-                       info->node.dev_name);
-        if (link->io.NumPorts2)
-            request_region(link->io.BasePort2, link->io.NumPorts2,
-                           info->node.dev_name);
-    }
-    info->ndev = 0;
-    link->dev = NULL;
-    
-    pcmcia_release_configuration(link->handle);
-    pcmcia_release_io(link->handle, &link->io);
-    pcmcia_release_irq(link->handle, &link->irq);
-    
-    link->state &= ~DEV_CONFIG;
-
-} /* parport_cs_release */
-
-static int parport_suspend(struct pcmcia_device *dev)
+void parport_cs_release(struct pcmcia_device *link)
 {
-        dev_link_t *link = dev_to_instance(dev);
+        parport_info_t *info = link->priv;
 
-        link->state |= DEV_SUSPEND;
-        if (link->state & DEV_CONFIG)
-                pcmcia_release_configuration(link->handle);
+        DEBUG(0, "parport_release(0x%p)\n", link);
 
-        return 0;
-}
-
-static int parport_resume(struct pcmcia_device *dev)
-{
-        dev_link_t *link = dev_to_instance(dev);
+        if (info->ndev) {
+                struct parport *p = info->port;
+                parport_pc_unregister_port(p);
+        }
+        info->ndev = 0;
 
-        link->state &= ~DEV_SUSPEND;
-        if (DEV_OK(link))
-                pcmcia_request_configuration(link->handle, &link->conf);
+        pcmcia_disable_device(link);
+} /* parport_cs_release */
 
-        return 0;
-}
 
 static struct pcmcia_device_id parport_ids[] = {
         PCMCIA_DEVICE_FUNC_ID(3),
@@ -328,11 +273,9 @@ static struct pcmcia_driver parport_cs_driver = {
         .drv            = {
                 .name   = "parport_cs",
         },
-        .probe          = parport_attach,
+        .probe          = parport_probe,
         .remove         = parport_detach,
         .id_table       = parport_ids,
-        .suspend        = parport_suspend,
-        .resume         = parport_resume,
 };
 
 static int __init init_parport_cs(void)
diff --git a/drivers/parport/parport_serial.c b/drivers/parport/parport_serial.c
index d121644646b9..98b83a85c60e 100644
--- a/drivers/parport/parport_serial.c
+++ b/drivers/parport/parport_serial.c
@@ -100,8 +100,6 @@ static struct pci_device_id parport_serial_pci_tbl[] = {
           PCI_ANY_ID, PCI_ANY_ID, 0, 0, netmos_9xx5_combo },
         { PCI_VENDOR_ID_NETMOS, PCI_DEVICE_ID_NETMOS_9835,
           PCI_ANY_ID, PCI_ANY_ID, 0, 0, netmos_9xx5_combo },
-        { PCI_VENDOR_ID_NETMOS, PCI_DEVICE_ID_NETMOS_9835,
-          PCI_ANY_ID, PCI_ANY_ID, 0, 0, netmos_9xx5_combo },
         { PCI_VENDOR_ID_NETMOS, PCI_DEVICE_ID_NETMOS_9845,
           PCI_ANY_ID, PCI_ANY_ID, 0, 0, netmos_9xx5_combo },
         { PCI_VENDOR_ID_NETMOS, PCI_DEVICE_ID_NETMOS_9855,
diff --git a/drivers/pcmcia/Kconfig b/drivers/pcmcia/Kconfig
index 1f4ad0e7836e..cba6c9eef28e 100644
--- a/drivers/pcmcia/Kconfig
+++ b/drivers/pcmcia/Kconfig
@@ -263,6 +263,13 @@ config OMAP_CF
           Say Y here to support the CompactFlash controller on OMAP.
           Note that this doesn't support "True IDE" mode.
 
+config AT91_CF
+        tristate "AT91 CompactFlash Controller"
+        depends on PCMCIA && ARCH_AT91RM9200
+        help
+          Say Y here to support the CompactFlash controller on AT91 chips.
+          Or choose M to compile the driver as a module named "at91_cf".
+
 config PCCARD_NONSTATIC
         tristate
 
diff --git a/drivers/pcmcia/Makefile b/drivers/pcmcia/Makefile
index bcecf5133b7e..4276965517f2 100644
--- a/drivers/pcmcia/Makefile
+++ b/drivers/pcmcia/Makefile
@@ -10,7 +10,7 @@ pcmcia_core-y					+= cs.o cistpl.o rsrc_mgr.o socket_sysfs.o
 pcmcia_core-$(CONFIG_CARDBUS)                   += cardbus.o
 obj-$(CONFIG_PCCARD)                            += pcmcia_core.o
 
-pcmcia-y                                        += ds.o pcmcia_compat.o pcmcia_resource.o
+pcmcia-y                                        += ds.o pcmcia_resource.o
 pcmcia-$(CONFIG_PCMCIA_IOCTL)                   += pcmcia_ioctl.o
 obj-$(CONFIG_PCMCIA)                            += pcmcia.o
 
@@ -36,6 +36,7 @@ obj-$(CONFIG_PCMCIA_AU1X00)			+= au1x00_ss.o
 obj-$(CONFIG_PCMCIA_VRC4171)                    += vrc4171_card.o
 obj-$(CONFIG_PCMCIA_VRC4173)                    += vrc4173_cardu.o
 obj-$(CONFIG_OMAP_CF)                           += omap_cf.o
+obj-$(CONFIG_AT91_CF)                           += at91_cf.o
 
 sa11xx_core-y                                   += soc_common.o sa11xx_base.o
 pxa2xx_core-y                                   += soc_common.o pxa2xx_base.o
diff --git a/drivers/pcmcia/at91_cf.c b/drivers/pcmcia/at91_cf.c
new file mode 100644
index 000000000000..67cc5f7d0c90
--- /dev/null
+++ b/drivers/pcmcia/at91_cf.c
@@ -0,0 +1,365 @@
+/*
+ * at91_cf.c -- AT91 CompactFlash controller driver
+ *
+ * Copyright (C) 2005 David Brownell
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ */
+
+#include <linux/module.h>
+#include <linux/kernel.h>
+#include <linux/sched.h>
+#include <linux/platform_device.h>
+#include <linux/errno.h>
+#include <linux/init.h>
+#include <linux/interrupt.h>
+
+#include <pcmcia/ss.h>
+
+#include <asm/hardware.h>
+#include <asm/io.h>
+#include <asm/sizes.h>
+
+#include <asm/arch/at91rm9200.h>
+#include <asm/arch/board.h>
+#include <asm/arch/gpio.h>
+
+
+#define CF_SIZE         0x30000000      /* CS5+CS6: unavailable */
+
+/*
+ * A0..A10 work in each range; A23 indicates I/O space;  A25 is CFRNW;
+ * some other bit in {A24,A22..A11} is nREG to flag memory access
+ * (vs attributes).  So more than 2KB/region would just be waste.
+ */
+#define CF_ATTR_PHYS    (AT91_CF_BASE)
+#define CF_IO_PHYS      (AT91_CF_BASE  + (1 << 23))
+#define CF_MEM_PHYS     (AT91_CF_BASE  + 0x017ff800)
+
+/*--------------------------------------------------------------------------*/
+
+static const char driver_name[] = "at91_cf";
+
+struct at91_cf_socket {
+        struct pcmcia_socket    socket;
+
+        unsigned                present:1;
+
+        struct platform_device  *pdev;
+        struct at91_cf_data     *board;
+};
+
+#define SZ_2K                   (2 * SZ_1K)
+
+static inline int at91_cf_present(struct at91_cf_socket *cf)
+{
+        return !at91_get_gpio_value(cf->board->det_pin);
+}
+
+/*--------------------------------------------------------------------------*/
+
+static int at91_cf_ss_init(struct pcmcia_socket *s)
+{
+        return 0;
+}
+
+static irqreturn_t at91_cf_irq(int irq, void *_cf, struct pt_regs *r)
+{
+        struct at91_cf_socket   *cf = (struct at91_cf_socket *) _cf;
+
+        if (irq == cf->board->det_pin) {
+                unsigned present = at91_cf_present(cf);
+
+                /* kick pccard as needed */
+                if (present != cf->present) {
+                        cf->present = present;
+                        pr_debug("%s: card %s\n", driver_name, present ? "present" : "gone");
+                        pcmcia_parse_events(&cf->socket, SS_DETECT);
+                }
+        }
+
+        return IRQ_HANDLED;
+}
+
+static int at91_cf_get_status(struct pcmcia_socket *s, u_int *sp)
+{
+        struct at91_cf_socket   *cf;
+
+        if (!sp)
+                return -EINVAL;
+
+        cf = container_of(s, struct at91_cf_socket, socket);
+
+        /* NOTE: we assume 3VCARD, not XVCARD...  */
+        if (at91_cf_present(cf)) {
+                int rdy = cf->board->irq_pin;   /* RDY/nIRQ */
+                int vcc = cf->board->vcc_pin;
+
+                *sp = SS_DETECT | SS_3VCARD;
+                if (!rdy || at91_get_gpio_value(rdy))
+                        *sp |= SS_READY;
+                if (!vcc || at91_get_gpio_value(vcc))
+                        *sp |= SS_POWERON;
+        } else
+                *sp = 0;
+
+        return 0;
+}
+
+static int at91_cf_set_socket(struct pcmcia_socket *sock, struct socket_state_t *s)
+{
+        struct at91_cf_socket   *cf;
+
+        cf = container_of(sock, struct at91_cf_socket, socket);
+
+        /* switch Vcc if needed and possible */
+        if (cf->board->vcc_pin) {
+                switch (s->Vcc) {
+                        case 0:
+                                at91_set_gpio_value(cf->board->vcc_pin, 0);
+                                break;
+                        case 33:
+                                at91_set_gpio_value(cf->board->vcc_pin, 1);
+                                break;
+                        default:
+                                return -EINVAL;
+                }
+        }
+
+        /* toggle reset if needed */
+        at91_set_gpio_value(cf->board->rst_pin, s->flags & SS_RESET);
+
+        pr_debug("%s: Vcc %d, io_irq %d, flags %04x csc %04x\n",
+                driver_name, s->Vcc, s->io_irq, s->flags, s->csc_mask);
+
+        return 0;
+}
+
+static int at91_cf_ss_suspend(struct pcmcia_socket *s)
+{
+        return at91_cf_set_socket(s, &dead_socket);
+}
+
+/* we already mapped the I/O region */
+static int at91_cf_set_io_map(struct pcmcia_socket *s, struct pccard_io_map *io)
+{
+        struct at91_cf_socket   *cf;
+        u32                     csr;
+
+        cf = container_of(s, struct at91_cf_socket, socket);
+        io->flags &= (MAP_ACTIVE | MAP_16BIT | MAP_AUTOSZ);
+
+        /*
+         * Use 16 bit accesses unless/until we need 8-bit i/o space.
+         * Always set CSR4 ... PCMCIA won't always unmap things.
+         */
+        csr = at91_sys_read(AT91_SMC_CSR(4)) & ~AT91_SMC_DBW;
+
+        /*
+         * NOTE: this CF controller ignores IOIS16, so we can't really do
+         * MAP_AUTOSZ.  The 16bit mode allows single byte access on either
+         * D0-D7 (even addr) or D8-D15 (odd), so it's close enough for many
+         * purposes (and handles ide-cs).
+         *
+         * The 8bit mode is needed for odd byte access on D0-D7.  It seems
+         * some cards only like that way to get at the odd byte, despite
+         * CF 3.0 spec table 35 also giving the D8-D15 option.
+         */
+        if (!(io->flags & (MAP_16BIT|MAP_AUTOSZ))) {
+                csr |= AT91_SMC_DBW_8;
+                pr_debug("%s: 8bit i/o bus\n", driver_name);
+        } else {
+                csr |= AT91_SMC_DBW_16;
+                pr_debug("%s: 16bit i/o bus\n", driver_name);
+        }
+        at91_sys_write(AT91_SMC_CSR(4), csr);
+
+        io->start = cf->socket.io_offset;
+        io->stop = io->start + SZ_2K - 1;
+
+        return 0;
+}
+
+/* pcmcia layer maps/unmaps mem regions */
+static int at91_cf_set_mem_map(struct pcmcia_socket *s, struct pccard_mem_map *map)
+{
+        struct at91_cf_socket   *cf;
+
+        if (map->card_start)
+                return -EINVAL;
+
+        cf = container_of(s, struct at91_cf_socket, socket);
+
+        map->flags &= MAP_ACTIVE|MAP_ATTRIB|MAP_16BIT;
+        if (map->flags & MAP_ATTRIB)
+                map->static_start = CF_ATTR_PHYS;
+        else
+                map->static_start = CF_MEM_PHYS;
+
+        return 0;
+}
+
+static struct pccard_operations at91_cf_ops = {
+        .init                   = at91_cf_ss_init,
+        .suspend                = at91_cf_ss_suspend,
+        .get_status             = at91_cf_get_status,
+        .set_socket             = at91_cf_set_socket,
+        .set_io_map             = at91_cf_set_io_map,
+        .set_mem_map            = at91_cf_set_mem_map,
+};
+
+/*--------------------------------------------------------------------------*/
+
+static int __init at91_cf_probe(struct device *dev)
+{
+        struct at91_cf_socket   *cf;
+        struct at91_cf_data     *board = dev->platform_data;
+        struct platform_device  *pdev = to_platform_device(dev);
+        unsigned int            csa;
+        int                     status;
+
+        if (!board || !board->det_pin || !board->rst_pin)
+                return -ENODEV;
+
+        cf = kcalloc(1, sizeof *cf, GFP_KERNEL);
+        if (!cf)
+                return -ENOMEM;
+
+        cf->board = board;
+        cf->pdev = pdev;
+        dev_set_drvdata(dev, cf);
+
+        /* CF takes over CS4, CS5, CS6 */
+        csa = at91_sys_read(AT91_EBI_CSA);
+        at91_sys_write(AT91_EBI_CSA, csa | AT91_EBI_CS4A_SMC_COMPACTFLASH);
+
+        /* force poweron defaults for these pins ... */
+        (void) at91_set_A_periph(AT91_PIN_PC9, 0);      /* A25/CFRNW */
+        (void) at91_set_A_periph(AT91_PIN_PC10, 0);     /* NCS4/CFCS */
+        (void) at91_set_A_periph(AT91_PIN_PC11, 0);     /* NCS5/CFCE1 */
+        (void) at91_set_A_periph(AT91_PIN_PC12, 0);     /* NCS6/CFCE2 */
+
+        /* nWAIT is _not_ a default setting */
+        (void) at91_set_A_periph(AT91_PIN_PC6, 1);      /*  nWAIT */
+
+        /*
+         * Static memory controller timing adjustments.
+         * REVISIT:  these timings are in terms of MCK cycles, so
+         * when MCK changes (cpufreq etc) so must these values...
+         */
+        at91_sys_write(AT91_SMC_CSR(4), AT91_SMC_ACSS_STD | AT91_SMC_DBW_16 | AT91_SMC_BAT | AT91_SMC_WSEN
+                                | AT91_SMC_NWS_(32)             /* wait states */
+                                | AT91_SMC_RWSETUP_(6)          /* setup time */
+                                | AT91_SMC_RWHOLD_(4)           /* hold time */
+        );
+
+        /* must be a GPIO; ergo must trigger on both edges */
+        status = request_irq(board->det_pin, at91_cf_irq,
+                        SA_SAMPLE_RANDOM, driver_name, cf);
+        if (status < 0)
+                goto fail0;
+
+        /*
+         * The card driver will request this irq later as needed.
+         * but it causes lots of "irqNN: nobody cared" messages
+         * unless we report that we handle everything (sigh).
+         * (Note:  DK board doesn't wire the IRQ pin...)
+         */
+        if (board->irq_pin) {
+                status = request_irq(board->irq_pin, at91_cf_irq,
+                                SA_SHIRQ, driver_name, cf);
+                if (status < 0)
+                        goto fail0a;
+                cf->socket.pci_irq = board->irq_pin;
+        }
+        else
+                cf->socket.pci_irq = NR_IRQS + 1;
+
+        /* pcmcia layer only remaps "real" memory not iospace */
+        cf->socket.io_offset = (unsigned long) ioremap(CF_IO_PHYS, SZ_2K);
+        if (!cf->socket.io_offset)
+                goto fail1;
+
+        /* reserve CS4, CS5, and CS6 regions; but use just CS4 */
+        if (!request_mem_region(AT91_CF_BASE, CF_SIZE, driver_name))
+                goto fail1;
+
+        pr_info("%s: irqs det #%d, io #%d\n", driver_name,
+                board->det_pin, board->irq_pin);
+
+        cf->socket.owner = THIS_MODULE;
+        cf->socket.dev.dev = dev;
+        cf->socket.ops = &at91_cf_ops;
+        cf->socket.resource_ops = &pccard_static_ops;
+        cf->socket.features = SS_CAP_PCCARD | SS_CAP_STATIC_MAP
+                                | SS_CAP_MEM_ALIGN;
+        cf->socket.map_size = SZ_2K;
+        cf->socket.io[0].NumPorts = SZ_2K;
+
+        status = pcmcia_register_socket(&cf->socket);
+        if (status < 0)
+                goto fail2;
+
+        return 0;
+
+fail2:
+        iounmap((void __iomem *) cf->socket.io_offset);
+        release_mem_region(AT91_CF_BASE, CF_SIZE);
+fail1:
+        if (board->irq_pin)
+                free_irq(board->irq_pin, cf);
+fail0a:
+        free_irq(board->det_pin, cf);
+fail0:
+        at91_sys_write(AT91_EBI_CSA, csa);
+        kfree(cf);
+        return status;
+}
+
+static int __exit at91_cf_remove(struct device *dev)
+{
+        struct at91_cf_socket *cf = dev_get_drvdata(dev);
+        unsigned int csa;
+
+        pcmcia_unregister_socket(&cf->socket);
+        free_irq(cf->board->irq_pin, cf);
+        free_irq(cf->board->det_pin, cf);
+        iounmap((void __iomem *) cf->socket.io_offset);
+        release_mem_region(AT91_CF_BASE, CF_SIZE);
+
+        csa = at91_sys_read(AT91_EBI_CSA);
+        at91_sys_write(AT91_EBI_CSA, csa & ~AT91_EBI_CS4A);
+
+        kfree(cf);
+        return 0;
+}
+
+static struct device_driver at91_cf_driver = {
+        .name           = (char *) driver_name,
+        .bus            = &platform_bus_type,
+        .probe          = at91_cf_probe,
+        .remove         = __exit_p(at91_cf_remove),
+        .suspend        = pcmcia_socket_dev_suspend,
+        .resume         = pcmcia_socket_dev_resume,
+};
+
+/*--------------------------------------------------------------------------*/
+
+static int __init at91_cf_init(void)
+{
+        return driver_register(&at91_cf_driver);
+}
+module_init(at91_cf_init);
+
+static void __exit at91_cf_exit(void)
+{
+        driver_unregister(&at91_cf_driver);
+}
+module_exit(at91_cf_exit);
+
+MODULE_DESCRIPTION("AT91 Compact Flash Driver");
+MODULE_AUTHOR("David Brownell");
+MODULE_LICENSE("GPL");
diff --git a/drivers/pcmcia/cistpl.c b/drivers/pcmcia/cistpl.c
index 120fa8da6392..912c03e5eb0a 100644
--- a/drivers/pcmcia/cistpl.c
+++ b/drivers/pcmcia/cistpl.c
@@ -12,7 +12,6 @@
  * (C) 1999             David A. Hinds
  */
 
-#include <linux/config.h>
 #include <linux/module.h>
 #include <linux/moduleparam.h>
 #include <linux/kernel.h>
diff --git a/drivers/pcmcia/cs.c b/drivers/pcmcia/cs.c
index 613f2f1fbfdd..3162998579c1 100644
--- a/drivers/pcmcia/cs.c
+++ b/drivers/pcmcia/cs.c
@@ -16,7 +16,6 @@
 #include <linux/moduleparam.h>
 #include <linux/init.h>
 #include <linux/kernel.h>
-#include <linux/config.h>
 #include <linux/string.h>
 #include <linux/major.h>
 #include <linux/errno.h>
@@ -111,9 +110,9 @@ int pcmcia_socket_dev_suspend(struct device *dev, pm_message_t state)
         list_for_each_entry(socket, &pcmcia_socket_list, socket_list) {
                 if (socket->dev.dev != dev)
                         continue;
-                down(&socket->skt_sem);
+                mutex_lock(&socket->skt_mutex);
                 socket_suspend(socket);
-                up(&socket->skt_sem);
+                mutex_unlock(&socket->skt_mutex);
         }
         up_read(&pcmcia_socket_list_rwsem);
 
@@ -129,9 +128,9 @@ int pcmcia_socket_dev_resume(struct device *dev)
         list_for_each_entry(socket, &pcmcia_socket_list, socket_list) {
                 if (socket->dev.dev != dev)
                         continue;
-                down(&socket->skt_sem);
+                mutex_lock(&socket->skt_mutex);
                 socket_resume(socket);
-                up(&socket->skt_sem);
+                mutex_unlock(&socket->skt_mutex);
         }
         up_read(&pcmcia_socket_list_rwsem);
 
@@ -237,7 +236,7 @@ int pcmcia_register_socket(struct pcmcia_socket *socket)
         init_completion(&socket->socket_released);
         init_completion(&socket->thread_done);
         init_waitqueue_head(&socket->thread_wait);
-        init_MUTEX(&socket->skt_sem);
+        mutex_init(&socket->skt_mutex);
         spin_lock_init(&socket->thread_lock);
 
         ret = kernel_thread(pccardd, socket, CLONE_KERNEL);
@@ -406,8 +405,6 @@ static void socket_shutdown(struct pcmcia_socket *s)
         cb_free(s);
 #endif
         s->functions = 0;
-        kfree(s->config);
-        s->config = NULL;
 
         s->ops->get_status(s, &status);
         if (status & SS_POWERON) {
@@ -664,7 +661,7 @@ static int pccardd(void *__skt)
                 spin_unlock_irqrestore(&skt->thread_lock, flags);
 
                 if (events) {
-                        down(&skt->skt_sem);
+                        mutex_lock(&skt->skt_mutex);
                         if (events & SS_DETECT)
                                 socket_detect_change(skt);
                         if (events & SS_BATDEAD)
@@ -673,7 +670,7 @@ static int pccardd(void *__skt)
                                 send_event(skt, CS_EVENT_BATTERY_LOW, CS_EVENT_PRI_LOW);
                         if (events & SS_READY)
                                 send_event(skt, CS_EVENT_READY_CHANGE, CS_EVENT_PRI_LOW);
-                        up(&skt->skt_sem);
+                        mutex_unlock(&skt->skt_mutex);
                         continue;
                 }
 
@@ -717,8 +714,8 @@ int pccard_register_pcmcia(struct pcmcia_socket *s, struct pcmcia_callback *c)
 {
         int ret = 0;
 
-        /* s->skt_sem also protects s->callback */
-        down(&s->skt_sem);
+        /* s->skt_mutex also protects s->callback */
+        mutex_lock(&s->skt_mutex);
 
         if (c) {
                 /* registration */
@@ -734,7 +731,7 @@ int pccard_register_pcmcia(struct pcmcia_socket *s, struct pcmcia_callback *c)
         } else
                 s->callback = NULL;
  err:
-        up(&s->skt_sem);
+        mutex_unlock(&s->skt_mutex);
 
         return ret;
 }
@@ -752,7 +749,7 @@ int pccard_reset_card(struct pcmcia_socket *skt)
 
         cs_dbg(skt, 1, "resetting socket\n");
 
-        down(&skt->skt_sem);
+        mutex_lock(&skt->skt_mutex);
         do {
                 if (!(skt->state & SOCKET_PRESENT)) {
                         ret = CS_NO_CARD;
@@ -781,7 +778,7 @@ int pccard_reset_card(struct pcmcia_socket *skt)
 
                 ret = CS_SUCCESS;
         } while (0);
-        up(&skt->skt_sem);
+        mutex_unlock(&skt->skt_mutex);
 
         return ret;
 } /* reset_card */
@@ -797,7 +794,7 @@ int pcmcia_suspend_card(struct pcmcia_socket *skt)
 
         cs_dbg(skt, 1, "suspending socket\n");
 
-        down(&skt->skt_sem);
+        mutex_lock(&skt->skt_mutex);
         do {
                 if (!(skt->state & SOCKET_PRESENT)) {
                         ret = CS_NO_CARD;
@@ -814,7 +811,7 @@ int pcmcia_suspend_card(struct pcmcia_socket *skt)
                 }
                 ret = socket_suspend(skt);
         } while (0);
-        up(&skt->skt_sem);
+        mutex_unlock(&skt->skt_mutex);
 
         return ret;
 } /* suspend_card */
@@ -827,7 +824,7 @@ int pcmcia_resume_card(struct pcmcia_socket *skt)
     
         cs_dbg(skt, 1, "waking up socket\n");
 
-        down(&skt->skt_sem);
+        mutex_lock(&skt->skt_mutex);
         do {
                 if (!(skt->state & SOCKET_PRESENT)) {
                         ret = CS_NO_CARD;
@@ -841,7 +838,7 @@ int pcmcia_resume_card(struct pcmcia_socket *skt)
                 if (!ret && skt->callback)
                         skt->callback->resume(skt);
         } while (0);
-        up(&skt->skt_sem);
+        mutex_unlock(&skt->skt_mutex);
 
         return ret;
 } /* resume_card */
@@ -855,7 +852,7 @@ int pcmcia_eject_card(struct pcmcia_socket *skt)
     
         cs_dbg(skt, 1, "user eject request\n");
 
-        down(&skt->skt_sem);
+        mutex_lock(&skt->skt_mutex);
         do {
                 if (!(skt->state & SOCKET_PRESENT)) {
                         ret = -ENODEV;
@@ -871,7 +868,7 @@ int pcmcia_eject_card(struct pcmcia_socket *skt)
                 socket_remove(skt);
                 ret = 0;
         } while (0);
-        up(&skt->skt_sem);
+        mutex_unlock(&skt->skt_mutex);
 
         return ret;
 } /* eject_card */
@@ -884,7 +881,7 @@ int pcmcia_insert_card(struct pcmcia_socket *skt)
 
         cs_dbg(skt, 1, "user insert request\n");
 
-        down(&skt->skt_sem);
+        mutex_lock(&skt->skt_mutex);
         do {
                 if (skt->state & SOCKET_PRESENT) {
                         ret = -EBUSY;
@@ -896,7 +893,7 @@ int pcmcia_insert_card(struct pcmcia_socket *skt)
                 }
                 ret = 0;
         } while (0);
-        up(&skt->skt_sem);
+        mutex_unlock(&skt->skt_mutex);
 
         return ret;
 } /* insert_card */
diff --git a/drivers/pcmcia/cs_internal.h b/drivers/pcmcia/cs_internal.h
index 7b37eba35bf1..d6164cd583fd 100644
--- a/drivers/pcmcia/cs_internal.h
+++ b/drivers/pcmcia/cs_internal.h
@@ -15,7 +15,7 @@
 #ifndef _LINUX_CS_INTERNAL_H
 #define _LINUX_CS_INTERNAL_H
 
-#include <linux/config.h>
+#include <linux/kref.h>
 
 /* Flags in client state */
 #define CLIENT_CONFIG_LOCKED    0x0001
@@ -23,7 +23,7 @@
 #define CLIENT_IO_REQ           0x0004
 #define CLIENT_UNBOUND          0x0008
 #define CLIENT_STALE            0x0010
-#define CLIENT_WIN_REQ(i)       (0x20<<(i))
+#define CLIENT_WIN_REQ(i)       (0x1<<(i))
 #define CLIENT_CARDBUS          0x8000
 
 #define REGION_MAGIC    0xE3C9
@@ -31,7 +31,7 @@ typedef struct region_t {
     u_short             region_magic;
     u_short             state;
     dev_info_t          dev_info;
-    client_handle_t     mtd;
+    struct pcmcia_device        *mtd;
     u_int               MediaID;
     region_info_t       info;
 } region_t;
@@ -40,12 +40,12 @@ typedef struct region_t {
 
 /* Each card function gets one of these guys */
 typedef struct config_t {
+        struct kref     ref;
     u_int               state;
     u_int               Attributes;
     u_int               IntType;
     u_int               ConfigBase;
     u_char              Status, Pin, Copy, Option, ExtStatus;
-    u_int               Present;
     u_int               CardValues;
     io_req_t            io;
     struct {
@@ -95,12 +95,6 @@ static inline void cs_socket_put(struct pcmcia_socket *skt)
         }
 }
 
-#define CHECK_SOCKET(s) \
-    (((s) >= sockets) || (socket_table[s]->ops == NULL))
-
-#define SOCKET(h) (h->socket)
-#define CONFIG(h) (&SOCKET(h)->config[(h)->func])
-
 /* In cardbus.c */
 int cb_alloc(struct pcmcia_socket *s);
 void cb_free(struct pcmcia_socket *s);
@@ -133,10 +127,9 @@ extern struct class_interface pccard_sysfs_interface;
 extern struct rw_semaphore pcmcia_socket_list_rwsem;
 extern struct list_head pcmcia_socket_list;
 int pcmcia_get_window(struct pcmcia_socket *s, window_handle_t *handle, int idx, win_req_t *req);
-int pccard_get_configuration_info(struct pcmcia_socket *s, unsigned int function, config_info_t *config);
+int pccard_get_configuration_info(struct pcmcia_socket *s, struct pcmcia_device *p_dev, config_info_t *config);
 int pccard_reset_card(struct pcmcia_socket *skt);
-int pccard_get_status(struct pcmcia_socket *s, unsigned int function, cs_status_t *status);
-int pccard_access_configuration_register(struct pcmcia_socket *s, unsigned int function, conf_reg_t *reg);
+int pccard_get_status(struct pcmcia_socket *s, struct pcmcia_device *p_dev, cs_status_t *status);
 
 
 struct pcmcia_callback{
diff --git a/drivers/pcmcia/ds.c b/drivers/pcmcia/ds.c
index bb96ce1db08c..ae10d1eed65e 100644
--- a/drivers/pcmcia/ds.c
+++ b/drivers/pcmcia/ds.c
@@ -10,10 +10,9 @@
  * are Copyright (C) 1999 David A. Hinds.  All Rights Reserved.
  *
  * (C) 1999             David A. Hinds
- * (C) 2003 - 2005      Dominik Brodowski
+ * (C) 2003 - 2006      Dominik Brodowski
  */
 
-#include <linux/config.h>
 #include <linux/kernel.h>
 #include <linux/module.h>
 #include <linux/init.h>
@@ -23,6 +22,7 @@
 #include <linux/workqueue.h>
 #include <linux/crc32.h>
 #include <linux/firmware.h>
+#include <linux/kref.h>
 
 #define IN_CARD_SERVICES
 #include <pcmcia/cs_types.h>
@@ -343,12 +343,19 @@ void pcmcia_put_dev(struct pcmcia_device *p_dev)
                 put_device(&p_dev->dev);
 }
 
+static void pcmcia_release_function(struct kref *ref)
+{
+        struct config_t *c = container_of(ref, struct config_t, ref);
+        kfree(c);
+}
+
 static void pcmcia_release_dev(struct device *dev)
 {
         struct pcmcia_device *p_dev = to_pcmcia_dev(dev);
         ds_dbg(1, "releasing dev %p\n", p_dev);
         pcmcia_put_socket(p_dev->socket);
         kfree(p_dev->devname);
+        kref_put(&p_dev->function_config->ref, pcmcia_release_function);
         kfree(p_dev);
 }
 
@@ -377,29 +384,12 @@ static int pcmcia_device_probe(struct device * dev)
         p_drv = to_pcmcia_drv(dev->driver);
         s = p_dev->socket;
 
-        if ((!p_drv->probe) || (!try_module_get(p_drv->owner))) {
+        if ((!p_drv->probe) || (!p_dev->function_config) ||
+            (!try_module_get(p_drv->owner))) {
                 ret = -EINVAL;
                 goto put_dev;
         }
 
-        p_dev->state &= ~CLIENT_UNBOUND;
-
-        /* set up the device configuration, if it hasn't been done before */
-        if (!s->functions) {
-                cistpl_longlink_mfc_t mfc;
-                if (pccard_read_tuple(s, p_dev->func, CISTPL_LONGLINK_MFC,
-                                      &mfc) == CS_SUCCESS)
-                        s->functions = mfc.nfn;
-                else
-                        s->functions = 1;
-                s->config = kzalloc(sizeof(config_t) * s->functions,
-                                    GFP_KERNEL);
-                if (!s->config) {
-                        ret = -ENOMEM;
-                        goto put_module;
-                }
-        }
-
         ret = p_drv->probe(p_dev);
         if (ret)
                 goto put_module;
@@ -425,15 +415,61 @@ static int pcmcia_device_probe(struct device * dev)
 }
 
 
+/*
+ * Removes a PCMCIA card from the device tree and socket list.
+ */
+static void pcmcia_card_remove(struct pcmcia_socket *s, struct pcmcia_device *leftover)
+{
+        struct pcmcia_device    *p_dev;
+        struct pcmcia_device    *tmp;
+        unsigned long           flags;
+
+        ds_dbg(2, "unbind_request(%d)\n", s->sock);
+
+
+        if (!leftover)
+                s->device_count = 0;
+        else
+                s->device_count = 1;
+
+        /* unregister all pcmcia_devices registered with this socket, except leftover */
+        list_for_each_entry_safe(p_dev, tmp, &s->devices_list, socket_device_list) {
+                if (p_dev == leftover)
+                        continue;
+
+                spin_lock_irqsave(&pcmcia_dev_list_lock, flags);
+                list_del(&p_dev->socket_device_list);
+                p_dev->_removed=1;
+                spin_unlock_irqrestore(&pcmcia_dev_list_lock, flags);
+
+                device_unregister(&p_dev->dev);
+        }
+
+        return;
+}
+
+
 static int pcmcia_device_remove(struct device * dev)
 {
         struct pcmcia_device *p_dev;
         struct pcmcia_driver *p_drv;
+        struct pcmcia_device_id *did;
         int i;
 
-        /* detach the "instance" */
         p_dev = to_pcmcia_dev(dev);
         p_drv = to_pcmcia_drv(dev->driver);
+
+        /* If we're removing the primary module driving a
+         * pseudo multi-function card, we need to unbind
+         * all devices
+         */
+        did = (struct pcmcia_device_id *) p_dev->dev.driver_data;
+        if (did && (did->match_flags & PCMCIA_DEV_ID_MATCH_DEVICE_NO) &&
+            (p_dev->socket->device_count != 0) &&
+            (p_dev->device_no == 0))
+                pcmcia_card_remove(p_dev->socket, p_dev);
+
+        /* detach the "instance" */
         if (!p_drv)
                 return 0;
 
@@ -441,17 +477,16 @@ static int pcmcia_device_remove(struct device * dev)
                 p_drv->remove(p_dev);
 
         /* check for proper unloading */
-        if (p_dev->state & (CLIENT_IRQ_REQ|CLIENT_IO_REQ|CLIENT_CONFIG_LOCKED))
+        if (p_dev->_irq || p_dev->_io || p_dev->_locked)
                 printk(KERN_INFO "pcmcia: driver %s did not release config properly\n",
                        p_drv->drv.name);
 
         for (i = 0; i < MAX_WIN; i++)
-                if (p_dev->state & CLIENT_WIN_REQ(i))
+                if (p_dev->_win & CLIENT_WIN_REQ(i))
                         printk(KERN_INFO "pcmcia: driver %s did not release windows properly\n",
                                p_drv->drv.name);
 
         /* references from pcmcia_probe_device */
-        p_dev->state = CLIENT_UNBOUND;
         pcmcia_put_dev(p_dev);
         module_put(p_drv->owner);
 
@@ -460,37 +495,6 @@ static int pcmcia_device_remove(struct device * dev)
 
 
 /*
- * Removes a PCMCIA card from the device tree and socket list.
- */
-static void pcmcia_card_remove(struct pcmcia_socket *s)
-{
-        struct pcmcia_device    *p_dev;
-        unsigned long           flags;
-
-        ds_dbg(2, "unbind_request(%d)\n", s->sock);
-
-        s->device_count = 0;
-
-        for (;;) {
-                /* unregister all pcmcia_devices registered with this socket*/
-                spin_lock_irqsave(&pcmcia_dev_list_lock, flags);
-                if (list_empty(&s->devices_list)) {
-                        spin_unlock_irqrestore(&pcmcia_dev_list_lock, flags);
-                        return;
-                }
-                p_dev = list_entry((&s->devices_list)->next, struct pcmcia_device, socket_device_list);
-                list_del(&p_dev->socket_device_list);
-                p_dev->state |= CLIENT_STALE;
-                spin_unlock_irqrestore(&pcmcia_dev_list_lock, flags);
-
-                device_unregister(&p_dev->dev);
-        }
-
-        return;
-} /* unbind_request */
-
-
-/*
  * pcmcia_device_query -- determine information about a pcmcia device
  */
 static int pcmcia_device_query(struct pcmcia_device *p_dev)
@@ -546,7 +550,7 @@ static int pcmcia_device_query(struct pcmcia_device *p_dev)
                         tmp = vers1->str + vers1->ofs[i];
 
                         length = strlen(tmp) + 1;
-                        if ((length < 3) || (length > 255))
+                        if ((length < 2) || (length > 255))
                                 continue;
 
                         p_dev->prod_id[i] = kmalloc(sizeof(char) * length,
@@ -571,11 +575,11 @@ static int pcmcia_device_query(struct pcmcia_device *p_dev)
  * won't work, this doesn't matter much at the moment: the driver core doesn't
  * support it either.
  */
-static DECLARE_MUTEX(device_add_lock);
+static DEFINE_MUTEX(device_add_lock);
 
 struct pcmcia_device * pcmcia_device_add(struct pcmcia_socket *s, unsigned int function)
 {
-        struct pcmcia_device *p_dev;
+        struct pcmcia_device *p_dev, *tmp_dev;
         unsigned long flags;
         int bus_id_len;
 
@@ -583,7 +587,7 @@ struct pcmcia_device * pcmcia_device_add(struct pcmcia_socket *s, unsigned int f
         if (!s)
                 return NULL;
 
-        down(&device_add_lock);
+        mutex_lock(&device_add_lock);
 
         /* max of 2 devices per card */
         if (s->device_count == 2)
@@ -596,6 +600,8 @@ struct pcmcia_device * pcmcia_device_add(struct pcmcia_socket *s, unsigned int f
         p_dev->socket = s;
         p_dev->device_no = (s->device_count++);
         p_dev->func   = function;
+        if (s->functions <= function)
+                s->functions = function + 1;
 
         p_dev->dev.bus = &pcmcia_bus_type;
         p_dev->dev.parent = s->dev.dev;
@@ -608,36 +614,55 @@ struct pcmcia_device * pcmcia_device_add(struct pcmcia_socket *s, unsigned int f
         sprintf (p_dev->devname, "pcmcia%s", p_dev->dev.bus_id);
 
         /* compat */
-        p_dev->state = CLIENT_UNBOUND;
+        spin_lock_irqsave(&pcmcia_dev_list_lock, flags);
+
+        /*
+         * p_dev->function_config must be the same for all card functions.
+         * Note that this is serialized by the device_add_lock, so that
+         * only one such struct will be created.
+         */
+        list_for_each_entry(tmp_dev, &s->devices_list, socket_device_list)
+                if (p_dev->func == tmp_dev->func) {
+                        p_dev->function_config = tmp_dev->function_config;
+                        kref_get(&p_dev->function_config->ref);
+                }
 
         /* Add to the list in pcmcia_bus_socket */
-        spin_lock_irqsave(&pcmcia_dev_list_lock, flags);
         list_add_tail(&p_dev->socket_device_list, &s->devices_list);
+
         spin_unlock_irqrestore(&pcmcia_dev_list_lock, flags);
 
+        if (!p_dev->function_config) {
+                p_dev->function_config = kzalloc(sizeof(struct config_t),
+                                                 GFP_KERNEL);
+                if (!p_dev->function_config)
+                        goto err_unreg;
+                kref_init(&p_dev->function_config->ref);
+        }
+
         printk(KERN_NOTICE "pcmcia: registering new device %s\n",
                p_dev->devname);
 
         pcmcia_device_query(p_dev);
 
-        if (device_register(&p_dev->dev)) {
-                spin_lock_irqsave(&pcmcia_dev_list_lock, flags);
-                list_del(&p_dev->socket_device_list);
-                spin_unlock_irqrestore(&pcmcia_dev_list_lock, flags);
-
-                goto err_free;
-       }
+        if (device_register(&p_dev->dev))
+                goto err_unreg;
 
-        up(&device_add_lock);
+        mutex_unlock(&device_add_lock);
 
         return p_dev;
 
+ err_unreg:
+        spin_lock_irqsave(&pcmcia_dev_list_lock, flags);
+        list_del(&p_dev->socket_device_list);
+        spin_unlock_irqrestore(&pcmcia_dev_list_lock, flags);
+
  err_free:
         kfree(p_dev->devname);
         kfree(p_dev);
         s->device_count--;
  err_put:
-        up(&device_add_lock);
+        mutex_unlock(&device_add_lock);
         pcmcia_put_socket(s);
 
         return NULL;
@@ -696,7 +721,7 @@ static void pcmcia_bus_rescan(struct pcmcia_socket *skt)
         int no_devices=0;
         unsigned long flags;
 
-        /* must be called with skt_sem held */
+        /* must be called with skt_mutex held */
         spin_lock_irqsave(&pcmcia_dev_list_lock, flags);
         if (list_empty(&skt->devices_list))
                 no_devices=1;
@@ -819,9 +844,11 @@ static int pcmcia_bus_match(struct device * dev, struct device_driver * drv) {
         struct pcmcia_driver * p_drv = to_pcmcia_drv(drv);
         struct pcmcia_device_id *did = p_drv->id_table;
 
+#ifdef CONFIG_PCMCIA_IOCTL
         /* matching by cardmgr */
         if (p_dev->cardmgr == p_drv)
                 return 1;
+#endif
 
         while (did && did->match_flags) {
                 if (pcmcia_devmatch(p_dev, did))
@@ -927,7 +954,7 @@ static ssize_t pcmcia_show_pm_state(struct device *dev, struct device_attribute
 {
         struct pcmcia_device *p_dev = to_pcmcia_dev(dev);
 
-        if (p_dev->dev.power.power_state.event != PM_EVENT_ON)
+        if (p_dev->suspended)
                 return sprintf(buf, "off\n");
         else
                 return sprintf(buf, "on\n");
@@ -942,11 +969,9 @@ static ssize_t pcmcia_store_pm_state(struct device *dev, struct device_attribute
         if (!count)
                 return -EINVAL;
 
-        if ((p_dev->dev.power.power_state.event == PM_EVENT_ON) &&
-            (!strncmp(buf, "off", 3)))
+        if ((!p_dev->suspended) && !strncmp(buf, "off", 3))
                 ret = dpm_runtime_suspend(dev, PMSG_SUSPEND);
-        else if ((p_dev->dev.power.power_state.event != PM_EVENT_ON) &&
-                 (!strncmp(buf, "on", 2)))
+        else if (p_dev->suspended && !strncmp(buf, "on", 2))
                 dpm_runtime_resume(dev);
 
         return ret ? ret : count;
@@ -982,9 +1007,9 @@ static ssize_t pcmcia_store_allow_func_id_match(struct device *dev,
         if (!count)
                 return -EINVAL;
 
-        down(&p_dev->socket->skt_sem);
+        mutex_lock(&p_dev->socket->skt_mutex);
         p_dev->allow_func_id_match = 1;
-        up(&p_dev->socket->skt_sem);
+        mutex_unlock(&p_dev->socket->skt_mutex);
 
         bus_rescan_devices(&pcmcia_bus_type);
 
@@ -1012,14 +1037,27 @@ static int pcmcia_dev_suspend(struct device * dev, pm_message_t state)
 {
         struct pcmcia_device *p_dev = to_pcmcia_dev(dev);
         struct pcmcia_driver *p_drv = NULL;
+        int ret = 0;
 
         if (dev->driver)
                 p_drv = to_pcmcia_drv(dev->driver);
 
-        if (p_drv && p_drv->suspend)
-                return p_drv->suspend(p_dev);
+        if (!p_drv)
+                goto out;
 
-        return 0;
+        if (p_drv->suspend) {
+                ret = p_drv->suspend(p_dev);
+                if (ret)
+                        goto out;
+        }
+
+        if (p_dev->device_no == p_dev->func)
+                pcmcia_release_configuration(p_dev);
+
+ out:
+        if (!ret)
+                p_dev->suspended = 1;
+        return ret;
 }
 
 
@@ -1027,14 +1065,27 @@ static int pcmcia_dev_resume(struct device * dev)
 {
         struct pcmcia_device *p_dev = to_pcmcia_dev(dev);
         struct pcmcia_driver *p_drv = NULL;
+        int ret = 0;
 
         if (dev->driver)
                 p_drv = to_pcmcia_drv(dev->driver);
 
-        if (p_drv && p_drv->resume)
-                return p_drv->resume(p_dev);
+        if (!p_drv)
+                goto out;
 
-        return 0;
+        if (p_dev->device_no == p_dev->func) {
+                ret = pcmcia_request_configuration(p_dev, &p_dev->conf);
+                if (ret)
+                        goto out;
+        }
+
+        if (p_drv->resume)
+                ret = p_drv->resume(p_dev);
+
+ out:
+        if (!ret)
+                p_dev->suspended = 0;
+        return ret;
 }
 
 
@@ -1100,7 +1151,7 @@ static int ds_event(struct pcmcia_socket *skt, event_t event, int priority)
         switch (event) {
         case CS_EVENT_CARD_REMOVAL:
                 s->pcmcia_state.present = 0;
-                pcmcia_card_remove(skt);
+                pcmcia_card_remove(skt, NULL);
                 handle_event(skt, event);
                 break;
 
@@ -1128,6 +1179,32 @@ static int ds_event(struct pcmcia_socket *skt, event_t event, int priority)
 } /* ds_event */
 
 
+struct pcmcia_device * pcmcia_dev_present(struct pcmcia_device *_p_dev)
+{
+        struct pcmcia_device *p_dev;
+        struct pcmcia_device *ret = NULL;
+
+        p_dev = pcmcia_get_dev(_p_dev);
+        if (!p_dev)
+                return NULL;
+
+        if (!p_dev->socket->pcmcia_state.present)
+                goto out;
+
+        if (p_dev->_removed)
+                goto out;
+
+        if (p_dev->suspended)
+                goto out;
+
+        ret = p_dev;
+ out:
+        pcmcia_put_dev(p_dev);
+        return ret;
+}
+EXPORT_SYMBOL(pcmcia_dev_present);
+
+
 static struct pcmcia_callback pcmcia_bus_callback = {
         .owner = THIS_MODULE,
         .event = ds_event,
diff --git a/drivers/pcmcia/ds_internal.h b/drivers/pcmcia/ds_internal.h
index d359bd25a51c..3a2b25e6ed73 100644
--- a/drivers/pcmcia/ds_internal.h
+++ b/drivers/pcmcia/ds_internal.h
@@ -8,6 +8,8 @@ extern void pcmcia_put_dev(struct pcmcia_device *p_dev);
 
 struct pcmcia_device * pcmcia_device_add(struct pcmcia_socket *s, unsigned int function);
 
+extern int pcmcia_release_configuration(struct pcmcia_device *p_dev);
+
 #ifdef CONFIG_PCMCIA_IOCTL
 extern void __init pcmcia_setup_ioctl(void);
 extern void __exit pcmcia_cleanup_ioctl(void);
@@ -15,7 +17,7 @@ extern void handle_event(struct pcmcia_socket *s, event_t event);
 extern int handle_request(struct pcmcia_socket *s, event_t event);
 #else
 static inline void __init pcmcia_setup_ioctl(void) { return; }
-static inline void __init pcmcia_cleanup_ioctl(void) { return; }
+static inline void __exit pcmcia_cleanup_ioctl(void) { return; }
 static inline void handle_event(struct pcmcia_socket *s, event_t event) { return; }
 static inline int handle_request(struct pcmcia_socket *s, event_t event) { return CS_SUCCESS; }
 #endif
diff --git a/drivers/pcmcia/i82092.c b/drivers/pcmcia/i82092.c
index 7979c85df3dc..d5f03a338c6c 100644
--- a/drivers/pcmcia/i82092.c
+++ b/drivers/pcmcia/i82092.c
@@ -10,7 +10,6 @@
  */
 
 #include <linux/kernel.h>
-#include <linux/config.h>
 #include <linux/module.h>
 #include <linux/pci.h>
 #include <linux/init.h>
diff --git a/drivers/pcmcia/i82365.c b/drivers/pcmcia/i82365.c
index 35a92d1e4945..bd0308e89815 100644
--- a/drivers/pcmcia/i82365.c
+++ b/drivers/pcmcia/i82365.c
@@ -34,7 +34,6 @@
 #include <linux/module.h>
 #include <linux/moduleparam.h>
 #include <linux/init.h>
-#include <linux/config.h>
 #include <linux/types.h>
 #include <linux/fcntl.h>
 #include <linux/string.h>
diff --git a/drivers/pcmcia/pcmcia_compat.c b/drivers/pcmcia/pcmcia_compat.c
deleted file mode 100644
index ebb161c4f819..000000000000
--- a/drivers/pcmcia/pcmcia_compat.c
+++ /dev/null
@@ -1,65 +0,0 @@
-/*
- * PCMCIA 16-bit compatibility functions
- *
- * The initial developer of the original code is David A. Hinds
- * <dahinds@users.sourceforge.net>.  Portions created by David A. Hinds
- * are Copyright (C) 1999 David A. Hinds.  All Rights Reserved.
- *
- * Copyright (C) 2004 Dominik Brodowski
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 2 as
- * published by the Free Software Foundation.
- *
- */
-
-#include <linux/config.h>
-#include <linux/module.h>
-#include <linux/init.h>
-
-#define IN_CARD_SERVICES
-#include <pcmcia/cs_types.h>
-#include <pcmcia/cs.h>
-#include <pcmcia/bulkmem.h>
-#include <pcmcia/cistpl.h>
-#include <pcmcia/ds.h>
-#include <pcmcia/ss.h>
-
-#include "cs_internal.h"
-
-int pcmcia_get_first_tuple(struct pcmcia_device *p_dev, tuple_t *tuple)
-{
-        return pccard_get_first_tuple(p_dev->socket, p_dev->func, tuple);
-}
-EXPORT_SYMBOL(pcmcia_get_first_tuple);
-
-int pcmcia_get_next_tuple(struct pcmcia_device *p_dev, tuple_t *tuple)
-{
-        return pccard_get_next_tuple(p_dev->socket, p_dev->func, tuple);
-}
-EXPORT_SYMBOL(pcmcia_get_next_tuple);
-
-int pcmcia_get_tuple_data(struct pcmcia_device *p_dev, tuple_t *tuple)
-{
-        return pccard_get_tuple_data(p_dev->socket, tuple);
-}
-EXPORT_SYMBOL(pcmcia_get_tuple_data);
-
-int pcmcia_parse_tuple(struct pcmcia_device *p_dev, tuple_t *tuple, cisparse_t *parse)
-{
-        return pccard_parse_tuple(tuple, parse);
-}
-EXPORT_SYMBOL(pcmcia_parse_tuple);
-
-int pcmcia_validate_cis(struct pcmcia_device *p_dev, cisinfo_t *info)
-{
-        return pccard_validate_cis(p_dev->socket, p_dev->func, info);
-}
-EXPORT_SYMBOL(pcmcia_validate_cis);
-
-
-int pcmcia_reset_card(struct pcmcia_device *p_dev, client_req_t *req)
-{
-        return pccard_reset_card(p_dev->socket);
-}
-EXPORT_SYMBOL(pcmcia_reset_card);
diff --git a/drivers/pcmcia/pcmcia_ioctl.c b/drivers/pcmcia/pcmcia_ioctl.c
index 80969f7e7a0b..c53db7ceda5e 100644
--- a/drivers/pcmcia/pcmcia_ioctl.c
+++ b/drivers/pcmcia/pcmcia_ioctl.c
@@ -18,7 +18,6 @@
  */
 
 
-#include <linux/config.h>
 #include <linux/kernel.h>
 #include <linux/module.h>
 #include <linux/init.h>
@@ -70,10 +69,26 @@ extern int ds_pc_debug;
 #define ds_dbg(lvl, fmt, arg...) do { } while (0)
 #endif
 
+static struct pcmcia_device *get_pcmcia_device(struct pcmcia_socket *s,
+                                                unsigned int function)
+{
+        struct pcmcia_device *p_dev = NULL;
+        unsigned long flags;
+
+        spin_lock_irqsave(&pcmcia_dev_list_lock, flags);
+        list_for_each_entry(p_dev, &s->devices_list, socket_device_list) {
+                if (p_dev->func == function) {
+                        spin_unlock_irqrestore(&pcmcia_dev_list_lock, flags);
+                        return pcmcia_get_dev(p_dev);
+                }
+        }
+        spin_unlock_irqrestore(&pcmcia_dev_list_lock, flags);
+        return NULL;
+}
 
 /* backwards-compatible accessing of driver --- by name! */
 
-static struct pcmcia_driver * get_pcmcia_driver (dev_info_t *dev_info)
+static struct pcmcia_driver *get_pcmcia_driver(dev_info_t *dev_info)
 {
         struct device_driver *drv;
         struct pcmcia_driver *p_drv;
@@ -214,7 +229,7 @@ static int bind_request(struct pcmcia_socket *s, bind_info_t *bind_info)
                                          * by userspace before, we need to
                                          * return the "instance". */
                                         spin_unlock_irqrestore(&pcmcia_dev_list_lock, flags);
-                                        bind_info->instance = p_dev->instance;
+                                        bind_info->instance = p_dev;
                                         ret = -EBUSY;
                                         goto err_put_module;
                                 } else {
@@ -253,9 +268,9 @@ rescan:
         /*
          * Prevent this racing with a card insertion.
          */
-        down(&s->skt_sem);
+        mutex_lock(&s->skt_mutex);
         bus_rescan_devices(&pcmcia_bus_type);
-        up(&s->skt_sem);
+        mutex_unlock(&s->skt_mutex);
 
         /* check whether the driver indeed matched. I don't care if this
          * is racy or not, because it can only happen on cardmgr access
@@ -289,6 +304,7 @@ static int get_device_info(struct pcmcia_socket *s, bind_info_t *bind_info, int
 {
         dev_node_t *node;
         struct pcmcia_device *p_dev;
+        struct pcmcia_driver *p_drv;
         unsigned long flags;
         int ret = 0;
 
@@ -343,16 +359,16 @@ static int get_device_info(struct pcmcia_socket *s, bind_info_t *bind_info, int
  found:
         spin_unlock_irqrestore(&pcmcia_dev_list_lock, flags);
 
-        if ((!p_dev->instance) ||
-            (p_dev->instance->state & DEV_CONFIG_PENDING)) {
+        p_drv = to_pcmcia_drv(p_dev->dev.driver);
+        if (p_drv && !p_dev->_locked) {
                 ret = -EAGAIN;
                 goto err_put;
         }
 
         if (first)
-                node = p_dev->instance->dev;
+                node = p_dev->dev_node;
         else
-                for (node = p_dev->instance->dev; node; node = node->next)
+                for (node = p_dev->dev_node; node; node = node->next)
                         if (node == bind_info->next)
                                 break;
         if (!node) {
@@ -583,14 +599,16 @@ static int ds_ioctl(struct inode * inode, struct file * file,
         if (buf->config.Function &&
            (buf->config.Function >= s->functions))
             ret = CS_BAD_ARGS;
-        else
-            ret = pccard_get_configuration_info(s,
-                        buf->config.Function, &buf->config);
+        else {
+            struct pcmcia_device *p_dev = get_pcmcia_device(s, buf->config.Function);
+            ret = pccard_get_configuration_info(s, p_dev, &buf->config);
+            pcmcia_put_dev(p_dev);
+        }
         break;
     case DS_GET_FIRST_TUPLE:
-        down(&s->skt_sem);
+        mutex_lock(&s->skt_mutex);
         pcmcia_validate_mem(s);
-        up(&s->skt_sem);
+        mutex_unlock(&s->skt_mutex);
         ret = pccard_get_first_tuple(s, BIND_FN_ALL, &buf->tuple);
         break;
     case DS_GET_NEXT_TUPLE:
@@ -609,16 +627,19 @@ static int ds_ioctl(struct inode * inode, struct file * file,
         ret = pccard_reset_card(s);
         break;
     case DS_GET_STATUS:
-        if (buf->status.Function &&
-           (buf->status.Function >= s->functions))
-            ret = CS_BAD_ARGS;
-        else
-        ret = pccard_get_status(s, buf->status.Function, &buf->status);
-        break;
+            if (buf->status.Function &&
+                (buf->status.Function >= s->functions))
+                    ret = CS_BAD_ARGS;
+            else {
+                    struct pcmcia_device *p_dev = get_pcmcia_device(s, buf->status.Function);
+                    ret = pccard_get_status(s, p_dev, &buf->status);
+                    pcmcia_put_dev(p_dev);
+            }
+            break;
     case DS_VALIDATE_CIS:
-        down(&s->skt_sem);
+        mutex_lock(&s->skt_mutex);
         pcmcia_validate_mem(s);
-        up(&s->skt_sem);
+        mutex_unlock(&s->skt_mutex);
         ret = pccard_validate_cis(s, BIND_FN_ALL, &buf->cisinfo);
         break;
     case DS_SUSPEND_CARD:
@@ -638,12 +659,16 @@ static int ds_ioctl(struct inode * inode, struct file * file,
             err = -EPERM;
             goto free_out;
         }
-        if (buf->conf_reg.Function &&
-           (buf->conf_reg.Function >= s->functions))
-            ret = CS_BAD_ARGS;
-        else
-            ret = pccard_access_configuration_register(s,
-                        buf->conf_reg.Function, &buf->conf_reg);
+
+        ret = CS_BAD_ARGS;
+
+        if (!(buf->conf_reg.Function &&
+             (buf->conf_reg.Function >= s->functions))) {
+                struct pcmcia_device *p_dev = get_pcmcia_device(s, buf->conf_reg.Function);
+                if (p_dev)
+                        ret = pcmcia_access_configuration_register(p_dev, &buf->conf_reg);
+                pcmcia_put_dev(p_dev);
+        }
         break;
     case DS_GET_FIRST_REGION:
     case DS_GET_NEXT_REGION:
diff --git a/drivers/pcmcia/pcmcia_resource.c b/drivers/pcmcia/pcmcia_resource.c
index 89022ad5b520..45063b4e5b78 100644
--- a/drivers/pcmcia/pcmcia_resource.c
+++ b/drivers/pcmcia/pcmcia_resource.c
@@ -14,7 +14,6 @@
  *
  */
 
-#include <linux/config.h>
 #include <linux/module.h>
 #include <linux/kernel.h>
 #include <linux/interrupt.h>
@@ -89,7 +88,7 @@ static int alloc_io_space(struct pcmcia_socket *s, u_int attr, ioaddr_t *base,
         }
         if ((s->features & SS_CAP_STATIC_MAP) && s->io_offset) {
                 *base = s->io_offset | (*base & 0x0fff);
-                s->io[0].Attributes = attr;
+                s->io[0].res->flags = (s->io[0].res->flags & ~IORESOURCE_BITS) | (attr & IORESOURCE_BITS);
                 return 0;
         }
         /* Check for an already-allocated window that must conflict with
@@ -97,38 +96,36 @@ static int alloc_io_space(struct pcmcia_socket *s, u_int attr, ioaddr_t *base,
          * potential conflicts, just the most obvious ones.
          */
         for (i = 0; i < MAX_IO_WIN; i++)
-                if ((s->io[i].NumPorts != 0) &&
-                    ((s->io[i].BasePort & (align-1)) == *base))
+                if ((s->io[i].res) &&
+                    ((s->io[i].res->start & (align-1)) == *base))
                         return 1;
         for (i = 0; i < MAX_IO_WIN; i++) {
-                if (s->io[i].NumPorts == 0) {
+                if (!s->io[i].res) {
                         s->io[i].res = pcmcia_find_io_region(*base, num, align, s);
                         if (s->io[i].res) {
-                                s->io[i].Attributes = attr;
-                                s->io[i].BasePort = *base = s->io[i].res->start;
-                                s->io[i].NumPorts = s->io[i].InUse = num;
+                                *base = s->io[i].res->start;
+                                s->io[i].res->flags = (s->io[i].res->flags & ~IORESOURCE_BITS) | (attr & IORESOURCE_BITS);
+                                s->io[i].InUse = num;
                                 break;
                         } else
                                 return 1;
-                } else if (s->io[i].Attributes != attr)
+                } else if ((s->io[i].res->flags & IORESOURCE_BITS) != (attr & IORESOURCE_BITS))
                         continue;
                 /* Try to extend top of window */
-                try = s->io[i].BasePort + s->io[i].NumPorts;
+                try = s->io[i].res->end + 1;
                 if ((*base == 0) || (*base == try))
                         if (pcmcia_adjust_io_region(s->io[i].res, s->io[i].res->start,
                                                     s->io[i].res->end + num, s) == 0) {
                                 *base = try;
-                                s->io[i].NumPorts += num;
                                 s->io[i].InUse += num;
                                 break;
                         }
                 /* Try to extend bottom of window */
-                try = s->io[i].BasePort - num;
+                try = s->io[i].res->start - num;
                 if ((*base == 0) || (*base == try))
                         if (pcmcia_adjust_io_region(s->io[i].res, s->io[i].res->start - num,
                                                     s->io[i].res->end, s) == 0) {
-                                s->io[i].BasePort = *base = try;
-                                s->io[i].NumPorts += num;
+                                *base = try;
                                 s->io[i].InUse += num;
                                 break;
                         }
@@ -143,12 +140,13 @@ static void release_io_space(struct pcmcia_socket *s, ioaddr_t base,
         int i;
 
         for (i = 0; i < MAX_IO_WIN; i++) {
-                if ((s->io[i].BasePort <= base) &&
-                    (s->io[i].BasePort+s->io[i].NumPorts >= base+num)) {
+                if (!s->io[i].res)
+                        continue;
+                if ((s->io[i].res->start <= base) &&
+                    (s->io[i].res->end >= base+num-1)) {
                         s->io[i].InUse -= num;
                         /* Free the window if no one else is using it */
                         if (s->io[i].InUse == 0) {
-                                s->io[i].NumPorts = 0;
                                 release_resource(s->io[i].res);
                                 kfree(s->io[i].res);
                                 s->io[i].res = NULL;
@@ -165,21 +163,19 @@ static void release_io_space(struct pcmcia_socket *s, ioaddr_t base,
  * this and the tuple reading services.
  */
 
-int pccard_access_configuration_register(struct pcmcia_socket *s,
-                                         unsigned int function,
+int pcmcia_access_configuration_register(struct pcmcia_device *p_dev,
                                          conf_reg_t *reg)
 {
+        struct pcmcia_socket *s;
         config_t *c;
         int addr;
         u_char val;
 
-        if (!s || !s->config)
+        if (!p_dev || !p_dev->function_config)
                 return CS_NO_CARD;
 
-        c = &s->config[function];
-
-        if (c == NULL)
-                return CS_NO_CARD;
+        s = p_dev->socket;
+        c = p_dev->function_config;
 
         if (!(c->state & CONFIG_LOCKED))
                 return CS_CONFIGURATION_LOCKED;
@@ -200,20 +196,12 @@ int pccard_access_configuration_register(struct pcmcia_socket *s,
                 break;
         }
         return CS_SUCCESS;
-} /* pccard_access_configuration_register */
-
-int pcmcia_access_configuration_register(struct pcmcia_device *p_dev,
-                                         conf_reg_t *reg)
-{
-        return pccard_access_configuration_register(p_dev->socket,
-                                                    p_dev->func, reg);
-}
+} /* pcmcia_access_configuration_register */
 EXPORT_SYMBOL(pcmcia_access_configuration_register);
 
 
-
 int pccard_get_configuration_info(struct pcmcia_socket *s,
-                                  unsigned int function,
+                                  struct pcmcia_device *p_dev,
                                   config_info_t *config)
 {
         config_t *c;
@@ -221,7 +209,7 @@ int pccard_get_configuration_info(struct pcmcia_socket *s,
         if (!(s->state & SOCKET_PRESENT))
                 return CS_NO_CARD;
 
-        config->Function = function;
+        config->Function = p_dev->func;
 
 #ifdef CONFIG_CARDBUS
         if (s->state & SOCKET_CARDBUS) {
@@ -235,14 +223,14 @@ int pccard_get_configuration_info(struct pcmcia_socket *s,
                         config->AssignedIRQ = s->irq.AssignedIRQ;
                         if (config->AssignedIRQ)
                                 config->Attributes |= CONF_ENABLE_IRQ;
-                        config->BasePort1 = s->io[0].BasePort;
-                        config->NumPorts1 = s->io[0].NumPorts;
+                        config->BasePort1 = s->io[0].res->start;
+                        config->NumPorts1 = s->io[0].res->end - config->BasePort1 + 1;
                 }
                 return CS_SUCCESS;
         }
 #endif
 
-        c = (s->config != NULL) ? &s->config[function] : NULL;
+        c = (p_dev) ? p_dev->function_config : NULL;
 
         if ((c == NULL) || !(c->state & CONFIG_LOCKED)) {
                 config->Attributes = 0;
@@ -271,7 +259,7 @@ int pccard_get_configuration_info(struct pcmcia_socket *s,
 int pcmcia_get_configuration_info(struct pcmcia_device *p_dev,
                                   config_info_t *config)
 {
-        return pccard_get_configuration_info(p_dev->socket, p_dev->func,
+        return pccard_get_configuration_info(p_dev->socket, p_dev,
                                              config);
 }
 EXPORT_SYMBOL(pcmcia_get_configuration_info);
@@ -317,7 +305,7 @@ EXPORT_SYMBOL(pcmcia_get_window);
  * SocketState yet: I haven't seen any point for it.
  */
 
-int pccard_get_status(struct pcmcia_socket *s, unsigned int function,
+int pccard_get_status(struct pcmcia_socket *s, struct pcmcia_device *p_dev,
                       cs_status_t *status)
 {
         config_t *c;
@@ -334,11 +322,12 @@ int pccard_get_status(struct pcmcia_socket *s, unsigned int function,
         if (!(s->state & SOCKET_PRESENT))
                 return CS_NO_CARD;
 
-        c = (s->config != NULL) ? &s->config[function] : NULL;
+        c = (p_dev) ? p_dev->function_config : NULL;
+
         if ((c != NULL) && (c->state & CONFIG_LOCKED) &&
             (c->IntType & (INT_MEMORY_AND_IO | INT_ZOOMED_VIDEO))) {
                 u_char reg;
-                if (c->Present & PRESENT_PIN_REPLACE) {
+                if (c->CardValues & PRESENT_PIN_REPLACE) {
                         pcmcia_read_cis_mem(s, 1, (c->ConfigBase+CISREG_PRR)>>1, 1, &reg);
                         status->CardState |=
                                 (reg & PRR_WP_STATUS) ? CS_EVENT_WRITE_PROTECT : 0;
@@ -352,7 +341,7 @@ int pccard_get_status(struct pcmcia_socket *s, unsigned int function,
                         /* No PRR?  Then assume we're always ready */
                         status->CardState |= CS_EVENT_READY_CHANGE;
                 }
-                if (c->Present & PRESENT_EXT_STATUS) {
+                if (c->CardValues & PRESENT_EXT_STATUS) {
                         pcmcia_read_cis_mem(s, 1, (c->ConfigBase+CISREG_ESR)>>1, 1, &reg);
                         status->CardState |=
                                 (reg & ESR_REQ_ATTN) ? CS_EVENT_REQUEST_ATTENTION : 0;
@@ -370,11 +359,9 @@ int pccard_get_status(struct pcmcia_socket *s, unsigned int function,
         return CS_SUCCESS;
 } /* pccard_get_status */
 
-int pcmcia_get_status(client_handle_t handle, cs_status_t *status)
+int pcmcia_get_status(struct pcmcia_device *p_dev, cs_status_t *status)
 {
-        struct pcmcia_socket *s;
-        s = SOCKET(handle);
-        return pccard_get_status(s, handle->func, status);
+        return pccard_get_status(p_dev->socket, p_dev, status);
 }
 EXPORT_SYMBOL(pcmcia_get_status);
 
@@ -422,7 +409,8 @@ int pcmcia_modify_configuration(struct pcmcia_device *p_dev,
         config_t *c;
 
         s = p_dev->socket;
-        c = CONFIG(p_dev);
+        c = p_dev->function_config;
+
         if (!(s->state & SOCKET_PRESENT))
                 return CS_NO_CARD;
         if (!(c->state & CONFIG_LOCKED))
@@ -454,6 +442,28 @@ int pcmcia_modify_configuration(struct pcmcia_device *p_dev,
                    (mod->Attributes & CONF_VPP2_CHANGE_VALID))
                 return CS_BAD_VPP;
 
+        if (mod->Attributes & CONF_IO_CHANGE_WIDTH) {
+                pccard_io_map io_off = { 0, 0, 0, 0, 1 };
+                pccard_io_map io_on;
+                int i;
+
+                io_on.speed = io_speed;
+                for (i = 0; i < MAX_IO_WIN; i++) {
+                        if (!s->io[i].res)
+                                continue;
+                        io_off.map = i;
+                        io_on.map = i;
+
+                        io_on.flags = MAP_ACTIVE | IO_DATA_PATH_WIDTH_8;
+                        io_on.start = s->io[i].res->start;
+                        io_on.stop = s->io[i].res->end;
+
+                        s->ops->set_io_map(s, &io_off);
+                        mdelay(40);
+                        s->ops->set_io_map(s, &io_on);
+                }
+        }
+
         return CS_SUCCESS;
 } /* modify_configuration */
 EXPORT_SYMBOL(pcmcia_modify_configuration);
@@ -463,23 +473,23 @@ int pcmcia_release_configuration(struct pcmcia_device *p_dev)
 {
         pccard_io_map io = { 0, 0, 0, 0, 1 };
         struct pcmcia_socket *s = p_dev->socket;
+        config_t *c = p_dev->function_config;
         int i;
 
-        if (!(p_dev->state & CLIENT_CONFIG_LOCKED))
-                return CS_BAD_HANDLE;
-        p_dev->state &= ~CLIENT_CONFIG_LOCKED;
-
-        if (!(p_dev->state & CLIENT_STALE)) {
-                config_t *c = CONFIG(p_dev);
+        if (p_dev->_locked) {
+                p_dev->_locked = 0;
                 if (--(s->lock_count) == 0) {
                         s->socket.flags = SS_OUTPUT_ENA;   /* Is this correct? */
                         s->socket.Vpp = 0;
                         s->socket.io_irq = 0;
                         s->ops->set_socket(s, &s->socket);
                 }
+        }
+        if (c->state & CONFIG_LOCKED) {
+                c->state &= ~CONFIG_LOCKED;
                 if (c->state & CONFIG_IO_REQ)
                         for (i = 0; i < MAX_IO_WIN; i++) {
-                                if (s->io[i].NumPorts == 0)
+                                if (!s->io[i].res)
                                         continue;
                                 s->io[i].Config--;
                                 if (s->io[i].Config != 0)
@@ -487,12 +497,10 @@ int pcmcia_release_configuration(struct pcmcia_device *p_dev)
                                 io.map = i;
                                 s->ops->set_io_map(s, &io);
                         }
-                c->state &= ~CONFIG_LOCKED;
         }
 
         return CS_SUCCESS;
 } /* pcmcia_release_configuration */
-EXPORT_SYMBOL(pcmcia_release_configuration);
 
 
 /** pcmcia_release_io
@@ -503,25 +511,23 @@ EXPORT_SYMBOL(pcmcia_release_configuration);
  * don't bother checking the port ranges against the current socket
  * values.
  */
-int pcmcia_release_io(struct pcmcia_device *p_dev, io_req_t *req)
+static int pcmcia_release_io(struct pcmcia_device *p_dev, io_req_t *req)
 {
         struct pcmcia_socket *s = p_dev->socket;
+        config_t *c = p_dev->function_config;
 
-        if (!(p_dev->state & CLIENT_IO_REQ))
+        if (!p_dev->_io )
                 return CS_BAD_HANDLE;
-        p_dev->state &= ~CLIENT_IO_REQ;
-
-        if (!(p_dev->state & CLIENT_STALE)) {
-                config_t *c = CONFIG(p_dev);
-                if (c->state & CONFIG_LOCKED)
-                        return CS_CONFIGURATION_LOCKED;
-                if ((c->io.BasePort1 != req->BasePort1) ||
-                    (c->io.NumPorts1 != req->NumPorts1) ||
-                    (c->io.BasePort2 != req->BasePort2) ||
-                    (c->io.NumPorts2 != req->NumPorts2))
-                        return CS_BAD_ARGS;
-                c->state &= ~CONFIG_IO_REQ;
-        }
+
+        p_dev->_io = 0;
+
+        if ((c->io.BasePort1 != req->BasePort1) ||
+            (c->io.NumPorts1 != req->NumPorts1) ||
+            (c->io.BasePort2 != req->BasePort2) ||
+            (c->io.NumPorts2 != req->NumPorts2))
+                return CS_BAD_ARGS;
+
+        c->state &= ~CONFIG_IO_REQ;
 
         release_io_space(s, req->BasePort1, req->NumPorts1);
         if (req->NumPorts2)
@@ -529,28 +535,26 @@ int pcmcia_release_io(struct pcmcia_device *p_dev, io_req_t *req)
 
         return CS_SUCCESS;
 } /* pcmcia_release_io */
-EXPORT_SYMBOL(pcmcia_release_io);
 
 
-int pcmcia_release_irq(struct pcmcia_device *p_dev, irq_req_t *req)
+static int pcmcia_release_irq(struct pcmcia_device *p_dev, irq_req_t *req)
 {
         struct pcmcia_socket *s = p_dev->socket;
-        if (!(p_dev->state & CLIENT_IRQ_REQ))
+        config_t *c= p_dev->function_config;
+
+        if (!p_dev->_irq)
                 return CS_BAD_HANDLE;
-        p_dev->state &= ~CLIENT_IRQ_REQ;
-
-        if (!(p_dev->state & CLIENT_STALE)) {
-                config_t *c = CONFIG(p_dev);
-                if (c->state & CONFIG_LOCKED)
-                        return CS_CONFIGURATION_LOCKED;
-                if (c->irq.Attributes != req->Attributes)
-                        return CS_BAD_ATTRIBUTE;
-                if (s->irq.AssignedIRQ != req->AssignedIRQ)
-                        return CS_BAD_IRQ;
-                if (--s->irq.Config == 0) {
-                        c->state &= ~CONFIG_IRQ_REQ;
-                        s->irq.AssignedIRQ = 0;
-                }
+        p_dev->_irq = 0;
+
+        if (c->state & CONFIG_LOCKED)
+                return CS_CONFIGURATION_LOCKED;
+        if (c->irq.Attributes != req->Attributes)
+                return CS_BAD_ATTRIBUTE;
+        if (s->irq.AssignedIRQ != req->AssignedIRQ)
+                return CS_BAD_IRQ;
+        if (--s->irq.Config == 0) {
+                c->state &= ~CONFIG_IRQ_REQ;
+                s->irq.AssignedIRQ = 0;
         }
 
         if (req->Attributes & IRQ_HANDLE_PRESENT) {
@@ -563,7 +567,6 @@ int pcmcia_release_irq(struct pcmcia_device *p_dev, irq_req_t *req)
 
         return CS_SUCCESS;
 } /* pcmcia_release_irq */
-EXPORT_SYMBOL(pcmcia_release_irq);
 
 
 int pcmcia_release_window(window_handle_t win)
@@ -573,7 +576,7 @@ int pcmcia_release_window(window_handle_t win)
         if ((win == NULL) || (win->magic != WINDOW_MAGIC))
                 return CS_BAD_HANDLE;
         s = win->sock;
-        if (!(win->handle->state & CLIENT_WIN_REQ(win->index)))
+        if (!(win->handle->_win & CLIENT_WIN_REQ(win->index)))
                 return CS_BAD_HANDLE;
 
         /* Shut down memory window */
@@ -587,7 +590,7 @@ int pcmcia_release_window(window_handle_t win)
                 kfree(win->ctl.res);
                 win->ctl.res = NULL;
         }
-        win->handle->state &= ~CLIENT_WIN_REQ(win->index);
+        win->handle->_win &= ~CLIENT_WIN_REQ(win->index);
 
         win->magic = 0;
 
@@ -610,16 +613,12 @@ int pcmcia_request_configuration(struct pcmcia_device *p_dev,
 
         if (req->IntType & INT_CARDBUS)
                 return CS_UNSUPPORTED_MODE;
-        c = CONFIG(p_dev);
+        c = p_dev->function_config;
         if (c->state & CONFIG_LOCKED)
                 return CS_CONFIGURATION_LOCKED;
 
         /* Do power control.  We don't allow changes in Vcc. */
-        if (s->socket.Vcc != req->Vcc)
-                return CS_BAD_VCC;
-        if (req->Vpp1 != req->Vpp2)
-                return CS_BAD_VPP;
-        s->socket.Vpp = req->Vpp1;
+        s->socket.Vpp = req->Vpp;
         if (s->ops->set_socket(s, &s->socket))
                 return CS_BAD_VPP;
 
@@ -643,7 +642,7 @@ int pcmcia_request_configuration(struct pcmcia_device *p_dev,
 
         /* Set up CIS configuration registers */
         base = c->ConfigBase = req->ConfigBase;
-        c->Present = c->CardValues = req->Present;
+        c->CardValues = req->Present;
         if (req->Present & PRESENT_COPY) {
                 c->Copy = req->Copy;
                 pcmcia_write_cis_mem(s, 1, (base + CISREG_SCR)>>1, 1, &c->Copy);
@@ -690,10 +689,10 @@ int pcmcia_request_configuration(struct pcmcia_device *p_dev,
         if (c->state & CONFIG_IO_REQ) {
                 iomap.speed = io_speed;
                 for (i = 0; i < MAX_IO_WIN; i++)
-                        if (s->io[i].NumPorts != 0) {
+                        if (s->io[i].res) {
                                 iomap.map = i;
                                 iomap.flags = MAP_ACTIVE;
-                                switch (s->io[i].Attributes & IO_DATA_PATH_WIDTH) {
+                                switch (s->io[i].res->flags & IO_DATA_PATH_WIDTH) {
                                 case IO_DATA_PATH_WIDTH_16:
                                         iomap.flags |= MAP_16BIT; break;
                                 case IO_DATA_PATH_WIDTH_AUTO:
@@ -701,15 +700,15 @@ int pcmcia_request_configuration(struct pcmcia_device *p_dev,
                                 default:
                                         break;
                                 }
-                                iomap.start = s->io[i].BasePort;
-                                iomap.stop = iomap.start + s->io[i].NumPorts - 1;
+                                iomap.start = s->io[i].res->start;
+                                iomap.stop = s->io[i].res->end;
                                 s->ops->set_io_map(s, &iomap);
                                 s->io[i].Config++;
                         }
         }
 
         c->state |= CONFIG_LOCKED;
-        p_dev->state |= CLIENT_CONFIG_LOCKED;
+        p_dev->_locked = 1;
         return CS_SUCCESS;
 } /* pcmcia_request_configuration */
 EXPORT_SYMBOL(pcmcia_request_configuration);
@@ -730,7 +729,7 @@ int pcmcia_request_io(struct pcmcia_device *p_dev, io_req_t *req)
 
         if (!req)
                 return CS_UNSUPPORTED_MODE;
-        c = CONFIG(p_dev);
+        c = p_dev->function_config;
         if (c->state & CONFIG_LOCKED)
                 return CS_CONFIGURATION_LOCKED;
         if (c->state & CONFIG_IO_REQ)
@@ -755,7 +754,7 @@ int pcmcia_request_io(struct pcmcia_device *p_dev, io_req_t *req)
 
         c->io = *req;
         c->state |= CONFIG_IO_REQ;
-        p_dev->state |= CLIENT_IO_REQ;
+        p_dev->_io = 1;
         return CS_SUCCESS;
 } /* pcmcia_request_io */
 EXPORT_SYMBOL(pcmcia_request_io);
@@ -786,7 +785,7 @@ int pcmcia_request_irq(struct pcmcia_device *p_dev, irq_req_t *req)
 
         if (!(s->state & SOCKET_PRESENT))
                 return CS_NO_CARD;
-        c = CONFIG(p_dev);
+        c = p_dev->function_config;
         if (c->state & CONFIG_LOCKED)
                 return CS_CONFIGURATION_LOCKED;
         if (c->state & CONFIG_IRQ_REQ)
@@ -851,7 +850,7 @@ int pcmcia_request_irq(struct pcmcia_device *p_dev, irq_req_t *req)
         s->irq.Config++;
 
         c->state |= CONFIG_IRQ_REQ;
-        p_dev->state |= CLIENT_IRQ_REQ;
+        p_dev->_irq = 1;
 
 #ifdef CONFIG_PCMCIA_PROBE
         pcmcia_used_irq[irq]++;
@@ -911,7 +910,7 @@ int pcmcia_request_window(struct pcmcia_device **p_dev, win_req_t *req, window_h
                 if (!win->ctl.res)
                         return CS_IN_USE;
         }
-        (*p_dev)->state |= CLIENT_WIN_REQ(w);
+        (*p_dev)->_win |= CLIENT_WIN_REQ(w);
 
         /* Configure the socket controller */
         win->ctl.map = w+1;
@@ -941,3 +940,14 @@ int pcmcia_request_window(struct pcmcia_device **p_dev, win_req_t *req, window_h
         return CS_SUCCESS;
 } /* pcmcia_request_window */
 EXPORT_SYMBOL(pcmcia_request_window);
+
+void pcmcia_disable_device(struct pcmcia_device *p_dev) {
+        pcmcia_release_configuration(p_dev);
+        pcmcia_release_io(p_dev, &p_dev->io);
+        pcmcia_release_irq(p_dev, &p_dev->irq);
+        if (&p_dev->win)
+                pcmcia_release_window(p_dev->win);
+
+        p_dev->dev_node = NULL;
+}
+EXPORT_SYMBOL(pcmcia_disable_device);
diff --git a/drivers/pcmcia/pd6729.c b/drivers/pcmcia/pd6729.c
index f2789afb22b2..16d1ea7b0a18 100644
--- a/drivers/pcmcia/pd6729.c
+++ b/drivers/pcmcia/pd6729.c
@@ -8,7 +8,6 @@
  */
 
 #include <linux/kernel.h>
-#include <linux/config.h>
 #include <linux/module.h>
 #include <linux/pci.h>
 #include <linux/init.h>
diff --git a/drivers/pcmcia/rsrc_mgr.c b/drivers/pcmcia/rsrc_mgr.c
index 514609369836..81dfc2cac2b4 100644
--- a/drivers/pcmcia/rsrc_mgr.c
+++ b/drivers/pcmcia/rsrc_mgr.c
@@ -12,7 +12,6 @@
  * (C) 1999             David A. Hinds
  */
 
-#include <linux/config.h>
 #include <linux/module.h>
 #include <linux/kernel.h>
 
@@ -22,6 +21,8 @@
 #include "cs_internal.h"
 
 
+#ifdef CONFIG_PCMCIA_IOCTL
+
 #ifdef CONFIG_PCMCIA_PROBE
 
 static int adjust_irq(struct pcmcia_socket *s, adjust_t *adj)
@@ -98,6 +99,8 @@ int pcmcia_adjust_resource_info(adjust_t *adj)
 }
 EXPORT_SYMBOL(pcmcia_adjust_resource_info);
 
+#endif
+
 int pcmcia_validate_mem(struct pcmcia_socket *s)
 {
         if (s->resource_ops->validate_mem)
diff --git a/drivers/pcmcia/rsrc_nonstatic.c b/drivers/pcmcia/rsrc_nonstatic.c
index 5301ac60358f..0f8b157c9717 100644
--- a/drivers/pcmcia/rsrc_nonstatic.c
+++ b/drivers/pcmcia/rsrc_nonstatic.c
@@ -12,7 +12,6 @@
  * (C) 1999             David A. Hinds
  */
 
-#include <linux/config.h>
 #include <linux/module.h>
 #include <linux/moduleparam.h>
 #include <linux/init.h>
@@ -61,7 +60,7 @@ struct socket_data {
         unsigned int                    rsrc_mem_probe;
 };
 
-static DECLARE_MUTEX(rsrc_sem);
+static DEFINE_MUTEX(rsrc_mutex);
 #define MEM_PROBE_LOW   (1 << 0)
 #define MEM_PROBE_HIGH  (1 << 1)
 
@@ -484,7 +483,7 @@ static int validate_mem(struct pcmcia_socket *s, unsigned int probe_mask)
 
 
 /*
- * Locking note: Must be called with skt_sem held!
+ * Locking note: Must be called with skt_mutex held!
  */
 static int pcmcia_nonstatic_validate_mem(struct pcmcia_socket *s)
 {
@@ -495,7 +494,7 @@ static int pcmcia_nonstatic_validate_mem(struct pcmcia_socket *s)
         if (!probe_mem)
                 return 0;
 
-        down(&rsrc_sem);
+        mutex_lock(&rsrc_mutex);
 
         if (s->features & SS_CAP_PAGE_REGS)
                 probe_mask = MEM_PROBE_HIGH;
@@ -507,7 +506,7 @@ static int pcmcia_nonstatic_validate_mem(struct pcmcia_socket *s)
                         s_data->rsrc_mem_probe |= probe_mask;
         }
 
-        up(&rsrc_sem);
+        mutex_unlock(&rsrc_mutex);
 
         return ret;
 }
@@ -585,7 +584,7 @@ static int nonstatic_adjust_io_region(struct resource *res, unsigned long r_star
         struct socket_data *s_data = s->resource_data;
         int ret = -ENOMEM;
 
-        down(&rsrc_sem);
+        mutex_lock(&rsrc_mutex);
         for (m = s_data->io_db.next; m != &s_data->io_db; m = m->next) {
                 unsigned long start = m->base;
                 unsigned long end = m->base + m->num - 1;
@@ -596,7 +595,7 @@ static int nonstatic_adjust_io_region(struct resource *res, unsigned long r_star
                 ret = adjust_resource(res, r_start, r_end - r_start + 1);
                 break;
         }
-        up(&rsrc_sem);
+        mutex_unlock(&rsrc_mutex);
 
         return ret;
 }
@@ -630,7 +629,7 @@ static struct resource *nonstatic_find_io_region(unsigned long base, int num,
         data.offset = base & data.mask;
         data.map = &s_data->io_db;
 
-        down(&rsrc_sem);
+        mutex_lock(&rsrc_mutex);
 #ifdef CONFIG_PCI
         if (s->cb_dev) {
                 ret = pci_bus_alloc_resource(s->cb_dev->bus, res, num, 1,
@@ -639,7 +638,7 @@ static struct resource *nonstatic_find_io_region(unsigned long base, int num,
 #endif
                 ret = allocate_resource(&ioport_resource, res, num, min, ~0UL,
                                         1, pcmcia_align, &data);
-        up(&rsrc_sem);
+        mutex_unlock(&rsrc_mutex);
 
         if (ret != 0) {
                 kfree(res);
@@ -672,7 +671,7 @@ static struct resource * nonstatic_find_mem_region(u_long base, u_long num,
                         min = 0x100000UL + base;
                 }
 
-                down(&rsrc_sem);
+                mutex_lock(&rsrc_mutex);
 #ifdef CONFIG_PCI
                 if (s->cb_dev) {
                         ret = pci_bus_alloc_resource(s->cb_dev->bus, res, num,
@@ -682,7 +681,7 @@ static struct resource * nonstatic_find_mem_region(u_long base, u_long num,
 #endif
                         ret = allocate_resource(&iomem_resource, res, num, min,
                                                 max, 1, pcmcia_align, &data);
-                up(&rsrc_sem);
+                mutex_unlock(&rsrc_mutex);
                 if (ret == 0 || low)
                         break;
                 low = 1;
@@ -705,7 +704,7 @@ static int adjust_memory(struct pcmcia_socket *s, unsigned int action, unsigned
         if (end < start)
                 return -EINVAL;
 
-        down(&rsrc_sem);
+        mutex_lock(&rsrc_mutex);
         switch (action) {
         case ADD_MANAGED_RESOURCE:
                 ret = add_interval(&data->mem_db, start, size);
@@ -723,7 +722,7 @@ static int adjust_memory(struct pcmcia_socket *s, unsigned int action, unsigned
         default:
                 ret = -EINVAL;
         }
-        up(&rsrc_sem);
+        mutex_unlock(&rsrc_mutex);
 
         return ret;
 }
@@ -741,7 +740,7 @@ static int adjust_io(struct pcmcia_socket *s, unsigned int action, unsigned long
         if (end > IO_SPACE_LIMIT)
                 return -EINVAL;
 
-        down(&rsrc_sem);
+        mutex_lock(&rsrc_mutex);
         switch (action) {
         case ADD_MANAGED_RESOURCE:
                 if (add_interval(&data->io_db, start, size) != 0) {
@@ -760,7 +759,7 @@ static int adjust_io(struct pcmcia_socket *s, unsigned int action, unsigned long
                 ret = -EINVAL;
                 break;
         }
-        up(&rsrc_sem);
+        mutex_unlock(&rsrc_mutex);
 
         return ret;
 }
@@ -867,7 +866,7 @@ static void nonstatic_release_resource_db(struct pcmcia_socket *s)
         struct socket_data *data = s->resource_data;
         struct resource_map *p, *q;
 
-        down(&rsrc_sem);
+        mutex_lock(&rsrc_mutex);
         for (p = data->mem_db.next; p != &data->mem_db; p = q) {
                 q = p->next;
                 kfree(p);
@@ -876,7 +875,7 @@ static void nonstatic_release_resource_db(struct pcmcia_socket *s)
                 q = p->next;
                 kfree(p);
         }
-        up(&rsrc_sem);
+        mutex_unlock(&rsrc_mutex);
 }
 
 
@@ -901,7 +900,7 @@ static ssize_t show_io_db(struct class_device *class_dev, char *buf)
         struct resource_map *p;
         ssize_t ret = 0;
 
-        down(&rsrc_sem);
+        mutex_lock(&rsrc_mutex);
         data = s->resource_data;
 
         for (p = data->io_db.next; p != &data->io_db; p = p->next) {
@@ -913,7 +912,7 @@ static ssize_t show_io_db(struct class_device *class_dev, char *buf)
                                  ((unsigned long) p->base + p->num - 1));
         }
 
-        up(&rsrc_sem);
+        mutex_unlock(&rsrc_mutex);
         return (ret);
 }
 
@@ -953,7 +952,7 @@ static ssize_t show_mem_db(struct class_device *class_dev, char *buf)
         struct resource_map *p;
         ssize_t ret = 0;
 
-        down(&rsrc_sem);
+        mutex_lock(&rsrc_mutex);
         data = s->resource_data;
 
         for (p = data->mem_db.next; p != &data->mem_db; p = p->next) {
@@ -965,7 +964,7 @@ static ssize_t show_mem_db(struct class_device *class_dev, char *buf)
                                  ((unsigned long) p->base + p->num - 1));
         }
 
-        up(&rsrc_sem);
+        mutex_unlock(&rsrc_mutex);
         return (ret);
 }
 
diff --git a/drivers/pcmcia/sa1100_cerf.c b/drivers/pcmcia/sa1100_cerf.c
index 2b3c2895b43d..eb89928f2338 100644
--- a/drivers/pcmcia/sa1100_cerf.c
+++ b/drivers/pcmcia/sa1100_cerf.c
@@ -5,7 +5,6 @@
  * Based off the Assabet.
  *
  */
-#include <linux/config.h>
 #include <linux/module.h>
 #include <linux/kernel.h>
 #include <linux/sched.h>
diff --git a/drivers/pcmcia/socket_sysfs.c b/drivers/pcmcia/socket_sysfs.c
index 5ab1cdef7c48..c5d7476da471 100644
--- a/drivers/pcmcia/socket_sysfs.c
+++ b/drivers/pcmcia/socket_sysfs.c
@@ -12,7 +12,6 @@
 #include <linux/moduleparam.h>
 #include <linux/init.h>
 #include <linux/kernel.h>
-#include <linux/config.h>
 #include <linux/string.h>
 #include <linux/major.h>
 #include <linux/errno.h>
@@ -25,6 +24,7 @@
 #include <linux/pm.h>
 #include <linux/pci.h>
 #include <linux/device.h>
+#include <linux/mutex.h>
 #include <asm/system.h>
 #include <asm/irq.h>
 
@@ -183,7 +183,7 @@ static ssize_t pccard_store_resource(struct class_device *dev, const char *buf,
                 s->resource_setup_done = 1;
         spin_unlock_irqrestore(&s->lock, flags);
 
-        down(&s->skt_sem);
+        mutex_lock(&s->skt_mutex);
         if ((s->callback) &&
             (s->state & SOCKET_PRESENT) &&
             !(s->state & SOCKET_CARDBUS)) {
@@ -192,7 +192,7 @@ static ssize_t pccard_store_resource(struct class_device *dev, const char *buf,
                         module_put(s->callback->owner);
                 }
         }
-        up(&s->skt_sem);
+        mutex_unlock(&s->skt_mutex);
 
         return count;
 }
@@ -322,7 +322,7 @@ static ssize_t pccard_store_cis(struct kobject *kobj, char *buf, loff_t off, siz
         kfree(cis);
 
         if (!ret) {
-                down(&s->skt_sem);
+                mutex_lock(&s->skt_mutex);
                 if ((s->callback) && (s->state & SOCKET_PRESENT) &&
                     !(s->state & SOCKET_CARDBUS)) {
                         if (try_module_get(s->callback->owner)) {
@@ -330,7 +330,7 @@ static ssize_t pccard_store_cis(struct kobject *kobj, char *buf, loff_t off, siz
                                 module_put(s->callback->owner);
                         }
                 }
-                up(&s->skt_sem);
+                mutex_unlock(&s->skt_mutex);
         }
 
 
diff --git a/drivers/pcmcia/ti113x.h b/drivers/pcmcia/ti113x.h
index d5b4ff74462e..7a3d1b8e16b9 100644
--- a/drivers/pcmcia/ti113x.h
+++ b/drivers/pcmcia/ti113x.h
@@ -30,7 +30,6 @@
 #ifndef _LINUX_TI113X_H
 #define _LINUX_TI113X_H
 
-#include <linux/config.h>
 
 /* Register definitions for TI 113X PCI-to-CardBus bridges */
 
diff --git a/drivers/rtc/Kconfig b/drivers/rtc/Kconfig
index 929dd8090578..65d090dbef46 100644
--- a/drivers/rtc/Kconfig
+++ b/drivers/rtc/Kconfig
@@ -147,6 +147,16 @@ config RTC_DRV_SA1100
           To compile this driver as a module, choose M here: the
           module will be called rtc-sa1100.
 
+config RTC_DRV_VR41XX
+        tristate "NEC VR41XX"
+        depends on RTC_CLASS && CPU_VR41XX
+        help
+          If you say Y here you will get access to the real time clock
+          built into your NEC VR41XX CPU.
+
+          To compile this driver as a module, choose M here: the
+          module will be called rtc-vr41xx.
+
 config RTC_DRV_TEST
         tristate "Test driver/device"
         depends on RTC_CLASS
diff --git a/drivers/rtc/Makefile b/drivers/rtc/Makefile
index 8d4c7fe88d58..a9ca0f171686 100644
--- a/drivers/rtc/Makefile
+++ b/drivers/rtc/Makefile
@@ -19,3 +19,4 @@ obj-$(CONFIG_RTC_DRV_RS5C372)	+= rtc-rs5c372.o
 obj-$(CONFIG_RTC_DRV_M48T86)    += rtc-m48t86.o
 obj-$(CONFIG_RTC_DRV_EP93XX)    += rtc-ep93xx.o
 obj-$(CONFIG_RTC_DRV_SA1100)    += rtc-sa1100.o
+obj-$(CONFIG_RTC_DRV_VR41XX)    += rtc-vr41xx.o
diff --git a/drivers/rtc/class.c b/drivers/rtc/class.c
index 8533936d50d8..413c7d54ea10 100644
--- a/drivers/rtc/class.c
+++ b/drivers/rtc/class.c
@@ -96,6 +96,8 @@ exit_idr:
         idr_remove(&rtc_idr, id);
 
 exit:
+        dev_err(dev, "rtc core: unable to register %s, err = %d\n",
+                        name, err);
         return ERR_PTR(err);
 }
 EXPORT_SYMBOL_GPL(rtc_device_register);
diff --git a/drivers/rtc/rtc-ds1672.c b/drivers/rtc/rtc-ds1672.c
index 358695a416f3..9be81fd4737c 100644
--- a/drivers/rtc/rtc-ds1672.c
+++ b/drivers/rtc/rtc-ds1672.c
@@ -1,6 +1,8 @@
 /*
  * An rtc/i2c driver for the Dallas DS1672
- * Copyright 2005 Alessandro Zummo
+ * Copyright 2005-06 Tower Technologies
+ *
+ * Author: Alessandro Zummo <a.zummo@towertech.it>
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License version 2 as
@@ -11,7 +13,7 @@
 #include <linux/i2c.h>
 #include <linux/rtc.h>
 
-#define DRV_VERSION "0.2"
+#define DRV_VERSION "0.3"
 
 /* Addresses to scan: none. This chip cannot be detected. */
 static unsigned short normal_i2c[] = { I2C_CLIENT_END };
@@ -25,6 +27,7 @@ I2C_CLIENT_INSMOD;
 #define DS1672_REG_CONTROL      4
 #define DS1672_REG_TRICKLE      5
 
+#define DS1672_REG_CONTROL_EOSC 0x80
 
 /* Prototypes */
 static int ds1672_probe(struct i2c_adapter *adapter, int address, int kind);
@@ -53,8 +56,7 @@ static int ds1672_get_datetime(struct i2c_client *client, struct rtc_time *tm)
 
         dev_dbg(&client->dev,
                 "%s: raw read data - counters=%02x,%02x,%02x,%02x\n"
-                __FUNCTION__,
-                buf[0], buf[1], buf[2], buf[3]);
+                __FUNCTION__, buf[0], buf[1], buf[2], buf[3]);
 
         time = (buf[3] << 24) | (buf[2] << 16) | (buf[1] << 8) | buf[0];
 
@@ -62,8 +64,7 @@ static int ds1672_get_datetime(struct i2c_client *client, struct rtc_time *tm)
 
         dev_dbg(&client->dev, "%s: tm is secs=%d, mins=%d, hours=%d, "
                 "mday=%d, mon=%d, year=%d, wday=%d\n",
-                __FUNCTION__,
-                tm->tm_sec, tm->tm_min, tm->tm_hour,
+                __FUNCTION__, tm->tm_sec, tm->tm_min, tm->tm_hour,
                 tm->tm_mday, tm->tm_mon, tm->tm_year, tm->tm_wday);
 
         return 0;
@@ -72,16 +73,17 @@ static int ds1672_get_datetime(struct i2c_client *client, struct rtc_time *tm)
 static int ds1672_set_mmss(struct i2c_client *client, unsigned long secs)
 {
         int xfer;
-        unsigned char buf[5];
+        unsigned char buf[6];
 
         buf[0] = DS1672_REG_CNT_BASE;
         buf[1] = secs & 0x000000FF;
         buf[2] = (secs & 0x0000FF00) >> 8;
         buf[3] = (secs & 0x00FF0000) >> 16;
         buf[4] = (secs & 0xFF000000) >> 24;
+        buf[5] = 0;     /* set control reg to enable counting */
 
-        xfer = i2c_master_send(client, buf, 5);
-        if (xfer != 5) {
+        xfer = i2c_master_send(client, buf, 6);
+        if (xfer != 6) {
                 dev_err(&client->dev, "%s: send: %d\n", __FUNCTION__, xfer);
                 return -EIO;
         }
@@ -120,6 +122,40 @@ static int ds1672_rtc_set_mmss(struct device *dev, unsigned long secs)
         return ds1672_set_mmss(to_i2c_client(dev), secs);
 }
 
+static int ds1672_get_control(struct i2c_client *client, u8 *status)
+{
+        unsigned char addr = DS1672_REG_CONTROL;
+
+        struct i2c_msg msgs[] = {
+                { client->addr, 0, 1, &addr },          /* setup read ptr */
+                { client->addr, I2C_M_RD, 1, status },  /* read control */
+        };
+
+        /* read control register */
+        if ((i2c_transfer(client->adapter, &msgs[0], 2)) != 2) {
+                dev_err(&client->dev, "%s: read error\n", __FUNCTION__);
+                return -EIO;
+        }
+
+        return 0;
+}
+
+/* following are the sysfs callback functions */
+static ssize_t show_control(struct device *dev, struct device_attribute *attr, char *buf)
+{
+        struct i2c_client *client = to_i2c_client(dev);
+        u8 control;
+        int err;
+
+        err = ds1672_get_control(client, &control);
+        if (err)
+                return err;
+
+        return sprintf(buf, "%s\n", (control & DS1672_REG_CONTROL_EOSC)
+                                        ? "disabled" : "enabled");
+}
+static DEVICE_ATTR(control, S_IRUGO, show_control, NULL);
+
 static struct rtc_class_ops ds1672_rtc_ops = {
         .read_time      = ds1672_rtc_read_time,
         .set_time       = ds1672_rtc_set_time,
@@ -128,7 +164,6 @@ static struct rtc_class_ops ds1672_rtc_ops = {
 
 static int ds1672_attach(struct i2c_adapter *adapter)
 {
-        dev_dbg(&adapter->dev, "%s\n", __FUNCTION__);
         return i2c_probe(adapter, &addr_data, ds1672_probe);
 }
 
@@ -137,8 +172,6 @@ static int ds1672_detach(struct i2c_client *client)
         int err;
         struct rtc_device *rtc = i2c_get_clientdata(client);
 
-        dev_dbg(&client->dev, "%s\n", __FUNCTION__);
-
         if (rtc)
                 rtc_device_unregister(rtc);
 
@@ -162,6 +195,7 @@ static struct i2c_driver ds1672_driver = {
 static int ds1672_probe(struct i2c_adapter *adapter, int address, int kind)
 {
         int err = 0;
+        u8 control;
         struct i2c_client *client;
         struct rtc_device *rtc;
 
@@ -195,13 +229,23 @@ static int ds1672_probe(struct i2c_adapter *adapter, int address, int kind)
 
         if (IS_ERR(rtc)) {
                 err = PTR_ERR(rtc);
-                dev_err(&client->dev,
-                        "unable to register the class device\n");
                 goto exit_detach;
         }
 
         i2c_set_clientdata(client, rtc);
 
+        /* read control register */
+        err = ds1672_get_control(client, &control);
+        if (err)
+                goto exit_detach;
+
+        if (control & DS1672_REG_CONTROL_EOSC)
+                dev_warn(&client->dev, "Oscillator not enabled. "
+                                        "Set time to enable.\n");
+
+        /* Register sysfs hooks */
+        device_create_file(&client->dev, &dev_attr_control);
+
         return 0;
 
 exit_detach:
diff --git a/drivers/rtc/rtc-ep93xx.c b/drivers/rtc/rtc-ep93xx.c
index 0dd80ea686a9..e1a1169e4664 100644
--- a/drivers/rtc/rtc-ep93xx.c
+++ b/drivers/rtc/rtc-ep93xx.c
@@ -67,7 +67,6 @@ static int ep93xx_rtc_proc(struct device *dev, struct seq_file *seq)
 
         ep93xx_get_swcomp(dev, &preload, &delete);
 
-        seq_printf(seq, "24hr\t\t: yes\n");
         seq_printf(seq, "preload\t\t: %d\n", preload);
         seq_printf(seq, "delete\t\t: %d\n", delete);
 
@@ -110,7 +109,6 @@ static int __devinit ep93xx_rtc_probe(struct platform_device *dev)
                                 &dev->dev, &ep93xx_rtc_ops, THIS_MODULE);
 
         if (IS_ERR(rtc)) {
-                dev_err(&dev->dev, "unable to register\n");
                 return PTR_ERR(rtc);
         }
 
diff --git a/drivers/rtc/rtc-m48t86.c b/drivers/rtc/rtc-m48t86.c
index db445c872b1b..f6e7ee04f3dc 100644
--- a/drivers/rtc/rtc-m48t86.c
+++ b/drivers/rtc/rtc-m48t86.c
@@ -23,7 +23,7 @@
 #define M48T86_REG_SECALRM      0x01
 #define M48T86_REG_MIN          0x02
 #define M48T86_REG_MINALRM      0x03
-#define M48T86_REG_HOUR 0x04
+#define M48T86_REG_HOUR         0x04
 #define M48T86_REG_HOURALRM     0x05
 #define M48T86_REG_DOW          0x06 /* 1 = sunday */
 #define M48T86_REG_DOM          0x07
@@ -127,9 +127,6 @@ static int m48t86_rtc_proc(struct device *dev, struct seq_file *seq)
 
         reg = ops->readb(M48T86_REG_B);
 
-        seq_printf(seq, "24hr\t\t: %s\n",
-                 (reg & M48T86_REG_B_H24) ? "yes" : "no");
-
         seq_printf(seq, "mode\t\t: %s\n",
                  (reg & M48T86_REG_B_DM) ? "binary" : "bcd");
 
@@ -154,10 +151,8 @@ static int __devinit m48t86_rtc_probe(struct platform_device *dev)
         struct rtc_device *rtc = rtc_device_register("m48t86",
                                 &dev->dev, &m48t86_rtc_ops, THIS_MODULE);
 
-        if (IS_ERR(rtc)) {
-                dev_err(&dev->dev, "unable to register\n");
+        if (IS_ERR(rtc))
                 return PTR_ERR(rtc);
-        }
 
         platform_set_drvdata(dev, rtc);
 
diff --git a/drivers/rtc/rtc-pcf8563.c b/drivers/rtc/rtc-pcf8563.c
index d857d45bdbe8..ba9a583b7b68 100644
--- a/drivers/rtc/rtc-pcf8563.c
+++ b/drivers/rtc/rtc-pcf8563.c
@@ -227,14 +227,7 @@ static int pcf8563_rtc_set_time(struct device *dev, struct rtc_time *tm)
         return pcf8563_set_datetime(to_i2c_client(dev), tm);
 }
 
-static int pcf8563_rtc_proc(struct device *dev, struct seq_file *seq)
-{
-        seq_printf(seq, "24hr\t\t: yes\n");
-        return 0;
-}
-
 static struct rtc_class_ops pcf8563_rtc_ops = {
-        .proc           = pcf8563_rtc_proc,
         .read_time      = pcf8563_rtc_read_time,
         .set_time       = pcf8563_rtc_set_time,
 };
@@ -297,8 +290,6 @@ static int pcf8563_probe(struct i2c_adapter *adapter, int address, int kind)
 
         if (IS_ERR(rtc)) {
                 err = PTR_ERR(rtc);
-                dev_err(&client->dev,
-                        "unable to register the class device\n");
                 goto exit_detach;
         }
 
@@ -321,8 +312,6 @@ static int pcf8563_detach(struct i2c_client *client)
         int err;
         struct rtc_device *rtc = i2c_get_clientdata(client);
 
-        dev_dbg(&client->dev, "%s\n", __FUNCTION__);
-
         if (rtc)
                 rtc_device_unregister(rtc);
 
diff --git a/drivers/rtc/rtc-proc.c b/drivers/rtc/rtc-proc.c
index 90b8a97a0919..cef5f5a3bbf9 100644
--- a/drivers/rtc/rtc-proc.c
+++ b/drivers/rtc/rtc-proc.c
@@ -71,6 +71,8 @@ static int rtc_proc_show(struct seq_file *seq, void *offset)
                                 alrm.pending ? "yes" : "no");
         }
 
+        seq_printf(seq, "24hr\t\t: yes\n");
+
         if (ops->proc)
                 ops->proc(class_dev->dev, seq);
 
diff --git a/drivers/rtc/rtc-rs5c372.c b/drivers/rtc/rtc-rs5c372.c
index 396c8681f66c..7553d797603f 100644
--- a/drivers/rtc/rtc-rs5c372.c
+++ b/drivers/rtc/rtc-rs5c372.c
@@ -151,9 +151,8 @@ static int rs5c372_rtc_proc(struct device *dev, struct seq_file *seq)
 {
         int err, osc, trim;
 
-        seq_printf(seq, "24hr\t\t: yes\n");
-
-        if ((err = rs5c372_get_trim(to_i2c_client(dev), &osc, &trim)) == 0) {
+        err = rs5c372_get_trim(to_i2c_client(dev), &osc, &trim);
+        if (err == 0) {
                 seq_printf(seq, "%d.%03d KHz\n", osc / 1000, osc % 1000);
                 seq_printf(seq, "trim\t: %d\n", trim);
         }
@@ -170,30 +169,31 @@ static struct rtc_class_ops rs5c372_rtc_ops = {
 static ssize_t rs5c372_sysfs_show_trim(struct device *dev,
                                 struct device_attribute *attr, char *buf)
 {
-        int trim;
+        int err, trim;
 
-        if (rs5c372_get_trim(to_i2c_client(dev), NULL, &trim) == 0)
-                return sprintf(buf, "0x%2x\n", trim);
+        err = rs5c372_get_trim(to_i2c_client(dev), NULL, &trim);
+        if (err)
+                return err;
 
-        return 0;
+        return sprintf(buf, "0x%2x\n", trim);
 }
 static DEVICE_ATTR(trim, S_IRUGO, rs5c372_sysfs_show_trim, NULL);
 
 static ssize_t rs5c372_sysfs_show_osc(struct device *dev,
                                 struct device_attribute *attr, char *buf)
 {
-        int osc;
+        int err, osc;
 
-        if (rs5c372_get_trim(to_i2c_client(dev), &osc, NULL) == 0)
-                return sprintf(buf, "%d.%03d KHz\n", osc / 1000, osc % 1000);
+        err = rs5c372_get_trim(to_i2c_client(dev), &osc, NULL);
+        if (err)
+                return err;
 
-        return 0;
+        return sprintf(buf, "%d.%03d KHz\n", osc / 1000, osc % 1000);
 }
 static DEVICE_ATTR(osc, S_IRUGO, rs5c372_sysfs_show_osc, NULL);
 
 static int rs5c372_attach(struct i2c_adapter *adapter)
 {
-        dev_dbg(&adapter->dev, "%s\n", __FUNCTION__);
         return i2c_probe(adapter, &addr_data, rs5c372_probe);
 }
 
@@ -233,8 +233,6 @@ static int rs5c372_probe(struct i2c_adapter *adapter, int address, int kind)
 
         if (IS_ERR(rtc)) {
                 err = PTR_ERR(rtc);
-                dev_err(&client->dev,
-                        "unable to register the class device\n");
                 goto exit_detach;
         }
 
@@ -260,8 +258,6 @@ static int rs5c372_detach(struct i2c_client *client)
         int err;
         struct rtc_device *rtc = i2c_get_clientdata(client);
 
-        dev_dbg(&client->dev, "%s\n", __FUNCTION__);
-
         if (rtc)
                 rtc_device_unregister(rtc);
 
diff --git a/drivers/rtc/rtc-sa1100.c b/drivers/rtc/rtc-sa1100.c
index 83b2bb480a16..a23ec54989f6 100644
--- a/drivers/rtc/rtc-sa1100.c
+++ b/drivers/rtc/rtc-sa1100.c
@@ -160,19 +160,19 @@ static int sa1100_rtc_open(struct device *dev)
         ret = request_irq(IRQ_RTC1Hz, sa1100_rtc_interrupt, SA_INTERRUPT,
                                 "rtc 1Hz", dev);
         if (ret) {
-                printk(KERN_ERR "rtc: IRQ%d already in use.\n", IRQ_RTC1Hz);
+                dev_err(dev, "IRQ %d already in use.\n", IRQ_RTC1Hz);
                 goto fail_ui;
         }
         ret = request_irq(IRQ_RTCAlrm, sa1100_rtc_interrupt, SA_INTERRUPT,
                                 "rtc Alrm", dev);
         if (ret) {
-                printk(KERN_ERR "rtc: IRQ%d already in use.\n", IRQ_RTCAlrm);
+                dev_err(dev, "IRQ %d already in use.\n", IRQ_RTCAlrm);
                 goto fail_ai;
         }
         ret = request_irq(IRQ_OST1, timer1_interrupt, SA_INTERRUPT,
                                 "rtc timer", dev);
         if (ret) {
-                printk(KERN_ERR "rtc: IRQ%d already in use.\n", IRQ_OST1);
+                dev_err(dev, "IRQ %d already in use.\n", IRQ_OST1);
                 goto fail_pi;
         }
         return 0;
@@ -332,7 +332,7 @@ static int sa1100_rtc_probe(struct platform_device *pdev)
          */
         if (RTTR == 0) {
                 RTTR = RTC_DEF_DIVIDER + (RTC_DEF_TRIM << 16);
-                printk(KERN_WARNING "rtc: warning: initializing default clock divider/trim value\n");
+                dev_warn(&pdev->dev, "warning: initializing default clock divider/trim value\n");
                 /* The current RTC value probably doesn't make sense either */
                 RCNR = 0;
         }
@@ -340,15 +340,11 @@ static int sa1100_rtc_probe(struct platform_device *pdev)
         rtc = rtc_device_register(pdev->name, &pdev->dev, &sa1100_rtc_ops,
                                 THIS_MODULE);
 
-        if (IS_ERR(rtc)) {
-                dev_err(&pdev->dev, "Unable to register the RTC device\n");
+        if (IS_ERR(rtc))
                 return PTR_ERR(rtc);
-        }
 
         platform_set_drvdata(pdev, rtc);
 
-        dev_info(&pdev->dev, "SA11xx/PXA2xx RTC Registered\n");
-
         return 0;
 }
 
diff --git a/drivers/rtc/rtc-test.c b/drivers/rtc/rtc-test.c
index 43d107487820..e1f7e8e86daf 100644
--- a/drivers/rtc/rtc-test.c
+++ b/drivers/rtc/rtc-test.c
@@ -49,7 +49,6 @@ static int test_rtc_proc(struct device *dev, struct seq_file *seq)
 {
         struct platform_device *plat_dev = to_platform_device(dev);
 
-        seq_printf(seq, "24hr\t\t: yes\n");
         seq_printf(seq, "test\t\t: yes\n");
         seq_printf(seq, "id\t\t: %d\n", plat_dev->id);
 
@@ -120,8 +119,6 @@ static int test_probe(struct platform_device *plat_dev)
                                                 &test_rtc_ops, THIS_MODULE);
         if (IS_ERR(rtc)) {
                 err = PTR_ERR(rtc);
-                dev_err(&plat_dev->dev,
-                        "unable to register the class device\n");
                 return err;
         }
         device_create_file(&plat_dev->dev, &dev_attr_irq);
diff --git a/drivers/char/vr41xx_rtc.c b/drivers/rtc/rtc-vr41xx.c
index b109d9a502d6..4d49fd501198 100644
--- a/drivers/char/vr41xx_rtc.c
+++ b/drivers/rtc/rtc-vr41xx.c
@@ -1,7 +1,7 @@
 /*
- *  Driver for NEC VR4100 series  Real Time Clock unit.
+ *  Driver for NEC VR4100 series Real Time Clock unit.
  *
- *  Copyright (C) 2003-2005  Yoichi Yuasa <yoichi_yuasa@tripeaks.co.jp>
+ *  Copyright (C) 2003-2006  Yoichi Yuasa <yoichi_yuasa@tripeaks.co.jp>
  *
  *  This program is free software; you can redistribute it and/or modify
  *  it under the terms of the GNU General Public License as published by
@@ -17,23 +17,18 @@
  *  along with this program; if not, write to the Free Software
  *  Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
  */
-#include <linux/platform_device.h>
 #include <linux/fs.h>
 #include <linux/init.h>
 #include <linux/ioport.h>
 #include <linux/irq.h>
-#include <linux/mc146818rtc.h>
-#include <linux/miscdevice.h>
 #include <linux/module.h>
-#include <linux/poll.h>
+#include <linux/platform_device.h>
 #include <linux/rtc.h>
 #include <linux/spinlock.h>
 #include <linux/types.h>
-#include <linux/wait.h>
 
 #include <asm/div64.h>
 #include <asm/io.h>
-#include <asm/time.h>
 #include <asm/uaccess.h>
 #include <asm/vr41xx/vr41xx.h>
 
@@ -99,27 +94,11 @@ static void __iomem *rtc2_base;
 
 static unsigned long epoch = 1970;      /* Jan 1 1970 00:00:00 */
 
-static spinlock_t rtc_task_lock;
-static wait_queue_head_t rtc_wait;
-static unsigned long rtc_irq_data;
-static struct fasync_struct *rtc_async_queue;
-static rtc_task_t *rtc_callback;
+static spinlock_t rtc_lock = SPIN_LOCK_UNLOCKED;
 static char rtc_name[] = "RTC";
 static unsigned long periodic_frequency;
 static unsigned long periodic_count;
 
-typedef enum {
-        RTC_RELEASE,
-        RTC_OPEN,
-} rtc_status_t;
-
-static rtc_status_t rtc_status;
-
-typedef enum {
-        FUNCTION_RTC_IOCTL,
-        FUNCTION_RTC_CONTROL,
-} rtc_callfrom_t;
-
 struct resource rtc_resource[2] = {
         {       .name   = rtc_name,
                 .flags  = IORESOURCE_MEM,       },
@@ -129,7 +108,9 @@ struct resource rtc_resource[2] = {
 
 static inline unsigned long read_elapsed_second(void)
 {
+
         unsigned long first_low, first_mid, first_high;
+
         unsigned long second_low, second_mid, second_high;
 
         do {
@@ -156,50 +137,36 @@ static inline void write_elapsed_second(unsigned long sec)
         spin_unlock_irq(&rtc_lock);
 }
 
-static void set_alarm(struct rtc_time *time)
+static void vr41xx_rtc_release(struct device *dev)
 {
-        unsigned long alarm_sec;
-
-        alarm_sec = mktime(time->tm_year + 1900, time->tm_mon + 1, time->tm_mday,
-                           time->tm_hour, time->tm_min, time->tm_sec);
-
-        spin_lock_irq(&rtc_lock);
-
-        rtc1_write(ECMPLREG, (uint16_t)(alarm_sec << 15));
-        rtc1_write(ECMPMREG, (uint16_t)(alarm_sec >> 1));
-        rtc1_write(ECMPHREG, (uint16_t)(alarm_sec >> 17));
-
-        spin_unlock_irq(&rtc_lock);
-}
-
-static void read_alarm(struct rtc_time *time)
-{
-        unsigned long low, mid, high;
 
         spin_lock_irq(&rtc_lock);
 
-        low = rtc1_read(ECMPLREG);
-        mid = rtc1_read(ECMPMREG);
-        high = rtc1_read(ECMPHREG);
+        rtc1_write(ECMPLREG, 0);
+        rtc1_write(ECMPMREG, 0);
+        rtc1_write(ECMPHREG, 0);
+        rtc1_write(RTCL1LREG, 0);
+        rtc1_write(RTCL1HREG, 0);
 
         spin_unlock_irq(&rtc_lock);
 
-        to_tm((high << 17) | (mid << 1) | (low >> 15), time);
-        time->tm_year -= 1900;
+        disable_irq(ELAPSEDTIME_IRQ);
+        disable_irq(RTCLONG1_IRQ);
 }
 
-static void read_time(struct rtc_time *time)
+static int vr41xx_rtc_read_time(struct device *dev, struct rtc_time *time)
 {
         unsigned long epoch_sec, elapsed_sec;
 
         epoch_sec = mktime(epoch, 1, 1, 0, 0, 0);
         elapsed_sec = read_elapsed_second();
 
-        to_tm(epoch_sec + elapsed_sec, time);
-        time->tm_year -= 1900;
+        rtc_time_to_tm(epoch_sec + elapsed_sec, time);
+
+        return 0;
 }
 
-static void set_time(struct rtc_time *time)
+static int vr41xx_rtc_set_time(struct device *dev, struct rtc_time *time)
 {
         unsigned long epoch_sec, current_sec;
 
@@ -208,73 +175,49 @@ static void set_time(struct rtc_time *time)
                              time->tm_hour, time->tm_min, time->tm_sec);
 
         write_elapsed_second(current_sec - epoch_sec);
+
+        return 0;
 }
 
-static ssize_t rtc_read(struct file *file, char __user *buf, size_t count, loff_t *ppos)
+static int vr41xx_rtc_read_alarm(struct device *dev, struct rtc_wkalrm *wkalrm)
 {
-        DECLARE_WAITQUEUE(wait, current);
-        unsigned long irq_data;
-        int retval = 0;
-
-        if (count != sizeof(unsigned int) && count != sizeof(unsigned long))
-                return -EINVAL;
-
-        add_wait_queue(&rtc_wait, &wait);
-
-        do {
-                __set_current_state(TASK_INTERRUPTIBLE);
+        unsigned long low, mid, high;
+        struct rtc_time *time = &wkalrm->time;
 
-                spin_lock_irq(&rtc_lock);
-                irq_data = rtc_irq_data;
-                rtc_irq_data = 0;
-                spin_unlock_irq(&rtc_lock);
+        spin_lock_irq(&rtc_lock);
 
-                if (irq_data != 0)
-                        break;
+        low = rtc1_read(ECMPLREG);
+        mid = rtc1_read(ECMPMREG);
+        high = rtc1_read(ECMPHREG);
 
-                if (file->f_flags & O_NONBLOCK) {
-                        retval = -EAGAIN;
-                        break;
-                }
+        spin_unlock_irq(&rtc_lock);
 
-                if (signal_pending(current)) {
-                        retval = -ERESTARTSYS;
-                        break;
-                }
-        } while (1);
+        rtc_time_to_tm((high << 17) | (mid << 1) | (low >> 15), time);
 
-        if (retval == 0) {
-                if (count == sizeof(unsigned int)) {
-                        retval = put_user(irq_data, (unsigned int __user *)buf);
-                        if (retval == 0)
-                                retval = sizeof(unsigned int);
-                } else {
-                        retval = put_user(irq_data, (unsigned long __user *)buf);
-                        if (retval == 0)
-                                retval = sizeof(unsigned long);
-                }
+        return 0;
+}
 
-        }
+static int vr41xx_rtc_set_alarm(struct device *dev, struct rtc_wkalrm *wkalrm)
+{
+        unsigned long alarm_sec;
+        struct rtc_time *time = &wkalrm->time;
 
-        __set_current_state(TASK_RUNNING);
-        remove_wait_queue(&rtc_wait, &wait);
+        alarm_sec = mktime(time->tm_year + 1900, time->tm_mon + 1, time->tm_mday,
+                           time->tm_hour, time->tm_min, time->tm_sec);
 
-        return retval;
-}
+        spin_lock_irq(&rtc_lock);
 
-static unsigned int rtc_poll(struct file *file, struct poll_table_struct *table)
-{
-        poll_wait(file, &rtc_wait, table);
+        rtc1_write(ECMPLREG, (uint16_t)(alarm_sec << 15));
+        rtc1_write(ECMPMREG, (uint16_t)(alarm_sec >> 1));
+        rtc1_write(ECMPHREG, (uint16_t)(alarm_sec >> 17));
 
-        if (rtc_irq_data != 0)
-                return POLLIN | POLLRDNORM;
+        spin_unlock_irq(&rtc_lock);
 
         return 0;
 }
 
-static int rtc_do_ioctl(unsigned int cmd, unsigned long arg, rtc_callfrom_t from)
+static int vr41xx_rtc_ioctl(struct device *dev, unsigned int cmd, unsigned long arg)
 {
-        struct rtc_time time;
         unsigned long count;
 
         switch (cmd) {
@@ -290,33 +233,6 @@ static int rtc_do_ioctl(unsigned int cmd, unsigned long arg, rtc_callfrom_t from
         case RTC_PIE_OFF:
                 disable_irq(RTCLONG1_IRQ);
                 break;
-        case RTC_ALM_SET:
-                if (copy_from_user(&time, (struct rtc_time __user *)arg,
-                                   sizeof(struct rtc_time)))
-                        return -EFAULT;
-
-                set_alarm(&time);
-                break;
-        case RTC_ALM_READ:
-                memset(&time, 0, sizeof(struct rtc_time));
-                read_alarm(&time);
-                break;
-        case RTC_RD_TIME:
-                memset(&time, 0, sizeof(struct rtc_time));
-                read_time(&time);
-                if (copy_to_user((void __user *)arg, &time, sizeof(struct rtc_time)))
-                        return -EFAULT;
-                break;
-        case RTC_SET_TIME:
-                if (capable(CAP_SYS_TIME) == 0)
-                        return -EACCES;
-
-                if (copy_from_user(&time, (struct rtc_time __user *)arg,
-                                   sizeof(struct rtc_time)))
-                        return -EFAULT;
-
-                set_time(&time);
-                break;
         case RTC_IRQP_READ:
                 return put_user(periodic_frequency, (unsigned long __user *)arg);
                 break;
@@ -324,8 +240,7 @@ static int rtc_do_ioctl(unsigned int cmd, unsigned long arg, rtc_callfrom_t from
                 if (arg > MAX_PERIODIC_RATE)
                         return -EINVAL;
 
-                if (from == FUNCTION_RTC_IOCTL && arg > MAX_USER_PERIODIC_RATE &&
-                    capable(CAP_SYS_RESOURCE) == 0)
+                if (arg > MAX_USER_PERIODIC_RATE && capable(CAP_SYS_RESOURCE) == 0)
                         return -EACCES;
 
                 periodic_frequency = arg;
@@ -361,205 +276,46 @@ static int rtc_do_ioctl(unsigned int cmd, unsigned long arg, rtc_callfrom_t from
         return 0;
 }
 
-static int rtc_ioctl(struct inode *inode, struct file *file, unsigned int cmd,
-                     unsigned long arg)
-{
-        return rtc_do_ioctl(cmd, arg, FUNCTION_RTC_IOCTL);
-}
-
-static int rtc_open(struct inode *inode, struct file *file)
-{
-        spin_lock_irq(&rtc_lock);
-
-        if (rtc_status == RTC_OPEN) {
-                spin_unlock_irq(&rtc_lock);
-                return -EBUSY;
-        }
-
-        rtc_status = RTC_OPEN;
-        rtc_irq_data = 0;
-
-        spin_unlock_irq(&rtc_lock);
-
-        return 0;
-}
-
-static int rtc_release(struct inode *inode, struct file *file)
-{
-        if (file->f_flags & FASYNC)
-                (void)fasync_helper(-1, file, 0, &rtc_async_queue);
-
-        spin_lock_irq(&rtc_lock);
-
-        rtc1_write(ECMPLREG, 0);
-        rtc1_write(ECMPMREG, 0);
-        rtc1_write(ECMPHREG, 0);
-        rtc1_write(RTCL1LREG, 0);
-        rtc1_write(RTCL1HREG, 0);
-
-        rtc_status = RTC_RELEASE;
-
-        spin_unlock_irq(&rtc_lock);
-
-        disable_irq(ELAPSEDTIME_IRQ);
-        disable_irq(RTCLONG1_IRQ);
-
-        return 0;
-}
-
-static int rtc_fasync(int fd, struct file *file, int on)
-{
-        return fasync_helper(fd, file, on, &rtc_async_queue);
-}
-
-static struct file_operations rtc_fops = {
-        .owner          = THIS_MODULE,
-        .llseek         = no_llseek,
-        .read           = rtc_read,
-        .poll           = rtc_poll,
-        .ioctl          = rtc_ioctl,
-        .open           = rtc_open,
-        .release        = rtc_release,
-        .fasync         = rtc_fasync,
-};
-
 static irqreturn_t elapsedtime_interrupt(int irq, void *dev_id, struct pt_regs *regs)
 {
-        spin_lock(&rtc_lock);
-        rtc2_write(RTCINTREG, ELAPSEDTIME_INT);
-
-        rtc_irq_data += 0x100;
-        rtc_irq_data &= ~0xff;
-        rtc_irq_data |= RTC_AF;
-        spin_unlock(&rtc_lock);
+        struct platform_device *pdev = (struct platform_device *)dev_id;
+        struct rtc_device *rtc = platform_get_drvdata(pdev);
 
-        spin_lock(&rtc_lock);
-        if (rtc_callback)
-                rtc_callback->func(rtc_callback->private_data);
-        spin_unlock(&rtc_lock);
-
-        wake_up_interruptible(&rtc_wait);
+        rtc2_write(RTCINTREG, ELAPSEDTIME_INT);
 
-        kill_fasync(&rtc_async_queue, SIGIO, POLL_IN);
+        rtc_update_irq(&rtc->class_dev, 1, RTC_AF);
 
         return IRQ_HANDLED;
 }
 
 static irqreturn_t rtclong1_interrupt(int irq, void *dev_id, struct pt_regs *regs)
 {
+        struct platform_device *pdev = (struct platform_device *)dev_id;
+        struct rtc_device *rtc = platform_get_drvdata(pdev);
         unsigned long count = periodic_count;
 
-        spin_lock(&rtc_lock);
         rtc2_write(RTCINTREG, RTCLONG1_INT);
 
         rtc1_write(RTCL1LREG, count);
         rtc1_write(RTCL1HREG, count >> 16);
 
-        rtc_irq_data += 0x100;
-        rtc_irq_data &= ~0xff;
-        rtc_irq_data |= RTC_PF;
-        spin_unlock(&rtc_lock);
-
-        spin_lock(&rtc_task_lock);
-        if (rtc_callback)
-                rtc_callback->func(rtc_callback->private_data);
-        spin_unlock(&rtc_task_lock);
-
-        wake_up_interruptible(&rtc_wait);
-
-        kill_fasync(&rtc_async_queue, SIGIO, POLL_IN);
+        rtc_update_irq(&rtc->class_dev, 1, RTC_PF);
 
         return IRQ_HANDLED;
 }
 
-int rtc_register(rtc_task_t *task)
-{
-        if (task == NULL || task->func == NULL)
-                return -EINVAL;
-
-        spin_lock_irq(&rtc_lock);
-        if (rtc_status == RTC_OPEN) {
-                spin_unlock_irq(&rtc_lock);
-                return -EBUSY;
-        }
-
-        spin_lock(&rtc_task_lock);
-        if (rtc_callback != NULL) {
-                spin_unlock(&rtc_task_lock);
-                spin_unlock_irq(&rtc_task_lock);
-                return -EBUSY;
-        }
-
-        rtc_callback = task;
-        spin_unlock(&rtc_task_lock);
-
-        rtc_status = RTC_OPEN;
-
-        spin_unlock_irq(&rtc_lock);
-
-        return 0;
-}
-
-EXPORT_SYMBOL_GPL(rtc_register);
-
-int rtc_unregister(rtc_task_t *task)
-{
-        spin_lock_irq(&rtc_task_lock);
-        if (task == NULL || rtc_callback != task) {
-                spin_unlock_irq(&rtc_task_lock);
-                return -ENXIO;
-        }
-
-        spin_lock(&rtc_lock);
-
-        rtc1_write(ECMPLREG, 0);
-        rtc1_write(ECMPMREG, 0);
-        rtc1_write(ECMPHREG, 0);
-        rtc1_write(RTCL1LREG, 0);
-        rtc1_write(RTCL1HREG, 0);
-
-        rtc_status = RTC_RELEASE;
-
-        spin_unlock(&rtc_lock);
-
-        rtc_callback = NULL;
-
-        spin_unlock_irq(&rtc_task_lock);
-
-        disable_irq(ELAPSEDTIME_IRQ);
-        disable_irq(RTCLONG1_IRQ);
-
-        return 0;
-}
-
-EXPORT_SYMBOL_GPL(rtc_unregister);
-
-int rtc_control(rtc_task_t *task, unsigned int cmd, unsigned long arg)
-{
-        int retval = 0;
-
-        spin_lock_irq(&rtc_task_lock);
-
-        if (rtc_callback != task)
-                retval = -ENXIO;
-        else
-                rtc_do_ioctl(cmd, arg, FUNCTION_RTC_CONTROL);
-
-        spin_unlock_irq(&rtc_task_lock);
-
-        return retval;
-}
-
-EXPORT_SYMBOL_GPL(rtc_control);
-
-static struct miscdevice rtc_miscdevice = {
-        .minor  = RTC_MINOR,
-        .name   = rtc_name,
-        .fops   = &rtc_fops,
+static struct rtc_class_ops vr41xx_rtc_ops = {
+        .release        = vr41xx_rtc_release,
+        .ioctl          = vr41xx_rtc_ioctl,
+        .read_time      = vr41xx_rtc_read_time,
+        .set_time       = vr41xx_rtc_set_time,
+        .read_alarm     = vr41xx_rtc_read_alarm,
+        .set_alarm      = vr41xx_rtc_set_alarm,
 };
 
 static int __devinit rtc_probe(struct platform_device *pdev)
 {
+        struct rtc_device *rtc;
         unsigned int irq;
         int retval;
 
@@ -577,13 +333,13 @@ static int __devinit rtc_probe(struct platform_device *pdev)
                 return -EBUSY;
         }
 
-        retval = misc_register(&rtc_miscdevice);
-        if (retval < 0) {
+        rtc = rtc_device_register(rtc_name, &pdev->dev, &vr41xx_rtc_ops, THIS_MODULE);
+        if (IS_ERR(rtc)) {
                 iounmap(rtc1_base);
                 iounmap(rtc2_base);
                 rtc1_base = NULL;
                 rtc2_base = NULL;
-                return retval;
+                return PTR_ERR(rtc);
         }
 
         spin_lock_irq(&rtc_lock);
@@ -594,24 +350,20 @@ static int __devinit rtc_probe(struct platform_device *pdev)
         rtc1_write(RTCL1LREG, 0);
         rtc1_write(RTCL1HREG, 0);
 
-        rtc_status = RTC_RELEASE;
-        rtc_irq_data = 0;
-
         spin_unlock_irq(&rtc_lock);
 
-        init_waitqueue_head(&rtc_wait);
-
         irq = ELAPSEDTIME_IRQ;
         retval = request_irq(irq, elapsedtime_interrupt, SA_INTERRUPT,
-                             "elapsed_time", NULL);
+                             "elapsed_time", pdev);
         if (retval == 0) {
                 irq = RTCLONG1_IRQ;
                 retval = request_irq(irq, rtclong1_interrupt, SA_INTERRUPT,
-                                     "rtclong1", NULL);
+                                     "rtclong1", pdev);
         }
 
         if (retval < 0) {
                 printk(KERN_ERR "rtc: IRQ%d is busy\n", irq);
+                rtc_device_unregister(rtc);
                 if (irq == RTCLONG1_IRQ)
                         free_irq(ELAPSEDTIME_IRQ, NULL);
                 iounmap(rtc1_base);
@@ -621,23 +373,25 @@ static int __devinit rtc_probe(struct platform_device *pdev)
                 return retval;
         }
 
+        platform_set_drvdata(pdev, rtc);
+
         disable_irq(ELAPSEDTIME_IRQ);
         disable_irq(RTCLONG1_IRQ);
 
-        spin_lock_init(&rtc_task_lock);
-
         printk(KERN_INFO "rtc: Real Time Clock of NEC VR4100 series\n");
 
         return 0;
 }
 
-static int __devexit rtc_remove(struct platform_device *dev)
+static int __devexit rtc_remove(struct platform_device *pdev)
 {
-        int retval;
+        struct rtc_device *rtc;
 
-        retval = misc_deregister(&rtc_miscdevice);
-        if (retval < 0)
-                return retval;
+        rtc = platform_get_drvdata(pdev);
+        if (rtc != NULL)
+                rtc_device_unregister(rtc);
+
+        platform_set_drvdata(pdev, NULL);
 
         free_irq(ELAPSEDTIME_IRQ, NULL);
         free_irq(RTCLONG1_IRQ, NULL);
@@ -651,7 +405,7 @@ static int __devexit rtc_remove(struct platform_device *dev)
 
 static struct platform_device *rtc_platform_device;
 
-static struct platform_driver rtc_device_driver = {
+static struct platform_driver rtc_platform_driver = {
         .probe          = rtc_probe,
         .remove         = __devexit_p(rtc_remove),
         .driver         = {
@@ -686,7 +440,7 @@ static int __init vr41xx_rtc_init(void)
         }
 
         rtc_platform_device = platform_device_alloc("RTC", -1);
-        if (!rtc_platform_device)
+        if (rtc_platform_device == NULL)
                 return -ENOMEM;
 
         retval = platform_device_add_resources(rtc_platform_device,
@@ -700,7 +454,7 @@ static int __init vr41xx_rtc_init(void)
                 return retval;
         }
 
-        retval = platform_driver_register(&rtc_device_driver);
+        retval = platform_driver_register(&rtc_platform_driver);
         if (retval < 0)
                 platform_device_unregister(rtc_platform_device);
 
@@ -709,7 +463,7 @@ static int __init vr41xx_rtc_init(void)
 
 static void __exit vr41xx_rtc_exit(void)
 {
-        platform_driver_unregister(&rtc_device_driver);
+        platform_driver_unregister(&rtc_platform_driver);
         platform_device_unregister(rtc_platform_device);
 }
 
diff --git a/drivers/rtc/rtc-x1205.c b/drivers/rtc/rtc-x1205.c
index 621d17afc0d9..788b6d1f8f2f 100644
--- a/drivers/rtc/rtc-x1205.c
+++ b/drivers/rtc/rtc-x1205.c
@@ -19,7 +19,7 @@
 #include <linux/rtc.h>
 #include <linux/delay.h>
 
-#define DRV_VERSION "1.0.6"
+#define DRV_VERSION "1.0.7"
 
 /* Addresses to scan: none. This chip is located at
  * 0x6f and uses a two bytes register addressing.
@@ -451,8 +451,6 @@ static int x1205_rtc_proc(struct device *dev, struct seq_file *seq)
 {
         int err, dtrim, atrim;
 
-        seq_printf(seq, "24hr\t\t: yes\n");
-
         if ((err = x1205_get_dtrim(to_i2c_client(dev), &dtrim)) == 0)
                 seq_printf(seq, "digital_trim\t: %d ppm\n", dtrim);
 
@@ -473,30 +471,31 @@ static struct rtc_class_ops x1205_rtc_ops = {
 static ssize_t x1205_sysfs_show_atrim(struct device *dev,
                                 struct device_attribute *attr, char *buf)
 {
-        int atrim;
+        int err, atrim;
 
-        if (x1205_get_atrim(to_i2c_client(dev), &atrim) == 0)
-                return sprintf(buf, "%d.%02d pF\n",
-                        atrim / 1000, atrim % 1000);
-        return 0;
+        err = x1205_get_atrim(to_i2c_client(dev), &atrim);
+        if (err)
+                return err;
+
+        return sprintf(buf, "%d.%02d pF\n", atrim / 1000, atrim % 1000);
 }
 static DEVICE_ATTR(atrim, S_IRUGO, x1205_sysfs_show_atrim, NULL);
 
 static ssize_t x1205_sysfs_show_dtrim(struct device *dev,
                                 struct device_attribute *attr, char *buf)
 {
-        int dtrim;
+        int err, dtrim;
 
-        if (x1205_get_dtrim(to_i2c_client(dev), &dtrim) == 0)
-                return sprintf(buf, "%d ppm\n", dtrim);
+        err = x1205_get_dtrim(to_i2c_client(dev), &dtrim);
+        if (err)
+                return err;
 
-        return 0;
+        return sprintf(buf, "%d ppm\n", dtrim);
 }
 static DEVICE_ATTR(dtrim, S_IRUGO, x1205_sysfs_show_dtrim, NULL);
 
 static int x1205_attach(struct i2c_adapter *adapter)
 {
-        dev_dbg(&adapter->dev, "%s\n", __FUNCTION__);
         return i2c_probe(adapter, &addr_data, x1205_probe);
 }
 
@@ -545,8 +544,6 @@ static int x1205_probe(struct i2c_adapter *adapter, int address, int kind)
 
         if (IS_ERR(rtc)) {
                 err = PTR_ERR(rtc);
-                dev_err(&client->dev,
-                        "unable to register the class device\n");
                 goto exit_detach;
         }
 
@@ -585,8 +582,6 @@ static int x1205_detach(struct i2c_client *client)
         int err;
         struct rtc_device *rtc = i2c_get_clientdata(client);
 
-        dev_dbg(&client->dev, "%s\n", __FUNCTION__);
-
         if (rtc)
                 rtc_device_unregister(rtc);
 
diff --git a/drivers/s390/block/dasd.c b/drivers/s390/block/dasd.c
index 0a9f12c4e911..a3bfebcf31ef 100644
--- a/drivers/s390/block/dasd.c
+++ b/drivers/s390/block/dasd.c
@@ -1257,25 +1257,28 @@ __dasd_start_head(struct dasd_device * device)
         if (list_empty(&device->ccw_queue))
                 return;
         cqr = list_entry(device->ccw_queue.next, struct dasd_ccw_req, list);
-        /* check FAILFAST */
+        if (cqr->status != DASD_CQR_QUEUED)
+                return;
+        /* Non-temporary stop condition will trigger fail fast */
         if (device->stopped & ~DASD_STOPPED_PENDING &&
             test_bit(DASD_CQR_FLAGS_FAILFAST, &cqr->flags) &&
             (!dasd_eer_enabled(device))) {
                 cqr->status = DASD_CQR_FAILED;
                 dasd_schedule_bh(device);
+                return;
         }
-        if ((cqr->status == DASD_CQR_QUEUED) &&
-            (!device->stopped)) {
-                /* try to start the first I/O that can be started */
-                rc = device->discipline->start_IO(cqr);
-                if (rc == 0)
-                        dasd_set_timer(device, cqr->expires);
-                else if (rc == -EACCES) {
-                        dasd_schedule_bh(device);
-                } else
-                        /* Hmpf, try again in 1/2 sec */
-                        dasd_set_timer(device, 50);
-        }
+        /* Don't try to start requests if device is stopped */
+        if (device->stopped)
+                return;
+
+        rc = device->discipline->start_IO(cqr);
+        if (rc == 0)
+                dasd_set_timer(device, cqr->expires);
+        else if (rc == -EACCES) {
+                dasd_schedule_bh(device);
+        } else
+                /* Hmpf, try again in 1/2 sec */
+                dasd_set_timer(device, 50);
 }
 
 /*
@@ -1968,7 +1971,7 @@ int
 dasd_generic_set_offline (struct ccw_device *cdev)
 {
         struct dasd_device *device;
-        int max_count;
+        int max_count, open_count;
 
         device = dasd_device_from_cdev(cdev);
         if (IS_ERR(device))
@@ -1985,10 +1988,16 @@ dasd_generic_set_offline (struct ccw_device *cdev)
          * in the other openers.
          */
         max_count = device->bdev ? 0 : -1;
-        if (atomic_read(&device->open_count) > max_count) {
-                printk (KERN_WARNING "Can't offline dasd device with open"
-                        " count = %i.\n",
-                        atomic_read(&device->open_count));
+        open_count = (int) atomic_read(&device->open_count);
+        if (open_count > max_count) {
+                if (open_count > 0)
+                        printk (KERN_WARNING "Can't offline dasd device with "
+                                "open count = %i.\n",
+                                open_count);
+                else
+                        printk (KERN_WARNING "%s",
+                                "Can't offline dasd device due to internal "
+                                "use\n");
                 clear_bit(DASD_FLAG_OFFLINE, &device->flags);
                 dasd_put_device(device);
                 return -EBUSY;
diff --git a/drivers/s390/block/dasd_erp.c b/drivers/s390/block/dasd_erp.c
index 8fd71ab02ef0..b842377cb0c6 100644
--- a/drivers/s390/block/dasd_erp.c
+++ b/drivers/s390/block/dasd_erp.c
@@ -32,9 +32,8 @@ dasd_alloc_erp_request(char *magic, int cplength, int datasize,
         int size;
 
         /* Sanity checks */
-        if ( magic == NULL || datasize > PAGE_SIZE ||
-             (cplength*sizeof(struct ccw1)) > PAGE_SIZE)
-                BUG();
+        BUG_ON( magic == NULL || datasize > PAGE_SIZE ||
+             (cplength*sizeof(struct ccw1)) > PAGE_SIZE);
 
         size = (sizeof(struct dasd_ccw_req) + 7L) & -8L;
         if (cplength > 0)
@@ -125,8 +124,7 @@ dasd_default_erp_postaction(struct dasd_ccw_req * cqr)
         struct dasd_device *device;
         int success;
 
-        if (cqr->refers == NULL || cqr->function == NULL)
-                BUG();
+        BUG_ON(cqr->refers == NULL || cqr->function == NULL);
 
         device = cqr->device;
         success = cqr->status == DASD_CQR_DONE;
diff --git a/drivers/s390/block/dasd_proc.c b/drivers/s390/block/dasd_proc.c
index 1aa3c261718a..ad23aede356c 100644
--- a/drivers/s390/block/dasd_proc.c
+++ b/drivers/s390/block/dasd_proc.c
@@ -294,23 +294,40 @@ out_error:
 #endif                          /* CONFIG_DASD_PROFILE */
 }
 
+/*
+ * Create dasd proc-fs entries.
+ * In case creation failed, cleanup and return -ENOENT.
+ */
 int
 dasd_proc_init(void)
 {
         dasd_proc_root_entry = proc_mkdir("dasd", &proc_root);
+        if (!dasd_proc_root_entry)
+                goto out_nodasd;
         dasd_proc_root_entry->owner = THIS_MODULE;
         dasd_devices_entry = create_proc_entry("devices",
                                                S_IFREG | S_IRUGO | S_IWUSR,
                                                dasd_proc_root_entry);
+        if (!dasd_devices_entry)
+                goto out_nodevices;
         dasd_devices_entry->proc_fops = &dasd_devices_file_ops;
         dasd_devices_entry->owner = THIS_MODULE;
         dasd_statistics_entry = create_proc_entry("statistics",
                                                   S_IFREG | S_IRUGO | S_IWUSR,
                                                   dasd_proc_root_entry);
+        if (!dasd_statistics_entry)
+                goto out_nostatistics;
         dasd_statistics_entry->read_proc = dasd_statistics_read;
         dasd_statistics_entry->write_proc = dasd_statistics_write;
         dasd_statistics_entry->owner = THIS_MODULE;
         return 0;
+
+ out_nostatistics:
+        remove_proc_entry("devices", dasd_proc_root_entry);
+ out_nodevices:
+        remove_proc_entry("dasd", &proc_root);
+ out_nodasd:
+        return -ENOENT;
 }
 
 void
diff --git a/drivers/s390/char/keyboard.c b/drivers/s390/char/keyboard.c
index 6badd8403409..d4d2ff0a9da2 100644
--- a/drivers/s390/char/keyboard.c
+++ b/drivers/s390/char/keyboard.c
@@ -54,7 +54,7 @@ kbd_alloc(void) {
         if (!kbd)
                 goto out;
         kbd->key_maps = kzalloc(sizeof(key_maps), GFP_KERNEL);
-        if (!key_maps)
+        if (!kbd->key_maps)
                 goto out_kbd;
         for (i = 0; i < ARRAY_SIZE(key_maps); i++) {
                 if (key_maps[i]) {
diff --git a/drivers/s390/char/sclp_rw.c b/drivers/s390/char/sclp_rw.c
index ac10dfb20a62..91e93c78f57a 100644
--- a/drivers/s390/char/sclp_rw.c
+++ b/drivers/s390/char/sclp_rw.c
@@ -24,7 +24,7 @@
 
 /*
  * The room for the SCCB (only for writing) is not equal to a pages size
- * (as it is specified as the maximum size in the the SCLP ducumentation)
+ * (as it is specified as the maximum size in the the SCLP documentation)
  * because of the additional data structure described above.
  */
 #define MAX_SCCB_ROOM (PAGE_SIZE - sizeof(struct sclp_buffer))
diff --git a/drivers/s390/char/tape_block.c b/drivers/s390/char/tape_block.c
index 5ced2725d6c7..b70d92690242 100644
--- a/drivers/s390/char/tape_block.c
+++ b/drivers/s390/char/tape_block.c
@@ -198,9 +198,7 @@ tapeblock_request_fn(request_queue_t *queue)
 
         device = (struct tape_device *) queue->queuedata;
         DBF_LH(6, "tapeblock_request_fn(device=%p)\n", device);
-        if (device == NULL)
-                BUG();
-
+        BUG_ON(device == NULL);
         tapeblock_trigger_requeue(device);
 }
 
@@ -307,8 +305,7 @@ tapeblock_revalidate_disk(struct gendisk *disk)
         int                     rc;
 
         device = (struct tape_device *) disk->private_data;
-        if (!device)
-                BUG();
+        BUG_ON(!device);
 
         if (!device->blk_data.medium_changed)
                 return 0;
@@ -435,16 +432,14 @@ tapeblock_ioctl(
 ) {
         int rc;
         int minor;
-        struct gendisk *disk = inode->i_bdev->bd_disk;
-        struct tape_device *device = disk->private_data;
+        struct gendisk *disk;
+        struct tape_device *device;
 
         rc     = 0;
         disk   = inode->i_bdev->bd_disk;
-        if (!disk)
-                BUG();
+        BUG_ON(!disk);
         device = disk->private_data;
-        if (!device)
-                BUG();
+        BUG_ON(!device);
         minor  = iminor(inode);
 
         DBF_LH(6, "tapeblock_ioctl(0x%0x)\n", command);
diff --git a/drivers/s390/char/tape_core.c b/drivers/s390/char/tape_core.c
index 389ee2c0f443..e6e4086d3224 100644
--- a/drivers/s390/char/tape_core.c
+++ b/drivers/s390/char/tape_core.c
@@ -210,18 +210,14 @@ tape_state_set(struct tape_device *device, enum tape_state newstate)
                 return;
         }
         DBF_EVENT(4, "ts. dev:  %x\n", device->first_minor);
-        if (device->tape_state < TO_SIZE && device->tape_state >= 0)
-                str = tape_state_verbose[device->tape_state];
-        else
-                str = "UNKNOWN TS";
-        DBF_EVENT(4, "old ts:   %s\n", str);
-        if (device->tape_state < TO_SIZE && device->tape_state >=0 )
+        DBF_EVENT(4, "old ts:\t\n");
+        if (device->tape_state < TS_SIZE && device->tape_state >=0 )
                 str = tape_state_verbose[device->tape_state];
         else
                 str = "UNKNOWN TS";
         DBF_EVENT(4, "%s\n", str);
         DBF_EVENT(4, "new ts:\t\n");
-        if (newstate < TO_SIZE && newstate >= 0)
+        if (newstate < TS_SIZE && newstate >= 0)
                 str = tape_state_verbose[newstate];
         else
                 str = "UNKNOWN TS";
diff --git a/drivers/s390/cio/blacklist.c b/drivers/s390/cio/blacklist.c
index cb8e2e672b68..0960bef7b199 100644
--- a/drivers/s390/cio/blacklist.c
+++ b/drivers/s390/cio/blacklist.c
@@ -414,11 +414,11 @@ cio_ignore_proc_init (void)
         entry = create_proc_entry ("cio_ignore", S_IFREG | S_IRUGO | S_IWUSR,
                                    &proc_root);
         if (!entry)
-                return 0;
+                return -ENOENT;
 
         entry->proc_fops = &cio_ignore_proc_fops;
 
-        return 1;
+        return 0;
 }
 
 __initcall (cio_ignore_proc_init);
diff --git a/drivers/s390/cio/cio.c b/drivers/s390/cio/cio.c
index cbb86fa5f293..5b20d8c9c025 100644
--- a/drivers/s390/cio/cio.c
+++ b/drivers/s390/cio/cio.c
@@ -67,7 +67,7 @@ cio_debug_init (void)
                 goto out_unregister;
         debug_register_view (cio_debug_msg_id, &debug_sprintf_view);
         debug_set_level (cio_debug_msg_id, 2);
-        cio_debug_trace_id = debug_register ("cio_trace", 16, 4, 8);
+        cio_debug_trace_id = debug_register ("cio_trace", 16, 4, 16);
         if (!cio_debug_trace_id)
                 goto out_unregister;
         debug_register_view (cio_debug_trace_id, &debug_hex_ascii_view);
diff --git a/drivers/s390/cio/cio_debug.h b/drivers/s390/cio/cio_debug.h
index 6af8b27d366b..f88844adae1b 100644
--- a/drivers/s390/cio/cio_debug.h
+++ b/drivers/s390/cio/cio_debug.h
@@ -3,6 +3,11 @@
 
 #include <asm/debug.h>
 
+/* for use of debug feature */
+extern debug_info_t *cio_debug_msg_id;
+extern debug_info_t *cio_debug_trace_id;
+extern debug_info_t *cio_debug_crw_id;
+
 #define CIO_TRACE_EVENT(imp, txt) do { \
                 debug_text_event(cio_debug_trace_id, imp, txt); \
         } while (0)
@@ -15,18 +20,19 @@
                 debug_sprintf_event(cio_debug_crw_id, imp , ##args); \
         } while (0)
 
-#define CIO_HEX_EVENT(imp, args...) do { \
-                debug_event(cio_debug_trace_id, imp, ##args); \
-        } while (0)
+static inline void
+CIO_HEX_EVENT(int level, void *data, int length)
+{
+        while (length > 0) {
+                debug_event(cio_debug_trace_id, level, data, length);
+                length -= cio_debug_trace_id->buf_size;
+                data += cio_debug_trace_id->buf_size;
+        }
+}
 
 #define CIO_DEBUG(printk_level,event_level,msg...) ({ \
         if (cio_show_msg) printk(printk_level msg); \
         CIO_MSG_EVENT (event_level, msg); \
 })
 
-/* for use of debug feature */
-extern debug_info_t *cio_debug_msg_id;
-extern debug_info_t *cio_debug_trace_id;
-extern debug_info_t *cio_debug_crw_id;
-
 #endif
diff --git a/drivers/s390/net/lcs.c b/drivers/s390/net/lcs.c
index edcf05d5d568..5d6b7a57b02f 100644
--- a/drivers/s390/net/lcs.c
+++ b/drivers/s390/net/lcs.c
@@ -675,9 +675,8 @@ lcs_ready_buffer(struct lcs_channel *channel, struct lcs_buffer *buffer)
         int index, rc;
 
         LCS_DBF_TEXT(5, trace, "rdybuff");
-        if (buffer->state != BUF_STATE_LOCKED &&
-            buffer->state != BUF_STATE_PROCESSED)
-                BUG();
+        BUG_ON(buffer->state != BUF_STATE_LOCKED &&
+                buffer->state != BUF_STATE_PROCESSED);
         spin_lock_irqsave(get_ccwdev_lock(channel->ccwdev), flags);
         buffer->state = BUF_STATE_READY;
         index = buffer - channel->iob;
@@ -701,8 +700,7 @@ __lcs_processed_buffer(struct lcs_channel *channel, struct lcs_buffer *buffer)
         int index, prev, next;
 
         LCS_DBF_TEXT(5, trace, "prcsbuff");
-        if (buffer->state != BUF_STATE_READY)
-                BUG();
+        BUG_ON(buffer->state != BUF_STATE_READY);
         buffer->state = BUF_STATE_PROCESSED;
         index = buffer - channel->iob;
         prev = (index - 1) & (LCS_NUM_BUFFS - 1);
@@ -734,9 +732,8 @@ lcs_release_buffer(struct lcs_channel *channel, struct lcs_buffer *buffer)
         unsigned long flags;
 
         LCS_DBF_TEXT(5, trace, "relbuff");
-        if (buffer->state != BUF_STATE_LOCKED &&
-            buffer->state != BUF_STATE_PROCESSED)
-                BUG();
+        BUG_ON(buffer->state != BUF_STATE_LOCKED &&
+                buffer->state != BUF_STATE_PROCESSED);
         spin_lock_irqsave(get_ccwdev_lock(channel->ccwdev), flags);
         buffer->state = BUF_STATE_EMPTY;
         spin_unlock_irqrestore(get_ccwdev_lock(channel->ccwdev), flags);
diff --git a/drivers/scsi/3w-xxxx.c b/drivers/scsi/3w-xxxx.c
index 25f678d0780b..e8e41e6eb42a 100644
--- a/drivers/scsi/3w-xxxx.c
+++ b/drivers/scsi/3w-xxxx.c
@@ -1508,10 +1508,12 @@ static void tw_transfer_internal(TW_Device_Extension *tw_dev, int request_id,
         struct scsi_cmnd *cmd = tw_dev->srb[request_id];
         void *buf;
         unsigned int transfer_len;
+        unsigned long flags = 0;
 
         if (cmd->use_sg) {
                 struct scatterlist *sg =
                         (struct scatterlist *)cmd->request_buffer;
+                local_irq_save(flags);
                 buf = kmap_atomic(sg->page, KM_IRQ0) + sg->offset;
                 transfer_len = min(sg->length, len);
         } else {
@@ -1526,6 +1528,7 @@ static void tw_transfer_internal(TW_Device_Extension *tw_dev, int request_id,
 
                 sg = (struct scatterlist *)cmd->request_buffer;
                 kunmap_atomic(buf - sg->offset, KM_IRQ0);
+                local_irq_restore(flags);
         }
 }
 
diff --git a/drivers/scsi/ahci.c b/drivers/scsi/ahci.c
index 1bd82c4e52a0..b4f8fb1d628b 100644
--- a/drivers/scsi/ahci.c
+++ b/drivers/scsi/ahci.c
@@ -207,7 +207,6 @@ static struct scsi_host_template ahci_sht = {
         .name                   = DRV_NAME,
         .ioctl                  = ata_scsi_ioctl,
         .queuecommand           = ata_scsi_queuecmd,
-        .eh_strategy_handler    = ata_scsi_error,
         .can_queue              = ATA_DEF_QUEUE,
         .this_id                = ATA_SHT_THIS_ID,
         .sg_tablesize           = AHCI_MAX_SG,
diff --git a/drivers/scsi/aic7xxx/Kconfig.aic7xxx b/drivers/scsi/aic7xxx/Kconfig.aic7xxx
index 6c2c395554ff..5517da5855f0 100644
--- a/drivers/scsi/aic7xxx/Kconfig.aic7xxx
+++ b/drivers/scsi/aic7xxx/Kconfig.aic7xxx
@@ -86,7 +86,7 @@ config AIC7XXX_DEBUG_MASK
         default "0"
         help
         Bit mask of debug options that is only valid if the
-        CONFIG_AIC7XXX_DEBUG_ENBLE option is enabled.  The bits in this mask
+        CONFIG_AIC7XXX_DEBUG_ENABLE option is enabled.  The bits in this mask
         are defined in the drivers/scsi/aic7xxx/aic7xxx.h - search for the
         variable ahc_debug in that file to find them.
 
diff --git a/drivers/scsi/ata_piix.c b/drivers/scsi/ata_piix.c
index 24e71b555172..6dc88149f9f1 100644
--- a/drivers/scsi/ata_piix.c
+++ b/drivers/scsi/ata_piix.c
@@ -209,7 +209,6 @@ static struct scsi_host_template piix_sht = {
         .name                   = DRV_NAME,
         .ioctl                  = ata_scsi_ioctl,
         .queuecommand           = ata_scsi_queuecmd,
-        .eh_strategy_handler    = ata_scsi_error,
         .can_queue              = ATA_DEF_QUEUE,
         .this_id                = ATA_SHT_THIS_ID,
         .sg_tablesize           = LIBATA_MAX_PRD,
diff --git a/drivers/scsi/hosts.c b/drivers/scsi/hosts.c
index ef57f253031c..dfcb96f3e60c 100644
--- a/drivers/scsi/hosts.c
+++ b/drivers/scsi/hosts.c
@@ -294,18 +294,6 @@ struct Scsi_Host *scsi_host_alloc(struct scsi_host_template *sht, int privsize)
         if (sht->unchecked_isa_dma && privsize)
                 gfp_mask |= __GFP_DMA;
 
-        /* Check to see if this host has any error handling facilities */
-        if (!sht->eh_strategy_handler && !sht->eh_abort_handler &&
-            !sht->eh_device_reset_handler && !sht->eh_bus_reset_handler &&
-            !sht->eh_host_reset_handler) {
-                printk(KERN_ERR "ERROR: SCSI host `%s' has no error handling\n"
-                                "ERROR: This is not a safe way to run your "
-                                        "SCSI host\n"
-                                "ERROR: The error handling must be added to "
-                                "this driver\n", sht->proc_name);
-                dump_stack();
-        }
-
         shost = kzalloc(sizeof(struct Scsi_Host) + privsize, gfp_mask);
         if (!shost)
                 return NULL;
diff --git a/drivers/scsi/ibmvscsi/rpa_vscsi.c b/drivers/scsi/ibmvscsi/rpa_vscsi.c
index f47dd87c05e7..892e8ed63091 100644
--- a/drivers/scsi/ibmvscsi/rpa_vscsi.c
+++ b/drivers/scsi/ibmvscsi/rpa_vscsi.c
@@ -80,7 +80,7 @@ void ibmvscsi_release_crq_queue(struct crq_queue *queue,
         tasklet_kill(&hostdata->srp_task);
         do {
                 rc = plpar_hcall_norets(H_FREE_CRQ, vdev->unit_address);
-        } while ((rc == H_Busy) || (H_isLongBusy(rc)));
+        } while ((rc == H_BUSY) || (H_IS_LONG_BUSY(rc)));
         dma_unmap_single(hostdata->dev,
                          queue->msg_token,
                          queue->size * sizeof(*queue->msgs), DMA_BIDIRECTIONAL);
@@ -230,7 +230,7 @@ int ibmvscsi_init_crq_queue(struct crq_queue *queue,
         rc = plpar_hcall_norets(H_REG_CRQ,
                                 vdev->unit_address,
                                 queue->msg_token, PAGE_SIZE);
-        if (rc == H_Resource) 
+        if (rc == H_RESOURCE)
                 /* maybe kexecing and resource is busy. try a reset */
                 rc = ibmvscsi_reset_crq_queue(queue,
                                               hostdata);
@@ -269,7 +269,7 @@ int ibmvscsi_init_crq_queue(struct crq_queue *queue,
       req_irq_failed:
         do {
                 rc = plpar_hcall_norets(H_FREE_CRQ, vdev->unit_address);
-        } while ((rc == H_Busy) || (H_isLongBusy(rc)));
+        } while ((rc == H_BUSY) || (H_IS_LONG_BUSY(rc)));
       reg_crq_failed:
         dma_unmap_single(hostdata->dev,
                          queue->msg_token,
@@ -295,7 +295,7 @@ int ibmvscsi_reenable_crq_queue(struct crq_queue *queue,
         /* Re-enable the CRQ */
         do {
                 rc = plpar_hcall_norets(H_ENABLE_CRQ, vdev->unit_address);
-        } while ((rc == H_InProgress) || (rc == H_Busy) || (H_isLongBusy(rc)));
+        } while ((rc == H_IN_PROGRESS) || (rc == H_BUSY) || (H_IS_LONG_BUSY(rc)));
 
         if (rc)
                 printk(KERN_ERR "ibmvscsi: Error %d enabling adapter\n", rc);
@@ -317,7 +317,7 @@ int ibmvscsi_reset_crq_queue(struct crq_queue *queue,
         /* Close the CRQ */
         do {
                 rc = plpar_hcall_norets(H_FREE_CRQ, vdev->unit_address);
-        } while ((rc == H_Busy) || (H_isLongBusy(rc)));
+        } while ((rc == H_BUSY) || (H_IS_LONG_BUSY(rc)));
 
         /* Clean out the queue */
         memset(queue->msgs, 0x00, PAGE_SIZE);
diff --git a/drivers/scsi/libata-core.c b/drivers/scsi/libata-core.c
index e63c1ff1e102..bd147207f25d 100644
--- a/drivers/scsi/libata-core.c
+++ b/drivers/scsi/libata-core.c
@@ -4938,7 +4938,6 @@ EXPORT_SYMBOL_GPL(ata_busy_sleep);
 EXPORT_SYMBOL_GPL(ata_port_queue_task);
 EXPORT_SYMBOL_GPL(ata_scsi_ioctl);
 EXPORT_SYMBOL_GPL(ata_scsi_queuecmd);
-EXPORT_SYMBOL_GPL(ata_scsi_error);
 EXPORT_SYMBOL_GPL(ata_scsi_slave_config);
 EXPORT_SYMBOL_GPL(ata_scsi_release);
 EXPORT_SYMBOL_GPL(ata_host_intr);
diff --git a/drivers/scsi/libata-scsi.c b/drivers/scsi/libata-scsi.c
index 53f5b0d9161c..a0289ec3e283 100644
--- a/drivers/scsi/libata-scsi.c
+++ b/drivers/scsi/libata-scsi.c
@@ -53,6 +53,7 @@
 typedef unsigned int (*ata_xlat_func_t)(struct ata_queued_cmd *qc, const u8 *scsicmd);
 static struct ata_device *
 ata_scsi_find_dev(struct ata_port *ap, const struct scsi_device *scsidev);
+static void ata_scsi_error(struct Scsi_Host *host);
 enum scsi_eh_timer_return ata_scsi_timed_out(struct scsi_cmnd *cmd);
 
 #define RW_RECOVERY_MPAGE 0x1
@@ -99,6 +100,7 @@ static const u8 def_control_mpage[CONTROL_MPAGE_LEN] = {
  * It just needs the eh_timed_out hook.
  */
 struct scsi_transport_template ata_scsi_transport_template = {
+        .eh_strategy_handler    = ata_scsi_error,
         .eh_timed_out           = ata_scsi_timed_out,
 };
 
@@ -772,12 +774,9 @@ enum scsi_eh_timer_return ata_scsi_timed_out(struct scsi_cmnd *cmd)
  *
  *      LOCKING:
  *      Inherited from SCSI layer (none, can sleep)
- *
- *      RETURNS:
- *      Zero.
  */
 
-int ata_scsi_error(struct Scsi_Host *host)
+static void ata_scsi_error(struct Scsi_Host *host)
 {
         struct ata_port *ap;
         unsigned long flags;
@@ -805,7 +804,6 @@ int ata_scsi_error(struct Scsi_Host *host)
         spin_unlock_irqrestore(&ap->host_set->lock, flags);
 
         DPRINTK("EXIT\n");
-        return 0;
 }
 
 static void ata_eh_scsidone(struct scsi_cmnd *scmd)
diff --git a/drivers/scsi/libata.h b/drivers/scsi/libata.h
index 1c755b14521a..bac8cbae06fe 100644
--- a/drivers/scsi/libata.h
+++ b/drivers/scsi/libata.h
@@ -60,7 +60,6 @@ extern int ata_cmd_ioctl(struct scsi_device *scsidev, void __user *arg);
 extern struct scsi_transport_template ata_scsi_transport_template;
 
 extern void ata_scsi_scan_host(struct ata_port *ap);
-extern int ata_scsi_error(struct Scsi_Host *host);
 extern unsigned int ata_scsiop_inq_std(struct ata_scsi_args *args, u8 *rbuf,
                                unsigned int buflen);
 
diff --git a/drivers/scsi/pcmcia/aha152x_stub.c b/drivers/scsi/pcmcia/aha152x_stub.c
index 5609847e254a..ee449b29fc82 100644
--- a/drivers/scsi/pcmcia/aha152x_stub.c
+++ b/drivers/scsi/pcmcia/aha152x_stub.c
@@ -89,29 +89,29 @@ MODULE_LICENSE("Dual MPL/GPL");
 /*====================================================================*/
 
 typedef struct scsi_info_t {
-    dev_link_t          link;
+        struct pcmcia_device    *p_dev;
     dev_node_t          node;
     struct Scsi_Host    *host;
 } scsi_info_t;
 
-static void aha152x_release_cs(dev_link_t *link);
+static void aha152x_release_cs(struct pcmcia_device *link);
 static void aha152x_detach(struct pcmcia_device *p_dev);
-static void aha152x_config_cs(dev_link_t *link);
+static int aha152x_config_cs(struct pcmcia_device *link);
 
-static dev_link_t *dev_list;
+static struct pcmcia_device *dev_list;
 
-static int aha152x_attach(struct pcmcia_device *p_dev)
+static int aha152x_probe(struct pcmcia_device *link)
 {
     scsi_info_t *info;
-    dev_link_t *link;
-    
+
     DEBUG(0, "aha152x_attach()\n");
 
     /* Create new SCSI device */
     info = kmalloc(sizeof(*info), GFP_KERNEL);
     if (!info) return -ENOMEM;
     memset(info, 0, sizeof(*info));
-    link = &info->link; link->priv = info;
+    info->p_dev = link;
+    link->priv = info;
 
     link->io.NumPorts1 = 0x20;
     link->io.Attributes1 = IO_DATA_PATH_WIDTH_AUTO;
@@ -119,41 +119,22 @@ static int aha152x_attach(struct pcmcia_device *p_dev)
     link->irq.Attributes = IRQ_TYPE_EXCLUSIVE;
     link->irq.IRQInfo1 = IRQ_LEVEL_ID;
     link->conf.Attributes = CONF_ENABLE_IRQ;
-    link->conf.Vcc = 50;
     link->conf.IntType = INT_MEMORY_AND_IO;
     link->conf.Present = PRESENT_OPTION;
 
-    link->handle = p_dev;
-    p_dev->instance = link;
-
-    link->state |= DEV_PRESENT | DEV_CONFIG_PENDING;
-    aha152x_config_cs(link);
-
-    return 0;
+    return aha152x_config_cs(link);
 } /* aha152x_attach */
 
 /*====================================================================*/
 
-static void aha152x_detach(struct pcmcia_device *p_dev)
+static void aha152x_detach(struct pcmcia_device *link)
 {
-    dev_link_t *link = dev_to_instance(p_dev);
-    dev_link_t **linkp;
-
     DEBUG(0, "aha152x_detach(0x%p)\n", link);
-    
-    /* Locate device structure */
-    for (linkp = &dev_list; *linkp; linkp = &(*linkp)->next)
-        if (*linkp == link) break;
-    if (*linkp == NULL)
-        return;
 
-    if (link->state & DEV_CONFIG)
-        aha152x_release_cs(link);
+    aha152x_release_cs(link);
 
     /* Unlink device structure, free bits */
-    *linkp = link->next;
     kfree(link->priv);
-    
 } /* aha152x_detach */
 
 /*====================================================================*/
@@ -161,9 +142,8 @@ static void aha152x_detach(struct pcmcia_device *p_dev)
 #define CS_CHECK(fn, ret) \
 do { last_fn = (fn); if ((last_ret = (ret)) != 0) goto cs_failed; } while (0)
 
-static void aha152x_config_cs(dev_link_t *link)
+static int aha152x_config_cs(struct pcmcia_device *link)
 {
-    client_handle_t handle = link->handle;
     scsi_info_t *info = link->priv;
     struct aha152x_setup s;
     tuple_t tuple;
@@ -178,19 +158,16 @@ static void aha152x_config_cs(dev_link_t *link)
     tuple.TupleData = tuple_data;
     tuple.TupleDataMax = 64;
     tuple.TupleOffset = 0;
-    CS_CHECK(GetFirstTuple, pcmcia_get_first_tuple(handle, &tuple));
-    CS_CHECK(GetTupleData, pcmcia_get_tuple_data(handle, &tuple));
-    CS_CHECK(ParseTuple, pcmcia_parse_tuple(handle, &tuple, &parse));
+    CS_CHECK(GetFirstTuple, pcmcia_get_first_tuple(link, &tuple));
+    CS_CHECK(GetTupleData, pcmcia_get_tuple_data(link, &tuple));
+    CS_CHECK(ParseTuple, pcmcia_parse_tuple(link, &tuple, &parse));
     link->conf.ConfigBase = parse.config.base;
 
-    /* Configure card */
-    link->state |= DEV_CONFIG;
-
     tuple.DesiredTuple = CISTPL_CFTABLE_ENTRY;
-    CS_CHECK(GetFirstTuple, pcmcia_get_first_tuple(handle, &tuple));
+    CS_CHECK(GetFirstTuple, pcmcia_get_first_tuple(link, &tuple));
     while (1) {
-        if (pcmcia_get_tuple_data(handle, &tuple) != 0 ||
-                pcmcia_parse_tuple(handle, &tuple, &parse) != 0)
+        if (pcmcia_get_tuple_data(link, &tuple) != 0 ||
+                pcmcia_parse_tuple(link, &tuple, &parse) != 0)
             goto next_entry;
         /* For New Media T&J, look for a SCSI window */
         if (parse.cftable_entry.io.win[0].len >= 0x20)
@@ -201,15 +178,15 @@ static void aha152x_config_cs(dev_link_t *link)
         if ((parse.cftable_entry.io.nwin > 0) &&
             (link->io.BasePort1 < 0xffff)) {
             link->conf.ConfigIndex = parse.cftable_entry.index;
-            i = pcmcia_request_io(handle, &link->io);
+            i = pcmcia_request_io(link, &link->io);
             if (i == CS_SUCCESS) break;
         }
     next_entry:
-        CS_CHECK(GetNextTuple, pcmcia_get_next_tuple(handle, &tuple));
+        CS_CHECK(GetNextTuple, pcmcia_get_next_tuple(link, &tuple));
     }
     
-    CS_CHECK(RequestIRQ, pcmcia_request_irq(handle, &link->irq));
-    CS_CHECK(RequestConfiguration, pcmcia_request_configuration(handle, &link->conf));
+    CS_CHECK(RequestIRQ, pcmcia_request_irq(link, &link->irq));
+    CS_CHECK(RequestConfiguration, pcmcia_request_configuration(link, &link->conf));
     
     /* Set configuration options for the aha152x driver */
     memset(&s, 0, sizeof(s));
@@ -231,53 +208,30 @@ static void aha152x_config_cs(dev_link_t *link)
     }
 
     sprintf(info->node.dev_name, "scsi%d", host->host_no);
-    link->dev = &info->node;
+    link->dev_node = &info->node;
     info->host = host;
 
-    link->state &= ~DEV_CONFIG_PENDING;
-    return;
-    
+    return 0;
+
 cs_failed:
-    cs_error(link->handle, last_fn, last_ret);
+    cs_error(link, last_fn, last_ret);
     aha152x_release_cs(link);
-    return;
+    return -ENODEV;
 }
 
-static void aha152x_release_cs(dev_link_t *link)
+static void aha152x_release_cs(struct pcmcia_device *link)
 {
         scsi_info_t *info = link->priv;
 
         aha152x_release(info->host);
-        link->dev = NULL;
-    
-        pcmcia_release_configuration(link->handle);
-        pcmcia_release_io(link->handle, &link->io);
-        pcmcia_release_irq(link->handle, &link->irq);
-    
-        link->state &= ~DEV_CONFIG;
+        pcmcia_disable_device(link);
 }
 
-static int aha152x_suspend(struct pcmcia_device *dev)
+static int aha152x_resume(struct pcmcia_device *link)
 {
-        dev_link_t *link = dev_to_instance(dev);
-
-        link->state |= DEV_SUSPEND;
-        if (link->state & DEV_CONFIG)
-                pcmcia_release_configuration(link->handle);
-
-        return 0;
-}
-
-static int aha152x_resume(struct pcmcia_device *dev)
-{
-        dev_link_t *link = dev_to_instance(dev);
         scsi_info_t *info = link->priv;
 
-        link->state &= ~DEV_SUSPEND;
-        if (link->state & DEV_CONFIG) {
-                pcmcia_request_configuration(link->handle, &link->conf);
-                aha152x_host_reset_host(info->host);
-        }
+        aha152x_host_reset_host(info->host);
 
         return 0;
 }
@@ -297,10 +251,9 @@ static struct pcmcia_driver aha152x_cs_driver = {
         .drv            = {
                 .name   = "aha152x_cs",
         },
-        .probe          = aha152x_attach,
+        .probe          = aha152x_probe,
         .remove         = aha152x_detach,
         .id_table       = aha152x_ids,
-        .suspend        = aha152x_suspend,
         .resume         = aha152x_resume,
 };
 
@@ -317,4 +270,3 @@ static void __exit exit_aha152x_cs(void)
 
 module_init(init_aha152x_cs);
 module_exit(exit_aha152x_cs);
- 
diff --git a/drivers/scsi/pcmcia/fdomain_stub.c b/drivers/scsi/pcmcia/fdomain_stub.c
index 788c58d805f3..85f7ffac19a0 100644
--- a/drivers/scsi/pcmcia/fdomain_stub.c
+++ b/drivers/scsi/pcmcia/fdomain_stub.c
@@ -73,57 +73,48 @@ static char *version =
 /*====================================================================*/
 
 typedef struct scsi_info_t {
-    dev_link_t          link;
+        struct pcmcia_device    *p_dev;
     dev_node_t          node;
     struct Scsi_Host    *host;
 } scsi_info_t;
 
 
-static void fdomain_release(dev_link_t *link);
+static void fdomain_release(struct pcmcia_device *link);
 static void fdomain_detach(struct pcmcia_device *p_dev);
-static void fdomain_config(dev_link_t *link);
+static int fdomain_config(struct pcmcia_device *link);
 
-static int fdomain_attach(struct pcmcia_device *p_dev)
+static int fdomain_probe(struct pcmcia_device *link)
 {
-    scsi_info_t *info;
-    dev_link_t *link;
-
-    DEBUG(0, "fdomain_attach()\n");
-
-    /* Create new SCSI device */
-    info = kmalloc(sizeof(*info), GFP_KERNEL);
-    if (!info) return -ENOMEM;
-    memset(info, 0, sizeof(*info));
-    link = &info->link; link->priv = info;
-    link->io.NumPorts1 = 0x10;
-    link->io.Attributes1 = IO_DATA_PATH_WIDTH_AUTO;
-    link->io.IOAddrLines = 10;
-    link->irq.Attributes = IRQ_TYPE_EXCLUSIVE;
-    link->irq.IRQInfo1 = IRQ_LEVEL_ID;
-    link->conf.Attributes = CONF_ENABLE_IRQ;
-    link->conf.Vcc = 50;
-    link->conf.IntType = INT_MEMORY_AND_IO;
-    link->conf.Present = PRESENT_OPTION;
-
-    link->handle = p_dev;
-    p_dev->instance = link;
-
-    link->state |= DEV_PRESENT | DEV_CONFIG_PENDING;
-    fdomain_config(link);
-
-    return 0;
+        scsi_info_t *info;
+
+        DEBUG(0, "fdomain_attach()\n");
+
+        /* Create new SCSI device */
+        info = kzalloc(sizeof(*info), GFP_KERNEL);
+        if (!info)
+                return -ENOMEM;
+
+        info->p_dev = link;
+        link->priv = info;
+        link->io.NumPorts1 = 0x10;
+        link->io.Attributes1 = IO_DATA_PATH_WIDTH_AUTO;
+        link->io.IOAddrLines = 10;
+        link->irq.Attributes = IRQ_TYPE_EXCLUSIVE;
+        link->irq.IRQInfo1 = IRQ_LEVEL_ID;
+        link->conf.Attributes = CONF_ENABLE_IRQ;
+        link->conf.IntType = INT_MEMORY_AND_IO;
+        link->conf.Present = PRESENT_OPTION;
+
+        return fdomain_config(link);
 } /* fdomain_attach */
 
 /*====================================================================*/
 
-static void fdomain_detach(struct pcmcia_device *p_dev)
+static void fdomain_detach(struct pcmcia_device *link)
 {
-        dev_link_t *link = dev_to_instance(p_dev);
-
         DEBUG(0, "fdomain_detach(0x%p)\n", link);
 
-        if (link->state & DEV_CONFIG)
-                fdomain_release(link);
+        fdomain_release(link);
 
         kfree(link->priv);
 } /* fdomain_detach */
@@ -133,9 +124,8 @@ static void fdomain_detach(struct pcmcia_device *p_dev)
 #define CS_CHECK(fn, ret) \
 do { last_fn = (fn); if ((last_ret = (ret)) != 0) goto cs_failed; } while (0)
 
-static void fdomain_config(dev_link_t *link)
+static int fdomain_config(struct pcmcia_device *link)
 {
-    client_handle_t handle = link->handle;
     scsi_info_t *info = link->priv;
     tuple_t tuple;
     cisparse_t parse;
@@ -150,103 +140,75 @@ static void fdomain_config(dev_link_t *link)
     tuple.TupleData = tuple_data;
     tuple.TupleDataMax = 64;
     tuple.TupleOffset = 0;
-    CS_CHECK(GetFirstTuple, pcmcia_get_first_tuple(handle, &tuple));
-    CS_CHECK(GetTupleData, pcmcia_get_tuple_data(handle, &tuple));
-    CS_CHECK(ParseTuple, pcmcia_parse_tuple(handle, &tuple, &parse));
+    CS_CHECK(GetFirstTuple, pcmcia_get_first_tuple(link, &tuple));
+    CS_CHECK(GetTupleData, pcmcia_get_tuple_data(link, &tuple));
+    CS_CHECK(ParseTuple, pcmcia_parse_tuple(link, &tuple, &parse));
     link->conf.ConfigBase = parse.config.base;
 
-    /* Configure card */
-    link->state |= DEV_CONFIG;
-    
     tuple.DesiredTuple = CISTPL_CFTABLE_ENTRY;
-    CS_CHECK(GetFirstTuple, pcmcia_get_first_tuple(handle, &tuple));
+    CS_CHECK(GetFirstTuple, pcmcia_get_first_tuple(link, &tuple));
     while (1) {
-        if (pcmcia_get_tuple_data(handle, &tuple) != 0 ||
-                pcmcia_parse_tuple(handle, &tuple, &parse) != 0)
+        if (pcmcia_get_tuple_data(link, &tuple) != 0 ||
+                pcmcia_parse_tuple(link, &tuple, &parse) != 0)
             goto next_entry;
         link->conf.ConfigIndex = parse.cftable_entry.index;
         link->io.BasePort1 = parse.cftable_entry.io.win[0].base;
-        i = pcmcia_request_io(handle, &link->io);
+        i = pcmcia_request_io(link, &link->io);
         if (i == CS_SUCCESS) break;
     next_entry:
-        CS_CHECK(GetNextTuple, pcmcia_get_next_tuple(handle, &tuple));
+        CS_CHECK(GetNextTuple, pcmcia_get_next_tuple(link, &tuple));
     }
 
-    CS_CHECK(RequestIRQ, pcmcia_request_irq(handle, &link->irq));
-    CS_CHECK(RequestConfiguration, pcmcia_request_configuration(handle, &link->conf));
-    
+    CS_CHECK(RequestIRQ, pcmcia_request_irq(link, &link->irq));
+    CS_CHECK(RequestConfiguration, pcmcia_request_configuration(link, &link->conf));
+
     /* A bad hack... */
     release_region(link->io.BasePort1, link->io.NumPorts1);
 
     /* Set configuration options for the fdomain driver */
     sprintf(str, "%d,%d", link->io.BasePort1, link->irq.AssignedIRQ);
     fdomain_setup(str);
-    
+
     host = __fdomain_16x0_detect(&fdomain_driver_template);
     if (!host) {
         printk(KERN_INFO "fdomain_cs: no SCSI devices found\n");
         goto cs_failed;
     }
- 
-    scsi_add_host(host, NULL); /* XXX handle failure */
+
+    if (scsi_add_host(host, NULL))
+            goto cs_failed;
     scsi_scan_host(host);
 
     sprintf(info->node.dev_name, "scsi%d", host->host_no);
-    link->dev = &info->node;
+    link->dev_node = &info->node;
     info->host = host;
-    
-    link->state &= ~DEV_CONFIG_PENDING;
-    return;
-    
+
+    return 0;
+
 cs_failed:
-    cs_error(link->handle, last_fn, last_ret);
+    cs_error(link, last_fn, last_ret);
     fdomain_release(link);
-    return;
-    
+    return -ENODEV;
 } /* fdomain_config */
 
 /*====================================================================*/
 
-static void fdomain_release(dev_link_t *link)
+static void fdomain_release(struct pcmcia_device *link)
 {
-    scsi_info_t *info = link->priv;
+        scsi_info_t *info = link->priv;
 
-    DEBUG(0, "fdomain_release(0x%p)\n", link);
+        DEBUG(0, "fdomain_release(0x%p)\n", link);
 
-    scsi_remove_host(info->host);
-    link->dev = NULL;
-    
-    pcmcia_release_configuration(link->handle);
-    pcmcia_release_io(link->handle, &link->io);
-    pcmcia_release_irq(link->handle, &link->irq);
-
-    scsi_unregister(info->host);
-
-    link->state &= ~DEV_CONFIG;
+        scsi_remove_host(info->host);
+        pcmcia_disable_device(link);
+        scsi_unregister(info->host);
 }
 
 /*====================================================================*/
 
-static int fdomain_suspend(struct pcmcia_device *dev)
+static int fdomain_resume(struct pcmcia_device *link)
 {
-        dev_link_t *link = dev_to_instance(dev);
-
-        link->state |= DEV_SUSPEND;
-        if (link->state & DEV_CONFIG)
-                pcmcia_release_configuration(link->handle);
-
-        return 0;
-}
-
-static int fdomain_resume(struct pcmcia_device *dev)
-{
-        dev_link_t *link = dev_to_instance(dev);
-
-        link->state &= ~DEV_SUSPEND;
-        if (link->state & DEV_CONFIG) {
-                pcmcia_request_configuration(link->handle, &link->conf);
-                fdomain_16x0_bus_reset(NULL);
-        }
+        fdomain_16x0_bus_reset(NULL);
 
         return 0;
 }
@@ -264,10 +226,9 @@ static struct pcmcia_driver fdomain_cs_driver = {
         .drv            = {
                 .name   = "fdomain_cs",
         },
-        .probe          = fdomain_attach,
+        .probe          = fdomain_probe,
         .remove         = fdomain_detach,
         .id_table       = fdomain_ids,
-        .suspend        = fdomain_suspend,
         .resume         = fdomain_resume,
 };
 
diff --git a/drivers/scsi/pcmcia/nsp_cs.c b/drivers/scsi/pcmcia/nsp_cs.c
index 9e3ab3fd5355..231f9c311c69 100644
--- a/drivers/scsi/pcmcia/nsp_cs.c
+++ b/drivers/scsi/pcmcia/nsp_cs.c
@@ -1593,11 +1593,11 @@ static int nsp_eh_host_reset(Scsi_Cmnd *SCpnt)
     configure the card at this point -- we wait until we receive a
     card insertion event.
 ======================================================================*/
-static int nsp_cs_attach(struct pcmcia_device *p_dev)
+static int nsp_cs_probe(struct pcmcia_device *link)
 {
         scsi_info_t  *info;
-        dev_link_t   *link;
         nsp_hw_data  *data = &nsp_data_base;
+        int ret;
 
         nsp_dbg(NSP_DEBUG_INIT, "in");
 
@@ -1605,7 +1605,7 @@ static int nsp_cs_attach(struct pcmcia_device *p_dev)
         info = kmalloc(sizeof(*info), GFP_KERNEL);
         if (info == NULL) { return -ENOMEM; }
         memset(info, 0, sizeof(*info));
-        link = &info->link;
+        info->p_dev = link;
         link->priv = info;
         data->ScsiInfo = info;
 
@@ -1627,18 +1627,13 @@ static int nsp_cs_attach(struct pcmcia_device *p_dev)
 
         /* General socket configuration */
         link->conf.Attributes    = CONF_ENABLE_IRQ;
-        link->conf.Vcc           = 50;
         link->conf.IntType       = INT_MEMORY_AND_IO;
         link->conf.Present       = PRESENT_OPTION;
 
-        link->handle = p_dev;
-        p_dev->instance = link;
-
-        link->state |= DEV_PRESENT | DEV_CONFIG_PENDING;
-        nsp_cs_config(link);
+        ret = nsp_cs_config(link);
 
         nsp_dbg(NSP_DEBUG_INIT, "link=0x%p", link);
-        return 0;
+        return ret;
 } /* nsp_cs_attach */
 
 
@@ -1648,16 +1643,12 @@ static int nsp_cs_attach(struct pcmcia_device *p_dev)
     structures are freed.  Otherwise, the structures will be freed
     when the device is released.
 ======================================================================*/
-static void nsp_cs_detach(struct pcmcia_device *p_dev)
+static void nsp_cs_detach(struct pcmcia_device *link)
 {
-        dev_link_t *link = dev_to_instance(p_dev);
-
         nsp_dbg(NSP_DEBUG_INIT, "in, link=0x%p", link);
 
-        if (link->state & DEV_CONFIG) {
-                ((scsi_info_t *)link->priv)->stop = 1;
-                nsp_cs_release(link);
-        }
+        ((scsi_info_t *)link->priv)->stop = 1;
+        nsp_cs_release(link);
 
         kfree(link->priv);
         link->priv = NULL;
@@ -1672,9 +1663,9 @@ static void nsp_cs_detach(struct pcmcia_device *p_dev)
 #define CS_CHECK(fn, ret) \
 do { last_fn = (fn); if ((last_ret = (ret)) != 0) goto cs_failed; } while (0)
 /*====================================================================*/
-static void nsp_cs_config(dev_link_t *link)
+static int nsp_cs_config(struct pcmcia_device *link)
 {
-        client_handle_t   handle = link->handle;
+        int               ret;
         scsi_info_t      *info   = link->priv;
         tuple_t           tuple;
         cisparse_t        parse;
@@ -1698,26 +1689,22 @@ static void nsp_cs_config(dev_link_t *link)
         tuple.TupleData       = tuple_data;
         tuple.TupleDataMax    = sizeof(tuple_data);
         tuple.TupleOffset     = 0;
-        CS_CHECK(GetFirstTuple, pcmcia_get_first_tuple(handle, &tuple));
-        CS_CHECK(GetTupleData,  pcmcia_get_tuple_data(handle, &tuple));
-        CS_CHECK(ParseTuple,    pcmcia_parse_tuple(handle, &tuple, &parse));
+        CS_CHECK(GetFirstTuple, pcmcia_get_first_tuple(link, &tuple));
+        CS_CHECK(GetTupleData,  pcmcia_get_tuple_data(link, &tuple));
+        CS_CHECK(ParseTuple,    pcmcia_parse_tuple(link, &tuple, &parse));
         link->conf.ConfigBase = parse.config.base;
         link->conf.Present    = parse.config.rmask[0];
 
-        /* Configure card */
-        link->state           |= DEV_CONFIG;
-
         /* Look up the current Vcc */
-        CS_CHECK(GetConfigurationInfo, pcmcia_get_configuration_info(handle, &conf));
-        link->conf.Vcc = conf.Vcc;
+        CS_CHECK(GetConfigurationInfo, pcmcia_get_configuration_info(link, &conf));
 
         tuple.DesiredTuple = CISTPL_CFTABLE_ENTRY;
-        CS_CHECK(GetFirstTuple, pcmcia_get_first_tuple(handle, &tuple));
+        CS_CHECK(GetFirstTuple, pcmcia_get_first_tuple(link, &tuple));
         while (1) {
                 cistpl_cftable_entry_t *cfg = &(parse.cftable_entry);
 
-                if (pcmcia_get_tuple_data(handle, &tuple) != 0 ||
-                                pcmcia_parse_tuple(handle, &tuple, &parse) != 0)
+                if (pcmcia_get_tuple_data(link, &tuple) != 0 ||
+                                pcmcia_parse_tuple(link, &tuple, &parse) != 0)
                         goto next_entry;
 
                 if (cfg->flags & CISTPL_CFTABLE_DEFAULT) { dflt = *cfg; }
@@ -1743,10 +1730,10 @@ static void nsp_cs_config(dev_link_t *link)
                 }
 
                 if (cfg->vpp1.present & (1 << CISTPL_POWER_VNOM)) {
-                        link->conf.Vpp1 = link->conf.Vpp2 =
+                        link->conf.Vpp =
                                 cfg->vpp1.param[CISTPL_POWER_VNOM] / 10000;
                 } else if (dflt.vpp1.present & (1 << CISTPL_POWER_VNOM)) {
-                        link->conf.Vpp1 = link->conf.Vpp2 =
+                        link->conf.Vpp =
                                 dflt.vpp1.param[CISTPL_POWER_VNOM] / 10000;
                 }
 
@@ -1773,7 +1760,7 @@ static void nsp_cs_config(dev_link_t *link)
                                 link->io.NumPorts2 = io->win[1].len;
                         }
                         /* This reserves IO space but doesn't actually enable it */
-                        if (pcmcia_request_io(link->handle, &link->io) != 0)
+                        if (pcmcia_request_io(link, &link->io) != 0)
                                 goto next_entry;
                 }
 
@@ -1788,7 +1775,7 @@ static void nsp_cs_config(dev_link_t *link)
                                 req.Size = 0x1000;
                         }
                         req.AccessSpeed = 0;
-                        if (pcmcia_request_window(&link->handle, &req, &link->win) != 0)
+                        if (pcmcia_request_window(&link, &req, &link->win) != 0)
                                 goto next_entry;
                         map.Page = 0; map.CardOffset = mem->win[0].card_addr;
                         if (pcmcia_map_mem_page(link->win, &map) != 0)
@@ -1802,17 +1789,14 @@ static void nsp_cs_config(dev_link_t *link)
 
         next_entry:
                 nsp_dbg(NSP_DEBUG_INIT, "next");
-
-                if (link->io.NumPorts1) {
-                        pcmcia_release_io(link->handle, &link->io);
-                }
-                CS_CHECK(GetNextTuple, pcmcia_get_next_tuple(handle, &tuple));
+                pcmcia_disable_device(link);
+                CS_CHECK(GetNextTuple, pcmcia_get_next_tuple(link, &tuple));
         }
 
         if (link->conf.Attributes & CONF_ENABLE_IRQ) {
-                CS_CHECK(RequestIRQ, pcmcia_request_irq(link->handle, &link->irq));
+                CS_CHECK(RequestIRQ, pcmcia_request_irq(link, &link->irq));
         }
-        CS_CHECK(RequestConfiguration, pcmcia_request_configuration(handle, &link->conf));
+        CS_CHECK(RequestConfiguration, pcmcia_request_configuration(link, &link->conf));
 
         if (free_ports) {
                 if (link->io.BasePort1) {
@@ -1854,16 +1838,19 @@ static void nsp_cs_config(dev_link_t *link)
 
 
 #if (LINUX_VERSION_CODE >= KERNEL_VERSION(2,5,74))
-        scsi_add_host (host, NULL);
+        ret = scsi_add_host (host, NULL);
+        if (ret)
+                goto cs_failed;
+
         scsi_scan_host(host);
 
         snprintf(info->node.dev_name, sizeof(info->node.dev_name), "scsi%d", host->host_no);
-        link->dev  = &info->node;
+        link->dev_node  = &info->node;
         info->host = host;
 
 #else
         nsp_dbg(NSP_DEBUG_INIT, "GET_SCSI_INFO");
-        tail = &link->dev;
+        tail = &link->dev_node;
         info->ndev = 0;
 
         nsp_dbg(NSP_DEBUG_INIT, "host=0x%p", host);
@@ -1908,11 +1895,10 @@ static void nsp_cs_config(dev_link_t *link)
 #endif
 
         /* Finally, report what we've done */
-        printk(KERN_INFO "nsp_cs: index 0x%02x: Vcc %d.%d",
-               link->conf.ConfigIndex,
-               link->conf.Vcc/10, link->conf.Vcc%10);
-        if (link->conf.Vpp1) {
-                printk(", Vpp %d.%d", link->conf.Vpp1/10, link->conf.Vpp1%10);
+        printk(KERN_INFO "nsp_cs: index 0x%02x: ",
+               link->conf.ConfigIndex);
+        if (link->conf.Vpp) {
+                printk(", Vpp %d.%d", link->conf.Vpp/10, link->conf.Vpp%10);
         }
         if (link->conf.Attributes & CONF_ENABLE_IRQ) {
                 printk(", irq %d", link->irq.AssignedIRQ);
@@ -1929,15 +1915,14 @@ static void nsp_cs_config(dev_link_t *link)
                        req.Base+req.Size-1);
         printk("\n");
 
-        link->state &= ~DEV_CONFIG_PENDING;
-        return;
+        return 0;
 
  cs_failed:
         nsp_dbg(NSP_DEBUG_INIT, "config fail");
-        cs_error(link->handle, last_fn, last_ret);
+        cs_error(link, last_fn, last_ret);
         nsp_cs_release(link);
 
-        return;
+        return -ENODEV;
 } /* nsp_cs_config */
 #undef CS_CHECK
 
@@ -1947,7 +1932,7 @@ static void nsp_cs_config(dev_link_t *link)
     device, and release the PCMCIA configuration.  If the device is
     still open, this will be postponed until it is closed.
 ======================================================================*/
-static void nsp_cs_release(dev_link_t *link)
+static void nsp_cs_release(struct pcmcia_device *link)
 {
         scsi_info_t *info = link->priv;
         nsp_hw_data *data = NULL;
@@ -1968,22 +1953,15 @@ static void nsp_cs_release(dev_link_t *link)
 #else
         scsi_unregister_host(&nsp_driver_template);
 #endif
-        link->dev = NULL;
+        link->dev_node = NULL;
 
         if (link->win) {
                 if (data != NULL) {
                         iounmap((void *)(data->MmioAddress));
                 }
-                pcmcia_release_window(link->win);
-        }
-        pcmcia_release_configuration(link->handle);
-        if (link->io.NumPorts1) {
-                pcmcia_release_io(link->handle, &link->io);
         }
-        if (link->irq.AssignedIRQ) {
-                pcmcia_release_irq(link->handle, &link->irq);
-        }
-        link->state &= ~DEV_CONFIG;
+        pcmcia_disable_device(link);
+
 #if (LINUX_VERSION_CODE >= KERNEL_VERSION(2,5,2))
         if (info->host != NULL) {
                 scsi_host_put(info->host);
@@ -1991,14 +1969,11 @@ static void nsp_cs_release(dev_link_t *link)
 #endif
 } /* nsp_cs_release */
 
-static int nsp_cs_suspend(struct pcmcia_device *dev)
+static int nsp_cs_suspend(struct pcmcia_device *link)
 {
-        dev_link_t *link = dev_to_instance(dev);
         scsi_info_t *info = link->priv;
         nsp_hw_data *data;
 
-        link->state |= DEV_SUSPEND;
-
         nsp_dbg(NSP_DEBUG_INIT, "event: suspend");
 
         if (info->host != NULL) {
@@ -2011,25 +1986,16 @@ static int nsp_cs_suspend(struct pcmcia_device *dev)
 
         info->stop = 1;
 
-        if (link->state & DEV_CONFIG)
-                pcmcia_release_configuration(link->handle);
-
         return 0;
 }
 
-static int nsp_cs_resume(struct pcmcia_device *dev)
+static int nsp_cs_resume(struct pcmcia_device *link)
 {
-        dev_link_t *link = dev_to_instance(dev);
         scsi_info_t *info = link->priv;
         nsp_hw_data *data;
 
         nsp_dbg(NSP_DEBUG_INIT, "event: resume");
 
-        link->state &= ~DEV_SUSPEND;
-
-        if (link->state & DEV_CONFIG)
-                pcmcia_request_configuration(link->handle, &link->conf);
-
         info->stop = 0;
 
         if (info->host != NULL) {
@@ -2065,7 +2031,7 @@ static struct pcmcia_driver nsp_driver = {
         .drv            = {
                 .name   = "nsp_cs",
         },
-        .probe          = nsp_cs_attach,
+        .probe          = nsp_cs_probe,
         .remove         = nsp_cs_detach,
         .id_table       = nsp_cs_ids,
         .suspend        = nsp_cs_suspend,
@@ -2098,19 +2064,7 @@ static int __init nsp_cs_init(void)
 static void __exit nsp_cs_exit(void)
 {
         nsp_msg(KERN_INFO, "unloading...");
-
-#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2,5,68))
         pcmcia_unregister_driver(&nsp_driver);
-#else
-        unregister_pcmcia_driver(&dev_info);
-        /* XXX: this really needs to move into generic code.. */
-        while (dev_list != NULL) {
-                if (dev_list->state & DEV_CONFIG) {
-                        nsp_cs_release(dev_list);
-                }
-                nsp_cs_detach(dev_list);
-        }
-#endif
 }
 
 
diff --git a/drivers/scsi/pcmcia/nsp_cs.h b/drivers/scsi/pcmcia/nsp_cs.h
index b66b140a745e..8908b8e5b78a 100644
--- a/drivers/scsi/pcmcia/nsp_cs.h
+++ b/drivers/scsi/pcmcia/nsp_cs.h
@@ -225,7 +225,7 @@
 /*====================================================================*/
 
 typedef struct scsi_info_t {
-        dev_link_t             link;
+        struct pcmcia_device    *p_dev;
         struct Scsi_Host      *host;
 #if (LINUX_VERSION_CODE >= KERNEL_VERSION(2,5,74))
         dev_node_t             node;
@@ -297,8 +297,8 @@ typedef struct _nsp_hw_data {
 
 /* Card service functions */
 static void        nsp_cs_detach (struct pcmcia_device *p_dev);
-static void        nsp_cs_release(dev_link_t *link);
-static void        nsp_cs_config (dev_link_t *link);
+static void        nsp_cs_release(struct pcmcia_device *link);
+static int        nsp_cs_config (struct pcmcia_device *link);
 
 /* Linux SCSI subsystem specific functions */
 static struct Scsi_Host *nsp_detect     (struct scsi_host_template *sht);
@@ -450,7 +450,7 @@ static inline struct Scsi_Host *scsi_host_hn_get(unsigned short hostno)
         return host;
 }
 
-static void cs_error(client_handle_t handle, int func, int ret)
+static void cs_error(struct pcmcia_device *handle, int func, int ret)
 {
         error_info_t err = { func, ret };
         pcmcia_report_error(handle, &err);
diff --git a/drivers/scsi/pcmcia/qlogic_stub.c b/drivers/scsi/pcmcia/qlogic_stub.c
index dce7e687fd4a..86c2ac6ae623 100644
--- a/drivers/scsi/pcmcia/qlogic_stub.c
+++ b/drivers/scsi/pcmcia/qlogic_stub.c
@@ -91,18 +91,18 @@ static struct scsi_host_template qlogicfas_driver_template = {
 /*====================================================================*/
 
 typedef struct scsi_info_t {
-        dev_link_t link;
+        struct pcmcia_device    *p_dev;
         dev_node_t node;
         struct Scsi_Host *host;
         unsigned short manf_id;
 } scsi_info_t;
 
-static void qlogic_release(dev_link_t *link);
+static void qlogic_release(struct pcmcia_device *link);
 static void qlogic_detach(struct pcmcia_device *p_dev);
-static void qlogic_config(dev_link_t * link);
+static int qlogic_config(struct pcmcia_device * link);
 
 static struct Scsi_Host *qlogic_detect(struct scsi_host_template *host,
-                                dev_link_t *link, int qbase, int qlirq)
+                                struct pcmcia_device *link, int qbase, int qlirq)
 {
         int qltyp;              /* type of chip */
         int qinitid;
@@ -156,10 +156,9 @@ free_scsi_host:
 err:
         return NULL;
 }
-static int qlogic_attach(struct pcmcia_device *p_dev)
+static int qlogic_probe(struct pcmcia_device *link)
 {
         scsi_info_t *info;
-        dev_link_t *link;
 
         DEBUG(0, "qlogic_attach()\n");
 
@@ -168,7 +167,7 @@ static int qlogic_attach(struct pcmcia_device *p_dev)
         if (!info)
                 return -ENOMEM;
         memset(info, 0, sizeof(*info));
-        link = &info->link;
+        info->p_dev = link;
         link->priv = info;
         link->io.NumPorts1 = 16;
         link->io.Attributes1 = IO_DATA_PATH_WIDTH_AUTO;
@@ -176,30 +175,19 @@ static int qlogic_attach(struct pcmcia_device *p_dev)
         link->irq.Attributes = IRQ_TYPE_EXCLUSIVE;
         link->irq.IRQInfo1 = IRQ_LEVEL_ID;
         link->conf.Attributes = CONF_ENABLE_IRQ;
-        link->conf.Vcc = 50;
         link->conf.IntType = INT_MEMORY_AND_IO;
         link->conf.Present = PRESENT_OPTION;
 
-        link->handle = p_dev;
-        p_dev->instance = link;
-
-        link->state |= DEV_PRESENT | DEV_CONFIG_PENDING;
-        qlogic_config(link);
-
-        return 0;
+        return qlogic_config(link);
 }                               /* qlogic_attach */
 
 /*====================================================================*/
 
-static void qlogic_detach(struct pcmcia_device *p_dev)
+static void qlogic_detach(struct pcmcia_device *link)
 {
-        dev_link_t *link = dev_to_instance(p_dev);
-
         DEBUG(0, "qlogic_detach(0x%p)\n", link);
 
-        if (link->state & DEV_CONFIG)
-                qlogic_release(link);
-
+        qlogic_release(link);
         kfree(link->priv);
 
 }                               /* qlogic_detach */
@@ -209,9 +197,8 @@ static void qlogic_detach(struct pcmcia_device *p_dev)
 #define CS_CHECK(fn, ret) \
 do { last_fn = (fn); if ((last_ret = (ret)) != 0) goto cs_failed; } while (0)
 
-static void qlogic_config(dev_link_t * link)
+static int qlogic_config(struct pcmcia_device * link)
 {
-        client_handle_t handle = link->handle;
         scsi_info_t *info = link->priv;
         tuple_t tuple;
         cisparse_t parse;
@@ -225,38 +212,35 @@ static void qlogic_config(dev_link_t * link)
         tuple.TupleDataMax = 64;
         tuple.TupleOffset = 0;
         tuple.DesiredTuple = CISTPL_CONFIG;
-        CS_CHECK(GetFirstTuple, pcmcia_get_first_tuple(handle, &tuple));
-        CS_CHECK(GetTupleData, pcmcia_get_tuple_data(handle, &tuple));
-        CS_CHECK(ParseTuple, pcmcia_parse_tuple(handle, &tuple, &parse));
+        CS_CHECK(GetFirstTuple, pcmcia_get_first_tuple(link, &tuple));
+        CS_CHECK(GetTupleData, pcmcia_get_tuple_data(link, &tuple));
+        CS_CHECK(ParseTuple, pcmcia_parse_tuple(link, &tuple, &parse));
         link->conf.ConfigBase = parse.config.base;
 
         tuple.DesiredTuple = CISTPL_MANFID;
-        if ((pcmcia_get_first_tuple(handle, &tuple) == CS_SUCCESS) && (pcmcia_get_tuple_data(handle, &tuple) == CS_SUCCESS))
+        if ((pcmcia_get_first_tuple(link, &tuple) == CS_SUCCESS) && (pcmcia_get_tuple_data(link, &tuple) == CS_SUCCESS))
                 info->manf_id = le16_to_cpu(tuple.TupleData[0]);
 
-        /* Configure card */
-        link->state |= DEV_CONFIG;
-
         tuple.DesiredTuple = CISTPL_CFTABLE_ENTRY;
-        CS_CHECK(GetFirstTuple, pcmcia_get_first_tuple(handle, &tuple));
+        CS_CHECK(GetFirstTuple, pcmcia_get_first_tuple(link, &tuple));
         while (1) {
-                if (pcmcia_get_tuple_data(handle, &tuple) != 0 ||
-                                pcmcia_parse_tuple(handle, &tuple, &parse) != 0)
+                if (pcmcia_get_tuple_data(link, &tuple) != 0 ||
+                                pcmcia_parse_tuple(link, &tuple, &parse) != 0)
                         goto next_entry;
                 link->conf.ConfigIndex = parse.cftable_entry.index;
                 link->io.BasePort1 = parse.cftable_entry.io.win[0].base;
                 link->io.NumPorts1 = parse.cftable_entry.io.win[0].len;
                 if (link->io.BasePort1 != 0) {
-                        i = pcmcia_request_io(handle, &link->io);
+                        i = pcmcia_request_io(link, &link->io);
                         if (i == CS_SUCCESS)
                                 break;
                 }
               next_entry:
-                CS_CHECK(GetNextTuple, pcmcia_get_next_tuple(handle, &tuple));
+                CS_CHECK(GetNextTuple, pcmcia_get_next_tuple(link, &tuple));
         }
 
-        CS_CHECK(RequestIRQ, pcmcia_request_irq(handle, &link->irq));
-        CS_CHECK(RequestConfiguration, pcmcia_request_configuration(handle, &link->conf));
+        CS_CHECK(RequestIRQ, pcmcia_request_irq(link, &link->irq));
+        CS_CHECK(RequestConfiguration, pcmcia_request_configuration(link, &link->conf));
 
         if ((info->manf_id == MANFID_MACNICA) || (info->manf_id == MANFID_PIONEER) || (info->manf_id == 0x0098)) {
                 /* set ATAcmd */
@@ -275,82 +259,54 @@ static void qlogic_config(dev_link_t * link)
         
         if (!host) {
                 printk(KERN_INFO "%s: no SCSI devices found\n", qlogic_name);
-                goto out;
+                goto cs_failed;
         }
 
         sprintf(info->node.dev_name, "scsi%d", host->host_no);
-        link->dev = &info->node;
+        link->dev_node = &info->node;
         info->host = host;
 
-out:
-        link->state &= ~DEV_CONFIG_PENDING;
-        return;
+        return 0;
 
 cs_failed:
-        cs_error(link->handle, last_fn, last_ret);
-        link->dev = NULL;
-        pcmcia_release_configuration(link->handle);
-        pcmcia_release_io(link->handle, &link->io);
-        pcmcia_release_irq(link->handle, &link->irq);
-        link->state &= ~DEV_CONFIG;
-        return;
+        cs_error(link, last_fn, last_ret);
+        pcmcia_disable_device(link);
+        return -ENODEV;
 
 }                               /* qlogic_config */
 
 /*====================================================================*/
 
-static void qlogic_release(dev_link_t *link)
+static void qlogic_release(struct pcmcia_device *link)
 {
         scsi_info_t *info = link->priv;
 
         DEBUG(0, "qlogic_release(0x%p)\n", link);
 
         scsi_remove_host(info->host);
-        link->dev = NULL;
 
         free_irq(link->irq.AssignedIRQ, info->host);
-
-        pcmcia_release_configuration(link->handle);
-        pcmcia_release_io(link->handle, &link->io);
-        pcmcia_release_irq(link->handle, &link->irq);
+        pcmcia_disable_device(link);
 
         scsi_host_put(info->host);
-
-        link->state &= ~DEV_CONFIG;
 }
 
 /*====================================================================*/
 
-static int qlogic_suspend(struct pcmcia_device *dev)
+static int qlogic_resume(struct pcmcia_device *link)
 {
-        dev_link_t *link = dev_to_instance(dev);
-
-        link->state |= DEV_SUSPEND;
-        if (link->state & DEV_CONFIG)
-                pcmcia_release_configuration(link->handle);
-
-        return 0;
-}
+        scsi_info_t *info = link->priv;
 
-static int qlogic_resume(struct pcmcia_device *dev)
-{
-        dev_link_t *link = dev_to_instance(dev);
-
-        link->state &= ~DEV_SUSPEND;
-        if (link->state & DEV_CONFIG) {
-                scsi_info_t *info = link->priv;
-
-                pcmcia_request_configuration(link->handle, &link->conf);
-                if ((info->manf_id == MANFID_MACNICA) ||
-                    (info->manf_id == MANFID_PIONEER) ||
-                    (info->manf_id == 0x0098)) {
-                        outb(0x80, link->io.BasePort1 + 0xd);
-                        outb(0x24, link->io.BasePort1 + 0x9);
-                        outb(0x04, link->io.BasePort1 + 0xd);
-                }
-                /* Ugggglllyyyy!!! */
-                qlogicfas408_bus_reset(NULL);
+        pcmcia_request_configuration(link, &link->conf);
+        if ((info->manf_id == MANFID_MACNICA) ||
+            (info->manf_id == MANFID_PIONEER) ||
+            (info->manf_id == 0x0098)) {
+                outb(0x80, link->io.BasePort1 + 0xd);
+                outb(0x24, link->io.BasePort1 + 0x9);
+                outb(0x04, link->io.BasePort1 + 0xd);
         }
+        /* Ugggglllyyyy!!! */
+        qlogicfas408_bus_reset(NULL);
 
         return 0;
 }
@@ -382,10 +338,9 @@ static struct pcmcia_driver qlogic_cs_driver = {
         .drv            = {
         .name           = "qlogic_cs",
         },
-        .probe          = qlogic_attach,
+        .probe          = qlogic_probe,
         .remove         = qlogic_detach,
         .id_table       = qlogic_ids,
-        .suspend        = qlogic_suspend,
         .resume         = qlogic_resume,
 };
 
diff --git a/drivers/scsi/pcmcia/sym53c500_cs.c b/drivers/scsi/pcmcia/sym53c500_cs.c
index 3a4dd6f5b81f..9f59827707f0 100644
--- a/drivers/scsi/pcmcia/sym53c500_cs.c
+++ b/drivers/scsi/pcmcia/sym53c500_cs.c
@@ -202,7 +202,7 @@ static char *version =
 /* ================================================================== */
 
 struct scsi_info_t {
-        dev_link_t link;
+        struct pcmcia_device    *p_dev;
         dev_node_t node;
         struct Scsi_Host *host;
         unsigned short manf_id;
@@ -527,7 +527,7 @@ idle_out:
 }
 
 static void
-SYM53C500_release(dev_link_t *link)
+SYM53C500_release(struct pcmcia_device *link)
 {
         struct scsi_info_t *info = link->priv;
         struct Scsi_Host *shost = info->host;
@@ -550,13 +550,7 @@ SYM53C500_release(dev_link_t *link)
         if (shost->io_port && shost->n_io_port)
                 release_region(shost->io_port, shost->n_io_port);
 
-        link->dev = NULL;
-
-        pcmcia_release_configuration(link->handle);
-        pcmcia_release_io(link->handle, &link->io);
-        pcmcia_release_irq(link->handle, &link->irq);
-
-        link->state &= ~DEV_CONFIG;
+        pcmcia_disable_device(link);
 
         scsi_host_put(shost);
 } /* SYM53C500_release */
@@ -713,10 +707,9 @@ static struct scsi_host_template sym53c500_driver_template = {
 #define CS_CHECK(fn, ret) \
 do { last_fn = (fn); if ((last_ret = (ret)) != 0) goto cs_failed; } while (0)
 
-static void
-SYM53C500_config(dev_link_t *link)
+static int
+SYM53C500_config(struct pcmcia_device *link)
 {
-        client_handle_t handle = link->handle;
         struct scsi_info_t *info = link->priv;
         tuple_t tuple;
         cisparse_t parse;
@@ -733,40 +726,37 @@ SYM53C500_config(dev_link_t *link)
         tuple.TupleDataMax = 64;
         tuple.TupleOffset = 0;
         tuple.DesiredTuple = CISTPL_CONFIG;
-        CS_CHECK(GetFirstTuple, pcmcia_get_first_tuple(handle, &tuple));
-        CS_CHECK(GetTupleData, pcmcia_get_tuple_data(handle, &tuple));
-        CS_CHECK(ParseTuple, pcmcia_parse_tuple(handle, &tuple, &parse));
+        CS_CHECK(GetFirstTuple, pcmcia_get_first_tuple(link, &tuple));
+        CS_CHECK(GetTupleData, pcmcia_get_tuple_data(link, &tuple));
+        CS_CHECK(ParseTuple, pcmcia_parse_tuple(link, &tuple, &parse));
         link->conf.ConfigBase = parse.config.base;
 
         tuple.DesiredTuple = CISTPL_MANFID;
-        if ((pcmcia_get_first_tuple(handle, &tuple) == CS_SUCCESS) &&
-            (pcmcia_get_tuple_data(handle, &tuple) == CS_SUCCESS))
+        if ((pcmcia_get_first_tuple(link, &tuple) == CS_SUCCESS) &&
+            (pcmcia_get_tuple_data(link, &tuple) == CS_SUCCESS))
                 info->manf_id = le16_to_cpu(tuple.TupleData[0]);
 
-        /* Configure card */
-        link->state |= DEV_CONFIG;
-
         tuple.DesiredTuple = CISTPL_CFTABLE_ENTRY;
-        CS_CHECK(GetFirstTuple, pcmcia_get_first_tuple(handle, &tuple));
+        CS_CHECK(GetFirstTuple, pcmcia_get_first_tuple(link, &tuple));
         while (1) {
-                if (pcmcia_get_tuple_data(handle, &tuple) != 0 ||
-                    pcmcia_parse_tuple(handle, &tuple, &parse) != 0)
+                if (pcmcia_get_tuple_data(link, &tuple) != 0 ||
+                    pcmcia_parse_tuple(link, &tuple, &parse) != 0)
                         goto next_entry;
                 link->conf.ConfigIndex = parse.cftable_entry.index;
                 link->io.BasePort1 = parse.cftable_entry.io.win[0].base;
                 link->io.NumPorts1 = parse.cftable_entry.io.win[0].len;
 
                 if (link->io.BasePort1 != 0) {
-                        i = pcmcia_request_io(handle, &link->io);
+                        i = pcmcia_request_io(link, &link->io);
                         if (i == CS_SUCCESS)
                                 break;
                 }
 next_entry:
-                CS_CHECK(GetNextTuple, pcmcia_get_next_tuple(handle, &tuple));
+                CS_CHECK(GetNextTuple, pcmcia_get_next_tuple(link, &tuple));
         }
 
-        CS_CHECK(RequestIRQ, pcmcia_request_irq(handle, &link->irq));
-        CS_CHECK(RequestConfiguration, pcmcia_request_configuration(handle, &link->conf));
+        CS_CHECK(RequestIRQ, pcmcia_request_irq(link, &link->irq));
+        CS_CHECK(RequestConfiguration, pcmcia_request_configuration(link, &link->conf));
 
         /*
         *  That's the trouble with copying liberally from another driver.
@@ -835,7 +825,7 @@ next_entry:
         data->fast_pio = USE_FAST_PIO;
 
         sprintf(info->node.dev_name, "scsi%d", host->host_no);
-        link->dev = &info->node;
+        link->dev_node = &info->node;
         info->host = host;
 
         if (scsi_add_host(host, NULL))
@@ -843,7 +833,7 @@ next_entry:
 
         scsi_scan_host(host);
 
-        goto out;       /* SUCCESS */
+        return 0;
 
 err_free_irq:
         free_irq(irq_level, host);
@@ -852,74 +842,50 @@ err_free_scsi:
 err_release:
         release_region(port_base, 0x10);
         printk(KERN_INFO "sym53c500_cs: no SCSI devices found\n");
-
-out:
-        link->state &= ~DEV_CONFIG_PENDING;
-        return;
+        return -ENODEV;
 
 cs_failed:
-        cs_error(link->handle, last_fn, last_ret);
+        cs_error(link, last_fn, last_ret);
         SYM53C500_release(link);
-        return;
+        return -ENODEV;
 } /* SYM53C500_config */
 
-static int sym53c500_suspend(struct pcmcia_device *dev)
-{
-        dev_link_t *link = dev_to_instance(dev);
-
-        link->state |= DEV_SUSPEND;
-        if (link->state & DEV_CONFIG)
-                pcmcia_release_configuration(link->handle);
-
-        return 0;
-}
-
-static int sym53c500_resume(struct pcmcia_device *dev)
+static int sym53c500_resume(struct pcmcia_device *link)
 {
-        dev_link_t *link = dev_to_instance(dev);
         struct scsi_info_t *info = link->priv;
 
-        link->state &= ~DEV_SUSPEND;
-        if (link->state & DEV_CONFIG) {
-                pcmcia_request_configuration(link->handle, &link->conf);
-
-                /* See earlier comment about manufacturer IDs. */
-                if ((info->manf_id == MANFID_MACNICA) ||
-                    (info->manf_id == MANFID_PIONEER) ||
-                    (info->manf_id == 0x0098)) {
-                        outb(0x80, link->io.BasePort1 + 0xd);
-                        outb(0x24, link->io.BasePort1 + 0x9);
-                        outb(0x04, link->io.BasePort1 + 0xd);
-                }
-                /*
-                 *  If things don't work after a "resume",
-                 *  this is a good place to start looking.
-                 */
-                SYM53C500_int_host_reset(link->io.BasePort1);
+        /* See earlier comment about manufacturer IDs. */
+        if ((info->manf_id == MANFID_MACNICA) ||
+            (info->manf_id == MANFID_PIONEER) ||
+            (info->manf_id == 0x0098)) {
+                outb(0x80, link->io.BasePort1 + 0xd);
+                outb(0x24, link->io.BasePort1 + 0x9);
+                outb(0x04, link->io.BasePort1 + 0xd);
         }
+        /*
+         *  If things don't work after a "resume",
+         *  this is a good place to start looking.
+         */
+        SYM53C500_int_host_reset(link->io.BasePort1);
 
         return 0;
 }
 
 static void
-SYM53C500_detach(struct pcmcia_device *p_dev)
+SYM53C500_detach(struct pcmcia_device *link)
 {
-        dev_link_t *link = dev_to_instance(p_dev);
-
         DEBUG(0, "SYM53C500_detach(0x%p)\n", link);
 
-        if (link->state & DEV_CONFIG)
-                SYM53C500_release(link);
+        SYM53C500_release(link);
 
         kfree(link->priv);
         link->priv = NULL;
 } /* SYM53C500_detach */
 
 static int
-SYM53C500_attach(struct pcmcia_device *p_dev)
+SYM53C500_probe(struct pcmcia_device *link)
 {
         struct scsi_info_t *info;
-        dev_link_t *link;
 
         DEBUG(0, "SYM53C500_attach()\n");
 
@@ -928,7 +894,7 @@ SYM53C500_attach(struct pcmcia_device *p_dev)
         if (!info)
                 return -ENOMEM;
         memset(info, 0, sizeof(*info));
-        link = &info->link;
+        info->p_dev = link;
         link->priv = info;
         link->io.NumPorts1 = 16;
         link->io.Attributes1 = IO_DATA_PATH_WIDTH_AUTO;
@@ -936,17 +902,10 @@ SYM53C500_attach(struct pcmcia_device *p_dev)
         link->irq.Attributes = IRQ_TYPE_EXCLUSIVE;
         link->irq.IRQInfo1 = IRQ_LEVEL_ID;
         link->conf.Attributes = CONF_ENABLE_IRQ;
-        link->conf.Vcc = 50;
         link->conf.IntType = INT_MEMORY_AND_IO;
         link->conf.Present = PRESENT_OPTION;
 
-        link->handle = p_dev;
-        p_dev->instance = link;
-
-        link->state |= DEV_PRESENT | DEV_CONFIG_PENDING;
-        SYM53C500_config(link);
-
-        return 0;
+        return SYM53C500_config(link);
 } /* SYM53C500_attach */
 
 MODULE_AUTHOR("Bob Tracy <rct@frus.com>");
@@ -966,10 +925,9 @@ static struct pcmcia_driver sym53c500_cs_driver = {
         .drv            = {
                 .name   = "sym53c500_cs",
         },
-        .probe          = SYM53C500_attach,
+        .probe          = SYM53C500_probe,
         .remove         = SYM53C500_detach,
         .id_table       = sym53c500_ids,
-        .suspend        = sym53c500_suspend,
         .resume         = sym53c500_resume,
 };
 
diff --git a/drivers/scsi/pdc_adma.c b/drivers/scsi/pdc_adma.c
index 3c85c4b66e19..5cda16cfacb0 100644
--- a/drivers/scsi/pdc_adma.c
+++ b/drivers/scsi/pdc_adma.c
@@ -143,7 +143,6 @@ static struct scsi_host_template adma_ata_sht = {
         .name                   = DRV_NAME,
         .ioctl                  = ata_scsi_ioctl,
         .queuecommand           = ata_scsi_queuecmd,
-        .eh_strategy_handler    = ata_scsi_error,
         .can_queue              = ATA_DEF_QUEUE,
         .this_id                = ATA_SHT_THIS_ID,
         .sg_tablesize           = LIBATA_MAX_PRD,
diff --git a/drivers/scsi/sata_mv.c b/drivers/scsi/sata_mv.c
index fa901fd65085..b64b077573c2 100644
--- a/drivers/scsi/sata_mv.c
+++ b/drivers/scsi/sata_mv.c
@@ -378,7 +378,6 @@ static struct scsi_host_template mv_sht = {
         .name                   = DRV_NAME,
         .ioctl                  = ata_scsi_ioctl,
         .queuecommand           = ata_scsi_queuecmd,
-        .eh_strategy_handler    = ata_scsi_error,
         .can_queue              = MV_USE_Q_DEPTH,
         .this_id                = ATA_SHT_THIS_ID,
         .sg_tablesize           = MV_MAX_SG_CT / 2,
diff --git a/drivers/scsi/sata_nv.c b/drivers/scsi/sata_nv.c
index f77bf183dfab..9f553081b5e8 100644
--- a/drivers/scsi/sata_nv.c
+++ b/drivers/scsi/sata_nv.c
@@ -201,7 +201,6 @@ static struct scsi_host_template nv_sht = {
         .name                   = DRV_NAME,
         .ioctl                  = ata_scsi_ioctl,
         .queuecommand           = ata_scsi_queuecmd,
-        .eh_strategy_handler    = ata_scsi_error,
         .can_queue              = ATA_DEF_QUEUE,
         .this_id                = ATA_SHT_THIS_ID,
         .sg_tablesize           = LIBATA_MAX_PRD,
diff --git a/drivers/scsi/sata_promise.c b/drivers/scsi/sata_promise.c
index cc928c68a479..7eb67a6bdc64 100644
--- a/drivers/scsi/sata_promise.c
+++ b/drivers/scsi/sata_promise.c
@@ -111,7 +111,6 @@ static struct scsi_host_template pdc_ata_sht = {
         .name                   = DRV_NAME,
         .ioctl                  = ata_scsi_ioctl,
         .queuecommand           = ata_scsi_queuecmd,
-        .eh_strategy_handler    = ata_scsi_error,
         .can_queue              = ATA_DEF_QUEUE,
         .this_id                = ATA_SHT_THIS_ID,
         .sg_tablesize           = LIBATA_MAX_PRD,
diff --git a/drivers/scsi/sata_qstor.c b/drivers/scsi/sata_qstor.c
index 9ffe1ef0d205..886f3447dd48 100644
--- a/drivers/scsi/sata_qstor.c
+++ b/drivers/scsi/sata_qstor.c
@@ -132,7 +132,6 @@ static struct scsi_host_template qs_ata_sht = {
         .name                   = DRV_NAME,
         .ioctl                  = ata_scsi_ioctl,
         .queuecommand           = ata_scsi_queuecmd,
-        .eh_strategy_handler    = ata_scsi_error,
         .can_queue              = ATA_DEF_QUEUE,
         .this_id                = ATA_SHT_THIS_ID,
         .sg_tablesize           = QS_MAX_PRD,
diff --git a/drivers/scsi/sata_sil.c b/drivers/scsi/sata_sil.c
index 18c296c56899..106627299d55 100644
--- a/drivers/scsi/sata_sil.c
+++ b/drivers/scsi/sata_sil.c
@@ -146,7 +146,6 @@ static struct scsi_host_template sil_sht = {
         .name                   = DRV_NAME,
         .ioctl                  = ata_scsi_ioctl,
         .queuecommand           = ata_scsi_queuecmd,
-        .eh_strategy_handler    = ata_scsi_error,
         .can_queue              = ATA_DEF_QUEUE,
         .this_id                = ATA_SHT_THIS_ID,
         .sg_tablesize           = LIBATA_MAX_PRD,
diff --git a/drivers/scsi/sata_sil24.c b/drivers/scsi/sata_sil24.c
index 068c98a4111b..f7264fd611c2 100644
--- a/drivers/scsi/sata_sil24.c
+++ b/drivers/scsi/sata_sil24.c
@@ -281,7 +281,6 @@ static struct scsi_host_template sil24_sht = {
         .name                   = DRV_NAME,
         .ioctl                  = ata_scsi_ioctl,
         .queuecommand           = ata_scsi_queuecmd,
-        .eh_strategy_handler    = ata_scsi_error,
         .can_queue              = ATA_DEF_QUEUE,
         .this_id                = ATA_SHT_THIS_ID,
         .sg_tablesize           = LIBATA_MAX_PRD,
diff --git a/drivers/scsi/sata_sis.c b/drivers/scsi/sata_sis.c
index acc8439dea23..728530df2e07 100644
--- a/drivers/scsi/sata_sis.c
+++ b/drivers/scsi/sata_sis.c
@@ -87,7 +87,6 @@ static struct scsi_host_template sis_sht = {
         .name                   = DRV_NAME,
         .ioctl                  = ata_scsi_ioctl,
         .queuecommand           = ata_scsi_queuecmd,
-        .eh_strategy_handler    = ata_scsi_error,
         .can_queue              = ATA_DEF_QUEUE,
         .this_id                = ATA_SHT_THIS_ID,
         .sg_tablesize           = ATA_MAX_PRD,
diff --git a/drivers/scsi/sata_svw.c b/drivers/scsi/sata_svw.c
index 724f0ed6a52d..53b0d5c0a61f 100644
--- a/drivers/scsi/sata_svw.c
+++ b/drivers/scsi/sata_svw.c
@@ -290,7 +290,6 @@ static struct scsi_host_template k2_sata_sht = {
         .name                   = DRV_NAME,
         .ioctl                  = ata_scsi_ioctl,
         .queuecommand           = ata_scsi_queuecmd,
-        .eh_strategy_handler    = ata_scsi_error,
         .can_queue              = ATA_DEF_QUEUE,
         .this_id                = ATA_SHT_THIS_ID,
         .sg_tablesize           = LIBATA_MAX_PRD,
diff --git a/drivers/scsi/sata_sx4.c b/drivers/scsi/sata_sx4.c
index ae70f60c7c0d..4139ad4b1df0 100644
--- a/drivers/scsi/sata_sx4.c
+++ b/drivers/scsi/sata_sx4.c
@@ -182,7 +182,6 @@ static struct scsi_host_template pdc_sata_sht = {
         .name                   = DRV_NAME,
         .ioctl                  = ata_scsi_ioctl,
         .queuecommand           = ata_scsi_queuecmd,
-        .eh_strategy_handler    = ata_scsi_error,
         .can_queue              = ATA_DEF_QUEUE,
         .this_id                = ATA_SHT_THIS_ID,
         .sg_tablesize           = LIBATA_MAX_PRD,
diff --git a/drivers/scsi/sata_uli.c b/drivers/scsi/sata_uli.c
index 7ac5a5f5a905..38b52bd3fa3f 100644
--- a/drivers/scsi/sata_uli.c
+++ b/drivers/scsi/sata_uli.c
@@ -81,7 +81,6 @@ static struct scsi_host_template uli_sht = {
         .name                   = DRV_NAME,
         .ioctl                  = ata_scsi_ioctl,
         .queuecommand           = ata_scsi_queuecmd,
-        .eh_strategy_handler    = ata_scsi_error,
         .can_queue              = ATA_DEF_QUEUE,
         .this_id                = ATA_SHT_THIS_ID,
         .sg_tablesize           = LIBATA_MAX_PRD,
diff --git a/drivers/scsi/sata_via.c b/drivers/scsi/sata_via.c
index 791bf652ba63..9e7ae4e0db32 100644
--- a/drivers/scsi/sata_via.c
+++ b/drivers/scsi/sata_via.c
@@ -94,7 +94,6 @@ static struct scsi_host_template svia_sht = {
         .name                   = DRV_NAME,
         .ioctl                  = ata_scsi_ioctl,
         .queuecommand           = ata_scsi_queuecmd,
-        .eh_strategy_handler    = ata_scsi_error,
         .can_queue              = ATA_DEF_QUEUE,
         .this_id                = ATA_SHT_THIS_ID,
         .sg_tablesize           = LIBATA_MAX_PRD,
diff --git a/drivers/scsi/sata_vsc.c b/drivers/scsi/sata_vsc.c
index 836bbbb26ff2..8a29ce340b47 100644
--- a/drivers/scsi/sata_vsc.c
+++ b/drivers/scsi/sata_vsc.c
@@ -263,7 +263,6 @@ static struct scsi_host_template vsc_sata_sht = {
         .name                   = DRV_NAME,
         .ioctl                  = ata_scsi_ioctl,
         .queuecommand           = ata_scsi_queuecmd,
-        .eh_strategy_handler    = ata_scsi_error,
         .can_queue              = ATA_DEF_QUEUE,
         .this_id                = ATA_SHT_THIS_ID,
         .sg_tablesize           = LIBATA_MAX_PRD,
diff --git a/drivers/scsi/scsi_error.c b/drivers/scsi/scsi_error.c
index 5f0fdfb2618c..1c75646f9689 100644
--- a/drivers/scsi/scsi_error.c
+++ b/drivers/scsi/scsi_error.c
@@ -1537,8 +1537,8 @@ int scsi_error_handler(void *data)
                  * what we need to do to get it up and online again (if we can).
                  * If we fail, we end up taking the thing offline.
                  */
-                if (shost->hostt->eh_strategy_handler) 
-                        shost->hostt->eh_strategy_handler(shost);
+                if (shost->transportt->eh_strategy_handler)
+                        shost->transportt->eh_strategy_handler(shost);
                 else
                         scsi_unjam_host(shost);
 
diff --git a/drivers/serial/jsm/jsm.h b/drivers/serial/jsm/jsm.h
index dfc1e86d3aa1..043f50b1d10c 100644
--- a/drivers/serial/jsm/jsm.h
+++ b/drivers/serial/jsm/jsm.h
@@ -20,7 +20,7 @@
  *
  * Contact Information:
  * Scott H Kilau <Scott_Kilau@digi.com>
- * Wendy Xiong   <wendyx@us.ltcfwd.linux.ibm.com>
+ * Wendy Xiong   <wendyx@us.ibm.com>
  *
  ***********************************************************************/
 
diff --git a/drivers/serial/jsm/jsm_driver.c b/drivers/serial/jsm/jsm_driver.c
index b1b66e71d281..b3e1f71be4da 100644
--- a/drivers/serial/jsm/jsm_driver.c
+++ b/drivers/serial/jsm/jsm_driver.c
@@ -20,7 +20,7 @@
  *
  * Contact Information:
  * Scott H Kilau <Scott_Kilau@digi.com>
- * Wendy Xiong   <wendyx@us.ltcfwd.linux.ibm.com>
+ * Wendy Xiong   <wendyx@us.ibm.com>
  *
  *
  ***********************************************************************/
diff --git a/drivers/serial/jsm/jsm_neo.c b/drivers/serial/jsm/jsm_neo.c
index 87e4e2cf8ce7..a5fc589d6ef5 100644
--- a/drivers/serial/jsm/jsm_neo.c
+++ b/drivers/serial/jsm/jsm_neo.c
@@ -20,7 +20,7 @@
  *
  * Contact Information:
  * Scott H Kilau <Scott_Kilau@digi.com>
- * Wendy Xiong   <wendyx@us.ltcfwd.linux.ibm.com>
+ * Wendy Xiong   <wendyx@us.ibm.com>
  *
  ***********************************************************************/
 #include <linux/delay.h>        /* For udelay */
diff --git a/drivers/serial/serial_cs.c b/drivers/serial/serial_cs.c
index c30333694fde..2c70773543e0 100644
--- a/drivers/serial/serial_cs.c
+++ b/drivers/serial/serial_cs.c
@@ -41,6 +41,7 @@
 #include <linux/string.h>
 #include <linux/timer.h>
 #include <linux/serial_core.h>
+#include <linux/delay.h>
 #include <linux/major.h>
 #include <asm/io.h>
 #include <asm/system.h>
@@ -97,11 +98,13 @@ static const struct multi_id multi_id[] = {
 #define MULTI_COUNT (sizeof(multi_id)/sizeof(struct multi_id))
 
 struct serial_info {
-        dev_link_t              link;
+        struct pcmcia_device    *p_dev;
         int                     ndev;
         int                     multi;
         int                     slave;
         int                     manfid;
+        int                     prodid;
+        int                     c950ctrl;
         dev_node_t              node[4];
         int                     line[4];
 };
@@ -113,9 +116,36 @@ struct serial_cfg_mem {
 };
 
 
-static void serial_config(dev_link_t * link);
+static int serial_config(struct pcmcia_device * link);
 
 
+static void wakeup_card(struct serial_info *info)
+{
+        int ctrl = info->c950ctrl;
+
+        if (info->manfid == MANFID_OXSEMI) {
+                outb(12, ctrl + 1);
+        } else if (info->manfid == MANFID_POSSIO && info->prodid == PRODID_POSSIO_GCC) {
+                /* request_region? oxsemi branch does no request_region too... */
+                /* This sequence is needed to properly initialize MC45 attached to OXCF950.
+                 * I tried decreasing these msleep()s, but it worked properly (survived
+                 * 1000 stop/start operations) with these timeouts (or bigger). */
+                outb(0xA, ctrl + 1);
+                msleep(100);
+                outb(0xE, ctrl + 1);
+                msleep(300);
+                outb(0xC, ctrl + 1);
+                msleep(100);
+                outb(0xE, ctrl + 1);
+                msleep(200);
+                outb(0xF, ctrl + 1);
+                msleep(100);
+                outb(0xE, ctrl + 1);
+                msleep(100);
+                outb(0xC, ctrl + 1);
+        }
+}
+
 /*======================================================================
 
     After a card is removed, serial_remove() will unregister
@@ -123,67 +153,45 @@ static void serial_config(dev_link_t * link);
     
 ======================================================================*/
 
-static void serial_remove(dev_link_t *link)
+static void serial_remove(struct pcmcia_device *link)
 {
         struct serial_info *info = link->priv;
         int i;
 
-        link->state &= ~DEV_PRESENT;
-
         DEBUG(0, "serial_release(0x%p)\n", link);
 
         /*
          * Recheck to see if the device is still configured.
          */
-        if (info->link.state & DEV_CONFIG) {
-                for (i = 0; i < info->ndev; i++)
-                        serial8250_unregister_port(info->line[i]);
+        for (i = 0; i < info->ndev; i++)
+                serial8250_unregister_port(info->line[i]);
 
-                info->link.dev = NULL;
+        info->p_dev->dev_node = NULL;
 
-                if (!info->slave) {
-                        pcmcia_release_configuration(info->link.handle);
-                        pcmcia_release_io(info->link.handle, &info->link.io);
-                        pcmcia_release_irq(info->link.handle, &info->link.irq);
-                }
-
-                info->link.state &= ~DEV_CONFIG;
-        }
+        if (!info->slave)
+                pcmcia_disable_device(link);
 }
 
-static int serial_suspend(struct pcmcia_device *dev)
+static int serial_suspend(struct pcmcia_device *link)
 {
-        dev_link_t *link = dev_to_instance(dev);
-        link->state |= DEV_SUSPEND;
-
-        if (link->state & DEV_CONFIG) {
-                struct serial_info *info = link->priv;
-                int i;
-
-                for (i = 0; i < info->ndev; i++)
-                        serial8250_suspend_port(info->line[i]);
+        struct serial_info *info = link->priv;
+        int i;
 
-                if (!info->slave)
-                        pcmcia_release_configuration(link->handle);
-        }
+        for (i = 0; i < info->ndev; i++)
+                serial8250_suspend_port(info->line[i]);
 
         return 0;
 }
 
-static int serial_resume(struct pcmcia_device *dev)
+static int serial_resume(struct pcmcia_device *link)
 {
-        dev_link_t *link = dev_to_instance(dev);
-        link->state &= ~DEV_SUSPEND;
-
-        if (DEV_OK(link)) {
+        if (pcmcia_dev_present(link)) {
                 struct serial_info *info = link->priv;
                 int i;
 
-                if (!info->slave)
-                        pcmcia_request_configuration(link->handle, &link->conf);
-
                 for (i = 0; i < info->ndev; i++)
                         serial8250_resume_port(info->line[i]);
+                wakeup_card(info);
         }
 
         return 0;
@@ -197,10 +205,9 @@ static int serial_resume(struct pcmcia_device *dev)
 
 ======================================================================*/
 
-static int serial_probe(struct pcmcia_device *p_dev)
+static int serial_probe(struct pcmcia_device *link)
 {
         struct serial_info *info;
-        dev_link_t *link;
 
         DEBUG(0, "serial_attach()\n");
 
@@ -209,7 +216,7 @@ static int serial_probe(struct pcmcia_device *p_dev)
         if (!info)
                 return -ENOMEM;
         memset(info, 0, sizeof (*info));
-        link = &info->link;
+        info->p_dev = link;
         link->priv = info;
 
         link->io.Attributes1 = IO_DATA_PATH_WIDTH_8;
@@ -223,12 +230,7 @@ static int serial_probe(struct pcmcia_device *p_dev)
         }
         link->conf.IntType = INT_MEMORY_AND_IO;
 
-        link->handle = p_dev;
-        p_dev->instance = link;
-        link->state |= DEV_PRESENT | DEV_CONFIG_PENDING;
-        serial_config(link);
-
-        return 0;
+        return serial_config(link);
 }
 
 /*======================================================================
@@ -240,9 +242,8 @@ static int serial_probe(struct pcmcia_device *p_dev)
 
 ======================================================================*/
 
-static void serial_detach(struct pcmcia_device *p_dev)
+static void serial_detach(struct pcmcia_device *link)
 {
-        dev_link_t *link = dev_to_instance(p_dev);
         struct serial_info *info = link->priv;
 
         DEBUG(0, "serial_detach(0x%p)\n", link);
@@ -263,7 +264,7 @@ static void serial_detach(struct pcmcia_device *p_dev)
 
 /*====================================================================*/
 
-static int setup_serial(client_handle_t handle, struct serial_info * info,
+static int setup_serial(struct pcmcia_device *handle, struct serial_info * info,
                         kio_addr_t iobase, int irq)
 {
         struct uart_port port;
@@ -298,7 +299,7 @@ static int setup_serial(client_handle_t handle, struct serial_info * info,
 /*====================================================================*/
 
 static int
-first_tuple(client_handle_t handle, tuple_t * tuple, cisparse_t * parse)
+first_tuple(struct pcmcia_device *handle, tuple_t * tuple, cisparse_t * parse)
 {
         int i;
         i = pcmcia_get_first_tuple(handle, tuple);
@@ -311,7 +312,7 @@ first_tuple(client_handle_t handle, tuple_t * tuple, cisparse_t * parse)
 }
 
 static int
-next_tuple(client_handle_t handle, tuple_t * tuple, cisparse_t * parse)
+next_tuple(struct pcmcia_device *handle, tuple_t * tuple, cisparse_t * parse)
 {
         int i;
         i = pcmcia_get_next_tuple(handle, tuple);
@@ -325,11 +326,10 @@ next_tuple(client_handle_t handle, tuple_t * tuple, cisparse_t * parse)
 
 /*====================================================================*/
 
-static int simple_config(dev_link_t *link)
+static int simple_config(struct pcmcia_device *link)
 {
         static const kio_addr_t base[5] = { 0x3f8, 0x2f8, 0x3e8, 0x2e8, 0x0 };
         static const int size_table[2] = { 8, 16 };
-        client_handle_t handle = link->handle;
         struct serial_info *info = link->priv;
         struct serial_cfg_mem *cfg_mem;
         tuple_t *tuple;
@@ -350,7 +350,7 @@ static int simple_config(dev_link_t *link)
         buf = cfg_mem->buf;
 
         /* If the card is already configured, look up the port and irq */
-        i = pcmcia_get_configuration_info(handle, &config);
+        i = pcmcia_get_configuration_info(link, &config);
         if ((i == CS_SUCCESS) && (config.Attributes & CONF_VALID_CLIENT)) {
                 kio_addr_t port = 0;
                 if ((config.BasePort2 != 0) && (config.NumPorts2 == 8)) {
@@ -363,10 +363,9 @@ static int simple_config(dev_link_t *link)
                 }
                 if (info->slave) {
                         kfree(cfg_mem);
-                        return setup_serial(handle, info, port, config.AssignedIRQ);
+                        return setup_serial(link, info, port, config.AssignedIRQ);
                 }
         }
-        link->conf.Vcc = config.Vcc;
 
         /* First pass: look for a config entry that looks normal. */
         tuple->TupleData = (cisdata_t *) buf;
@@ -377,12 +376,12 @@ static int simple_config(dev_link_t *link)
         /* Two tries: without IO aliases, then with aliases */
         for (s = 0; s < 2; s++) {
                 for (try = 0; try < 2; try++) {
-                        i = first_tuple(handle, tuple, parse);
+                        i = first_tuple(link, tuple, parse);
                         while (i != CS_NO_MORE_ITEMS) {
                                 if (i != CS_SUCCESS)
                                         goto next_entry;
                                 if (cf->vpp1.present & (1 << CISTPL_POWER_VNOM))
-                                        link->conf.Vpp1 = link->conf.Vpp2 =
+                                        link->conf.Vpp =
                                             cf->vpp1.param[CISTPL_POWER_VNOM] / 10000;
                                 if ((cf->io.nwin > 0) && (cf->io.win[0].len == size_table[s]) &&
                                             (cf->io.win[0].base != 0)) {
@@ -390,19 +389,19 @@ static int simple_config(dev_link_t *link)
                                         link->io.BasePort1 = cf->io.win[0].base;
                                         link->io.IOAddrLines = (try == 0) ?
                                             16 : cf->io.flags & CISTPL_IO_LINES_MASK;
-                                        i = pcmcia_request_io(link->handle, &link->io);
+                                        i = pcmcia_request_io(link, &link->io);
                                         if (i == CS_SUCCESS)
                                                 goto found_port;
                                 }
 next_entry:
-                                i = next_tuple(handle, tuple, parse);
+                                i = next_tuple(link, tuple, parse);
                         }
                 }
         }
         /* Second pass: try to find an entry that isn't picky about
            its base address, then try to grab any standard serial port
            address, and finally try to get any free port. */
-        i = first_tuple(handle, tuple, parse);
+        i = first_tuple(link, tuple, parse);
         while (i != CS_NO_MORE_ITEMS) {
                 if ((i == CS_SUCCESS) && (cf->io.nwin > 0) &&
                     ((cf->io.flags & CISTPL_IO_LINES_MASK) <= 3)) {
@@ -410,50 +409,48 @@ next_entry:
                         for (j = 0; j < 5; j++) {
                                 link->io.BasePort1 = base[j];
                                 link->io.IOAddrLines = base[j] ? 16 : 3;
-                                i = pcmcia_request_io(link->handle, &link->io);
+                                i = pcmcia_request_io(link, &link->io);
                                 if (i == CS_SUCCESS)
                                         goto found_port;
                         }
                 }
-                i = next_tuple(handle, tuple, parse);
+                i = next_tuple(link, tuple, parse);
         }
 
       found_port:
         if (i != CS_SUCCESS) {
                 printk(KERN_NOTICE
                        "serial_cs: no usable port range found, giving up\n");
-                cs_error(link->handle, RequestIO, i);
+                cs_error(link, RequestIO, i);
                 kfree(cfg_mem);
                 return -1;
         }
 
-        i = pcmcia_request_irq(link->handle, &link->irq);
+        i = pcmcia_request_irq(link, &link->irq);
         if (i != CS_SUCCESS) {
-                cs_error(link->handle, RequestIRQ, i);
+                cs_error(link, RequestIRQ, i);
                 link->irq.AssignedIRQ = 0;
         }
         if (info->multi && (info->manfid == MANFID_3COM))
                 link->conf.ConfigIndex &= ~(0x08);
-        i = pcmcia_request_configuration(link->handle, &link->conf);
+        i = pcmcia_request_configuration(link, &link->conf);
         if (i != CS_SUCCESS) {
-                cs_error(link->handle, RequestConfiguration, i);
+                cs_error(link, RequestConfiguration, i);
                 kfree(cfg_mem);
                 return -1;
         }
         kfree(cfg_mem);
-        return setup_serial(handle, info, link->io.BasePort1, link->irq.AssignedIRQ);
+        return setup_serial(link, info, link->io.BasePort1, link->irq.AssignedIRQ);
 }
 
-static int multi_config(dev_link_t * link)
+static int multi_config(struct pcmcia_device * link)
 {
-        client_handle_t handle = link->handle;
         struct serial_info *info = link->priv;
         struct serial_cfg_mem *cfg_mem;
         tuple_t *tuple;
         u_char *buf;
         cisparse_t *parse;
         cistpl_cftable_entry_t *cf;
-        config_info_t config;
         int i, rc, base2 = 0;
 
         cfg_mem = kmalloc(sizeof(struct serial_cfg_mem), GFP_KERNEL);
@@ -464,14 +461,6 @@ static int multi_config(dev_link_t * link)
         cf = &parse->cftable_entry;
         buf = cfg_mem->buf;
 
-        i = pcmcia_get_configuration_info(handle, &config);
-        if (i != CS_SUCCESS) {
-                cs_error(handle, GetConfigurationInfo, i);
-                rc = -1;
-                goto free_cfg_mem;
-        }
-        link->conf.Vcc = config.Vcc;
-
         tuple->TupleData = (cisdata_t *) buf;
         tuple->TupleOffset = 0;
         tuple->TupleDataMax = 255;
@@ -480,7 +469,7 @@ static int multi_config(dev_link_t * link)
 
         /* First, look for a generic full-sized window */
         link->io.NumPorts1 = info->multi * 8;
-        i = first_tuple(handle, tuple, parse);
+        i = first_tuple(link, tuple, parse);
         while (i != CS_NO_MORE_ITEMS) {
                 /* The quad port cards have bad CIS's, so just look for a
                    window larger than 8 ports and assume it will be right */
@@ -490,19 +479,19 @@ static int multi_config(dev_link_t * link)
                         link->io.BasePort1 = cf->io.win[0].base;
                         link->io.IOAddrLines =
                             cf->io.flags & CISTPL_IO_LINES_MASK;
-                        i = pcmcia_request_io(link->handle, &link->io);
+                        i = pcmcia_request_io(link, &link->io);
                         base2 = link->io.BasePort1 + 8;
                         if (i == CS_SUCCESS)
                                 break;
                 }
-                i = next_tuple(handle, tuple, parse);
+                i = next_tuple(link, tuple, parse);
         }
 
         /* If that didn't work, look for two windows */
         if (i != CS_SUCCESS) {
                 link->io.NumPorts1 = link->io.NumPorts2 = 8;
                 info->multi = 2;
-                i = first_tuple(handle, tuple, parse);
+                i = first_tuple(link, tuple, parse);
                 while (i != CS_NO_MORE_ITEMS) {
                         if ((i == CS_SUCCESS) && (cf->io.nwin == 2)) {
                                 link->conf.ConfigIndex = cf->index;
@@ -510,26 +499,26 @@ static int multi_config(dev_link_t * link)
                                 link->io.BasePort2 = cf->io.win[1].base;
                                 link->io.IOAddrLines =
                                     cf->io.flags & CISTPL_IO_LINES_MASK;
-                                i = pcmcia_request_io(link->handle, &link->io);
+                                i = pcmcia_request_io(link, &link->io);
                                 base2 = link->io.BasePort2;
                                 if (i == CS_SUCCESS)
                                         break;
                         }
-                        i = next_tuple(handle, tuple, parse);
+                        i = next_tuple(link, tuple, parse);
                 }
         }
 
         if (i != CS_SUCCESS) {
-                cs_error(link->handle, RequestIO, i);
+                cs_error(link, RequestIO, i);
                 rc = -1;
                 goto free_cfg_mem;
         }
 
-        i = pcmcia_request_irq(link->handle, &link->irq);
+        i = pcmcia_request_irq(link, &link->irq);
         if (i != CS_SUCCESS) {
                 printk(KERN_NOTICE
                        "serial_cs: no usable port range found, giving up\n");
-                cs_error(link->handle, RequestIRQ, i);
+                cs_error(link, RequestIRQ, i);
                 link->irq.AssignedIRQ = 0;
         }
         /* Socket Dual IO: this enables irq's for second port */
@@ -537,35 +526,43 @@ static int multi_config(dev_link_t * link)
                 link->conf.Present |= PRESENT_EXT_STATUS;
                 link->conf.ExtStatus = ESR_REQ_ATTN_ENA;
         }
-        i = pcmcia_request_configuration(link->handle, &link->conf);
+        i = pcmcia_request_configuration(link, &link->conf);
         if (i != CS_SUCCESS) {
-                cs_error(link->handle, RequestConfiguration, i);
+                cs_error(link, RequestConfiguration, i);
                 rc = -1;
                 goto free_cfg_mem;
         }
 
         /* The Oxford Semiconductor OXCF950 cards are in fact single-port:
-           8 registers are for the UART, the others are extra registers */
-        if (info->manfid == MANFID_OXSEMI) {
+         * 8 registers are for the UART, the others are extra registers.
+         * Siemen's MC45 PCMCIA (Possio's GCC) is OXCF950 based too.
+         */
+        if (info->manfid == MANFID_OXSEMI || (info->manfid == MANFID_POSSIO &&
+                                info->prodid == PRODID_POSSIO_GCC)) {
+                int err;
+
                 if (cf->index == 1 || cf->index == 3) {
-                        setup_serial(handle, info, base2, link->irq.AssignedIRQ);
-                        outb(12, link->io.BasePort1 + 1);
+                        err = setup_serial(link, info, base2,
+                                        link->irq.AssignedIRQ);
+                        base2 = link->io.BasePort1;
                 } else {
-                        setup_serial(handle, info, link->io.BasePort1, link->irq.AssignedIRQ);
-                        outb(12, base2 + 1);
+                        err = setup_serial(link, info, link->io.BasePort1,
+                                        link->irq.AssignedIRQ);
                 }
+                info->c950ctrl = base2;
+                wakeup_card(info);
                 rc = 0;
                 goto free_cfg_mem;
         }
 
-        setup_serial(handle, info, link->io.BasePort1, link->irq.AssignedIRQ);
+        setup_serial(link, info, link->io.BasePort1, link->irq.AssignedIRQ);
         /* The Nokia cards are not really multiport cards */
         if (info->manfid == MANFID_NOKIA) {
                 rc = 0;
                 goto free_cfg_mem;
         }
         for (i = 0; i < info->multi - 1; i++)
-                setup_serial(handle, info, base2 + (8 * i),
+                setup_serial(link, info, base2 + (8 * i),
                                 link->irq.AssignedIRQ);
         rc = 0;
 free_cfg_mem:
@@ -581,9 +578,8 @@ free_cfg_mem:
 
 ======================================================================*/
 
-void serial_config(dev_link_t * link)
+static int serial_config(struct pcmcia_device * link)
 {
-        client_handle_t handle = link->handle;
         struct serial_info *info = link->priv;
         struct serial_cfg_mem *cfg_mem;
         tuple_t *tuple;
@@ -609,7 +605,7 @@ void serial_config(dev_link_t * link)
         tuple->Attributes = 0;
         /* Get configuration register information */
         tuple->DesiredTuple = CISTPL_CONFIG;
-        last_ret = first_tuple(handle, tuple, parse);
+        last_ret = first_tuple(link, tuple, parse);
         if (last_ret != CS_SUCCESS) {
                 last_fn = ParseTuple;
                 goto cs_failed;
@@ -617,18 +613,16 @@ void serial_config(dev_link_t * link)
         link->conf.ConfigBase = parse->config.base;
         link->conf.Present = parse->config.rmask[0];
 
-        /* Configure card */
-        link->state |= DEV_CONFIG;
-
         /* Is this a compliant multifunction card? */
         tuple->DesiredTuple = CISTPL_LONGLINK_MFC;
         tuple->Attributes = TUPLE_RETURN_COMMON | TUPLE_RETURN_LINK;
-        info->multi = (first_tuple(handle, tuple, parse) == CS_SUCCESS);
+        info->multi = (first_tuple(link, tuple, parse) == CS_SUCCESS);
 
         /* Is this a multiport card? */
         tuple->DesiredTuple = CISTPL_MANFID;
-        if (first_tuple(handle, tuple, parse) == CS_SUCCESS) {
+        if (first_tuple(link, tuple, parse) == CS_SUCCESS) {
                 info->manfid = parse->manfid.manf;
+                info->prodid = le16_to_cpu(buf[1]);
                 for (i = 0; i < MULTI_COUNT; i++)
                         if ((info->manfid == multi_id[i].manfid) &&
                             (parse->manfid.card == multi_id[i].prodid))
@@ -641,11 +635,11 @@ void serial_config(dev_link_t * link)
            multifunction cards that ask for appropriate IO port ranges */
         tuple->DesiredTuple = CISTPL_FUNCID;
         if ((info->multi == 0) &&
-            ((first_tuple(handle, tuple, parse) != CS_SUCCESS) ||
+            ((first_tuple(link, tuple, parse) != CS_SUCCESS) ||
              (parse->funcid.func == CISTPL_FUNCID_MULTI) ||
              (parse->funcid.func == CISTPL_FUNCID_SERIAL))) {
                 tuple->DesiredTuple = CISTPL_CFTABLE_ENTRY;
-                if (first_tuple(handle, tuple, parse) == CS_SUCCESS) {
+                if (first_tuple(link, tuple, parse) == CS_SUCCESS) {
                         if ((cf->io.nwin == 1) && (cf->io.win[0].len % 8 == 0))
                                 info->multi = cf->io.win[0].len >> 3;
                         if ((cf->io.nwin == 2) && (cf->io.win[0].len == 8) &&
@@ -664,31 +658,30 @@ void serial_config(dev_link_t * link)
 
         if (info->manfid == MANFID_IBM) {
                 conf_reg_t reg = { 0, CS_READ, 0x800, 0 };
-                last_ret = pcmcia_access_configuration_register(link->handle, &reg);
+                last_ret = pcmcia_access_configuration_register(link, &reg);
                 if (last_ret) {
                         last_fn = AccessConfigurationRegister;
                         goto cs_failed;
                 }
                 reg.Action = CS_WRITE;
                 reg.Value = reg.Value | 1;
-                last_ret = pcmcia_access_configuration_register(link->handle, &reg);
+                last_ret = pcmcia_access_configuration_register(link, &reg);
                 if (last_ret) {
                         last_fn = AccessConfigurationRegister;
                         goto cs_failed;
                 }
         }
 
-        link->dev = &info->node[0];
-        link->state &= ~DEV_CONFIG_PENDING;
+        link->dev_node = &info->node[0];
         kfree(cfg_mem);
-        return;
+        return 0;
 
  cs_failed:
-        cs_error(link->handle, last_fn, last_ret);
+        cs_error(link, last_fn, last_ret);
  failed:
         serial_remove(link);
-        link->state &= ~DEV_CONFIG_PENDING;
         kfree(cfg_mem);
+        return -ENODEV;
 }
 
 static struct pcmcia_device_id serial_ids[] = {
@@ -739,6 +732,7 @@ static struct pcmcia_device_id serial_ids[] = {
         PCMCIA_MFC_DEVICE_PROD_ID1(1, "Motorola MARQUIS", 0xf03e4e77),
         PCMCIA_MFC_DEVICE_PROD_ID2(1, "FAX/Modem/Ethernet Combo Card ", 0x1ed59302),
         PCMCIA_DEVICE_MANF_CARD(0x0089, 0x0301),
+        PCMCIA_DEVICE_MANF_CARD(0x00a4, 0x0276),
         PCMCIA_DEVICE_MANF_CARD(0x0101, 0x0039),
         PCMCIA_DEVICE_MANF_CARD(0x0104, 0x0006),
         PCMCIA_DEVICE_MANF_CARD(0x0105, 0x410a),
@@ -757,6 +751,7 @@ static struct pcmcia_device_id serial_ids[] = {
         PCMCIA_DEVICE_PROD_ID14("MEGAHERTZ", "PCMCIA MODEM", 0xf510db04, 0xbd6c43ef),
         PCMCIA_DEVICE_PROD_ID124("TOSHIBA", "T144PF", "PCMCIA MODEM", 0xb4585a1a, 0x7271409c, 0xbd6c43ef),
         PCMCIA_DEVICE_PROD_ID123("FUJITSU", "FC14F ", "MBH10213", 0x6ee5a3d8, 0x30ead12b, 0xb00f05a0),
+        PCMCIA_DEVICE_PROD_ID123("Novatel Wireless", "Merlin UMTS Modem", "U630", 0x32607776, 0xd9e73b13, 0xe87332e),
         PCMCIA_DEVICE_PROD_ID13("MEGAHERTZ", "V.34 PCMCIA MODEM", 0xf510db04, 0xbb2cce4a),
         PCMCIA_DEVICE_PROD_ID12("Brain Boxes", "Bluetooth PC Card", 0xee138382, 0xd4ce9b02),
         PCMCIA_DEVICE_PROD_ID12("CIRRUS LOGIC", "FAX MODEM", 0xe625f451, 0xcecd6dfa),
diff --git a/drivers/sn/ioc3.c b/drivers/sn/ioc3.c
index 93449a1a0065..0b49ff78efc1 100644
--- a/drivers/sn/ioc3.c
+++ b/drivers/sn/ioc3.c
@@ -11,6 +11,7 @@
 #include <linux/errno.h>
 #include <linux/module.h>
 #include <linux/pci.h>
+#include <linux/dma-mapping.h>
 #include <linux/interrupt.h>
 #include <linux/spinlock.h>
 #include <linux/delay.h>
@@ -619,9 +620,9 @@ static int ioc3_probe(struct pci_dev *pdev, const struct pci_device_id *pci_id)
         pci_set_master(pdev);
 
 #ifdef USE_64BIT_DMA
-        ret = pci_set_dma_mask(pdev, 0xffffffffffffffffULL);
+        ret = pci_set_dma_mask(pdev, DMA_64BIT_MASK);
         if (!ret) {
-                ret = pci_set_consistent_dma_mask(pdev, 0xffffffffffffffffULL);
+                ret = pci_set_consistent_dma_mask(pdev, DMA_64BIT_MASK);
                 if (ret < 0) {
                         printk(KERN_WARNING "%s: Unable to obtain 64 bit DMA "
                                "for consistent allocations\n",
diff --git a/drivers/telephony/ixj_pcmcia.c b/drivers/telephony/ixj_pcmcia.c
index d3a7b0c3d38b..dda0ca45d904 100644
--- a/drivers/telephony/ixj_pcmcia.c
+++ b/drivers/telephony/ixj_pcmcia.c
@@ -35,73 +35,52 @@ typedef struct ixj_info_t {
 } ixj_info_t;
 
 static void ixj_detach(struct pcmcia_device *p_dev);
-static void ixj_config(dev_link_t * link);
-static void ixj_cs_release(dev_link_t * link);
+static int ixj_config(struct pcmcia_device * link);
+static void ixj_cs_release(struct pcmcia_device * link);
 
-static int ixj_attach(struct pcmcia_device *p_dev)
+static int ixj_probe(struct pcmcia_device *p_dev)
 {
-        dev_link_t *link;
-
         DEBUG(0, "ixj_attach()\n");
         /* Create new ixj device */
-        link = kmalloc(sizeof(struct dev_link_t), GFP_KERNEL);
-        if (!link)
-                return -ENOMEM;
-        memset(link, 0, sizeof(struct dev_link_t));
-        link->io.Attributes1 = IO_DATA_PATH_WIDTH_8;
-        link->io.Attributes2 = IO_DATA_PATH_WIDTH_8;
-        link->io.IOAddrLines = 3;
-        link->conf.Vcc = 50;
-        link->conf.IntType = INT_MEMORY_AND_IO;
-        link->priv = kmalloc(sizeof(struct ixj_info_t), GFP_KERNEL);
-        if (!link->priv) {
-                kfree(link);
+        p_dev->io.Attributes1 = IO_DATA_PATH_WIDTH_8;
+        p_dev->io.Attributes2 = IO_DATA_PATH_WIDTH_8;
+        p_dev->io.IOAddrLines = 3;
+        p_dev->conf.IntType = INT_MEMORY_AND_IO;
+        p_dev->priv = kmalloc(sizeof(struct ixj_info_t), GFP_KERNEL);
+        if (!p_dev->priv) {
                 return -ENOMEM;
         }
-        memset(link->priv, 0, sizeof(struct ixj_info_t));
-
-        link->handle = p_dev;
-        p_dev->instance = link;
+        memset(p_dev->priv, 0, sizeof(struct ixj_info_t));
 
-        link->state |= DEV_PRESENT | DEV_CONFIG_PENDING;
-        ixj_config(link);
-
-        return 0;
+        return ixj_config(p_dev);
 }
 
-static void ixj_detach(struct pcmcia_device *p_dev)
+static void ixj_detach(struct pcmcia_device *link)
 {
-        dev_link_t *link = dev_to_instance(p_dev);
-
         DEBUG(0, "ixj_detach(0x%p)\n", link);
 
-        link->state &= ~DEV_RELEASE_PENDING;
-        if (link->state & DEV_CONFIG)
-                ixj_cs_release(link);
+        ixj_cs_release(link);
 
         kfree(link->priv);
-        kfree(link);
 }
 
 #define CS_CHECK(fn, ret) \
 do { last_fn = (fn); if ((last_ret = (ret)) != 0) goto cs_failed; } while (0)
 
-static void ixj_get_serial(dev_link_t * link, IXJ * j)
+static void ixj_get_serial(struct pcmcia_device * link, IXJ * j)
 {
-        client_handle_t handle;
         tuple_t tuple;
         u_short buf[128];
         char *str;
         int last_ret, last_fn, i, place;
-        handle = link->handle;
         DEBUG(0, "ixj_get_serial(0x%p)\n", link);
         tuple.TupleData = (cisdata_t *) buf;
         tuple.TupleOffset = 0;
         tuple.TupleDataMax = 80;
         tuple.Attributes = 0;
         tuple.DesiredTuple = CISTPL_VERS_1;
-        CS_CHECK(GetFirstTuple, pcmcia_get_first_tuple(handle, &tuple));
-        CS_CHECK(GetTupleData, pcmcia_get_tuple_data(handle, &tuple));
+        CS_CHECK(GetFirstTuple, pcmcia_get_first_tuple(link, &tuple));
+        CS_CHECK(GetTupleData, pcmcia_get_tuple_data(link, &tuple));
         str = (char *) buf;
         printk("PCMCIA Version %d.%d\n", str[0], str[1]);
         str += 2;
@@ -149,22 +128,19 @@ static void ixj_get_serial(dev_link_t * link, IXJ * j)
         return;
 }
 
-static void ixj_config(dev_link_t * link)
+static int ixj_config(struct pcmcia_device * link)
 {
         IXJ *j;
-        client_handle_t handle;
         ixj_info_t *info;
         tuple_t tuple;
         u_short buf[128];
         cisparse_t parse;
-        config_info_t conf;
         cistpl_cftable_entry_t *cfg = &parse.cftable_entry;
         cistpl_cftable_entry_t dflt =
         {
                 0
         };
         int last_ret, last_fn;
-        handle = link->handle;
         info = link->priv;
         DEBUG(0, "ixj_config(0x%p)\n", link);
         tuple.TupleData = (cisdata_t *) buf;
@@ -172,19 +148,17 @@ static void ixj_config(dev_link_t * link)
         tuple.TupleDataMax = 255;
         tuple.Attributes = 0;
         tuple.DesiredTuple = CISTPL_CONFIG;
-        CS_CHECK(GetFirstTuple, pcmcia_get_first_tuple(handle, &tuple));
-        CS_CHECK(GetTupleData, pcmcia_get_tuple_data(handle, &tuple));
-        CS_CHECK(ParseTuple, pcmcia_parse_tuple(handle, &tuple, &parse));
+        CS_CHECK(GetFirstTuple, pcmcia_get_first_tuple(link, &tuple));
+        CS_CHECK(GetTupleData, pcmcia_get_tuple_data(link, &tuple));
+        CS_CHECK(ParseTuple, pcmcia_parse_tuple(link, &tuple, &parse));
         link->conf.ConfigBase = parse.config.base;
         link->conf.Present = parse.config.rmask[0];
-        link->state |= DEV_CONFIG;
-        CS_CHECK(GetConfigurationInfo, pcmcia_get_configuration_info(handle, &conf));
         tuple.DesiredTuple = CISTPL_CFTABLE_ENTRY;
         tuple.Attributes = 0;
-        CS_CHECK(GetFirstTuple, pcmcia_get_first_tuple(handle, &tuple));
+        CS_CHECK(GetFirstTuple, pcmcia_get_first_tuple(link, &tuple));
         while (1) {
-                if (pcmcia_get_tuple_data(handle, &tuple) != 0 ||
-                                pcmcia_parse_tuple(handle, &tuple, &parse) != 0)
+                if (pcmcia_get_tuple_data(link, &tuple) != 0 ||
+                                pcmcia_parse_tuple(link, &tuple, &parse) != 0)
                         goto next_entry;
                 if ((cfg->io.nwin > 0) || (dflt.io.nwin > 0)) {
                         cistpl_io_t *io = (cfg->io.nwin) ? &cfg->io : &dflt.io;
@@ -195,7 +169,7 @@ static void ixj_config(dev_link_t * link)
                                 link->io.BasePort2 = io->win[1].base;
                                 link->io.NumPorts2 = io->win[1].len;
                         }
-                        if (pcmcia_request_io(link->handle, &link->io) != 0)
+                        if (pcmcia_request_io(link, &link->io) != 0)
                                 goto next_entry;
                         /* If we've got this far, we're done */
                         break;
@@ -203,10 +177,10 @@ static void ixj_config(dev_link_t * link)
               next_entry:
                 if (cfg->flags & CISTPL_CFTABLE_DEFAULT)
                         dflt = *cfg;
-                CS_CHECK(GetNextTuple, pcmcia_get_next_tuple(handle, &tuple));
+                CS_CHECK(GetNextTuple, pcmcia_get_next_tuple(link, &tuple));
         }
 
-        CS_CHECK(RequestConfiguration, pcmcia_request_configuration(handle, &link->conf));
+        CS_CHECK(RequestConfiguration, pcmcia_request_configuration(link, &link->conf));
 
         /*
          *      Register the card with the core.
@@ -215,46 +189,21 @@ static void ixj_config(dev_link_t * link)
 
         info->ndev = 1;
         info->node.major = PHONE_MAJOR;
-        link->dev = &info->node;
+        link->dev_node = &info->node;
         ixj_get_serial(link, j);
-        link->state &= ~DEV_CONFIG_PENDING;
-        return;
+        return 0;
       cs_failed:
-        cs_error(link->handle, last_fn, last_ret);
+        cs_error(link, last_fn, last_ret);
         ixj_cs_release(link);
+        return -ENODEV;
 }
 
-static void ixj_cs_release(dev_link_t *link)
+static void ixj_cs_release(struct pcmcia_device *link)
 {
         ixj_info_t *info = link->priv;
         DEBUG(0, "ixj_cs_release(0x%p)\n", link);
         info->ndev = 0;
-        link->dev = NULL;
-        pcmcia_release_configuration(link->handle);
-        pcmcia_release_io(link->handle, &link->io);
-        link->state &= ~DEV_CONFIG;
-}
-
-static int ixj_suspend(struct pcmcia_device *dev)
-{
-        dev_link_t *link = dev_to_instance(dev);
-
-        link->state |= DEV_SUSPEND;
-        if (link->state & DEV_CONFIG)
-                pcmcia_release_configuration(link->handle);
-
-        return 0;
-}
-
-static int ixj_resume(struct pcmcia_device *dev)
-{
-        dev_link_t *link = dev_to_instance(dev);
-
-        link->state &= ~DEV_SUSPEND;
-        if (DEV_OK(link))
-                pcmcia_request_configuration(link->handle, &link->conf);
-
-        return 0;
+        pcmcia_disable_device(link);
 }
 
 static struct pcmcia_device_id ixj_ids[] = {
@@ -268,11 +217,9 @@ static struct pcmcia_driver ixj_driver = {
         .drv            = {
                 .name   = "ixj_cs",
         },
-        .probe          = ixj_attach,
+        .probe          = ixj_probe,
         .remove         = ixj_detach,
         .id_table       = ixj_ids,
-        .suspend        = ixj_suspend,
-        .resume         = ixj_resume,
 };
 
 static int __init ixj_pcmcia_init(void)
diff --git a/drivers/usb/host/sl811_cs.c b/drivers/usb/host/sl811_cs.c
index 134d2000128a..302aa1ec312f 100644
--- a/drivers/usb/host/sl811_cs.c
+++ b/drivers/usb/host/sl811_cs.c
@@ -67,11 +67,11 @@ module_param(pc_debug, int, 0644);
 static const char driver_name[DEV_NAME_LEN]  = "sl811_cs";
 
 typedef struct local_info_t {
-        dev_link_t              link;
+        struct pcmcia_device    *p_dev;
         dev_node_t              node;
 } local_info_t;
 
-static void sl811_cs_release(dev_link_t * link);
+static void sl811_cs_release(struct pcmcia_device * link);
 
 /*====================================================================*/
 
@@ -138,41 +138,27 @@ static int sl811_hc_init(struct device *parent, ioaddr_t base_addr, int irq)
 
 /*====================================================================*/
 
-static void sl811_cs_detach(struct pcmcia_device *p_dev)
+static void sl811_cs_detach(struct pcmcia_device *link)
 {
-        dev_link_t *link = dev_to_instance(p_dev);
-
         DBG(0, "sl811_cs_detach(0x%p)\n", link);
 
-        link->state &= ~DEV_PRESENT;
-        if (link->state & DEV_CONFIG)
-                sl811_cs_release(link);
+        sl811_cs_release(link);
 
         /* This points to the parent local_info_t struct */
         kfree(link->priv);
 }
 
-static void sl811_cs_release(dev_link_t * link)
+static void sl811_cs_release(struct pcmcia_device * link)
 {
-
         DBG(0, "sl811_cs_release(0x%p)\n", link);
 
-        /* Unlink the device chain */
-        link->dev = NULL;
-
+        pcmcia_disable_device(link);
         platform_device_unregister(&platform_dev);
-        pcmcia_release_configuration(link->handle);
-        if (link->io.NumPorts1)
-                pcmcia_release_io(link->handle, &link->io);
-        if (link->irq.AssignedIRQ)
-                pcmcia_release_irq(link->handle, &link->irq);
-        link->state &= ~DEV_CONFIG;
 }
 
-static void sl811_cs_config(dev_link_t *link)
+static int sl811_cs_config(struct pcmcia_device *link)
 {
-        client_handle_t         handle = link->handle;
-        struct device           *parent = &handle_to_dev(handle);
+        struct device           *parent = &handle_to_dev(link);
         local_info_t            *dev = link->priv;
         tuple_t                 tuple;
         cisparse_t              parse;
@@ -188,27 +174,23 @@ static void sl811_cs_config(dev_link_t *link)
         tuple.TupleData = buf;
         tuple.TupleDataMax = sizeof(buf);
         tuple.TupleOffset = 0;
-        CS_CHECK(GetFirstTuple, pcmcia_get_first_tuple(handle, &tuple));
-        CS_CHECK(GetTupleData, pcmcia_get_tuple_data(handle, &tuple));
-        CS_CHECK(ParseTuple, pcmcia_parse_tuple(handle, &tuple, &parse));
+        CS_CHECK(GetFirstTuple, pcmcia_get_first_tuple(link, &tuple));
+        CS_CHECK(GetTupleData, pcmcia_get_tuple_data(link, &tuple));
+        CS_CHECK(ParseTuple, pcmcia_parse_tuple(link, &tuple, &parse));
         link->conf.ConfigBase = parse.config.base;
         link->conf.Present = parse.config.rmask[0];
 
-        /* Configure card */
-        link->state |= DEV_CONFIG;
-
         /* Look up the current Vcc */
         CS_CHECK(GetConfigurationInfo,
-                        pcmcia_get_configuration_info(handle, &conf));
-        link->conf.Vcc = conf.Vcc;
+                        pcmcia_get_configuration_info(link, &conf));
 
         tuple.DesiredTuple = CISTPL_CFTABLE_ENTRY;
-        CS_CHECK(GetFirstTuple, pcmcia_get_first_tuple(handle, &tuple));
+        CS_CHECK(GetFirstTuple, pcmcia_get_first_tuple(link, &tuple));
         while (1) {
                 cistpl_cftable_entry_t  *cfg = &(parse.cftable_entry);
 
-                if (pcmcia_get_tuple_data(handle, &tuple) != 0
-                                || pcmcia_parse_tuple(handle, &tuple, &parse)
+                if (pcmcia_get_tuple_data(link, &tuple) != 0
+                                || pcmcia_parse_tuple(link, &tuple, &parse)
                                                 != 0)
                         goto next_entry;
 
@@ -234,10 +216,10 @@ static void sl811_cs_config(dev_link_t *link)
                 }
 
                 if (cfg->vpp1.present & (1<<CISTPL_POWER_VNOM))
-                        link->conf.Vpp1 = link->conf.Vpp2 =
+                        link->conf.Vpp =
                                 cfg->vpp1.param[CISTPL_POWER_VNOM]/10000;
                 else if (dflt.vpp1.present & (1<<CISTPL_POWER_VNOM))
-                        link->conf.Vpp1 = link->conf.Vpp2 =
+                        link->conf.Vpp =
                                 dflt.vpp1.param[CISTPL_POWER_VNOM]/10000;
 
                 /* we need an interrupt */
@@ -254,15 +236,14 @@ static void sl811_cs_config(dev_link_t *link)
                         link->io.BasePort1 = io->win[0].base;
                         link->io.NumPorts1 = io->win[0].len;
 
-                        if (pcmcia_request_io(link->handle, &link->io) != 0)
+                        if (pcmcia_request_io(link, &link->io) != 0)
                                 goto next_entry;
                 }
                 break;
 
 next_entry:
-                if (link->io.NumPorts1)
-                        pcmcia_release_io(link->handle, &link->io);
-                last_ret = pcmcia_get_next_tuple(handle, &tuple);
+                pcmcia_disable_device(link);
+                last_ret = pcmcia_get_next_tuple(link, &tuple);
         }
 
         /* require an IRQ and two registers */
@@ -270,71 +251,46 @@ next_entry:
                 goto cs_failed;
         if (link->conf.Attributes & CONF_ENABLE_IRQ)
                 CS_CHECK(RequestIRQ,
-                        pcmcia_request_irq(link->handle, &link->irq));
+                        pcmcia_request_irq(link, &link->irq));
         else
                 goto cs_failed;
 
         CS_CHECK(RequestConfiguration,
-                pcmcia_request_configuration(link->handle, &link->conf));
+                pcmcia_request_configuration(link, &link->conf));
 
         sprintf(dev->node.dev_name, driver_name);
         dev->node.major = dev->node.minor = 0;
-        link->dev = &dev->node;
+        link->dev_node = &dev->node;
 
-        printk(KERN_INFO "%s: index 0x%02x: Vcc %d.%d",
-               dev->node.dev_name, link->conf.ConfigIndex,
-               link->conf.Vcc/10, link->conf.Vcc%10);
-        if (link->conf.Vpp1)
-                printk(", Vpp %d.%d", link->conf.Vpp1/10, link->conf.Vpp1%10);
+        printk(KERN_INFO "%s: index 0x%02x: ",
+               dev->node.dev_name, link->conf.ConfigIndex);
+        if (link->conf.Vpp)
+                printk(", Vpp %d.%d", link->conf.Vpp/10, link->conf.Vpp%10);
         printk(", irq %d", link->irq.AssignedIRQ);
         printk(", io 0x%04x-0x%04x", link->io.BasePort1,
                link->io.BasePort1+link->io.NumPorts1-1);
         printk("\n");
 
-        link->state &= ~DEV_CONFIG_PENDING;
-
         if (sl811_hc_init(parent, link->io.BasePort1, link->irq.AssignedIRQ)
                         < 0) {
 cs_failed:
                 printk("sl811_cs_config failed\n");
-                cs_error(link->handle, last_fn, last_ret);
+                cs_error(link, last_fn, last_ret);
                 sl811_cs_release(link);
-                link->state &= ~DEV_CONFIG_PENDING;
+                return  -ENODEV;
         }
-}
-
-static int sl811_suspend(struct pcmcia_device *dev)
-{
-        dev_link_t *link = dev_to_instance(dev);
-
-        link->state |= DEV_SUSPEND;
-        if (link->state & DEV_CONFIG)
-                pcmcia_release_configuration(link->handle);
-
-        return 0;
-}
-
-static int sl811_resume(struct pcmcia_device *dev)
-{
-        dev_link_t *link = dev_to_instance(dev);
-
-        link->state &= ~DEV_SUSPEND;
-        if (link->state & DEV_CONFIG)
-                pcmcia_request_configuration(link->handle, &link->conf);
-
         return 0;
 }
 
-static int sl811_cs_attach(struct pcmcia_device *p_dev)
+static int sl811_cs_probe(struct pcmcia_device *link)
 {
         local_info_t *local;
-        dev_link_t *link;
 
         local = kmalloc(sizeof(local_info_t), GFP_KERNEL);
         if (!local)
                 return -ENOMEM;
         memset(local, 0, sizeof(local_info_t));
-        link = &local->link;
+        local->p_dev = link;
         link->priv = local;
 
         /* Initialize */
@@ -343,16 +299,9 @@ static int sl811_cs_attach(struct pcmcia_device *p_dev)
         link->irq.Handler = NULL;
 
         link->conf.Attributes = 0;
-        link->conf.Vcc = 33;
         link->conf.IntType = INT_MEMORY_AND_IO;
 
-        link->handle = p_dev;
-        p_dev->instance = link;
-
-        link->state |= DEV_PRESENT | DEV_CONFIG_PENDING;
-        sl811_cs_config(link);
-
-        return 0;
+        return sl811_cs_config(link);
 }
 
 static struct pcmcia_device_id sl811_ids[] = {
@@ -366,11 +315,9 @@ static struct pcmcia_driver sl811_cs_driver = {
         .drv            = {
                 .name   = (char *)driver_name,
         },
-        .probe          = sl811_cs_attach,
+        .probe          = sl811_cs_probe,
         .remove         = sl811_cs_detach,
         .id_table       = sl811_ids,
-        .suspend        = sl811_suspend,
-        .resume         = sl811_resume,
 };
 
 /*====================================================================*/
diff --git a/drivers/usb/input/hid-input.c b/drivers/usb/input/hid-input.c
index cb0d80f49252..25bc85f8ce39 100644
--- a/drivers/usb/input/hid-input.c
+++ b/drivers/usb/input/hid-input.c
@@ -510,7 +510,7 @@ static void hidinput_configure_usage(struct hid_input *hidinput, struct hid_fiel
                                 case 0x025: map_key_clear(KEY_TV);              break;
                                 case 0x026: map_key_clear(KEY_MENU);            break;
                                 case 0x031: map_key_clear(KEY_AUDIO);           break;
-                                case 0x032: map_key_clear(KEY_SUBTITLE);        break;
+                                case 0x032: map_key_clear(KEY_TEXT);            break;
                                 case 0x033: map_key_clear(KEY_LAST);            break;
                                 case 0x047: map_key_clear(KEY_MP3);             break;
                                 case 0x048: map_key_clear(KEY_DVD);             break;
diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
index 495db5755df9..5cf2b80add7a 100644
--- a/drivers/usb/serial/option.c
+++ b/drivers/usb/serial/option.c
@@ -28,6 +28,7 @@
   2005-09-10  v0.4.3 added HUAWEI E600 card and Audiovox AirCard
   2005-09-20  v0.4.4 increased recv buffer size: the card sometimes
                      wants to send >2000 bytes.
+  2006-04-10  v0.4.2 fixed two array overrun errors :-/
 
   Work sponsored by: Sigos GmbH, Germany <info@sigos.de>
 
@@ -582,14 +583,14 @@ static void option_setup_urbs(struct usb_serial *serial)
         portdata = usb_get_serial_port_data(port);
 
         /* Do indat endpoints first */
-        for (j = 0; j <= N_IN_URB; ++j) {
+        for (j = 0; j < N_IN_URB; ++j) {
                 portdata->in_urbs[j] = option_setup_urb (serial,
                   port->bulk_in_endpointAddress, USB_DIR_IN, port,
                   portdata->in_buffer[j], IN_BUFLEN, option_indat_callback);
         }
 
         /* outdat endpoints */
-        for (j = 0; j <= N_OUT_URB; ++j) {
+        for (j = 0; j < N_OUT_URB; ++j) {
                 portdata->out_urbs[j] = option_setup_urb (serial,
                   port->bulk_out_endpointAddress, USB_DIR_OUT, port,
                   portdata->out_buffer[j], OUT_BUFLEN, option_outdat_callback);
diff --git a/drivers/video/Kconfig b/drivers/video/Kconfig
index f87c0171f4ec..9060e7137441 100644
--- a/drivers/video/Kconfig
+++ b/drivers/video/Kconfig
@@ -961,7 +961,7 @@ config FB_ATY128
 
 config FB_ATY
         tristate "ATI Mach64 display support" if PCI || ATARI
-        depends on FB
+        depends on FB && !SPARC32
         select FB_CFB_FILLRECT
         select FB_CFB_COPYAREA
         select FB_CFB_IMAGEBLIT
diff --git a/drivers/video/aty/atyfb_base.c b/drivers/video/aty/atyfb_base.c
index b39e72d5413b..d9d7d3c4cae2 100644
--- a/drivers/video/aty/atyfb_base.c
+++ b/drivers/video/aty/atyfb_base.c
@@ -3400,7 +3400,7 @@ static int __devinit atyfb_pci_probe(struct pci_dev *pdev, const struct pci_devi
         struct atyfb_par *par;
         int i, rc = -ENOMEM;
 
-        for (i = ARRAY_SIZE(aty_chips); i >= 0; i--)
+        for (i = ARRAY_SIZE(aty_chips) - 1; i >= 0; i--)
                 if (pdev->device == aty_chips[i].pci_id)
                         break;
 
diff --git a/drivers/video/fbmem.c b/drivers/video/fbmem.c
index 944855b3e4af..8d8eadb64853 100644
--- a/drivers/video/fbmem.c
+++ b/drivers/video/fbmem.c
@@ -435,6 +435,11 @@ int fb_prepare_logo(struct fb_info *info, int rotate)
                         depth = info->var.green.length;
         }
 
+        if (info->fix.visual == FB_VISUAL_STATIC_PSEUDOCOLOR) {
+                /* assume console colormap */
+                depth = 4;
+        }
+
         if (depth >= 8) {
                 switch (info->fix.visual) {
                 case FB_VISUAL_TRUECOLOR:
diff --git a/drivers/video/vesafb.c b/drivers/video/vesafb.c
index 8982e540214c..b0b9acfdd430 100644
--- a/drivers/video/vesafb.c
+++ b/drivers/video/vesafb.c
@@ -57,7 +57,7 @@ static unsigned short  *pmi_base  = NULL;
 static void            (*pmi_start)(void);
 static void            (*pmi_pal)(void);
 static int             depth;
-
+static int             vga_compat;
 /* --------------------------------------------------------------------- */
 
 static int vesafb_pan_display(struct fb_var_screeninfo *var,
@@ -83,9 +83,10 @@ static int vesafb_pan_display(struct fb_var_screeninfo *var,
 static void vesa_setpalette(int regno, unsigned red, unsigned green,
                             unsigned blue)
 {
+        int shift = 16 - depth;
+
 #ifdef __i386__
         struct { u_char blue, green, red, pad; } entry;
-        int shift = 16 - depth;
 
         if (pmi_setpal) {
                 entry.red   = red   >> shift;
@@ -101,14 +102,20 @@ static void vesa_setpalette(int regno, unsigned red, unsigned green,
                   "d" (regno),          /* EDX */
                   "D" (&entry),         /* EDI */
                   "S" (&pmi_pal));      /* ESI */
-        } else {
-                /* without protected mode interface, try VGA registers... */
+                return;
+        }
+#endif
+
+/*
+ * without protected mode interface and if VGA compatible,
+ * try VGA registers...
+ */
+        if (vga_compat) {
                 outb_p(regno,       dac_reg);
                 outb_p(red   >> shift, dac_val);
                 outb_p(green >> shift, dac_val);
                 outb_p(blue  >> shift, dac_val);
         }
-#endif
 }
 
 static int vesafb_setcolreg(unsigned regno, unsigned red, unsigned green,
@@ -214,6 +221,7 @@ static int __init vesafb_probe(struct platform_device *dev)
         if (screen_info.orig_video_isVGA != VIDEO_TYPE_VLFB)
                 return -ENODEV;
 
+        vga_compat = (screen_info.capabilities & 2) ? 0 : 1;
         vesafb_fix.smem_start = screen_info.lfb_base;
         vesafb_defined.bits_per_pixel = screen_info.lfb_depth;
         if (15 == vesafb_defined.bits_per_pixel)
@@ -318,6 +326,12 @@ static int __init vesafb_probe(struct platform_device *dev)
                 }
         }
 
+        if (vesafb_defined.bits_per_pixel == 8 && !pmi_setpal && !vga_compat) {
+                printk(KERN_WARNING "vesafb: hardware palette is unchangeable,\n"
+                                    "        colors may be incorrect\n");
+                vesafb_fix.visual = FB_VISUAL_STATIC_PSEUDOCOLOR;
+        }
+
         vesafb_defined.xres_virtual = vesafb_defined.xres;
         vesafb_defined.yres_virtual = vesafb_fix.smem_len / vesafb_fix.line_length;
         if (ypan && vesafb_defined.yres_virtual > vesafb_defined.yres) {
@@ -354,7 +368,8 @@ static int __init vesafb_probe(struct platform_device *dev)
         printk(KERN_INFO "vesafb: %s: "
                "size=%d:%d:%d:%d, shift=%d:%d:%d:%d\n",
                (vesafb_defined.bits_per_pixel > 8) ?
-               "Truecolor" : "Pseudocolor",
+               "Truecolor" : (vga_compat || pmi_setpal) ?
+               "Pseudocolor" : "Static Pseudocolor",
                screen_info.rsvd_size,
                screen_info.red_size,
                screen_info.green_size,
diff --git a/fs/9p/vfs_super.c b/fs/9p/vfs_super.c
index b0a0ae509c00..61c599b4a1e3 100644
--- a/fs/9p/vfs_super.c
+++ b/fs/9p/vfs_super.c
@@ -127,12 +127,13 @@ static struct super_block *v9fs_get_sb(struct file_system_type
 
         if ((newfid = v9fs_session_init(v9ses, dev_name, data)) < 0) {
                 dprintk(DEBUG_ERROR, "problem initiating session\n");
-                kfree(v9ses);
-                return ERR_PTR(newfid);
+                sb = ERR_PTR(newfid);
+                goto out_free_session;
         }
 
         sb = sget(fs_type, NULL, v9fs_set_super, v9ses);
-
+        if (IS_ERR(sb))
+                goto out_close_session;
         v9fs_fill_super(sb, v9ses, flags);
 
         inode = v9fs_get_inode(sb, S_IFDIR | mode);
@@ -185,6 +186,12 @@ static struct super_block *v9fs_get_sb(struct file_system_type
 
         return sb;
 
+out_close_session:
+        v9fs_session_close(v9ses);
+out_free_session:
+        kfree(v9ses);
+        return sb;
+
 put_back_sb:
         /* deactivate_super calls v9fs_kill_super which will frees the rest */
         up_write(&sb->s_umount);
diff --git a/fs/Kconfig b/fs/Kconfig
index e207be68d4ca..2524629dc835 100644
--- a/fs/Kconfig
+++ b/fs/Kconfig
@@ -799,6 +799,7 @@ config PROC_KCORE
 config PROC_VMCORE
         bool "/proc/vmcore support (EXPERIMENTAL)"
         depends on PROC_FS && EXPERIMENTAL && CRASH_DUMP
+        default y
         help
         Exports the dump image of crashed kernel in ELF format.
 
@@ -861,7 +862,7 @@ config RAMFS
 
 config CONFIGFS_FS
         tristate "Userspace-driven configuration filesystem (EXPERIMENTAL)"
-        depends on EXPERIMENTAL
+        depends on SYSFS && EXPERIMENTAL
         help
           configfs is a ram-based filesystem that provides the converse
           of sysfs's functionality. Where sysfs is a filesystem-based
diff --git a/fs/configfs/dir.c b/fs/configfs/dir.c
index 8ed9b06a9828..5638c8f9362f 100644
--- a/fs/configfs/dir.c
+++ b/fs/configfs/dir.c
@@ -504,7 +504,7 @@ static int populate_groups(struct config_group *group)
         int ret = 0;
         int i;
 
-        if (group && group->default_groups) {
+        if (group->default_groups) {
                 /* FYI, we're faking mkdir here
                  * I'm not sure we need this semaphore, as we're called
                  * from our parent's mkdir.  That holds our parent's
diff --git a/fs/direct-io.c b/fs/direct-io.c
index 910a8ed74b5d..b05d1b218776 100644
--- a/fs/direct-io.c
+++ b/fs/direct-io.c
@@ -929,8 +929,7 @@ do_holes:
                         block_in_page += this_chunk_blocks;
                         dio->blocks_available -= this_chunk_blocks;
 next_block:
-                        if (dio->block_in_file > dio->final_block_in_request)
-                                BUG();
+                        BUG_ON(dio->block_in_file > dio->final_block_in_request);
                         if (dio->block_in_file == dio->final_block_in_request)
                                 break;
                 }
diff --git a/fs/dquot.c b/fs/dquot.c
index 6b3886920939..81d87a413c68 100644
--- a/fs/dquot.c
+++ b/fs/dquot.c
@@ -590,8 +590,7 @@ we_slept:
         atomic_dec(&dquot->dq_count);
 #ifdef __DQUOT_PARANOIA
         /* sanity check */
-        if (!list_empty(&dquot->dq_free))
-                BUG();
+        BUG_ON(!list_empty(&dquot->dq_free));
 #endif
         put_dquot_last(dquot);
         spin_unlock(&dq_list_lock);
@@ -666,8 +665,7 @@ we_slept:
                 return NODQUOT;
         }
 #ifdef __DQUOT_PARANOIA
-        if (!dquot->dq_sb)      /* Has somebody invalidated entry under us? */
-                BUG();
+        BUG_ON(!dquot->dq_sb);  /* Has somebody invalidated entry under us? */
 #endif
 
         return dquot;
diff --git a/fs/eventpoll.c b/fs/eventpoll.c
index 242fe1a66ce5..1b4491cdd115 100644
--- a/fs/eventpoll.c
+++ b/fs/eventpoll.c
@@ -599,7 +599,7 @@ sys_epoll_ctl(int epfd, int op, int fd, struct epoll_event __user *event)
         switch (op) {
         case EPOLL_CTL_ADD:
                 if (!epi) {
-                        epds.events |= POLLERR | POLLHUP | POLLRDHUP;
+                        epds.events |= POLLERR | POLLHUP;
 
                         error = ep_insert(ep, &epds, tfile, fd);
                 } else
@@ -613,7 +613,7 @@ sys_epoll_ctl(int epfd, int op, int fd, struct epoll_event __user *event)
                 break;
         case EPOLL_CTL_MOD:
                 if (epi) {
-                        epds.events |= POLLERR | POLLHUP | POLLRDHUP;
+                        epds.events |= POLLERR | POLLHUP;
                         error = ep_modify(ep, epi, &epds);
                 } else
                         error = -ENOENT;
diff --git a/fs/exec.c b/fs/exec.c
index 950ebd43cdc3..3234a0c32d54 100644
--- a/fs/exec.c
+++ b/fs/exec.c
@@ -561,7 +561,7 @@ static int exec_mmap(struct mm_struct *mm)
         arch_pick_mmap_layout(mm);
         if (old_mm) {
                 up_read(&old_mm->mmap_sem);
-                if (active_mm != old_mm) BUG();
+                BUG_ON(active_mm != old_mm);
                 mmput(old_mm);
                 return 0;
         }
@@ -678,6 +678,18 @@ static int de_thread(struct task_struct *tsk)
                 while (leader->exit_state != EXIT_ZOMBIE)
                         yield();
 
+                /*
+                 * The only record we have of the real-time age of a
+                 * process, regardless of execs it's done, is start_time.
+                 * All the past CPU time is accumulated in signal_struct
+                 * from sister threads now dead.  But in this non-leader
+                 * exec, nothing survives from the original leader thread,
+                 * whose birth marks the true age of this process now.
+                 * When we take on its identity by switching to its PID, we
+                 * also take its birthdate (always earlier than our own).
+                 */
+                current->start_time = leader->start_time;
+
                 spin_lock(&leader->proc_lock);
                 spin_lock(&current->proc_lock);
                 proc_dentry1 = proc_pid_unhash(current);
@@ -723,7 +735,12 @@ static int de_thread(struct task_struct *tsk)
                 current->parent = current->real_parent = leader->real_parent;
                 leader->parent = leader->real_parent = child_reaper;
                 current->group_leader = current;
-                leader->group_leader = leader;
+                leader->group_leader = current;
+
+                /* Reduce leader to a thread */
+                detach_pid(leader, PIDTYPE_PGID);
+                detach_pid(leader, PIDTYPE_SID);
+                list_del_init(&leader->tasks);
 
                 add_parent(current);
                 add_parent(leader);
diff --git a/fs/ext3/resize.c b/fs/ext3/resize.c
index 1041dab6de2f..14f5f6ea3e72 100644
--- a/fs/ext3/resize.c
+++ b/fs/ext3/resize.c
@@ -974,6 +974,7 @@ int ext3_group_extend(struct super_block *sb, struct ext3_super_block *es,
         if (o_blocks_count != le32_to_cpu(es->s_blocks_count)) {
                 ext3_warning(sb, __FUNCTION__,
                              "multiple resizers run on filesystem!");
+                unlock_super(sb);
                 err = -EBUSY;
                 goto exit_put;
         }
diff --git a/fs/fcntl.c b/fs/fcntl.c
index 2a2479196f96..d35cbc6bc112 100644
--- a/fs/fcntl.c
+++ b/fs/fcntl.c
@@ -453,8 +453,7 @@ static void send_sigio_to_task(struct task_struct *p,
                         /* Make sure we are called with one of the POLL_*
                            reasons, otherwise we could leak kernel stack into
                            userspace.  */
-                        if ((reason & __SI_MASK) != __SI_POLL)
-                                BUG();
+                        BUG_ON((reason & __SI_MASK) != __SI_POLL);
                         if (reason - POLL_IN >= NSIGPOLL)
                                 si.si_band  = ~0L;
                         else
diff --git a/fs/fifo.c b/fs/fifo.c
index 889f722ee36d..49035b174b48 100644
--- a/fs/fifo.c
+++ b/fs/fifo.c
@@ -15,30 +15,35 @@
 #include <linux/fs.h>
 #include <linux/pipe_fs_i.h>
 
-static void wait_for_partner(struct inode* inode, unsigned int* cnt)
+static void wait_for_partner(struct inode* inode, unsigned int *cnt)
 {
         int cur = *cnt; 
-        while(cur == *cnt) {
-                pipe_wait(inode);
-                if(signal_pending(current))
+
+        while (cur == *cnt) {
+                pipe_wait(inode->i_pipe);
+                if (signal_pending(current))
                         break;
         }
 }
 
 static void wake_up_partner(struct inode* inode)
 {
-        wake_up_interruptible(PIPE_WAIT(*inode));
+        wake_up_interruptible(&inode->i_pipe->wait);
 }
 
 static int fifo_open(struct inode *inode, struct file *filp)
 {
+        struct pipe_inode_info *pipe;
         int ret;
 
-        mutex_lock(PIPE_MUTEX(*inode));
-        if (!inode->i_pipe) {
+        mutex_lock(&inode->i_mutex);
+        pipe = inode->i_pipe;
+        if (!pipe) {
                 ret = -ENOMEM;
-                if(!pipe_new(inode))
+                pipe = alloc_pipe_info(inode);
+                if (!pipe)
                         goto err_nocleanup;
+                inode->i_pipe = pipe;
         }
         filp->f_version = 0;
 
@@ -53,18 +58,18 @@ static int fifo_open(struct inode *inode, struct file *filp)
          *  opened, even when there is no process writing the FIFO.
          */
                 filp->f_op = &read_fifo_fops;
-                PIPE_RCOUNTER(*inode)++;
-                if (PIPE_READERS(*inode)++ == 0)
+                pipe->r_counter++;
+                if (pipe->readers++ == 0)
                         wake_up_partner(inode);
 
-                if (!PIPE_WRITERS(*inode)) {
+                if (!pipe->writers) {
                         if ((filp->f_flags & O_NONBLOCK)) {
                                 /* suppress POLLHUP until we have
                                  * seen a writer */
-                                filp->f_version = PIPE_WCOUNTER(*inode);
+                                filp->f_version = pipe->w_counter;
                         } else 
                         {
-                                wait_for_partner(inode, &PIPE_WCOUNTER(*inode));
+                                wait_for_partner(inode, &pipe->w_counter);
                                 if(signal_pending(current))
                                         goto err_rd;
                         }
@@ -78,16 +83,16 @@ static int fifo_open(struct inode *inode, struct file *filp)
          *  errno=ENXIO when there is no process reading the FIFO.
          */
                 ret = -ENXIO;
-                if ((filp->f_flags & O_NONBLOCK) && !PIPE_READERS(*inode))
+                if ((filp->f_flags & O_NONBLOCK) && !pipe->readers)
                         goto err;
 
                 filp->f_op = &write_fifo_fops;
-                PIPE_WCOUNTER(*inode)++;
-                if (!PIPE_WRITERS(*inode)++)
+                pipe->w_counter++;
+                if (!pipe->writers++)
                         wake_up_partner(inode);
 
-                if (!PIPE_READERS(*inode)) {
-                        wait_for_partner(inode, &PIPE_RCOUNTER(*inode));
+                if (!pipe->readers) {
+                        wait_for_partner(inode, &pipe->r_counter);
                         if (signal_pending(current))
                                 goto err_wr;
                 }
@@ -102,11 +107,11 @@ static int fifo_open(struct inode *inode, struct file *filp)
          */
                 filp->f_op = &rdwr_fifo_fops;
 
-                PIPE_READERS(*inode)++;
-                PIPE_WRITERS(*inode)++;
-                PIPE_RCOUNTER(*inode)++;
-                PIPE_WCOUNTER(*inode)++;
-                if (PIPE_READERS(*inode) == 1 || PIPE_WRITERS(*inode) == 1)
+                pipe->readers++;
+                pipe->writers++;
+                pipe->r_counter++;
+                pipe->w_counter++;
+                if (pipe->readers == 1 || pipe->writers == 1)
                         wake_up_partner(inode);
                 break;
 
@@ -116,27 +121,27 @@ static int fifo_open(struct inode *inode, struct file *filp)
         }
 
         /* Ok! */
-        mutex_unlock(PIPE_MUTEX(*inode));
+        mutex_unlock(&inode->i_mutex);
         return 0;
 
 err_rd:
-        if (!--PIPE_READERS(*inode))
-                wake_up_interruptible(PIPE_WAIT(*inode));
+        if (!--pipe->readers)
+                wake_up_interruptible(&pipe->wait);
         ret = -ERESTARTSYS;
         goto err;
 
 err_wr:
-        if (!--PIPE_WRITERS(*inode))
-                wake_up_interruptible(PIPE_WAIT(*inode));
+        if (!--pipe->writers)
+                wake_up_interruptible(&pipe->wait);
         ret = -ERESTARTSYS;
         goto err;
 
 err:
-        if (!PIPE_READERS(*inode) && !PIPE_WRITERS(*inode))
+        if (!pipe->readers && !pipe->writers)
                 free_pipe_info(inode);
 
 err_nocleanup:
-        mutex_unlock(PIPE_MUTEX(*inode));
+        mutex_unlock(&inode->i_mutex);
         return ret;
 }
 
diff --git a/fs/freevxfs/vxfs_olt.c b/fs/freevxfs/vxfs_olt.c
index 76a0708ae978..049500847903 100644
--- a/fs/freevxfs/vxfs_olt.c
+++ b/fs/freevxfs/vxfs_olt.c
@@ -42,24 +42,21 @@
 static inline void
 vxfs_get_fshead(struct vxfs_oltfshead *fshp, struct vxfs_sb_info *infp)
 {
-        if (infp->vsi_fshino)
-                BUG();
+        BUG_ON(infp->vsi_fshino);
         infp->vsi_fshino = fshp->olt_fsino[0];
 }
 
 static inline void
 vxfs_get_ilist(struct vxfs_oltilist *ilistp, struct vxfs_sb_info *infp)
 {
-        if (infp->vsi_iext)
-                BUG();
+        BUG_ON(infp->vsi_iext);
         infp->vsi_iext = ilistp->olt_iext[0]; 
 }
 
 static inline u_long
 vxfs_oblock(struct super_block *sbp, daddr_t block, u_long bsize)
 {
-        if (sbp->s_blocksize % bsize)
-                BUG();
+        BUG_ON(sbp->s_blocksize % bsize);
         return (block * (sbp->s_blocksize / bsize));
 }
 
diff --git a/fs/fuse/dev.c b/fs/fuse/dev.c
index 23d1f52eb1b8..6c740f860665 100644
--- a/fs/fuse/dev.c
+++ b/fs/fuse/dev.c
@@ -1,6 +1,6 @@
 /*
   FUSE: Filesystem in Userspace
-  Copyright (C) 2001-2005  Miklos Szeredi <miklos@szeredi.hu>
+  Copyright (C) 2001-2006  Miklos Szeredi <miklos@szeredi.hu>
 
   This program can be distributed under the terms of the GNU GPL.
   See the file COPYING.
@@ -23,13 +23,11 @@ static kmem_cache_t *fuse_req_cachep;
 
 static struct fuse_conn *fuse_get_conn(struct file *file)
 {
-        struct fuse_conn *fc;
-        spin_lock(&fuse_lock);
-        fc = file->private_data;
-        if (fc && !fc->connected)
-                fc = NULL;
-        spin_unlock(&fuse_lock);
-        return fc;
+        /*
+         * Lockless access is OK, because file->private data is set
+         * once during mount and is valid until the file is released.
+         */
+        return file->private_data;
 }
 
 static void fuse_request_init(struct fuse_req *req)
@@ -74,10 +72,8 @@ static void restore_sigs(sigset_t *oldset)
  */
 void fuse_reset_request(struct fuse_req *req)
 {
-        int preallocated = req->preallocated;
         BUG_ON(atomic_read(&req->count) != 1);
         fuse_request_init(req);
-        req->preallocated = preallocated;
 }
 
 static void __fuse_get_request(struct fuse_req *req)
@@ -92,80 +88,52 @@ static void __fuse_put_request(struct fuse_req *req)
         atomic_dec(&req->count);
 }
 
-static struct fuse_req *do_get_request(struct fuse_conn *fc)
+struct fuse_req *fuse_get_req(struct fuse_conn *fc)
 {
         struct fuse_req *req;
-
-        spin_lock(&fuse_lock);
-        BUG_ON(list_empty(&fc->unused_list));
-        req = list_entry(fc->unused_list.next, struct fuse_req, list);
-        list_del_init(&req->list);
-        spin_unlock(&fuse_lock);
-        fuse_request_init(req);
-        req->preallocated = 1;
-        req->in.h.uid = current->fsuid;
-        req->in.h.gid = current->fsgid;
-        req->in.h.pid = current->pid;
-        return req;
-}
-
-/* This can return NULL, but only in case it's interrupted by a SIGKILL */
-struct fuse_req *fuse_get_request(struct fuse_conn *fc)
-{
-        int intr;
         sigset_t oldset;
+        int err;
 
-        atomic_inc(&fc->num_waiting);
         block_sigs(&oldset);
-        intr = down_interruptible(&fc->outstanding_sem);
+        err = wait_event_interruptible(fc->blocked_waitq, !fc->blocked);
         restore_sigs(&oldset);
-        if (intr) {
-                atomic_dec(&fc->num_waiting);
-                return NULL;
-        }
-        return do_get_request(fc);
-}
+        if (err)
+                return ERR_PTR(-EINTR);
 
-/* Must be called with fuse_lock held */
-static void fuse_putback_request(struct fuse_conn *fc, struct fuse_req *req)
-{
-        if (req->preallocated) {
-                atomic_dec(&fc->num_waiting);
-                list_add(&req->list, &fc->unused_list);
-        } else
-                fuse_request_free(req);
+        req = fuse_request_alloc();
+        if (!req)
+                return ERR_PTR(-ENOMEM);
 
-        /* If we are in debt decrease that first */
-        if (fc->outstanding_debt)
-                fc->outstanding_debt--;
-        else
-                up(&fc->outstanding_sem);
+        atomic_inc(&fc->num_waiting);
+        fuse_request_init(req);
+        req->in.h.uid = current->fsuid;
+        req->in.h.gid = current->fsgid;
+        req->in.h.pid = current->pid;
+        return req;
 }
 
 void fuse_put_request(struct fuse_conn *fc, struct fuse_req *req)
 {
         if (atomic_dec_and_test(&req->count)) {
-                spin_lock(&fuse_lock);
-                fuse_putback_request(fc, req);
-                spin_unlock(&fuse_lock);
+                atomic_dec(&fc->num_waiting);
+                fuse_request_free(req);
         }
 }
 
-static void fuse_put_request_locked(struct fuse_conn *fc, struct fuse_req *req)
-{
-        if (atomic_dec_and_test(&req->count))
-                fuse_putback_request(fc, req);
-}
-
-void fuse_release_background(struct fuse_req *req)
+void fuse_release_background(struct fuse_conn *fc, struct fuse_req *req)
 {
         iput(req->inode);
         iput(req->inode2);
         if (req->file)
                 fput(req->file);
-        spin_lock(&fuse_lock);
+        spin_lock(&fc->lock);
         list_del(&req->bg_entry);
-        spin_unlock(&fuse_lock);
+        if (fc->num_background == FUSE_MAX_BACKGROUND) {
+                fc->blocked = 0;
+                wake_up_all(&fc->blocked_waitq);
+        }
+        fc->num_background--;
+        spin_unlock(&fc->lock);
 }
 
 /*
@@ -184,23 +152,23 @@ void fuse_release_background(struct fuse_req *req)
  * interrupted and put in the background, it will return with an error
  * and hence never be reset and reused.
  *
- * Called with fuse_lock, unlocks it
+ * Called with fc->lock, unlocks it
  */
 static void request_end(struct fuse_conn *fc, struct fuse_req *req)
 {
         list_del(&req->list);
         req->state = FUSE_REQ_FINISHED;
         if (!req->background) {
+                spin_unlock(&fc->lock);
                 wake_up(&req->waitq);
-                fuse_put_request_locked(fc, req);
-                spin_unlock(&fuse_lock);
+                fuse_put_request(fc, req);
         } else {
                 void (*end) (struct fuse_conn *, struct fuse_req *) = req->end;
                 req->end = NULL;
-                spin_unlock(&fuse_lock);
+                spin_unlock(&fc->lock);
                 down_read(&fc->sbput_sem);
                 if (fc->mounted)
-                        fuse_release_background(req);
+                        fuse_release_background(fc, req);
                 up_read(&fc->sbput_sem);
                 if (end)
                         end(fc, req);
@@ -242,6 +210,9 @@ static void background_request(struct fuse_conn *fc, struct fuse_req *req)
 {
         req->background = 1;
         list_add(&req->bg_entry, &fc->background);
+        fc->num_background++;
+        if (fc->num_background == FUSE_MAX_BACKGROUND)
+                fc->blocked = 1;
         if (req->inode)
                 req->inode = igrab(req->inode);
         if (req->inode2)
@@ -250,16 +221,16 @@ static void background_request(struct fuse_conn *fc, struct fuse_req *req)
                 get_file(req->file);
 }
 
-/* Called with fuse_lock held.  Releases, and then reacquires it. */
+/* Called with fc->lock held.  Releases, and then reacquires it. */
 static void request_wait_answer(struct fuse_conn *fc, struct fuse_req *req)
 {
         sigset_t oldset;
 
-        spin_unlock(&fuse_lock);
+        spin_unlock(&fc->lock);
         block_sigs(&oldset);
         wait_event_interruptible(req->waitq, req->state == FUSE_REQ_FINISHED);
         restore_sigs(&oldset);
-        spin_lock(&fuse_lock);
+        spin_lock(&fc->lock);
         if (req->state == FUSE_REQ_FINISHED && !req->interrupted)
                 return;
 
@@ -273,9 +244,9 @@ static void request_wait_answer(struct fuse_conn *fc, struct fuse_req *req)
                    locked state, there mustn't be any filesystem
                    operation (e.g. page fault), since that could lead
                    to deadlock */
-                spin_unlock(&fuse_lock);
+                spin_unlock(&fc->lock);
                 wait_event(req->waitq, !req->locked);
-                spin_lock(&fuse_lock);
+                spin_lock(&fc->lock);
         }
         if (req->state == FUSE_REQ_PENDING) {
                 list_del(&req->list);
@@ -304,19 +275,10 @@ static void queue_request(struct fuse_conn *fc, struct fuse_req *req)
         req->in.h.unique = fc->reqctr;
         req->in.h.len = sizeof(struct fuse_in_header) +
                 len_args(req->in.numargs, (struct fuse_arg *) req->in.args);
-        if (!req->preallocated) {
-                /* If request is not preallocated (either FORGET or
-                   RELEASE), then still decrease outstanding_sem, so
-                   user can't open infinite number of files while not
-                   processing the RELEASE requests.  However for
-                   efficiency do it without blocking, so if down()
-                   would block, just increase the debt instead */
-                if (down_trylock(&fc->outstanding_sem))
-                        fc->outstanding_debt++;
-        }
         list_add_tail(&req->list, &fc->pending);
         req->state = FUSE_REQ_PENDING;
         wake_up(&fc->waitq);
+        kill_fasync(&fc->fasync, SIGIO, POLL_IN);
 }
 
 /*
@@ -325,7 +287,7 @@ static void queue_request(struct fuse_conn *fc, struct fuse_req *req)
 void request_send(struct fuse_conn *fc, struct fuse_req *req)
 {
         req->isreply = 1;
-        spin_lock(&fuse_lock);
+        spin_lock(&fc->lock);
         if (!fc->connected)
                 req->out.h.error = -ENOTCONN;
         else if (fc->conn_error)
@@ -338,15 +300,16 @@ void request_send(struct fuse_conn *fc, struct fuse_req *req)
 
                 request_wait_answer(fc, req);
         }
-        spin_unlock(&fuse_lock);
+        spin_unlock(&fc->lock);
 }
 
 static void request_send_nowait(struct fuse_conn *fc, struct fuse_req *req)
 {
-        spin_lock(&fuse_lock);
+        spin_lock(&fc->lock);
+        background_request(fc, req);
         if (fc->connected) {
                 queue_request(fc, req);
-                spin_unlock(&fuse_lock);
+                spin_unlock(&fc->lock);
         } else {
                 req->out.h.error = -ENOTCONN;
                 request_end(fc, req);
@@ -362,9 +325,6 @@ void request_send_noreply(struct fuse_conn *fc, struct fuse_req *req)
 void request_send_background(struct fuse_conn *fc, struct fuse_req *req)
 {
         req->isreply = 1;
-        spin_lock(&fuse_lock);
-        background_request(fc, req);
-        spin_unlock(&fuse_lock);
         request_send_nowait(fc, req);
 }
 
@@ -373,16 +333,16 @@ void request_send_background(struct fuse_conn *fc, struct fuse_req *req)
  * anything that could cause a page-fault.  If the request was already
  * interrupted bail out.
  */
-static int lock_request(struct fuse_req *req)
+static int lock_request(struct fuse_conn *fc, struct fuse_req *req)
 {
         int err = 0;
         if (req) {
-                spin_lock(&fuse_lock);
+                spin_lock(&fc->lock);
                 if (req->interrupted)
                         err = -ENOENT;
                 else
                         req->locked = 1;
-                spin_unlock(&fuse_lock);
+                spin_unlock(&fc->lock);
         }
         return err;
 }
@@ -392,18 +352,19 @@ static int lock_request(struct fuse_req *req)
  * requester thread is currently waiting for it to be unlocked, so
  * wake it up.
  */
-static void unlock_request(struct fuse_req *req)
+static void unlock_request(struct fuse_conn *fc, struct fuse_req *req)
 {
         if (req) {
-                spin_lock(&fuse_lock);
+                spin_lock(&fc->lock);
                 req->locked = 0;
                 if (req->interrupted)
                         wake_up(&req->waitq);
-                spin_unlock(&fuse_lock);
+                spin_unlock(&fc->lock);
         }
 }
 
 struct fuse_copy_state {
+        struct fuse_conn *fc;
         int write;
         struct fuse_req *req;
         const struct iovec *iov;
@@ -416,11 +377,12 @@ struct fuse_copy_state {
         unsigned len;
 };
 
-static void fuse_copy_init(struct fuse_copy_state *cs, int write,
-                           struct fuse_req *req, const struct iovec *iov,
-                           unsigned long nr_segs)
+static void fuse_copy_init(struct fuse_copy_state *cs, struct fuse_conn *fc,
+                           int write, struct fuse_req *req,
+                           const struct iovec *iov, unsigned long nr_segs)
 {
         memset(cs, 0, sizeof(*cs));
+        cs->fc = fc;
         cs->write = write;
         cs->req = req;
         cs->iov = iov;
@@ -450,7 +412,7 @@ static int fuse_copy_fill(struct fuse_copy_state *cs)
         unsigned long offset;
         int err;
 
-        unlock_request(cs->req);
+        unlock_request(cs->fc, cs->req);
         fuse_copy_finish(cs);
         if (!cs->seglen) {
                 BUG_ON(!cs->nr_segs);
@@ -473,7 +435,7 @@ static int fuse_copy_fill(struct fuse_copy_state *cs)
         cs->seglen -= cs->len;
         cs->addr += cs->len;
 
-        return lock_request(cs->req);
+        return lock_request(cs->fc, cs->req);
 }
 
 /* Do as much copy to/from userspace buffer as we can */
@@ -585,9 +547,9 @@ static void request_wait(struct fuse_conn *fc)
                 if (signal_pending(current))
                         break;
 
-                spin_unlock(&fuse_lock);
+                spin_unlock(&fc->lock);
                 schedule();
-                spin_lock(&fuse_lock);
+                spin_lock(&fc->lock);
         }
         set_current_state(TASK_RUNNING);
         remove_wait_queue(&fc->waitq, &wait);
@@ -606,18 +568,21 @@ static ssize_t fuse_dev_readv(struct file *file, const struct iovec *iov,
                               unsigned long nr_segs, loff_t *off)
 {
         int err;
-        struct fuse_conn *fc;
         struct fuse_req *req;
         struct fuse_in *in;
         struct fuse_copy_state cs;
         unsigned reqsize;
+        struct fuse_conn *fc = fuse_get_conn(file);
+        if (!fc)
+                return -EPERM;
 
  restart:
-        spin_lock(&fuse_lock);
-        fc = file->private_data;
-        err = -EPERM;
-        if (!fc)
+        spin_lock(&fc->lock);
+        err = -EAGAIN;
+        if ((file->f_flags & O_NONBLOCK) && fc->connected &&
+            list_empty(&fc->pending))
                 goto err_unlock;
+
         request_wait(fc);
         err = -ENODEV;
         if (!fc->connected)
@@ -641,14 +606,14 @@ static ssize_t fuse_dev_readv(struct file *file, const struct iovec *iov,
                 request_end(fc, req);
                 goto restart;
         }
-        spin_unlock(&fuse_lock);
-        fuse_copy_init(&cs, 1, req, iov, nr_segs);
+        spin_unlock(&fc->lock);
+        fuse_copy_init(&cs, fc, 1, req, iov, nr_segs);
         err = fuse_copy_one(&cs, &in->h, sizeof(in->h));
         if (!err)
                 err = fuse_copy_args(&cs, in->numargs, in->argpages,
                                      (struct fuse_arg *) in->args, 0);
         fuse_copy_finish(&cs);
-        spin_lock(&fuse_lock);
+        spin_lock(&fc->lock);
         req->locked = 0;
         if (!err && req->interrupted)
                 err = -ENOENT;
@@ -663,12 +628,12 @@ static ssize_t fuse_dev_readv(struct file *file, const struct iovec *iov,
         else {
                 req->state = FUSE_REQ_SENT;
                 list_move_tail(&req->list, &fc->processing);
-                spin_unlock(&fuse_lock);
+                spin_unlock(&fc->lock);
         }
         return reqsize;
 
  err_unlock:
-        spin_unlock(&fuse_lock);
+        spin_unlock(&fc->lock);
         return err;
 }
 
@@ -735,9 +700,9 @@ static ssize_t fuse_dev_writev(struct file *file, const struct iovec *iov,
         struct fuse_copy_state cs;
         struct fuse_conn *fc = fuse_get_conn(file);
         if (!fc)
-                return -ENODEV;
+                return -EPERM;
 
-        fuse_copy_init(&cs, 0, NULL, iov, nr_segs);
+        fuse_copy_init(&cs, fc, 0, NULL, iov, nr_segs);
         if (nbytes < sizeof(struct fuse_out_header))
                 return -EINVAL;
 
@@ -749,7 +714,7 @@ static ssize_t fuse_dev_writev(struct file *file, const struct iovec *iov,
             oh.len != nbytes)
                 goto err_finish;
 
-        spin_lock(&fuse_lock);
+        spin_lock(&fc->lock);
         err = -ENOENT;
         if (!fc->connected)
                 goto err_unlock;
@@ -760,9 +725,9 @@ static ssize_t fuse_dev_writev(struct file *file, const struct iovec *iov,
                 goto err_unlock;
 
         if (req->interrupted) {
-                spin_unlock(&fuse_lock);
+                spin_unlock(&fc->lock);
                 fuse_copy_finish(&cs);
-                spin_lock(&fuse_lock);
+                spin_lock(&fc->lock);
                 request_end(fc, req);
                 return -ENOENT;
         }
@@ -770,12 +735,12 @@ static ssize_t fuse_dev_writev(struct file *file, const struct iovec *iov,
         req->out.h = oh;
         req->locked = 1;
         cs.req = req;
-        spin_unlock(&fuse_lock);
+        spin_unlock(&fc->lock);
 
         err = copy_out_args(&cs, &req->out, nbytes);
         fuse_copy_finish(&cs);
 
-        spin_lock(&fuse_lock);
+        spin_lock(&fc->lock);
         req->locked = 0;
         if (!err) {
                 if (req->interrupted)
@@ -787,7 +752,7 @@ static ssize_t fuse_dev_writev(struct file *file, const struct iovec *iov,
         return err ? err : nbytes;
 
  err_unlock:
-        spin_unlock(&fuse_lock);
+        spin_unlock(&fc->lock);
  err_finish:
         fuse_copy_finish(&cs);
         return err;
@@ -804,18 +769,19 @@ static ssize_t fuse_dev_write(struct file *file, const char __user *buf,
 
 static unsigned fuse_dev_poll(struct file *file, poll_table *wait)
 {
-        struct fuse_conn *fc = fuse_get_conn(file);
         unsigned mask = POLLOUT | POLLWRNORM;
-
+        struct fuse_conn *fc = fuse_get_conn(file);
         if (!fc)
-                return -ENODEV;
+                return POLLERR;
 
         poll_wait(file, &fc->waitq, wait);
 
-        spin_lock(&fuse_lock);
-        if (!list_empty(&fc->pending))
-                mask |= POLLIN | POLLRDNORM;
-        spin_unlock(&fuse_lock);
+        spin_lock(&fc->lock);
+        if (!fc->connected)
+                mask = POLLERR;
+        else if (!list_empty(&fc->pending))
+                mask |= POLLIN | POLLRDNORM;
+        spin_unlock(&fc->lock);
 
         return mask;
 }
@@ -823,7 +789,7 @@ static unsigned fuse_dev_poll(struct file *file, poll_table *wait)
 /*
  * Abort all requests on the given list (pending or processing)
  *
- * This function releases and reacquires fuse_lock
+ * This function releases and reacquires fc->lock
  */
 static void end_requests(struct fuse_conn *fc, struct list_head *head)
 {
@@ -832,7 +798,7 @@ static void end_requests(struct fuse_conn *fc, struct list_head *head)
                 req = list_entry(head->next, struct fuse_req, list);
                 req->out.h.error = -ECONNABORTED;
                 request_end(fc, req);
-                spin_lock(&fuse_lock);
+                spin_lock(&fc->lock);
         }
 }
 
@@ -863,10 +829,10 @@ static void end_io_requests(struct fuse_conn *fc)
                         req->end = NULL;
                         /* The end function will consume this reference */
                         __fuse_get_request(req);
-                        spin_unlock(&fuse_lock);
+                        spin_unlock(&fc->lock);
                         wait_event(req->waitq, !req->locked);
                         end(fc, req);
-                        spin_lock(&fuse_lock);
+                        spin_lock(&fc->lock);
                 }
         }
 }
@@ -893,35 +859,44 @@ static void end_io_requests(struct fuse_conn *fc)
  */
 void fuse_abort_conn(struct fuse_conn *fc)
 {
-        spin_lock(&fuse_lock);
+        spin_lock(&fc->lock);
         if (fc->connected) {
                 fc->connected = 0;
                 end_io_requests(fc);
                 end_requests(fc, &fc->pending);
                 end_requests(fc, &fc->processing);
                 wake_up_all(&fc->waitq);
+                kill_fasync(&fc->fasync, SIGIO, POLL_IN);
         }
-        spin_unlock(&fuse_lock);
+        spin_unlock(&fc->lock);
 }
 
 static int fuse_dev_release(struct inode *inode, struct file *file)
 {
-        struct fuse_conn *fc;
-
-        spin_lock(&fuse_lock);
-        fc = file->private_data;
+        struct fuse_conn *fc = fuse_get_conn(file);
         if (fc) {
+                spin_lock(&fc->lock);
                 fc->connected = 0;
                 end_requests(fc, &fc->pending);
                 end_requests(fc, &fc->processing);
-        }
-        spin_unlock(&fuse_lock);
-        if (fc)
+                spin_unlock(&fc->lock);
+                fasync_helper(-1, file, 0, &fc->fasync);
                 kobject_put(&fc->kobj);
+        }
 
         return 0;
 }
 
+static int fuse_dev_fasync(int fd, struct file *file, int on)
+{
+        struct fuse_conn *fc = fuse_get_conn(file);
+        if (!fc)
+                return -EPERM;
+
+        /* No locking - fasync_helper does its own locking */
+        return fasync_helper(fd, file, on, &fc->fasync);
+}
+
 const struct file_operations fuse_dev_operations = {
         .owner          = THIS_MODULE,
         .llseek         = no_llseek,
@@ -931,6 +906,7 @@ const struct file_operations fuse_dev_operations = {
         .writev         = fuse_dev_writev,
         .poll           = fuse_dev_poll,
         .release        = fuse_dev_release,
+        .fasync         = fuse_dev_fasync,
 };
 
 static struct miscdevice fuse_miscdevice = {
diff --git a/fs/fuse/dir.c b/fs/fuse/dir.c
index 256355b80256..8d7546e832e8 100644
--- a/fs/fuse/dir.c
+++ b/fs/fuse/dir.c
@@ -117,8 +117,8 @@ static int fuse_dentry_revalidate(struct dentry *entry, struct nameidata *nd)
                         return 0;
 
                 fc = get_fuse_conn(inode);
-                req = fuse_get_request(fc);
-                if (!req)
+                req = fuse_get_req(fc);
+                if (IS_ERR(req))
                         return 0;
 
                 fuse_lookup_init(req, entry->d_parent->d_inode, entry, &outarg);
@@ -188,9 +188,9 @@ static struct dentry *fuse_lookup(struct inode *dir, struct dentry *entry,
         if (entry->d_name.len > FUSE_NAME_MAX)
                 return ERR_PTR(-ENAMETOOLONG);
 
-        req = fuse_get_request(fc);
-        if (!req)
-                return ERR_PTR(-EINTR);
+        req = fuse_get_req(fc);
+        if (IS_ERR(req))
+                return ERR_PTR(PTR_ERR(req));
 
         fuse_lookup_init(req, dir, entry, &outarg);
         request_send(fc, req);
@@ -244,15 +244,14 @@ static int fuse_create_open(struct inode *dir, struct dentry *entry, int mode,
         struct file *file;
         int flags = nd->intent.open.flags - 1;
 
-        err = -ENOSYS;
         if (fc->no_create)
-                goto out;
+                return -ENOSYS;
 
-        err = -EINTR;
-        req = fuse_get_request(fc);
-        if (!req)
-                goto out;
+        req = fuse_get_req(fc);
+        if (IS_ERR(req))
+                return PTR_ERR(req);
 
+        err = -ENOMEM;
         ff = fuse_file_alloc();
         if (!ff)
                 goto out_put_request;
@@ -314,7 +313,6 @@ static int fuse_create_open(struct inode *dir, struct dentry *entry, int mode,
         fuse_file_free(ff);
  out_put_request:
         fuse_put_request(fc, req);
- out:
         return err;
 }
 
@@ -375,9 +373,9 @@ static int fuse_mknod(struct inode *dir, struct dentry *entry, int mode,
 {
         struct fuse_mknod_in inarg;
         struct fuse_conn *fc = get_fuse_conn(dir);
-        struct fuse_req *req = fuse_get_request(fc);
-        if (!req)
-                return -EINTR;
+        struct fuse_req *req = fuse_get_req(fc);
+        if (IS_ERR(req))
+                return PTR_ERR(req);
 
         memset(&inarg, 0, sizeof(inarg));
         inarg.mode = mode;
@@ -407,9 +405,9 @@ static int fuse_mkdir(struct inode *dir, struct dentry *entry, int mode)
 {
         struct fuse_mkdir_in inarg;
         struct fuse_conn *fc = get_fuse_conn(dir);
-        struct fuse_req *req = fuse_get_request(fc);
-        if (!req)
-                return -EINTR;
+        struct fuse_req *req = fuse_get_req(fc);
+        if (IS_ERR(req))
+                return PTR_ERR(req);
 
         memset(&inarg, 0, sizeof(inarg));
         inarg.mode = mode;
@@ -427,9 +425,9 @@ static int fuse_symlink(struct inode *dir, struct dentry *entry,
 {
         struct fuse_conn *fc = get_fuse_conn(dir);
         unsigned len = strlen(link) + 1;
-        struct fuse_req *req = fuse_get_request(fc);
-        if (!req)
-                return -EINTR;
+        struct fuse_req *req = fuse_get_req(fc);
+        if (IS_ERR(req))
+                return PTR_ERR(req);
 
         req->in.h.opcode = FUSE_SYMLINK;
         req->in.numargs = 2;
@@ -444,9 +442,9 @@ static int fuse_unlink(struct inode *dir, struct dentry *entry)
 {
         int err;
         struct fuse_conn *fc = get_fuse_conn(dir);
-        struct fuse_req *req = fuse_get_request(fc);
-        if (!req)
-                return -EINTR;
+        struct fuse_req *req = fuse_get_req(fc);
+        if (IS_ERR(req))
+                return PTR_ERR(req);
 
         req->in.h.opcode = FUSE_UNLINK;
         req->in.h.nodeid = get_node_id(dir);
@@ -476,9 +474,9 @@ static int fuse_rmdir(struct inode *dir, struct dentry *entry)
 {
         int err;
         struct fuse_conn *fc = get_fuse_conn(dir);
-        struct fuse_req *req = fuse_get_request(fc);
-        if (!req)
-                return -EINTR;
+        struct fuse_req *req = fuse_get_req(fc);
+        if (IS_ERR(req))
+                return PTR_ERR(req);
 
         req->in.h.opcode = FUSE_RMDIR;
         req->in.h.nodeid = get_node_id(dir);
@@ -504,9 +502,9 @@ static int fuse_rename(struct inode *olddir, struct dentry *oldent,
         int err;
         struct fuse_rename_in inarg;
         struct fuse_conn *fc = get_fuse_conn(olddir);
-        struct fuse_req *req = fuse_get_request(fc);
-        if (!req)
-                return -EINTR;
+        struct fuse_req *req = fuse_get_req(fc);
+        if (IS_ERR(req))
+                return PTR_ERR(req);
 
         memset(&inarg, 0, sizeof(inarg));
         inarg.newdir = get_node_id(newdir);
@@ -553,9 +551,9 @@ static int fuse_link(struct dentry *entry, struct inode *newdir,
         struct fuse_link_in inarg;
         struct inode *inode = entry->d_inode;
         struct fuse_conn *fc = get_fuse_conn(inode);
-        struct fuse_req *req = fuse_get_request(fc);
-        if (!req)
-                return -EINTR;
+        struct fuse_req *req = fuse_get_req(fc);
+        if (IS_ERR(req))
+                return PTR_ERR(req);
 
         memset(&inarg, 0, sizeof(inarg));
         inarg.oldnodeid = get_node_id(inode);
@@ -583,9 +581,9 @@ int fuse_do_getattr(struct inode *inode)
         int err;
         struct fuse_attr_out arg;
         struct fuse_conn *fc = get_fuse_conn(inode);
-        struct fuse_req *req = fuse_get_request(fc);
-        if (!req)
-                return -EINTR;
+        struct fuse_req *req = fuse_get_req(fc);
+        if (IS_ERR(req))
+                return PTR_ERR(req);
 
         req->in.h.opcode = FUSE_GETATTR;
         req->in.h.nodeid = get_node_id(inode);
@@ -673,9 +671,9 @@ static int fuse_access(struct inode *inode, int mask)
         if (fc->no_access)
                 return 0;
 
-        req = fuse_get_request(fc);
-        if (!req)
-                return -EINTR;
+        req = fuse_get_req(fc);
+        if (IS_ERR(req))
+                return PTR_ERR(req);
 
         memset(&inarg, 0, sizeof(inarg));
         inarg.mask = mask;
@@ -780,9 +778,9 @@ static int fuse_readdir(struct file *file, void *dstbuf, filldir_t filldir)
         if (is_bad_inode(inode))
                 return -EIO;
 
-        req = fuse_get_request(fc);
-        if (!req)
-                return -EINTR;
+        req = fuse_get_req(fc);
+        if (IS_ERR(req))
+                return PTR_ERR(req);
 
         page = alloc_page(GFP_KERNEL);
         if (!page) {
@@ -809,11 +807,11 @@ static char *read_link(struct dentry *dentry)
 {
         struct inode *inode = dentry->d_inode;
         struct fuse_conn *fc = get_fuse_conn(inode);
-        struct fuse_req *req = fuse_get_request(fc);
+        struct fuse_req *req = fuse_get_req(fc);
         char *link;
 
-        if (!req)
-                return ERR_PTR(-EINTR);
+        if (IS_ERR(req))
+                return ERR_PTR(PTR_ERR(req));
 
         link = (char *) __get_free_page(GFP_KERNEL);
         if (!link) {
@@ -933,9 +931,9 @@ static int fuse_setattr(struct dentry *entry, struct iattr *attr)
                 }
         }
 
-        req = fuse_get_request(fc);
-        if (!req)
-                return -EINTR;
+        req = fuse_get_req(fc);
+        if (IS_ERR(req))
+                return PTR_ERR(req);
 
         memset(&inarg, 0, sizeof(inarg));
         iattr_to_fattr(attr, &inarg);
@@ -995,9 +993,9 @@ static int fuse_setxattr(struct dentry *entry, const char *name,
         if (fc->no_setxattr)
                 return -EOPNOTSUPP;
 
-        req = fuse_get_request(fc);
-        if (!req)
-                return -EINTR;
+        req = fuse_get_req(fc);
+        if (IS_ERR(req))
+                return PTR_ERR(req);
 
         memset(&inarg, 0, sizeof(inarg));
         inarg.size = size;
@@ -1035,9 +1033,9 @@ static ssize_t fuse_getxattr(struct dentry *entry, const char *name,
         if (fc->no_getxattr)
                 return -EOPNOTSUPP;
 
-        req = fuse_get_request(fc);
-        if (!req)
-                return -EINTR;
+        req = fuse_get_req(fc);
+        if (IS_ERR(req))
+                return PTR_ERR(req);
 
         memset(&inarg, 0, sizeof(inarg));
         inarg.size = size;
@@ -1085,9 +1083,9 @@ static ssize_t fuse_listxattr(struct dentry *entry, char *list, size_t size)
         if (fc->no_listxattr)
                 return -EOPNOTSUPP;
 
-        req = fuse_get_request(fc);
-        if (!req)
-                return -EINTR;
+        req = fuse_get_req(fc);
+        if (IS_ERR(req))
+                return PTR_ERR(req);
 
         memset(&inarg, 0, sizeof(inarg));
         inarg.size = size;
@@ -1131,9 +1129,9 @@ static int fuse_removexattr(struct dentry *entry, const char *name)
         if (fc->no_removexattr)
                 return -EOPNOTSUPP;
 
-        req = fuse_get_request(fc);
-        if (!req)
-                return -EINTR;
+        req = fuse_get_req(fc);
+        if (IS_ERR(req))
+                return PTR_ERR(req);
 
         req->in.h.opcode = FUSE_REMOVEXATTR;
         req->in.h.nodeid = get_node_id(inode);
diff --git a/fs/fuse/file.c b/fs/fuse/file.c
index 975f2697e866..e4f041a11bb5 100644
--- a/fs/fuse/file.c
+++ b/fs/fuse/file.c
@@ -22,9 +22,9 @@ static int fuse_send_open(struct inode *inode, struct file *file, int isdir,
         struct fuse_req *req;
         int err;
 
-        req = fuse_get_request(fc);
-        if (!req)
-                return -EINTR;
+        req = fuse_get_req(fc);
+        if (IS_ERR(req))
+                return PTR_ERR(req);
 
         memset(&inarg, 0, sizeof(inarg));
         inarg.flags = file->f_flags & ~(O_CREAT | O_EXCL | O_NOCTTY | O_TRUNC);
@@ -184,9 +184,9 @@ static int fuse_flush(struct file *file)
         if (fc->no_flush)
                 return 0;
 
-        req = fuse_get_request(fc);
-        if (!req)
-                return -EINTR;
+        req = fuse_get_req(fc);
+        if (IS_ERR(req))
+                return PTR_ERR(req);
 
         memset(&inarg, 0, sizeof(inarg));
         inarg.fh = ff->fh;
@@ -223,9 +223,9 @@ int fuse_fsync_common(struct file *file, struct dentry *de, int datasync,
         if ((!isdir && fc->no_fsync) || (isdir && fc->no_fsyncdir))
                 return 0;
 
-        req = fuse_get_request(fc);
-        if (!req)
-                return -EINTR;
+        req = fuse_get_req(fc);
+        if (IS_ERR(req))
+                return PTR_ERR(req);
 
         memset(&inarg, 0, sizeof(inarg));
         inarg.fh = ff->fh;
@@ -297,9 +297,9 @@ static int fuse_readpage(struct file *file, struct page *page)
         if (is_bad_inode(inode))
                 goto out;
 
-        err = -EINTR;
-        req = fuse_get_request(fc);
-        if (!req)
+        req = fuse_get_req(fc);
+        err = PTR_ERR(req);
+        if (IS_ERR(req))
                 goto out;
 
         req->out.page_zeroing = 1;
@@ -368,10 +368,10 @@ static int fuse_readpages_fill(void *_data, struct page *page)
              (req->num_pages + 1) * PAGE_CACHE_SIZE > fc->max_read ||
              req->pages[req->num_pages - 1]->index + 1 != page->index)) {
                 fuse_send_readpages(req, data->file, inode);
-                data->req = req = fuse_get_request(fc);
-                if (!req) {
+                data->req = req = fuse_get_req(fc);
+                if (IS_ERR(req)) {
                         unlock_page(page);
-                        return -EINTR;
+                        return PTR_ERR(req);
                 }
         }
         req->pages[req->num_pages] = page;
@@ -392,13 +392,17 @@ static int fuse_readpages(struct file *file, struct address_space *mapping,
 
         data.file = file;
         data.inode = inode;
-        data.req = fuse_get_request(fc);
-        if (!data.req)
-                return -EINTR;
+        data.req = fuse_get_req(fc);
+        if (IS_ERR(data.req))
+                return PTR_ERR(data.req);
 
         err = read_cache_pages(mapping, pages, fuse_readpages_fill, &data);
-        if (!err)
-                fuse_send_readpages(data.req, file, inode);
+        if (!err) {
+                if (data.req->num_pages)
+                        fuse_send_readpages(data.req, file, inode);
+                else
+                        fuse_put_request(fc, data.req);
+        }
         return err;
 }
 
@@ -451,9 +455,9 @@ static int fuse_commit_write(struct file *file, struct page *page,
         if (is_bad_inode(inode))
                 return -EIO;
 
-        req = fuse_get_request(fc);
-        if (!req)
-                return -EINTR;
+        req = fuse_get_req(fc);
+        if (IS_ERR(req))
+                return PTR_ERR(req);
 
         req->num_pages = 1;
         req->pages[0] = page;
@@ -528,9 +532,9 @@ static ssize_t fuse_direct_io(struct file *file, const char __user *buf,
         if (is_bad_inode(inode))
                 return -EIO;
 
-        req = fuse_get_request(fc);
-        if (!req)
-                return -EINTR;
+        req = fuse_get_req(fc);
+        if (IS_ERR(req))
+                return PTR_ERR(req);
 
         while (count) {
                 size_t nres;
diff --git a/fs/fuse/fuse_i.h b/fs/fuse/fuse_i.h
index a16a04fcf41e..19c7185a7546 100644
--- a/fs/fuse/fuse_i.h
+++ b/fs/fuse/fuse_i.h
@@ -1,6 +1,6 @@
 /*
   FUSE: Filesystem in Userspace
-  Copyright (C) 2001-2005  Miklos Szeredi <miklos@szeredi.hu>
+  Copyright (C) 2001-2006  Miklos Szeredi <miklos@szeredi.hu>
 
   This program can be distributed under the terms of the GNU GPL.
   See the file COPYING.
@@ -18,8 +18,8 @@
 /** Max number of pages that can be used in a single read request */
 #define FUSE_MAX_PAGES_PER_REQ 32
 
-/** If more requests are outstanding, then the operation will block */
-#define FUSE_MAX_OUTSTANDING 10
+/** Maximum number of outstanding background requests */
+#define FUSE_MAX_BACKGROUND 10
 
 /** It could be as large as PATH_MAX, but would that have any uses? */
 #define FUSE_NAME_MAX 1024
@@ -131,8 +131,8 @@ struct fuse_conn;
  * A request to the client
  */
 struct fuse_req {
-        /** This can be on either unused_list, pending processing or
-            io lists in fuse_conn */
+        /** This can be on either pending processing or io lists in
+            fuse_conn */
         struct list_head list;
 
         /** Entry on the background list */
@@ -144,15 +144,12 @@ struct fuse_req {
         /*
          * The following bitfields are either set once before the
          * request is queued or setting/clearing them is protected by
-         * fuse_lock
+         * fuse_conn->lock
          */
 
         /** True if the request has reply */
         unsigned isreply:1;
 
-        /** The request is preallocated */
-        unsigned preallocated:1;
-
         /** The request was interrupted */
         unsigned interrupted:1;
 
@@ -213,6 +210,9 @@ struct fuse_req {
  * unmounted.
  */
 struct fuse_conn {
+        /** Lock protecting accessess to  members of this structure */
+        spinlock_t lock;
+
         /** The user id for this mount */
         uid_t user_id;
 
@@ -244,19 +244,20 @@ struct fuse_conn {
             interrupted request) */
         struct list_head background;
 
-        /** Controls the maximum number of outstanding requests */
-        struct semaphore outstanding_sem;
+        /** Number of requests currently in the background */
+        unsigned num_background;
+
+        /** Flag indicating if connection is blocked.  This will be
+            the case before the INIT reply is received, and if there
+            are too many outstading backgrounds requests */
+        int blocked;
 
-        /** This counts the number of outstanding requests if
-            outstanding_sem would go negative */
-        unsigned outstanding_debt;
+        /** waitq for blocked connection */
+        wait_queue_head_t blocked_waitq;
 
         /** RW semaphore for exclusion with fuse_put_super() */
         struct rw_semaphore sbput_sem;
 
-        /** The list of unused requests */
-        struct list_head unused_list;
-
         /** The next unique request id */
         u64 reqctr;
 
@@ -318,6 +319,9 @@ struct fuse_conn {
 
         /** kobject */
         struct kobject kobj;
+
+        /** O_ASYNC requests */
+        struct fasync_struct *fasync;
 };
 
 static inline struct fuse_conn *get_fuse_conn_super(struct super_block *sb)
@@ -349,21 +353,6 @@ static inline u64 get_node_id(struct inode *inode)
 extern const struct file_operations fuse_dev_operations;
 
 /**
- * This is the single global spinlock which protects FUSE's structures
- *
- * The following data is protected by this lock:
- *
- *  - the private_data field of the device file
- *  - the s_fs_info field of the super block
- *  - unused_list, pending, processing lists in fuse_conn
- *  - background list in fuse_conn
- *  - the unique request ID counter reqctr in fuse_conn
- *  - the sb (super_block) field in fuse_conn
- *  - the file (device file) field in fuse_conn
- */
-extern spinlock_t fuse_lock;
-
-/**
  * Get a filled in inode
  */
 struct inode *fuse_iget(struct super_block *sb, unsigned long nodeid,
@@ -461,11 +450,11 @@ void fuse_reset_request(struct fuse_req *req);
 /**
  * Reserve a preallocated request
  */
-struct fuse_req *fuse_get_request(struct fuse_conn *fc);
+struct fuse_req *fuse_get_req(struct fuse_conn *fc);
 
 /**
- * Decrement reference count of a request.  If count goes to zero put
- * on unused list (preallocated) or free request (not preallocated).
+ * Decrement reference count of a request.  If count goes to zero free
+ * the request.
  */
 void fuse_put_request(struct fuse_conn *fc, struct fuse_req *req);
 
@@ -487,7 +476,7 @@ void request_send_background(struct fuse_conn *fc, struct fuse_req *req);
 /**
  * Release inodes and file associated with background request
  */
-void fuse_release_background(struct fuse_req *req);
+void fuse_release_background(struct fuse_conn *fc, struct fuse_req *req);
 
 /* Abort all requests */
 void fuse_abort_conn(struct fuse_conn *fc);
diff --git a/fs/fuse/inode.c b/fs/fuse/inode.c
index 879e6fba9480..fd34037b0588 100644
--- a/fs/fuse/inode.c
+++ b/fs/fuse/inode.c
@@ -1,6 +1,6 @@
 /*
   FUSE: Filesystem in Userspace
-  Copyright (C) 2001-2005  Miklos Szeredi <miklos@szeredi.hu>
+  Copyright (C) 2001-2006  Miklos Szeredi <miklos@szeredi.hu>
 
   This program can be distributed under the terms of the GNU GPL.
   See the file COPYING.
@@ -22,7 +22,6 @@ MODULE_AUTHOR("Miklos Szeredi <miklos@szeredi.hu>");
 MODULE_DESCRIPTION("Filesystem in Userspace");
 MODULE_LICENSE("GPL");
 
-spinlock_t fuse_lock;
 static kmem_cache_t *fuse_inode_cachep;
 static struct subsystem connections_subsys;
 
@@ -207,15 +206,17 @@ static void fuse_put_super(struct super_block *sb)
 
         down_write(&fc->sbput_sem);
         while (!list_empty(&fc->background))
-                fuse_release_background(list_entry(fc->background.next,
+                fuse_release_background(fc,
+                                        list_entry(fc->background.next,
                                                    struct fuse_req, bg_entry));
 
-        spin_lock(&fuse_lock);
+        spin_lock(&fc->lock);
         fc->mounted = 0;
         fc->connected = 0;
-        spin_unlock(&fuse_lock);
+        spin_unlock(&fc->lock);
         up_write(&fc->sbput_sem);
         /* Flush all readers on this fs */
+        kill_fasync(&fc->fasync, SIGIO, POLL_IN);
         wake_up_all(&fc->waitq);
         kobject_del(&fc->kobj);
         kobject_put(&fc->kobj);
@@ -242,9 +243,9 @@ static int fuse_statfs(struct super_block *sb, struct kstatfs *buf)
         struct fuse_statfs_out outarg;
         int err;
 
-        req = fuse_get_request(fc);
-        if (!req)
-                return -EINTR;
+        req = fuse_get_req(fc);
+        if (IS_ERR(req))
+                return PTR_ERR(req);
 
         memset(&outarg, 0, sizeof(outarg));
         req->in.numargs = 0;
@@ -369,15 +370,7 @@ static int fuse_show_options(struct seq_file *m, struct vfsmount *mnt)
 
 static void fuse_conn_release(struct kobject *kobj)
 {
-        struct fuse_conn *fc = get_fuse_conn_kobj(kobj);
-
-        while (!list_empty(&fc->unused_list)) {
-                struct fuse_req *req;
-                req = list_entry(fc->unused_list.next, struct fuse_req, list);
-                list_del(&req->list);
-                fuse_request_free(req);
-        }
-        kfree(fc);
+        kfree(get_fuse_conn_kobj(kobj));
 }
 
 static struct fuse_conn *new_conn(void)
@@ -386,64 +379,25 @@ static struct fuse_conn *new_conn(void)
 
         fc = kzalloc(sizeof(*fc), GFP_KERNEL);
         if (fc) {
-                int i;
+                spin_lock_init(&fc->lock);
                 init_waitqueue_head(&fc->waitq);
+                init_waitqueue_head(&fc->blocked_waitq);
                 INIT_LIST_HEAD(&fc->pending);
                 INIT_LIST_HEAD(&fc->processing);
                 INIT_LIST_HEAD(&fc->io);
-                INIT_LIST_HEAD(&fc->unused_list);
                 INIT_LIST_HEAD(&fc->background);
-                sema_init(&fc->outstanding_sem, 1); /* One for INIT */
                 init_rwsem(&fc->sbput_sem);
                 kobj_set_kset_s(fc, connections_subsys);
                 kobject_init(&fc->kobj);
                 atomic_set(&fc->num_waiting, 0);
-                for (i = 0; i < FUSE_MAX_OUTSTANDING; i++) {
-                        struct fuse_req *req = fuse_request_alloc();
-                        if (!req) {
-                                kobject_put(&fc->kobj);
-                                return NULL;
-                        }
-                        list_add(&req->list, &fc->unused_list);
-                }
                 fc->bdi.ra_pages = (VM_MAX_READAHEAD * 1024) / PAGE_CACHE_SIZE;
                 fc->bdi.unplug_io_fn = default_unplug_io_fn;
                 fc->reqctr = 0;
+                fc->blocked = 1;
         }
         return fc;
 }
 
-static struct fuse_conn *get_conn(struct file *file, struct super_block *sb)
-{
-        struct fuse_conn *fc;
-        int err;
-
-        err = -EINVAL;
-        if (file->f_op != &fuse_dev_operations)
-                goto out_err;
-
-        err = -ENOMEM;
-        fc = new_conn();
-        if (!fc)
-                goto out_err;
-
-        spin_lock(&fuse_lock);
-        err = -EINVAL;
-        if (file->private_data)
-                goto out_unlock;
-
-        kobject_get(&fc->kobj);
-        file->private_data = fc;
-        spin_unlock(&fuse_lock);
-        return fc;
-
- out_unlock:
-        spin_unlock(&fuse_lock);
-        kobject_put(&fc->kobj);
- out_err:
-        return ERR_PTR(err);
-}
-
 static struct inode *get_root_inode(struct super_block *sb, unsigned mode)
 {
         struct fuse_attr attr;
@@ -467,7 +421,6 @@ static struct super_operations fuse_super_operations = {
 
 static void process_init_reply(struct fuse_conn *fc, struct fuse_req *req)
 {
-        int i;
         struct fuse_init_out *arg = &req->misc.init_out;
 
         if (req->out.h.error || arg->major != FUSE_KERNEL_VERSION)
@@ -486,22 +439,13 @@ static void process_init_reply(struct fuse_conn *fc, struct fuse_req *req)
                 fc->minor = arg->minor;
                 fc->max_write = arg->minor < 5 ? 4096 : arg->max_write;
         }
-
-        /* After INIT reply is received other requests can go
-           out.  So do (FUSE_MAX_OUTSTANDING - 1) number of
-           up()s on outstanding_sem.  The last up() is done in
-           fuse_putback_request() */
-        for (i = 1; i < FUSE_MAX_OUTSTANDING; i++)
-                up(&fc->outstanding_sem);
-
         fuse_put_request(fc, req);
+        fc->blocked = 0;
+        wake_up_all(&fc->blocked_waitq);
 }
 
-static void fuse_send_init(struct fuse_conn *fc)
+static void fuse_send_init(struct fuse_conn *fc, struct fuse_req *req)
 {
-        /* This is called from fuse_read_super() so there's guaranteed
-           to be exactly one request available */
-        struct fuse_req *req = fuse_get_request(fc);
         struct fuse_init_in *arg = &req->misc.init_in;
 
         arg->major = FUSE_KERNEL_VERSION;
@@ -525,12 +469,9 @@ static void fuse_send_init(struct fuse_conn *fc)
 
 static unsigned long long conn_id(void)
 {
+        /* BKL is held for ->get_sb() */
         static unsigned long long ctr = 1;
-        unsigned long long val;
-        spin_lock(&fuse_lock);
-        val = ctr++;
-        spin_unlock(&fuse_lock);
-        return val;
+        return ctr++;
 }
 
 static int fuse_fill_super(struct super_block *sb, void *data, int silent)
@@ -540,6 +481,7 @@ static int fuse_fill_super(struct super_block *sb, void *data, int silent)
         struct fuse_mount_data d;
         struct file *file;
         struct dentry *root_dentry;
+        struct fuse_req *init_req;
         int err;
 
         if (!parse_fuse_opt((char *) data, &d))
@@ -555,10 +497,17 @@ static int fuse_fill_super(struct super_block *sb, void *data, int silent)
         if (!file)
                 return -EINVAL;
 
-        fc = get_conn(file, sb);
-        fput(file);
-        if (IS_ERR(fc))
-                return PTR_ERR(fc);
+        if (file->f_op != &fuse_dev_operations)
+                return -EINVAL;
+
+        /* Setting file->private_data can't race with other mount()
+           instances, since BKL is held for ->get_sb() */
+        if (file->private_data)
+                return -EINVAL;
+
+        fc = new_conn();
+        if (!fc)
+                return -ENOMEM;
 
         fc->flags = d.flags;
         fc->user_id = d.user_id;
@@ -579,27 +528,40 @@ static int fuse_fill_super(struct super_block *sb, void *data, int silent)
                 goto err;
         }
 
+        init_req = fuse_request_alloc();
+        if (!init_req)
+                goto err_put_root;
+
         err = kobject_set_name(&fc->kobj, "%llu", conn_id());
         if (err)
-                goto err_put_root;
+                goto err_free_req;
 
         err = kobject_add(&fc->kobj);
         if (err)
-                goto err_put_root;
+                goto err_free_req;
 
         sb->s_root = root_dentry;
-        spin_lock(&fuse_lock);
         fc->mounted = 1;
         fc->connected = 1;
-        spin_unlock(&fuse_lock);
+        kobject_get(&fc->kobj);
+        file->private_data = fc;
+        /*
+         * atomic_dec_and_test() in fput() provides the necessary
+         * memory barrier for file->private_data to be visible on all
+         * CPUs after this
+         */
+        fput(file);
 
-        fuse_send_init(fc);
+        fuse_send_init(fc, init_req);
 
         return 0;
 
+ err_free_req:
+        fuse_request_free(init_req);
  err_put_root:
         dput(root_dentry);
  err:
+        fput(file);
         kobject_put(&fc->kobj);
         return err;
 }
@@ -753,7 +715,6 @@ static int __init fuse_init(void)
         printk("fuse init (API version %i.%i)\n",
                FUSE_KERNEL_VERSION, FUSE_KERNEL_MINOR_VERSION);
 
-        spin_lock_init(&fuse_lock);
         res = fuse_fs_init();
         if (res)
                 goto err;
diff --git a/fs/hfsplus/bnode.c b/fs/hfsplus/bnode.c
index 8f07e8fbd03d..746abc9ecf70 100644
--- a/fs/hfsplus/bnode.c
+++ b/fs/hfsplus/bnode.c
@@ -466,8 +466,7 @@ void hfs_bnode_unhash(struct hfs_bnode *node)
         for (p = &node->tree->node_hash[hfs_bnode_hash(node->this)];
              *p && *p != node; p = &(*p)->next_hash)
                 ;
-        if (!*p)
-                BUG();
+        BUG_ON(!*p);
         *p = node->next_hash;
         node->tree->node_hash_cnt--;
 }
@@ -622,8 +621,7 @@ void hfs_bnode_put(struct hfs_bnode *node)
 
                 dprint(DBG_BNODE_REFS, "put_node(%d:%d): %d\n",
                        node->tree->cnid, node->this, atomic_read(&node->refcnt));
-                if (!atomic_read(&node->refcnt))
-                        BUG();
+                BUG_ON(!atomic_read(&node->refcnt));
                 if (!atomic_dec_and_lock(&node->refcnt, &tree->hash_lock))
                         return;
                 for (i = 0; i < tree->pages_per_bnode; i++) {
diff --git a/fs/hfsplus/btree.c b/fs/hfsplus/btree.c
index a67edfa34e9e..effa8991999c 100644
--- a/fs/hfsplus/btree.c
+++ b/fs/hfsplus/btree.c
@@ -269,8 +269,7 @@ void hfs_bmap_free(struct hfs_bnode *node)
         u8 *data, byte, m;
 
         dprint(DBG_BNODE_MOD, "btree_free_node: %u\n", node->this);
-        if (!node->this)
-                BUG();
+        BUG_ON(!node->this);
         tree = node->tree;
         nidx = node->this;
         node = hfs_bnode_find(tree, 0);
diff --git a/fs/inode.c b/fs/inode.c
index 32b7c3375021..3a2446a27d2c 100644
--- a/fs/inode.c
+++ b/fs/inode.c
@@ -172,8 +172,7 @@ static struct inode *alloc_inode(struct super_block *sb)
 
 void destroy_inode(struct inode *inode) 
 {
-        if (inode_has_buffers(inode))
-                BUG();
+        BUG_ON(inode_has_buffers(inode));
         security_inode_free(inode);
         if (inode->i_sb->s_op->destroy_inode)
                 inode->i_sb->s_op->destroy_inode(inode);
@@ -249,12 +248,9 @@ void clear_inode(struct inode *inode)
         might_sleep();
         invalidate_inode_buffers(inode);
        
-        if (inode->i_data.nrpages)
-                BUG();
-        if (!(inode->i_state & I_FREEING))
-                BUG();
-        if (inode->i_state & I_CLEAR)
-                BUG();
+        BUG_ON(inode->i_data.nrpages);
+        BUG_ON(!(inode->i_state & I_FREEING));
+        BUG_ON(inode->i_state & I_CLEAR);
         wait_on_inode(inode);
         DQUOT_DROP(inode);
         if (inode->i_sb && inode->i_sb->s_op->clear_inode)
@@ -1054,8 +1050,7 @@ void generic_delete_inode(struct inode *inode)
         hlist_del_init(&inode->i_hash);
         spin_unlock(&inode_lock);
         wake_up_inode(inode);
-        if (inode->i_state != I_CLEAR)
-                BUG();
+        BUG_ON(inode->i_state != I_CLEAR);
         destroy_inode(inode);
 }
 
diff --git a/fs/inotify.c b/fs/inotify.c
index 367c487c014b..1f50302849c5 100644
--- a/fs/inotify.c
+++ b/fs/inotify.c
@@ -538,7 +538,7 @@ void inotify_d_instantiate(struct dentry *entry, struct inode *inode)
         WARN_ON(entry->d_flags & DCACHE_INOTIFY_PARENT_WATCHED);
         spin_lock(&entry->d_lock);
         parent = entry->d_parent;
-        if (inotify_inode_watched(parent->d_inode))
+        if (parent->d_inode && inotify_inode_watched(parent->d_inode))
                 entry->d_flags |= DCACHE_INOTIFY_PARENT_WATCHED;
         spin_unlock(&entry->d_lock);
 }
diff --git a/fs/jffs2/background.c b/fs/jffs2/background.c
index 7b77a9541125..ff2a872e80e7 100644
--- a/fs/jffs2/background.c
+++ b/fs/jffs2/background.c
@@ -35,8 +35,7 @@ int jffs2_start_garbage_collect_thread(struct jffs2_sb_info *c)
         pid_t pid;
         int ret = 0;
 
-        if (c->gc_task)
-                BUG();
+        BUG_ON(c->gc_task);
 
         init_completion(&c->gc_thread_start);
         init_completion(&c->gc_thread_exit);
diff --git a/fs/namespace.c b/fs/namespace.c
index bf478addb852..2c5f1f80bdc2 100644
--- a/fs/namespace.c
+++ b/fs/namespace.c
@@ -899,11 +899,13 @@ static int do_change_type(struct nameidata *nd, int flag)
 /*
  * do loopback mount.
  */
-static int do_loopback(struct nameidata *nd, char *old_name, int recurse)
+static int do_loopback(struct nameidata *nd, char *old_name, unsigned long flags, int mnt_flags)
 {
         struct nameidata old_nd;
         struct vfsmount *mnt = NULL;
+        int recurse = flags & MS_REC;
         int err = mount_is_safe(nd);
+
         if (err)
                 return err;
         if (!old_name || !*old_name)
@@ -937,6 +939,7 @@ static int do_loopback(struct nameidata *nd, char *old_name, int recurse)
                 spin_unlock(&vfsmount_lock);
                 release_mounts(&umount_list);
         }
+        mnt->mnt_flags = mnt_flags;
 
 out:
         up_write(&namespace_sem);
@@ -1350,7 +1353,7 @@ long do_mount(char *dev_name, char *dir_name, char *type_page,
                 retval = do_remount(&nd, flags & ~MS_REMOUNT, mnt_flags,
                                     data_page);
         else if (flags & MS_BIND)
-                retval = do_loopback(&nd, dev_name, flags & MS_REC);
+                retval = do_loopback(&nd, dev_name, flags, mnt_flags);
         else if (flags & (MS_SHARED | MS_PRIVATE | MS_SLAVE | MS_UNBINDABLE))
                 retval = do_change_type(&nd, flags);
         else if (flags & MS_MOVE)
diff --git a/fs/nfsd/auth.c b/fs/nfsd/auth.c
index cfe9ce881613..6e92b0fe5323 100644
--- a/fs/nfsd/auth.c
+++ b/fs/nfsd/auth.c
@@ -14,46 +14,46 @@
 
 int nfsd_setuser(struct svc_rqst *rqstp, struct svc_export *exp)
 {
-        struct svc_cred *cred = &rqstp->rq_cred;
+        struct svc_cred cred = rqstp->rq_cred;
         int i;
         int ret;
 
         if (exp->ex_flags & NFSEXP_ALLSQUASH) {
-                cred->cr_uid = exp->ex_anon_uid;
-                cred->cr_gid = exp->ex_anon_gid;
-                put_group_info(cred->cr_group_info);
-                cred->cr_group_info = groups_alloc(0);
+                cred.cr_uid = exp->ex_anon_uid;
+                cred.cr_gid = exp->ex_anon_gid;
+                cred.cr_group_info = groups_alloc(0);
         } else if (exp->ex_flags & NFSEXP_ROOTSQUASH) {
                 struct group_info *gi;
-                if (!cred->cr_uid)
-                        cred->cr_uid = exp->ex_anon_uid;
-                if (!cred->cr_gid)
-                        cred->cr_gid = exp->ex_anon_gid;
-                gi = groups_alloc(cred->cr_group_info->ngroups);
+                if (!cred.cr_uid)
+                        cred.cr_uid = exp->ex_anon_uid;
+                if (!cred.cr_gid)
+                        cred.cr_gid = exp->ex_anon_gid;
+                gi = groups_alloc(cred.cr_group_info->ngroups);
                 if (gi)
-                        for (i = 0; i < cred->cr_group_info->ngroups; i++) {
-                                if (!GROUP_AT(cred->cr_group_info, i))
+                        for (i = 0; i < cred.cr_group_info->ngroups; i++) {
+                                if (!GROUP_AT(cred.cr_group_info, i))
                                         GROUP_AT(gi, i) = exp->ex_anon_gid;
                                 else
-                                        GROUP_AT(gi, i) = GROUP_AT(cred->cr_group_info, i);
+                                        GROUP_AT(gi, i) = GROUP_AT(cred.cr_group_info, i);
                         }
-                put_group_info(cred->cr_group_info);
-                cred->cr_group_info = gi;
-        }
+                cred.cr_group_info = gi;
+        } else
+                get_group_info(cred.cr_group_info);
 
-        if (cred->cr_uid != (uid_t) -1)
-                current->fsuid = cred->cr_uid;
+        if (cred.cr_uid != (uid_t) -1)
+                current->fsuid = cred.cr_uid;
         else
                 current->fsuid = exp->ex_anon_uid;
-        if (cred->cr_gid != (gid_t) -1)
-                current->fsgid = cred->cr_gid;
+        if (cred.cr_gid != (gid_t) -1)
+                current->fsgid = cred.cr_gid;
         else
                 current->fsgid = exp->ex_anon_gid;
 
-        if (!cred->cr_group_info)
+        if (!cred.cr_group_info)
                 return -ENOMEM;
-        ret = set_current_groups(cred->cr_group_info);
-        if ((cred->cr_uid)) {
+        ret = set_current_groups(cred.cr_group_info);
+        put_group_info(cred.cr_group_info);
+        if ((cred.cr_uid)) {
                 cap_t(current->cap_effective) &= ~CAP_NFSD_MASK;
         } else {
                 cap_t(current->cap_effective) |= (CAP_NFSD_MASK &
diff --git a/fs/nfsd/export.c b/fs/nfsd/export.c
index c340be0a3f59..4e0578121d9a 100644
--- a/fs/nfsd/export.c
+++ b/fs/nfsd/export.c
@@ -422,7 +422,7 @@ static int svc_export_parse(struct cache_detail *cd, char *mesg, int mlen)
         if ((len=qword_get(&mesg, buf, PAGE_SIZE)) <= 0)
                 goto out;
         err = path_lookup(buf, 0, &nd);
-        if (err) goto out;
+        if (err) goto out_no_path;
 
         exp.h.flags = 0;
         exp.ex_client = dom;
@@ -475,6 +475,7 @@ static int svc_export_parse(struct cache_detail *cd, char *mesg, int mlen)
  out:
         if (nd.dentry)
                 path_release(&nd);
+ out_no_path:
         if (dom)
                 auth_domain_put(dom);
         kfree(buf);
diff --git a/fs/nfsd/nfs3proc.c b/fs/nfsd/nfs3proc.c
index 6d2dfed1de08..f61142afea44 100644
--- a/fs/nfsd/nfs3proc.c
+++ b/fs/nfsd/nfs3proc.c
@@ -682,7 +682,7 @@ static struct svc_procedure		nfsd_procedures3[22] = {
   PROC(lookup,   dirop,         dirop,          fhandle2, RC_NOCACHE, ST+FH+pAT+pAT),
   PROC(access,   access,        access,         fhandle,  RC_NOCACHE, ST+pAT+1),
   PROC(readlink, readlink,      readlink,       fhandle,  RC_NOCACHE, ST+pAT+1+NFS3_MAXPATHLEN/4),
-  PROC(read,     read,          read,           fhandle,  RC_NOCACHE, ST+pAT+4+NFSSVC_MAXBLKSIZE),
+  PROC(read,     read,          read,           fhandle,  RC_NOCACHE, ST+pAT+4+NFSSVC_MAXBLKSIZE/4),
   PROC(write,    write,         write,          fhandle,  RC_REPLBUFF, ST+WC+4),
   PROC(create,   create,        create,         fhandle2, RC_REPLBUFF, ST+(1+FH+pAT)+WC),
   PROC(mkdir,    mkdir,         create,         fhandle2, RC_REPLBUFF, ST+(1+FH+pAT)+WC),
diff --git a/fs/nfsd/nfs4acl.c b/fs/nfsd/nfs4acl.c
index 7391f4aabedb..edb107e61b91 100644
--- a/fs/nfsd/nfs4acl.c
+++ b/fs/nfsd/nfs4acl.c
@@ -710,9 +710,9 @@ calculate_posix_ace_count(struct nfs4_acl *n4acl)
                 /* Also, the remaining entries are for named users and
                  * groups, and come in threes (mask, allow, deny): */
                 if (n4acl->naces < 7)
-                        return -1;
+                        return -EINVAL;
                 if ((n4acl->naces - 7) % 3)
-                        return -1;
+                        return -EINVAL;
                 return 4 + (n4acl->naces - 7)/3;
         }
 }
@@ -790,7 +790,7 @@ nfs4_acl_split(struct nfs4_acl *acl, struct nfs4_acl *dacl)
                         continue;
 
                 error = nfs4_acl_add_ace(dacl, ace->type, ace->flag,
-                                ace->access_mask, ace->whotype, ace->who) == -1;
+                                ace->access_mask, ace->whotype, ace->who);
                 if (error < 0)
                         goto out;
 
@@ -866,7 +866,7 @@ nfs4_acl_add_ace(struct nfs4_acl *acl, u32 type, u32 flag, u32 access_mask,
         struct nfs4_ace *ace;
 
         if ((ace = kmalloc(sizeof(*ace), GFP_KERNEL)) == NULL)
-                return -1;
+                return -ENOMEM;
 
         ace->type = type;
         ace->flag = flag;
diff --git a/fs/nfsd/nfs4callback.c b/fs/nfsd/nfs4callback.c
index c872bd07fc10..dbaf3f93f328 100644
--- a/fs/nfsd/nfs4callback.c
+++ b/fs/nfsd/nfs4callback.c
@@ -441,8 +441,9 @@ nfsd4_probe_callback(struct nfs4_client *clp)
                 goto out_clnt;
         }
 
-        /* the task holds a reference to the nfs4_client struct */
         cb->cb_client = clnt;
+
+        /* the task holds a reference to the nfs4_client struct */
         atomic_inc(&clp->cl_count);
 
         msg.rpc_cred = nfsd4_lookupcred(clp,0);
@@ -460,13 +461,12 @@ nfsd4_probe_callback(struct nfs4_client *clp)
 out_rpciod:
         atomic_dec(&clp->cl_count);
         rpciod_down();
+        cb->cb_client = NULL;
 out_clnt:
         rpc_shutdown_client(clnt);
-        goto out_err;
 out_err:
         dprintk("NFSD: warning: no callback path to client %.*s\n",
                 (int)clp->cl_name.len, clp->cl_name.data);
-        cb->cb_client = NULL;
 }
 
 static void
diff --git a/fs/nfsd/nfs4proc.c b/fs/nfsd/nfs4proc.c
index 6d63f1d9e5f5..b0e095ea0c03 100644
--- a/fs/nfsd/nfs4proc.c
+++ b/fs/nfsd/nfs4proc.c
@@ -288,8 +288,6 @@ nfsd4_putrootfh(struct svc_rqst *rqstp, struct svc_fh *current_fh)
         fh_put(current_fh);
         status = exp_pseudoroot(rqstp->rq_client, current_fh,
                               &rqstp->rq_chandle);
-        if (!status)
-                status = nfserrno(nfsd_setuser(rqstp, current_fh->fh_export));
         return status;
 }
 
@@ -975,7 +973,7 @@ struct nfsd4_voidargs { int dummy; };
  */
 static struct svc_procedure             nfsd_procedures4[2] = {
   PROC(null,     void,          void,           void,     RC_NOCACHE, 1),
-  PROC(compound, compound,      compound,       compound, RC_NOCACHE, NFSD_BUFSIZE)
+  PROC(compound, compound,      compound,       compound, RC_NOCACHE, NFSD_BUFSIZE/4)
 };
 
 struct svc_version      nfsd_version4 = {
diff --git a/fs/nfsd/nfs4state.c b/fs/nfsd/nfs4state.c
index 47ec112b266c..96c7578cbe1e 100644
--- a/fs/nfsd/nfs4state.c
+++ b/fs/nfsd/nfs4state.c
@@ -147,6 +147,42 @@ get_nfs4_file(struct nfs4_file *fi)
         kref_get(&fi->fi_ref);
 }
 
+static int num_delegations;
+
+/*
+ * Open owner state (share locks)
+ */
+
+/* hash tables for nfs4_stateowner */
+#define OWNER_HASH_BITS              8
+#define OWNER_HASH_SIZE             (1 << OWNER_HASH_BITS)
+#define OWNER_HASH_MASK             (OWNER_HASH_SIZE - 1)
+
+#define ownerid_hashval(id) \
+        ((id) & OWNER_HASH_MASK)
+#define ownerstr_hashval(clientid, ownername) \
+        (((clientid) + opaque_hashval((ownername.data), (ownername.len))) & OWNER_HASH_MASK)
+
+static struct list_head ownerid_hashtbl[OWNER_HASH_SIZE];
+static struct list_head ownerstr_hashtbl[OWNER_HASH_SIZE];
+
+/* hash table for nfs4_file */
+#define FILE_HASH_BITS                   8
+#define FILE_HASH_SIZE                  (1 << FILE_HASH_BITS)
+#define FILE_HASH_MASK                  (FILE_HASH_SIZE - 1)
+/* hash table for (open)nfs4_stateid */
+#define STATEID_HASH_BITS              10
+#define STATEID_HASH_SIZE              (1 << STATEID_HASH_BITS)
+#define STATEID_HASH_MASK              (STATEID_HASH_SIZE - 1)
+
+#define file_hashval(x) \
+        hash_ptr(x, FILE_HASH_BITS)
+#define stateid_hashval(owner_id, file_id)  \
+        (((owner_id) + (file_id)) & STATEID_HASH_MASK)
+
+static struct list_head file_hashtbl[FILE_HASH_SIZE];
+static struct list_head stateid_hashtbl[STATEID_HASH_SIZE];
+
 static struct nfs4_delegation *
 alloc_init_deleg(struct nfs4_client *clp, struct nfs4_stateid *stp, struct svc_fh *current_fh, u32 type)
 {
@@ -155,9 +191,12 @@ alloc_init_deleg(struct nfs4_client *clp, struct nfs4_stateid *stp, struct svc_f
         struct nfs4_callback *cb = &stp->st_stateowner->so_client->cl_callback;
 
         dprintk("NFSD alloc_init_deleg\n");
+        if (num_delegations > STATEID_HASH_SIZE * 4)
+                return NULL;
         dp = kmem_cache_alloc(deleg_slab, GFP_KERNEL);
         if (dp == NULL)
                 return dp;
+        num_delegations++;
         INIT_LIST_HEAD(&dp->dl_perfile);
         INIT_LIST_HEAD(&dp->dl_perclnt);
         INIT_LIST_HEAD(&dp->dl_recall_lru);
@@ -192,6 +231,7 @@ nfs4_put_delegation(struct nfs4_delegation *dp)
                 dprintk("NFSD: freeing dp %p\n",dp);
                 put_nfs4_file(dp->dl_file);
                 kmem_cache_free(deleg_slab, dp);
+                num_delegations--;
         }
 }
 
@@ -330,22 +370,29 @@ put_nfs4_client(struct nfs4_client *clp)
 }
 
 static void
+shutdown_callback_client(struct nfs4_client *clp)
+{
+        struct rpc_clnt *clnt = clp->cl_callback.cb_client;
+
+        /* shutdown rpc client, ending any outstanding recall rpcs */
+        if (clnt) {
+                clp->cl_callback.cb_client = NULL;
+                rpc_shutdown_client(clnt);
+                rpciod_down();
+        }
+}
+
+static void
 expire_client(struct nfs4_client *clp)
 {
         struct nfs4_stateowner *sop;
         struct nfs4_delegation *dp;
-        struct nfs4_callback *cb = &clp->cl_callback;
-        struct rpc_clnt *clnt = clp->cl_callback.cb_client;
         struct list_head reaplist;
 
         dprintk("NFSD: expire_client cl_count %d\n",
                             atomic_read(&clp->cl_count));
 
-        /* shutdown rpc client, ending any outstanding recall rpcs */
-        if (atomic_read(&cb->cb_set) == 1 && clnt) {
-                rpc_shutdown_client(clnt);
-                clnt = clp->cl_callback.cb_client = NULL;
-        }
+        shutdown_callback_client(clp);
 
         INIT_LIST_HEAD(&reaplist);
         spin_lock(&recall_lock);
@@ -936,40 +983,6 @@ out:
         return status;
 }
 
-/* 
- * Open owner state (share locks)
- */
-
-/* hash tables for nfs4_stateowner */
-#define OWNER_HASH_BITS              8
-#define OWNER_HASH_SIZE             (1 << OWNER_HASH_BITS)
-#define OWNER_HASH_MASK             (OWNER_HASH_SIZE - 1)
-
-#define ownerid_hashval(id) \
-        ((id) & OWNER_HASH_MASK)
-#define ownerstr_hashval(clientid, ownername) \
-        (((clientid) + opaque_hashval((ownername.data), (ownername.len))) & OWNER_HASH_MASK)
-
-static struct list_head ownerid_hashtbl[OWNER_HASH_SIZE];
-static struct list_head ownerstr_hashtbl[OWNER_HASH_SIZE];
-
-/* hash table for nfs4_file */
-#define FILE_HASH_BITS                   8
-#define FILE_HASH_SIZE                  (1 << FILE_HASH_BITS)
-#define FILE_HASH_MASK                  (FILE_HASH_SIZE - 1)
-/* hash table for (open)nfs4_stateid */
-#define STATEID_HASH_BITS              10
-#define STATEID_HASH_SIZE              (1 << STATEID_HASH_BITS)
-#define STATEID_HASH_MASK              (STATEID_HASH_SIZE - 1)
-
-#define file_hashval(x) \
-        hash_ptr(x, FILE_HASH_BITS)
-#define stateid_hashval(owner_id, file_id)  \
-        (((owner_id) + (file_id)) & STATEID_HASH_MASK)
-
-static struct list_head file_hashtbl[FILE_HASH_SIZE];
-static struct list_head stateid_hashtbl[STATEID_HASH_SIZE];
-
 /* OPEN Share state helper functions */
 static inline struct nfs4_file *
 alloc_init_file(struct inode *ino)
@@ -1186,8 +1199,7 @@ move_to_close_lru(struct nfs4_stateowner *sop)
 {
         dprintk("NFSD: move_to_close_lru nfs4_stateowner %p\n", sop);
 
-        unhash_stateowner(sop);
-        list_add_tail(&sop->so_close_lru, &close_lru);
+        list_move_tail(&sop->so_close_lru, &close_lru);
         sop->so_time = get_seconds();
 }
 
@@ -1916,8 +1928,7 @@ nfs4_laundromat(void)
                 }
                 dprintk("NFSD: purging unused open stateowner (so_id %d)\n",
                         sop->so_id);
-                list_del(&sop->so_close_lru);
-                nfs4_put_stateowner(sop);
+                release_stateowner(sop);
         }
         if (clientid_val < NFSD_LAUNDROMAT_MINTIMEOUT)
                 clientid_val = NFSD_LAUNDROMAT_MINTIMEOUT;
@@ -2495,36 +2506,27 @@ nfs4_transform_lock_offset(struct file_lock *lock)
                 lock->fl_end = OFFSET_MAX;
 }
 
-static int
-nfs4_verify_lock_stateowner(struct nfs4_stateowner *sop, unsigned int hashval)
-{
-        struct nfs4_stateowner *local = NULL;
-        int status = 0;
-                                
-        if (hashval >= LOCK_HASH_SIZE)
-                goto out;
-        list_for_each_entry(local, &lock_ownerid_hashtbl[hashval], so_idhash) {
-                if (local == sop) {
-                        status = 1;
-                        goto out;
-                }
-        }
-out:
-        return status;
-}
-
+/* Hack!: For now, we're defining this just so we can use a pointer to it
+ * as a unique cookie to identify our (NFSv4's) posix locks. */
+static struct lock_manager_operations nfsd_posix_mng_ops  = {
+};
 
 static inline void
 nfs4_set_lock_denied(struct file_lock *fl, struct nfsd4_lock_denied *deny)
 {
-        struct nfs4_stateowner *sop = (struct nfs4_stateowner *) fl->fl_owner;
-        unsigned int hval = lockownerid_hashval(sop->so_id);
+        struct nfs4_stateowner *sop;
+        unsigned int hval;
 
-        deny->ld_sop = NULL;
-        if (nfs4_verify_lock_stateowner(sop, hval)) {
+        if (fl->fl_lmops == &nfsd_posix_mng_ops) {
+                sop = (struct nfs4_stateowner *) fl->fl_owner;
+                hval = lockownerid_hashval(sop->so_id);
                 kref_get(&sop->so_ref);
                 deny->ld_sop = sop;
                 deny->ld_clientid = sop->so_client->cl_clientid;
+        } else {
+                deny->ld_sop = NULL;
+                deny->ld_clientid.cl_boot = 0;
+                deny->ld_clientid.cl_id = 0;
         }
         deny->ld_start = fl->fl_start;
         deny->ld_length = ~(u64)0;
@@ -2736,6 +2738,7 @@ nfsd4_lock(struct svc_rqst *rqstp, struct svc_fh *current_fh, struct nfsd4_lock
         file_lock.fl_pid = current->tgid;
         file_lock.fl_file = filp;
         file_lock.fl_flags = FL_POSIX;
+        file_lock.fl_lmops = &nfsd_posix_mng_ops;
 
         file_lock.fl_start = lock->lk_offset;
         if ((lock->lk_length == ~(u64)0) || 
@@ -2841,6 +2844,7 @@ nfsd4_lockt(struct svc_rqst *rqstp, struct svc_fh *current_fh, struct nfsd4_lock
                 file_lock.fl_owner = (fl_owner_t)lockt->lt_stateowner;
         file_lock.fl_pid = current->tgid;
         file_lock.fl_flags = FL_POSIX;
+        file_lock.fl_lmops = &nfsd_posix_mng_ops;
 
         file_lock.fl_start = lockt->lt_offset;
         if ((lockt->lt_length == ~(u64)0) || LOFF_OVERFLOW(lockt->lt_offset, lockt->lt_length))
@@ -2900,6 +2904,7 @@ nfsd4_locku(struct svc_rqst *rqstp, struct svc_fh *current_fh, struct nfsd4_lock
         file_lock.fl_pid = current->tgid;
         file_lock.fl_file = filp;
         file_lock.fl_flags = FL_POSIX; 
+        file_lock.fl_lmops = &nfsd_posix_mng_ops;
         file_lock.fl_start = locku->lu_offset;
 
         if ((locku->lu_length == ~(u64)0) || LOFF_OVERFLOW(locku->lu_offset, locku->lu_length))
@@ -3211,15 +3216,8 @@ __nfs4_state_shutdown(void)
         int i;
         struct nfs4_client *clp = NULL;
         struct nfs4_delegation *dp = NULL;
-        struct nfs4_stateowner *sop = NULL;
         struct list_head *pos, *next, reaplist;
 
-        list_for_each_safe(pos, next, &close_lru) {
-                sop = list_entry(pos, struct nfs4_stateowner, so_close_lru);
-                list_del(&sop->so_close_lru);
-                nfs4_put_stateowner(sop);
-        }
-
         for (i = 0; i < CLIENT_HASH_SIZE; i++) {
                 while (!list_empty(&conf_id_hashtbl[i])) {
                         clp = list_entry(conf_id_hashtbl[i].next, struct nfs4_client, cl_idhash);
@@ -3244,8 +3242,6 @@ __nfs4_state_shutdown(void)
         }
 
         cancel_delayed_work(&laundromat_work);
-        flush_workqueue(laundry_wq);
-        destroy_workqueue(laundry_wq);
         nfsd4_shutdown_recdir();
         nfs4_init = 0;
 }
@@ -3253,6 +3249,8 @@ __nfs4_state_shutdown(void)
 void
 nfs4_state_shutdown(void)
 {
+        cancel_rearming_delayed_workqueue(laundry_wq, &laundromat_work);
+        destroy_workqueue(laundry_wq);
         nfs4_lock_state();
         nfs4_release_reclaim();
         __nfs4_state_shutdown();
diff --git a/fs/nfsd/nfs4xdr.c b/fs/nfsd/nfs4xdr.c
index 03857fd81126..de3998f15f10 100644
--- a/fs/nfsd/nfs4xdr.c
+++ b/fs/nfsd/nfs4xdr.c
@@ -299,11 +299,10 @@ nfsd4_decode_fattr(struct nfsd4_compoundargs *argp, u32 *bmval, struct iattr *ia
                                                 buf, dummy32, &ace.who);
                         if (status)
                                 goto out_nfserr;
-                        if (nfs4_acl_add_ace(*acl, ace.type, ace.flag,
-                                 ace.access_mask, ace.whotype, ace.who) != 0) {
-                                status = -ENOMEM;
+                        status = nfs4_acl_add_ace(*acl, ace.type, ace.flag,
+                                 ace.access_mask, ace.whotype, ace.who);
+                        if (status)
                                 goto out_nfserr;
-                        }
                 }
         } else
                 *acl = NULL;
@@ -2085,27 +2084,20 @@ nfsd4_encode_read(struct nfsd4_compoundres *resp, int nfserr, struct nfsd4_read
         WRITE32(eof);
         WRITE32(maxcount);
         ADJUST_ARGS();
-        resp->xbuf->head[0].iov_len = ((char*)resp->p) - (char*)resp->xbuf->head[0].iov_base;
-
+        resp->xbuf->head[0].iov_len = (char*)p
+                                        - (char*)resp->xbuf->head[0].iov_base;
         resp->xbuf->page_len = maxcount;
 
-        /* read zero bytes -> don't set up tail */
-        if(!maxcount)
-                return 0;        
-
-        /* set up page for remaining responses */
-        svc_take_page(resp->rqstp);
-        resp->xbuf->tail[0].iov_base = 
-                page_address(resp->rqstp->rq_respages[resp->rqstp->rq_resused-1]);
-        resp->rqstp->rq_restailpage = resp->rqstp->rq_resused-1;
+        /* Use rest of head for padding and remaining ops: */
+        resp->rqstp->rq_restailpage = 0;
+        resp->xbuf->tail[0].iov_base = p;
         resp->xbuf->tail[0].iov_len = 0;
-        resp->p = resp->xbuf->tail[0].iov_base;
-        resp->end = resp->p + PAGE_SIZE/4;
-
         if (maxcount&3) {
-                *(resp->p)++ = 0;
+                RESERVE_SPACE(4);
+                WRITE32(0);
                 resp->xbuf->tail[0].iov_base += maxcount&3;
                 resp->xbuf->tail[0].iov_len = 4 - (maxcount&3);
+                ADJUST_ARGS();
         }
         return 0;
 }
@@ -2142,21 +2134,20 @@ nfsd4_encode_readlink(struct nfsd4_compoundres *resp, int nfserr, struct nfsd4_r
 
         WRITE32(maxcount);
         ADJUST_ARGS();
-        resp->xbuf->head[0].iov_len = ((char*)resp->p) - (char*)resp->xbuf->head[0].iov_base;
+        resp->xbuf->head[0].iov_len = (char*)p
+                                - (char*)resp->xbuf->head[0].iov_base;
+        resp->xbuf->page_len = maxcount;
 
-        svc_take_page(resp->rqstp);
-        resp->xbuf->tail[0].iov_base = 
-                page_address(resp->rqstp->rq_respages[resp->rqstp->rq_resused-1]);
-        resp->rqstp->rq_restailpage = resp->rqstp->rq_resused-1;
+        /* Use rest of head for padding and remaining ops: */
+        resp->rqstp->rq_restailpage = 0;
+        resp->xbuf->tail[0].iov_base = p;
         resp->xbuf->tail[0].iov_len = 0;
-        resp->p = resp->xbuf->tail[0].iov_base;
-        resp->end = resp->p + PAGE_SIZE/4;
-
-        resp->xbuf->page_len = maxcount;
         if (maxcount&3) {
-                *(resp->p)++ = 0;
+                RESERVE_SPACE(4);
+                WRITE32(0);
                 resp->xbuf->tail[0].iov_base += maxcount&3;
                 resp->xbuf->tail[0].iov_len = 4 - (maxcount&3);
+                ADJUST_ARGS();
         }
         return 0;
 }
@@ -2166,7 +2157,7 @@ nfsd4_encode_readdir(struct nfsd4_compoundres *resp, int nfserr, struct nfsd4_re
 {
         int maxcount;
         loff_t offset;
-        u32 *page, *savep;
+        u32 *page, *savep, *tailbase;
         ENCODE_HEAD;
 
         if (nfserr)
@@ -2182,6 +2173,7 @@ nfsd4_encode_readdir(struct nfsd4_compoundres *resp, int nfserr, struct nfsd4_re
         WRITE32(0);
         ADJUST_ARGS();
         resp->xbuf->head[0].iov_len = ((char*)resp->p) - (char*)resp->xbuf->head[0].iov_base;
+        tailbase = p;
 
         maxcount = PAGE_SIZE;
         if (maxcount > readdir->rd_maxcount)
@@ -2226,14 +2218,12 @@ nfsd4_encode_readdir(struct nfsd4_compoundres *resp, int nfserr, struct nfsd4_re
         *p++ = htonl(readdir->common.err == nfserr_eof);
         resp->xbuf->page_len = ((char*)p) - (char*)page_address(resp->rqstp->rq_respages[resp->rqstp->rq_resused-1]);
 
-        /* allocate a page for the tail */
-        svc_take_page(resp->rqstp);
-        resp->xbuf->tail[0].iov_base = 
-                page_address(resp->rqstp->rq_respages[resp->rqstp->rq_resused-1]);
-        resp->rqstp->rq_restailpage = resp->rqstp->rq_resused-1;
+        /* Use rest of head for padding and remaining ops: */
+        resp->rqstp->rq_restailpage = 0;
+        resp->xbuf->tail[0].iov_base = tailbase;
         resp->xbuf->tail[0].iov_len = 0;
         resp->p = resp->xbuf->tail[0].iov_base;
-        resp->end = resp->p + PAGE_SIZE/4;
+        resp->end = resp->p + (PAGE_SIZE - resp->xbuf->head[0].iov_len)/4;
 
         return 0;
 err_no_verf:
diff --git a/fs/nfsd/nfsproc.c b/fs/nfsd/nfsproc.c
index 3e6b75cd90fd..06cd0db0f32b 100644
--- a/fs/nfsd/nfsproc.c
+++ b/fs/nfsd/nfsproc.c
@@ -553,7 +553,7 @@ static struct svc_procedure		nfsd_procedures2[18] = {
   PROC(none,     void,          void,           none,           RC_NOCACHE, ST),
   PROC(lookup,   diropargs,     diropres,       fhandle,        RC_NOCACHE, ST+FH+AT),
   PROC(readlink, readlinkargs,  readlinkres,    none,           RC_NOCACHE, ST+1+NFS_MAXPATHLEN/4),
-  PROC(read,     readargs,      readres,        fhandle,        RC_NOCACHE, ST+AT+1+NFSSVC_MAXBLKSIZE),
+  PROC(read,     readargs,      readres,        fhandle,        RC_NOCACHE, ST+AT+1+NFSSVC_MAXBLKSIZE/4),
   PROC(none,     void,          void,           none,           RC_NOCACHE, ST),
   PROC(write,    writeargs,     attrstat,       fhandle,        RC_REPLBUFF, ST+AT),
   PROC(create,   createargs,    diropres,       fhandle,        RC_REPLBUFF, ST+FH+AT),
diff --git a/fs/nfsd/vfs.c b/fs/nfsd/vfs.c
index 31018333dc38..6aa92d0e6876 100644
--- a/fs/nfsd/vfs.c
+++ b/fs/nfsd/vfs.c
@@ -371,7 +371,6 @@ out_nfserr:
 static ssize_t nfsd_getxattr(struct dentry *dentry, char *key, void **buf)
 {
         ssize_t buflen;
-        int error;
 
         buflen = vfs_getxattr(dentry, key, NULL, 0);
         if (buflen <= 0)
@@ -381,10 +380,7 @@ static ssize_t nfsd_getxattr(struct dentry *dentry, char *key, void **buf)
         if (!*buf)
                 return -ENOMEM;
 
-        error = vfs_getxattr(dentry, key, *buf, buflen);
-        if (error < 0)
-                return error;
-        return buflen;
+        return vfs_getxattr(dentry, key, *buf, buflen);
 }
 #endif
 
diff --git a/fs/ocfs2/cluster/heartbeat.c b/fs/ocfs2/cluster/heartbeat.c
index bff0f0d06867..21f38accd039 100644
--- a/fs/ocfs2/cluster/heartbeat.c
+++ b/fs/ocfs2/cluster/heartbeat.c
@@ -153,6 +153,7 @@ struct o2hb_region {
 struct o2hb_bio_wait_ctxt {
         atomic_t          wc_num_reqs;
         struct completion wc_io_complete;
+        int               wc_error;
 };
 
 static void o2hb_write_timeout(void *arg)
@@ -186,6 +187,7 @@ static inline void o2hb_bio_wait_init(struct o2hb_bio_wait_ctxt *wc,
 {
         atomic_set(&wc->wc_num_reqs, num_ios);
         init_completion(&wc->wc_io_complete);
+        wc->wc_error = 0;
 }
 
 /* Used in error paths too */
@@ -218,8 +220,10 @@ static int o2hb_bio_end_io(struct bio *bio,
 {
         struct o2hb_bio_wait_ctxt *wc = bio->bi_private;
 
-        if (error)
+        if (error) {
                 mlog(ML_ERROR, "IO Error %d\n", error);
+                wc->wc_error = error;
+        }
 
         if (bio->bi_size)
                 return 1;
@@ -390,6 +394,8 @@ static int o2hb_read_slots(struct o2hb_region *reg,
 
 bail_and_wait:
         o2hb_wait_on_io(reg, &wc);
+        if (wc.wc_error && !status)
+                status = wc.wc_error;
 
         if (bios) {
                 for(i = 0; i < num_bios; i++)
@@ -790,20 +796,24 @@ static int o2hb_highest_node(unsigned long *nodes,
         return highest;
 }
 
-static void o2hb_do_disk_heartbeat(struct o2hb_region *reg)
+static int o2hb_do_disk_heartbeat(struct o2hb_region *reg)
 {
         int i, ret, highest_node, change = 0;
         unsigned long configured_nodes[BITS_TO_LONGS(O2NM_MAX_NODES)];
         struct bio *write_bio;
         struct o2hb_bio_wait_ctxt write_wc;
 
-        if (o2nm_configured_node_map(configured_nodes, sizeof(configured_nodes)))
-                return;
+        ret = o2nm_configured_node_map(configured_nodes,
+                                       sizeof(configured_nodes));
+        if (ret) {
+                mlog_errno(ret);
+                return ret;
+        }
 
         highest_node = o2hb_highest_node(configured_nodes, O2NM_MAX_NODES);
         if (highest_node >= O2NM_MAX_NODES) {
                 mlog(ML_NOTICE, "ocfs2_heartbeat: no configured nodes found!\n");
-                return;
+                return -EINVAL;
         }
 
         /* No sense in reading the slots of nodes that don't exist
@@ -813,7 +823,7 @@ static void o2hb_do_disk_heartbeat(struct o2hb_region *reg)
         ret = o2hb_read_slots(reg, highest_node + 1);
         if (ret < 0) {
                 mlog_errno(ret);
-                return;
+                return ret;
         }
 
         /* With an up to date view of the slots, we can check that no
@@ -831,7 +841,7 @@ static void o2hb_do_disk_heartbeat(struct o2hb_region *reg)
         ret = o2hb_issue_node_write(reg, &write_bio, &write_wc);
         if (ret < 0) {
                 mlog_errno(ret);
-                return;
+                return ret;
         }
 
         i = -1;
@@ -847,6 +857,15 @@ static void o2hb_do_disk_heartbeat(struct o2hb_region *reg)
          */
         o2hb_wait_on_io(reg, &write_wc);
         bio_put(write_bio);
+        if (write_wc.wc_error) {
+                /* Do not re-arm the write timeout on I/O error - we
+                 * can't be sure that the new block ever made it to
+                 * disk */
+                mlog(ML_ERROR, "Write error %d on device \"%s\"\n",
+                     write_wc.wc_error, reg->hr_dev_name);
+                return write_wc.wc_error;
+        }
+
         o2hb_arm_write_timeout(reg);
 
         /* let the person who launched us know when things are steady */
@@ -854,6 +873,8 @@ static void o2hb_do_disk_heartbeat(struct o2hb_region *reg)
                 if (atomic_dec_and_test(&reg->hr_steady_iterations))
                         wake_up(&o2hb_steady_queue);
         }
+
+        return 0;
 }
 
 /* Subtract b from a, storing the result in a. a *must* have a larger
@@ -913,7 +934,10 @@ static int o2hb_thread(void *data)
                  * likely to time itself out. */
                 do_gettimeofday(&before_hb);
 
-                o2hb_do_disk_heartbeat(reg);
+                i = 0;
+                do {
+                        ret = o2hb_do_disk_heartbeat(reg);
+                } while (ret && ++i < 2);
 
                 do_gettimeofday(&after_hb);
                 elapsed_msec = o2hb_elapsed_msecs(&before_hb, &after_hb);
diff --git a/fs/ocfs2/dlm/userdlm.c b/fs/ocfs2/dlm/userdlm.c
index c3764f4744ee..74ca4e5f9765 100644
--- a/fs/ocfs2/dlm/userdlm.c
+++ b/fs/ocfs2/dlm/userdlm.c
@@ -139,6 +139,10 @@ static void user_ast(void *opaque)
                 return;
         }
 
+        mlog_bug_on_msg(lockres->l_requested == LKM_IVMODE,
+                        "Lockres %s, requested ivmode. flags 0x%x\n",
+                        lockres->l_name, lockres->l_flags);
+
         /* we're downconverting. */
         if (lockres->l_requested < lockres->l_level) {
                 if (lockres->l_requested <=
@@ -229,23 +233,42 @@ static void user_unlock_ast(void *opaque, enum dlm_status status)
 
         mlog(0, "UNLOCK AST called on lock %s\n", lockres->l_name);
 
-        if (status != DLM_NORMAL)
+        if (status != DLM_NORMAL && status != DLM_CANCELGRANT)
                 mlog(ML_ERROR, "Dlm returns status %d\n", status);
 
         spin_lock(&lockres->l_lock);
-        if (lockres->l_flags & USER_LOCK_IN_TEARDOWN)
+        /* The teardown flag gets set early during the unlock process,
+         * so test the cancel flag to make sure that this ast isn't
+         * for a concurrent cancel. */
+        if (lockres->l_flags & USER_LOCK_IN_TEARDOWN
+            && !(lockres->l_flags & USER_LOCK_IN_CANCEL)) {
                 lockres->l_level = LKM_IVMODE;
-        else {
+        } else if (status == DLM_CANCELGRANT) {
+                mlog(0, "Lock %s, cancel fails, flags 0x%x\n",
+                     lockres->l_name, lockres->l_flags);
+                /* We tried to cancel a convert request, but it was
+                 * already granted. Don't clear the busy flag - the
+                 * ast should've done this already. */
+                BUG_ON(!(lockres->l_flags & USER_LOCK_IN_CANCEL));
+                lockres->l_flags &= ~USER_LOCK_IN_CANCEL;
+                goto out_noclear;
+        } else {
+                BUG_ON(!(lockres->l_flags & USER_LOCK_IN_CANCEL));
+                /* Cancel succeeded, we want to re-queue */
+                mlog(0, "Lock %s, cancel succeeds, flags 0x%x\n",
+                     lockres->l_name, lockres->l_flags);
                 lockres->l_requested = LKM_IVMODE; /* cancel an
                                                     * upconvert
                                                     * request. */
                 lockres->l_flags &= ~USER_LOCK_IN_CANCEL;
                 /* we want the unblock thread to look at it again
                  * now. */
-                __user_dlm_queue_lockres(lockres);
+                if (lockres->l_flags & USER_LOCK_BLOCKED)
+                        __user_dlm_queue_lockres(lockres);
         }
 
         lockres->l_flags &= ~USER_LOCK_BUSY;
+out_noclear:
         spin_unlock(&lockres->l_lock);
 
         wake_up(&lockres->l_event);
@@ -268,13 +291,26 @@ static void user_dlm_unblock_lock(void *opaque)
 
         spin_lock(&lockres->l_lock);
 
-        BUG_ON(!(lockres->l_flags & USER_LOCK_BLOCKED));
-        BUG_ON(!(lockres->l_flags & USER_LOCK_QUEUED));
+        mlog_bug_on_msg(!(lockres->l_flags & USER_LOCK_QUEUED),
+                        "Lockres %s, flags 0x%x\n",
+                        lockres->l_name, lockres->l_flags);
 
-        /* notice that we don't clear USER_LOCK_BLOCKED here. That's
-         * for user_ast to do. */
+        /* notice that we don't clear USER_LOCK_BLOCKED here. If it's
+         * set, we want user_ast clear it. */
         lockres->l_flags &= ~USER_LOCK_QUEUED;
 
+        /* It's valid to get here and no longer be blocked - if we get
+         * several basts in a row, we might be queued by the first
+         * one, the unblock thread might run and clear the queued
+         * flag, and finally we might get another bast which re-queues
+         * us before our ast for the downconvert is called. */
+        if (!(lockres->l_flags & USER_LOCK_BLOCKED)) {
+                mlog(0, "Lockres %s, flags 0x%x: queued but not blocking\n",
+                        lockres->l_name, lockres->l_flags);
+                spin_unlock(&lockres->l_lock);
+                goto drop_ref;
+        }
+
         if (lockres->l_flags & USER_LOCK_IN_TEARDOWN) {
                 mlog(0, "lock is in teardown so we do nothing\n");
                 spin_unlock(&lockres->l_lock);
@@ -282,7 +318,9 @@ static void user_dlm_unblock_lock(void *opaque)
         }
 
         if (lockres->l_flags & USER_LOCK_BUSY) {
-                mlog(0, "BUSY flag detected...\n");
+                mlog(0, "Cancel lock %s, flags 0x%x\n",
+                     lockres->l_name, lockres->l_flags);
+
                 if (lockres->l_flags & USER_LOCK_IN_CANCEL) {
                         spin_unlock(&lockres->l_lock);
                         goto drop_ref;
@@ -296,14 +334,7 @@ static void user_dlm_unblock_lock(void *opaque)
                                    LKM_CANCEL,
                                    user_unlock_ast,
                                    lockres);
-                if (status == DLM_CANCELGRANT) {
-                        /* If we got this, then the ast was fired
-                         * before we could cancel. We cleanup our
-                         * state, and restart the function. */
-                        spin_lock(&lockres->l_lock);
-                        lockres->l_flags &= ~USER_LOCK_IN_CANCEL;
-                        spin_unlock(&lockres->l_lock);
-                } else if (status != DLM_NORMAL)
+                if (status != DLM_NORMAL)
                         user_log_dlm_error("dlmunlock", status, lockres);
                 goto drop_ref;
         }
@@ -581,6 +612,14 @@ int user_dlm_destroy_lock(struct user_lock_res *lockres)
         mlog(0, "asked to destroy %s\n", lockres->l_name);
 
         spin_lock(&lockres->l_lock);
+        if (lockres->l_flags & USER_LOCK_IN_TEARDOWN) {
+                mlog(0, "Lock is already torn down\n");
+                spin_unlock(&lockres->l_lock);
+                return 0;
+        }
+
+        lockres->l_flags |= USER_LOCK_IN_TEARDOWN;
+
         while (lockres->l_flags & USER_LOCK_BUSY) {
                 spin_unlock(&lockres->l_lock);
 
@@ -606,7 +645,6 @@ int user_dlm_destroy_lock(struct user_lock_res *lockres)
 
         lockres->l_flags &= ~USER_LOCK_ATTACHED;
         lockres->l_flags |= USER_LOCK_BUSY;
-        lockres->l_flags |= USER_LOCK_IN_TEARDOWN;
         spin_unlock(&lockres->l_lock);
 
         mlog(0, "unlocking lockres %s\n", lockres->l_name);
diff --git a/fs/ocfs2/file.c b/fs/ocfs2/file.c
index 34e903a6a46b..581eb451a41a 100644
--- a/fs/ocfs2/file.c
+++ b/fs/ocfs2/file.c
@@ -260,6 +260,17 @@ static int ocfs2_truncate_file(struct inode *inode,
         if (new_i_size == le64_to_cpu(fe->i_size))
                 goto bail;
 
+        /* This forces other nodes to sync and drop their pages. Do
+         * this even if we have a truncate without allocation change -
+         * ocfs2 cluster sizes can be much greater than page size, so
+         * we have to truncate them anyway.  */
+        status = ocfs2_data_lock(inode, 1);
+        if (status < 0) {
+                mlog_errno(status);
+                goto bail;
+        }
+        ocfs2_data_unlock(inode, 1);
+
         if (le32_to_cpu(fe->i_clusters) ==
             ocfs2_clusters_for_bytes(osb->sb, new_i_size)) {
                 mlog(0, "fe->i_clusters = %u, so we do a simple truncate\n",
@@ -272,14 +283,6 @@ static int ocfs2_truncate_file(struct inode *inode,
                 goto bail;
         }
 
-        /* This forces other nodes to sync and drop their pages */
-        status = ocfs2_data_lock(inode, 1);
-        if (status < 0) {
-                mlog_errno(status);
-                goto bail;
-        }
-        ocfs2_data_unlock(inode, 1);
-
         /* alright, we're going to need to do a full blown alloc size
          * change. Orphan the inode so that recovery can complete the
          * truncate if necessary. This does the task of marking
diff --git a/fs/pipe.c b/fs/pipe.c
index 109a102c150d..e984beb93a0e 100644
--- a/fs/pipe.c
+++ b/fs/pipe.c
@@ -36,7 +36,7 @@
  */
 
 /* Drop the inode semaphore and wait for a pipe event, atomically */
-void pipe_wait(struct inode * inode)
+void pipe_wait(struct pipe_inode_info *pipe)
 {
         DEFINE_WAIT(wait);
 
@@ -44,11 +44,14 @@ void pipe_wait(struct inode * inode)
          * Pipes are system-local resources, so sleeping on them
          * is considered a noninteractive wait:
          */
-        prepare_to_wait(PIPE_WAIT(*inode), &wait, TASK_INTERRUPTIBLE|TASK_NONINTERACTIVE);
-        mutex_unlock(PIPE_MUTEX(*inode));
+        prepare_to_wait(&pipe->wait, &wait,
+                        TASK_INTERRUPTIBLE | TASK_NONINTERACTIVE);
+        if (pipe->inode)
+                mutex_unlock(&pipe->inode->i_mutex);
         schedule();
-        finish_wait(PIPE_WAIT(*inode), &wait);
-        mutex_lock(PIPE_MUTEX(*inode));
+        finish_wait(&pipe->wait, &wait);
+        if (pipe->inode)
+                mutex_lock(&pipe->inode->i_mutex);
 }
 
 static int
@@ -91,40 +94,40 @@ pipe_iov_copy_to_user(struct iovec *iov, const void *from, unsigned long len)
         return 0;
 }
 
-static void anon_pipe_buf_release(struct pipe_inode_info *info, struct pipe_buffer *buf)
+static void anon_pipe_buf_release(struct pipe_inode_info *pipe,
+                                  struct pipe_buffer *buf)
 {
         struct page *page = buf->page;
 
+        buf->flags &= ~PIPE_BUF_FLAG_STOLEN;
+
         /*
          * If nobody else uses this page, and we don't already have a
          * temporary page, let's keep track of it as a one-deep
-         * allocation cache
-         */
-        if (page_count(page) == 1 && !info->tmp_page) {
-                info->tmp_page = page;
-                return;
-        }
-
-        /*
-         * Otherwise just release our reference to it
+         * allocation cache. (Otherwise just release our reference to it)
          */
-        page_cache_release(page);
+        if (page_count(page) == 1 && !pipe->tmp_page)
+                pipe->tmp_page = page;
+        else
+                page_cache_release(page);
 }
 
-static void *anon_pipe_buf_map(struct file *file, struct pipe_inode_info *info, struct pipe_buffer *buf)
+static void * anon_pipe_buf_map(struct file *file, struct pipe_inode_info *pipe,
+                                struct pipe_buffer *buf)
 {
         return kmap(buf->page);
 }
 
-static void anon_pipe_buf_unmap(struct pipe_inode_info *info, struct pipe_buffer *buf)
+static void anon_pipe_buf_unmap(struct pipe_inode_info *pipe,
+                                struct pipe_buffer *buf)
 {
         kunmap(buf->page);
 }
 
-static int anon_pipe_buf_steal(struct pipe_inode_info *info,
+static int anon_pipe_buf_steal(struct pipe_inode_info *pipe,
                                struct pipe_buffer *buf)
 {
-        buf->stolen = 1;
+        buf->flags |= PIPE_BUF_FLAG_STOLEN;
         return 0;
 }
 
@@ -141,7 +144,7 @@ pipe_readv(struct file *filp, const struct iovec *_iov,
            unsigned long nr_segs, loff_t *ppos)
 {
         struct inode *inode = filp->f_dentry->d_inode;
-        struct pipe_inode_info *info;
+        struct pipe_inode_info *pipe;
         int do_wakeup;
         ssize_t ret;
         struct iovec *iov = (struct iovec *)_iov;
@@ -154,13 +157,13 @@ pipe_readv(struct file *filp, const struct iovec *_iov,
 
         do_wakeup = 0;
         ret = 0;
-        mutex_lock(PIPE_MUTEX(*inode));
-        info = inode->i_pipe;
+        mutex_lock(&inode->i_mutex);
+        pipe = inode->i_pipe;
         for (;;) {
-                int bufs = info->nrbufs;
+                int bufs = pipe->nrbufs;
                 if (bufs) {
-                        int curbuf = info->curbuf;
-                        struct pipe_buffer *buf = info->bufs + curbuf;
+                        int curbuf = pipe->curbuf;
+                        struct pipe_buffer *buf = pipe->bufs + curbuf;
                         struct pipe_buf_operations *ops = buf->ops;
                         void *addr;
                         size_t chars = buf->len;
@@ -169,16 +172,17 @@ pipe_readv(struct file *filp, const struct iovec *_iov,
                         if (chars > total_len)
                                 chars = total_len;
 
-                        addr = ops->map(filp, info, buf);
+                        addr = ops->map(filp, pipe, buf);
                         if (IS_ERR(addr)) {
                                 if (!ret)
                                         ret = PTR_ERR(addr);
                                 break;
                         }
                         error = pipe_iov_copy_to_user(iov, addr + buf->offset, chars);
-                        ops->unmap(info, buf);
+                        ops->unmap(pipe, buf);
                         if (unlikely(error)) {
-                                if (!ret) ret = -EFAULT;
+                                if (!ret)
+                                        ret = -EFAULT;
                                 break;
                         }
                         ret += chars;
@@ -186,10 +190,10 @@ pipe_readv(struct file *filp, const struct iovec *_iov,
                         buf->len -= chars;
                         if (!buf->len) {
                                 buf->ops = NULL;
-                                ops->release(info, buf);
+                                ops->release(pipe, buf);
                                 curbuf = (curbuf + 1) & (PIPE_BUFFERS-1);
-                                info->curbuf = curbuf;
-                                info->nrbufs = --bufs;
+                                pipe->curbuf = curbuf;
+                                pipe->nrbufs = --bufs;
                                 do_wakeup = 1;
                         }
                         total_len -= chars;
@@ -198,9 +202,9 @@ pipe_readv(struct file *filp, const struct iovec *_iov,
                 }
                 if (bufs)       /* More to do? */
                         continue;
-                if (!PIPE_WRITERS(*inode))
+                if (!pipe->writers)
                         break;
-                if (!PIPE_WAITING_WRITERS(*inode)) {
+                if (!pipe->waiting_writers) {
                         /* syscall merging: Usually we must not sleep
                          * if O_NONBLOCK is set, or if we got some data.
                          * But if a writer sleeps in kernel space, then
@@ -214,20 +218,22 @@ pipe_readv(struct file *filp, const struct iovec *_iov,
                         }
                 }
                 if (signal_pending(current)) {
-                        if (!ret) ret = -ERESTARTSYS;
+                        if (!ret)
+                                ret = -ERESTARTSYS;
                         break;
                 }
                 if (do_wakeup) {
-                        wake_up_interruptible_sync(PIPE_WAIT(*inode));
-                        kill_fasync(PIPE_FASYNC_WRITERS(*inode), SIGIO, POLL_OUT);
+                        wake_up_interruptible_sync(&pipe->wait);
+                        kill_fasync(&pipe->fasync_writers, SIGIO, POLL_OUT);
                 }
-                pipe_wait(inode);
+                pipe_wait(pipe);
         }
-        mutex_unlock(PIPE_MUTEX(*inode));
-        /* Signal writers asynchronously that there is more room.  */
+        mutex_unlock(&inode->i_mutex);
+
+        /* Signal writers asynchronously that there is more room. */
         if (do_wakeup) {
-                wake_up_interruptible(PIPE_WAIT(*inode));
-                kill_fasync(PIPE_FASYNC_WRITERS(*inode), SIGIO, POLL_OUT);
+                wake_up_interruptible(&pipe->wait);
+                kill_fasync(&pipe->fasync_writers, SIGIO, POLL_OUT);
         }
         if (ret > 0)
                 file_accessed(filp);
@@ -238,6 +244,7 @@ static ssize_t
 pipe_read(struct file *filp, char __user *buf, size_t count, loff_t *ppos)
 {
         struct iovec iov = { .iov_base = buf, .iov_len = count };
+
         return pipe_readv(filp, &iov, 1, ppos);
 }
 
@@ -246,7 +253,7 @@ pipe_writev(struct file *filp, const struct iovec *_iov,
             unsigned long nr_segs, loff_t *ppos)
 {
         struct inode *inode = filp->f_dentry->d_inode;
-        struct pipe_inode_info *info;
+        struct pipe_inode_info *pipe;
         ssize_t ret;
         int do_wakeup;
         struct iovec *iov = (struct iovec *)_iov;
@@ -260,10 +267,10 @@ pipe_writev(struct file *filp, const struct iovec *_iov,
 
         do_wakeup = 0;
         ret = 0;
-        mutex_lock(PIPE_MUTEX(*inode));
-        info = inode->i_pipe;
+        mutex_lock(&inode->i_mutex);
+        pipe = inode->i_pipe;
 
-        if (!PIPE_READERS(*inode)) {
+        if (!pipe->readers) {
                 send_sig(SIGPIPE, current, 0);
                 ret = -EPIPE;
                 goto out;
@@ -271,23 +278,25 @@ pipe_writev(struct file *filp, const struct iovec *_iov,
 
         /* We try to merge small writes */
         chars = total_len & (PAGE_SIZE-1); /* size of the last buffer */
-        if (info->nrbufs && chars != 0) {
-                int lastbuf = (info->curbuf + info->nrbufs - 1) & (PIPE_BUFFERS-1);
-                struct pipe_buffer *buf = info->bufs + lastbuf;
+        if (pipe->nrbufs && chars != 0) {
+                int lastbuf = (pipe->curbuf + pipe->nrbufs - 1) &
+                                                        (PIPE_BUFFERS-1);
+                struct pipe_buffer *buf = pipe->bufs + lastbuf;
                 struct pipe_buf_operations *ops = buf->ops;
                 int offset = buf->offset + buf->len;
+
                 if (ops->can_merge && offset + chars <= PAGE_SIZE) {
                         void *addr;
                         int error;
 
-                        addr = ops->map(filp, info, buf);
+                        addr = ops->map(filp, pipe, buf);
                         if (IS_ERR(addr)) {
                                 error = PTR_ERR(addr);
                                 goto out;
                         }
                         error = pipe_iov_copy_from_user(offset + addr, iov,
                                                         chars);
-                        ops->unmap(info, buf);
+                        ops->unmap(pipe, buf);
                         ret = error;
                         do_wakeup = 1;
                         if (error)
@@ -302,16 +311,18 @@ pipe_writev(struct file *filp, const struct iovec *_iov,
 
         for (;;) {
                 int bufs;
-                if (!PIPE_READERS(*inode)) {
+
+                if (!pipe->readers) {
                         send_sig(SIGPIPE, current, 0);
-                        if (!ret) ret = -EPIPE;
+                        if (!ret)
+                                ret = -EPIPE;
                         break;
                 }
-                bufs = info->nrbufs;
+                bufs = pipe->nrbufs;
                 if (bufs < PIPE_BUFFERS) {
-                        int newbuf = (info->curbuf + bufs) & (PIPE_BUFFERS-1);
-                        struct pipe_buffer *buf = info->bufs + newbuf;
-                        struct page *page = info->tmp_page;
+                        int newbuf = (pipe->curbuf + bufs) & (PIPE_BUFFERS-1);
+                        struct pipe_buffer *buf = pipe->bufs + newbuf;
+                        struct page *page = pipe->tmp_page;
                         int error;
 
                         if (!page) {
@@ -320,9 +331,9 @@ pipe_writev(struct file *filp, const struct iovec *_iov,
                                         ret = ret ? : -ENOMEM;
                                         break;
                                 }
-                                info->tmp_page = page;
+                                pipe->tmp_page = page;
                         }
-                        /* Always wakeup, even if the copy fails. Otherwise
+                        /* Always wake up, even if the copy fails. Otherwise
                          * we lock up (O_NONBLOCK-)readers that sleep due to
                          * syscall merging.
                          * FIXME! Is this really true?
@@ -335,7 +346,8 @@ pipe_writev(struct file *filp, const struct iovec *_iov,
                         error = pipe_iov_copy_from_user(kmap(page), iov, chars);
                         kunmap(page);
                         if (unlikely(error)) {
-                                if (!ret) ret = -EFAULT;
+                                if (!ret)
+                                        ret = -EFAULT;
                                 break;
                         }
                         ret += chars;
@@ -345,8 +357,8 @@ pipe_writev(struct file *filp, const struct iovec *_iov,
                         buf->ops = &anon_pipe_buf_ops;
                         buf->offset = 0;
                         buf->len = chars;
-                        info->nrbufs = ++bufs;
-                        info->tmp_page = NULL;
+                        pipe->nrbufs = ++bufs;
+                        pipe->tmp_page = NULL;
 
                         total_len -= chars;
                         if (!total_len)
@@ -355,27 +367,29 @@ pipe_writev(struct file *filp, const struct iovec *_iov,
                 if (bufs < PIPE_BUFFERS)
                         continue;
                 if (filp->f_flags & O_NONBLOCK) {
-                        if (!ret) ret = -EAGAIN;
+                        if (!ret)
+                                ret = -EAGAIN;
                         break;
                 }
                 if (signal_pending(current)) {
-                        if (!ret) ret = -ERESTARTSYS;
+                        if (!ret)
+                                ret = -ERESTARTSYS;
                         break;
                 }
                 if (do_wakeup) {
-                        wake_up_interruptible_sync(PIPE_WAIT(*inode));
-                        kill_fasync(PIPE_FASYNC_READERS(*inode), SIGIO, POLL_IN);
+                        wake_up_interruptible_sync(&pipe->wait);
+                        kill_fasync(&pipe->fasync_readers, SIGIO, POLL_IN);
                         do_wakeup = 0;
                 }
-                PIPE_WAITING_WRITERS(*inode)++;
-                pipe_wait(inode);
-                PIPE_WAITING_WRITERS(*inode)--;
+                pipe->waiting_writers++;
+                pipe_wait(pipe);
+                pipe->waiting_writers--;
         }
 out:
-        mutex_unlock(PIPE_MUTEX(*inode));
+        mutex_unlock(&inode->i_mutex);
         if (do_wakeup) {
-                wake_up_interruptible(PIPE_WAIT(*inode));
-                kill_fasync(PIPE_FASYNC_READERS(*inode), SIGIO, POLL_IN);
+                wake_up_interruptible(&pipe->wait);
+                kill_fasync(&pipe->fasync_readers, SIGIO, POLL_IN);
         }
         if (ret > 0)
                 file_update_time(filp);
@@ -387,6 +401,7 @@ pipe_write(struct file *filp, const char __user *buf,
            size_t count, loff_t *ppos)
 {
         struct iovec iov = { .iov_base = (void __user *)buf, .iov_len = count };
+
         return pipe_writev(filp, &iov, 1, ppos);
 }
 
@@ -397,7 +412,8 @@ bad_pipe_r(struct file *filp, char __user *buf, size_t count, loff_t *ppos)
 }
 
 static ssize_t
-bad_pipe_w(struct file *filp, const char __user *buf, size_t count, loff_t *ppos)
+bad_pipe_w(struct file *filp, const char __user *buf, size_t count,
+           loff_t *ppos)
 {
         return -EBADF;
 }
@@ -407,21 +423,22 @@ pipe_ioctl(struct inode *pino, struct file *filp,
            unsigned int cmd, unsigned long arg)
 {
         struct inode *inode = filp->f_dentry->d_inode;
-        struct pipe_inode_info *info;
+        struct pipe_inode_info *pipe;
         int count, buf, nrbufs;
 
         switch (cmd) {
                 case FIONREAD:
-                        mutex_lock(PIPE_MUTEX(*inode));
-                        info =  inode->i_pipe;
+                        mutex_lock(&inode->i_mutex);
+                        pipe = inode->i_pipe;
                         count = 0;
-                        buf = info->curbuf;
-                        nrbufs = info->nrbufs;
+                        buf = pipe->curbuf;
+                        nrbufs = pipe->nrbufs;
                         while (--nrbufs >= 0) {
-                                count += info->bufs[buf].len;
+                                count += pipe->bufs[buf].len;
                                 buf = (buf+1) & (PIPE_BUFFERS-1);
                         }
-                        mutex_unlock(PIPE_MUTEX(*inode));
+                        mutex_unlock(&inode->i_mutex);
+
                         return put_user(count, (int __user *)arg);
                 default:
                         return -EINVAL;
@@ -434,17 +451,17 @@ pipe_poll(struct file *filp, poll_table *wait)
 {
         unsigned int mask;
         struct inode *inode = filp->f_dentry->d_inode;
-        struct pipe_inode_info *info = inode->i_pipe;
+        struct pipe_inode_info *pipe = inode->i_pipe;
         int nrbufs;
 
-        poll_wait(filp, PIPE_WAIT(*inode), wait);
+        poll_wait(filp, &pipe->wait, wait);
 
         /* Reading only -- no need for acquiring the semaphore.  */
-        nrbufs = info->nrbufs;
+        nrbufs = pipe->nrbufs;
         mask = 0;
         if (filp->f_mode & FMODE_READ) {
                 mask = (nrbufs > 0) ? POLLIN | POLLRDNORM : 0;
-                if (!PIPE_WRITERS(*inode) && filp->f_version != PIPE_WCOUNTER(*inode))
+                if (!pipe->writers && filp->f_version != pipe->w_counter)
                         mask |= POLLHUP;
         }
 
@@ -454,7 +471,7 @@ pipe_poll(struct file *filp, poll_table *wait)
                  * Most Unices do not set POLLERR for FIFOs but on Linux they
                  * behave exactly like pipes for poll().
                  */
-                if (!PIPE_READERS(*inode))
+                if (!pipe->readers)
                         mask |= POLLERR;
         }
 
@@ -464,17 +481,21 @@ pipe_poll(struct file *filp, poll_table *wait)
 static int
 pipe_release(struct inode *inode, int decr, int decw)
 {
-        mutex_lock(PIPE_MUTEX(*inode));
-        PIPE_READERS(*inode) -= decr;
-        PIPE_WRITERS(*inode) -= decw;
-        if (!PIPE_READERS(*inode) && !PIPE_WRITERS(*inode)) {
+        struct pipe_inode_info *pipe;
+
+        mutex_lock(&inode->i_mutex);
+        pipe = inode->i_pipe;
+        pipe->readers -= decr;
+        pipe->writers -= decw;
+
+        if (!pipe->readers && !pipe->writers) {
                 free_pipe_info(inode);
         } else {
-                wake_up_interruptible(PIPE_WAIT(*inode));
-                kill_fasync(PIPE_FASYNC_READERS(*inode), SIGIO, POLL_IN);
-                kill_fasync(PIPE_FASYNC_WRITERS(*inode), SIGIO, POLL_OUT);
+                wake_up_interruptible(&pipe->wait);
+                kill_fasync(&pipe->fasync_readers, SIGIO, POLL_IN);
+                kill_fasync(&pipe->fasync_writers, SIGIO, POLL_OUT);
         }
-        mutex_unlock(PIPE_MUTEX(*inode));
+        mutex_unlock(&inode->i_mutex);
 
         return 0;
 }
@@ -485,9 +506,9 @@ pipe_read_fasync(int fd, struct file *filp, int on)
         struct inode *inode = filp->f_dentry->d_inode;
         int retval;
 
-        mutex_lock(PIPE_MUTEX(*inode));
-        retval = fasync_helper(fd, filp, on, PIPE_FASYNC_READERS(*inode));
-        mutex_unlock(PIPE_MUTEX(*inode));
+        mutex_lock(&inode->i_mutex);
+        retval = fasync_helper(fd, filp, on, &inode->i_pipe->fasync_readers);
+        mutex_unlock(&inode->i_mutex);
 
         if (retval < 0)
                 return retval;
@@ -502,9 +523,9 @@ pipe_write_fasync(int fd, struct file *filp, int on)
         struct inode *inode = filp->f_dentry->d_inode;
         int retval;
 
-        mutex_lock(PIPE_MUTEX(*inode));
-        retval = fasync_helper(fd, filp, on, PIPE_FASYNC_WRITERS(*inode));
-        mutex_unlock(PIPE_MUTEX(*inode));
+        mutex_lock(&inode->i_mutex);
+        retval = fasync_helper(fd, filp, on, &inode->i_pipe->fasync_writers);
+        mutex_unlock(&inode->i_mutex);
 
         if (retval < 0)
                 return retval;
@@ -517,16 +538,17 @@ static int
 pipe_rdwr_fasync(int fd, struct file *filp, int on)
 {
         struct inode *inode = filp->f_dentry->d_inode;
+        struct pipe_inode_info *pipe = inode->i_pipe;
         int retval;
 
-        mutex_lock(PIPE_MUTEX(*inode));
+        mutex_lock(&inode->i_mutex);
 
-        retval = fasync_helper(fd, filp, on, PIPE_FASYNC_READERS(*inode));
+        retval = fasync_helper(fd, filp, on, &pipe->fasync_readers);
 
         if (retval >= 0)
-                retval = fasync_helper(fd, filp, on, PIPE_FASYNC_WRITERS(*inode));
+                retval = fasync_helper(fd, filp, on, &pipe->fasync_writers);
 
-        mutex_unlock(PIPE_MUTEX(*inode));
+        mutex_unlock(&inode->i_mutex);
 
         if (retval < 0)
                 return retval;
@@ -565,9 +587,9 @@ pipe_read_open(struct inode *inode, struct file *filp)
 {
         /* We could have perhaps used atomic_t, but this and friends
            below are the only places.  So it doesn't seem worthwhile.  */
-        mutex_lock(PIPE_MUTEX(*inode));
-        PIPE_READERS(*inode)++;
-        mutex_unlock(PIPE_MUTEX(*inode));
+        mutex_lock(&inode->i_mutex);
+        inode->i_pipe->readers++;
+        mutex_unlock(&inode->i_mutex);
 
         return 0;
 }
@@ -575,9 +597,9 @@ pipe_read_open(struct inode *inode, struct file *filp)
 static int
 pipe_write_open(struct inode *inode, struct file *filp)
 {
-        mutex_lock(PIPE_MUTEX(*inode));
-        PIPE_WRITERS(*inode)++;
-        mutex_unlock(PIPE_MUTEX(*inode));
+        mutex_lock(&inode->i_mutex);
+        inode->i_pipe->writers++;
+        mutex_unlock(&inode->i_mutex);
 
         return 0;
 }
@@ -585,12 +607,12 @@ pipe_write_open(struct inode *inode, struct file *filp)
 static int
 pipe_rdwr_open(struct inode *inode, struct file *filp)
 {
-        mutex_lock(PIPE_MUTEX(*inode));
+        mutex_lock(&inode->i_mutex);
         if (filp->f_mode & FMODE_READ)
-                PIPE_READERS(*inode)++;
+                inode->i_pipe->readers++;
         if (filp->f_mode & FMODE_WRITE)
-                PIPE_WRITERS(*inode)++;
-        mutex_unlock(PIPE_MUTEX(*inode));
+                inode->i_pipe->writers++;
+        mutex_unlock(&inode->i_mutex);
 
         return 0;
 }
@@ -673,37 +695,38 @@ static struct file_operations rdwr_pipe_fops = {
         .fasync         = pipe_rdwr_fasync,
 };
 
-void free_pipe_info(struct inode *inode)
+struct pipe_inode_info * alloc_pipe_info(struct inode *inode)
+{
+        struct pipe_inode_info *pipe;
+
+        pipe = kzalloc(sizeof(struct pipe_inode_info), GFP_KERNEL);
+        if (pipe) {
+                init_waitqueue_head(&pipe->wait);
+                pipe->r_counter = pipe->w_counter = 1;
+                pipe->inode = inode;
+        }
+
+        return pipe;
+}
+
+void __free_pipe_info(struct pipe_inode_info *pipe)
 {
         int i;
-        struct pipe_inode_info *info = inode->i_pipe;
 
-        inode->i_pipe = NULL;
         for (i = 0; i < PIPE_BUFFERS; i++) {
-                struct pipe_buffer *buf = info->bufs + i;
+                struct pipe_buffer *buf = pipe->bufs + i;
                 if (buf->ops)
-                        buf->ops->release(info, buf);
+                        buf->ops->release(pipe, buf);
         }
-        if (info->tmp_page)
-                __free_page(info->tmp_page);
-        kfree(info);
+        if (pipe->tmp_page)
+                __free_page(pipe->tmp_page);
+        kfree(pipe);
 }
 
-struct inode* pipe_new(struct inode* inode)
+void free_pipe_info(struct inode *inode)
 {
-        struct pipe_inode_info *info;
-
-        info = kzalloc(sizeof(struct pipe_inode_info), GFP_KERNEL);
-        if (!info)
-                goto fail_page;
-        inode->i_pipe = info;
-
-        init_waitqueue_head(PIPE_WAIT(*inode));
-        PIPE_RCOUNTER(*inode) = PIPE_WCOUNTER(*inode) = 1;
-
-        return inode;
-fail_page:
-        return NULL;
+        __free_pipe_info(inode->i_pipe);
+        inode->i_pipe = NULL;
 }
 
 static struct vfsmount *pipe_mnt __read_mostly;
@@ -711,6 +734,7 @@ static int pipefs_delete_dentry(struct dentry *dentry)
 {
         return 1;
 }
+
 static struct dentry_operations pipefs_dentry_operations = {
         .d_delete       = pipefs_delete_dentry,
 };
@@ -718,13 +742,17 @@ static struct dentry_operations pipefs_dentry_operations = {
 static struct inode * get_pipe_inode(void)
 {
         struct inode *inode = new_inode(pipe_mnt->mnt_sb);
+        struct pipe_inode_info *pipe;
 
         if (!inode)
                 goto fail_inode;
 
-        if(!pipe_new(inode))
+        pipe = alloc_pipe_info(inode);
+        if (!pipe)
                 goto fail_iput;
-        PIPE_READERS(*inode) = PIPE_WRITERS(*inode) = 1;
+        inode->i_pipe = pipe;
+
+        pipe->readers = pipe->writers = 1;
         inode->i_fop = &rdwr_pipe_fops;
 
         /*
@@ -739,10 +767,12 @@ static struct inode * get_pipe_inode(void)
         inode->i_gid = current->fsgid;
         inode->i_atime = inode->i_mtime = inode->i_ctime = CURRENT_TIME;
         inode->i_blksize = PAGE_SIZE;
+
         return inode;
 
 fail_iput:
         iput(inode);
+
 fail_inode:
         return NULL;
 }
@@ -755,7 +785,7 @@ int do_pipe(int *fd)
         struct inode * inode;
         struct file *f1, *f2;
         int error;
-        int i,j;
+        int i, j;
 
         error = -ENFILE;
         f1 = get_empty_filp();
@@ -788,6 +818,7 @@ int do_pipe(int *fd)
         dentry = d_alloc(pipe_mnt->mnt_sb->s_root, &this);
         if (!dentry)
                 goto close_f12_inode_i_j;
+
         dentry->d_op = &pipefs_dentry_operations;
         d_add(dentry, inode);
         f1->f_vfsmnt = f2->f_vfsmnt = mntget(mntget(pipe_mnt));
@@ -811,6 +842,7 @@ int do_pipe(int *fd)
         fd_install(j, f2);
         fd[0] = i;
         fd[1] = j;
+
         return 0;
 
 close_f12_inode_i_j:
@@ -835,8 +867,9 @@ no_files:
  * d_name - pipe: will go nicely and kill the special-casing in procfs.
  */
 
-static struct super_block *pipefs_get_sb(struct file_system_type *fs_type,
-        int flags, const char *dev_name, void *data)
+static struct super_block *
+pipefs_get_sb(struct file_system_type *fs_type, int flags,
+              const char *dev_name, void *data)
 {
         return get_sb_pseudo(fs_type, "pipe:", NULL, PIPEFS_MAGIC);
 }
@@ -850,6 +883,7 @@ static struct file_system_type pipe_fs_type = {
 static int __init init_pipe_fs(void)
 {
         int err = register_filesystem(&pipe_fs_type);
+
         if (!err) {
                 pipe_mnt = kern_mount(&pipe_fs_type);
                 if (IS_ERR(pipe_mnt)) {
diff --git a/fs/proc/vmcore.c b/fs/proc/vmcore.c
index 7efa73d44c9a..20d4b2237fce 100644
--- a/fs/proc/vmcore.c
+++ b/fs/proc/vmcore.c
@@ -103,8 +103,8 @@ static ssize_t read_vmcore(struct file *file, char __user *buffer,
                                 size_t buflen, loff_t *fpos)
 {
         ssize_t acc = 0, tmp;
-        size_t tsz, nr_bytes;
-        u64 start;
+        size_t tsz;
+        u64 start, nr_bytes;
         struct vmcore *curr_m = NULL;
 
         if (buflen == 0 || *fpos >= vmcore_size)
diff --git a/fs/read_write.c b/fs/read_write.c
index 6256ca81a718..5bc0e9234f9d 100644
--- a/fs/read_write.c
+++ b/fs/read_write.c
@@ -202,7 +202,7 @@ int rw_verify_area(int read_write, struct file *file, loff_t *ppos, size_t count
                 goto Einval;
 
         inode = file->f_dentry->d_inode;
-        if (inode->i_flock && MANDATORY_LOCK(inode)) {
+        if (unlikely(inode->i_flock && MANDATORY_LOCK(inode))) {
                 int retval = locks_mandatory_area(
                         read_write == READ ? FLOCK_VERIFY_READ : FLOCK_VERIFY_WRITE,
                         inode, file, pos, count);
diff --git a/fs/select.c b/fs/select.c
index 071660fa7b01..a8109baa5e46 100644
--- a/fs/select.c
+++ b/fs/select.c
@@ -310,8 +310,9 @@ static int core_sys_select(int n, fd_set __user *inp, fd_set __user *outp,
                            fd_set __user *exp, s64 *timeout)
 {
         fd_set_bits fds;
-        char *bits;
-        int ret, size, max_fdset;
+        void *bits;
+        int ret, max_fdset;
+        unsigned int size;
         struct fdtable *fdt;
         /* Allocate small arguments on the stack to save memory and be faster */
         long stack_fds[SELECT_STACK_ALLOC/sizeof(long)];
@@ -333,20 +334,21 @@ static int core_sys_select(int n, fd_set __user *inp, fd_set __user *outp,
          * since we used fdset we need to allocate memory in units of
          * long-words. 
          */
-        ret = -ENOMEM;
         size = FDS_BYTES(n);
-        if (6*size < SELECT_STACK_ALLOC)
-                bits = stack_fds;
-        else
+        bits = stack_fds;
+        if (size > sizeof(stack_fds) / 6) {
+                /* Not enough space in on-stack array; must use kmalloc */
+                ret = -ENOMEM;
                 bits = kmalloc(6 * size, GFP_KERNEL);
-        if (!bits)
-                goto out_nofds;
-        fds.in      = (unsigned long *)  bits;
-        fds.out     = (unsigned long *) (bits +   size);
-        fds.ex      = (unsigned long *) (bits + 2*size);
-        fds.res_in  = (unsigned long *) (bits + 3*size);
-        fds.res_out = (unsigned long *) (bits + 4*size);
-        fds.res_ex  = (unsigned long *) (bits + 5*size);
+                if (!bits)
+                        goto out_nofds;
+        }
+        fds.in      = bits;
+        fds.out     = bits +   size;
+        fds.ex      = bits + 2*size;
+        fds.res_in  = bits + 3*size;
+        fds.res_out = bits + 4*size;
+        fds.res_ex  = bits + 5*size;
 
         if ((ret = get_fd_set(n, inp, fds.in)) ||
             (ret = get_fd_set(n, outp, fds.out)) ||
diff --git a/fs/smbfs/file.c b/fs/smbfs/file.c
index c56bd99a9701..ed9a24d19d7d 100644
--- a/fs/smbfs/file.c
+++ b/fs/smbfs/file.c
@@ -178,11 +178,9 @@ smb_writepage(struct page *page, struct writeback_control *wbc)
         unsigned offset = PAGE_CACHE_SIZE;
         int err;
 
-        if (!mapping)
-                BUG();
+        BUG_ON(!mapping);
         inode = mapping->host;
-        if (!inode)
-                BUG();
+        BUG_ON(!inode);
 
         end_index = inode->i_size >> PAGE_CACHE_SHIFT;
 
diff --git a/fs/splice.c b/fs/splice.c
index 7c2bbf18d7a7..e50a460239dd 100644
--- a/fs/splice.c
+++ b/fs/splice.c
@@ -9,11 +9,12 @@
  * that transfers data buffers to or from a pipe buffer.
  *
  * Named by Larry McVoy, original implementation from Linus, extended by
- * Jens to support splicing to files and fixing the initial implementation
- * bugs.
+ * Jens to support splicing to files, network, direct splicing, etc and
+ * fixing lots of bugs.
  *
- * Copyright (C) 2005 Jens Axboe <axboe@suse.de>
- * Copyright (C) 2005 Linus Torvalds <torvalds@osdl.org>
+ * Copyright (C) 2005-2006 Jens Axboe <axboe@suse.de>
+ * Copyright (C) 2005-2006 Linus Torvalds <torvalds@osdl.org>
+ * Copyright (C) 2006 Ingo Molnar <mingo@elte.hu>
  *
  */
 #include <linux/fs.h>
@@ -22,7 +23,10 @@
 #include <linux/pipe_fs_i.h>
 #include <linux/mm_inline.h>
 #include <linux/swap.h>
+#include <linux/writeback.h>
+#include <linux/buffer_head.h>
 #include <linux/module.h>
+#include <linux/syscalls.h>
 
 /*
  * Passed to the actors
@@ -34,28 +38,37 @@ struct splice_desc {
         loff_t pos;                     /* file position */
 };
 
+/*
+ * Attempt to steal a page from a pipe buffer. This should perhaps go into
+ * a vm helper function, it's already simplified quite a bit by the
+ * addition of remove_mapping(). If success is returned, the caller may
+ * attempt to reuse this page for another destination.
+ */
 static int page_cache_pipe_buf_steal(struct pipe_inode_info *info,
                                      struct pipe_buffer *buf)
 {
         struct page *page = buf->page;
+        struct address_space *mapping = page_mapping(page);
 
         WARN_ON(!PageLocked(page));
         WARN_ON(!PageUptodate(page));
 
-        if (!remove_mapping(page_mapping(page), page))
-                return 1;
+        /*
+         * At least for ext2 with nobh option, we need to wait on writeback
+         * completing on this page, since we'll remove it from the pagecache.
+         * Otherwise truncate wont wait on the page, allowing the disk
+         * blocks to be reused by someone else before we actually wrote our
+         * data to them. fs corruption ensues.
+         */
+        wait_on_page_writeback(page);
 
-        if (PageLRU(page)) {
-                struct zone *zone = page_zone(page);
+        if (PagePrivate(page))
+                try_to_release_page(page, mapping_gfp_mask(mapping));
 
-                spin_lock_irq(&zone->lru_lock);
-                BUG_ON(!PageLRU(page));
-                __ClearPageLRU(page);
-                del_page_from_lru(zone, page);
-                spin_unlock_irq(&zone->lru_lock);
-        }
+        if (!remove_mapping(mapping, page))
+                return 1;
 
-        buf->stolen = 1;
+        buf->flags |= PIPE_BUF_FLAG_STOLEN | PIPE_BUF_FLAG_LRU;
         return 0;
 }
 
@@ -64,7 +77,7 @@ static void page_cache_pipe_buf_release(struct pipe_inode_info *info,
 {
         page_cache_release(buf->page);
         buf->page = NULL;
-        buf->stolen = 0;
+        buf->flags &= ~(PIPE_BUF_FLAG_STOLEN | PIPE_BUF_FLAG_LRU);
 }
 
 static void *page_cache_pipe_buf_map(struct file *file,
@@ -72,27 +85,43 @@ static void *page_cache_pipe_buf_map(struct file *file,
                                      struct pipe_buffer *buf)
 {
         struct page *page = buf->page;
-
-        lock_page(page);
+        int err;
 
         if (!PageUptodate(page)) {
-                unlock_page(page);
-                return ERR_PTR(-EIO);
-        }
+                lock_page(page);
+
+                /*
+                 * Page got truncated/unhashed. This will cause a 0-byte
+                 * splice, if this is the first page.
+                 */
+                if (!page->mapping) {
+                        err = -ENODATA;
+                        goto error;
+                }
 
-        if (!page->mapping) {
+                /*
+                 * Uh oh, read-error from disk.
+                 */
+                if (!PageUptodate(page)) {
+                        err = -EIO;
+                        goto error;
+                }
+
+                /*
+                 * Page is ok afterall, fall through to mapping.
+                 */
                 unlock_page(page);
-                return ERR_PTR(-ENODATA);
         }
 
-        return kmap(buf->page);
+        return kmap(page);
+error:
+        unlock_page(page);
+        return ERR_PTR(err);
 }
 
 static void page_cache_pipe_buf_unmap(struct pipe_inode_info *info,
                                       struct pipe_buffer *buf)
 {
-        if (!buf->stolen)
-                unlock_page(buf->page);
         kunmap(buf->page);
 }
 
@@ -104,34 +133,34 @@ static struct pipe_buf_operations page_cache_pipe_buf_ops = {
         .steal = page_cache_pipe_buf_steal,
 };
 
-static ssize_t move_to_pipe(struct inode *inode, struct page **pages,
+/*
+ * Pipe output worker. This sets up our pipe format with the page cache
+ * pipe buffer operations. Otherwise very similar to the regular pipe_writev().
+ */
+static ssize_t move_to_pipe(struct pipe_inode_info *pipe, struct page **pages,
                             int nr_pages, unsigned long offset,
-                            unsigned long len)
+                            unsigned long len, unsigned int flags)
 {
-        struct pipe_inode_info *info;
         int ret, do_wakeup, i;
 
         ret = 0;
         do_wakeup = 0;
         i = 0;
 
-        mutex_lock(PIPE_MUTEX(*inode));
+        if (pipe->inode)
+                mutex_lock(&pipe->inode->i_mutex);
 
-        info = inode->i_pipe;
         for (;;) {
-                int bufs;
-
-                if (!PIPE_READERS(*inode)) {
+                if (!pipe->readers) {
                         send_sig(SIGPIPE, current, 0);
                         if (!ret)
                                 ret = -EPIPE;
                         break;
                 }
 
-                bufs = info->nrbufs;
-                if (bufs < PIPE_BUFFERS) {
-                        int newbuf = (info->curbuf + bufs) & (PIPE_BUFFERS - 1);
-                        struct pipe_buffer *buf = info->bufs + newbuf;
+                if (pipe->nrbufs < PIPE_BUFFERS) {
+                        int newbuf = (pipe->curbuf + pipe->nrbufs) & (PIPE_BUFFERS - 1);
+                        struct pipe_buffer *buf = pipe->bufs + newbuf;
                         struct page *page = pages[i++];
                         unsigned long this_len;
 
@@ -143,8 +172,9 @@ static ssize_t move_to_pipe(struct inode *inode, struct page **pages,
                         buf->offset = offset;
                         buf->len = this_len;
                         buf->ops = &page_cache_pipe_buf_ops;
-                        info->nrbufs = ++bufs;
-                        do_wakeup = 1;
+                        pipe->nrbufs++;
+                        if (pipe->inode)
+                                do_wakeup = 1;
 
                         ret += this_len;
                         len -= this_len;
@@ -153,12 +183,18 @@ static ssize_t move_to_pipe(struct inode *inode, struct page **pages,
                                 break;
                         if (!len)
                                 break;
-                        if (bufs < PIPE_BUFFERS)
+                        if (pipe->nrbufs < PIPE_BUFFERS)
                                 continue;
 
                         break;
                 }
 
+                if (flags & SPLICE_F_NONBLOCK) {
+                        if (!ret)
+                                ret = -EAGAIN;
+                        break;
+                }
+
                 if (signal_pending(current)) {
                         if (!ret)
                                 ret = -ERESTARTSYS;
@@ -166,22 +202,26 @@ static ssize_t move_to_pipe(struct inode *inode, struct page **pages,
                 }
 
                 if (do_wakeup) {
-                        wake_up_interruptible_sync(PIPE_WAIT(*inode));
-                        kill_fasync(PIPE_FASYNC_READERS(*inode), SIGIO,
-                                    POLL_IN);
+                        smp_mb();
+                        if (waitqueue_active(&pipe->wait))
+                                wake_up_interruptible_sync(&pipe->wait);
+                        kill_fasync(&pipe->fasync_readers, SIGIO, POLL_IN);
                         do_wakeup = 0;
                 }
 
-                PIPE_WAITING_WRITERS(*inode)++;
-                pipe_wait(inode);
-                PIPE_WAITING_WRITERS(*inode)--;
+                pipe->waiting_writers++;
+                pipe_wait(pipe);
+                pipe->waiting_writers--;
         }
 
-        mutex_unlock(PIPE_MUTEX(*inode));
+        if (pipe->inode)
+                mutex_unlock(&pipe->inode->i_mutex);
 
         if (do_wakeup) {
-                wake_up_interruptible(PIPE_WAIT(*inode));
-                kill_fasync(PIPE_FASYNC_READERS(*inode), SIGIO, POLL_IN);
+                smp_mb();
+                if (waitqueue_active(&pipe->wait))
+                        wake_up_interruptible(&pipe->wait);
+                kill_fasync(&pipe->fasync_readers, SIGIO, POLL_IN);
         }
 
         while (i < nr_pages)
@@ -190,15 +230,16 @@ static ssize_t move_to_pipe(struct inode *inode, struct page **pages,
         return ret;
 }
 
-static int __generic_file_splice_read(struct file *in, struct inode *pipe,
-                                      size_t len)
+static int
+__generic_file_splice_read(struct file *in, struct pipe_inode_info *pipe,
+                           size_t len, unsigned int flags)
 {
         struct address_space *mapping = in->f_mapping;
         unsigned int offset, nr_pages;
-        struct page *pages[PIPE_BUFFERS], *shadow[PIPE_BUFFERS];
+        struct page *pages[PIPE_BUFFERS];
         struct page *page;
-        pgoff_t index, pidx;
-        int i, j;
+        pgoff_t index;
+        int i, error;
 
         index = in->f_pos >> PAGE_CACHE_SHIFT;
         offset = in->f_pos & ~PAGE_CACHE_MASK;
@@ -208,81 +249,106 @@ static int __generic_file_splice_read(struct file *in, struct inode *pipe,
                 nr_pages = PIPE_BUFFERS;
 
         /*
-         * initiate read-ahead on this page range
-         */
-        do_page_cache_readahead(mapping, in, index, nr_pages);
-
-        /*
-         * Get as many pages from the page cache as possible..
-         * Start IO on the page cache entries we create (we
-         * can assume that any pre-existing ones we find have
-         * already had IO started on them).
+         * Initiate read-ahead on this page range. however, don't call into
+         * read-ahead if this is a non-zero offset (we are likely doing small
+         * chunk splice and the page is already there) for a single page.
          */
-        i = find_get_pages(mapping, index, nr_pages, pages);
+        if (!offset || nr_pages > 1)
+                do_page_cache_readahead(mapping, in, index, nr_pages);
 
         /*
-         * common case - we found all pages and they are contiguous,
-         * kick them off
+         * Now fill in the holes:
          */
-        if (i && (pages[i - 1]->index == index + i - 1))
-                goto splice_them;
+        error = 0;
+        for (i = 0; i < nr_pages; i++, index++) {
+find_page:
+                /*
+                 * lookup the page for this index
+                 */
+                page = find_get_page(mapping, index);
+                if (!page) {
+                        /*
+                         * If in nonblock mode then dont block on
+                         * readpage (we've kicked readahead so there
+                         * will be asynchronous progress):
+                         */
+                        if (flags & SPLICE_F_NONBLOCK)
+                                break;
 
-        /*
-         * fill shadow[] with pages at the right locations, so we only
-         * have to fill holes
-         */
-        memset(shadow, 0, i * sizeof(struct page *));
-        for (j = 0, pidx = index; j < i; pidx++, j++)
-                shadow[pages[j]->index - pidx] = pages[j];
+                        /*
+                         * page didn't exist, allocate one
+                         */
+                        page = page_cache_alloc_cold(mapping);
+                        if (!page)
+                                break;
 
-        /*
-         * now fill in the holes
-         */
-        for (i = 0, pidx = index; i < nr_pages; pidx++, i++) {
-                int error;
+                        error = add_to_page_cache_lru(page, mapping, index,
+                                                mapping_gfp_mask(mapping));
+                        if (unlikely(error)) {
+                                page_cache_release(page);
+                                break;
+                        }
 
-                if (shadow[i])
-                        continue;
+                        goto readpage;
+                }
 
                 /*
-                 * no page there, look one up / create it
+                 * If the page isn't uptodate, we may need to start io on it
                  */
-                page = find_or_create_page(mapping, pidx,
-                                                   mapping_gfp_mask(mapping));
-                if (!page)
-                        break;
+                if (!PageUptodate(page)) {
+                        lock_page(page);
+
+                        /*
+                         * page was truncated, stop here. if this isn't the
+                         * first page, we'll just complete what we already
+                         * added
+                         */
+                        if (!page->mapping) {
+                                unlock_page(page);
+                                page_cache_release(page);
+                                break;
+                        }
+                        /*
+                         * page was already under io and is now done, great
+                         */
+                        if (PageUptodate(page)) {
+                                unlock_page(page);
+                                goto fill_it;
+                        }
 
-                if (PageUptodate(page))
-                        unlock_page(page);
-                else {
+readpage:
+                        /*
+                         * need to read in the page
+                         */
                         error = mapping->a_ops->readpage(in, page);
 
                         if (unlikely(error)) {
                                 page_cache_release(page);
+                                if (error == AOP_TRUNCATED_PAGE)
+                                        goto find_page;
                                 break;
                         }
                 }
-                shadow[i] = page;
-        }
-
-        if (!i) {
-                for (i = 0; i < nr_pages; i++) {
-                         if (shadow[i])
-                                page_cache_release(shadow[i]);
-                }
-                return 0;
+fill_it:
+                pages[i] = page;
         }
 
-        memcpy(pages, shadow, i * sizeof(struct page *));
+        if (i)
+                return move_to_pipe(pipe, pages, i, offset, len, flags);
 
-        /*
-         * Now we splice them into the pipe..
-         */
-splice_them:
-        return move_to_pipe(pipe, pages, i, offset, len);
+        return error;
 }
 
-ssize_t generic_file_splice_read(struct file *in, struct inode *pipe,
+/**
+ * generic_file_splice_read - splice data from file to a pipe
+ * @in:         file to splice from
+ * @pipe:       pipe to splice to
+ * @len:        number of bytes to splice
+ * @flags:      splice modifier flags
+ *
+ * Will read pages from given file and fill them into a pipe.
+ */
+ssize_t generic_file_splice_read(struct file *in, struct pipe_inode_info *pipe,
                                  size_t len, unsigned int flags)
 {
         ssize_t spliced;
@@ -290,8 +356,9 @@ ssize_t generic_file_splice_read(struct file *in, struct inode *pipe,
 
         ret = 0;
         spliced = 0;
+
         while (len) {
-                ret = __generic_file_splice_read(in, pipe, len);
+                ret = __generic_file_splice_read(in, pipe, len, flags);
 
                 if (ret <= 0)
                         break;
@@ -299,6 +366,11 @@ ssize_t generic_file_splice_read(struct file *in, struct inode *pipe,
                 in->f_pos += ret;
                 len -= ret;
                 spliced += ret;
+
+                if (!(flags & SPLICE_F_NONBLOCK))
+                        continue;
+                ret = -EAGAIN;
+                break;
         }
 
         if (spliced)
@@ -307,8 +379,11 @@ ssize_t generic_file_splice_read(struct file *in, struct inode *pipe,
         return ret;
 }
 
+EXPORT_SYMBOL(generic_file_splice_read);
+
 /*
- * Send 'len' bytes to socket from 'file' at position 'pos' using sendpage().
+ * Send 'sd->len' bytes to socket from 'sd->file' at position 'sd->pos'
+ * using sendpage().
  */
 static int pipe_to_sendpage(struct pipe_inode_info *info,
                             struct pipe_buffer *buf, struct splice_desc *sd)
@@ -318,21 +393,22 @@ static int pipe_to_sendpage(struct pipe_inode_info *info,
         unsigned int offset;
         ssize_t ret;
         void *ptr;
+        int more;
 
         /*
-         * sub-optimal, but we are limited by the pipe ->map. we don't
+         * Sub-optimal, but we are limited by the pipe ->map. We don't
          * need a kmap'ed buffer here, we just want to make sure we
          * have the page pinned if the pipe page originates from the
-         * page cache
+         * page cache.
          */
         ptr = buf->ops->map(file, info, buf);
         if (IS_ERR(ptr))
                 return PTR_ERR(ptr);
 
         offset = pos & ~PAGE_CACHE_MASK;
+        more = (sd->flags & SPLICE_F_MORE) || sd->len < sd->total_len;
 
-        ret = file->f_op->sendpage(file, buf->page, offset, sd->len, &pos,
-                                        sd->len < sd->total_len);
+        ret = file->f_op->sendpage(file, buf->page, offset, sd->len, &pos,more);
 
         buf->ops->unmap(info, buf);
         if (ret == sd->len)
@@ -354,16 +430,19 @@ static int pipe_to_sendpage(struct pipe_inode_info *info,
  *      - Destination page does not exist, we can add the pipe page to
  *        the page cache and avoid the copy.
  *
- * For now we just do the slower thing and always copy pages over, it's
- * easier than migrating pages from the pipe to the target file. For the
- * case of doing file | file splicing, the migrate approach had some LRU
- * nastiness...
+ * If asked to move pages to the output file (SPLICE_F_MOVE is set in
+ * sd->flags), we attempt to migrate pages from the pipe to the output
+ * file address space page cache. This is possible if no one else has
+ * the pipe page referenced outside of the pipe and page cache. If
+ * SPLICE_F_MOVE isn't set, or we cannot move the page, we simply create
+ * a new page in the output file page cache and fill/dirty that.
  */
 static int pipe_to_file(struct pipe_inode_info *info, struct pipe_buffer *buf,
                         struct splice_desc *sd)
 {
         struct file *file = sd->file;
         struct address_space *mapping = file->f_mapping;
+        gfp_t gfp_mask = mapping_gfp_mask(mapping);
         unsigned int offset;
         struct page *page;
         pgoff_t index;
@@ -371,7 +450,7 @@ static int pipe_to_file(struct pipe_inode_info *info, struct pipe_buffer *buf,
         int ret;
 
         /*
-         * after this, page will be locked and unmapped
+         * make sure the data in this buffer is uptodate
          */
         src = buf->ops->map(file, info, buf);
         if (IS_ERR(src))
@@ -381,23 +460,31 @@ static int pipe_to_file(struct pipe_inode_info *info, struct pipe_buffer *buf,
         offset = sd->pos & ~PAGE_CACHE_MASK;
 
         /*
-         * reuse buf page, if SPLICE_F_MOVE is set
+         * Reuse buf page, if SPLICE_F_MOVE is set.
          */
         if (sd->flags & SPLICE_F_MOVE) {
+                /*
+                 * If steal succeeds, buf->page is now pruned from the vm
+                 * side (LRU and page cache) and we can reuse it.
+                 */
                 if (buf->ops->steal(info, buf))
                         goto find_page;
 
+                /*
+                 * this will also set the page locked
+                 */
                 page = buf->page;
-                if (add_to_page_cache_lru(page, mapping, index,
-                                                mapping_gfp_mask(mapping)))
+                if (add_to_page_cache(page, mapping, index, gfp_mask))
                         goto find_page;
+
+                if (!(buf->flags & PIPE_BUF_FLAG_LRU))
+                        lru_cache_add(page);
         } else {
 find_page:
                 ret = -ENOMEM;
-                page = find_or_create_page(mapping, index,
-                                                mapping_gfp_mask(mapping));
+                page = find_or_create_page(mapping, index, gfp_mask);
                 if (!page)
-                        goto out;
+                        goto out_nomem;
 
                 /*
                  * If the page is uptodate, it is also locked. If it isn't
@@ -414,7 +501,7 @@ find_page:
 
                                 if (!PageUptodate(page)) {
                                         /*
-                                         * page got invalidated, repeat
+                                         * Page got invalidated, repeat.
                                          */
                                         if (!page->mapping) {
                                                 unlock_page(page);
@@ -432,10 +519,13 @@ find_page:
         }
 
         ret = mapping->a_ops->prepare_write(file, page, 0, sd->len);
-        if (ret)
+        if (ret == AOP_TRUNCATED_PAGE) {
+                page_cache_release(page);
+                goto find_page;
+        } else if (ret)
                 goto out;
 
-        if (!buf->stolen) {
+        if (!(buf->flags & PIPE_BUF_FLAG_STOLEN)) {
                 char *dst = kmap_atomic(page, KM_USER0);
 
                 memcpy(dst + offset, src + buf->offset, sd->len);
@@ -444,16 +534,20 @@ find_page:
         }
 
         ret = mapping->a_ops->commit_write(file, page, 0, sd->len);
-        if (ret < 0)
+        if (ret == AOP_TRUNCATED_PAGE) {
+                page_cache_release(page);
+                goto find_page;
+        } else if (ret)
                 goto out;
 
-        set_page_dirty(page);
-        ret = write_one_page(page, 0);
+        mark_page_accessed(page);
+        balance_dirty_pages_ratelimited(mapping);
 out:
-        if (ret < 0)
-                unlock_page(page);
-        if (!buf->stolen)
+        if (!(buf->flags & PIPE_BUF_FLAG_STOLEN)) {
                 page_cache_release(page);
+                unlock_page(page);
+        }
+out_nomem:
         buf->ops->unmap(info, buf);
         return ret;
 }
@@ -461,11 +555,15 @@ out:
 typedef int (splice_actor)(struct pipe_inode_info *, struct pipe_buffer *,
                            struct splice_desc *);
 
-static ssize_t move_from_pipe(struct inode *inode, struct file *out,
+/*
+ * Pipe input worker. Most of this logic works like a regular pipe, the
+ * key here is the 'actor' worker passed in that actually moves the data
+ * to the wanted destination. See pipe_to_file/pipe_to_sendpage above.
+ */
+static ssize_t move_from_pipe(struct pipe_inode_info *pipe, struct file *out,
                               size_t len, unsigned int flags,
                               splice_actor *actor)
 {
-        struct pipe_inode_info *info;
         int ret, do_wakeup, err;
         struct splice_desc sd;
 
@@ -477,22 +575,19 @@ static ssize_t move_from_pipe(struct inode *inode, struct file *out,
         sd.file = out;
         sd.pos = out->f_pos;
 
-        mutex_lock(PIPE_MUTEX(*inode));
+        if (pipe->inode)
+                mutex_lock(&pipe->inode->i_mutex);
 
-        info = inode->i_pipe;
         for (;;) {
-                int bufs = info->nrbufs;
-
-                if (bufs) {
-                        int curbuf = info->curbuf;
-                        struct pipe_buffer *buf = info->bufs + curbuf;
+                if (pipe->nrbufs) {
+                        struct pipe_buffer *buf = pipe->bufs + pipe->curbuf;
                         struct pipe_buf_operations *ops = buf->ops;
 
                         sd.len = buf->len;
                         if (sd.len > sd.total_len)
                                 sd.len = sd.total_len;
 
-                        err = actor(info, buf, &sd);
+                        err = actor(pipe, buf, &sd);
                         if (err) {
                                 if (!ret && err != -ENODATA)
                                         ret = err;
@@ -503,13 +598,14 @@ static ssize_t move_from_pipe(struct inode *inode, struct file *out,
                         ret += sd.len;
                         buf->offset += sd.len;
                         buf->len -= sd.len;
+
                         if (!buf->len) {
                                 buf->ops = NULL;
-                                ops->release(info, buf);
-                                curbuf = (curbuf + 1) & (PIPE_BUFFERS - 1);
-                                info->curbuf = curbuf;
-                                info->nrbufs = --bufs;
-                                do_wakeup = 1;
+                                ops->release(pipe, buf);
+                                pipe->curbuf = (pipe->curbuf + 1) & (PIPE_BUFFERS - 1);
+                                pipe->nrbufs--;
+                                if (pipe->inode)
+                                        do_wakeup = 1;
                         }
 
                         sd.pos += sd.len;
@@ -518,15 +614,21 @@ static ssize_t move_from_pipe(struct inode *inode, struct file *out,
                                 break;
                 }
 
-                if (bufs)
+                if (pipe->nrbufs)
                         continue;
-                if (!PIPE_WRITERS(*inode))
+                if (!pipe->writers)
                         break;
-                if (!PIPE_WAITING_WRITERS(*inode)) {
+                if (!pipe->waiting_writers) {
                         if (ret)
                                 break;
                 }
 
+                if (flags & SPLICE_F_NONBLOCK) {
+                        if (!ret)
+                                ret = -EAGAIN;
+                        break;
+                }
+
                 if (signal_pending(current)) {
                         if (!ret)
                                 ret = -ERESTARTSYS;
@@ -534,56 +636,109 @@ static ssize_t move_from_pipe(struct inode *inode, struct file *out,
                 }
 
                 if (do_wakeup) {
-                        wake_up_interruptible_sync(PIPE_WAIT(*inode));
-                        kill_fasync(PIPE_FASYNC_WRITERS(*inode),SIGIO,POLL_OUT);
+                        smp_mb();
+                        if (waitqueue_active(&pipe->wait))
+                                wake_up_interruptible_sync(&pipe->wait);
+                        kill_fasync(&pipe->fasync_writers, SIGIO, POLL_OUT);
                         do_wakeup = 0;
                 }
 
-                pipe_wait(inode);
+                pipe_wait(pipe);
         }
 
-        mutex_unlock(PIPE_MUTEX(*inode));
+        if (pipe->inode)
+                mutex_unlock(&pipe->inode->i_mutex);
 
         if (do_wakeup) {
-                wake_up_interruptible(PIPE_WAIT(*inode));
-                kill_fasync(PIPE_FASYNC_WRITERS(*inode), SIGIO, POLL_OUT);
+                smp_mb();
+                if (waitqueue_active(&pipe->wait))
+                        wake_up_interruptible(&pipe->wait);
+                kill_fasync(&pipe->fasync_writers, SIGIO, POLL_OUT);
         }
 
-        mutex_lock(&out->f_mapping->host->i_mutex);
         out->f_pos = sd.pos;
-        mutex_unlock(&out->f_mapping->host->i_mutex);
         return ret;
 
 }
 
-ssize_t generic_file_splice_write(struct inode *inode, struct file *out,
-                                  size_t len, unsigned int flags)
+/**
+ * generic_file_splice_write - splice data from a pipe to a file
+ * @pipe:       pipe info
+ * @out:        file to write to
+ * @len:        number of bytes to splice
+ * @flags:      splice modifier flags
+ *
+ * Will either move or copy pages (determined by @flags options) from
+ * the given pipe inode to the given file.
+ *
+ */
+ssize_t
+generic_file_splice_write(struct pipe_inode_info *pipe, struct file *out,
+                          size_t len, unsigned int flags)
 {
-        return move_from_pipe(inode, out, len, flags, pipe_to_file);
+        struct address_space *mapping = out->f_mapping;
+        ssize_t ret;
+
+        ret = move_from_pipe(pipe, out, len, flags, pipe_to_file);
+
+        /*
+         * If file or inode is SYNC and we actually wrote some data, sync it.
+         */
+        if (unlikely((out->f_flags & O_SYNC) || IS_SYNC(mapping->host))
+            && ret > 0) {
+                struct inode *inode = mapping->host;
+                int err;
+
+                mutex_lock(&inode->i_mutex);
+                err = generic_osync_inode(mapping->host, mapping,
+                                          OSYNC_METADATA|OSYNC_DATA);
+                mutex_unlock(&inode->i_mutex);
+
+                if (err)
+                        ret = err;
+        }
+
+        return ret;
 }
 
-ssize_t generic_splice_sendpage(struct inode *inode, struct file *out,
+EXPORT_SYMBOL(generic_file_splice_write);
+
+/**
+ * generic_splice_sendpage - splice data from a pipe to a socket
+ * @inode:      pipe inode
+ * @out:        socket to write to
+ * @len:        number of bytes to splice
+ * @flags:      splice modifier flags
+ *
+ * Will send @len bytes from the pipe to a network socket. No data copying
+ * is involved.
+ *
+ */
+ssize_t generic_splice_sendpage(struct pipe_inode_info *pipe, struct file *out,
                                 size_t len, unsigned int flags)
 {
-        return move_from_pipe(inode, out, len, flags, pipe_to_sendpage);
+        return move_from_pipe(pipe, out, len, flags, pipe_to_sendpage);
 }
 
-EXPORT_SYMBOL(generic_file_splice_write);
-EXPORT_SYMBOL(generic_file_splice_read);
+EXPORT_SYMBOL(generic_splice_sendpage);
 
-static long do_splice_from(struct inode *pipe, struct file *out, size_t len,
-                           unsigned int flags)
+/*
+ * Attempt to initiate a splice from pipe to file.
+ */
+static long do_splice_from(struct pipe_inode_info *pipe, struct file *out,
+                           size_t len, unsigned int flags)
 {
         loff_t pos;
         int ret;
 
-        if (!out->f_op || !out->f_op->splice_write)
+        if (unlikely(!out->f_op || !out->f_op->splice_write))
                 return -EINVAL;
 
-        if (!(out->f_mode & FMODE_WRITE))
+        if (unlikely(!(out->f_mode & FMODE_WRITE)))
                 return -EBADF;
 
         pos = out->f_pos;
+
         ret = rw_verify_area(WRITE, out, &pos, len);
         if (unlikely(ret < 0))
                 return ret;
@@ -591,19 +746,23 @@ static long do_splice_from(struct inode *pipe, struct file *out, size_t len,
         return out->f_op->splice_write(pipe, out, len, flags);
 }
 
-static long do_splice_to(struct file *in, struct inode *pipe, size_t len,
-                         unsigned int flags)
+/*
+ * Attempt to initiate a splice from a file to a pipe.
+ */
+static long do_splice_to(struct file *in, struct pipe_inode_info *pipe,
+                         size_t len, unsigned int flags)
 {
         loff_t pos, isize, left;
         int ret;
 
-        if (!in->f_op || !in->f_op->splice_read)
+        if (unlikely(!in->f_op || !in->f_op->splice_read))
                 return -EINVAL;
 
-        if (!(in->f_mode & FMODE_READ))
+        if (unlikely(!(in->f_mode & FMODE_READ)))
                 return -EBADF;
 
         pos = in->f_pos;
+
         ret = rw_verify_area(READ, in, &pos, len);
         if (unlikely(ret < 0))
                 return ret;
@@ -613,29 +772,168 @@ static long do_splice_to(struct file *in, struct inode *pipe, size_t len,
                 return 0;
         
         left = isize - in->f_pos;
-        if (left < len)
+        if (unlikely(left < len))
                 len = left;
 
         return in->f_op->splice_read(in, pipe, len, flags);
 }
 
-static long do_splice(struct file *in, struct file *out, size_t len,
+long do_splice_direct(struct file *in, struct file *out, size_t len,
                       unsigned int flags)
 {
-        struct inode *pipe;
+        struct pipe_inode_info *pipe;
+        long ret, bytes;
+        umode_t i_mode;
+        int i;
+
+        /*
+         * We require the input being a regular file, as we don't want to
+         * randomly drop data for eg socket -> socket splicing. Use the
+         * piped splicing for that!
+         */
+        i_mode = in->f_dentry->d_inode->i_mode;
+        if (unlikely(!S_ISREG(i_mode) && !S_ISBLK(i_mode)))
+                return -EINVAL;
+
+        /*
+         * neither in nor out is a pipe, setup an internal pipe attached to
+         * 'out' and transfer the wanted data from 'in' to 'out' through that
+         */
+        pipe = current->splice_pipe;
+        if (unlikely(!pipe)) {
+                pipe = alloc_pipe_info(NULL);
+                if (!pipe)
+                        return -ENOMEM;
+
+                /*
+                 * We don't have an immediate reader, but we'll read the stuff
+                 * out of the pipe right after the move_to_pipe(). So set
+                 * PIPE_READERS appropriately.
+                 */
+                pipe->readers = 1;
+
+                current->splice_pipe = pipe;
+        }
+
+        /*
+         * Do the splice.
+         */
+        ret = 0;
+        bytes = 0;
+
+        while (len) {
+                size_t read_len, max_read_len;
+
+                /*
+                 * Do at most PIPE_BUFFERS pages worth of transfer:
+                 */
+                max_read_len = min(len, (size_t)(PIPE_BUFFERS*PAGE_SIZE));
+
+                ret = do_splice_to(in, pipe, max_read_len, flags);
+                if (unlikely(ret < 0))
+                        goto out_release;
+
+                read_len = ret;
+
+                /*
+                 * NOTE: nonblocking mode only applies to the input. We
+                 * must not do the output in nonblocking mode as then we
+                 * could get stuck data in the internal pipe:
+                 */
+                ret = do_splice_from(pipe, out, read_len,
+                                     flags & ~SPLICE_F_NONBLOCK);
+                if (unlikely(ret < 0))
+                        goto out_release;
+
+                bytes += ret;
+                len -= ret;
+
+                /*
+                 * In nonblocking mode, if we got back a short read then
+                 * that was due to either an IO error or due to the
+                 * pagecache entry not being there. In the IO error case
+                 * the _next_ splice attempt will produce a clean IO error
+                 * return value (not a short read), so in both cases it's
+                 * correct to break out of the loop here:
+                 */
+                if ((flags & SPLICE_F_NONBLOCK) && (read_len < max_read_len))
+                        break;
+        }
+
+        pipe->nrbufs = pipe->curbuf = 0;
+
+        return bytes;
+
+out_release:
+        /*
+         * If we did an incomplete transfer we must release
+         * the pipe buffers in question:
+         */
+        for (i = 0; i < PIPE_BUFFERS; i++) {
+                struct pipe_buffer *buf = pipe->bufs + i;
+
+                if (buf->ops) {
+                        buf->ops->release(pipe, buf);
+                        buf->ops = NULL;
+                }
+        }
+        pipe->nrbufs = pipe->curbuf = 0;
+
+        /*
+         * If we transferred some data, return the number of bytes:
+         */
+        if (bytes > 0)
+                return bytes;
+
+        return ret;
+}
+
+EXPORT_SYMBOL(do_splice_direct);
+
+/*
+ * Determine where to splice to/from.
+ */
+static long do_splice(struct file *in, loff_t __user *off_in,
+                      struct file *out, loff_t __user *off_out,
+                      size_t len, unsigned int flags)
+{
+        struct pipe_inode_info *pipe;
+
+        pipe = in->f_dentry->d_inode->i_pipe;
+        if (pipe) {
+                if (off_in)
+                        return -ESPIPE;
+                if (off_out) {
+                        if (out->f_op->llseek == no_llseek)
+                                return -EINVAL;
+                        if (copy_from_user(&out->f_pos, off_out,
+                                           sizeof(loff_t)))
+                                return -EFAULT;
+                }
 
-        pipe = in->f_dentry->d_inode;
-        if (pipe->i_pipe)
                 return do_splice_from(pipe, out, len, flags);
+        }
+
+        pipe = out->f_dentry->d_inode->i_pipe;
+        if (pipe) {
+                if (off_out)
+                        return -ESPIPE;
+                if (off_in) {
+                        if (in->f_op->llseek == no_llseek)
+                                return -EINVAL;
+                        if (copy_from_user(&in->f_pos, off_in, sizeof(loff_t)))
+                                return -EFAULT;
+                }
 
-        pipe = out->f_dentry->d_inode;
-        if (pipe->i_pipe)
                 return do_splice_to(in, pipe, len, flags);
+        }
 
         return -EINVAL;
 }
 
-asmlinkage long sys_splice(int fdin, int fdout, size_t len, unsigned int flags)
+asmlinkage long sys_splice(int fd_in, loff_t __user *off_in,
+                           int fd_out, loff_t __user *off_out,
+                           size_t len, unsigned int flags)
 {
         long error;
         struct file *in, *out;
@@ -645,13 +943,15 @@ asmlinkage long sys_splice(int fdin, int fdout, size_t len, unsigned int flags)
                 return 0;
 
         error = -EBADF;
-        in = fget_light(fdin, &fput_in);
+        in = fget_light(fd_in, &fput_in);
         if (in) {
                 if (in->f_mode & FMODE_READ) {
-                        out = fget_light(fdout, &fput_out);
+                        out = fget_light(fd_out, &fput_out);
                         if (out) {
                                 if (out->f_mode & FMODE_WRITE)
-                                        error = do_splice(in, out, len, flags);
+                                        error = do_splice(in, off_in,
+                                                          out, off_out,
+                                                          len, flags);
                                 fput_light(out, fput_out);
                         }
                 }
diff --git a/fs/sync.c b/fs/sync.c
index 8616006d2094..aab5ffe77e9f 100644
--- a/fs/sync.c
+++ b/fs/sync.c
@@ -61,7 +61,7 @@
  * will be available after a crash.
  */
 asmlinkage long sys_sync_file_range(int fd, loff_t offset, loff_t nbytes,
-                                        int flags)
+                                        unsigned int flags)
 {
         int ret;
         struct file *file;
@@ -126,7 +126,7 @@ out:
  * `endbyte' is inclusive
  */
 int do_sync_file_range(struct file *file, loff_t offset, loff_t endbyte,
-                        int flags)
+                        unsigned int flags)
 {
         int ret;
         struct address_space *mapping;
diff --git a/fs/sysfs/dir.c b/fs/sysfs/dir.c
index f26880a4785e..6cfdc9a87772 100644
--- a/fs/sysfs/dir.c
+++ b/fs/sysfs/dir.c
@@ -50,7 +50,7 @@ static struct sysfs_dirent * sysfs_new_dirent(struct sysfs_dirent * parent_sd,
         return sd;
 }
 
-/**
+/*
  *
  * Return -EEXIST if there is already a sysfs element with the same name for
  * the same parent.
diff --git a/fs/sysfs/file.c b/fs/sysfs/file.c
index 830f76fa098c..f1cb1ddde511 100644
--- a/fs/sysfs/file.c
+++ b/fs/sysfs/file.c
@@ -183,7 +183,7 @@ fill_write_buffer(struct sysfs_buffer * buffer, const char __user * buf, size_t
                 return -ENOMEM;
 
         if (count >= PAGE_SIZE)
-                count = PAGE_SIZE;
+                count = PAGE_SIZE - 1;
         error = copy_from_user(buffer->page,buf,count);
         buffer->needs_read_fill = 1;
         return error ? -EFAULT : count;
diff --git a/fs/sysfs/inode.c b/fs/sysfs/inode.c
index 4c29ac41ac3e..f0b347bd12ca 100644
--- a/fs/sysfs/inode.c
+++ b/fs/sysfs/inode.c
@@ -175,8 +175,7 @@ const unsigned char * sysfs_get_name(struct sysfs_dirent *sd)
         struct bin_attribute * bin_attr;
         struct sysfs_symlink  * sl;
 
-        if (!sd || !sd->s_element)
-                BUG();
+        BUG_ON(!sd || !sd->s_element);
 
         switch (sd->s_type) {
                 case SYSFS_DIR:
diff --git a/fs/sysv/dir.c b/fs/sysv/dir.c
index 8c66e9270dd6..d7074341ee87 100644
--- a/fs/sysv/dir.c
+++ b/fs/sysv/dir.c
@@ -253,8 +253,7 @@ int sysv_delete_entry(struct sysv_dir_entry *de, struct page *page)
 
         lock_page(page);
         err = mapping->a_ops->prepare_write(NULL, page, from, to);
-        if (err)
-                BUG();
+        BUG_ON(err);
         de->inode = 0;
         err = dir_commit_chunk(page, from, to);
         dir_put_page(page);
@@ -353,8 +352,7 @@ void sysv_set_link(struct sysv_dir_entry *de, struct page *page,
 
         lock_page(page);
         err = page->mapping->a_ops->prepare_write(NULL, page, from, to);
-        if (err)
-                BUG();
+        BUG_ON(err);
         de->inode = cpu_to_fs16(SYSV_SB(inode->i_sb), inode->i_ino);
         err = dir_commit_chunk(page, from, to);
         dir_put_page(page);
diff --git a/fs/udf/inode.c b/fs/udf/inode.c
index 81e0e8459af1..2983afd5e7fd 100644
--- a/fs/udf/inode.c
+++ b/fs/udf/inode.c
@@ -312,12 +312,10 @@ static int udf_get_block(struct inode *inode, sector_t block, struct buffer_head
         err = 0;
 
         bh = inode_getblk(inode, block, &err, &phys, &new);
-        if (bh)
-                BUG();
+        BUG_ON(bh);
         if (err)
                 goto abort;
-        if (!phys)
-                BUG();
+        BUG_ON(!phys);
 
         if (new)
                 set_buffer_new(bh_result);
diff --git a/fs/xfs/linux-2.6/xfs_aops.c b/fs/xfs/linux-2.6/xfs_aops.c
index 6cbbd165c60d..4d191ef39b67 100644
--- a/fs/xfs/linux-2.6/xfs_aops.c
+++ b/fs/xfs/linux-2.6/xfs_aops.c
@@ -870,12 +870,14 @@ xfs_page_state_convert(
         pgoff_t                 end_index, last_index, tlast;
         ssize_t                 size, len;
         int                     flags, err, iomap_valid = 0, uptodate = 1;
-        int                     page_dirty, count = 0, trylock_flag = 0;
+        int                     page_dirty, count = 0;
+        int                     trylock = 0;
         int                     all_bh = unmapped;
 
-        /* wait for other IO threads? */
-        if (startio && (wbc->sync_mode == WB_SYNC_NONE && wbc->nonblocking))
-                trylock_flag |= BMAPI_TRYLOCK;
+        if (startio) {
+                if (wbc->sync_mode == WB_SYNC_NONE && wbc->nonblocking)
+                        trylock |= BMAPI_TRYLOCK;
+        }
 
         /* Is this page beyond the end of the file? */
         offset = i_size_read(inode);
@@ -956,15 +958,13 @@ xfs_page_state_convert(
 
                         if (buffer_unwritten(bh)) {
                                 type = IOMAP_UNWRITTEN;
-                                flags = BMAPI_WRITE|BMAPI_IGNSTATE;
+                                flags = BMAPI_WRITE | BMAPI_IGNSTATE;
                         } else if (buffer_delay(bh)) {
                                 type = IOMAP_DELAY;
-                                flags = BMAPI_ALLOCATE;
-                                if (!startio)
-                                        flags |= trylock_flag;
+                                flags = BMAPI_ALLOCATE | trylock;
                         } else {
                                 type = IOMAP_NEW;
-                                flags = BMAPI_WRITE|BMAPI_MMAP;
+                                flags = BMAPI_WRITE | BMAPI_MMAP;
                         }
 
                         if (!iomap_valid) {
diff --git a/fs/xfs/linux-2.6/xfs_buf.c b/fs/xfs/linux-2.6/xfs_buf.c
index 9fb0312665ca..26fed0756f01 100644
--- a/fs/xfs/linux-2.6/xfs_buf.c
+++ b/fs/xfs/linux-2.6/xfs_buf.c
@@ -182,7 +182,7 @@ free_address(
 {
         a_list_t        *aentry;
 
-        aentry = kmalloc(sizeof(a_list_t), GFP_ATOMIC & ~__GFP_HIGH);
+        aentry = kmalloc(sizeof(a_list_t), GFP_NOWAIT);
         if (likely(aentry)) {
                 spin_lock(&as_lock);
                 aentry->next = as_free_head;
diff --git a/fs/xfs/linux-2.6/xfs_file.c b/fs/xfs/linux-2.6/xfs_file.c
index 85997b1205f5..269721af02f3 100644
--- a/fs/xfs/linux-2.6/xfs_file.c
+++ b/fs/xfs/linux-2.6/xfs_file.c
@@ -69,7 +69,6 @@ __xfs_file_read(
         return rval;
 }
 
-
 STATIC ssize_t
 xfs_file_aio_read(
         struct kiocb            *iocb,
@@ -90,7 +89,6 @@ xfs_file_aio_read_invis(
         return __xfs_file_read(iocb, buf, IO_ISAIO|IO_INVIS, count, pos);
 }
 
-
 STATIC inline ssize_t
 __xfs_file_write(
         struct kiocb    *iocb,
@@ -113,7 +111,6 @@ __xfs_file_write(
         return rval;
 }
 
-
 STATIC ssize_t
 xfs_file_aio_write(
         struct kiocb            *iocb,
@@ -134,7 +131,6 @@ xfs_file_aio_write_invis(
         return __xfs_file_write(iocb, buf, IO_ISAIO|IO_INVIS, count, pos);
 }
 
-
 STATIC inline ssize_t
 __xfs_file_readv(
         struct file             *file,
@@ -179,7 +175,6 @@ xfs_file_readv_invis(
         return __xfs_file_readv(file, iov, IO_INVIS, nr_segs, ppos);
 }
 
-
 STATIC inline ssize_t
 __xfs_file_writev(
         struct file             *file,
@@ -204,7 +199,6 @@ __xfs_file_writev(
         return rval;
 }
 
-
 STATIC ssize_t
 xfs_file_writev(
         struct file             *file,
@@ -228,7 +222,7 @@ xfs_file_writev_invis(
 STATIC ssize_t
 xfs_file_sendfile(
         struct file             *filp,
-        loff_t                  *ppos,
+        loff_t                  *pos,
         size_t                  count,
         read_actor_t            actor,
         void                    *target)
@@ -236,10 +230,80 @@ xfs_file_sendfile(
         vnode_t                 *vp = vn_from_inode(filp->f_dentry->d_inode);
         ssize_t                 rval;
 
-        VOP_SENDFILE(vp, filp, ppos, 0, count, actor, target, NULL, rval);
+        VOP_SENDFILE(vp, filp, pos, 0, count, actor, target, NULL, rval);
         return rval;
 }
 
+STATIC ssize_t
+xfs_file_sendfile_invis(
+        struct file             *filp,
+        loff_t                  *pos,
+        size_t                  count,
+        read_actor_t            actor,
+        void                    *target)
+{
+        vnode_t                 *vp = vn_from_inode(filp->f_dentry->d_inode);
+        ssize_t                 rval;
+
+        VOP_SENDFILE(vp, filp, pos, IO_INVIS, count, actor, target, NULL, rval);
+        return rval;
+}
+
+STATIC ssize_t
+xfs_file_splice_read(
+        struct file             *infilp,
+        struct pipe_inode_info  *pipe,
+        size_t                  len,
+        unsigned int            flags)
+{
+        vnode_t                 *vp = vn_from_inode(infilp->f_dentry->d_inode);
+        ssize_t                 rval;
+
+        VOP_SPLICE_READ(vp, infilp, pipe, len, flags, 0, NULL, rval);
+        return rval;
+}
+
+STATIC ssize_t
+xfs_file_splice_read_invis(
+        struct file             *infilp,
+        struct pipe_inode_info  *pipe,
+        size_t                  len,
+        unsigned int            flags)
+{
+        vnode_t                 *vp = vn_from_inode(infilp->f_dentry->d_inode);
+        ssize_t                 rval;
+
+        VOP_SPLICE_READ(vp, infilp, pipe, len, flags, IO_INVIS, NULL, rval);
+        return rval;
+}
+
+STATIC ssize_t
+xfs_file_splice_write(
+        struct pipe_inode_info  *pipe,
+        struct file             *outfilp,
+        size_t                  len,
+        unsigned int            flags)
+{
+        vnode_t                 *vp = vn_from_inode(outfilp->f_dentry->d_inode);
+        ssize_t                 rval;
+
+        VOP_SPLICE_WRITE(vp, pipe, outfilp, len, flags, 0, NULL, rval);
+        return rval;
+}
+
+STATIC ssize_t
+xfs_file_splice_write_invis(
+        struct pipe_inode_info  *pipe,
+        struct file             *outfilp,
+        size_t                  len,
+        unsigned int            flags)
+{
+        vnode_t                 *vp = vn_from_inode(outfilp->f_dentry->d_inode);
+        ssize_t                 rval;
+
+        VOP_SPLICE_WRITE(vp, pipe, outfilp, len, flags, IO_INVIS, NULL, rval);
+        return rval;
+}
 
 STATIC int
 xfs_file_open(
@@ -251,13 +315,10 @@ xfs_file_open(
 
         if (!(filp->f_flags & O_LARGEFILE) && i_size_read(inode) > MAX_NON_LFS)
                 return -EFBIG;
-
-        ASSERT(vp);
         VOP_OPEN(vp, NULL, error);
         return -error;
 }
 
-
 STATIC int
 xfs_file_release(
         struct inode    *inode,
@@ -271,7 +332,6 @@ xfs_file_release(
         return -error;
 }
 
-
 STATIC int
 xfs_file_fsync(
         struct file     *filp,
@@ -285,21 +345,11 @@ xfs_file_fsync(
 
         if (datasync)
                 flags |= FSYNC_DATA;
-
-        ASSERT(vp);
         VOP_FSYNC(vp, flags, NULL, (xfs_off_t)0, (xfs_off_t)-1, error);
         return -error;
 }
 
-/*
- * xfs_file_readdir maps to VOP_READDIR().
- * We need to build a uio, cred, ...
- */
-
-#define nextdp(dp)      ((struct xfs_dirent *)((char *)(dp) + (dp)->d_reclen))
-
 #ifdef CONFIG_XFS_DMAPI
-
 STATIC struct page *
 xfs_vm_nopage(
         struct vm_area_struct   *area,
@@ -319,10 +369,8 @@ xfs_vm_nopage(
 
         return filemap_nopage(area, address, type);
 }
-
 #endif /* CONFIG_XFS_DMAPI */
 
-
 STATIC int
 xfs_file_readdir(
         struct file     *filp,
@@ -330,7 +378,7 @@ xfs_file_readdir(
         filldir_t       filldir)
 {
         int             error = 0;
-        vnode_t         *vp;
+        vnode_t         *vp = vn_from_inode(filp->f_dentry->d_inode);
         uio_t           uio;
         iovec_t         iov;
         int             eof = 0;
@@ -340,9 +388,6 @@ xfs_file_readdir(
         xfs_off_t       start_offset, curr_offset;
         xfs_dirent_t    *dbp = NULL;
 
-        vp = vn_from_inode(filp->f_dentry->d_inode);
-        ASSERT(vp);
-
         /* Try fairly hard to get memory */
         do {
                 if ((read_buf = (caddr_t)kmalloc(rlen, GFP_KERNEL)))
@@ -387,7 +432,7 @@ xfs_file_readdir(
                         }
                         size -= dbp->d_reclen;
                         curr_offset = (loff_t)dbp->d_off /* & 0x7fffffff */;
-                        dbp = nextdp(dbp);
+                        dbp = (xfs_dirent_t *)((char *)dbp + dbp->d_reclen);
                 }
         }
 done:
@@ -402,7 +447,6 @@ done:
         return -error;
 }
 
-
 STATIC int
 xfs_file_mmap(
         struct file     *filp,
@@ -457,11 +501,10 @@ xfs_file_ioctl_invis(
         unsigned int    cmd,
         unsigned long   arg)
 {
-        int             error;
         struct inode    *inode = filp->f_dentry->d_inode;
         vnode_t         *vp = vn_from_inode(inode);
+        int             error;
 
-        ASSERT(vp);
         VOP_IOCTL(vp, inode, filp, IO_INVIS, cmd, (void __user *)arg, error);
         VMODIFY(vp);
 
@@ -537,6 +580,8 @@ const struct file_operations xfs_file_operations = {
         .aio_read       = xfs_file_aio_read,
         .aio_write      = xfs_file_aio_write,
         .sendfile       = xfs_file_sendfile,
+        .splice_read    = xfs_file_splice_read,
+        .splice_write   = xfs_file_splice_write,
         .unlocked_ioctl = xfs_file_ioctl,
 #ifdef CONFIG_COMPAT
         .compat_ioctl   = xfs_file_compat_ioctl,
@@ -558,7 +603,9 @@ const struct file_operations xfs_invis_file_operations = {
         .writev         = xfs_file_writev_invis,
         .aio_read       = xfs_file_aio_read_invis,
         .aio_write      = xfs_file_aio_write_invis,
-        .sendfile       = xfs_file_sendfile,
+        .sendfile       = xfs_file_sendfile_invis,
+        .splice_read    = xfs_file_splice_read_invis,
+        .splice_write   = xfs_file_splice_write_invis,
         .unlocked_ioctl = xfs_file_ioctl_invis,
 #ifdef CONFIG_COMPAT
         .compat_ioctl   = xfs_file_compat_invis_ioctl,
diff --git a/fs/xfs/linux-2.6/xfs_iops.c b/fs/xfs/linux-2.6/xfs_iops.c
index 149237304fb6..2e2e275c786f 100644
--- a/fs/xfs/linux-2.6/xfs_iops.c
+++ b/fs/xfs/linux-2.6/xfs_iops.c
@@ -673,8 +673,7 @@ xfs_vn_setattr(
         if (ia_valid & ATTR_ATIME) {
                 vattr.va_mask |= XFS_AT_ATIME;
                 vattr.va_atime = attr->ia_atime;
-                if (ia_valid & ATTR_ATIME_SET)
-                        inode->i_atime = attr->ia_atime;
+                inode->i_atime = attr->ia_atime;
         }
         if (ia_valid & ATTR_MTIME) {
                 vattr.va_mask |= XFS_AT_MTIME;
diff --git a/fs/xfs/linux-2.6/xfs_linux.h b/fs/xfs/linux-2.6/xfs_linux.h
index 1fe09f2d6519..e9fe43d74768 100644
--- a/fs/xfs/linux-2.6/xfs_linux.h
+++ b/fs/xfs/linux-2.6/xfs_linux.h
@@ -103,6 +103,7 @@
  */
 #undef  HAVE_REFCACHE   /* reference cache not needed for NFS in 2.6 */
 #define HAVE_SENDFILE   /* sendfile(2) exists in 2.6, but not in 2.4 */
+#define HAVE_SPLICE     /* a splice(2) exists in 2.6, but not in 2.4 */
 #ifdef CONFIG_SMP
 #define HAVE_PERCPU_SB  /* per cpu superblock counters are a 2.6 feature */
 #else
diff --git a/fs/xfs/linux-2.6/xfs_lrw.c b/fs/xfs/linux-2.6/xfs_lrw.c
index 84ddf1893894..74a52937f208 100644
--- a/fs/xfs/linux-2.6/xfs_lrw.c
+++ b/fs/xfs/linux-2.6/xfs_lrw.c
@@ -301,36 +301,23 @@ xfs_sendfile(
         void                    *target,
         cred_t                  *credp)
 {
+        xfs_inode_t             *ip = XFS_BHVTOI(bdp);
+        xfs_mount_t             *mp = ip->i_mount;
         ssize_t                 ret;
-        xfs_fsize_t             n;
-        xfs_inode_t             *ip;
-        xfs_mount_t             *mp;
-        vnode_t                 *vp;
-
-        ip = XFS_BHVTOI(bdp);
-        vp = BHV_TO_VNODE(bdp);
-        mp = ip->i_mount;
 
         XFS_STATS_INC(xs_read_calls);
-
-        n = XFS_MAXIOFFSET(mp) - *offset;
-        if ((n <= 0) || (count == 0))
-                return 0;
-
-        if (n < count)
-                count = n;
-
-        if (XFS_FORCED_SHUTDOWN(ip->i_mount))
+        if (XFS_FORCED_SHUTDOWN(mp))
                 return -EIO;
 
         xfs_ilock(ip, XFS_IOLOCK_SHARED);
 
-        if (DM_EVENT_ENABLED(vp->v_vfsp, ip, DM_EVENT_READ) &&
+        if (DM_EVENT_ENABLED(BHV_TO_VNODE(bdp)->v_vfsp, ip, DM_EVENT_READ) &&
             (!(ioflags & IO_INVIS))) {
                 vrwlock_t locktype = VRWLOCK_READ;
                 int error;
 
-                error = XFS_SEND_DATA(mp, DM_EVENT_READ, BHV_TO_VNODE(bdp), *offset, count,
+                error = XFS_SEND_DATA(mp, DM_EVENT_READ, BHV_TO_VNODE(bdp),
+                                      *offset, count,
                                       FILP_DELAY_FLAG(filp), &locktype);
                 if (error) {
                         xfs_iunlock(ip, XFS_IOLOCK_SHARED);
@@ -340,12 +327,96 @@ xfs_sendfile(
         xfs_rw_enter_trace(XFS_SENDFILE_ENTER, &ip->i_iocore,
                    (void *)(unsigned long)target, count, *offset, ioflags);
         ret = generic_file_sendfile(filp, offset, count, actor, target);
+        if (ret > 0)
+                XFS_STATS_ADD(xs_read_bytes, ret);
 
         xfs_iunlock(ip, XFS_IOLOCK_SHARED);
+        return ret;
+}
 
+ssize_t
+xfs_splice_read(
+        bhv_desc_t              *bdp,
+        struct file             *infilp,
+        struct pipe_inode_info  *pipe,
+        size_t                  count,
+        int                     flags,
+        int                     ioflags,
+        cred_t                  *credp)
+{
+        xfs_inode_t             *ip = XFS_BHVTOI(bdp);
+        xfs_mount_t             *mp = ip->i_mount;
+        ssize_t                 ret;
+
+        XFS_STATS_INC(xs_read_calls);
+        if (XFS_FORCED_SHUTDOWN(ip->i_mount))
+                return -EIO;
+
+        xfs_ilock(ip, XFS_IOLOCK_SHARED);
+
+        if (DM_EVENT_ENABLED(BHV_TO_VNODE(bdp)->v_vfsp, ip, DM_EVENT_READ) &&
+            (!(ioflags & IO_INVIS))) {
+                vrwlock_t locktype = VRWLOCK_READ;
+                int error;
+
+                error = XFS_SEND_DATA(mp, DM_EVENT_READ, BHV_TO_VNODE(bdp),
+                                        infilp->f_pos, count,
+                                        FILP_DELAY_FLAG(infilp), &locktype);
+                if (error) {
+                        xfs_iunlock(ip, XFS_IOLOCK_SHARED);
+                        return -error;
+                }
+        }
+        xfs_rw_enter_trace(XFS_SPLICE_READ_ENTER, &ip->i_iocore,
+                           pipe, count, infilp->f_pos, ioflags);
+        ret = generic_file_splice_read(infilp, pipe, count, flags);
         if (ret > 0)
                 XFS_STATS_ADD(xs_read_bytes, ret);
 
+        xfs_iunlock(ip, XFS_IOLOCK_SHARED);
+        return ret;
+}
+
+ssize_t
+xfs_splice_write(
+        bhv_desc_t              *bdp,
+        struct pipe_inode_info  *pipe,
+        struct file             *outfilp,
+        size_t                  count,
+        int                     flags,
+        int                     ioflags,
+        cred_t                  *credp)
+{
+        xfs_inode_t             *ip = XFS_BHVTOI(bdp);
+        xfs_mount_t             *mp = ip->i_mount;
+        ssize_t                 ret;
+
+        XFS_STATS_INC(xs_write_calls);
+        if (XFS_FORCED_SHUTDOWN(ip->i_mount))
+                return -EIO;
+
+        xfs_ilock(ip, XFS_IOLOCK_EXCL);
+
+        if (DM_EVENT_ENABLED(BHV_TO_VNODE(bdp)->v_vfsp, ip, DM_EVENT_WRITE) &&
+            (!(ioflags & IO_INVIS))) {
+                vrwlock_t locktype = VRWLOCK_WRITE;
+                int error;
+
+                error = XFS_SEND_DATA(mp, DM_EVENT_WRITE, BHV_TO_VNODE(bdp),
+                                        outfilp->f_pos, count,
+                                        FILP_DELAY_FLAG(outfilp), &locktype);
+                if (error) {
+                        xfs_iunlock(ip, XFS_IOLOCK_EXCL);
+                        return -error;
+                }
+        }
+        xfs_rw_enter_trace(XFS_SPLICE_WRITE_ENTER, &ip->i_iocore,
+                           pipe, count, outfilp->f_pos, ioflags);
+        ret = generic_file_splice_write(pipe, outfilp, count, flags);
+        if (ret > 0)
+                XFS_STATS_ADD(xs_write_bytes, ret);
+
+        xfs_iunlock(ip, XFS_IOLOCK_EXCL);
         return ret;
 }
 
@@ -363,7 +434,7 @@ xfs_zero_last_block(
         xfs_fsize_t     end_size)
 {
         xfs_fileoff_t   last_fsb;
-        xfs_mount_t     *mp;
+        xfs_mount_t     *mp = io->io_mount;
         int             nimaps;
         int             zero_offset;
         int             zero_len;
@@ -373,8 +444,6 @@ xfs_zero_last_block(
 
         ASSERT(ismrlocked(io->io_lock, MR_UPDATE) != 0);
 
-        mp = io->io_mount;
-
         zero_offset = XFS_B_FSB_OFFSET(mp, isize);
         if (zero_offset == 0) {
                 /*
@@ -405,10 +474,9 @@ xfs_zero_last_block(
          * don't deadlock when the buffer cache calls back to us.
          */
         XFS_IUNLOCK(mp, io, XFS_ILOCK_EXCL| XFS_EXTSIZE_RD);
-        loff = XFS_FSB_TO_B(mp, last_fsb);
 
+        loff = XFS_FSB_TO_B(mp, last_fsb);
         zero_len = mp->m_sb.sb_blocksize - zero_offset;
-
         error = xfs_iozero(ip, loff + zero_offset, zero_len, end_size);
 
         XFS_ILOCK(mp, io, XFS_ILOCK_EXCL|XFS_EXTSIZE_RD);
@@ -441,7 +509,7 @@ xfs_zero_eof(
         xfs_fileoff_t   zero_count_fsb;
         xfs_fileoff_t   last_fsb;
         xfs_extlen_t    buf_len_fsb;
-        xfs_mount_t     *mp;
+        xfs_mount_t     *mp = io->io_mount;
         int             nimaps;
         int             error = 0;
         xfs_bmbt_irec_t imap;
@@ -450,8 +518,6 @@ xfs_zero_eof(
         ASSERT(ismrlocked(io->io_iolock, MR_UPDATE));
         ASSERT(offset > isize);
 
-        mp = io->io_mount;
-
         /*
          * First handle zeroing the block on which isize resides.
          * We only zero a part of that block so it is handled specially.
diff --git a/fs/xfs/linux-2.6/xfs_lrw.h b/fs/xfs/linux-2.6/xfs_lrw.h
index 38864a88d42d..55c689a86ad2 100644
--- a/fs/xfs/linux-2.6/xfs_lrw.h
+++ b/fs/xfs/linux-2.6/xfs_lrw.h
@@ -60,6 +60,8 @@ struct xfs_iomap;
 #define XFS_IOMAP_ALLOC_ENTER   25
 #define XFS_IOMAP_ALLOC_MAP     26
 #define XFS_IOMAP_UNWRITTEN     27
+#define XFS_SPLICE_READ_ENTER   28
+#define XFS_SPLICE_WRITE_ENTER  29
 extern void xfs_rw_enter_trace(int, struct xfs_iocore *,
                                 void *, size_t, loff_t, int);
 extern void xfs_inval_cached_trace(struct xfs_iocore *,
@@ -78,6 +80,7 @@ extern int xfs_bmap(struct bhv_desc *, xfs_off_t, ssize_t, int,
                         struct xfs_iomap *, int *);
 extern int xfsbdstrat(struct xfs_mount *, struct xfs_buf *);
 extern int xfs_bdstrat_cb(struct xfs_buf *);
+extern int xfs_dev_is_read_only(struct xfs_mount *, char *);
 
 extern int xfs_zero_eof(struct vnode *, struct xfs_iocore *, xfs_off_t,
                                 xfs_fsize_t, xfs_fsize_t);
@@ -90,7 +93,11 @@ extern ssize_t xfs_write(struct bhv_desc *, struct kiocb *,
 extern ssize_t xfs_sendfile(struct bhv_desc *, struct file *,
                                 loff_t *, int, size_t, read_actor_t,
                                 void *, struct cred *);
-
-extern int xfs_dev_is_read_only(struct xfs_mount *, char *);
+extern ssize_t xfs_splice_read(struct bhv_desc *, struct file *,
+                                struct pipe_inode_info *, size_t, int, int,
+                                struct cred *);
+extern ssize_t xfs_splice_write(struct bhv_desc *, struct pipe_inode_info *,
+                                struct file *, size_t, int, int,
+                                struct cred *);
 
 #endif  /* __XFS_LRW_H__ */
diff --git a/fs/xfs/linux-2.6/xfs_super.c b/fs/xfs/linux-2.6/xfs_super.c
index 1884300417e3..68f4793e8a11 100644
--- a/fs/xfs/linux-2.6/xfs_super.c
+++ b/fs/xfs/linux-2.6/xfs_super.c
@@ -67,7 +67,8 @@ mempool_t *xfs_ioend_pool;
 
 STATIC struct xfs_mount_args *
 xfs_args_allocate(
-        struct super_block      *sb)
+        struct super_block      *sb,
+        int                     silent)
 {
         struct xfs_mount_args   *args;
 
@@ -80,8 +81,8 @@ xfs_args_allocate(
                 args->flags |= XFSMNT_DIRSYNC;
         if (sb->s_flags & MS_SYNCHRONOUS)
                 args->flags |= XFSMNT_WSYNC;
-
-        /* Default to 32 bit inodes on Linux all the time */
+        if (silent)
+                args->flags |= XFSMNT_QUIET;
         args->flags |= XFSMNT_32BITINODES;
 
         return args;
@@ -719,7 +720,7 @@ xfs_fs_remount(
         char                    *options)
 {
         vfs_t                   *vfsp = vfs_from_sb(sb);
-        struct xfs_mount_args   *args = xfs_args_allocate(sb);
+        struct xfs_mount_args   *args = xfs_args_allocate(sb, 0);
         int                     error;
 
         VFS_PARSEARGS(vfsp, options, args, 1, error);
@@ -825,7 +826,7 @@ xfs_fs_fill_super(
 {
         vnode_t                 *rootvp;
         struct vfs              *vfsp = vfs_allocate(sb);
-        struct xfs_mount_args   *args = xfs_args_allocate(sb);
+        struct xfs_mount_args   *args = xfs_args_allocate(sb, silent);
         struct kstatfs          statvfs;
         int                     error, error2;
 
diff --git a/fs/xfs/linux-2.6/xfs_vnode.h b/fs/xfs/linux-2.6/xfs_vnode.h
index 06f5845e9568..88b09f186289 100644
--- a/fs/xfs/linux-2.6/xfs_vnode.h
+++ b/fs/xfs/linux-2.6/xfs_vnode.h
@@ -173,6 +173,12 @@ typedef ssize_t (*vop_write_t)(bhv_desc_t *, struct kiocb *,
 typedef ssize_t (*vop_sendfile_t)(bhv_desc_t *, struct file *,
                                 loff_t *, int, size_t, read_actor_t,
                                 void *, struct cred *);
+typedef ssize_t (*vop_splice_read_t)(bhv_desc_t *, struct file *,
+                                struct pipe_inode_info *, size_t, int, int,
+                                struct cred *);
+typedef ssize_t (*vop_splice_write_t)(bhv_desc_t *, struct pipe_inode_info *,
+                                struct file *, size_t, int, int,
+                                struct cred *);
 typedef int     (*vop_ioctl_t)(bhv_desc_t *, struct inode *, struct file *,
                                 int, unsigned int, void __user *);
 typedef int     (*vop_getattr_t)(bhv_desc_t *, struct vattr *, int,
@@ -231,6 +237,8 @@ typedef struct vnodeops {
         vop_read_t              vop_read;
         vop_write_t             vop_write;
         vop_sendfile_t          vop_sendfile;
+        vop_splice_read_t       vop_splice_read;
+        vop_splice_write_t      vop_splice_write;
         vop_ioctl_t             vop_ioctl;
         vop_getattr_t           vop_getattr;
         vop_setattr_t           vop_setattr;
@@ -276,6 +284,10 @@ typedef struct vnodeops {
         rv = _VOP_(vop_write, vp)((vp)->v_fbhv,file,iov,segs,offset,ioflags,cr)
 #define VOP_SENDFILE(vp,f,off,ioflags,cnt,act,targ,cr,rv)               \
         rv = _VOP_(vop_sendfile, vp)((vp)->v_fbhv,f,off,ioflags,cnt,act,targ,cr)
+#define VOP_SPLICE_READ(vp,f,pipe,cnt,fl,iofl,cr,rv)                    \
+        rv = _VOP_(vop_splice_read, vp)((vp)->v_fbhv,f,pipe,cnt,fl,iofl,cr)
+#define VOP_SPLICE_WRITE(vp,f,pipe,cnt,fl,iofl,cr,rv)                   \
+        rv = _VOP_(vop_splice_write, vp)((vp)->v_fbhv,f,pipe,cnt,fl,iofl,cr)
 #define VOP_BMAP(vp,of,sz,rw,b,n,rv)                                    \
         rv = _VOP_(vop_bmap, vp)((vp)->v_fbhv,of,sz,rw,b,n)
 #define VOP_OPEN(vp, cr, rv)                                            \
diff --git a/fs/xfs/quota/xfs_qm.c b/fs/xfs/quota/xfs_qm.c
index 73c1e5e80c07..7fb5eca9bd50 100644
--- a/fs/xfs/quota/xfs_qm.c
+++ b/fs/xfs/quota/xfs_qm.c
@@ -2624,7 +2624,7 @@ xfs_qm_vop_chown_reserve(
 {
         int             error;
         xfs_mount_t     *mp;
-        uint            delblks, blkflags;
+        uint            delblks, blkflags, prjflags = 0;
         xfs_dquot_t     *unresudq, *unresgdq, *delblksudq, *delblksgdq;
 
         ASSERT(XFS_ISLOCKED_INODE(ip));
@@ -2650,10 +2650,13 @@ xfs_qm_vop_chown_reserve(
                 }
         }
         if (XFS_IS_OQUOTA_ON(ip->i_mount) && gdqp) {
-                if ((XFS_IS_GQUOTA_ON(ip->i_mount) &&
-                     ip->i_d.di_gid != be32_to_cpu(gdqp->q_core.d_id)) ||
-                    (XFS_IS_PQUOTA_ON(ip->i_mount) &&
-                     ip->i_d.di_projid != be32_to_cpu(gdqp->q_core.d_id))) {
+                if (XFS_IS_PQUOTA_ON(ip->i_mount) &&
+                     ip->i_d.di_projid != be32_to_cpu(gdqp->q_core.d_id))
+                        prjflags = XFS_QMOPT_ENOSPC;
+
+                if (prjflags ||
+                    (XFS_IS_GQUOTA_ON(ip->i_mount) &&
+                     ip->i_d.di_gid != be32_to_cpu(gdqp->q_core.d_id))) {
                         delblksgdq = gdqp;
                         if (delblks) {
                                 ASSERT(ip->i_gdquot);
@@ -2664,7 +2667,7 @@ xfs_qm_vop_chown_reserve(
 
         if ((error = xfs_trans_reserve_quota_bydquots(tp, ip->i_mount,
                                 delblksudq, delblksgdq, ip->i_d.di_nblocks, 1,
-                                flags | blkflags)))
+                                flags | blkflags | prjflags)))
                 return (error);
 
         /*
@@ -2681,7 +2684,7 @@ xfs_qm_vop_chown_reserve(
                 ASSERT(unresudq || unresgdq);
                 if ((error = xfs_trans_reserve_quota_bydquots(NULL, ip->i_mount,
                                 delblksudq, delblksgdq, (xfs_qcnt_t)delblks, 0,
-                                flags | blkflags)))
+                                flags | blkflags | prjflags)))
                         return (error);
                 xfs_trans_reserve_quota_bydquots(NULL, ip->i_mount,
                                 unresudq, unresgdq, -((xfs_qcnt_t)delblks), 0,
diff --git a/fs/xfs/quota/xfs_trans_dquot.c b/fs/xfs/quota/xfs_trans_dquot.c
index d8e131ec0aa8..9168918db252 100644
--- a/fs/xfs/quota/xfs_trans_dquot.c
+++ b/fs/xfs/quota/xfs_trans_dquot.c
@@ -595,12 +595,19 @@ xfs_trans_unreserve_and_mod_dquots(
         }
 }
 
+STATIC int
+xfs_quota_error(uint flags)
+{
+        if (flags & XFS_QMOPT_ENOSPC)
+                return ENOSPC;
+        return EDQUOT;
+}
+
 /*
  * This reserves disk blocks and inodes against a dquot.
  * Flags indicate if the dquot is to be locked here and also
  * if the blk reservation is for RT or regular blocks.
  * Sending in XFS_QMOPT_FORCE_RES flag skips the quota check.
- * Returns EDQUOT if quota is exceeded.
  */
 STATIC int
 xfs_trans_dqresv(
@@ -666,19 +673,15 @@ xfs_trans_dqresv(
                          */
                         if (hardlimit > 0ULL &&
                              (hardlimit <= nblks + *resbcountp)) {
-                                error = EDQUOT;
+                                error = xfs_quota_error(flags);
                                 goto error_return;
                         }
 
                         if (softlimit > 0ULL &&
                              (softlimit <= nblks + *resbcountp)) {
-                                /*
-                                 * If timer or warnings has expired,
-                                 * return EDQUOT
-                                 */
                                 if ((timer != 0 && get_seconds() > timer) ||
                                     (warns != 0 && warns >= warnlimit)) {
-                                        error = EDQUOT;
+                                        error = xfs_quota_error(flags);
                                         goto error_return;
                                 }
                         }
@@ -695,16 +698,12 @@ xfs_trans_dqresv(
                         if (!softlimit)
                                 softlimit = q->qi_isoftlimit;
                         if (hardlimit > 0ULL && count >= hardlimit) {
-                                error = EDQUOT;
+                                error = xfs_quota_error(flags);
                                 goto error_return;
                         } else if (softlimit > 0ULL && count >= softlimit) {
-                                /*
-                                 * If timer or warnings has expired,
-                                 * return EDQUOT
-                                 */
                                 if ((timer != 0 && get_seconds() > timer) ||
                                      (warns != 0 && warns >= warnlimit)) {
-                                        error = EDQUOT;
+                                        error = xfs_quota_error(flags);
                                         goto error_return;
                                 }
                         }
@@ -751,13 +750,14 @@ error_return:
 
 
 /*
- * Given a dquot(s), make disk block and/or inode reservations against them.
+ * Given dquot(s), make disk block and/or inode reservations against them.
  * The fact that this does the reservation against both the usr and
- * grp quotas is important, because this follows a both-or-nothing
+ * grp/prj quotas is important, because this follows a both-or-nothing
  * approach.
  *
  * flags = XFS_QMOPT_DQLOCK indicate if dquot(s) need to be locked.
  *         XFS_QMOPT_FORCE_RES evades limit enforcement. Used by chown.
+ *         XFS_QMOPT_ENOSPC returns ENOSPC not EDQUOT.  Used by pquota.
  *         XFS_TRANS_DQ_RES_BLKS reserves regular disk blocks
  *         XFS_TRANS_DQ_RES_RTBLKS reserves realtime disk blocks
  * dquots are unlocked on return, if they were not locked by caller.
@@ -772,25 +772,27 @@ xfs_trans_reserve_quota_bydquots(
         long            ninos,
         uint            flags)
 {
-        int             resvd;
+        int             resvd = 0, error;
 
-        if (! XFS_IS_QUOTA_ON(mp))
-                return (0);
+        if (!XFS_IS_QUOTA_ON(mp))
+                return 0;
 
         if (tp && tp->t_dqinfo == NULL)
                 xfs_trans_alloc_dqinfo(tp);
 
         ASSERT(flags & XFS_QMOPT_RESBLK_MASK);
-        resvd = 0;
 
         if (udqp) {
-                if (xfs_trans_dqresv(tp, mp, udqp, nblks, ninos, flags))
-                        return (EDQUOT);
+                error = xfs_trans_dqresv(tp, mp, udqp, nblks, ninos,
+                                        (flags & ~XFS_QMOPT_ENOSPC));
+                if (error)
+                        return error;
                 resvd = 1;
         }
 
         if (gdqp) {
-                if (xfs_trans_dqresv(tp, mp, gdqp, nblks, ninos, flags)) {
+                error = xfs_trans_dqresv(tp, mp, gdqp, nblks, ninos, flags);
+                if (error) {
                         /*
                          * can't do it, so backout previous reservation
                          */
@@ -799,14 +801,14 @@ xfs_trans_reserve_quota_bydquots(
                                 xfs_trans_dqresv(tp, mp, udqp,
                                                  -nblks, -ninos, flags);
                         }
-                        return (EDQUOT);
+                        return error;
                 }
         }
 
         /*
          * Didn't change anything critical, so, no need to log
          */
-        return (0);
+        return 0;
 }
 
 
@@ -814,8 +816,6 @@ xfs_trans_reserve_quota_bydquots(
  * Lock the dquot and change the reservation if we can.
  * This doesn't change the actual usage, just the reservation.
  * The inode sent in is locked.
- *
- * Returns 0 on success, EDQUOT or other errors otherwise
  */
 STATIC int
 xfs_trans_reserve_quota_nblks(
@@ -824,20 +824,24 @@ xfs_trans_reserve_quota_nblks(
         xfs_inode_t     *ip,
         long            nblks,
         long            ninos,
-        uint            type)
+        uint            flags)
 {
         int             error;
 
         if (!XFS_IS_QUOTA_ON(mp))
-                return (0);
+                return 0;
+        if (XFS_IS_PQUOTA_ON(mp))
+                flags |= XFS_QMOPT_ENOSPC;
 
         ASSERT(ip->i_ino != mp->m_sb.sb_uquotino);
         ASSERT(ip->i_ino != mp->m_sb.sb_gquotino);
 
         ASSERT(XFS_ISLOCKED_INODE_EXCL(ip));
         ASSERT(XFS_IS_QUOTA_RUNNING(ip->i_mount));
-        ASSERT((type & ~XFS_QMOPT_FORCE_RES) == XFS_TRANS_DQ_RES_RTBLKS ||
-               (type & ~XFS_QMOPT_FORCE_RES) == XFS_TRANS_DQ_RES_BLKS);
+        ASSERT((flags & ~(XFS_QMOPT_FORCE_RES | XFS_QMOPT_ENOSPC)) ==
+                                XFS_TRANS_DQ_RES_RTBLKS ||
+               (flags & ~(XFS_QMOPT_FORCE_RES | XFS_QMOPT_ENOSPC)) ==
+                                XFS_TRANS_DQ_RES_BLKS);
 
         /*
          * Reserve nblks against these dquots, with trans as the mediator.
@@ -845,8 +849,8 @@ xfs_trans_reserve_quota_nblks(
         error = xfs_trans_reserve_quota_bydquots(tp, mp,
                                                  ip->i_udquot, ip->i_gdquot,
                                                  nblks, ninos,
-                                                 type);
-        return (error);
+                                                 flags);
+        return error;
 }
 
 /*
diff --git a/fs/xfs/xfs_bmap.c b/fs/xfs/xfs_bmap.c
index d384e489705f..26939d364bc4 100644
--- a/fs/xfs/xfs_bmap.c
+++ b/fs/xfs/xfs_bmap.c
@@ -4719,18 +4719,17 @@ xfs_bmapi(
                                 /*
                                  * Make a transaction-less quota reservation for
                                  * delayed allocation blocks. This number gets
-                                 * adjusted later.
-                                 * We return EDQUOT if we haven't allocated
-                                 * blks already inside this loop;
+                                 * adjusted later.  We return if we haven't
+                                 * allocated blocks already inside this loop.
                                  */
-                                if (XFS_TRANS_RESERVE_QUOTA_NBLKS(
+                                if ((error = XFS_TRANS_RESERVE_QUOTA_NBLKS(
                                                 mp, NULL, ip, (long)alen, 0,
                                                 rt ? XFS_QMOPT_RES_RTBLKS :
-                                                     XFS_QMOPT_RES_REGBLKS)) {
+                                                     XFS_QMOPT_RES_REGBLKS))) {
                                         if (n == 0) {
                                                 *nmap = 0;
                                                 ASSERT(cur == NULL);
-                                                return XFS_ERROR(EDQUOT);
+                                                return error;
                                         }
                                         break;
                                 }
diff --git a/fs/xfs/xfs_bmap.h b/fs/xfs/xfs_bmap.h
index f83399c89ce3..8e0d73d9ccc4 100644
--- a/fs/xfs/xfs_bmap.h
+++ b/fs/xfs/xfs_bmap.h
@@ -353,10 +353,11 @@ xfs_check_nostate_extents(
         xfs_extnum_t            num);
 
 /*
- * Call xfs_bmap_do_search_extents() to search for the extent
- * record containing block bno. If in multi-level in-core extent
- * allocation mode, find and extract the target extent buffer,
- * otherwise just use the direct extent list.
+ * Search the extent records for the entry containing block bno.
+ * If bno lies in a hole, point to the next entry.  If bno lies
+ * past eof, *eofp will be set, and *prevp will contain the last
+ * entry (null if none).  Else, *lastxp will be set to the index
+ * of the found entry; *gotp will contain the entry.
  */
 xfs_bmbt_rec_t *
 xfs_bmap_search_multi_extents(struct xfs_ifork *, xfs_fileoff_t, int *,
diff --git a/fs/xfs/xfs_clnt.h b/fs/xfs/xfs_clnt.h
index 022fff62085b..5b7eb81453be 100644
--- a/fs/xfs/xfs_clnt.h
+++ b/fs/xfs/xfs_clnt.h
@@ -68,6 +68,7 @@ struct xfs_mount_args {
                                                  * enforcement */
 #define XFSMNT_PQUOTAENF        0x00000040      /* IRIX project quota limit
                                                  * enforcement */
+#define XFSMNT_QUIET            0x00000080      /* don't report mount errors */
 #define XFSMNT_NOALIGN          0x00000200      /* don't allocate at
                                                  * stripe boundaries*/
 #define XFSMNT_RETERR           0x00000400      /* return error to user */
diff --git a/fs/xfs/xfs_error.h b/fs/xfs/xfs_error.h
index 26b8e709a569..bc43163456ef 100644
--- a/fs/xfs/xfs_error.h
+++ b/fs/xfs/xfs_error.h
@@ -186,4 +186,7 @@ extern void xfs_fs_cmn_err(int level, struct xfs_mount *mp, char *fmt, ...);
 #define xfs_fs_repair_cmn_err(level, mp, fmt, args...) \
         xfs_fs_cmn_err(level, mp, fmt "  Unmount and run xfs_repair.", ## args)
 
+#define xfs_fs_mount_cmn_err(f, fmt, args...) \
+        ((f & XFS_MFSI_QUIET)? cmn_err(CE_WARN, "XFS: " fmt, ## args) : (void)0)
+
 #endif  /* __XFS_ERROR_H__ */
diff --git a/fs/xfs/xfs_ialloc.c b/fs/xfs/xfs_ialloc.c
index 4eeb856183b1..deddbd03c166 100644
--- a/fs/xfs/xfs_ialloc.c
+++ b/fs/xfs/xfs_ialloc.c
@@ -158,9 +158,10 @@ xfs_ialloc_ag_alloc(
          */
         agi = XFS_BUF_TO_AGI(agbp);
         newino = be32_to_cpu(agi->agi_newino);
-        if(likely(newino != NULLAGINO)) {
-                args.agbno = XFS_AGINO_TO_AGBNO(args.mp, newino) +
-                                XFS_IALLOC_BLOCKS(args.mp);
+        args.agbno = XFS_AGINO_TO_AGBNO(args.mp, newino) +
+                        XFS_IALLOC_BLOCKS(args.mp);
+        if (likely(newino != NULLAGINO &&
+                  (args.agbno < be32_to_cpu(agi->agi_length)))) {
                 args.fsbno = XFS_AGB_TO_FSB(args.mp,
                                 be32_to_cpu(agi->agi_seqno), args.agbno);
                 args.type = XFS_ALLOCTYPE_THIS_BNO;
@@ -182,8 +183,8 @@ xfs_ialloc_ag_alloc(
                  * Set the alignment for the allocation.
                  * If stripe alignment is turned on then align at stripe unit
                  * boundary.
-                 * If the cluster size is smaller than a filesystem block 
-                 * then we're doing I/O for inodes in filesystem block size 
+                 * If the cluster size is smaller than a filesystem block
+                 * then we're doing I/O for inodes in filesystem block size
                  * pieces, so don't need alignment anyway.
                  */
                 isaligned = 0;
@@ -192,7 +193,7 @@ xfs_ialloc_ag_alloc(
                         args.alignment = args.mp->m_dalign;
                         isaligned = 1;
                 } else if (XFS_SB_VERSION_HASALIGN(&args.mp->m_sb) &&
-                           args.mp->m_sb.sb_inoalignmt >= 
+                           args.mp->m_sb.sb_inoalignmt >=
                            XFS_B_TO_FSBT(args.mp,
                                 XFS_INODE_CLUSTER_SIZE(args.mp)))
                                 args.alignment = args.mp->m_sb.sb_inoalignmt;
@@ -220,7 +221,7 @@ xfs_ialloc_ag_alloc(
                 if ((error = xfs_alloc_vextent(&args)))
                         return error;
         }
- 
+
         /*
          * If stripe alignment is turned on, then try again with cluster
          * alignment.
diff --git a/fs/xfs/xfs_iget.c b/fs/xfs/xfs_iget.c
index bb33113eef9f..b53854325266 100644
--- a/fs/xfs/xfs_iget.c
+++ b/fs/xfs/xfs_iget.c
@@ -421,7 +421,10 @@ finish_inode:
                         ip->i_chash = chlnew;
                         chlnew->chl_ip = ip;
                         chlnew->chl_blkno = ip->i_blkno;
+                        if (ch->ch_list)
+                                ch->ch_list->chl_prev = chlnew;
                         chlnew->chl_next = ch->ch_list;
+                        chlnew->chl_prev = NULL;
                         ch->ch_list = chlnew;
                         chlnew = NULL;
                 }
@@ -723,23 +726,15 @@ xfs_iextract(
                 ASSERT(ip->i_cnext == ip && ip->i_cprev == ip);
                 ASSERT(ip->i_chash != NULL);
                 chm=NULL;
-                for (chl = ch->ch_list; chl != NULL; chl = chl->chl_next) {
-                        if (chl->chl_blkno == ip->i_blkno) {
-                                if (chm == NULL) {
-                                        /* first item on the list */
-                                        ch->ch_list = chl->chl_next;
-                                } else {
-                                        chm->chl_next = chl->chl_next;
-                                }
-                                kmem_zone_free(xfs_chashlist_zone, chl);
-                                break;
-                        } else {
-                                ASSERT(chl->chl_ip != ip);
-                                chm = chl;
-                        }
-                }
-                ASSERT_ALWAYS(chl != NULL);
-       } else {
+                chl = ip->i_chash;
+                if (chl->chl_prev)
+                        chl->chl_prev->chl_next = chl->chl_next;
+                else
+                        ch->ch_list = chl->chl_next;
+                if (chl->chl_next)
+                        chl->chl_next->chl_prev = chl->chl_prev;
+                kmem_zone_free(xfs_chashlist_zone, chl);
+        } else {
                 /* delete one inode from a non-empty list */
                 iq = ip->i_cnext;
                 iq->i_cprev = ip->i_cprev;
diff --git a/fs/xfs/xfs_inode.c b/fs/xfs/xfs_inode.c
index 48146bdc6bdd..94b60dd03801 100644
--- a/fs/xfs/xfs_inode.c
+++ b/fs/xfs/xfs_inode.c
@@ -2732,16 +2732,29 @@ xfs_iunpin(
         ASSERT(atomic_read(&ip->i_pincount) > 0);
 
         if (atomic_dec_and_test(&ip->i_pincount)) {
-                vnode_t *vp = XFS_ITOV_NULL(ip);
+                /*
+                 * If the inode is currently being reclaimed, the
+                 * linux inode _and_ the xfs vnode may have been
+                 * freed so we cannot reference either of them safely.
+                 * Hence we should not try to do anything to them
+                 * if the xfs inode is currently in the reclaim
+                 * path.
+                 *
+                 * However, we still need to issue the unpin wakeup
+                 * call as the inode reclaim may be blocked waiting for
+                 * the inode to become unpinned.
+                 */
+                if (!(ip->i_flags & (XFS_IRECLAIM|XFS_IRECLAIMABLE))) {
+                        vnode_t *vp = XFS_ITOV_NULL(ip);
 
-                /* make sync come back and flush this inode */
-                if (vp) {
-                        struct inode    *inode = vn_to_inode(vp);
+                        /* make sync come back and flush this inode */
+                        if (vp) {
+                                struct inode    *inode = vn_to_inode(vp);
 
-                        if (!(inode->i_state & I_NEW))
-                                mark_inode_dirty_sync(inode);
+                                if (!(inode->i_state & I_NEW))
+                                        mark_inode_dirty_sync(inode);
+                        }
                 }
-
                 wake_up(&ip->i_ipin_wait);
         }
 }
diff --git a/fs/xfs/xfs_inode.h b/fs/xfs/xfs_inode.h
index 39ef9c36ea55..3b544db1790b 100644
--- a/fs/xfs/xfs_inode.h
+++ b/fs/xfs/xfs_inode.h
@@ -189,6 +189,7 @@ typedef struct xfs_ihash {
  */
 typedef struct xfs_chashlist {
         struct xfs_chashlist    *chl_next;
+        struct xfs_chashlist    *chl_prev;
         struct xfs_inode        *chl_ip;
         xfs_daddr_t             chl_blkno;      /* starting block number of
                                                  * the cluster */
diff --git a/fs/xfs/xfs_mount.c b/fs/xfs/xfs_mount.c
index 72e7e78bfff8..c0b1c2906880 100644
--- a/fs/xfs/xfs_mount.c
+++ b/fs/xfs/xfs_mount.c
@@ -213,7 +213,8 @@ xfs_mount_free(
 STATIC int
 xfs_mount_validate_sb(
         xfs_mount_t     *mp,
-        xfs_sb_t        *sbp)
+        xfs_sb_t        *sbp,
+        int             flags)
 {
         /*
          * If the log device and data device have the
@@ -223,33 +224,29 @@ xfs_mount_validate_sb(
          * a volume filesystem in a non-volume manner.
          */
         if (sbp->sb_magicnum != XFS_SB_MAGIC) {
-                cmn_err(CE_WARN, "XFS: bad magic number");
+                xfs_fs_mount_cmn_err(flags, "bad magic number");
                 return XFS_ERROR(EWRONGFS);
         }
 
         if (!XFS_SB_GOOD_VERSION(sbp)) {
-                cmn_err(CE_WARN, "XFS: bad version");
+                xfs_fs_mount_cmn_err(flags, "bad version");
                 return XFS_ERROR(EWRONGFS);
         }
 
         if (unlikely(
             sbp->sb_logstart == 0 && mp->m_logdev_targp == mp->m_ddev_targp)) {
-                cmn_err(CE_WARN,
-        "XFS: filesystem is marked as having an external log; "
-        "specify logdev on the\nmount command line.");
-                XFS_CORRUPTION_ERROR("xfs_mount_validate_sb(1)",
-                                     XFS_ERRLEVEL_HIGH, mp, sbp);
-                return XFS_ERROR(EFSCORRUPTED);
+                xfs_fs_mount_cmn_err(flags,
+                        "filesystem is marked as having an external log; "
+                        "specify logdev on the\nmount command line.");
+                return XFS_ERROR(EINVAL);
         }
 
         if (unlikely(
             sbp->sb_logstart != 0 && mp->m_logdev_targp != mp->m_ddev_targp)) {
-                cmn_err(CE_WARN,
-        "XFS: filesystem is marked as having an internal log; "
-        "don't specify logdev on\nthe mount command line.");
-                XFS_CORRUPTION_ERROR("xfs_mount_validate_sb(2)",
-                                     XFS_ERRLEVEL_HIGH, mp, sbp);
-                return XFS_ERROR(EFSCORRUPTED);
+                xfs_fs_mount_cmn_err(flags,
+                        "filesystem is marked as having an internal log; "
+                        "do not specify logdev on\nthe mount command line.");
+                return XFS_ERROR(EINVAL);
         }
 
         /*
@@ -273,10 +270,8 @@ xfs_mount_validate_sb(
             (sbp->sb_blocklog - sbp->sb_inodelog != sbp->sb_inopblog)   ||
             (sbp->sb_rextsize * sbp->sb_blocksize > XFS_MAX_RTEXTSIZE)  ||
             (sbp->sb_rextsize * sbp->sb_blocksize < XFS_MIN_RTEXTSIZE)  ||
-            (sbp->sb_imax_pct > 100 || sbp->sb_imax_pct < 1))) {
-                cmn_err(CE_WARN, "XFS: SB sanity check 1 failed");
-                XFS_CORRUPTION_ERROR("xfs_mount_validate_sb(3)",
-                                     XFS_ERRLEVEL_LOW, mp, sbp);
+            (sbp->sb_imax_pct > 100 /* zero sb_imax_pct is valid */))) {
+                xfs_fs_mount_cmn_err(flags, "SB sanity check 1 failed");
                 return XFS_ERROR(EFSCORRUPTED);
         }
 
@@ -289,9 +284,7 @@ xfs_mount_validate_sb(
              (xfs_drfsbno_t)sbp->sb_agcount * sbp->sb_agblocks ||
             sbp->sb_dblocks < (xfs_drfsbno_t)(sbp->sb_agcount - 1) *
                               sbp->sb_agblocks + XFS_MIN_AG_BLOCKS)) {
-                cmn_err(CE_WARN, "XFS: SB sanity check 2 failed");
-                XFS_ERROR_REPORT("xfs_mount_validate_sb(4)",
-                                 XFS_ERRLEVEL_LOW, mp);
+                xfs_fs_mount_cmn_err(flags, "SB sanity check 2 failed");
                 return XFS_ERROR(EFSCORRUPTED);
         }
 
@@ -307,15 +300,13 @@ xfs_mount_validate_sb(
             (sbp->sb_dblocks << (sbp->sb_blocklog - BBSHIFT)) > UINT_MAX ||
             (sbp->sb_rblocks << (sbp->sb_blocklog - BBSHIFT)) > UINT_MAX)) {
 #endif
-                cmn_err(CE_WARN,
-        "XFS: File system is too large to be mounted on this system.");
+                xfs_fs_mount_cmn_err(flags,
+                        "file system too large to be mounted on this system.");
                 return XFS_ERROR(E2BIG);
         }
 
         if (unlikely(sbp->sb_inprogress)) {
-                cmn_err(CE_WARN, "XFS: file system busy");
-                XFS_ERROR_REPORT("xfs_mount_validate_sb(5)",
-                                 XFS_ERRLEVEL_LOW, mp);
+                xfs_fs_mount_cmn_err(flags, "file system busy");
                 return XFS_ERROR(EFSCORRUPTED);
         }
 
@@ -323,8 +314,8 @@ xfs_mount_validate_sb(
          * Version 1 directory format has never worked on Linux.
          */
         if (unlikely(!XFS_SB_VERSION_HASDIRV2(sbp))) {
-                cmn_err(CE_WARN,
-        "XFS: Attempted to mount file system using version 1 directory format");
+                xfs_fs_mount_cmn_err(flags,
+                        "file system using version 1 directory format");
                 return XFS_ERROR(ENOSYS);
         }
 
@@ -332,11 +323,11 @@ xfs_mount_validate_sb(
          * Until this is fixed only page-sized or smaller data blocks work.
          */
         if (unlikely(sbp->sb_blocksize > PAGE_SIZE)) {
-                cmn_err(CE_WARN,
-                "XFS: Attempted to mount file system with blocksize %d bytes",
+                xfs_fs_mount_cmn_err(flags,
+                        "file system with blocksize %d bytes",
                         sbp->sb_blocksize);
-                cmn_err(CE_WARN,
-                "XFS: Only page-sized (%ld) or less blocksizes currently work.",
+                xfs_fs_mount_cmn_err(flags,
+                        "only pagesize (%ld) or less will currently work.",
                         PAGE_SIZE);
                 return XFS_ERROR(ENOSYS);
         }
@@ -484,7 +475,7 @@ xfs_xlatesb(
  * Does the initial read of the superblock.
  */
 int
-xfs_readsb(xfs_mount_t *mp)
+xfs_readsb(xfs_mount_t *mp, int flags)
 {
         unsigned int    sector_size;
         unsigned int    extra_flags;
@@ -506,7 +497,7 @@ xfs_readsb(xfs_mount_t *mp)
         bp = xfs_buf_read_flags(mp->m_ddev_targp, XFS_SB_DADDR,
                                 BTOBB(sector_size), extra_flags);
         if (!bp || XFS_BUF_ISERROR(bp)) {
-                cmn_err(CE_WARN, "XFS: SB read failed");
+                xfs_fs_mount_cmn_err(flags, "SB read failed");
                 error = bp ? XFS_BUF_GETERROR(bp) : ENOMEM;
                 goto fail;
         }
@@ -520,9 +511,9 @@ xfs_readsb(xfs_mount_t *mp)
         sbp = XFS_BUF_TO_SBP(bp);
         xfs_xlatesb(XFS_BUF_PTR(bp), &(mp->m_sb), 1, XFS_SB_ALL_BITS);
 
-        error = xfs_mount_validate_sb(mp, &(mp->m_sb));
+        error = xfs_mount_validate_sb(mp, &(mp->m_sb), flags);
         if (error) {
-                cmn_err(CE_WARN, "XFS: SB validate failed");
+                xfs_fs_mount_cmn_err(flags, "SB validate failed");
                 goto fail;
         }
 
@@ -530,8 +521,8 @@ xfs_readsb(xfs_mount_t *mp)
          * We must be able to do sector-sized and sector-aligned IO.
          */
         if (sector_size > mp->m_sb.sb_sectsize) {
-                cmn_err(CE_WARN,
-                        "XFS: device supports only %u byte sectors (not %u)",
+                xfs_fs_mount_cmn_err(flags,
+                        "device supports only %u byte sectors (not %u)",
                         sector_size, mp->m_sb.sb_sectsize);
                 error = ENOSYS;
                 goto fail;
@@ -548,7 +539,7 @@ xfs_readsb(xfs_mount_t *mp)
                 bp = xfs_buf_read_flags(mp->m_ddev_targp, XFS_SB_DADDR,
                                         BTOBB(sector_size), extra_flags);
                 if (!bp || XFS_BUF_ISERROR(bp)) {
-                        cmn_err(CE_WARN, "XFS: SB re-read failed");
+                        xfs_fs_mount_cmn_err(flags, "SB re-read failed");
                         error = bp ? XFS_BUF_GETERROR(bp) : ENOMEM;
                         goto fail;
                 }
@@ -678,7 +669,7 @@ xfs_mountfs(
         int             error = 0;
 
         if (mp->m_sb_bp == NULL) {
-                if ((error = xfs_readsb(mp))) {
+                if ((error = xfs_readsb(mp, mfsi_flags))) {
                         return error;
                 }
         }
diff --git a/fs/xfs/xfs_mount.h b/fs/xfs/xfs_mount.h
index 66cbee79864e..668ad23fd37c 100644
--- a/fs/xfs/xfs_mount.h
+++ b/fs/xfs/xfs_mount.h
@@ -510,9 +510,12 @@ xfs_preferred_iosize(xfs_mount_t *mp)
  */
 #define XFS_MFSI_SECOND         0x01    /* Secondary mount -- skip stuff */
 #define XFS_MFSI_CLIENT         0x02    /* Is a client -- skip lots of stuff */
+/*      XFS_MFSI_RRINODES       */
 #define XFS_MFSI_NOUNLINK       0x08    /* Skip unlinked inode processing in */
                                         /* log recovery */
 #define XFS_MFSI_NO_QUOTACHECK  0x10    /* Skip quotacheck processing */
+/*      XFS_MFSI_CONVERT_SUNIT  */
+#define XFS_MFSI_QUIET          0x40    /* Be silent if mount errors found */
 
 /*
  * Macros for getting from mount to vfs and back.
@@ -581,7 +584,7 @@ extern int	xfs_mod_incore_sb_unlocked(xfs_mount_t *, xfs_sb_field_t,
 extern int      xfs_mod_incore_sb_batch(xfs_mount_t *, xfs_mod_sb_t *,
                         uint, int);
 extern struct xfs_buf *xfs_getsb(xfs_mount_t *, int);
-extern int      xfs_readsb(xfs_mount_t *mp);
+extern int      xfs_readsb(xfs_mount_t *, int);
 extern void     xfs_freesb(xfs_mount_t *);
 extern void     xfs_do_force_shutdown(bhv_desc_t *, int, char *, int);
 extern int      xfs_syncsub(xfs_mount_t *, int, int, int *);
diff --git a/fs/xfs/xfs_quota.h b/fs/xfs/xfs_quota.h
index 4f6a034de7f7..7fbef974bce6 100644
--- a/fs/xfs/xfs_quota.h
+++ b/fs/xfs/xfs_quota.h
@@ -196,10 +196,11 @@ typedef struct xfs_qoff_logformat {
 #define XFS_QMOPT_QUOTAOFF      0x0000080 /* quotas are being turned off */
 #define XFS_QMOPT_UMOUNTING     0x0000100 /* filesys is being unmounted */
 #define XFS_QMOPT_DOLOG         0x0000200 /* log buf changes (in quotacheck) */
-#define XFS_QMOPT_DOWARN        0x0000400 /* increase warning cnt if necessary */
+#define XFS_QMOPT_DOWARN        0x0000400 /* increase warning cnt if needed */
 #define XFS_QMOPT_ILOCKED       0x0000800 /* inode is already locked (excl) */
-#define XFS_QMOPT_DQREPAIR      0x0001000 /* repair dquot, if damaged. */
+#define XFS_QMOPT_DQREPAIR      0x0001000 /* repair dquot if damaged */
 #define XFS_QMOPT_GQUOTA        0x0002000 /* group dquot requested */
+#define XFS_QMOPT_ENOSPC        0x0004000 /* enospc instead of edquot (prj) */
 
 /*
  * flags to xfs_trans_mod_dquot to indicate which field needs to be
diff --git a/fs/xfs/xfs_vfsops.c b/fs/xfs/xfs_vfsops.c
index 504d2a80747a..f0e09ca14139 100644
--- a/fs/xfs/xfs_vfsops.c
+++ b/fs/xfs/xfs_vfsops.c
@@ -442,6 +442,9 @@ xfs_mount(
         p = vfs_bhv_lookup(vfsp, VFS_POSITION_IO);
         mp->m_io_ops = p ? *(xfs_ioops_t *) vfs_bhv_custom(p) : xfs_iocore_xfs;
 
+        if (args->flags & XFSMNT_QUIET)
+                flags |= XFS_MFSI_QUIET;
+
         /*
          * Open real time and log devices - order is important.
          */
@@ -492,7 +495,7 @@ xfs_mount(
         error = xfs_start_flags(vfsp, args, mp);
         if (error)
                 goto error1;
-        error = xfs_readsb(mp);
+        error = xfs_readsb(mp, flags);
         if (error)
                 goto error1;
         error = xfs_finish_flags(vfsp, args, mp);
@@ -1697,8 +1700,9 @@ xfs_parseargs(
         int                     dsunit, dswidth, vol_dsunit, vol_dswidth;
         int                     iosize;
 
-        args->flags2 |= XFSMNT2_COMPAT_IOSIZE;
         args->flags |= XFSMNT_IDELETE;
+        args->flags |= XFSMNT_BARRIER;
+        args->flags2 |= XFSMNT2_COMPAT_IOSIZE;
 
         if (!options)
                 goto done;
@@ -1947,8 +1951,6 @@ xfs_showargs(
                 seq_printf(m, "," MNTOPT_IKEEP);
         if (!(mp->m_flags & XFS_MOUNT_COMPAT_IOSIZE))
                 seq_printf(m, "," MNTOPT_LARGEIO);
-        if (mp->m_flags & XFS_MOUNT_BARRIER)
-                seq_printf(m, "," MNTOPT_BARRIER);
 
         if (!(vfsp->vfs_flag & VFS_32BITINODES))
                 seq_printf(m, "," MNTOPT_64BITINODE);
diff --git a/fs/xfs/xfs_vnodeops.c b/fs/xfs/xfs_vnodeops.c
index de49601919c1..fa71b305ba5c 100644
--- a/fs/xfs/xfs_vnodeops.c
+++ b/fs/xfs/xfs_vnodeops.c
@@ -4649,6 +4649,10 @@ vnodeops_t xfs_vnodeops = {
 #ifdef HAVE_SENDFILE
         .vop_sendfile           = xfs_sendfile,
 #endif
+#ifdef HAVE_SPLICE
+        .vop_splice_read        = xfs_splice_read,
+        .vop_splice_write       = xfs_splice_write,
+#endif
         .vop_write              = xfs_write,
         .vop_ioctl              = xfs_ioctl,
         .vop_getattr            = xfs_getattr,
diff --git a/include/asm-alpha/numnodes.h b/include/asm-alpha/numnodes.h
deleted file mode 100644
index cd425827e4f3..000000000000
--- a/include/asm-alpha/numnodes.h
+++ /dev/null
@@ -1,7 +0,0 @@
-#ifndef _ASM_MAX_NUMNODES_H
-#define _ASM_MAX_NUMNODES_H
-
-/* Max 128 Nodes - Marvel */
-#define NODES_SHIFT     7
-
-#endif /* _ASM_MAX_NUMNODES_H */
diff --git a/include/asm-arm/arch-at91rm9200/at91rm9200_mci.h b/include/asm-arm/arch-at91rm9200/at91rm9200_mci.h
new file mode 100644
index 000000000000..f28636d61e39
--- /dev/null
+++ b/include/asm-arm/arch-at91rm9200/at91rm9200_mci.h
@@ -0,0 +1,104 @@
+/*
+ * include/asm-arm/arch-at91rm9200/at91rm9200_mci.h
+ *
+ * Copyright (C) 2005 Ivan Kokshaysky
+ * Copyright (C) SAN People
+ *
+ * MultiMedia Card Interface (MCI) registers.
+ * Based on AT91RM9200 datasheet revision E.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ */
+
+#ifndef AT91RM9200_MCI_H
+#define AT91RM9200_MCI_H
+
+#define AT91_MCI_CR             0x00            /* Control Register */
+#define         AT91_MCI_MCIEN          (1 <<  0)       /* Multi-Media Interface Enable */
+#define         AT91_MCI_MCIDIS         (1 <<  1)       /* Multi-Media Interface Disable */
+#define         AT91_MCI_PWSEN          (1 <<  2)       /* Power Save Mode Enable */
+#define         AT91_MCI_PWSDIS         (1 <<  3)       /* Power Save Mode Disable */
+#define         AT91_MCI_SWRST          (1 <<  7)       /* Software Reset */
+
+#define AT91_MCI_MR             0x04            /* Mode Register */
+#define         AT91_MCI_CLKDIV         (0xff  <<  0)   /* Clock Divider */
+#define         AT91_MCI_PWSDIV         (3     <<  8)   /* Power Saving Divider */
+#define         AT91_MCI_PDCPADV        (1     << 14)   /* PDC Padding Value */
+#define         AT91_MCI_PDCMODE        (1     << 15)   /* PDC-orientated Mode */
+#define         AT91_MCI_BLKLEN         (0xfff << 18)   /* Data Block Length */
+
+#define AT91_MCI_DTOR           0x08            /* Data Timeout Register */
+#define         AT91_MCI_DTOCYC         (0xf << 0)      /* Data Timeout Cycle Number */
+#define         AT91_MCI_DTOMUL         (7   << 4)      /* Data Timeout Multiplier */
+#define         AT91_MCI_DTOMUL_1               (0 <<  4)
+#define         AT91_MCI_DTOMUL_16              (1 <<  4)
+#define         AT91_MCI_DTOMUL_128             (2 <<  4)
+#define         AT91_MCI_DTOMUL_256             (3 <<  4)
+#define         AT91_MCI_DTOMUL_1K              (4 <<  4)
+#define         AT91_MCI_DTOMUL_4K              (5 <<  4)
+#define         AT91_MCI_DTOMUL_64K             (6 <<  4)
+#define         AT91_MCI_DTOMUL_1M              (7 <<  4)
+
+#define AT91_MCI_SDCR           0x0c            /* SD Card Register */
+#define         AT91_MCI_SDCSEL         (0xf << 0)      /* SD Card Selector */
+#define         AT91_MCI_SDCBUS         (1   << 7)      /* 1-bit or 4-bit bus */
+
+#define AT91_MCI_ARGR           0x10            /* Argument Register */
+
+#define AT91_MCI_CMDR           0x14            /* Command Register */
+#define         AT91_MCI_CMDNB          (0x3f << 0)     /* Command Number */
+#define         AT91_MCI_RSPTYP         (3    << 6)     /* Response Type */
+#define                 AT91_MCI_RSPTYP_NONE    (0 <<  6)
+#define                 AT91_MCI_RSPTYP_48      (1 <<  6)
+#define                 AT91_MCI_RSPTYP_136     (2 <<  6)
+#define         AT91_MCI_SPCMD          (7    << 8)     /* Special Command */
+#define                 AT91_MCI_SPCMD_NONE     (0 <<  8)
+#define                 AT91_MCI_SPCMD_INIT     (1 <<  8)
+#define                 AT91_MCI_SPCMD_SYNC     (2 <<  8)
+#define                 AT91_MCI_SPCMD_ICMD     (4 <<  8)
+#define                 AT91_MCI_SPCMD_IRESP    (5 <<  8)
+#define         AT91_MCI_OPDCMD         (1 << 11)       /* Open Drain Command */
+#define         AT91_MCI_MAXLAT         (1 << 12)       /* Max Latency for Command to Response */
+#define         AT91_MCI_TRCMD          (3 << 16)       /* Transfer Command */
+#define                 AT91_MCI_TRCMD_NONE     (0 << 16)
+#define                 AT91_MCI_TRCMD_START    (1 << 16)
+#define                 AT91_MCI_TRCMD_STOP     (2 << 16)
+#define         AT91_MCI_TRDIR          (1 << 18)       /* Transfer Direction */
+#define         AT91_MCI_TRTYP          (3 << 19)       /* Transfer Type */
+#define                 AT91_MCI_TRTYP_BLOCK    (0 << 19)
+#define                 AT91_MCI_TRTYP_MULTIPLE (1 << 19)
+#define                 AT91_MCI_TRTYP_STREAM   (2 << 19)
+
+#define AT91_MCI_RSPR(n)        (0x20 + ((n) * 4))      /* Response Registers 0-3 */
+#define AT91_MCR_RDR            0x30            /* Receive Data Register */
+#define AT91_MCR_TDR            0x34            /* Transmit Data Register */
+
+#define AT91_MCI_SR             0x40            /* Status Register */
+#define         AT91_MCI_CMDRDY         (1 <<  0)       /* Command Ready */
+#define         AT91_MCI_RXRDY          (1 <<  1)       /* Receiver Ready */
+#define         AT91_MCI_TXRDY          (1 <<  2)       /* Transmit Ready */
+#define         AT91_MCI_BLKE           (1 <<  3)       /* Data Block Ended */
+#define         AT91_MCI_DTIP           (1 <<  4)       /* Data Transfer in Progress */
+#define         AT91_MCI_NOTBUSY        (1 <<  5)       /* Data Not Busy */
+#define         AT91_MCI_ENDRX          (1 <<  6)       /* End of RX Buffer */
+#define         AT91_MCI_ENDTX          (1 <<  7)       /* End fo TX Buffer */
+#define         AT91_MCI_RXBUFF         (1 << 14)       /* RX Buffer Full */
+#define         AT91_MCI_TXBUFE         (1 << 15)       /* TX Buffer Empty */
+#define         AT91_MCI_RINDE          (1 << 16)       /* Response Index Error */
+#define         AT91_MCI_RDIRE          (1 << 17)       /* Response Direction Error */
+#define         AT91_MCI_RCRCE          (1 << 18)       /* Response CRC Error */
+#define         AT91_MCI_RENDE          (1 << 19)       /* Response End Bit Error */
+#define         AT91_MCI_RTOE           (1 << 20)       /* Reponse Time-out Error */
+#define         AT91_MCI_DCRCE          (1 << 21)       /* Data CRC Error */
+#define         AT91_MCI_DTOE           (1 << 22)       /* Data Time-out Error */
+#define         AT91_MCI_OVRE           (1 << 30)       /* Overrun */
+#define         AT91_MCI_UNRE           (1 << 31)       /* Underrun */
+
+#define AT91_MCI_IER            0x44            /* Interrupt Enable Register */
+#define AT91_MCI_IDR            0x48            /* Interrupt Disable Register */
+#define AT91_MCI_IMR            0x4c            /* Interrupt Mask Register */
+
+#endif
diff --git a/include/asm-arm/arch-at91rm9200/board.h b/include/asm-arm/arch-at91rm9200/board.h
index 2e7d1139a799..4fdef13d01d4 100644
--- a/include/asm-arm/arch-at91rm9200/board.h
+++ b/include/asm-arm/arch-at91rm9200/board.h
@@ -38,6 +38,8 @@ extern unsigned long at91_master_clock;
 extern int at91_serial_map[AT91_NR_UART];
 extern int at91_console_port;
 
+#include <linux/mtd/partitions.h>
+
  /* USB Device */
 struct at91_udc_data {
         u8      vbus_pin;               /* high == host powering us */
@@ -77,4 +79,26 @@ struct at91_usbh_data {
 };
 extern void __init at91_add_device_usbh(struct at91_usbh_data *data);
 
+ /* NAND / SmartMedia */
+struct at91_nand_data {
+        u8              enable_pin;     /* chip enable */
+        u8              det_pin;        /* card detect */
+        u8              rdy_pin;        /* ready/busy */
+        u8              ale;            /* address line number connected to ALE */
+        u8              cle;            /* address line number connected to CLE */
+        struct mtd_partition* (*partition_info)(int, int*);
+};
+extern void __init at91_add_device_nand(struct at91_nand_data *data);
+
+ /* I2C*/
+void __init at91_add_device_i2c(void);
+
+ /* RTC */
+void __init at91_add_device_rtc(void);
+
+ /* LEDs */
+extern u8 at91_leds_cpu;
+extern u8 at91_leds_timer;
+extern void __init at91_init_leds(u8 cpu_led, u8 timer_led);
+
 #endif
diff --git a/include/asm-arm/arch-at91rm9200/hardware.h b/include/asm-arm/arch-at91rm9200/hardware.h
index 2646c01f8e97..59e6f44d3a0d 100644
--- a/include/asm-arm/arch-at91rm9200/hardware.h
+++ b/include/asm-arm/arch-at91rm9200/hardware.h
@@ -65,6 +65,9 @@
 /* SmartMedia */
 #define AT91_SMARTMEDIA_BASE    0x40000000      /* NCS3: Smartmedia physical base address */
 
+/* Compact Flash */
+#define AT91_CF_BASE            0x50000000      /* NCS4-NCS6: Compact Flash physical base address */
+
 /* Multi-Master Memory controller */
 #define AT91_UHP_BASE           0x00300000      /* USB Host controller */
 
diff --git a/include/asm-arm/arch-cl7500/hardware.h b/include/asm-arm/arch-cl7500/hardware.h
index 2339b764f69f..1adfd18e6154 100644
--- a/include/asm-arm/arch-cl7500/hardware.h
+++ b/include/asm-arm/arch-cl7500/hardware.h
@@ -53,16 +53,12 @@
 #define SCREEN_END              0xdfc00000
 #define SCREEN_BASE             0xdf800000
 
-#define FLUSH_BASE              0xdf000000
-
 #define VIDC_BASE               (void __iomem *)0xe0400000
 #define IOMD_BASE               IOMEM(0xe0200000)
 #define IOC_BASE                IOMEM(0xe0200000)
 #define FLOPPYDMA_BASE          IOMEM(0xe002a000)
 #define PCIO_BASE               IOMEM(0xe0010000)
 
-#define FLUSH_BASE_PHYS         0x00000000      /* ROM */
-
 #define vidc_writel(val)        __raw_writel(val, VIDC_BASE)
 
 /* in/out bias for the ISA slot region */
diff --git a/include/asm-arm/arch-cl7500/memory.h b/include/asm-arm/arch-cl7500/memory.h
index 34f40a6cec30..3178140e24ca 100644
--- a/include/asm-arm/arch-cl7500/memory.h
+++ b/include/asm-arm/arch-cl7500/memory.h
@@ -26,4 +26,10 @@
 #define __virt_to_bus(x) __virt_to_phys(x)
 #define __bus_to_virt(x) __phys_to_virt(x)
 
+/*
+ * Cache flushing area - ROM
+ */
+#define FLUSH_BASE_PHYS         0x00000000
+#define FLUSH_BASE              0xdf000000
+
 #endif
diff --git a/include/asm-arm/arch-ebsa110/debug-macro.S b/include/asm-arm/arch-ebsa110/debug-macro.S
index f61cadabe0ec..9213bfe4831d 100644
--- a/include/asm-arm/arch-ebsa110/debug-macro.S
+++ b/include/asm-arm/arch-ebsa110/debug-macro.S
@@ -18,4 +18,4 @@
 
 #define UART_SHIFT      2
 #define FLOW_CONTROL
-#include <asm/hardware/debug-8250.h>
+#include <asm/hardware/debug-8250.S>
diff --git a/include/asm-arm/arch-ebsa110/hardware.h b/include/asm-arm/arch-ebsa110/hardware.h
index 4e41c2358f4e..3ce864def41e 100644
--- a/include/asm-arm/arch-ebsa110/hardware.h
+++ b/include/asm-arm/arch-ebsa110/hardware.h
@@ -57,9 +57,6 @@
 /*
  * RAM definitions
  */
-#define FLUSH_BASE_PHYS         0x40000000
-#define FLUSH_BASE              0xdf000000
-
 #define UNCACHEABLE_ADDR        0xff000000      /* IRQ_STAT */
 
 #endif
diff --git a/include/asm-arm/arch-ebsa110/memory.h b/include/asm-arm/arch-ebsa110/memory.h
index 02f144520c10..c7c500e176d0 100644
--- a/include/asm-arm/arch-ebsa110/memory.h
+++ b/include/asm-arm/arch-ebsa110/memory.h
@@ -28,4 +28,10 @@
 #define __virt_to_bus(x)        (x)
 #define __bus_to_virt(x)        (x)
 
+/*
+ * Cache flushing area - SRAM
+ */
+#define FLUSH_BASE_PHYS         0x40000000
+#define FLUSH_BASE              0xdf000000
+
 #endif
diff --git a/include/asm-arm/arch-ebsa110/uncompress.h b/include/asm-arm/arch-ebsa110/uncompress.h
index 66b19c7fd908..ae5b775eb0b7 100644
--- a/include/asm-arm/arch-ebsa110/uncompress.h
+++ b/include/asm-arm/arch-ebsa110/uncompress.h
@@ -10,7 +10,7 @@
 
 #include <linux/serial_reg.h>
 
-#define SERIAL_BASE     ((unsigned char *)0xfe000be0)
+#define SERIAL_BASE     ((unsigned char *)0xf0000be0)
 
 /*
  * This does not append a newline
diff --git a/include/asm-arm/arch-ebsa285/hardware.h b/include/asm-arm/arch-ebsa285/hardware.h
index 2ef2200f108c..ec51fe92483b 100644
--- a/include/asm-arm/arch-ebsa285/hardware.h
+++ b/include/asm-arm/arch-ebsa285/hardware.h
@@ -48,9 +48,6 @@
 #define PCICFG0_SIZE            0x01000000
 #define PCICFG0_BASE            0xfa000000
 
-#define FLUSH_SIZE              0x00100000
-#define FLUSH_BASE              0xf9000000
-
 #define PCIMEM_SIZE             0x01000000
 #define PCIMEM_BASE             0xf0000000
 
@@ -61,9 +58,6 @@
 #define PCIMEM_SIZE             0x80000000
 #define PCIMEM_BASE             0x80000000
 
-#define FLUSH_SIZE              0x00100000
-#define FLUSH_BASE              0x7e000000
-
 #define WFLUSH_SIZE             0x01000000
 #define WFLUSH_BASE             0x7d000000
 
@@ -94,7 +88,6 @@
 #define XBUS_SWITCH_J17_11      ((*XBUS_SWITCH) & (1 << 5))
 #define XBUS_SWITCH_J17_9       ((*XBUS_SWITCH) & (1 << 6))
 
-#define FLUSH_BASE_PHYS         0x50000000
 #define UNCACHEABLE_ADDR        (ARMCSR_BASE + 0x108)
 
 
diff --git a/include/asm-arm/arch-ebsa285/memory.h b/include/asm-arm/arch-ebsa285/memory.h
index 09e335cd687d..99181ffc7e27 100644
--- a/include/asm-arm/arch-ebsa285/memory.h
+++ b/include/asm-arm/arch-ebsa285/memory.h
@@ -49,12 +49,22 @@ extern unsigned long __bus_to_virt(unsigned long);
 #define TASK_SIZE               UL(0xbf000000)
 #define PAGE_OFFSET             UL(0xc0000000)
 
+/*
+ * Cache flushing area.
+ */
+#define FLUSH_BASE              0xf9000000
+
 #elif defined(CONFIG_ARCH_CO285)
 
 /* Task size and page offset at 1.5GB */
 #define TASK_SIZE               UL(0x5f000000)
 #define PAGE_OFFSET             UL(0x60000000)
 
+/*
+ * Cache flushing area.
+ */
+#define FLUSH_BASE              0x7e000000
+
 #else
 
 #error "Undefined footbridge architecture"
@@ -72,4 +82,6 @@ extern unsigned long __bus_to_virt(unsigned long);
  */
 #define TASK_UNMAPPED_BASE ((TASK_SIZE + 0x01000000) / 3)
 
+#define FLUSH_BASE_PHYS         0x50000000
+
 #endif
diff --git a/include/asm-arm/arch-ep93xx/ts72xx.h b/include/asm-arm/arch-ep93xx/ts72xx.h
index 412215e77f44..a94f63ff0535 100644
--- a/include/asm-arm/arch-ep93xx/ts72xx.h
+++ b/include/asm-arm/arch-ep93xx/ts72xx.h
@@ -12,6 +12,8 @@
  * febfc000     [67]0000000     4K      NAND data register
  * febfb000     [67]0400000     4K      NAND control register
  * febfa000     [67]0800000     4K      NAND busy register
+ * febf9000     10800000        4K      TS-5620 RTC index register
+ * febf8000     11700000        4K      TS-5620 RTC data register
  */
 
 #define TS72XX_MODEL_PHYS_BASE          0x22000000
@@ -58,6 +60,15 @@
 #define TS72XX_NAND_BUSY_SIZE           0x00001000
 
 
+#define TS72XX_RTC_INDEX_VIRT_BASE      0xfebf9000
+#define TS72XX_RTC_INDEX_PHYS_BASE      0x10800000
+#define TS72XX_RTC_INDEX_SIZE           0x00001000
+
+#define TS72XX_RTC_DATA_VIRT_BASE       0xfebf8000
+#define TS72XX_RTC_DATA_PHYS_BASE       0x11700000
+#define TS72XX_RTC_DATA_SIZE            0x00001000
+
+
 #ifndef __ASSEMBLY__
 #include <asm/io.h>
 
diff --git a/include/asm-arm/arch-imx/dma.h b/include/asm-arm/arch-imx/dma.h
index b45fa367d71e..621ff2c730f2 100644
--- a/include/asm-arm/arch-imx/dma.h
+++ b/include/asm-arm/arch-imx/dma.h
@@ -17,27 +17,16 @@
  * along with this program; if not, write to the Free Software
  * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
  */
+
 #ifndef __ASM_ARCH_DMA_H
 #define __ASM_ARCH_DMA_H
 
-/*
- * DMA registration
- */
-
 typedef enum {
         DMA_PRIO_HIGH = 0,
-        DMA_PRIO_MEDIUM = 3,
-        DMA_PRIO_LOW = 6
+        DMA_PRIO_MEDIUM = 1,
+        DMA_PRIO_LOW = 2
 } imx_dma_prio;
 
-int imx_request_dma(char *name, imx_dma_prio prio,
-                    void (*irq_handler) (int, void *, struct pt_regs *),
-                    void (*err_handler) (int, void *, struct pt_regs *),
-                    void *data);
-
-void imx_free_dma(int dma_ch);
-
-
 #define DMA_REQ_UART3_T        2
 #define DMA_REQ_UART3_R        3
 #define DMA_REQ_SSI2_T         4
diff --git a/include/asm-arm/arch-imx/imx-dma.h b/include/asm-arm/arch-imx/imx-dma.h
new file mode 100644
index 000000000000..f2063c1d610d
--- /dev/null
+++ b/include/asm-arm/arch-imx/imx-dma.h
@@ -0,0 +1,90 @@
+/*
+ *  linux/include/asm-arm/imxads/dma.h
+ *
+ *  Copyright (C) 1997,1998 Russell King
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+ */
+
+#include <asm/dma.h>
+
+#ifndef __ASM_ARCH_IMX_DMA_H
+#define __ASM_ARCH_IMX_DMA_H
+
+#define IMX_DMA_CHANNELS  11
+
+/*
+ * struct imx_dma_channel - i.MX specific DMA extension
+ * @name: name specified by DMA client
+ * @irq_handler: client callback for end of transfer
+ * @err_handler: client callback for error condition
+ * @data: clients context data for callbacks
+ * @dma_mode: direction of the transfer %DMA_MODE_READ or %DMA_MODE_WRITE
+ * @sg: pointer to the actual read/written chunk for scatter-gather emulation
+ * @sgbc: counter of processed bytes in the actual read/written chunk
+ * @resbytes: total residual number of bytes to transfer
+ *            (it can be lower or same as sum of SG mapped chunk sizes)
+ * @sgcount: number of chunks to be read/written
+ *
+ * Structure is used for IMX DMA processing. It would be probably good
+ * @struct dma_struct in the future for external interfacing and use
+ * @struct imx_dma_channel only as extension to it.
+ */
+
+struct imx_dma_channel {
+        const char *name;
+        void (*irq_handler) (int, void *, struct pt_regs *);
+        void (*err_handler) (int, void *, struct pt_regs *);
+        void *data;
+        dmamode_t  dma_mode;
+        struct scatterlist *sg;
+        unsigned int sgbc;
+        unsigned int sgcount;
+        unsigned int resbytes;
+        int dma_num;
+};
+
+extern struct imx_dma_channel imx_dma_channels[IMX_DMA_CHANNELS];
+
+
+/* The type to distinguish channel numbers parameter from ordinal int type */
+typedef int imx_dmach_t;
+
+int
+imx_dma_setup_single(imx_dmach_t dma_ch, dma_addr_t dma_address,
+                unsigned int dma_length, unsigned int dev_addr, dmamode_t dmamode);
+
+int
+imx_dma_setup_sg(imx_dmach_t dma_ch,
+                 struct scatterlist *sg, unsigned int sgcount, unsigned int dma_length,
+                 unsigned int dev_addr, dmamode_t dmamode);
+
+int
+imx_dma_setup_handlers(imx_dmach_t dma_ch,
+                void (*irq_handler) (int, void *, struct pt_regs *),
+                void (*err_handler) (int, void *, struct pt_regs *), void *data);
+
+void imx_dma_enable(imx_dmach_t dma_ch);
+
+void imx_dma_disable(imx_dmach_t dma_ch);
+
+int imx_dma_request(imx_dmach_t dma_ch, const char *name);
+
+void imx_dma_free(imx_dmach_t dma_ch);
+
+int imx_dma_request_by_prio(imx_dmach_t *pdma_ch, const char *name, imx_dma_prio prio);
+
+
+#endif  /* _ASM_ARCH_IMX_DMA_H */
diff --git a/include/asm-arm/arch-imx/mmc.h b/include/asm-arm/arch-imx/mmc.h
new file mode 100644
index 000000000000..1937151665c7
--- /dev/null
+++ b/include/asm-arm/arch-imx/mmc.h
@@ -0,0 +1,12 @@
+#ifndef ASMARM_ARCH_MMC_H
+#define ASMARM_ARCH_MMC_H
+
+#include <linux/mmc/protocol.h>
+
+struct imxmmc_platform_data {
+        int (*card_present)(void);
+};
+
+extern void imx_set_mmc_info(struct imxmmc_platform_data *info);
+
+#endif
diff --git a/include/asm-arm/arch-ixp23xx/debug-macro.S b/include/asm-arm/arch-ixp23xx/debug-macro.S
index eb99fd69fd24..2b25e640247d 100644
--- a/include/asm-arm/arch-ixp23xx/debug-macro.S
+++ b/include/asm-arm/arch-ixp23xx/debug-macro.S
@@ -17,6 +17,9 @@
                 tst     \rx, #1                         @ mmu enabled?
                 ldreq   \rx, =IXP23XX_PERIPHERAL_PHYS   @ physical
                 ldrne   \rx, =IXP23XX_PERIPHERAL_VIRT   @ virtual
+#ifdef __ARMEB__
+                orr     \rx, \rx, #0x00000003
+#endif
                 .endm
 
 #define UART_SHIFT      2
diff --git a/include/asm-arm/arch-ixp23xx/memory.h b/include/asm-arm/arch-ixp23xx/memory.h
index bebcf0aa0d72..6e19f46d54d1 100644
--- a/include/asm-arm/arch-ixp23xx/memory.h
+++ b/include/asm-arm/arch-ixp23xx/memory.h
@@ -28,6 +28,7 @@
  *              to an address that the kernel can use.
  */
 #ifndef __ASSEMBLY__
+#include <asm/mach-types.h>
 
 #define __virt_to_bus(v)                                                \
         ({ unsigned int ret;                                            \
@@ -40,6 +41,22 @@
         data = *((volatile int *)IXP23XX_PCI_SDRAM_BAR);                \
          __phys_to_virt((((b - (data & 0xfffffff0)) + 0x00000000))); })
 
+/*
+ * Coherency support.  Only supported on A2 CPUs or on A1
+ * systems that have the cache coherency workaround.
+ */
+static inline int __ixp23xx_arch_is_coherent(void)
+{
+        extern unsigned int processor_id;
+
+        if (((processor_id & 15) >= 2) || machine_is_roadrunner())
+                return 1;
+
+        return 0;
+}
+
+#define arch_is_coherent()      __ixp23xx_arch_is_coherent()
+
 #endif
 
 
diff --git a/include/asm-arm/arch-ixp23xx/platform.h b/include/asm-arm/arch-ixp23xx/platform.h
index f85b4685a491..e4d99060a049 100644
--- a/include/asm-arm/arch-ixp23xx/platform.h
+++ b/include/asm-arm/arch-ixp23xx/platform.h
@@ -22,6 +22,7 @@ void ixp23xx_sys_init(void);
 int ixp23xx_pci_setup(int, struct pci_sys_data *);
 void ixp23xx_pci_preinit(void);
 struct pci_bus *ixp23xx_pci_scan_bus(int, struct pci_sys_data*);
+void ixp23xx_pci_slave_init(void);
 
 extern struct sys_timer ixp23xx_timer;
 
diff --git a/include/asm-arm/arch-l7200/hardware.h b/include/asm-arm/arch-l7200/hardware.h
index b755079befab..2ab43f3a4a8d 100644
--- a/include/asm-arm/arch-l7200/hardware.h
+++ b/include/asm-arm/arch-l7200/hardware.h
@@ -52,9 +52,6 @@
 #define ISA_SIZE                0x20000000
 #define ISA_BASE                0xe0000000
 
-#define FLUSH_BASE_PHYS         0x40000000      /* ROM */
-#define FLUSH_BASE              0xdf000000
-
 #define PCIO_BASE               IO_BASE
 
 #endif
diff --git a/include/asm-arm/arch-l7200/memory.h b/include/asm-arm/arch-l7200/memory.h
index 9e50a171f78a..402df637e740 100644
--- a/include/asm-arm/arch-l7200/memory.h
+++ b/include/asm-arm/arch-l7200/memory.h
@@ -20,4 +20,10 @@
 #define __virt_to_bus(x) __virt_to_phys(x)
 #define __bus_to_virt(x) __phys_to_virt(x)
 
+/*
+ * Cache flushing area - ROM
+ */
+#define FLUSH_BASE_PHYS         0x40000000
+#define FLUSH_BASE              0xdf000000
+
 #endif
diff --git a/include/asm-arm/arch-lh7a40x/memory.h b/include/asm-arm/arch-lh7a40x/memory.h
index c92bcb837629..9f1a58cbf407 100644
--- a/include/asm-arm/arch-lh7a40x/memory.h
+++ b/include/asm-arm/arch-lh7a40x/memory.h
@@ -31,8 +31,6 @@
 
 #ifdef CONFIG_DISCONTIGMEM
 
-#define NODES_SHIFT     4       /* Up to 16 nodes */
-
 /*
  * Given a kernel address, find the home node of the underlying memory.
  */
diff --git a/include/asm-arm/arch-omap/aic23.h b/include/asm-arm/arch-omap/aic23.h
index 590bac25b7c4..6513065941d0 100644
--- a/include/asm-arm/arch-omap/aic23.h
+++ b/include/asm-arm/arch-omap/aic23.h
@@ -57,6 +57,7 @@
 #define LHV_MIN                         0x0000
 
 // Analog audio path control register
+#define STA_REG(x)                      ((x)<<6)
 #define STE_ENABLED                     0x0020
 #define DAC_SELECTED                    0x0010
 #define BYPASS_ON                       0x0008
@@ -109,4 +110,7 @@
 #define TLV320AIC23ID1                  (0x1a)  // cs low
 #define TLV320AIC23ID2                  (0x1b)  // cs high
 
+void tlv320aic23_power_up(void);
+void tlv320aic23_power_down(void);
+
 #endif /* __ASM_ARCH_AIC23_H */
diff --git a/include/asm-arm/arch-omap/board-ams-delta.h b/include/asm-arm/arch-omap/board-ams-delta.h
new file mode 100644
index 000000000000..0070f6d3b75c
--- /dev/null
+++ b/include/asm-arm/arch-omap/board-ams-delta.h
@@ -0,0 +1,65 @@
+/*
+ * linux/include/asm-arm/arch-omap/board-ams-delta.h
+ *
+ * Copyright (C) 2006 Jonathan McDowell <noodles@earth.li>
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the
+ * Free Software Foundation; either version 2 of the License, or (at your
+ * option) any later version.
+ *
+ * THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED
+ * WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN
+ * NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF
+ * USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
+ * ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 675 Mass Ave, Cambridge, MA 02139, USA.
+ */
+#ifndef __ASM_ARCH_OMAP_AMS_DELTA_H
+#define __ASM_ARCH_OMAP_AMS_DELTA_H
+
+#if defined (CONFIG_MACH_AMS_DELTA)
+
+#define AMS_DELTA_LATCH1_PHYS           0x01000000
+#define AMS_DELTA_LATCH1_VIRT           0xEA000000
+#define AMS_DELTA_MODEM_PHYS            0x04000000
+#define AMS_DELTA_MODEM_VIRT            0xEB000000
+#define AMS_DELTA_LATCH2_PHYS           0x08000000
+#define AMS_DELTA_LATCH2_VIRT           0xEC000000
+
+#define AMS_DELTA_LATCH1_LED_CAMERA     0x01
+#define AMS_DELTA_LATCH1_LED_ADVERT     0x02
+#define AMS_DELTA_LATCH1_LED_EMAIL      0x04
+#define AMS_DELTA_LATCH1_LED_HANDSFREE  0x08
+#define AMS_DELTA_LATCH1_LED_VOICEMAIL  0x10
+#define AMS_DELTA_LATCH1_LED_VOICE      0x20
+
+#define AMS_DELTA_LATCH2_LCD_VBLEN      0x0001
+#define AMS_DELTA_LATCH2_LCD_NDISP      0x0002
+#define AMS_DELTA_LATCH2_NAND_NCE       0x0004
+#define AMS_DELTA_LATCH2_NAND_NRE       0x0008
+#define AMS_DELTA_LATCH2_NAND_NWP       0x0010
+#define AMS_DELTA_LATCH2_NAND_NWE       0x0020
+#define AMS_DELTA_LATCH2_NAND_ALE       0x0040
+#define AMS_DELTA_LATCH2_NAND_CLE       0x0080
+#define AMS_DELTA_LATCH2_MODEM_NRESET   0x1000
+#define AMS_DELTA_LATCH2_MODEM_CODEC    0x2000
+
+#define AMS_DELTA_GPIO_PIN_NAND_RB      12
+
+#ifndef __ASSEMBLY__
+void ams_delta_latch1_write(u8 mask, u8 value);
+void ams_delta_latch2_write(u16 mask, u16 value);
+#endif
+
+#endif /* CONFIG_MACH_AMS_DELTA */
+
+#endif /* __ASM_ARCH_OMAP_AMS_DELTA_H */
diff --git a/include/asm-arm/arch-omap/board-apollon.h b/include/asm-arm/arch-omap/board-apollon.h
new file mode 100644
index 000000000000..de0c5b792c58
--- /dev/null
+++ b/include/asm-arm/arch-omap/board-apollon.h
@@ -0,0 +1,45 @@
+/*
+ * linux/include/asm-arm/arch-omap/board-apollon.h
+ *
+ * Hardware definitions for Samsung OMAP24XX Apollon board.
+ *
+ * Initial creation by Kyungmin Park <kyungmin.park@samsung.com>
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the
+ * Free Software Foundation; either version 2 of the License, or (at your
+ * option) any later version.
+ *
+ * THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED
+ * WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN
+ * NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF
+ * USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
+ * ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, write to the Free Software Foundation, Inc.,
+ * 675 Mass Ave, Cambridge, MA 02139, USA.
+ */
+
+#ifndef __ASM_ARCH_OMAP_APOLLON_H
+#define __ASM_ARCH_OMAP_APOLLON_H
+
+/* Placeholder for APOLLON specific defines */
+/* GPMC CS0 */
+#define APOLLON_CS0_BASE                0x00000000
+/* GPMC CS1 */
+#define APOLLON_CS1_BASE                0x08000000
+#define APOLLON_ETHR_START              (APOLLON_CS1_BASE + 0x300)
+#define APOLLON_ETHR_GPIO_IRQ           74
+/* GPMC CS2 - reserved for OneNAND */
+#define APOLLON_CS2_BASE                0x10000000
+/* GPMC CS3 - reserved for NOR or NAND */
+#define APOLLON_CS3_BASE                0x18000000
+
+#endif /*  __ASM_ARCH_OMAP_APOLLON_H */
+
diff --git a/include/asm-arm/arch-omap/board-h2.h b/include/asm-arm/arch-omap/board-h2.h
index 39ca5a31aeea..b2888ef9e9b4 100644
--- a/include/asm-arm/arch-omap/board-h2.h
+++ b/include/asm-arm/arch-omap/board-h2.h
@@ -34,9 +34,5 @@
 /* At OMAP1610 Innovator the Ethernet is directly connected to CS1 */
 #define OMAP1610_ETHR_START             0x04000300
 
-/* Samsung NAND flash at CS2B or CS3(NAND Boot) */
-#define OMAP_NAND_FLASH_START1           0x0A000000 /* CS2B */
-#define OMAP_NAND_FLASH_START2           0x0C000000 /* CS3 */
-
 #endif /*  __ASM_ARCH_OMAP_H2_H */
 
diff --git a/include/asm-arm/arch-omap/board-h3.h b/include/asm-arm/arch-omap/board-h3.h
index 1b12c1dcc2fa..761ea0a17897 100644
--- a/include/asm-arm/arch-omap/board-h3.h
+++ b/include/asm-arm/arch-omap/board-h3.h
@@ -30,10 +30,6 @@
 /* In OMAP1710 H3 the Ethernet is directly connected to CS1 */
 #define OMAP1710_ETHR_START             0x04000300
 
-/* Samsung NAND flash at CS2B or CS3(NAND Boot) */
-#define OMAP_NAND_FLASH_START1           0x0A000000 /* CS2B */
-#define OMAP_NAND_FLASH_START2           0x0C000000 /* CS3 */
-
 #define MAXIRQNUM                       (IH_BOARD_BASE)
 #define MAXFIQNUM                       MAXIRQNUM
 #define MAXSWINUM                       MAXIRQNUM
diff --git a/include/asm-arm/arch-omap/board-h4.h b/include/asm-arm/arch-omap/board-h4.h
index 33ea29a41654..7ef664bc9e33 100644
--- a/include/asm-arm/arch-omap/board-h4.h
+++ b/include/asm-arm/arch-omap/board-h4.h
@@ -33,12 +33,6 @@
 /* GPMC CS1 */
 #define OMAP24XX_ETHR_START             0x08000300
 #define OMAP24XX_ETHR_GPIO_IRQ          92
-
-#define H4_CS0_BASE                  0x04000000
-
-#define H4_CS0_BASE                  0x04000000
-
-#define H4_CS0_BASE                  0x04000000
-
+#define H4_CS0_BASE                     0x04000000
 #endif /*  __ASM_ARCH_OMAP_H4_H */
 
diff --git a/include/asm-arm/arch-omap/board-netstar.h b/include/asm-arm/arch-omap/board-netstar.h
deleted file mode 100644
index 77cc0fb54d54..000000000000
--- a/include/asm-arm/arch-omap/board-netstar.h
+++ /dev/null
@@ -1,19 +0,0 @@
-/*
- * Copyright (C) 2004 2N Telekomunikace, Ladislav Michl <michl@2n.cz>
- *
- * Hardware definitions for OMAP5910 based NetStar board.
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 2 as
- * published by the Free Software Foundation.
- */
-
-#ifndef __ASM_ARCH_NETSTAR_H
-#define __ASM_ARCH_NETSTAR_H
-
-#include <asm/arch/tc.h>
-
-#define OMAP_NAND_FLASH_START1          OMAP_CS1_PHYS + (1 << 23)
-#define OMAP_NAND_FLASH_START2          OMAP_CS1_PHYS + (2 << 23)
-
-#endif /*  __ASM_ARCH_NETSTAR_H */
diff --git a/include/asm-arm/arch-omap/board-nokia.h b/include/asm-arm/arch-omap/board-nokia.h
new file mode 100644
index 000000000000..72deea203493
--- /dev/null
+++ b/include/asm-arm/arch-omap/board-nokia.h
@@ -0,0 +1,54 @@
+/*
+ *  linux/include/asm-arm/arch-omap/board-nokia.h
+ *
+ *  Information structures for Nokia-specific board config data
+ *
+ *  Copyright (C) 2005  Nokia Corporation
+ */
+
+#ifndef _OMAP_BOARD_NOKIA_H
+#define _OMAP_BOARD_NOKIA_H
+
+#include <linux/types.h>
+
+#define OMAP_TAG_NOKIA_BT       0x4e01
+#define OMAP_TAG_WLAN_CX3110X   0x4e02
+#define OMAP_TAG_CBUS           0x4e03
+#define OMAP_TAG_EM_ASIC_BB5    0x4e04
+
+
+#define BT_CHIP_CSR             1
+#define BT_CHIP_TI              2
+
+#define BT_SYSCLK_12            1
+#define BT_SYSCLK_38_4          2
+
+struct omap_bluetooth_config {
+        u8    chip_type;
+        u8    bt_wakeup_gpio;
+        u8    host_wakeup_gpio;
+        u8    reset_gpio;
+        u8    bt_uart;
+        u8    bd_addr[6];
+        u8    bt_sysclk;
+};
+
+struct omap_wlan_cx3110x_config {
+        u8  chip_type;
+        s16 power_gpio;
+        s16 irq_gpio;
+        s16 spi_cs_gpio;
+};
+
+struct omap_cbus_config {
+        s16 clk_gpio;
+        s16 dat_gpio;
+        s16 sel_gpio;
+};
+
+struct omap_em_asic_bb5_config {
+        s16 retu_irq_gpio;
+        s16 tahvo_irq_gpio;
+};
+
+#endif
diff --git a/include/asm-arm/arch-omap/board-perseus2.h b/include/asm-arm/arch-omap/board-perseus2.h
index 691e52a52b43..eb74420cb439 100644
--- a/include/asm-arm/arch-omap/board-perseus2.h
+++ b/include/asm-arm/arch-omap/board-perseus2.h
@@ -42,8 +42,4 @@
 
 #define NR_IRQS                 (MAXIRQNUM + 1)
 
-/* Samsung NAND flash at CS2B or CS3(NAND Boot) */
-#define OMAP_NAND_FLASH_START1     0x0A000000 /* CS2B */
-#define OMAP_NAND_FLASH_START2     0x0C000000 /* CS3 */
-
 #endif
diff --git a/include/asm-arm/arch-omap/board.h b/include/asm-arm/arch-omap/board.h
index a0040cd86639..6d6240a4681c 100644
--- a/include/asm-arm/arch-omap/board.h
+++ b/include/asm-arm/arch-omap/board.h
@@ -21,9 +21,12 @@
 #define OMAP_TAG_LCD            0x4f05
 #define OMAP_TAG_GPIO_SWITCH    0x4f06
 #define OMAP_TAG_UART           0x4f07
+#define OMAP_TAG_FBMEM          0x4f08
+#define OMAP_TAG_STI_CONSOLE    0x4f09
 
 #define OMAP_TAG_BOOT_REASON    0x4f80
 #define OMAP_TAG_FLASH_PART     0x4f81
+#define OMAP_TAG_VERSION_STR    0x4f82
 
 struct omap_clock_config {
         /* 0 for 12 MHz, 1 for 13 MHz and 2 for 19.2 MHz */
@@ -54,6 +57,11 @@ struct omap_serial_console_config {
         u32 console_speed;
 };
 
+struct omap_sti_console_config {
+        unsigned enable:1;
+        u8 channel;
+};
+
 struct omap_usb_config {
         /* Configure drivers according to the connectors on your board:
          *  - "A" connector (rectagular)
@@ -87,6 +95,13 @@ struct omap_lcd_config {
         char ctrl_name[16];
 };
 
+struct omap_fbmem_config {
+        u32 fb_sram_start;
+        u32 fb_sram_size;
+        u32 fb_sdram_start;
+        u32 fb_sdram_size;
+};
+
 /* Cover:
  *      high -> closed
  *      low  -> open
@@ -106,6 +121,12 @@ struct omap_gpio_switch_config {
         int key_code:24; /* Linux key code */
 };
 
+struct omap_uart_config {
+        /* Bit field of UARTs present; bit 0 --> UART1 */
+        unsigned int enabled_uarts;
+};
+
+
 struct omap_flash_part_config {
         char part_table[0];
 };
@@ -114,11 +135,14 @@ struct omap_boot_reason_config {
         char reason_str[12];
 };
 
-struct omap_uart_config {
-        /* Bit field of UARTs present; bit 0 --> UART1 */
-        unsigned int enabled_uarts;
+struct omap_version_config {
+        char component[12];
+        char version[12];
 };
 
+
+#include <asm-arm/arch-omap/board-nokia.h>
+
 struct omap_board_config_entry {
         u16 tag;
         u16 len;
diff --git a/include/asm-arm/arch-omap/clock.h b/include/asm-arm/arch-omap/clock.h
index 46a0402696de..3c4eb9fbe48a 100644
--- a/include/asm-arm/arch-omap/clock.h
+++ b/include/asm-arm/arch-omap/clock.h
@@ -19,6 +19,7 @@ struct clk {
         struct list_head        node;
         struct module           *owner;
         const char              *name;
+        int                     id;
         struct clk              *parent;
         unsigned long           rate;
         __u32                   flags;
@@ -57,6 +58,7 @@ extern void propagate_rate(struct clk *clk);
 extern void followparent_recalc(struct clk * clk);
 extern void clk_allow_idle(struct clk *clk);
 extern void clk_deny_idle(struct clk *clk);
+extern int clk_get_usecount(struct clk *clk);
 
 /* Clock flags */
 #define RATE_CKCTL              (1 << 0)        /* Main fixed ratio clocks */
@@ -80,10 +82,11 @@ extern void clk_deny_idle(struct clk *clk);
 #define CM_PLL_SEL1             (1 << 18)
 #define CM_PLL_SEL2             (1 << 19)
 #define CM_SYSCLKOUT_SEL1       (1 << 20)
-#define CLOCK_IN_OMAP730        (1 << 21)
-#define CLOCK_IN_OMAP1510       (1 << 22)
-#define CLOCK_IN_OMAP16XX       (1 << 23)
-#define CLOCK_IN_OMAP242X       (1 << 24)
-#define CLOCK_IN_OMAP243X       (1 << 25)
+#define CLOCK_IN_OMAP310        (1 << 21)
+#define CLOCK_IN_OMAP730        (1 << 22)
+#define CLOCK_IN_OMAP1510       (1 << 23)
+#define CLOCK_IN_OMAP16XX       (1 << 24)
+#define CLOCK_IN_OMAP242X       (1 << 25)
+#define CLOCK_IN_OMAP243X       (1 << 26)
 
 #endif
diff --git a/include/asm-arm/arch-omap/dma.h b/include/asm-arm/arch-omap/dma.h
index d4e73efcb816..ca1202312a45 100644
--- a/include/asm-arm/arch-omap/dma.h
+++ b/include/asm-arm/arch-omap/dma.h
@@ -404,6 +404,7 @@ extern void omap_free_lcd_dma(void);
 extern void omap_setup_lcd_dma(void);
 extern void omap_enable_lcd_dma(void);
 extern void omap_stop_lcd_dma(void);
+extern int  omap_lcd_dma_ext_running(void);
 extern void omap_set_lcd_dma_ext_controller(int external);
 extern void omap_set_lcd_dma_single_transfer(int single);
 extern void omap_set_lcd_dma_b1(unsigned long addr, u16 fb_xres, u16 fb_yres,
diff --git a/include/asm-arm/arch-omap/dmtimer.h b/include/asm-arm/arch-omap/dmtimer.h
index 11772c792f3e..e6522e6a3834 100644
--- a/include/asm-arm/arch-omap/dmtimer.h
+++ b/include/asm-arm/arch-omap/dmtimer.h
@@ -88,5 +88,6 @@ unsigned int omap_dm_timer_read_counter(struct omap_dm_timer *timer);
 void omap_dm_timer_reset_counter(struct omap_dm_timer *timer);
 
 int omap_dm_timers_active(void);
+u32 omap_dm_timer_modify_idlect_mask(u32 inputmask);
 
 #endif /* __ASM_ARCH_TIMER_H */
diff --git a/include/asm-arm/arch-omap/dsp.h b/include/asm-arm/arch-omap/dsp.h
index 57bf4f39ca58..06dad83dd41f 100644
--- a/include/asm-arm/arch-omap/dsp.h
+++ b/include/asm-arm/arch-omap/dsp.h
@@ -181,10 +181,16 @@ struct omap_dsp_varinfo {
 #define OMAP_DSP_MBCMD_PM_ENABLE        0x01
 
 #define OMAP_DSP_MBCMD_KFUNC_FBCTL      0x00
+#define OMAP_DSP_MBCMD_KFUNC_AUDIO_PWR  0x01
 
+#define OMAP_DSP_MBCMD_FBCTL_UPD        0x0000
 #define OMAP_DSP_MBCMD_FBCTL_ENABLE     0x0002
 #define OMAP_DSP_MBCMD_FBCTL_DISABLE    0x0003
 
+#define OMAP_DSP_MBCMD_AUDIO_PWR_UP     0x0000
+#define OMAP_DSP_MBCMD_AUDIO_PWR_DOWN1  0x0001
+#define OMAP_DSP_MBCMD_AUDIO_PWR_DOWN2  0x0002
+
 #define OMAP_DSP_MBCMD_TDEL_SAFE        0x0000
 #define OMAP_DSP_MBCMD_TDEL_KILL        0x0001
 
diff --git a/include/asm-arm/arch-omap/dsp_common.h b/include/asm-arm/arch-omap/dsp_common.h
index 4fcce6944056..16a459dfa714 100644
--- a/include/asm-arm/arch-omap/dsp_common.h
+++ b/include/asm-arm/arch-omap/dsp_common.h
@@ -27,11 +27,12 @@
 #ifndef ASM_ARCH_DSP_COMMON_H
 #define ASM_ARCH_DSP_COMMON_H
 
-void omap_dsp_pm_suspend(void);
-void omap_dsp_pm_resume(void);
-void omap_dsp_request_mpui(void);
-void omap_dsp_release_mpui(void);
-int omap_dsp_request_mem(void);
-int omap_dsp_release_mem(void);
+extern void omap_dsp_request_mpui(void);
+extern void omap_dsp_release_mpui(void);
+extern int omap_dsp_request_mem(void);
+extern int omap_dsp_release_mem(void);
+
+extern void (*omap_dsp_audio_pwr_up_request)(int stage);
+extern void (*omap_dsp_audio_pwr_down_request)(int stage);
 
 #endif /* ASM_ARCH_DSP_COMMON_H */
diff --git a/include/asm-arm/arch-omap/gpioexpander.h b/include/asm-arm/arch-omap/gpioexpander.h
new file mode 100644
index 000000000000..7a43b0a912e4
--- /dev/null
+++ b/include/asm-arm/arch-omap/gpioexpander.h
@@ -0,0 +1,24 @@
+/*
+ * linux/include/asm-arm/arch-omap/gpioexpander.h
+ *
+ *
+ * Copyright (C) 2004 Texas Instruments, Inc.
+ *
+ * This package is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ *
+ * THIS PACKAGE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR
+ * IMPLIED WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED
+ * WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR A PARTICULAR PURPOSE.
+ */
+
+#ifndef __ASM_ARCH_OMAP_GPIOEXPANDER_H
+#define __ASM_ARCH_OMAP_GPIOEXPANDER_H
+
+/* Function Prototypes for GPIO Expander functions */
+
+int read_gpio_expa(u8 *, int);
+int write_gpio_expa(u8 , int);
+
+#endif /* __ASM_ARCH_OMAP_GPIOEXPANDER_H */
diff --git a/include/asm-arm/arch-omap/hardware.h b/include/asm-arm/arch-omap/hardware.h
index 5406b875c422..7909b729826c 100644
--- a/include/asm-arm/arch-omap/hardware.h
+++ b/include/asm-arm/arch-omap/hardware.h
@@ -306,6 +306,10 @@
 #include "board-h4.h"
 #endif
 
+#ifdef CONFIG_MACH_OMAP_APOLLON
+#include "board-apollon.h"
+#endif
+
 #ifdef CONFIG_MACH_OMAP_OSK
 #include "board-osk.h"
 #endif
@@ -314,10 +318,6 @@
 #include "board-voiceblue.h"
 #endif
 
-#ifdef CONFIG_MACH_NETSTAR
-#include "board-netstar.h"
-#endif
-
 #endif /* !__ASSEMBLER__ */
 
 #endif  /* __ASM_ARCH_OMAP_HARDWARE_H */
diff --git a/include/asm-arm/arch-omap/irda.h b/include/asm-arm/arch-omap/irda.h
new file mode 100644
index 000000000000..805ae3575e44
--- /dev/null
+++ b/include/asm-arm/arch-omap/irda.h
@@ -0,0 +1,36 @@
+/*
+ *  linux/include/asm-arm/arch-omap/irda.h
+ *
+ *  Copyright (C) 2005-2006 Komal Shah <komal_shah802003@yahoo.com>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+#ifndef ASMARM_ARCH_IRDA_H
+#define ASMARM_ARCH_IRDA_H
+
+/* board specific transceiver capabilities */
+
+#define IR_SEL          1       /* Selects IrDA */
+#define IR_SIRMODE      2
+#define IR_FIRMODE      4
+#define IR_MIRMODE      8
+
+struct omap_irda_config {
+        int transceiver_cap;
+        int (*transceiver_mode)(struct device *dev, int mode);
+        int (*select_irda)(struct device *dev, int state);
+        /* Very specific to the needs of some platforms (h3,h4)
+         * having calls which can sleep in irda_set_speed.
+         */
+        struct work_struct gpio_expa;
+        int rx_channel;
+        int tx_channel;
+        unsigned long dest_start;
+        unsigned long src_start;
+        int tx_trigger;
+        int rx_trigger;
+};
+
+#endif
diff --git a/include/asm-arm/arch-omap/irqs.h b/include/asm-arm/arch-omap/irqs.h
index 4ffce1d77759..42098d99f302 100644
--- a/include/asm-arm/arch-omap/irqs.h
+++ b/include/asm-arm/arch-omap/irqs.h
@@ -242,6 +242,11 @@
 #define INT_24XX_GPIO_BANK2     30
 #define INT_24XX_GPIO_BANK3     31
 #define INT_24XX_GPIO_BANK4     32
+#define INT_24XX_MCBSP1_IRQ_TX  59
+#define INT_24XX_MCBSP1_IRQ_RX  60
+#define INT_24XX_MCBSP2_IRQ_TX  62
+#define INT_24XX_MCBSP2_IRQ_RX  63
+#define INT_24XX_UART3_IRQ      74
 
 /* Max. 128 level 2 IRQs (OMAP1610), 192 GPIOs (OMAP730) and
  * 16 MPUIO lines */
diff --git a/include/asm-arm/arch-omap/keypad.h b/include/asm-arm/arch-omap/keypad.h
new file mode 100644
index 000000000000..8a023a984acb
--- /dev/null
+++ b/include/asm-arm/arch-omap/keypad.h
@@ -0,0 +1,36 @@
+/*
+ *  linux/include/asm-arm/arch-omap/keypad.h
+ *
+ *  Copyright (C) 2006 Komal Shah <komal_shah802003@yahoo.com>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+#ifndef ASMARM_ARCH_KEYPAD_H
+#define ASMARM_ARCH_KEYPAD_H
+
+struct omap_kp_platform_data {
+        int rows;
+        int cols;
+        int *keymap;
+        unsigned int rep:1;
+        /* specific to OMAP242x*/
+        unsigned int *row_gpios;
+        unsigned int *col_gpios;
+};
+
+/* Group (0..3) -- when multiple keys are pressed, only the
+ * keys pressed in the same group are considered as pressed. This is
+ * in order to workaround certain crappy HW designs that produce ghost
+ * keypresses. */
+#define GROUP_0         (0 << 16)
+#define GROUP_1         (1 << 16)
+#define GROUP_2         (2 << 16)
+#define GROUP_3         (3 << 16)
+#define GROUP_MASK      GROUP_3
+
+#define KEY(col, row, val) (((col) << 28) | ((row) << 24) | (val))
+
+#endif
+
diff --git a/include/asm-arm/arch-omap/lcd_lph8923.h b/include/asm-arm/arch-omap/lcd_lph8923.h
new file mode 100644
index 000000000000..004e67e22ca7
--- /dev/null
+++ b/include/asm-arm/arch-omap/lcd_lph8923.h
@@ -0,0 +1,14 @@
+#ifndef __LCD_LPH8923_H
+#define __LCD_LPH8923_H
+
+enum lcd_lph8923_test_num {
+        LCD_LPH8923_TEST_RGB_LINES,
+};
+
+enum lcd_lph8923_test_result {
+        LCD_LPH8923_TEST_SUCCESS,
+        LCD_LPH8923_TEST_INVALID,
+        LCD_LPH8923_TEST_FAILED,
+};
+
+#endif
diff --git a/include/asm-arm/arch-omap/mcbsp.h b/include/asm-arm/arch-omap/mcbsp.h
index e79d98ab2ab6..ed0dde4f7219 100644
--- a/include/asm-arm/arch-omap/mcbsp.h
+++ b/include/asm-arm/arch-omap/mcbsp.h
@@ -37,6 +37,11 @@
 #define OMAP1610_MCBSP2_BASE    0xfffb1000
 #define OMAP1610_MCBSP3_BASE    0xe1017000
 
+#define OMAP24XX_MCBSP1_BASE    0x48074000
+#define OMAP24XX_MCBSP2_BASE    0x48076000
+
+#if defined(CONFIG_ARCH_OMAP15XX) || defined(CONFIG_ARCH_OMAP16XX) || defined(CONFIG_ARCH_OMAP730)
+
 #define OMAP_MCBSP_REG_DRR2     0x00
 #define OMAP_MCBSP_REG_DRR1     0x02
 #define OMAP_MCBSP_REG_DXR2     0x04
@@ -71,9 +76,62 @@
 
 #define OMAP_MAX_MCBSP_COUNT 3
 
+#define AUDIO_MCBSP_DATAWRITE   (OMAP1510_MCBSP1_BASE + OMAP_MCBSP_REG_DXR1)
+#define AUDIO_MCBSP_DATAREAD    (OMAP1510_MCBSP1_BASE + OMAP_MCBSP_REG_DRR1)
+
+#define AUDIO_MCBSP             OMAP_MCBSP1
+#define AUDIO_DMA_TX            OMAP_DMA_MCBSP1_TX
+#define AUDIO_DMA_RX            OMAP_DMA_MCBSP1_RX
+
+#elif defined(CONFIG_ARCH_OMAP24XX)
+
+#define OMAP_MCBSP_REG_DRR2     0x00
+#define OMAP_MCBSP_REG_DRR1     0x04
+#define OMAP_MCBSP_REG_DXR2     0x08
+#define OMAP_MCBSP_REG_DXR1     0x0C
+#define OMAP_MCBSP_REG_SPCR2    0x10
+#define OMAP_MCBSP_REG_SPCR1    0x14
+#define OMAP_MCBSP_REG_RCR2     0x18
+#define OMAP_MCBSP_REG_RCR1     0x1C
+#define OMAP_MCBSP_REG_XCR2     0x20
+#define OMAP_MCBSP_REG_XCR1     0x24
+#define OMAP_MCBSP_REG_SRGR2    0x28
+#define OMAP_MCBSP_REG_SRGR1    0x2C
+#define OMAP_MCBSP_REG_MCR2     0x30
+#define OMAP_MCBSP_REG_MCR1     0x34
+#define OMAP_MCBSP_REG_RCERA    0x38
+#define OMAP_MCBSP_REG_RCERB    0x3C
+#define OMAP_MCBSP_REG_XCERA    0x40
+#define OMAP_MCBSP_REG_XCERB    0x44
+#define OMAP_MCBSP_REG_PCR0     0x48
+#define OMAP_MCBSP_REG_RCERC    0x4C
+#define OMAP_MCBSP_REG_RCERD    0x50
+#define OMAP_MCBSP_REG_XCERC    0x54
+#define OMAP_MCBSP_REG_XCERD    0x58
+#define OMAP_MCBSP_REG_RCERE    0x5C
+#define OMAP_MCBSP_REG_RCERF    0x60
+#define OMAP_MCBSP_REG_XCERE    0x64
+#define OMAP_MCBSP_REG_XCERF    0x68
+#define OMAP_MCBSP_REG_RCERG    0x6C
+#define OMAP_MCBSP_REG_RCERH    0x70
+#define OMAP_MCBSP_REG_XCERG    0x74
+#define OMAP_MCBSP_REG_XCERH    0x78
+
+#define OMAP_MAX_MCBSP_COUNT 2
+
+#define AUDIO_MCBSP_DATAWRITE   (OMAP24XX_MCBSP2_BASE + OMAP_MCBSP_REG_DXR1)
+#define AUDIO_MCBSP_DATAREAD    (OMAP24XX_MCBSP2_BASE + OMAP_MCBSP_REG_DRR1)
+
+#define AUDIO_MCBSP             OMAP_MCBSP2
+#define AUDIO_DMA_TX            OMAP24XX_DMA_MCBSP2_TX
+#define AUDIO_DMA_RX            OMAP24XX_DMA_MCBSP2_RX
+
+#endif
+
 #define OMAP_MCBSP_READ(base, reg)              __raw_readw((base) + OMAP_MCBSP_REG_##reg)
 #define OMAP_MCBSP_WRITE(base, reg, val)        __raw_writew((val), (base) + OMAP_MCBSP_REG_##reg)
 
+
 /************************** McBSP SPCR1 bit definitions ***********************/
 #define RRST                    0x0001
 #define RRDY                    0x0002
@@ -195,6 +253,10 @@ typedef enum {
         OMAP_MCBSP3,
 } omap_mcbsp_id;
 
+typedef int __bitwise omap_mcbsp_io_type_t;
+#define OMAP_MCBSP_IRQ_IO ((__force omap_mcbsp_io_type_t) 1)
+#define OMAP_MCBSP_POLL_IO ((__force omap_mcbsp_io_type_t) 2)
+
 typedef enum {
         OMAP_MCBSP_WORD_8 = 0,
         OMAP_MCBSP_WORD_12,
@@ -246,6 +308,9 @@ u32 omap_mcbsp_recv_word(unsigned int id);
 
 int omap_mcbsp_xmit_buffer(unsigned int id, dma_addr_t buffer, unsigned int length);
 int omap_mcbsp_recv_buffer(unsigned int id, dma_addr_t buffer, unsigned int length);
+int omap_mcbsp_spi_master_xmit_word_poll(unsigned int id, u32 word);
+int omap_mcbsp_spi_master_recv_word_poll(unsigned int id, u32 * word);
+
 
 /* SPI specific API */
 void omap_mcbsp_set_spi_mode(unsigned int id, const struct omap_mcbsp_spi_cfg * spi_cfg);
diff --git a/include/asm-arm/arch-omap/mcspi.h b/include/asm-arm/arch-omap/mcspi.h
new file mode 100644
index 000000000000..9e7f40a88e1b
--- /dev/null
+++ b/include/asm-arm/arch-omap/mcspi.h
@@ -0,0 +1,16 @@
+#ifndef _OMAP2_MCSPI_H
+#define _OMAP2_MCSPI_H
+
+struct omap2_mcspi_platform_config {
+        unsigned long   base;
+        unsigned short  num_cs;
+};
+
+struct omap2_mcspi_device_config {
+        unsigned turbo_mode:1;
+
+        /* Do we want one channel enabled at the same time? */
+        unsigned single_channel:1;
+};
+
+#endif
diff --git a/include/asm-arm/arch-omap/menelaus.h b/include/asm-arm/arch-omap/menelaus.h
index 46be8b8d6346..88cd4c87f0de 100644
--- a/include/asm-arm/arch-omap/menelaus.h
+++ b/include/asm-arm/arch-omap/menelaus.h
@@ -7,7 +7,7 @@
 #ifndef __ASM_ARCH_MENELAUS_H
 #define __ASM_ARCH_MENELAUS_H
 
-extern void menelaus_mmc_register(void (*callback)(u8 card_mask),
+extern void menelaus_mmc_register(void (*callback)(unsigned long data, u8 card_mask),
                                   unsigned long data);
 extern void menelaus_mmc_remove(void);
 extern void menelaus_mmc_opendrain(int enable);
diff --git a/include/asm-arm/arch-omap/mux.h b/include/asm-arm/arch-omap/mux.h
index 13415a9aab06..0dc24d4ba59c 100644
--- a/include/asm-arm/arch-omap/mux.h
+++ b/include/asm-arm/arch-omap/mux.h
@@ -112,14 +112,13 @@
  *   as mux config
  */
 #define MUX_CFG_730(desc, mux_reg, mode_offset, mode,   \
-                   pull_reg, pull_bit, pull_status,     \
-                   pu_pd_reg, pu_pd_status, debug_status)\
+                   pull_bit, pull_status, debug_status)\
 {                                                       \
         .name =  desc,                                  \
         .debug = debug_status,                          \
         MUX_REG_730(mux_reg, mode_offset, mode)         \
         PULL_REG_730(mux_reg, pull_bit, pull_status)    \
-        PU_PD_REG(pu_pd_reg, pu_pd_status)              \
+        PU_PD_REG(NA, 0)                \
 },
 
 #define MUX_CFG_24XX(desc, reg_offset, mode,                    \
@@ -172,6 +171,11 @@ enum omap730_index {
         E4_730_KBC2,
         F4_730_KBC3,
         E3_730_KBC4,
+
+        /* USB */
+        AA17_730_USB_DM,
+        W16_730_USB_PU_EN,
+        W17_730_USB_VBUSI,
 };
 
 enum omap1xxx_index {
@@ -403,9 +407,53 @@ enum omap24xx_index {
         /* 24xx Menelaus interrupt */
         W19_24XX_SYS_NIRQ,
 
+        /* 24xx clock */
+        W14_24XX_SYS_CLKOUT,
+
+        /* 242X McBSP */
+        Y15_24XX_MCBSP2_CLKX,
+        R14_24XX_MCBSP2_FSX,
+        W15_24XX_MCBSP2_DR,
+        V15_24XX_MCBSP2_DX,
+
         /* 24xx GPIO */
+        M21_242X_GPIO11,
+        AA10_242X_GPIO13,
+        AA6_242X_GPIO14,
+        AA4_242X_GPIO15,
+        Y11_242X_GPIO16,
+        AA12_242X_GPIO17,
+        AA8_242X_GPIO58,
         Y20_24XX_GPIO60,
+        W4__24XX_GPIO74,
         M15_24XX_GPIO92,
+        V14_24XX_GPIO117,
+
+        P20_24XX_TSC_IRQ,
+
+        /* UART3 */
+        K15_24XX_UART3_TX,
+        K14_24XX_UART3_RX,
+
+        /* Keypad GPIO*/
+        T19_24XX_KBR0,
+        R19_24XX_KBR1,
+        V18_24XX_KBR2,
+        M21_24XX_KBR3,
+        E5__24XX_KBR4,
+        M18_24XX_KBR5,
+        R20_24XX_KBC0,
+        M14_24XX_KBC1,
+        H19_24XX_KBC2,
+        V17_24XX_KBC3,
+        P21_24XX_KBC4,
+        L14_24XX_KBC5,
+        N19_24XX_KBC6,
+
+        /* 24xx Menelaus Keypad GPIO */
+        B3__24XX_KBR5,
+        AA4_24XX_KBC2,
+        B13_24XX_KBC6,
 };
 
 #ifdef  CONFIG_OMAP_MUX
diff --git a/include/asm-arm/arch-omap/omap-alsa.h b/include/asm-arm/arch-omap/omap-alsa.h
new file mode 100644
index 000000000000..df4695474e3d
--- /dev/null
+++ b/include/asm-arm/arch-omap/omap-alsa.h
@@ -0,0 +1,124 @@
+/*
+ * linux/include/asm-arm/arch-omap/omap-alsa.h
+ *
+ * Alsa Driver for AIC23 and TSC2101 codecs on OMAP platform boards.
+ *
+ * Copyright (C) 2006 Mika Laitio <lamikr@cc.jyu.fi>
+ *
+ * Copyright (C) 2005 Instituto Nokia de Tecnologia - INdT - Manaus Brazil
+ * Written by Daniel Petrini, David Cohen, Anderson Briglia
+ *            {daniel.petrini, david.cohen, anderson.briglia}@indt.org.br
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the
+ * Free Software Foundation; either version 2 of the License, or (at your
+ * option) any later version.
+ *
+ * THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED
+ * WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN
+ * NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF
+ * USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
+ * ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ *
+ * You should have received a copy of the  GNU General Public License along
+ * with this program; if not, write  to the Free Software Foundation, Inc.,
+ * 675 Mass Ave, Cambridge, MA 02139, USA.
+ *
+ *  History
+ *  -------
+ *
+ *  2005/07/25 INdT-10LE Kernel Team -  Alsa driver for omap osk,
+ *                                      original version based in sa1100 driver
+ *                                      and omap oss driver.
+ */
+
+#ifndef __OMAP_ALSA_H
+#define __OMAP_ALSA_H
+
+#include <sound/driver.h>
+#include <asm/arch/dma.h>
+#include <sound/core.h>
+#include <sound/pcm.h>
+#include <asm/arch/mcbsp.h>
+#include <linux/platform_device.h>
+
+#define DMA_BUF_SIZE    (1024 * 8)
+
+/*
+ * Buffer management for alsa and dma
+ */
+struct audio_stream {
+        char *id;               /* identification string */
+        int stream_id;          /* numeric identification */
+        int dma_dev;            /* dma number of that device */
+        int *lch;               /* Chain of channels this stream is linked to */
+        char started;           /* to store if the chain was started or not */
+        int dma_q_head;         /* DMA Channel Q Head */
+        int dma_q_tail;         /* DMA Channel Q Tail */
+        char dma_q_count;       /* DMA Channel Q Count */
+        int active:1;           /* we are using this stream for transfer now */
+        int period;             /* current transfer period */
+        int periods;            /* current count of periods registerd in the DMA engine */
+        spinlock_t dma_lock;    /* for locking in DMA operations */
+        snd_pcm_substream_t *stream;    /* the pcm stream */
+        unsigned linked:1;      /* dma channels linked */
+        int offset;             /* store start position of the last period in the alsa buffer */
+        int (*hw_start)(void);  /* interface to start HW interface, e.g. McBSP */
+        int (*hw_stop)(void);   /* interface to stop HW interface, e.g. McBSP */
+};
+
+/*
+ * Alsa card structure for aic23
+ */
+struct snd_card_omap_codec {
+        snd_card_t *card;
+        snd_pcm_t *pcm;
+        long samplerate;
+        struct audio_stream s[2];       /* playback & capture */
+};
+
+/* Codec specific information and function pointers.
+ * Codec (omap-alsa-aic23.c and omap-alsa-tsc2101.c)
+ * are responsible for defining the function pointers.
+ */
+struct omap_alsa_codec_config {
+        char    *name;
+        struct  omap_mcbsp_reg_cfg *mcbsp_regs_alsa;
+        snd_pcm_hw_constraint_list_t *hw_constraints_rates;
+        snd_pcm_hardware_t *snd_omap_alsa_playback;
+        snd_pcm_hardware_t *snd_omap_alsa_capture;
+        void    (*codec_configure_dev)(void);
+        void    (*codec_set_samplerate)(long);
+        void    (*codec_clock_setup)(void);
+        int     (*codec_clock_on)(void);
+        int     (*codec_clock_off)(void);
+        int     (*get_default_samplerate)(void);
+};
+
+/*********** Mixer function prototypes *************************/
+int snd_omap_mixer(struct snd_card_omap_codec *);
+void snd_omap_init_mixer(void);
+
+#ifdef CONFIG_PM
+void snd_omap_suspend_mixer(void);
+void snd_omap_resume_mixer(void);
+#endif
+
+int snd_omap_alsa_post_probe(struct platform_device *pdev, struct omap_alsa_codec_config *config);
+int snd_omap_alsa_remove(struct platform_device *pdev);
+#ifdef CONFIG_PM
+int snd_omap_alsa_suspend(struct platform_device *pdev, pm_message_t state);
+int snd_omap_alsa_resume(struct platform_device *pdev);
+#else
+#define snd_omap_alsa_suspend   NULL
+#define snd_omap_alsa_resume    NULL
+#endif
+
+void callback_omap_alsa_sound_dma(void *);
+
+#endif
diff --git a/include/asm-arm/arch-omap/omapfb.h b/include/asm-arm/arch-omap/omapfb.h
index 4ba2622cc142..fccdb3db025f 100644
--- a/include/asm-arm/arch-omap/omapfb.h
+++ b/include/asm-arm/arch-omap/omapfb.h
@@ -34,9 +34,10 @@
 #define OMAPFB_MIRROR           OMAP_IOW(31, int)
 #define OMAPFB_SYNC_GFX         OMAP_IO(37)
 #define OMAPFB_VSYNC            OMAP_IO(38)
-#define OMAPFB_SET_UPDATE_MODE  OMAP_IOW(40, enum omapfb_update_mode)
+#define OMAPFB_SET_UPDATE_MODE  OMAP_IOW(40, int)
+#define OMAPFB_UPDATE_WINDOW_OLD OMAP_IOW(41, struct omapfb_update_window_old)
 #define OMAPFB_GET_CAPS         OMAP_IOR(42, unsigned long)
-#define OMAPFB_GET_UPDATE_MODE  OMAP_IOW(43, enum omapfb_update_mode)
+#define OMAPFB_GET_UPDATE_MODE  OMAP_IOW(43, int)
 #define OMAPFB_LCD_TEST         OMAP_IOW(45, int)
 #define OMAPFB_CTRL_TEST        OMAP_IOW(46, int)
 #define OMAPFB_UPDATE_WINDOW    OMAP_IOW(47, struct omapfb_update_window)
@@ -66,9 +67,14 @@ enum omapfb_color_format {
 };
 
 struct omapfb_update_window {
-        u32 x, y;
-        u32 width, height;
-        u32 format;
+        __u32 x, y;
+        __u32 width, height;
+        __u32 format;
+};
+
+struct omapfb_update_window_old {
+        __u32 x, y;
+        __u32 width, height;
 };
 
 enum omapfb_plane {
@@ -83,17 +89,17 @@ enum omapfb_channel_out {
 };
 
 struct omapfb_setup_plane {
-        u8  plane;
-        u8  channel_out;
-        u32 offset;
-        u32 pos_x, pos_y;
-        u32 width, height;
-        u32 color_mode;
+        __u8  plane;
+        __u8  channel_out;
+        __u32 offset;
+        __u32 pos_x, pos_y;
+        __u32 width, height;
+        __u32 color_mode;
 };
 
 struct omapfb_enable_plane {
-        u8  plane;
-        u8  enable;
+        __u8  plane;
+        __u8  enable;
 };
 
 enum omapfb_color_key_type {
@@ -103,10 +109,10 @@ enum omapfb_color_key_type {
 };
 
 struct omapfb_color_key {
-        u8  channel_out;
-        u32 background;
-        u32 trans_key;
-        u8  key_type;
+        __u8  channel_out;
+        __u32 background;
+        __u32 trans_key;
+        __u8  key_type;
 };
 
 enum omapfb_update_mode {
@@ -120,6 +126,9 @@ enum omapfb_update_mode {
 #include <linux/completion.h>
 #include <linux/interrupt.h>
 #include <linux/fb.h>
+#include <linux/mutex.h>
+
+#include <asm/arch/board.h>
 
 #define OMAP_LCDC_INV_VSYNC             0x0001
 #define OMAP_LCDC_INV_HSYNC             0x0002
@@ -184,19 +193,38 @@ struct extif_timings {
         int re_cycle_time;
         int cs_pulse_width;
         int access_time;
+
+        int clk_div;
+
+        u32 tim[5];             /* set by extif->convert_timings */
+
+        int converted;
 };
 
 struct lcd_ctrl_extif {
         int  (*init)            (void);
         void (*cleanup)         (void);
+        void (*get_clk_info)    (u32 *clk_period, u32 *max_clk_div);
+        int  (*convert_timings) (struct extif_timings *timings);
         void (*set_timings)     (const struct extif_timings *timings);
-        void (*write_command)   (u32 cmd);
-        u32  (*read_data)       (void);
-        void (*write_data)      (u32 data);
+        void (*set_bits_per_cycle)(int bpc);
+        void (*write_command)   (const void *buf, unsigned int len);
+        void (*read_data)       (void *buf, unsigned int len);
+        void (*write_data)      (const void *buf, unsigned int len);
         void (*transfer_area)   (int width, int height,
                                  void (callback)(void * data), void *data);
+        unsigned long           max_transmit_size;
 };
 
+struct omapfb_notifier_block {
+        struct notifier_block   nb;
+        void                    *data;
+};
+
+typedef int (*omapfb_notifier_callback_t)(struct omapfb_notifier_block *,
+                                           unsigned long event,
+                                           struct omapfb_device *fbdev);
+
 struct lcd_ctrl {
         const char      *name;
         void            *data;
@@ -204,9 +232,11 @@ struct lcd_ctrl {
         int             (*init)           (struct omapfb_device *fbdev,
                                            int ext_mode, int req_vram_size);
         void            (*cleanup)        (void);
+        void            (*bind_client)    (struct omapfb_notifier_block *nb);
         void            (*get_vram_layout)(unsigned long *size,
                                            void **virt_base,
                                            dma_addr_t *phys_base);
+        int             (*mmap)           (struct vm_area_struct *vma);
         unsigned long   (*get_caps)       (void);
         int             (*set_update_mode)(enum omapfb_update_mode mode);
         enum omapfb_update_mode (*get_update_mode)(void);
@@ -240,7 +270,7 @@ struct omapfb_device {
         int                     state;
         int                     ext_lcdc;               /* Using external
                                                            LCD controller */
-        struct semaphore        rqueue_sema;
+        struct mutex            rqueue_mutex;
 
         void                    *vram_virt_base;
         dma_addr_t              vram_phys_base;
@@ -261,12 +291,13 @@ struct omapfb_device {
         struct device           *dev;
 };
 
-extern struct lcd_panel h3_panel;
-extern struct lcd_panel h2_panel;
-extern struct lcd_panel p2_panel;
-extern struct lcd_panel osk_panel;
-extern struct lcd_panel innovator1610_panel;
-extern struct lcd_panel innovator1510_panel;
+struct omapfb_platform_data {
+        struct omap_lcd_config   lcd;
+        struct omap_fbmem_config fbmem;
+};
+
+#define OMAPFB_EVENT_READY      1
+#define OMAPFB_EVENT_DISABLED   2
 
 #ifdef CONFIG_ARCH_OMAP1
 extern struct lcd_ctrl omap1_lcd_ctrl;
@@ -274,7 +305,20 @@ extern struct lcd_ctrl omap1_lcd_ctrl;
 extern struct lcd_ctrl omap2_disp_ctrl;
 #endif
 
+extern void omapfb_register_panel(struct lcd_panel *panel);
 extern void omapfb_write_first_pixel(struct omapfb_device *fbdev, u16 pixval);
+extern void omapfb_notify_clients(struct omapfb_device *fbdev,
+                                  unsigned long event);
+extern int  omapfb_register_client(struct omapfb_notifier_block *nb,
+                                    omapfb_notifier_callback_t callback,
+                                    void *callback_data);
+extern int  omapfb_unregister_client(struct omapfb_notifier_block *nb);
+extern int  omapfb_update_window_async(struct omapfb_update_window *win,
+                                        void (*callback)(void *),
+                                        void *callback_data);
+
+/* in arch/arm/plat-omap/devices.c */
+extern void omapfb_reserve_mem(void);
 
 #endif /* __KERNEL__ */
 
diff --git a/include/asm-arm/arch-omap/param.h b/include/asm-arm/arch-omap/param.h
new file mode 100644
index 000000000000..face9ad41e97
--- /dev/null
+++ b/include/asm-arm/arch-omap/param.h
@@ -0,0 +1,8 @@
+/*
+ *  linux/include/asm-arm/arch-omap/param.h
+ *
+ */
+
+#ifdef CONFIG_OMAP_32K_TIMER_HZ
+#define HZ      CONFIG_OMAP_32K_TIMER_HZ
+#endif
diff --git a/include/asm-arm/arch-omap/pm.h b/include/asm-arm/arch-omap/pm.h
index 7c790425e363..05b003f3a94c 100644
--- a/include/asm-arm/arch-omap/pm.h
+++ b/include/asm-arm/arch-omap/pm.h
@@ -49,7 +49,7 @@
 
 /*
  * ----------------------------------------------------------------------------
- * Powermanagement bitmasks
+ * Power management bitmasks
  * ----------------------------------------------------------------------------
  */
 #define IDLE_WAIT_CYCLES                0x00000fff
@@ -112,32 +112,59 @@
 #endif
 
 #ifndef __ASSEMBLER__
+
+#include <linux/clk.h>
+
+extern void prevent_idle_sleep(void);
+extern void allow_idle_sleep(void);
+
+/**
+ * clk_deny_idle - Prevents the clock from being idled during MPU idle
+ * @clk: clock signal handle
+ */
+void clk_deny_idle(struct clk *clk);
+
+/**
+ * clk_allow_idle - Counters previous clk_deny_idle
+ * @clk: clock signal handle
+ */
+void clk_deny_idle(struct clk *clk);
+
 extern void omap_pm_idle(void);
 extern void omap_pm_suspend(void);
 extern void omap730_cpu_suspend(unsigned short, unsigned short);
 extern void omap1510_cpu_suspend(unsigned short, unsigned short);
 extern void omap1610_cpu_suspend(unsigned short, unsigned short);
+extern void omap24xx_cpu_suspend(u32 dll_ctrl, u32 cpu_revision);
 extern void omap730_idle_loop_suspend(void);
 extern void omap1510_idle_loop_suspend(void);
 extern void omap1610_idle_loop_suspend(void);
+extern void omap24xx_idle_loop_suspend(void);
+
+extern unsigned int omap730_cpu_suspend_sz;
+extern unsigned int omap1510_cpu_suspend_sz;
+extern unsigned int omap1610_cpu_suspend_sz;
+extern unsigned int omap24xx_cpu_suspend_sz;
+extern unsigned int omap730_idle_loop_suspend_sz;
+extern unsigned int omap1510_idle_loop_suspend_sz;
+extern unsigned int omap1610_idle_loop_suspend_sz;
+extern unsigned int omap24xx_idle_loop_suspend_sz;
 
 #ifdef CONFIG_OMAP_SERIAL_WAKE
 extern void omap_serial_wake_trigger(int enable);
 #else
+#define omap_serial_wakeup_init()       {}
 #define omap_serial_wake_trigger(x)     {}
 #endif  /* CONFIG_OMAP_SERIAL_WAKE */
 
-extern unsigned int omap730_cpu_suspend_sz;
-extern unsigned int omap730_idle_loop_suspend_sz;
-extern unsigned int omap1510_cpu_suspend_sz;
-extern unsigned int omap1510_idle_loop_suspend_sz;
-extern unsigned int omap1610_cpu_suspend_sz;
-extern unsigned int omap1610_idle_loop_suspend_sz;
-
 #define ARM_SAVE(x) arm_sleep_save[ARM_SLEEP_SAVE_##x] = omap_readl(x)
 #define ARM_RESTORE(x) omap_writel((arm_sleep_save[ARM_SLEEP_SAVE_##x]), (x))
 #define ARM_SHOW(x) arm_sleep_save[ARM_SLEEP_SAVE_##x]
 
+#define DSP_SAVE(x) dsp_sleep_save[DSP_SLEEP_SAVE_##x] = __raw_readw(x)
+#define DSP_RESTORE(x) __raw_writew((dsp_sleep_save[DSP_SLEEP_SAVE_##x]), (x))
+#define DSP_SHOW(x) dsp_sleep_save[DSP_SLEEP_SAVE_##x]
+
 #define ULPD_SAVE(x) ulpd_sleep_save[ULPD_SLEEP_SAVE_##x] = omap_readw(x)
 #define ULPD_RESTORE(x) omap_writew((ulpd_sleep_save[ULPD_SLEEP_SAVE_##x]), (x))
 #define ULPD_SHOW(x) ulpd_sleep_save[ULPD_SLEEP_SAVE_##x]
@@ -154,6 +181,10 @@ extern unsigned int omap1610_idle_loop_suspend_sz;
 #define MPUI1610_RESTORE(x) omap_writel((mpui1610_sleep_save[MPUI1610_SLEEP_SAVE_##x]), (x))
 #define MPUI1610_SHOW(x) mpui1610_sleep_save[MPUI1610_SLEEP_SAVE_##x]
 
+#define OMAP24XX_SAVE(x) omap24xx_sleep_save[OMAP24XX_SLEEP_SAVE_##x] = x
+#define OMAP24XX_RESTORE(x) x = omap24xx_sleep_save[OMAP24XX_SLEEP_SAVE_##x]
+#define OMAP24XX_SHOW(x) omap24xx_sleep_save[OMAP24XX_SLEEP_SAVE_##x]
+
 /*
  * List of global OMAP registers to preserve.
  * More ones like CP and general purpose register values are preserved
@@ -176,6 +207,15 @@ enum arm_save_state {
         ARM_SLEEP_SAVE_SIZE
 };
 
+enum dsp_save_state {
+        DSP_SLEEP_SAVE_START = 0,
+        /*
+         * DSP registers 16 bits
+         */
+        DSP_SLEEP_SAVE_DSP_IDLECT2,
+        DSP_SLEEP_SAVE_SIZE
+};
+
 enum ulpd_save_state {
         ULPD_SLEEP_SAVE_START = 0,
         /*
@@ -254,5 +294,30 @@ enum mpui1610_save_state {
 #endif
 };
 
+enum omap24xx_save_state {
+        OMAP24XX_SLEEP_SAVE_START = 0,
+        OMAP24XX_SLEEP_SAVE_INTC_MIR0,
+        OMAP24XX_SLEEP_SAVE_INTC_MIR1,
+        OMAP24XX_SLEEP_SAVE_INTC_MIR2,
+        OMAP24XX_SLEEP_SAVE_CM_FCLKEN1_CORE,
+        OMAP24XX_SLEEP_SAVE_CM_FCLKEN2_CORE,
+        OMAP24XX_SLEEP_SAVE_CM_ICLKEN1_CORE,
+        OMAP24XX_SLEEP_SAVE_CM_ICLKEN2_CORE,
+        OMAP24XX_SLEEP_SAVE_CM_ICLKEN4_CORE,
+        OMAP24XX_SLEEP_SAVE_GPIO1_IRQENABLE1,
+        OMAP24XX_SLEEP_SAVE_GPIO2_IRQENABLE1,
+        OMAP24XX_SLEEP_SAVE_GPIO3_IRQENABLE1,
+        OMAP24XX_SLEEP_SAVE_GPIO4_IRQENABLE1,
+        OMAP24XX_SLEEP_SAVE_GPIO3_OE,
+        OMAP24XX_SLEEP_SAVE_GPIO4_OE,
+        OMAP24XX_SLEEP_SAVE_GPIO3_RISINGDETECT,
+        OMAP24XX_SLEEP_SAVE_GPIO3_FALLINGDETECT,
+        OMAP24XX_SLEEP_SAVE_CONTROL_PADCONF_SPI1_NCS2,
+        OMAP24XX_SLEEP_SAVE_CONTROL_PADCONF_MCBSP1_DX,
+        OMAP24XX_SLEEP_SAVE_CONTROL_PADCONF_SSI1_FLAG_TX,
+        OMAP24XX_SLEEP_SAVE_CONTROL_PADCONF_SYS_NIRQW0,
+        OMAP24XX_SLEEP_SAVE_SIZE
+};
+
 #endif /* ASSEMBLER */
 #endif /* __ASM_ARCH_OMAP_PM_H */
diff --git a/include/asm-arm/arch-omap/prcm.h b/include/asm-arm/arch-omap/prcm.h
index 7b48a5cbb15f..7bcaf94bde9f 100644
--- a/include/asm-arm/arch-omap/prcm.h
+++ b/include/asm-arm/arch-omap/prcm.h
@@ -1,5 +1,7 @@
 /*
- * prcm.h - Access definations for use in OMAP24XX clock and power management
+ * linux/include/asm-arm/arch-omap/prcm.h
+ *
+ * Access definations for use in OMAP24XX clock and power management
  *
  * Copyright (C) 2005 Texas Instruments, Inc.
  *
@@ -21,405 +23,7 @@
 #ifndef __ASM_ARM_ARCH_DPM_PRCM_H
 #define __ASM_ARM_ARCH_DPM_PRCM_H
 
-/* SET_PERFORMANCE_LEVEL PARAMETERS */
-#define PRCM_HALF_SPEED 1
-#define PRCM_FULL_SPEED 2
-
-#ifndef __ASSEMBLER__
-
-#define PRCM_REG32(offset)      __REG32(OMAP24XX_PRCM_BASE + (offset))
-
-#define PRCM_REVISION           PRCM_REG32(0x000)
-#define PRCM_SYSCONFIG          PRCM_REG32(0x010)
-#define PRCM_IRQSTATUS_MPU      PRCM_REG32(0x018)
-#define PRCM_IRQENABLE_MPU      PRCM_REG32(0x01C)
-#define PRCM_VOLTCTRL           PRCM_REG32(0x050)
-#define PRCM_VOLTST             PRCM_REG32(0x054)
-#define PRCM_CLKSRC_CTRL        PRCM_REG32(0x060)
-#define PRCM_CLKOUT_CTRL        PRCM_REG32(0x070)
-#define PRCM_CLKEMUL_CTRL       PRCM_REG32(0x078)
-#define PRCM_CLKCFG_CTRL        PRCM_REG32(0x080)
-#define PRCM_CLKCFG_STATUS      PRCM_REG32(0x084)
-#define PRCM_VOLTSETUP          PRCM_REG32(0x090)
-#define PRCM_CLKSSETUP          PRCM_REG32(0x094)
-#define PRCM_POLCTRL            PRCM_REG32(0x098)
-
-/* GENERAL PURPOSE */
-#define GENERAL_PURPOSE1        PRCM_REG32(0x0B0)
-#define GENERAL_PURPOSE2        PRCM_REG32(0x0B4)
-#define GENERAL_PURPOSE3        PRCM_REG32(0x0B8)
-#define GENERAL_PURPOSE4        PRCM_REG32(0x0BC)
-#define GENERAL_PURPOSE5        PRCM_REG32(0x0C0)
-#define GENERAL_PURPOSE6        PRCM_REG32(0x0C4)
-#define GENERAL_PURPOSE7        PRCM_REG32(0x0C8)
-#define GENERAL_PURPOSE8        PRCM_REG32(0x0CC)
-#define GENERAL_PURPOSE9        PRCM_REG32(0x0D0)
-#define GENERAL_PURPOSE10       PRCM_REG32(0x0D4)
-#define GENERAL_PURPOSE11       PRCM_REG32(0x0D8)
-#define GENERAL_PURPOSE12       PRCM_REG32(0x0DC)
-#define GENERAL_PURPOSE13       PRCM_REG32(0x0E0)
-#define GENERAL_PURPOSE14       PRCM_REG32(0x0E4)
-#define GENERAL_PURPOSE15       PRCM_REG32(0x0E8)
-#define GENERAL_PURPOSE16       PRCM_REG32(0x0EC)
-#define GENERAL_PURPOSE17       PRCM_REG32(0x0F0)
-#define GENERAL_PURPOSE18       PRCM_REG32(0x0F4)
-#define GENERAL_PURPOSE19       PRCM_REG32(0x0F8)
-#define GENERAL_PURPOSE20       PRCM_REG32(0x0FC)
-
-/* MPU */
-#define CM_CLKSEL_MPU           PRCM_REG32(0x140)
-#define CM_CLKSTCTRL_MPU        PRCM_REG32(0x148)
-#define RM_RSTST_MPU            PRCM_REG32(0x158)
-#define PM_WKDEP_MPU            PRCM_REG32(0x1C8)
-#define PM_EVGENCTRL_MPU        PRCM_REG32(0x1D4)
-#define PM_EVEGENONTIM_MPU      PRCM_REG32(0x1D8)
-#define PM_EVEGENOFFTIM_MPU     PRCM_REG32(0x1DC)
-#define PM_PWSTCTRL_MPU         PRCM_REG32(0x1E0)
-#define PM_PWSTST_MPU           PRCM_REG32(0x1E4)
-
-/* CORE */
-#define CM_FCLKEN1_CORE         PRCM_REG32(0x200)
-#define CM_FCLKEN2_CORE         PRCM_REG32(0x204)
-#define CM_FCLKEN3_CORE         PRCM_REG32(0x208)
-#define CM_ICLKEN1_CORE         PRCM_REG32(0x210)
-#define CM_ICLKEN2_CORE         PRCM_REG32(0x214)
-#define CM_ICLKEN3_CORE         PRCM_REG32(0x218)
-#define CM_ICLKEN4_CORE         PRCM_REG32(0x21C)
-#define CM_IDLEST1_CORE         PRCM_REG32(0x220)
-#define CM_IDLEST2_CORE         PRCM_REG32(0x224)
-#define CM_IDLEST3_CORE         PRCM_REG32(0x228)
-#define CM_IDLEST4_CORE         PRCM_REG32(0x22C)
-#define CM_AUTOIDLE1_CORE       PRCM_REG32(0x230)
-#define CM_AUTOIDLE2_CORE       PRCM_REG32(0x234)
-#define CM_AUTOIDLE3_CORE       PRCM_REG32(0x238)
-#define CM_AUTOIDLE4_CORE       PRCM_REG32(0x23C)
-#define CM_CLKSEL1_CORE         PRCM_REG32(0x240)
-#define CM_CLKSEL2_CORE         PRCM_REG32(0x244)
-#define CM_CLKSTCTRL_CORE       PRCM_REG32(0x248)
-#define PM_WKEN1_CORE           PRCM_REG32(0x2A0)
-#define PM_WKEN2_CORE           PRCM_REG32(0x2A4)
-#define PM_WKST1_CORE           PRCM_REG32(0x2B0)
-#define PM_WKST2_CORE           PRCM_REG32(0x2B4)
-#define PM_WKDEP_CORE           PRCM_REG32(0x2C8)
-#define PM_PWSTCTRL_CORE        PRCM_REG32(0x2E0)
-#define PM_PWSTST_CORE          PRCM_REG32(0x2E4)
-
-/* GFX */
-#define CM_FCLKEN_GFX           PRCM_REG32(0x300)
-#define CM_ICLKEN_GFX           PRCM_REG32(0x310)
-#define CM_IDLEST_GFX           PRCM_REG32(0x320)
-#define CM_CLKSEL_GFX           PRCM_REG32(0x340)
-#define CM_CLKSTCTRL_GFX        PRCM_REG32(0x348)
-#define RM_RSTCTRL_GFX          PRCM_REG32(0x350)
-#define RM_RSTST_GFX            PRCM_REG32(0x358)
-#define PM_WKDEP_GFX            PRCM_REG32(0x3C8)
-#define PM_PWSTCTRL_GFX         PRCM_REG32(0x3E0)
-#define PM_PWSTST_GFX           PRCM_REG32(0x3E4)
-
-/* WAKE-UP */
-#define CM_FCLKEN_WKUP          PRCM_REG32(0x400)
-#define CM_ICLKEN_WKUP          PRCM_REG32(0x410)
-#define CM_IDLEST_WKUP          PRCM_REG32(0x420)
-#define CM_AUTOIDLE_WKUP        PRCM_REG32(0x430)
-#define CM_CLKSEL_WKUP          PRCM_REG32(0x440)
-#define RM_RSTCTRL_WKUP         PRCM_REG32(0x450)
-#define RM_RSTTIME_WKUP         PRCM_REG32(0x454)
-#define RM_RSTST_WKUP           PRCM_REG32(0x458)
-#define PM_WKEN_WKUP            PRCM_REG32(0x4A0)
-#define PM_WKST_WKUP            PRCM_REG32(0x4B0)
-
-/* CLOCKS */
-#define CM_CLKEN_PLL            PRCM_REG32(0x500)
-#define CM_IDLEST_CKGEN         PRCM_REG32(0x520)
-#define CM_AUTOIDLE_PLL         PRCM_REG32(0x530)
-#define CM_CLKSEL1_PLL          PRCM_REG32(0x540)
-#define CM_CLKSEL2_PLL          PRCM_REG32(0x544)
-
-/* DSP */
-#define CM_FCLKEN_DSP           PRCM_REG32(0x800)
-#define CM_ICLKEN_DSP           PRCM_REG32(0x810)
-#define CM_IDLEST_DSP           PRCM_REG32(0x820)
-#define CM_AUTOIDLE_DSP         PRCM_REG32(0x830)
-#define CM_CLKSEL_DSP           PRCM_REG32(0x840)
-#define CM_CLKSTCTRL_DSP        PRCM_REG32(0x848)
-#define RM_RSTCTRL_DSP          PRCM_REG32(0x850)
-#define RM_RSTST_DSP            PRCM_REG32(0x858)
-#define PM_WKEN_DSP             PRCM_REG32(0x8A0)
-#define PM_WKDEP_DSP            PRCM_REG32(0x8C8)
-#define PM_PWSTCTRL_DSP         PRCM_REG32(0x8E0)
-#define PM_PWSTST_DSP           PRCM_REG32(0x8E4)
-#define PRCM_IRQSTATUS_DSP      PRCM_REG32(0x8F0)
-#define PRCM_IRQENABLE_DSP      PRCM_REG32(0x8F4)
-
-/* IVA */
-#define PRCM_IRQSTATUS_IVA      PRCM_REG32(0x8F8)
-#define PRCM_IRQENABLE_IVA      PRCM_REG32(0x8FC)
-
-/* Modem on 2430 */
-#define CM_FCLKEN_MDM           PRCM_REG32(0xC00)
-#define CM_ICLKEN_MDM           PRCM_REG32(0xC10)
-#define CM_IDLEST_MDM           PRCM_REG32(0xC20)
-#define CM_CLKSEL_MDM           PRCM_REG32(0xC40)
-
-/* FIXME: Move to header for 2430 */
-#define DISP_BASE               (OMAP24XX_L4_IO_BASE+0x50000)
-#define DISP_REG32(offset)      __REG32(DISP_BASE + (offset))
-
-#define OMAP24XX_GPMC_BASE      (L3_24XX_BASE + 0xa000)
-#define GPMC_BASE               (OMAP24XX_GPMC_BASE)
-#define GPMC_REG32(offset)      __REG32(GPMC_BASE + (offset))
-
-#define GPT1_BASE               (OMAP24XX_GPT1)
-#define GPT1_REG32(offset)      __REG32(GPT1_BASE + (offset))
-
-/* Misc sysconfig */
-#define DISPC_SYSCONFIG         DISP_REG32(0x410)
-#define SPI_BASE                (OMAP24XX_L4_IO_BASE+0x98000)
-#define MCSPI1_SYSCONFIG        __REG32(SPI_BASE + 0x10)
-#define MCSPI2_SYSCONFIG        __REG32(SPI_BASE+0x2000 + 0x10)
-
-//#define DSP_MMU_SYSCONFIG     0x5A000010
-#define CAMERA_MMU_SYSCONFIG    __REG32(DISP_BASE+0x2C10)
-//#define IVA_MMU_SYSCONFIG     0x5D000010
-//#define DSP_DMA_SYSCONFIG     0x00FCC02C
-#define CAMERA_DMA_SYSCONFIG    __REG32(DISP_BASE+0x282C)
-#define SYSTEM_DMA_SYSCONFIG    __REG32(DISP_BASE+0x602C)
-#define GPMC_SYSCONFIG          GPMC_REG32(0x010)
-#define MAILBOXES_SYSCONFIG     __REG32(OMAP24XX_L4_IO_BASE+0x94010)
-#define UART1_SYSCONFIG         __REG32(OMAP24XX_L4_IO_BASE+0x6A054)
-#define UART2_SYSCONFIG         __REG32(OMAP24XX_L4_IO_BASE+0x6C054)
-#define UART3_SYSCONFIG         __REG32(OMAP24XX_L4_IO_BASE+0x6E054)
-//#define IVA_SYSCONFIG         0x5C060010
-#define SDRC_SYSCONFIG          __REG32(OMAP24XX_SDRC_BASE+0x10)
-#define SMS_SYSCONFIG           __REG32(OMAP24XX_SMS_BASE+0x10)
-#define SSI_SYSCONFIG           __REG32(DISP_BASE+0x8010)
-//#define VLYNQ_SYSCONFIG       0x67FFFE10
-
-/* rkw - good cannidates for PM_ to start what nm was trying */
-#define OMAP24XX_GPT2           (OMAP24XX_L4_IO_BASE+0x2A000)
-#define OMAP24XX_GPT3           (OMAP24XX_L4_IO_BASE+0x78000)
-#define OMAP24XX_GPT4           (OMAP24XX_L4_IO_BASE+0x7A000)
-#define OMAP24XX_GPT5           (OMAP24XX_L4_IO_BASE+0x7C000)
-#define OMAP24XX_GPT6           (OMAP24XX_L4_IO_BASE+0x7E000)
-#define OMAP24XX_GPT7           (OMAP24XX_L4_IO_BASE+0x80000)
-#define OMAP24XX_GPT8           (OMAP24XX_L4_IO_BASE+0x82000)
-#define OMAP24XX_GPT9           (OMAP24XX_L4_IO_BASE+0x84000)
-#define OMAP24XX_GPT10          (OMAP24XX_L4_IO_BASE+0x86000)
-#define OMAP24XX_GPT11          (OMAP24XX_L4_IO_BASE+0x88000)
-#define OMAP24XX_GPT12          (OMAP24XX_L4_IO_BASE+0x8A000)
-
-#define GPTIMER1_SYSCONFIG      GPT1_REG32(0x010)
-#define GPTIMER2_SYSCONFIG      __REG32(OMAP24XX_GPT2 + 0x10)
-#define GPTIMER3_SYSCONFIG      __REG32(OMAP24XX_GPT3 + 0x10)
-#define GPTIMER4_SYSCONFIG      __REG32(OMAP24XX_GPT4 + 0x10)
-#define GPTIMER5_SYSCONFIG      __REG32(OMAP24XX_GPT5 + 0x10)
-#define GPTIMER6_SYSCONFIG      __REG32(OMAP24XX_GPT6 + 0x10)
-#define GPTIMER7_SYSCONFIG      __REG32(OMAP24XX_GPT7 + 0x10)
-#define GPTIMER8_SYSCONFIG      __REG32(OMAP24XX_GPT8 + 0x10)
-#define GPTIMER9_SYSCONFIG      __REG32(OMAP24XX_GPT9 + 0x10)
-#define GPTIMER10_SYSCONFIG     __REG32(OMAP24XX_GPT10 + 0x10)
-#define GPTIMER11_SYSCONFIG     __REG32(OMAP24XX_GPT11 + 0x10)
-#define GPTIMER12_SYSCONFIG     __REG32(OMAP24XX_GPT12 + 0x10)
-
-#define GPIOX_BASE(X)           (OMAP24XX_GPIO_BASE+(0x2000*((X)-1)))
-
-#define GPIO1_SYSCONFIG         __REG32((GPIOX_BASE(1)+0x10))
-#define GPIO2_SYSCONFIG         __REG32((GPIOX_BASE(2)+0x10))
-#define GPIO3_SYSCONFIG         __REG32((GPIOX_BASE(3)+0x10))
-#define GPIO4_SYSCONFIG         __REG32((GPIOX_BASE(4)+0x10))
-
-/* GP TIMER 1 */
-#define GPTIMER1_TISTAT         GPT1_REG32(0x014)
-#define GPTIMER1_TISR           GPT1_REG32(0x018)
-#define GPTIMER1_TIER           GPT1_REG32(0x01C)
-#define GPTIMER1_TWER           GPT1_REG32(0x020)
-#define GPTIMER1_TCLR           GPT1_REG32(0x024)
-#define GPTIMER1_TCRR           GPT1_REG32(0x028)
-#define GPTIMER1_TLDR           GPT1_REG32(0x02C)
-#define GPTIMER1_TTGR           GPT1_REG32(0x030)
-#define GPTIMER1_TWPS           GPT1_REG32(0x034)
-#define GPTIMER1_TMAR           GPT1_REG32(0x038)
-#define GPTIMER1_TCAR1          GPT1_REG32(0x03C)
-#define GPTIMER1_TSICR          GPT1_REG32(0x040)
-#define GPTIMER1_TCAR2          GPT1_REG32(0x044)
-
-/* rkw -- base fix up please... */
-#define GPTIMER3_TISR           __REG32(OMAP24XX_L4_IO_BASE+0x78018)
-
-/* SDRC */
-#define SDRC_DLLA_CTRL          __REG32(OMAP24XX_SDRC_BASE+0x060)
-#define SDRC_DLLA_STATUS        __REG32(OMAP24XX_SDRC_BASE+0x064)
-#define SDRC_DLLB_CTRL          __REG32(OMAP24XX_SDRC_BASE+0x068)
-#define SDRC_DLLB_STATUS        __REG32(OMAP24XX_SDRC_BASE+0x06C)
-#define SDRC_POWER              __REG32(OMAP24XX_SDRC_BASE+0x070)
-#define SDRC_MR_0               __REG32(OMAP24XX_SDRC_BASE+0x084)
-
-/* GPIO 1 */
-#define GPIO1_BASE              GPIOX_BASE(1)
-#define GPIO1_REG32(offset)     __REG32(GPIO1_BASE + (offset))
-#define GPIO1_IRQENABLE1        GPIO1_REG32(0x01C)
-#define GPIO1_IRQSTATUS1        GPIO1_REG32(0x018)
-#define GPIO1_IRQENABLE2        GPIO1_REG32(0x02C)
-#define GPIO1_IRQSTATUS2        GPIO1_REG32(0x028)
-#define GPIO1_WAKEUPENABLE      GPIO1_REG32(0x020)
-#define GPIO1_RISINGDETECT      GPIO1_REG32(0x048)
-#define GPIO1_DATAIN            GPIO1_REG32(0x038)
-#define GPIO1_OE                GPIO1_REG32(0x034)
-#define GPIO1_DATAOUT           GPIO1_REG32(0x03C)
-
-/* GPIO2 */
-#define GPIO2_BASE              GPIOX_BASE(2)
-#define GPIO2_REG32(offset)     __REG32(GPIO2_BASE + (offset))
-#define GPIO2_IRQENABLE1        GPIO2_REG32(0x01C)
-#define GPIO2_IRQSTATUS1        GPIO2_REG32(0x018)
-#define GPIO2_IRQENABLE2        GPIO2_REG32(0x02C)
-#define GPIO2_IRQSTATUS2        GPIO2_REG32(0x028)
-#define GPIO2_WAKEUPENABLE      GPIO2_REG32(0x020)
-#define GPIO2_RISINGDETECT      GPIO2_REG32(0x048)
-#define GPIO2_DATAIN            GPIO2_REG32(0x038)
-#define GPIO2_OE                GPIO2_REG32(0x034)
-#define GPIO2_DATAOUT           GPIO2_REG32(0x03C)
-
-/* GPIO 3 */
-#define GPIO3_BASE              GPIOX_BASE(3)
-#define GPIO3_REG32(offset)     __REG32(GPIO3_BASE + (offset))
-#define GPIO3_IRQENABLE1        GPIO3_REG32(0x01C)
-#define GPIO3_IRQSTATUS1        GPIO3_REG32(0x018)
-#define GPIO3_IRQENABLE2        GPIO3_REG32(0x02C)
-#define GPIO3_IRQSTATUS2        GPIO3_REG32(0x028)
-#define GPIO3_WAKEUPENABLE      GPIO3_REG32(0x020)
-#define GPIO3_RISINGDETECT      GPIO3_REG32(0x048)
-#define GPIO3_FALLINGDETECT     GPIO3_REG32(0x04C)
-#define GPIO3_DATAIN            GPIO3_REG32(0x038)
-#define GPIO3_OE                GPIO3_REG32(0x034)
-#define GPIO3_DATAOUT           GPIO3_REG32(0x03C)
-#define GPIO3_DEBOUNCENABLE     GPIO3_REG32(0x050)
-#define GPIO3_DEBOUNCINGTIME    GPIO3_REG32(0x054)
-
-/* GPIO 4 */
-#define GPIO4_BASE              GPIOX_BASE(4)
-#define GPIO4_REG32(offset)     __REG32(GPIO4_BASE + (offset))
-#define GPIO4_IRQENABLE1        GPIO4_REG32(0x01C)
-#define GPIO4_IRQSTATUS1        GPIO4_REG32(0x018)
-#define GPIO4_IRQENABLE2        GPIO4_REG32(0x02C)
-#define GPIO4_IRQSTATUS2        GPIO4_REG32(0x028)
-#define GPIO4_WAKEUPENABLE      GPIO4_REG32(0x020)
-#define GPIO4_RISINGDETECT      GPIO4_REG32(0x048)
-#define GPIO4_FALLINGDETECT     GPIO4_REG32(0x04C)
-#define GPIO4_DATAIN            GPIO4_REG32(0x038)
-#define GPIO4_OE                GPIO4_REG32(0x034)
-#define GPIO4_DATAOUT           GPIO4_REG32(0x03C)
-#define GPIO4_DEBOUNCENABLE     GPIO4_REG32(0x050)
-#define GPIO4_DEBOUNCINGTIME    GPIO4_REG32(0x054)
-
-
-/* IO CONFIG */
-#define CONTROL_BASE            (OMAP24XX_CTRL_BASE)
-#define CONTROL_REG32(offset)   __REG32(CONTROL_BASE + (offset))
-
-#define CONTROL_PADCONF_SPI1_NCS2       CONTROL_REG32(0x104)
-#define CONTROL_PADCONF_SYS_XTALOUT     CONTROL_REG32(0x134)
-#define CONTROL_PADCONF_UART1_RX        CONTROL_REG32(0x0C8)
-#define CONTROL_PADCONF_MCBSP1_DX       CONTROL_REG32(0x10C)
-#define CONTROL_PADCONF_GPMC_NCS4       CONTROL_REG32(0x090)
-#define CONTROL_PADCONF_DSS_D5          CONTROL_REG32(0x0B8)
-#define CONTROL_PADCONF_DSS_D9          CONTROL_REG32(0x0BC)
-#define CONTROL_PADCONF_DSS_D13         CONTROL_REG32(0x0C0)
-#define CONTROL_PADCONF_DSS_VSYNC       CONTROL_REG32(0x0CC)
-
-/* CONTROL */
-#define CONTROL_DEVCONF         CONTROL_REG32(0x274)
-
-/* INTERRUPT CONTROLLER */
-#define INTC_BASE               (OMAP24XX_L4_IO_BASE+0xfe000)
-#define INTC_REG32(offset)      __REG32(INTC_BASE + (offset))
-
-#define INTC1_U_BASE            INTC_REG32(0x000)
-#define INTC_MIR0               INTC_REG32(0x084)
-#define INTC_MIR_SET0           INTC_REG32(0x08C)
-#define INTC_MIR_CLEAR0         INTC_REG32(0x088)
-#define INTC_ISR_CLEAR0         INTC_REG32(0x094)
-#define INTC_MIR1               INTC_REG32(0x0A4)
-#define INTC_MIR_SET1           INTC_REG32(0x0AC)
-#define INTC_MIR_CLEAR1         INTC_REG32(0x0A8)
-#define INTC_ISR_CLEAR1         INTC_REG32(0x0B4)
-#define INTC_MIR2               INTC_REG32(0x0C4)
-#define INTC_MIR_SET2           INTC_REG32(0x0CC)
-#define INTC_MIR_CLEAR2         INTC_REG32(0x0C8)
-#define INTC_ISR_CLEAR2         INTC_REG32(0x0D4)
-#define INTC_SIR_IRQ            INTC_REG32(0x040)
-#define INTC_CONTROL            INTC_REG32(0x048)
-#define INTC_ILR11              INTC_REG32(0x12C)
-#define INTC_ILR32              INTC_REG32(0x180)
-#define INTC_ILR37              INTC_REG32(0x194)
-#define INTC_SYSCONFIG          INTC_REG32(0x010)
-
-/* RAM FIREWALL */
-#define RAMFW_BASE              (0x68005000)
-#define RAMFW_REG32(offset)     __REG32(RAMFW_BASE + (offset))
-
-#define RAMFW_REQINFOPERM0      RAMFW_REG32(0x048)
-#define RAMFW_READPERM0         RAMFW_REG32(0x050)
-#define RAMFW_WRITEPERM0        RAMFW_REG32(0x058)
-
-/* GPMC CS1 FPGA ON USER INTERFACE MODULE */
-//#define DEBUG_BOARD_LED_REGISTER 0x04000014
-
-/* GPMC CS0 */
-#define GPMC_CONFIG1_0          GPMC_REG32(0x060)
-#define GPMC_CONFIG2_0          GPMC_REG32(0x064)
-#define GPMC_CONFIG3_0          GPMC_REG32(0x068)
-#define GPMC_CONFIG4_0          GPMC_REG32(0x06C)
-#define GPMC_CONFIG5_0          GPMC_REG32(0x070)
-#define GPMC_CONFIG6_0          GPMC_REG32(0x074)
-#define GPMC_CONFIG7_0          GPMC_REG32(0x078)
-
-/* GPMC CS1 */
-#define GPMC_CONFIG1_1          GPMC_REG32(0x090)
-#define GPMC_CONFIG2_1          GPMC_REG32(0x094)
-#define GPMC_CONFIG3_1          GPMC_REG32(0x098)
-#define GPMC_CONFIG4_1          GPMC_REG32(0x09C)
-#define GPMC_CONFIG5_1          GPMC_REG32(0x0a0)
-#define GPMC_CONFIG6_1          GPMC_REG32(0x0a4)
-#define GPMC_CONFIG7_1          GPMC_REG32(0x0a8)
-
-/* DSS */
-#define DSS_CONTROL             DISP_REG32(0x040)
-#define DISPC_CONTROL           DISP_REG32(0x440)
-#define DISPC_SYSSTATUS         DISP_REG32(0x414)
-#define DISPC_IRQSTATUS         DISP_REG32(0x418)
-#define DISPC_IRQENABLE         DISP_REG32(0x41C)
-#define DISPC_CONFIG            DISP_REG32(0x444)
-#define DISPC_DEFAULT_COLOR0    DISP_REG32(0x44C)
-#define DISPC_DEFAULT_COLOR1    DISP_REG32(0x450)
-#define DISPC_TRANS_COLOR0      DISP_REG32(0x454)
-#define DISPC_TRANS_COLOR1      DISP_REG32(0x458)
-#define DISPC_LINE_NUMBER       DISP_REG32(0x460)
-#define DISPC_TIMING_H          DISP_REG32(0x464)
-#define DISPC_TIMING_V          DISP_REG32(0x468)
-#define DISPC_POL_FREQ          DISP_REG32(0x46C)
-#define DISPC_DIVISOR           DISP_REG32(0x470)
-#define DISPC_SIZE_DIG          DISP_REG32(0x478)
-#define DISPC_SIZE_LCD          DISP_REG32(0x47C)
-#define DISPC_GFX_BA0           DISP_REG32(0x480)
-#define DISPC_GFX_BA1           DISP_REG32(0x484)
-#define DISPC_GFX_POSITION      DISP_REG32(0x488)
-#define DISPC_GFX_SIZE          DISP_REG32(0x48C)
-#define DISPC_GFX_ATTRIBUTES    DISP_REG32(0x4A0)
-#define DISPC_GFX_FIFO_THRESHOLD        DISP_REG32(0x4A4)
-#define DISPC_GFX_ROW_INC       DISP_REG32(0x4AC)
-#define DISPC_GFX_PIXEL_INC     DISP_REG32(0x4B0)
-#define DISPC_GFX_WINDOW_SKIP   DISP_REG32(0x4B4)
-#define DISPC_GFX_TABLE_BA      DISP_REG32(0x4B8)
-#define DISPC_DATA_CYCLE1       DISP_REG32(0x5D4)
-#define DISPC_DATA_CYCLE2       DISP_REG32(0x5D8)
-#define DISPC_DATA_CYCLE3       DISP_REG32(0x5DC)
-
-/* Wake up define for board */
-#define GPIO97                  (1 << 1)
-#define GPIO88                  (1 << 24)
-
-#endif /* __ASSEMBLER__ */
+u32 omap_prcm_get_reset_sources(void);
 
 #endif
 
diff --git a/include/asm-arm/arch-omap/sram.h b/include/asm-arm/arch-omap/sram.h
index e72ccbf0fe06..6fc0dd57b7c3 100644
--- a/include/asm-arm/arch-omap/sram.h
+++ b/include/asm-arm/arch-omap/sram.h
@@ -20,6 +20,8 @@ extern void omap2_sram_reprogram_sdrc(u32 perf_level, u32 dll_val,
                                       u32 mem_type);
 extern u32 omap2_set_prcm(u32 dpll_ctrl_val, u32 sdrc_rfr_val, int bypass);
 
+extern unsigned long omap_fb_sram_start;
+extern unsigned long omap_fb_sram_size;
 
 /* Do not use these */
 extern void sram_reprogram_clock(u32 ckctl, u32 dpllctl);
diff --git a/include/asm-arm/arch-omap/system.h b/include/asm-arm/arch-omap/system.h
index 6724a81bd10b..67970d1a2020 100644
--- a/include/asm-arm/arch-omap/system.h
+++ b/include/asm-arm/arch-omap/system.h
@@ -9,12 +9,13 @@
 
 #include <asm/mach-types.h>
 #include <asm/hardware.h>
-#include <asm/arch/prcm.h>
 
 #ifndef CONFIG_MACH_VOICEBLUE
 #define voiceblue_reset()               do {} while (0)
 #endif
 
+extern void omap_prcm_arch_reset(char mode);
+
 static inline void arch_idle(void)
 {
         cpu_do_idle();
@@ -38,24 +39,12 @@ static inline void omap1_arch_reset(char mode)
                 omap_writew(1, ARM_RSTCT1);
 }
 
-static inline void omap2_arch_reset(char mode)
-{
-        u32 rate;
-        struct clk *vclk, *sclk;
-
-        vclk = clk_get(NULL, "virt_prcm_set");
-        sclk = clk_get(NULL, "sys_ck");
-        rate = clk_get_rate(sclk);
-        clk_set_rate(vclk, rate);       /* go to bypass for OMAP limitation */
-        RM_RSTCTRL_WKUP |= 2;
-}
-
 static inline void arch_reset(char mode)
 {
         if (!cpu_is_omap24xx())
                 omap1_arch_reset(mode);
         else
-                omap2_arch_reset(mode);
+                omap_prcm_arch_reset(mode);
 }
 
 #endif
diff --git a/include/asm-arm/arch-rpc/hardware.h b/include/asm-arm/arch-rpc/hardware.h
index 9d7f87375aa7..7480f4e8d974 100644
--- a/include/asm-arm/arch-rpc/hardware.h
+++ b/include/asm-arm/arch-rpc/hardware.h
@@ -46,7 +46,6 @@
 #define SCREEN_END              0xdfc00000
 #define SCREEN_BASE             0xdf800000
 
-#define FLUSH_BASE              0xdf000000
 #define UNCACHEABLE_ADDR        0xdf010000
 
 /*
@@ -59,8 +58,6 @@
 #define PCIO_BASE               IOMEM(0xe0010000)
 #define FLOPPYDMA_BASE          IOMEM(0xe002a000)
 
-#define FLUSH_BASE_PHYS         0x00000000      /* ROM */
-
 #define vidc_writel(val)        __raw_writel(val, VIDC_BASE)
 
 #define IO_EC_EASI_BASE         0x81400000
diff --git a/include/asm-arm/arch-rpc/memory.h b/include/asm-arm/arch-rpc/memory.h
index 0592cb3f0c74..303c424ce673 100644
--- a/include/asm-arm/arch-rpc/memory.h
+++ b/include/asm-arm/arch-rpc/memory.h
@@ -30,4 +30,10 @@
 #define __virt_to_bus(x) __virt_to_phys(x)
 #define __bus_to_virt(x) __phys_to_virt(x)
 
+/*
+ * Cache flushing area - ROM
+ */
+#define FLUSH_BASE_PHYS         0x00000000
+#define FLUSH_BASE              0xdf000000
+
 #endif
diff --git a/include/asm-arm/arch-s3c2410/entry-macro.S b/include/asm-arm/arch-s3c2410/entry-macro.S
index cc06b1bd37b2..894c35cf3b1e 100644
--- a/include/asm-arm/arch-s3c2410/entry-macro.S
+++ b/include/asm-arm/arch-s3c2410/entry-macro.S
@@ -6,116 +6,83 @@
  * This file is licensed under  the terms of the GNU General Public
  * License version 2. This program is licensed "as is" without any
  * warranty of any kind, whether express or implied.
+*/
+
+/* We have a problem that the INTOFFSET register does not always
+ * show one interrupt. Occasionally we get two interrupts through
+ * the prioritiser, and this causes the INTOFFSET register to show
+ * what looks like the logical-or of the two interrupt numbers.
+ *
+ * Thanks to Klaus, Shannon, et al for helping to debug this problem
+*/
+
+#define INTPND          (0x10)
+#define INTOFFSET       (0x14)
+#define EXTINTPEND      (0xa8)
+#define EXTINTMASK      (0xa4)
 
- * Modifications:
- *     10-Mar-2005 LCVR  Changed S3C2410_VA to S3C24XX_VA
- */
 #include <asm/hardware.h>
 #include <asm/arch/irqs.h>
 
-
         .macro  get_irqnr_and_base, irqnr, irqstat, base, tmp
 
-                mov     \tmp, #S3C24XX_VA_IRQ
-                ldr     \irqnr, [ \tmp, #0x14 ]         @ get irq no
-30000:
-                teq     \irqnr, #4
-                teqne   \irqnr, #5
-                beq     1002f                           @ external irq reg
-
-                @ debug check to see if interrupt reported is the same
-                @ as the offset....
-
-                teq     \irqnr, #0
-                beq     20002f
-                ldr     \irqstat, [ \tmp, #0x10 ]       @ INTPND
-                mov     \irqstat, \irqstat, lsr \irqnr
-                tst     \irqstat, #1
-                bne     20002f
-
-                /* debug/warning if we get an invalud response from the
-                 * INTOFFSET register */
-#if 1
-                stmfd   r13!, { r0 - r4 , r8-r12, r14 }
-                ldr     r1,     [ \tmp, #0x14 ]         @ INTOFFSET
-                ldr     r2,     [ \tmp, #0x10 ]         @ INTPND
-                ldr     r3,     [ \tmp, #0x00 ]         @ SRCPND
-                adr     r0, 20003f
-                bl      printk
-                b       20004f
-
-20003:
-                .ascii  "<7>irq: err - bad offset %d, intpnd=%08x, srcpnd=%08x\n"
-                .byte   0
-                .align  4
-20004:
-                mov     r1, #1
-                mov     \tmp, #S3C24XX_VA_IRQ
-                ldmfd   r13!, { r0 - r4 , r8-r12, r14 }
-#endif
-
-                @ try working out interrupt number for ourselves
-                mov     \irqnr, #0
-                ldr     \irqstat, [ \tmp, #0x10 ]       @ INTPND
-10021:
-                movs    \irqstat, \irqstat, lsr#1
-                bcs     30000b          @ try and re-start the proccess
-                add     \irqnr, \irqnr, #1
-                cmp     \irqnr, #32
-                ble     10021b
-
-                @ found no interrupt, set Z flag and leave
-                movs    \irqnr, #0
-                b       1001f
-
-20005:
-20002:          @ exit
-                @ we base the s3c2410x interrupts at 16 and above to allow
-                @ isa peripherals to have their standard interrupts, also
-                @ ensure that Z flag is un-set on exit
-
-                @ note, we cannot be sure if we get IRQ_EINT0 (0) that
-                @ there is simply no interrupt pending, so in all other
-                @ cases we jump to say we have found something, otherwise
-                @ we check to see if the interrupt really is assrted
-                adds    \irqnr, \irqnr, #IRQ_EINT0
-                teq     \irqnr, #IRQ_EINT0
-                bne     1001f                           @ exit
-                ldr     \irqstat, [ \tmp, #0x10 ]       @ INTPND
-                teq     \irqstat, #0
-                moveq   \irqnr, #0
-                b       1001f
-
-                @ we get here from no main or external interrupts pending
-1002:
-                add     \tmp, \tmp, #S3C24XX_VA_GPIO - S3C24XX_VA_IRQ
-                ldr     \irqstat, [ \tmp, # 0xa8 ]      @ EXTINTPEND
-                ldr     \irqnr, [ \tmp, # 0xa4 ]        @ EXTINTMASK
-
-                bic     \irqstat, \irqstat, \irqnr      @ clear masked irqs
-
-                mov     \irqnr, #IRQ_EINT4              @ start extint nos
-                mov     \irqstat, \irqstat, lsr#4       @ ignore bottom 4 bits
-10021:
-                movs    \irqstat, \irqstat, lsr#1
-                bcs     1004f
-                add     \irqnr, \irqnr, #1
-                cmp     \irqnr, #IRQ_EINT23
-                ble     10021b
-
-                @ found no interrupt, set Z flag and leave
-                movs    \irqnr, #0
-
-1004:           @ ensure Z flag clear in case our MOVS shifted out the last bit
-                teq     \irqnr, #0
+                mov     \base, #S3C24XX_VA_IRQ
+
+                ldr     \irqstat, [ \base, #INTPND]
+                bics    \irqnr, \irqstat, #3<<4         @@ only an GPIO IRQ
+                beq     2000f
+
+                @@ try the interrupt offset register, since it is there
+
+                ldr     \irqnr, [ \base, #INTOFFSET ]
+                mov     \tmp, #1
+                tst     \irqstat, \tmp, lsl \irqnr
+                addne   \irqnr, \irqnr, #IRQ_EINT0
+                bne     1001f
+
+                @@ the number specified is not a valid irq, so try
+                @@ and work it out for ourselves
+
+                mov     \irqnr, #IRQ_EINT0              @@ start here
+                b       3000f
+
+2000:
+                @@ load the GPIO interrupt register, and check it
+
+                add     \tmp, \base, #S3C24XX_VA_GPIO - S3C24XX_VA_IRQ
+                ldr     \irqstat, [ \tmp, # EXTINTPEND ]
+                ldr     \irqnr,   [ \tmp, # EXTINTMASK ]
+                bics    \irqstat, \irqstat, \irqnr
+                beq     1001f
+
+                mov     \irqnr, #(IRQ_EINT4 - 4)
+
+                @@ work out which irq (if any) we got
+3000:
+                movs    \tmp, \irqstat, lsl#16
+                addeq   \irqnr, \irqnr, #16
+                moveq   \irqstat, \irqstat, lsr#16
+                tst     \irqstat, #0xff
+                addeq   \irqnr, \irqnr, #8
+                moveq   \irqstat, \irqstat, lsr#8
+                tst     \irqstat, #0xf
+                addeq   \irqnr, \irqnr, #4
+                moveq   \irqstat, \irqstat, lsr#4
+                tst     \irqstat, #0x3
+                addeq   \irqnr, \irqnr, #2
+                moveq   \irqstat, \irqstat, lsr#2
+                tst     \irqstat, #0x1
+                addeq   \irqnr, \irqnr, #1
+
+                @@ we have the value
+                movs    \irqnr, \irqnr
+
 1001:
-                @ exit irq routine
-                .endm
+                @@ exit here, Z flag unset if IRQ
 
+        .endm
 
                 /* currently don't need an disable_fiq macro */
 
                 .macro  disable_fiq
                 .endm
-
-
diff --git a/include/asm-arm/arch-s3c2410/leds-gpio.h b/include/asm-arm/arch-s3c2410/leds-gpio.h
new file mode 100644
index 000000000000..f07ed040622b
--- /dev/null
+++ b/include/asm-arm/arch-s3c2410/leds-gpio.h
@@ -0,0 +1,28 @@
+/* linux/include/asm-arm/arch-s3c2410/leds-gpio.h
+ *
+ * (c) 2006 Simtec Electronics
+ *      http://armlinux.simtec.co.uk/
+ *      Ben Dooks <ben@simtec.co.uk>
+ *
+ * S3C24XX - LEDs GPIO connector
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+*/
+
+#ifndef __ASM_ARCH_LEDSGPIO_H
+#define __ASM_ARCH_LEDSGPIO_H "leds-gpio.h"
+
+#define S3C24XX_LEDF_ACTLOW     (1<<0)          /* LED is on when GPIO low */
+#define S3C24XX_LEDF_TRISTATE   (1<<1)          /* tristate to turn off */
+
+struct s3c24xx_led_platdata {
+        unsigned int             gpio;
+        unsigned int             flags;
+
+        char                    *name;
+        char                    *def_trigger;
+};
+
+#endif /* __ASM_ARCH_LEDSGPIO_H */
diff --git a/include/asm-arm/arch-sa1100/hardware.h b/include/asm-arm/arch-sa1100/hardware.h
index 28711aaa4968..ee008a5484f3 100644
--- a/include/asm-arm/arch-sa1100/hardware.h
+++ b/include/asm-arm/arch-sa1100/hardware.h
@@ -14,10 +14,6 @@
 
 #include <linux/config.h>
 
-/* Flushing areas */
-#define FLUSH_BASE_PHYS         0xe0000000      /* SA1100 zero bank */
-#define FLUSH_BASE              0xf5000000
-#define FLUSH_BASE_MINICACHE    0xf5800000
 #define UNCACHEABLE_ADDR        0xfa050000
 
 
diff --git a/include/asm-arm/arch-sa1100/memory.h b/include/asm-arm/arch-sa1100/memory.h
index 018a9f0e3986..a29fac1387ca 100644
--- a/include/asm-arm/arch-sa1100/memory.h
+++ b/include/asm-arm/arch-sa1100/memory.h
@@ -91,4 +91,11 @@ void sa1111_adjust_zones(int node, unsigned long *size, unsigned long *holes);
 
 #endif
 
+/*
+ * Cache flushing area - SA1100 zero bank
+ */
+#define FLUSH_BASE_PHYS         0xe0000000
+#define FLUSH_BASE              0xf5000000
+#define FLUSH_BASE_MINICACHE    0xf5100000
+
 #endif
diff --git a/include/asm-arm/arch-shark/hardware.h b/include/asm-arm/arch-shark/hardware.h
index 4d35f8c154c3..ecba45260898 100644
--- a/include/asm-arm/arch-shark/hardware.h
+++ b/include/asm-arm/arch-shark/hardware.h
@@ -17,11 +17,6 @@
  */
 #define IO_BASE                 0xe0000000
 
-/*
- * RAM definitions
- */
-#define FLUSH_BASE_PHYS         0x80000000
-
 #else
 
 #define IO_BASE                 0
@@ -33,7 +28,6 @@
 #define ROMCARD_SIZE            0x08000000
 #define ROMCARD_START           0x10000000
 
-#define FLUSH_BASE              0xdf000000
 #define PCIO_BASE               0xe0000000
 
 
diff --git a/include/asm-arm/arch-shark/memory.h b/include/asm-arm/arch-shark/memory.h
index 95a29b4bc5d0..6968d6103ea0 100644
--- a/include/asm-arm/arch-shark/memory.h
+++ b/include/asm-arm/arch-shark/memory.h
@@ -39,4 +39,10 @@ static inline void __arch_adjust_zones(int node, unsigned long *zone_size, unsig
 #define __virt_to_bus(x)        __virt_to_phys(x)
 #define __bus_to_virt(x)        __phys_to_virt(x)
 
+/*
+ * Cache flushing area
+ */
+#define FLUSH_BASE_PHYS         0x80000000
+#define FLUSH_BASE              0xdf000000
+
 #endif
diff --git a/include/asm-arm/dma-mapping.h b/include/asm-arm/dma-mapping.h
index e3e8541ee63b..63ca7412a462 100644
--- a/include/asm-arm/dma-mapping.h
+++ b/include/asm-arm/dma-mapping.h
@@ -47,7 +47,7 @@ static inline int dma_get_cache_alignment(void)
 
 static inline int dma_is_consistent(dma_addr_t handle)
 {
-        return 0;
+        return !!arch_is_coherent();
 }
 
 /*
@@ -145,7 +145,9 @@ static inline dma_addr_t
 dma_map_single(struct device *dev, void *cpu_addr, size_t size,
                enum dma_data_direction dir)
 {
-        consistent_sync(cpu_addr, size, dir);
+        if (!arch_is_coherent())
+                consistent_sync(cpu_addr, size, dir);
+
         return virt_to_dma(dev, (unsigned long)cpu_addr);
 }
 #else
@@ -255,7 +257,9 @@ dma_map_sg(struct device *dev, struct scatterlist *sg, int nents,
 
                 sg->dma_address = page_to_dma(dev, sg->page) + sg->offset;
                 virt = page_address(sg->page) + sg->offset;
-                consistent_sync(virt, sg->length, dir);
+
+                if (!arch_is_coherent())
+                        consistent_sync(virt, sg->length, dir);
         }
 
         return nents;
@@ -310,14 +314,16 @@ static inline void
 dma_sync_single_for_cpu(struct device *dev, dma_addr_t handle, size_t size,
                         enum dma_data_direction dir)
 {
-        consistent_sync((void *)dma_to_virt(dev, handle), size, dir);
+        if (!arch_is_coherent())
+                consistent_sync((void *)dma_to_virt(dev, handle), size, dir);
 }
 
 static inline void
 dma_sync_single_for_device(struct device *dev, dma_addr_t handle, size_t size,
                            enum dma_data_direction dir)
 {
-        consistent_sync((void *)dma_to_virt(dev, handle), size, dir);
+        if (!arch_is_coherent())
+                consistent_sync((void *)dma_to_virt(dev, handle), size, dir);
 }
 #else
 extern void dma_sync_single_for_cpu(struct device*, dma_addr_t, size_t, enum dma_data_direction);
@@ -347,7 +353,8 @@ dma_sync_sg_for_cpu(struct device *dev, struct scatterlist *sg, int nents,
 
         for (i = 0; i < nents; i++, sg++) {
                 char *virt = page_address(sg->page) + sg->offset;
-                consistent_sync(virt, sg->length, dir);
+                if (!arch_is_coherent())
+                        consistent_sync(virt, sg->length, dir);
         }
 }
 
@@ -359,7 +366,8 @@ dma_sync_sg_for_device(struct device *dev, struct scatterlist *sg, int nents,
 
         for (i = 0; i < nents; i++, sg++) {
                 char *virt = page_address(sg->page) + sg->offset;
-                consistent_sync(virt, sg->length, dir);
+                if (!arch_is_coherent())
+                        consistent_sync(virt, sg->length, dir);
         }
 }
 #else
diff --git a/include/asm-arm/fpstate.h b/include/asm-arm/fpstate.h
index 6246bf83627d..52bae088a185 100644
--- a/include/asm-arm/fpstate.h
+++ b/include/asm-arm/fpstate.h
@@ -26,7 +26,9 @@
 
 struct vfp_hard_struct {
         __u64 fpregs[16];
+#if __LINUX_ARM_ARCH__ < 6
         __u32 fpmx_state;
+#endif
         __u32 fpexc;
         __u32 fpscr;
         /*
diff --git a/include/asm-arm/memory.h b/include/asm-arm/memory.h
index afa5c3ea077c..209289407595 100644
--- a/include/asm-arm/memory.h
+++ b/include/asm-arm/memory.h
@@ -172,10 +172,10 @@ static inline __deprecated void *bus_to_virt(unsigned long x)
  *  virt_addr_valid(k)  indicates whether a virtual address is valid
  */
 #ifndef CONFIG_DISCONTIGMEM
-#define ARCH_PFN_OFFSET         (PHYS_PFN_OFFSET)
+#define ARCH_PFN_OFFSET         PHYS_PFN_OFFSET
 #define pfn_valid(pfn)          ((pfn) >= PHYS_PFN_OFFSET && (pfn) < (PHYS_PFN_OFFSET + max_mapnr))
 
-#define virt_to_page(kaddr)     (pfn_to_page(__pa(kaddr) >> PAGE_SHIFT))
+#define virt_to_page(kaddr)     pfn_to_page(__pa(kaddr) >> PAGE_SHIFT)
 #define virt_addr_valid(kaddr)  ((unsigned long)(kaddr) >= PAGE_OFFSET && (unsigned long)(kaddr) < (unsigned long)high_memory)
 
 #define PHYS_TO_NID(addr)       (0)
@@ -187,8 +187,8 @@ static inline __deprecated void *bus_to_virt(unsigned long x)
  * around in memory.
  */
 #include <linux/numa.h>
-#define arch_pfn_to_nid(pfn)    (PFN_TO_NID(pfn))
-#define arch_local_page_offset(pfn, nid) (LOCAL_MAP_NR((pfn) << PAGE_OFFSET))
+#define arch_pfn_to_nid(pfn)    PFN_TO_NID(pfn)
+#define arch_local_page_offset(pfn, nid) LOCAL_MAP_NR((pfn) << PAGE_SHIFT)
 
 #define pfn_valid(pfn)                                          \
         ({                                                      \
@@ -234,6 +234,14 @@ static inline __deprecated void *bus_to_virt(unsigned long x)
 #define virt_to_dma(dev, addr)          (__arch_virt_to_dma(dev, addr))
 #endif
 
+/*
+ * Optional coherency support.  Currently used only by selected
+ * Intel XSC3-based systems.
+ */
+#ifndef arch_is_coherent
+#define arch_is_coherent()              0
+#endif
+
 #endif
 
 #include <asm-generic/memory_model.h>
diff --git a/include/asm-arm/numnodes.h b/include/asm-arm/numnodes.h
deleted file mode 100644
index 8df36818ebc9..000000000000
--- a/include/asm-arm/numnodes.h
+++ /dev/null
@@ -1,26 +0,0 @@
-/*
- *  linux/include/asm-arm/numnodes.h
- *
- *  Copyright (C) 2002 Russell King
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 2 as
- * published by the Free Software Foundation.
- */
-
-/* This declaration for the size of the NUMA (CONFIG_DISCONTIGMEM)
- * memory node table is the default.
- *
- * A good place to override this value is include/asm/arch/memory.h.
- */
-
-#ifndef __ASM_ARM_NUMNODES_H
-#define __ASM_ARM_NUMNODES_H
-
-#include <asm/memory.h>
-
-#ifndef NODES_SHIFT
-# define NODES_SHIFT    2       /* Normally, Max 4 Nodes */
-#endif
-
-#endif
diff --git a/include/asm-arm/pgtable-hwdef.h b/include/asm-arm/pgtable-hwdef.h
index 1d033495cc75..1bc1f997bda2 100644
--- a/include/asm-arm/pgtable-hwdef.h
+++ b/include/asm-arm/pgtable-hwdef.h
@@ -73,6 +73,7 @@
 #define PTE_EXT_AP_URW_SRW      (PTE_EXT_AP1|PTE_EXT_AP0)
 #define PTE_EXT_TEX(x)          ((x) << 6)      /* v5 */
 #define PTE_EXT_APX             (1 << 9)        /* v6 */
+#define PTE_EXT_COHERENT        (1 << 9)        /* XScale3 */
 #define PTE_EXT_SHARED          (1 << 10)       /* v6 */
 #define PTE_EXT_NG              (1 << 11)       /* v6 */
 
diff --git a/include/asm-arm/pgtable.h b/include/asm-arm/pgtable.h
index e595ae24efe2..e85c08d78dda 100644
--- a/include/asm-arm/pgtable.h
+++ b/include/asm-arm/pgtable.h
@@ -156,6 +156,7 @@ extern void __pgd_error(const char *file, int line, unsigned long val);
 #define L_PTE_WRITE             (1 << 5)
 #define L_PTE_EXEC              (1 << 6)
 #define L_PTE_DIRTY             (1 << 7)
+#define L_PTE_COHERENT          (1 << 9)        /* I/O coherent (xsc3) */
 #define L_PTE_SHARED            (1 << 10)       /* shared between CPUs (v6) */
 #define L_PTE_ASID              (1 << 11)       /* non-global (use ASID, v6) */
 
diff --git a/include/asm-arm/vfpmacros.h b/include/asm-arm/vfpmacros.h
index 15bd6e74c9cf..27fe028b4e72 100644
--- a/include/asm-arm/vfpmacros.h
+++ b/include/asm-arm/vfpmacros.h
@@ -16,10 +16,18 @@
 
         @ read all the working registers back into the VFP
         .macro  VFPFLDMIA, base
+#if __LINUX_ARM_ARCH__ < 6
         LDC     p11, cr0, [\base],#33*4             @ FLDMIAX \base!, {d0-d15}
+#else
+        LDC     p11, cr0, [\base],#32*4             @ FLDMIAD \base!, {d0-d15}
+#endif
         .endm
 
         @ write all the working registers out of the VFP
         .macro  VFPFSTMIA, base
+#if __LINUX_ARM_ARCH__ < 6
         STC     p11, cr0, [\base],#33*4             @ FSTMIAX \base!, {d0-d15}
+#else
+        STC     p11, cr0, [\base],#32*4             @ FSTMIAD \base!, {d0-d15}
+#endif
         .endm
diff --git a/include/asm-cris/system.h b/include/asm-cris/system.h
index 1d63c2aa8ec2..b1c593b6dbff 100644
--- a/include/asm-cris/system.h
+++ b/include/asm-cris/system.h
@@ -8,7 +8,6 @@
  */
 
 extern struct task_struct *resume(struct task_struct *prev, struct task_struct *next, int);
-#define prepare_to_switch()     do { } while(0)
 #define switch_to(prev,next,last) last = resume(prev,next, \
                                          (int)&((struct task_struct *)0)->thread)
 
diff --git a/include/asm-cris/unistd.h b/include/asm-cris/unistd.h
index 2627bbdf8a11..bb2dfe480213 100644
--- a/include/asm-cris/unistd.h
+++ b/include/asm-cris/unistd.h
@@ -288,7 +288,7 @@
 #define __NR_mq_timedreceive    (__NR_mq_open+3)
 #define __NR_mq_notify          (__NR_mq_open+4)
 #define __NR_mq_getsetattr      (__NR_mq_open+5)
-#define __NR_sys_kexec_load     283
+#define __NR_kexec_load         283
 #define __NR_waitid             284
 /* #define __NR_sys_setaltroot  285 */
 #define __NR_add_key            286
diff --git a/include/asm-frv/system.h b/include/asm-frv/system.h
index f72ff0c4dc0b..1734ed91bcdc 100644
--- a/include/asm-frv/system.h
+++ b/include/asm-frv/system.h
@@ -18,8 +18,6 @@
 
 struct thread_struct;
 
-#define prepare_to_switch()    do { } while(0)
-
 /*
  * switch_to(prev, next) should switch from task `prev' to `next'
  * `prev' will never be the same as `next'.
diff --git a/include/asm-frv/unistd.h b/include/asm-frv/unistd.h
index 322531caa484..2662a3e12dc4 100644
--- a/include/asm-frv/unistd.h
+++ b/include/asm-frv/unistd.h
@@ -289,7 +289,7 @@
 #define __NR_mq_timedreceive    (__NR_mq_open+3)
 #define __NR_mq_notify          (__NR_mq_open+4)
 #define __NR_mq_getsetattr      (__NR_mq_open+5)
-#define __NR_sys_kexec_load     283
+#define __NR_kexec_load         283
 #define __NR_waitid             284
 /* #define __NR_sys_setaltroot  285 */
 #define __NR_add_key            286
diff --git a/include/asm-h8300/system.h b/include/asm-h8300/system.h
index dfe96c7121cf..8e81cf665e75 100644
--- a/include/asm-h8300/system.h
+++ b/include/asm-h8300/system.h
@@ -4,8 +4,6 @@
 #include <linux/config.h> /* get configuration macros */
 #include <linux/linkage.h>
 
-#define prepare_to_switch()     do { } while(0)
-
 /*
  * switch_to(n) should switch tasks to task ptr, first checking that
  * ptr isn't the current task, in which case it does nothing.  This
diff --git a/include/asm-h8300/unistd.h b/include/asm-h8300/unistd.h
index 56a4a5686c88..adb05159379b 100644
--- a/include/asm-h8300/unistd.h
+++ b/include/asm-h8300/unistd.h
@@ -285,7 +285,7 @@
 #define __NR_mq_timedreceive    (__NR_mq_open+3)
 #define __NR_mq_notify          (__NR_mq_open+4)
 #define __NR_mq_getsetattr      (__NR_mq_open+5)
-#define __NR_sys_kexec_load     283
+#define __NR_kexec_load         283
 #define __NR_waitid             284
 /* #define __NR_sys_setaltroot  285 */
 #define __NR_add_key            286
diff --git a/include/asm-i386/apic.h b/include/asm-i386/apic.h
index ff9ac8d19eb2..288233fd77d7 100644
--- a/include/asm-i386/apic.h
+++ b/include/asm-i386/apic.h
@@ -139,6 +139,8 @@ void switch_ipi_to_APIC_timer(void *cpumask);
 
 extern int timer_over_8254;
 
+extern int modern_apic(void);
+
 #else /* !CONFIG_X86_LOCAL_APIC */
 static inline void lapic_shutdown(void) { }
 
diff --git a/include/asm-i386/e820.h b/include/asm-i386/e820.h
index edf65be21a92..ca82acb8cb1f 100644
--- a/include/asm-i386/e820.h
+++ b/include/asm-i386/e820.h
@@ -35,6 +35,10 @@ struct e820map {
 };
 
 extern struct e820map e820;
+
+extern int e820_all_mapped(unsigned long start, unsigned long end,
+                           unsigned type);
+
 #endif/*!__ASSEMBLY__*/
 
 #endif/*__E820_HEADER*/
diff --git a/include/asm-i386/hpet.h b/include/asm-i386/hpet.h
index 16ef9f996e3f..7f1a8a6ee32f 100644
--- a/include/asm-i386/hpet.h
+++ b/include/asm-i386/hpet.h
@@ -89,6 +89,7 @@
  * then 32 bit HPET counter wrapsaround in less than 0.5 sec.
  */
 #define HPET_MIN_PERIOD (100000UL)
+#define HPET_TICK_RATE  (HZ * 100000UL)
 
 extern unsigned long hpet_tick;         /* hpet clks count per tick */
 extern unsigned long hpet_address;      /* hpet memory map physical address */
diff --git a/include/asm-i386/mpspec.h b/include/asm-i386/mpspec.h
index 62113d3bfdc2..770bf6da8c3d 100644
--- a/include/asm-i386/mpspec.h
+++ b/include/asm-i386/mpspec.h
@@ -18,7 +18,6 @@ extern void find_smp_config (void);
 extern void get_smp_config (void);
 extern int nr_ioapics;
 extern int apic_version [MAX_APICS];
-extern int mp_bus_id_to_type [MAX_MP_BUSSES];
 extern int mp_irq_entries;
 extern struct mpc_config_intsrc mp_irqs [MAX_IRQ_SOURCES];
 extern int mpc_default_type;
diff --git a/include/asm-i386/numnodes.h b/include/asm-i386/numnodes.h
deleted file mode 100644
index a61f38c8176f..000000000000
--- a/include/asm-i386/numnodes.h
+++ /dev/null
@@ -1,18 +0,0 @@
-#ifndef _ASM_MAX_NUMNODES_H
-#define _ASM_MAX_NUMNODES_H
-
-#include <linux/config.h>
-
-#ifdef CONFIG_X86_NUMAQ
-
-/* Max 16 Nodes */
-#define NODES_SHIFT     4
-
-#elif defined(CONFIG_ACPI_SRAT)
-
-/* Max 8 Nodes */
-#define NODES_SHIFT     3
-
-#endif /* CONFIG_X86_NUMAQ */
-
-#endif /* _ASM_MAX_NUMNODES_H */
diff --git a/include/asm-i386/unistd.h b/include/asm-i386/unistd.h
index 2e7f3e257fdd..6a8dd83c350f 100644
--- a/include/asm-i386/unistd.h
+++ b/include/asm-i386/unistd.h
@@ -288,7 +288,7 @@
 #define __NR_mq_timedreceive    (__NR_mq_open+3)
 #define __NR_mq_notify          (__NR_mq_open+4)
 #define __NR_mq_getsetattr      (__NR_mq_open+5)
-#define __NR_sys_kexec_load     283
+#define __NR_kexec_load         283
 #define __NR_waitid             284
 /* #define __NR_sys_setaltroot  285 */
 #define __NR_add_key            286
@@ -318,8 +318,8 @@
 #define __NR_unshare            310
 #define __NR_set_robust_list    311
 #define __NR_get_robust_list    312
-#define __NR_sys_splice         313
-#define __NR_sys_sync_file_range 314
+#define __NR_splice             313
+#define __NR_sync_file_range    314
 
 #define NR_syscalls 315
 
diff --git a/include/asm-ia64/acpi-ext.h b/include/asm-ia64/acpi-ext.h
index 56d2ddc97b30..734d137dda6e 100644
--- a/include/asm-ia64/acpi-ext.h
+++ b/include/asm-ia64/acpi-ext.h
@@ -1,12 +1,15 @@
 /*
- * ia64/platform/hp/common/hp_acpi.h
+ * (c) Copyright 2003, 2006 Hewlett-Packard Development Company, L.P.
+ *      Alex Williamson <alex.williamson@hp.com>
+ *      Bjorn Helgaas <bjorn.helgaas@hp.com>
  *
- * Copyright (C) 2003 Hewlett-Packard
- * Copyright (C) Alex Williamson
- * Copyright (C) Bjorn Helgaas
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
  *
  * Vendor specific extensions to ACPI.
  */
+
 #ifndef _ASM_IA64_ACPI_EXT_H
 #define _ASM_IA64_ACPI_EXT_H
 
diff --git a/include/asm-ia64/kdebug.h b/include/asm-ia64/kdebug.h
index 218c458ab60c..c195a9ad1255 100644
--- a/include/asm-ia64/kdebug.h
+++ b/include/asm-ia64/kdebug.h
@@ -58,6 +58,8 @@ enum die_val {
         DIE_MCA_RENDZVOUS_ENTER,
         DIE_MCA_RENDZVOUS_PROCESS,
         DIE_MCA_RENDZVOUS_LEAVE,
+        DIE_MCA_NEW_TIMEOUT,
+        DIE_INIT_ENTER,
         DIE_INIT_MONARCH_ENTER,
         DIE_INIT_MONARCH_PROCESS,
         DIE_INIT_MONARCH_LEAVE,
diff --git a/include/asm-ia64/mca.h b/include/asm-ia64/mca.h
index bfbbb8da79c7..9c5389b7e623 100644
--- a/include/asm-ia64/mca.h
+++ b/include/asm-ia64/mca.h
@@ -148,6 +148,11 @@ extern int  ia64_reg_MCA_extension(int (*fn)(void *, struct ia64_sal_os_state *)
 extern void ia64_unreg_MCA_extension(void);
 extern u64 ia64_get_rnat(u64 *);
 
+struct ia64_mca_notify_die {
+        struct ia64_sal_os_state *sos;
+        int *monarch_cpu;
+};
+
 #else   /* __ASSEMBLY__ */
 
 #define IA64_MCA_CORRECTED      0x0     /* Error has been corrected by OS_MCA */
diff --git a/include/asm-ia64/mutex.h b/include/asm-ia64/mutex.h
index 5a3224f6af38..bed73a643a56 100644
--- a/include/asm-ia64/mutex.h
+++ b/include/asm-ia64/mutex.h
@@ -84,7 +84,7 @@ __mutex_fastpath_unlock(atomic_t *count, void (*fail_fn)(atomic_t *))
 static inline int
 __mutex_fastpath_trylock(atomic_t *count, int (*fail_fn)(atomic_t *))
 {
-        if (likely(cmpxchg_acq(count, 1, 0)) == 1)
+        if (cmpxchg_acq(count, 1, 0) == 1)
                 return 1;
         return 0;
 }
diff --git a/include/asm-ia64/numnodes.h b/include/asm-ia64/numnodes.h
deleted file mode 100644
index e9d356f549d9..000000000000
--- a/include/asm-ia64/numnodes.h
+++ /dev/null
@@ -1,20 +0,0 @@
-#ifndef _ASM_MAX_NUMNODES_H
-#define _ASM_MAX_NUMNODES_H
-
-#ifdef CONFIG_IA64_DIG
-/* Max 8 Nodes */
-#  define NODES_SHIFT   3
-#elif defined(CONFIG_IA64_HP_ZX1) || defined(CONFIG_IA64_HP_ZX1_SWIOTLB)
-/* Max 32 Nodes */
-#  define NODES_SHIFT   5
-#elif defined(CONFIG_IA64_SGI_SN2) || defined(CONFIG_IA64_GENERIC)
-#  if CONFIG_IA64_NR_NODES == 256
-#    define NODES_SHIFT 8
-#  elif CONFIG_IA64_NR_NODES <= 512
-#    define NODES_SHIFT    9
-#  elif CONFIG_IA64_NR_NODES <= 1024
-#    define NODES_SHIFT    10
-#  endif
-#endif
-
-#endif /* _ASM_MAX_NUMNODES_H */
diff --git a/include/asm-ia64/unistd.h b/include/asm-ia64/unistd.h
index 36070c1014d8..1c749acca021 100644
--- a/include/asm-ia64/unistd.h
+++ b/include/asm-ia64/unistd.h
@@ -286,12 +286,15 @@
 /* 1294, 1295 reserved for pselect/ppoll */
 #define __NR_unshare                    1296
 #define __NR_splice                     1297
+#define __NR_set_robust_list            1298
+#define __NR_get_robust_list            1299
+#define __NR_sync_file_range            1300
 
 #ifdef __KERNEL__
 
 #include <linux/config.h>
 
-#define NR_syscalls                     274 /* length of syscall table */
+#define NR_syscalls                     277 /* length of syscall table */
 
 #define __ARCH_WANT_SYS_RT_SIGACTION
 
diff --git a/include/asm-ia64/vga.h b/include/asm-ia64/vga.h
index bc3349ffc505..091177cda223 100644
--- a/include/asm-ia64/vga.h
+++ b/include/asm-ia64/vga.h
@@ -17,7 +17,7 @@
 extern unsigned long vga_console_iobase;
 extern unsigned long vga_console_membase;
 
-#define VGA_MAP_MEM(x)  ((unsigned long) ioremap(vga_console_membase + (x), 0))
+#define VGA_MAP_MEM(x)  ((unsigned long) ioremap_nocache(vga_console_membase + (x), 0))
 
 #define vga_readb(x)    (*(x))
 #define vga_writeb(x,y) (*(y) = (x))
diff --git a/include/asm-m32r/numnodes.h b/include/asm-m32r/numnodes.h
deleted file mode 100644
index 479a39d49f83..000000000000
--- a/include/asm-m32r/numnodes.h
+++ /dev/null
@@ -1,15 +0,0 @@
-#ifndef _ASM_NUMNODES_H_
-#define _ASM_NUMNODES_H_
-
-#include <linux/config.h>
-
-#ifdef CONFIG_DISCONTIGMEM
-
-#if defined(CONFIG_CHIP_M32700)
-#define NODES_SHIFT     1       /* Max 2 Nodes */
-#endif  /* CONFIG_CHIP_M32700 */
-
-#endif  /* CONFIG_DISCONTIGMEM */
-
-#endif  /* _ASM_NUMNODES_H_ */
-
diff --git a/include/asm-m32r/smp.h b/include/asm-m32r/smp.h
index 7885b7df84a2..1184293e5712 100644
--- a/include/asm-m32r/smp.h
+++ b/include/asm-m32r/smp.h
@@ -67,7 +67,8 @@ extern volatile int cpu_2_physid[NR_CPUS];
 #define raw_smp_processor_id()  (current_thread_info()->cpu)
 
 extern cpumask_t cpu_callout_map;
-#define cpu_possible_map cpu_callout_map
+extern cpumask_t cpu_possible_map;
+extern cpumask_t cpu_present_map;
 
 static __inline__ int hard_smp_processor_id(void)
 {
diff --git a/include/asm-m32r/system.h b/include/asm-m32r/system.h
index d6a2c613be68..c5ab5da56d21 100644
--- a/include/asm-m32r/system.h
+++ b/include/asm-m32r/system.h
@@ -22,10 +22,6 @@
  * `next' and `prev' should be struct task_struct, but it isn't always defined
  */
 
-#ifndef CONFIG_SMP
-#define prepare_to_switch()  do { } while(0)
-#endif  /* not CONFIG_SMP */
-
 #define switch_to(prev, next, last)  do { \
         register unsigned long  arg0 __asm__ ("r0") = (unsigned long)prev; \
         register unsigned long  arg1 __asm__ ("r1") = (unsigned long)next; \
diff --git a/include/asm-m32r/uaccess.h b/include/asm-m32r/uaccess.h
index e8ae61956a51..819cc28a94f7 100644
--- a/include/asm-m32r/uaccess.h
+++ b/include/asm-m32r/uaccess.h
@@ -5,17 +5,9 @@
  *  linux/include/asm-m32r/uaccess.h
  *
  *  M32R version.
- *    Copyright (C) 2004  Hirokazu Takata <takata at linux-m32r.org>
+ *    Copyright (C) 2004, 2006  Hirokazu Takata <takata at linux-m32r.org>
  */
 
-#undef UACCESS_DEBUG
-
-#ifdef UACCESS_DEBUG
-#define UAPRINTK(args...) printk(args)
-#else
-#define UAPRINTK(args...)
-#endif /* UACCESS_DEBUG */
-
 /*
  * User space memory access functions
  */
@@ -38,27 +30,29 @@
 #define MAKE_MM_SEG(s)  ((mm_segment_t) { (s) })
 
 #ifdef CONFIG_MMU
+
 #define KERNEL_DS       MAKE_MM_SEG(0xFFFFFFFF)
 #define USER_DS         MAKE_MM_SEG(PAGE_OFFSET)
-#else
-#define KERNEL_DS       MAKE_MM_SEG(0xFFFFFFFF)
-#define USER_DS         MAKE_MM_SEG(0xFFFFFFFF)
-#endif /* CONFIG_MMU */
-
 #define get_ds()        (KERNEL_DS)
-#ifdef CONFIG_MMU
 #define get_fs()        (current_thread_info()->addr_limit)
 #define set_fs(x)       (current_thread_info()->addr_limit = (x))
-#else
+
+#else /* not CONFIG_MMU */
+
+#define KERNEL_DS       MAKE_MM_SEG(0xFFFFFFFF)
+#define USER_DS         MAKE_MM_SEG(0xFFFFFFFF)
+#define get_ds()        (KERNEL_DS)
+
 static inline mm_segment_t get_fs(void)
 {
-  return USER_DS;
+        return USER_DS;
 }
 
 static inline void set_fs(mm_segment_t s)
 {
 }
-#endif /* CONFIG_MMU */
+
+#endif /* not CONFIG_MMU */
 
 #define segment_eq(a,b) ((a).seg == (b).seg)
 
@@ -83,9 +77,9 @@ static inline void set_fs(mm_segment_t s)
                 "       subx    %0, %0\n"                               \
                 "       cmpu    %4, %1\n"                               \
                 "       subx    %0, %5\n"                               \
-                : "=&r"(flag), "=r"(sum)                                \
-                : "1"(addr), "r"((int)(size)),                          \
-                  "r"(current_thread_info()->addr_limit.seg), "r"(0)    \
+                : "=&r" (flag), "=r" (sum)                              \
+                : "1" (addr), "r" ((int)(size)),                        \
+                  "r" (current_thread_info()->addr_limit.seg), "r" (0)  \
                 : "cbit" );                                             \
         flag; })
 
@@ -113,10 +107,10 @@ static inline void set_fs(mm_segment_t s)
 #else
 static inline int access_ok(int type, const void *addr, unsigned long size)
 {
-  extern unsigned long memory_start, memory_end;
-  unsigned long val = (unsigned long)addr;
+        extern unsigned long memory_start, memory_end;
+        unsigned long val = (unsigned long)addr;
 
-  return ((val >= memory_start) && ((val + size) < memory_end));
+        return ((val >= memory_start) && ((val + size) < memory_end));
 }
 #endif /* CONFIG_MMU */
 
@@ -155,39 +149,6 @@ extern int fixup_exception(struct pt_regs *regs);
  * accesses to the same area of user memory).
  */
 
-extern void __get_user_1(void);
-extern void __get_user_2(void);
-extern void __get_user_4(void);
-
-#ifndef MODULE
-#define __get_user_x(size,ret,x,ptr)                                    \
-        __asm__ __volatile__(                                           \
-                "       mv      r0, %0\n"                               \
-                "       mv      r1, %1\n"                               \
-                "       bl __get_user_" #size "\n"                      \
-                "       mv      %0, r0\n"                               \
-                "       mv      %1, r1\n"                               \
-                : "=r"(ret), "=r"(x)                                    \
-                : "0"(ptr)                                              \
-                : "r0", "r1", "r14" )
-#else /* MODULE */
-/*
- * Use "jl" instead of "bl" for MODULE
- */
-#define __get_user_x(size,ret,x,ptr)                                    \
-        __asm__ __volatile__(                                           \
-                "       mv      r0, %0\n"                               \
-                "       mv      r1, %1\n"                               \
-                "       seth    lr, #high(__get_user_" #size ")\n"      \
-                "       or3     lr, lr, #low(__get_user_" #size ")\n"   \
-                "       jl      lr\n"                                   \
-                "       mv      %0, r0\n"                               \
-                "       mv      %1, r1\n"                               \
-                : "=r"(ret), "=r"(x)                                    \
-                : "0"(ptr)                                              \
-                : "r0", "r1", "r14" )
-#endif
-
 /* Careful: we have to cast the result to the type of the pointer for sign
    reasons */
 /**
@@ -208,20 +169,7 @@ extern void __get_user_4(void);
  * On error, the variable @x is set to zero.
  */
 #define get_user(x,ptr)                                                 \
-({      int __ret_gu;                                                   \
-        unsigned long __val_gu;                                         \
-        __chk_user_ptr(ptr);                                            \
-        switch(sizeof (*(ptr))) {                                       \
-        case 1:  __get_user_x(1,__ret_gu,__val_gu,ptr); break;          \
-        case 2:  __get_user_x(2,__ret_gu,__val_gu,ptr); break;          \
-        case 4:  __get_user_x(4,__ret_gu,__val_gu,ptr); break;          \
-        default: __get_user_x(X,__ret_gu,__val_gu,ptr); break;          \
-        }                                                               \
-        (x) = (__typeof__(*(ptr)))__val_gu;                             \
-        __ret_gu;                                                       \
-})
-
-extern void __put_user_bad(void);
+        __get_user_check((x),(ptr),sizeof(*(ptr)))
 
 /**
  * put_user: - Write a simple value into user space.
@@ -240,8 +188,7 @@ extern void __put_user_bad(void);
  * Returns zero on success, or -EFAULT on error.
  */
 #define put_user(x,ptr)                                                 \
-  __put_user_check((__typeof__(*(ptr)))(x),(ptr),sizeof(*(ptr)))
-
+        __put_user_check((__typeof__(*(ptr)))(x),(ptr),sizeof(*(ptr)))
 
 /**
  * __get_user: - Get a simple variable from user space, with less checking.
@@ -264,8 +211,64 @@ extern void __put_user_bad(void);
  * On error, the variable @x is set to zero.
  */
 #define __get_user(x,ptr) \
-  __get_user_nocheck((x),(ptr),sizeof(*(ptr)))
+        __get_user_nocheck((x),(ptr),sizeof(*(ptr)))
 
+#define __get_user_nocheck(x,ptr,size)                                  \
+({                                                                      \
+        long __gu_err = 0;                                              \
+        unsigned long __gu_val;                                         \
+        might_sleep();                                                  \
+        __get_user_size(__gu_val,(ptr),(size),__gu_err);                \
+        (x) = (__typeof__(*(ptr)))__gu_val;                             \
+        __gu_err;                                                       \
+})
+
+#define __get_user_check(x,ptr,size)                                    \
+({                                                                      \
+        long __gu_err = -EFAULT;                                        \
+        unsigned long __gu_val = 0;                                     \
+        const __typeof__(*(ptr)) __user *__gu_addr = (ptr);             \
+        might_sleep();                                                  \
+        if (access_ok(VERIFY_READ,__gu_addr,size))                      \
+                __get_user_size(__gu_val,__gu_addr,(size),__gu_err);    \
+        (x) = (__typeof__(*(ptr)))__gu_val;                             \
+        __gu_err;                                                       \
+})
+
+extern long __get_user_bad(void);
+
+#define __get_user_size(x,ptr,size,retval)                              \
+do {                                                                    \
+        retval = 0;                                                     \
+        __chk_user_ptr(ptr);                                            \
+        switch (size) {                                                 \
+          case 1: __get_user_asm(x,ptr,retval,"ub"); break;             \
+          case 2: __get_user_asm(x,ptr,retval,"uh"); break;             \
+          case 4: __get_user_asm(x,ptr,retval,""); break;               \
+          default: (x) = __get_user_bad();                              \
+        }                                                               \
+} while (0)
+
+#define __get_user_asm(x, addr, err, itype)                             \
+        __asm__ __volatile__(                                           \
+                "       .fillinsn\n"                                    \
+                "1:     ld"itype" %1,@%2\n"                             \
+                "       .fillinsn\n"                                    \
+                "2:\n"                                                  \
+                ".section .fixup,\"ax\"\n"                              \
+                "       .balign 4\n"                                    \
+                "3:     ldi %0,%3\n"                                    \
+                "       seth r14,#high(2b)\n"                           \
+                "       or3 r14,r14,#low(2b)\n"                         \
+                "       jmp r14\n"                                      \
+                ".previous\n"                                           \
+                ".section __ex_table,\"a\"\n"                           \
+                "       .balign 4\n"                                    \
+                "       .long 1b,3b\n"                                  \
+                ".previous"                                             \
+                : "=&r" (err), "=&r" (x)                                \
+                : "r" (addr), "i" (-EFAULT), "0" (err)                  \
+                : "r14", "memory")
 
 /**
  * __put_user: - Write a simple value into user space, with less checking.
@@ -287,11 +290,13 @@ extern void __put_user_bad(void);
  * Returns zero on success, or -EFAULT on error.
  */
 #define __put_user(x,ptr) \
-  __put_user_nocheck((__typeof__(*(ptr)))(x),(ptr),sizeof(*(ptr)))
+        __put_user_nocheck((__typeof__(*(ptr)))(x),(ptr),sizeof(*(ptr)))
+
 
 #define __put_user_nocheck(x,ptr,size)                                  \
 ({                                                                      \
         long __pu_err;                                                  \
+        might_sleep();                                                  \
         __put_user_size((x),(ptr),(size),__pu_err);                     \
         __pu_err;                                                       \
 })
@@ -308,28 +313,28 @@ extern void __put_user_bad(void);
 })
 
 #if defined(__LITTLE_ENDIAN__)
-#define __put_user_u64(x, addr, err)                                    \
-        __asm__ __volatile__(                                           \
-                "       .fillinsn\n"                                    \
-                "1:     st %L1,@%2\n"                                    \
-                "       .fillinsn\n"                                    \
-                "2:     st %H1,@(4,%2)\n"                                \
-                "       .fillinsn\n"                                    \
-                "3:\n"                                                  \
-                ".section .fixup,\"ax\"\n"                              \
-                "       .balign 4\n"                                    \
-                "4:     ldi %0,%3\n"                                    \
-                "       seth r14,#high(3b)\n"                           \
-                "       or3 r14,r14,#low(3b)\n"                         \
-                "       jmp r14\n"                                      \
-                ".previous\n"                                           \
-                ".section __ex_table,\"a\"\n"                           \
-                "       .balign 4\n"                                    \
-                "       .long 1b,4b\n"                                  \
-                "       .long 2b,4b\n"                                  \
-                ".previous"                                             \
-                : "=&r"(err)                                             \
-                : "r"(x), "r"(addr), "i"(-EFAULT), "0"(err)             \
+#define __put_user_u64(x, addr, err)                                    \
+        __asm__ __volatile__(                                           \
+                "       .fillinsn\n"                                    \
+                "1:     st %L1,@%2\n"                                   \
+                "       .fillinsn\n"                                    \
+                "2:     st %H1,@(4,%2)\n"                               \
+                "       .fillinsn\n"                                    \
+                "3:\n"                                                  \
+                ".section .fixup,\"ax\"\n"                              \
+                "       .balign 4\n"                                    \
+                "4:     ldi %0,%3\n"                                    \
+                "       seth r14,#high(3b)\n"                           \
+                "       or3 r14,r14,#low(3b)\n"                         \
+                "       jmp r14\n"                                      \
+                ".previous\n"                                           \
+                ".section __ex_table,\"a\"\n"                           \
+                "       .balign 4\n"                                    \
+                "       .long 1b,4b\n"                                  \
+                "       .long 2b,4b\n"                                  \
+                ".previous"                                             \
+                : "=&r" (err)                                           \
+                : "r" (x), "r" (addr), "i" (-EFAULT), "0" (err)         \
                 : "r14", "memory")
 
 #elif defined(__BIG_ENDIAN__)
@@ -353,13 +358,15 @@ extern void __put_user_bad(void);
                 "       .long 1b,4b\n"                                  \
                 "       .long 2b,4b\n"                                  \
                 ".previous"                                             \
-                : "=&r"(err)                                            \
-                : "r"(x), "r"(addr), "i"(-EFAULT), "0"(err)             \
+                : "=&r" (err)                                           \
+                : "r" (x), "r" (addr), "i" (-EFAULT), "0" (err)         \
                 : "r14", "memory")
 #else
 #error no endian defined
 #endif
 
+extern void __put_user_bad(void);
+
 #define __put_user_size(x,ptr,size,retval)                              \
 do {                                                                    \
         retval = 0;                                                     \
@@ -398,52 +405,8 @@ struct __large_struct { unsigned long buf[100]; };
                 "       .balign 4\n"                                    \
                 "       .long 1b,3b\n"                                  \
                 ".previous"                                             \
-                : "=&r"(err)                                            \
-                : "r"(x), "r"(addr), "i"(-EFAULT), "0"(err)             \
-                : "r14", "memory")
-
-#define __get_user_nocheck(x,ptr,size)                                  \
-({                                                                      \
-        long __gu_err;                                                  \
-        unsigned long __gu_val;                                         \
-        __get_user_size(__gu_val,(ptr),(size),__gu_err);                \
-        (x) = (__typeof__(*(ptr)))__gu_val;                             \
-        __gu_err;                                                       \
-})
-
-extern long __get_user_bad(void);
-
-#define __get_user_size(x,ptr,size,retval)                              \
-do {                                                                    \
-        retval = 0;                                                     \
-        __chk_user_ptr(ptr);                                            \
-        switch (size) {                                                 \
-          case 1: __get_user_asm(x,ptr,retval,"ub"); break;             \
-          case 2: __get_user_asm(x,ptr,retval,"uh"); break;             \
-          case 4: __get_user_asm(x,ptr,retval,""); break;               \
-          default: (x) = __get_user_bad();                              \
-        }                                                               \
-} while (0)
-
-#define __get_user_asm(x, addr, err, itype)                             \
-        __asm__ __volatile__(                                           \
-                "       .fillinsn\n"                                    \
-                "1:     ld"itype" %1,@%2\n"                             \
-                "       .fillinsn\n"                                    \
-                "2:\n"                                                  \
-                ".section .fixup,\"ax\"\n"                              \
-                "       .balign 4\n"                                    \
-                "3:     ldi %0,%3\n"                                    \
-                "       seth r14,#high(2b)\n"                           \
-                "       or3 r14,r14,#low(2b)\n"                         \
-                "       jmp r14\n"                                      \
-                ".previous\n"                                           \
-                ".section __ex_table,\"a\"\n"                           \
-                "       .balign 4\n"                                    \
-                "       .long 1b,3b\n"                                  \
-                ".previous"                                             \
-                : "=&r"(err), "=&r"(x)                                  \
-                : "r"(addr), "i"(-EFAULT), "0"(err)                     \
+                : "=&r" (err)                                           \
+                : "r" (x), "r" (addr), "i" (-EFAULT), "0" (err)         \
                 : "r14", "memory")
 
 /*
@@ -453,7 +416,6 @@ do {									\
  * anything, so this is accurate.
  */
 
-
 /*
  * Copy To/From Userspace
  */
@@ -511,8 +473,9 @@ do {									\
                 "       .long 2b,9b\n"                                  \
                 "       .long 3b,9b\n"                                  \
                 ".previous\n"                                           \
-                : "=&r"(__dst), "=&r"(__src), "=&r"(size), "=&r"(__c)   \
-                : "0"(to), "1"(from), "2"(size), "3"(size / 4)          \
+                : "=&r" (__dst), "=&r" (__src), "=&r" (size),           \
+                  "=&r" (__c)                                           \
+                : "0" (to), "1" (from), "2" (size), "3" (size / 4)      \
                 : "r14", "memory");                                     \
 } while (0)
 
@@ -573,8 +536,9 @@ do {									\
                 "       .long 2b,7b\n"                                  \
                 "       .long 3b,7b\n"                                  \
                 ".previous\n"                                           \
-                : "=&r"(__dst), "=&r"(__src), "=&r"(size), "=&r"(__c)   \
-                : "0"(to), "1"(from), "2"(size), "3"(size / 4)          \
+                : "=&r" (__dst), "=&r" (__src), "=&r" (size),           \
+                  "=&r" (__c)                                           \
+                : "0" (to), "1" (from), "2" (size), "3" (size / 4)      \
                 : "r14", "memory");                                     \
 } while (0)
 
@@ -676,7 +640,7 @@ unsigned long __generic_copy_from_user(void *, const void __user *, unsigned lon
 #define copy_from_user(to,from,n)                       \
 ({                                                      \
         might_sleep();                                  \
-__generic_copy_from_user((to),(from),(n));      \
+        __generic_copy_from_user((to),(from),(n));      \
 })
 
 long __must_check strncpy_from_user(char *dst, const char __user *src,
diff --git a/include/asm-m32r/unistd.h b/include/asm-m32r/unistd.h
index 39be87ca2a5a..be0eb014c3b0 100644
--- a/include/asm-m32r/unistd.h
+++ b/include/asm-m32r/unistd.h
@@ -292,7 +292,7 @@
 #define __NR_mq_timedreceive    (__NR_mq_open+3)
 #define __NR_mq_notify          (__NR_mq_open+4)
 #define __NR_mq_getsetattr      (__NR_mq_open+5)
-#define __NR_sys_kexec_load     283
+#define __NR_kexec_load         283
 #define __NR_waitid             284
 
 #define NR_syscalls 285
diff --git a/include/asm-mips/numnodes.h b/include/asm-mips/numnodes.h
deleted file mode 100644
index 4f00c16ceeb0..000000000000
--- a/include/asm-mips/numnodes.h
+++ /dev/null
@@ -1,7 +0,0 @@
-#ifndef _ASM_MAX_NUMNODES_H
-#define _ASM_MAX_NUMNODES_H
-
-/* Max 128 Nodes */
-#define NODES_SHIFT     6
-
-#endif /* _ASM_MAX_NUMNODES_H */
diff --git a/include/asm-parisc/numnodes.h b/include/asm-parisc/numnodes.h
deleted file mode 100644
index 6c67651efd1c..000000000000
--- a/include/asm-parisc/numnodes.h
+++ /dev/null
@@ -1,7 +0,0 @@
-#ifndef _ASM_MAX_NUMNODES_H
-#define _ASM_MAX_NUMNODES_H
-
-/* Max 8 Nodes */
-#define NODES_SHIFT     3
-
-#endif /* _ASM_MAX_NUMNODES_H */
diff --git a/include/asm-powerpc/eeh.h b/include/asm-powerpc/eeh.h
index 5207758a6dd9..868c7139dbff 100644
--- a/include/asm-powerpc/eeh.h
+++ b/include/asm-powerpc/eeh.h
@@ -60,24 +60,10 @@ void __init pci_addr_cache_build(void);
  * device (including config space i/o).  Call eeh_add_device_late
  * to finish the eeh setup for this device.
  */
-void eeh_add_device_early(struct device_node *);
-void eeh_add_device_late(struct pci_dev *dev);
 void eeh_add_device_tree_early(struct device_node *);
 void eeh_add_device_tree_late(struct pci_bus *);
 
 /**
- * eeh_remove_device - undo EEH setup for the indicated pci device
- * @dev: pci device to be removed
- *
- * This routine should be called when a device is removed from
- * a running system (e.g. by hotplug or dlpar).  It unregisters
- * the PCI device from the EEH subsystem.  I/O errors affecting
- * this device will no longer be detected after this call; thus,
- * i/o errors affecting this slot may leave this device unusable.
- */
-void eeh_remove_device(struct pci_dev *);
-
-/**
  * eeh_remove_device_recursive - undo EEH for device & children.
  * @dev: pci device to be removed
  *
@@ -116,12 +102,6 @@ static inline int eeh_dn_check_failure(struct device_node *dn, struct pci_dev *d
 
 static inline void pci_addr_cache_build(void) { }
 
-static inline void eeh_add_device_early(struct device_node *dn) { }
-
-static inline void eeh_add_device_late(struct pci_dev *dev) { }
-
-static inline void eeh_remove_device(struct pci_dev *dev) { }
-
 static inline void eeh_add_device_tree_early(struct device_node *dn) { }
 
 static inline void eeh_add_device_tree_late(struct pci_bus *bus) { }
diff --git a/include/asm-powerpc/hvcall.h b/include/asm-powerpc/hvcall.h
index b72c04f3f551..6cc7e1fb7bfd 100644
--- a/include/asm-powerpc/hvcall.h
+++ b/include/asm-powerpc/hvcall.h
@@ -4,47 +4,88 @@
 
 #define HVSC                    .long 0x44000022
 
-#define H_Success       0
-#define H_Busy          1       /* Hardware busy -- retry later */
-#define H_Closed        2       /* Resource closed */
-#define H_Constrained   4       /* Resource request constrained to max allowed */
-#define H_InProgress   14       /* Kind of like busy */
-#define H_Pending      17       /* returned from H_POLL_PENDING */
-#define H_Continue     18       /* Returned from H_Join on success */
-#define H_LongBusyStartRange   9900  /* Start of long busy range */
-#define H_LongBusyOrder1msec   9900  /* Long busy, hint that 1msec is a good time to retry */
-#define H_LongBusyOrder10msec  9901  /* Long busy, hint that 10msec is a good time to retry */
-#define H_LongBusyOrder100msec 9902  /* Long busy, hint that 100msec is a good time to retry */
-#define H_LongBusyOrder1sec    9903  /* Long busy, hint that 1sec is a good time to retry */
-#define H_LongBusyOrder10sec   9904  /* Long busy, hint that 10sec is a good time to retry */
-#define H_LongBusyOrder100sec  9905  /* Long busy, hint that 100sec is a good time to retry */
-#define H_LongBusyEndRange     9905  /* End of long busy range */
-#define H_Hardware      -1      /* Hardware error */
-#define H_Function      -2      /* Function not supported */
-#define H_Privilege     -3      /* Caller not privileged */
-#define H_Parameter     -4      /* Parameter invalid, out-of-range or conflicting */
-#define H_Bad_Mode      -5      /* Illegal msr value */
-#define H_PTEG_Full     -6      /* PTEG is full */
-#define H_Not_Found     -7      /* PTE was not found" */
-#define H_Reserved_DABR -8      /* DABR address is reserved by the hypervisor on this processor" */
-#define H_NoMem                 -9
-#define H_Authority            -10
-#define H_Permission           -11
-#define H_Dropped              -12
-#define H_SourceParm           -13
-#define H_DestParm             -14
-#define H_RemoteParm           -15
-#define H_Resource             -16
+#define H_SUCCESS       0
+#define H_BUSY          1       /* Hardware busy -- retry later */
+#define H_CLOSED        2       /* Resource closed */
+#define H_NOT_AVAILABLE 3
+#define H_CONSTRAINED   4       /* Resource request constrained to max allowed */
+#define H_PARTIAL       5
+#define H_IN_PROGRESS   14      /* Kind of like busy */
+#define H_PAGE_REGISTERED 15
+#define H_PARTIAL_STORE   16
+#define H_PENDING       17      /* returned from H_POLL_PENDING */
+#define H_CONTINUE      18      /* Returned from H_Join on success */
+#define H_LONG_BUSY_START_RANGE         9900  /* Start of long busy range */
+#define H_LONG_BUSY_ORDER_1_MSEC        9900  /* Long busy, hint that 1msec \
+                                                 is a good time to retry */
+#define H_LONG_BUSY_ORDER_10_MSEC       9901  /* Long busy, hint that 10msec \
+                                                 is a good time to retry */
+#define H_LONG_BUSY_ORDER_100_MSEC      9902  /* Long busy, hint that 100msec \
+                                                 is a good time to retry */
+#define H_LONG_BUSY_ORDER_1_SEC         9903  /* Long busy, hint that 1sec \
+                                                 is a good time to retry */
+#define H_LONG_BUSY_ORDER_10_SEC        9904  /* Long busy, hint that 10sec \
+                                                 is a good time to retry */
+#define H_LONG_BUSY_ORDER_100_SEC       9905  /* Long busy, hint that 100sec \
+                                                 is a good time to retry */
+#define H_LONG_BUSY_END_RANGE           9905  /* End of long busy range */
+#define H_HARDWARE      -1      /* Hardware error */
+#define H_FUNCTION      -2      /* Function not supported */
+#define H_PRIVILEGE     -3      /* Caller not privileged */
+#define H_PARAMETER     -4      /* Parameter invalid, out-of-range or conflicting */
+#define H_BAD_MODE      -5      /* Illegal msr value */
+#define H_PTEG_FULL     -6      /* PTEG is full */
+#define H_NOT_FOUND     -7      /* PTE was not found" */
+#define H_RESERVED_DABR -8      /* DABR address is reserved by the hypervisor on this processor" */
+#define H_NO_MEM        -9
+#define H_AUTHORITY     -10
+#define H_PERMISSION    -11
+#define H_DROPPED       -12
+#define H_SOURCE_PARM   -13
+#define H_DEST_PARM     -14
+#define H_REMOTE_PARM   -15
+#define H_RESOURCE      -16
+#define H_ADAPTER_PARM  -17
+#define H_RH_PARM       -18
+#define H_RCQ_PARM      -19
+#define H_SCQ_PARM      -20
+#define H_EQ_PARM       -21
+#define H_RT_PARM       -22
+#define H_ST_PARM       -23
+#define H_SIGT_PARM     -24
+#define H_TOKEN_PARM    -25
+#define H_MLENGTH_PARM  -27
+#define H_MEM_PARM      -28
+#define H_MEM_ACCESS_PARM -29
+#define H_ATTR_PARM     -30
+#define H_PORT_PARM     -31
+#define H_MCG_PARM      -32
+#define H_VL_PARM       -33
+#define H_TSIZE_PARM    -34
+#define H_TRACE_PARM    -35
+
+#define H_MASK_PARM     -37
+#define H_MCG_FULL      -38
+#define H_ALIAS_EXIST   -39
+#define H_P_COUNTER     -40
+#define H_TABLE_FULL    -41
+#define H_ALT_TABLE     -42
+#define H_MR_CONDITION  -43
+#define H_NOT_ENOUGH_RESOURCES -44
+#define H_R_STATE       -45
+#define H_RESCINDEND    -46
+
 
 /* Long Busy is a condition that can be returned by the firmware
  * when a call cannot be completed now, but the identical call
  * should be retried later.  This prevents calls blocking in the
- * firmware for long periods of time. Annoyingly the firmware can return
+ * firmware for long periods of time.  Annoyingly the firmware can return
  * a range of return codes, hinting at how long we should wait before
  * retrying.  If you don't care for the hint, the macro below is a good
  * way to check for the long_busy return codes
  */
-#define H_isLongBusy(x)  ((x >= H_LongBusyStartRange) && (x <= H_LongBusyEndRange))
+#define H_IS_LONG_BUSY(x)  ((x >= H_LONG_BUSY_START_RANGE) \
+                             && (x <= H_LONG_BUSY_END_RANGE))
 
 /* Flags */
 #define H_LARGE_PAGE            (1UL<<(63-16))
@@ -66,6 +107,9 @@
 #define H_DABRX_KERNEL          (1UL<<(63-62))
 #define H_DABRX_USER            (1UL<<(63-63))
 
+/* Each control block has to be on a 4K bondary */
+#define H_CB_ALIGNMENT          4096
+
 /* pSeries hypervisor opcodes */
 #define H_REMOVE                0x04
 #define H_ENTER                 0x08
@@ -99,25 +143,52 @@
 #define H_PERFMON               0x7c
 #define H_MIGRATE_DMA           0x78
 #define H_REGISTER_VPA          0xDC
-#define H_CEDE                  0xE0
+#define H_CEDE                  0xE0
 #define H_CONFER                0xE4
-#define H_PROD                  0xE8
+#define H_PROD                  0xE8
 #define H_GET_PPP               0xEC
 #define H_SET_PPP               0xF0
 #define H_PURR                  0xF4
-#define H_PIC                   0xF8
+#define H_PIC                   0xF8
 #define H_REG_CRQ               0xFC
 #define H_FREE_CRQ              0x100
 #define H_VIO_SIGNAL            0x104
 #define H_SEND_CRQ              0x108
-#define H_COPY_RDMA             0x110
+#define H_COPY_RDMA             0x110
 #define H_SET_XDABR             0x134
 #define H_STUFF_TCE             0x138
 #define H_PUT_TCE_INDIRECT      0x13C
 #define H_VTERM_PARTNER_INFO    0x150
 #define H_REGISTER_VTERM        0x154
 #define H_FREE_VTERM            0x158
-#define H_POLL_PENDING          0x1D8
+#define H_RESET_EVENTS          0x15C
+#define H_ALLOC_RESOURCE        0x160
+#define H_FREE_RESOURCE         0x164
+#define H_MODIFY_QP             0x168
+#define H_QUERY_QP              0x16C
+#define H_REREGISTER_PMR        0x170
+#define H_REGISTER_SMR          0x174
+#define H_QUERY_MR              0x178
+#define H_QUERY_MW              0x17C
+#define H_QUERY_HCA             0x180
+#define H_QUERY_PORT            0x184
+#define H_MODIFY_PORT           0x188
+#define H_DEFINE_AQP1           0x18C
+#define H_GET_TRACE_BUFFER      0x190
+#define H_DEFINE_AQP0           0x194
+#define H_RESIZE_MR             0x198
+#define H_ATTACH_MCQP           0x19C
+#define H_DETACH_MCQP           0x1A0
+#define H_CREATE_RPT            0x1A4
+#define H_REMOVE_RPT            0x1A8
+#define H_REGISTER_RPAGES       0x1AC
+#define H_DISABLE_AND_GETC      0x1B0
+#define H_ERROR_DATA            0x1B4
+#define H_GET_HCA_INFO          0x1B8
+#define H_GET_PERF_COUNT        0x1BC
+#define H_MANAGE_TRACE          0x1C0
+#define H_QUERY_INT_STATE       0x1E4
+#define H_POLL_PENDING          0x1D8
 #define H_JOIN                  0x298
 #define H_ENABLE_CRQ            0x2B0
 
@@ -152,7 +223,7 @@ long plpar_hcall_norets(unsigned long opcode, ...);
  */
 long plpar_hcall_8arg_2ret(unsigned long opcode,
                            unsigned long arg1,
-                           unsigned long arg2,
+                           unsigned long arg2,
                            unsigned long arg3,
                            unsigned long arg4,
                            unsigned long arg5,
@@ -176,6 +247,42 @@ long plpar_hcall_4out(unsigned long opcode,
                       unsigned long *out3,
                       unsigned long *out4);
 
+long plpar_hcall_7arg_7ret(unsigned long opcode,
+                           unsigned long arg1,
+                           unsigned long arg2,
+                           unsigned long arg3,
+                           unsigned long arg4,
+                           unsigned long arg5,
+                           unsigned long arg6,
+                           unsigned long arg7,
+                           unsigned long *out1,
+                           unsigned long *out2,
+                           unsigned long *out3,
+                           unsigned long *out4,
+                           unsigned long *out5,
+                           unsigned long *out6,
+                           unsigned long *out7);
+
+long plpar_hcall_9arg_9ret(unsigned long opcode,
+                           unsigned long arg1,
+                           unsigned long arg2,
+                           unsigned long arg3,
+                           unsigned long arg4,
+                           unsigned long arg5,
+                           unsigned long arg6,
+                           unsigned long arg7,
+                           unsigned long arg8,
+                           unsigned long arg9,
+                           unsigned long *out1,
+                           unsigned long *out2,
+                           unsigned long *out3,
+                           unsigned long *out4,
+                           unsigned long *out5,
+                           unsigned long *out6,
+                           unsigned long *out7,
+                           unsigned long *out8,
+                           unsigned long *out9);
+
 #endif /* __ASSEMBLY__ */
 #endif /* __KERNEL__ */
 #endif /* _ASM_POWERPC_HVCALL_H */
diff --git a/include/asm-powerpc/numnodes.h b/include/asm-powerpc/numnodes.h
deleted file mode 100644
index e138edae09dd..000000000000
--- a/include/asm-powerpc/numnodes.h
+++ /dev/null
@@ -1,9 +0,0 @@
-#ifndef _ASM_POWERPC_MAX_NUMNODES_H
-#define _ASM_POWERPC_MAX_NUMNODES_H
-#ifdef __KERNEL__
-
-/* Max 16 Nodes */
-#define NODES_SHIFT     4
-
-#endif /* __KERNEL__ */
-#endif /* _ASM_POWERPC_MAX_NUMNODES_H */
diff --git a/include/asm-s390/atomic.h b/include/asm-s390/atomic.h
index de1d9926aa60..399bf02894dd 100644
--- a/include/asm-s390/atomic.h
+++ b/include/asm-s390/atomic.h
@@ -1,6 +1,8 @@
 #ifndef __ARCH_S390_ATOMIC__
 #define __ARCH_S390_ATOMIC__
 
+#include <linux/compiler.h>
+
 /*
  *  include/asm-s390/atomic.h
  *
diff --git a/include/asm-s390/ebcdic.h b/include/asm-s390/ebcdic.h
index 4cbc336e4d60..15fd2eda6c90 100644
--- a/include/asm-s390/ebcdic.h
+++ b/include/asm-s390/ebcdic.h
@@ -14,12 +14,12 @@
 #include <types.h>
 #endif
 
-extern __u8 _ascebc_500[];   /* ASCII -> EBCDIC 500 conversion table */
-extern __u8 _ebcasc_500[];   /* EBCDIC 500 -> ASCII conversion table */
-extern __u8 _ascebc[];   /* ASCII -> EBCDIC conversion table */
-extern __u8 _ebcasc[];   /* EBCDIC -> ASCII conversion table */
-extern __u8 _ebc_tolower[]; /* EBCDIC -> lowercase */
-extern __u8 _ebc_toupper[]; /* EBCDIC -> uppercase */
+extern __u8 _ascebc_500[256];   /* ASCII -> EBCDIC 500 conversion table */
+extern __u8 _ebcasc_500[256];   /* EBCDIC 500 -> ASCII conversion table */
+extern __u8 _ascebc[256];   /* ASCII -> EBCDIC conversion table */
+extern __u8 _ebcasc[256];   /* EBCDIC -> ASCII conversion table */
+extern __u8 _ebc_tolower[256]; /* EBCDIC -> lowercase */
+extern __u8 _ebc_toupper[256]; /* EBCDIC -> uppercase */
 
 static inline void
 codepage_convert(const __u8 *codepage, volatile __u8 * addr, unsigned long nr)
diff --git a/include/asm-sh/numnodes.h b/include/asm-sh/numnodes.h
deleted file mode 100644
index f73e85b72ecb..000000000000
--- a/include/asm-sh/numnodes.h
+++ /dev/null
@@ -1,7 +0,0 @@
-#ifndef _ASM_MAX_NUMNODES_H
-#define _ASM_MAX_NUMNODES_H
-
-/* Max 2 Nodes */
-#define NODES_SHIFT     1
-
-#endif /* _ASM_MAX_NUMNODES_H */
diff --git a/include/asm-sh/unistd.h b/include/asm-sh/unistd.h
index f2c8e14d1fd9..05520cebda12 100644
--- a/include/asm-sh/unistd.h
+++ b/include/asm-sh/unistd.h
@@ -290,7 +290,7 @@
 #define __NR_mq_timedreceive    (__NR_mq_open+3)
 #define __NR_mq_notify          (__NR_mq_open+4)
 #define __NR_mq_getsetattr      (__NR_mq_open+5)
-#define __NR_sys_kexec_load     283
+#define __NR_kexec_load         283
 #define __NR_waitid             284
 #define __NR_add_key            285
 #define __NR_request_key        286
diff --git a/include/asm-sh64/unistd.h b/include/asm-sh64/unistd.h
index 2a1cfa404ea4..1f8f394ae371 100644
--- a/include/asm-sh64/unistd.h
+++ b/include/asm-sh64/unistd.h
@@ -333,7 +333,7 @@
 #define __NR_mq_timedreceive    (__NR_mq_open+3)
 #define __NR_mq_notify          (__NR_mq_open+4)
 #define __NR_mq_getsetattr      (__NR_mq_open+5)
-#define __NR_sys_kexec_load     311
+#define __NR_kexec_load         311
 #define __NR_waitid             312
 #define __NR_add_key            313
 #define __NR_request_key        314
diff --git a/include/asm-sparc/unistd.h b/include/asm-sparc/unistd.h
index 64ec640a40ee..264f0ebeaedc 100644
--- a/include/asm-sparc/unistd.h
+++ b/include/asm-sparc/unistd.h
@@ -180,7 +180,7 @@
 #define __NR_sched_get_affinity 161 /* Linux specific, getfh under SunOS           */
 #define __NR_getdomainname      162 /* SunOS Specific                              */
 #define __NR_setdomainname      163 /* Common                                      */
-/* #define __NR_ni_syscall      164    ENOSYS under SunOS                          */
+/* #define __NR_utrap_install   164    Linux sparc64 specific                      */
 #define __NR_quotactl           165 /* Common                                      */
 #define __NR_set_tid_address    166 /* Linux specific, exportfs under SunOS        */
 #define __NR_mount              167 /* Common                                      */
@@ -248,7 +248,7 @@
 #define __NR_setfsgid           229 /* Linux Specific                              */
 #define __NR__newselect         230 /* Linux Specific                              */
 #define __NR_time               231 /* Linux Specific                              */
-/* #define __NR_oldstat         232    Linux Specific                              */
+#define __NR_sys_splice         232 /* Linux Specific                              */
 #define __NR_stime              233 /* Linux Specific                              */
 #define __NR_statfs64           234 /* Linux Specific                              */
 #define __NR_fstatfs64          235 /* Linux Specific                              */
@@ -271,7 +271,7 @@
 #define __NR_getsid             252
 #define __NR_fdatasync          253
 #define __NR_nfsservctl         254
-#define __NR_aplib              255
+#define __NR_sys_sync_file_range 255
 #define __NR_clock_settime      256
 #define __NR_clock_gettime      257
 #define __NR_clock_getres       258
diff --git a/include/asm-sparc/vga.h b/include/asm-sparc/vga.h
new file mode 100644
index 000000000000..c69d5b2ba19a
--- /dev/null
+++ b/include/asm-sparc/vga.h
@@ -0,0 +1,33 @@
+/*
+ *      Access to VGA videoram
+ *
+ *      (c) 1998 Martin Mares <mj@ucw.cz>
+ */
+
+#ifndef _LINUX_ASM_VGA_H_
+#define _LINUX_ASM_VGA_H_
+
+#include <asm/types.h>
+
+#define VT_BUF_HAVE_RW
+
+#undef scr_writew
+#undef scr_readw
+
+static inline void scr_writew(u16 val, u16 *addr)
+{
+        BUG_ON((long) addr >= 0);
+
+        *addr = val;
+}
+
+static inline u16 scr_readw(const u16 *addr)
+{
+        BUG_ON((long) addr >= 0);
+
+        return *addr;
+}
+
+#define VGA_MAP_MEM(x,s) (x)
+
+#endif
diff --git a/include/asm-sparc64/percpu.h b/include/asm-sparc64/percpu.h
index 82032e159a76..baef13b58952 100644
--- a/include/asm-sparc64/percpu.h
+++ b/include/asm-sparc64/percpu.h
@@ -26,7 +26,7 @@ register unsigned long __local_per_cpu_offset asm("g5");
 #define percpu_modcopy(pcpudst, src, size)                      \
 do {                                                            \
         unsigned int __i;                                       \
-        for_each_cpu(__i)                                       \
+        for_each_possible_cpu(__i)                              \
                 memcpy((pcpudst)+__per_cpu_offset(__i),         \
                        (src), (size));                          \
 } while (0)
diff --git a/include/asm-sparc64/unistd.h b/include/asm-sparc64/unistd.h
index a284986b1541..d0544b4f47b7 100644
--- a/include/asm-sparc64/unistd.h
+++ b/include/asm-sparc64/unistd.h
@@ -250,7 +250,7 @@
 #ifdef __KERNEL__
 #define __NR_time               231 /* Linux sparc32                               */
 #endif
-/* #define __NR_oldstat         232    Linux Specific                              */
+#define __NR_sys_splice         232 /* Linux Specific                              */
 #define __NR_stime              233 /* Linux Specific                              */
 #define __NR_statfs64           234 /* Linux Specific                              */
 #define __NR_fstatfs64          235 /* Linux Specific                              */
@@ -273,7 +273,7 @@
 #define __NR_getsid             252
 #define __NR_fdatasync          253
 #define __NR_nfsservctl         254
-#define __NR_aplib              255
+#define __NR_sys_sync_file_range 255
 #define __NR_clock_settime      256
 #define __NR_clock_gettime      257
 #define __NR_clock_getres       258
diff --git a/include/asm-um/ptrace-i386.h b/include/asm-um/ptrace-i386.h
index 30656c962d74..6e2528bb0083 100644
--- a/include/asm-um/ptrace-i386.h
+++ b/include/asm-um/ptrace-i386.h
@@ -56,6 +56,9 @@ extern int do_get_thread_area_tt(struct user_desc *info);
 extern int arch_switch_tls_skas(struct task_struct *from, struct task_struct *to);
 extern int arch_switch_tls_tt(struct task_struct *from, struct task_struct *to);
 
+extern void arch_switch_to_tt(struct task_struct *from, struct task_struct *to);
+extern void arch_switch_to_skas(struct task_struct *from, struct task_struct *to);
+
 static inline int do_get_thread_area(struct user_desc *info)
 {
         return CHOOSE_MODE_PROC(do_get_thread_area_tt, do_get_thread_area_skas, info);
diff --git a/include/asm-v850/system.h b/include/asm-v850/system.h
index 107decbd6e6c..7091af4b7866 100644
--- a/include/asm-v850/system.h
+++ b/include/asm-v850/system.h
@@ -18,8 +18,6 @@
 #include <asm/ptrace.h>
 
 
-#define prepare_to_switch()     do { } while (0)
-
 /*
  * switch_to(n) should switch tasks to task ptr, first checking that
  * ptr isn't the current task, in which case it does nothing.
diff --git a/include/asm-x86_64/e820.h b/include/asm-x86_64/e820.h
index 8dcc32665240..93b51df51687 100644
--- a/include/asm-x86_64/e820.h
+++ b/include/asm-x86_64/e820.h
@@ -47,7 +47,8 @@ extern void contig_e820_setup(void);
 extern unsigned long e820_end_of_ram(void);
 extern void e820_reserve_resources(void);
 extern void e820_print_map(char *who);
-extern int e820_mapped(unsigned long start, unsigned long end, unsigned type);
+extern int e820_any_mapped(unsigned long start, unsigned long end, unsigned type);
+extern int e820_all_mapped(unsigned long start, unsigned long end, unsigned type);
 
 extern void e820_bootmem_free(pg_data_t *pgdat, unsigned long start,unsigned long end);
 extern void e820_setup_gap(void);
diff --git a/include/asm-x86_64/hpet.h b/include/asm-x86_64/hpet.h
index 08b75c15269a..18ff7ee9e774 100644
--- a/include/asm-x86_64/hpet.h
+++ b/include/asm-x86_64/hpet.h
@@ -51,6 +51,8 @@
 
 #define HPET_TN_ROUTE_SHIFT     9
 
+#define HPET_TICK_RATE (HZ * 100000UL)
+
 extern int is_hpet_enabled(void);
 extern int hpet_rtc_timer_init(void);
 extern int oem_force_hpet_timer(void);
diff --git a/include/asm-x86_64/ia32_unistd.h b/include/asm-x86_64/ia32_unistd.h
index eeb2bcd635de..b4f4b172b15a 100644
--- a/include/asm-x86_64/ia32_unistd.h
+++ b/include/asm-x86_64/ia32_unistd.h
@@ -317,6 +317,4 @@
 #define __NR_ia32_ppoll                 309
 #define __NR_ia32_unshare               310
 
-#define IA32_NR_syscalls 315    /* must be > than biggest syscall! */
-
 #endif /* _ASM_X86_64_IA32_UNISTD_H_ */
diff --git a/include/asm-x86_64/io.h b/include/asm-x86_64/io.h
index cafdfb37f0d8..a05da8a50bfd 100644
--- a/include/asm-x86_64/io.h
+++ b/include/asm-x86_64/io.h
@@ -177,7 +177,7 @@ static inline __u16 __readw(const volatile void __iomem *addr)
 {
         return *(__force volatile __u16 *)addr;
 }
-static inline __u32 __readl(const volatile void __iomem *addr)
+static __always_inline __u32 __readl(const volatile void __iomem *addr)
 {
         return *(__force volatile __u32 *)addr;
 }
diff --git a/include/asm-x86_64/mce.h b/include/asm-x86_64/mce.h
index 5d298b799a9f..7229785094e3 100644
--- a/include/asm-x86_64/mce.h
+++ b/include/asm-x86_64/mce.h
@@ -70,6 +70,9 @@ struct mce_log {
 #define MCE_THRESHOLD_BASE      MCE_EXTENDED_BANK + 1 /* MCE_AMD */
 #define MCE_THRESHOLD_DRAM_ECC  MCE_THRESHOLD_BASE + 4
 
+#ifdef __KERNEL__
+#include <asm/atomic.h>
+
 void mce_log(struct mce *m);
 #ifdef CONFIG_X86_MCE_INTEL
 void mce_intel_feature_init(struct cpuinfo_x86 *c);
@@ -87,4 +90,8 @@ static inline void mce_amd_feature_init(struct cpuinfo_x86 *c)
 }
 #endif
 
+extern atomic_t mce_entry;
+
+#endif
+
 #endif
diff --git a/include/asm-x86_64/numa.h b/include/asm-x86_64/numa.h
index f6cbb4cbb5a3..1cc92fe02503 100644
--- a/include/asm-x86_64/numa.h
+++ b/include/asm-x86_64/numa.h
@@ -2,7 +2,6 @@
 #define _ASM_X8664_NUMA_H 1
 
 #include <linux/nodemask.h>
-#include <asm/numnodes.h>
 
 struct bootnode {
         u64 start,end; 
@@ -18,6 +17,8 @@ extern void numa_init_array(void);
 extern int numa_off;
 
 extern void numa_set_node(int cpu, int node);
+extern void srat_reserve_add_area(int nodeid);
+extern int hotadd_percent;
 
 extern unsigned char apicid_to_node[256];
 #ifdef CONFIG_NUMA
diff --git a/include/asm-x86_64/numnodes.h b/include/asm-x86_64/numnodes.h
deleted file mode 100644
index 32be16b8ae96..000000000000
--- a/include/asm-x86_64/numnodes.h
+++ /dev/null
@@ -1,12 +0,0 @@
-#ifndef _ASM_X8664_NUMNODES_H
-#define _ASM_X8664_NUMNODES_H 1
-
-#include <linux/config.h>
-
-#ifdef CONFIG_NUMA
-#define NODES_SHIFT     6
-#else
-#define NODES_SHIFT     0
-#endif
-
-#endif
diff --git a/include/asm-x86_64/timex.h b/include/asm-x86_64/timex.h
index f18443fcdf04..b9e5320b7625 100644
--- a/include/asm-x86_64/timex.h
+++ b/include/asm-x86_64/timex.h
@@ -33,7 +33,7 @@ static __always_inline cycles_t get_cycles_sync(void)
         unsigned eax;
         /* Don't do an additional sync on CPUs where we know
            RDTSC is already synchronous. */
-        alternative_io(ASM_NOP2, "cpuid", X86_FEATURE_SYNC_RDTSC,
+        alternative_io("cpuid", ASM_NOP2, X86_FEATURE_SYNC_RDTSC,
                           "=a" (eax), "0" (1) : "ebx","ecx","edx","memory");
         rdtscll(ret);
         return ret;
diff --git a/include/asm-xtensa/system.h b/include/asm-xtensa/system.h
index 9284867f1cb9..b29f7ae6a08a 100644
--- a/include/asm-xtensa/system.h
+++ b/include/asm-xtensa/system.h
@@ -111,8 +111,6 @@ extern void *_switch_to(void *last, void *next);
 
 #endif  /* __ASSEMBLY__ */
 
-#define prepare_to_switch()     do { } while(0)
-
 #define switch_to(prev,next,last)               \
 do {                                            \
         clear_cpenable();                       \
diff --git a/include/linux/bootmem.h b/include/linux/bootmem.h
index de3eb8d8ae26..da2d107fe2cf 100644
--- a/include/linux/bootmem.h
+++ b/include/linux/bootmem.h
@@ -45,6 +45,7 @@ extern unsigned long __init bootmem_bootmap_pages (unsigned long);
 extern unsigned long __init init_bootmem (unsigned long addr, unsigned long memend);
 extern void __init free_bootmem (unsigned long addr, unsigned long size);
 extern void * __init __alloc_bootmem (unsigned long size, unsigned long align, unsigned long goal);
+extern void * __init __alloc_bootmem_nopanic (unsigned long size, unsigned long align, unsigned long goal);
 extern void * __init __alloc_bootmem_low(unsigned long size,
                                          unsigned long align,
                                          unsigned long goal);
diff --git a/include/linux/dma-mapping.h b/include/linux/dma-mapping.h
index 9b4751aecc23..ff61817082fa 100644
--- a/include/linux/dma-mapping.h
+++ b/include/linux/dma-mapping.h
@@ -21,7 +21,7 @@ enum dma_data_direction {
 #define DMA_30BIT_MASK  0x000000003fffffffULL
 #define DMA_29BIT_MASK  0x000000001fffffffULL
 #define DMA_28BIT_MASK  0x000000000fffffffULL
-#define DMA_24BIT_MASK 0x0000000000ffffffULL
+#define DMA_24BIT_MASK  0x0000000000ffffffULL
 
 #include <asm/dma-mapping.h>
 
diff --git a/include/linux/fs.h b/include/linux/fs.h
index 4ed7e602d703..162c6e57307a 100644
--- a/include/linux/fs.h
+++ b/include/linux/fs.h
@@ -762,7 +762,7 @@ extern int fcntl_getlease(struct file *filp);
 #define SYNC_FILE_RANGE_WRITE           2
 #define SYNC_FILE_RANGE_WAIT_AFTER      4
 extern int do_sync_file_range(struct file *file, loff_t offset, loff_t endbyte,
-                        int flags);
+                        unsigned int flags);
 
 /* fs/locks.c */
 extern void locks_init_lock(struct file_lock *);
@@ -864,7 +864,7 @@ struct super_block {
          */
         struct mutex s_vfs_rename_mutex;        /* Kludge */
 
-        /* Granuality of c/m/atime in ns.
+        /* Granularity of c/m/atime in ns.
            Cannot be worse than a second */
         u32                s_time_gran;
 };
@@ -1039,8 +1039,8 @@ struct file_operations {
         int (*check_flags)(int);
         int (*dir_notify)(struct file *filp, unsigned long arg);
         int (*flock) (struct file *, int, struct file_lock *);
-        ssize_t (*splice_write)(struct inode *, struct file *, size_t, unsigned int);
-        ssize_t (*splice_read)(struct file *, struct inode *, size_t, unsigned int);
+        ssize_t (*splice_write)(struct pipe_inode_info *, struct file *, size_t, unsigned int);
+        ssize_t (*splice_read)(struct file *, struct pipe_inode_info *, size_t, unsigned int);
 };
 
 struct inode_operations {
@@ -1611,8 +1611,17 @@ extern ssize_t generic_file_sendfile(struct file *, loff_t *, size_t, read_actor
 extern void do_generic_mapping_read(struct address_space *mapping,
                                     struct file_ra_state *, struct file *,
                                     loff_t *, read_descriptor_t *, read_actor_t);
-extern ssize_t generic_file_splice_read(struct file *, struct inode *, size_t, unsigned int);
-extern ssize_t generic_file_splice_write(struct inode *, struct file *, size_t, unsigned int);
+
+/* fs/splice.c */
+extern ssize_t generic_file_splice_read(struct file *,
+                struct pipe_inode_info *, size_t, unsigned int);
+extern ssize_t generic_file_splice_write(struct pipe_inode_info *,
+                struct file *, size_t, unsigned int);
+extern ssize_t generic_splice_sendpage(struct pipe_inode_info *pipe,
+                struct file *out, size_t len, unsigned int flags);
+extern long do_splice_direct(struct file *in, struct file *out,
+                size_t len, unsigned int flags);
+
 extern void
 file_ra_state_init(struct file_ra_state *ra, struct address_space *mapping);
 extern ssize_t generic_file_readv(struct file *filp, const struct iovec *iov, 
diff --git a/include/linux/gameport.h b/include/linux/gameport.h
index 9c8e6da2393b..71e7b2847cb3 100644
--- a/include/linux/gameport.h
+++ b/include/linux/gameport.h
@@ -11,6 +11,7 @@
 
 #include <asm/io.h>
 #include <linux/list.h>
+#include <linux/mutex.h>
 #include <linux/device.h>
 #include <linux/timer.h>
 
@@ -40,7 +41,7 @@ struct gameport {
         struct gameport *parent, *child;
 
         struct gameport_driver *drv;
-        struct semaphore drv_sem;       /* protects serio->drv so attributes can pin driver */
+        struct mutex drv_mutex;         /* protects serio->drv so attributes can pin driver */
 
         struct device dev;
         unsigned int registered;        /* port has been fully registered with driver core */
@@ -137,12 +138,12 @@ static inline void gameport_set_drvdata(struct gameport *gameport, void *data)
  */
 static inline int gameport_pin_driver(struct gameport *gameport)
 {
-        return down_interruptible(&gameport->drv_sem);
+        return mutex_lock_interruptible(&gameport->drv_mutex);
 }
 
 static inline void gameport_unpin_driver(struct gameport *gameport)
 {
-        up(&gameport->drv_sem);
+        mutex_unlock(&gameport->drv_mutex);
 }
 
 void __gameport_register_driver(struct gameport_driver *drv, struct module *owner);
diff --git a/include/linux/gfp.h b/include/linux/gfp.h
index 7851e6b520cf..3ac452945a7d 100644
--- a/include/linux/gfp.h
+++ b/include/linux/gfp.h
@@ -57,6 +57,8 @@ struct vm_area_struct;
                         __GFP_NOFAIL|__GFP_NORETRY|__GFP_NO_GROW|__GFP_COMP| \
                         __GFP_NOMEMALLOC|__GFP_HARDWALL)
 
+/* This equals 0, but use constants in case they ever change */
+#define GFP_NOWAIT      (GFP_ATOMIC & ~__GFP_HIGH)
 /* GFP_ATOMIC means both !wait (__GFP_WAIT not set) and use emergency pool */
 #define GFP_ATOMIC      (__GFP_HIGH)
 #define GFP_NOIO        (__GFP_WAIT)
diff --git a/include/linux/hrtimer.h b/include/linux/hrtimer.h
index b20939287613..306acf1dc6d5 100644
--- a/include/linux/hrtimer.h
+++ b/include/linux/hrtimer.h
@@ -80,7 +80,7 @@ struct hrtimer_sleeper {
  * @first:              pointer to the timer node which expires first
  * @resolution:         the resolution of the clock, in nanoseconds
  * @get_time:           function to retrieve the current time of the clock
- * @get_sofirq_time:    function to retrieve the current time from the softirq
+ * @get_softirq_time:   function to retrieve the current time from the softirq
  * @curr_timer:         the timer which is executing a callback right now
  * @softirq_time:       the time when running the hrtimer queue in the softirq
  */
diff --git a/include/linux/init.h b/include/linux/init.h
index ed0ac7c39fdc..93dcbe1abb4c 100644
--- a/include/linux/init.h
+++ b/include/linux/init.h
@@ -245,7 +245,8 @@ void __init parse_early_param(void);
 #define __cpuexitdata   __exitdata
 #endif
 
-#ifdef CONFIG_MEMORY_HOTPLUG
+#if defined(CONFIG_MEMORY_HOTPLUG) || defined(CONFIG_ACPI_HOTPLUG_MEMORY) \
+        || defined(CONFIG_ACPI_HOTPLUG_MEMORY_MODULE)
 #define __meminit
 #define __meminitdata
 #define __memexit
diff --git a/include/linux/input.h b/include/linux/input.h
index 1d4e341b72e6..b0e612dda0cf 100644
--- a/include/linux/input.h
+++ b/include/linux/input.h
@@ -421,7 +421,7 @@ struct input_absinfo {
 #define BTN_GEAR_UP             0x151
 
 #define KEY_OK                  0x160
-#define KEY_SELECT              0x161
+#define KEY_SELECT              0x161
 #define KEY_GOTO                0x162
 #define KEY_CLEAR               0x163
 #define KEY_POWER2              0x164
@@ -512,6 +512,15 @@ struct input_absinfo {
 #define KEY_FN_S                0x1e3
 #define KEY_FN_B                0x1e4
 
+#define KEY_BRL_DOT1            0x1f1
+#define KEY_BRL_DOT2            0x1f2
+#define KEY_BRL_DOT3            0x1f3
+#define KEY_BRL_DOT4            0x1f4
+#define KEY_BRL_DOT5            0x1f5
+#define KEY_BRL_DOT6            0x1f6
+#define KEY_BRL_DOT7            0x1f7
+#define KEY_BRL_DOT8            0x1f8
+
 /* We avoid low common keys in module aliases so they don't get huge. */
 #define KEY_MIN_INTERESTING     KEY_MUTE
 #define KEY_MAX                 0x1ff
@@ -929,7 +938,7 @@ struct input_dev {
 
         struct input_handle *grab;
 
-        struct semaphore sem;   /* serializes open and close operations */
+        struct mutex mutex;     /* serializes open and close operations */
         unsigned int users;
 
         struct class_device cdev;
@@ -995,11 +1004,6 @@ static inline void init_input_dev(struct input_dev *dev)
 
 struct input_dev *input_allocate_device(void);
 
-static inline void input_free_device(struct input_dev *dev)
-{
-        kfree(dev);
-}
-
 static inline struct input_dev *input_get_device(struct input_dev *dev)
 {
         return to_input_dev(class_device_get(&dev->cdev));
@@ -1010,6 +1014,11 @@ static inline void input_put_device(struct input_dev *dev)
         class_device_put(&dev->cdev);
 }
 
+static inline void input_free_device(struct input_dev *dev)
+{
+        input_put_device(dev);
+}
+
 int input_register_device(struct input_dev *);
 void input_unregister_device(struct input_dev *);
 
diff --git a/include/linux/jiffies.h b/include/linux/jiffies.h
index 99905e180532..043376920f51 100644
--- a/include/linux/jiffies.h
+++ b/include/linux/jiffies.h
@@ -36,6 +36,8 @@
 /* LATCH is used in the interval timer and ftape setup. */
 #define LATCH  ((CLOCK_TICK_RATE + HZ/2) / HZ)  /* For divider */
 
+#define LATCH_HPET ((HPET_TICK_RATE + HZ/2) / HZ)
+
 /* Suppose we want to devide two numbers NOM and DEN: NOM/DEN, the we can
  * improve accuracy by shifting LSH bits, hence calculating:
  *     (NOM << LSH) / DEN
@@ -51,9 +53,13 @@
 /* HZ is the requested value. ACTHZ is actual HZ ("<< 8" is for accuracy) */
 #define ACTHZ (SH_DIV (CLOCK_TICK_RATE, LATCH, 8))
 
+#define ACTHZ_HPET (SH_DIV (HPET_TICK_RATE, LATCH_HPET, 8))
+
 /* TICK_NSEC is the time between ticks in nsec assuming real ACTHZ */
 #define TICK_NSEC (SH_DIV (1000000UL * 1000, ACTHZ, 8))
 
+#define TICK_NSEC_HPET (SH_DIV(1000000UL * 1000, ACTHZ_HPET, 8))
+
 /* TICK_USEC is the time between ticks in usec assuming fake USER_HZ */
 #define TICK_USEC ((1000000UL + USER_HZ/2) / USER_HZ)
 
diff --git a/include/linux/kbd_kern.h b/include/linux/kbd_kern.h
index e87c32a5c86a..4eb851ece080 100644
--- a/include/linux/kbd_kern.h
+++ b/include/linux/kbd_kern.h
@@ -135,6 +135,8 @@ static inline void chg_vc_kbd_led(struct kbd_struct * kbd, int flag)
 
 #define U(x) ((x) ^ 0xf000)
 
+#define BRL_UC_ROW 0x2800
+
 /* keyboard.c */
 
 struct console;
diff --git a/include/linux/kernel.h b/include/linux/kernel.h
index a3720f973ea5..e1bd0842f6a1 100644
--- a/include/linux/kernel.h
+++ b/include/linux/kernel.h
@@ -176,7 +176,7 @@ static inline void console_verbose(void)
 
 extern void bust_spinlocks(int yes);
 extern int oops_in_progress;            /* If set, an oops, panic(), BUG() or die() is in progress */
-extern __deprecated_for_modules int panic_timeout;
+extern int panic_timeout;
 extern int panic_on_oops;
 extern int tainted;
 extern const char *print_tainted(void);
diff --git a/include/linux/keyboard.h b/include/linux/keyboard.h
index 08488042d74a..de76843bbe8a 100644
--- a/include/linux/keyboard.h
+++ b/include/linux/keyboard.h
@@ -44,6 +44,7 @@ extern unsigned short plain_map[NR_KEYS];
 #define KT_ASCII        9
 #define KT_LOCK         10
 #define KT_SLOCK        12
+#define KT_BRL          14
 
 #define K(t,v)          (((t)<<8)|(v))
 #define KTYP(x)         ((x) >> 8)
@@ -427,5 +428,17 @@ extern unsigned short plain_map[NR_KEYS];
 
 #define NR_LOCK         8
 
+#define K_BRL_BLANK     K(KT_BRL, 0)
+#define K_BRL_DOT1      K(KT_BRL, 1)
+#define K_BRL_DOT2      K(KT_BRL, 2)
+#define K_BRL_DOT3      K(KT_BRL, 3)
+#define K_BRL_DOT4      K(KT_BRL, 4)
+#define K_BRL_DOT5      K(KT_BRL, 5)
+#define K_BRL_DOT6      K(KT_BRL, 6)
+#define K_BRL_DOT7      K(KT_BRL, 7)
+#define K_BRL_DOT8      K(KT_BRL, 8)
+
+#define NR_BRL          9
+
 #define MAX_DIACR       256
 #endif
diff --git a/include/linux/leds.h b/include/linux/leds.h
index 4617e75903b0..dc23c7c639f3 100644
--- a/include/linux/leds.h
+++ b/include/linux/leds.h
@@ -19,39 +19,38 @@ struct class_device;
  */
 
 enum led_brightness {
-        LED_OFF = 0,
-        LED_HALF = 127,
-        LED_FULL = 255,
+        LED_OFF         = 0,
+        LED_HALF        = 127,
+        LED_FULL        = 255,
 };
 
 struct led_classdev {
-        const char *name;
-        int brightness;
-        int flags;
-#define LED_SUSPENDED       (1 << 0)
+        const char              *name;
+        int                      brightness;
+        int                      flags;
 
-        /* A function to set the brightness of the led */
-        void (*brightness_set)(struct led_classdev *led_cdev,
-                                enum led_brightness brightness);
+#define LED_SUSPENDED           (1 << 0)
 
-        struct class_device *class_dev;
-        /* LED Device linked list */
-        struct list_head node;
+        /* Set LED brightness level */
+        void            (*brightness_set)(struct led_classdev *led_cdev,
+                                          enum led_brightness brightness);
+
+        struct class_device     *class_dev;
+        struct list_head         node;                  /* LED Device list */
+        char                    *default_trigger;       /* Trigger to use */
 
-        /* Trigger data */
-        char *default_trigger;
 #ifdef CONFIG_LEDS_TRIGGERS
-        rwlock_t trigger_lock;
         /* Protects the trigger data below */
+        rwlock_t                 trigger_lock;
 
-        struct led_trigger *trigger;
-        struct list_head trig_list;
-        void *trigger_data;
+        struct led_trigger      *trigger;
+        struct list_head         trig_list;
+        void                    *trigger_data;
 #endif
 };
 
 extern int led_classdev_register(struct device *parent,
-                                struct led_classdev *led_cdev);
+                                 struct led_classdev *led_cdev);
 extern void led_classdev_unregister(struct led_classdev *led_cdev);
 extern void led_classdev_suspend(struct led_classdev *led_cdev);
 extern void led_classdev_resume(struct led_classdev *led_cdev);
@@ -65,16 +64,16 @@ extern void led_classdev_resume(struct led_classdev *led_cdev);
 
 struct led_trigger {
         /* Trigger Properties */
-        const char *name;
-        void (*activate)(struct led_classdev *led_cdev);
-        void (*deactivate)(struct led_classdev *led_cdev);
+        const char       *name;
+        void            (*activate)(struct led_classdev *led_cdev);
+        void            (*deactivate)(struct led_classdev *led_cdev);
 
         /* LEDs under control by this trigger (for simple triggers) */
-        rwlock_t leddev_list_lock;
-        struct list_head led_cdevs;
+        rwlock_t          leddev_list_lock;
+        struct list_head  led_cdevs;
 
         /* Link to next registered trigger */
-        struct list_head next_trig;
+        struct list_head  next_trig;
 };
 
 /* Registration functions for complex triggers */
diff --git a/include/linux/libata.h b/include/linux/libata.h
index 0d61357604d5..b80d2e7fa6d2 100644
--- a/include/linux/libata.h
+++ b/include/linux/libata.h
@@ -523,7 +523,6 @@ extern void ata_host_set_remove(struct ata_host_set *host_set);
 extern int ata_scsi_detect(struct scsi_host_template *sht);
 extern int ata_scsi_ioctl(struct scsi_device *dev, int cmd, void __user *arg);
 extern int ata_scsi_queuecmd(struct scsi_cmnd *cmd, void (*done)(struct scsi_cmnd *));
-extern int ata_scsi_error(struct Scsi_Host *host);
 extern void ata_eh_qc_complete(struct ata_queued_cmd *qc);
 extern void ata_eh_qc_retry(struct ata_queued_cmd *qc);
 extern int ata_scsi_release(struct Scsi_Host *host);
diff --git a/include/linux/libps2.h b/include/linux/libps2.h
index a710bddda4eb..08a450a9dbf7 100644
--- a/include/linux/libps2.h
+++ b/include/linux/libps2.h
@@ -28,7 +28,7 @@ struct ps2dev {
         struct serio *serio;
 
         /* Ensures that only one command is executing at a time */
-        struct semaphore cmd_sem;
+        struct mutex cmd_mutex;
 
         /* Used to signal completion from interrupt handler */
         wait_queue_head_t wait;
diff --git a/include/linux/memory_hotplug.h b/include/linux/memory_hotplug.h
index 968b1aa3732c..4ca3e6ad03ec 100644
--- a/include/linux/memory_hotplug.h
+++ b/include/linux/memory_hotplug.h
@@ -58,8 +58,6 @@ extern int add_one_highpage(struct page *page, int pfn, int bad_ppro);
 /* need some defines for these for archs that don't support it */
 extern void online_page(struct page *page);
 /* VM interface that may be used by firmware interface */
-extern int add_memory(u64 start, u64 size);
-extern int remove_memory(u64 start, u64 size);
 extern int online_pages(unsigned long, unsigned long);
 
 /* reasonably generic interface to expand the physical pages in a zone  */
@@ -92,11 +90,6 @@ static inline int mhp_notimplemented(const char *func)
         return -ENOSYS;
 }
 
-static inline int __add_pages(struct zone *zone, unsigned long start_pfn,
-        unsigned long nr_pages)
-{
-        return mhp_notimplemented(__FUNCTION__);
-}
 #endif /* ! CONFIG_MEMORY_HOTPLUG */
 static inline int __remove_pages(struct zone *zone, unsigned long start_pfn,
         unsigned long nr_pages)
@@ -105,4 +98,11 @@ static inline int __remove_pages(struct zone *zone, unsigned long start_pfn,
         dump_stack();
         return -ENOSYS;
 }
+
+#if defined(CONFIG_MEMORY_HOTPLUG) || defined(CONFIG_ACPI_HOTPLUG_MEMORY) \
+        || defined(CONFIG_ACPI_HOTPLUG_MEMORY_MODULE)
+extern int add_memory(u64 start, u64 size);
+extern int remove_memory(u64 start, u64 size);
+#endif
+
 #endif /* __LINUX_MEMORY_HOTPLUG_H */
diff --git a/include/linux/mm.h b/include/linux/mm.h
index 6aa016f1d3ae..1154684209a4 100644
--- a/include/linux/mm.h
+++ b/include/linux/mm.h
@@ -229,10 +229,9 @@ struct page {
                 unsigned long private;          /* Mapping-private opaque data:
                                                  * usually used for buffer_heads
                                                  * if PagePrivate set; used for
-                                                 * swp_entry_t if PageSwapCache.
-                                                 * When page is free, this
+                                                 * swp_entry_t if PageSwapCache;
                                                  * indicates order in the buddy
-                                                 * system.
+                                                 * system if PG_buddy is set.
                                                  */
                 struct address_space *mapping;  /* If low bit clear, points to
                                                  * inode address_space, or NULL.
diff --git a/include/linux/netfilter.h b/include/linux/netfilter.h
index 412e52ca9720..b31a9bca9361 100644
--- a/include/linux/netfilter.h
+++ b/include/linux/netfilter.h
@@ -110,6 +110,8 @@ struct nf_info
 /* Function to register/unregister hook points. */
 int nf_register_hook(struct nf_hook_ops *reg);
 void nf_unregister_hook(struct nf_hook_ops *reg);
+int nf_register_hooks(struct nf_hook_ops *reg, unsigned int n);
+void nf_unregister_hooks(struct nf_hook_ops *reg, unsigned int n);
 
 /* Functions to register get/setsockopt ranges (non-inclusive).  You
    need to check permissions yourself! */
@@ -281,16 +283,42 @@ extern void nf_invalidate_cache(int pf);
    Returns true or false. */
 extern int skb_make_writable(struct sk_buff **pskb, unsigned int writable_len);
 
-struct nf_queue_rerouter {
-        void (*save)(const struct sk_buff *skb, struct nf_info *info);
-        int (*reroute)(struct sk_buff **skb, const struct nf_info *info);
-        int rer_size;
+struct nf_afinfo {
+        unsigned short  family;
+        unsigned int    (*checksum)(struct sk_buff *skb, unsigned int hook,
+                                    unsigned int dataoff, u_int8_t protocol);
+        void            (*saveroute)(const struct sk_buff *skb,
+                                     struct nf_info *info);
+        int             (*reroute)(struct sk_buff **skb,
+                                   const struct nf_info *info);
+        int             route_key_size;
 };
 
-#define nf_info_reroute(x) ((void *)x + sizeof(struct nf_info))
+extern struct nf_afinfo *nf_afinfo[];
+static inline struct nf_afinfo *nf_get_afinfo(unsigned short family)
+{
+        return rcu_dereference(nf_afinfo[family]);
+}
+
+static inline unsigned int
+nf_checksum(struct sk_buff *skb, unsigned int hook, unsigned int dataoff,
+            u_int8_t protocol, unsigned short family)
+{
+        struct nf_afinfo *afinfo;
+        unsigned int csum = 0;
+
+        rcu_read_lock();
+        afinfo = nf_get_afinfo(family);
+        if (afinfo)
+                csum = afinfo->checksum(skb, hook, dataoff, protocol);
+        rcu_read_unlock();
+        return csum;
+}
 
-extern int nf_register_queue_rerouter(int pf, struct nf_queue_rerouter *rer);
-extern int nf_unregister_queue_rerouter(int pf);
+extern int nf_register_afinfo(struct nf_afinfo *afinfo);
+extern void nf_unregister_afinfo(struct nf_afinfo *afinfo);
+
+#define nf_info_reroute(x) ((void *)x + sizeof(struct nf_info))
 
 #include <net/flow.h>
 extern void (*ip_nat_decode_session)(struct sk_buff *, struct flowi *);
diff --git a/include/linux/netfilter/x_tables.h b/include/linux/netfilter/x_tables.h
index 1350e47b0234..f6bdef82a322 100644
--- a/include/linux/netfilter/x_tables.h
+++ b/include/linux/netfilter/x_tables.h
@@ -142,6 +142,12 @@ struct xt_counters_info
 #define ASSERT_WRITE_LOCK(x)
 #include <linux/netfilter_ipv4/listhelp.h>
 
+#ifdef CONFIG_COMPAT
+#define COMPAT_TO_USER          1
+#define COMPAT_FROM_USER        -1
+#define COMPAT_CALC_SIZE        0
+#endif
+
 struct xt_match
 {
         struct list_head list;
@@ -175,6 +181,9 @@ struct xt_match
         void (*destroy)(const struct xt_match *match, void *matchinfo,
                         unsigned int matchinfosize);
 
+        /* Called when userspace align differs from kernel space one */
+        int (*compat)(void *match, void **dstptr, int *size, int convert);
+
         /* Set this to THIS_MODULE if you are a module, otherwise NULL */
         struct module *me;
 
@@ -220,6 +229,9 @@ struct xt_target
         void (*destroy)(const struct xt_target *target, void *targinfo,
                         unsigned int targinfosize);
 
+        /* Called when userspace align differs from kernel space one */
+        int (*compat)(void *target, void **dstptr, int *size, int convert);
+
         /* Set this to THIS_MODULE if you are a module, otherwise NULL */
         struct module *me;
 
@@ -314,6 +326,61 @@ extern void xt_proto_fini(int af);
 extern struct xt_table_info *xt_alloc_table_info(unsigned int size);
 extern void xt_free_table_info(struct xt_table_info *info);
 
+#ifdef CONFIG_COMPAT
+#include <net/compat.h>
+
+struct compat_xt_entry_match
+{
+        union {
+                struct {
+                        u_int16_t match_size;
+                        char name[XT_FUNCTION_MAXNAMELEN - 1];
+                        u_int8_t revision;
+                } user;
+                u_int16_t match_size;
+        } u;
+        unsigned char data[0];
+};
+
+struct compat_xt_entry_target
+{
+        union {
+                struct {
+                        u_int16_t target_size;
+                        char name[XT_FUNCTION_MAXNAMELEN - 1];
+                        u_int8_t revision;
+                } user;
+                u_int16_t target_size;
+        } u;
+        unsigned char data[0];
+};
+
+/* FIXME: this works only on 32 bit tasks
+ * need to change whole approach in order to calculate align as function of
+ * current task alignment */
+
+struct compat_xt_counters
+{
+        u_int32_t cnt[4];
+};
+
+struct compat_xt_counters_info
+{
+        char name[XT_TABLE_MAXNAMELEN];
+        compat_uint_t num_counters;
+        struct compat_xt_counters counters[0];
+};
+
+#define COMPAT_XT_ALIGN(s) (((s) + (__alignof__(struct compat_xt_counters)-1)) \
+                & ~(__alignof__(struct compat_xt_counters)-1))
+
+extern void xt_compat_lock(int af);
+extern void xt_compat_unlock(int af);
+extern int xt_compat_match(void *match, void **dstptr, int *size, int convert);
+extern int xt_compat_target(void *target, void **dstptr, int *size,
+                int convert);
+
+#endif /* CONFIG_COMPAT */
 #endif /* __KERNEL__ */
 
 #endif /* _X_TABLES_H */
diff --git a/include/linux/netfilter/xt_esp.h b/include/linux/netfilter/xt_esp.h
new file mode 100644
index 000000000000..9380fb1c27da
--- /dev/null
+++ b/include/linux/netfilter/xt_esp.h
@@ -0,0 +1,14 @@
+#ifndef _XT_ESP_H
+#define _XT_ESP_H
+
+struct xt_esp
+{
+        u_int32_t spis[2];      /* Security Parameter Index */
+        u_int8_t  invflags;     /* Inverse flags */
+};
+
+/* Values for "invflags" field in struct xt_esp. */
+#define XT_ESP_INV_SPI  0x01    /* Invert the sense of spi. */
+#define XT_ESP_INV_MASK 0x01    /* All possible flags. */
+
+#endif /*_XT_ESP_H*/
diff --git a/include/linux/netfilter/xt_multiport.h b/include/linux/netfilter/xt_multiport.h
new file mode 100644
index 000000000000..d49ee4183710
--- /dev/null
+++ b/include/linux/netfilter/xt_multiport.h
@@ -0,0 +1,30 @@
+#ifndef _XT_MULTIPORT_H
+#define _XT_MULTIPORT_H
+
+enum xt_multiport_flags
+{
+        XT_MULTIPORT_SOURCE,
+        XT_MULTIPORT_DESTINATION,
+        XT_MULTIPORT_EITHER
+};
+
+#define XT_MULTI_PORTS  15
+
+/* Must fit inside union xt_matchinfo: 16 bytes */
+struct xt_multiport
+{
+        u_int8_t flags;                         /* Type of comparison */
+        u_int8_t count;                         /* Number of ports */
+        u_int16_t ports[XT_MULTI_PORTS];        /* Ports */
+};
+
+struct xt_multiport_v1
+{
+        u_int8_t flags;                         /* Type of comparison */
+        u_int8_t count;                         /* Number of ports */
+        u_int16_t ports[XT_MULTI_PORTS];        /* Ports */
+        u_int8_t pflags[XT_MULTI_PORTS];        /* Port flags */
+        u_int8_t invert;                        /* Invert flag */
+};
+
+#endif /*_XT_MULTIPORT_H*/
diff --git a/include/linux/netfilter_ipv4.h b/include/linux/netfilter_ipv4.h
index 43c09d790b83..85301c5e8d24 100644
--- a/include/linux/netfilter_ipv4.h
+++ b/include/linux/netfilter_ipv4.h
@@ -80,6 +80,8 @@ enum nf_ip_hook_priorities {
 #ifdef __KERNEL__
 extern int ip_route_me_harder(struct sk_buff **pskb);
 extern int ip_xfrm_me_harder(struct sk_buff **pskb);
+extern unsigned int nf_ip_checksum(struct sk_buff *skb, unsigned int hook,
+                                   unsigned int dataoff, u_int8_t protocol);
 #endif /*__KERNEL__*/
 
 #endif /*__LINUX_IP_NETFILTER_H*/
diff --git a/include/linux/netfilter_ipv4/ip_conntrack_h323.h b/include/linux/netfilter_ipv4/ip_conntrack_h323.h
index 0987cea53840..eace86bd2adb 100644
--- a/include/linux/netfilter_ipv4/ip_conntrack_h323.h
+++ b/include/linux/netfilter_ipv4/ip_conntrack_h323.h
@@ -3,6 +3,8 @@
 
 #ifdef __KERNEL__
 
+#include <linux/netfilter_ipv4/ip_conntrack_helper_h323_asn1.h>
+
 #define RAS_PORT 1719
 #define Q931_PORT 1720
 #define H323_RTP_CHANNEL_MAX 4  /* Audio, video, FAX and other */
@@ -25,6 +27,56 @@ struct ip_ct_h323_master {
         };
 };
 
+struct ip_conntrack_expect;
+
+extern int get_h225_addr(unsigned char *data, TransportAddress * addr,
+                         u_int32_t * ip, u_int16_t * port);
+extern void ip_conntrack_h245_expect(struct ip_conntrack *new,
+                                     struct ip_conntrack_expect *this);
+extern void ip_conntrack_q931_expect(struct ip_conntrack *new,
+                                     struct ip_conntrack_expect *this);
+extern int (*set_h245_addr_hook) (struct sk_buff ** pskb,
+                                  unsigned char **data, int dataoff,
+                                  H245_TransportAddress * addr,
+                                  u_int32_t ip, u_int16_t port);
+extern int (*set_h225_addr_hook) (struct sk_buff ** pskb,
+                                  unsigned char **data, int dataoff,
+                                  TransportAddress * addr,
+                                  u_int32_t ip, u_int16_t port);
+extern int (*set_sig_addr_hook) (struct sk_buff ** pskb,
+                                 struct ip_conntrack * ct,
+                                 enum ip_conntrack_info ctinfo,
+                                 unsigned char **data,
+                                 TransportAddress * addr, int count);
+extern int (*set_ras_addr_hook) (struct sk_buff ** pskb,
+                                 struct ip_conntrack * ct,
+                                 enum ip_conntrack_info ctinfo,
+                                 unsigned char **data,
+                                 TransportAddress * addr, int count);
+extern int (*nat_rtp_rtcp_hook) (struct sk_buff ** pskb,
+                                 struct ip_conntrack * ct,
+                                 enum ip_conntrack_info ctinfo,
+                                 unsigned char **data, int dataoff,
+                                 H245_TransportAddress * addr,
+                                 u_int16_t port, u_int16_t rtp_port,
+                                 struct ip_conntrack_expect * rtp_exp,
+                                 struct ip_conntrack_expect * rtcp_exp);
+extern int (*nat_t120_hook) (struct sk_buff ** pskb, struct ip_conntrack * ct,
+                             enum ip_conntrack_info ctinfo,
+                             unsigned char **data, int dataoff,
+                             H245_TransportAddress * addr, u_int16_t port,
+                             struct ip_conntrack_expect * exp);
+extern int (*nat_h245_hook) (struct sk_buff ** pskb, struct ip_conntrack * ct,
+                             enum ip_conntrack_info ctinfo,
+                             unsigned char **data, int dataoff,
+                             TransportAddress * addr, u_int16_t port,
+                             struct ip_conntrack_expect * exp);
+extern int (*nat_q931_hook) (struct sk_buff ** pskb, struct ip_conntrack * ct,
+                             enum ip_conntrack_info ctinfo,
+                             unsigned char **data, TransportAddress * addr,
+                             int idx, u_int16_t port,
+                             struct ip_conntrack_expect * exp);
+
 #endif
 
 #endif
diff --git a/net/ipv4/netfilter/ip_conntrack_helper_h323_asn1.h b/include/linux/netfilter_ipv4/ip_conntrack_helper_h323_asn1.h
index 0bd828081c0c..0bd828081c0c 100644
--- a/net/ipv4/netfilter/ip_conntrack_helper_h323_asn1.h
+++ b/include/linux/netfilter_ipv4/ip_conntrack_helper_h323_asn1.h
diff --git a/net/ipv4/netfilter/ip_conntrack_helper_h323_types.h b/include/linux/netfilter_ipv4/ip_conntrack_helper_h323_types.h
index cc98f7aa5abe..cc98f7aa5abe 100644
--- a/net/ipv4/netfilter/ip_conntrack_helper_h323_types.h
+++ b/include/linux/netfilter_ipv4/ip_conntrack_helper_h323_types.h
diff --git a/include/linux/netfilter_ipv4/ip_tables.h b/include/linux/netfilter_ipv4/ip_tables.h
index d5b8c0d6a12b..c0dac16e1902 100644
--- a/include/linux/netfilter_ipv4/ip_tables.h
+++ b/include/linux/netfilter_ipv4/ip_tables.h
@@ -316,5 +316,23 @@ extern unsigned int ipt_do_table(struct sk_buff **pskb,
                                  void *userdata);
 
 #define IPT_ALIGN(s) XT_ALIGN(s)
+
+#ifdef CONFIG_COMPAT
+#include <net/compat.h>
+
+struct compat_ipt_entry
+{
+        struct ipt_ip ip;
+        compat_uint_t nfcache;
+        u_int16_t target_offset;
+        u_int16_t next_offset;
+        compat_uint_t comefrom;
+        struct compat_xt_counters counters;
+        unsigned char elems[0];
+};
+
+#define COMPAT_IPT_ALIGN(s)     COMPAT_XT_ALIGN(s)
+
+#endif /* CONFIG_COMPAT */
 #endif /*__KERNEL__*/
 #endif /* _IPTABLES_H */
diff --git a/include/linux/netfilter_ipv4/ipt_esp.h b/include/linux/netfilter_ipv4/ipt_esp.h
index c782a83e53e0..78296e7eeff9 100644
--- a/include/linux/netfilter_ipv4/ipt_esp.h
+++ b/include/linux/netfilter_ipv4/ipt_esp.h
@@ -1,16 +1,10 @@
 #ifndef _IPT_ESP_H
 #define _IPT_ESP_H
 
-struct ipt_esp
-{
-        u_int32_t spis[2];                      /* Security Parameter Index */
-        u_int8_t  invflags;                     /* Inverse flags */
-};
+#include <linux/netfilter/xt_esp.h>
 
-
-
-/* Values for "invflags" field in struct ipt_esp. */
-#define IPT_ESP_INV_SPI         0x01    /* Invert the sense of spi. */
-#define IPT_ESP_INV_MASK        0x01    /* All possible flags. */
+#define ipt_esp xt_esp
+#define IPT_ESP_INV_SPI         XT_ESP_INV_SPI
+#define IPT_ESP_INV_MASK        XT_ESP_INV_MASK
 
 #endif /*_IPT_ESP_H*/
diff --git a/include/linux/netfilter_ipv4/ipt_multiport.h b/include/linux/netfilter_ipv4/ipt_multiport.h
index e6b6fff811df..55fe85eca88c 100644
--- a/include/linux/netfilter_ipv4/ipt_multiport.h
+++ b/include/linux/netfilter_ipv4/ipt_multiport.h
@@ -1,30 +1,15 @@
 #ifndef _IPT_MULTIPORT_H
 #define _IPT_MULTIPORT_H
-#include <linux/netfilter_ipv4/ip_tables.h>
 
-enum ipt_multiport_flags
-{
-        IPT_MULTIPORT_SOURCE,
-        IPT_MULTIPORT_DESTINATION,
-        IPT_MULTIPORT_EITHER
-};
+#include <linux/netfilter/xt_multiport.h>
 
-#define IPT_MULTI_PORTS 15
+#define IPT_MULTIPORT_SOURCE            XT_MULTIPORT_SOURCE
+#define IPT_MULTIPORT_DESTINATION       XT_MULTIPORT_DESTINATION
+#define IPT_MULTIPORT_EITHER            XT_MULTIPORT_EITHER
 
-/* Must fit inside union ipt_matchinfo: 16 bytes */
-struct ipt_multiport
-{
-        u_int8_t flags;                         /* Type of comparison */
-        u_int8_t count;                         /* Number of ports */
-        u_int16_t ports[IPT_MULTI_PORTS];       /* Ports */
-};
+#define IPT_MULTI_PORTS                 XT_MULTI_PORTS
+
+#define ipt_multiport                   xt_multiport
+#define ipt_multiport_v1                xt_multiport_v1
 
-struct ipt_multiport_v1
-{
-        u_int8_t flags;                         /* Type of comparison */
-        u_int8_t count;                         /* Number of ports */
-        u_int16_t ports[IPT_MULTI_PORTS];       /* Ports */
-        u_int8_t pflags[IPT_MULTI_PORTS];       /* Port flags */
-        u_int8_t invert;                        /* Invert flag */
-};
 #endif /*_IPT_MULTIPORT_H*/
diff --git a/include/linux/netfilter_ipv6.h b/include/linux/netfilter_ipv6.h
index 14f2bd010884..52a7b9e76428 100644
--- a/include/linux/netfilter_ipv6.h
+++ b/include/linux/netfilter_ipv6.h
@@ -73,6 +73,9 @@ enum nf_ip6_hook_priorities {
 };
 
 #ifdef CONFIG_NETFILTER
+extern unsigned int nf_ip6_checksum(struct sk_buff *skb, unsigned int hook,
+                                    unsigned int dataoff, u_int8_t protocol);
+
 extern int ipv6_netfilter_init(void);
 extern void ipv6_netfilter_fini(void);
 #else /* CONFIG_NETFILTER */
diff --git a/include/linux/netfilter_ipv6/ip6t_esp.h b/include/linux/netfilter_ipv6/ip6t_esp.h
index a91b6abc8079..f62eaf53c16c 100644
--- a/include/linux/netfilter_ipv6/ip6t_esp.h
+++ b/include/linux/netfilter_ipv6/ip6t_esp.h
@@ -1,14 +1,10 @@
 #ifndef _IP6T_ESP_H
 #define _IP6T_ESP_H
 
-struct ip6t_esp
-{
-        u_int32_t spis[2];                      /* Security Parameter Index */
-        u_int8_t  invflags;                     /* Inverse flags */
-};
+#include <linux/netfilter/xt_esp.h>
 
-/* Values for "invflags" field in struct ip6t_esp. */
-#define IP6T_ESP_INV_SPI                0x01    /* Invert the sense of spi. */
-#define IP6T_ESP_INV_MASK       0x01    /* All possible flags. */
+#define ip6t_esp xt_esp
+#define IP6T_ESP_INV_SPI        XT_ESP_INV_SPI
+#define IP6T_ESP_INV_MASK       XT_ESP_INV_MASK
 
 #endif /*_IP6T_ESP_H*/
diff --git a/include/linux/netfilter_ipv6/ip6t_multiport.h b/include/linux/netfilter_ipv6/ip6t_multiport.h
index efe4954a8681..042c92661cee 100644
--- a/include/linux/netfilter_ipv6/ip6t_multiport.h
+++ b/include/linux/netfilter_ipv6/ip6t_multiport.h
@@ -1,21 +1,14 @@
 #ifndef _IP6T_MULTIPORT_H
 #define _IP6T_MULTIPORT_H
-#include <linux/netfilter_ipv6/ip6_tables.h>
 
-enum ip6t_multiport_flags
-{
-        IP6T_MULTIPORT_SOURCE,
-        IP6T_MULTIPORT_DESTINATION,
-        IP6T_MULTIPORT_EITHER
-};
+#include <linux/netfilter/xt_multiport.h>
 
-#define IP6T_MULTI_PORTS        15
+#define IP6T_MULTIPORT_SOURCE           XT_MULTIPORT_SOURCE
+#define IP6T_MULTIPORT_DESTINATION      XT_MULTIPORT_DESTINATION
+#define IP6T_MULTIPORT_EITHER           XT_MULTIPORT_EITHER
 
-/* Must fit inside union ip6t_matchinfo: 16 bytes */
-struct ip6t_multiport
-{
-        u_int8_t flags;                         /* Type of comparison */
-        u_int8_t count;                         /* Number of ports */
-        u_int16_t ports[IP6T_MULTI_PORTS];      /* Ports */
-};
-#endif /*_IPT_MULTIPORT_H*/
+#define IP6T_MULTI_PORTS                XT_MULTI_PORTS
+
+#define ip6t_multiport                  xt_multiport
+
+#endif /*_IP6T_MULTIPORT_H*/
diff --git a/include/linux/numa.h b/include/linux/numa.h
index f0c539bd3cfc..e481feb1bfd8 100644
--- a/include/linux/numa.h
+++ b/include/linux/numa.h
@@ -3,11 +3,9 @@
 
 #include <linux/config.h>
 
-#ifndef CONFIG_FLATMEM
-#include <asm/numnodes.h>
-#endif
-
-#ifndef NODES_SHIFT
+#ifdef CONFIG_NODES_SHIFT
+#define NODES_SHIFT     CONFIG_NODES_SHIFT
+#else
 #define NODES_SHIFT     0
 #endif
 
diff --git a/include/linux/page-flags.h b/include/linux/page-flags.h
index 9ea629c02a4b..d276a4e2f825 100644
--- a/include/linux/page-flags.h
+++ b/include/linux/page-flags.h
@@ -48,8 +48,20 @@
 
 /*
  * Don't use the *_dontuse flags.  Use the macros.  Otherwise you'll break
- * locked- and dirty-page accounting.  The top eight bits of page->flags are
- * used for page->zone, so putting flag bits there doesn't work.
+ * locked- and dirty-page accounting.
+ *
+ * The page flags field is split into two parts, the main flags area
+ * which extends from the low bits upwards, and the fields area which
+ * extends from the high bits downwards.
+ *
+ *  | FIELD | ... | FLAGS |
+ *  N-1     ^             0
+ *          (N-FLAGS_RESERVED)
+ *
+ * The fields area is reserved for fields mapping zone, node and SPARSEMEM
+ * section.  The boundry between these two areas is defined by
+ * FLAGS_RESERVED which defines the width of the fields section
+ * (see linux/mmzone.h).  New flags must _not_ overlap with this area.
  */
 #define PG_locked                0      /* Page is locked. Don't touch. */
 #define PG_error                 1
@@ -74,7 +86,9 @@
 #define PG_mappedtodisk         16      /* Has blocks allocated on-disk */
 #define PG_reclaim              17      /* To be reclaimed asap */
 #define PG_nosave_free          18      /* Free, should not be written */
-#define PG_uncached             19      /* Page has been mapped as uncached */
+#define PG_buddy                19      /* Page is free, on buddy lists */
+
+#define PG_uncached             20      /* Page has been mapped as uncached */
 
 /*
  * Global page accounting.  One instance per CPU.  Only unsigned longs are
@@ -317,6 +331,10 @@ extern void __mod_page_state_offset(unsigned long offset, unsigned long delta);
 #define SetPageNosaveFree(page) set_bit(PG_nosave_free, &(page)->flags)
 #define ClearPageNosaveFree(page)               clear_bit(PG_nosave_free, &(page)->flags)
 
+#define PageBuddy(page)         test_bit(PG_buddy, &(page)->flags)
+#define __SetPageBuddy(page)    __set_bit(PG_buddy, &(page)->flags)
+#define __ClearPageBuddy(page)  __clear_bit(PG_buddy, &(page)->flags)
+
 #define PageMappedToDisk(page)  test_bit(PG_mappedtodisk, &(page)->flags)
 #define SetPageMappedToDisk(page) set_bit(PG_mappedtodisk, &(page)->flags)
 #define ClearPageMappedToDisk(page) clear_bit(PG_mappedtodisk, &(page)->flags)
diff --git a/include/linux/pipe_fs_i.h b/include/linux/pipe_fs_i.h
index 75c7f55023ab..123a7c24bc72 100644
--- a/include/linux/pipe_fs_i.h
+++ b/include/linux/pipe_fs_i.h
@@ -5,11 +5,14 @@
 
 #define PIPE_BUFFERS (16)
 
+#define PIPE_BUF_FLAG_STOLEN    0x01
+#define PIPE_BUF_FLAG_LRU       0x02
+
 struct pipe_buffer {
         struct page *page;
         unsigned int offset, len;
         struct pipe_buf_operations *ops;
-        unsigned int stolen;
+        unsigned int flags;
 };
 
 struct pipe_buf_operations {
@@ -33,32 +36,28 @@ struct pipe_inode_info {
         unsigned int w_counter;
         struct fasync_struct *fasync_readers;
         struct fasync_struct *fasync_writers;
+        struct inode *inode;
 };
 
 /* Differs from PIPE_BUF in that PIPE_SIZE is the length of the actual
    memory allocation, whereas PIPE_BUF makes atomicity guarantees.  */
 #define PIPE_SIZE               PAGE_SIZE
 
-#define PIPE_MUTEX(inode)       (&(inode).i_mutex)
-#define PIPE_WAIT(inode)        (&(inode).i_pipe->wait)
-#define PIPE_READERS(inode)     ((inode).i_pipe->readers)
-#define PIPE_WRITERS(inode)     ((inode).i_pipe->writers)
-#define PIPE_WAITING_WRITERS(inode)     ((inode).i_pipe->waiting_writers)
-#define PIPE_RCOUNTER(inode)    ((inode).i_pipe->r_counter)
-#define PIPE_WCOUNTER(inode)    ((inode).i_pipe->w_counter)
-#define PIPE_FASYNC_READERS(inode)     (&((inode).i_pipe->fasync_readers))
-#define PIPE_FASYNC_WRITERS(inode)     (&((inode).i_pipe->fasync_writers))
-
 /* Drop the inode semaphore and wait for a pipe event, atomically */
-void pipe_wait(struct inode * inode);
+void pipe_wait(struct pipe_inode_info *pipe);
 
-struct inode* pipe_new(struct inode* inode);
-void free_pipe_info(struct inode* inode);
+struct pipe_inode_info * alloc_pipe_info(struct inode * inode);
+void free_pipe_info(struct inode * inode);
+void __free_pipe_info(struct pipe_inode_info *);
 
 /*
  * splice is tied to pipes as a transport (at least for now), so we'll just
  * add the splice flags here.
  */
 #define SPLICE_F_MOVE   (0x01)  /* move pages instead of copying */
+#define SPLICE_F_NONBLOCK (0x02) /* don't block on the pipe splicing (but */
+                                 /* we may still block on the fd we splice */
+                                 /* from/to, of course */
+#define SPLICE_F_MORE   (0x04)  /* expect more data */
 
 #endif
diff --git a/include/linux/proc_fs.h b/include/linux/proc_fs.h
index 135871df9911..4b47a0253425 100644
--- a/include/linux/proc_fs.h
+++ b/include/linux/proc_fs.h
@@ -79,7 +79,7 @@ struct kcore_list {
 struct vmcore {
         struct list_head list;
         unsigned long long paddr;
-        unsigned long size;
+        unsigned long long size;
         loff_t offset;
 };
 
diff --git a/include/linux/raid/md_p.h b/include/linux/raid/md_p.h
index 774e1acfb8c4..f1fbae7e390e 100644
--- a/include/linux/raid/md_p.h
+++ b/include/linux/raid/md_p.h
@@ -227,8 +227,8 @@ struct mdp_superblock_1 {
                                  */
 
         /* These are only valid with feature bit '4' */
-        __u64   reshape_position;       /* next address in array-space for reshape */
         __u32   new_level;      /* new level we are reshaping to                */
+        __u64   reshape_position;       /* next address in array-space for reshape */
         __u32   delta_disks;    /* change in number of raid_disks               */
         __u32   new_layout;     /* new layout                                   */
         __u32   new_chunk;      /* new chunk size (bytes)                       */
diff --git a/include/linux/sched.h b/include/linux/sched.h
index 541f4828f5e7..e3539c14e47e 100644
--- a/include/linux/sched.h
+++ b/include/linux/sched.h
@@ -684,6 +684,7 @@ static inline void prefetch_stack(struct task_struct *t) { }
 
 struct audit_context;           /* See audit.c */
 struct mempolicy;
+struct pipe_inode_info;
 
 enum sleep_type {
         SLEEP_NORMAL,
@@ -882,6 +883,11 @@ struct task_struct {
 
         atomic_t fs_excl;       /* holding fs exclusive resources */
         struct rcu_head rcu;
+
+        /*
+         * cache last used pipe for splice
+         */
+        struct pipe_inode_info *splice_pipe;
 };
 
 static inline pid_t process_group(struct task_struct *tsk)
@@ -1203,9 +1209,10 @@ extern void wait_task_inactive(task_t * p);
 #define while_each_thread(g, t) \
         while ((t = next_thread(t)) != g)
 
-#define thread_group_leader(p)  (p->pid == p->tgid)
+/* de_thread depends on thread_group_leader not being a pid based check */
+#define thread_group_leader(p)  (p == p->group_leader)
 
-static inline task_t *next_thread(task_t *p)
+static inline task_t *next_thread(const task_t *p)
 {
         return list_entry(rcu_dereference(p->thread_group.next),
                                 task_t, thread_group);
diff --git a/include/linux/screen_info.h b/include/linux/screen_info.h
index 6336987dae62..2925e66a6732 100644
--- a/include/linux/screen_info.h
+++ b/include/linux/screen_info.h
@@ -41,7 +41,8 @@ struct screen_info {
         u16 vesapm_off;         /* 0x30 */
         u16 pages;              /* 0x32 */
         u16 vesa_attributes;    /* 0x34 */
-                                /* 0x36 -- 0x3f reserved for future expansion */
+        u32 capabilities;       /* 0x36 */
+                                /* 0x3a -- 0x3f reserved for future expansion */
 };
 
 extern struct screen_info screen_info;
diff --git a/include/linux/seqlock.h b/include/linux/seqlock.h
index fca9b0fb5b4e..5a095572881d 100644
--- a/include/linux/seqlock.h
+++ b/include/linux/seqlock.h
@@ -73,7 +73,7 @@ static inline int write_tryseqlock(seqlock_t *sl)
 }
 
 /* Start of read calculation -- fetch last complete writer token */
-static inline unsigned read_seqbegin(const seqlock_t *sl)
+static __always_inline unsigned read_seqbegin(const seqlock_t *sl)
 {
         unsigned ret = sl->sequence;
         smp_rmb();
@@ -88,7 +88,7 @@ static inline unsigned read_seqbegin(const seqlock_t *sl)
  *    
  * Using xor saves one conditional branch.
  */
-static inline int read_seqretry(const seqlock_t *sl, unsigned iv)
+static __always_inline int read_seqretry(const seqlock_t *sl, unsigned iv)
 {
         smp_rmb();
         return (iv & 1) | (sl->sequence ^ iv);
diff --git a/include/linux/serio.h b/include/linux/serio.h
index 690aabca8ed0..6348e8330897 100644
--- a/include/linux/serio.h
+++ b/include/linux/serio.h
@@ -18,6 +18,7 @@
 #include <linux/interrupt.h>
 #include <linux/list.h>
 #include <linux/spinlock.h>
+#include <linux/mutex.h>
 #include <linux/device.h>
 #include <linux/mod_devicetable.h>
 
@@ -42,7 +43,7 @@ struct serio {
         struct serio *parent, *child;
 
         struct serio_driver *drv;       /* accessed from interrupt, must be protected by serio->lock and serio->sem */
-        struct semaphore drv_sem;       /* protects serio->drv so attributes can pin driver */
+        struct mutex drv_mutex;         /* protects serio->drv so attributes can pin driver */
 
         struct device dev;
         unsigned int registered;        /* port has been fully registered with driver core */
@@ -151,17 +152,17 @@ static inline void serio_continue_rx(struct serio *serio)
  */
 static inline int serio_pin_driver(struct serio *serio)
 {
-        return down_interruptible(&serio->drv_sem);
+        return mutex_lock_interruptible(&serio->drv_mutex);
 }
 
 static inline void serio_pin_driver_uninterruptible(struct serio *serio)
 {
-        down(&serio->drv_sem);
+        mutex_lock(&serio->drv_mutex);
 }
 
 static inline void serio_unpin_driver(struct serio *serio)
 {
-        up(&serio->drv_sem);
+        mutex_unlock(&serio->drv_mutex);
 }
 
 
diff --git a/include/linux/string.h b/include/linux/string.h
index dee221429ad0..c61306da8c52 100644
--- a/include/linux/string.h
+++ b/include/linux/string.h
@@ -13,11 +13,6 @@
 extern "C" {
 #endif
 
-extern char * strpbrk(const char *,const char *);
-extern char * strsep(char **,const char *);
-extern __kernel_size_t strspn(const char *,const char *);
-extern __kernel_size_t strcspn(const char *,const char *);
-
 extern char *strndup_user(const char __user *, long);
 
 /*
@@ -70,6 +65,18 @@ extern __kernel_size_t strlen(const char *);
 #ifndef __HAVE_ARCH_STRNLEN
 extern __kernel_size_t strnlen(const char *,__kernel_size_t);
 #endif
+#ifndef __HAVE_ARCH_STRPBRK
+extern char * strpbrk(const char *,const char *);
+#endif
+#ifndef __HAVE_ARCH_STRSEP
+extern char * strsep(char **,const char *);
+#endif
+#ifndef __HAVE_ARCH_STRSPN
+extern __kernel_size_t strspn(const char *,const char *);
+#endif
+#ifndef __HAVE_ARCH_STRCSPN
+extern __kernel_size_t strcspn(const char *,const char *);
+#endif
 
 #ifndef __HAVE_ARCH_MEMSET
 extern void * memset(void *,int,__kernel_size_t);
diff --git a/include/linux/sunrpc/svc.h b/include/linux/sunrpc/svc.h
index 50cab2a09f28..503564384545 100644
--- a/include/linux/sunrpc/svc.h
+++ b/include/linux/sunrpc/svc.h
@@ -197,15 +197,16 @@ svc_take_res_page(struct svc_rqst *rqstp)
         return rqstp->rq_respages[rqstp->rq_resused++];
 }
 
-static inline int svc_take_page(struct svc_rqst *rqstp)
+static inline void svc_take_page(struct svc_rqst *rqstp)
 {
-        if (rqstp->rq_arghi <= rqstp->rq_argused)
-                return -ENOMEM;
+        if (rqstp->rq_arghi <= rqstp->rq_argused) {
+                WARN_ON(1);
+                return;
+        }
         rqstp->rq_arghi--;
         rqstp->rq_respages[rqstp->rq_resused] =
                 rqstp->rq_argpages[rqstp->rq_arghi];
         rqstp->rq_resused++;
-        return 0;
 }
 
 static inline void svc_pushback_allpages(struct svc_rqst *rqstp)
diff --git a/include/linux/swap.h b/include/linux/swap.h
index 54eac8a39a4c..5b1fdf1cff4f 100644
--- a/include/linux/swap.h
+++ b/include/linux/swap.h
@@ -155,6 +155,7 @@ extern void swapin_readahead(swp_entry_t, unsigned long, struct vm_area_struct *
 /* linux/mm/page_alloc.c */
 extern unsigned long totalram_pages;
 extern unsigned long totalhigh_pages;
+extern unsigned long totalreserve_pages;
 extern long nr_swap_pages;
 extern unsigned int nr_free_pages(void);
 extern unsigned int nr_free_pages_pgdat(pg_data_t *pgdat);
diff --git a/include/linux/syscalls.h b/include/linux/syscalls.h
index 5717147596b6..f001bad28d9a 100644
--- a/include/linux/syscalls.h
+++ b/include/linux/syscalls.h
@@ -569,9 +569,12 @@ asmlinkage long compat_sys_newfstatat(unsigned int dfd, char __user * filename,
 asmlinkage long compat_sys_openat(unsigned int dfd, const char __user *filename,
                                    int flags, int mode);
 asmlinkage long sys_unshare(unsigned long unshare_flags);
-asmlinkage long sys_splice(int fdin, int fdout, size_t len,
-                                unsigned int flags);
+
+asmlinkage long sys_splice(int fd_in, loff_t __user *off_in,
+                           int fd_out, loff_t __user *off_out,
+                           size_t len, unsigned int flags);
+
 asmlinkage long sys_sync_file_range(int fd, loff_t offset, loff_t nbytes,
-                                        int flags);
+                                        unsigned int flags);
 
 #endif
diff --git a/include/linux/tty_flip.h b/include/linux/tty_flip.h
index 0976a163b459..31548303ee37 100644
--- a/include/linux/tty_flip.h
+++ b/include/linux/tty_flip.h
@@ -6,9 +6,10 @@ extern int tty_insert_flip_string(struct tty_struct *tty, const unsigned char *c
 extern int tty_insert_flip_string_flags(struct tty_struct *tty, const unsigned char *chars, const char *flags, size_t size);
 extern int tty_prepare_flip_string(struct tty_struct *tty, unsigned char **chars, size_t size);
 extern int tty_prepare_flip_string_flags(struct tty_struct *tty, unsigned char **chars, char **flags, size_t size);
+void tty_schedule_flip(struct tty_struct *tty);
 
 static inline int tty_insert_flip_char(struct tty_struct *tty,
-                                       unsigned char ch, char flag)
+                                        unsigned char ch, char flag)
 {
         struct tty_buffer *tb = tty->buf.tail;
         if (tb && tb->active && tb->used < tb->size) {
@@ -19,26 +20,4 @@ static inline int tty_insert_flip_char(struct tty_struct *tty,
         return tty_insert_flip_string_flags(tty, &ch, &flag, 1);
 }
 
-static inline void tty_schedule_flip(struct tty_struct *tty)
-{
-        unsigned long flags;
-        spin_lock_irqsave(&tty->buf.lock, flags);
-        if (tty->buf.tail != NULL) {
-                tty->buf.tail->active = 0;
-                tty->buf.tail->commit = tty->buf.tail->used;
-        }
-        spin_unlock_irqrestore(&tty->buf.lock, flags);
-        schedule_delayed_work(&tty->buf.work, 1);
-}
-
-#undef _INLINE_
-
-
 #endif /* _LINUX_TTY_FLIP_H */
-
-
-
-
-
-
-
diff --git a/include/linux/uinput.h b/include/linux/uinput.h
index 0ff7ca68e5c5..7168302f9844 100644
--- a/include/linux/uinput.h
+++ b/include/linux/uinput.h
@@ -20,7 +20,7 @@
  * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
  *
  * Author: Aristeu Sergio Rozanski Filho <aris@cathedrallabs.org>
- * 
+ *
  * Changes/Revisions:
  *      0.2     16/10/2004 (Micah Dowty <micah@navi.cx>)
  *              - added force feedback support
@@ -51,7 +51,7 @@ struct uinput_request {
 
 struct uinput_device {
         struct input_dev        *dev;
-        struct semaphore        sem;
+        struct mutex            mutex;
         enum uinput_state       state;
         wait_queue_head_t       waitq;
         unsigned char           ready;
diff --git a/include/linux/vermagic.h b/include/linux/vermagic.h
index fadc535e2925..dc7c621e4647 100644
--- a/include/linux/vermagic.h
+++ b/include/linux/vermagic.h
@@ -12,6 +12,11 @@
 #else
 #define MODULE_VERMAGIC_PREEMPT ""
 #endif
+#ifdef CONFIG_MODULE_UNLOAD
+#define MODULE_VERMAGIC_MODULE_UNLOAD "mod_unload "
+#else
+#define MODULE_VERMAGIC_MODULE_UNLOAD ""
+#endif
 #ifndef MODULE_ARCH_VERMAGIC
 #define MODULE_ARCH_VERMAGIC ""
 #endif
@@ -19,5 +24,5 @@
 #define VERMAGIC_STRING                                                 \
         UTS_RELEASE " "                                                 \
         MODULE_VERMAGIC_SMP MODULE_VERMAGIC_PREEMPT                     \
-        MODULE_ARCH_VERMAGIC                                            \
+        MODULE_VERMAGIC_MODULE_UNLOAD MODULE_ARCH_VERMAGIC              \
         "gcc-" __stringify(__GNUC__) "." __stringify(__GNUC_MINOR__)
diff --git a/include/linux/videodev2.h b/include/linux/videodev2.h
index af2d6155d3fe..d7670ec1ec1e 100644
--- a/include/linux/videodev2.h
+++ b/include/linux/videodev2.h
@@ -966,66 +966,17 @@ struct v4l2_sliced_vbi_format
 
 /* Teletext World System Teletext
    (WST), defined on ITU-R BT.653-2 */
-#define V4L2_SLICED_TELETEXT_PAL_B      (0x000001)
-#define V4L2_SLICED_TELETEXT_PAL_C      (0x000002)
-#define V4L2_SLICED_TELETEXT_NTSC_B     (0x000010)
-#define V4L2_SLICED_TELETEXT_SECAM      (0x000020)
-
-/* Teletext North American Broadcast Teletext Specification
-   (NABTS), defined on ITU-R BT.653-2 */
-#define V4L2_SLICED_TELETEXT_NTSC_C     (0x000040)
-#define V4L2_SLICED_TELETEXT_NTSC_D     (0x000080)
-
+#define V4L2_SLICED_TELETEXT_B          (0x0001)
 /* Video Program System, defined on ETS 300 231*/
-#define V4L2_SLICED_VPS                 (0x000400)
-
+#define V4L2_SLICED_VPS                 (0x0400)
 /* Closed Caption, defined on EIA-608 */
-#define V4L2_SLICED_CAPTION_525         (0x001000)
-#define V4L2_SLICED_CAPTION_625         (0x002000)
-
+#define V4L2_SLICED_CAPTION_525         (0x1000)
 /* Wide Screen System, defined on ITU-R BT1119.1 */
-#define V4L2_SLICED_WSS_625             (0x004000)
-
-/* Wide Screen System, defined on IEC 61880 */
-#define V4L2_SLICED_WSS_525             (0x008000)
-
-/* Vertical Interval Timecode (VITC), defined on SMPTE 12M */
-#define V4l2_SLICED_VITC_625            (0x010000)
-#define V4l2_SLICED_VITC_525            (0x020000)
-
-#define V4L2_SLICED_TELETEXT_B          (V4L2_SLICED_TELETEXT_PAL_B  |\
-                                         V4L2_SLICED_TELETEXT_NTSC_B)
-
-#define V4L2_SLICED_TELETEXT            (V4L2_SLICED_TELETEXT_PAL_B  |\
-                                         V4L2_SLICED_TELETEXT_PAL_C  |\
-                                         V4L2_SLICED_TELETEXT_SECAM  |\
-                                         V4L2_SLICED_TELETEXT_NTSC_B |\
-                                         V4L2_SLICED_TELETEXT_NTSC_C |\
-                                         V4L2_SLICED_TELETEXT_NTSC_D)
-
-#define V4L2_SLICED_CAPTION             (V4L2_SLICED_CAPTION_525     |\
-                                         V4L2_SLICED_CAPTION_625)
-
-#define V4L2_SLICED_WSS                 (V4L2_SLICED_WSS_525         |\
-                                         V4L2_SLICED_WSS_625)
-
-#define V4L2_SLICED_VITC                (V4L2_SLICED_VITC_525        |\
-                                         V4L2_SLICED_VITC_625)
-
-#define V4L2_SLICED_VBI_525             (V4L2_SLICED_TELETEXT_NTSC_B |\
-                                         V4L2_SLICED_TELETEXT_NTSC_C |\
-                                         V4L2_SLICED_TELETEXT_NTSC_D |\
-                                         V4L2_SLICED_CAPTION_525     |\
-                                         V4L2_SLICED_WSS_525         |\
-                                         V4l2_SLICED_VITC_525)
-
-#define V4L2_SLICED_VBI_625             (V4L2_SLICED_TELETEXT_PAL_B  |\
-                                         V4L2_SLICED_TELETEXT_PAL_C  |\
-                                         V4L2_SLICED_TELETEXT_SECAM  |\
-                                         V4L2_SLICED_VPS             |\
-                                         V4L2_SLICED_CAPTION_625     |\
-                                         V4L2_SLICED_WSS_625         |\
-                                         V4l2_SLICED_VITC_625)
+#define V4L2_SLICED_WSS_625             (0x4000)
+
+#define V4L2_SLICED_VBI_525             (V4L2_SLICED_CAPTION_525)
+#define V4L2_SLICED_VBI_625             (V4L2_SLICED_TELETEXT_B | V4L2_SLICED_VPS | V4L2_SLICED_WSS_625)
+
 
 struct v4l2_sliced_vbi_cap
 {
diff --git a/include/media/cx25840.h b/include/media/cx25840.h
new file mode 100644
index 000000000000..8e7e52d659a0
--- /dev/null
+++ b/include/media/cx25840.h
@@ -0,0 +1,64 @@
+/*
+    cx25840.h - definition for cx25840/1/2/3 inputs
+
+    Copyright (C) 2006 Hans Verkuil (hverkuil@xs4all.nl)
+
+    This program is free software; you can redistribute it and/or modify
+    it under the terms of the GNU General Public License as published by
+    the Free Software Foundation; either version 2 of the License, or
+    (at your option) any later version.
+
+    This program is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+    GNU General Public License for more details.
+
+    You should have received a copy of the GNU General Public License
+    along with this program; if not, write to the Free Software
+    Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
+*/
+
+#ifndef _CX25840_H_
+#define _CX25840_H_
+
+enum cx25840_video_input {
+        /* Composite video inputs In1-In8 */
+        CX25840_COMPOSITE1 = 1,
+        CX25840_COMPOSITE2,
+        CX25840_COMPOSITE3,
+        CX25840_COMPOSITE4,
+        CX25840_COMPOSITE5,
+        CX25840_COMPOSITE6,
+        CX25840_COMPOSITE7,
+        CX25840_COMPOSITE8,
+
+        /* S-Video inputs consist of one luma input (In1-In4) ORed with one
+           chroma input (In5-In8) */
+        CX25840_SVIDEO_LUMA1 = 0x10,
+        CX25840_SVIDEO_LUMA2 = 0x20,
+        CX25840_SVIDEO_LUMA3 = 0x30,
+        CX25840_SVIDEO_LUMA4 = 0x40,
+        CX25840_SVIDEO_CHROMA4 = 0x400,
+        CX25840_SVIDEO_CHROMA5 = 0x500,
+        CX25840_SVIDEO_CHROMA6 = 0x600,
+        CX25840_SVIDEO_CHROMA7 = 0x700,
+        CX25840_SVIDEO_CHROMA8 = 0x800,
+
+        /* S-Video aliases for common luma/chroma combinations */
+        CX25840_SVIDEO1 = 0x510,
+        CX25840_SVIDEO2 = 0x620,
+        CX25840_SVIDEO3 = 0x730,
+        CX25840_SVIDEO4 = 0x840,
+};
+
+enum cx25840_audio_input {
+        /* Audio inputs: serial or In4-In8 */
+        CX25840_AUDIO_SERIAL,
+        CX25840_AUDIO4 = 4,
+        CX25840_AUDIO5,
+        CX25840_AUDIO6,
+        CX25840_AUDIO7,
+        CX25840_AUDIO8,
+};
+
+#endif
diff --git a/include/media/msp3400.h b/include/media/msp3400.h
index 0be61a021d45..6ab854931c05 100644
--- a/include/media/msp3400.h
+++ b/include/media/msp3400.h
@@ -80,16 +80,16 @@
  */
 
 /* SCART input to DSP selection */
-#define MSP_IN_SCART_1          0  /* Pin SC1_IN */
-#define MSP_IN_SCART_2          1  /* Pin SC2_IN */
-#define MSP_IN_SCART_3          2  /* Pin SC3_IN */
-#define MSP_IN_SCART_4          3  /* Pin SC4_IN */
+#define MSP_IN_SCART1           0  /* Pin SC1_IN */
+#define MSP_IN_SCART2           1  /* Pin SC2_IN */
+#define MSP_IN_SCART3           2  /* Pin SC3_IN */
+#define MSP_IN_SCART4           3  /* Pin SC4_IN */
 #define MSP_IN_MONO             6  /* Pin MONO_IN */
 #define MSP_IN_MUTE             7  /* Mute DSP input */
 #define MSP_SCART_TO_DSP(in)    (in)
 /* Tuner input to demodulator and DSP selection */
-#define MSP_IN_TUNER_1          0  /* Analog Sound IF input pin ANA_IN1 */
-#define MSP_IN_TUNER_2          1  /* Analog Sound IF input pin ANA_IN2 */
+#define MSP_IN_TUNER1           0  /* Analog Sound IF input pin ANA_IN1 */
+#define MSP_IN_TUNER2           1  /* Analog Sound IF input pin ANA_IN2 */
 #define MSP_TUNER_TO_DSP(in)    ((in) << 3)
 
 /* The msp has up to 5 DSP outputs, each output can independently select
@@ -109,14 +109,14 @@
    DSP. This is currently not implemented. Also not implemented is the
    multi-channel capable I2S3 input of the 44x0G. If someone can demonstrate
    a need for one of those features then additional support can be added. */
-#define MSP_DSP_OUT_TUNER       0  /* Tuner output */
-#define MSP_DSP_OUT_SCART       2  /* SCART output */
-#define MSP_DSP_OUT_I2S1        5  /* I2S1 output */
-#define MSP_DSP_OUT_I2S2        6  /* I2S2 output */
-#define MSP_DSP_OUT_I2S3        7  /* I2S3 output */
-#define MSP_DSP_OUT_MAIN_AVC    11 /* MAIN AVC processed output */
-#define MSP_DSP_OUT_MAIN        12 /* MAIN output */
-#define MSP_DSP_OUT_AUX         13 /* AUX output */
+#define MSP_DSP_IN_TUNER        0  /* Tuner DSP input */
+#define MSP_DSP_IN_SCART        2  /* SCART DSP input */
+#define MSP_DSP_IN_I2S1         5  /* I2S1 DSP input */
+#define MSP_DSP_IN_I2S2         6  /* I2S2 DSP input */
+#define MSP_DSP_IN_I2S3         7  /* I2S3 DSP input */
+#define MSP_DSP_IN_MAIN_AVC     11 /* MAIN AVC processed DSP input */
+#define MSP_DSP_IN_MAIN         12 /* MAIN DSP input */
+#define MSP_DSP_IN_AUX          13 /* AUX DSP input */
 #define MSP_DSP_TO_MAIN(in)     ((in) << 4)
 #define MSP_DSP_TO_AUX(in)      ((in) << 8)
 #define MSP_DSP_TO_SCART1(in)   ((in) << 12)
@@ -125,16 +125,16 @@
 
 /* Output SCART select: the SCART outputs can select which input
    to use. */
-#define MSP_OUT_SCART1          0  /* SCART1 input, bypassing the DSP */
-#define MSP_OUT_SCART2          1  /* SCART2 input, bypassing the DSP */
-#define MSP_OUT_SCART3          2  /* SCART3 input, bypassing the DSP */
-#define MSP_OUT_SCART4          3  /* SCART4 input, bypassing the DSP */
-#define MSP_OUT_SCART1_DA       4  /* DSP SCART1 output */
-#define MSP_OUT_SCART2_DA       5  /* DSP SCART2 output */
-#define MSP_OUT_MONO            6  /* MONO input, bypassing the DSP */
-#define MSP_OUT_MUTE            7  /* MUTE output */
-#define MSP_OUT_TO_SCART1(in)           (in)
-#define MSP_OUT_TO_SCART2(in)           ((in) << 4)
+#define MSP_SC_IN_SCART1        0  /* SCART1 input, bypassing the DSP */
+#define MSP_SC_IN_SCART2        1  /* SCART2 input, bypassing the DSP */
+#define MSP_SC_IN_SCART3        2  /* SCART3 input, bypassing the DSP */
+#define MSP_SC_IN_SCART4        3  /* SCART4 input, bypassing the DSP */
+#define MSP_SC_IN_DSP_SCART1    4  /* DSP SCART1 input */
+#define MSP_SC_IN_DSP_SCART2    5  /* DSP SCART2 input */
+#define MSP_SC_IN_MONO          6  /* MONO input, bypassing the DSP */
+#define MSP_SC_IN_MUTE          7  /* MUTE output */
+#define MSP_SC_TO_SCART1(in)    (in)
+#define MSP_SC_TO_SCART2(in)    ((in) << 4)
 
 /* Shortcut macros */
 #define MSP_INPUT(sc, t, main_aux_src, sc_i2s_src) \
@@ -145,14 +145,14 @@
          MSP_DSP_TO_SCART1(sc_i2s_src) | \
          MSP_DSP_TO_SCART2(sc_i2s_src) | \
          MSP_DSP_TO_I2S(sc_i2s_src))
-#define MSP_INPUT_DEFAULT MSP_INPUT(MSP_IN_SCART_1, MSP_IN_TUNER_1, \
-                                    MSP_DSP_OUT_TUNER, MSP_DSP_OUT_TUNER)
+#define MSP_INPUT_DEFAULT MSP_INPUT(MSP_IN_SCART1, MSP_IN_TUNER1, \
+                                    MSP_DSP_IN_TUNER, MSP_DSP_IN_TUNER)
 #define MSP_OUTPUT(sc) \
-        (MSP_OUT_TO_SCART1(sc) | \
-         MSP_OUT_TO_SCART2(sc))
+        (MSP_SC_TO_SCART1(sc) | \
+         MSP_SC_TO_SCART2(sc))
 /* This equals the RESET position of the msp3400 ACB register */
-#define MSP_OUTPUT_DEFAULT (MSP_OUT_TO_SCART1(MSP_OUT_SCART3) | \
-                            MSP_OUT_TO_SCART2(MSP_OUT_SCART1_DA))
+#define MSP_OUTPUT_DEFAULT (MSP_SC_TO_SCART1(MSP_SC_IN_SCART3) | \
+                            MSP_SC_TO_SCART2(MSP_SC_IN_DSP_SCART1))
 
 /* Tuner inputs vs. msp version */
 /* Chip      TUNER_1   TUNER_2
diff --git a/include/media/saa7115.h b/include/media/saa7115.h
new file mode 100644
index 000000000000..6b4836f3f057
--- /dev/null
+++ b/include/media/saa7115.h
@@ -0,0 +1,37 @@
+/*
+    saa7115.h - definition for saa7113/4/5 inputs
+
+    Copyright (C) 2006 Hans Verkuil (hverkuil@xs4all.nl)
+
+    This program is free software; you can redistribute it and/or modify
+    it under the terms of the GNU General Public License as published by
+    the Free Software Foundation; either version 2 of the License, or
+    (at your option) any later version.
+
+    This program is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+    GNU General Public License for more details.
+
+    You should have received a copy of the GNU General Public License
+    along with this program; if not, write to the Free Software
+    Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
+*/
+
+#ifndef _SAA7115_H_
+#define _SAA7115_H_
+
+/* SAA7113/4/5 HW inputs */
+#define SAA7115_COMPOSITE0 0
+#define SAA7115_COMPOSITE1 1
+#define SAA7115_COMPOSITE2 2
+#define SAA7115_COMPOSITE3 3
+#define SAA7115_COMPOSITE4 4 /* not available for the saa7113 */
+#define SAA7115_COMPOSITE5 5 /* not available for the saa7113 */
+#define SAA7115_SVIDEO0    6
+#define SAA7115_SVIDEO1    7
+#define SAA7115_SVIDEO2    8
+#define SAA7115_SVIDEO3    9
+
+#endif
+
diff --git a/include/media/saa7127.h b/include/media/saa7127.h
new file mode 100644
index 000000000000..bbcf862141af
--- /dev/null
+++ b/include/media/saa7127.h
@@ -0,0 +1,41 @@
+/*
+    saa7127.h - definition for saa7126/7/8/9 inputs/outputs
+
+    Copyright (C) 2006 Hans Verkuil (hverkuil@xs4all.nl)
+
+    This program is free software; you can redistribute it and/or modify
+    it under the terms of the GNU General Public License as published by
+    the Free Software Foundation; either version 2 of the License, or
+    (at your option) any later version.
+
+    This program is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+    GNU General Public License for more details.
+
+    You should have received a copy of the GNU General Public License
+    along with this program; if not, write to the Free Software
+    Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
+*/
+
+#ifndef _SAA7127_H_
+#define _SAA7127_H_
+
+/* Enumeration for the supported input types */
+enum saa7127_input_type {
+        SAA7127_INPUT_TYPE_NORMAL,
+        SAA7127_INPUT_TYPE_TEST_IMAGE
+};
+
+/* Enumeration for the supported output signal types */
+enum saa7127_output_type {
+        SAA7127_OUTPUT_TYPE_BOTH,
+        SAA7127_OUTPUT_TYPE_COMPOSITE,
+        SAA7127_OUTPUT_TYPE_SVIDEO,
+        SAA7127_OUTPUT_TYPE_RGB,
+        SAA7127_OUTPUT_TYPE_YUV_C,
+        SAA7127_OUTPUT_TYPE_YUV_V
+};
+
+#endif
+
diff --git a/include/media/upd64031a.h b/include/media/upd64031a.h
new file mode 100644
index 000000000000..3ad6a32e1bce
--- /dev/null
+++ b/include/media/upd64031a.h
@@ -0,0 +1,40 @@
+/*
+ * upd64031a - NEC Electronics Ghost Reduction input defines
+ *
+ * 2006 by Hans Verkuil (hverkuil@xs4all.nl)
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * as published by the Free Software Foundation; either version 2
+ * of the License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+ */
+
+#ifndef _UPD64031A_H_
+#define _UPD64031A_H_
+
+/* Ghost reduction modes */
+#define UPD64031A_GR_ON         0
+#define UPD64031A_GR_OFF        1
+#define UPD64031A_GR_THROUGH    3
+
+/* Direct 3D/YCS Connection */
+#define UPD64031A_3DYCS_DISABLE   (0 << 2)
+#define UPD64031A_3DYCS_COMPOSITE (2 << 2)
+#define UPD64031A_3DYCS_SVIDEO    (3 << 2)
+
+/* Composite sync digital separation circuit */
+#define UPD64031A_COMPOSITE_EXTERNAL (1 << 4)
+
+/* Vertical sync digital separation circuit */
+#define UPD64031A_VERTICAL_EXTERNAL (1 << 5)
+
+#endif
diff --git a/include/media/upd64083.h b/include/media/upd64083.h
new file mode 100644
index 000000000000..59b6f32ba300
--- /dev/null
+++ b/include/media/upd64083.h
@@ -0,0 +1,58 @@
+/*
+ * upd6408x - NEC Electronics 3-Dimensional Y/C separation input defines
+ *
+ * 2006 by Hans Verkuil (hverkuil@xs4all.nl)
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * as published by the Free Software Foundation; either version 2
+ * of the License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+ */
+
+#ifndef _UPD64083_H_
+#define _UPD64083_H_
+
+/* There are two bits of information that the driver needs in order
+   to select the correct routing: the operating mode and the selection
+   of the Y input (external or internal).
+
+   The first two operating modes expect a composite signal on the Y input,
+   the second two operating modes use both the Y and C inputs.
+
+   Normally YCS_MODE is used for tuner and composite inputs, and the
+   YCNR mode is used for S-Video inputs.
+
+   The external Y-ADC is selected when the composite input comes from a
+   upd64031a ghost reduction device. If this device is not present, or
+   the input is a S-Video signal, then the internal Y-ADC input should
+   be used. */
+
+/* Operating modes: */
+
+/* YCS mode: Y/C separation (burst locked clocking) */
+#define UPD64083_YCS_MODE      0
+/* YCS+ mode: 2D Y/C separation and YCNR (burst locked clocking) */
+#define UPD64083_YCS_PLUS_MODE 1
+
+/* Note: the following two modes cannot be used in combination with the
+   external Y-ADC. */
+/* MNNR mode: frame comb type YNR+C delay (line locked clocking) */
+#define UPD64083_MNNR_MODE     2
+/* YCNR mode: frame recursive YCNR (burst locked clocking) */
+#define UPD64083_YCNR_MODE     3
+
+/* Select external Y-ADC: this should be set if this device is used in
+   combination with the upd64031a ghost reduction device.
+   Otherwise leave at 0 (use internal Y-ADC). */
+#define UPD64083_EXT_Y_ADC     (1 << 2)
+
+#endif
diff --git a/include/net/inet6_hashtables.h b/include/net/inet6_hashtables.h
index 25f708ff020e..59f0c83d55a2 100644
--- a/include/net/inet6_hashtables.h
+++ b/include/net/inet6_hashtables.h
@@ -48,31 +48,7 @@ static inline int inet6_sk_ehashfn(const struct sock *sk)
         return inet6_ehashfn(laddr, lport, faddr, fport);
 }
 
-static inline void __inet6_hash(struct inet_hashinfo *hashinfo,
-                                struct sock *sk)
-{
-        struct hlist_head *list;
-        rwlock_t *lock;
-
-        BUG_TRAP(sk_unhashed(sk));
-
-        if (sk->sk_state == TCP_LISTEN) {
-                list = &hashinfo->listening_hash[inet_sk_listen_hashfn(sk)];
-                lock = &hashinfo->lhash_lock;
-                inet_listen_wlock(hashinfo);
-        } else {
-                unsigned int hash;
-                sk->sk_hash = hash = inet6_sk_ehashfn(sk);
-                hash &= (hashinfo->ehash_size - 1);
-                list = &hashinfo->ehash[hash].chain;
-                lock = &hashinfo->ehash[hash].lock;
-                write_lock(lock);
-        }
-
-        __sk_add_node(sk, list);
-        sock_prot_inc_use(sk->sk_prot);
-        write_unlock(lock);
-}
+extern void __inet6_hash(struct inet_hashinfo *hashinfo, struct sock *sk);
 
 /*
  * Sockets in TCP_CLOSE state are _always_ taken out of the hash, so
@@ -80,52 +56,12 @@ static inline void __inet6_hash(struct inet_hashinfo *hashinfo,
  *
  * The sockhash lock must be held as a reader here.
  */
-static inline struct sock *
-                __inet6_lookup_established(struct inet_hashinfo *hashinfo,
+extern struct sock *__inet6_lookup_established(struct inet_hashinfo *hashinfo,
                                            const struct in6_addr *saddr,
                                            const u16 sport,
                                            const struct in6_addr *daddr,
                                            const u16 hnum,
-                                           const int dif)
-{
-        struct sock *sk;
-        const struct hlist_node *node;
-        const __u32 ports = INET_COMBINED_PORTS(sport, hnum);
-        /* Optimize here for direct hit, only listening connections can
-         * have wildcards anyways.
-         */
-        unsigned int hash = inet6_ehashfn(daddr, hnum, saddr, sport);
-        struct inet_ehash_bucket *head = inet_ehash_bucket(hashinfo, hash);
-
-        prefetch(head->chain.first);
-        read_lock(&head->lock);
-        sk_for_each(sk, node, &head->chain) {
-                /* For IPV6 do the cheaper port and family tests first. */
-                if (INET6_MATCH(sk, hash, saddr, daddr, ports, dif))
-                        goto hit; /* You sunk my battleship! */
-        }
-        /* Must check for a TIME_WAIT'er before going to listener hash. */
-        sk_for_each(sk, node, &(head + hashinfo->ehash_size)->chain) {
-                const struct inet_timewait_sock *tw = inet_twsk(sk);
-
-                if(*((__u32 *)&(tw->tw_dport))  == ports        &&
-                   sk->sk_family                == PF_INET6) {
-                        const struct inet6_timewait_sock *tw6 = inet6_twsk(sk);
-
-                        if (ipv6_addr_equal(&tw6->tw_v6_daddr, saddr)   &&
-                            ipv6_addr_equal(&tw6->tw_v6_rcv_saddr, daddr)       &&
-                            (!sk->sk_bound_dev_if || sk->sk_bound_dev_if == dif))
-                                goto hit;
-                }
-        }
-        read_unlock(&head->lock);
-        return NULL;
-
-hit:
-        sock_hold(sk);
-        read_unlock(&head->lock);
-        return sk;
-}
+                                           const int dif);
 
 extern struct sock *inet6_lookup_listener(struct inet_hashinfo *hashinfo,
                                           const struct in6_addr *daddr,
diff --git a/include/net/ip.h b/include/net/ip.h
index 8fe6156ca9b0..3d2e5ca62a5a 100644
--- a/include/net/ip.h
+++ b/include/net/ip.h
@@ -95,6 +95,7 @@ extern int		ip_local_deliver(struct sk_buff *skb);
 extern int              ip_mr_input(struct sk_buff *skb);
 extern int              ip_output(struct sk_buff *skb);
 extern int              ip_mc_output(struct sk_buff *skb);
+extern int              ip_fragment(struct sk_buff *skb, int (*output)(struct sk_buff *));
 extern int              ip_do_nat(struct sk_buff *skb);
 extern void             ip_send_check(struct iphdr *ip);
 extern int              ip_queue_xmit(struct sk_buff *skb, int ipfragok);
diff --git a/include/net/x25device.h b/include/net/x25device.h
index 1a318374faef..1d10c879f7e2 100644
--- a/include/net/x25device.h
+++ b/include/net/x25device.h
@@ -8,6 +8,7 @@
 static inline __be16 x25_type_trans(struct sk_buff *skb, struct net_device *dev)
 {
         skb->mac.raw = skb->data;
+        skb->dev = dev;
         skb->pkt_type = PACKET_HOST;
         
         return htons(ETH_P_X25);
diff --git a/include/net/xfrm.h b/include/net/xfrm.h
index e100291e43f4..0d5529c382e8 100644
--- a/include/net/xfrm.h
+++ b/include/net/xfrm.h
@@ -242,7 +242,6 @@ extern int xfrm_state_unregister_afinfo(struct xfrm_state_afinfo *afinfo);
 
 extern void xfrm_state_delete_tunnel(struct xfrm_state *x);
 
-struct xfrm_decap_state;
 struct xfrm_type
 {
         char                    *description;
@@ -251,7 +250,7 @@ struct xfrm_type
 
         int                     (*init_state)(struct xfrm_state *x);
         void                    (*destructor)(struct xfrm_state *);
-        int                     (*input)(struct xfrm_state *, struct xfrm_decap_state *, struct sk_buff *skb);
+        int                     (*input)(struct xfrm_state *, struct sk_buff *skb);
         int                     (*output)(struct xfrm_state *, struct sk_buff *pskb);
         /* Estimate maximal size of result of transformation of a dgram */
         u32                     (*get_max_size)(struct xfrm_state *, int size);
@@ -606,25 +605,11 @@ static inline void xfrm_dst_destroy(struct xfrm_dst *xdst)
 
 extern void xfrm_dst_ifdown(struct dst_entry *dst, struct net_device *dev);
 
-/* Decapsulation state, used by the input to store data during
- * decapsulation procedure, to be used later (during the policy
- * check
- */
-struct xfrm_decap_state {
-        char    decap_data[20];
-        __u16   decap_type;
-};   
-
-struct sec_decap_state {
-        struct xfrm_state       *xvec;
-        struct xfrm_decap_state decap;
-};
-
 struct sec_path
 {
         atomic_t                refcnt;
         int                     len;
-        struct sec_decap_state  x[XFRM_MAX_DEPTH];
+        struct xfrm_state       *xvec[XFRM_MAX_DEPTH];
 };
 
 static inline struct sec_path *
diff --git a/include/pcmcia/bulkmem.h b/include/pcmcia/bulkmem.h
index b53b78d497ba..6bc7472293b2 100644
--- a/include/pcmcia/bulkmem.h
+++ b/include/pcmcia/bulkmem.h
@@ -35,7 +35,7 @@ typedef struct region_info_t {
 #define REGION_BAR_MASK         0xe000
 #define REGION_BAR_SHIFT        13
 
-int pcmcia_get_first_region(client_handle_t handle, region_info_t *rgn);
-int pcmcia_get_next_region(client_handle_t handle, region_info_t *rgn);
+int pcmcia_get_first_region(struct pcmcia_device *handle, region_info_t *rgn);
+int pcmcia_get_next_region(struct pcmcia_device *handle, region_info_t *rgn);
 
 #endif /* _LINUX_BULKMEM_H */
diff --git a/include/pcmcia/ciscode.h b/include/pcmcia/ciscode.h
index da19c297dd65..c1da8558339a 100644
--- a/include/pcmcia/ciscode.h
+++ b/include/pcmcia/ciscode.h
@@ -1,5 +1,5 @@
 /*
- * ciscode.h -- Definitions for bulk memory services
+ * ciscode.h
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License version 2 as
@@ -122,4 +122,7 @@
 
 #define MANFID_XIRCOM                   0x0105
 
+#define MANFID_POSSIO                   0x030c
+#define PRODID_POSSIO_GCC               0x0003
+
 #endif /* _LINUX_CISCODE_H */
diff --git a/include/pcmcia/cistpl.h b/include/pcmcia/cistpl.h
index c6a069554fd7..d3bbb19caf81 100644
--- a/include/pcmcia/cistpl.h
+++ b/include/pcmcia/cistpl.h
@@ -586,12 +586,7 @@ typedef struct cisdump_t {
     cisdata_t   Data[CISTPL_MAX_CIS_SIZE];
 } cisdump_t;
 
-int pcmcia_get_first_tuple(client_handle_t handle, tuple_t *tuple);
-int pcmcia_get_next_tuple(client_handle_t handle, tuple_t *tuple);
-int pcmcia_get_tuple_data(client_handle_t handle, tuple_t *tuple);
-int pcmcia_parse_tuple(client_handle_t handle, tuple_t *tuple, cisparse_t *parse);
 
-int pcmcia_validate_cis(client_handle_t handle, cisinfo_t *info);
 int pcmcia_replace_cis(struct pcmcia_socket *s, cisdump_t *cis);
 
 /* don't use outside of PCMCIA core yet */
@@ -602,4 +597,20 @@ int pccard_parse_tuple(tuple_t *tuple, cisparse_t *parse);
 
 int pccard_validate_cis(struct pcmcia_socket *s, unsigned int function, cisinfo_t *info);
 
+/* ... but use these wrappers instead */
+#define pcmcia_get_first_tuple(p_dev, tuple) \
+                pccard_get_first_tuple(p_dev->socket, p_dev->func, tuple)
+
+#define pcmcia_get_next_tuple(p_dev, tuple) \
+                pccard_get_next_tuple(p_dev->socket, p_dev->func, tuple)
+
+#define pcmcia_get_tuple_data(p_dev, tuple) \
+                pccard_get_tuple_data(p_dev->socket, tuple)
+
+#define pcmcia_parse_tuple(p_dev, tuple, parse) \
+                pccard_parse_tuple(tuple, parse)
+
+#define pcmcia_validate_cis(p_dev, info) \
+                pccard_validate_cis(p_dev->socket, p_dev->func, info)
+
 #endif /* LINUX_CISTPL_H */
diff --git a/include/pcmcia/cs.h b/include/pcmcia/cs.h
index 52660f32663d..d5838c30d20f 100644
--- a/include/pcmcia/cs.h
+++ b/include/pcmcia/cs.h
@@ -109,17 +109,6 @@ typedef struct client_req_t {
 
 #define CLIENT_THIS_SOCKET      0x01
 
-/* For RegisterClient */
-typedef struct client_reg_t {
-    dev_info_t  *dev_info;
-    u_int       Attributes;  /* UNUSED */
-    u_int       EventMask;
-    int         (*event_handler)(event_t event, int priority,
-                                 event_callback_args_t *);
-    event_callback_args_t event_callback_args;
-    u_int       Version;
-} client_reg_t;
-
 /* ModifyConfiguration */
 typedef struct modconf_t {
     u_int       Attributes;
@@ -127,15 +116,16 @@ typedef struct modconf_t {
 } modconf_t;
 
 /* Attributes for ModifyConfiguration */
-#define CONF_IRQ_CHANGE_VALID   0x100
-#define CONF_VCC_CHANGE_VALID   0x200
-#define CONF_VPP1_CHANGE_VALID  0x400
-#define CONF_VPP2_CHANGE_VALID  0x800
+#define CONF_IRQ_CHANGE_VALID   0x0100
+#define CONF_VCC_CHANGE_VALID   0x0200
+#define CONF_VPP1_CHANGE_VALID  0x0400
+#define CONF_VPP2_CHANGE_VALID  0x0800
+#define CONF_IO_CHANGE_WIDTH    0x1000
 
 /* For RequestConfiguration */
 typedef struct config_req_t {
     u_int       Attributes;
-    u_int       Vcc, Vpp1, Vpp2;
+    u_int       Vpp; /* both Vpp1 and Vpp2 */
     u_int       IntType;
     u_int       ConfigBase;
     u_char      Status, Pin, Copy, ExtStatus;
@@ -389,23 +379,27 @@ int pcmcia_get_status(struct pcmcia_device *p_dev, cs_status_t *status);
 int pcmcia_get_mem_page(window_handle_t win, memreq_t *req);
 int pcmcia_map_mem_page(window_handle_t win, memreq_t *req);
 int pcmcia_modify_configuration(struct pcmcia_device *p_dev, modconf_t *mod);
-int pcmcia_release_configuration(struct pcmcia_device *p_dev);
-int pcmcia_release_io(struct pcmcia_device *p_dev, io_req_t *req);
-int pcmcia_release_irq(struct pcmcia_device *p_dev, irq_req_t *req);
 int pcmcia_release_window(window_handle_t win);
 int pcmcia_request_configuration(struct pcmcia_device *p_dev, config_req_t *req);
 int pcmcia_request_io(struct pcmcia_device *p_dev, io_req_t *req);
 int pcmcia_request_irq(struct pcmcia_device *p_dev, irq_req_t *req);
 int pcmcia_request_window(struct pcmcia_device **p_dev, win_req_t *req, window_handle_t *wh);
-int pcmcia_reset_card(struct pcmcia_device *p_dev, client_req_t *req);
 int pcmcia_suspend_card(struct pcmcia_socket *skt);
 int pcmcia_resume_card(struct pcmcia_socket *skt);
 int pcmcia_eject_card(struct pcmcia_socket *skt);
 int pcmcia_insert_card(struct pcmcia_socket *skt);
+int pccard_reset_card(struct pcmcia_socket *skt);
+
+struct pcmcia_device * pcmcia_dev_present(struct pcmcia_device *p_dev);
+void pcmcia_disable_device(struct pcmcia_device *p_dev);
 
 struct pcmcia_socket * pcmcia_get_socket(struct pcmcia_socket *skt);
 void pcmcia_put_socket(struct pcmcia_socket *skt);
 
+/* compatibility functions */
+#define pcmcia_reset_card(p_dev, req) \
+                pccard_reset_card(p_dev->socket)
+
 #endif /* __KERNEL__ */
 
 #endif /* _LINUX_CS_H */
diff --git a/include/pcmcia/ds.h b/include/pcmcia/ds.h
index 8e2a96396478..8c339f5678cf 100644
--- a/include/pcmcia/ds.h
+++ b/include/pcmcia/ds.h
@@ -39,7 +39,7 @@ typedef struct win_info_t {
 typedef struct bind_info_t {
     dev_info_t          dev_info;
     u_char              function;
-    struct dev_link_t   *instance;
+    struct pcmcia_device *instance;
     char                name[DEV_NAME_LEN];
     u_short             major, minor;
     void                *next;
@@ -96,6 +96,7 @@ typedef union ds_ioctl_arg_t {
 
 #ifdef __KERNEL__
 #include <linux/device.h>
+#include <pcmcia/ss.h>
 
 typedef struct dev_node_t {
     char                dev_name[DEV_NAME_LEN];
@@ -103,34 +104,9 @@ typedef struct dev_node_t {
     struct dev_node_t   *next;
 } dev_node_t;
 
-typedef struct dev_link_t {
-    dev_node_t          *dev;
-    u_int               state, open;
-    wait_queue_head_t   pending;
-    client_handle_t     handle;
-    io_req_t            io;
-    irq_req_t           irq;
-    config_req_t        conf;
-    window_handle_t     win;
-    void                *priv;
-    struct dev_link_t   *next;
-} dev_link_t;
-
-/* Flags for device state */
-#define DEV_PRESENT             0x01
-#define DEV_CONFIG              0x02
-#define DEV_STALE_CONFIG        0x04    /* release on close */
-#define DEV_STALE_LINK          0x08    /* detach on release */
-#define DEV_CONFIG_PENDING      0x10
-#define DEV_RELEASE_PENDING     0x20
-#define DEV_SUSPEND             0x40
-#define DEV_BUSY                0x80
-
-#define DEV_OK(l) \
-    ((l) && ((l->state & ~DEV_BUSY) == (DEV_CONFIG|DEV_PRESENT)))
-
 
 struct pcmcia_socket;
+struct config_t;
 
 struct pcmcia_driver {
         int (*probe)            (struct pcmcia_device *dev);
@@ -148,6 +124,7 @@ struct pcmcia_driver {
 int pcmcia_register_driver(struct pcmcia_driver *driver);
 void pcmcia_unregister_driver(struct pcmcia_driver *driver);
 
+
 struct pcmcia_device {
         /* the socket and the device_no [for multifunction devices]
            uniquely define a pcmcia_device */
@@ -160,21 +137,40 @@ struct pcmcia_device {
         /* the hardware "function" device; certain subdevices can
          * share one hardware "function" device. */
         u8                      func;
+        struct config_t*        function_config;
 
         struct list_head        socket_device_list;
 
-        /* deprecated, a cleaned up version will be moved into this
-           struct soon */
-        dev_link_t              *instance;
-        u_int                   state;
+        /* deprecated, will be cleaned up soon */
+        dev_node_t              *dev_node;
+        u_int                   open;
+        io_req_t                io;
+        irq_req_t               irq;
+        config_req_t            conf;
+        window_handle_t         win;
+
+        /* Is the device suspended, or in the process of
+         * being removed? */
+        u16                     suspended:1;
+        u16                     _removed:1;
+
+        /* Flags whether io, irq, win configurations were
+         * requested, and whether the configuration is "locked" */
+        u16                     _irq:1;
+        u16                     _io:1;
+        u16                     _win:4;
+        u16                     _locked:1;
+
+        /* Flag whether a "fuzzy" func_id based match is
+         * allowed. */
+        u16                     allow_func_id_match:1;
 
         /* information about this device */
-        u8                      has_manf_id:1;
-        u8                      has_card_id:1;
-        u8                      has_func_id:1;
+        u16                     has_manf_id:1;
+        u16                     has_card_id:1;
+        u16                     has_func_id:1;
 
-        u8                      allow_func_id_match:1;
-        u8                      reserved:4;
+        u16                     reserved:3;
 
         u8                      func_id;
         u16                     manf_id;
@@ -182,22 +178,24 @@ struct pcmcia_device {
 
         char *                  prod_id[4];
 
+        struct device           dev;
+
+#ifdef CONFIG_PCMCIA_IOCTL
         /* device driver wanted by cardmgr */
         struct pcmcia_driver *  cardmgr;
+#endif
 
-        struct device           dev;
+        /* data private to drivers */
+        void                    *priv;
 };
 
 #define to_pcmcia_dev(n) container_of(n, struct pcmcia_device, dev)
 #define to_pcmcia_drv(n) container_of(n, struct pcmcia_driver, drv)
 
-#define handle_to_pdev(handle) (handle)
 #define handle_to_dev(handle) (handle->dev)
 
-#define dev_to_instance(dev) (dev->instance)
-
 /* error reporting */
-void cs_error(client_handle_t handle, int func, int ret);
+void cs_error(struct pcmcia_device *handle, int func, int ret);
 
 #endif /* __KERNEL__ */
 #endif /* _LINUX_DS_H */
diff --git a/include/pcmcia/ss.h b/include/pcmcia/ss.h
index 2889a69a7a8f..5e0a01ab2216 100644
--- a/include/pcmcia/ss.h
+++ b/include/pcmcia/ss.h
@@ -18,6 +18,7 @@
 #include <linux/config.h>
 #include <linux/device.h>
 #include <linux/sched.h>        /* task_struct, completion */
+#include <linux/mutex.h>
 
 #include <pcmcia/cs_types.h>
 #include <pcmcia/cs.h>
@@ -146,14 +147,15 @@ extern struct pccard_resource_ops pccard_static_ops;
 /* !SS_CAP_STATIC_MAP */
 extern struct pccard_resource_ops pccard_nonstatic_ops;
 
+/* static mem, dynamic IO sockets */
+extern struct pccard_resource_ops pccard_iodyn_ops;
+
 /*
  *  Calls to set up low-level "Socket Services" drivers
  */
 struct pcmcia_socket;
 
 typedef struct io_window_t {
-        u_int                   Attributes;
-        kio_addr_t              BasePort, NumPorts;
         kio_addr_t              InUse, Config;
         struct resource         *res;
 } io_window_t;
@@ -162,7 +164,7 @@ typedef struct io_window_t {
 typedef struct window_t {
         u_short                 magic;
         u_short                 index;
-        client_handle_t         handle;
+        struct pcmcia_device    *handle;
         struct pcmcia_socket    *sock;
         pccard_mem_map          ctl;
 } window_t;
@@ -186,7 +188,6 @@ struct pcmcia_socket {
         u_short                         lock_count;
         pccard_mem_map                  cis_mem;
         void __iomem                    *cis_virt;
-        struct config_t                 *config;
         struct {
                 u_int                   AssignedIRQ;
                 u_int                   Config;
@@ -241,7 +242,7 @@ struct pcmcia_socket {
 #endif
 
         /* state thread */
-        struct semaphore                skt_sem;        /* protects socket h/w state */
+        struct mutex                    skt_mutex;      /* protects socket h/w state */
 
         struct task_struct              *thread;
         struct completion               thread_done;
diff --git a/include/scsi/scsi_host.h b/include/scsi/scsi_host.h
index dc6862d09e53..de6ce541a046 100644
--- a/include/scsi/scsi_host.h
+++ b/include/scsi/scsi_host.h
@@ -140,7 +140,6 @@ struct scsi_host_template {
          *
          * Status: REQUIRED     (at least one of them)
          */
-        int (* eh_strategy_handler)(struct Scsi_Host *);
         int (* eh_abort_handler)(struct scsi_cmnd *);
         int (* eh_device_reset_handler)(struct scsi_cmnd *);
         int (* eh_bus_reset_handler)(struct scsi_cmnd *);
diff --git a/include/scsi/scsi_transport.h b/include/scsi/scsi_transport.h
index b3657f111937..cca1d4926d2a 100644
--- a/include/scsi/scsi_transport.h
+++ b/include/scsi/scsi_transport.h
@@ -50,6 +50,11 @@ struct scsi_transport_template {
         unsigned int create_work_queue : 1;
 
         /*
+         * Allows a transport to override the default error handler.
+         */
+        void (* eh_strategy_handler)(struct Scsi_Host *);
+
+        /*
          * This is an optional routine that allows the transport to become
          * involved when a scsi io timer fires. The return value tells the
          * timer routine how to finish the io timeout handling:
diff --git a/include/sound/core.h b/include/sound/core.h
index 7f32c12b4a0a..5135147f20e8 100644
--- a/include/sound/core.h
+++ b/include/sound/core.h
@@ -170,13 +170,13 @@ static inline void snd_power_change_state(struct snd_card *card, unsigned int st
 }
 
 /* init.c */
-int snd_power_wait(struct snd_card *card, unsigned int power_state, struct file *file);
+int snd_power_wait(struct snd_card *card, unsigned int power_state);
 
 #else /* ! CONFIG_PM */
 
 #define snd_power_lock(card)            do { (void)(card); } while (0)
 #define snd_power_unlock(card)          do { (void)(card); } while (0)
-static inline int snd_power_wait(struct snd_card *card, unsigned int state, struct file *file) { return 0; }
+static inline int snd_power_wait(struct snd_card *card, unsigned int state) { return 0; }
 #define snd_power_get_state(card)       SNDRV_CTL_POWER_D0
 #define snd_power_change_state(card, state)     do { (void)(card); } while (0)
 
diff --git a/include/sound/pcm.h b/include/sound/pcm.h
index 15b885660bf0..66b1f08b42b9 100644
--- a/include/sound/pcm.h
+++ b/include/sound/pcm.h
@@ -369,6 +369,7 @@ struct snd_pcm_substream {
         /* -- assigned files -- */
         struct snd_pcm_file *file;
         struct file *ffile;
+        void (*pcm_release)(struct snd_pcm_substream *);
 #if defined(CONFIG_SND_PCM_OSS) || defined(CONFIG_SND_PCM_OSS_MODULE)
         /* -- OSS things -- */
         struct snd_pcm_oss_substream oss;
@@ -381,13 +382,10 @@ struct snd_pcm_substream {
         struct snd_info_entry *proc_prealloc_entry;
         /* misc flags */
         unsigned int no_mmap_ctrl: 1;
+        unsigned int hw_opened: 1;
 };
 
-#if defined(CONFIG_SND_PCM_OSS) || defined(CONFIG_SND_PCM_OSS_MODULE)
-#define SUBSTREAM_BUSY(substream) ((substream)->file != NULL || ((substream)->oss.file != NULL))
-#else
 #define SUBSTREAM_BUSY(substream) ((substream)->file != NULL)
-#endif
 
 
 struct snd_pcm_str {
@@ -460,7 +458,6 @@ int snd_pcm_info_user(struct snd_pcm_substream *substream,
                       struct snd_pcm_info __user *info);
 int snd_pcm_status(struct snd_pcm_substream *substream,
                    struct snd_pcm_status *status);
-int snd_pcm_prepare(struct snd_pcm_substream *substream);
 int snd_pcm_start(struct snd_pcm_substream *substream);
 int snd_pcm_stop(struct snd_pcm_substream *substream, int status);
 int snd_pcm_drain_done(struct snd_pcm_substream *substream);
@@ -468,11 +465,13 @@ int snd_pcm_drain_done(struct snd_pcm_substream *substream);
 int snd_pcm_suspend(struct snd_pcm_substream *substream);
 int snd_pcm_suspend_all(struct snd_pcm *pcm);
 #endif
-int snd_pcm_kernel_playback_ioctl(struct snd_pcm_substream *substream, unsigned int cmd, void *arg);
-int snd_pcm_kernel_capture_ioctl(struct snd_pcm_substream *substream, unsigned int cmd, void *arg);
 int snd_pcm_kernel_ioctl(struct snd_pcm_substream *substream, unsigned int cmd, void *arg);
-int snd_pcm_open_substream(struct snd_pcm *pcm, int stream, struct snd_pcm_substream **rsubstream);
+int snd_pcm_open_substream(struct snd_pcm *pcm, int stream, struct file *file,
+                           struct snd_pcm_substream **rsubstream);
 void snd_pcm_release_substream(struct snd_pcm_substream *substream);
+int snd_pcm_attach_substream(struct snd_pcm *pcm, int stream, struct file *file,
+                             struct snd_pcm_substream **rsubstream);
+void snd_pcm_detach_substream(struct snd_pcm_substream *substream);
 void snd_pcm_vma_notify_data(void *client, void *data);
 int snd_pcm_mmap_data(struct snd_pcm_substream *substream, struct file *file, struct vm_area_struct *area);
 
diff --git a/include/sound/pcm_oss.h b/include/sound/pcm_oss.h
index bff0778e1969..39df2baca18a 100644
--- a/include/sound/pcm_oss.h
+++ b/include/sound/pcm_oss.h
@@ -69,8 +69,7 @@ struct snd_pcm_oss_file {
 
 struct snd_pcm_oss_substream {
         unsigned oss: 1;                        /* oss mode */
-        struct snd_pcm_oss_setup *setup;                /* active setup */
-        struct snd_pcm_oss_file *file;
+        struct snd_pcm_oss_setup setup;         /* active setup */
 };
 
 struct snd_pcm_oss_stream {
diff --git a/init/Kconfig b/init/Kconfig
index 3b36a1d53656..f1bc2f0e94e5 100644
--- a/init/Kconfig
+++ b/init/Kconfig
@@ -374,6 +374,15 @@ config SLAB
           SLOB is more space efficient but does not scale well and is
           more susceptible to fragmentation.
 
+config DOUBLEFAULT
+        default y
+        bool "Enable doublefault exception handler" if EMBEDDED && X86_32
+        help
+          This option allows trapping of rare doublefault exceptions that
+          would otherwise cause a system to silently reboot. Disabling this
+          option saves about 4k and might cause you much additional grey
+          hair.
+
 endmenu         # General setup
 
 config TINY_SHMEM
diff --git a/ipc/shm.c b/ipc/shm.c
index f806a2e314e0..6b0c9af5bbf7 100644
--- a/ipc/shm.c
+++ b/ipc/shm.c
@@ -91,8 +91,8 @@ static inline int shm_addid(struct shmid_kernel *shp)
 static inline void shm_inc (int id) {
         struct shmid_kernel *shp;
 
-        if(!(shp = shm_lock(id)))
-                BUG();
+        shp = shm_lock(id);
+        BUG_ON(!shp);
         shp->shm_atim = get_seconds();
         shp->shm_lprid = current->tgid;
         shp->shm_nattch++;
@@ -142,8 +142,8 @@ static void shm_close (struct vm_area_struct *shmd)
 
         mutex_lock(&shm_ids.mutex);
         /* remove from the list of attaches of the shm segment */
-        if(!(shp = shm_lock(id)))
-                BUG();
+        shp = shm_lock(id);
+        BUG_ON(!shp);
         shp->shm_lprid = current->tgid;
         shp->shm_dtim = get_seconds();
         shp->shm_nattch--;
@@ -283,8 +283,7 @@ asmlinkage long sys_shmget (key_t key, size_t size, int shmflg)
                 err = -EEXIST;
         } else {
                 shp = shm_lock(id);
-                if(shp==NULL)
-                        BUG();
+                BUG_ON(shp==NULL);
                 if (shp->shm_segsz < size)
                         err = -EINVAL;
                 else if (ipcperms(&shp->shm_perm, shmflg))
@@ -774,8 +773,8 @@ invalid:
         up_write(&current->mm->mmap_sem);
 
         mutex_lock(&shm_ids.mutex);
-        if(!(shp = shm_lock(shmid)))
-                BUG();
+        shp = shm_lock(shmid);
+        BUG_ON(!shp);
         shp->shm_nattch--;
         if(shp->shm_nattch == 0 &&
            shp->shm_perm.mode & SHM_DEST)
diff --git a/ipc/util.c b/ipc/util.c
index 23151ef32590..5e785a29e1e6 100644
--- a/ipc/util.c
+++ b/ipc/util.c
@@ -266,8 +266,7 @@ struct kern_ipc_perm* ipc_rmid(struct ipc_ids* ids, int id)
 {
         struct kern_ipc_perm* p;
         int lid = id % SEQ_MULTIPLIER;
-        if(lid >= ids->entries->size)
-                BUG();
+        BUG_ON(lid >= ids->entries->size);
 
         /* 
          * do not need a rcu_dereference()() here to force ordering
@@ -275,8 +274,7 @@ struct kern_ipc_perm* ipc_rmid(struct ipc_ids* ids, int id)
          */     
         p = ids->entries->p[lid];
         ids->entries->p[lid] = NULL;
-        if(p==NULL)
-                BUG();
+        BUG_ON(p==NULL);
         ids->in_use--;
 
         if (lid == ids->max_id) {
diff --git a/kernel/exit.c b/kernel/exit.c
index 6c2eeb8f6390..1a9787ac6173 100644
--- a/kernel/exit.c
+++ b/kernel/exit.c
@@ -34,6 +34,7 @@
 #include <linux/mutex.h>
 #include <linux/futex.h>
 #include <linux/compat.h>
+#include <linux/pipe_fs_i.h>
 
 #include <asm/uaccess.h>
 #include <asm/unistd.h>
@@ -941,6 +942,9 @@ fastcall NORET_TYPE void do_exit(long code)
         if (tsk->io_context)
                 exit_io_context();
 
+        if (tsk->splice_pipe)
+                __free_pipe_info(tsk->splice_pipe);
+
         /* PF_DEAD causes final put_task_struct after we schedule. */
         preempt_disable();
         BUG_ON(tsk->flags & PF_DEAD);
diff --git a/kernel/hrtimer.c b/kernel/hrtimer.c
index f181ff4dd32e..d2a7296c8251 100644
--- a/kernel/hrtimer.c
+++ b/kernel/hrtimer.c
@@ -501,6 +501,7 @@ int hrtimer_cancel(struct hrtimer *timer)
 
                 if (ret >= 0)
                         return ret;
+                cpu_relax();
         }
 }
 
diff --git a/kernel/irq/Makefile b/kernel/irq/Makefile
index 2b33f852be3e..9f77f50d8143 100644
--- a/kernel/irq/Makefile
+++ b/kernel/irq/Makefile
@@ -1,4 +1,5 @@
 
-obj-y := handle.o manage.o spurious.o migration.o
+obj-y := handle.o manage.o spurious.o
 obj-$(CONFIG_GENERIC_IRQ_PROBE) += autoprobe.o
 obj-$(CONFIG_PROC_FS) += proc.o
+obj-$(CONFIG_GENERIC_PENDING_IRQ) += migration.o
diff --git a/kernel/irq/migration.c b/kernel/irq/migration.c
index 52a8655fa080..134f9f2e0e39 100644
--- a/kernel/irq/migration.c
+++ b/kernel/irq/migration.c
@@ -1,6 +1,5 @@
-#include <linux/irq.h>
 
-#if defined(CONFIG_GENERIC_PENDING_IRQ)
+#include <linux/irq.h>
 
 void set_pending_irq(unsigned int irq, cpumask_t mask)
 {
@@ -61,5 +60,3 @@ void move_native_irq(int irq)
         }
         cpus_clear(pending_irq_cpumask[irq]);
 }
-
-#endif
diff --git a/kernel/panic.c b/kernel/panic.c
index f895c7c01d5b..cc2a4c9c36ac 100644
--- a/kernel/panic.c
+++ b/kernel/panic.c
@@ -27,7 +27,6 @@ static int pause_on_oops_flag;
 static DEFINE_SPINLOCK(pause_on_oops_lock);
 
 int panic_timeout;
-EXPORT_SYMBOL(panic_timeout);
 
 ATOMIC_NOTIFIER_HEAD(panic_notifier_list);
 
diff --git a/kernel/power/Kconfig b/kernel/power/Kconfig
index 9fd8d4f03595..ce0dfb8f4a4e 100644
--- a/kernel/power/Kconfig
+++ b/kernel/power/Kconfig
@@ -41,7 +41,7 @@ config SOFTWARE_SUSPEND
         depends on PM && SWAP && (X86 && (!SMP || SUSPEND_SMP)) || ((FRV || PPC32) && !SMP)
         ---help---
           Enable the possibility of suspending the machine.
-          It doesn't need APM.
+          It doesn't need ACPI or APM.
           You may suspend your machine by 'swsusp' or 'shutdown -z <time>' 
           (patch for sysvinit needed). 
 
diff --git a/kernel/printk.c b/kernel/printk.c
index 8cc19431e74b..c056f3324432 100644
--- a/kernel/printk.c
+++ b/kernel/printk.c
@@ -360,8 +360,7 @@ static void call_console_drivers(unsigned long start, unsigned long end)
         unsigned long cur_index, start_print;
         static int msg_level = -1;
 
-        if (((long)(start - end)) > 0)
-                BUG();
+        BUG_ON(((long)(start - end)) > 0);
 
         cur_index = start;
         start_print = start;
@@ -708,8 +707,7 @@ int __init add_preferred_console(char *name, int idx, char *options)
  */
 void acquire_console_sem(void)
 {
-        if (in_interrupt())
-                BUG();
+        BUG_ON(in_interrupt());
         down(&console_sem);
         console_locked = 1;
         console_may_schedule = 1;
diff --git a/kernel/ptrace.c b/kernel/ptrace.c
index 86a7f6c60cb2..0eeb7e66722c 100644
--- a/kernel/ptrace.c
+++ b/kernel/ptrace.c
@@ -30,8 +30,7 @@
  */
 void __ptrace_link(task_t *child, task_t *new_parent)
 {
-        if (!list_empty(&child->ptrace_list))
-                BUG();
+        BUG_ON(!list_empty(&child->ptrace_list));
         if (child->parent == new_parent)
                 return;
         list_add(&child->ptrace_list, &child->parent->ptrace_children);
diff --git a/kernel/sched.c b/kernel/sched.c
index dd153d6f8a04..365f0b90b4de 100644
--- a/kernel/sched.c
+++ b/kernel/sched.c
@@ -665,13 +665,55 @@ static int effective_prio(task_t *p)
 }
 
 /*
+ * We place interactive tasks back into the active array, if possible.
+ *
+ * To guarantee that this does not starve expired tasks we ignore the
+ * interactivity of a task if the first expired task had to wait more
+ * than a 'reasonable' amount of time. This deadline timeout is
+ * load-dependent, as the frequency of array switched decreases with
+ * increasing number of running tasks. We also ignore the interactivity
+ * if a better static_prio task has expired, and switch periodically
+ * regardless, to ensure that highly interactive tasks do not starve
+ * the less fortunate for unreasonably long periods.
+ */
+static inline int expired_starving(runqueue_t *rq)
+{
+        int limit;
+
+        /*
+         * Arrays were recently switched, all is well
+         */
+        if (!rq->expired_timestamp)
+                return 0;
+
+        limit = STARVATION_LIMIT * rq->nr_running;
+
+        /*
+         * It's time to switch arrays
+         */
+        if (jiffies - rq->expired_timestamp >= limit)
+                return 1;
+
+        /*
+         * There's a better selection in the expired array
+         */
+        if (rq->curr->static_prio > rq->best_expired_prio)
+                return 1;
+
+        /*
+         * All is well
+         */
+        return 0;
+}
+
+/*
  * __activate_task - move a task to the runqueue.
  */
 static void __activate_task(task_t *p, runqueue_t *rq)
 {
         prio_array_t *target = rq->active;
 
-        if (batch_task(p))
+        if (unlikely(batch_task(p) || (expired_starving(rq) && !rt_task(p))))
                 target = rq->expired;
         enqueue_task(p, target);
         rq->nr_running++;
@@ -2490,22 +2532,6 @@ unsigned long long current_sched_time(const task_t *tsk)
 }
 
 /*
- * We place interactive tasks back into the active array, if possible.
- *
- * To guarantee that this does not starve expired tasks we ignore the
- * interactivity of a task if the first expired task had to wait more
- * than a 'reasonable' amount of time. This deadline timeout is
- * load-dependent, as the frequency of array switched decreases with
- * increasing number of running tasks. We also ignore the interactivity
- * if a better static_prio task has expired:
- */
-#define EXPIRED_STARVING(rq) \
-        ((STARVATION_LIMIT && ((rq)->expired_timestamp && \
-                (jiffies - (rq)->expired_timestamp >= \
-                        STARVATION_LIMIT * ((rq)->nr_running) + 1))) || \
-                        ((rq)->curr->static_prio > (rq)->best_expired_prio))
-
-/*
  * Account user cpu time to a process.
  * @p: the process that the cpu time gets accounted to
  * @hardirq_offset: the offset to subtract from hardirq_count()
@@ -2640,7 +2666,7 @@ void scheduler_tick(void)
 
                 if (!rq->expired_timestamp)
                         rq->expired_timestamp = jiffies;
-                if (!TASK_INTERACTIVE(p) || EXPIRED_STARVING(rq)) {
+                if (!TASK_INTERACTIVE(p) || expired_starving(rq)) {
                         enqueue_task(p, rq->expired);
                         if (p->static_prio < rq->best_expired_prio)
                                 rq->best_expired_prio = p->static_prio;
diff --git a/kernel/signal.c b/kernel/signal.c
index 92025b108791..b14f895027c3 100644
--- a/kernel/signal.c
+++ b/kernel/signal.c
@@ -769,8 +769,7 @@ specific_send_sig_info(int sig, struct siginfo *info, struct task_struct *t)
 {
         int ret = 0;
 
-        if (!irqs_disabled())
-                BUG();
+        BUG_ON(!irqs_disabled());
         assert_spin_locked(&t->sighand->siglock);
 
         /* Short-circuit ignored signals.  */
@@ -869,7 +868,6 @@ __group_complete_signal(int sig, struct task_struct *p)
                 if (t == NULL)
                         /* restart balancing at this thread */
                         t = p->signal->curr_target = p;
-                BUG_ON(t->tgid != p->tgid);
 
                 while (!wants_signal(sig, t)) {
                         t = next_thread(t);
@@ -1384,8 +1382,7 @@ send_group_sigqueue(int sig, struct sigqueue *q, struct task_struct *p)
                  * the overrun count.  Other uses should not try to
                  * send the signal multiple times.
                  */
-                if (q->info.si_code != SI_TIMER)
-                        BUG();
+                BUG_ON(q->info.si_code != SI_TIMER);
                 q->info.si_overrun++;
                 goto out;
         } 
diff --git a/kernel/sys_ni.c b/kernel/sys_ni.c
index d82864c4a617..5433195040f1 100644
--- a/kernel/sys_ni.c
+++ b/kernel/sys_ni.c
@@ -120,3 +120,15 @@ cond_syscall(sys32_sysctl);
 cond_syscall(ppc_rtas);
 cond_syscall(sys_spu_run);
 cond_syscall(sys_spu_create);
+
+/* mmu depending weak syscall entries */
+cond_syscall(sys_mprotect);
+cond_syscall(sys_msync);
+cond_syscall(sys_mlock);
+cond_syscall(sys_munlock);
+cond_syscall(sys_mlockall);
+cond_syscall(sys_munlockall);
+cond_syscall(sys_mincore);
+cond_syscall(sys_madvise);
+cond_syscall(sys_mremap);
+cond_syscall(sys_remap_file_pages);
diff --git a/kernel/time.c b/kernel/time.c
index ff8e7019c4c4..b00ddc71cedb 100644
--- a/kernel/time.c
+++ b/kernel/time.c
@@ -410,7 +410,7 @@ EXPORT_SYMBOL(current_kernel_time);
  * current_fs_time - Return FS time
  * @sb: Superblock.
  *
- * Return the current time truncated to the time granuality supported by
+ * Return the current time truncated to the time granularity supported by
  * the fs.
  */
 struct timespec current_fs_time(struct super_block *sb)
@@ -421,11 +421,11 @@ struct timespec current_fs_time(struct super_block *sb)
 EXPORT_SYMBOL(current_fs_time);
 
 /**
- * timespec_trunc - Truncate timespec to a granuality
+ * timespec_trunc - Truncate timespec to a granularity
  * @t: Timespec
- * @gran: Granuality in ns.
+ * @gran: Granularity in ns.
  *
- * Truncate a timespec to a granuality. gran must be smaller than a second.
+ * Truncate a timespec to a granularity. gran must be smaller than a second.
  * Always rounds down.
  *
  * This function should be only used for timestamps returned by
diff --git a/kernel/timer.c b/kernel/timer.c
index 6b812c04737b..883773788836 100644
--- a/kernel/timer.c
+++ b/kernel/timer.c
@@ -81,9 +81,10 @@ struct tvec_t_base_s {
 } ____cacheline_aligned_in_smp;
 
 typedef struct tvec_t_base_s tvec_base_t;
-static DEFINE_PER_CPU(tvec_base_t *, tvec_bases);
+
 tvec_base_t boot_tvec_bases;
 EXPORT_SYMBOL(boot_tvec_bases);
+static DEFINE_PER_CPU(tvec_base_t *, tvec_bases) = { &boot_tvec_bases };
 
 static inline void set_running_timer(tvec_base_t *base,
                                         struct timer_list *timer)
@@ -1224,28 +1225,36 @@ static int __devinit init_timers_cpu(int cpu)
 {
         int j;
         tvec_base_t *base;
+        static char __devinitdata tvec_base_done[NR_CPUS];
 
-        base = per_cpu(tvec_bases, cpu);
-        if (!base) {
+        if (!tvec_base_done[cpu]) {
                 static char boot_done;
 
-                /*
-                 * Cannot do allocation in init_timers as that runs before the
-                 * allocator initializes (and would waste memory if there are
-                 * more possible CPUs than will ever be installed/brought up).
-                 */
                 if (boot_done) {
+                        /*
+                         * The APs use this path later in boot
+                         */
                         base = kmalloc_node(sizeof(*base), GFP_KERNEL,
                                                 cpu_to_node(cpu));
                         if (!base)
                                 return -ENOMEM;
                         memset(base, 0, sizeof(*base));
+                        per_cpu(tvec_bases, cpu) = base;
                 } else {
-                        base = &boot_tvec_bases;
+                        /*
+                         * This is for the boot CPU - we use compile-time
+                         * static initialisation because per-cpu memory isn't
+                         * ready yet and because the memory allocators are not
+                         * initialised either.
+                         */
                         boot_done = 1;
+                        base = &boot_tvec_bases;
                 }
-                per_cpu(tvec_bases, cpu) = base;
+                tvec_base_done[cpu] = 1;
+        } else {
+                base = per_cpu(tvec_bases, cpu);
         }
+
         spin_lock_init(&base->lock);
         for (j = 0; j < TVN_SIZE; j++) {
                 INIT_LIST_HEAD(base->tv5.vec + j);
@@ -1455,7 +1464,7 @@ static void time_interpolator_update(long delta_nsec)
          */
         if (jiffies % INTERPOLATOR_ADJUST == 0)
         {
-                if (time_interpolator->skips == 0 && time_interpolator->offset > TICK_NSEC)
+                if (time_interpolator->skips == 0 && time_interpolator->offset > tick_nsec)
                         time_interpolator->nsec_per_cyc--;
                 if (time_interpolator->ns_skipped > INTERPOLATOR_MAX_SKIP && time_interpolator->offset == 0)
                         time_interpolator->nsec_per_cyc++;
@@ -1479,8 +1488,7 @@ register_time_interpolator(struct time_interpolator *ti)
         unsigned long flags;
 
         /* Sanity check */
-        if (ti->frequency == 0 || ti->mask == 0)
-                BUG();
+        BUG_ON(ti->frequency == 0 || ti->mask == 0);
 
         ti->nsec_per_cyc = ((u64)NSEC_PER_SEC << ti->shift) / ti->frequency;
         spin_lock(&time_interpolator_lock);
diff --git a/lib/string.c b/lib/string.c
index b3c28a3f6332..064f6315b1c3 100644
--- a/lib/string.c
+++ b/lib/string.c
@@ -362,6 +362,7 @@ size_t strspn(const char *s, const char *accept)
 EXPORT_SYMBOL(strspn);
 #endif
 
+#ifndef __HAVE_ARCH_STRCSPN
 /**
  * strcspn - Calculate the length of the initial substring of @s which does
  *      not contain letters in @reject
@@ -384,6 +385,7 @@ size_t strcspn(const char *s, const char *reject)
         return count;
 }
 EXPORT_SYMBOL(strcspn);
+#endif
 
 #ifndef __HAVE_ARCH_STRPBRK
 /**
@@ -403,6 +405,7 @@ char *strpbrk(const char *cs, const char *ct)
         }
         return NULL;
 }
+EXPORT_SYMBOL(strpbrk);
 #endif
 
 #ifndef __HAVE_ARCH_STRSEP
@@ -467,7 +470,7 @@ EXPORT_SYMBOL(memset);
 void *memcpy(void *dest, const void *src, size_t count)
 {
         char *tmp = dest;
-        char *s = src;
+        const char *s = src;
 
         while (count--)
                 *tmp++ = *s++;
diff --git a/mm/bootmem.c b/mm/bootmem.c
index d3e3bd2ffcea..d213feded10d 100644
--- a/mm/bootmem.c
+++ b/mm/bootmem.c
@@ -401,7 +401,7 @@ unsigned long __init free_all_bootmem (void)
         return(free_all_bootmem_core(NODE_DATA(0)));
 }
 
-void * __init __alloc_bootmem(unsigned long size, unsigned long align, unsigned long goal)
+void * __init __alloc_bootmem_nopanic(unsigned long size, unsigned long align, unsigned long goal)
 {
         bootmem_data_t *bdata;
         void *ptr;
@@ -409,7 +409,14 @@ void * __init __alloc_bootmem(unsigned long size, unsigned long align, unsigned
         list_for_each_entry(bdata, &bdata_list, list)
                 if ((ptr = __alloc_bootmem_core(bdata, size, align, goal, 0)))
                         return(ptr);
+        return NULL;
+}
 
+void * __init __alloc_bootmem(unsigned long size, unsigned long align, unsigned long goal)
+{
+        void *mem = __alloc_bootmem_nopanic(size,align,goal);
+        if (mem)
+                return mem;
         /*
          * Whoops, we cannot satisfy the allocation request.
          */
diff --git a/mm/highmem.c b/mm/highmem.c
index 55885f64af40..9b274fdf9d08 100644
--- a/mm/highmem.c
+++ b/mm/highmem.c
@@ -74,8 +74,7 @@ static void flush_all_zero_pkmaps(void)
                 pkmap_count[i] = 0;
 
                 /* sanity check */
-                if (pte_none(pkmap_page_table[i]))
-                        BUG();
+                BUG_ON(pte_none(pkmap_page_table[i]));
 
                 /*
                  * Don't need an atomic fetch-and-clear op here;
@@ -158,8 +157,7 @@ void fastcall *kmap_high(struct page *page)
         if (!vaddr)
                 vaddr = map_new_virtual(page);
         pkmap_count[PKMAP_NR(vaddr)]++;
-        if (pkmap_count[PKMAP_NR(vaddr)] < 2)
-                BUG();
+        BUG_ON(pkmap_count[PKMAP_NR(vaddr)] < 2);
         spin_unlock(&kmap_lock);
         return (void*) vaddr;
 }
@@ -174,8 +172,7 @@ void fastcall kunmap_high(struct page *page)
 
         spin_lock(&kmap_lock);
         vaddr = (unsigned long)page_address(page);
-        if (!vaddr)
-                BUG();
+        BUG_ON(!vaddr);
         nr = PKMAP_NR(vaddr);
 
         /*
@@ -220,8 +217,7 @@ static __init int init_emergency_pool(void)
                 return 0;
 
         page_pool = mempool_create_page_pool(POOL_SIZE, 0);
-        if (!page_pool)
-                BUG();
+        BUG_ON(!page_pool);
         printk("highmem bounce pool size: %d pages\n", POOL_SIZE);
 
         return 0;
@@ -264,8 +260,7 @@ int init_emergency_isa_pool(void)
 
         isa_page_pool = mempool_create(ISA_POOL_SIZE, mempool_alloc_pages_isa,
                                        mempool_free_pages, (void *) 0);
-        if (!isa_page_pool)
-                BUG();
+        BUG_ON(!isa_page_pool);
 
         printk("isa bounce pool size: %d pages\n", ISA_POOL_SIZE);
         return 0;
diff --git a/mm/migrate.c b/mm/migrate.c
index 09f6e4aa87fc..d444229f2599 100644
--- a/mm/migrate.c
+++ b/mm/migrate.c
@@ -16,8 +16,7 @@
 #include <linux/module.h>
 #include <linux/swap.h>
 #include <linux/pagemap.h>
-#include <linux/buffer_head.h>  /* for try_to_release_page(),
-                                        buffer_heads_over_limit */
+#include <linux/buffer_head.h>
 #include <linux/mm_inline.h>
 #include <linux/pagevec.h>
 #include <linux/rmap.h>
@@ -28,8 +27,6 @@
 
 #include "internal.h"
 
-#include "internal.h"
-
 /* The maximum number of pages to take off the LRU for migration */
 #define MIGRATE_CHUNK_SIZE 256
 
@@ -176,7 +173,6 @@ unlock_retry:
 retry:
         return -EAGAIN;
 }
-EXPORT_SYMBOL(swap_page);
 
 /*
  * Remove references for a page and establish the new page with the correct
@@ -234,7 +230,7 @@ int migrate_page_remove_references(struct page *newpage,
         if (!page_mapping(page) || page_count(page) != nr_refs ||
                         *radix_pointer != page) {
                 write_unlock_irq(&mapping->tree_lock);
-                return 1;
+                return -EAGAIN;
         }
 
         /*
diff --git a/mm/mmap.c b/mm/mmap.c
index 4f5b5709136a..e6ee12344b13 100644
--- a/mm/mmap.c
+++ b/mm/mmap.c
@@ -121,14 +121,26 @@ int __vm_enough_memory(long pages, int cap_sys_admin)
                  * only call if we're about to fail.
                  */
                 n = nr_free_pages();
+
+                /*
+                 * Leave reserved pages. The pages are not for anonymous pages.
+                 */
+                if (n <= totalreserve_pages)
+                        goto error;
+                else
+                        n -= totalreserve_pages;
+
+                /*
+                 * Leave the last 3% for root
+                 */
                 if (!cap_sys_admin)
                         n -= n / 32;
                 free += n;
 
                 if (free > pages)
                         return 0;
-                vm_unacct_memory(pages);
-                return -ENOMEM;
+
+                goto error;
         }
 
         allowed = (totalram_pages - hugetlb_total_pages())
@@ -150,7 +162,7 @@ int __vm_enough_memory(long pages, int cap_sys_admin)
          */
         if (atomic_read(&vm_committed_space) < (long)allowed)
                 return 0;
-
+error:
         vm_unacct_memory(pages);
 
         return -ENOMEM;
@@ -220,6 +232,17 @@ asmlinkage unsigned long sys_brk(unsigned long brk)
 
         if (brk < mm->end_code)
                 goto out;
+
+        /*
+         * Check against rlimit here. If this check is done later after the test
+         * of oldbrk with newbrk then it can escape the test and let the data
+         * segment grow beyond its set limit the in case where the limit is
+         * not page aligned -Ram Gupta
+         */
+        rlim = current->signal->rlim[RLIMIT_DATA].rlim_cur;
+        if (rlim < RLIM_INFINITY && brk - mm->start_data > rlim)
+                goto out;
+
         newbrk = PAGE_ALIGN(brk);
         oldbrk = PAGE_ALIGN(mm->brk);
         if (oldbrk == newbrk)
@@ -232,11 +255,6 @@ asmlinkage unsigned long sys_brk(unsigned long brk)
                 goto out;
         }
 
-        /* Check against rlimit.. */
-        rlim = current->signal->rlim[RLIMIT_DATA].rlim_cur;
-        if (rlim < RLIM_INFINITY && brk - mm->start_data > rlim)
-                goto out;
-
         /* Check against existing mmap mappings. */
         if (find_vma_intersection(mm, oldbrk, newbrk+PAGE_SIZE))
                 goto out;
@@ -294,8 +312,7 @@ void validate_mm(struct mm_struct *mm)
         i = browse_rb(&mm->mm_rb);
         if (i != mm->map_count)
                 printk("map_count %d rb %d\n", mm->map_count, i), bug = 1;
-        if (bug)
-                BUG();
+        BUG_ON(bug);
 }
 #else
 #define validate_mm(mm) do { } while (0)
@@ -432,8 +449,7 @@ __insert_vm_struct(struct mm_struct * mm, struct vm_area_struct * vma)
         struct rb_node ** rb_link, * rb_parent;
 
         __vma = find_vma_prepare(mm, vma->vm_start,&prev, &rb_link, &rb_parent);
-        if (__vma && __vma->vm_start < vma->vm_end)
-                BUG();
+        BUG_ON(__vma && __vma->vm_start < vma->vm_end);
         __vma_link(mm, vma, prev, rb_link, rb_parent);
         mm->map_count++;
 }
@@ -813,8 +829,7 @@ try_prev:
          * (e.g. stash info in next's anon_vma_node when assigning
          * an anon_vma, or when trying vma_merge).  Another time.
          */
-        if (find_vma_prev(vma->vm_mm, vma->vm_start, &near) != vma)
-                BUG();
+        BUG_ON(find_vma_prev(vma->vm_mm, vma->vm_start, &near) != vma);
         if (!near)
                 goto none;
 
diff --git a/mm/nommu.c b/mm/nommu.c
index db45efac17cc..029fadac0fb5 100644
--- a/mm/nommu.c
+++ b/mm/nommu.c
@@ -1147,14 +1147,26 @@ int __vm_enough_memory(long pages, int cap_sys_admin)
                  * only call if we're about to fail.
                  */
                 n = nr_free_pages();
+
+                /*
+                 * Leave reserved pages. The pages are not for anonymous pages.
+                 */
+                if (n <= totalreserve_pages)
+                        goto error;
+                else
+                        n -= totalreserve_pages;
+
+                /*
+                 * Leave the last 3% for root
+                 */
                 if (!cap_sys_admin)
                         n -= n / 32;
                 free += n;
 
                 if (free > pages)
                         return 0;
-                vm_unacct_memory(pages);
-                return -ENOMEM;
+
+                goto error;
         }
 
         allowed = totalram_pages * sysctl_overcommit_ratio / 100;
@@ -1175,7 +1187,7 @@ int __vm_enough_memory(long pages, int cap_sys_admin)
          */
         if (atomic_read(&vm_committed_space) < (long)allowed)
                 return 0;
-
+error:
         vm_unacct_memory(pages);
 
         return -ENOMEM;
diff --git a/mm/page-writeback.c b/mm/page-writeback.c
index 893d7677579e..75d7f48b79bb 100644
--- a/mm/page-writeback.c
+++ b/mm/page-writeback.c
@@ -72,13 +72,12 @@ int dirty_background_ratio = 10;
 int vm_dirty_ratio = 40;
 
 /*
- * The interval between `kupdate'-style writebacks, in centiseconds
- * (hundredths of a second)
+ * The interval between `kupdate'-style writebacks, in jiffies
  */
 int dirty_writeback_interval = 5 * HZ;
 
 /*
- * The longest number of centiseconds for which data is allowed to remain dirty
+ * The longest number of jiffies for which data is allowed to remain dirty
  */
 int dirty_expire_interval = 30 * HZ;
 
@@ -258,7 +257,7 @@ static void balance_dirty_pages(struct address_space *mapping)
 /**
  * balance_dirty_pages_ratelimited_nr - balance dirty memory state
  * @mapping: address_space which was dirtied
- * @nr_pages: number of pages which the caller has just dirtied
+ * @nr_pages_dirtied: number of pages which the caller has just dirtied
  *
  * Processes which are dirtying memory should call in here once for each page
  * which was newly dirtied.  The function will periodically check the system's
diff --git a/mm/page_alloc.c b/mm/page_alloc.c
index dc523a1f270d..97d6827c7d66 100644
--- a/mm/page_alloc.c
+++ b/mm/page_alloc.c
@@ -51,6 +51,7 @@ nodemask_t node_possible_map __read_mostly = NODE_MASK_ALL;
 EXPORT_SYMBOL(node_possible_map);
 unsigned long totalram_pages __read_mostly;
 unsigned long totalhigh_pages __read_mostly;
+unsigned long totalreserve_pages __read_mostly;
 long nr_swap_pages;
 int percpu_pagelist_fraction;
 
@@ -151,7 +152,8 @@ static void bad_page(struct page *page)
                         1 << PG_reclaim |
                         1 << PG_slab    |
                         1 << PG_swapcache |
-                        1 << PG_writeback );
+                        1 << PG_writeback |
+                        1 << PG_buddy );
         set_page_count(page, 0);
         reset_page_mapcount(page);
         page->mapping = NULL;
@@ -236,12 +238,12 @@ static inline unsigned long page_order(struct page *page) {
 
 static inline void set_page_order(struct page *page, int order) {
         set_page_private(page, order);
-        __SetPagePrivate(page);
+        __SetPageBuddy(page);
 }
 
 static inline void rmv_page_order(struct page *page)
 {
-        __ClearPagePrivate(page);
+        __ClearPageBuddy(page);
         set_page_private(page, 0);
 }
 
@@ -280,11 +282,13 @@ __find_combined_index(unsigned long page_idx, unsigned int order)
  * This function checks whether a page is free && is the buddy
  * we can do coalesce a page and its buddy if
  * (a) the buddy is not in a hole &&
- * (b) the buddy is free &&
- * (c) the buddy is on the buddy system &&
- * (d) a page and its buddy have the same order.
- * for recording page's order, we use page_private(page) and PG_private.
+ * (b) the buddy is in the buddy system &&
+ * (c) a page and its buddy have the same order.
+ *
+ * For recording whether a page is in the buddy system, we use PG_buddy.
+ * Setting, clearing, and testing PG_buddy is serialized by zone->lock.
  *
+ * For recording page's order, we use page_private(page).
  */
 static inline int page_is_buddy(struct page *page, int order)
 {
@@ -293,10 +297,10 @@ static inline int page_is_buddy(struct page *page, int order)
                 return 0;
 #endif
 
-       if (PagePrivate(page)           &&
-           (page_order(page) == order) &&
-            page_count(page) == 0)
+        if (PageBuddy(page) && page_order(page) == order) {
+                BUG_ON(page_count(page) != 0);
                return 1;
+        }
        return 0;
 }
 
@@ -313,7 +317,7 @@ static inline int page_is_buddy(struct page *page, int order)
  * as necessary, plus some accounting needed to play nicely with other
  * parts of the VM system.
  * At each level, we keep a list of pages, which are heads of continuous
- * free pages of length of (1 << order) and marked with PG_Private.Page's
+ * free pages of length of (1 << order) and marked with PG_buddy. Page's
  * order is recorded in page_private(page) field.
  * So when we are allocating or freeing one, we can derive the state of the
  * other.  That is, if we allocate a small block, and both were   
@@ -376,7 +380,8 @@ static inline int free_pages_check(struct page *page)
                         1 << PG_slab    |
                         1 << PG_swapcache |
                         1 << PG_writeback |
-                        1 << PG_reserved ))))
+                        1 << PG_reserved |
+                        1 << PG_buddy ))))
                 bad_page(page);
         if (PageDirty(page))
                 __ClearPageDirty(page);
@@ -524,7 +529,8 @@ static int prep_new_page(struct page *page, int order, gfp_t gfp_flags)
                         1 << PG_slab    |
                         1 << PG_swapcache |
                         1 << PG_writeback |
-                        1 << PG_reserved ))))
+                        1 << PG_reserved |
+                        1 << PG_buddy ))))
                 bad_page(page);
 
         /*
@@ -2472,6 +2478,38 @@ void __init page_alloc_init(void)
 }
 
 /*
+ * calculate_totalreserve_pages - called when sysctl_lower_zone_reserve_ratio
+ *      or min_free_kbytes changes.
+ */
+static void calculate_totalreserve_pages(void)
+{
+        struct pglist_data *pgdat;
+        unsigned long reserve_pages = 0;
+        int i, j;
+
+        for_each_online_pgdat(pgdat) {
+                for (i = 0; i < MAX_NR_ZONES; i++) {
+                        struct zone *zone = pgdat->node_zones + i;
+                        unsigned long max = 0;
+
+                        /* Find valid and maximum lowmem_reserve in the zone */
+                        for (j = i; j < MAX_NR_ZONES; j++) {
+                                if (zone->lowmem_reserve[j] > max)
+                                        max = zone->lowmem_reserve[j];
+                        }
+
+                        /* we treat pages_high as reserved pages. */
+                        max += zone->pages_high;
+
+                        if (max > zone->present_pages)
+                                max = zone->present_pages;
+                        reserve_pages += max;
+                }
+        }
+        totalreserve_pages = reserve_pages;
+}
+
+/*
  * setup_per_zone_lowmem_reserve - called whenever
  *      sysctl_lower_zone_reserve_ratio changes.  Ensures that each zone
  *      has a correct pages reserved value, so an adequate number of
@@ -2502,6 +2540,9 @@ static void setup_per_zone_lowmem_reserve(void)
                         }
                 }
         }
+
+        /* update totalreserve_pages */
+        calculate_totalreserve_pages();
 }
 
 /*
@@ -2556,6 +2597,9 @@ void setup_per_zone_pages_min(void)
                 zone->pages_high  = zone->pages_min + tmp / 2;
                 spin_unlock_irqrestore(&zone->lru_lock, flags);
         }
+
+        /* update totalreserve_pages */
+        calculate_totalreserve_pages();
 }
 
 /*
diff --git a/mm/slab.c b/mm/slab.c
index 4cbf8bb13557..e6ef9bd52335 100644
--- a/mm/slab.c
+++ b/mm/slab.c
@@ -420,6 +420,7 @@ struct kmem_cache {
         unsigned long max_freeable;
         unsigned long node_allocs;
         unsigned long node_frees;
+        unsigned long node_overflow;
         atomic_t allochit;
         atomic_t allocmiss;
         atomic_t freehit;
@@ -465,6 +466,7 @@ struct kmem_cache {
 #define STATS_INC_ERR(x)        ((x)->errors++)
 #define STATS_INC_NODEALLOCS(x) ((x)->node_allocs++)
 #define STATS_INC_NODEFREES(x)  ((x)->node_frees++)
+#define STATS_INC_ACOVERFLOW(x)   ((x)->node_overflow++)
 #define STATS_SET_FREEABLE(x, i)                                        \
         do {                                                            \
                 if ((x)->max_freeable < i)                              \
@@ -484,6 +486,7 @@ struct kmem_cache {
 #define STATS_INC_ERR(x)        do { } while (0)
 #define STATS_INC_NODEALLOCS(x) do { } while (0)
 #define STATS_INC_NODEFREES(x)  do { } while (0)
+#define STATS_INC_ACOVERFLOW(x)   do { } while (0)
 #define STATS_SET_FREEABLE(x, i) do { } while (0)
 #define STATS_INC_ALLOCHIT(x)   do { } while (0)
 #define STATS_INC_ALLOCMISS(x)  do { } while (0)
@@ -1297,8 +1300,7 @@ void __init kmem_cache_init(void)
                 if (cache_cache.num)
                         break;
         }
-        if (!cache_cache.num)
-                BUG();
+        BUG_ON(!cache_cache.num);
         cache_cache.gfporder = order;
         cache_cache.colour = left_over / cache_cache.colour_off;
         cache_cache.slab_size = ALIGN(cache_cache.num * sizeof(kmem_bufctl_t) +
@@ -1454,7 +1456,14 @@ static void *kmem_getpages(struct kmem_cache *cachep, gfp_t flags, int nodeid)
         int i;
 
         flags |= cachep->gfpflags;
+#ifndef CONFIG_MMU
+        /* nommu uses slab's for process anonymous memory allocations, so
+         * requires __GFP_COMP to properly refcount higher order allocations"
+         */
+        page = alloc_pages_node(nodeid, (flags | __GFP_COMP), cachep->gfporder);
+#else
         page = alloc_pages_node(nodeid, flags, cachep->gfporder);
+#endif
         if (!page)
                 return NULL;
         addr = page_address(page);
@@ -1974,8 +1983,7 @@ kmem_cache_create (const char *name, size_t size, size_t align,
          * Always checks flags, a caller might be expecting debug support which
          * isn't available.
          */
-        if (flags & ~CREATE_MASK)
-                BUG();
+        BUG_ON(flags & ~CREATE_MASK);
 
         /*
          * Check that size is in terms of words.  This is needed to avoid
@@ -2206,8 +2214,7 @@ static int __node_shrink(struct kmem_cache *cachep, int node)
 
                 slabp = list_entry(l3->slabs_free.prev, struct slab, list);
 #if DEBUG
-                if (slabp->inuse)
-                        BUG();
+                BUG_ON(slabp->inuse);
 #endif
                 list_del(&slabp->list);
 
@@ -2248,8 +2255,7 @@ static int __cache_shrink(struct kmem_cache *cachep)
  */
 int kmem_cache_shrink(struct kmem_cache *cachep)
 {
-        if (!cachep || in_interrupt())
-                BUG();
+        BUG_ON(!cachep || in_interrupt());
 
         return __cache_shrink(cachep);
 }
@@ -2277,8 +2283,7 @@ int kmem_cache_destroy(struct kmem_cache *cachep)
         int i;
         struct kmem_list3 *l3;
 
-        if (!cachep || in_interrupt())
-                BUG();
+        BUG_ON(!cachep || in_interrupt());
 
         /* Don't let CPUs to come and go */
         lock_cpu_hotplug();
@@ -2323,13 +2328,15 @@ EXPORT_SYMBOL(kmem_cache_destroy);
 
 /* Get the memory for a slab management obj. */
 static struct slab *alloc_slabmgmt(struct kmem_cache *cachep, void *objp,
-                                   int colour_off, gfp_t local_flags)
+                                   int colour_off, gfp_t local_flags,
+                                   int nodeid)
 {
         struct slab *slabp;
 
         if (OFF_SLAB(cachep)) {
                 /* Slab management obj is off-slab. */
-                slabp = kmem_cache_alloc(cachep->slabp_cache, local_flags);
+                slabp = kmem_cache_alloc_node(cachep->slabp_cache,
+                                              local_flags, nodeid);
                 if (!slabp)
                         return NULL;
         } else {
@@ -2339,6 +2346,7 @@ static struct slab *alloc_slabmgmt(struct kmem_cache *cachep, void *objp,
         slabp->inuse = 0;
         slabp->colouroff = colour_off;
         slabp->s_mem = objp + colour_off;
+        slabp->nodeid = nodeid;
         return slabp;
 }
 
@@ -2477,8 +2485,7 @@ static int cache_grow(struct kmem_cache *cachep, gfp_t flags, int nodeid)
          * Be lazy and only check for valid flags here,  keeping it out of the
          * critical path in kmem_cache_alloc().
          */
-        if (flags & ~(SLAB_DMA | SLAB_LEVEL_MASK | SLAB_NO_GROW))
-                BUG();
+        BUG_ON(flags & ~(SLAB_DMA | SLAB_LEVEL_MASK | SLAB_NO_GROW));
         if (flags & SLAB_NO_GROW)
                 return 0;
 
@@ -2525,7 +2532,7 @@ static int cache_grow(struct kmem_cache *cachep, gfp_t flags, int nodeid)
                 goto failed;
 
         /* Get slab management. */
-        slabp = alloc_slabmgmt(cachep, objp, offset, local_flags);
+        slabp = alloc_slabmgmt(cachep, objp, offset, local_flags, nodeid);
         if (!slabp)
                 goto opps1;
 
@@ -3086,9 +3093,11 @@ static inline void __cache_free(struct kmem_cache *cachep, void *objp)
                         if (l3->alien && l3->alien[nodeid]) {
                                 alien = l3->alien[nodeid];
                                 spin_lock(&alien->lock);
-                                if (unlikely(alien->avail == alien->limit))
+                                if (unlikely(alien->avail == alien->limit)) {
+                                        STATS_INC_ACOVERFLOW(cachep);
                                         __drain_alien_cache(cachep,
                                                             alien, nodeid);
+                                }
                                 alien->entry[alien->avail++] = objp;
                                 spin_unlock(&alien->lock);
                         } else {
@@ -3766,7 +3775,7 @@ static void print_slabinfo_header(struct seq_file *m)
         seq_puts(m, " : slabdata <active_slabs> <num_slabs> <sharedavail>");
 #if STATS
         seq_puts(m, " : globalstat <listallocs> <maxobjs> <grown> <reaped> "
-                 "<error> <maxfreeable> <nodeallocs> <remotefrees>");
+                 "<error> <maxfreeable> <nodeallocs> <remotefrees> <alienoverflow>");
         seq_puts(m, " : cpustat <allochit> <allocmiss> <freehit> <freemiss>");
 #endif
         seq_putc(m, '\n');
@@ -3880,11 +3889,12 @@ static int s_show(struct seq_file *m, void *p)
                 unsigned long max_freeable = cachep->max_freeable;
                 unsigned long node_allocs = cachep->node_allocs;
                 unsigned long node_frees = cachep->node_frees;
+                unsigned long overflows = cachep->node_overflow;
 
                 seq_printf(m, " : globalstat %7lu %6lu %5lu %4lu \
-                                %4lu %4lu %4lu %4lu", allocs, high, grown,
+                                %4lu %4lu %4lu %4lu %4lu", allocs, high, grown,
                                 reaped, errors, max_freeable, node_allocs,
-                                node_frees);
+                                node_frees, overflows);
         }
         /* cpu stats */
         {
diff --git a/mm/swap_state.c b/mm/swap_state.c
index d7af296833fc..e0e1583f32c2 100644
--- a/mm/swap_state.c
+++ b/mm/swap_state.c
@@ -148,8 +148,7 @@ int add_to_swap(struct page * page, gfp_t gfp_mask)
         swp_entry_t entry;
         int err;
 
-        if (!PageLocked(page))
-                BUG();
+        BUG_ON(!PageLocked(page));
 
         for (;;) {
                 entry = get_swap_page();
diff --git a/mm/vmalloc.c b/mm/vmalloc.c
index 729eb3eec75f..c0504f1e34eb 100644
--- a/mm/vmalloc.c
+++ b/mm/vmalloc.c
@@ -321,8 +321,7 @@ void __vunmap(void *addr, int deallocate_pages)
                 int i;
 
                 for (i = 0; i < area->nr_pages; i++) {
-                        if (unlikely(!area->pages[i]))
-                                BUG();
+                        BUG_ON(!area->pages[i]);
                         __free_page(area->pages[i]);
                 }
 
diff --git a/net/bluetooth/sco.c b/net/bluetooth/sco.c
index 6b61323ce23c..0c2d13ad69bb 100644
--- a/net/bluetooth/sco.c
+++ b/net/bluetooth/sco.c
@@ -255,7 +255,7 @@ static inline int sco_send_frame(struct sock *sk, struct msghdr *msg, int len)
         }
 
         if ((err = hci_send_sco(conn->hcon, skb)) < 0)
-                goto fail;
+                return err;
 
         return count;
 
diff --git a/net/bridge/br_netfilter.c b/net/bridge/br_netfilter.c
index f29450b788be..3da9264449f7 100644
--- a/net/bridge/br_netfilter.c
+++ b/net/bridge/br_netfilter.c
@@ -765,6 +765,15 @@ out:
         return NF_STOLEN;
 }
 
+static int br_nf_dev_queue_xmit(struct sk_buff *skb)
+{
+        if (skb->protocol == htons(ETH_P_IP) &&
+            skb->len > skb->dev->mtu &&
+            !(skb_shinfo(skb)->ufo_size || skb_shinfo(skb)->tso_size))
+                return ip_fragment(skb, br_dev_queue_push_xmit);
+        else
+                return br_dev_queue_push_xmit(skb);
+}
 
 /* PF_BRIDGE/POST_ROUTING ********************************************/
 static unsigned int br_nf_post_routing(unsigned int hook, struct sk_buff **pskb,
@@ -824,7 +833,7 @@ static unsigned int br_nf_post_routing(unsigned int hook, struct sk_buff **pskb,
                 realoutdev = nf_bridge->netoutdev;
 #endif
         NF_HOOK(pf, NF_IP_POST_ROUTING, skb, NULL, realoutdev,
-                br_dev_queue_push_xmit);
+                br_nf_dev_queue_xmit);
 
         return NF_STOLEN;
 
@@ -869,7 +878,7 @@ static unsigned int ip_sabotage_out(unsigned int hook, struct sk_buff **pskb,
 
         if ((out->hard_start_xmit == br_dev_xmit &&
              okfn != br_nf_forward_finish &&
-             okfn != br_nf_local_out_finish && okfn != br_dev_queue_push_xmit)
+             okfn != br_nf_local_out_finish && okfn != br_nf_dev_queue_xmit)
 #if defined(CONFIG_VLAN_8021Q) || defined(CONFIG_VLAN_8021Q_MODULE)
             || ((out->priv_flags & IFF_802_1Q_VLAN) &&
                 VLAN_DEV_INFO(out)->real_dev->hard_start_xmit == br_dev_xmit)
diff --git a/net/bridge/netfilter/ebtables.c b/net/bridge/netfilter/ebtables.c
index 01eae97c53d9..66bd93252c4e 100644
--- a/net/bridge/netfilter/ebtables.c
+++ b/net/bridge/netfilter/ebtables.c
@@ -829,7 +829,7 @@ static int translate_table(struct ebt_replace *repl,
                                                 * sizeof(struct ebt_chainstack));
                 if (!newinfo->chainstack)
                         return -ENOMEM;
-                for_each_cpu(i) {
+                for_each_possible_cpu(i) {
                         newinfo->chainstack[i] =
                            vmalloc(udc_cnt * sizeof(struct ebt_chainstack));
                         if (!newinfo->chainstack[i]) {
@@ -901,7 +901,7 @@ static void get_counters(struct ebt_counter *oldcounters,
                sizeof(struct ebt_counter) * nentries);
 
         /* add other counters to those of cpu 0 */
-        for_each_cpu(cpu) {
+        for_each_possible_cpu(cpu) {
                 if (cpu == 0)
                         continue;
                 counter_base = COUNTER_BASE(oldcounters, nentries, cpu);
@@ -1036,7 +1036,7 @@ static int do_replace(void __user *user, unsigned int len)
 
         vfree(table->entries);
         if (table->chainstack) {
-                for_each_cpu(i)
+                for_each_possible_cpu(i)
                         vfree(table->chainstack[i]);
                 vfree(table->chainstack);
         }
@@ -1054,7 +1054,7 @@ free_counterstmp:
         vfree(counterstmp);
         /* can be initialized in translate_table() */
         if (newinfo->chainstack) {
-                for_each_cpu(i)
+                for_each_possible_cpu(i)
                         vfree(newinfo->chainstack[i]);
                 vfree(newinfo->chainstack);
         }
@@ -1201,7 +1201,7 @@ free_unlock:
         mutex_unlock(&ebt_mutex);
 free_chainstack:
         if (newinfo->chainstack) {
-                for_each_cpu(i)
+                for_each_possible_cpu(i)
                         vfree(newinfo->chainstack[i]);
                 vfree(newinfo->chainstack);
         }
@@ -1224,7 +1224,7 @@ void ebt_unregister_table(struct ebt_table *table)
         mutex_unlock(&ebt_mutex);
         vfree(table->private->entries);
         if (table->private->chainstack) {
-                for_each_cpu(i)
+                for_each_possible_cpu(i)
                         vfree(table->private->chainstack[i]);
                 vfree(table->private->chainstack);
         }
diff --git a/net/compat.c b/net/compat.c
index 8fd37cd7b501..d5d69fa15d07 100644
--- a/net/compat.c
+++ b/net/compat.c
@@ -476,8 +476,7 @@ asmlinkage long compat_sys_setsockopt(int fd, int level, int optname,
         int err;
         struct socket *sock;
 
-        /* SO_SET_REPLACE seems to be the same in all levels */
-        if (optname == IPT_SO_SET_REPLACE)
+        if (level == SOL_IPV6 && optname == IPT_SO_SET_REPLACE)
                 return do_netfilter_replace(fd, level, optname,
                                             optval, optlen);
 
diff --git a/net/core/dev.c b/net/core/dev.c
index 434220d093aa..83231a27ae02 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -3042,11 +3042,11 @@ void netdev_run_todo(void)
 
                 switch(dev->reg_state) {
                 case NETREG_REGISTERING:
+                        dev->reg_state = NETREG_REGISTERED;
                         err = netdev_register_sysfs(dev);
                         if (err)
                                 printk(KERN_ERR "%s: failed sysfs registration (%d)\n",
                                        dev->name, err);
-                        dev->reg_state = NETREG_REGISTERED;
                         break;
 
                 case NETREG_UNREGISTERING:
@@ -3100,12 +3100,11 @@ struct net_device *alloc_netdev(int sizeof_priv, const char *name,
         alloc_size = (sizeof(*dev) + NETDEV_ALIGN_CONST) & ~NETDEV_ALIGN_CONST;
         alloc_size += sizeof_priv + NETDEV_ALIGN_CONST;
 
-        p = kmalloc(alloc_size, GFP_KERNEL);
+        p = kzalloc(alloc_size, GFP_KERNEL);
         if (!p) {
                 printk(KERN_ERR "alloc_dev: Unable to allocate device.\n");
                 return NULL;
         }
-        memset(p, 0, alloc_size);
 
         dev = (struct net_device *)
                 (((long)p + NETDEV_ALIGN_CONST) & ~NETDEV_ALIGN_CONST);
@@ -3347,7 +3346,7 @@ static int __init net_dev_init(void)
          *      Initialise the packet receive queues.
          */
 
-        for_each_cpu(i) {
+        for_each_possible_cpu(i) {
                 struct softnet_data *queue;
 
                 queue = &per_cpu(softnet_data, i);
diff --git a/net/core/dv.c b/net/core/dv.c
index cf581407538c..29ee77f15932 100644
--- a/net/core/dv.c
+++ b/net/core/dv.c
@@ -55,15 +55,12 @@ int alloc_divert_blk(struct net_device *dev)
 
         dev->divert = NULL;
         if (dev->type == ARPHRD_ETHER) {
-                dev->divert = (struct divert_blk *)
-                        kmalloc(alloc_size, GFP_KERNEL);
+                dev->divert = kzalloc(alloc_size, GFP_KERNEL);
                 if (dev->divert == NULL) {
                         printk(KERN_INFO "divert: unable to allocate divert_blk for %s\n",
                                dev->name);
                         return -ENOMEM;
                 }
-
-                memset(dev->divert, 0, sizeof(struct divert_blk));
                 dev_hold(dev);
         }
 
diff --git a/net/core/flow.c b/net/core/flow.c
index 55789f832eda..2191af5f26ac 100644
--- a/net/core/flow.c
+++ b/net/core/flow.c
@@ -79,7 +79,7 @@ static void flow_cache_new_hashrnd(unsigned long arg)
 {
         int i;
 
-        for_each_cpu(i)
+        for_each_possible_cpu(i)
                 flow_hash_rnd_recalc(i) = 1;
 
         flow_hash_rnd_timer.expires = jiffies + FLOW_HASH_RND_PERIOD;
@@ -318,12 +318,10 @@ static void __devinit flow_cache_cpu_prepare(int cpu)
                 /* NOTHING */;
 
         flow_table(cpu) = (struct flow_cache_entry **)
-                __get_free_pages(GFP_KERNEL, order);
+                __get_free_pages(GFP_KERNEL|__GFP_ZERO, order);
         if (!flow_table(cpu))
                 panic("NET: failed to allocate flow cache order %lu\n", order);
 
-        memset(flow_table(cpu), 0, PAGE_SIZE << order);
-
         flow_hash_rnd_recalc(cpu) = 1;
         flow_count(cpu) = 0;
 
@@ -363,7 +361,7 @@ static int __init flow_cache_init(void)
         flow_hash_rnd_timer.expires = jiffies + FLOW_HASH_RND_PERIOD;
         add_timer(&flow_hash_rnd_timer);
 
-        for_each_cpu(i)
+        for_each_possible_cpu(i)
                 flow_cache_cpu_prepare(i);
 
         hotcpu_notifier(flow_cache_cpu, 0);
diff --git a/net/core/gen_estimator.c b/net/core/gen_estimator.c
index b07c029e8219..3cad026764f0 100644
--- a/net/core/gen_estimator.c
+++ b/net/core/gen_estimator.c
@@ -159,11 +159,10 @@ int gen_new_estimator(struct gnet_stats_basic *bstats,
         if (parm->interval < -2 || parm->interval > 3)
                 return -EINVAL;
 
-        est = kmalloc(sizeof(*est), GFP_KERNEL);
+        est = kzalloc(sizeof(*est), GFP_KERNEL);
         if (est == NULL)
                 return -ENOBUFS;
 
-        memset(est, 0, sizeof(*est));
         est->interval = parm->interval + 2;
         est->bstats = bstats;
         est->rate_est = rate_est;
diff --git a/net/core/neighbour.c b/net/core/neighbour.c
index 0c8666872d10..4cf878efdb49 100644
--- a/net/core/neighbour.c
+++ b/net/core/neighbour.c
@@ -284,14 +284,11 @@ static struct neighbour **neigh_hash_alloc(unsigned int entries)
         struct neighbour **ret;
 
         if (size <= PAGE_SIZE) {
-                ret = kmalloc(size, GFP_ATOMIC);
+                ret = kzalloc(size, GFP_ATOMIC);
         } else {
                 ret = (struct neighbour **)
-                        __get_free_pages(GFP_ATOMIC, get_order(size));
+                      __get_free_pages(GFP_ATOMIC|__GFP_ZERO, get_order(size));
         }
-        if (ret)
-                memset(ret, 0, size);
-
         return ret;
 }
 
@@ -1089,8 +1086,7 @@ static void neigh_hh_init(struct neighbour *n, struct dst_entry *dst,
                 if (hh->hh_type == protocol)
                         break;
 
-        if (!hh && (hh = kmalloc(sizeof(*hh), GFP_ATOMIC)) != NULL) {
-                memset(hh, 0, sizeof(struct hh_cache));
+        if (!hh && (hh = kzalloc(sizeof(*hh), GFP_ATOMIC)) != NULL) {
                 rwlock_init(&hh->hh_lock);
                 hh->hh_type = protocol;
                 atomic_set(&hh->hh_refcnt, 0);
@@ -1366,13 +1362,11 @@ void neigh_table_init(struct neigh_table *tbl)
         tbl->hash_buckets = neigh_hash_alloc(tbl->hash_mask + 1);
 
         phsize = (PNEIGH_HASHMASK + 1) * sizeof(struct pneigh_entry *);
-        tbl->phash_buckets = kmalloc(phsize, GFP_KERNEL);
+        tbl->phash_buckets = kzalloc(phsize, GFP_KERNEL);
 
         if (!tbl->hash_buckets || !tbl->phash_buckets)
                 panic("cannot allocate neighbour cache hashes");
 
-        memset(tbl->phash_buckets, 0, phsize);
-
         get_random_bytes(&tbl->hash_rnd, sizeof(tbl->hash_rnd));
 
         rwlock_init(&tbl->lock);
@@ -1633,7 +1627,7 @@ static int neightbl_fill_info(struct neigh_table *tbl, struct sk_buff *skb,
 
                 memset(&ndst, 0, sizeof(ndst));
 
-                for_each_cpu(cpu) {
+                for_each_possible_cpu(cpu) {
                         struct neigh_statistics *st;
 
                         st = per_cpu_ptr(tbl->stats, cpu);
diff --git a/net/core/net-sysfs.c b/net/core/net-sysfs.c
index 21b68464cabb..c12990c9c603 100644
--- a/net/core/net-sysfs.c
+++ b/net/core/net-sysfs.c
@@ -165,7 +165,7 @@ static ssize_t show_operstate(struct class_device *dev, char *buf)
                 operstate = IF_OPER_DOWN;
         read_unlock(&dev_base_lock);
 
-        if (operstate >= sizeof(operstates))
+        if (operstate >= ARRAY_SIZE(operstates))
                 return -EINVAL; /* should not happen */
 
         return sprintf(buf, "%s\n", operstates[operstate]);
diff --git a/net/core/request_sock.c b/net/core/request_sock.c
index 1e44eda1fda9..79ebd75fbe4d 100644
--- a/net/core/request_sock.c
+++ b/net/core/request_sock.c
@@ -38,13 +38,11 @@ int reqsk_queue_alloc(struct request_sock_queue *queue,
 {
         const int lopt_size = sizeof(struct listen_sock) +
                               nr_table_entries * sizeof(struct request_sock *);
-        struct listen_sock *lopt = kmalloc(lopt_size, GFP_KERNEL);
+        struct listen_sock *lopt = kzalloc(lopt_size, GFP_KERNEL);
 
         if (lopt == NULL)
                 return -ENOMEM;
 
-        memset(lopt, 0, lopt_size);
-
         for (lopt->max_qlen_log = 6;
              (1 << lopt->max_qlen_log) < sysctl_max_syn_backlog;
              lopt->max_qlen_log++);
diff --git a/net/core/utils.c b/net/core/utils.c
index fdc4f38bc46c..4f96f389243d 100644
--- a/net/core/utils.c
+++ b/net/core/utils.c
@@ -121,7 +121,7 @@ void __init net_random_init(void)
 {
         int i;
 
-        for_each_cpu(i) {
+        for_each_possible_cpu(i) {
                 struct nrnd_state *state = &per_cpu(net_rand_state,i);
                 __net_srandom(state, i+jiffies);
         }
@@ -133,7 +133,7 @@ static int net_random_reseed(void)
         unsigned long seed[NR_CPUS];
 
         get_random_bytes(seed, sizeof(seed));
-        for_each_cpu(i) {
+        for_each_possible_cpu(i) {
                 struct nrnd_state *state = &per_cpu(net_rand_state,i);
                 __net_srandom(state, seed[i]);
         }
diff --git a/net/ipv4/ah4.c b/net/ipv4/ah4.c
index e16d8b42b953..e2e4771fa4c6 100644
--- a/net/ipv4/ah4.c
+++ b/net/ipv4/ah4.c
@@ -116,7 +116,7 @@ error:
         return err;
 }
 
-static int ah_input(struct xfrm_state *x, struct xfrm_decap_state *decap, struct sk_buff *skb)
+static int ah_input(struct xfrm_state *x, struct sk_buff *skb)
 {
         int ah_hlen;
         struct iphdr *iph;
diff --git a/net/ipv4/esp4.c b/net/ipv4/esp4.c
index bf88c620a954..9d1881c07a32 100644
--- a/net/ipv4/esp4.c
+++ b/net/ipv4/esp4.c
@@ -133,7 +133,7 @@ error:
  * expensive, so we only support truncated data, which is the recommended
  * and common case.
  */
-static int esp_input(struct xfrm_state *x, struct xfrm_decap_state *decap, struct sk_buff *skb)
+static int esp_input(struct xfrm_state *x, struct sk_buff *skb)
 {
         struct iphdr *iph;
         struct ip_esp_hdr *esph;
@@ -208,9 +208,6 @@ static int esp_input(struct xfrm_state *x, struct xfrm_decap_state *decap, struc
                 struct xfrm_encap_tmpl *encap = x->encap;
                 struct udphdr *uh;
 
-                if (encap->encap_type != decap->decap_type)
-                        goto out;
-
                 uh = (struct udphdr *)(iph + 1);
                 encap_len = (void*)esph - (void*)uh;
 
diff --git a/net/ipv4/fib_trie.c b/net/ipv4/fib_trie.c
index ccd3efc6a173..95a639f2e3db 100644
--- a/net/ipv4/fib_trie.c
+++ b/net/ipv4/fib_trie.c
@@ -50,7 +50,7 @@
  *              Patrick McHardy <kaber@trash.net>
  */
 
-#define VERSION "0.406"
+#define VERSION "0.407"
 
 #include <linux/config.h>
 #include <asm/uaccess.h>
@@ -314,11 +314,6 @@ static void __leaf_free_rcu(struct rcu_head *head)
         kfree(container_of(head, struct leaf, rcu));
 }
 
-static inline void free_leaf(struct leaf *leaf)
-{
-        call_rcu(&leaf->rcu, __leaf_free_rcu);
-}
-
 static void __leaf_info_free_rcu(struct rcu_head *head)
 {
         kfree(container_of(head, struct leaf_info, rcu));
@@ -357,7 +352,12 @@ static void __tnode_free_rcu(struct rcu_head *head)
 
 static inline void tnode_free(struct tnode *tn)
 {
-        call_rcu(&tn->rcu, __tnode_free_rcu);
+        if(IS_LEAF(tn)) {
+                struct leaf *l = (struct leaf *) tn;
+                call_rcu_bh(&l->rcu, __leaf_free_rcu);
+        }
+        else
+                call_rcu(&tn->rcu, __tnode_free_rcu);
 }
 
 static struct leaf *leaf_new(void)
diff --git a/net/ipv4/icmp.c b/net/ipv4/icmp.c
index 9831fd2c73a0..2a0455911ee0 100644
--- a/net/ipv4/icmp.c
+++ b/net/ipv4/icmp.c
@@ -1107,7 +1107,7 @@ void __init icmp_init(struct net_proto_family *ops)
         struct inet_sock *inet;
         int i;
 
-        for_each_cpu(i) {
+        for_each_possible_cpu(i) {
                 int err;
 
                 err = sock_create_kern(PF_INET, SOCK_RAW, IPPROTO_ICMP,
diff --git a/net/ipv4/ip_fragment.c b/net/ipv4/ip_fragment.c
index 2a8adda15e11..da734c439179 100644
--- a/net/ipv4/ip_fragment.c
+++ b/net/ipv4/ip_fragment.c
@@ -304,13 +304,17 @@ out:
 
 /* Creation primitives. */
 
-static struct ipq *ip_frag_intern(unsigned int hash, struct ipq *qp_in)
+static struct ipq *ip_frag_intern(struct ipq *qp_in)
 {
         struct ipq *qp;
 #ifdef CONFIG_SMP
         struct hlist_node *n;
 #endif
+        unsigned int hash;
+
         write_lock(&ipfrag_lock);
+        hash = ipqhashfn(qp_in->id, qp_in->saddr, qp_in->daddr,
+                         qp_in->protocol);
 #ifdef CONFIG_SMP
         /* With SMP race we have to recheck hash table, because
          * such entry could be created on other cpu, while we
@@ -345,7 +349,7 @@ static struct ipq *ip_frag_intern(unsigned int hash, struct ipq *qp_in)
 }
 
 /* Add an entry to the 'ipq' queue for a newly received IP datagram. */
-static struct ipq *ip_frag_create(unsigned hash, struct iphdr *iph, u32 user)
+static struct ipq *ip_frag_create(struct iphdr *iph, u32 user)
 {
         struct ipq *qp;
 
@@ -371,7 +375,7 @@ static struct ipq *ip_frag_create(unsigned hash, struct iphdr *iph, u32 user)
         spin_lock_init(&qp->lock);
         atomic_set(&qp->refcnt, 1);
 
-        return ip_frag_intern(hash, qp);
+        return ip_frag_intern(qp);
 
 out_nomem:
         LIMIT_NETDEBUG(KERN_ERR "ip_frag_create: no memory left !\n");
@@ -387,11 +391,12 @@ static inline struct ipq *ip_find(struct iphdr *iph, u32 user)
         __u32 saddr = iph->saddr;
         __u32 daddr = iph->daddr;
         __u8 protocol = iph->protocol;
-        unsigned int hash = ipqhashfn(id, saddr, daddr, protocol);
+        unsigned int hash;
         struct ipq *qp;
         struct hlist_node *n;
 
         read_lock(&ipfrag_lock);
+        hash = ipqhashfn(id, saddr, daddr, protocol);
         hlist_for_each_entry(qp, n, &ipq_hash[hash], list) {
                 if(qp->id == id         &&
                    qp->saddr == saddr   &&
@@ -405,7 +410,7 @@ static inline struct ipq *ip_find(struct iphdr *iph, u32 user)
         }
         read_unlock(&ipfrag_lock);
 
-        return ip_frag_create(hash, iph, user);
+        return ip_frag_create(iph, user);
 }
 
 /* Is the fragment too far ahead to be part of ipq? */
diff --git a/net/ipv4/ip_gre.c b/net/ipv4/ip_gre.c
index 9981dcd68f11..ab99bebdcdc8 100644
--- a/net/ipv4/ip_gre.c
+++ b/net/ipv4/ip_gre.c
@@ -656,7 +656,7 @@ static int ipgre_rcv(struct sk_buff *skb)
                 read_unlock(&ipgre_lock);
                 return(0);
         }
-        icmp_send(skb, ICMP_DEST_UNREACH, ICMP_PROT_UNREACH, 0);
+        icmp_send(skb, ICMP_DEST_UNREACH, ICMP_PORT_UNREACH, 0);
 
 drop:
         read_unlock(&ipgre_lock);
diff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c
index f75ff1d96551..8dcba3887f04 100644
--- a/net/ipv4/ip_output.c
+++ b/net/ipv4/ip_output.c
@@ -86,8 +86,6 @@
 
 int sysctl_ip_default_ttl = IPDEFTTL;
 
-static int ip_fragment(struct sk_buff *skb, int (*output)(struct sk_buff*));
-
 /* Generate a checksum for an outgoing IP datagram. */
 __inline__ void ip_send_check(struct iphdr *iph)
 {
@@ -421,7 +419,7 @@ static void ip_copy_metadata(struct sk_buff *to, struct sk_buff *from)
  *      single device frame, and queue such a frame for sending.
  */
 
-static int ip_fragment(struct sk_buff *skb, int (*output)(struct sk_buff*))
+int ip_fragment(struct sk_buff *skb, int (*output)(struct sk_buff*))
 {
         struct iphdr *iph;
         int raw = 0;
@@ -673,6 +671,8 @@ fail:
         return err;
 }
 
+EXPORT_SYMBOL(ip_fragment);
+
 int
 ip_generic_getfrag(void *from, char *to, int offset, int len, int odd, struct sk_buff *skb)
 {
diff --git a/net/ipv4/ipcomp.c b/net/ipv4/ipcomp.c
index c95020f7c81e..04a429465665 100644
--- a/net/ipv4/ipcomp.c
+++ b/net/ipv4/ipcomp.c
@@ -81,8 +81,7 @@ out:
         return err;
 }
 
-static int ipcomp_input(struct xfrm_state *x,
-                        struct xfrm_decap_state *decap, struct sk_buff *skb)
+static int ipcomp_input(struct xfrm_state *x, struct sk_buff *skb)
 {
         u8 nexthdr;
         int err = 0;
@@ -291,7 +290,7 @@ static void ipcomp_free_scratches(void)
         if (!scratches)
                 return;
 
-        for_each_cpu(i) {
+        for_each_possible_cpu(i) {
                 void *scratch = *per_cpu_ptr(scratches, i);
                 if (scratch)
                         vfree(scratch);
@@ -314,7 +313,7 @@ static void **ipcomp_alloc_scratches(void)
 
         ipcomp_scratches = scratches;
 
-        for_each_cpu(i) {
+        for_each_possible_cpu(i) {
                 void *scratch = vmalloc(IPCOMP_SCRATCH_SIZE);
                 if (!scratch)
                         return NULL;
@@ -345,7 +344,7 @@ static void ipcomp_free_tfms(struct crypto_tfm **tfms)
         if (!tfms)
                 return;
 
-        for_each_cpu(cpu) {
+        for_each_possible_cpu(cpu) {
                 struct crypto_tfm *tfm = *per_cpu_ptr(tfms, cpu);
                 crypto_free_tfm(tfm);
         }
@@ -385,7 +384,7 @@ static struct crypto_tfm **ipcomp_alloc_tfms(const char *alg_name)
         if (!tfms)
                 goto error;
 
-        for_each_cpu(cpu) {
+        for_each_possible_cpu(cpu) {
                 struct crypto_tfm *tfm = crypto_alloc_tfm(alg_name, 0);
                 if (!tfm)
                         goto error;
diff --git a/net/ipv4/ipip.c b/net/ipv4/ipip.c
index eef07b0916a3..ea398ee43f28 100644
--- a/net/ipv4/ipip.c
+++ b/net/ipv4/ipip.c
@@ -474,9 +474,6 @@ static int ipip_rcv(struct sk_buff *skb)
         struct iphdr *iph;
         struct ip_tunnel *tunnel;
 
-        if (!pskb_may_pull(skb, sizeof(struct iphdr)))
-                goto out;
-
         iph = skb->nh.iph;
 
         read_lock(&ipip_lock);
@@ -508,7 +505,6 @@ static int ipip_rcv(struct sk_buff *skb)
         }
         read_unlock(&ipip_lock);
 
-out:
         return -1;
 }
 
diff --git a/net/ipv4/netfilter.c b/net/ipv4/netfilter.c
index b5ad9ac2fbcc..6a9e34b794bc 100644
--- a/net/ipv4/netfilter.c
+++ b/net/ipv4/netfilter.c
@@ -133,7 +133,7 @@ struct ip_rt_info {
         u_int8_t tos;
 };
 
-static void queue_save(const struct sk_buff *skb, struct nf_info *info)
+static void nf_ip_saveroute(const struct sk_buff *skb, struct nf_info *info)
 {
         struct ip_rt_info *rt_info = nf_info_reroute(info);
 
@@ -146,7 +146,7 @@ static void queue_save(const struct sk_buff *skb, struct nf_info *info)
         }
 }
 
-static int queue_reroute(struct sk_buff **pskb, const struct nf_info *info)
+static int nf_ip_reroute(struct sk_buff **pskb, const struct nf_info *info)
 {
         const struct ip_rt_info *rt_info = nf_info_reroute(info);
 
@@ -161,20 +161,54 @@ static int queue_reroute(struct sk_buff **pskb, const struct nf_info *info)
         return 0;
 }
 
-static struct nf_queue_rerouter ip_reroute = {
-        .rer_size       = sizeof(struct ip_rt_info),
-        .save           = queue_save,
-        .reroute        = queue_reroute,
+unsigned int nf_ip_checksum(struct sk_buff *skb, unsigned int hook,
+                            unsigned int dataoff, u_int8_t protocol)
+{
+        struct iphdr *iph = skb->nh.iph;
+        unsigned int csum = 0;
+
+        switch (skb->ip_summed) {
+        case CHECKSUM_HW:
+                if (hook != NF_IP_PRE_ROUTING && hook != NF_IP_LOCAL_IN)
+                        break;
+                if ((protocol == 0 && !(u16)csum_fold(skb->csum)) ||
+                    !csum_tcpudp_magic(iph->saddr, iph->daddr,
+                                       skb->len - dataoff, protocol,
+                                       skb->csum)) {
+                        skb->ip_summed = CHECKSUM_UNNECESSARY;
+                        break;
+                }
+                /* fall through */
+        case CHECKSUM_NONE:
+                if (protocol == 0)
+                        skb->csum = 0;
+                else
+                        skb->csum = csum_tcpudp_nofold(iph->saddr, iph->daddr,
+                                                       skb->len - dataoff,
+                                                       protocol, 0);
+                csum = __skb_checksum_complete(skb);
+        }
+        return csum;
+}
+
+EXPORT_SYMBOL(nf_ip_checksum);
+
+static struct nf_afinfo nf_ip_afinfo = {
+        .family         = AF_INET,
+        .checksum       = nf_ip_checksum,
+        .saveroute      = nf_ip_saveroute,
+        .reroute        = nf_ip_reroute,
+        .route_key_size = sizeof(struct ip_rt_info),
 };
 
 static int ipv4_netfilter_init(void)
 {
-        return nf_register_queue_rerouter(PF_INET, &ip_reroute);
+        return nf_register_afinfo(&nf_ip_afinfo);
 }
 
 static void ipv4_netfilter_fini(void)
 {
-        nf_unregister_queue_rerouter(PF_INET);
+        nf_unregister_afinfo(&nf_ip_afinfo);
 }
 
 module_init(ipv4_netfilter_init);
diff --git a/net/ipv4/netfilter/Kconfig b/net/ipv4/netfilter/Kconfig
index 882b842c25d4..c60fd5c4ea1e 100644
--- a/net/ipv4/netfilter/Kconfig
+++ b/net/ipv4/netfilter/Kconfig
@@ -69,6 +69,7 @@ config IP_NF_CONNTRACK_NETLINK
         tristate 'Connection tracking netlink interface (EXPERIMENTAL)'
         depends on EXPERIMENTAL && IP_NF_CONNTRACK && NETFILTER_NETLINK
         depends on IP_NF_CONNTRACK!=y || NETFILTER_NETLINK!=m
+        depends on IP_NF_NAT=n || IP_NF_NAT
         help
           This option enables support for a netlink-based userspace interface
 
@@ -221,16 +222,6 @@ config IP_NF_MATCH_IPRANGE
 
           To compile it as a module, choose M here.  If unsure, say N.
 
-config IP_NF_MATCH_MULTIPORT
-        tristate "Multiple port match support"
-        depends on IP_NF_IPTABLES
-        help
-          Multiport matching allows you to match TCP or UDP packets based on
-          a series of source or destination ports: normally a rule can only
-          match a single range of ports.
-
-          To compile it as a module, choose M here.  If unsure, say N.
-
 config IP_NF_MATCH_TOS
         tristate "TOS match support"
         depends on IP_NF_IPTABLES
@@ -272,12 +263,12 @@ config IP_NF_MATCH_DSCP
 
           To compile it as a module, choose M here.  If unsure, say N.
 
-config IP_NF_MATCH_AH_ESP
-        tristate "AH/ESP match support"
+config IP_NF_MATCH_AH
+        tristate "AH match support"
         depends on IP_NF_IPTABLES
         help
-          These two match extensions (`ah' and `esp') allow you to match a
-          range of SPIs inside AH or ESP headers of IPSec packets.
+          This match extension allows you to match a range of SPIs
+          inside AH header of IPSec packets.
 
           To compile it as a module, choose M here.  If unsure, say N.
 
diff --git a/net/ipv4/netfilter/Makefile b/net/ipv4/netfilter/Makefile
index f2cd9a6c5b91..461cb1eb5de7 100644
--- a/net/ipv4/netfilter/Makefile
+++ b/net/ipv4/netfilter/Makefile
@@ -53,13 +53,12 @@ obj-$(CONFIG_IP_NF_RAW) += iptable_raw.o
 # matches
 obj-$(CONFIG_IP_NF_MATCH_HASHLIMIT) += ipt_hashlimit.o
 obj-$(CONFIG_IP_NF_MATCH_IPRANGE) += ipt_iprange.o
-obj-$(CONFIG_IP_NF_MATCH_MULTIPORT) += ipt_multiport.o
 obj-$(CONFIG_IP_NF_MATCH_OWNER) += ipt_owner.o
 obj-$(CONFIG_IP_NF_MATCH_TOS) += ipt_tos.o
 obj-$(CONFIG_IP_NF_MATCH_RECENT) += ipt_recent.o
 obj-$(CONFIG_IP_NF_MATCH_ECN) += ipt_ecn.o
 obj-$(CONFIG_IP_NF_MATCH_DSCP) += ipt_dscp.o
-obj-$(CONFIG_IP_NF_MATCH_AH_ESP) += ipt_ah.o ipt_esp.o
+obj-$(CONFIG_IP_NF_MATCH_AH) += ipt_ah.o
 obj-$(CONFIG_IP_NF_MATCH_TTL) += ipt_ttl.o
 obj-$(CONFIG_IP_NF_MATCH_ADDRTYPE) += ipt_addrtype.o
 
diff --git a/net/ipv4/netfilter/arp_tables.c b/net/ipv4/netfilter/arp_tables.c
index a44a5d73457d..c2d92f99a2b8 100644
--- a/net/ipv4/netfilter/arp_tables.c
+++ b/net/ipv4/netfilter/arp_tables.c
@@ -646,7 +646,7 @@ static int translate_table(const char *name,
         }
 
         /* And one copy for every other CPU */
-        for_each_cpu(i) {
+        for_each_possible_cpu(i) {
                 if (newinfo->entries[i] && newinfo->entries[i] != entry0)
                         memcpy(newinfo->entries[i], entry0, newinfo->size);
         }
@@ -696,7 +696,7 @@ static void get_counters(const struct xt_table_info *t,
                            counters,
                            &i);
 
-        for_each_cpu(cpu) {
+        for_each_possible_cpu(cpu) {
                 if (cpu == curcpu)
                         continue;
                 i = 0;
diff --git a/net/ipv4/netfilter/arptable_filter.c b/net/ipv4/netfilter/arptable_filter.c
index d0d379c7df9a..d7c472faa53b 100644
--- a/net/ipv4/netfilter/arptable_filter.c
+++ b/net/ipv4/netfilter/arptable_filter.c
@@ -181,33 +181,26 @@ static struct nf_hook_ops arpt_ops[] = {
 
 static int __init arptable_filter_init(void)
 {
-        int ret, i;
+        int ret;
 
         /* Register table */
         ret = arpt_register_table(&packet_filter, &initial_table.repl);
         if (ret < 0)
                 return ret;
 
-        for (i = 0; i < ARRAY_SIZE(arpt_ops); i++)
-                if ((ret = nf_register_hook(&arpt_ops[i])) < 0)
-                        goto cleanup_hooks;
+        ret = nf_register_hooks(arpt_ops, ARRAY_SIZE(arpt_ops));
+        if (ret < 0)
+                goto cleanup_table;
         return ret;
 
-cleanup_hooks:
-        while (--i >= 0)
-                nf_unregister_hook(&arpt_ops[i]);
-
+cleanup_table:
         arpt_unregister_table(&packet_filter);
         return ret;
 }
 
 static void __exit arptable_filter_fini(void)
 {
-        unsigned int i;
-
-        for (i = 0; i < ARRAY_SIZE(arpt_ops); i++)
-                nf_unregister_hook(&arpt_ops[i]);
-
+        nf_unregister_hooks(arpt_ops, ARRAY_SIZE(arpt_ops));
         arpt_unregister_table(&packet_filter);
 }
 
diff --git a/net/ipv4/netfilter/ip_conntrack_core.c b/net/ipv4/netfilter/ip_conntrack_core.c
index ceaabc18202b..979a2eac6f00 100644
--- a/net/ipv4/netfilter/ip_conntrack_core.c
+++ b/net/ipv4/netfilter/ip_conntrack_core.c
@@ -133,7 +133,7 @@ static void ip_ct_event_cache_flush(void)
         struct ip_conntrack_ecache *ecache;
         int cpu;
 
-        for_each_cpu(cpu) {
+        for_each_possible_cpu(cpu) {
                 ecache = &per_cpu(ip_conntrack_ecache, cpu);
                 if (ecache->ct)
                         ip_conntrack_put(ecache->ct);
diff --git a/net/ipv4/netfilter/ip_conntrack_helper_h323.c b/net/ipv4/netfilter/ip_conntrack_helper_h323.c
index daeb1395faa4..2c2fb700d835 100644
--- a/net/ipv4/netfilter/ip_conntrack_helper_h323.c
+++ b/net/ipv4/netfilter/ip_conntrack_helper_h323.c
@@ -9,37 +9,6 @@
  * Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
  *
  * For more information, please see http://nath323.sourceforge.net/
- *
- * Changes:
- *      2006-02-01 - initial version 0.1
- *
- *      2006-02-20 - version 0.2
- *        1. Changed source format to follow kernel conventions
- *        2. Deleted some unnecessary structures
- *        3. Minor fixes
- *
- *      2006-03-10 - version 0.3
- *        1. Added support for multiple TPKTs in one packet (suggested by
- *           Patrick McHardy)
- *        2. Avoid excessive stack usage (based on Patrick McHardy's patch)
- *        3. Added support for non-linear skb (based on Patrick McHardy's patch)
- *        4. Fixed missing H.245 module owner (Patrick McHardy)
- *        5. Avoid long RAS expectation chains (Patrick McHardy)
- *        6. Fixed incorrect __exit attribute (Patrick McHardy)
- *        7. Eliminated unnecessary return code
- *        8. Fixed incorrect use of NAT data from conntrack code (suggested by
- *           Patrick McHardy)
- *        9. Fixed TTL calculation error in RCF
- *        10. Added TTL support in RRQ
- *        11. Better support for separate TPKT header and data
- *
- *      2006-03-15 - version 0.4
- *        1. Added support for T.120 channels
- *        2. Added parameter gkrouted_only (suggested by Patrick McHardy)
- *        3. Splitted ASN.1 code and data (suggested by Patrick McHardy)
- *        4. Sort ASN.1 data to avoid forwarding declarations (suggested by
- *           Patrick McHardy)
- *        5. Reset next TPKT data length in get_tpkt_data()
  */
 
 #include <linux/config.h>
@@ -54,8 +23,6 @@
 #include <linux/netfilter_ipv4/ip_conntrack_h323.h>
 #include <linux/moduleparam.h>
 
-#include "ip_conntrack_helper_h323_asn1.h"
-
 #if 0
 #define DEBUGP printk
 #else
@@ -63,6 +30,10 @@
 #endif
 
 /* Parameters */
+static unsigned int default_rrq_ttl = 300;
+module_param(default_rrq_ttl, uint, 0600);
+MODULE_PARM_DESC(default_rrq_ttl, "use this TTL if it's missing in RRQ");
+
 static int gkrouted_only = 1;
 module_param(gkrouted_only, int, 0600);
 MODULE_PARM_DESC(gkrouted_only, "only accept calls from gatekeeper");
@@ -222,8 +193,8 @@ static int get_tpkt_data(struct sk_buff **pskb, struct ip_conntrack *ct,
 }
 
 /****************************************************************************/
-int get_h245_addr(unsigned char *data, H245_TransportAddress * addr,
-                  u_int32_t * ip, u_int16_t * port)
+static int get_h245_addr(unsigned char *data, H245_TransportAddress * addr,
+                         u_int32_t * ip, u_int16_t * port)
 {
         unsigned char *p;
 
@@ -1302,7 +1273,7 @@ static int process_rrq(struct sk_buff **pskb, struct ip_conntrack *ct,
                 DEBUGP("ip_ct_ras: RRQ TTL = %u seconds\n", rrq->timeToLive);
                 info->timeout = rrq->timeToLive;
         } else
-                info->timeout = 0;
+                info->timeout = default_rrq_ttl;
 
         return 0;
 }
@@ -1713,18 +1684,17 @@ static int __init init(void)
 module_init(init);
 module_exit(fini);
 
-EXPORT_SYMBOL(get_h245_addr);
-EXPORT_SYMBOL(get_h225_addr);
-EXPORT_SYMBOL(ip_conntrack_h245_expect);
-EXPORT_SYMBOL(ip_conntrack_q931_expect);
-EXPORT_SYMBOL(set_h245_addr_hook);
-EXPORT_SYMBOL(set_h225_addr_hook);
-EXPORT_SYMBOL(set_sig_addr_hook);
-EXPORT_SYMBOL(set_ras_addr_hook);
-EXPORT_SYMBOL(nat_rtp_rtcp_hook);
-EXPORT_SYMBOL(nat_t120_hook);
-EXPORT_SYMBOL(nat_h245_hook);
-EXPORT_SYMBOL(nat_q931_hook);
+EXPORT_SYMBOL_GPL(get_h225_addr);
+EXPORT_SYMBOL_GPL(ip_conntrack_h245_expect);
+EXPORT_SYMBOL_GPL(ip_conntrack_q931_expect);
+EXPORT_SYMBOL_GPL(set_h245_addr_hook);
+EXPORT_SYMBOL_GPL(set_h225_addr_hook);
+EXPORT_SYMBOL_GPL(set_sig_addr_hook);
+EXPORT_SYMBOL_GPL(set_ras_addr_hook);
+EXPORT_SYMBOL_GPL(nat_rtp_rtcp_hook);
+EXPORT_SYMBOL_GPL(nat_t120_hook);
+EXPORT_SYMBOL_GPL(nat_h245_hook);
+EXPORT_SYMBOL_GPL(nat_q931_hook);
 
 MODULE_AUTHOR("Jing Min Zhao <zhaojingmin@users.sourceforge.net>");
 MODULE_DESCRIPTION("H.323 connection tracking helper");
diff --git a/net/ipv4/netfilter/ip_conntrack_helper_h323_asn1.c b/net/ipv4/netfilter/ip_conntrack_helper_h323_asn1.c
index afa525129b51..48078002e450 100644
--- a/net/ipv4/netfilter/ip_conntrack_helper_h323_asn1.c
+++ b/net/ipv4/netfilter/ip_conntrack_helper_h323_asn1.c
@@ -15,7 +15,7 @@
 #else
 #include <stdio.h>
 #endif
-#include "ip_conntrack_helper_h323_asn1.h"
+#include <linux/netfilter_ipv4/ip_conntrack_helper_h323_asn1.h>
 
 /* Trace Flag */
 #ifndef H323_TRACE
diff --git a/net/ipv4/netfilter/ip_conntrack_netlink.c b/net/ipv4/netfilter/ip_conntrack_netlink.c
index 9b6e19bae90f..01bd7cab9367 100644
--- a/net/ipv4/netfilter/ip_conntrack_netlink.c
+++ b/net/ipv4/netfilter/ip_conntrack_netlink.c
@@ -1658,7 +1658,7 @@ static void __exit ctnetlink_exit(void)
         printk("ctnetlink: unregistering from nfnetlink.\n");
 
 #ifdef CONFIG_IP_NF_CONNTRACK_EVENTS
-        ip_conntrack_unregister_notifier(&ctnl_notifier_exp);
+        ip_conntrack_expect_unregister_notifier(&ctnl_notifier_exp);
         ip_conntrack_unregister_notifier(&ctnl_notifier);
 #endif
 
diff --git a/net/ipv4/netfilter/ip_conntrack_proto_icmp.c b/net/ipv4/netfilter/ip_conntrack_proto_icmp.c
index 3021af0910f1..d8b14a9010a6 100644
--- a/net/ipv4/netfilter/ip_conntrack_proto_icmp.c
+++ b/net/ipv4/netfilter/ip_conntrack_proto_icmp.c
@@ -224,25 +224,14 @@ icmp_error(struct sk_buff *skb, enum ip_conntrack_info *ctinfo,
         }
 
         /* See ip_conntrack_proto_tcp.c */
-        if (hooknum != NF_IP_PRE_ROUTING)
-                goto checksum_skipped;
-
-        switch (skb->ip_summed) {
-        case CHECKSUM_HW:
-                if (!(u16)csum_fold(skb->csum)) 
-                        break;
-                /* fall through */
-        case CHECKSUM_NONE:
-                skb->csum = 0;
-                if (__skb_checksum_complete(skb)) {
-                        if (LOG_INVALID(IPPROTO_ICMP))
-                                nf_log_packet(PF_INET, 0, skb, NULL, NULL, NULL,
-                                              "ip_ct_icmp: bad ICMP checksum ");
-                        return -NF_ACCEPT;
-                }
+        if (hooknum == NF_IP_PRE_ROUTING &&
+            nf_ip_checksum(skb, hooknum, skb->nh.iph->ihl * 4, 0)) {
+                if (LOG_INVALID(IPPROTO_ICMP))
+                        nf_log_packet(PF_INET, 0, skb, NULL, NULL, NULL,
+                                      "ip_ct_icmp: bad ICMP checksum ");
+                return -NF_ACCEPT;
         }
 
-checksum_skipped:
         /*
          *      18 is the highest 'known' ICMP type. Anything else is a mystery
          *
diff --git a/net/ipv4/netfilter/ip_conntrack_proto_tcp.c b/net/ipv4/netfilter/ip_conntrack_proto_tcp.c
index e0dc37063545..062b252b58ad 100644
--- a/net/ipv4/netfilter/ip_conntrack_proto_tcp.c
+++ b/net/ipv4/netfilter/ip_conntrack_proto_tcp.c
@@ -870,11 +870,8 @@ static int tcp_error(struct sk_buff *skb,
          * and moreover root might send raw packets.
          */
         /* FIXME: Source route IP option packets --RR */
-        if (hooknum == NF_IP_PRE_ROUTING
-            && skb->ip_summed != CHECKSUM_UNNECESSARY
-            && csum_tcpudp_magic(iph->saddr, iph->daddr, tcplen, IPPROTO_TCP,
-                                 skb->ip_summed == CHECKSUM_HW ? skb->csum
-                                 : skb_checksum(skb, iph->ihl*4, tcplen, 0))) {
+        if (hooknum == NF_IP_PRE_ROUTING &&
+            nf_ip_checksum(skb, hooknum, iph->ihl * 4, IPPROTO_TCP)) {
                 if (LOG_INVALID(IPPROTO_TCP))
                         nf_log_packet(PF_INET, 0, skb, NULL, NULL, NULL,
                                   "ip_ct_tcp: bad TCP checksum ");
diff --git a/net/ipv4/netfilter/ip_conntrack_proto_udp.c b/net/ipv4/netfilter/ip_conntrack_proto_udp.c
index 55b7d3210adf..70899868783b 100644
--- a/net/ipv4/netfilter/ip_conntrack_proto_udp.c
+++ b/net/ipv4/netfilter/ip_conntrack_proto_udp.c
@@ -120,11 +120,8 @@ static int udp_error(struct sk_buff *skb, enum ip_conntrack_info *ctinfo,
          * because the semantic of CHECKSUM_HW is different there 
          * and moreover root might send raw packets.
          * FIXME: Source route IP option packets --RR */
-        if (hooknum == NF_IP_PRE_ROUTING
-            && skb->ip_summed != CHECKSUM_UNNECESSARY
-            && csum_tcpudp_magic(iph->saddr, iph->daddr, udplen, IPPROTO_UDP,
-                                 skb->ip_summed == CHECKSUM_HW ? skb->csum
-                                 : skb_checksum(skb, iph->ihl*4, udplen, 0))) {
+        if (hooknum == NF_IP_PRE_ROUTING &&
+            nf_ip_checksum(skb, hooknum, iph->ihl * 4, IPPROTO_UDP)) {
                 if (LOG_INVALID(IPPROTO_UDP))
                         nf_log_packet(PF_INET, 0, skb, NULL, NULL, NULL,
                                   "ip_ct_udp: bad UDP checksum ");
diff --git a/net/ipv4/netfilter/ip_conntrack_standalone.c b/net/ipv4/netfilter/ip_conntrack_standalone.c
index 52076026db36..929d61f7be91 100644
--- a/net/ipv4/netfilter/ip_conntrack_standalone.c
+++ b/net/ipv4/netfilter/ip_conntrack_standalone.c
@@ -469,70 +469,63 @@ static unsigned int ip_conntrack_local(unsigned int hooknum,
 
 /* Connection tracking may drop packets, but never alters them, so
    make it the first hook. */
-static struct nf_hook_ops ip_conntrack_defrag_ops = {
-        .hook           = ip_conntrack_defrag,
-        .owner          = THIS_MODULE,
-        .pf             = PF_INET,
-        .hooknum        = NF_IP_PRE_ROUTING,
-        .priority       = NF_IP_PRI_CONNTRACK_DEFRAG,
-};
-
-static struct nf_hook_ops ip_conntrack_in_ops = {
-        .hook           = ip_conntrack_in,
-        .owner          = THIS_MODULE,
-        .pf             = PF_INET,
-        .hooknum        = NF_IP_PRE_ROUTING,
-        .priority       = NF_IP_PRI_CONNTRACK,
-};
-
-static struct nf_hook_ops ip_conntrack_defrag_local_out_ops = {
-        .hook           = ip_conntrack_defrag,
-        .owner          = THIS_MODULE,
-        .pf             = PF_INET,
-        .hooknum        = NF_IP_LOCAL_OUT,
-        .priority       = NF_IP_PRI_CONNTRACK_DEFRAG,
-};
-
-static struct nf_hook_ops ip_conntrack_local_out_ops = {
-        .hook           = ip_conntrack_local,
-        .owner          = THIS_MODULE,
-        .pf             = PF_INET,
-        .hooknum        = NF_IP_LOCAL_OUT,
-        .priority       = NF_IP_PRI_CONNTRACK,
-};
-
-/* helpers */
-static struct nf_hook_ops ip_conntrack_helper_out_ops = {
-        .hook           = ip_conntrack_help,
-        .owner          = THIS_MODULE,
-        .pf             = PF_INET,
-        .hooknum        = NF_IP_POST_ROUTING,
-        .priority       = NF_IP_PRI_CONNTRACK_HELPER,
-};
-
-static struct nf_hook_ops ip_conntrack_helper_in_ops = {
-        .hook           = ip_conntrack_help,
-        .owner          = THIS_MODULE,
-        .pf             = PF_INET,
-        .hooknum        = NF_IP_LOCAL_IN,
-        .priority       = NF_IP_PRI_CONNTRACK_HELPER,
-};
-
-/* Refragmenter; last chance. */
-static struct nf_hook_ops ip_conntrack_out_ops = {
-        .hook           = ip_confirm,
-        .owner          = THIS_MODULE,
-        .pf             = PF_INET,
-        .hooknum        = NF_IP_POST_ROUTING,
-        .priority       = NF_IP_PRI_CONNTRACK_CONFIRM,
-};
-
-static struct nf_hook_ops ip_conntrack_local_in_ops = {
-        .hook           = ip_confirm,
-        .owner          = THIS_MODULE,
-        .pf             = PF_INET,
-        .hooknum        = NF_IP_LOCAL_IN,
-        .priority       = NF_IP_PRI_CONNTRACK_CONFIRM,
+static struct nf_hook_ops ip_conntrack_ops[] = {
+        {
+                .hook           = ip_conntrack_defrag,
+                .owner          = THIS_MODULE,
+                .pf             = PF_INET,
+                .hooknum        = NF_IP_PRE_ROUTING,
+                .priority       = NF_IP_PRI_CONNTRACK_DEFRAG,
+        },
+        {
+                .hook           = ip_conntrack_in,
+                .owner          = THIS_MODULE,
+                .pf             = PF_INET,
+                .hooknum        = NF_IP_PRE_ROUTING,
+                .priority       = NF_IP_PRI_CONNTRACK,
+        },
+        {
+                .hook           = ip_conntrack_defrag,
+                .owner          = THIS_MODULE,
+                .pf             = PF_INET,
+                .hooknum        = NF_IP_LOCAL_OUT,
+                .priority       = NF_IP_PRI_CONNTRACK_DEFRAG,
+        },
+        {
+                .hook           = ip_conntrack_local,
+                .owner          = THIS_MODULE,
+                .pf             = PF_INET,
+                .hooknum        = NF_IP_LOCAL_OUT,
+                .priority       = NF_IP_PRI_CONNTRACK,
+        },
+        {
+                .hook           = ip_conntrack_help,
+                .owner          = THIS_MODULE,
+                .pf             = PF_INET,
+                .hooknum        = NF_IP_POST_ROUTING,
+                .priority       = NF_IP_PRI_CONNTRACK_HELPER,
+        },
+        {
+                .hook           = ip_conntrack_help,
+                .owner          = THIS_MODULE,
+                .pf             = PF_INET,
+                .hooknum        = NF_IP_LOCAL_IN,
+                .priority       = NF_IP_PRI_CONNTRACK_HELPER,
+        },
+        {
+                .hook           = ip_confirm,
+                .owner          = THIS_MODULE,
+                .pf             = PF_INET,
+                .hooknum        = NF_IP_POST_ROUTING,
+                .priority       = NF_IP_PRI_CONNTRACK_CONFIRM,
+        },
+        {
+                .hook           = ip_confirm,
+                .owner          = THIS_MODULE,
+                .pf             = PF_INET,
+                .hooknum        = NF_IP_LOCAL_IN,
+                .priority       = NF_IP_PRI_CONNTRACK_CONFIRM,
+        },
 };
 
 /* Sysctl support */
@@ -783,18 +776,46 @@ static ctl_table ip_ct_net_table[] = {
 EXPORT_SYMBOL(ip_ct_log_invalid);
 #endif /* CONFIG_SYSCTL */
 
-static int init_or_cleanup(int init)
+/* FIXME: Allow NULL functions and sub in pointers to generic for
+   them. --RR */
+int ip_conntrack_protocol_register(struct ip_conntrack_protocol *proto)
+{
+        int ret = 0;
+
+        write_lock_bh(&ip_conntrack_lock);
+        if (ip_ct_protos[proto->proto] != &ip_conntrack_generic_protocol) {
+                ret = -EBUSY;
+                goto out;
+        }
+        ip_ct_protos[proto->proto] = proto;
+ out:
+        write_unlock_bh(&ip_conntrack_lock);
+        return ret;
+}
+
+void ip_conntrack_protocol_unregister(struct ip_conntrack_protocol *proto)
+{
+        write_lock_bh(&ip_conntrack_lock);
+        ip_ct_protos[proto->proto] = &ip_conntrack_generic_protocol;
+        write_unlock_bh(&ip_conntrack_lock);
+
+        /* Somebody could be still looking at the proto in bh. */
+        synchronize_net();
+
+        /* Remove all contrack entries for this protocol */
+        ip_ct_iterate_cleanup(kill_proto, &proto->proto);
+}
+
+static int __init ip_conntrack_standalone_init(void)
 {
 #ifdef CONFIG_PROC_FS
         struct proc_dir_entry *proc, *proc_exp, *proc_stat;
 #endif
         int ret = 0;
 
-        if (!init) goto cleanup;
-
         ret = ip_conntrack_init();
         if (ret < 0)
-                goto cleanup_nothing;
+                return ret;
 
 #ifdef CONFIG_PROC_FS
         ret = -ENOMEM;
@@ -813,78 +834,25 @@ static int init_or_cleanup(int init)
         proc_stat->owner = THIS_MODULE;
 #endif
 
-        ret = nf_register_hook(&ip_conntrack_defrag_ops);
+        ret = nf_register_hooks(ip_conntrack_ops, ARRAY_SIZE(ip_conntrack_ops));
         if (ret < 0) {
-                printk("ip_conntrack: can't register pre-routing defrag hook.\n");
+                printk("ip_conntrack: can't register hooks.\n");
                 goto cleanup_proc_stat;
         }
-        ret = nf_register_hook(&ip_conntrack_defrag_local_out_ops);
-        if (ret < 0) {
-                printk("ip_conntrack: can't register local_out defrag hook.\n");
-                goto cleanup_defragops;
-        }
-        ret = nf_register_hook(&ip_conntrack_in_ops);
-        if (ret < 0) {
-                printk("ip_conntrack: can't register pre-routing hook.\n");
-                goto cleanup_defraglocalops;
-        }
-        ret = nf_register_hook(&ip_conntrack_local_out_ops);
-        if (ret < 0) {
-                printk("ip_conntrack: can't register local out hook.\n");
-                goto cleanup_inops;
-        }
-        ret = nf_register_hook(&ip_conntrack_helper_in_ops);
-        if (ret < 0) {
-                printk("ip_conntrack: can't register local in helper hook.\n");
-                goto cleanup_inandlocalops;
-        }
-        ret = nf_register_hook(&ip_conntrack_helper_out_ops);
-        if (ret < 0) {
-                printk("ip_conntrack: can't register postrouting helper hook.\n");
-                goto cleanup_helperinops;
-        }
-        ret = nf_register_hook(&ip_conntrack_out_ops);
-        if (ret < 0) {
-                printk("ip_conntrack: can't register post-routing hook.\n");
-                goto cleanup_helperoutops;
-        }
-        ret = nf_register_hook(&ip_conntrack_local_in_ops);
-        if (ret < 0) {
-                printk("ip_conntrack: can't register local in hook.\n");
-                goto cleanup_inoutandlocalops;
-        }
 #ifdef CONFIG_SYSCTL
         ip_ct_sysctl_header = register_sysctl_table(ip_ct_net_table, 0);
         if (ip_ct_sysctl_header == NULL) {
                 printk("ip_conntrack: can't register to sysctl.\n");
                 ret = -ENOMEM;
-                goto cleanup_localinops;
+                goto cleanup_hooks;
         }
 #endif
-
         return ret;
 
- cleanup:
-        synchronize_net();
 #ifdef CONFIG_SYSCTL
-        unregister_sysctl_table(ip_ct_sysctl_header);
- cleanup_localinops:
+ cleanup_hooks:
+        nf_unregister_hooks(ip_conntrack_ops, ARRAY_SIZE(ip_conntrack_ops));
 #endif
-        nf_unregister_hook(&ip_conntrack_local_in_ops);
- cleanup_inoutandlocalops:
-        nf_unregister_hook(&ip_conntrack_out_ops);
- cleanup_helperoutops:
-        nf_unregister_hook(&ip_conntrack_helper_out_ops);
- cleanup_helperinops:
-        nf_unregister_hook(&ip_conntrack_helper_in_ops);
- cleanup_inandlocalops:
-        nf_unregister_hook(&ip_conntrack_local_out_ops);
- cleanup_inops:
-        nf_unregister_hook(&ip_conntrack_in_ops);
- cleanup_defraglocalops:
-        nf_unregister_hook(&ip_conntrack_defrag_local_out_ops);
- cleanup_defragops:
-        nf_unregister_hook(&ip_conntrack_defrag_ops);
  cleanup_proc_stat:
 #ifdef CONFIG_PROC_FS
         remove_proc_entry("ip_conntrack", proc_net_stat);
@@ -895,48 +863,22 @@ static int init_or_cleanup(int init)
  cleanup_init:
 #endif /* CONFIG_PROC_FS */
         ip_conntrack_cleanup();
- cleanup_nothing:
-        return ret;
-}
-
-/* FIXME: Allow NULL functions and sub in pointers to generic for
-   them. --RR */
-int ip_conntrack_protocol_register(struct ip_conntrack_protocol *proto)
-{
-        int ret = 0;
-
-        write_lock_bh(&ip_conntrack_lock);
-        if (ip_ct_protos[proto->proto] != &ip_conntrack_generic_protocol) {
-                ret = -EBUSY;
-                goto out;
-        }
-        ip_ct_protos[proto->proto] = proto;
- out:
-        write_unlock_bh(&ip_conntrack_lock);
         return ret;
 }
 
-void ip_conntrack_protocol_unregister(struct ip_conntrack_protocol *proto)
-{
-        write_lock_bh(&ip_conntrack_lock);
-        ip_ct_protos[proto->proto] = &ip_conntrack_generic_protocol;
-        write_unlock_bh(&ip_conntrack_lock);
-        
-        /* Somebody could be still looking at the proto in bh. */
-        synchronize_net();
-
-        /* Remove all contrack entries for this protocol */
-        ip_ct_iterate_cleanup(kill_proto, &proto->proto);
-}
-
-static int __init ip_conntrack_standalone_init(void)
-{
-        return init_or_cleanup(1);
-}
-
 static void __exit ip_conntrack_standalone_fini(void)
 {
-        init_or_cleanup(0);
+        synchronize_net();
+#ifdef CONFIG_SYSCTL
+        unregister_sysctl_table(ip_ct_sysctl_header);
+#endif
+        nf_unregister_hooks(ip_conntrack_ops, ARRAY_SIZE(ip_conntrack_ops));
+#ifdef CONFIG_PROC_FS
+        remove_proc_entry("ip_conntrack", proc_net_stat);
+        proc_net_remove("ip_conntrack_expect");
+        proc_net_remove("ip_conntrack");
+#endif /* CONFIG_PROC_FS */
+        ip_conntrack_cleanup();
 }
 
 module_init(ip_conntrack_standalone_init);
diff --git a/net/ipv4/netfilter/ip_nat_helper_h323.c b/net/ipv4/netfilter/ip_nat_helper_h323.c
index a0bc883928c0..d45663d137a7 100644
--- a/net/ipv4/netfilter/ip_nat_helper_h323.c
+++ b/net/ipv4/netfilter/ip_nat_helper_h323.c
@@ -7,24 +7,6 @@
  *
  * Based on the 'brute force' H.323 NAT module by
  * Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
- *
- * Changes:
- *      2006-02-01 - initial version 0.1
- *
- *      2006-02-20 - version 0.2
- *        1. Changed source format to follow kernel conventions
- *        2. Deleted some unnecessary structures
- *        3. Minor fixes
- *
- *      2006-03-10 - version 0.3
- *        1. Added support for multiple TPKTs in one packet (suggested by
- *           Patrick McHardy)
- *        2. Added support for non-linear skb (based on Patrick McHardy's patch)
- *        3. Eliminated unnecessary return code
- *
- *      2006-03-15 - version 0.4
- *        1. Added support for T.120 channels
- *        2. Added parameter gkrouted_only (suggested by Patrick McHardy)
  */
 
 #include <linux/module.h>
@@ -41,65 +23,12 @@
 #include <linux/netfilter_ipv4/ip_conntrack_h323.h>
 #include <linux/netfilter_ipv4/ip_conntrack_helper.h>
 
-#include "ip_conntrack_helper_h323_asn1.h"
-
 #if 0
 #define DEBUGP printk
 #else
 #define DEBUGP(format, args...)
 #endif
 
-extern int get_h245_addr(unsigned char *data, H245_TransportAddress * addr,
-                         u_int32_t * ip, u_int16_t * port);
-extern int get_h225_addr(unsigned char *data, TransportAddress * addr,
-                         u_int32_t * ip, u_int16_t * port);
-extern void ip_conntrack_h245_expect(struct ip_conntrack *new,
-                                     struct ip_conntrack_expect *this);
-extern void ip_conntrack_q931_expect(struct ip_conntrack *new,
-                                     struct ip_conntrack_expect *this);
-extern int (*set_h245_addr_hook) (struct sk_buff ** pskb,
-                                  unsigned char **data, int dataoff,
-                                  H245_TransportAddress * addr,
-                                  u_int32_t ip, u_int16_t port);
-extern int (*set_h225_addr_hook) (struct sk_buff ** pskb,
-                                  unsigned char **data, int dataoff,
-                                  TransportAddress * addr,
-                                  u_int32_t ip, u_int16_t port);
-extern int (*set_sig_addr_hook) (struct sk_buff ** pskb,
-                                 struct ip_conntrack * ct,
-                                 enum ip_conntrack_info ctinfo,
-                                 unsigned char **data,
-                                 TransportAddress * addr, int count);
-extern int (*set_ras_addr_hook) (struct sk_buff ** pskb,
-                                 struct ip_conntrack * ct,
-                                 enum ip_conntrack_info ctinfo,
-                                 unsigned char **data,
-                                 TransportAddress * addr, int count);
-extern int (*nat_rtp_rtcp_hook) (struct sk_buff ** pskb,
-                                 struct ip_conntrack * ct,
-                                 enum ip_conntrack_info ctinfo,
-                                 unsigned char **data, int dataoff,
-                                 H245_TransportAddress * addr,
-                                 u_int16_t port, u_int16_t rtp_port,
-                                 struct ip_conntrack_expect * rtp_exp,
-                                 struct ip_conntrack_expect * rtcp_exp);
-extern int (*nat_t120_hook) (struct sk_buff ** pskb, struct ip_conntrack * ct,
-                             enum ip_conntrack_info ctinfo,
-                             unsigned char **data, int dataoff,
-                             H245_TransportAddress * addr, u_int16_t port,
-                             struct ip_conntrack_expect * exp);
-extern int (*nat_h245_hook) (struct sk_buff ** pskb, struct ip_conntrack * ct,
-                             enum ip_conntrack_info ctinfo,
-                             unsigned char **data, int dataoff,
-                             TransportAddress * addr, u_int16_t port,
-                             struct ip_conntrack_expect * exp);
-extern int (*nat_q931_hook) (struct sk_buff ** pskb, struct ip_conntrack * ct,
-                             enum ip_conntrack_info ctinfo,
-                             unsigned char **data, TransportAddress * addr,
-                             int idx, u_int16_t port,
-                             struct ip_conntrack_expect * exp);
-
-
 /****************************************************************************/
 static int set_addr(struct sk_buff **pskb,
                     unsigned char **data, int dataoff,
diff --git a/net/ipv4/netfilter/ip_nat_rule.c b/net/ipv4/netfilter/ip_nat_rule.c
index efba8c4e42e0..1aba926c1cb0 100644
--- a/net/ipv4/netfilter/ip_nat_rule.c
+++ b/net/ipv4/netfilter/ip_nat_rule.c
@@ -279,7 +279,7 @@ static struct ipt_target ipt_dnat_reg = {
         .target         = ipt_dnat_target,
         .targetsize     = sizeof(struct ip_nat_multi_range_compat),
         .table          = "nat",
-        .hooks          = 1 << NF_IP_PRE_ROUTING,
+        .hooks          = (1 << NF_IP_PRE_ROUTING) | (1 << NF_IP_LOCAL_OUT),
         .checkentry     = ipt_dnat_checkentry,
 };
 
diff --git a/net/ipv4/netfilter/ip_nat_standalone.c b/net/ipv4/netfilter/ip_nat_standalone.c
index 3505b0de2e04..8f760b28617e 100644
--- a/net/ipv4/netfilter/ip_nat_standalone.c
+++ b/net/ipv4/netfilter/ip_nat_standalone.c
@@ -299,69 +299,63 @@ ip_nat_adjust(unsigned int hooknum,
 
 /* We must be after connection tracking and before packet filtering. */
 
-/* Before packet filtering, change destination */
-static struct nf_hook_ops ip_nat_in_ops = {
-        .hook           = ip_nat_in,
-        .owner          = THIS_MODULE,
-        .pf             = PF_INET,
-        .hooknum        = NF_IP_PRE_ROUTING,
-        .priority       = NF_IP_PRI_NAT_DST,
+static struct nf_hook_ops ip_nat_ops[] = {
+        /* Before packet filtering, change destination */
+        {
+                .hook           = ip_nat_in,
+                .owner          = THIS_MODULE,
+                .pf             = PF_INET,
+                .hooknum        = NF_IP_PRE_ROUTING,
+                .priority       = NF_IP_PRI_NAT_DST,
+        },
+        /* After packet filtering, change source */
+        {
+                .hook           = ip_nat_out,
+                .owner          = THIS_MODULE,
+                .pf             = PF_INET,
+                .hooknum        = NF_IP_POST_ROUTING,
+                .priority       = NF_IP_PRI_NAT_SRC,
+        },
+        /* After conntrack, adjust sequence number */
+        {
+                .hook           = ip_nat_adjust,
+                .owner          = THIS_MODULE,
+                .pf             = PF_INET,
+                .hooknum        = NF_IP_POST_ROUTING,
+                .priority       = NF_IP_PRI_NAT_SEQ_ADJUST,
+        },
+        /* Before packet filtering, change destination */
+        {
+                .hook           = ip_nat_local_fn,
+                .owner          = THIS_MODULE,
+                .pf             = PF_INET,
+                .hooknum        = NF_IP_LOCAL_OUT,
+                .priority       = NF_IP_PRI_NAT_DST,
+        },
+        /* After packet filtering, change source */
+        {
+                .hook           = ip_nat_fn,
+                .owner          = THIS_MODULE,
+                .pf             = PF_INET,
+                .hooknum        = NF_IP_LOCAL_IN,
+                .priority       = NF_IP_PRI_NAT_SRC,
+        },
+        /* After conntrack, adjust sequence number */
+        {
+                .hook           = ip_nat_adjust,
+                .owner          = THIS_MODULE,
+                .pf             = PF_INET,
+                .hooknum        = NF_IP_LOCAL_IN,
+                .priority       = NF_IP_PRI_NAT_SEQ_ADJUST,
+        },
 };
 
-/* After packet filtering, change source */
-static struct nf_hook_ops ip_nat_out_ops = {
-        .hook           = ip_nat_out,
-        .owner          = THIS_MODULE,
-        .pf             = PF_INET,
-        .hooknum        = NF_IP_POST_ROUTING,
-        .priority       = NF_IP_PRI_NAT_SRC,
-};
-
-/* After conntrack, adjust sequence number */
-static struct nf_hook_ops ip_nat_adjust_out_ops = {
-        .hook           = ip_nat_adjust,
-        .owner          = THIS_MODULE,
-        .pf             = PF_INET,
-        .hooknum        = NF_IP_POST_ROUTING,
-        .priority       = NF_IP_PRI_NAT_SEQ_ADJUST,
-};
-
-/* Before packet filtering, change destination */
-static struct nf_hook_ops ip_nat_local_out_ops = {
-        .hook           = ip_nat_local_fn,
-        .owner          = THIS_MODULE,
-        .pf             = PF_INET,
-        .hooknum        = NF_IP_LOCAL_OUT,
-        .priority       = NF_IP_PRI_NAT_DST,
-};
-
-/* After packet filtering, change source for reply packets of LOCAL_OUT DNAT */
-static struct nf_hook_ops ip_nat_local_in_ops = {
-        .hook           = ip_nat_fn,
-        .owner          = THIS_MODULE,
-        .pf             = PF_INET,
-        .hooknum        = NF_IP_LOCAL_IN,
-        .priority       = NF_IP_PRI_NAT_SRC,
-};
-
-/* After conntrack, adjust sequence number */
-static struct nf_hook_ops ip_nat_adjust_in_ops = {
-        .hook           = ip_nat_adjust,
-        .owner          = THIS_MODULE,
-        .pf             = PF_INET,
-        .hooknum        = NF_IP_LOCAL_IN,
-        .priority       = NF_IP_PRI_NAT_SEQ_ADJUST,
-};
-
-
-static int init_or_cleanup(int init)
+static int __init ip_nat_standalone_init(void)
 {
         int ret = 0;
 
         need_conntrack();
 
-        if (!init) goto cleanup;
-
 #ifdef CONFIG_XFRM
         BUG_ON(ip_nat_decode_session != NULL);
         ip_nat_decode_session = nat_decode_session;
@@ -371,50 +365,13 @@ static int init_or_cleanup(int init)
                 printk("ip_nat_init: can't setup rules.\n");
                 goto cleanup_decode_session;
         }
-        ret = nf_register_hook(&ip_nat_in_ops);
+        ret = nf_register_hooks(ip_nat_ops, ARRAY_SIZE(ip_nat_ops));
         if (ret < 0) {
-                printk("ip_nat_init: can't register in hook.\n");
+                printk("ip_nat_init: can't register hooks.\n");
                 goto cleanup_rule_init;
         }
-        ret = nf_register_hook(&ip_nat_out_ops);
-        if (ret < 0) {
-                printk("ip_nat_init: can't register out hook.\n");
-                goto cleanup_inops;
-        }
-        ret = nf_register_hook(&ip_nat_adjust_in_ops);
-        if (ret < 0) {
-                printk("ip_nat_init: can't register adjust in hook.\n");
-                goto cleanup_outops;
-        }
-        ret = nf_register_hook(&ip_nat_adjust_out_ops);
-        if (ret < 0) {
-                printk("ip_nat_init: can't register adjust out hook.\n");
-                goto cleanup_adjustin_ops;
-        }
-        ret = nf_register_hook(&ip_nat_local_out_ops);
-        if (ret < 0) {
-                printk("ip_nat_init: can't register local out hook.\n");
-                goto cleanup_adjustout_ops;
-        }
-        ret = nf_register_hook(&ip_nat_local_in_ops);
-        if (ret < 0) {
-                printk("ip_nat_init: can't register local in hook.\n");
-                goto cleanup_localoutops;
-        }
         return ret;
 
- cleanup:
-        nf_unregister_hook(&ip_nat_local_in_ops);
- cleanup_localoutops:
-        nf_unregister_hook(&ip_nat_local_out_ops);
- cleanup_adjustout_ops:
-        nf_unregister_hook(&ip_nat_adjust_out_ops);
- cleanup_adjustin_ops:
-        nf_unregister_hook(&ip_nat_adjust_in_ops);
- cleanup_outops:
-        nf_unregister_hook(&ip_nat_out_ops);
- cleanup_inops:
-        nf_unregister_hook(&ip_nat_in_ops);
  cleanup_rule_init:
         ip_nat_rule_cleanup();
  cleanup_decode_session:
@@ -425,14 +382,14 @@ static int init_or_cleanup(int init)
         return ret;
 }
 
-static int __init ip_nat_standalone_init(void)
-{
-        return init_or_cleanup(1);
-}
-
 static void __exit ip_nat_standalone_fini(void)
 {
-        init_or_cleanup(0);
+        nf_unregister_hooks(ip_nat_ops, ARRAY_SIZE(ip_nat_ops));
+        ip_nat_rule_cleanup();
+#ifdef CONFIG_XFRM
+        ip_nat_decode_session = NULL;
+        synchronize_net();
+#endif
 }
 
 module_init(ip_nat_standalone_init);
diff --git a/net/ipv4/netfilter/ip_queue.c b/net/ipv4/netfilter/ip_queue.c
index 896a244f8f91..b93f0494362f 100644
--- a/net/ipv4/netfilter/ip_queue.c
+++ b/net/ipv4/netfilter/ip_queue.c
@@ -662,15 +662,11 @@ static struct nf_queue_handler nfqh = {
         .outfn  = &ipq_enqueue_packet,
 };
 
-static int
-init_or_cleanup(int init)
+static int __init ip_queue_init(void)
 {
         int status = -ENOMEM;
         struct proc_dir_entry *proc;
         
-        if (!init)
-                goto cleanup;
-
         netlink_register_notifier(&ipq_nl_notifier);
         ipqnl = netlink_kernel_create(NETLINK_FIREWALL, 0, ipq_rcv_sk,
                                       THIS_MODULE);
@@ -697,11 +693,6 @@ init_or_cleanup(int init)
         }
         return status;
 
-cleanup:
-        nf_unregister_queue_handlers(&nfqh);
-        synchronize_net();
-        ipq_flush(NF_DROP);
-        
 cleanup_sysctl:
         unregister_sysctl_table(ipq_sysctl_header);
         unregister_netdevice_notifier(&ipq_dev_notifier);
@@ -717,15 +708,21 @@ cleanup_netlink_notifier:
         return status;
 }
 
-static int __init ip_queue_init(void)
-{
-        
-        return init_or_cleanup(1);
-}
-
 static void __exit ip_queue_fini(void)
 {
-        init_or_cleanup(0);
+        nf_unregister_queue_handlers(&nfqh);
+        synchronize_net();
+        ipq_flush(NF_DROP);
+
+        unregister_sysctl_table(ipq_sysctl_header);
+        unregister_netdevice_notifier(&ipq_dev_notifier);
+        proc_net_remove(IPQ_PROC_FS_NAME);
+
+        sock_release(ipqnl->sk_socket);
+        mutex_lock(&ipqnl_mutex);
+        mutex_unlock(&ipqnl_mutex);
+
+        netlink_unregister_notifier(&ipq_nl_notifier);
 }
 
 MODULE_DESCRIPTION("IPv4 packet queue handler");
diff --git a/net/ipv4/netfilter/ip_tables.c b/net/ipv4/netfilter/ip_tables.c
index 460fd905fad0..d25ac8ba6eba 100644
--- a/net/ipv4/netfilter/ip_tables.c
+++ b/net/ipv4/netfilter/ip_tables.c
@@ -24,6 +24,7 @@
 #include <linux/module.h>
 #include <linux/icmp.h>
 #include <net/ip.h>
+#include <net/compat.h>
 #include <asm/uaccess.h>
 #include <linux/mutex.h>
 #include <linux/proc_fs.h>
@@ -734,7 +735,7 @@ translate_table(const char *name,
         }
 
         /* And one copy for every other CPU */
-        for_each_cpu(i) {
+        for_each_possible_cpu(i) {
                 if (newinfo->entries[i] && newinfo->entries[i] != entry0)
                         memcpy(newinfo->entries[i], entry0, newinfo->size);
         }
@@ -787,7 +788,7 @@ get_counters(const struct xt_table_info *t,
                           counters,
                           &i);
 
-        for_each_cpu(cpu) {
+        for_each_possible_cpu(cpu) {
                 if (cpu == curcpu)
                         continue;
                 i = 0;
@@ -799,17 +800,11 @@ get_counters(const struct xt_table_info *t,
         }
 }
 
-static int
-copy_entries_to_user(unsigned int total_size,
-                     struct ipt_table *table,
-                     void __user *userptr)
+static inline struct xt_counters * alloc_counters(struct ipt_table *table)
 {
-        unsigned int off, num, countersize;
-        struct ipt_entry *e;
+        unsigned int countersize;
         struct xt_counters *counters;
         struct xt_table_info *private = table->private;
-        int ret = 0;
-        void *loc_cpu_entry;
 
         /* We need atomic snapshot of counters: rest doesn't change
            (other than comefrom, which userspace doesn't care
@@ -818,13 +813,32 @@ copy_entries_to_user(unsigned int total_size,
         counters = vmalloc_node(countersize, numa_node_id());
 
         if (counters == NULL)
-                return -ENOMEM;
+                return ERR_PTR(-ENOMEM);
 
         /* First, sum counters... */
         write_lock_bh(&table->lock);
         get_counters(private, counters);
         write_unlock_bh(&table->lock);
 
+        return counters;
+}
+
+static int
+copy_entries_to_user(unsigned int total_size,
+                     struct ipt_table *table,
+                     void __user *userptr)
+{
+        unsigned int off, num;
+        struct ipt_entry *e;
+        struct xt_counters *counters;
+        struct xt_table_info *private = table->private;
+        int ret = 0;
+        void *loc_cpu_entry;
+
+        counters = alloc_counters(table);
+        if (IS_ERR(counters))
+                return PTR_ERR(counters);
+
         /* choose the copy that is on our node/cpu, ...
          * This choice is lazy (because current thread is
          * allowed to migrate to another cpu)
@@ -884,25 +898,278 @@ copy_entries_to_user(unsigned int total_size,
         return ret;
 }
 
+#ifdef CONFIG_COMPAT
+struct compat_delta {
+        struct compat_delta *next;
+        u_int16_t offset;
+        short delta;
+};
+
+static struct compat_delta *compat_offsets = NULL;
+
+static int compat_add_offset(u_int16_t offset, short delta)
+{
+        struct compat_delta *tmp;
+
+        tmp = kmalloc(sizeof(struct compat_delta), GFP_KERNEL);
+        if (!tmp)
+                return -ENOMEM;
+        tmp->offset = offset;
+        tmp->delta = delta;
+        if (compat_offsets) {
+                tmp->next = compat_offsets->next;
+                compat_offsets->next = tmp;
+        } else {
+                compat_offsets = tmp;
+                tmp->next = NULL;
+        }
+        return 0;
+}
+
+static void compat_flush_offsets(void)
+{
+        struct compat_delta *tmp, *next;
+
+        if (compat_offsets) {
+                for(tmp = compat_offsets; tmp; tmp = next) {
+                        next = tmp->next;
+                        kfree(tmp);
+                }
+                compat_offsets = NULL;
+        }
+}
+
+static short compat_calc_jump(u_int16_t offset)
+{
+        struct compat_delta *tmp;
+        short delta;
+
+        for(tmp = compat_offsets, delta = 0; tmp; tmp = tmp->next)
+                if (tmp->offset < offset)
+                        delta += tmp->delta;
+        return delta;
+}
+
+struct compat_ipt_standard_target
+{
+        struct compat_xt_entry_target target;
+        compat_int_t verdict;
+};
+
+#define IPT_ST_OFFSET   (sizeof(struct ipt_standard_target) - \
+                                sizeof(struct compat_ipt_standard_target))
+
+struct compat_ipt_standard
+{
+        struct compat_ipt_entry entry;
+        struct compat_ipt_standard_target target;
+};
+
+static int compat_ipt_standard_fn(void *target,
+                void **dstptr, int *size, int convert)
+{
+        struct compat_ipt_standard_target compat_st, *pcompat_st;
+        struct ipt_standard_target st, *pst;
+        int ret;
+
+        ret = 0;
+        switch (convert) {
+                case COMPAT_TO_USER:
+                        pst = (struct ipt_standard_target *)target;
+                        memcpy(&compat_st.target, &pst->target,
+                                        sizeof(struct ipt_entry_target));
+                        compat_st.verdict = pst->verdict;
+                        if (compat_st.verdict > 0)
+                                compat_st.verdict -=
+                                        compat_calc_jump(compat_st.verdict);
+                        compat_st.target.u.user.target_size =
+                        sizeof(struct compat_ipt_standard_target);
+                        if (__copy_to_user(*dstptr, &compat_st,
+                                sizeof(struct compat_ipt_standard_target)))
+                                ret = -EFAULT;
+                        *size -= IPT_ST_OFFSET;
+                        *dstptr += sizeof(struct compat_ipt_standard_target);
+                        break;
+                case COMPAT_FROM_USER:
+                        pcompat_st =
+                                (struct compat_ipt_standard_target *)target;
+                        memcpy(&st.target, &pcompat_st->target,
+                                        sizeof(struct ipt_entry_target));
+                        st.verdict = pcompat_st->verdict;
+                        if (st.verdict > 0)
+                                st.verdict += compat_calc_jump(st.verdict);
+                        st.target.u.user.target_size =
+                        sizeof(struct ipt_standard_target);
+                        memcpy(*dstptr, &st,
+                                        sizeof(struct ipt_standard_target));
+                        *size += IPT_ST_OFFSET;
+                        *dstptr += sizeof(struct ipt_standard_target);
+                        break;
+                case COMPAT_CALC_SIZE:
+                        *size += IPT_ST_OFFSET;
+                        break;
+                default:
+                        ret = -ENOPROTOOPT;
+                        break;
+        }
+        return ret;
+}
+
+static inline int
+compat_calc_match(struct ipt_entry_match *m, int * size)
+{
+        if (m->u.kernel.match->compat)
+                m->u.kernel.match->compat(m, NULL, size, COMPAT_CALC_SIZE);
+        else
+                xt_compat_match(m, NULL, size, COMPAT_CALC_SIZE);
+        return 0;
+}
+
+static int compat_calc_entry(struct ipt_entry *e, struct xt_table_info *info,
+                void *base, struct xt_table_info *newinfo)
+{
+        struct ipt_entry_target *t;
+        u_int16_t entry_offset;
+        int off, i, ret;
+
+        off = 0;
+        entry_offset = (void *)e - base;
+        IPT_MATCH_ITERATE(e, compat_calc_match, &off);
+        t = ipt_get_target(e);
+        if (t->u.kernel.target->compat)
+                t->u.kernel.target->compat(t, NULL, &off, COMPAT_CALC_SIZE);
+        else
+                xt_compat_target(t, NULL, &off, COMPAT_CALC_SIZE);
+        newinfo->size -= off;
+        ret = compat_add_offset(entry_offset, off);
+        if (ret)
+                return ret;
+
+        for (i = 0; i< NF_IP_NUMHOOKS; i++) {
+                if (info->hook_entry[i] && (e < (struct ipt_entry *)
+                                (base + info->hook_entry[i])))
+                        newinfo->hook_entry[i] -= off;
+                if (info->underflow[i] && (e < (struct ipt_entry *)
+                                (base + info->underflow[i])))
+                        newinfo->underflow[i] -= off;
+        }
+        return 0;
+}
+
+static int compat_table_info(struct xt_table_info *info,
+                struct xt_table_info *newinfo)
+{
+        void *loc_cpu_entry;
+        int i;
+
+        if (!newinfo || !info)
+                return -EINVAL;
+
+        memset(newinfo, 0, sizeof(struct xt_table_info));
+        newinfo->size = info->size;
+        newinfo->number = info->number;
+        for (i = 0; i < NF_IP_NUMHOOKS; i++) {
+                newinfo->hook_entry[i] = info->hook_entry[i];
+                newinfo->underflow[i] = info->underflow[i];
+        }
+        loc_cpu_entry = info->entries[raw_smp_processor_id()];
+        return IPT_ENTRY_ITERATE(loc_cpu_entry, info->size,
+                        compat_calc_entry, info, loc_cpu_entry, newinfo);
+}
+#endif
+
+static int get_info(void __user *user, int *len, int compat)
+{
+        char name[IPT_TABLE_MAXNAMELEN];
+        struct ipt_table *t;
+        int ret;
+
+        if (*len != sizeof(struct ipt_getinfo)) {
+                duprintf("length %u != %u\n", *len,
+                        (unsigned int)sizeof(struct ipt_getinfo));
+                return -EINVAL;
+        }
+
+        if (copy_from_user(name, user, sizeof(name)) != 0)
+                return -EFAULT;
+
+        name[IPT_TABLE_MAXNAMELEN-1] = '\0';
+#ifdef CONFIG_COMPAT
+        if (compat)
+                xt_compat_lock(AF_INET);
+#endif
+        t = try_then_request_module(xt_find_table_lock(AF_INET, name),
+                        "iptable_%s", name);
+        if (t && !IS_ERR(t)) {
+                struct ipt_getinfo info;
+                struct xt_table_info *private = t->private;
+
+#ifdef CONFIG_COMPAT
+                if (compat) {
+                        struct xt_table_info tmp;
+                        ret = compat_table_info(private, &tmp);
+                        compat_flush_offsets();
+                        private =  &tmp;
+                }
+#endif
+                info.valid_hooks = t->valid_hooks;
+                memcpy(info.hook_entry, private->hook_entry,
+                                sizeof(info.hook_entry));
+                memcpy(info.underflow, private->underflow,
+                                sizeof(info.underflow));
+                info.num_entries = private->number;
+                info.size = private->size;
+                strcpy(info.name, name);
+
+                if (copy_to_user(user, &info, *len) != 0)
+                        ret = -EFAULT;
+                else
+                        ret = 0;
+
+                xt_table_unlock(t);
+                module_put(t->me);
+        } else
+                ret = t ? PTR_ERR(t) : -ENOENT;
+#ifdef CONFIG_COMPAT
+        if (compat)
+                xt_compat_unlock(AF_INET);
+#endif
+        return ret;
+}
+
 static int
-get_entries(const struct ipt_get_entries *entries,
-            struct ipt_get_entries __user *uptr)
+get_entries(struct ipt_get_entries __user *uptr, int *len)
 {
         int ret;
+        struct ipt_get_entries get;
         struct ipt_table *t;
 
-        t = xt_find_table_lock(AF_INET, entries->name);
+        if (*len < sizeof(get)) {
+                duprintf("get_entries: %u < %d\n", *len,
+                                (unsigned int)sizeof(get));
+                return -EINVAL;
+        }
+        if (copy_from_user(&get, uptr, sizeof(get)) != 0)
+                return -EFAULT;
+        if (*len != sizeof(struct ipt_get_entries) + get.size) {
+                duprintf("get_entries: %u != %u\n", *len,
+                                (unsigned int)(sizeof(struct ipt_get_entries) +
+                                get.size));
+                return -EINVAL;
+        }
+
+        t = xt_find_table_lock(AF_INET, get.name);
         if (t && !IS_ERR(t)) {
                 struct xt_table_info *private = t->private;
                 duprintf("t->private->number = %u\n",
                          private->number);
-                if (entries->size == private->size)
+                if (get.size == private->size)
                         ret = copy_entries_to_user(private->size,
                                                    t, uptr->entrytable);
                 else {
                         duprintf("get_entries: I've got %u not %u!\n",
                                  private->size,
-                                 entries->size);
+                                 get.size);
                         ret = -EINVAL;
                 }
                 module_put(t->me);
@@ -914,79 +1181,47 @@ get_entries(const struct ipt_get_entries *entries,
 }
 
 static int
-do_replace(void __user *user, unsigned int len)
+__do_replace(const char *name, unsigned int valid_hooks,
+                struct xt_table_info *newinfo, unsigned int num_counters,
+                void __user *counters_ptr)
 {
         int ret;
-        struct ipt_replace tmp;
         struct ipt_table *t;
-        struct xt_table_info *newinfo, *oldinfo;
+        struct xt_table_info *oldinfo;
         struct xt_counters *counters;
-        void *loc_cpu_entry, *loc_cpu_old_entry;
+        void *loc_cpu_old_entry;
 
-        if (copy_from_user(&tmp, user, sizeof(tmp)) != 0)
-                return -EFAULT;
-
-        /* Hack: Causes ipchains to give correct error msg --RR */
-        if (len != sizeof(tmp) + tmp.size)
-                return -ENOPROTOOPT;
-
-        /* overflow check */
-        if (tmp.size >= (INT_MAX - sizeof(struct xt_table_info)) / NR_CPUS -
-                        SMP_CACHE_BYTES)
-                return -ENOMEM;
-        if (tmp.num_counters >= INT_MAX / sizeof(struct xt_counters))
-                return -ENOMEM;
-
-        newinfo = xt_alloc_table_info(tmp.size);
-        if (!newinfo)
-                return -ENOMEM;
-
-        /* choose the copy that is our node/cpu */
-        loc_cpu_entry = newinfo->entries[raw_smp_processor_id()];
-        if (copy_from_user(loc_cpu_entry, user + sizeof(tmp),
-                           tmp.size) != 0) {
-                ret = -EFAULT;
-                goto free_newinfo;
-        }
-
-        counters = vmalloc(tmp.num_counters * sizeof(struct xt_counters));
+        ret = 0;
+        counters = vmalloc(num_counters * sizeof(struct xt_counters));
         if (!counters) {
                 ret = -ENOMEM;
-                goto free_newinfo;
+                goto out;
         }
 
-        ret = translate_table(tmp.name, tmp.valid_hooks,
-                              newinfo, loc_cpu_entry, tmp.size, tmp.num_entries,
-                              tmp.hook_entry, tmp.underflow);
-        if (ret != 0)
-                goto free_newinfo_counters;
-
-        duprintf("ip_tables: Translated table\n");
-
-        t = try_then_request_module(xt_find_table_lock(AF_INET, tmp.name),
-                                    "iptable_%s", tmp.name);
+        t = try_then_request_module(xt_find_table_lock(AF_INET, name),
+                                    "iptable_%s", name);
         if (!t || IS_ERR(t)) {
                 ret = t ? PTR_ERR(t) : -ENOENT;
                 goto free_newinfo_counters_untrans;
         }
 
         /* You lied! */
-        if (tmp.valid_hooks != t->valid_hooks) {
+        if (valid_hooks != t->valid_hooks) {
                 duprintf("Valid hook crap: %08X vs %08X\n",
-                         tmp.valid_hooks, t->valid_hooks);
+                         valid_hooks, t->valid_hooks);
                 ret = -EINVAL;
                 goto put_module;
         }
 
-        oldinfo = xt_replace_table(t, tmp.num_counters, newinfo, &ret);
+        oldinfo = xt_replace_table(t, num_counters, newinfo, &ret);
         if (!oldinfo)
                 goto put_module;
 
         /* Update module usage count based on number of rules */
         duprintf("do_replace: oldnum=%u, initnum=%u, newnum=%u\n",
                 oldinfo->number, oldinfo->initial_entries, newinfo->number);
-        if ((oldinfo->number > oldinfo->initial_entries) || 
-            (newinfo->number <= oldinfo->initial_entries)) 
+        if ((oldinfo->number > oldinfo->initial_entries) ||
+            (newinfo->number <= oldinfo->initial_entries))
                 module_put(t->me);
         if ((oldinfo->number > oldinfo->initial_entries) &&
             (newinfo->number <= oldinfo->initial_entries))
@@ -998,8 +1233,8 @@ do_replace(void __user *user, unsigned int len)
         loc_cpu_old_entry = oldinfo->entries[raw_smp_processor_id()];
         IPT_ENTRY_ITERATE(loc_cpu_old_entry, oldinfo->size, cleanup_entry,NULL);
         xt_free_table_info(oldinfo);
-        if (copy_to_user(tmp.counters, counters,
-                         sizeof(struct xt_counters) * tmp.num_counters) != 0)
+        if (copy_to_user(counters_ptr, counters,
+                         sizeof(struct xt_counters) * num_counters) != 0)
                 ret = -EFAULT;
         vfree(counters);
         xt_table_unlock(t);
@@ -1009,9 +1244,62 @@ do_replace(void __user *user, unsigned int len)
         module_put(t->me);
         xt_table_unlock(t);
  free_newinfo_counters_untrans:
-        IPT_ENTRY_ITERATE(loc_cpu_entry, newinfo->size, cleanup_entry,NULL);
- free_newinfo_counters:
         vfree(counters);
+ out:
+        return ret;
+}
+
+static int
+do_replace(void __user *user, unsigned int len)
+{
+        int ret;
+        struct ipt_replace tmp;
+        struct xt_table_info *newinfo;
+        void *loc_cpu_entry;
+
+        if (copy_from_user(&tmp, user, sizeof(tmp)) != 0)
+                return -EFAULT;
+
+        /* Hack: Causes ipchains to give correct error msg --RR */
+        if (len != sizeof(tmp) + tmp.size)
+                return -ENOPROTOOPT;
+
+        /* overflow check */
+        if (tmp.size >= (INT_MAX - sizeof(struct xt_table_info)) / NR_CPUS -
+                        SMP_CACHE_BYTES)
+                return -ENOMEM;
+        if (tmp.num_counters >= INT_MAX / sizeof(struct xt_counters))
+                return -ENOMEM;
+
+        newinfo = xt_alloc_table_info(tmp.size);
+        if (!newinfo)
+                return -ENOMEM;
+
+        /* choose the copy that is our node/cpu */
+        loc_cpu_entry = newinfo->entries[raw_smp_processor_id()];
+        if (copy_from_user(loc_cpu_entry, user + sizeof(tmp),
+                           tmp.size) != 0) {
+                ret = -EFAULT;
+                goto free_newinfo;
+        }
+
+        ret = translate_table(tmp.name, tmp.valid_hooks,
+                              newinfo, loc_cpu_entry, tmp.size, tmp.num_entries,
+                              tmp.hook_entry, tmp.underflow);
+        if (ret != 0)
+                goto free_newinfo;
+
+        duprintf("ip_tables: Translated table\n");
+
+        ret = __do_replace(tmp.name, tmp.valid_hooks,
+                              newinfo, tmp.num_counters,
+                              tmp.counters);
+        if (ret)
+                goto free_newinfo_untrans;
+        return 0;
+
+ free_newinfo_untrans:
+        IPT_ENTRY_ITERATE(loc_cpu_entry, newinfo->size, cleanup_entry,NULL);
  free_newinfo:
         xt_free_table_info(newinfo);
         return ret;
@@ -1040,31 +1328,59 @@ add_counter_to_entry(struct ipt_entry *e,
 }
 
 static int
-do_add_counters(void __user *user, unsigned int len)
+do_add_counters(void __user *user, unsigned int len, int compat)
 {
         unsigned int i;
-        struct xt_counters_info tmp, *paddc;
+        struct xt_counters_info tmp;
+        struct xt_counters *paddc;
+        unsigned int num_counters;
+        char *name;
+        int size;
+        void *ptmp;
         struct ipt_table *t;
         struct xt_table_info *private;
         int ret = 0;
         void *loc_cpu_entry;
+#ifdef CONFIG_COMPAT
+        struct compat_xt_counters_info compat_tmp;
 
-        if (copy_from_user(&tmp, user, sizeof(tmp)) != 0)
+        if (compat) {
+                ptmp = &compat_tmp;
+                size = sizeof(struct compat_xt_counters_info);
+        } else
+#endif
+        {
+                ptmp = &tmp;
+                size = sizeof(struct xt_counters_info);
+        }
+
+        if (copy_from_user(ptmp, user, size) != 0)
                 return -EFAULT;
 
-        if (len != sizeof(tmp) + tmp.num_counters*sizeof(struct xt_counters))
+#ifdef CONFIG_COMPAT
+        if (compat) {
+                num_counters = compat_tmp.num_counters;
+                name = compat_tmp.name;
+        } else
+#endif
+        {
+                num_counters = tmp.num_counters;
+                name = tmp.name;
+        }
+
+        if (len != size + num_counters * sizeof(struct xt_counters))
                 return -EINVAL;
 
-        paddc = vmalloc_node(len, numa_node_id());
+        paddc = vmalloc_node(len - size, numa_node_id());
         if (!paddc)
                 return -ENOMEM;
 
-        if (copy_from_user(paddc, user, len) != 0) {
+        if (copy_from_user(paddc, user + size, len - size) != 0) {
                 ret = -EFAULT;
                 goto free;
         }
 
-        t = xt_find_table_lock(AF_INET, tmp.name);
+        t = xt_find_table_lock(AF_INET, name);
         if (!t || IS_ERR(t)) {
                 ret = t ? PTR_ERR(t) : -ENOENT;
                 goto free;
@@ -1072,7 +1388,7 @@ do_add_counters(void __user *user, unsigned int len)
 
         write_lock_bh(&t->lock);
         private = t->private;
-        if (private->number != paddc->num_counters) {
+        if (private->number != num_counters) {
                 ret = -EINVAL;
                 goto unlock_up_free;
         }
@@ -1083,7 +1399,7 @@ do_add_counters(void __user *user, unsigned int len)
         IPT_ENTRY_ITERATE(loc_cpu_entry,
                           private->size,
                           add_counter_to_entry,
-                          paddc->counters,
+                          paddc,
                           &i);
  unlock_up_free:
         write_unlock_bh(&t->lock);
@@ -1095,8 +1411,438 @@ do_add_counters(void __user *user, unsigned int len)
         return ret;
 }
 
+#ifdef CONFIG_COMPAT
+struct compat_ipt_replace {
+        char                    name[IPT_TABLE_MAXNAMELEN];
+        u32                     valid_hooks;
+        u32                     num_entries;
+        u32                     size;
+        u32                     hook_entry[NF_IP_NUMHOOKS];
+        u32                     underflow[NF_IP_NUMHOOKS];
+        u32                     num_counters;
+        compat_uptr_t           counters;       /* struct ipt_counters * */
+        struct compat_ipt_entry entries[0];
+};
+
+static inline int compat_copy_match_to_user(struct ipt_entry_match *m,
+                void __user **dstptr, compat_uint_t *size)
+{
+        if (m->u.kernel.match->compat)
+                return m->u.kernel.match->compat(m, dstptr, size,
+                                COMPAT_TO_USER);
+        else
+                return xt_compat_match(m, dstptr, size, COMPAT_TO_USER);
+}
+
+static int compat_copy_entry_to_user(struct ipt_entry *e,
+                void __user **dstptr, compat_uint_t *size)
+{
+        struct ipt_entry_target __user *t;
+        struct compat_ipt_entry __user *ce;
+        u_int16_t target_offset, next_offset;
+        compat_uint_t origsize;
+        int ret;
+
+        ret = -EFAULT;
+        origsize = *size;
+        ce = (struct compat_ipt_entry __user *)*dstptr;
+        if (__copy_to_user(ce, e, sizeof(struct ipt_entry)))
+                goto out;
+
+        *dstptr += sizeof(struct compat_ipt_entry);
+        ret = IPT_MATCH_ITERATE(e, compat_copy_match_to_user, dstptr, size);
+        target_offset = e->target_offset - (origsize - *size);
+        if (ret)
+                goto out;
+        t = ipt_get_target(e);
+        if (t->u.kernel.target->compat)
+                ret = t->u.kernel.target->compat(t, dstptr, size,
+                                COMPAT_TO_USER);
+        else
+                ret = xt_compat_target(t, dstptr, size, COMPAT_TO_USER);
+        if (ret)
+                goto out;
+        ret = -EFAULT;
+        next_offset = e->next_offset - (origsize - *size);
+        if (__put_user(target_offset, &ce->target_offset))
+                goto out;
+        if (__put_user(next_offset, &ce->next_offset))
+                goto out;
+        return 0;
+out:
+        return ret;
+}
+
+static inline int
+compat_check_calc_match(struct ipt_entry_match *m,
+            const char *name,
+            const struct ipt_ip *ip,
+            unsigned int hookmask,
+            int *size, int *i)
+{
+        struct ipt_match *match;
+
+        match = try_then_request_module(xt_find_match(AF_INET, m->u.user.name,
+                                                   m->u.user.revision),
+                                        "ipt_%s", m->u.user.name);
+        if (IS_ERR(match) || !match) {
+                duprintf("compat_check_calc_match: `%s' not found\n",
+                                m->u.user.name);
+                return match ? PTR_ERR(match) : -ENOENT;
+        }
+        m->u.kernel.match = match;
+
+        if (m->u.kernel.match->compat)
+                m->u.kernel.match->compat(m, NULL, size, COMPAT_CALC_SIZE);
+        else
+                xt_compat_match(m, NULL, size, COMPAT_CALC_SIZE);
+
+        (*i)++;
+        return 0;
+}
+
+static inline int
+check_compat_entry_size_and_hooks(struct ipt_entry *e,
+                           struct xt_table_info *newinfo,
+                           unsigned int *size,
+                           unsigned char *base,
+                           unsigned char *limit,
+                           unsigned int *hook_entries,
+                           unsigned int *underflows,
+                           unsigned int *i,
+                           const char *name)
+{
+        struct ipt_entry_target *t;
+        struct ipt_target *target;
+        u_int16_t entry_offset;
+        int ret, off, h, j;
+
+        duprintf("check_compat_entry_size_and_hooks %p\n", e);
+        if ((unsigned long)e % __alignof__(struct compat_ipt_entry) != 0
+            || (unsigned char *)e + sizeof(struct compat_ipt_entry) >= limit) {
+                duprintf("Bad offset %p, limit = %p\n", e, limit);
+                return -EINVAL;
+        }
+
+        if (e->next_offset < sizeof(struct compat_ipt_entry) +
+                        sizeof(struct compat_xt_entry_target)) {
+                duprintf("checking: element %p size %u\n",
+                         e, e->next_offset);
+                return -EINVAL;
+        }
+
+        if (!ip_checkentry(&e->ip)) {
+                duprintf("ip_tables: ip check failed %p %s.\n", e, name);
+                return -EINVAL;
+        }
+
+        off = 0;
+        entry_offset = (void *)e - (void *)base;
+        j = 0;
+        ret = IPT_MATCH_ITERATE(e, compat_check_calc_match, name, &e->ip,
+                        e->comefrom, &off, &j);
+        if (ret != 0)
+                goto out;
+
+        t = ipt_get_target(e);
+        target = try_then_request_module(xt_find_target(AF_INET,
+                                                     t->u.user.name,
+                                                     t->u.user.revision),
+                                         "ipt_%s", t->u.user.name);
+        if (IS_ERR(target) || !target) {
+                duprintf("check_entry: `%s' not found\n", t->u.user.name);
+                ret = target ? PTR_ERR(target) : -ENOENT;
+                goto out;
+        }
+        t->u.kernel.target = target;
+
+        if (t->u.kernel.target->compat)
+                t->u.kernel.target->compat(t, NULL, &off, COMPAT_CALC_SIZE);
+        else
+                xt_compat_target(t, NULL, &off, COMPAT_CALC_SIZE);
+        *size += off;
+        ret = compat_add_offset(entry_offset, off);
+        if (ret)
+                goto out;
+
+        /* Check hooks & underflows */
+        for (h = 0; h < NF_IP_NUMHOOKS; h++) {
+                if ((unsigned char *)e - base == hook_entries[h])
+                        newinfo->hook_entry[h] = hook_entries[h];
+                if ((unsigned char *)e - base == underflows[h])
+                        newinfo->underflow[h] = underflows[h];
+        }
+
+        /* Clear counters and comefrom */
+        e->counters = ((struct ipt_counters) { 0, 0 });
+        e->comefrom = 0;
+
+        (*i)++;
+        return 0;
+out:
+        IPT_MATCH_ITERATE(e, cleanup_match, &j);
+        return ret;
+}
+
+static inline int compat_copy_match_from_user(struct ipt_entry_match *m,
+        void **dstptr, compat_uint_t *size, const char *name,
+        const struct ipt_ip *ip, unsigned int hookmask)
+{
+        struct ipt_entry_match *dm;
+        struct ipt_match *match;
+        int ret;
+
+        dm = (struct ipt_entry_match *)*dstptr;
+        match = m->u.kernel.match;
+        if (match->compat)
+                match->compat(m, dstptr, size, COMPAT_FROM_USER);
+        else
+                xt_compat_match(m, dstptr, size, COMPAT_FROM_USER);
+
+        ret = xt_check_match(match, AF_INET, dm->u.match_size - sizeof(*dm),
+                             name, hookmask, ip->proto,
+                             ip->invflags & IPT_INV_PROTO);
+        if (ret)
+                return ret;
+
+        if (m->u.kernel.match->checkentry
+            && !m->u.kernel.match->checkentry(name, ip, match, dm->data,
+                                              dm->u.match_size - sizeof(*dm),
+                                              hookmask)) {
+                duprintf("ip_tables: check failed for `%s'.\n",
+                         m->u.kernel.match->name);
+                return -EINVAL;
+        }
+        return 0;
+}
+
+static int compat_copy_entry_from_user(struct ipt_entry *e, void **dstptr,
+        unsigned int *size, const char *name,
+        struct xt_table_info *newinfo, unsigned char *base)
+{
+        struct ipt_entry_target *t;
+        struct ipt_target *target;
+        struct ipt_entry *de;
+        unsigned int origsize;
+        int ret, h;
+
+        ret = 0;
+        origsize = *size;
+        de = (struct ipt_entry *)*dstptr;
+        memcpy(de, e, sizeof(struct ipt_entry));
+
+        *dstptr += sizeof(struct compat_ipt_entry);
+        ret = IPT_MATCH_ITERATE(e, compat_copy_match_from_user, dstptr, size,
+                        name, &de->ip, de->comefrom);
+        if (ret)
+                goto out;
+        de->target_offset = e->target_offset - (origsize - *size);
+        t = ipt_get_target(e);
+        target = t->u.kernel.target;
+        if (target->compat)
+                target->compat(t, dstptr, size, COMPAT_FROM_USER);
+        else
+                xt_compat_target(t, dstptr, size, COMPAT_FROM_USER);
+
+        de->next_offset = e->next_offset - (origsize - *size);
+        for (h = 0; h < NF_IP_NUMHOOKS; h++) {
+                if ((unsigned char *)de - base < newinfo->hook_entry[h])
+                        newinfo->hook_entry[h] -= origsize - *size;
+                if ((unsigned char *)de - base < newinfo->underflow[h])
+                        newinfo->underflow[h] -= origsize - *size;
+        }
+
+        t = ipt_get_target(de);
+        target = t->u.kernel.target;
+        ret = xt_check_target(target, AF_INET, t->u.target_size - sizeof(*t),
+                              name, e->comefrom, e->ip.proto,
+                              e->ip.invflags & IPT_INV_PROTO);
+        if (ret)
+                goto out;
+
+        ret = -EINVAL;
+        if (t->u.kernel.target == &ipt_standard_target) {
+                if (!standard_check(t, *size))
+                        goto out;
+        } else if (t->u.kernel.target->checkentry
+                   && !t->u.kernel.target->checkentry(name, de, target,
+                                t->data, t->u.target_size - sizeof(*t),
+                                de->comefrom)) {
+                duprintf("ip_tables: compat: check failed for `%s'.\n",
+                         t->u.kernel.target->name);
+                goto out;
+        }
+        ret = 0;
+out:
+        return ret;
+}
+
 static int
-do_ipt_set_ctl(struct sock *sk, int cmd, void __user *user, unsigned int len)
+translate_compat_table(const char *name,
+                unsigned int valid_hooks,
+                struct xt_table_info **pinfo,
+                void **pentry0,
+                unsigned int total_size,
+                unsigned int number,
+                unsigned int *hook_entries,
+                unsigned int *underflows)
+{
+        unsigned int i;
+        struct xt_table_info *newinfo, *info;
+        void *pos, *entry0, *entry1;
+        unsigned int size;
+        int ret;
+
+        info = *pinfo;
+        entry0 = *pentry0;
+        size = total_size;
+        info->number = number;
+
+        /* Init all hooks to impossible value. */
+        for (i = 0; i < NF_IP_NUMHOOKS; i++) {
+                info->hook_entry[i] = 0xFFFFFFFF;
+                info->underflow[i] = 0xFFFFFFFF;
+        }
+
+        duprintf("translate_compat_table: size %u\n", info->size);
+        i = 0;
+        xt_compat_lock(AF_INET);
+        /* Walk through entries, checking offsets. */
+        ret = IPT_ENTRY_ITERATE(entry0, total_size,
+                                check_compat_entry_size_and_hooks,
+                                info, &size, entry0,
+                                entry0 + total_size,
+                                hook_entries, underflows, &i, name);
+        if (ret != 0)
+                goto out_unlock;
+
+        ret = -EINVAL;
+        if (i != number) {
+                duprintf("translate_compat_table: %u not %u entries\n",
+                         i, number);
+                goto out_unlock;
+        }
+
+        /* Check hooks all assigned */
+        for (i = 0; i < NF_IP_NUMHOOKS; i++) {
+                /* Only hooks which are valid */
+                if (!(valid_hooks & (1 << i)))
+                        continue;
+                if (info->hook_entry[i] == 0xFFFFFFFF) {
+                        duprintf("Invalid hook entry %u %u\n",
+                                 i, hook_entries[i]);
+                        goto out_unlock;
+                }
+                if (info->underflow[i] == 0xFFFFFFFF) {
+                        duprintf("Invalid underflow %u %u\n",
+                                 i, underflows[i]);
+                        goto out_unlock;
+                }
+        }
+
+        ret = -ENOMEM;
+        newinfo = xt_alloc_table_info(size);
+        if (!newinfo)
+                goto out_unlock;
+
+        newinfo->number = number;
+        for (i = 0; i < NF_IP_NUMHOOKS; i++) {
+                newinfo->hook_entry[i] = info->hook_entry[i];
+                newinfo->underflow[i] = info->underflow[i];
+        }
+        entry1 = newinfo->entries[raw_smp_processor_id()];
+        pos = entry1;
+        size =  total_size;
+        ret = IPT_ENTRY_ITERATE(entry0, total_size,
+                        compat_copy_entry_from_user, &pos, &size,
+                        name, newinfo, entry1);
+        compat_flush_offsets();
+        xt_compat_unlock(AF_INET);
+        if (ret)
+                goto free_newinfo;
+
+        ret = -ELOOP;
+        if (!mark_source_chains(newinfo, valid_hooks, entry1))
+                goto free_newinfo;
+
+        /* And one copy for every other CPU */
+        for_each_cpu(i)
+                if (newinfo->entries[i] && newinfo->entries[i] != entry1)
+                        memcpy(newinfo->entries[i], entry1, newinfo->size);
+
+        *pinfo = newinfo;
+        *pentry0 = entry1;
+        xt_free_table_info(info);
+        return 0;
+
+free_newinfo:
+        xt_free_table_info(newinfo);
+out:
+        return ret;
+out_unlock:
+        xt_compat_unlock(AF_INET);
+        goto out;
+}
+
+static int
+compat_do_replace(void __user *user, unsigned int len)
+{
+        int ret;
+        struct compat_ipt_replace tmp;
+        struct xt_table_info *newinfo;
+        void *loc_cpu_entry;
+
+        if (copy_from_user(&tmp, user, sizeof(tmp)) != 0)
+                return -EFAULT;
+
+        /* Hack: Causes ipchains to give correct error msg --RR */
+        if (len != sizeof(tmp) + tmp.size)
+                return -ENOPROTOOPT;
+
+        /* overflow check */
+        if (tmp.size >= (INT_MAX - sizeof(struct xt_table_info)) / NR_CPUS -
+                        SMP_CACHE_BYTES)
+                return -ENOMEM;
+        if (tmp.num_counters >= INT_MAX / sizeof(struct xt_counters))
+                return -ENOMEM;
+
+        newinfo = xt_alloc_table_info(tmp.size);
+        if (!newinfo)
+                return -ENOMEM;
+
+        /* choose the copy that is our node/cpu */
+        loc_cpu_entry = newinfo->entries[raw_smp_processor_id()];
+        if (copy_from_user(loc_cpu_entry, user + sizeof(tmp),
+                           tmp.size) != 0) {
+                ret = -EFAULT;
+                goto free_newinfo;
+        }
+
+        ret = translate_compat_table(tmp.name, tmp.valid_hooks,
+                              &newinfo, &loc_cpu_entry, tmp.size,
+                              tmp.num_entries, tmp.hook_entry, tmp.underflow);
+        if (ret != 0)
+                goto free_newinfo;
+
+        duprintf("compat_do_replace: Translated table\n");
+
+        ret = __do_replace(tmp.name, tmp.valid_hooks,
+                              newinfo, tmp.num_counters,
+                              compat_ptr(tmp.counters));
+        if (ret)
+                goto free_newinfo_untrans;
+        return 0;
+
+ free_newinfo_untrans:
+        IPT_ENTRY_ITERATE(loc_cpu_entry, newinfo->size, cleanup_entry,NULL);
+ free_newinfo:
+        xt_free_table_info(newinfo);
+        return ret;
+}
+
+static int
+compat_do_ipt_set_ctl(struct sock *sk,  int cmd, void __user *user,
+                unsigned int len)
 {
         int ret;
 
@@ -1105,11 +1851,11 @@ do_ipt_set_ctl(struct sock *sk,	int cmd, void __user *user, unsigned int len)
 
         switch (cmd) {
         case IPT_SO_SET_REPLACE:
-                ret = do_replace(user, len);
+                ret = compat_do_replace(user, len);
                 break;
 
         case IPT_SO_SET_ADD_COUNTERS:
-                ret = do_add_counters(user, len);
+                ret = do_add_counters(user, len, 1);
                 break;
 
         default:
@@ -1120,75 +1866,196 @@ do_ipt_set_ctl(struct sock *sk,	int cmd, void __user *user, unsigned int len)
         return ret;
 }
 
+struct compat_ipt_get_entries
+{
+        char name[IPT_TABLE_MAXNAMELEN];
+        compat_uint_t size;
+        struct compat_ipt_entry entrytable[0];
+};
+
+static int compat_copy_entries_to_user(unsigned int total_size,
+                     struct ipt_table *table, void __user *userptr)
+{
+        unsigned int off, num;
+        struct compat_ipt_entry e;
+        struct xt_counters *counters;
+        struct xt_table_info *private = table->private;
+        void __user *pos;
+        unsigned int size;
+        int ret = 0;
+        void *loc_cpu_entry;
+
+        counters = alloc_counters(table);
+        if (IS_ERR(counters))
+                return PTR_ERR(counters);
+
+        /* choose the copy that is on our node/cpu, ...
+         * This choice is lazy (because current thread is
+         * allowed to migrate to another cpu)
+         */
+        loc_cpu_entry = private->entries[raw_smp_processor_id()];
+        pos = userptr;
+        size = total_size;
+        ret = IPT_ENTRY_ITERATE(loc_cpu_entry, total_size,
+                        compat_copy_entry_to_user, &pos, &size);
+        if (ret)
+                goto free_counters;
+
+        /* ... then go back and fix counters and names */
+        for (off = 0, num = 0; off < size; off += e.next_offset, num++) {
+                unsigned int i;
+                struct ipt_entry_match m;
+                struct ipt_entry_target t;
+
+                ret = -EFAULT;
+                if (copy_from_user(&e, userptr + off,
+                                        sizeof(struct compat_ipt_entry)))
+                        goto free_counters;
+                if (copy_to_user(userptr + off +
+                        offsetof(struct compat_ipt_entry, counters),
+                         &counters[num], sizeof(counters[num])))
+                        goto free_counters;
+
+                for (i = sizeof(struct compat_ipt_entry);
+                                i < e.target_offset; i += m.u.match_size) {
+                        if (copy_from_user(&m, userptr + off + i,
+                                        sizeof(struct ipt_entry_match)))
+                                goto free_counters;
+                        if (copy_to_user(userptr + off + i +
+                                offsetof(struct ipt_entry_match, u.user.name),
+                                m.u.kernel.match->name,
+                                strlen(m.u.kernel.match->name) + 1))
+                                goto free_counters;
+                }
+
+                if (copy_from_user(&t, userptr + off + e.target_offset,
+                                        sizeof(struct ipt_entry_target)))
+                        goto free_counters;
+                if (copy_to_user(userptr + off + e.target_offset +
+                        offsetof(struct ipt_entry_target, u.user.name),
+                        t.u.kernel.target->name,
+                        strlen(t.u.kernel.target->name) + 1))
+                        goto free_counters;
+        }
+        ret = 0;
+free_counters:
+        vfree(counters);
+        return ret;
+}
+
 static int
-do_ipt_get_ctl(struct sock *sk, int cmd, void __user *user, int *len)
+compat_get_entries(struct compat_ipt_get_entries __user *uptr, int *len)
 {
         int ret;
+        struct compat_ipt_get_entries get;
+        struct ipt_table *t;
 
-        if (!capable(CAP_NET_ADMIN))
-                return -EPERM;
 
-        switch (cmd) {
-        case IPT_SO_GET_INFO: {
-                char name[IPT_TABLE_MAXNAMELEN];
-                struct ipt_table *t;
+        if (*len < sizeof(get)) {
+                duprintf("compat_get_entries: %u < %u\n",
+                                *len, (unsigned int)sizeof(get));
+                return -EINVAL;
+        }
+
+        if (copy_from_user(&get, uptr, sizeof(get)) != 0)
+                return -EFAULT;
+
+        if (*len != sizeof(struct compat_ipt_get_entries) + get.size) {
+                duprintf("compat_get_entries: %u != %u\n", *len,
+                        (unsigned int)(sizeof(struct compat_ipt_get_entries) +
+                        get.size));
+                return -EINVAL;
+        }
 
-                if (*len != sizeof(struct ipt_getinfo)) {
-                        duprintf("length %u != %u\n", *len,
-                                 sizeof(struct ipt_getinfo));
+        xt_compat_lock(AF_INET);
+        t = xt_find_table_lock(AF_INET, get.name);
+        if (t && !IS_ERR(t)) {
+                struct xt_table_info *private = t->private;
+                struct xt_table_info info;
+                duprintf("t->private->number = %u\n",
+                         private->number);
+                ret = compat_table_info(private, &info);
+                if (!ret && get.size == info.size) {
+                        ret = compat_copy_entries_to_user(private->size,
+                                                   t, uptr->entrytable);
+                } else if (!ret) {
+                        duprintf("compat_get_entries: I've got %u not %u!\n",
+                                 private->size,
+                                 get.size);
                         ret = -EINVAL;
-                        break;
                 }
+                compat_flush_offsets();
+                module_put(t->me);
+                xt_table_unlock(t);
+        } else
+                ret = t ? PTR_ERR(t) : -ENOENT;
 
-                if (copy_from_user(name, user, sizeof(name)) != 0) {
-                        ret = -EFAULT;
-                        break;
-                }
-                name[IPT_TABLE_MAXNAMELEN-1] = '\0';
-
-                t = try_then_request_module(xt_find_table_lock(AF_INET, name),
-                                            "iptable_%s", name);
-                if (t && !IS_ERR(t)) {
-                        struct ipt_getinfo info;
-                        struct xt_table_info *private = t->private;
-
-                        info.valid_hooks = t->valid_hooks;
-                        memcpy(info.hook_entry, private->hook_entry,
-                               sizeof(info.hook_entry));
-                        memcpy(info.underflow, private->underflow,
-                               sizeof(info.underflow));
-                        info.num_entries = private->number;
-                        info.size = private->size;
-                        memcpy(info.name, name, sizeof(info.name));
-
-                        if (copy_to_user(user, &info, *len) != 0)
-                                ret = -EFAULT;
-                        else
-                                ret = 0;
-                        xt_table_unlock(t);
-                        module_put(t->me);
-                } else
-                        ret = t ? PTR_ERR(t) : -ENOENT;
+        xt_compat_unlock(AF_INET);
+        return ret;
+}
+
+static int
+compat_do_ipt_get_ctl(struct sock *sk, int cmd, void __user *user, int *len)
+{
+        int ret;
+
+        switch (cmd) {
+        case IPT_SO_GET_INFO:
+                ret = get_info(user, len, 1);
+                break;
+        case IPT_SO_GET_ENTRIES:
+                ret = compat_get_entries(user, len);
+                break;
+        default:
+                duprintf("compat_do_ipt_get_ctl: unknown request %i\n", cmd);
+                ret = -EINVAL;
         }
-        break;
+        return ret;
+}
+#endif
 
-        case IPT_SO_GET_ENTRIES: {
-                struct ipt_get_entries get;
+static int
+do_ipt_set_ctl(struct sock *sk, int cmd, void __user *user, unsigned int len)
+{
+        int ret;
 
-                if (*len < sizeof(get)) {
-                        duprintf("get_entries: %u < %u\n", *len, sizeof(get));
-                        ret = -EINVAL;
-                } else if (copy_from_user(&get, user, sizeof(get)) != 0) {
-                        ret = -EFAULT;
-                } else if (*len != sizeof(struct ipt_get_entries) + get.size) {
-                        duprintf("get_entries: %u != %u\n", *len,
-                                 sizeof(struct ipt_get_entries) + get.size);
-                        ret = -EINVAL;
-                } else
-                        ret = get_entries(&get, user);
+        if (!capable(CAP_NET_ADMIN))
+                return -EPERM;
+
+        switch (cmd) {
+        case IPT_SO_SET_REPLACE:
+                ret = do_replace(user, len);
                 break;
+
+        case IPT_SO_SET_ADD_COUNTERS:
+                ret = do_add_counters(user, len, 0);
+                break;
+
+        default:
+                duprintf("do_ipt_set_ctl:  unknown request %i\n", cmd);
+                ret = -EINVAL;
         }
 
+        return ret;
+}
+
+static int
+do_ipt_get_ctl(struct sock *sk, int cmd, void __user *user, int *len)
+{
+        int ret;
+
+        if (!capable(CAP_NET_ADMIN))
+                return -EPERM;
+
+        switch (cmd) {
+        case IPT_SO_GET_INFO:
+                ret = get_info(user, len, 0);
+                break;
+
+        case IPT_SO_GET_ENTRIES:
+                ret = get_entries(user, len);
+                break;
+
         case IPT_SO_GET_REVISION_MATCH:
         case IPT_SO_GET_REVISION_TARGET: {
                 struct ipt_get_revision rev;
@@ -1336,6 +2203,9 @@ static struct ipt_target ipt_standard_target = {
         .name           = IPT_STANDARD_TARGET,
         .targetsize     = sizeof(int),
         .family         = AF_INET,
+#ifdef CONFIG_COMPAT
+        .compat         = &compat_ipt_standard_fn,
+#endif
 };
 
 static struct ipt_target ipt_error_target = {
@@ -1350,9 +2220,15 @@ static struct nf_sockopt_ops ipt_sockopts = {
         .set_optmin     = IPT_BASE_CTL,
         .set_optmax     = IPT_SO_SET_MAX+1,
         .set            = do_ipt_set_ctl,
+#ifdef CONFIG_COMPAT
+        .compat_set     = compat_do_ipt_set_ctl,
+#endif
         .get_optmin     = IPT_BASE_CTL,
         .get_optmax     = IPT_SO_GET_MAX+1,
         .get            = do_ipt_get_ctl,
+#ifdef CONFIG_COMPAT
+        .compat_get     = compat_do_ipt_get_ctl,
+#endif
 };
 
 static struct ipt_match icmp_matchstruct = {
diff --git a/net/ipv4/netfilter/ipt_CLUSTERIP.c b/net/ipv4/netfilter/ipt_CLUSTERIP.c
index e4768a31718b..aad9d28c8d71 100644
--- a/net/ipv4/netfilter/ipt_CLUSTERIP.c
+++ b/net/ipv4/netfilter/ipt_CLUSTERIP.c
@@ -725,22 +725,17 @@ static struct file_operations clusterip_proc_fops = {
 
 #endif /* CONFIG_PROC_FS */
 
-static int init_or_cleanup(int fini)
+static int __init ipt_clusterip_init(void)
 {
         int ret;
 
-        if (fini)
-                goto cleanup;
-
-        if (ipt_register_target(&clusterip_tgt)) {
-                ret = -EINVAL;
-                goto cleanup_none;
-        }
+        ret = ipt_register_target(&clusterip_tgt);
+        if (ret < 0)
+                return ret;
 
-        if (nf_register_hook(&cip_arp_ops) < 0) {
-                ret = -EINVAL;
+        ret = nf_register_hook(&cip_arp_ops);
+        if (ret < 0)
                 goto cleanup_target;
-        }
 
 #ifdef CONFIG_PROC_FS
         clusterip_procdir = proc_mkdir("ipt_CLUSTERIP", proc_net);
@@ -753,31 +748,24 @@ static int init_or_cleanup(int fini)
 
         printk(KERN_NOTICE "ClusterIP Version %s loaded successfully\n",
                 CLUSTERIP_VERSION);
-
         return 0;
 
-cleanup:
-        printk(KERN_NOTICE "ClusterIP Version %s unloading\n",
-                CLUSTERIP_VERSION);
-#ifdef CONFIG_PROC_FS
-        remove_proc_entry(clusterip_procdir->name, clusterip_procdir->parent);
-#endif
 cleanup_hook:
         nf_unregister_hook(&cip_arp_ops);
 cleanup_target:
         ipt_unregister_target(&clusterip_tgt);
-cleanup_none:
-        return -EINVAL;
-}
-
-static int __init ipt_clusterip_init(void)
-{
-        return init_or_cleanup(0);
+        return ret;
 }
 
 static void __exit ipt_clusterip_fini(void)
 {
-        init_or_cleanup(1);
+        printk(KERN_NOTICE "ClusterIP Version %s unloading\n",
+                CLUSTERIP_VERSION);
+#ifdef CONFIG_PROC_FS
+        remove_proc_entry(clusterip_procdir->name, clusterip_procdir->parent);
+#endif
+        nf_unregister_hook(&cip_arp_ops);
+        ipt_unregister_target(&clusterip_tgt);
 }
 
 module_init(ipt_clusterip_init);
diff --git a/net/ipv4/netfilter/ipt_REJECT.c b/net/ipv4/netfilter/ipt_REJECT.c
index 4269a5440d43..0bba3c2bb786 100644
--- a/net/ipv4/netfilter/ipt_REJECT.c
+++ b/net/ipv4/netfilter/ipt_REJECT.c
@@ -106,7 +106,6 @@ static void send_reset(struct sk_buff *oldskb, int hook)
         struct rtable *rt;
         u_int16_t tmp_port;
         u_int32_t tmp_addr;
-        unsigned int tcplen;
         int needs_ack;
         int hh_len;
 
@@ -124,13 +123,7 @@ static void send_reset(struct sk_buff *oldskb, int hook)
                 return;
 
         /* Check checksum */
-        tcplen = oldskb->len - iph->ihl * 4;
-        if (((hook != NF_IP_LOCAL_IN && oldskb->ip_summed != CHECKSUM_HW) ||
-             (hook == NF_IP_LOCAL_IN &&
-              oldskb->ip_summed != CHECKSUM_UNNECESSARY)) &&
-            csum_tcpudp_magic(iph->saddr, iph->daddr, tcplen, IPPROTO_TCP,
-                              oldskb->ip_summed == CHECKSUM_HW ? oldskb->csum :
-                              skb_checksum(oldskb, iph->ihl * 4, tcplen, 0)))
+        if (nf_ip_checksum(oldskb, hook, iph->ihl * 4, IPPROTO_TCP))
                 return;
 
         if ((rt = route_reverse(oldskb, oth, hook)) == NULL)
diff --git a/net/ipv4/netfilter/ipt_multiport.c b/net/ipv4/netfilter/ipt_multiport.c
deleted file mode 100644
index ac95d8390bcc..000000000000
--- a/net/ipv4/netfilter/ipt_multiport.c
+++ /dev/null
@@ -1,195 +0,0 @@
-/* Kernel module to match one of a list of TCP/UDP ports: ports are in
-   the same place so we can treat them as equal. */
-
-/* (C) 1999-2001 Paul `Rusty' Russell
- * (C) 2002-2004 Netfilter Core Team <coreteam@netfilter.org>
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 2 as
- * published by the Free Software Foundation.
- */
-
-#include <linux/module.h>
-#include <linux/types.h>
-#include <linux/udp.h>
-#include <linux/skbuff.h>
-
-#include <linux/netfilter_ipv4/ipt_multiport.h>
-#include <linux/netfilter_ipv4/ip_tables.h>
-
-MODULE_LICENSE("GPL");
-MODULE_AUTHOR("Netfilter Core Team <coreteam@netfilter.org>");
-MODULE_DESCRIPTION("iptables multiple port match module");
-
-#if 0
-#define duprintf(format, args...) printk(format , ## args)
-#else
-#define duprintf(format, args...)
-#endif
-
-/* Returns 1 if the port is matched by the test, 0 otherwise. */
-static inline int
-ports_match(const u_int16_t *portlist, enum ipt_multiport_flags flags,
-            u_int8_t count, u_int16_t src, u_int16_t dst)
-{
-        unsigned int i;
-        for (i=0; i<count; i++) {
-                if (flags != IPT_MULTIPORT_DESTINATION
-                    && portlist[i] == src)
-                        return 1;
-
-                if (flags != IPT_MULTIPORT_SOURCE
-                    && portlist[i] == dst)
-                        return 1;
-        }
-
-        return 0;
-}
-
-/* Returns 1 if the port is matched by the test, 0 otherwise. */
-static inline int
-ports_match_v1(const struct ipt_multiport_v1 *minfo,
-               u_int16_t src, u_int16_t dst)
-{
-        unsigned int i;
-        u_int16_t s, e;
-
-        for (i=0; i < minfo->count; i++) {
-                s = minfo->ports[i];
-
-                if (minfo->pflags[i]) {
-                        /* range port matching */
-                        e = minfo->ports[++i];
-                        duprintf("src or dst matches with %d-%d?\n", s, e);
-
-                        if (minfo->flags == IPT_MULTIPORT_SOURCE
-                            && src >= s && src <= e)
-                                return 1 ^ minfo->invert;
-                        if (minfo->flags == IPT_MULTIPORT_DESTINATION
-                            && dst >= s && dst <= e)
-                                return 1 ^ minfo->invert;
-                        if (minfo->flags == IPT_MULTIPORT_EITHER
-                            && ((dst >= s && dst <= e)
-                                || (src >= s && src <= e)))
-                                return 1 ^ minfo->invert;
-                } else {
-                        /* exact port matching */
-                        duprintf("src or dst matches with %d?\n", s);
-
-                        if (minfo->flags == IPT_MULTIPORT_SOURCE
-                            && src == s)
-                                return 1 ^ minfo->invert;
-                        if (minfo->flags == IPT_MULTIPORT_DESTINATION
-                            && dst == s)
-                                return 1 ^ minfo->invert;
-                        if (minfo->flags == IPT_MULTIPORT_EITHER
-                            && (src == s || dst == s))
-                                return 1 ^ minfo->invert;
-                }
-        }
- 
-        return minfo->invert;
-}
-
-static int
-match(const struct sk_buff *skb,
-      const struct net_device *in,
-      const struct net_device *out,
-      const struct xt_match *match,
-      const void *matchinfo,
-      int offset,
-      unsigned int protoff,
-      int *hotdrop)
-{
-        u16 _ports[2], *pptr;
-        const struct ipt_multiport *multiinfo = matchinfo;
-
-        if (offset)
-                return 0;
-
-        pptr = skb_header_pointer(skb, protoff,
-                                  sizeof(_ports), _ports);
-        if (pptr == NULL) {
-                /* We've been asked to examine this packet, and we
-                 * can't.  Hence, no choice but to drop.
-                 */
-                duprintf("ipt_multiport:"
-                         " Dropping evil offset=0 tinygram.\n");
-                *hotdrop = 1;
-                return 0;
-        }
-
-        return ports_match(multiinfo->ports,
-                           multiinfo->flags, multiinfo->count,
-                           ntohs(pptr[0]), ntohs(pptr[1]));
-}
-
-static int
-match_v1(const struct sk_buff *skb,
-         const struct net_device *in,
-         const struct net_device *out,
-         const struct xt_match *match,
-         const void *matchinfo,
-         int offset,
-         unsigned int protoff,
-         int *hotdrop)
-{
-        u16 _ports[2], *pptr;
-        const struct ipt_multiport_v1 *multiinfo = matchinfo;
-
-        if (offset)
-                return 0;
-
-        pptr = skb_header_pointer(skb, protoff,
-                                  sizeof(_ports), _ports);
-        if (pptr == NULL) {
-                /* We've been asked to examine this packet, and we
-                 * can't.  Hence, no choice but to drop.
-                 */
-                duprintf("ipt_multiport:"
-                         " Dropping evil offset=0 tinygram.\n");
-                *hotdrop = 1;
-                return 0;
-        }
-
-        return ports_match_v1(multiinfo, ntohs(pptr[0]), ntohs(pptr[1]));
-}
-
-static struct ipt_match multiport_match = {
-        .name           = "multiport",
-        .revision       = 0,
-        .match          = match,
-        .matchsize      = sizeof(struct ipt_multiport),
-        .me             = THIS_MODULE,
-};
-
-static struct ipt_match multiport_match_v1 = {
-        .name           = "multiport",
-        .revision       = 1,
-        .match          = match_v1,
-        .matchsize      = sizeof(struct ipt_multiport_v1),
-        .me             = THIS_MODULE,
-};
-
-static int __init ipt_multiport_init(void)
-{
-        int err;
-
-        err = ipt_register_match(&multiport_match);
-        if (!err) {
-                err = ipt_register_match(&multiport_match_v1);
-                if (err)
-                        ipt_unregister_match(&multiport_match);
-        }
-
-        return err;
-}
-
-static void __exit ipt_multiport_fini(void)
-{
-        ipt_unregister_match(&multiport_match);
-        ipt_unregister_match(&multiport_match_v1);
-}
-
-module_init(ipt_multiport_init);
-module_exit(ipt_multiport_fini);
diff --git a/net/ipv4/netfilter/iptable_filter.c b/net/ipv4/netfilter/iptable_filter.c
index 3d80aefe9cfa..7f417484bfbf 100644
--- a/net/ipv4/netfilter/iptable_filter.c
+++ b/net/ipv4/netfilter/iptable_filter.c
@@ -157,37 +157,20 @@ static int __init iptable_filter_init(void)
                 return ret;
 
         /* Register hooks */
-        ret = nf_register_hook(&ipt_ops[0]);
+        ret = nf_register_hooks(ipt_ops, ARRAY_SIZE(ipt_ops));
         if (ret < 0)
                 goto cleanup_table;
 
-        ret = nf_register_hook(&ipt_ops[1]);
-        if (ret < 0)
-                goto cleanup_hook0;
-
-        ret = nf_register_hook(&ipt_ops[2]);
-        if (ret < 0)
-                goto cleanup_hook1;
-
         return ret;
 
- cleanup_hook1:
-        nf_unregister_hook(&ipt_ops[1]);
- cleanup_hook0:
-        nf_unregister_hook(&ipt_ops[0]);
  cleanup_table:
         ipt_unregister_table(&packet_filter);
-
         return ret;
 }
 
 static void __exit iptable_filter_fini(void)
 {
-        unsigned int i;
-
-        for (i = 0; i < sizeof(ipt_ops)/sizeof(struct nf_hook_ops); i++)
-                nf_unregister_hook(&ipt_ops[i]);
-
+        nf_unregister_hooks(ipt_ops, ARRAY_SIZE(ipt_ops));
         ipt_unregister_table(&packet_filter);
 }
 
diff --git a/net/ipv4/netfilter/iptable_mangle.c b/net/ipv4/netfilter/iptable_mangle.c
index 412fc96cc896..397b95cc026b 100644
--- a/net/ipv4/netfilter/iptable_mangle.c
+++ b/net/ipv4/netfilter/iptable_mangle.c
@@ -211,49 +211,20 @@ static int __init iptable_mangle_init(void)
                 return ret;
 
         /* Register hooks */
-        ret = nf_register_hook(&ipt_ops[0]);
+        ret = nf_register_hooks(ipt_ops, ARRAY_SIZE(ipt_ops));
         if (ret < 0)
                 goto cleanup_table;
 
-        ret = nf_register_hook(&ipt_ops[1]);
-        if (ret < 0)
-                goto cleanup_hook0;
-
-        ret = nf_register_hook(&ipt_ops[2]);
-        if (ret < 0)
-                goto cleanup_hook1;
-
-        ret = nf_register_hook(&ipt_ops[3]);
-        if (ret < 0)
-                goto cleanup_hook2;
-
-        ret = nf_register_hook(&ipt_ops[4]);
-        if (ret < 0)
-                goto cleanup_hook3;
-
         return ret;
 
- cleanup_hook3:
-        nf_unregister_hook(&ipt_ops[3]);
- cleanup_hook2:
-        nf_unregister_hook(&ipt_ops[2]);
- cleanup_hook1:
-        nf_unregister_hook(&ipt_ops[1]);
- cleanup_hook0:
-        nf_unregister_hook(&ipt_ops[0]);
  cleanup_table:
         ipt_unregister_table(&packet_mangler);
-
         return ret;
 }
 
 static void __exit iptable_mangle_fini(void)
 {
-        unsigned int i;
-
-        for (i = 0; i < sizeof(ipt_ops)/sizeof(struct nf_hook_ops); i++)
-                nf_unregister_hook(&ipt_ops[i]);
-
+        nf_unregister_hooks(ipt_ops, ARRAY_SIZE(ipt_ops));
         ipt_unregister_table(&packet_mangler);
 }
 
diff --git a/net/ipv4/netfilter/iptable_raw.c b/net/ipv4/netfilter/iptable_raw.c
index 03cc79a6160a..7912cce1e1b8 100644
--- a/net/ipv4/netfilter/iptable_raw.c
+++ b/net/ipv4/netfilter/iptable_raw.c
@@ -101,18 +101,18 @@ ipt_hook(unsigned int hook,
 /* 'raw' is the very first table. */
 static struct nf_hook_ops ipt_ops[] = {
         {
-          .hook = ipt_hook, 
-          .pf = PF_INET, 
-          .hooknum = NF_IP_PRE_ROUTING, 
-          .priority = NF_IP_PRI_RAW,
-          .owner = THIS_MODULE,
+                .hook = ipt_hook,
+                .pf = PF_INET,
+                .hooknum = NF_IP_PRE_ROUTING,
+                .priority = NF_IP_PRI_RAW,
+                .owner = THIS_MODULE,
         },
         {
-          .hook = ipt_hook, 
-          .pf = PF_INET, 
-          .hooknum = NF_IP_LOCAL_OUT, 
-          .priority = NF_IP_PRI_RAW,
-          .owner = THIS_MODULE,
+                .hook = ipt_hook,
+                .pf = PF_INET,
+                .hooknum = NF_IP_LOCAL_OUT,
+                .priority = NF_IP_PRI_RAW,
+                .owner = THIS_MODULE,
         },
 };
 
@@ -126,31 +126,20 @@ static int __init iptable_raw_init(void)
                 return ret;
 
         /* Register hooks */
-        ret = nf_register_hook(&ipt_ops[0]);
+        ret = nf_register_hooks(ipt_ops, ARRAY_SIZE(ipt_ops));
         if (ret < 0)
                 goto cleanup_table;
 
-        ret = nf_register_hook(&ipt_ops[1]);
-        if (ret < 0)
-                goto cleanup_hook0;
-
         return ret;
 
- cleanup_hook0:
-        nf_unregister_hook(&ipt_ops[0]);
  cleanup_table:
         ipt_unregister_table(&packet_raw);
-
         return ret;
 }
 
 static void __exit iptable_raw_fini(void)
 {
-        unsigned int i;
-
-        for (i = 0; i < sizeof(ipt_ops)/sizeof(struct nf_hook_ops); i++)
-                nf_unregister_hook(&ipt_ops[i]);
-
+        nf_unregister_hooks(ipt_ops, ARRAY_SIZE(ipt_ops));
         ipt_unregister_table(&packet_raw);
 }
 
diff --git a/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c b/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c
index 4afbc699d3ba..5bc9f64d7b5b 100644
--- a/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c
+++ b/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c
@@ -210,71 +210,63 @@ static unsigned int ipv4_conntrack_local(unsigned int hooknum,
 
 /* Connection tracking may drop packets, but never alters them, so
    make it the first hook. */
-static struct nf_hook_ops ipv4_conntrack_defrag_ops = {
-        .hook           = ipv4_conntrack_defrag,
-        .owner          = THIS_MODULE,
-        .pf             = PF_INET,
-        .hooknum        = NF_IP_PRE_ROUTING,
-        .priority       = NF_IP_PRI_CONNTRACK_DEFRAG,
-};
-
-static struct nf_hook_ops ipv4_conntrack_in_ops = {
-        .hook           = ipv4_conntrack_in,
-        .owner          = THIS_MODULE,
-        .pf             = PF_INET,
-        .hooknum        = NF_IP_PRE_ROUTING,
-        .priority       = NF_IP_PRI_CONNTRACK,
-};
-
-static struct nf_hook_ops ipv4_conntrack_defrag_local_out_ops = {
-        .hook           = ipv4_conntrack_defrag,
-        .owner          = THIS_MODULE,
-        .pf             = PF_INET,
-        .hooknum        = NF_IP_LOCAL_OUT,
-        .priority       = NF_IP_PRI_CONNTRACK_DEFRAG,
-};
-
-static struct nf_hook_ops ipv4_conntrack_local_out_ops = {
-        .hook           = ipv4_conntrack_local,
-        .owner          = THIS_MODULE,
-        .pf             = PF_INET,
-        .hooknum        = NF_IP_LOCAL_OUT,
-        .priority       = NF_IP_PRI_CONNTRACK,
-};
-
-/* helpers */
-static struct nf_hook_ops ipv4_conntrack_helper_out_ops = {
-        .hook           = ipv4_conntrack_help,
-        .owner          = THIS_MODULE,
-        .pf             = PF_INET,
-        .hooknum        = NF_IP_POST_ROUTING,
-        .priority       = NF_IP_PRI_CONNTRACK_HELPER,
-};
-
-static struct nf_hook_ops ipv4_conntrack_helper_in_ops = {
-        .hook           = ipv4_conntrack_help,
-        .owner          = THIS_MODULE,
-        .pf             = PF_INET,
-        .hooknum        = NF_IP_LOCAL_IN,
-        .priority       = NF_IP_PRI_CONNTRACK_HELPER,
-};
-
-
-/* Refragmenter; last chance. */
-static struct nf_hook_ops ipv4_conntrack_out_ops = {
-        .hook           = ipv4_confirm,
-        .owner          = THIS_MODULE,
-        .pf             = PF_INET,
-        .hooknum        = NF_IP_POST_ROUTING,
-        .priority       = NF_IP_PRI_CONNTRACK_CONFIRM,
-};
-
-static struct nf_hook_ops ipv4_conntrack_local_in_ops = {
-        .hook           = ipv4_confirm,
-        .owner          = THIS_MODULE,
-        .pf             = PF_INET,
-        .hooknum        = NF_IP_LOCAL_IN,
-        .priority       = NF_IP_PRI_CONNTRACK_CONFIRM,
+static struct nf_hook_ops ipv4_conntrack_ops[] = {
+        {
+                .hook           = ipv4_conntrack_defrag,
+                .owner          = THIS_MODULE,
+                .pf             = PF_INET,
+                .hooknum        = NF_IP_PRE_ROUTING,
+                .priority       = NF_IP_PRI_CONNTRACK_DEFRAG,
+        },
+        {
+                .hook           = ipv4_conntrack_in,
+                .owner          = THIS_MODULE,
+                .pf             = PF_INET,
+                .hooknum        = NF_IP_PRE_ROUTING,
+                .priority       = NF_IP_PRI_CONNTRACK,
+        },
+        {
+                .hook           = ipv4_conntrack_defrag,
+                .owner          = THIS_MODULE,
+                .pf             = PF_INET,
+                .hooknum        = NF_IP_LOCAL_OUT,
+                .priority       = NF_IP_PRI_CONNTRACK_DEFRAG,
+        },
+        {
+                .hook           = ipv4_conntrack_local,
+                .owner          = THIS_MODULE,
+                .pf             = PF_INET,
+                .hooknum        = NF_IP_LOCAL_OUT,
+                .priority       = NF_IP_PRI_CONNTRACK,
+        },
+        {
+                .hook           = ipv4_conntrack_help,
+                .owner          = THIS_MODULE,
+                .pf             = PF_INET,
+                .hooknum        = NF_IP_POST_ROUTING,
+                .priority       = NF_IP_PRI_CONNTRACK_HELPER,
+        },
+        {
+                .hook           = ipv4_conntrack_help,
+                .owner          = THIS_MODULE,
+                .pf             = PF_INET,
+                .hooknum        = NF_IP_LOCAL_IN,
+                .priority       = NF_IP_PRI_CONNTRACK_HELPER,
+        },
+        {
+                .hook           = ipv4_confirm,
+                .owner          = THIS_MODULE,
+                .pf             = PF_INET,
+                .hooknum        = NF_IP_POST_ROUTING,
+                .priority       = NF_IP_PRI_CONNTRACK_CONFIRM,
+        },
+        {
+                .hook           = ipv4_confirm,
+                .owner          = THIS_MODULE,
+                .pf             = PF_INET,
+                .hooknum        = NF_IP_LOCAL_IN,
+                .priority       = NF_IP_PRI_CONNTRACK_CONFIRM,
+        },
 };
 
 #ifdef CONFIG_SYSCTL
@@ -440,16 +432,20 @@ struct nf_conntrack_l3proto nf_conntrack_l3proto_ipv4 = {
 extern struct nf_conntrack_protocol nf_conntrack_protocol_tcp4;
 extern struct nf_conntrack_protocol nf_conntrack_protocol_udp4;
 extern struct nf_conntrack_protocol nf_conntrack_protocol_icmp;
-static int init_or_cleanup(int init)
+
+MODULE_ALIAS("nf_conntrack-" __stringify(AF_INET));
+MODULE_LICENSE("GPL");
+
+static int __init nf_conntrack_l3proto_ipv4_init(void)
 {
         int ret = 0;
 
-        if (!init) goto cleanup;
+        need_conntrack();
 
         ret = nf_register_sockopt(&so_getorigdst);
         if (ret < 0) {
                 printk(KERN_ERR "Unable to register netfilter socket option\n");
-                goto cleanup_nothing;
+                return ret;
         }
 
         ret = nf_conntrack_protocol_register(&nf_conntrack_protocol_tcp4);
@@ -476,84 +472,26 @@ static int init_or_cleanup(int init)
                 goto cleanup_icmp;
         }
 
-        ret = nf_register_hook(&ipv4_conntrack_defrag_ops);
+        ret = nf_register_hooks(ipv4_conntrack_ops,
+                                ARRAY_SIZE(ipv4_conntrack_ops));
         if (ret < 0) {
-                printk("nf_conntrack_ipv4: can't register pre-routing defrag hook.\n");
+                printk("nf_conntrack_ipv4: can't register hooks.\n");
                 goto cleanup_ipv4;
         }
-        ret = nf_register_hook(&ipv4_conntrack_defrag_local_out_ops);
-        if (ret < 0) {
-                printk("nf_conntrack_ipv4: can't register local_out defrag hook.\n");
-                goto cleanup_defragops;
-        }
-
-        ret = nf_register_hook(&ipv4_conntrack_in_ops);
-        if (ret < 0) {
-                printk("nf_conntrack_ipv4: can't register pre-routing hook.\n");
-                goto cleanup_defraglocalops;
-        }
-
-        ret = nf_register_hook(&ipv4_conntrack_local_out_ops);
-        if (ret < 0) {
-                printk("nf_conntrack_ipv4: can't register local out hook.\n");
-                goto cleanup_inops;
-        }
-
-        ret = nf_register_hook(&ipv4_conntrack_helper_in_ops);
-        if (ret < 0) {
-                printk("nf_conntrack_ipv4: can't register local helper hook.\n");
-                goto cleanup_inandlocalops;
-        }
-
-        ret = nf_register_hook(&ipv4_conntrack_helper_out_ops);
-        if (ret < 0) {
-                printk("nf_conntrack_ipv4: can't register postrouting helper hook.\n");
-                goto cleanup_helperinops;
-        }
-
-        ret = nf_register_hook(&ipv4_conntrack_out_ops);
-        if (ret < 0) {
-                printk("nf_conntrack_ipv4: can't register post-routing hook.\n");
-                goto cleanup_helperoutops;
-        }
-
-        ret = nf_register_hook(&ipv4_conntrack_local_in_ops);
-        if (ret < 0) {
-                printk("nf_conntrack_ipv4: can't register local in hook.\n");
-                goto cleanup_inoutandlocalops;
-        }
-
 #ifdef CONFIG_SYSCTL
         nf_ct_ipv4_sysctl_header = register_sysctl_table(nf_ct_net_table, 0);
         if (nf_ct_ipv4_sysctl_header == NULL) {
                 printk("nf_conntrack: can't register to sysctl.\n");
                 ret = -ENOMEM;
-                goto cleanup_localinops;
+                goto cleanup_hooks;
         }
 #endif
         return ret;
 
- cleanup:
-        synchronize_net();
 #ifdef CONFIG_SYSCTL
-        unregister_sysctl_table(nf_ct_ipv4_sysctl_header);
- cleanup_localinops:
+ cleanup_hooks:
+        nf_unregister_hooks(ipv4_conntrack_ops, ARRAY_SIZE(ipv4_conntrack_ops));
 #endif
-        nf_unregister_hook(&ipv4_conntrack_local_in_ops);
- cleanup_inoutandlocalops:
-        nf_unregister_hook(&ipv4_conntrack_out_ops);
- cleanup_helperoutops:
-        nf_unregister_hook(&ipv4_conntrack_helper_out_ops);
- cleanup_helperinops:
-        nf_unregister_hook(&ipv4_conntrack_helper_in_ops);
- cleanup_inandlocalops:
-        nf_unregister_hook(&ipv4_conntrack_local_out_ops);
- cleanup_inops:
-        nf_unregister_hook(&ipv4_conntrack_in_ops);
- cleanup_defraglocalops:
-        nf_unregister_hook(&ipv4_conntrack_defrag_local_out_ops);
- cleanup_defragops:
-        nf_unregister_hook(&ipv4_conntrack_defrag_ops);
  cleanup_ipv4:
         nf_conntrack_l3proto_unregister(&nf_conntrack_l3proto_ipv4);
  cleanup_icmp:
@@ -564,22 +502,21 @@ static int init_or_cleanup(int init)
         nf_conntrack_protocol_unregister(&nf_conntrack_protocol_tcp4);
  cleanup_sockopt:
         nf_unregister_sockopt(&so_getorigdst);
- cleanup_nothing:
         return ret;
 }
 
-MODULE_ALIAS("nf_conntrack-" __stringify(AF_INET));
-MODULE_LICENSE("GPL");
-
-static int __init nf_conntrack_l3proto_ipv4_init(void)
-{
-        need_conntrack();
-        return init_or_cleanup(1);
-}
-
 static void __exit nf_conntrack_l3proto_ipv4_fini(void)
 {
-        init_or_cleanup(0);
+        synchronize_net();
+#ifdef CONFIG_SYSCTL
+        unregister_sysctl_table(nf_ct_ipv4_sysctl_header);
+#endif
+        nf_unregister_hooks(ipv4_conntrack_ops, ARRAY_SIZE(ipv4_conntrack_ops));
+        nf_conntrack_l3proto_unregister(&nf_conntrack_l3proto_ipv4);
+        nf_conntrack_protocol_unregister(&nf_conntrack_protocol_icmp);
+        nf_conntrack_protocol_unregister(&nf_conntrack_protocol_udp4);
+        nf_conntrack_protocol_unregister(&nf_conntrack_protocol_tcp4);
+        nf_unregister_sockopt(&so_getorigdst);
 }
 
 module_init(nf_conntrack_l3proto_ipv4_init);
diff --git a/net/ipv4/netfilter/nf_conntrack_proto_icmp.c b/net/ipv4/netfilter/nf_conntrack_proto_icmp.c
index 52dc175be39a..4b0d361cc6e6 100644
--- a/net/ipv4/netfilter/nf_conntrack_proto_icmp.c
+++ b/net/ipv4/netfilter/nf_conntrack_proto_icmp.c
@@ -235,30 +235,14 @@ icmp_error(struct sk_buff *skb, unsigned int dataoff,
         }
 
         /* See ip_conntrack_proto_tcp.c */
-        if (hooknum != NF_IP_PRE_ROUTING)
-                goto checksum_skipped;
-
-        switch (skb->ip_summed) {
-        case CHECKSUM_HW:
-                if (!(u16)csum_fold(skb->csum))
-                        break;
+        if (hooknum == NF_IP_PRE_ROUTING &&
+            nf_ip_checksum(skb, hooknum, dataoff, 0)) {
                 if (LOG_INVALID(IPPROTO_ICMP))
                         nf_log_packet(PF_INET, 0, skb, NULL, NULL, NULL,
                                       "nf_ct_icmp: bad HW ICMP checksum ");
                 return -NF_ACCEPT;
-        case CHECKSUM_NONE:
-                if ((u16)csum_fold(skb_checksum(skb, 0, skb->len, 0))) {
-                        if (LOG_INVALID(IPPROTO_ICMP))
-                                nf_log_packet(PF_INET, 0, skb, NULL, NULL,
-                                              NULL,
-                                              "nf_ct_icmp: bad ICMP checksum ");
-                        return -NF_ACCEPT;
-                }
-        default:
-                break;
         }
 
-checksum_skipped:
         /*
          *      18 is the highest 'known' ICMP type. Anything else is a mystery
          *
diff --git a/net/ipv4/proc.c b/net/ipv4/proc.c
index 1b167c4bb3be..d61e2a9d394d 100644
--- a/net/ipv4/proc.c
+++ b/net/ipv4/proc.c
@@ -49,7 +49,7 @@ static int fold_prot_inuse(struct proto *proto)
         int res = 0;
         int cpu;
 
-        for_each_cpu(cpu)
+        for_each_possible_cpu(cpu)
                 res += proto->stats[cpu].inuse;
 
         return res;
@@ -91,7 +91,7 @@ fold_field(void *mib[], int offt)
         unsigned long res = 0;
         int i;
 
-        for_each_cpu(i) {
+        for_each_possible_cpu(i) {
                 res += *(((unsigned long *) per_cpu_ptr(mib[0], i)) + offt);
                 res += *(((unsigned long *) per_cpu_ptr(mib[1], i)) + offt);
         }
diff --git a/net/ipv4/route.c b/net/ipv4/route.c
index 94fcbc5e5a1b..ff434821909f 100644
--- a/net/ipv4/route.c
+++ b/net/ipv4/route.c
@@ -3083,7 +3083,7 @@ static int ip_rt_acct_read(char *buffer, char **start, off_t offset,
                 memcpy(dst, src, length);
 
                 /* Add the other cpus in, one int at a time */
-                for_each_cpu(i) {
+                for_each_possible_cpu(i) {
                         unsigned int j;
 
                         src = ((u32 *) IP_RT_ACCT_CPU(i)) + offset;
diff --git a/net/ipv4/tunnel4.c b/net/ipv4/tunnel4.c
index 0d7d386dac22..8d30c48f090e 100644
--- a/net/ipv4/tunnel4.c
+++ b/net/ipv4/tunnel4.c
@@ -8,6 +8,8 @@
 #include <linux/mutex.h>
 #include <linux/netdevice.h>
 #include <linux/skbuff.h>
+#include <net/icmp.h>
+#include <net/ip.h>
 #include <net/protocol.h>
 #include <net/xfrm.h>
 
@@ -70,10 +72,16 @@ static int tunnel4_rcv(struct sk_buff *skb)
 {
         struct xfrm_tunnel *handler;
 
+        if (!pskb_may_pull(skb, sizeof(struct iphdr)))
+                goto drop;
+
         for (handler = tunnel4_handlers; handler; handler = handler->next)
                 if (!handler->handler(skb))
                         return 0;
 
+        icmp_send(skb, ICMP_DEST_UNREACH, ICMP_PORT_UNREACH, 0);
+
+drop:
         kfree_skb(skb);
         return 0;
 }
diff --git a/net/ipv4/xfrm4_input.c b/net/ipv4/xfrm4_input.c
index 850d919591d1..3e174c83bfe7 100644
--- a/net/ipv4/xfrm4_input.c
+++ b/net/ipv4/xfrm4_input.c
@@ -37,8 +37,6 @@ static int xfrm4_parse_spi(struct sk_buff *skb, u8 nexthdr, u32 *spi, u32 *seq)
 {
         switch (nexthdr) {
         case IPPROTO_IPIP:
-                if (!pskb_may_pull(skb, sizeof(struct iphdr)))
-                        return -EINVAL;
                 *spi = skb->nh.iph->saddr;
                 *seq = 0;
                 return 0;
@@ -68,7 +66,7 @@ int xfrm4_rcv_encap(struct sk_buff *skb, __u16 encap_type)
 {
         int err;
         u32 spi, seq;
-        struct sec_decap_state xfrm_vec[XFRM_MAX_DEPTH];
+        struct xfrm_state *xfrm_vec[XFRM_MAX_DEPTH];
         struct xfrm_state *x;
         int xfrm_nr = 0;
         int decaps = 0;
@@ -90,14 +88,16 @@ int xfrm4_rcv_encap(struct sk_buff *skb, __u16 encap_type)
                 if (unlikely(x->km.state != XFRM_STATE_VALID))
                         goto drop_unlock;
 
+                if ((x->encap ? x->encap->encap_type : 0) != encap_type)
+                        goto drop_unlock;
+
                 if (x->props.replay_window && xfrm_replay_check(x, seq))
                         goto drop_unlock;
 
                 if (xfrm_state_check_expire(x))
                         goto drop_unlock;
 
-                xfrm_vec[xfrm_nr].decap.decap_type = encap_type;
-                if (x->type->input(x, &(xfrm_vec[xfrm_nr].decap), skb))
+                if (x->type->input(x, skb))
                         goto drop_unlock;
 
                 /* only the first xfrm gets the encap type */
@@ -111,7 +111,7 @@ int xfrm4_rcv_encap(struct sk_buff *skb, __u16 encap_type)
 
                 spin_unlock(&x->lock);
 
-                xfrm_vec[xfrm_nr++].xvec = x;
+                xfrm_vec[xfrm_nr++] = x;
 
                 iph = skb->nh.iph;
 
@@ -153,7 +153,8 @@ int xfrm4_rcv_encap(struct sk_buff *skb, __u16 encap_type)
         if (xfrm_nr + skb->sp->len > XFRM_MAX_DEPTH)
                 goto drop;
 
-        memcpy(skb->sp->x+skb->sp->len, xfrm_vec, xfrm_nr*sizeof(struct sec_decap_state));
+        memcpy(skb->sp->xvec + skb->sp->len, xfrm_vec,
+               xfrm_nr * sizeof(xfrm_vec[0]));
         skb->sp->len += xfrm_nr;
 
         nf_reset(skb);
@@ -184,7 +185,7 @@ drop_unlock:
         xfrm_state_put(x);
 drop:
         while (--xfrm_nr >= 0)
-                xfrm_state_put(xfrm_vec[xfrm_nr].xvec);
+                xfrm_state_put(xfrm_vec[xfrm_nr]);
 
         kfree_skb(skb);
         return 0;
diff --git a/net/ipv4/xfrm4_tunnel.c b/net/ipv4/xfrm4_tunnel.c
index 2d670935c2b5..f8ceaa127c83 100644
--- a/net/ipv4/xfrm4_tunnel.c
+++ b/net/ipv4/xfrm4_tunnel.c
@@ -21,7 +21,7 @@ static int ipip_output(struct xfrm_state *x, struct sk_buff *skb)
         return 0;
 }
 
-static int ipip_xfrm_rcv(struct xfrm_state *x, struct xfrm_decap_state *decap, struct sk_buff *skb)
+static int ipip_xfrm_rcv(struct xfrm_state *x, struct sk_buff *skb)
 {
         return 0;
 }
diff --git a/net/ipv6/ah6.c b/net/ipv6/ah6.c
index cf58251df4b3..6778173a3dda 100644
--- a/net/ipv6/ah6.c
+++ b/net/ipv6/ah6.c
@@ -229,7 +229,7 @@ error:
         return err;
 }
 
-static int ah6_input(struct xfrm_state *x, struct xfrm_decap_state *decap, struct sk_buff *skb)
+static int ah6_input(struct xfrm_state *x, struct sk_buff *skb)
 {
         /*
          * Before process AH
diff --git a/net/ipv6/esp6.c b/net/ipv6/esp6.c
index 3dcaac7a0972..22f046079037 100644
--- a/net/ipv6/esp6.c
+++ b/net/ipv6/esp6.c
@@ -130,7 +130,7 @@ error:
         return err;
 }
 
-static int esp6_input(struct xfrm_state *x, struct xfrm_decap_state *decap, struct sk_buff *skb)
+static int esp6_input(struct xfrm_state *x, struct sk_buff *skb)
 {
         struct ipv6hdr *iph;
         struct ipv6_esp_hdr *esph;
diff --git a/net/ipv6/icmp.c b/net/ipv6/icmp.c
index 21eb725e885f..1044b6fce0d5 100644
--- a/net/ipv6/icmp.c
+++ b/net/ipv6/icmp.c
@@ -717,7 +717,7 @@ int __init icmpv6_init(struct net_proto_family *ops)
         struct sock *sk;
         int err, i, j;
 
-        for_each_cpu(i) {
+        for_each_possible_cpu(i) {
                 err = sock_create_kern(PF_INET6, SOCK_RAW, IPPROTO_ICMPV6,
                                        &per_cpu(__icmpv6_socket, i));
                 if (err < 0) {
@@ -763,7 +763,7 @@ void icmpv6_cleanup(void)
 {
         int i;
 
-        for_each_cpu(i) {
+        for_each_possible_cpu(i) {
                 sock_release(per_cpu(__icmpv6_socket, i));
         }
         inet6_del_protocol(&icmpv6_protocol, IPPROTO_ICMPV6);
diff --git a/net/ipv6/inet6_hashtables.c b/net/ipv6/inet6_hashtables.c
index bb8ffb8a14c5..2ae84c961678 100644
--- a/net/ipv6/inet6_hashtables.c
+++ b/net/ipv6/inet6_hashtables.c
@@ -23,6 +23,86 @@
 #include <net/inet6_hashtables.h>
 #include <net/ip.h>
 
+void __inet6_hash(struct inet_hashinfo *hashinfo,
+                                struct sock *sk)
+{
+        struct hlist_head *list;
+        rwlock_t *lock;
+
+        BUG_TRAP(sk_unhashed(sk));
+
+        if (sk->sk_state == TCP_LISTEN) {
+                list = &hashinfo->listening_hash[inet_sk_listen_hashfn(sk)];
+                lock = &hashinfo->lhash_lock;
+                inet_listen_wlock(hashinfo);
+        } else {
+                unsigned int hash;
+                sk->sk_hash = hash = inet6_sk_ehashfn(sk);
+                hash &= (hashinfo->ehash_size - 1);
+                list = &hashinfo->ehash[hash].chain;
+                lock = &hashinfo->ehash[hash].lock;
+                write_lock(lock);
+        }
+
+        __sk_add_node(sk, list);
+        sock_prot_inc_use(sk->sk_prot);
+        write_unlock(lock);
+}
+EXPORT_SYMBOL(__inet6_hash);
+
+/*
+ * Sockets in TCP_CLOSE state are _always_ taken out of the hash, so
+ * we need not check it for TCP lookups anymore, thanks Alexey. -DaveM
+ *
+ * The sockhash lock must be held as a reader here.
+ */
+struct sock *__inet6_lookup_established(struct inet_hashinfo *hashinfo,
+                                           const struct in6_addr *saddr,
+                                           const u16 sport,
+                                           const struct in6_addr *daddr,
+                                           const u16 hnum,
+                                           const int dif)
+{
+        struct sock *sk;
+        const struct hlist_node *node;
+        const __u32 ports = INET_COMBINED_PORTS(sport, hnum);
+        /* Optimize here for direct hit, only listening connections can
+         * have wildcards anyways.
+         */
+        unsigned int hash = inet6_ehashfn(daddr, hnum, saddr, sport);
+        struct inet_ehash_bucket *head = inet_ehash_bucket(hashinfo, hash);
+
+        prefetch(head->chain.first);
+        read_lock(&head->lock);
+        sk_for_each(sk, node, &head->chain) {
+                /* For IPV6 do the cheaper port and family tests first. */
+                if (INET6_MATCH(sk, hash, saddr, daddr, ports, dif))
+                        goto hit; /* You sunk my battleship! */
+        }
+        /* Must check for a TIME_WAIT'er before going to listener hash. */
+        sk_for_each(sk, node, &(head + hashinfo->ehash_size)->chain) {
+                const struct inet_timewait_sock *tw = inet_twsk(sk);
+
+                if(*((__u32 *)&(tw->tw_dport))  == ports        &&
+                   sk->sk_family                == PF_INET6) {
+                        const struct inet6_timewait_sock *tw6 = inet6_twsk(sk);
+
+                        if (ipv6_addr_equal(&tw6->tw_v6_daddr, saddr)   &&
+                            ipv6_addr_equal(&tw6->tw_v6_rcv_saddr, daddr)       &&
+                            (!sk->sk_bound_dev_if || sk->sk_bound_dev_if == dif))
+                                goto hit;
+                }
+        }
+        read_unlock(&head->lock);
+        return NULL;
+
+hit:
+        sock_hold(sk);
+        read_unlock(&head->lock);
+        return sk;
+}
+EXPORT_SYMBOL(__inet6_lookup_established);
+
 struct sock *inet6_lookup_listener(struct inet_hashinfo *hashinfo,
                                    const struct in6_addr *daddr,
                                    const unsigned short hnum, const int dif)
diff --git a/net/ipv6/ip6_tunnel.c b/net/ipv6/ip6_tunnel.c
index ff9040c92556..a995796b5a57 100644
--- a/net/ipv6/ip6_tunnel.c
+++ b/net/ipv6/ip6_tunnel.c
@@ -519,9 +519,6 @@ ip6ip6_rcv(struct sk_buff *skb)
         struct ipv6hdr *ipv6h;
         struct ip6_tnl *t;
 
-        if (!pskb_may_pull(skb, sizeof (*ipv6h)))
-                goto discard;
-
         ipv6h = skb->nh.ipv6h;
 
         read_lock(&ip6ip6_lock);
@@ -529,8 +526,7 @@ ip6ip6_rcv(struct sk_buff *skb)
         if ((t = ip6ip6_tnl_lookup(&ipv6h->saddr, &ipv6h->daddr)) != NULL) {
                 if (!xfrm6_policy_check(NULL, XFRM_POLICY_IN, skb)) {
                         read_unlock(&ip6ip6_lock);
-                        kfree_skb(skb);
-                        return 0;
+                        goto discard;
                 }
 
                 if (!(t->parms.flags & IP6_TNL_F_CAP_RCV)) {
@@ -557,9 +553,11 @@ ip6ip6_rcv(struct sk_buff *skb)
                 return 0;
         }
         read_unlock(&ip6ip6_lock);
-        icmpv6_send(skb, ICMPV6_DEST_UNREACH, ICMPV6_ADDR_UNREACH, 0, skb->dev);
-discard:
         return 1;
+
+discard:
+        kfree_skb(skb);
+        return 0;
 }
 
 static inline struct ipv6_txoptions *create_tel(__u8 encap_limit)
diff --git a/net/ipv6/ipcomp6.c b/net/ipv6/ipcomp6.c
index d4cfec3f414e..05eb67def39f 100644
--- a/net/ipv6/ipcomp6.c
+++ b/net/ipv6/ipcomp6.c
@@ -63,7 +63,7 @@ static void **ipcomp6_scratches;
 static int ipcomp6_scratch_users;
 static LIST_HEAD(ipcomp6_tfms_list);
 
-static int ipcomp6_input(struct xfrm_state *x, struct xfrm_decap_state *decap, struct sk_buff *skb)
+static int ipcomp6_input(struct xfrm_state *x, struct sk_buff *skb)
 {
         int err = 0;
         u8 nexthdr = 0;
@@ -290,7 +290,7 @@ static void ipcomp6_free_scratches(void)
         if (!scratches)
                 return;
 
-        for_each_cpu(i) {
+        for_each_possible_cpu(i) {
                 void *scratch = *per_cpu_ptr(scratches, i);
 
                 vfree(scratch);
@@ -313,7 +313,7 @@ static void **ipcomp6_alloc_scratches(void)
 
         ipcomp6_scratches = scratches;
 
-        for_each_cpu(i) {
+        for_each_possible_cpu(i) {
                 void *scratch = vmalloc(IPCOMP_SCRATCH_SIZE);
                 if (!scratch)
                         return NULL;
@@ -344,7 +344,7 @@ static void ipcomp6_free_tfms(struct crypto_tfm **tfms)
         if (!tfms)
                 return;
 
-        for_each_cpu(cpu) {
+        for_each_possible_cpu(cpu) {
                 struct crypto_tfm *tfm = *per_cpu_ptr(tfms, cpu);
                 crypto_free_tfm(tfm);
         }
@@ -384,7 +384,7 @@ static struct crypto_tfm **ipcomp6_alloc_tfms(const char *alg_name)
         if (!tfms)
                 goto error;
 
-        for_each_cpu(cpu) {
+        for_each_possible_cpu(cpu) {
                 struct crypto_tfm *tfm = crypto_alloc_tfm(alg_name, 0);
                 if (!tfm)
                         goto error;
diff --git a/net/ipv6/netfilter.c b/net/ipv6/netfilter.c
index d750cfc019dc..395a417ba955 100644
--- a/net/ipv6/netfilter.c
+++ b/net/ipv6/netfilter.c
@@ -7,6 +7,7 @@
 #include <net/ipv6.h>
 #include <net/ip6_route.h>
 #include <net/xfrm.h>
+#include <net/ip6_checksum.h>
 
 int ip6_route_me_harder(struct sk_buff *skb)
 {
@@ -54,7 +55,7 @@ struct ip6_rt_info {
         struct in6_addr saddr;
 };
 
-static void save(const struct sk_buff *skb, struct nf_info *info)
+static void nf_ip6_saveroute(const struct sk_buff *skb, struct nf_info *info)
 {
         struct ip6_rt_info *rt_info = nf_info_reroute(info);
 
@@ -66,7 +67,7 @@ static void save(const struct sk_buff *skb, struct nf_info *info)
         }
 }
 
-static int reroute(struct sk_buff **pskb, const struct nf_info *info)
+static int nf_ip6_reroute(struct sk_buff **pskb, const struct nf_info *info)
 {
         struct ip6_rt_info *rt_info = nf_info_reroute(info);
 
@@ -79,15 +80,50 @@ static int reroute(struct sk_buff **pskb, const struct nf_info *info)
         return 0;
 }
 
-static struct nf_queue_rerouter ip6_reroute = {
-        .rer_size       = sizeof(struct ip6_rt_info),
-        .save           = &save,
-        .reroute        = &reroute,
+unsigned int nf_ip6_checksum(struct sk_buff *skb, unsigned int hook,
+                             unsigned int dataoff, u_int8_t protocol)
+{
+        struct ipv6hdr *ip6h = skb->nh.ipv6h;
+        unsigned int csum = 0;
+
+        switch (skb->ip_summed) {
+        case CHECKSUM_HW:
+                if (hook != NF_IP6_PRE_ROUTING && hook != NF_IP6_LOCAL_IN)
+                        break;
+                if (!csum_ipv6_magic(&ip6h->saddr, &ip6h->daddr,
+                                     skb->len - dataoff, protocol,
+                                     csum_sub(skb->csum,
+                                              skb_checksum(skb, 0,
+                                                           dataoff, 0)))) {
+                        skb->ip_summed = CHECKSUM_UNNECESSARY;
+                        break;
+                }
+                /* fall through */
+        case CHECKSUM_NONE:
+                skb->csum = ~csum_ipv6_magic(&ip6h->saddr, &ip6h->daddr,
+                                             skb->len - dataoff,
+                                             protocol,
+                                             csum_sub(0,
+                                                      skb_checksum(skb, 0,
+                                                                   dataoff, 0)));
+                csum = __skb_checksum_complete(skb);
+        }
+        return csum;
+}
+
+EXPORT_SYMBOL(nf_ip6_checksum);
+
+static struct nf_afinfo nf_ip6_afinfo = {
+        .family         = AF_INET6,
+        .checksum       = nf_ip6_checksum,
+        .saveroute      = nf_ip6_saveroute,
+        .reroute        = nf_ip6_reroute,
+        .route_key_size = sizeof(struct ip6_rt_info),
 };
 
 int __init ipv6_netfilter_init(void)
 {
-        return nf_register_queue_rerouter(PF_INET6, &ip6_reroute);
+        return nf_register_afinfo(&nf_ip6_afinfo);
 }
 
 /* This can be called from inet6_init() on errors, so it cannot
@@ -95,5 +131,5 @@ int __init ipv6_netfilter_init(void)
  */
 void ipv6_netfilter_fini(void)
 {
-        nf_unregister_queue_rerouter(PF_INET6);
+        nf_unregister_afinfo(&nf_ip6_afinfo);
 }
diff --git a/net/ipv6/netfilter/Kconfig b/net/ipv6/netfilter/Kconfig
index 98f78759f1ab..4bc4e5b33794 100644
--- a/net/ipv6/netfilter/Kconfig
+++ b/net/ipv6/netfilter/Kconfig
@@ -87,16 +87,6 @@ config IP6_NF_MATCH_HL
 
           To compile it as a module, choose M here.  If unsure, say N.
 
-config IP6_NF_MATCH_MULTIPORT
-        tristate "Multiple port match support"
-        depends on IP6_NF_IPTABLES
-        help
-          Multiport matching allows you to match TCP or UDP packets based on
-          a series of source or destination ports: normally a rule can only
-          match a single range of ports.
-
-          To compile it as a module, choose M here.  If unsure, say N.
-
 config IP6_NF_MATCH_OWNER
         tristate "Owner match support"
         depends on IP6_NF_IPTABLES
@@ -115,11 +105,11 @@ config IP6_NF_MATCH_IPV6HEADER
 
           To compile it as a module, choose M here.  If unsure, say N.
 
-config IP6_NF_MATCH_AHESP
-        tristate "AH/ESP match support"
+config IP6_NF_MATCH_AH
+        tristate "AH match support"
         depends on IP6_NF_IPTABLES
         help
-          This module allows one to match AH and ESP packets.
+          This module allows one to match AH packets.
 
           To compile it as a module, choose M here.  If unsure, say N.
 
diff --git a/net/ipv6/netfilter/Makefile b/net/ipv6/netfilter/Makefile
index 8436a1a1731f..eeeb57d4c9c5 100644
--- a/net/ipv6/netfilter/Makefile
+++ b/net/ipv6/netfilter/Makefile
@@ -8,9 +8,8 @@ obj-$(CONFIG_IP6_NF_MATCH_RT) += ip6t_rt.o
 obj-$(CONFIG_IP6_NF_MATCH_OPTS) += ip6t_hbh.o ip6t_dst.o
 obj-$(CONFIG_IP6_NF_MATCH_IPV6HEADER) += ip6t_ipv6header.o
 obj-$(CONFIG_IP6_NF_MATCH_FRAG) += ip6t_frag.o
-obj-$(CONFIG_IP6_NF_MATCH_AHESP) += ip6t_esp.o ip6t_ah.o
+obj-$(CONFIG_IP6_NF_MATCH_AH) += ip6t_ah.o
 obj-$(CONFIG_IP6_NF_MATCH_EUI64) += ip6t_eui64.o
-obj-$(CONFIG_IP6_NF_MATCH_MULTIPORT) += ip6t_multiport.o
 obj-$(CONFIG_IP6_NF_MATCH_OWNER) += ip6t_owner.o
 obj-$(CONFIG_IP6_NF_FILTER) += ip6table_filter.o
 obj-$(CONFIG_IP6_NF_MANGLE) += ip6table_mangle.o
diff --git a/net/ipv6/netfilter/ip6_queue.c b/net/ipv6/netfilter/ip6_queue.c
index e81c6a9dab81..b4b7d441af25 100644
--- a/net/ipv6/netfilter/ip6_queue.c
+++ b/net/ipv6/netfilter/ip6_queue.c
@@ -658,15 +658,11 @@ static struct nf_queue_handler nfqh = {
         .outfn  = &ipq_enqueue_packet,
 };
 
-static int
-init_or_cleanup(int init)
+static int __init ip6_queue_init(void)
 {
         int status = -ENOMEM;
         struct proc_dir_entry *proc;
         
-        if (!init)
-                goto cleanup;
-
         netlink_register_notifier(&ipq_nl_notifier);
         ipqnl = netlink_kernel_create(NETLINK_IP6_FW, 0, ipq_rcv_sk,
                                       THIS_MODULE);
@@ -693,11 +689,6 @@ init_or_cleanup(int init)
         }
         return status;
 
-cleanup:
-        nf_unregister_queue_handlers(&nfqh);
-        synchronize_net();
-        ipq_flush(NF_DROP);
-        
 cleanup_sysctl:
         unregister_sysctl_table(ipq_sysctl_header);
         unregister_netdevice_notifier(&ipq_dev_notifier);
@@ -713,15 +704,21 @@ cleanup_netlink_notifier:
         return status;
 }
 
-static int __init ip6_queue_init(void)
-{
-        
-        return init_or_cleanup(1);
-}
-
 static void __exit ip6_queue_fini(void)
 {
-        init_or_cleanup(0);
+        nf_unregister_queue_handlers(&nfqh);
+        synchronize_net();
+        ipq_flush(NF_DROP);
+
+        unregister_sysctl_table(ipq_sysctl_header);
+        unregister_netdevice_notifier(&ipq_dev_notifier);
+        proc_net_remove(IPQ_PROC_FS_NAME);
+
+        sock_release(ipqnl->sk_socket);
+        mutex_lock(&ipqnl_mutex);
+        mutex_unlock(&ipqnl_mutex);
+
+        netlink_unregister_notifier(&ipq_nl_notifier);
 }
 
 MODULE_DESCRIPTION("IPv6 packet queue handler");
diff --git a/net/ipv6/netfilter/ip6_tables.c b/net/ipv6/netfilter/ip6_tables.c
index 3ecf2db841f8..642b4b11464f 100644
--- a/net/ipv6/netfilter/ip6_tables.c
+++ b/net/ipv6/netfilter/ip6_tables.c
@@ -788,7 +788,7 @@ translate_table(const char *name,
         }
 
         /* And one copy for every other CPU */
-        for_each_cpu(i) {
+        for_each_possible_cpu(i) {
                 if (newinfo->entries[i] && newinfo->entries[i] != entry0)
                         memcpy(newinfo->entries[i], entry0, newinfo->size);
         }
@@ -841,7 +841,7 @@ get_counters(const struct xt_table_info *t,
                            counters,
                            &i);
 
-        for_each_cpu(cpu) {
+        for_each_possible_cpu(cpu) {
                 if (cpu == curcpu)
                         continue;
                 i = 0;
diff --git a/net/ipv6/netfilter/ip6t_esp.c b/net/ipv6/netfilter/ip6t_esp.c
deleted file mode 100644
index 36bedad2c6f7..000000000000
--- a/net/ipv6/netfilter/ip6t_esp.c
+++ /dev/null
@@ -1,115 +0,0 @@
-/* Kernel module to match ESP parameters. */
-/* (C) 2001-2002 Andras Kis-Szabo <kisza@sch.bme.hu>
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 2 as
- * published by the Free Software Foundation.
- */
-
-
-#include <linux/module.h>
-#include <linux/skbuff.h>
-#include <linux/ip.h>
-#include <linux/ipv6.h>
-#include <linux/types.h>
-#include <net/checksum.h>
-#include <net/ipv6.h>
-
-#include <linux/netfilter_ipv6/ip6_tables.h>
-#include <linux/netfilter_ipv6/ip6t_esp.h>
-
-MODULE_LICENSE("GPL");
-MODULE_DESCRIPTION("IPv6 ESP match");
-MODULE_AUTHOR("Andras Kis-Szabo <kisza@sch.bme.hu>");
-
-#if 0
-#define DEBUGP printk
-#else
-#define DEBUGP(format, args...)
-#endif
-
-/* Returns 1 if the spi is matched by the range, 0 otherwise */
-static inline int
-spi_match(u_int32_t min, u_int32_t max, u_int32_t spi, int invert)
-{
-        int r=0;
-        DEBUGP("esp spi_match:%c 0x%x <= 0x%x <= 0x%x",invert? '!':' ',
-               min,spi,max);
-        r=(spi >= min && spi <= max) ^ invert;
-        DEBUGP(" result %s\n",r? "PASS\n" : "FAILED\n");
-        return r;
-}
-
-static int
-match(const struct sk_buff *skb,
-      const struct net_device *in,
-      const struct net_device *out,
-      const struct xt_match *match,
-      const void *matchinfo,
-      int offset,
-      unsigned int protoff,
-      int *hotdrop)
-{
-        struct ip_esp_hdr _esp, *eh;
-        const struct ip6t_esp *espinfo = matchinfo;
-        unsigned int ptr;
-
-        /* Make sure this isn't an evil packet */
-        /*DEBUGP("ipv6_esp entered \n");*/
-
-        if (ipv6_find_hdr(skb, &ptr, NEXTHDR_ESP, NULL) < 0)
-                return 0;
-
-        eh = skb_header_pointer(skb, ptr, sizeof(_esp), &_esp);
-        if (eh == NULL) {
-                *hotdrop = 1;
-                return 0;
-        }
-
-        DEBUGP("IPv6 ESP SPI %u %08X\n", ntohl(eh->spi), ntohl(eh->spi));
-
-        return (eh != NULL)
-                && spi_match(espinfo->spis[0], espinfo->spis[1],
-                              ntohl(eh->spi),
-                              !!(espinfo->invflags & IP6T_ESP_INV_SPI));
-}
-
-/* Called when user tries to insert an entry of this type. */
-static int
-checkentry(const char *tablename,
-           const void *ip,
-           const struct xt_match *match,
-           void *matchinfo,
-           unsigned int matchinfosize,
-           unsigned int hook_mask)
-{
-        const struct ip6t_esp *espinfo = matchinfo;
-
-        if (espinfo->invflags & ~IP6T_ESP_INV_MASK) {
-                DEBUGP("ip6t_esp: unknown flags %X\n",
-                         espinfo->invflags);
-                return 0;
-        }
-        return 1;
-}
-
-static struct ip6t_match esp_match = {
-        .name           = "esp",
-        .match          = match,
-        .matchsize      = sizeof(struct ip6t_esp),
-        .checkentry     = checkentry,
-        .me             = THIS_MODULE,
-};
-
-static int __init ip6t_esp_init(void)
-{
-        return ip6t_register_match(&esp_match);
-}
-
-static void __exit ip6t_esp_fini(void)
-{
-        ip6t_unregister_match(&esp_match);
-}
-
-module_init(ip6t_esp_init);
-module_exit(ip6t_esp_fini);
diff --git a/net/ipv6/netfilter/ip6t_multiport.c b/net/ipv6/netfilter/ip6t_multiport.c
deleted file mode 100644
index 10c48ba596d6..000000000000
--- a/net/ipv6/netfilter/ip6t_multiport.c
+++ /dev/null
@@ -1,125 +0,0 @@
-/* Kernel module to match one of a list of TCP/UDP ports: ports are in
-   the same place so we can treat them as equal. */
-
-/* (C) 1999-2001 Paul `Rusty' Russell
- * (C) 2002-2004 Netfilter Core Team <coreteam@netfilter.org>
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 2 as
- * published by the Free Software Foundation.
- */
-
-#include <linux/module.h>
-#include <linux/types.h>
-#include <linux/udp.h>
-#include <linux/skbuff.h>
-#include <linux/in.h>
-
-#include <linux/netfilter_ipv6/ip6t_multiport.h>
-#include <linux/netfilter_ipv6/ip6_tables.h>
-
-MODULE_LICENSE("GPL");
-MODULE_AUTHOR("Netfilter Core Team <coreteam@netfilter.org>");
-MODULE_DESCRIPTION("ip6tables match for multiple ports");
-
-#if 0
-#define duprintf(format, args...) printk(format , ## args)
-#else
-#define duprintf(format, args...)
-#endif
-
-/* Returns 1 if the port is matched by the test, 0 otherwise. */
-static inline int
-ports_match(const u_int16_t *portlist, enum ip6t_multiport_flags flags,
-            u_int8_t count, u_int16_t src, u_int16_t dst)
-{
-        unsigned int i;
-        for (i=0; i<count; i++) {
-                if (flags != IP6T_MULTIPORT_DESTINATION
-                    && portlist[i] == src)
-                        return 1;
-
-                if (flags != IP6T_MULTIPORT_SOURCE
-                    && portlist[i] == dst)
-                        return 1;
-        }
-
-        return 0;
-}
-
-static int
-match(const struct sk_buff *skb,
-      const struct net_device *in,
-      const struct net_device *out,
-      const struct xt_match *match,
-      const void *matchinfo,
-      int offset,
-      unsigned int protoff,
-      int *hotdrop)
-{
-        u16 _ports[2], *pptr;
-        const struct ip6t_multiport *multiinfo = matchinfo;
-
-        /* Must not be a fragment. */
-        if (offset)
-                return 0;
-
-        /* Must be big enough to read ports (both UDP and TCP have
-           them at the start). */
-        pptr = skb_header_pointer(skb, protoff, sizeof(_ports), &_ports[0]);
-        if (pptr == NULL) {
-                /* We've been asked to examine this packet, and we
-                 * can't.  Hence, no choice but to drop.
-                 */
-                duprintf("ip6t_multiport:"
-                         " Dropping evil offset=0 tinygram.\n");
-                *hotdrop = 1;
-                return 0;
-        }
-
-        return ports_match(multiinfo->ports,
-                           multiinfo->flags, multiinfo->count,
-                           ntohs(pptr[0]), ntohs(pptr[1]));
-}
-
-/* Called when user tries to insert an entry of this type. */
-static int
-checkentry(const char *tablename,
-           const void *info,
-           const struct xt_match *match,
-           void *matchinfo,
-           unsigned int matchsize,
-           unsigned int hook_mask)
-{
-        const struct ip6t_ip6 *ip = info;
-        const struct ip6t_multiport *multiinfo = matchinfo;
-
-        /* Must specify proto == TCP/UDP, no unknown flags or bad count */
-        return (ip->proto == IPPROTO_TCP || ip->proto == IPPROTO_UDP)
-                && !(ip->invflags & IP6T_INV_PROTO)
-                && (multiinfo->flags == IP6T_MULTIPORT_SOURCE
-                    || multiinfo->flags == IP6T_MULTIPORT_DESTINATION
-                    || multiinfo->flags == IP6T_MULTIPORT_EITHER)
-                && multiinfo->count <= IP6T_MULTI_PORTS;
-}
-
-static struct ip6t_match multiport_match = {
-        .name           = "multiport",
-        .match          = match,
-        .matchsize      = sizeof(struct ip6t_multiport),
-        .checkentry     = checkentry,
-        .me             = THIS_MODULE,
-};
-
-static int __init ip6t_multiport_init(void)
-{
-        return ip6t_register_match(&multiport_match);
-}
-
-static void __exit ip6t_multiport_fini(void)
-{
-        ip6t_unregister_match(&multiport_match);
-}
-
-module_init(ip6t_multiport_init);
-module_exit(ip6t_multiport_fini);
diff --git a/net/ipv6/netfilter/ip6table_filter.c b/net/ipv6/netfilter/ip6table_filter.c
index e5e724d9ee60..60976c0c58e8 100644
--- a/net/ipv6/netfilter/ip6table_filter.c
+++ b/net/ipv6/netfilter/ip6table_filter.c
@@ -177,37 +177,20 @@ static int __init ip6table_filter_init(void)
                 return ret;
 
         /* Register hooks */
-        ret = nf_register_hook(&ip6t_ops[0]);
+        ret = nf_register_hooks(ip6t_ops, ARRAY_SIZE(ip6t_ops));
         if (ret < 0)
                 goto cleanup_table;
 
-        ret = nf_register_hook(&ip6t_ops[1]);
-        if (ret < 0)
-                goto cleanup_hook0;
-
-        ret = nf_register_hook(&ip6t_ops[2]);
-        if (ret < 0)
-                goto cleanup_hook1;
-
         return ret;
 
- cleanup_hook1:
-        nf_unregister_hook(&ip6t_ops[1]);
- cleanup_hook0:
-        nf_unregister_hook(&ip6t_ops[0]);
  cleanup_table:
         ip6t_unregister_table(&packet_filter);
-
         return ret;
 }
 
 static void __exit ip6table_filter_fini(void)
 {
-        unsigned int i;
-
-        for (i = 0; i < sizeof(ip6t_ops)/sizeof(struct nf_hook_ops); i++)
-                nf_unregister_hook(&ip6t_ops[i]);
-
+        nf_unregister_hooks(ip6t_ops, ARRAY_SIZE(ip6t_ops));
         ip6t_unregister_table(&packet_filter);
 }
 
diff --git a/net/ipv6/netfilter/ip6table_mangle.c b/net/ipv6/netfilter/ip6table_mangle.c
index e1f0f6ae9841..03a13eab1dae 100644
--- a/net/ipv6/netfilter/ip6table_mangle.c
+++ b/net/ipv6/netfilter/ip6table_mangle.c
@@ -238,49 +238,20 @@ static int __init ip6table_mangle_init(void)
                 return ret;
 
         /* Register hooks */
-        ret = nf_register_hook(&ip6t_ops[0]);
+        ret = nf_register_hooks(ip6t_ops, ARRAY_SIZE(ip6t_ops));
         if (ret < 0)
                 goto cleanup_table;
 
-        ret = nf_register_hook(&ip6t_ops[1]);
-        if (ret < 0)
-                goto cleanup_hook0;
-
-        ret = nf_register_hook(&ip6t_ops[2]);
-        if (ret < 0)
-                goto cleanup_hook1;
-
-        ret = nf_register_hook(&ip6t_ops[3]);
-        if (ret < 0)
-                goto cleanup_hook2;
-
-        ret = nf_register_hook(&ip6t_ops[4]);
-        if (ret < 0)
-                goto cleanup_hook3;
-
         return ret;
 
- cleanup_hook3:
-        nf_unregister_hook(&ip6t_ops[3]);
- cleanup_hook2:
-        nf_unregister_hook(&ip6t_ops[2]);
- cleanup_hook1:
-        nf_unregister_hook(&ip6t_ops[1]);
- cleanup_hook0:
-        nf_unregister_hook(&ip6t_ops[0]);
  cleanup_table:
         ip6t_unregister_table(&packet_mangler);
-
         return ret;
 }
 
 static void __exit ip6table_mangle_fini(void)
 {
-        unsigned int i;
-
-        for (i = 0; i < sizeof(ip6t_ops)/sizeof(struct nf_hook_ops); i++)
-                nf_unregister_hook(&ip6t_ops[i]);
-
+        nf_unregister_hooks(ip6t_ops, ARRAY_SIZE(ip6t_ops));
         ip6t_unregister_table(&packet_mangler);
 }
 
diff --git a/net/ipv6/netfilter/ip6table_raw.c b/net/ipv6/netfilter/ip6table_raw.c
index 54d1fffd62ba..61a7c58e99f8 100644
--- a/net/ipv6/netfilter/ip6table_raw.c
+++ b/net/ipv6/netfilter/ip6table_raw.c
@@ -152,31 +152,20 @@ static int __init ip6table_raw_init(void)
                 return ret;
 
         /* Register hooks */
-        ret = nf_register_hook(&ip6t_ops[0]);
+        ret = nf_register_hooks(ip6t_ops, ARRAY_SIZE(ip6t_ops));
         if (ret < 0)
                 goto cleanup_table;
 
-        ret = nf_register_hook(&ip6t_ops[1]);
-        if (ret < 0)
-                goto cleanup_hook0;
-
         return ret;
 
- cleanup_hook0:
-        nf_unregister_hook(&ip6t_ops[0]);
  cleanup_table:
         ip6t_unregister_table(&packet_raw);
-
         return ret;
 }
 
 static void __exit ip6table_raw_fini(void)
 {
-        unsigned int i;
-
-        for (i = 0; i < sizeof(ip6t_ops)/sizeof(struct nf_hook_ops); i++)
-                nf_unregister_hook(&ip6t_ops[i]);
-
+        nf_unregister_hooks(ip6t_ops, ARRAY_SIZE(ip6t_ops));
         ip6t_unregister_table(&packet_raw);
 }
 
diff --git a/net/ipv6/netfilter/nf_conntrack_l3proto_ipv6.c b/net/ipv6/netfilter/nf_conntrack_l3proto_ipv6.c
index c8b5a96cbb0f..93bae36f2663 100644
--- a/net/ipv6/netfilter/nf_conntrack_l3proto_ipv6.c
+++ b/net/ipv6/netfilter/nf_conntrack_l3proto_ipv6.c
@@ -286,55 +286,49 @@ static unsigned int ipv6_conntrack_local(unsigned int hooknum,
         return ipv6_conntrack_in(hooknum, pskb, in, out, okfn);
 }
 
-/* Connection tracking may drop packets, but never alters them, so
-   make it the first hook. */
-static struct nf_hook_ops ipv6_conntrack_defrag_ops = {
-        .hook           = ipv6_defrag,
-        .owner          = THIS_MODULE,
-        .pf             = PF_INET6,
-        .hooknum        = NF_IP6_PRE_ROUTING,
-        .priority       = NF_IP6_PRI_CONNTRACK_DEFRAG,
-};
-
-static struct nf_hook_ops ipv6_conntrack_in_ops = {
-        .hook           = ipv6_conntrack_in,
-        .owner          = THIS_MODULE,
-        .pf             = PF_INET6,
-        .hooknum        = NF_IP6_PRE_ROUTING,
-        .priority       = NF_IP6_PRI_CONNTRACK,
-};
-
-static struct nf_hook_ops ipv6_conntrack_local_out_ops = {
-        .hook           = ipv6_conntrack_local,
-        .owner          = THIS_MODULE,
-        .pf             = PF_INET6,
-        .hooknum        = NF_IP6_LOCAL_OUT,
-        .priority       = NF_IP6_PRI_CONNTRACK,
-};
-
-static struct nf_hook_ops ipv6_conntrack_defrag_local_out_ops = {
-        .hook           = ipv6_defrag,
-        .owner          = THIS_MODULE,
-        .pf             = PF_INET6,
-        .hooknum        = NF_IP6_LOCAL_OUT,
-        .priority       = NF_IP6_PRI_CONNTRACK_DEFRAG,
-};
-
-/* Refragmenter; last chance. */
-static struct nf_hook_ops ipv6_conntrack_out_ops = {
-        .hook           = ipv6_confirm,
-        .owner          = THIS_MODULE,
-        .pf             = PF_INET6,
-        .hooknum        = NF_IP6_POST_ROUTING,
-        .priority       = NF_IP6_PRI_LAST,
-};
-
-static struct nf_hook_ops ipv6_conntrack_local_in_ops = {
-        .hook           = ipv6_confirm,
-        .owner          = THIS_MODULE,
-        .pf             = PF_INET6,
-        .hooknum        = NF_IP6_LOCAL_IN,
-        .priority       = NF_IP6_PRI_LAST-1,
+static struct nf_hook_ops ipv6_conntrack_ops[] = {
+        {
+                .hook           = ipv6_defrag,
+                .owner          = THIS_MODULE,
+                .pf             = PF_INET6,
+                .hooknum        = NF_IP6_PRE_ROUTING,
+                .priority       = NF_IP6_PRI_CONNTRACK_DEFRAG,
+        },
+        {
+                .hook           = ipv6_conntrack_in,
+                .owner          = THIS_MODULE,
+                .pf             = PF_INET6,
+                .hooknum        = NF_IP6_PRE_ROUTING,
+                .priority       = NF_IP6_PRI_CONNTRACK,
+        },
+        {
+                .hook           = ipv6_conntrack_local,
+                .owner          = THIS_MODULE,
+                .pf             = PF_INET6,
+                .hooknum        = NF_IP6_LOCAL_OUT,
+                .priority       = NF_IP6_PRI_CONNTRACK,
+        },
+        {
+                .hook           = ipv6_defrag,
+                .owner          = THIS_MODULE,
+                .pf             = PF_INET6,
+                .hooknum        = NF_IP6_LOCAL_OUT,
+                .priority       = NF_IP6_PRI_CONNTRACK_DEFRAG,
+        },
+        {
+                .hook           = ipv6_confirm,
+                .owner          = THIS_MODULE,
+                .pf             = PF_INET6,
+                .hooknum        = NF_IP6_POST_ROUTING,
+                .priority       = NF_IP6_PRI_LAST,
+        },
+        {
+                .hook           = ipv6_confirm,
+                .owner          = THIS_MODULE,
+                .pf             = PF_INET6,
+                .hooknum        = NF_IP6_LOCAL_IN,
+                .priority       = NF_IP6_PRI_LAST-1,
+        },
 };
 
 #ifdef CONFIG_SYSCTL
@@ -470,16 +464,21 @@ extern struct nf_conntrack_protocol nf_conntrack_protocol_udp6;
 extern struct nf_conntrack_protocol nf_conntrack_protocol_icmpv6;
 extern int nf_ct_frag6_init(void);
 extern void nf_ct_frag6_cleanup(void);
-static int init_or_cleanup(int init)
+
+MODULE_ALIAS("nf_conntrack-" __stringify(AF_INET6));
+MODULE_LICENSE("GPL");
+MODULE_AUTHOR("Yasuyuki KOZAKAI @USAGI <yasuyuki.kozakai@toshiba.co.jp>");
+
+static int __init nf_conntrack_l3proto_ipv6_init(void)
 {
         int ret = 0;
 
-        if (!init) goto cleanup;
+        need_conntrack();
 
         ret = nf_ct_frag6_init();
         if (ret < 0) {
                 printk("nf_conntrack_ipv6: can't initialize frag6.\n");
-                goto cleanup_nothing;
+                return ret;
         }
         ret = nf_conntrack_protocol_register(&nf_conntrack_protocol_tcp6);
         if (ret < 0) {
@@ -505,71 +504,27 @@ static int init_or_cleanup(int init)
                 goto cleanup_icmpv6;
         }
 
-        ret = nf_register_hook(&ipv6_conntrack_defrag_ops);
+        ret = nf_register_hooks(ipv6_conntrack_ops,
+                                ARRAY_SIZE(ipv6_conntrack_ops));
         if (ret < 0) {
                 printk("nf_conntrack_ipv6: can't register pre-routing defrag "
                        "hook.\n");
                 goto cleanup_ipv6;
         }
-
-        ret = nf_register_hook(&ipv6_conntrack_defrag_local_out_ops);
-        if (ret < 0) {
-                printk("nf_conntrack_ipv6: can't register local_out defrag "
-                       "hook.\n");
-                goto cleanup_defragops;
-        }
-
-        ret = nf_register_hook(&ipv6_conntrack_in_ops);
-        if (ret < 0) {
-                printk("nf_conntrack_ipv6: can't register pre-routing hook.\n");
-                goto cleanup_defraglocalops;
-        }
-
-        ret = nf_register_hook(&ipv6_conntrack_local_out_ops);
-        if (ret < 0) {
-                printk("nf_conntrack_ipv6: can't register local out hook.\n");
-                goto cleanup_inops;
-        }
-
-        ret = nf_register_hook(&ipv6_conntrack_out_ops);
-        if (ret < 0) {
-                printk("nf_conntrack_ipv6: can't register post-routing hook.\n");
-                goto cleanup_inandlocalops;
-        }
-
-        ret = nf_register_hook(&ipv6_conntrack_local_in_ops);
-        if (ret < 0) {
-                printk("nf_conntrack_ipv6: can't register local in hook.\n");
-                goto cleanup_inoutandlocalops;
-        }
-
 #ifdef CONFIG_SYSCTL
         nf_ct_ipv6_sysctl_header = register_sysctl_table(nf_ct_net_table, 0);
         if (nf_ct_ipv6_sysctl_header == NULL) {
                 printk("nf_conntrack: can't register to sysctl.\n");
                 ret = -ENOMEM;
-                goto cleanup_localinops;
+                goto cleanup_hooks;
         }
 #endif
         return ret;
 
- cleanup:
-        synchronize_net();
 #ifdef CONFIG_SYSCTL
-        unregister_sysctl_table(nf_ct_ipv6_sysctl_header);
- cleanup_localinops:
+ cleanup_hooks:
+        nf_unregister_hooks(ipv6_conntrack_ops, ARRAY_SIZE(ipv6_conntrack_ops));
 #endif
-        nf_unregister_hook(&ipv6_conntrack_local_in_ops);
- cleanup_inoutandlocalops:
-        nf_unregister_hook(&ipv6_conntrack_out_ops);
- cleanup_inandlocalops:
-        nf_unregister_hook(&ipv6_conntrack_local_out_ops);
- cleanup_inops:
-        nf_unregister_hook(&ipv6_conntrack_in_ops);
- cleanup_defraglocalops:
-        nf_unregister_hook(&ipv6_conntrack_defrag_local_out_ops);
- cleanup_defragops:
-        nf_unregister_hook(&ipv6_conntrack_defrag_ops);
  cleanup_ipv6:
         nf_conntrack_l3proto_unregister(&nf_conntrack_l3proto_ipv6);
  cleanup_icmpv6:
@@ -580,23 +535,21 @@ static int init_or_cleanup(int init)
         nf_conntrack_protocol_unregister(&nf_conntrack_protocol_tcp6);
  cleanup_frag6:
         nf_ct_frag6_cleanup();
- cleanup_nothing:
         return ret;
 }
 
-MODULE_ALIAS("nf_conntrack-" __stringify(AF_INET6));
-MODULE_LICENSE("GPL");
-MODULE_AUTHOR("Yasuyuki KOZAKAI @USAGI <yasuyuki.kozakai@toshiba.co.jp>");
-
-static int __init nf_conntrack_l3proto_ipv6_init(void)
-{
-        need_conntrack();
-        return init_or_cleanup(1);
-}
-
 static void __exit nf_conntrack_l3proto_ipv6_fini(void)
 {
-        init_or_cleanup(0);
+        synchronize_net();
+#ifdef CONFIG_SYSCTL
+        unregister_sysctl_table(nf_ct_ipv6_sysctl_header);
+#endif
+        nf_unregister_hooks(ipv6_conntrack_ops, ARRAY_SIZE(ipv6_conntrack_ops));
+        nf_conntrack_l3proto_unregister(&nf_conntrack_l3proto_ipv6);
+        nf_conntrack_protocol_unregister(&nf_conntrack_protocol_icmpv6);
+        nf_conntrack_protocol_unregister(&nf_conntrack_protocol_udp6);
+        nf_conntrack_protocol_unregister(&nf_conntrack_protocol_tcp6);
+        nf_ct_frag6_cleanup();
 }
 
 module_init(nf_conntrack_l3proto_ipv6_init);
diff --git a/net/ipv6/netfilter/nf_conntrack_proto_icmpv6.c b/net/ipv6/netfilter/nf_conntrack_proto_icmpv6.c
index 09945c333055..86c6703265d0 100644
--- a/net/ipv6/netfilter/nf_conntrack_proto_icmpv6.c
+++ b/net/ipv6/netfilter/nf_conntrack_proto_icmpv6.c
@@ -233,21 +233,13 @@ icmpv6_error(struct sk_buff *skb, unsigned int dataoff,
                 return -NF_ACCEPT;
         }
 
-        if (hooknum != NF_IP6_PRE_ROUTING)
-                goto skipped;
-
-        /* Ignore it if the checksum's bogus. */
-        if (csum_ipv6_magic(&skb->nh.ipv6h->saddr, &skb->nh.ipv6h->daddr,
-                            skb->len - dataoff, IPPROTO_ICMPV6,
-                            skb_checksum(skb, dataoff,
-                                         skb->len - dataoff, 0))) {
+        if (hooknum == NF_IP6_PRE_ROUTING &&
+            nf_ip6_checksum(skb, hooknum, dataoff, IPPROTO_ICMPV6)) {
                 nf_log_packet(PF_INET6, 0, skb, NULL, NULL, NULL,
                               "nf_ct_icmpv6: ICMPv6 checksum failed\n");
                 return -NF_ACCEPT;
         }
 
-skipped:
-
         /* is not error message ? */
         if (icmp6h->icmp6_type >= 128)
                 return NF_ACCEPT;
diff --git a/net/ipv6/proc.c b/net/ipv6/proc.c
index 4238b1ed8860..779ddf77f4d4 100644
--- a/net/ipv6/proc.c
+++ b/net/ipv6/proc.c
@@ -38,7 +38,7 @@ static int fold_prot_inuse(struct proto *proto)
         int res = 0;
         int cpu;
 
-        for_each_cpu(cpu)
+        for_each_possible_cpu(cpu)
                 res += proto->stats[cpu].inuse;
 
         return res;
@@ -140,7 +140,7 @@ fold_field(void *mib[], int offt)
         unsigned long res = 0;
         int i;
  
-        for_each_cpu(i) {
+        for_each_possible_cpu(i) {
                 res += *(((unsigned long *)per_cpu_ptr(mib[0], i)) + offt);
                 res += *(((unsigned long *)per_cpu_ptr(mib[1], i)) + offt);
         }
diff --git a/net/ipv6/sit.c b/net/ipv6/sit.c
index c2d3e17beae6..6578c3080f47 100644
--- a/net/ipv6/sit.c
+++ b/net/ipv6/sit.c
@@ -397,7 +397,7 @@ static int ipip6_rcv(struct sk_buff *skb)
                 return 0;
         }
 
-        icmp_send(skb, ICMP_DEST_UNREACH, ICMP_PROT_UNREACH, 0);
+        icmp_send(skb, ICMP_DEST_UNREACH, ICMP_PORT_UNREACH, 0);
         kfree_skb(skb);
         read_unlock(&ipip6_lock);
 out:
diff --git a/net/ipv6/tunnel6.c b/net/ipv6/tunnel6.c
index 5659b52284bd..0ef9a35798d1 100644
--- a/net/ipv6/tunnel6.c
+++ b/net/ipv6/tunnel6.c
@@ -19,11 +19,13 @@
  *              YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org>
  */
 
+#include <linux/icmpv6.h>
 #include <linux/init.h>
 #include <linux/module.h>
 #include <linux/mutex.h>
 #include <linux/netdevice.h>
 #include <linux/skbuff.h>
+#include <net/ipv6.h>
 #include <net/protocol.h>
 #include <net/xfrm.h>
 
@@ -87,10 +89,16 @@ static int tunnel6_rcv(struct sk_buff **pskb)
         struct sk_buff *skb = *pskb;
         struct xfrm6_tunnel *handler;
 
+        if (!pskb_may_pull(skb, sizeof(struct ipv6hdr)))
+                goto drop;
+
         for (handler = tunnel6_handlers; handler; handler = handler->next)
                 if (!handler->handler(skb))
                         return 0;
 
+        icmpv6_send(skb, ICMPV6_DEST_UNREACH, ICMPV6_PORT_UNREACH, 0, skb->dev);
+
+drop:
         kfree_skb(skb);
         return 0;
 }
diff --git a/net/ipv6/xfrm6_input.c b/net/ipv6/xfrm6_input.c
index cccf8b76f046..00cfdee18dca 100644
--- a/net/ipv6/xfrm6_input.c
+++ b/net/ipv6/xfrm6_input.c
@@ -32,7 +32,7 @@ int xfrm6_rcv_spi(struct sk_buff *skb, u32 spi)
 {
         int err;
         u32 seq;
-        struct sec_decap_state xfrm_vec[XFRM_MAX_DEPTH];
+        struct xfrm_state *xfrm_vec[XFRM_MAX_DEPTH];
         struct xfrm_state *x;
         int xfrm_nr = 0;
         int decaps = 0;
@@ -65,7 +65,7 @@ int xfrm6_rcv_spi(struct sk_buff *skb, u32 spi)
                 if (xfrm_state_check_expire(x))
                         goto drop_unlock;
 
-                nexthdr = x->type->input(x, &(xfrm_vec[xfrm_nr].decap), skb);
+                nexthdr = x->type->input(x, skb);
                 if (nexthdr <= 0)
                         goto drop_unlock;
 
@@ -79,7 +79,7 @@ int xfrm6_rcv_spi(struct sk_buff *skb, u32 spi)
 
                 spin_unlock(&x->lock);
 
-                xfrm_vec[xfrm_nr++].xvec = x;
+                xfrm_vec[xfrm_nr++] = x;
 
                 if (x->props.mode) { /* XXX */
                         if (nexthdr != IPPROTO_IPV6)
@@ -118,7 +118,8 @@ int xfrm6_rcv_spi(struct sk_buff *skb, u32 spi)
         if (xfrm_nr + skb->sp->len > XFRM_MAX_DEPTH)
                 goto drop;
 
-        memcpy(skb->sp->x+skb->sp->len, xfrm_vec, xfrm_nr*sizeof(struct sec_decap_state));
+        memcpy(skb->sp->xvec + skb->sp->len, xfrm_vec,
+               xfrm_nr * sizeof(xfrm_vec[0]));
         skb->sp->len += xfrm_nr;
         skb->ip_summed = CHECKSUM_NONE;
 
@@ -149,7 +150,7 @@ drop_unlock:
         xfrm_state_put(x);
 drop:
         while (--xfrm_nr >= 0)
-                xfrm_state_put(xfrm_vec[xfrm_nr].xvec);
+                xfrm_state_put(xfrm_vec[xfrm_nr]);
         kfree_skb(skb);
         return -1;
 }
diff --git a/net/ipv6/xfrm6_tunnel.c b/net/ipv6/xfrm6_tunnel.c
index a8f6776c518d..d37768e5064f 100644
--- a/net/ipv6/xfrm6_tunnel.c
+++ b/net/ipv6/xfrm6_tunnel.c
@@ -351,7 +351,7 @@ static int xfrm6_tunnel_output(struct xfrm_state *x, struct sk_buff *skb)
         return 0;
 }
 
-static int xfrm6_tunnel_input(struct xfrm_state *x, struct xfrm_decap_state *decap, struct sk_buff *skb)
+static int xfrm6_tunnel_input(struct xfrm_state *x, struct sk_buff *skb)
 {
         return 0;
 }
diff --git a/net/netfilter/Kconfig b/net/netfilter/Kconfig
index 332acb37b385..e2893effdfaa 100644
--- a/net/netfilter/Kconfig
+++ b/net/netfilter/Kconfig
@@ -231,6 +231,15 @@ config NETFILTER_XT_MATCH_DCCP
           If you want to compile it as a module, say M here and read
           <file:Documentation/modules.txt>.  If unsure, say `N'.
 
+config NETFILTER_XT_MATCH_ESP
+        tristate '"ESP" match support'
+        depends on NETFILTER_XTABLES
+        help
+          This match extension allows you to match a range of SPIs
+          inside ESP header of IPSec packets.
+
+          To compile it as a module, choose M here.  If unsure, say N.
+
 config NETFILTER_XT_MATCH_HELPER
         tristate '"helper" match support'
         depends on NETFILTER_XTABLES
@@ -289,6 +298,16 @@ config NETFILTER_XT_MATCH_POLICY
 
           To compile it as a module, choose M here.  If unsure, say N.
 
+config NETFILTER_XT_MATCH_MULTIPORT
+        tristate "Multiple port match support"
+        depends on NETFILTER_XTABLES
+        help
+          Multiport matching allows you to match TCP or UDP packets based on
+          a series of source or destination ports: normally a rule can only
+          match a single range of ports.
+
+          To compile it as a module, choose M here.  If unsure, say N.
+
 config NETFILTER_XT_MATCH_PHYSDEV
         tristate '"physdev" match support'
         depends on NETFILTER_XTABLES && BRIDGE_NETFILTER
diff --git a/net/netfilter/Makefile b/net/netfilter/Makefile
index 9558727f5e79..95b7e416512d 100644
--- a/net/netfilter/Makefile
+++ b/net/netfilter/Makefile
@@ -35,11 +35,13 @@ obj-$(CONFIG_NETFILTER_XT_MATCH_CONNBYTES) += xt_connbytes.o
 obj-$(CONFIG_NETFILTER_XT_MATCH_CONNMARK) += xt_connmark.o
 obj-$(CONFIG_NETFILTER_XT_MATCH_CONNTRACK) += xt_conntrack.o
 obj-$(CONFIG_NETFILTER_XT_MATCH_DCCP) += xt_dccp.o
+obj-$(CONFIG_NETFILTER_XT_MATCH_ESP) += xt_esp.o
 obj-$(CONFIG_NETFILTER_XT_MATCH_HELPER) += xt_helper.o
 obj-$(CONFIG_NETFILTER_XT_MATCH_LENGTH) += xt_length.o
 obj-$(CONFIG_NETFILTER_XT_MATCH_LIMIT) += xt_limit.o
 obj-$(CONFIG_NETFILTER_XT_MATCH_MAC) += xt_mac.o
 obj-$(CONFIG_NETFILTER_XT_MATCH_MARK) += xt_mark.o
+obj-$(CONFIG_NETFILTER_XT_MATCH_MULTIPORT) += xt_multiport.o
 obj-$(CONFIG_NETFILTER_XT_MATCH_POLICY) += xt_policy.o
 obj-$(CONFIG_NETFILTER_XT_MATCH_PKTTYPE) += xt_pkttype.o
 obj-$(CONFIG_NETFILTER_XT_MATCH_REALM) += xt_realm.o
diff --git a/net/netfilter/core.c b/net/netfilter/core.c
index 1ceb1a6c254b..8455a32ea5c4 100644
--- a/net/netfilter/core.c
+++ b/net/netfilter/core.c
@@ -27,6 +27,29 @@
 
 #include "nf_internals.h"
 
+static DEFINE_SPINLOCK(afinfo_lock);
+
+struct nf_afinfo *nf_afinfo[NPROTO];
+EXPORT_SYMBOL(nf_afinfo);
+
+int nf_register_afinfo(struct nf_afinfo *afinfo)
+{
+        spin_lock(&afinfo_lock);
+        rcu_assign_pointer(nf_afinfo[afinfo->family], afinfo);
+        spin_unlock(&afinfo_lock);
+        return 0;
+}
+EXPORT_SYMBOL_GPL(nf_register_afinfo);
+
+void nf_unregister_afinfo(struct nf_afinfo *afinfo)
+{
+        spin_lock(&afinfo_lock);
+        rcu_assign_pointer(nf_afinfo[afinfo->family], NULL);
+        spin_unlock(&afinfo_lock);
+        synchronize_rcu();
+}
+EXPORT_SYMBOL_GPL(nf_unregister_afinfo);
+
 /* In this code, we can be waiting indefinitely for userspace to
  * service a packet if a hook returns NF_QUEUE.  We could keep a count
  * of skbuffs queued for userspace, and not deregister a hook unless
@@ -63,6 +86,34 @@ void nf_unregister_hook(struct nf_hook_ops *reg)
 }
 EXPORT_SYMBOL(nf_unregister_hook);
 
+int nf_register_hooks(struct nf_hook_ops *reg, unsigned int n)
+{
+        unsigned int i;
+        int err = 0;
+
+        for (i = 0; i < n; i++) {
+                err = nf_register_hook(&reg[i]);
+                if (err)
+                        goto err;
+        }
+        return err;
+
+err:
+        if (i > 0)
+                nf_unregister_hooks(reg, i);
+        return err;
+}
+EXPORT_SYMBOL(nf_register_hooks);
+
+void nf_unregister_hooks(struct nf_hook_ops *reg, unsigned int n)
+{
+        unsigned int i;
+
+        for (i = 0; i < n; i++)
+                nf_unregister_hook(&reg[i]);
+}
+EXPORT_SYMBOL(nf_unregister_hooks);
+
 unsigned int nf_iterate(struct list_head *head,
                         struct sk_buff **skb,
                         int hook,
diff --git a/net/netfilter/nf_conntrack_core.c b/net/netfilter/nf_conntrack_core.c
index 56389c83557c..e581190fb6c3 100644
--- a/net/netfilter/nf_conntrack_core.c
+++ b/net/netfilter/nf_conntrack_core.c
@@ -146,7 +146,7 @@ static void nf_ct_event_cache_flush(void)
         struct nf_conntrack_ecache *ecache;
         int cpu;
 
-        for_each_cpu(cpu) {
+        for_each_possible_cpu(cpu) {
                 ecache = &per_cpu(nf_conntrack_ecache, cpu);
                 if (ecache->ct)
                         nf_ct_put(ecache->ct);
diff --git a/net/netfilter/nf_conntrack_netlink.c b/net/netfilter/nf_conntrack_netlink.c
index 0e0e9d7b34c8..bd10eb944b65 100644
--- a/net/netfilter/nf_conntrack_netlink.c
+++ b/net/netfilter/nf_conntrack_netlink.c
@@ -1022,7 +1022,7 @@ ctnetlink_change_conntrack(struct nf_conn *ct, struct nfattr *cda[])
                         return err;
         }
 
-#if defined(CONFIG_IP_NF_CONNTRACK_MARK)
+#if defined(CONFIG_NF_CONNTRACK_MARK)
         if (cda[CTA_MARK-1])
                 ct->mark = ntohl(*(u_int32_t *)NFA_DATA(cda[CTA_MARK-1]));
 #endif
@@ -1062,7 +1062,7 @@ ctnetlink_create_conntrack(struct nfattr *cda[],
                         return err;
         }
 
-#if defined(CONFIG_IP_NF_CONNTRACK_MARK)
+#if defined(CONFIG_NF_CONNTRACK_MARK)
         if (cda[CTA_MARK-1])
                 ct->mark = ntohl(*(u_int32_t *)NFA_DATA(cda[CTA_MARK-1]));
 #endif
@@ -1687,7 +1687,7 @@ static void __exit ctnetlink_exit(void)
         printk("ctnetlink: unregistering from nfnetlink.\n");
 
 #ifdef CONFIG_NF_CONNTRACK_EVENTS
-        nf_conntrack_unregister_notifier(&ctnl_notifier_exp);
+        nf_conntrack_expect_unregister_notifier(&ctnl_notifier_exp);
         nf_conntrack_unregister_notifier(&ctnl_notifier);
 #endif
 
diff --git a/net/netfilter/nf_conntrack_proto_tcp.c b/net/netfilter/nf_conntrack_proto_tcp.c
index 6492ed66fb3c..69899f27d26a 100644
--- a/net/netfilter/nf_conntrack_proto_tcp.c
+++ b/net/netfilter/nf_conntrack_proto_tcp.c
@@ -799,8 +799,7 @@ static int tcp_error(struct sk_buff *skb,
                      unsigned int dataoff,
                      enum ip_conntrack_info *ctinfo,
                      int pf,
-                     unsigned int hooknum,
-                     int(*csum)(const struct sk_buff *,unsigned int))
+                     unsigned int hooknum)
 {
         struct tcphdr _tcph, *th;
         unsigned int tcplen = skb->len - dataoff;
@@ -830,9 +829,8 @@ static int tcp_error(struct sk_buff *skb,
          */
         /* FIXME: Source route IP option packets --RR */
         if (((pf == PF_INET && hooknum == NF_IP_PRE_ROUTING) ||
-             (pf == PF_INET6 && hooknum  == NF_IP6_PRE_ROUTING))
-            && skb->ip_summed != CHECKSUM_UNNECESSARY
-            && csum(skb, dataoff)) {
+             (pf == PF_INET6 && hooknum  == NF_IP6_PRE_ROUTING)) &&
+            nf_checksum(skb, hooknum, dataoff, IPPROTO_TCP, pf)) {
                 if (LOG_INVALID(IPPROTO_TCP))
                         nf_log_packet(pf, 0, skb, NULL, NULL, NULL,
                                   "nf_ct_tcp: bad TCP checksum ");
@@ -851,44 +849,6 @@ static int tcp_error(struct sk_buff *skb,
         return NF_ACCEPT;
 }
 
-static int csum4(const struct sk_buff *skb, unsigned int dataoff)
-{
-        return csum_tcpudp_magic(skb->nh.iph->saddr, skb->nh.iph->daddr,
-                                 skb->len - dataoff, IPPROTO_TCP,
-                                 skb->ip_summed == CHECKSUM_HW ? skb->csum
-                                 : skb_checksum(skb, dataoff,
-                                                skb->len - dataoff, 0));
-}
-
-static int csum6(const struct sk_buff *skb, unsigned int dataoff)
-{
-        return csum_ipv6_magic(&skb->nh.ipv6h->saddr, &skb->nh.ipv6h->daddr,
-                               skb->len - dataoff, IPPROTO_TCP,
-                               skb->ip_summed == CHECKSUM_HW
-                               ? csum_sub(skb->csum,
-                                          skb_checksum(skb, 0, dataoff, 0))
-                               : skb_checksum(skb, dataoff, skb->len - dataoff,
-                                              0));
-}
-
-static int tcp_error4(struct sk_buff *skb,
-                      unsigned int dataoff,
-                      enum ip_conntrack_info *ctinfo,
-                      int pf,
-                      unsigned int hooknum)
-{
-        return tcp_error(skb, dataoff, ctinfo, pf, hooknum, csum4);
-}
-
-static int tcp_error6(struct sk_buff *skb,
-                      unsigned int dataoff,
-                      enum ip_conntrack_info *ctinfo,
-                      int pf,
-                      unsigned int hooknum)
-{
-        return tcp_error(skb, dataoff, ctinfo, pf, hooknum, csum6);
-}
-
 /* Returns verdict for packet, or -1 for invalid. */
 static int tcp_packet(struct nf_conn *conntrack,
                       const struct sk_buff *skb,
@@ -1218,7 +1178,7 @@ struct nf_conntrack_protocol nf_conntrack_protocol_tcp4 =
         .print_conntrack        = tcp_print_conntrack,
         .packet                 = tcp_packet,
         .new                    = tcp_new,
-        .error                  = tcp_error4,
+        .error                  = tcp_error,
 #if defined(CONFIG_NF_CT_NETLINK) || \
     defined(CONFIG_NF_CT_NETLINK_MODULE)
         .to_nfattr              = tcp_to_nfattr,
@@ -1239,7 +1199,7 @@ struct nf_conntrack_protocol nf_conntrack_protocol_tcp6 =
         .print_conntrack        = tcp_print_conntrack,
         .packet                 = tcp_packet,
         .new                    = tcp_new,
-        .error                  = tcp_error6,
+        .error                  = tcp_error,
 #if defined(CONFIG_NF_CT_NETLINK) || \
     defined(CONFIG_NF_CT_NETLINK_MODULE)
         .to_nfattr              = tcp_to_nfattr,
diff --git a/net/netfilter/nf_conntrack_proto_udp.c b/net/netfilter/nf_conntrack_proto_udp.c
index 831d206344e0..d93edbfde9e3 100644
--- a/net/netfilter/nf_conntrack_proto_udp.c
+++ b/net/netfilter/nf_conntrack_proto_udp.c
@@ -103,8 +103,7 @@ static int udp_new(struct nf_conn *conntrack, const struct sk_buff *skb,
 static int udp_error(struct sk_buff *skb, unsigned int dataoff,
                      enum ip_conntrack_info *ctinfo,
                      int pf,
-                     unsigned int hooknum,
-                     int (*csum)(const struct sk_buff *, unsigned int))
+                     unsigned int hooknum)
 {
         unsigned int udplen = skb->len - dataoff;
         struct udphdr _hdr, *hdr;
@@ -136,9 +135,8 @@ static int udp_error(struct sk_buff *skb, unsigned int dataoff,
          * and moreover root might send raw packets.
          * FIXME: Source route IP option packets --RR */
         if (((pf == PF_INET && hooknum == NF_IP_PRE_ROUTING) ||
-             (pf == PF_INET6 && hooknum == NF_IP6_PRE_ROUTING))
-            && skb->ip_summed != CHECKSUM_UNNECESSARY
-            && csum(skb, dataoff)) {
+             (pf == PF_INET6 && hooknum == NF_IP6_PRE_ROUTING)) &&
+            nf_checksum(skb, hooknum, dataoff, IPPROTO_UDP, pf)) {
                 if (LOG_INVALID(IPPROTO_UDP))
                         nf_log_packet(pf, 0, skb, NULL, NULL, NULL,
                                 "nf_ct_udp: bad UDP checksum ");
@@ -148,44 +146,6 @@ static int udp_error(struct sk_buff *skb, unsigned int dataoff,
         return NF_ACCEPT;
 }
 
-static int csum4(const struct sk_buff *skb, unsigned int dataoff)
-{
-        return csum_tcpudp_magic(skb->nh.iph->saddr, skb->nh.iph->daddr,
-                                 skb->len - dataoff, IPPROTO_UDP,
-                                 skb->ip_summed == CHECKSUM_HW ? skb->csum
-                                 : skb_checksum(skb, dataoff,
-                                                skb->len - dataoff, 0));
-}
-
-static int csum6(const struct sk_buff *skb, unsigned int dataoff)
-{
-        return csum_ipv6_magic(&skb->nh.ipv6h->saddr, &skb->nh.ipv6h->daddr,
-                               skb->len - dataoff, IPPROTO_UDP,
-                               skb->ip_summed == CHECKSUM_HW
-                               ? csum_sub(skb->csum,
-                                          skb_checksum(skb, 0, dataoff, 0))
-                               : skb_checksum(skb, dataoff, skb->len - dataoff,
-                                              0));
-}
-
-static int udp_error4(struct sk_buff *skb,
-                      unsigned int dataoff,
-                      enum ip_conntrack_info *ctinfo,
-                      int pf,
-                      unsigned int hooknum)
-{
-        return udp_error(skb, dataoff, ctinfo, pf, hooknum, csum4);
-}
-
-static int udp_error6(struct sk_buff *skb,
-                      unsigned int dataoff,
-                      enum ip_conntrack_info *ctinfo,
-                      int pf,
-                      unsigned int hooknum)
-{
-        return udp_error(skb, dataoff, ctinfo, pf, hooknum, csum6);
-}
-
 struct nf_conntrack_protocol nf_conntrack_protocol_udp4 =
 {
         .l3proto                = PF_INET,
@@ -197,7 +157,7 @@ struct nf_conntrack_protocol nf_conntrack_protocol_udp4 =
         .print_conntrack        = udp_print_conntrack,
         .packet                 = udp_packet,
         .new                    = udp_new,
-        .error                  = udp_error4,
+        .error                  = udp_error,
 #if defined(CONFIG_NF_CT_NETLINK) || \
     defined(CONFIG_NF_CT_NETLINK_MODULE)
         .tuple_to_nfattr        = nf_ct_port_tuple_to_nfattr,
@@ -216,7 +176,7 @@ struct nf_conntrack_protocol nf_conntrack_protocol_udp6 =
         .print_conntrack        = udp_print_conntrack,
         .packet                 = udp_packet,
         .new                    = udp_new,
-        .error                  = udp_error6,
+        .error                  = udp_error,
 #if defined(CONFIG_NF_CT_NETLINK) || \
     defined(CONFIG_NF_CT_NETLINK_MODULE)
         .tuple_to_nfattr        = nf_ct_port_tuple_to_nfattr,
diff --git a/net/netfilter/nf_conntrack_standalone.c b/net/netfilter/nf_conntrack_standalone.c
index c72aa3cd22e4..408960c6a544 100644
--- a/net/netfilter/nf_conntrack_standalone.c
+++ b/net/netfilter/nf_conntrack_standalone.c
@@ -649,63 +649,6 @@ static ctl_table nf_ct_net_table[] = {
 EXPORT_SYMBOL(nf_ct_log_invalid);
 #endif /* CONFIG_SYSCTL */
 
-static int init_or_cleanup(int init)
-{
-#ifdef CONFIG_PROC_FS
-        struct proc_dir_entry *proc, *proc_exp, *proc_stat;
-#endif
-        int ret = 0;
-
-        if (!init) goto cleanup;
-
-        ret = nf_conntrack_init();
-        if (ret < 0)
-                goto cleanup_nothing;
-
-#ifdef CONFIG_PROC_FS
-        proc = proc_net_fops_create("nf_conntrack", 0440, &ct_file_ops);
-        if (!proc) goto cleanup_init;
-
-        proc_exp = proc_net_fops_create("nf_conntrack_expect", 0440,
-                                        &exp_file_ops);
-        if (!proc_exp) goto cleanup_proc;
-
-        proc_stat = create_proc_entry("nf_conntrack", S_IRUGO, proc_net_stat);
-        if (!proc_stat)
-                goto cleanup_proc_exp;
-
-        proc_stat->proc_fops = &ct_cpu_seq_fops;
-        proc_stat->owner = THIS_MODULE;
-#endif
-#ifdef CONFIG_SYSCTL
-        nf_ct_sysctl_header = register_sysctl_table(nf_ct_net_table, 0);
-        if (nf_ct_sysctl_header == NULL) {
-                printk("nf_conntrack: can't register to sysctl.\n");
-                ret = -ENOMEM;
-                goto cleanup_proc_stat;
-        }
-#endif
-
-        return ret;
-
- cleanup:
-#ifdef CONFIG_SYSCTL
-        unregister_sysctl_table(nf_ct_sysctl_header);
- cleanup_proc_stat:
-#endif
-#ifdef CONFIG_PROC_FS
-        remove_proc_entry("nf_conntrack", proc_net_stat);
- cleanup_proc_exp:
-        proc_net_remove("nf_conntrack_expect");
- cleanup_proc:
-        proc_net_remove("nf_conntrack");
- cleanup_init:
-#endif /* CNFIG_PROC_FS */
-        nf_conntrack_cleanup();
- cleanup_nothing:
-        return ret;
-}
-
 int nf_conntrack_l3proto_register(struct nf_conntrack_l3proto *proto)
 {
         int ret = 0;
@@ -808,12 +751,66 @@ void nf_conntrack_protocol_unregister(struct nf_conntrack_protocol *proto)
 
 static int __init nf_conntrack_standalone_init(void)
 {
-        return init_or_cleanup(1);
+#ifdef CONFIG_PROC_FS
+        struct proc_dir_entry *proc, *proc_exp, *proc_stat;
+#endif
+        int ret = 0;
+
+        ret = nf_conntrack_init();
+        if (ret < 0)
+                return ret;
+
+#ifdef CONFIG_PROC_FS
+        proc = proc_net_fops_create("nf_conntrack", 0440, &ct_file_ops);
+        if (!proc) goto cleanup_init;
+
+        proc_exp = proc_net_fops_create("nf_conntrack_expect", 0440,
+                                        &exp_file_ops);
+        if (!proc_exp) goto cleanup_proc;
+
+        proc_stat = create_proc_entry("nf_conntrack", S_IRUGO, proc_net_stat);
+        if (!proc_stat)
+                goto cleanup_proc_exp;
+
+        proc_stat->proc_fops = &ct_cpu_seq_fops;
+        proc_stat->owner = THIS_MODULE;
+#endif
+#ifdef CONFIG_SYSCTL
+        nf_ct_sysctl_header = register_sysctl_table(nf_ct_net_table, 0);
+        if (nf_ct_sysctl_header == NULL) {
+                printk("nf_conntrack: can't register to sysctl.\n");
+                ret = -ENOMEM;
+                goto cleanup_proc_stat;
+        }
+#endif
+        return ret;
+
+#ifdef CONFIG_SYSCTL
+ cleanup_proc_stat:
+#endif
+#ifdef CONFIG_PROC_FS
+        remove_proc_entry("nf_conntrack", proc_net_stat);
+ cleanup_proc_exp:
+        proc_net_remove("nf_conntrack_expect");
+ cleanup_proc:
+        proc_net_remove("nf_conntrack");
+ cleanup_init:
+#endif /* CNFIG_PROC_FS */
+        nf_conntrack_cleanup();
+        return ret;
 }
 
 static void __exit nf_conntrack_standalone_fini(void)
 {
-        init_or_cleanup(0);
+#ifdef CONFIG_SYSCTL
+        unregister_sysctl_table(nf_ct_sysctl_header);
+#endif
+#ifdef CONFIG_PROC_FS
+        remove_proc_entry("nf_conntrack", proc_net_stat);
+        proc_net_remove("nf_conntrack_expect");
+        proc_net_remove("nf_conntrack");
+#endif /* CNFIG_PROC_FS */
+        nf_conntrack_cleanup();
 }
 
 module_init(nf_conntrack_standalone_init);
diff --git a/net/netfilter/nf_queue.c b/net/netfilter/nf_queue.c
index d9f0d7ef103b..ee8f70889f47 100644
--- a/net/netfilter/nf_queue.c
+++ b/net/netfilter/nf_queue.c
@@ -17,7 +17,6 @@
  * for queueing and must reinject all packets it receives, no matter what.
  */
 static struct nf_queue_handler *queue_handler[NPROTO];
-static struct nf_queue_rerouter *queue_rerouter[NPROTO];
 
 static DEFINE_RWLOCK(queue_handler_lock);
 
@@ -59,32 +58,6 @@ int nf_unregister_queue_handler(int pf)
 }
 EXPORT_SYMBOL(nf_unregister_queue_handler);
 
-int nf_register_queue_rerouter(int pf, struct nf_queue_rerouter *rer)
-{
-        if (pf >= NPROTO)
-                return -EINVAL;
-
-        write_lock_bh(&queue_handler_lock);
-        rcu_assign_pointer(queue_rerouter[pf], rer);
-        write_unlock_bh(&queue_handler_lock);
-
-        return 0;
-}
-EXPORT_SYMBOL_GPL(nf_register_queue_rerouter);
-
-int nf_unregister_queue_rerouter(int pf)
-{
-        if (pf >= NPROTO)
-                return -EINVAL;
-
-        write_lock_bh(&queue_handler_lock);
-        rcu_assign_pointer(queue_rerouter[pf], NULL);
-        write_unlock_bh(&queue_handler_lock);
-        synchronize_rcu();
-        return 0;
-}
-EXPORT_SYMBOL_GPL(nf_unregister_queue_rerouter);
-
 void nf_unregister_queue_handlers(struct nf_queue_handler *qh)
 {
         int pf;
@@ -116,7 +89,7 @@ int nf_queue(struct sk_buff **skb,
         struct net_device *physindev = NULL;
         struct net_device *physoutdev = NULL;
 #endif
-        struct nf_queue_rerouter *rerouter;
+        struct nf_afinfo *afinfo;
 
         /* QUEUE == DROP if noone is waiting, to be safe. */
         read_lock(&queue_handler_lock);
@@ -126,7 +99,14 @@ int nf_queue(struct sk_buff **skb,
                 return 1;
         }
 
-        info = kmalloc(sizeof(*info)+queue_rerouter[pf]->rer_size, GFP_ATOMIC);
+        afinfo = nf_get_afinfo(pf);
+        if (!afinfo) {
+                read_unlock(&queue_handler_lock);
+                kfree_skb(*skb);
+                return 1;
+        }
+
+        info = kmalloc(sizeof(*info) + afinfo->route_key_size, GFP_ATOMIC);
         if (!info) {
                 if (net_ratelimit())
                         printk(KERN_ERR "OOM queueing packet %p\n",
@@ -158,10 +138,7 @@ int nf_queue(struct sk_buff **skb,
                 if (physoutdev) dev_hold(physoutdev);
         }
 #endif
-        rerouter = rcu_dereference(queue_rerouter[pf]);
-        if (rerouter)
-                rerouter->save(*skb, info);
-
+        afinfo->saveroute(*skb, info);
         status = queue_handler[pf]->outfn(*skb, info, queuenum,
                                           queue_handler[pf]->data);
 
@@ -190,7 +167,7 @@ void nf_reinject(struct sk_buff *skb, struct nf_info *info,
 {
         struct list_head *elem = &info->elem->list;
         struct list_head *i;
-        struct nf_queue_rerouter *rerouter;
+        struct nf_afinfo *afinfo;
 
         rcu_read_lock();
 
@@ -228,8 +205,8 @@ void nf_reinject(struct sk_buff *skb, struct nf_info *info,
         }
 
         if (verdict == NF_ACCEPT) {
-                rerouter = rcu_dereference(queue_rerouter[info->pf]);
-                if (rerouter && rerouter->reroute(&skb, info) < 0)
+                afinfo = nf_get_afinfo(info->pf);
+                if (!afinfo || afinfo->reroute(&skb, info) < 0)
                         verdict = NF_DROP;
         }
 
diff --git a/net/netfilter/nfnetlink_log.c b/net/netfilter/nfnetlink_log.c
index 3e3f5448bacb..c60273cad778 100644
--- a/net/netfilter/nfnetlink_log.c
+++ b/net/netfilter/nfnetlink_log.c
@@ -1033,17 +1033,13 @@ static struct file_operations nful_file_ops = {
 
 #endif /* PROC_FS */
 
-static int
-init_or_cleanup(int init)
+static int __init nfnetlink_log_init(void)
 {
         int i, status = -ENOMEM;
 #ifdef CONFIG_PROC_FS
         struct proc_dir_entry *proc_nful;
 #endif
         
-        if (!init)
-                goto cleanup;
-
         for (i = 0; i < INSTANCE_BUCKETS; i++)
                 INIT_HLIST_HEAD(&instance_table[i]);
         
@@ -1066,30 +1062,25 @@ init_or_cleanup(int init)
                 goto cleanup_subsys;
         proc_nful->proc_fops = &nful_file_ops;
 #endif
-
         return status;
 
-cleanup:
-        nf_log_unregister_logger(&nfulnl_logger);
 #ifdef CONFIG_PROC_FS
-        remove_proc_entry("nfnetlink_log", proc_net_netfilter);
 cleanup_subsys:
-#endif
         nfnetlink_subsys_unregister(&nfulnl_subsys);
+#endif
 cleanup_netlink_notifier:
         netlink_unregister_notifier(&nfulnl_rtnl_notifier);
         return status;
 }
 
-static int __init nfnetlink_log_init(void)
-{
-        
-        return init_or_cleanup(1);
-}
-
 static void __exit nfnetlink_log_fini(void)
 {
-        init_or_cleanup(0);
+        nf_log_unregister_logger(&nfulnl_logger);
+#ifdef CONFIG_PROC_FS
+        remove_proc_entry("nfnetlink_log", proc_net_netfilter);
+#endif
+        nfnetlink_subsys_unregister(&nfulnl_subsys);
+        netlink_unregister_notifier(&nfulnl_rtnl_notifier);
 }
 
 MODULE_DESCRIPTION("netfilter userspace logging");
diff --git a/net/netfilter/nfnetlink_queue.c b/net/netfilter/nfnetlink_queue.c
index d0e62f68139f..86a4ac33de34 100644
--- a/net/netfilter/nfnetlink_queue.c
+++ b/net/netfilter/nfnetlink_queue.c
@@ -1071,17 +1071,13 @@ static struct file_operations nfqnl_file_ops = {
 
 #endif /* PROC_FS */
 
-static int
-init_or_cleanup(int init)
+static int __init nfnetlink_queue_init(void)
 {
         int i, status = -ENOMEM;
 #ifdef CONFIG_PROC_FS
         struct proc_dir_entry *proc_nfqueue;
 #endif
         
-        if (!init)
-                goto cleanup;
-
         for (i = 0; i < INSTANCE_BUCKETS; i++)
                 INIT_HLIST_HEAD(&instance_table[i]);
 
@@ -1101,31 +1097,26 @@ init_or_cleanup(int init)
 #endif
 
         register_netdevice_notifier(&nfqnl_dev_notifier);
-
         return status;
 
-cleanup:
-        nf_unregister_queue_handlers(&nfqh);
-        unregister_netdevice_notifier(&nfqnl_dev_notifier);
 #ifdef CONFIG_PROC_FS
-        remove_proc_entry("nfnetlink_queue", proc_net_netfilter);
 cleanup_subsys:
-#endif  
         nfnetlink_subsys_unregister(&nfqnl_subsys);
+#endif
 cleanup_netlink_notifier:
         netlink_unregister_notifier(&nfqnl_rtnl_notifier);
         return status;
 }
 
-static int __init nfnetlink_queue_init(void)
-{
-        
-        return init_or_cleanup(1);
-}
-
 static void __exit nfnetlink_queue_fini(void)
 {
-        init_or_cleanup(0);
+        nf_unregister_queue_handlers(&nfqh);
+        unregister_netdevice_notifier(&nfqnl_dev_notifier);
+#ifdef CONFIG_PROC_FS
+        remove_proc_entry("nfnetlink_queue", proc_net_netfilter);
+#endif
+        nfnetlink_subsys_unregister(&nfqnl_subsys);
+        netlink_unregister_notifier(&nfqnl_rtnl_notifier);
 }
 
 MODULE_DESCRIPTION("netfilter packet queue handler");
diff --git a/net/netfilter/x_tables.c b/net/netfilter/x_tables.c
index a657ab5394c3..00cf0a4f4d92 100644
--- a/net/netfilter/x_tables.c
+++ b/net/netfilter/x_tables.c
@@ -38,6 +38,7 @@ struct xt_af {
         struct list_head match;
         struct list_head target;
         struct list_head tables;
+        struct mutex compat_mutex;
 };
 
 static struct xt_af *xt;
@@ -272,6 +273,54 @@ int xt_check_match(const struct xt_match *match, unsigned short family,
 }
 EXPORT_SYMBOL_GPL(xt_check_match);
 
+#ifdef CONFIG_COMPAT
+int xt_compat_match(void *match, void **dstptr, int *size, int convert)
+{
+        struct xt_match *m;
+        struct compat_xt_entry_match *pcompat_m;
+        struct xt_entry_match *pm;
+        u_int16_t msize;
+        int off, ret;
+
+        ret = 0;
+        m = ((struct xt_entry_match *)match)->u.kernel.match;
+        off = XT_ALIGN(m->matchsize) - COMPAT_XT_ALIGN(m->matchsize);
+        switch (convert) {
+                case COMPAT_TO_USER:
+                        pm = (struct xt_entry_match *)match;
+                        msize = pm->u.user.match_size;
+                        if (__copy_to_user(*dstptr, pm, msize)) {
+                                ret = -EFAULT;
+                                break;
+                        }
+                        msize -= off;
+                        if (put_user(msize, (u_int16_t *)*dstptr))
+                                ret = -EFAULT;
+                        *size -= off;
+                        *dstptr += msize;
+                        break;
+                case COMPAT_FROM_USER:
+                        pcompat_m = (struct compat_xt_entry_match *)match;
+                        pm = (struct xt_entry_match *)*dstptr;
+                        msize = pcompat_m->u.user.match_size;
+                        memcpy(pm, pcompat_m, msize);
+                        msize += off;
+                        pm->u.user.match_size = msize;
+                        *size += off;
+                        *dstptr += msize;
+                        break;
+                case COMPAT_CALC_SIZE:
+                        *size += off;
+                        break;
+                default:
+                        ret = -ENOPROTOOPT;
+                        break;
+        }
+        return ret;
+}
+EXPORT_SYMBOL_GPL(xt_compat_match);
+#endif
+
 int xt_check_target(const struct xt_target *target, unsigned short family,
                     unsigned int size, const char *table, unsigned int hook_mask,
                     unsigned short proto, int inv_proto)
@@ -301,6 +350,54 @@ int xt_check_target(const struct xt_target *target, unsigned short family,
 }
 EXPORT_SYMBOL_GPL(xt_check_target);
 
+#ifdef CONFIG_COMPAT
+int xt_compat_target(void *target, void **dstptr, int *size, int convert)
+{
+        struct xt_target *t;
+        struct compat_xt_entry_target *pcompat;
+        struct xt_entry_target *pt;
+        u_int16_t tsize;
+        int off, ret;
+
+        ret = 0;
+        t = ((struct xt_entry_target *)target)->u.kernel.target;
+        off = XT_ALIGN(t->targetsize) - COMPAT_XT_ALIGN(t->targetsize);
+        switch (convert) {
+                case COMPAT_TO_USER:
+                        pt = (struct xt_entry_target *)target;
+                        tsize = pt->u.user.target_size;
+                        if (__copy_to_user(*dstptr, pt, tsize)) {
+                                ret = -EFAULT;
+                                break;
+                        }
+                        tsize -= off;
+                        if (put_user(tsize, (u_int16_t *)*dstptr))
+                                ret = -EFAULT;
+                        *size -= off;
+                        *dstptr += tsize;
+                        break;
+                case COMPAT_FROM_USER:
+                        pcompat = (struct compat_xt_entry_target *)target;
+                        pt = (struct xt_entry_target *)*dstptr;
+                        tsize = pcompat->u.user.target_size;
+                        memcpy(pt, pcompat, tsize);
+                        tsize += off;
+                        pt->u.user.target_size = tsize;
+                        *size += off;
+                        *dstptr += tsize;
+                        break;
+                case COMPAT_CALC_SIZE:
+                        *size += off;
+                        break;
+                default:
+                        ret = -ENOPROTOOPT;
+                        break;
+        }
+        return ret;
+}
+EXPORT_SYMBOL_GPL(xt_compat_target);
+#endif
+
 struct xt_table_info *xt_alloc_table_info(unsigned int size)
 {
         struct xt_table_info *newinfo;
@@ -316,7 +413,7 @@ struct xt_table_info *xt_alloc_table_info(unsigned int size)
 
         newinfo->size = size;
 
-        for_each_cpu(cpu) {
+        for_each_possible_cpu(cpu) {
                 if (size <= PAGE_SIZE)
                         newinfo->entries[cpu] = kmalloc_node(size,
                                                         GFP_KERNEL,
@@ -339,7 +436,7 @@ void xt_free_table_info(struct xt_table_info *info)
 {
         int cpu;
 
-        for_each_cpu(cpu) {
+        for_each_possible_cpu(cpu) {
                 if (info->size <= PAGE_SIZE)
                         kfree(info->entries[cpu]);
                 else
@@ -371,6 +468,19 @@ void xt_table_unlock(struct xt_table *table)
 }
 EXPORT_SYMBOL_GPL(xt_table_unlock);
 
+#ifdef CONFIG_COMPAT
+void xt_compat_lock(int af)
+{
+        mutex_lock(&xt[af].compat_mutex);
+}
+EXPORT_SYMBOL_GPL(xt_compat_lock);
+
+void xt_compat_unlock(int af)
+{
+        mutex_unlock(&xt[af].compat_mutex);
+}
+EXPORT_SYMBOL_GPL(xt_compat_unlock);
+#endif
 
 struct xt_table_info *
 xt_replace_table(struct xt_table *table,
@@ -671,6 +781,9 @@ static int __init xt_init(void)
 
         for (i = 0; i < NPROTO; i++) {
                 mutex_init(&xt[i].mutex);
+#ifdef CONFIG_COMPAT
+                mutex_init(&xt[i].compat_mutex);
+#endif
                 INIT_LIST_HEAD(&xt[i].target);
                 INIT_LIST_HEAD(&xt[i].match);
                 INIT_LIST_HEAD(&xt[i].tables);
diff --git a/net/ipv4/netfilter/ipt_esp.c b/net/netfilter/xt_esp.c
index 3840b417a3c5..9dad6281e0c1 100644
--- a/net/ipv4/netfilter/ipt_esp.c
+++ b/net/netfilter/xt_esp.c
@@ -9,16 +9,22 @@
 
 #include <linux/module.h>
 #include <linux/skbuff.h>
+#include <linux/in.h>
 #include <linux/ip.h>
 
-#include <linux/netfilter_ipv4/ipt_esp.h>
+#include <linux/netfilter/xt_esp.h>
+#include <linux/netfilter/x_tables.h>
+
 #include <linux/netfilter_ipv4/ip_tables.h>
+#include <linux/netfilter_ipv6/ip6_tables.h>
 
 MODULE_LICENSE("GPL");
 MODULE_AUTHOR("Yon Uriarte <yon@astaro.de>");
-MODULE_DESCRIPTION("iptables ESP SPI match module");
+MODULE_DESCRIPTION("x_tables ESP SPI match module");
+MODULE_ALIAS("ipt_esp");
+MODULE_ALIAS("ip6t_esp");
 
-#ifdef DEBUG_CONNTRACK
+#if 0
 #define duprintf(format, args...) printk(format , ## args)
 #else
 #define duprintf(format, args...)
@@ -28,11 +34,11 @@ MODULE_DESCRIPTION("iptables ESP SPI match module");
 static inline int
 spi_match(u_int32_t min, u_int32_t max, u_int32_t spi, int invert)
 {
-        int r=0;
-        duprintf("esp spi_match:%c 0x%x <= 0x%x <= 0x%x",invert? '!':' ',
-                min,spi,max);
-        r=(spi >= min && spi <= max) ^ invert;
-        duprintf(" result %s\n",r? "PASS" : "FAILED");
+        int r = 0;
+        duprintf("esp spi_match:%c 0x%x <= 0x%x <= 0x%x", invert ? '!' : ' ',
+                 min, spi, max);
+        r = (spi >= min && spi <= max) ^ invert;
+        duprintf(" result %s\n", r ? "PASS" : "FAILED");
         return r;
 }
 
@@ -47,14 +53,13 @@ match(const struct sk_buff *skb,
       int *hotdrop)
 {
         struct ip_esp_hdr _esp, *eh;
-        const struct ipt_esp *espinfo = matchinfo;
+        const struct xt_esp *espinfo = matchinfo;
 
         /* Must not be a fragment. */
         if (offset)
                 return 0;
 
-        eh = skb_header_pointer(skb, protoff,
-                                sizeof(_esp), &_esp);
+        eh = skb_header_pointer(skb, protoff, sizeof(_esp), &_esp);
         if (eh == NULL) {
                 /* We've been asked to examine this packet, and we
                  * can't.  Hence, no choice but to drop.
@@ -64,9 +69,8 @@ match(const struct sk_buff *skb,
                 return 0;
         }
 
-        return spi_match(espinfo->spis[0], espinfo->spis[1],
-                         ntohl(eh->spi),
-                         !!(espinfo->invflags & IPT_ESP_INV_SPI));
+        return spi_match(espinfo->spis[0], espinfo->spis[1], ntohl(eh->spi),
+                         !!(espinfo->invflags & XT_ESP_INV_SPI));
 }
 
 /* Called when user tries to insert an entry of this type. */
@@ -78,34 +82,55 @@ checkentry(const char *tablename,
            unsigned int matchinfosize,
            unsigned int hook_mask)
 {
-        const struct ipt_esp *espinfo = matchinfo;
+        const struct xt_esp *espinfo = matchinfo;
 
-        /* Must specify no unknown invflags */
-        if (espinfo->invflags & ~IPT_ESP_INV_MASK) {
-                duprintf("ipt_esp: unknown flags %X\n", espinfo->invflags);
+        if (espinfo->invflags & ~XT_ESP_INV_MASK) {
+                duprintf("xt_esp: unknown flags %X\n", espinfo->invflags);
                 return 0;
         }
+
         return 1;
 }
 
-static struct ipt_match esp_match = {
+static struct xt_match esp_match = {
         .name           = "esp",
-        .match          = match,
-        .matchsize      = sizeof(struct ipt_esp),
+        .family         = AF_INET,
         .proto          = IPPROTO_ESP,
-        .checkentry     = checkentry,
+        .match          = &match,
+        .matchsize      = sizeof(struct xt_esp),
+        .checkentry     = &checkentry,
         .me             = THIS_MODULE,
 };
 
-static int __init ipt_esp_init(void)
+static struct xt_match esp6_match = {
+        .name           = "esp",
+        .family         = AF_INET6,
+        .proto          = IPPROTO_ESP,
+        .match          = &match,
+        .matchsize      = sizeof(struct xt_esp),
+        .checkentry     = &checkentry,
+        .me             = THIS_MODULE,
+};
+
+static int __init xt_esp_init(void)
 {
-        return ipt_register_match(&esp_match);
+        int ret;
+        ret = xt_register_match(&esp_match);
+        if (ret)
+                return ret;
+
+        ret = xt_register_match(&esp6_match);
+        if (ret)
+                xt_unregister_match(&esp_match);
+
+        return ret;
 }
 
-static void __exit ipt_esp_fini(void)
+static void __exit xt_esp_cleanup(void)
 {
-        ipt_unregister_match(&esp_match);
+        xt_unregister_match(&esp_match);
+        xt_unregister_match(&esp6_match);
 }
 
-module_init(ipt_esp_init);
-module_exit(ipt_esp_fini);
+module_init(xt_esp_init);
+module_exit(xt_esp_cleanup);
diff --git a/net/netfilter/xt_multiport.c b/net/netfilter/xt_multiport.c
new file mode 100644
index 000000000000..b56cd2baaac2
--- /dev/null
+++ b/net/netfilter/xt_multiport.c
@@ -0,0 +1,314 @@
+/* Kernel module to match one of a list of TCP/UDP ports: ports are in
+   the same place so we can treat them as equal. */
+
+/* (C) 1999-2001 Paul `Rusty' Russell
+ * (C) 2002-2004 Netfilter Core Team <coreteam@netfilter.org>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+
+#include <linux/module.h>
+#include <linux/types.h>
+#include <linux/udp.h>
+#include <linux/skbuff.h>
+#include <linux/in.h>
+
+#include <linux/netfilter/xt_multiport.h>
+#include <linux/netfilter/x_tables.h>
+#include <linux/netfilter_ipv4/ip_tables.h>
+#include <linux/netfilter_ipv6/ip6_tables.h>
+
+MODULE_LICENSE("GPL");
+MODULE_AUTHOR("Netfilter Core Team <coreteam@netfilter.org>");
+MODULE_DESCRIPTION("x_tables multiple port match module");
+MODULE_ALIAS("ipt_multiport");
+MODULE_ALIAS("ip6t_multiport");
+
+#if 0
+#define duprintf(format, args...) printk(format , ## args)
+#else
+#define duprintf(format, args...)
+#endif
+
+/* Returns 1 if the port is matched by the test, 0 otherwise. */
+static inline int
+ports_match(const u_int16_t *portlist, enum xt_multiport_flags flags,
+            u_int8_t count, u_int16_t src, u_int16_t dst)
+{
+        unsigned int i;
+        for (i = 0; i < count; i++) {
+                if (flags != XT_MULTIPORT_DESTINATION && portlist[i] == src)
+                        return 1;
+
+                if (flags != XT_MULTIPORT_SOURCE && portlist[i] == dst)
+                        return 1;
+        }
+
+        return 0;
+}
+
+/* Returns 1 if the port is matched by the test, 0 otherwise. */
+static inline int
+ports_match_v1(const struct xt_multiport_v1 *minfo,
+               u_int16_t src, u_int16_t dst)
+{
+        unsigned int i;
+        u_int16_t s, e;
+
+        for (i = 0; i < minfo->count; i++) {
+                s = minfo->ports[i];
+
+                if (minfo->pflags[i]) {
+                        /* range port matching */
+                        e = minfo->ports[++i];
+                        duprintf("src or dst matches with %d-%d?\n", s, e);
+
+                        if (minfo->flags == XT_MULTIPORT_SOURCE
+                            && src >= s && src <= e)
+                                return 1 ^ minfo->invert;
+                        if (minfo->flags == XT_MULTIPORT_DESTINATION
+                            && dst >= s && dst <= e)
+                                return 1 ^ minfo->invert;
+                        if (minfo->flags == XT_MULTIPORT_EITHER
+                            && ((dst >= s && dst <= e)
+                                || (src >= s && src <= e)))
+                                return 1 ^ minfo->invert;
+                } else {
+                        /* exact port matching */
+                        duprintf("src or dst matches with %d?\n", s);
+
+                        if (minfo->flags == XT_MULTIPORT_SOURCE
+                            && src == s)
+                                return 1 ^ minfo->invert;
+                        if (minfo->flags == XT_MULTIPORT_DESTINATION
+                            && dst == s)
+                                return 1 ^ minfo->invert;
+                        if (minfo->flags == XT_MULTIPORT_EITHER
+                            && (src == s || dst == s))
+                                return 1 ^ minfo->invert;
+                }
+        }
+
+        return minfo->invert;
+}
+
+static int
+match(const struct sk_buff *skb,
+      const struct net_device *in,
+      const struct net_device *out,
+      const struct xt_match *match,
+      const void *matchinfo,
+      int offset,
+      unsigned int protoff,
+      int *hotdrop)
+{
+        u16 _ports[2], *pptr;
+        const struct xt_multiport *multiinfo = matchinfo;
+
+        if (offset)
+                return 0;
+
+        pptr = skb_header_pointer(skb, protoff, sizeof(_ports), _ports);
+        if (pptr == NULL) {
+                /* We've been asked to examine this packet, and we
+                 * can't.  Hence, no choice but to drop.
+                 */
+                duprintf("xt_multiport: Dropping evil offset=0 tinygram.\n");
+                *hotdrop = 1;
+                return 0;
+        }
+
+        return ports_match(multiinfo->ports,
+                           multiinfo->flags, multiinfo->count,
+                           ntohs(pptr[0]), ntohs(pptr[1]));
+}
+
+static int
+match_v1(const struct sk_buff *skb,
+         const struct net_device *in,
+         const struct net_device *out,
+         const struct xt_match *match,
+         const void *matchinfo,
+         int offset,
+         unsigned int protoff,
+         int *hotdrop)
+{
+        u16 _ports[2], *pptr;
+        const struct xt_multiport_v1 *multiinfo = matchinfo;
+
+        if (offset)
+                return 0;
+
+        pptr = skb_header_pointer(skb, protoff, sizeof(_ports), _ports);
+        if (pptr == NULL) {
+                /* We've been asked to examine this packet, and we
+                 * can't.  Hence, no choice but to drop.
+                 */
+                duprintf("xt_multiport: Dropping evil offset=0 tinygram.\n");
+                *hotdrop = 1;
+                return 0;
+        }
+
+        return ports_match_v1(multiinfo, ntohs(pptr[0]), ntohs(pptr[1]));
+}
+
+static inline int
+check(u_int16_t proto,
+      u_int8_t ip_invflags,
+      u_int8_t match_flags,
+      u_int8_t count)
+{
+        /* Must specify proto == TCP/UDP, no unknown flags or bad count */
+        return (proto == IPPROTO_TCP || proto == IPPROTO_UDP)
+                && !(ip_invflags & XT_INV_PROTO)
+                && (match_flags == XT_MULTIPORT_SOURCE
+                    || match_flags == XT_MULTIPORT_DESTINATION
+                    || match_flags == XT_MULTIPORT_EITHER)
+                && count <= XT_MULTI_PORTS;
+}
+
+/* Called when user tries to insert an entry of this type. */
+static int
+checkentry(const char *tablename,
+           const void *info,
+           const struct xt_match *match,
+           void *matchinfo,
+           unsigned int matchsize,
+           unsigned int hook_mask)
+{
+        const struct ipt_ip *ip = info;
+        const struct xt_multiport *multiinfo = matchinfo;
+
+        return check(ip->proto, ip->invflags, multiinfo->flags,
+                     multiinfo->count);
+}
+
+static int
+checkentry_v1(const char *tablename,
+              const void *info,
+              const struct xt_match *match,
+              void *matchinfo,
+              unsigned int matchsize,
+              unsigned int hook_mask)
+{
+        const struct ipt_ip *ip = info;
+        const struct xt_multiport_v1 *multiinfo = matchinfo;
+
+        return check(ip->proto, ip->invflags, multiinfo->flags,
+                     multiinfo->count);
+}
+
+static int
+checkentry6(const char *tablename,
+            const void *info,
+            const struct xt_match *match,
+            void *matchinfo,
+            unsigned int matchsize,
+            unsigned int hook_mask)
+{
+        const struct ip6t_ip6 *ip = info;
+        const struct xt_multiport *multiinfo = matchinfo;
+
+        return check(ip->proto, ip->invflags, multiinfo->flags,
+                     multiinfo->count);
+}
+
+static int
+checkentry6_v1(const char *tablename,
+               const void *info,
+               const struct xt_match *match,
+               void *matchinfo,
+               unsigned int matchsize,
+               unsigned int hook_mask)
+{
+        const struct ip6t_ip6 *ip = info;
+        const struct xt_multiport_v1 *multiinfo = matchinfo;
+
+        return check(ip->proto, ip->invflags, multiinfo->flags,
+                     multiinfo->count);
+}
+
+static struct xt_match multiport_match = {
+        .name           = "multiport",
+        .revision       = 0,
+        .matchsize      = sizeof(struct xt_multiport),
+        .match          = &match,
+        .checkentry     = &checkentry,
+        .family         = AF_INET,
+        .me             = THIS_MODULE,
+};
+
+static struct xt_match multiport_match_v1 = {
+        .name           = "multiport",
+        .revision       = 1,
+        .matchsize      = sizeof(struct xt_multiport_v1),
+        .match          = &match_v1,
+        .checkentry     = &checkentry_v1,
+        .family         = AF_INET,
+        .me             = THIS_MODULE,
+};
+
+static struct xt_match multiport6_match = {
+        .name           = "multiport",
+        .revision       = 0,
+        .matchsize      = sizeof(struct xt_multiport),
+        .match          = &match,
+        .checkentry     = &checkentry6,
+        .family         = AF_INET6,
+        .me             = THIS_MODULE,
+};
+
+static struct xt_match multiport6_match_v1 = {
+        .name           = "multiport",
+        .revision       = 1,
+        .matchsize      = sizeof(struct xt_multiport_v1),
+        .match          = &match_v1,
+        .checkentry     = &checkentry6_v1,
+        .family         = AF_INET6,
+        .me             = THIS_MODULE,
+};
+
+static int __init xt_multiport_init(void)
+{
+        int ret;
+
+        ret = xt_register_match(&multiport_match);
+        if (ret)
+                goto out;
+
+        ret = xt_register_match(&multiport_match_v1);
+        if (ret)
+                goto out_unreg_multi_v0;
+
+        ret = xt_register_match(&multiport6_match);
+        if (ret)
+                goto out_unreg_multi_v1;
+
+        ret = xt_register_match(&multiport6_match_v1);
+        if (ret)
+                goto out_unreg_multi6_v0;
+
+        return ret;
+
+out_unreg_multi6_v0:
+        xt_unregister_match(&multiport6_match);
+out_unreg_multi_v1:
+        xt_unregister_match(&multiport_match_v1);
+out_unreg_multi_v0:
+        xt_unregister_match(&multiport_match);
+out:
+        return ret;
+}
+
+static void __exit xt_multiport_fini(void)
+{
+        xt_unregister_match(&multiport_match);
+        xt_unregister_match(&multiport_match_v1);
+        xt_unregister_match(&multiport6_match);
+        xt_unregister_match(&multiport6_match_v1);
+}
+
+module_init(xt_multiport_init);
+module_exit(xt_multiport_fini);
diff --git a/net/netfilter/xt_policy.c b/net/netfilter/xt_policy.c
index 1099cb005fcc..a3aa62fbda6f 100644
--- a/net/netfilter/xt_policy.c
+++ b/net/netfilter/xt_policy.c
@@ -71,7 +71,7 @@ match_policy_in(const struct sk_buff *skb, const struct xt_policy_info *info,
                         return 0;
                 e = &info->pol[pos];
 
-                if (match_xfrm_state(sp->x[i].xvec, e, family)) {
+                if (match_xfrm_state(sp->xvec[i], e, family)) {
                         if (!strict)
                                 return 1;
                 } else if (strict)
diff --git a/net/sched/act_police.c b/net/sched/act_police.c
index fa877f8f652c..24c348fa8922 100644
--- a/net/sched/act_police.c
+++ b/net/sched/act_police.c
@@ -66,7 +66,7 @@ static __inline__ struct tcf_police * tcf_police_lookup(u32 index)
 }
 
 #ifdef CONFIG_NET_CLS_ACT
-static int tcf_generic_walker(struct sk_buff *skb, struct netlink_callback *cb,
+static int tcf_act_police_walker(struct sk_buff *skb, struct netlink_callback *cb,
                               int type, struct tc_action *a)
 {
         struct tcf_police *p;
@@ -113,7 +113,7 @@ rtattr_failure:
 }
 
 static inline int
-tcf_hash_search(struct tc_action *a, u32 index)
+tcf_act_police_hash_search(struct tc_action *a, u32 index)
 {
         struct tcf_police *p = tcf_police_lookup(index);
 
@@ -387,9 +387,9 @@ static struct tc_action_ops act_police_ops = {
         .act            =       tcf_act_police,
         .dump           =       tcf_act_police_dump,
         .cleanup        =       tcf_act_police_cleanup,
-        .lookup         =       tcf_hash_search,
+        .lookup         =       tcf_act_police_hash_search,
         .init           =       tcf_act_police_locate,
-        .walk           =       tcf_generic_walker
+        .walk           =       tcf_act_police_walker
 };
 
 static int __init
diff --git a/net/sctp/proc.c b/net/sctp/proc.c
index d47a52c303a8..5b3b0e0ae7e5 100644
--- a/net/sctp/proc.c
+++ b/net/sctp/proc.c
@@ -69,7 +69,7 @@ fold_field(void *mib[], int nr)
         unsigned long res = 0;
         int i;
 
-        for_each_cpu(i) {
+        for_each_possible_cpu(i) {
                 res +=
                     *((unsigned long *) (((void *) per_cpu_ptr(mib[0], i)) +
                                          sizeof (unsigned long) * nr));
diff --git a/net/socket.c b/net/socket.c
index b13042f68c02..23898f45f713 100644
--- a/net/socket.c
+++ b/net/socket.c
@@ -119,10 +119,6 @@ static ssize_t sock_writev(struct file *file, const struct iovec *vector,
 static ssize_t sock_sendpage(struct file *file, struct page *page,
                              int offset, size_t size, loff_t *ppos, int more);
 
-extern ssize_t generic_splice_sendpage(struct inode *inode, struct file *out,
-                                size_t len, unsigned int flags);
-
-
 /*
  *      Socket files have a set of 'special' operations as well as the generic file ones. These don't appear
  *      in the operation structures but are done directly via the socketcall() multiplexor.
@@ -1418,7 +1414,8 @@ asmlinkage long sys_accept(int fd, struct sockaddr __user *upeer_sockaddr, int _
         newfd = sock_alloc_fd(&newfile);
         if (unlikely(newfd < 0)) {
                 err = newfd;
-                goto out_release;
+                sock_release(newsock);
+                goto out_put;
         }
 
         err = sock_attach_fd(newsock, newfile);
@@ -1455,10 +1452,8 @@ out_put:
 out:
         return err;
 out_fd:
-        put_filp(newfile);
+        fput(newfile);
         put_unused_fd(newfd);
-out_release:
-        sock_release(newsock);
         goto out_put;
 }
 
@@ -2137,7 +2132,7 @@ void socket_seq_show(struct seq_file *seq)
         int cpu;
         int counter = 0;
 
-        for_each_cpu(cpu)
+        for_each_possible_cpu(cpu)
                 counter += per_cpu(sockets_in_use, cpu);
 
         /* It can be negative, by the way. 8) */
diff --git a/net/sunrpc/auth_gss/svcauth_gss.c b/net/sunrpc/auth_gss/svcauth_gss.c
index 4d7eb9e704da..d51e316c5821 100644
--- a/net/sunrpc/auth_gss/svcauth_gss.c
+++ b/net/sunrpc/auth_gss/svcauth_gss.c
@@ -1122,18 +1122,20 @@ svcauth_gss_release(struct svc_rqst *rqstp)
                                         integ_len))
                         BUG();
                 if (resbuf->page_len == 0
-                        && resbuf->tail[0].iov_len + RPC_MAX_AUTH_SIZE
+                        && resbuf->head[0].iov_len + RPC_MAX_AUTH_SIZE
                                 < PAGE_SIZE) {
                         BUG_ON(resbuf->tail[0].iov_len);
                         /* Use head for everything */
                         resv = &resbuf->head[0];
                 } else if (resbuf->tail[0].iov_base == NULL) {
-                        /* copied from nfsd4_encode_read */
-                        svc_take_page(rqstp);
-                        resbuf->tail[0].iov_base = page_address(rqstp
-                                        ->rq_respages[rqstp->rq_resused-1]);
-                        rqstp->rq_restailpage = rqstp->rq_resused-1;
+                        if (resbuf->head[0].iov_len + RPC_MAX_AUTH_SIZE
+                                        > PAGE_SIZE)
+                                goto out_err;
+                        resbuf->tail[0].iov_base =
+                                resbuf->head[0].iov_base
+                                + resbuf->head[0].iov_len;
                         resbuf->tail[0].iov_len = 0;
+                        rqstp->rq_restailpage = 0;
                         resv = &resbuf->tail[0];
                 } else {
                         resv = &resbuf->tail[0];
diff --git a/net/xfrm/xfrm_input.c b/net/xfrm/xfrm_input.c
index 2407a7072327..b54971059f16 100644
--- a/net/xfrm/xfrm_input.c
+++ b/net/xfrm/xfrm_input.c
@@ -18,7 +18,7 @@ void __secpath_destroy(struct sec_path *sp)
 {
         int i;
         for (i = 0; i < sp->len; i++)
-                xfrm_state_put(sp->x[i].xvec);
+                xfrm_state_put(sp->xvec[i]);
         kmem_cache_free(secpath_cachep, sp);
 }
 EXPORT_SYMBOL(__secpath_destroy);
@@ -37,7 +37,7 @@ struct sec_path *secpath_dup(struct sec_path *src)
 
                 memcpy(sp, src, sizeof(*sp));
                 for (i = 0; i < sp->len; i++)
-                        xfrm_state_hold(sp->x[i].xvec);
+                        xfrm_state_hold(sp->xvec[i]);
         }
         atomic_set(&sp->refcnt, 1);
         return sp;
diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c
index f5eae9febd26..c3725fe2a8fb 100644
--- a/net/xfrm/xfrm_policy.c
+++ b/net/xfrm/xfrm_policy.c
@@ -943,9 +943,9 @@ xfrm_policy_ok(struct xfrm_tmpl *tmpl, struct sec_path *sp, int start,
         } else
                 start = -1;
         for (; idx < sp->len; idx++) {
-                if (xfrm_state_ok(tmpl, sp->x[idx].xvec, family))
+                if (xfrm_state_ok(tmpl, sp->xvec[idx], family))
                         return ++idx;
-                if (sp->x[idx].xvec->props.mode)
+                if (sp->xvec[idx]->props.mode)
                         break;
         }
         return start;
@@ -968,7 +968,7 @@ EXPORT_SYMBOL(xfrm_decode_session);
 static inline int secpath_has_tunnel(struct sec_path *sp, int k)
 {
         for (; k < sp->len; k++) {
-                if (sp->x[k].xvec->props.mode)
+                if (sp->xvec[k]->props.mode)
                         return 1;
         }
 
@@ -994,8 +994,8 @@ int __xfrm_policy_check(struct sock *sk, int dir, struct sk_buff *skb,
                 int i;
 
                 for (i=skb->sp->len-1; i>=0; i--) {
-                        struct sec_decap_state *xvec = &(skb->sp->x[i]);
-                        if (!xfrm_selector_match(&xvec->xvec->sel, &fl, family))
+                        struct xfrm_state *x = skb->sp->xvec[i];
+                        if (!xfrm_selector_match(&x->sel, &fl, family))
                                 return 0;
                 }
         }
diff --git a/scripts/Kbuild.include b/scripts/Kbuild.include
index 59620b1554e0..b0d067be7390 100644
--- a/scripts/Kbuild.include
+++ b/scripts/Kbuild.include
@@ -87,6 +87,11 @@ cc-ifversion = $(shell if [ $(call cc-version, $(CC)) $(1) $(2) ]; then \
 # $(Q)$(MAKE) $(build)=dir
 build := -f $(if $(KBUILD_SRC),$(srctree)/)scripts/Makefile.build obj
 
+# Prefix -I with $(srctree) if it is not an absolute path
+addtree = $(if $(filter-out -I/%,$(1)),$(patsubst -I%,-I$(srctree)/%,$(1))) $(1)
+# Find all -I options and call addtree
+flags = $(foreach o,$($(1)),$(if $(filter -I%,$(o)),$(call addtree,$(o)),$(o)))
+
 # If quiet is set, only print short version of command
 cmd = @$(echo-cmd) $(cmd_$(1))
 
diff --git a/scripts/Makefile.lib b/scripts/Makefile.lib
index 550798f57da5..2cb4935e85d1 100644
--- a/scripts/Makefile.lib
+++ b/scripts/Makefile.lib
@@ -99,11 +99,6 @@ __a_flags	= $(_a_flags)
 __cpp_flags     = $(_cpp_flags)
 else
 
-# Prefix -I with $(srctree) if it is not an absolute path
-addtree = $(if $(filter-out -I/%,$(1)),$(patsubst -I%,-I$(srctree)/%,$(1))) $(1)
-# Find all -I options and call addtree
-flags = $(foreach o,$($(1)),$(if $(filter -I%,$(o)),$(call addtree,$(o)),$(o)))
-
 # -I$(obj) locates generated .h files
 # $(call addtree,-I$(obj)) locates .h files in srctree, from generated .c files
 #   and locates generated .h files
diff --git a/scripts/bloat-o-meter b/scripts/bloat-o-meter
index 75f21d843c1d..75f21d843c1d 100644..100755
--- a/scripts/bloat-o-meter
+++ b/scripts/bloat-o-meter
diff --git a/scripts/checkstack.pl b/scripts/checkstack.pl
index dadfa20ffec0..dadfa20ffec0 100644..100755
--- a/scripts/checkstack.pl
+++ b/scripts/checkstack.pl
diff --git a/scripts/gen_initramfs_list.sh b/scripts/gen_initramfs_list.sh
index 6d411169bfa6..56b3bed1108f 100644
--- a/scripts/gen_initramfs_list.sh
+++ b/scripts/gen_initramfs_list.sh
@@ -1,22 +1,55 @@
 #!/bin/bash
 # Copyright (C) Martin Schlemmer <azarah@nosferatu.za.org>
-# Released under the terms of the GNU GPL
-#
-# Generate a newline separated list of entries from the file/directory
-# supplied as an argument.
-#
-# If a file/directory is not supplied then generate a small dummy file.
+# Copyright (c) 2006           Sam Ravnborg <sam@ravnborg.org>
 #
-# The output is suitable for gen_init_cpio built from usr/gen_init_cpio.c.
+# Released under the terms of the GNU GPL
 #
+# Generate a cpio packed initramfs. It uses gen_init_cpio to generate
+# the cpio archive, and gzip to pack it.
+# The script may also be used to generate the inputfile used for gen_init_cpio
+# This script assumes that gen_init_cpio is located in usr/ directory
+
+# error out on errors
+set -e
+
+usage() {
+cat << EOF
+Usage:
+$0 [-o <file>] [-u <uid>] [-g <gid>] {-d | <cpio_source>} ...
+        -o <file>      Create gzipped initramfs file named <file> using
+                       gen_init_cpio and gzip
+        -u <uid>       User ID to map to user ID 0 (root).
+                       <uid> is only meaningful if <cpio_source>
+                       is a directory.
+        -g <gid>       Group ID to map to group ID 0 (root).
+                       <gid> is only meaningful if <cpio_source>
+                       is a directory.
+        <cpio_source>  File list or directory for cpio archive.
+                       If <cpio_source> is a .cpio file it will be used
+                       as direct input to initramfs.
+        -d             Output the default cpio list.
+
+All options except -o and -l may be repeated and are interpreted
+sequentially and immediately.  -u and -g states are preserved across
+<cpio_source> options so an explicit "-u 0 -g 0" is required
+to reset the root/group mapping.
+EOF
+}
+
+list_default_initramfs() {
+        # echo usr/kinit/kinit
+        :
+}
 
 default_initramfs() {
-        cat <<-EOF
+        cat <<-EOF >> ${output}
                 # This is a very simple, default initramfs
 
                 dir /dev 0755 0 0
                 nod /dev/console 0600 0 0 c 5 1
                 dir /root 0700 0 0
+                # file /kinit usr/kinit/kinit 0755 0 0
+                # slink /init kinit 0755 0 0
         EOF
 }
 
@@ -42,18 +75,28 @@ filetype() {
         return 0
 }
 
+list_print_mtime() {
+        :
+}
+
 print_mtime() {
-        local argv1="$1"
         local my_mtime="0"
 
-        if [ -e "${argv1}" ]; then
-                my_mtime=$(find "${argv1}" -printf "%T@\n" | sort -r | head -n 1)
+        if [ -e "$1" ]; then
+                my_mtime=$(find "$1" -printf "%T@\n" | sort -r | head -n 1)
         fi
-        
-        echo "# Last modified: ${my_mtime}"
-        echo
+
+        echo "# Last modified: ${my_mtime}" >> ${output}
+        echo "" >> ${output}
+}
+
+list_parse() {
+        echo "$1 \\"
 }
 
+# for each file print a line in following format
+# <filetype> <name> <path to file> <octal mode> <uid> <gid>
+# for links, devices etc the format differs. See gen_init_cpio for details
 parse() {
         local location="$1"
         local name="${location/${srcdir}//}"
@@ -99,80 +142,112 @@ parse() {
                         ;;
         esac
 
-        echo "${str}"
+        echo "${str}" >> ${output}
 
         return 0
 }
 
-usage() {
-        printf    "Usage:\n"
-        printf    "$0 [ [-u <root_uid>] [-g <root_gid>] [-d | <cpio_source>] ] . . .\n"
-        printf    "\n"
-        printf -- "-u <root_uid>  User ID to map to user ID 0 (root).\n"
-        printf    "               <root_uid> is only meaningful if <cpio_source>\n"
-        printf    "               is a directory.\n"
-        printf -- "-g <root_gid>  Group ID to map to group ID 0 (root).\n"
-        printf    "               <root_gid> is only meaningful if <cpio_source>\n"
-        printf    "               is a directory.\n"
-        printf    "<cpio_source>  File list or directory for cpio archive.\n"
-        printf    "               If <cpio_source> is not provided then a\n"
-        printf    "               a default list will be output.\n"
-        printf -- "-d             Output the default cpio list.  If no <cpio_source>\n"
-        printf    "               is given then the default cpio list will be output.\n"
-        printf    "\n"
-        printf    "All options may be repeated and are interpreted sequentially\n"
-        printf    "and immediately.  -u and -g states are preserved across\n"
-        printf    "<cpio_source> options so an explicit \"-u 0 -g 0\" is required\n"
-        printf    "to reset the root/group mapping.\n"
+unknown_option() {
+        printf "ERROR: unknown option \"$arg\"\n" >&2
+        printf "If the filename validly begins with '-', " >&2
+        printf "then it must be prefixed\n" >&2
+        printf "by './' so that it won't be interpreted as an option." >&2
+        printf "\n" >&2
+        usage >&2
+        exit 1
+}
+
+list_header() {
+        echo "deps_initramfs := \\"
+}
+
+header() {
+        printf "\n#####################\n# $1\n" >> ${output}
+}
+
+# process one directory (incl sub-directories)
+dir_filelist() {
+        ${dep_list}header "$1"
+
+        srcdir=$(echo "$1" | sed -e 's://*:/:g')
+        dirlist=$(find "${srcdir}" -printf "%p %m %U %G\n" 2>/dev/null)
+
+        # If $dirlist is only one line, then the directory is empty
+        if [  "$(echo "${dirlist}" | wc -l)" -gt 1 ]; then
+                ${dep_list}print_mtime "$1"
+
+                echo "${dirlist}" | \
+                while read x; do
+                        ${dep_list}parse ${x}
+                done
+        fi
 }
 
-build_list() {
-        printf "\n#####################\n# $cpio_source\n"
-
-        if [ -f "$cpio_source" ]; then
-                print_mtime "$cpio_source"
-                cat "$cpio_source"
-        elif [ -d "$cpio_source" ]; then
-                srcdir=$(echo "$cpio_source" | sed -e 's://*:/:g')
-                dirlist=$(find "${srcdir}" -printf "%p %m %U %G\n" 2>/dev/null)
-
-                # If $dirlist is only one line, then the directory is empty
-                if [  "$(echo "${dirlist}" | wc -l)" -gt 1 ]; then
-                        print_mtime "$cpio_source"
-                
-                        echo "${dirlist}" | \
-                        while read x; do
-                                parse ${x}
-                        done
+# if only one file is specified and it is .cpio file then use it direct as fs
+# if a directory is specified then add all files in given direcotry to fs
+# if a regular file is specified assume it is in gen_initramfs format
+input_file() {
+        source="$1"
+        if [ -f "$1" ]; then
+                ${dep_list}header "$1"
+                is_cpio="$(echo "$1" | sed 's/^.*\.cpio/cpio/')"
+                if [ $2 -eq 0 -a ${is_cpio} == "cpio" ]; then
+                        cpio_file=$1
+                        [ ! -z ${dep_list} ] && echo "$1"
+                        return 0
+                fi
+                if [ -z ${dep_list} ]; then
+                        print_mtime "$1" >> ${output}
+                        cat "$1"         >> ${output}
                 else
-                        # Failsafe in case directory is empty
-                        default_initramfs
+                        grep ^file "$1" | cut -d ' ' -f 3
                 fi
+        elif [ -d "$1" ]; then
+                dir_filelist "$1"
         else
-                echo "  $0: Cannot open '$cpio_source'" >&2
+                echo "  ${prog}: Cannot open '$1'" >&2
                 exit 1
         fi
 }
 
-
+prog=$0
 root_uid=0
 root_gid=0
+dep_list=
+cpio_file=
+cpio_list=
+output="/dev/stdout"
+output_file=""
 
+arg="$1"
+case "$arg" in
+        "-l")   # files included in initramfs - used by kbuild
+                dep_list="list_"
+                shift
+                ;;
+        "-o")   # generate gzipped cpio image named $1
+                shift
+                output_file="$1"
+                cpio_list="$(mktemp ${TMPDIR:-/tmp}/cpiolist.XXXXXX)"
+                output=${cpio_list}
+                shift
+                ;;
+esac
 while [ $# -gt 0 ]; do
         arg="$1"
         shift
         case "$arg" in
-                "-u")
+                "-u")   # map $1 to uid=0 (root)
                         root_uid="$1"
                         shift
                         ;;
-                "-g")
+                "-g")   # map $1 to gid=0 (root)
                         root_gid="$1"
                         shift
                         ;;
-                "-d")
+                "-d")   # display default initramfs list
                         default_list="$arg"
-                        default_initramfs
+                        ${dep_list}default_initramfs
                         ;;
                 "-h")
                         usage
@@ -181,23 +256,27 @@ while [ $# -gt 0 ]; do
                 *)
                         case "$arg" in
                                 "-"*)
-                                        printf "ERROR: unknown option \"$arg\"\n" >&2
-                                        printf "If the filename validly begins with '-', then it must be prefixed\n" >&2
-                                        printf "by './' so that it won't be interpreted as an option." >&2
-                                        printf "\n" >&2
-                                        usage >&2
-                                        exit 1
+                                        unknown_option
                                         ;;
-                                *)
-                                        cpio_source="$arg"
-                                        build_list
+                                *)      # input file/dir - process it
+                                        input_file "$arg" "$#"
                                         ;;
                         esac
                         ;;
         esac
 done
 
-# spit out the default cpio list if a source hasn't been specified
-[ -z "$cpio_source" -a -z "$default_list" ] && default_initramfs
-
+# If output_file is set we will generate cpio archive and gzip it
+# we are carefull to delete tmp files
+if [ ! -z ${output_file} ]; then
+        if [ -z ${cpio_file} ]; then
+                cpio_tfile="$(mktemp ${TMPDIR:-/tmp}/cpiofile.XXXXXX)"
+                usr/gen_init_cpio ${cpio_list} > ${cpio_tfile}
+        else
+                cpio_tfile=${cpio_file}
+        fi
+        rm ${cpio_list}
+        cat ${cpio_tfile} | gzip -f -9 - > ${output_file}
+        [ -z ${cpio_file} ] && rm ${cpio_tfile}
+fi
 exit 0
diff --git a/scripts/kconfig/conf.c b/scripts/kconfig/conf.c
index 10eeae53d827..ae5ab981bb1d 100644
--- a/scripts/kconfig/conf.c
+++ b/scripts/kconfig/conf.c
@@ -63,20 +63,6 @@ static void check_stdin(void)
         }
 }
 
-static char *fgets_check_stream(char *s, int size, FILE *stream)
-{
-        char *ret = fgets(s, size, stream);
-
-        if (ret == NULL && feof(stream)) {
-                printf(_("aborted!\n\n"));
-                printf(_("Console input is closed. "));
-                printf(_("Run 'make oldconfig' to update configuration.\n\n"));
-                exit(1);
-        }
-
-        return ret;
-}
-
 static void conf_askvalue(struct symbol *sym, const char *def)
 {
         enum symbol_type type = sym_get_type(sym);
@@ -114,7 +100,7 @@ static void conf_askvalue(struct symbol *sym, const char *def)
                 check_stdin();
         case ask_all:
                 fflush(stdout);
-                fgets_check_stream(line, 128, stdin);
+                fgets(line, 128, stdin);
                 return;
         case set_default:
                 printf("%s\n", def);
@@ -328,8 +314,7 @@ static int conf_choice(struct menu *menu)
                 printf("%*s%s\n", indent - 1, "", menu_get_prompt(menu));
                 def_sym = sym_get_choice_value(sym);
                 cnt = def = 0;
-                line[0] = '0';
-                line[1] = 0;
+                line[0] = 0;
                 for (child = menu->list; child; child = child->next) {
                         if (!menu_is_visible(child))
                                 continue;
@@ -370,7 +355,7 @@ static int conf_choice(struct menu *menu)
                         check_stdin();
                 case ask_all:
                         fflush(stdout);
-                        fgets_check_stream(line, 128, stdin);
+                        fgets(line, 128, stdin);
                         strip(line);
                         if (line[0] == '?') {
                                 printf("\n%s\n", menu->sym->help ?
diff --git a/scripts/kconfig/confdata.c b/scripts/kconfig/confdata.c
index 1b8882ddbc74..1b5df589f3ae 100644
--- a/scripts/kconfig/confdata.c
+++ b/scripts/kconfig/confdata.c
@@ -325,7 +325,7 @@ int conf_read(const char *name)
                                 sym->flags |= e->right.sym->flags & SYMBOL_NEW;
         }
 
-        sym_change_count = conf_warnings && conf_unsaved;
+        sym_change_count = conf_warnings || conf_unsaved;
 
         return 0;
 }
diff --git a/scripts/kconfig/lxdialog/menubox.c b/scripts/kconfig/lxdialog/menubox.c
index 09512b544375..bf8052f4fd4a 100644
--- a/scripts/kconfig/lxdialog/menubox.c
+++ b/scripts/kconfig/lxdialog/menubox.c
@@ -58,8 +58,7 @@
 
 #include "dialog.h"
 
-#define ITEM_IDENT 1   /* Indent of menu entries. Fixed for all menus */
-static int menu_width;
+static int menu_width, item_x;
 
 /*
  * Print menu item
@@ -70,7 +69,7 @@ static void do_print_item(WINDOW * win, const char *item, int choice,
         int j;
         char *menu_item = malloc(menu_width + 1);
 
-        strncpy(menu_item, item, menu_width - ITEM_IDENT);
+        strncpy(menu_item, item, menu_width - item_x);
         menu_item[menu_width] = 0;
         j = first_alpha(menu_item, "YyNnMmHh");
 
@@ -87,13 +86,13 @@ static void do_print_item(WINDOW * win, const char *item, int choice,
         wclrtoeol(win);
 #endif
         wattrset(win, selected ? item_selected_attr : item_attr);
-        mvwaddstr(win, choice, ITEM_IDENT, menu_item);
+        mvwaddstr(win, choice, item_x, menu_item);
         if (hotkey) {
                 wattrset(win, selected ? tag_key_selected_attr : tag_key_attr);
-                mvwaddch(win, choice, ITEM_IDENT + j, menu_item[j]);
+                mvwaddch(win, choice, item_x + j, menu_item[j]);
         }
         if (selected) {
-                wmove(win, choice, ITEM_IDENT + 1);
+                wmove(win, choice, item_x + 1);
         }
         free(menu_item);
         wrefresh(win);
@@ -227,6 +226,8 @@ int dialog_menu(const char *title, const char *prompt, int height, int width,
         draw_box(dialog, box_y, box_x, menu_height + 2, menu_width + 2,
                  menubox_border_attr, menubox_attr);
 
+        item_x = (menu_width - 70) / 2;
+
         /* Set choice to default item */
         for (i = 0; i < item_no; i++)
                 if (strcmp(current, items[i * 2]) == 0)
@@ -263,10 +264,10 @@ int dialog_menu(const char *title, const char *prompt, int height, int width,
         wnoutrefresh(menu);
 
         print_arrows(dialog, item_no, scroll,
-                     box_y, box_x + ITEM_IDENT + 1, menu_height);
+                     box_y, box_x + item_x + 1, menu_height);
 
         print_buttons(dialog, height, width, 0);
-        wmove(menu, choice, ITEM_IDENT + 1);
+        wmove(menu, choice, item_x + 1);
         wrefresh(menu);
 
         while (key != ESC) {
@@ -349,7 +350,7 @@ int dialog_menu(const char *title, const char *prompt, int height, int width,
                         print_item(scroll + choice, choice, TRUE);
 
                         print_arrows(dialog, item_no, scroll,
-                                     box_y, box_x + ITEM_IDENT + 1, menu_height);
+                                     box_y, box_x + item_x + 1, menu_height);
 
                         wnoutrefresh(dialog);
                         wrefresh(menu);
diff --git a/scripts/mod/modpost.c b/scripts/mod/modpost.c
index 0b92ddff26fd..7e8079a34adf 100644
--- a/scripts/mod/modpost.c
+++ b/scripts/mod/modpost.c
@@ -658,7 +658,7 @@ static void warn_sec_mismatch(const char *modname, const char *fromsec,
                 warn("%s - Section mismatch: reference to %s:%s from %s "
                      "before '%s' (at offset -0x%llx)\n",
                      modname, secname, refsymname, fromsec,
-                     elf->strtab + before->st_name,
+                     elf->strtab + after->st_name,
                      (long long)r.r_offset);
         } else {
                 warn("%s - Section mismatch: reference to %s:%s from %s "
diff --git a/scripts/namespace.pl b/scripts/namespace.pl
index f34373853ef8..f34373853ef8 100644..100755
--- a/scripts/namespace.pl
+++ b/scripts/namespace.pl
diff --git a/scripts/show_delta b/scripts/show_delta
index 48a706ab3d0c..48a706ab3d0c 100644..100755
--- a/scripts/show_delta
+++ b/scripts/show_delta
diff --git a/scripts/ver_linux b/scripts/ver_linux
index beb43ef7f761..84999f69773d 100755
--- a/scripts/ver_linux
+++ b/scripts/ver_linux
@@ -39,10 +39,10 @@ tune2fs 2>&1 | grep "^tune2fs" | sed 's/,//' |  awk \
 fsck.jfs -V 2>&1 | grep version | sed 's/,//' |  awk \
 'NR==1 {print "jfsutils              ", $3}'
 
-reiserfsck -V 2>&1 | grep reiserfsck | awk \
+reiserfsck -V 2>&1 | grep ^reiserfsck | awk \
 'NR==1{print "reiserfsprogs         ", $2}'
 
-fsck.reiser4 -V 2>&1 | grep fsck.reiser4 | awk \
+fsck.reiser4 -V 2>&1 | grep ^fsck.reiser4 | awk \
 'NR==1{print "reiser4progs          ", $2}'
 
 xfs_db -V 2>&1 | grep version | awk \
diff --git a/security/keys/key.c b/security/keys/key.c
index a057e3311aad..b6061fa29da7 100644
--- a/security/keys/key.c
+++ b/security/keys/key.c
@@ -785,6 +785,10 @@ key_ref_t key_create_or_update(key_ref_t keyring_ref,
 
         key_check(keyring);
 
+        key_ref = ERR_PTR(-ENOTDIR);
+        if (keyring->type != &key_type_keyring)
+                goto error_2;
+
         down_write(&keyring->sem);
 
         /* if we're going to allocate a new key, we're going to have
diff --git a/security/keys/keyring.c b/security/keys/keyring.c
index d65a180f888d..bffa924c1f88 100644
--- a/security/keys/keyring.c
+++ b/security/keys/keyring.c
@@ -437,6 +437,7 @@ EXPORT_SYMBOL(keyring_search);
 /*
  * search the given keyring only (no recursion)
  * - keyring must be locked by caller
+ * - caller must guarantee that the keyring is a keyring
  */
 key_ref_t __keyring_search_one(key_ref_t keyring_ref,
                                const struct key_type *ktype,
diff --git a/security/keys/process_keys.c b/security/keys/process_keys.c
index f6940618e345..217a0bef3c82 100644
--- a/security/keys/process_keys.c
+++ b/security/keys/process_keys.c
@@ -168,11 +168,12 @@ error:
  */
 int install_process_keyring(struct task_struct *tsk)
 {
-        unsigned long flags;
         struct key *keyring;
         char buf[20];
         int ret;
 
+        might_sleep();
+
         if (!tsk->signal->process_keyring) {
                 sprintf(buf, "_pid.%u", tsk->tgid);
 
@@ -183,12 +184,12 @@ int install_process_keyring(struct task_struct *tsk)
                 }
 
                 /* attach keyring */
-                spin_lock_irqsave(&tsk->sighand->siglock, flags);
+                spin_lock_irq(&tsk->sighand->siglock);
                 if (!tsk->signal->process_keyring) {
                         tsk->signal->process_keyring = keyring;
                         keyring = NULL;
                 }
-                spin_unlock_irqrestore(&tsk->sighand->siglock, flags);
+                spin_unlock_irq(&tsk->sighand->siglock);
 
                 key_put(keyring);
         }
@@ -207,38 +208,37 @@ error:
 static int install_session_keyring(struct task_struct *tsk,
                                    struct key *keyring)
 {
-        unsigned long flags;
         struct key *old;
         char buf[20];
-        int ret;
+
+        might_sleep();
 
         /* create an empty session keyring */
         if (!keyring) {
                 sprintf(buf, "_ses.%u", tsk->tgid);
 
                 keyring = keyring_alloc(buf, tsk->uid, tsk->gid, 1, NULL);
-                if (IS_ERR(keyring)) {
-                        ret = PTR_ERR(keyring);
-                        goto error;
-                }
+                if (IS_ERR(keyring))
+                        return PTR_ERR(keyring);
         }
         else {
                 atomic_inc(&keyring->usage);
         }
 
         /* install the keyring */
-        spin_lock_irqsave(&tsk->sighand->siglock, flags);
-        old = rcu_dereference(tsk->signal->session_keyring);
+        spin_lock_irq(&tsk->sighand->siglock);
+        old = tsk->signal->session_keyring;
         rcu_assign_pointer(tsk->signal->session_keyring, keyring);
-        spin_unlock_irqrestore(&tsk->sighand->siglock, flags);
+        spin_unlock_irq(&tsk->sighand->siglock);
 
-        ret = 0;
+        /* we're using RCU on the pointer, but there's no point synchronising
+         * on it if it didn't previously point to anything */
+        if (old) {
+                synchronize_rcu();
+                key_put(old);
+        }
 
-        /* we're using RCU on the pointer */
-        synchronize_rcu();
-        key_put(old);
-error:
-        return ret;
+        return 0;
 
 } /* end install_session_keyring() */
 
@@ -311,7 +311,6 @@ void exit_keys(struct task_struct *tsk)
  */
 int exec_keys(struct task_struct *tsk)
 {
-        unsigned long flags;
         struct key *old;
 
         /* newly exec'd tasks don't get a thread keyring */
@@ -323,10 +322,10 @@ int exec_keys(struct task_struct *tsk)
         key_put(old);
 
         /* discard the process keyring from a newly exec'd task */
-        spin_lock_irqsave(&tsk->sighand->siglock, flags);
+        spin_lock_irq(&tsk->sighand->siglock);
         old = tsk->signal->process_keyring;
         tsk->signal->process_keyring = NULL;
-        spin_unlock_irqrestore(&tsk->sighand->siglock, flags);
+        spin_unlock_irq(&tsk->sighand->siglock);
 
         key_put(old);
 
diff --git a/security/selinux/xfrm.c b/security/selinux/xfrm.c
index dfab6c886698..abe99d881376 100644
--- a/security/selinux/xfrm.c
+++ b/security/selinux/xfrm.c
@@ -281,7 +281,7 @@ u32 selinux_socket_getpeer_dgram(struct sk_buff *skb)
                 int i;
 
                 for (i = sp->len-1; i >= 0; i--) {
-                        struct xfrm_state *x = sp->x[i].xvec;
+                        struct xfrm_state *x = sp->xvec[i];
                         if (selinux_authorizable_xfrm(x)) {
                                 struct xfrm_sec_ctx *ctx = x->security;
                                 return ctx->ctx_sid;
@@ -314,7 +314,7 @@ int selinux_xfrm_sock_rcv_skb(u32 isec_sid, struct sk_buff *skb)
                  *  Only need to verify the existence of an authorizable sp.
                  */
                 for (i = 0; i < sp->len; i++) {
-                        struct xfrm_state *x = sp->x[i].xvec;
+                        struct xfrm_state *x = sp->xvec[i];
 
                         if (x && selinux_authorizable_xfrm(x))
                                 goto accept;
diff --git a/sound/core/Kconfig b/sound/core/Kconfig
index 9dd121bb5638..8efc1b12f3a8 100644
--- a/sound/core/Kconfig
+++ b/sound/core/Kconfig
@@ -92,8 +92,9 @@ config SND_SEQUENCER_OSS
 
           Many programs still use the OSS API, so say Y.
 
-          To compile this driver as a module, choose M here: the module
-          will be called snd-seq-oss.
+          If you choose M in "Sequencer support" (SND_SEQUENCER),
+          this will be compiled as a module. The module will be called
+          snd-seq-oss.
 
 config SND_RTCTIMER
         tristate "RTC Timer support"
diff --git a/sound/core/control.c b/sound/core/control.c
index 574745314e70..22565c9b9603 100644
--- a/sound/core/control.c
+++ b/sound/core/control.c
@@ -664,7 +664,7 @@ static int snd_ctl_elem_info_user(struct snd_ctl_file *ctl,
         if (copy_from_user(&info, _info, sizeof(info)))
                 return -EFAULT;
         snd_power_lock(ctl->card);
-        result = snd_power_wait(ctl->card, SNDRV_CTL_POWER_D0, NULL);
+        result = snd_power_wait(ctl->card, SNDRV_CTL_POWER_D0);
         if (result >= 0)
                 result = snd_ctl_elem_info(ctl, &info);
         snd_power_unlock(ctl->card);
@@ -718,7 +718,7 @@ static int snd_ctl_elem_read_user(struct snd_card *card,
                 return -EFAULT;
         }
         snd_power_lock(card);
-        result = snd_power_wait(card, SNDRV_CTL_POWER_D0, NULL);
+        result = snd_power_wait(card, SNDRV_CTL_POWER_D0);
         if (result >= 0)
                 result = snd_ctl_elem_read(card, control);
         snd_power_unlock(card);
@@ -783,7 +783,7 @@ static int snd_ctl_elem_write_user(struct snd_ctl_file *file,
         }
         card = file->card;
         snd_power_lock(card);
-        result = snd_power_wait(card, SNDRV_CTL_POWER_D0, NULL);
+        result = snd_power_wait(card, SNDRV_CTL_POWER_D0);
         if (result >= 0)
                 result = snd_ctl_elem_write(card, file, control);
         snd_power_unlock(card);
diff --git a/sound/core/control_compat.c b/sound/core/control_compat.c
index 84fef5084e17..3c0161bb5ba4 100644
--- a/sound/core/control_compat.c
+++ b/sound/core/control_compat.c
@@ -109,7 +109,7 @@ static int snd_ctl_elem_info_compat(struct snd_ctl_file *ctl,
                 goto error;
 
         snd_power_lock(ctl->card);
-        err = snd_power_wait(ctl->card, SNDRV_CTL_POWER_D0, NULL);
+        err = snd_power_wait(ctl->card, SNDRV_CTL_POWER_D0);
         if (err >= 0)
                 err = snd_ctl_elem_info(ctl, data);
         snd_power_unlock(ctl->card);
@@ -294,7 +294,7 @@ static int snd_ctl_elem_read_user_compat(struct snd_card *card,
                 goto error;
 
         snd_power_lock(card);
-        err = snd_power_wait(card, SNDRV_CTL_POWER_D0, NULL);
+        err = snd_power_wait(card, SNDRV_CTL_POWER_D0);
         if (err >= 0)
                 err = snd_ctl_elem_read(card, data);
         snd_power_unlock(card);
@@ -320,7 +320,7 @@ static int snd_ctl_elem_write_user_compat(struct snd_ctl_file *file,
                 goto error;
 
         snd_power_lock(card);
-        err = snd_power_wait(card, SNDRV_CTL_POWER_D0, NULL);
+        err = snd_power_wait(card, SNDRV_CTL_POWER_D0);
         if (err >= 0)
                 err = snd_ctl_elem_write(card, file, data);
         snd_power_unlock(card);
diff --git a/sound/core/init.c b/sound/core/init.c
index 5bb8a8b23d51..39ed2e5bb0af 100644
--- a/sound/core/init.c
+++ b/sound/core/init.c
@@ -722,13 +722,12 @@ int snd_card_file_remove(struct snd_card *card, struct file *file)
  *  snd_power_wait - wait until the power-state is changed.
  *  @card: soundcard structure
  *  @power_state: expected power state
- *  @file: file structure for the O_NONBLOCK check (optional)
  *
  *  Waits until the power-state is changed.
  *
  *  Note: the power lock must be active before call.
  */
-int snd_power_wait(struct snd_card *card, unsigned int power_state, struct file *file)
+int snd_power_wait(struct snd_card *card, unsigned int power_state)
 {
         wait_queue_t wait;
         int result = 0;
@@ -745,12 +744,6 @@ int snd_power_wait(struct snd_card *card, unsigned int power_state, struct file
                 }
                 if (snd_power_get_state(card) == power_state)
                         break;
-#if 0 /* block all devices */
-                if (file && (file->f_flags & O_NONBLOCK)) {
-                        result = -EAGAIN;
-                        break;
-                }
-#endif
                 set_current_state(TASK_UNINTERRUPTIBLE);
                 snd_power_unlock(card);
                 schedule_timeout(30 * HZ);
diff --git a/sound/core/oss/pcm_oss.c b/sound/core/oss/pcm_oss.c
index f8302b703a30..91114c7aeff5 100644
--- a/sound/core/oss/pcm_oss.c
+++ b/sound/core/oss/pcm_oss.c
@@ -208,9 +208,8 @@ static int snd_pcm_oss_period_size(struct snd_pcm_substream *substream,
                         oss_buffer_size = runtime->oss.mmap_bytes;
         }
 
-        if (substream->oss.setup &&
-            substream->oss.setup->period_size > 16)
-                oss_period_size = substream->oss.setup->period_size;
+        if (substream->oss.setup.period_size > 16)
+                oss_period_size = substream->oss.setup.period_size;
         else if (runtime->oss.fragshift) {
                 oss_period_size = 1 << runtime->oss.fragshift;
                 if (oss_period_size > oss_buffer_size / 2)
@@ -252,10 +251,8 @@ static int snd_pcm_oss_period_size(struct snd_pcm_substream *substream,
 
         oss_periods = oss_buffer_size / oss_period_size;
 
-        if (substream->oss.setup) {
-                if (substream->oss.setup->periods > 1)
-                        oss_periods = substream->oss.setup->periods;
-        }
+        if (substream->oss.setup.periods > 1)
+                oss_periods = substream->oss.setup.periods;
 
         s = snd_pcm_hw_param_value_max(slave_params, SNDRV_PCM_HW_PARAM_PERIODS, NULL);
         if (runtime->oss.maxfrags && s > runtime->oss.maxfrags)
@@ -341,12 +338,10 @@ static int snd_pcm_oss_change_params(struct snd_pcm_substream *substream)
                 goto failure;
         }
 
-        if (atomic_read(&runtime->mmap_count)) {
+        if (atomic_read(&runtime->mmap_count))
                 direct = 1;
-        } else {
-                struct snd_pcm_oss_setup *setup = substream->oss.setup;
-                direct = (setup != NULL && setup->direct);
-        }
+        else
+                direct = substream->oss.setup.direct;
 
         _snd_pcm_hw_params_any(sparams);
         _snd_pcm_hw_param_setinteger(sparams, SNDRV_PCM_HW_PARAM_PERIODS);
@@ -482,7 +477,7 @@ static int snd_pcm_oss_change_params(struct snd_pcm_substream *substream)
                 1 : runtime->period_size;
         sw_params->xfer_align = 1;
         if (atomic_read(&runtime->mmap_count) ||
-            (substream->oss.setup && substream->oss.setup->nosilence)) {
+            substream->oss.setup.nosilence) {
                 sw_params->silence_threshold = 0;
                 sw_params->silence_size = 0;
         } else {
@@ -843,7 +838,7 @@ static ssize_t snd_pcm_oss_write1(struct snd_pcm_substream *substream, const cha
                         buf += tmp;
                         bytes -= tmp;
                         xfer += tmp;
-                        if ((substream->oss.setup != NULL && substream->oss.setup->partialfrag) ||
+                        if (substream->oss.setup.partialfrag ||
                             runtime->oss.buffer_used == runtime->oss.period_bytes) {
                                 tmp = snd_pcm_oss_write2(substream, runtime->oss.buffer + runtime->oss.period_ptr, 
                                                          runtime->oss.buffer_used - runtime->oss.period_ptr, 1);
@@ -959,12 +954,12 @@ static int snd_pcm_oss_reset(struct snd_pcm_oss_file *pcm_oss_file)
 
         substream = pcm_oss_file->streams[SNDRV_PCM_STREAM_PLAYBACK];
         if (substream != NULL) {
-                snd_pcm_kernel_playback_ioctl(substream, SNDRV_PCM_IOCTL_DROP, NULL);
+                snd_pcm_kernel_ioctl(substream, SNDRV_PCM_IOCTL_DROP, NULL);
                 substream->runtime->oss.prepare = 1;
         }
         substream = pcm_oss_file->streams[SNDRV_PCM_STREAM_CAPTURE];
         if (substream != NULL) {
-                snd_pcm_kernel_capture_ioctl(substream, SNDRV_PCM_IOCTL_DROP, NULL);
+                snd_pcm_kernel_ioctl(substream, SNDRV_PCM_IOCTL_DROP, NULL);
                 substream->runtime->oss.prepare = 1;
         }
         return 0;
@@ -979,7 +974,7 @@ static int snd_pcm_oss_post(struct snd_pcm_oss_file *pcm_oss_file)
         if (substream != NULL) {
                 if ((err = snd_pcm_oss_make_ready(substream)) < 0)
                         return err;
-                snd_pcm_kernel_playback_ioctl(substream, SNDRV_PCM_IOCTL_START, NULL);
+                snd_pcm_kernel_ioctl(substream, SNDRV_PCM_IOCTL_START, NULL);
         }
         /* note: all errors from the start action are ignored */
         /* OSS apps do not know, how to handle them */
@@ -1108,7 +1103,7 @@ static int snd_pcm_oss_sync(struct snd_pcm_oss_file *pcm_oss_file)
               __direct:
                 saved_f_flags = substream->ffile->f_flags;
                 substream->ffile->f_flags &= ~O_NONBLOCK;
-                err = snd_pcm_kernel_playback_ioctl(substream, SNDRV_PCM_IOCTL_DRAIN, NULL);
+                err = snd_pcm_kernel_ioctl(substream, SNDRV_PCM_IOCTL_DRAIN, NULL);
                 substream->ffile->f_flags = saved_f_flags;
                 if (err < 0)
                         return err;
@@ -1120,7 +1115,7 @@ static int snd_pcm_oss_sync(struct snd_pcm_oss_file *pcm_oss_file)
                 if ((err = snd_pcm_oss_make_ready(substream)) < 0)
                         return err;
                 runtime = substream->runtime;
-                err = snd_pcm_kernel_capture_ioctl(substream, SNDRV_PCM_IOCTL_DROP, NULL);
+                err = snd_pcm_kernel_ioctl(substream, SNDRV_PCM_IOCTL_DROP, NULL);
                 if (err < 0)
                         return err;
                 runtime->oss.buffer_used = 0;
@@ -1214,12 +1209,10 @@ static int snd_pcm_oss_get_formats(struct snd_pcm_oss_file *pcm_oss_file)
 
         if ((err = snd_pcm_oss_get_active_substream(pcm_oss_file, &substream)) < 0)
                 return err;
-        if (atomic_read(&substream->runtime->mmap_count)) {
+        if (atomic_read(&substream->runtime->mmap_count))
                 direct = 1;
-        } else {
-                struct snd_pcm_oss_setup *setup = substream->oss.setup;
-                direct = (setup != NULL && setup->direct);
-        }
+        else
+                direct = substream->oss.setup.direct;
         if (!direct)
                 return AFMT_MU_LAW | AFMT_U8 |
                        AFMT_S16_LE | AFMT_S16_BE |
@@ -1437,7 +1430,7 @@ static int snd_pcm_oss_set_trigger(struct snd_pcm_oss_file *pcm_oss_file, int tr
                         cmd = SNDRV_PCM_IOCTL_DROP;
                         runtime->oss.prepare = 1;
                 }
-                err = snd_pcm_kernel_playback_ioctl(psubstream, cmd, NULL);
+                err = snd_pcm_kernel_ioctl(psubstream, cmd, NULL);
                 if (err < 0)
                         return err;
         }
@@ -1458,7 +1451,7 @@ static int snd_pcm_oss_set_trigger(struct snd_pcm_oss_file *pcm_oss_file, int tr
                         cmd = SNDRV_PCM_IOCTL_DROP;
                         runtime->oss.prepare = 1;
                 }
-                err = snd_pcm_kernel_capture_ioctl(csubstream, cmd, NULL);
+                err = snd_pcm_kernel_ioctl(csubstream, cmd, NULL);
                 if (err < 0)
                         return err;
         }
@@ -1495,7 +1488,7 @@ static int snd_pcm_oss_get_odelay(struct snd_pcm_oss_file *pcm_oss_file)
         runtime = substream->runtime;
         if (runtime->oss.params || runtime->oss.prepare)
                 return 0;
-        err = snd_pcm_kernel_playback_ioctl(substream, SNDRV_PCM_IOCTL_DELAY, &delay);
+        err = snd_pcm_kernel_ioctl(substream, SNDRV_PCM_IOCTL_DELAY, &delay);
         if (err == -EPIPE)
                 delay = 0;      /* hack for broken OSS applications */
         else if (err < 0)
@@ -1555,8 +1548,7 @@ static int snd_pcm_oss_get_ptr(struct snd_pcm_oss_file *pcm_oss_file, int stream
         } else {
                 delay = snd_pcm_oss_bytes(substream, delay);
                 if (stream == SNDRV_PCM_STREAM_PLAYBACK) {
-                        struct snd_pcm_oss_setup *setup = substream->oss.setup;
-                        if (setup && setup->buggyptr)
+                        if (substream->oss.setup.buggyptr)
                                 info.blocks = (runtime->oss.buffer_bytes - delay - fixup) / runtime->oss.period_bytes;
                         else
                                 info.blocks = (delay + fixup) / runtime->oss.period_bytes;
@@ -1638,37 +1630,46 @@ static int snd_pcm_oss_get_mapbuf(struct snd_pcm_oss_file *pcm_oss_file, int str
         return -EINVAL;
 }
 
-static struct snd_pcm_oss_setup *snd_pcm_oss_look_for_setup(struct snd_pcm *pcm, int stream, const char *task_name)
+static const char *strip_task_path(const char *path)
 {
-        const char *ptr, *ptrl;
-        struct snd_pcm_oss_setup *setup;
-
-        mutex_lock(&pcm->streams[stream].oss.setup_mutex);
-        for (setup = pcm->streams[stream].oss.setup_list; setup; setup = setup->next) {
-                if (!strcmp(setup->task_name, task_name)) {
-                        mutex_unlock(&pcm->streams[stream].oss.setup_mutex);
-                        return setup;
-                }
-        }
-        ptr = ptrl = task_name;
-        while (*ptr) {
+        const char *ptr, *ptrl = NULL;
+        for (ptr = path; *ptr; ptr++) {
                 if (*ptr == '/')
                         ptrl = ptr + 1;
-                ptr++;
         }
-        if (ptrl == task_name) {
-                goto __not_found;
-                return NULL;
-        }
-        for (setup = pcm->streams[stream].oss.setup_list; setup; setup = setup->next) {
-                if (!strcmp(setup->task_name, ptrl)) {
-                        mutex_unlock(&pcm->streams[stream].oss.setup_mutex);
-                        return setup;
+        return ptrl;
+}
+
+static void snd_pcm_oss_look_for_setup(struct snd_pcm *pcm, int stream,
+                                      const char *task_name,
+                                      struct snd_pcm_oss_setup *rsetup)
+{
+        struct snd_pcm_oss_setup *setup;
+
+        mutex_lock(&pcm->streams[stream].oss.setup_mutex);
+        do {
+                for (setup = pcm->streams[stream].oss.setup_list; setup;
+                     setup = setup->next) {
+                        if (!strcmp(setup->task_name, task_name))
+                                goto out;
                 }
-        }
-      __not_found:
+        } while ((task_name = strip_task_path(task_name)) != NULL);
+ out:
+        if (setup)
+                *rsetup = *setup;
         mutex_unlock(&pcm->streams[stream].oss.setup_mutex);
-        return NULL;
+}
+
+static void snd_pcm_oss_release_substream(struct snd_pcm_substream *substream)
+{
+        struct snd_pcm_runtime *runtime;
+        runtime = substream->runtime;
+        vfree(runtime->oss.buffer);
+        runtime->oss.buffer = NULL;
+#ifdef CONFIG_SND_PCM_OSS_PLUGINS
+        snd_pcm_oss_plugin_clear(substream);
+#endif
+        substream->oss.oss = 0;
 }
 
 static void snd_pcm_oss_init_substream(struct snd_pcm_substream *substream,
@@ -1678,7 +1679,11 @@ static void snd_pcm_oss_init_substream(struct snd_pcm_substream *substream,
         struct snd_pcm_runtime *runtime;
 
         substream->oss.oss = 1;
-        substream->oss.setup = setup;
+        substream->oss.setup = *setup;
+        if (setup->nonblock)
+                substream->ffile->f_flags |= O_NONBLOCK;
+        else
+                substream->ffile->f_flags &= ~O_NONBLOCK;
         runtime = substream->runtime;
         runtime->oss.params = 1;
         runtime->oss.trigger = 1;
@@ -1697,18 +1702,7 @@ static void snd_pcm_oss_init_substream(struct snd_pcm_substream *substream,
         runtime->oss.fragshift = 0;
         runtime->oss.maxfrags = 0;
         runtime->oss.subdivision = 0;
-}
-
-static void snd_pcm_oss_release_substream(struct snd_pcm_substream *substream)
-{
-        struct snd_pcm_runtime *runtime;
-        runtime = substream->runtime;
-        vfree(runtime->oss.buffer);
-#ifdef CONFIG_SND_PCM_OSS_PLUGINS
-        snd_pcm_oss_plugin_clear(substream);
-#endif
-        substream->oss.file = NULL;
-        substream->oss.oss = 0;
+        substream->pcm_release = snd_pcm_oss_release_substream;
 }
 
 static int snd_pcm_oss_release_file(struct snd_pcm_oss_file *pcm_oss_file)
@@ -1717,23 +1711,8 @@ static int snd_pcm_oss_release_file(struct snd_pcm_oss_file *pcm_oss_file)
         snd_assert(pcm_oss_file != NULL, return -ENXIO);
         for (cidx = 0; cidx < 2; ++cidx) {
                 struct snd_pcm_substream *substream = pcm_oss_file->streams[cidx];
-                struct snd_pcm_runtime *runtime;
-                if (substream == NULL)
-                        continue;
-                runtime = substream->runtime;
-                
-                snd_pcm_stream_lock_irq(substream);
-                if (snd_pcm_running(substream))
-                        snd_pcm_stop(substream, SNDRV_PCM_STATE_SETUP);
-                snd_pcm_stream_unlock_irq(substream);
-                if (substream->ffile != NULL) {
-                        if (substream->ops->hw_free != NULL)
-                                substream->ops->hw_free(substream);
-                        substream->ops->close(substream);
-                        substream->ffile = NULL;
-                }
-                snd_pcm_oss_release_substream(substream);
-                snd_pcm_release_substream(substream);
+                if (substream)
+                        snd_pcm_release_substream(substream);
         }
         kfree(pcm_oss_file);
         return 0;
@@ -1743,12 +1722,11 @@ static int snd_pcm_oss_open_file(struct file *file,
                                  struct snd_pcm *pcm,
                                  struct snd_pcm_oss_file **rpcm_oss_file,
                                  int minor,
-                                 struct snd_pcm_oss_setup *psetup,
-                                 struct snd_pcm_oss_setup *csetup)
+                                 struct snd_pcm_oss_setup *setup)
 {
-        int err = 0;
+        int idx, err;
         struct snd_pcm_oss_file *pcm_oss_file;
-        struct snd_pcm_substream *psubstream = NULL, *csubstream = NULL;
+        struct snd_pcm_substream *substream;
         unsigned int f_mode = file->f_mode;
 
         snd_assert(rpcm_oss_file != NULL, return -EINVAL);
@@ -1761,73 +1739,31 @@ static int snd_pcm_oss_open_file(struct file *file,
         if ((f_mode & (FMODE_WRITE|FMODE_READ)) == (FMODE_WRITE|FMODE_READ) &&
             (pcm->info_flags & SNDRV_PCM_INFO_HALF_DUPLEX))
                 f_mode = FMODE_WRITE;
-        if ((f_mode & FMODE_WRITE) && !(psetup && psetup->disable)) {
-                if ((err = snd_pcm_open_substream(pcm, SNDRV_PCM_STREAM_PLAYBACK,
-                                               &psubstream)) < 0) {
+
+        for (idx = 0; idx < 2; idx++) {
+                if (setup[idx].disable)
+                        continue;
+                if (idx == SNDRV_PCM_STREAM_PLAYBACK) {
+                        if (! (f_mode & FMODE_WRITE))
+                                continue;
+                } else {
+                        if (! (f_mode & FMODE_READ))
+                                continue;
+                }
+                err = snd_pcm_open_substream(pcm, idx, file, &substream);
+                if (err < 0) {
                         snd_pcm_oss_release_file(pcm_oss_file);
                         return err;
                 }
-                pcm_oss_file->streams[SNDRV_PCM_STREAM_PLAYBACK] = psubstream;
-        }
-        if ((f_mode & FMODE_READ) && !(csetup && csetup->disable)) {
-                if ((err = snd_pcm_open_substream(pcm, SNDRV_PCM_STREAM_CAPTURE, 
-                                               &csubstream)) < 0) {
-                        if (!(f_mode & FMODE_WRITE) || err != -ENODEV) {
-                                snd_pcm_oss_release_file(pcm_oss_file);
-                                return err;
-                        } else {
-                                csubstream = NULL;
-                        }
-                }
-                pcm_oss_file->streams[SNDRV_PCM_STREAM_CAPTURE] = csubstream;
+
+                pcm_oss_file->streams[idx] = substream;
+                snd_pcm_oss_init_substream(substream, &setup[idx], minor);
         }
         
-        if (psubstream == NULL && csubstream == NULL) {
+        if (! pcm_oss_file->streams[0] && pcm_oss_file->streams[1]) {
                 snd_pcm_oss_release_file(pcm_oss_file);
                 return -EINVAL;
         }
-        if (psubstream != NULL) {
-                psubstream->oss.file = pcm_oss_file;
-                err = snd_pcm_hw_constraints_init(psubstream);
-                if (err < 0) {
-                        snd_printd("snd_pcm_hw_constraint_init failed\n");
-                        snd_pcm_oss_release_file(pcm_oss_file);
-                        return err;
-                }
-                if ((err = psubstream->ops->open(psubstream)) < 0) {
-                        snd_pcm_oss_release_file(pcm_oss_file);
-                        return err;
-                }
-                psubstream->ffile = file;
-                err = snd_pcm_hw_constraints_complete(psubstream);
-                if (err < 0) {
-                        snd_printd("snd_pcm_hw_constraint_complete failed\n");
-                        snd_pcm_oss_release_file(pcm_oss_file);
-                        return err;
-                }
-                snd_pcm_oss_init_substream(psubstream, psetup, minor);
-        }
-        if (csubstream != NULL) {
-                csubstream->oss.file = pcm_oss_file;
-                err = snd_pcm_hw_constraints_init(csubstream);
-                if (err < 0) {
-                        snd_printd("snd_pcm_hw_constraint_init failed\n");
-                        snd_pcm_oss_release_file(pcm_oss_file);
-                        return err;
-                }
-                if ((err = csubstream->ops->open(csubstream)) < 0) {
-                        snd_pcm_oss_release_file(pcm_oss_file);
-                        return err;
-                }
-                csubstream->ffile = file;
-                err = snd_pcm_hw_constraints_complete(csubstream);
-                if (err < 0) {
-                        snd_printd("snd_pcm_hw_constraint_complete failed\n");
-                        snd_pcm_oss_release_file(pcm_oss_file);
-                        return err;
-                }
-                snd_pcm_oss_init_substream(csubstream, csetup, minor);
-        }
 
         file->private_data = pcm_oss_file;
         *rpcm_oss_file = pcm_oss_file;
@@ -1852,7 +1788,7 @@ static int snd_pcm_oss_open(struct inode *inode, struct file *file)
         char task_name[32];
         struct snd_pcm *pcm;
         struct snd_pcm_oss_file *pcm_oss_file;
-        struct snd_pcm_oss_setup *psetup = NULL, *csetup = NULL;
+        struct snd_pcm_oss_setup setup[2];
         int nonblock;
         wait_queue_t wait;
 
@@ -1873,23 +1809,15 @@ static int snd_pcm_oss_open(struct inode *inode, struct file *file)
                 err = -EFAULT;
                 goto __error;
         }
+        memset(setup, 0, sizeof(*setup));
         if (file->f_mode & FMODE_WRITE)
-                psetup = snd_pcm_oss_look_for_setup(pcm, SNDRV_PCM_STREAM_PLAYBACK, task_name);
+                snd_pcm_oss_look_for_setup(pcm, SNDRV_PCM_STREAM_PLAYBACK,
+                                           task_name, &setup[0]);
         if (file->f_mode & FMODE_READ)
-                csetup = snd_pcm_oss_look_for_setup(pcm, SNDRV_PCM_STREAM_CAPTURE, task_name);
+                snd_pcm_oss_look_for_setup(pcm, SNDRV_PCM_STREAM_CAPTURE,
+                                           task_name, &setup[1]);
 
         nonblock = !!(file->f_flags & O_NONBLOCK);
-        if (psetup && !psetup->disable) {
-                if (psetup->nonblock)
-                        nonblock = 1;
-                else if (psetup->block)
-                        nonblock = 0;
-        } else if (csetup && !csetup->disable) {
-                if (csetup->nonblock)
-                        nonblock = 1;
-                else if (csetup->block)
-                        nonblock = 0;
-        }
         if (!nonblock)
                 nonblock = nonblock_open;
 
@@ -1898,7 +1826,7 @@ static int snd_pcm_oss_open(struct inode *inode, struct file *file)
         mutex_lock(&pcm->open_mutex);
         while (1) {
                 err = snd_pcm_oss_open_file(file, pcm, &pcm_oss_file,
-                                            iminor(inode), psetup, csetup);
+                                            iminor(inode), setup);
                 if (err >= 0)
                         break;
                 if (err == -EAGAIN) {
@@ -2312,13 +2240,8 @@ static void snd_pcm_oss_proc_read(struct snd_info_entry *entry,
 
 static void snd_pcm_oss_proc_free_setup_list(struct snd_pcm_str * pstr)
 {
-        unsigned int idx;
-        struct snd_pcm_substream *substream;
         struct snd_pcm_oss_setup *setup, *setupn;
 
-        for (idx = 0, substream = pstr->substream;
-             idx < pstr->substream_count; idx++, substream = substream->next)
-                substream->oss.setup = NULL;
         for (setup = pstr->oss.setup_list, pstr->oss.setup_list = NULL;
              setup; setup = setupn) {
                 setupn = setup->next;
@@ -2379,21 +2302,28 @@ static void snd_pcm_oss_proc_write(struct snd_info_entry *entry,
                         }
                 } while (*str);
                 if (setup == NULL) {
-                        setup = kmalloc(sizeof(struct snd_pcm_oss_setup), GFP_KERNEL);
-                        if (setup) {
-                                if (pstr->oss.setup_list == NULL) {
-                                        pstr->oss.setup_list = setup;
-                                } else {
-                                        for (setup1 = pstr->oss.setup_list; setup1->next; setup1 = setup1->next);
-                                        setup1->next = setup;
-                                }
-                                template.task_name = kstrdup(task_name, GFP_KERNEL);
-                        } else {
+                        setup = kmalloc(sizeof(*setup), GFP_KERNEL);
+                        if (! setup) {
+                                buffer->error = -ENOMEM;
+                                mutex_lock(&pstr->oss.setup_mutex);
+                                return;
+                        }
+                        if (pstr->oss.setup_list == NULL)
+                                pstr->oss.setup_list = setup;
+                        else {
+                                for (setup1 = pstr->oss.setup_list;
+                                     setup1->next; setup1 = setup1->next);
+                                setup1->next = setup;
+                        }
+                        template.task_name = kstrdup(task_name, GFP_KERNEL);
+                        if (! template.task_name) {
+                                kfree(setup);
                                 buffer->error = -ENOMEM;
+                                mutex_lock(&pstr->oss.setup_mutex);
+                                return;
                         }
                 }
-                if (setup)
-                        *setup = template;
+                *setup = template;
                 mutex_unlock(&pstr->oss.setup_mutex);
         }
 }
diff --git a/sound/core/pcm.c b/sound/core/pcm.c
index 3da6a38c2d0f..5d7eb123b999 100644
--- a/sound/core/pcm.c
+++ b/sound/core/pcm.c
@@ -777,8 +777,9 @@ static void snd_pcm_tick_timer_func(unsigned long data)
         snd_pcm_tick_elapsed(substream);
 }
 
-int snd_pcm_open_substream(struct snd_pcm *pcm, int stream,
-                           struct snd_pcm_substream **rsubstream)
+int snd_pcm_attach_substream(struct snd_pcm *pcm, int stream,
+                             struct file *file,
+                             struct snd_pcm_substream **rsubstream)
 {
         struct snd_pcm_str * pstr;
         struct snd_pcm_substream *substream;
@@ -793,7 +794,7 @@ int snd_pcm_open_substream(struct snd_pcm *pcm, int stream,
         *rsubstream = NULL;
         snd_assert(pcm != NULL, return -ENXIO);
         pstr = &pcm->streams[stream];
-        if (pstr->substream == NULL)
+        if (pstr->substream == NULL || pstr->substream_count == 0)
                 return -ENODEV;
 
         card = pcm->card;
@@ -807,8 +808,6 @@ int snd_pcm_open_substream(struct snd_pcm *pcm, int stream,
         }
         up_read(&card->controls_rwsem);
 
-        if (pstr->substream_count == 0)
-                return -ENODEV;
         switch (stream) {
         case SNDRV_PCM_STREAM_PLAYBACK:
                 if (pcm->info_flags & SNDRV_PCM_INFO_HALF_DUPLEX) {
@@ -874,12 +873,13 @@ int snd_pcm_open_substream(struct snd_pcm *pcm, int stream,
 
         substream->runtime = runtime;
         substream->private_data = pcm->private_data;
+        substream->ffile = file;
         pstr->substream_opened++;
         *rsubstream = substream;
         return 0;
 }
 
-void snd_pcm_release_substream(struct snd_pcm_substream *substream)
+void snd_pcm_detach_substream(struct snd_pcm_substream *substream)
 {
         struct snd_pcm_runtime *runtime;
         substream->file = NULL;
@@ -1111,8 +1111,6 @@ EXPORT_SYMBOL(snd_pcm_link_rwlock);
 EXPORT_SYMBOL(snd_pcm_suspend);
 EXPORT_SYMBOL(snd_pcm_suspend_all);
 #endif
-EXPORT_SYMBOL(snd_pcm_kernel_playback_ioctl);
-EXPORT_SYMBOL(snd_pcm_kernel_capture_ioctl);
 EXPORT_SYMBOL(snd_pcm_kernel_ioctl);
 EXPORT_SYMBOL(snd_pcm_mmap_data);
 #if SNDRV_PCM_INFO_MMAP_IOMEM
diff --git a/sound/core/pcm_lib.c b/sound/core/pcm_lib.c
index eeba2f060955..230a940d00bd 100644
--- a/sound/core/pcm_lib.c
+++ b/sound/core/pcm_lib.c
@@ -2299,19 +2299,7 @@ snd_pcm_sframes_t snd_pcm_lib_write(struct snd_pcm_substream *substream, const v
         if (runtime->status->state == SNDRV_PCM_STATE_OPEN)
                 return -EBADFD;
 
-        snd_assert(substream->ffile != NULL, return -ENXIO);
         nonblock = !!(substream->ffile->f_flags & O_NONBLOCK);
-#if defined(CONFIG_SND_PCM_OSS) || defined(CONFIG_SND_PCM_OSS_MODULE)
-        if (substream->oss.oss) {
-                struct snd_pcm_oss_setup *setup = substream->oss.setup;
-                if (setup != NULL) {
-                        if (setup->nonblock)
-                                nonblock = 1;
-                        else if (setup->block)
-                                nonblock = 0;
-                }
-        }
-#endif
 
         if (runtime->access != SNDRV_PCM_ACCESS_RW_INTERLEAVED &&
             runtime->channels > 1)
@@ -2374,19 +2362,7 @@ snd_pcm_sframes_t snd_pcm_lib_writev(struct snd_pcm_substream *substream,
         if (runtime->status->state == SNDRV_PCM_STATE_OPEN)
                 return -EBADFD;
 
-        snd_assert(substream->ffile != NULL, return -ENXIO);
         nonblock = !!(substream->ffile->f_flags & O_NONBLOCK);
-#if defined(CONFIG_SND_PCM_OSS) || defined(CONFIG_SND_PCM_OSS_MODULE)
-        if (substream->oss.oss) {
-                struct snd_pcm_oss_setup *setup = substream->oss.setup;
-                if (setup != NULL) {
-                        if (setup->nonblock)
-                                nonblock = 1;
-                        else if (setup->block)
-                                nonblock = 0;
-                }
-        }
-#endif
 
         if (runtime->access != SNDRV_PCM_ACCESS_RW_NONINTERLEAVED)
                 return -EINVAL;
@@ -2596,19 +2572,7 @@ snd_pcm_sframes_t snd_pcm_lib_read(struct snd_pcm_substream *substream, void __u
         if (runtime->status->state == SNDRV_PCM_STATE_OPEN)
                 return -EBADFD;
 
-        snd_assert(substream->ffile != NULL, return -ENXIO);
         nonblock = !!(substream->ffile->f_flags & O_NONBLOCK);
-#if defined(CONFIG_SND_PCM_OSS) || defined(CONFIG_SND_PCM_OSS_MODULE)
-        if (substream->oss.oss) {
-                struct snd_pcm_oss_setup *setup = substream->oss.setup;
-                if (setup != NULL) {
-                        if (setup->nonblock)
-                                nonblock = 1;
-                        else if (setup->block)
-                                nonblock = 0;
-                }
-        }
-#endif
         if (runtime->access != SNDRV_PCM_ACCESS_RW_INTERLEAVED)
                 return -EINVAL;
         return snd_pcm_lib_read1(substream, (unsigned long)buf, size, nonblock, snd_pcm_lib_read_transfer);
@@ -2665,20 +2629,7 @@ snd_pcm_sframes_t snd_pcm_lib_readv(struct snd_pcm_substream *substream,
         if (runtime->status->state == SNDRV_PCM_STATE_OPEN)
                 return -EBADFD;
 
-        snd_assert(substream->ffile != NULL, return -ENXIO);
         nonblock = !!(substream->ffile->f_flags & O_NONBLOCK);
-#if defined(CONFIG_SND_PCM_OSS) || defined(CONFIG_SND_PCM_OSS_MODULE)
-        if (substream->oss.oss) {
-                struct snd_pcm_oss_setup *setup = substream->oss.setup;
-                if (setup != NULL) {
-                        if (setup->nonblock)
-                                nonblock = 1;
-                        else if (setup->block)
-                                nonblock = 0;
-                }
-        }
-#endif
-
         if (runtime->access != SNDRV_PCM_ACCESS_RW_NONINTERLEAVED)
                 return -EINVAL;
         return snd_pcm_lib_read1(substream, (unsigned long)bufs, frames, nonblock, snd_pcm_lib_readv_transfer);
diff --git a/sound/core/pcm_native.c b/sound/core/pcm_native.c
index 01f150f0990e..964e4c47a7f1 100644
--- a/sound/core/pcm_native.c
+++ b/sound/core/pcm_native.c
@@ -1170,7 +1170,7 @@ static int snd_pcm_resume(struct snd_pcm_substream *substream)
         int res;
 
         snd_power_lock(card);
-        if ((res = snd_power_wait(card, SNDRV_CTL_POWER_D0, substream->ffile)) >= 0)
+        if ((res = snd_power_wait(card, SNDRV_CTL_POWER_D0)) >= 0)
                 res = snd_pcm_action_lock_irq(&snd_pcm_action_resume, substream, 0);
         snd_power_unlock(card);
         return res;
@@ -1198,7 +1198,7 @@ static int snd_pcm_xrun(struct snd_pcm_substream *substream)
 
         snd_power_lock(card);
         if (runtime->status->state == SNDRV_PCM_STATE_SUSPENDED) {
-                result = snd_power_wait(card, SNDRV_CTL_POWER_D0, substream->ffile);
+                result = snd_power_wait(card, SNDRV_CTL_POWER_D0);
                 if (result < 0)
                         goto _unlock;
         }
@@ -1313,13 +1313,13 @@ static struct action_ops snd_pcm_action_prepare = {
  *
  * Prepare the PCM substream to be triggerable.
  */
-int snd_pcm_prepare(struct snd_pcm_substream *substream)
+static int snd_pcm_prepare(struct snd_pcm_substream *substream)
 {
         int res;
         struct snd_card *card = substream->pcm->card;
 
         snd_power_lock(card);
-        if ((res = snd_power_wait(card, SNDRV_CTL_POWER_D0, substream->ffile)) >= 0)
+        if ((res = snd_power_wait(card, SNDRV_CTL_POWER_D0)) >= 0)
                 res = snd_pcm_action_nonatomic(&snd_pcm_action_prepare, substream, 0);
         snd_power_unlock(card);
         return res;
@@ -1410,7 +1410,7 @@ static int snd_pcm_drain(struct snd_pcm_substream *substream)
 
         snd_power_lock(card);
         if (runtime->status->state == SNDRV_PCM_STATE_SUSPENDED) {
-                result = snd_power_wait(card, SNDRV_CTL_POWER_D0, substream->ffile);
+                result = snd_power_wait(card, SNDRV_CTL_POWER_D0);
                 if (result < 0) {
                         snd_power_unlock(card);
                         return result;
@@ -1533,7 +1533,7 @@ static int snd_pcm_drop(struct snd_pcm_substream *substream)
 
         snd_power_lock(card);
         if (runtime->status->state == SNDRV_PCM_STATE_SUSPENDED) {
-                result = snd_power_wait(card, SNDRV_CTL_POWER_D0, substream->ffile);
+                result = snd_power_wait(card, SNDRV_CTL_POWER_D0);
                 if (result < 0)
                         goto _unlock;
         }
@@ -1995,28 +1995,63 @@ static void snd_pcm_remove_file(struct snd_pcm_str *str,
         }
 }
 
-static int snd_pcm_release_file(struct snd_pcm_file * pcm_file)
+static void pcm_release_private(struct snd_pcm_substream *substream)
 {
-        struct snd_pcm_substream *substream;
-        struct snd_pcm_runtime *runtime;
-        struct snd_pcm_str * str;
+        struct snd_pcm_file *pcm_file = substream->file;
 
-        snd_assert(pcm_file != NULL, return -ENXIO);
-        substream = pcm_file->substream;
-        snd_assert(substream != NULL, return -ENXIO);
-        runtime = substream->runtime;
-        str = substream->pstr;
         snd_pcm_unlink(substream);
-        if (substream->ffile != NULL) {
+        snd_pcm_remove_file(substream->pstr, pcm_file);
+        kfree(pcm_file);
+}
+
+void snd_pcm_release_substream(struct snd_pcm_substream *substream)
+{
+        snd_pcm_drop(substream);
+        if (substream->pcm_release)
+                substream->pcm_release(substream);
+        if (substream->hw_opened) {
                 if (substream->ops->hw_free != NULL)
                         substream->ops->hw_free(substream);
                 substream->ops->close(substream);
-                substream->ffile = NULL;
+                substream->hw_opened = 0;
         }
-        snd_pcm_remove_file(str, pcm_file);
-        snd_pcm_release_substream(substream);
-        kfree(pcm_file);
+        snd_pcm_detach_substream(substream);
+}
+
+int snd_pcm_open_substream(struct snd_pcm *pcm, int stream,
+                           struct file *file,
+                           struct snd_pcm_substream **rsubstream)
+{
+        struct snd_pcm_substream *substream;
+        int err;
+
+        err = snd_pcm_attach_substream(pcm, stream, file, &substream);
+        if (err < 0)
+                return err;
+        substream->no_mmap_ctrl = 0;
+        err = snd_pcm_hw_constraints_init(substream);
+        if (err < 0) {
+                snd_printd("snd_pcm_hw_constraints_init failed\n");
+                goto error;
+        }
+
+        if ((err = substream->ops->open(substream)) < 0)
+                goto error;
+
+        substream->hw_opened = 1;
+
+        err = snd_pcm_hw_constraints_complete(substream);
+        if (err < 0) {
+                snd_printd("snd_pcm_hw_constraints_complete failed\n");
+                goto error;
+        }
+
+        *rsubstream = substream;
         return 0;
+
+ error:
+        snd_pcm_release_substream(substream);
+        return err;
 }
 
 static int snd_pcm_open_file(struct file *file,
@@ -2024,52 +2059,29 @@ static int snd_pcm_open_file(struct file *file,
                              int stream,
                              struct snd_pcm_file **rpcm_file)
 {
-        int err = 0;
         struct snd_pcm_file *pcm_file;
         struct snd_pcm_substream *substream;
         struct snd_pcm_str *str;
+        int err;
 
         snd_assert(rpcm_file != NULL, return -EINVAL);
         *rpcm_file = NULL;
 
+        err = snd_pcm_open_substream(pcm, stream, file, &substream);
+        if (err < 0)
+                return err;
+
         pcm_file = kzalloc(sizeof(*pcm_file), GFP_KERNEL);
         if (pcm_file == NULL) {
+                snd_pcm_release_substream(substream);
                 return -ENOMEM;
         }
-
-        if ((err = snd_pcm_open_substream(pcm, stream, &substream)) < 0) {
-                kfree(pcm_file);
-                return err;
-        }
-
         str = substream->pstr;
         substream->file = pcm_file;
-        substream->no_mmap_ctrl = 0;
-
+        substream->pcm_release = pcm_release_private;
         pcm_file->substream = substream;
-
         snd_pcm_add_file(str, pcm_file);
 
-        err = snd_pcm_hw_constraints_init(substream);
-        if (err < 0) {
-                snd_printd("snd_pcm_hw_constraints_init failed\n");
-                snd_pcm_release_file(pcm_file);
-                return err;
-        }
-
-        if ((err = substream->ops->open(substream)) < 0) {
-                snd_pcm_release_file(pcm_file);
-                return err;
-        }
-        substream->ffile = file;
-
-        err = snd_pcm_hw_constraints_complete(substream);
-        if (err < 0) {
-                snd_printd("snd_pcm_hw_constraints_complete failed\n");
-                snd_pcm_release_file(pcm_file);
-                return err;
-        }
-
         file->private_data = pcm_file;
         *rpcm_file = pcm_file;
         return 0;
@@ -2158,10 +2170,9 @@ static int snd_pcm_release(struct inode *inode, struct file *file)
         snd_assert(substream != NULL, return -ENXIO);
         snd_assert(!atomic_read(&substream->runtime->mmap_count), );
         pcm = substream->pcm;
-        snd_pcm_drop(substream);
         fasync_helper(-1, file, 0, &substream->runtime->fasync);
         mutex_lock(&pcm->open_mutex);
-        snd_pcm_release_file(pcm_file);
+        snd_pcm_release_substream(substream);
         mutex_unlock(&pcm->open_mutex);
         wake_up(&pcm->open_wait);
         module_put(pcm->card->module);
@@ -2480,11 +2491,6 @@ static int snd_pcm_sync_ptr(struct snd_pcm_substream *substream,
         return 0;
 }
                 
-static int snd_pcm_playback_ioctl1(struct snd_pcm_substream *substream,
-                                   unsigned int cmd, void __user *arg);
-static int snd_pcm_capture_ioctl1(struct snd_pcm_substream *substream,
-                                  unsigned int cmd, void __user *arg);
-
 static int snd_pcm_common_ioctl1(struct snd_pcm_substream *substream,
                                  unsigned int cmd, void __user *arg)
 {
@@ -2736,41 +2742,28 @@ static long snd_pcm_capture_ioctl(struct file *file, unsigned int cmd,
         return snd_pcm_capture_ioctl1(pcm_file->substream, cmd, (void __user *)arg);
 }
 
-int snd_pcm_kernel_playback_ioctl(struct snd_pcm_substream *substream,
-                                  unsigned int cmd, void *arg)
-{
-        mm_segment_t fs;
-        int result;
-        
-        fs = snd_enter_user();
-        result = snd_pcm_playback_ioctl1(substream, cmd, (void __user *)arg);
-        snd_leave_user(fs);
-        return result;
-}
-
-int snd_pcm_kernel_capture_ioctl(struct snd_pcm_substream *substream,
-                                 unsigned int cmd, void *arg)
+int snd_pcm_kernel_ioctl(struct snd_pcm_substream *substream,
+                         unsigned int cmd, void *arg)
 {
         mm_segment_t fs;
         int result;
         
         fs = snd_enter_user();
-        result = snd_pcm_capture_ioctl1(substream, cmd, (void __user *)arg);
-        snd_leave_user(fs);
-        return result;
-}
-
-int snd_pcm_kernel_ioctl(struct snd_pcm_substream *substream,
-                         unsigned int cmd, void *arg)
-{
         switch (substream->stream) {
         case SNDRV_PCM_STREAM_PLAYBACK:
-                return snd_pcm_kernel_playback_ioctl(substream, cmd, arg);
+                result = snd_pcm_playback_ioctl1(substream,
+                                                 cmd, (void __user *)arg);
+                break;
         case SNDRV_PCM_STREAM_CAPTURE:
-                return snd_pcm_kernel_capture_ioctl(substream, cmd, arg);
+                result = snd_pcm_capture_ioctl1(substream,
+                                                cmd, (void __user *)arg);
+                break;
         default:
-                return -EINVAL;
+                result = -EINVAL;
+                break;
         }
+        snd_leave_user(fs);
+        return result;
 }
 
 static ssize_t snd_pcm_read(struct file *file, char __user *buf, size_t count,
diff --git a/sound/isa/Kconfig b/sound/isa/Kconfig
index ff8fef932786..557c4de22960 100644
--- a/sound/isa/Kconfig
+++ b/sound/isa/Kconfig
@@ -11,6 +11,15 @@ config SND_CS4231_LIB
         tristate
         select SND_PCM
 
+config SND_ADLIB
+        tristate "AdLib FM card"
+        select SND_OPL3_LIB
+        help
+          Say Y here to include support for AdLib FM cards.
+
+          To compile this driver as a module, choose M here: the module
+          will be called snd-adlib.
+
 config SND_AD1816A
         tristate "Analog Devices SoundPort AD1816A"
         depends on SND && PNP && ISA
@@ -292,6 +301,20 @@ config SND_OPTI93X
           To compile this driver as a module, choose M here: the module
           will be called snd-opti93x.
 
+config SND_MIRO
+        tristate "Miro miroSOUND PCM1pro/PCM12/PCM20radio driver"
+        depends on SND
+        select SND_OPL4_LIB
+        select SND_CS4231_LIB
+        select SND_MPU401_UART
+        select SND_PCM
+        help
+          Say 'Y' or 'M' to include support for Miro miroSOUND PCM1 pro, 
+          miroSOUND PCM12 and miroSOUND PCM20 Radio soundcards.
+
+          To compile this driver as a module, choose M here: the module
+          will be called snd-miro.
+
 config SND_SB8
         tristate "Sound Blaster 1.0/2.0/Pro (8-bit)"
         depends on SND
diff --git a/sound/isa/Makefile b/sound/isa/Makefile
index 05724eb7bfe4..bb317ccc170f 100644
--- a/sound/isa/Makefile
+++ b/sound/isa/Makefile
@@ -3,6 +3,7 @@
 # Copyright (c) 2001 by Jaroslav Kysela <perex@suse.cz>
 #
 
+snd-adlib-objs := adlib.o
 snd-als100-objs := als100.o
 snd-azt2320-objs := azt2320.o
 snd-cmi8330-objs := cmi8330.o
@@ -13,6 +14,7 @@ snd-sgalaxy-objs := sgalaxy.o
 snd-sscape-objs := sscape.o
 
 # Toplevel Module Dependency
+obj-$(CONFIG_SND_ADLIB) += snd-adlib.o
 obj-$(CONFIG_SND_ALS100) += snd-als100.o
 obj-$(CONFIG_SND_AZT2320) += snd-azt2320.o
 obj-$(CONFIG_SND_CMI8330) += snd-cmi8330.o
diff --git a/sound/isa/adlib.c b/sound/isa/adlib.c
new file mode 100644
index 000000000000..a253a14e6a45
--- /dev/null
+++ b/sound/isa/adlib.c
@@ -0,0 +1,161 @@
+/*
+ * AdLib FM card driver.
+ */
+
+#include <sound/driver.h>
+#include <linux/kernel.h>
+#include <linux/module.h>
+#include <linux/platform_device.h>
+#include <sound/core.h>
+#include <sound/initval.h>
+#include <sound/opl3.h>
+
+#define CRD_NAME "AdLib FM"
+#define DRV_NAME "snd_adlib"
+
+MODULE_DESCRIPTION(CRD_NAME);
+MODULE_AUTHOR("Rene Herman");
+MODULE_LICENSE("GPL");
+
+static int index[SNDRV_CARDS] = SNDRV_DEFAULT_IDX;
+static char *id[SNDRV_CARDS] = SNDRV_DEFAULT_STR;
+static int enable[SNDRV_CARDS] = SNDRV_DEFAULT_ENABLE;
+static long port[SNDRV_CARDS] = SNDRV_DEFAULT_PORT;
+
+module_param_array(index, int, NULL, 0444);
+MODULE_PARM_DESC(index, "Index value for " CRD_NAME " soundcard.");
+module_param_array(id, charp, NULL, 0444);
+MODULE_PARM_DESC(id, "ID string for " CRD_NAME " soundcard.");
+module_param_array(enable, bool, NULL, 0444);
+MODULE_PARM_DESC(enable, "Enable " CRD_NAME " soundcard.");
+module_param_array(port, long, NULL, 0444);
+MODULE_PARM_DESC(port, "Port # for " CRD_NAME " driver.");
+
+static struct platform_device *devices[SNDRV_CARDS];
+
+static void snd_adlib_free(struct snd_card *card)
+{
+        release_and_free_resource(card->private_data);
+}
+
+static int __devinit snd_adlib_probe(struct platform_device *device)
+{
+        struct snd_card *card;
+        struct snd_opl3 *opl3;
+
+        int error;
+        int i = device->id;
+
+        if (port[i] == SNDRV_AUTO_PORT) {
+                snd_printk(KERN_ERR DRV_NAME ": please specify port\n");
+                error = -EINVAL;
+                goto out0;
+        }
+
+        card = snd_card_new(index[i], id[i], THIS_MODULE, 0);
+        if (!card) {
+                snd_printk(KERN_ERR DRV_NAME ": could not create card\n");
+                error = -EINVAL;
+                goto out0;
+        }
+
+        card->private_data = request_region(port[i], 4, CRD_NAME);
+        if (!card->private_data) {
+                snd_printk(KERN_ERR DRV_NAME ": could not grab ports\n");
+                error = -EBUSY;
+                goto out1;
+        }
+        card->private_free = snd_adlib_free;
+
+        error = snd_opl3_create(card, port[i], port[i] + 2, OPL3_HW_AUTO, 1, &opl3);
+        if (error < 0) {
+                snd_printk(KERN_ERR DRV_NAME ": could not create OPL\n");
+                goto out1;
+        }
+
+        error = snd_opl3_hwdep_new(opl3, 0, 0, NULL);
+        if (error < 0) {
+                snd_printk(KERN_ERR DRV_NAME ": could not create FM\n");
+                goto out1;
+        }
+
+        strcpy(card->driver, DRV_NAME);
+        strcpy(card->shortname, CRD_NAME);
+        sprintf(card->longname, CRD_NAME " at %#lx", port[i]);
+
+        snd_card_set_dev(card, &device->dev);
+
+        error = snd_card_register(card);
+        if (error < 0) {
+                snd_printk(KERN_ERR DRV_NAME ": could not register card\n");
+                goto out1;
+        }
+
+        platform_set_drvdata(device, card);
+        return 0;
+
+out1:   snd_card_free(card);
+ out0:  error = -EINVAL; /* FIXME: should be the original error code */
+        return error;
+}
+
+static int __devexit snd_adlib_remove(struct platform_device *device)
+{
+        snd_card_free(platform_get_drvdata(device));
+        platform_set_drvdata(device, NULL);
+        return 0;
+}
+
+static struct platform_driver snd_adlib_driver = {
+        .probe          = snd_adlib_probe,
+        .remove         = __devexit_p(snd_adlib_remove),
+
+        .driver         = {
+                .name   = DRV_NAME
+        }
+};
+
+static int __init alsa_card_adlib_init(void)
+{
+        int i, cards;
+
+        if (platform_driver_register(&snd_adlib_driver) < 0) {
+                snd_printk(KERN_ERR DRV_NAME ": could not register driver\n");
+                return -ENODEV;
+        }
+
+        for (cards = 0, i = 0; i < SNDRV_CARDS; i++) {
+                struct platform_device *device;
+
+                if (!enable[i])
+                        continue;
+
+                device = platform_device_register_simple(DRV_NAME, i, NULL, 0);
+                if (IS_ERR(device))
+                        continue;
+
+                devices[i] = device;
+                cards++;
+        }
+
+        if (!cards) {
+#ifdef MODULE
+                printk(KERN_ERR CRD_NAME " soundcard not found or device busy\n");
+#endif
+                platform_driver_unregister(&snd_adlib_driver);
+                return -ENODEV;
+        }
+        return 0;
+}
+
+static void __exit alsa_card_adlib_exit(void)
+{
+        int i;
+
+        for (i = 0; i < SNDRV_CARDS; i++)
+                platform_device_unregister(devices[i]);
+        platform_driver_unregister(&snd_adlib_driver);
+}
+
+module_init(alsa_card_adlib_init);
+module_exit(alsa_card_adlib_exit);
diff --git a/sound/isa/cmi8330.c b/sound/isa/cmi8330.c
index fa63048a8b9d..bc0f5ebf5d3c 100644
--- a/sound/isa/cmi8330.c
+++ b/sound/isa/cmi8330.c
@@ -693,9 +693,9 @@ static int __init alsa_card_cmi8330_init(void)
         if ((err = platform_driver_register(&snd_cmi8330_driver)) < 0)
                 return err;
 
-        for (i = 0; i < SNDRV_CARDS && enable[i]; i++) {
+        for (i = 0; i < SNDRV_CARDS; i++) {
                 struct platform_device *device;
-                if (is_isapnp_selected(i))
+                if (! enable[i] || is_isapnp_selected(i))
                         continue;
                 device = platform_device_register_simple(CMI8330_DRIVER,
                                                          i, NULL, 0);
diff --git a/sound/isa/opti9xx/Makefile b/sound/isa/opti9xx/Makefile
index 28c64070cd56..0e41bfd5a403 100644
--- a/sound/isa/opti9xx/Makefile
+++ b/sound/isa/opti9xx/Makefile
@@ -6,8 +6,10 @@
 snd-opti92x-ad1848-objs := opti92x-ad1848.o
 snd-opti92x-cs4231-objs := opti92x-cs4231.o
 snd-opti93x-objs := opti93x.o
+snd-miro-objs := miro.o
 
 # Toplevel Module Dependency
 obj-$(CONFIG_SND_OPTI92X_AD1848) += snd-opti92x-ad1848.o
 obj-$(CONFIG_SND_OPTI92X_CS4231) += snd-opti92x-cs4231.o
 obj-$(CONFIG_SND_OPTI93X) += snd-opti93x.o
+obj-$(CONFIG_SND_MIRO) += snd-miro.o
diff --git a/sound/isa/opti9xx/miro.c b/sound/isa/opti9xx/miro.c
new file mode 100644
index 000000000000..09384d03dc31
--- /dev/null
+++ b/sound/isa/opti9xx/miro.c
@@ -0,0 +1,1455 @@
+/*
+ *   ALSA soundcard driver for Miro miroSOUND PCM1 pro
+ *                                  miroSOUND PCM12
+ *                                  miroSOUND PCM20 Radio
+ *
+ *   Copyright (C) 2004-2005 Martin Langer <martin-langer@gmx.de>
+ *
+ *   Based on OSS ACI and ALSA OPTi9xx drivers
+ *
+ *   This program is free software; you can redistribute it and/or modify
+ *   it under the terms of the GNU General Public License as published by
+ *   the Free Software Foundation; either version 2 of the License, or
+ *   (at your option) any later version.
+ *
+ *   This program is distributed in the hope that it will be useful,
+ *   but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ *   GNU General Public License for more details.
+ *
+ *   You should have received a copy of the GNU General Public License
+ *   along with this program; if not, write to the Free Software
+ *   Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307 USA
+ */
+
+#include <sound/driver.h>
+#include <linux/init.h>
+#include <linux/err.h>
+#include <linux/platform_device.h>
+#include <linux/delay.h>
+#include <linux/slab.h>
+#include <linux/ioport.h>
+#include <linux/moduleparam.h>
+#include <asm/io.h>
+#include <asm/dma.h>
+#include <sound/core.h>
+#include <sound/cs4231.h>
+#include <sound/mpu401.h>
+#include <sound/opl4.h>
+#include <sound/control.h>
+#include <sound/info.h>
+#define SNDRV_LEGACY_FIND_FREE_IRQ
+#define SNDRV_LEGACY_FIND_FREE_DMA
+#include <sound/initval.h>
+#include "miro.h"
+
+MODULE_AUTHOR("Martin Langer <martin-langer@gmx.de>");
+MODULE_LICENSE("GPL");
+MODULE_DESCRIPTION("Miro miroSOUND PCM1 pro, PCM12, PCM20 Radio");
+MODULE_SUPPORTED_DEVICE("{{Miro,miroSOUND PCM1 pro}, "
+                        "{Miro,miroSOUND PCM12}, "
+                        "{Miro,miroSOUND PCM20 Radio}}");
+
+static int index = SNDRV_DEFAULT_IDX1;          /* Index 0-MAX */
+static char *id = SNDRV_DEFAULT_STR1;           /* ID for this card */
+static long port = SNDRV_DEFAULT_PORT1;         /* 0x530,0xe80,0xf40,0x604 */
+static long mpu_port = SNDRV_DEFAULT_PORT1;     /* 0x300,0x310,0x320,0x330 */
+static long fm_port = SNDRV_DEFAULT_PORT1;      /* 0x388 */
+static int irq = SNDRV_DEFAULT_IRQ1;            /* 5,7,9,10,11 */
+static int mpu_irq = SNDRV_DEFAULT_IRQ1;        /* 5,7,9,10 */
+static int dma1 = SNDRV_DEFAULT_DMA1;           /* 0,1,3 */
+static int dma2 = SNDRV_DEFAULT_DMA1;           /* 0,1,3 */
+static int wss;
+static int ide;
+
+module_param(index, int, 0444);
+MODULE_PARM_DESC(index, "Index value for miro soundcard.");
+module_param(id, charp, 0444);
+MODULE_PARM_DESC(id, "ID string for miro soundcard.");
+module_param(port, long, 0444);
+MODULE_PARM_DESC(port, "WSS port # for miro driver.");
+module_param(mpu_port, long, 0444);
+MODULE_PARM_DESC(mpu_port, "MPU-401 port # for miro driver.");
+module_param(fm_port, long, 0444);
+MODULE_PARM_DESC(fm_port, "FM Port # for miro driver.");
+module_param(irq, int, 0444);
+MODULE_PARM_DESC(irq, "WSS irq # for miro driver.");
+module_param(mpu_irq, int, 0444);
+MODULE_PARM_DESC(mpu_irq, "MPU-401 irq # for miro driver.");
+module_param(dma1, int, 0444);
+MODULE_PARM_DESC(dma1, "1st dma # for miro driver.");
+module_param(dma2, int, 0444);
+MODULE_PARM_DESC(dma2, "2nd dma # for miro driver.");
+module_param(wss, int, 0444);
+MODULE_PARM_DESC(wss, "wss mode");
+module_param(ide, int, 0444);
+MODULE_PARM_DESC(ide, "enable ide port");
+
+#define OPTi9XX_HW_DETECT       0
+#define OPTi9XX_HW_82C928       1
+#define OPTi9XX_HW_82C929       2
+#define OPTi9XX_HW_82C924       3
+#define OPTi9XX_HW_82C925       4
+#define OPTi9XX_HW_82C930       5
+#define OPTi9XX_HW_82C931       6
+#define OPTi9XX_HW_82C933       7
+#define OPTi9XX_HW_LAST         OPTi9XX_HW_82C933
+
+#define OPTi9XX_MC_REG(n)       n
+
+
+struct snd_miro {
+        unsigned short hardware;
+        unsigned char password;
+        char name[7];
+
+        struct resource *res_mc_base;
+        struct resource *res_aci_port;
+
+        unsigned long mc_base;
+        unsigned long mc_base_size;
+        unsigned long pwd_reg;
+
+        spinlock_t lock;
+        struct snd_card *card;
+        struct snd_pcm *pcm;
+
+        long wss_base;
+        int irq;
+        int dma1;
+        int dma2;
+
+        long fm_port;
+
+        long mpu_port;
+        int mpu_irq;
+
+        unsigned long aci_port;
+        int aci_vendor;
+        int aci_product;
+        int aci_version;
+        int aci_amp;
+        int aci_preamp;
+        int aci_solomode;
+
+        struct mutex aci_mutex;
+};
+
+static void snd_miro_proc_init(struct snd_miro * miro);
+
+#define DRIVER_NAME "snd-miro"
+
+static struct platform_device *device;
+
+static char * snd_opti9xx_names[] = {
+        "unkown",
+        "82C928", "82C929",
+        "82C924", "82C925",
+        "82C930", "82C931", "82C933"
+};
+
+/* 
+ *  ACI control
+ */
+
+static int aci_busy_wait(struct snd_miro * miro)
+{
+        long timeout;
+        unsigned char byte;
+
+        for (timeout = 1; timeout <= ACI_MINTIME+30; timeout++) {
+                if (((byte=inb(miro->aci_port + ACI_REG_BUSY)) & 1) == 0) {
+                        if (timeout >= ACI_MINTIME)
+                                snd_printd("aci ready in round %ld.\n",
+                                           timeout-ACI_MINTIME);
+                        return byte;
+                }
+                if (timeout >= ACI_MINTIME) {
+                        long out=10*HZ;
+                        switch (timeout-ACI_MINTIME) {
+                        case 0 ... 9:
+                                out /= 10;
+                        case 10 ... 19:
+                                out /= 10;
+                        case 20 ... 30:
+                                out /= 10;
+                        default:
+                                set_current_state(TASK_UNINTERRUPTIBLE);
+                                schedule_timeout(out);
+                                break;
+                        }
+                }
+        }
+        snd_printk(KERN_ERR "aci_busy_wait() time out\n");
+        return -EBUSY;
+}
+
+static inline int aci_write(struct snd_miro * miro, unsigned char byte)
+{
+        if (aci_busy_wait(miro) >= 0) {
+                outb(byte, miro->aci_port + ACI_REG_COMMAND);
+                return 0;
+        } else {
+                snd_printk(KERN_ERR "aci busy, aci_write(0x%x) stopped.\n", byte);
+                return -EBUSY;
+        }
+}
+
+static inline int aci_read(struct snd_miro * miro)
+{
+        unsigned char byte;
+
+        if (aci_busy_wait(miro) >= 0) {
+                byte=inb(miro->aci_port + ACI_REG_STATUS);
+                return byte;
+        } else {
+                snd_printk(KERN_ERR "aci busy, aci_read() stopped.\n");
+                return -EBUSY;
+        }
+}
+
+static int aci_cmd(struct snd_miro * miro, int write1, int write2, int write3)
+{
+        int write[] = {write1, write2, write3};
+        int value, i;
+
+        if (mutex_lock_interruptible(&miro->aci_mutex))
+                return -EINTR;
+
+        for (i=0; i<3; i++) {
+                if (write[i]< 0 || write[i] > 255)
+                        break;
+                else {
+                        value = aci_write(miro, write[i]);
+                        if (value < 0)
+                                goto out;
+                }
+        }
+
+        value = aci_read(miro);
+
+out:    mutex_unlock(&miro->aci_mutex);
+        return value;
+}
+
+static int aci_getvalue(struct snd_miro * miro, unsigned char index)
+{
+        return aci_cmd(miro, ACI_STATUS, index, -1);
+}
+
+static int aci_setvalue(struct snd_miro * miro, unsigned char index, int value)
+{
+        return aci_cmd(miro, index, value, -1);
+}
+
+/*
+ *  MIXER part
+ */
+
+static int snd_miro_info_capture(struct snd_kcontrol *kcontrol,
+                                 struct snd_ctl_elem_info *uinfo)
+{
+        uinfo->type = SNDRV_CTL_ELEM_TYPE_BOOLEAN;
+        uinfo->count = 1;
+
+        return 0;
+}
+
+static int snd_miro_get_capture(struct snd_kcontrol *kcontrol,
+                                struct snd_ctl_elem_value *ucontrol)
+{
+        struct snd_miro *miro = snd_kcontrol_chip(kcontrol);
+        int value;
+
+        if ((value = aci_getvalue(miro, ACI_S_GENERAL)) < 0) {
+                snd_printk(KERN_ERR "snd_miro_get_capture() failed: %d\n", value);
+                return value;
+        }
+
+        ucontrol->value.integer.value[0] = value & 0x20;
+
+        return 0;
+}
+
+static int snd_miro_put_capture(struct snd_kcontrol *kcontrol,
+                                struct snd_ctl_elem_value *ucontrol)
+{
+        struct snd_miro *miro = snd_kcontrol_chip(kcontrol);
+        int change, value, error;
+
+        value = !(ucontrol->value.integer.value[0]);
+
+        if ((error = aci_setvalue(miro, ACI_SET_SOLOMODE, value)) < 0) {
+                snd_printk(KERN_ERR "snd_miro_put_capture() failed: %d\n", error);
+                return error;
+        }
+
+        change = (value != miro->aci_solomode);
+        miro->aci_solomode = value;
+        
+        return change;
+}
+
+static int snd_miro_info_preamp(struct snd_kcontrol *kcontrol,
+                                struct snd_ctl_elem_info *uinfo)
+{
+        uinfo->type = SNDRV_CTL_ELEM_TYPE_INTEGER;
+        uinfo->count = 1;
+        uinfo->value.integer.min = 0;
+        uinfo->value.integer.max = 3;
+
+        return 0;
+}
+
+static int snd_miro_get_preamp(struct snd_kcontrol *kcontrol,
+                               struct snd_ctl_elem_value *ucontrol)
+{
+        struct snd_miro *miro = snd_kcontrol_chip(kcontrol);
+        int value;
+
+        if (miro->aci_version <= 176) {
+
+                /* 
+                   OSS says it's not readable with versions < 176.
+                   But it doesn't work on my card,
+                   which is a PCM12 with aci_version = 176.
+                */
+
+                ucontrol->value.integer.value[0] = miro->aci_preamp;
+                return 0;
+        }
+
+        if ((value = aci_getvalue(miro, ACI_GET_PREAMP)) < 0) {
+                snd_printk(KERN_ERR "snd_miro_get_preamp() failed: %d\n", value);
+                return value;
+        }
+        
+        ucontrol->value.integer.value[0] = value;
+
+        return 0;
+}
+
+static int snd_miro_put_preamp(struct snd_kcontrol *kcontrol,
+                               struct snd_ctl_elem_value *ucontrol)
+{
+        struct snd_miro *miro = snd_kcontrol_chip(kcontrol);
+        int error, value, change;
+
+        value = ucontrol->value.integer.value[0];
+
+        if ((error = aci_setvalue(miro, ACI_SET_PREAMP, value)) < 0) {
+                snd_printk(KERN_ERR "snd_miro_put_preamp() failed: %d\n", error);
+                return error;
+        }
+
+        change = (value != miro->aci_preamp);
+        miro->aci_preamp = value;
+
+        return change;
+}
+
+static int snd_miro_info_amp(struct snd_kcontrol *kcontrol,
+                             struct snd_ctl_elem_info *uinfo)
+{
+        uinfo->type = SNDRV_CTL_ELEM_TYPE_BOOLEAN;
+        uinfo->count = 1;
+
+        return 0;
+}
+
+static int snd_miro_get_amp(struct snd_kcontrol *kcontrol,
+                            struct snd_ctl_elem_value *ucontrol)
+{
+        struct snd_miro *miro = snd_kcontrol_chip(kcontrol);
+        ucontrol->value.integer.value[0] = miro->aci_amp;
+
+        return 0;
+}
+
+static int snd_miro_put_amp(struct snd_kcontrol *kcontrol,
+                            struct snd_ctl_elem_value *ucontrol)
+{
+        struct snd_miro *miro = snd_kcontrol_chip(kcontrol);
+        int error, value, change;
+
+        value = ucontrol->value.integer.value[0];
+
+        if ((error = aci_setvalue(miro, ACI_SET_POWERAMP, value)) < 0) {
+                snd_printk(KERN_ERR "snd_miro_put_amp() to %d failed: %d\n", value, error);
+                return error;
+        }
+
+        change = (value != miro->aci_amp);
+        miro->aci_amp = value;
+
+        return change;
+}
+
+#define MIRO_DOUBLE(ctl_name, ctl_index, get_right_reg, set_right_reg) \
+{ .iface = SNDRV_CTL_ELEM_IFACE_MIXER, \
+  .name = ctl_name, \
+  .index = ctl_index, \
+  .info = snd_miro_info_double, \
+  .get = snd_miro_get_double, \
+  .put = snd_miro_put_double, \
+  .private_value = get_right_reg | (set_right_reg << 8) \
+}
+
+static int snd_miro_info_double(struct snd_kcontrol *kcontrol, 
+                                struct snd_ctl_elem_info *uinfo)
+{
+        int reg = kcontrol->private_value & 0xff;
+
+        uinfo->type = SNDRV_CTL_ELEM_TYPE_INTEGER;
+        uinfo->count = 2;
+
+        if ((reg >= ACI_GET_EQ1) && (reg <= ACI_GET_EQ7)) {
+
+                /* equalizer elements */
+
+                uinfo->value.integer.min = - 0x7f;
+                uinfo->value.integer.max = 0x7f;
+        } else {
+
+                /* non-equalizer elements */
+
+                uinfo->value.integer.min = 0;
+                uinfo->value.integer.max = 0x20;
+        }
+
+        return 0;
+}
+
+static int snd_miro_get_double(struct snd_kcontrol *kcontrol, 
+                               struct snd_ctl_elem_value *uinfo)
+{
+        struct snd_miro *miro = snd_kcontrol_chip(kcontrol);
+        int left_val, right_val;
+
+        int right_reg = kcontrol->private_value & 0xff;
+        int left_reg = right_reg + 1;
+
+        if ((right_val = aci_getvalue(miro, right_reg)) < 0) {
+                snd_printk(KERN_ERR "aci_getvalue(%d) failed: %d\n", right_reg, right_val);
+                return right_val;
+        }
+
+        if ((left_val = aci_getvalue(miro, left_reg)) < 0) {
+                snd_printk(KERN_ERR "aci_getvalue(%d) failed: %d\n", left_reg, left_val);
+                return left_val;
+        }
+
+        if ((right_reg >= ACI_GET_EQ1) && (right_reg <= ACI_GET_EQ7)) {
+
+                /* equalizer elements */
+
+                if (left_val < 0x80) {
+                        uinfo->value.integer.value[0] = left_val;
+                } else {
+                        uinfo->value.integer.value[0] = 0x80 - left_val;
+                }
+
+                if (right_val < 0x80) {
+                        uinfo->value.integer.value[1] = right_val;
+                } else {
+                        uinfo->value.integer.value[1] = 0x80 - right_val;
+                }
+
+        } else {
+
+                /* non-equalizer elements */
+
+                uinfo->value.integer.value[0] = 0x20 - left_val;
+                uinfo->value.integer.value[1] = 0x20 - right_val;
+        }
+
+        return 0;
+}
+
+static int snd_miro_put_double(struct snd_kcontrol *kcontrol, 
+                               struct snd_ctl_elem_value *ucontrol)
+{
+        struct snd_miro *miro = snd_kcontrol_chip(kcontrol);
+        int left, right, left_old, right_old;
+        int setreg_left, setreg_right, getreg_left, getreg_right;
+        int change, error;
+
+        left = ucontrol->value.integer.value[0];
+        right = ucontrol->value.integer.value[1];
+
+        setreg_right = (kcontrol->private_value >> 8) & 0xff;
+        if (setreg_right == ACI_SET_MASTER) {
+                setreg_left = setreg_right + 1;
+        } else {
+                setreg_left = setreg_right + 8;
+        }
+
+        getreg_right = kcontrol->private_value & 0xff;
+        getreg_left = getreg_right + 1;
+
+        if ((left_old = aci_getvalue(miro, getreg_left)) < 0) {
+                snd_printk(KERN_ERR "aci_getvalue(%d) failed: %d\n", getreg_left, left_old);
+                return left_old;
+        }
+
+        if ((right_old = aci_getvalue(miro, getreg_right)) < 0) {
+                snd_printk(KERN_ERR "aci_getvalue(%d) failed: %d\n", getreg_right, right_old);
+                return right_old;
+        }
+
+        if ((getreg_right >= ACI_GET_EQ1) && (getreg_right <= ACI_GET_EQ7)) {
+
+                /* equalizer elements */
+
+                if (left_old > 0x80) 
+                        left_old = 0x80 - left_old;
+                if (right_old > 0x80) 
+                        right_old = 0x80 - right_old;
+
+                if (left >= 0) {
+                        if ((error = aci_setvalue(miro, setreg_left, left)) < 0) {
+                                snd_printk(KERN_ERR "aci_setvalue(%d) failed: %d\n",
+                                           left, error);
+                                return error;
+                        }
+                } else {
+                        if ((error = aci_setvalue(miro, setreg_left, 0x80 - left)) < 0) {
+                                snd_printk(KERN_ERR "aci_setvalue(%d) failed: %d\n",
+                                           0x80 - left, error);
+                                return error;
+                        }
+                }
+
+                if (right >= 0) {
+                        if ((error = aci_setvalue(miro, setreg_right, right)) < 0) {
+                                snd_printk(KERN_ERR "aci_setvalue(%d) failed: %d\n",
+                                           right, error);
+                                return error;
+                        }
+                } else {
+                        if ((error = aci_setvalue(miro, setreg_right, 0x80 - right)) < 0) {
+                                snd_printk(KERN_ERR "aci_setvalue(%d) failed: %d\n",
+                                           0x80 - right, error);
+                                return error;
+                        }
+                }
+
+        } else {
+
+                /* non-equalizer elements */
+
+                left_old = 0x20 - left_old;
+                right_old = 0x20 - right_old;
+
+                if ((error = aci_setvalue(miro, setreg_left, 0x20 - left)) < 0) {
+                        snd_printk(KERN_ERR "aci_setvalue(%d) failed: %d\n",
+                                   0x20 - left, error);
+                        return error;
+                }
+                if ((error = aci_setvalue(miro, setreg_right, 0x20 - right)) < 0) {
+                        snd_printk(KERN_ERR "aci_setvalue(%d) failed: %d\n",
+                                   0x20 - right, error);
+                        return error;
+                }
+        }
+
+        change = (left != left_old) || (right != right_old);
+
+        return change;
+}
+
+static struct snd_kcontrol_new snd_miro_controls[] = {
+MIRO_DOUBLE("Master Playback Volume", 0, ACI_GET_MASTER, ACI_SET_MASTER),
+MIRO_DOUBLE("Mic Playback Volume", 1, ACI_GET_MIC, ACI_SET_MIC),
+MIRO_DOUBLE("Line Playback Volume", 1, ACI_GET_LINE, ACI_SET_LINE),
+MIRO_DOUBLE("CD Playback Volume", 0, ACI_GET_CD, ACI_SET_CD),
+MIRO_DOUBLE("Synth Playback Volume", 0, ACI_GET_SYNTH, ACI_SET_SYNTH),
+MIRO_DOUBLE("PCM Playback Volume", 1, ACI_GET_PCM, ACI_SET_PCM),
+MIRO_DOUBLE("Aux Playback Volume", 2, ACI_GET_LINE2, ACI_SET_LINE2),
+};
+
+/* Equalizer with seven bands (only PCM20) 
+   from -12dB up to +12dB on each band */
+static struct snd_kcontrol_new snd_miro_eq_controls[] = {
+MIRO_DOUBLE("Tone Control - 28 Hz", 0, ACI_GET_EQ1, ACI_SET_EQ1),
+MIRO_DOUBLE("Tone Control - 160 Hz", 0, ACI_GET_EQ2, ACI_SET_EQ2),
+MIRO_DOUBLE("Tone Control - 400 Hz", 0, ACI_GET_EQ3, ACI_SET_EQ3),
+MIRO_DOUBLE("Tone Control - 1 kHz", 0, ACI_GET_EQ4, ACI_SET_EQ4),
+MIRO_DOUBLE("Tone Control - 2.5 kHz", 0, ACI_GET_EQ5, ACI_SET_EQ5),
+MIRO_DOUBLE("Tone Control - 6.3 kHz", 0, ACI_GET_EQ6, ACI_SET_EQ6),
+MIRO_DOUBLE("Tone Control - 16 kHz", 0, ACI_GET_EQ7, ACI_SET_EQ7),
+};
+
+static struct snd_kcontrol_new snd_miro_radio_control[] = {
+MIRO_DOUBLE("Radio Playback Volume", 0, ACI_GET_LINE1, ACI_SET_LINE1),
+};
+
+static struct snd_kcontrol_new snd_miro_line_control[] = {
+MIRO_DOUBLE("Line Playback Volume", 2, ACI_GET_LINE1, ACI_SET_LINE1),
+};
+
+static struct snd_kcontrol_new snd_miro_preamp_control[] = {
+{
+        .iface = SNDRV_CTL_ELEM_IFACE_MIXER,
+        .name = "Mic Boost",
+        .index = 1,
+        .info = snd_miro_info_preamp,
+        .get = snd_miro_get_preamp,
+        .put = snd_miro_put_preamp,
+}};
+
+static struct snd_kcontrol_new snd_miro_amp_control[] = {
+{
+        .iface = SNDRV_CTL_ELEM_IFACE_MIXER,
+        .name = "Line Boost",
+        .index = 0,
+        .info = snd_miro_info_amp,
+        .get = snd_miro_get_amp,
+        .put = snd_miro_put_amp,
+}};
+
+static struct snd_kcontrol_new snd_miro_capture_control[] = {
+{
+        .iface = SNDRV_CTL_ELEM_IFACE_MIXER,
+        .name = "PCM Capture Switch",
+        .index = 0,
+        .info = snd_miro_info_capture,
+        .get = snd_miro_get_capture,
+        .put = snd_miro_put_capture,
+}};
+
+static unsigned char aci_init_values[][2] __initdata = {
+        { ACI_SET_MUTE, 0x00 },
+        { ACI_SET_POWERAMP, 0x00 },
+        { ACI_SET_PREAMP, 0x00 },
+        { ACI_SET_SOLOMODE, 0x00 },
+        { ACI_SET_MIC + 0, 0x20 },
+        { ACI_SET_MIC + 8, 0x20 },
+        { ACI_SET_LINE + 0, 0x20 },
+        { ACI_SET_LINE + 8, 0x20 },
+        { ACI_SET_CD + 0, 0x20 },
+        { ACI_SET_CD + 8, 0x20 },
+        { ACI_SET_PCM + 0, 0x20 },
+        { ACI_SET_PCM + 8, 0x20 },
+        { ACI_SET_LINE1 + 0, 0x20 },
+        { ACI_SET_LINE1 + 8, 0x20 },
+        { ACI_SET_LINE2 + 0, 0x20 },
+        { ACI_SET_LINE2 + 8, 0x20 },
+        { ACI_SET_SYNTH + 0, 0x20 },
+        { ACI_SET_SYNTH + 8, 0x20 },
+        { ACI_SET_MASTER + 0, 0x20 },
+        { ACI_SET_MASTER + 1, 0x20 },
+};
+
+static int __init snd_set_aci_init_values(struct snd_miro *miro)
+{
+        int idx, error;
+
+        /* enable WSS on PCM1 */
+
+        if ((miro->aci_product == 'A') && wss) {
+                if ((error = aci_setvalue(miro, ACI_SET_WSS, wss)) < 0) {
+                        snd_printk(KERN_ERR "enabling WSS mode failed\n");
+                        return error;
+                }
+        }
+
+        /* enable IDE port */
+
+        if (ide) {
+                if ((error = aci_setvalue(miro, ACI_SET_IDE, ide)) < 0) {
+                        snd_printk(KERN_ERR "enabling IDE port failed\n");
+                        return error;
+                }
+        }
+
+        /* set common aci values */
+
+        for (idx = 0; idx < ARRAY_SIZE(aci_init_values); idx++)
+                if ((error = aci_setvalue(miro, aci_init_values[idx][0], 
+                                          aci_init_values[idx][1])) < 0) {
+                        snd_printk(KERN_ERR "aci_setvalue(%d) failed: %d\n", 
+                                   aci_init_values[idx][0], error);
+                        return error;
+                }
+
+        miro->aci_amp = 0;
+        miro->aci_preamp = 0;
+        miro->aci_solomode = 1;
+
+        return 0;
+}
+
+static int snd_miro_mixer(struct snd_miro *miro)
+{
+        struct snd_card *card;
+        unsigned int idx;
+        int err;
+
+        snd_assert(miro != NULL && miro->card != NULL, return -EINVAL);
+
+        card = miro->card;
+
+        switch (miro->hardware) {
+        case OPTi9XX_HW_82C924:
+                strcpy(card->mixername, "ACI & OPTi924");
+                break;
+        case OPTi9XX_HW_82C929:
+                strcpy(card->mixername, "ACI & OPTi929");
+                break;
+        default:
+                snd_BUG();
+                break;
+        }
+
+        for (idx = 0; idx < ARRAY_SIZE(snd_miro_controls); idx++) {
+                if ((err = snd_ctl_add(card, snd_ctl_new1(&snd_miro_controls[idx], miro))) < 0)
+                        return err;
+        }
+
+        if ((miro->aci_product == 'A') || (miro->aci_product == 'B')) {
+                /* PCM1/PCM12 with power-amp and Line 2 */
+                if ((err = snd_ctl_add(card, snd_ctl_new1(&snd_miro_line_control[0], miro))) < 0)
+                        return err;
+                if ((err = snd_ctl_add(card, snd_ctl_new1(&snd_miro_amp_control[0], miro))) < 0)
+                        return err;
+        }
+
+        if ((miro->aci_product == 'B') || (miro->aci_product == 'C')) {
+                /* PCM12/PCM20 with mic-preamp */
+                if ((err = snd_ctl_add(card, snd_ctl_new1(&snd_miro_preamp_control[0], miro))) < 0)
+                        return err;
+                if (miro->aci_version >= 176)
+                        if ((err = snd_ctl_add(card, snd_ctl_new1(&snd_miro_capture_control[0], miro))) < 0)
+                                return err;
+        }
+
+        if (miro->aci_product == 'C') {
+                /* PCM20 with radio and 7 band equalizer */
+                if ((err = snd_ctl_add(card, snd_ctl_new1(&snd_miro_radio_control[0], miro))) < 0)
+                        return err;
+                for (idx = 0; idx < ARRAY_SIZE(snd_miro_eq_controls); idx++) {
+                        if ((err = snd_ctl_add(card, snd_ctl_new1(&snd_miro_eq_controls[idx], miro))) < 0)
+                                return err;
+                }
+        }
+
+        return 0;
+}
+
+static long snd_legacy_find_free_ioport(long *port_table, long size)
+{
+        while (*port_table != -1) {
+                struct resource *res;
+                if ((res = request_region(*port_table, size, 
+                                          "ALSA test")) != NULL) {
+                        release_and_free_resource(res);
+                        return *port_table;
+                }
+                port_table++;
+        }
+        return -1;
+}
+
+static int __init snd_miro_init(struct snd_miro *chip, unsigned short hardware)
+{
+        static int opti9xx_mc_size[] = {7, 7, 10, 10, 2, 2, 2};
+
+        chip->hardware = hardware;
+        strcpy(chip->name, snd_opti9xx_names[hardware]);
+
+        chip->mc_base_size = opti9xx_mc_size[hardware];  
+
+        spin_lock_init(&chip->lock);
+
+        chip->wss_base = -1;
+        chip->irq = -1;
+        chip->dma1 = -1;
+        chip->dma2 = -1;
+        chip->fm_port = -1;
+        chip->mpu_port = -1;
+        chip->mpu_irq = -1;
+
+        switch (hardware) {
+        case OPTi9XX_HW_82C929:
+                chip->mc_base = 0xf8c;
+                chip->password = 0xe3;
+                chip->pwd_reg = 3;
+                break;
+
+        case OPTi9XX_HW_82C924:
+                chip->mc_base = 0xf8c;
+                chip->password = 0xe5;
+                chip->pwd_reg = 3;
+                break;
+
+        default:
+                snd_printk(KERN_ERR "sorry, no support for %d\n", hardware);
+                return -ENODEV;
+        }
+
+        return 0;
+}
+
+static unsigned char snd_miro_read(struct snd_miro *chip,
+                                   unsigned char reg)
+{
+        unsigned long flags;
+        unsigned char retval = 0xff;
+
+        spin_lock_irqsave(&chip->lock, flags);
+        outb(chip->password, chip->mc_base + chip->pwd_reg);
+
+        switch (chip->hardware) {
+        case OPTi9XX_HW_82C924:
+                if (reg > 7) {
+                        outb(reg, chip->mc_base + 8);
+                        outb(chip->password, chip->mc_base + chip->pwd_reg);
+                        retval = inb(chip->mc_base + 9);
+                        break;
+                }
+
+        case OPTi9XX_HW_82C929:
+                retval = inb(chip->mc_base + reg);
+                break;
+
+        default:
+                snd_printk(KERN_ERR "sorry, no support for %d\n", chip->hardware);
+        }
+
+        spin_unlock_irqrestore(&chip->lock, flags);
+        return retval;
+}
+
+static void snd_miro_write(struct snd_miro *chip, unsigned char reg,
+                           unsigned char value)
+{
+        unsigned long flags;
+
+        spin_lock_irqsave(&chip->lock, flags);
+        outb(chip->password, chip->mc_base + chip->pwd_reg);
+
+        switch (chip->hardware) {
+        case OPTi9XX_HW_82C924:
+                if (reg > 7) {
+                        outb(reg, chip->mc_base + 8);
+                        outb(chip->password, chip->mc_base + chip->pwd_reg);
+                        outb(value, chip->mc_base + 9);
+                        break;
+                }
+
+        case OPTi9XX_HW_82C929:
+                outb(value, chip->mc_base + reg);
+                break;
+
+        default:
+                snd_printk(KERN_ERR "sorry, no support for %d\n", chip->hardware);
+        }
+
+        spin_unlock_irqrestore(&chip->lock, flags);
+}
+
+
+#define snd_miro_write_mask(chip, reg, value, mask)     \
+        snd_miro_write(chip, reg,                       \
+                (snd_miro_read(chip, reg) & ~(mask)) | ((value) & (mask)))
+
+/*
+ *  Proc Interface
+ */
+
+static void snd_miro_proc_read(struct snd_info_entry * entry, 
+                               struct snd_info_buffer *buffer)
+{
+        struct snd_miro *miro = (struct snd_miro *) entry->private_data;
+        char* model = "unknown";
+
+        /* miroSOUND PCM1 pro, early PCM12 */
+
+        if ((miro->hardware == OPTi9XX_HW_82C929) &&
+            (miro->aci_vendor == 'm') && 
+            (miro->aci_product == 'A')) {
+                switch(miro->aci_version) {
+                case 3:
+                        model = "miroSOUND PCM1 pro";
+                        break;
+                default:
+                        model = "miroSOUND PCM1 pro / (early) PCM12";
+                        break;
+                }
+        }
+
+        /* miroSOUND PCM12, PCM12 (Rev. E), PCM12 pnp */
+
+        if ((miro->hardware == OPTi9XX_HW_82C924) &&
+            (miro->aci_vendor == 'm') && 
+            (miro->aci_product == 'B')) {
+                switch(miro->aci_version) {
+                case 4:
+                        model = "miroSOUND PCM12";
+                        break;
+                case 176:
+                        model = "miroSOUND PCM12 (Rev. E)";
+                        break;
+                default:
+                        model = "miroSOUND PCM12 / PCM12 pnp";
+                        break;
+                }
+        }
+
+        /* miroSOUND PCM20 radio */
+
+        if ((miro->hardware == OPTi9XX_HW_82C924) &&
+            (miro->aci_vendor == 'm') && 
+            (miro->aci_product == 'C')) {
+                switch(miro->aci_version) {
+                case 7:
+                        model = "miroSOUND PCM20 radio (Rev. E)";
+                        break;
+                default:
+                        model = "miroSOUND PCM20 radio";
+                        break;
+                }
+        }
+
+        snd_iprintf(buffer, "\nGeneral information:\n");
+        snd_iprintf(buffer, "  model   : %s\n", model);
+        snd_iprintf(buffer, "  opti    : %s\n", miro->name);
+        snd_iprintf(buffer, "  codec   : %s\n", miro->pcm->name);
+        snd_iprintf(buffer, "  port    : 0x%lx\n", miro->wss_base);
+        snd_iprintf(buffer, "  irq     : %d\n", miro->irq);
+        snd_iprintf(buffer, "  dma     : %d,%d\n\n", miro->dma1, miro->dma2);
+
+        snd_iprintf(buffer, "MPU-401:\n");
+        snd_iprintf(buffer, "  port    : 0x%lx\n", miro->mpu_port);
+        snd_iprintf(buffer, "  irq     : %d\n\n", miro->mpu_irq);
+
+        snd_iprintf(buffer, "ACI information:\n");
+        snd_iprintf(buffer, "  vendor  : ");
+        switch(miro->aci_vendor) {
+        case 'm':
+                snd_iprintf(buffer, "Miro\n");
+                break;
+        default:
+                snd_iprintf(buffer, "unknown (0x%x)\n", miro->aci_vendor);
+                break;
+        }
+
+        snd_iprintf(buffer, "  product : ");
+        switch(miro->aci_product) {
+        case 'A':
+                snd_iprintf(buffer, "miroSOUND PCM1 pro / (early) PCM12\n");
+                break;
+        case 'B':
+                snd_iprintf(buffer, "miroSOUND PCM12\n");
+                break;
+        case 'C':
+                snd_iprintf(buffer, "miroSOUND PCM20 radio\n");
+                break;
+        default:
+                snd_iprintf(buffer, "unknown (0x%x)\n", miro->aci_product);
+                break;
+        }
+
+        snd_iprintf(buffer, "  firmware: %d (0x%x)\n",
+                    miro->aci_version, miro->aci_version);
+        snd_iprintf(buffer, "  port    : 0x%lx-0x%lx\n", 
+                    miro->aci_port, miro->aci_port+2);
+        snd_iprintf(buffer, "  wss     : 0x%x\n", wss);
+        snd_iprintf(buffer, "  ide     : 0x%x\n", ide);
+        snd_iprintf(buffer, "  solomode: 0x%x\n", miro->aci_solomode);
+        snd_iprintf(buffer, "  amp     : 0x%x\n", miro->aci_amp);
+        snd_iprintf(buffer, "  preamp  : 0x%x\n", miro->aci_preamp);
+}
+
+static void __init snd_miro_proc_init(struct snd_miro * miro)
+{
+        struct snd_info_entry *entry;
+
+        if (! snd_card_proc_new(miro->card, "miro", &entry))
+                snd_info_set_text_ops(entry, miro, 1024, snd_miro_proc_read);
+}
+
+/*
+ *  Init
+ */
+
+static int __init snd_miro_configure(struct snd_miro *chip)
+{
+        unsigned char wss_base_bits;
+        unsigned char irq_bits;
+        unsigned char dma_bits;
+        unsigned char mpu_port_bits = 0;
+        unsigned char mpu_irq_bits;
+        unsigned long flags;
+
+        switch (chip->hardware) {
+        case OPTi9XX_HW_82C924:
+                snd_miro_write_mask(chip, OPTi9XX_MC_REG(6), 0x02, 0x02);
+                snd_miro_write_mask(chip, OPTi9XX_MC_REG(1), 0x80, 0x80);
+                snd_miro_write_mask(chip, OPTi9XX_MC_REG(2), 0x20, 0x20); /* OPL4 */
+                snd_miro_write_mask(chip, OPTi9XX_MC_REG(3), 0xf0, 0xff);
+                snd_miro_write_mask(chip, OPTi9XX_MC_REG(5), 0x02, 0x02);
+                break;
+        case OPTi9XX_HW_82C929:
+                /* untested init commands for OPTi929 */
+                snd_miro_write_mask(chip, OPTi9XX_MC_REG(1), 0x80, 0x80);
+                snd_miro_write_mask(chip, OPTi9XX_MC_REG(2), 0x20, 0x20); /* OPL4 */
+                snd_miro_write_mask(chip, OPTi9XX_MC_REG(4), 0x00, 0x0c);
+                snd_miro_write_mask(chip, OPTi9XX_MC_REG(5), 0x02, 0x02);
+                break;
+        default:
+                snd_printk(KERN_ERR "chip %d not supported\n", chip->hardware);
+                return -EINVAL;
+        }
+
+        switch (chip->wss_base) {
+        case 0x530:
+                wss_base_bits = 0x00;
+                break;
+        case 0x604:
+                wss_base_bits = 0x03;
+                break;
+        case 0xe80:
+                wss_base_bits = 0x01;
+                break;
+        case 0xf40:
+                wss_base_bits = 0x02;
+                break;
+        default:
+                snd_printk(KERN_ERR "WSS port 0x%lx not valid\n", chip->wss_base);
+                goto __skip_base;
+        }
+        snd_miro_write_mask(chip, OPTi9XX_MC_REG(1), wss_base_bits << 4, 0x30);
+
+__skip_base:
+        switch (chip->irq) {
+        case 5:
+                irq_bits = 0x05;
+                break;
+        case 7:
+                irq_bits = 0x01;
+                break;
+        case 9:
+                irq_bits = 0x02;
+                break;
+        case 10:
+                irq_bits = 0x03;
+                break;
+        case 11:
+                irq_bits = 0x04;
+                break;
+        default:
+                snd_printk(KERN_ERR "WSS irq # %d not valid\n", chip->irq);
+                goto __skip_resources;
+        }
+
+        switch (chip->dma1) {
+        case 0:
+                dma_bits = 0x01;
+                break;
+        case 1:
+                dma_bits = 0x02;
+                break;
+        case 3:
+                dma_bits = 0x03;
+                break;
+        default:
+                snd_printk(KERN_ERR "WSS dma1 # %d not valid\n", chip->dma1);
+                goto __skip_resources;
+        }
+
+        if (chip->dma1 == chip->dma2) {
+                snd_printk(KERN_ERR "don't want to share dmas\n");
+                return -EBUSY;
+        }
+
+        switch (chip->dma2) {
+        case 0:
+        case 1:
+                break;
+        default:
+                snd_printk(KERN_ERR "WSS dma2 # %d not valid\n", chip->dma2);
+                goto __skip_resources;
+        }
+        dma_bits |= 0x04;
+
+        spin_lock_irqsave(&chip->lock, flags);
+        outb(irq_bits << 3 | dma_bits, chip->wss_base);
+        spin_unlock_irqrestore(&chip->lock, flags);
+
+__skip_resources:
+        if (chip->hardware > OPTi9XX_HW_82C928) {
+                switch (chip->mpu_port) {
+                case 0:
+                case -1:
+                        break;
+                case 0x300:
+                        mpu_port_bits = 0x03;
+                        break;
+                case 0x310:
+                        mpu_port_bits = 0x02;
+                        break;
+                case 0x320:
+                        mpu_port_bits = 0x01;
+                        break;
+                case 0x330:
+                        mpu_port_bits = 0x00;
+                        break;
+                default:
+                        snd_printk(KERN_ERR "MPU-401 port 0x%lx not valid\n",
+                                   chip->mpu_port);
+                        goto __skip_mpu;
+                }
+
+                switch (chip->mpu_irq) {
+                case 5:
+                        mpu_irq_bits = 0x02;
+                        break;
+                case 7:
+                        mpu_irq_bits = 0x03;
+                        break;
+                case 9:
+                        mpu_irq_bits = 0x00;
+                        break;
+                case 10:
+                        mpu_irq_bits = 0x01;
+                        break;
+                default:
+                        snd_printk(KERN_ERR "MPU-401 irq # %d not valid\n",
+                                   chip->mpu_irq);
+                        goto __skip_mpu;
+                }
+
+                snd_miro_write_mask(chip, OPTi9XX_MC_REG(6),
+                        (chip->mpu_port <= 0) ? 0x00 :
+                                0x80 | mpu_port_bits << 5 | mpu_irq_bits << 3,
+                        0xf8);
+        }
+__skip_mpu:
+
+        return 0;
+}
+
+static int __init snd_card_miro_detect(struct snd_card *card, struct snd_miro *chip)
+{
+        int i, err;
+        unsigned char value;
+
+        for (i = OPTi9XX_HW_82C929; i <= OPTi9XX_HW_82C924; i++) {
+
+                if ((err = snd_miro_init(chip, i)) < 0)
+                        return err;
+
+                if ((chip->res_mc_base = request_region(chip->mc_base, chip->mc_base_size, "OPTi9xx MC")) == NULL)
+                        continue;
+
+                value = snd_miro_read(chip, OPTi9XX_MC_REG(1));
+                if ((value != 0xff) && (value != inb(chip->mc_base + 1)))
+                        if (value == snd_miro_read(chip, OPTi9XX_MC_REG(1)))
+                                return 1;
+
+                release_and_free_resource(chip->res_mc_base);
+                chip->res_mc_base = NULL;
+
+        }
+
+        return -ENODEV;
+}
+
+static int __init snd_card_miro_aci_detect(struct snd_card *card, struct snd_miro * miro)
+{
+        unsigned char regval;
+        int i;
+
+        mutex_init(&miro->aci_mutex);
+
+        /* get ACI port from OPTi9xx MC 4 */
+
+        miro->mc_base = 0xf8c;
+        regval=inb(miro->mc_base + 4);
+        miro->aci_port = (regval & 0x10) ? 0x344: 0x354;
+
+        if ((miro->res_aci_port = request_region(miro->aci_port, 3, "miro aci")) == NULL) {
+                snd_printk(KERN_ERR "aci i/o area 0x%lx-0x%lx already used.\n", 
+                           miro->aci_port, miro->aci_port+2);
+                return -ENOMEM;
+        }
+
+        /* force ACI into a known state */
+        for (i = 0; i < 3; i++)
+                if (aci_cmd(miro, ACI_ERROR_OP, -1, -1) < 0) {
+                        snd_card_free(card);
+                        snd_printk(KERN_ERR "can't force aci into known state.\n");
+                        return -ENXIO;
+                }
+
+        if ((miro->aci_vendor=aci_cmd(miro, ACI_READ_IDCODE, -1, -1)) < 0 ||
+            (miro->aci_product=aci_cmd(miro, ACI_READ_IDCODE, -1, -1)) < 0) {
+                snd_card_free(card);
+                snd_printk(KERN_ERR "can't read aci id on 0x%lx.\n", miro->aci_port);
+                return -ENXIO;
+        }
+
+        if ((miro->aci_version=aci_cmd(miro, ACI_READ_VERSION, -1, -1)) < 0) {
+                snd_card_free(card);
+                snd_printk(KERN_ERR "can't read aci version on 0x%lx.\n", 
+                           miro->aci_port);
+                return -ENXIO;
+        }
+
+        if (aci_cmd(miro, ACI_INIT, -1, -1) < 0 ||
+            aci_cmd(miro, ACI_ERROR_OP, ACI_ERROR_OP, ACI_ERROR_OP) < 0 ||
+            aci_cmd(miro, ACI_ERROR_OP, ACI_ERROR_OP, ACI_ERROR_OP) < 0) {
+                snd_printk(KERN_ERR "can't initialize aci.\n"); 
+                return -ENXIO;
+        }
+
+        return 0;
+}
+
+static void snd_card_miro_free(struct snd_card *card)
+{
+        struct snd_miro *miro = card->private_data;
+        
+        release_and_free_resource(miro->res_aci_port);
+        release_and_free_resource(miro->res_mc_base);
+}
+
+static int __init snd_miro_probe(struct platform_device *devptr)
+{
+        static long possible_ports[] = {0x530, 0xe80, 0xf40, 0x604, -1};
+        static long possible_mpu_ports[] = {0x330, 0x300, 0x310, 0x320, -1};
+        static int possible_irqs[] = {11, 9, 10, 7, -1};
+        static int possible_mpu_irqs[] = {10, 5, 9, 7, -1};
+        static int possible_dma1s[] = {3, 1, 0, -1};
+        static int possible_dma2s[][2] = {{1,-1}, {0,-1}, {-1,-1}, {0,-1}};
+
+        int error;
+        struct snd_miro *miro;
+        struct snd_cs4231 *codec;
+        struct snd_timer *timer;
+        struct snd_card *card;
+        struct snd_pcm *pcm;
+        struct snd_rawmidi *rmidi;
+
+        if (!(card = snd_card_new(index, id, THIS_MODULE,
+                                  sizeof(struct snd_miro))))
+                return -ENOMEM;
+
+        card->private_free = snd_card_miro_free;
+        miro = card->private_data;
+        miro->card = card;
+
+        if ((error = snd_card_miro_aci_detect(card, miro)) < 0) {
+                snd_card_free(card);
+                snd_printk(KERN_ERR "unable to detect aci chip\n");
+                return -ENODEV;
+        }
+
+        /* init proc interface */
+        snd_miro_proc_init(miro);
+
+        if ((error = snd_card_miro_detect(card, miro)) < 0) {
+                snd_card_free(card);
+                snd_printk(KERN_ERR "unable to detect OPTi9xx chip\n");
+                return -ENODEV;
+        }
+
+        if (! miro->res_mc_base &&
+            (miro->res_mc_base = request_region(miro->mc_base, miro->mc_base_size,
+                                                "miro (OPTi9xx MC)")) == NULL) {
+                snd_card_free(card);
+                snd_printk(KERN_ERR "request for OPTI9xx MC failed\n");
+                return -ENOMEM;
+        }
+
+        miro->wss_base = port;
+        miro->fm_port = fm_port;
+        miro->mpu_port = mpu_port;
+        miro->irq = irq;
+        miro->mpu_irq = mpu_irq;
+        miro->dma1 = dma1;
+        miro->dma2 = dma2;
+
+        if (miro->wss_base == SNDRV_AUTO_PORT) {
+                if ((miro->wss_base = snd_legacy_find_free_ioport(possible_ports, 4)) < 0) {
+                        snd_card_free(card);
+                        snd_printk(KERN_ERR "unable to find a free WSS port\n");
+                        return -EBUSY;
+                }
+        }
+
+        if (miro->mpu_port == SNDRV_AUTO_PORT) {
+                if ((miro->mpu_port = snd_legacy_find_free_ioport(possible_mpu_ports, 2)) < 0) {
+                        snd_card_free(card);
+                        snd_printk(KERN_ERR "unable to find a free MPU401 port\n");
+                        return -EBUSY;
+                }
+        }
+        if (miro->irq == SNDRV_AUTO_IRQ) {
+                if ((miro->irq = snd_legacy_find_free_irq(possible_irqs)) < 0) {
+                        snd_card_free(card);
+                        snd_printk(KERN_ERR "unable to find a free IRQ\n");
+                        return -EBUSY;
+                }
+        }
+        if (miro->mpu_irq == SNDRV_AUTO_IRQ) {
+                if ((miro->mpu_irq = snd_legacy_find_free_irq(possible_mpu_irqs)) < 0) {
+                        snd_card_free(card);
+                        snd_printk(KERN_ERR "unable to find a free MPU401 IRQ\n");
+                        return -EBUSY;
+                }
+        }
+        if (miro->dma1 == SNDRV_AUTO_DMA) {
+                if ((miro->dma1 = snd_legacy_find_free_dma(possible_dma1s)) < 0) {
+                        snd_card_free(card);
+                        snd_printk(KERN_ERR "unable to find a free DMA1\n");
+                        return -EBUSY;
+                }
+        }
+        if (miro->dma2 == SNDRV_AUTO_DMA) {
+                if ((miro->dma2 = snd_legacy_find_free_dma(possible_dma2s[miro->dma1 % 4])) < 0) {
+                        snd_card_free(card);
+                        snd_printk(KERN_ERR "unable to find a free DMA2\n");
+                        return -EBUSY;
+                }
+        }
+
+        if ((error = snd_miro_configure(miro))) {
+                snd_card_free(card);
+                return error;
+        }
+
+        if ((error = snd_cs4231_create(card, miro->wss_base + 4, -1,
+                                       miro->irq, miro->dma1, miro->dma2,
+                                       CS4231_HW_AD1845,
+                                       0,
+                                       &codec)) < 0) {
+                snd_card_free(card);
+                return error;
+        }
+
+        if ((error = snd_cs4231_pcm(codec, 0, &pcm)) < 0) {
+                snd_card_free(card);
+                return error;
+        }
+        if ((error = snd_cs4231_mixer(codec)) < 0) {
+                snd_card_free(card);
+                return error;
+        }
+        if ((error = snd_cs4231_timer(codec, 0, &timer)) < 0) {
+                snd_card_free(card);
+                return error;
+        }
+
+        miro->pcm = pcm;
+
+        if ((error = snd_miro_mixer(miro)) < 0) {
+                snd_card_free(card);
+                return error;
+        }
+
+        if (miro->aci_vendor == 'm') {
+                /* It looks like a miro sound card. */
+                switch (miro->aci_product) {
+                case 'A':
+                        sprintf(card->shortname, 
+                                "miroSOUND PCM1 pro / PCM12");
+                        break;
+                case 'B':
+                        sprintf(card->shortname, 
+                                "miroSOUND PCM12");
+                        break;
+                case 'C':
+                        sprintf(card->shortname, 
+                                "miroSOUND PCM20 radio");
+                        break;
+                default:
+                        sprintf(card->shortname, 
+                                "unknown miro");
+                        snd_printk(KERN_INFO "unknown miro aci id\n");
+                        break;
+                }
+        } else {
+                snd_printk(KERN_INFO "found unsupported aci card\n");
+                sprintf(card->shortname, "unknown Cardinal Technologies");
+        }
+
+        strcpy(card->driver, "miro");
+        sprintf(card->longname, "%s: OPTi%s, %s at 0x%lx, irq %d, dma %d&%d",
+                card->shortname, miro->name, pcm->name, miro->wss_base + 4,
+                miro->irq, miro->dma1, miro->dma2);
+
+        if (miro->mpu_port <= 0 || miro->mpu_port == SNDRV_AUTO_PORT)
+                rmidi = NULL;
+        else
+                if ((error = snd_mpu401_uart_new(card, 0, MPU401_HW_MPU401,
+                                miro->mpu_port, 0, miro->mpu_irq, SA_INTERRUPT,
+                                &rmidi)))
+                        snd_printk(KERN_WARNING "no MPU-401 device at 0x%lx?\n", miro->mpu_port);
+
+        if (miro->fm_port > 0 && miro->fm_port != SNDRV_AUTO_PORT) {
+                struct snd_opl3 *opl3 = NULL;
+                struct snd_opl4 *opl4;
+                if (snd_opl4_create(card, miro->fm_port, miro->fm_port - 8, 
+                                    2, &opl3, &opl4) < 0)
+                        snd_printk(KERN_WARNING "no OPL4 device at 0x%lx\n", miro->fm_port);
+        }
+
+        if ((error = snd_set_aci_init_values(miro)) < 0) {
+                snd_card_free(card);
+                return error;
+        }
+
+        snd_card_set_dev(card, &devptr->dev);
+
+        if ((error = snd_card_register(card))) {
+                snd_card_free(card);
+                return error;
+        }
+
+        platform_set_drvdata(devptr, card);
+        return 0;
+}
+
+static int __devexit snd_miro_remove(struct platform_device *devptr)
+{
+        snd_card_free(platform_get_drvdata(devptr));
+        platform_set_drvdata(devptr, NULL);
+        return 0;
+}
+
+static struct platform_driver snd_miro_driver = {
+        .probe          = snd_miro_probe,
+        .remove         = __devexit_p(snd_miro_remove),
+        /* FIXME: suspend/resume */
+        .driver         = {
+                .name   = DRIVER_NAME
+        },
+};
+
+static int __init alsa_card_miro_init(void)
+{
+        int error;
+
+        if ((error = platform_driver_register(&snd_miro_driver)) < 0)
+                return error;
+        device = platform_device_register_simple(DRIVER_NAME, -1, NULL, 0);
+        if (! IS_ERR(device))
+                return 0;
+#ifdef MODULE
+        printk(KERN_ERR "no miro soundcard found\n");
+#endif
+        platform_driver_unregister(&snd_miro_driver);
+        return PTR_ERR(device);
+}
+
+static void __exit alsa_card_miro_exit(void)
+{
+        platform_device_unregister(device);
+        platform_driver_unregister(&snd_miro_driver);
+}
+
+module_init(alsa_card_miro_init)
+module_exit(alsa_card_miro_exit)
diff --git a/sound/isa/opti9xx/miro.h b/sound/isa/opti9xx/miro.h
new file mode 100644
index 000000000000..6e1385b8e07e
--- /dev/null
+++ b/sound/isa/opti9xx/miro.h
@@ -0,0 +1,73 @@
+#ifndef _MIRO_H_
+#define _MIRO_H_
+
+#define ACI_REG_COMMAND         0       /* write register offset */
+#define ACI_REG_STATUS          1       /* read register offset */
+#define ACI_REG_BUSY            2       /* busy register offset */
+#define ACI_REG_RDS             2       /* PCM20: RDS register offset */
+#define ACI_MINTIME             500     /* ACI time out limit */
+
+#define ACI_SET_MUTE            0x0d
+#define ACI_SET_POWERAMP        0x0f
+#define ACI_SET_TUNERMUTE       0xa3
+#define ACI_SET_TUNERMONO       0xa4
+#define ACI_SET_IDE             0xd0
+#define ACI_SET_WSS             0xd1
+#define ACI_SET_SOLOMODE        0xd2
+#define ACI_SET_PREAMP          0x03
+#define ACI_GET_PREAMP          0x21
+#define ACI_WRITE_TUNE          0xa7
+#define ACI_READ_TUNERSTEREO    0xa8
+#define ACI_READ_TUNERSTATION   0xa9
+#define ACI_READ_VERSION        0xf1
+#define ACI_READ_IDCODE         0xf2
+#define ACI_INIT                0xff
+#define ACI_STATUS              0xf0
+#define ACI_S_GENERAL           0x00
+#define ACI_ERROR_OP            0xdf
+
+/* ACI Mixer */
+
+/* These are the values for the right channel GET registers.
+   Add an offset of 0x01 for the left channel register.
+   (left=right+0x01) */
+
+#define ACI_GET_MASTER          0x03
+#define ACI_GET_MIC             0x05
+#define ACI_GET_LINE            0x07
+#define ACI_GET_CD              0x09
+#define ACI_GET_SYNTH           0x0b
+#define ACI_GET_PCM             0x0d
+#define ACI_GET_LINE1           0x10    /* Radio on PCM20 */
+#define ACI_GET_LINE2           0x12
+
+#define ACI_GET_EQ1             0x22    /* from Bass ... */
+#define ACI_GET_EQ2             0x24
+#define ACI_GET_EQ3             0x26
+#define ACI_GET_EQ4             0x28
+#define ACI_GET_EQ5             0x2a
+#define ACI_GET_EQ6             0x2c
+#define ACI_GET_EQ7             0x2e    /* ... to Treble */
+
+/* And these are the values for the right channel SET registers.
+   For left channel access you have to add an offset of 0x08.
+   MASTER is an exception, which needs an offset of 0x01 */
+
+#define ACI_SET_MASTER          0x00
+#define ACI_SET_MIC             0x30
+#define ACI_SET_LINE            0x31
+#define ACI_SET_CD              0x34
+#define ACI_SET_SYNTH           0x33
+#define ACI_SET_PCM             0x32
+#define ACI_SET_LINE1           0x35    /* Radio on PCM20 */
+#define ACI_SET_LINE2           0x36
+
+#define ACI_SET_EQ1             0x40    /* from Bass ... */
+#define ACI_SET_EQ2             0x41
+#define ACI_SET_EQ3             0x42
+#define ACI_SET_EQ4             0x43
+#define ACI_SET_EQ5             0x44
+#define ACI_SET_EQ6             0x45
+#define ACI_SET_EQ7             0x46    /* ... to Treble */
+
+#endif  /* _MIRO_H_ */
diff --git a/sound/oss/emu10k1/main.c b/sound/oss/emu10k1/main.c
index 0cd44a6f7ac0..3721c5857b90 100644
--- a/sound/oss/emu10k1/main.c
+++ b/sound/oss/emu10k1/main.c
@@ -94,6 +94,7 @@
 #include <linux/init.h>
 #include <linux/delay.h>
 #include <linux/proc_fs.h>
+#include <linux/dma-mapping.h>
 
 #include "hwaccess.h"
 #include "8010.h"
@@ -119,7 +120,7 @@
  
 
 /* the emu10k1 _seems_ to only supports 29 bit (512MiB) bit bus master */
-#define EMU10K1_DMA_MASK                0x1fffffff      /* DMA buffer mask for pci_alloc_consist */
+#define EMU10K1_DMA_MASK DMA_29BIT_MASK /* DMA buffer mask for pci_alloc_consist */
 
 #ifndef PCI_VENDOR_ID_CREATIVE
 #define PCI_VENDOR_ID_CREATIVE 0x1102
diff --git a/sound/pci/Kconfig b/sound/pci/Kconfig
index 1e2e19305e38..a2081803a827 100644
--- a/sound/pci/Kconfig
+++ b/sound/pci/Kconfig
@@ -15,6 +15,18 @@ config SND_AD1889
           To compile this as a module, choose M here: the module
           will be called snd-ad1889.
 
+config SND_ALS300
+        tristate "Avance Logic ALS300/ALS300+"
+        depends on SND
+        select SND_PCM
+        select SND_AC97_CODEC
+        select SND_OPL3_LIB
+        help
+          Say 'Y' or 'M' to include support for Avance Logic ALS300/ALS300+
+
+          To compile this driver as a module, choose M here: the module
+          will be called snd-als300
+
 config SND_ALS4000
         tristate "Avance Logic ALS4000"
         depends on SND && ISA_DMA_API
@@ -195,8 +207,9 @@ config SND_CS46XX
           will be called snd-cs46xx.
 
 config SND_CS46XX_NEW_DSP
-        bool "Cirrus Logic (Sound Fusion) New DSP support (EXPERIMENTAL)"
-        depends on SND_CS46XX && EXPERIMENTAL
+        bool "Cirrus Logic (Sound Fusion) New DSP support"
+        depends on SND_CS46XX
+        default y
         help
           Say Y here to use a new DSP image for SPDIF and dual codecs.
 
@@ -466,6 +479,19 @@ config SND_PCXHR
           To compile this driver as a module, choose M here: the module
           will be called snd-pcxhr.
 
+config SND_RIPTIDE
+        tristate "Conexant Riptide"
+        depends on SND
+        depends on FW_LOADER
+        select SND_OPL3_LIB
+        select SND_MPU401_UART
+        select SND_AC97_CODEC
+        help
+          Say 'Y' or 'M' to include support for Conexant Riptide chip.
+
+          To compile this driver as a module, choose M here: the module
+          will be called snd-riptide
+
 config SND_RME32
         tristate "RME Digi32, 32/8, 32 PRO"
         depends on SND
diff --git a/sound/pci/Makefile b/sound/pci/Makefile
index a6c3cd58fe94..cba5105aafea 100644
--- a/sound/pci/Makefile
+++ b/sound/pci/Makefile
@@ -4,6 +4,7 @@
 #
 
 snd-ad1889-objs := ad1889.o
+snd-als300-objs := als300.o
 snd-als4000-objs := als4000.o
 snd-atiixp-objs := atiixp.o
 snd-atiixp-modem-objs := atiixp_modem.o
@@ -27,6 +28,7 @@ snd-via82xx-modem-objs := via82xx_modem.o
 
 # Toplevel Module Dependency
 obj-$(CONFIG_SND_AD1889) += snd-ad1889.o
+obj-$(CONFIG_SND_ALS300) += snd-als300.o
 obj-$(CONFIG_SND_ALS4000) += snd-als4000.o
 obj-$(CONFIG_SND_ATIIXP) += snd-atiixp.o
 obj-$(CONFIG_SND_ATIIXP_MODEM) += snd-atiixp-modem.o
@@ -62,6 +64,7 @@ obj-$(CONFIG_SND) += \
         mixart/ \
         nm256/ \
         pcxhr/ \
+        riptide/ \
         rme9652/ \
         trident/ \
         ymfpci/ \
diff --git a/sound/pci/als300.c b/sound/pci/als300.c
new file mode 100644
index 000000000000..91899f87f037
--- /dev/null
+++ b/sound/pci/als300.c
@@ -0,0 +1,867 @@
+/*
+ *  als300.c - driver for Avance Logic ALS300/ALS300+ soundcards.
+ *  Copyright (C) 2005 by Ash Willis <ashwillis@programmer.net>
+ *
+ *  This program is free software; you can redistribute it and/or modify
+ *  it under the terms of the GNU General Public License as published by
+ *  the Free Software Foundation; either version 2 of the License, or
+ *  (at your option) any later version.
+ *
+ *  This program is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ *  GNU General Public License for more details.
+ *
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program; if not, write to the Free Software
+ *  Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307 USA
+ *
+ *  TODO
+ *  4 channel playback for ALS300+
+ *  gameport
+ *  mpu401
+ *  opl3
+ *
+ *  NOTES
+ *  The BLOCK_COUNTER registers for the ALS300(+) return a figure related to
+ *  the position in the current period, NOT the whole buffer. It is important
+ *  to know which period we are in so we can calculate the correct pointer.
+ *  This is why we always use 2 periods. We can then use a flip-flop variable
+ *  to keep track of what period we are in.
+ */
+
+#include <sound/driver.h>
+#include <linux/delay.h>
+#include <linux/init.h>
+#include <linux/moduleparam.h>
+#include <linux/pci.h>
+#include <linux/dma-mapping.h>
+#include <linux/interrupt.h>
+#include <linux/slab.h>
+
+#include <asm/io.h>
+
+#include <sound/core.h>
+#include <sound/control.h>
+#include <sound/initval.h>
+#include <sound/pcm.h>
+#include <sound/pcm_params.h>
+#include <sound/ac97_codec.h>
+#include <sound/opl3.h>
+
+/* snd_als300_set_irq_flag */
+#define IRQ_DISABLE             0
+#define IRQ_ENABLE              1
+
+/* I/O port layout */
+#define AC97_ACCESS             0x00
+#define AC97_READ               0x04
+#define AC97_STATUS             0x06
+#define   AC97_DATA_AVAIL               (1<<6)
+#define   AC97_BUSY                     (1<<7)
+#define ALS300_IRQ_STATUS       0x07            /* ALS300 Only */
+#define   IRQ_PLAYBACK                  (1<<3)
+#define   IRQ_CAPTURE                   (1<<2)
+#define GCR_DATA                0x08
+#define GCR_INDEX               0x0C
+#define ALS300P_DRAM_IRQ_STATUS 0x0D            /* ALS300+ Only */
+#define MPU_IRQ_STATUS          0x0E            /* ALS300 Rev. E+, ALS300+ */
+#define ALS300P_IRQ_STATUS      0x0F            /* ALS300+ Only */
+
+/* General Control Registers */
+#define PLAYBACK_START          0x80
+#define PLAYBACK_END            0x81
+#define PLAYBACK_CONTROL        0x82
+#define   TRANSFER_START                (1<<16)
+#define   FIFO_PAUSE                    (1<<17)
+#define RECORD_START            0x83
+#define RECORD_END              0x84
+#define RECORD_CONTROL          0x85
+#define DRAM_WRITE_CONTROL      0x8B
+#define   WRITE_TRANS_START             (1<<16)
+#define   DRAM_MODE_2                   (1<<17)
+#define MISC_CONTROL            0x8C
+#define   IRQ_SET_BIT                   (1<<15)
+#define   VMUTE_NORMAL                  (1<<20)
+#define   MMUTE_NORMAL                  (1<<21)
+#define MUS_VOC_VOL             0x8E
+#define PLAYBACK_BLOCK_COUNTER  0x9A
+#define RECORD_BLOCK_COUNTER    0x9B
+
+#define DEBUG_CALLS     1
+#define DEBUG_PLAY_REC  1
+
+#if DEBUG_CALLS
+#define snd_als300_dbgcalls(format, args...) printk(format, ##args)
+#define snd_als300_dbgcallenter() printk(KERN_ERR "--> %s\n", __FUNCTION__)
+#define snd_als300_dbgcallleave() printk(KERN_ERR "<-- %s\n", __FUNCTION__)
+#else
+#define snd_als300_dbgcalls(format, args...)
+#define snd_als300_dbgcallenter()
+#define snd_als300_dbgcallleave()
+#endif
+
+#if DEBUG_PLAY_REC
+#define snd_als300_dbgplay(format, args...) printk(KERN_ERR format, ##args)
+#else
+#define snd_als300_dbgplay(format, args...)
+#endif          
+
+enum {DEVICE_ALS300, DEVICE_ALS300_PLUS};
+
+MODULE_AUTHOR("Ash Willis <ashwillis@programmer.net>");
+MODULE_DESCRIPTION("Avance Logic ALS300");
+MODULE_LICENSE("GPL");
+MODULE_SUPPORTED_DEVICE("{{Avance Logic,ALS300},{Avance Logic,ALS300+}}");
+
+static int index[SNDRV_CARDS] = SNDRV_DEFAULT_IDX;
+static char *id[SNDRV_CARDS] = SNDRV_DEFAULT_STR;
+static int enable[SNDRV_CARDS] = SNDRV_DEFAULT_ENABLE_PNP;
+
+struct snd_als300 {
+        unsigned long port;
+        spinlock_t reg_lock;
+        struct snd_card *card;
+        struct pci_dev *pci;
+
+        struct snd_pcm *pcm;
+        struct snd_pcm_substream *playback_substream;
+        struct snd_pcm_substream *capture_substream;
+
+        struct snd_ac97 *ac97;
+        struct snd_opl3 *opl3;
+
+        struct resource *res_port;
+
+        int irq;
+
+        int chip_type; /* ALS300 or ALS300+ */
+
+        char revision;  
+};
+
+struct snd_als300_substream_data {
+        int period_flipflop;
+        int control_register;
+        int block_counter_register;
+};
+
+static struct pci_device_id snd_als300_ids[] = {
+        { 0x4005, 0x0300, PCI_ANY_ID, PCI_ANY_ID, 0, 0, DEVICE_ALS300 },
+        { 0x4005, 0x0308, PCI_ANY_ID, PCI_ANY_ID, 0, 0, DEVICE_ALS300_PLUS },
+        { 0, }
+};
+
+MODULE_DEVICE_TABLE(pci, snd_als300_ids);
+
+static inline u32 snd_als300_gcr_read(unsigned long port, unsigned short reg)
+{
+        outb(reg, port+GCR_INDEX);
+        return inl(port+GCR_DATA);
+}
+
+static inline void snd_als300_gcr_write(unsigned long port,
+                                                unsigned short reg, u32 val)
+{
+        outb(reg, port+GCR_INDEX);
+        outl(val, port+GCR_DATA);
+}
+
+/* Enable/Disable Interrupts */
+static void snd_als300_set_irq_flag(struct snd_als300 *chip, int cmd)
+{
+        u32 tmp = snd_als300_gcr_read(chip->port, MISC_CONTROL);
+        snd_als300_dbgcallenter();
+
+        /* boolean XOR check, since old vs. new hardware have
+           directly reversed bit setting for ENABLE and DISABLE.
+           ALS300+ acts like newer versions of ALS300 */
+        if (((chip->revision > 5 || chip->chip_type == DEVICE_ALS300_PLUS) ^
+                                                (cmd == IRQ_ENABLE)) == 0)
+                tmp |= IRQ_SET_BIT;
+        else
+                tmp &= ~IRQ_SET_BIT;
+        snd_als300_gcr_write(chip->port, MISC_CONTROL, tmp);
+        snd_als300_dbgcallleave();
+}
+
+static int snd_als300_free(struct snd_als300 *chip)
+{
+        snd_als300_dbgcallenter();
+        snd_als300_set_irq_flag(chip, IRQ_DISABLE);
+        if (chip->irq >= 0)
+                free_irq(chip->irq, (void *)chip);
+        pci_release_regions(chip->pci);
+        pci_disable_device(chip->pci);
+        kfree(chip);
+        snd_als300_dbgcallleave();
+        return 0;
+}
+
+static int snd_als300_dev_free(struct snd_device *device)
+{
+        struct snd_als300 *chip = device->device_data;
+        return snd_als300_free(chip);
+}
+
+static irqreturn_t snd_als300_interrupt(int irq, void *dev_id,
+                                                struct pt_regs *regs)
+{
+        u8 status;
+        struct snd_als300 *chip = dev_id;
+        struct snd_als300_substream_data *data;
+
+        status = inb(chip->port+ALS300_IRQ_STATUS);
+        if (!status) /* shared IRQ, for different device?? Exit ASAP! */
+                return IRQ_NONE;
+
+        /* ACK everything ASAP */
+        outb(status, chip->port+ALS300_IRQ_STATUS);
+        if (status & IRQ_PLAYBACK) {
+                if (chip->pcm && chip->playback_substream) {
+                        data = chip->playback_substream->runtime->private_data;
+                        data->period_flipflop ^= 1;
+                        snd_pcm_period_elapsed(chip->playback_substream);
+                        snd_als300_dbgplay("IRQ_PLAYBACK\n");
+                }
+        }
+        if (status & IRQ_CAPTURE) {
+                if (chip->pcm && chip->capture_substream) {
+                        data = chip->capture_substream->runtime->private_data;
+                        data->period_flipflop ^= 1;
+                        snd_pcm_period_elapsed(chip->capture_substream);
+                        snd_als300_dbgplay("IRQ_CAPTURE\n");
+                }
+        }
+        return IRQ_HANDLED;
+}
+
+static irqreturn_t snd_als300plus_interrupt(int irq, void *dev_id,
+                                                struct pt_regs *regs)
+{
+        u8 general, mpu, dram;
+        struct snd_als300 *chip = dev_id;
+        struct snd_als300_substream_data *data;
+        
+        general = inb(chip->port+ALS300P_IRQ_STATUS);
+        mpu = inb(chip->port+MPU_IRQ_STATUS);
+        dram = inb(chip->port+ALS300P_DRAM_IRQ_STATUS);
+
+        /* shared IRQ, for different device?? Exit ASAP! */
+        if ((general == 0) && ((mpu & 0x80) == 0) && ((dram & 0x01) == 0))
+                return IRQ_NONE;
+
+        if (general & IRQ_PLAYBACK) {
+                if (chip->pcm && chip->playback_substream) {
+                        outb(IRQ_PLAYBACK, chip->port+ALS300P_IRQ_STATUS);
+                        data = chip->playback_substream->runtime->private_data;
+                        data->period_flipflop ^= 1;
+                        snd_pcm_period_elapsed(chip->playback_substream);
+                        snd_als300_dbgplay("IRQ_PLAYBACK\n");
+                }
+        }
+        if (general & IRQ_CAPTURE) {
+                if (chip->pcm && chip->capture_substream) {
+                        outb(IRQ_CAPTURE, chip->port+ALS300P_IRQ_STATUS);
+                        data = chip->capture_substream->runtime->private_data;
+                        data->period_flipflop ^= 1;
+                        snd_pcm_period_elapsed(chip->capture_substream);
+                        snd_als300_dbgplay("IRQ_CAPTURE\n");
+                }
+        }
+        /* FIXME: Ack other interrupt types. Not important right now as
+         * those other devices aren't enabled. */
+        return IRQ_HANDLED;
+}
+
+static void __devexit snd_als300_remove(struct pci_dev *pci)
+{
+        snd_als300_dbgcallenter();
+        snd_card_free(pci_get_drvdata(pci));
+        pci_set_drvdata(pci, NULL);
+        snd_als300_dbgcallleave();
+}
+
+static unsigned short snd_als300_ac97_read(struct snd_ac97 *ac97,
+                                                        unsigned short reg)
+{
+        int i;
+        struct snd_als300 *chip = ac97->private_data;
+
+        for (i = 0; i < 1000; i++) {
+                if ((inb(chip->port+AC97_STATUS) & (AC97_BUSY)) == 0)
+                        break;
+                udelay(10);
+        }
+        outl((reg << 24) | (1 << 31), chip->port+AC97_ACCESS);
+
+        for (i = 0; i < 1000; i++) {
+                if ((inb(chip->port+AC97_STATUS) & (AC97_DATA_AVAIL)) != 0)
+                        break;
+                udelay(10);
+        }
+        return inw(chip->port+AC97_READ);
+}
+
+static void snd_als300_ac97_write(struct snd_ac97 *ac97,
+                                unsigned short reg, unsigned short val)
+{
+        int i;
+        struct snd_als300 *chip = ac97->private_data;
+
+        for (i = 0; i < 1000; i++) {
+                if ((inb(chip->port+AC97_STATUS) & (AC97_BUSY)) == 0)
+                        break;
+                udelay(10);
+        }
+        outl((reg << 24) | val, chip->port+AC97_ACCESS);
+}
+
+static int snd_als300_ac97(struct snd_als300 *chip)
+{
+        struct snd_ac97_bus *bus;
+        struct snd_ac97_template ac97;
+        int err;
+        static struct snd_ac97_bus_ops ops = {
+                .write = snd_als300_ac97_write,
+                .read = snd_als300_ac97_read,
+        };
+
+        snd_als300_dbgcallenter();
+        if ((err = snd_ac97_bus(chip->card, 0, &ops, NULL, &bus)) < 0)
+                return err;
+
+        memset(&ac97, 0, sizeof(ac97));
+        ac97.private_data = chip;
+
+        snd_als300_dbgcallleave();
+        return snd_ac97_mixer(bus, &ac97, &chip->ac97);
+}
+
+/* hardware definition
+ *
+ * In AC97 mode, we always use 48k/16bit/stereo.
+ * Any request to change data type is ignored by
+ * the card when it is running outside of legacy
+ * mode.
+ */
+static struct snd_pcm_hardware snd_als300_playback_hw =
+{
+        .info =                 (SNDRV_PCM_INFO_MMAP |
+                                SNDRV_PCM_INFO_INTERLEAVED |
+                                SNDRV_PCM_INFO_PAUSE |
+                                SNDRV_PCM_INFO_MMAP_VALID),
+        .formats =              SNDRV_PCM_FMTBIT_S16,
+        .rates =                SNDRV_PCM_RATE_48000,
+        .rate_min =             48000,
+        .rate_max =             48000,
+        .channels_min =         2,
+        .channels_max =         2,
+        .buffer_bytes_max =     64 * 1024,
+        .period_bytes_min =     64,
+        .period_bytes_max =     32 * 1024,
+        .periods_min =          2,
+        .periods_max =          2,
+};
+
+static struct snd_pcm_hardware snd_als300_capture_hw =
+{
+        .info =                 (SNDRV_PCM_INFO_MMAP |
+                                SNDRV_PCM_INFO_INTERLEAVED |
+                                SNDRV_PCM_INFO_PAUSE |
+                                SNDRV_PCM_INFO_MMAP_VALID),
+        .formats =              SNDRV_PCM_FMTBIT_S16,
+        .rates =                SNDRV_PCM_RATE_48000,
+        .rate_min =             48000,
+        .rate_max =             48000,
+        .channels_min =         2,
+        .channels_max =         2,
+        .buffer_bytes_max =     64 * 1024,
+        .period_bytes_min =     64,
+        .period_bytes_max =     32 * 1024,
+        .periods_min =          2,
+        .periods_max =          2,
+};
+
+static int snd_als300_playback_open(struct snd_pcm_substream *substream)
+{
+        struct snd_als300 *chip = snd_pcm_substream_chip(substream);
+        struct snd_pcm_runtime *runtime = substream->runtime;
+        struct snd_als300_substream_data *data = kzalloc(sizeof(*data),
+                                                                GFP_KERNEL);
+
+        snd_als300_dbgcallenter();
+        chip->playback_substream = substream;
+        runtime->hw = snd_als300_playback_hw;
+        runtime->private_data = data;
+        data->control_register = PLAYBACK_CONTROL;
+        data->block_counter_register = PLAYBACK_BLOCK_COUNTER;
+        snd_als300_dbgcallleave();
+        return 0;
+}
+
+static int snd_als300_playback_close(struct snd_pcm_substream *substream)
+{
+        struct snd_als300 *chip = snd_pcm_substream_chip(substream);
+        struct snd_als300_substream_data *data;
+
+        data = substream->runtime->private_data;
+        snd_als300_dbgcallenter();
+        kfree(data);
+        chip->playback_substream = NULL;
+        snd_pcm_lib_free_pages(substream);
+        snd_als300_dbgcallleave();
+        return 0;
+}
+
+static int snd_als300_capture_open(struct snd_pcm_substream *substream)
+{
+        struct snd_als300 *chip = snd_pcm_substream_chip(substream);
+        struct snd_pcm_runtime *runtime = substream->runtime;
+        struct snd_als300_substream_data *data = kzalloc(sizeof(*data),
+                                                                GFP_KERNEL);
+
+        snd_als300_dbgcallenter();
+        chip->capture_substream = substream;
+        runtime->hw = snd_als300_capture_hw;
+        runtime->private_data = data;
+        data->control_register = RECORD_CONTROL;
+        data->block_counter_register = RECORD_BLOCK_COUNTER;
+        snd_als300_dbgcallleave();
+        return 0;
+}
+
+static int snd_als300_capture_close(struct snd_pcm_substream *substream)
+{
+        struct snd_als300 *chip = snd_pcm_substream_chip(substream);
+        struct snd_als300_substream_data *data;
+
+        data = substream->runtime->private_data;
+        snd_als300_dbgcallenter();
+        kfree(data);
+        chip->capture_substream = NULL;
+        snd_pcm_lib_free_pages(substream);
+        snd_als300_dbgcallleave();
+        return 0;
+}
+
+static int snd_als300_pcm_hw_params(struct snd_pcm_substream *substream,
+                                        snd_pcm_hw_params_t * hw_params)
+{
+        return snd_pcm_lib_malloc_pages(substream,
+                                        params_buffer_bytes(hw_params));
+}
+
+static int snd_als300_pcm_hw_free(struct snd_pcm_substream *substream)
+{
+        return snd_pcm_lib_free_pages(substream);
+}
+
+static int snd_als300_playback_prepare(struct snd_pcm_substream *substream)
+{
+        u32 tmp;
+        struct snd_als300 *chip = snd_pcm_substream_chip(substream);
+        struct snd_pcm_runtime *runtime = substream->runtime;
+        unsigned short period_bytes = snd_pcm_lib_period_bytes(substream);
+        unsigned short buffer_bytes = snd_pcm_lib_buffer_bytes(substream);
+        
+        snd_als300_dbgcallenter();
+        spin_lock_irq(&chip->reg_lock);
+        tmp = snd_als300_gcr_read(chip->port, PLAYBACK_CONTROL);
+        tmp &= ~TRANSFER_START;
+
+        snd_als300_dbgplay("Period bytes: %d Buffer bytes %d\n",
+                                                period_bytes, buffer_bytes);
+        
+        /* set block size */
+        tmp &= 0xffff0000;
+        tmp |= period_bytes - 1;
+        snd_als300_gcr_write(chip->port, PLAYBACK_CONTROL, tmp);
+
+        /* set dma area */
+        snd_als300_gcr_write(chip->port, PLAYBACK_START,
+                                        runtime->dma_addr);
+        snd_als300_gcr_write(chip->port, PLAYBACK_END,
+                                        runtime->dma_addr + buffer_bytes - 1);
+        spin_unlock_irq(&chip->reg_lock);
+        snd_als300_dbgcallleave();
+        return 0;
+}
+
+static int snd_als300_capture_prepare(struct snd_pcm_substream *substream)
+{
+        u32 tmp;
+        struct snd_als300 *chip = snd_pcm_substream_chip(substream);
+        struct snd_pcm_runtime *runtime = substream->runtime;
+        unsigned short period_bytes = snd_pcm_lib_period_bytes(substream);
+        unsigned short buffer_bytes = snd_pcm_lib_buffer_bytes(substream);
+
+        snd_als300_dbgcallenter();
+        spin_lock_irq(&chip->reg_lock);
+        tmp = snd_als300_gcr_read(chip->port, RECORD_CONTROL);
+        tmp &= ~TRANSFER_START;
+
+        snd_als300_dbgplay("Period bytes: %d Buffer bytes %d\n", period_bytes,
+                                                        buffer_bytes);
+
+        /* set block size */
+        tmp &= 0xffff0000;
+        tmp |= period_bytes - 1;
+
+        /* set dma area */
+        snd_als300_gcr_write(chip->port, RECORD_CONTROL, tmp);
+        snd_als300_gcr_write(chip->port, RECORD_START,
+                                        runtime->dma_addr);
+        snd_als300_gcr_write(chip->port, RECORD_END,
+                                        runtime->dma_addr + buffer_bytes - 1);
+        spin_unlock_irq(&chip->reg_lock);
+        snd_als300_dbgcallleave();
+        return 0;
+}
+
+static int snd_als300_trigger(struct snd_pcm_substream *substream, int cmd)
+{
+        struct snd_als300 *chip = snd_pcm_substream_chip(substream);
+        u32 tmp;
+        struct snd_als300_substream_data *data;
+        unsigned short reg;
+        int ret = 0;
+
+        data = substream->runtime->private_data;
+        reg = data->control_register;
+
+        snd_als300_dbgcallenter();
+        spin_lock(&chip->reg_lock);
+        switch (cmd) {
+        case SNDRV_PCM_TRIGGER_START:
+        case SNDRV_PCM_TRIGGER_RESUME:
+                tmp = snd_als300_gcr_read(chip->port, reg);
+                data->period_flipflop = 1;
+                snd_als300_gcr_write(chip->port, reg, tmp | TRANSFER_START);
+                snd_als300_dbgplay("TRIGGER START\n");
+                break;
+        case SNDRV_PCM_TRIGGER_STOP:
+        case SNDRV_PCM_TRIGGER_SUSPEND:
+                tmp = snd_als300_gcr_read(chip->port, reg);
+                snd_als300_gcr_write(chip->port, reg, tmp & ~TRANSFER_START);
+                snd_als300_dbgplay("TRIGGER STOP\n");
+                break;
+        case SNDRV_PCM_TRIGGER_PAUSE_PUSH:
+                tmp = snd_als300_gcr_read(chip->port, reg);
+                snd_als300_gcr_write(chip->port, reg, tmp | FIFO_PAUSE);
+                snd_als300_dbgplay("TRIGGER PAUSE\n");
+                break;
+        case SNDRV_PCM_TRIGGER_PAUSE_RELEASE:
+                tmp = snd_als300_gcr_read(chip->port, reg);
+                snd_als300_gcr_write(chip->port, reg, tmp & ~FIFO_PAUSE);
+                snd_als300_dbgplay("TRIGGER RELEASE\n");
+                break;
+        default:
+                snd_als300_dbgplay("TRIGGER INVALID\n");
+                ret = -EINVAL;
+        }
+        spin_unlock(&chip->reg_lock);
+        snd_als300_dbgcallleave();
+        return ret;
+}
+
+static snd_pcm_uframes_t snd_als300_pointer(struct snd_pcm_substream *substream)
+{
+        u16 current_ptr;
+        struct snd_als300 *chip = snd_pcm_substream_chip(substream);
+        struct snd_als300_substream_data *data;
+        unsigned short period_bytes;
+
+        data = substream->runtime->private_data;
+        period_bytes = snd_pcm_lib_period_bytes(substream);
+        
+        snd_als300_dbgcallenter();
+        spin_lock(&chip->reg_lock);
+        current_ptr = (u16) snd_als300_gcr_read(chip->port,
+                                        data->block_counter_register) + 4;
+        spin_unlock(&chip->reg_lock);
+        if (current_ptr > period_bytes)
+                current_ptr = 0;
+        else
+                current_ptr = period_bytes - current_ptr;
+
+        if (data->period_flipflop == 0)
+                current_ptr += period_bytes;
+        snd_als300_dbgplay("Pointer (bytes): %d\n", current_ptr);
+        snd_als300_dbgcallleave();
+        return bytes_to_frames(substream->runtime, current_ptr);
+}
+
+static struct snd_pcm_ops snd_als300_playback_ops = {
+        .open =         snd_als300_playback_open,
+        .close =        snd_als300_playback_close,
+        .ioctl =        snd_pcm_lib_ioctl,
+        .hw_params =    snd_als300_pcm_hw_params,
+        .hw_free =      snd_als300_pcm_hw_free,
+        .prepare =      snd_als300_playback_prepare,
+        .trigger =      snd_als300_trigger,
+        .pointer =      snd_als300_pointer,
+};
+
+static struct snd_pcm_ops snd_als300_capture_ops = {
+        .open =         snd_als300_capture_open,
+        .close =        snd_als300_capture_close,
+        .ioctl =        snd_pcm_lib_ioctl,
+        .hw_params =    snd_als300_pcm_hw_params,
+        .hw_free =      snd_als300_pcm_hw_free,
+        .prepare =      snd_als300_capture_prepare,
+        .trigger =      snd_als300_trigger,
+        .pointer =      snd_als300_pointer,
+};
+
+static int __devinit snd_als300_new_pcm(struct snd_als300 *chip)
+{
+        struct snd_pcm *pcm;
+        int err;
+
+        snd_als300_dbgcallenter();
+        err = snd_pcm_new(chip->card, "ALS300", 0, 1, 1, &pcm);
+        if (err < 0)
+                return err;
+        pcm->private_data = chip;
+        strcpy(pcm->name, "ALS300");
+        chip->pcm = pcm;
+
+        /* set operators */
+        snd_pcm_set_ops(pcm, SNDRV_PCM_STREAM_PLAYBACK,
+                                &snd_als300_playback_ops);
+        snd_pcm_set_ops(pcm, SNDRV_PCM_STREAM_CAPTURE,
+                                &snd_als300_capture_ops);
+
+        /* pre-allocation of buffers */
+        snd_pcm_lib_preallocate_pages_for_all(pcm, SNDRV_DMA_TYPE_DEV,
+        snd_dma_pci_data(chip->pci), 64*1024, 64*1024);
+        snd_als300_dbgcallleave();
+        return 0;
+}
+
+static void snd_als300_init(struct snd_als300 *chip)
+{
+        unsigned long flags;
+        u32 tmp;
+        
+        snd_als300_dbgcallenter();
+        spin_lock_irqsave(&chip->reg_lock, flags);
+        chip->revision = (snd_als300_gcr_read(chip->port, MISC_CONTROL) >> 16)
+                                                                & 0x0000000F;
+        /* Setup DRAM */
+        tmp = snd_als300_gcr_read(chip->port, DRAM_WRITE_CONTROL);
+        snd_als300_gcr_write(chip->port, DRAM_WRITE_CONTROL,
+                                                (tmp | DRAM_MODE_2)
+                                                & ~WRITE_TRANS_START);
+
+        /* Enable IRQ output */
+        snd_als300_set_irq_flag(chip, IRQ_ENABLE);
+
+        /* Unmute hardware devices so their outputs get routed to
+         * the onboard mixer */
+        tmp = snd_als300_gcr_read(chip->port, MISC_CONTROL);
+        snd_als300_gcr_write(chip->port, MISC_CONTROL,
+                        tmp | VMUTE_NORMAL | MMUTE_NORMAL);
+
+        /* Reset volumes */
+        snd_als300_gcr_write(chip->port, MUS_VOC_VOL, 0);
+
+        /* Make sure playback transfer is stopped */
+        tmp = snd_als300_gcr_read(chip->port, PLAYBACK_CONTROL);
+        snd_als300_gcr_write(chip->port, PLAYBACK_CONTROL,
+                        tmp & ~TRANSFER_START);
+        spin_unlock_irqrestore(&chip->reg_lock, flags);
+        snd_als300_dbgcallleave();
+}
+
+static int __devinit snd_als300_create(snd_card_t *card,
+                                       struct pci_dev *pci, int chip_type,
+                                       struct snd_als300 **rchip)
+{
+        struct snd_als300 *chip;
+        void *irq_handler;
+        int err;
+
+        static snd_device_ops_t ops = {
+                .dev_free = snd_als300_dev_free,
+        };
+        *rchip = NULL;
+
+        snd_als300_dbgcallenter();
+        if ((err = pci_enable_device(pci)) < 0)
+                return err;
+
+        if (pci_set_dma_mask(pci, DMA_28BIT_MASK) < 0 ||
+                pci_set_consistent_dma_mask(pci, DMA_28BIT_MASK) < 0) {
+                printk(KERN_ERR "error setting 28bit DMA mask\n");
+                pci_disable_device(pci);
+                return -ENXIO;
+        }
+        pci_set_master(pci);
+
+        chip = kzalloc(sizeof(*chip), GFP_KERNEL);
+        if (chip == NULL) {
+                pci_disable_device(pci);
+                return -ENOMEM;
+        }
+
+        chip->card = card;
+        chip->pci = pci;
+        chip->irq = -1;
+        chip->chip_type = chip_type;
+        spin_lock_init(&chip->reg_lock);
+
+        if ((err = pci_request_regions(pci, "ALS300")) < 0) {
+                kfree(chip);
+                pci_disable_device(pci);
+                return err;
+        }
+        chip->port = pci_resource_start(pci, 0);
+
+        if (chip->chip_type == DEVICE_ALS300_PLUS)
+                irq_handler = snd_als300plus_interrupt;
+        else
+                irq_handler = snd_als300_interrupt;
+
+        if (request_irq(pci->irq, irq_handler, SA_INTERRUPT|SA_SHIRQ,
+                                        card->shortname, (void *)chip)) {
+                snd_printk(KERN_ERR "unable to grab IRQ %d\n", pci->irq);
+                snd_als300_free(chip);
+                return -EBUSY;
+        }
+        chip->irq = pci->irq;
+
+
+        snd_als300_init(chip);
+
+        if (snd_als300_ac97(chip) < 0) {
+                snd_printk(KERN_WARNING "Could not create ac97\n");
+                snd_als300_free(chip);
+                return err;
+        }
+
+        if ((err = snd_als300_new_pcm(chip)) < 0) {
+                snd_printk(KERN_WARNING "Could not create PCM\n");
+                snd_als300_free(chip);
+                return err;
+        }
+
+        if ((err = snd_device_new(card, SNDRV_DEV_LOWLEVEL,
+                                                chip, &ops)) < 0) {
+                snd_als300_free(chip);
+                return err;
+        }
+
+        snd_card_set_dev(card, &pci->dev);
+
+        *rchip = chip;
+        snd_als300_dbgcallleave();
+        return 0;
+}
+
+#ifdef CONFIG_PM
+static int snd_als300_suspend(struct pci_dev *pci, pm_message_t state)
+{
+        struct snd_card *card = pci_get_drvdata(pci);
+        struct snd_als300 *chip = card->private_data;
+
+        snd_power_change_state(card, SNDRV_CTL_POWER_D3hot);
+        snd_pcm_suspend_all(chip->pcm);
+        snd_ac97_suspend(chip->ac97);
+
+        pci_set_power_state(pci, PCI_D3hot);
+        pci_disable_device(pci);
+        pci_save_state(pci);
+        return 0;
+}
+
+static int snd_als300_resume(struct pci_dev *pci)
+{
+        struct snd_card *card = pci_get_drvdata(pci);
+        struct snd_als300 *chip = card->private_data;
+
+        pci_restore_state(pci);
+        pci_enable_device(pci);
+        pci_set_power_state(pci, PCI_D0);
+        pci_set_master(pci);
+
+        snd_als300_init(chip);
+        snd_ac97_resume(chip->ac97);
+
+        snd_power_change_state(card, SNDRV_CTL_POWER_D0);
+        return 0;
+}
+#endif
+
+static int __devinit snd_als300_probe(struct pci_dev *pci,
+                             const struct pci_device_id *pci_id)
+{
+        static int dev;
+        struct snd_card *card;
+        struct snd_als300 *chip;
+        int err, chip_type;
+
+        if (dev >= SNDRV_CARDS)
+                return -ENODEV;
+        if (!enable[dev]) {
+                dev++;
+                return -ENOENT;
+        }
+
+        card = snd_card_new(index[dev], id[dev], THIS_MODULE, 0);
+
+        if (card == NULL)
+                return -ENOMEM;
+
+        chip_type = pci_id->driver_data;
+
+        if ((err = snd_als300_create(card, pci, chip_type, &chip)) < 0) {
+                snd_card_free(card);
+                return err;
+        }
+        card->private_data = chip;
+
+        strcpy(card->driver, "ALS300");
+        if (chip->chip_type == DEVICE_ALS300_PLUS)
+                /* don't know much about ALS300+ yet
+                 * print revision number for now */
+                sprintf(card->shortname, "ALS300+ (Rev. %d)", chip->revision);
+        else
+                sprintf(card->shortname, "ALS300 (Rev. %c)", 'A' +
+                                                        chip->revision - 1);
+        sprintf(card->longname, "%s at 0x%lx irq %i",
+                                card->shortname, chip->port, chip->irq);
+
+        if ((err = snd_card_register(card)) < 0) {
+                snd_card_free(card);
+                return err;
+        }
+        pci_set_drvdata(pci, card);
+        dev++;
+        return 0;
+}
+
+static struct pci_driver driver = {
+        .name = "ALS300",
+        .id_table = snd_als300_ids,
+        .probe = snd_als300_probe,
+        .remove = __devexit_p(snd_als300_remove),
+#ifdef CONFIG_PM
+        .suspend = snd_als300_suspend,
+        .resume = snd_als300_resume,
+#endif
+};
+
+static int __init alsa_card_als300_init(void)
+{
+        return pci_register_driver(&driver);
+}
+
+static void __exit alsa_card_als300_exit(void)
+{
+        pci_unregister_driver(&driver);
+}
+
+module_init(alsa_card_als300_init)
+module_exit(alsa_card_als300_exit)
diff --git a/sound/pci/cs4281.c b/sound/pci/cs4281.c
index 4f65ec56bf35..ac4e73f69c1d 100644
--- a/sound/pci/cs4281.c
+++ b/sound/pci/cs4281.c
@@ -1046,7 +1046,7 @@ static int snd_cs4281_put_volume(struct snd_kcontrol *kcontrol,
                 snd_cs4281_pokeBA0(chip, regL, volL);
                 change = 1;
         }
-        if (ucontrol->value.integer.value[0] != volL) {
+        if (ucontrol->value.integer.value[1] != volR) {
                 volR = CS_VOL_MASK - (ucontrol->value.integer.value[1] & CS_VOL_MASK);
                 snd_cs4281_pokeBA0(chip, regR, volR);
                 change = 1;
@@ -1416,7 +1416,7 @@ static int __devinit snd_cs4281_create(struct snd_card *card,
 static int snd_cs4281_chip_init(struct cs4281 *chip)
 {
         unsigned int tmp;
-        int timeout;
+        unsigned long end_time;
         int retry_count = 2;
 
         /* Having EPPMC.FPDN=1 prevent proper chip initialisation */
@@ -1496,7 +1496,7 @@ static int snd_cs4281_chip_init(struct cs4281 *chip)
         /*
          * Wait for the DLL ready signal from the clock logic.
          */
-        timeout = 100;
+        end_time = jiffies + HZ;
         do {
                 /*
                  *  Read the AC97 status register to see if we've seen a CODEC
@@ -1504,8 +1504,8 @@ static int snd_cs4281_chip_init(struct cs4281 *chip)
                  */
                 if (snd_cs4281_peekBA0(chip, BA0_CLKCR1) & BA0_CLKCR1_DLLRDY)
                         goto __ok0;
-                msleep(1);
-        } while (timeout-- > 0);
+                schedule_timeout_uninterruptible(1);
+        } while (time_after_eq(end_time, jiffies));
 
         snd_printk(KERN_ERR "DLLRDY not seen\n");
         return -EIO;
@@ -1522,7 +1522,7 @@ static int snd_cs4281_chip_init(struct cs4281 *chip)
         /*
          * Wait for the codec ready signal from the AC97 codec.
          */
-        timeout = 100;
+        end_time = jiffies + HZ;
         do {
                 /*
                  *  Read the AC97 status register to see if we've seen a CODEC
@@ -1530,20 +1530,20 @@ static int snd_cs4281_chip_init(struct cs4281 *chip)
                  */
                 if (snd_cs4281_peekBA0(chip, BA0_ACSTS) & BA0_ACSTS_CRDY)
                         goto __ok1;
-                msleep(1);
-        } while (timeout-- > 0);
+                schedule_timeout_uninterruptible(1);
+        } while (time_after_eq(end_time, jiffies));
 
         snd_printk(KERN_ERR "never read codec ready from AC'97 (0x%x)\n", snd_cs4281_peekBA0(chip, BA0_ACSTS));
         return -EIO;
 
       __ok1:
         if (chip->dual_codec) {
-                timeout = 100;
+                end_time = jiffies + HZ;
                 do {
                         if (snd_cs4281_peekBA0(chip, BA0_ACSTS2) & BA0_ACSTS_CRDY)
                                 goto __codec2_ok;
-                        msleep(1);
-                } while (timeout-- > 0);
+                        schedule_timeout_uninterruptible(1);
+                } while (time_after_eq(end_time, jiffies));
                 snd_printk(KERN_INFO "secondary codec doesn't respond. disable it...\n");
                 chip->dual_codec = 0;
         __codec2_ok: ;
@@ -1561,7 +1561,7 @@ static int snd_cs4281_chip_init(struct cs4281 *chip)
          *  the codec is pumping ADC data across the AC-link.
          */
 
-        timeout = 100;
+        end_time = jiffies + HZ;
         do {
                 /*
                  *  Read the input slot valid register and see if input slots 3
@@ -1569,8 +1569,8 @@ static int snd_cs4281_chip_init(struct cs4281 *chip)
                  */
                 if ((snd_cs4281_peekBA0(chip, BA0_ACISV) & (BA0_ACISV_SLV(3) | BA0_ACISV_SLV(4))) == (BA0_ACISV_SLV(3) | BA0_ACISV_SLV(4)))
                         goto __ok2;
-                msleep(1);
-        } while (timeout-- > 0);
+                schedule_timeout_uninterruptible(1);
+        } while (time_after_eq(end_time, jiffies));
 
         if (--retry_count > 0)
                 goto __retry;
diff --git a/sound/pci/hda/hda_codec.c b/sound/pci/hda/hda_codec.c
index b42dff7ceed0..5bee3b536478 100644
--- a/sound/pci/hda/hda_codec.c
+++ b/sound/pci/hda/hda_codec.c
@@ -295,7 +295,7 @@ static int init_unsol_queue(struct hda_bus *bus)
                 snd_printk(KERN_ERR "hda_codec: can't allocate unsolicited queue\n");
                 return -ENOMEM;
         }
-        unsol->workq = create_workqueue("hda_codec");
+        unsol->workq = create_singlethread_workqueue("hda_codec");
         if (! unsol->workq) {
                 snd_printk(KERN_ERR "hda_codec: can't create workqueue\n");
                 kfree(unsol);
diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c
index c096606970ff..0ad60ae29011 100644
--- a/sound/pci/hda/hda_intel.c
+++ b/sound/pci/hda/hda_intel.c
@@ -81,6 +81,7 @@ MODULE_SUPPORTED_DEVICE("{{Intel, ICH6},"
                          "{Intel, ESB2},"
                          "{Intel, ICH8},"
                          "{ATI, SB450},"
+                         "{ATI, SB600},"
                          "{VIA, VT8251},"
                          "{VIA, VT8237A},"
                          "{SiS, SIS966},"
@@ -1619,6 +1620,7 @@ static struct pci_device_id azx_ids[] = {
         { 0x8086, 0x269a, PCI_ANY_ID, PCI_ANY_ID, 0, 0, AZX_DRIVER_ICH }, /* ESB2 */
         { 0x8086, 0x284b, PCI_ANY_ID, PCI_ANY_ID, 0, 0, AZX_DRIVER_ICH }, /* ICH8 */
         { 0x1002, 0x437b, PCI_ANY_ID, PCI_ANY_ID, 0, 0, AZX_DRIVER_ATI }, /* ATI SB450 */
+        { 0x1002, 0x4383, PCI_ANY_ID, PCI_ANY_ID, 0, 0, AZX_DRIVER_ATI }, /* ATI SB600 */
         { 0x1106, 0x3288, PCI_ANY_ID, PCI_ANY_ID, 0, 0, AZX_DRIVER_VIA }, /* VIA VT8251/VT8237A */
         { 0x1039, 0x7502, PCI_ANY_ID, PCI_ANY_ID, 0, 0, AZX_DRIVER_SIS }, /* SIS966 */
         { 0x10b9, 0x5461, PCI_ANY_ID, PCI_ANY_ID, 0, 0, AZX_DRIVER_ULI }, /* ULI M5461 */
diff --git a/sound/pci/hda/patch_analog.c b/sound/pci/hda/patch_analog.c
index 32401bd8c229..2bfe37e8543c 100644
--- a/sound/pci/hda/patch_analog.c
+++ b/sound/pci/hda/patch_analog.c
@@ -44,6 +44,7 @@ struct ad198x_spec {
                                          * dig_out_nid and hp_nid are optional
                                          */
         unsigned int cur_eapd;
+        unsigned int need_dac_fix;
 
         /* capture */
         unsigned int num_adc_nids;
@@ -836,10 +837,14 @@ static int patch_ad1986a(struct hda_codec *codec)
         case AD1986A_3STACK:
                 spec->num_mixers = 2;
                 spec->mixers[1] = ad1986a_3st_mixers;
-                spec->num_init_verbs = 2;
+                spec->num_init_verbs = 3;
                 spec->init_verbs[1] = ad1986a_3st_init_verbs;
+                spec->init_verbs[2] = ad1986a_ch2_init;
                 spec->channel_mode = ad1986a_modes;
                 spec->num_channel_mode = ARRAY_SIZE(ad1986a_modes);
+                spec->need_dac_fix = 1;
+                spec->multiout.max_channels = 2;
+                spec->multiout.num_dacs = 1;
                 break;
         case AD1986A_LAPTOP:
                 spec->mixers[0] = ad1986a_laptop_mixers;
@@ -1555,6 +1560,8 @@ static int ad198x_ch_mode_put(struct snd_kcontrol *kcontrol,
 {
         struct hda_codec *codec = snd_kcontrol_chip(kcontrol);
         struct ad198x_spec *spec = codec->spec;
+        if (spec->need_dac_fix)
+                spec->multiout.num_dacs = spec->multiout.max_channels / 2;
         return snd_hda_ch_mode_put(codec, ucontrol, spec->channel_mode,
                                    spec->num_channel_mode, &spec->multiout.max_channels);
 }
diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
index 4c6c9ec8ea5b..66bbdb60f50b 100644
--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -52,6 +52,7 @@ enum {
         ALC880_CLEVO,
         ALC880_TCL_S700,
         ALC880_LG,
+        ALC880_LG_LW,
 #ifdef CONFIG_SND_DEBUG
         ALC880_TEST,
 #endif
@@ -131,6 +132,7 @@ struct alc_spec {
         hda_nid_t dig_in_nid;           /* digital-in NID; optional */
 
         /* capture source */
+        unsigned int num_mux_defs;
         const struct hda_input_mux *input_mux;
         unsigned int cur_mux[3];
 
@@ -172,6 +174,7 @@ struct alc_config_preset {
         hda_nid_t dig_in_nid;
         unsigned int num_channel_mode;
         const struct hda_channel_mode *channel_mode;
+        unsigned int num_mux_defs;
         const struct hda_input_mux *input_mux;
         void (*unsol_event)(struct hda_codec *, unsigned int);
         void (*init_hook)(struct hda_codec *);
@@ -185,7 +188,10 @@ static int alc_mux_enum_info(struct snd_kcontrol *kcontrol, struct snd_ctl_elem_
 {
         struct hda_codec *codec = snd_kcontrol_chip(kcontrol);
         struct alc_spec *spec = codec->spec;
-        return snd_hda_input_mux_info(spec->input_mux, uinfo);
+        unsigned int mux_idx = snd_ctl_get_ioffidx(kcontrol, &uinfo->id);
+        if (mux_idx >= spec->num_mux_defs)
+                mux_idx = 0;
+        return snd_hda_input_mux_info(&spec->input_mux[mux_idx], uinfo);
 }
 
 static int alc_mux_enum_get(struct snd_kcontrol *kcontrol, struct snd_ctl_elem_value *ucontrol)
@@ -203,7 +209,8 @@ static int alc_mux_enum_put(struct snd_kcontrol *kcontrol, struct snd_ctl_elem_v
         struct hda_codec *codec = snd_kcontrol_chip(kcontrol);
         struct alc_spec *spec = codec->spec;
         unsigned int adc_idx = snd_ctl_get_ioffidx(kcontrol, &ucontrol->id);
-        return snd_hda_input_mux_put(codec, spec->input_mux, ucontrol,
+        unsigned int mux_idx = adc_idx >= spec->num_mux_defs ? 0 : adc_idx;
+        return snd_hda_input_mux_put(codec, &spec->input_mux[mux_idx], ucontrol,
                                      spec->adc_nids[adc_idx], &spec->cur_mux[adc_idx]);
 }
 
@@ -245,7 +252,8 @@ static int alc_ch_mode_put(struct snd_kcontrol *kcontrol, struct snd_ctl_elem_va
  * states other than HiZ (eg: PIN_VREFxx) and revert to HiZ if any of these
  * are requested.  Therefore order this list so that this behaviour will not
  * cause problems when mixer clients move through the enum sequentially.
- * NIDs 0x0f and 0x10 have been observed to have this behaviour.
+ * NIDs 0x0f and 0x10 have been observed to have this behaviour as of
+ * March 2006.
  */
 static char *alc_pin_mode_names[] = {
         "Mic 50pc bias", "Mic 80pc bias",
@@ -255,19 +263,27 @@ static unsigned char alc_pin_mode_values[] = {
         PIN_VREF50, PIN_VREF80, PIN_IN, PIN_OUT, PIN_HP,
 };
 /* The control can present all 5 options, or it can limit the options based
- * in the pin being assumed to be exclusively an input or an output pin.
+ * in the pin being assumed to be exclusively an input or an output pin.  In
+ * addition, "input" pins may or may not process the mic bias option
+ * depending on actual widget capability (NIDs 0x0f and 0x10 don't seem to
+ * accept requests for bias as of chip versions up to March 2006) and/or
+ * wiring in the computer.
  */
-#define ALC_PIN_DIR_IN    0x00
-#define ALC_PIN_DIR_OUT   0x01
-#define ALC_PIN_DIR_INOUT 0x02
+#define ALC_PIN_DIR_IN              0x00
+#define ALC_PIN_DIR_OUT             0x01
+#define ALC_PIN_DIR_INOUT           0x02
+#define ALC_PIN_DIR_IN_NOMICBIAS    0x03
+#define ALC_PIN_DIR_INOUT_NOMICBIAS 0x04
 
-/* Info about the pin modes supported by the three different pin directions. 
+/* Info about the pin modes supported by the different pin direction modes. 
  * For each direction the minimum and maximum values are given.
  */
-static signed char alc_pin_mode_dir_info[3][2] = {
+static signed char alc_pin_mode_dir_info[5][2] = {
         { 0, 2 },    /* ALC_PIN_DIR_IN */
         { 3, 4 },    /* ALC_PIN_DIR_OUT */
         { 0, 4 },    /* ALC_PIN_DIR_INOUT */
+        { 2, 2 },    /* ALC_PIN_DIR_IN_NOMICBIAS */
+        { 2, 4 },    /* ALC_PIN_DIR_INOUT_NOMICBIAS */
 };
 #define alc_pin_mode_min(_dir) (alc_pin_mode_dir_info[_dir][0])
 #define alc_pin_mode_max(_dir) (alc_pin_mode_dir_info[_dir][1])
@@ -329,9 +345,10 @@ static int alc_pin_mode_put(struct snd_kcontrol *kcontrol, struct snd_ctl_elem_v
                  * input modes.
                  *
                  * Dynamically switching the input/output buffers probably
-                 * reduces noise slightly, particularly on input.  However,
-                 * havingboth input and output buffers enabled
-                 * simultaneously doesn't seem to be problematic.
+                 * reduces noise slightly (particularly on input) so we'll
+                 * do it.  However, having both input and output buffers
+                 * enabled simultaneously doesn't seem to be problematic if
+                 * this turns out to be necessary in the future.
                  */
                 if (val <= 2) {
                         snd_hda_codec_write(codec,nid,0,AC_VERB_SET_AMP_GAIN_MUTE,
@@ -483,6 +500,9 @@ static void setup_preset(struct alc_spec *spec, const struct alc_config_preset *
         spec->multiout.dig_out_nid = preset->dig_out_nid;
         spec->multiout.hp_nid = preset->hp_nid;
         
+        spec->num_mux_defs = preset->num_mux_defs;
+        if (! spec->num_mux_defs)
+                spec->num_mux_defs = 1;
         spec->input_mux = preset->input_mux;
 
         spec->num_adc_nids = preset->num_adc_nids;
@@ -1427,6 +1447,82 @@ static void alc880_lg_unsol_event(struct hda_codec *codec, unsigned int res)
 }
 
 /*
+ * LG LW20
+ *
+ * Pin assignment:
+ *   Speaker-out: 0x14
+ *   Mic-In: 0x18
+ *   Built-in Mic-In: 0x19 (?)
+ *   HP-Out: 0x1b
+ *   SPDIF-Out: 0x1e
+ */
+
+/* seems analog CD is not working */
+static struct hda_input_mux alc880_lg_lw_capture_source = {
+        .num_items = 2,
+        .items = {
+                { "Mic", 0x0 },
+                { "Internal Mic", 0x1 },
+        },
+};
+
+static struct snd_kcontrol_new alc880_lg_lw_mixer[] = {
+        HDA_CODEC_VOLUME("Master Playback Volume", 0x0c, 0x0, HDA_OUTPUT),
+        HDA_BIND_MUTE("Master Playback Switch", 0x0c, 2, HDA_INPUT),
+        HDA_CODEC_VOLUME("Mic Playback Volume", 0x0b, 0x0, HDA_INPUT),
+        HDA_CODEC_MUTE("Mic Playback Switch", 0x0b, 0x0, HDA_INPUT),
+        HDA_CODEC_VOLUME("Internal Mic Playback Volume", 0x0b, 0x01, HDA_INPUT),
+        HDA_CODEC_MUTE("Internal Mic Playback Switch", 0x0b, 0x01, HDA_INPUT),
+        { } /* end */
+};
+
+static struct hda_verb alc880_lg_lw_init_verbs[] = {
+        /* set capture source to mic-in */
+        {0x07, AC_VERB_SET_AMP_GAIN_MUTE, AMP_IN_UNMUTE(0)},
+        {0x08, AC_VERB_SET_AMP_GAIN_MUTE, AMP_IN_UNMUTE(0)},
+        {0x09, AC_VERB_SET_AMP_GAIN_MUTE, AMP_IN_UNMUTE(0)},
+        {0x0b, AC_VERB_SET_AMP_GAIN_MUTE, AMP_IN_UNMUTE(7)},
+        /* speaker-out */
+        {0x14, AC_VERB_SET_PIN_WIDGET_CONTROL, PIN_HP},
+        {0x14, AC_VERB_SET_AMP_GAIN_MUTE, AMP_OUT_UNMUTE},
+        /* HP-out */
+        {0x13, AC_VERB_SET_CONNECT_SEL, 0x00},
+        {0x1b, AC_VERB_SET_PIN_WIDGET_CONTROL, PIN_HP},
+        {0x1b, AC_VERB_SET_AMP_GAIN_MUTE, AMP_OUT_UNMUTE},
+        /* mic-in to input */
+        {0x18, AC_VERB_SET_PIN_WIDGET_CONTROL, PIN_VREF80},
+        {0x18, AC_VERB_SET_AMP_GAIN_MUTE, AMP_OUT_UNMUTE},
+        /* built-in mic */
+        {0x19, AC_VERB_SET_PIN_WIDGET_CONTROL, PIN_VREF80},
+        {0x19, AC_VERB_SET_AMP_GAIN_MUTE, AMP_OUT_UNMUTE},
+        /* jack sense */
+        {0x1b, AC_VERB_SET_UNSOLICITED_ENABLE, AC_USRSP_EN | 0x1},
+        { }
+};
+
+/* toggle speaker-output according to the hp-jack state */
+static void alc880_lg_lw_automute(struct hda_codec *codec)
+{
+        unsigned int present;
+
+        present = snd_hda_codec_read(codec, 0x1b, 0,
+                                     AC_VERB_GET_PIN_SENSE, 0) & 0x80000000;
+        snd_hda_codec_amp_update(codec, 0x14, 0, HDA_OUTPUT, 0,
+                                 0x80, present ? 0x80 : 0);
+        snd_hda_codec_amp_update(codec, 0x14, 1, HDA_OUTPUT, 0,
+                                 0x80, present ? 0x80 : 0);
+}
+
+static void alc880_lg_lw_unsol_event(struct hda_codec *codec, unsigned int res)
+{
+        /* Looks like the unsol event is incompatible with the standard
+         * definition.  4bit tag is placed at 28 bit!
+         */
+        if ((res >> 28) == 0x01)
+                alc880_lg_lw_automute(codec);
+}
+
+/*
  * Common callbacks
  */
 
@@ -2078,6 +2174,9 @@ static struct hda_board_config alc880_cfg_tbl[] = {
         { .modelname = "lg", .config = ALC880_LG },
         { .pci_subvendor = 0x1854, .pci_subdevice = 0x003b, .config = ALC880_LG },
 
+        { .modelname = "lg-lw", .config = ALC880_LG_LW },
+        { .pci_subvendor = 0x1854, .pci_subdevice = 0x0018, .config = ALC880_LG_LW },
+
 #ifdef CONFIG_SND_DEBUG
         { .modelname = "test", .config = ALC880_TEST },
 #endif
@@ -2268,6 +2367,19 @@ static struct alc_config_preset alc880_presets[] = {
                 .unsol_event = alc880_lg_unsol_event,
                 .init_hook = alc880_lg_automute,
         },
+        [ALC880_LG_LW] = {
+                .mixers = { alc880_lg_lw_mixer },
+                .init_verbs = { alc880_volume_init_verbs,
+                                alc880_lg_lw_init_verbs },
+                .num_dacs = 1, 
+                .dac_nids = alc880_dac_nids,
+                .dig_out_nid = ALC880_DIGOUT_NID,
+                .num_channel_mode = ARRAY_SIZE(alc880_2_jack_modes),
+                .channel_mode = alc880_2_jack_modes,
+                .input_mux = &alc880_lg_lw_capture_source,
+                .unsol_event = alc880_lg_lw_unsol_event,
+                .init_hook = alc880_lg_lw_automute,
+        },
 #ifdef CONFIG_SND_DEBUG
         [ALC880_TEST] = {
                 .mixers = { alc880_test_mixer },
@@ -2593,6 +2705,7 @@ static int alc880_parse_auto_config(struct hda_codec *codec)
 
         spec->init_verbs[spec->num_init_verbs++] = alc880_volume_init_verbs;
 
+        spec->num_mux_defs = 1;
         spec->input_mux = &spec->private_imux;
 
         return 1;
@@ -2722,30 +2835,56 @@ static struct hda_input_mux alc260_capture_source = {
 };
 
 /* On Fujitsu S702x laptops capture only makes sense from Mic/LineIn jack,
- * headphone jack and the internal CD lines.
+ * headphone jack and the internal CD lines since these are the only pins at
+ * which audio can appear.  For flexibility, also allow the option of
+ * recording the mixer output on the second ADC (ADC0 doesn't have a
+ * connection to the mixer output).
  */
-static struct hda_input_mux alc260_fujitsu_capture_source = {
-        .num_items = 3,
-        .items = {
-                { "Mic/Line", 0x0 },
-                { "CD", 0x4 },
-                { "Headphone", 0x2 },
+static struct hda_input_mux alc260_fujitsu_capture_sources[2] = {
+        {
+                .num_items = 3,
+                .items = {
+                        { "Mic/Line", 0x0 },
+                        { "CD", 0x4 },
+                        { "Headphone", 0x2 },
+                },
         },
+        {
+                .num_items = 4,
+                .items = {
+                        { "Mic/Line", 0x0 },
+                        { "CD", 0x4 },
+                        { "Headphone", 0x2 },
+                        { "Mixer", 0x5 },
+                },
+        },
+
 };
 
-/* Acer TravelMate(/Extensa/Aspire) notebooks have similar configutation to
- * the Fujitsu S702x, but jacks are marked differently. We won't allow
- * retasking the Headphone jack, so it won't be available here.
+/* Acer TravelMate(/Extensa/Aspire) notebooks have similar configuration to
+ * the Fujitsu S702x, but jacks are marked differently.
  */
-static struct hda_input_mux alc260_acer_capture_source = {
-        .num_items = 3,
-        .items = {
-                { "Mic", 0x0 },
-                { "Line", 0x2 },
-                { "CD", 0x4 },
+static struct hda_input_mux alc260_acer_capture_sources[2] = {
+        {
+                .num_items = 4,
+                .items = {
+                        { "Mic", 0x0 },
+                        { "Line", 0x2 },
+                        { "CD", 0x4 },
+                        { "Headphone", 0x5 },
+                },
+        },
+        {
+                .num_items = 5,
+                .items = {
+                        { "Mic", 0x0 },
+                        { "Line", 0x2 },
+                        { "CD", 0x4 },
+                        { "Headphone", 0x6 },
+                        { "Mixer", 0x5 },
+                },
         },
 };
-
 /*
  * This is just place-holder, so there's something for alc_build_pcms to look
  * at when it calculates the maximum number of channels. ALC260 has no mixer
@@ -2806,6 +2945,9 @@ static struct snd_kcontrol_new alc260_hp_3013_mixer[] = {
         { } /* end */
 };
 
+/* Fujitsu S702x series laptops.  ALC260 pin usage: Mic/Line jack = 0x12, 
+ * HP jack = 0x14, CD audio =  0x16, internal speaker = 0x10.
+ */
 static struct snd_kcontrol_new alc260_fujitsu_mixer[] = {
         HDA_CODEC_VOLUME("Headphone Playback Volume", 0x08, 0x0, HDA_OUTPUT),
         HDA_BIND_MUTE("Headphone Playback Switch", 0x08, 2, HDA_INPUT),
@@ -2822,9 +2964,28 @@ static struct snd_kcontrol_new alc260_fujitsu_mixer[] = {
         { } /* end */
 };
 
+/* Mixer for Acer TravelMate(/Extensa/Aspire) notebooks.  Note that current
+ * versions of the ALC260 don't act on requests to enable mic bias from NID
+ * 0x0f (used to drive the headphone jack in these laptops).  The ALC260
+ * datasheet doesn't mention this restriction.  At this stage it's not clear
+ * whether this behaviour is intentional or is a hardware bug in chip
+ * revisions available in early 2006.  Therefore for now allow the
+ * "Headphone Jack Mode" control to span all choices, but if it turns out
+ * that the lack of mic bias for this NID is intentional we could change the
+ * mode from ALC_PIN_DIR_INOUT to ALC_PIN_DIR_INOUT_NOMICBIAS.
+ *
+ * In addition, Acer TravelMate(/Extensa/Aspire) notebooks in early 2006
+ * don't appear to make the mic bias available from the "line" jack, even
+ * though the NID used for this jack (0x14) can supply it.  The theory is
+ * that perhaps Acer have included blocking capacitors between the ALC260
+ * and the output jack.  If this turns out to be the case for all such
+ * models the "Line Jack Mode" mode could be changed from ALC_PIN_DIR_INOUT
+ * to ALC_PIN_DIR_INOUT_NOMICBIAS.
+ */
 static struct snd_kcontrol_new alc260_acer_mixer[] = {
         HDA_CODEC_VOLUME("Master Playback Volume", 0x08, 0x0, HDA_OUTPUT),
         HDA_BIND_MUTE("Master Playback Switch", 0x08, 2, HDA_INPUT),
+        ALC_PIN_MODE("Headphone Jack Mode", 0x0f, ALC_PIN_DIR_INOUT),
         HDA_CODEC_VOLUME("CD Playback Volume", 0x07, 0x04, HDA_INPUT),
         HDA_CODEC_MUTE("CD Playback Switch", 0x07, 0x04, HDA_INPUT),
         HDA_CODEC_VOLUME("Mic Playback Volume", 0x07, 0x0, HDA_INPUT),
@@ -3038,7 +3199,8 @@ static struct hda_verb alc260_hp_3013_init_verbs[] = {
 };
 
 /* Initialisation sequence for ALC260 as configured in Fujitsu S702x
- * laptops.
+ * laptops.  ALC260 pin usage: Mic/Line jack = 0x12, HP jack = 0x14, CD
+ * audio = 0x16, internal speaker = 0x10.
  */
 static struct hda_verb alc260_fujitsu_init_verbs[] = {
         /* Disable all GPIOs */
@@ -3185,10 +3347,10 @@ static struct hda_verb alc260_acer_init_verbs[] = {
         {0x04, AC_VERB_SET_CONNECT_SEL, 0x00},
 
         /* Do similar with the second ADC: mute capture input amp and
-         * set ADC connection to line (on line1 pin)
+         * set ADC connection to mic to match ALSA's default state.
          */
         {0x05, AC_VERB_SET_AMP_GAIN_MUTE, AMP_IN_MUTE(0)},
-        {0x05, AC_VERB_SET_CONNECT_SEL, 0x02},
+        {0x05, AC_VERB_SET_CONNECT_SEL, 0x00},
 
         /* Mute all inputs to mixer widget (even unconnected ones) */
         {0x07, AC_VERB_SET_AMP_GAIN_MUTE, AMP_IN_MUTE(0)}, /* mic1 pin */
@@ -3213,26 +3375,35 @@ static hda_nid_t alc260_test_dac_nids[1] = {
 static hda_nid_t alc260_test_adc_nids[2] = {
         0x04, 0x05,
 };
-/* This is a bit messy since the two input muxes in the ALC260 have slight
- * variations in their signal assignments.  The ideal way to deal with this
- * is to extend alc_spec.input_mux to allow a different input MUX for each
- * ADC.  For the purposes of the test model it's sufficient to just list
- * both options for affected signal indices.  The separate input mux
- * functionality only needs to be considered if a model comes along which
- * actually uses signals 0x5, 0x6 and 0x7 for something which makes sense to
- * record.
+/* For testing the ALC260, each input MUX needs its own definition since
+ * the signal assignments are different.  This assumes that the first ADC 
+ * is NID 0x04.
  */
-static struct hda_input_mux alc260_test_capture_source = {
-        .num_items = 8,
-        .items = {
-                { "MIC1 pin", 0x0 },
-                { "MIC2 pin", 0x1 },
-                { "LINE1 pin", 0x2 },
-                { "LINE2 pin", 0x3 },
-                { "CD pin", 0x4 },
-                { "LINE-OUT pin (cap1), Mixer (cap2)", 0x5 },
-                { "HP-OUT pin (cap1), LINE-OUT pin (cap2)", 0x6 },
-                { "HP-OUT pin (cap2 only)", 0x7 },
+static struct hda_input_mux alc260_test_capture_sources[2] = {
+        {
+                .num_items = 7,
+                .items = {
+                        { "MIC1 pin", 0x0 },
+                        { "MIC2 pin", 0x1 },
+                        { "LINE1 pin", 0x2 },
+                        { "LINE2 pin", 0x3 },
+                        { "CD pin", 0x4 },
+                        { "LINE-OUT pin", 0x5 },
+                        { "HP-OUT pin", 0x6 },
+                },
+        },
+        {
+                .num_items = 8,
+                .items = {
+                        { "MIC1 pin", 0x0 },
+                        { "MIC2 pin", 0x1 },
+                        { "LINE1 pin", 0x2 },
+                        { "LINE2 pin", 0x3 },
+                        { "CD pin", 0x4 },
+                        { "Mixer", 0x5 },
+                        { "LINE-OUT pin", 0x6 },
+                        { "HP-OUT pin", 0x7 },
+                },
         },
 };
 static struct snd_kcontrol_new alc260_test_mixer[] = {
@@ -3244,7 +3415,17 @@ static struct snd_kcontrol_new alc260_test_mixer[] = {
         HDA_CODEC_VOLUME("LOUT1 Playback Volume", 0x08, 0x0, HDA_OUTPUT),
         HDA_BIND_MUTE("LOUT1 Playback Switch", 0x08, 2, HDA_INPUT),
 
-        /* Modes for retasking pin widgets */
+        /* Modes for retasking pin widgets
+         * Note: the ALC260 doesn't seem to act on requests to enable mic
+         * bias from NIDs 0x0f and 0x10.  The ALC260 datasheet doesn't
+         * mention this restriction.  At this stage it's not clear whether
+         * this behaviour is intentional or is a hardware bug in chip
+         * revisions available at least up until early 2006.  Therefore for
+         * now allow the "HP-OUT" and "LINE-OUT" Mode controls to span all
+         * choices, but if it turns out that the lack of mic bias for these
+         * NIDs is intentional we could change their modes from
+         * ALC_PIN_DIR_INOUT to ALC_PIN_DIR_INOUT_NOMICBIAS.
+         */
         ALC_PIN_MODE("HP-OUT pin mode", 0x10, ALC_PIN_DIR_INOUT),
         ALC_PIN_MODE("LINE-OUT pin mode", 0x0f, ALC_PIN_DIR_INOUT),
         ALC_PIN_MODE("LINE2 pin mode", 0x15, ALC_PIN_DIR_INOUT),
@@ -3606,6 +3787,7 @@ static int alc260_parse_auto_config(struct hda_codec *codec)
 
         spec->init_verbs[spec->num_init_verbs++] = alc260_volume_init_verbs;
 
+        spec->num_mux_defs = 1;
         spec->input_mux = &spec->private_imux;
 
         /* check whether NID 0x04 is valid */
@@ -3711,7 +3893,8 @@ static struct alc_config_preset alc260_presets[] = {
                 .adc_nids = alc260_dual_adc_nids,
                 .num_channel_mode = ARRAY_SIZE(alc260_modes),
                 .channel_mode = alc260_modes,
-                .input_mux = &alc260_fujitsu_capture_source,
+                .num_mux_defs = ARRAY_SIZE(alc260_fujitsu_capture_sources),
+                .input_mux = alc260_fujitsu_capture_sources,
         },
         [ALC260_ACER] = {
                 .mixers = { alc260_acer_mixer,
@@ -3723,7 +3906,8 @@ static struct alc_config_preset alc260_presets[] = {
                 .adc_nids = alc260_dual_adc_nids,
                 .num_channel_mode = ARRAY_SIZE(alc260_modes),
                 .channel_mode = alc260_modes,
-                .input_mux = &alc260_acer_capture_source,
+                .num_mux_defs = ARRAY_SIZE(alc260_acer_capture_sources),
+                .input_mux = alc260_acer_capture_sources,
         },
 #ifdef CONFIG_SND_DEBUG
         [ALC260_TEST] = {
@@ -3736,7 +3920,8 @@ static struct alc_config_preset alc260_presets[] = {
                 .adc_nids = alc260_test_adc_nids,
                 .num_channel_mode = ARRAY_SIZE(alc260_modes),
                 .channel_mode = alc260_modes,
-                .input_mux = &alc260_test_capture_source,
+                .num_mux_defs = ARRAY_SIZE(alc260_test_capture_sources),
+                .input_mux = alc260_test_capture_sources,
         },
 #endif
 };
@@ -3828,7 +4013,6 @@ static struct hda_input_mux alc882_capture_source = {
                 { "CD", 0x4 },
         },
 };
-
 #define alc882_mux_enum_info alc_mux_enum_info
 #define alc882_mux_enum_get alc_mux_enum_get
 
@@ -4730,6 +4914,7 @@ static int alc262_parse_auto_config(struct hda_codec *codec)
                 spec->mixers[spec->num_mixers++] = spec->kctl_alloc;
 
         spec->init_verbs[spec->num_init_verbs++] = alc262_volume_init_verbs;
+        spec->num_mux_defs = 1;
         spec->input_mux = &spec->private_imux;
 
         return 1;
@@ -5406,6 +5591,7 @@ static int alc861_parse_auto_config(struct hda_codec *codec)
 
         spec->init_verbs[spec->num_init_verbs++] = alc861_auto_init_verbs;
 
+        spec->num_mux_defs = 1;
         spec->input_mux = &spec->private_imux;
 
         spec->adc_nids = alc861_adc_nids;
diff --git a/sound/pci/hda/patch_sigmatel.c b/sound/pci/hda/patch_sigmatel.c
index b56ca4019392..abe9493f0a2c 100644
--- a/sound/pci/hda/patch_sigmatel.c
+++ b/sound/pci/hda/patch_sigmatel.c
@@ -534,6 +534,22 @@ static int stac92xx_build_pcms(struct hda_codec *codec)
         return 0;
 }
 
+static unsigned int stac92xx_get_vref(struct hda_codec *codec, hda_nid_t nid)
+{
+        unsigned int pincap = snd_hda_param_read(codec, nid,
+                                                 AC_PAR_PIN_CAP);
+        pincap = (pincap & AC_PINCAP_VREF) >> AC_PINCAP_VREF_SHIFT;
+        if (pincap & AC_PINCAP_VREF_100)
+                return AC_PINCTL_VREF_100;
+        if (pincap & AC_PINCAP_VREF_80)
+                return AC_PINCTL_VREF_80;
+        if (pincap & AC_PINCAP_VREF_50)
+                return AC_PINCTL_VREF_50;
+        if (pincap & AC_PINCAP_VREF_GRD)
+                return AC_PINCTL_VREF_GRD;
+        return 0;
+}
+
 static void stac92xx_auto_set_pinctl(struct hda_codec *codec, hda_nid_t nid, int pin_type)
 
 {
@@ -571,9 +587,12 @@ static int stac92xx_io_switch_put(struct snd_kcontrol *kcontrol, struct snd_ctl_
 
         if (val)
                 stac92xx_auto_set_pinctl(codec, nid, AC_PINCTL_OUT_EN);
-        else
-                stac92xx_auto_set_pinctl(codec, nid, AC_PINCTL_IN_EN);
-
+        else {
+                unsigned int pinctl = AC_PINCTL_IN_EN;
+                if (io_idx) /* set VREF for mic */
+                        pinctl |= stac92xx_get_vref(codec, nid);
+                stac92xx_auto_set_pinctl(codec, nid, pinctl);
+        }
         return 1;
 }
 
@@ -767,13 +786,8 @@ static int stac92xx_auto_create_hp_ctls(struct hda_codec *codec, struct auto_pin
                 return 0;
 
         wid_caps = get_wcaps(codec, pin);
-        if (wid_caps & AC_WCAP_UNSOL_CAP) {
-                /* Enable unsolicited responses on the HP widget */
-                snd_hda_codec_write(codec, pin, 0,
-                                AC_VERB_SET_UNSOLICITED_ENABLE,
-                                STAC_UNSOL_ENABLE);
+        if (wid_caps & AC_WCAP_UNSOL_CAP)
                 spec->hp_detect = 1;
-        }
 
         nid = snd_hda_codec_read(codec, pin, 0, AC_VERB_GET_CONNECT_LIST, 0) & 0xff;
         for (i = 0; i < cfg->line_outs; i++) {
@@ -896,13 +910,8 @@ static int stac9200_auto_create_hp_ctls(struct hda_codec *codec,
                 return 0;
 
         wid_caps = get_wcaps(codec, pin);
-        if (wid_caps & AC_WCAP_UNSOL_CAP) {
-                /* Enable unsolicited responses on the HP widget */
-                snd_hda_codec_write(codec, pin, 0,
-                                AC_VERB_SET_UNSOLICITED_ENABLE,
-                                STAC_UNSOL_ENABLE);
+        if (wid_caps & AC_WCAP_UNSOL_CAP)
                 spec->hp_detect = 1;
-        }
 
         return 0;
 }
@@ -944,6 +953,10 @@ static int stac92xx_init(struct hda_codec *codec)
 
         /* set up pins */
         if (spec->hp_detect) {
+                /* Enable unsolicited responses on the HP widget */
+                snd_hda_codec_write(codec, cfg->hp_pin, 0,
+                                AC_VERB_SET_UNSOLICITED_ENABLE,
+                                STAC_UNSOL_ENABLE);
                 /* fake event to set up pins */
                 codec->patch_ops.unsol_event(codec, STAC_HP_EVENT << 26);
         } else {
@@ -951,9 +964,13 @@ static int stac92xx_init(struct hda_codec *codec)
                 stac92xx_auto_init_hp_out(codec);
         }
         for (i = 0; i < AUTO_PIN_LAST; i++) {
-                if (cfg->input_pins[i])
-                        stac92xx_auto_set_pinctl(codec, cfg->input_pins[i],
-                                                 AC_PINCTL_IN_EN);
+                hda_nid_t nid = cfg->input_pins[i];
+                if (nid) {
+                        unsigned int pinctl = AC_PINCTL_IN_EN;
+                        if (i == AUTO_PIN_MIC || i == AUTO_PIN_FRONT_MIC)
+                                pinctl |= stac92xx_get_vref(codec, nid);
+                        stac92xx_auto_set_pinctl(codec, nid, pinctl);
+                }
         }
         if (cfg->dig_out_pin)
                 stac92xx_auto_set_pinctl(codec, cfg->dig_out_pin,
diff --git a/sound/pci/ice1712/aureon.c b/sound/pci/ice1712/aureon.c
index 7e6608b14abc..336dc489aee1 100644
--- a/sound/pci/ice1712/aureon.c
+++ b/sound/pci/ice1712/aureon.c
@@ -87,7 +87,151 @@
 #define CS8415_C_BUFFER 0x20
 #define CS8415_ID               0x7F
 
-static void aureon_ac97_write(struct snd_ice1712 *ice, unsigned short reg, unsigned short val) {
+/* PCA9554 registers */
+#define PCA9554_DEV     0x40            /* I2C device address */
+#define PCA9554_IN      0x00            /* input port */
+#define PCA9554_OUT     0x01            /* output port */
+#define PCA9554_INVERT  0x02            /* input invert */
+#define PCA9554_DIR     0x03            /* port directions */
+
+/*
+ * Aureon Universe additional controls using PCA9554
+ */
+
+/*
+ * Send data to pca9554
+ */
+static void aureon_pca9554_write(struct snd_ice1712 *ice, unsigned char reg,
+                                 unsigned char data)
+{
+        unsigned int tmp;
+        int i, j;
+        unsigned char dev = PCA9554_DEV;  /* ID 0100000, write */
+        unsigned char val = 0;
+
+        tmp = snd_ice1712_gpio_read(ice);
+
+        snd_ice1712_gpio_set_mask(ice, ~(AUREON_SPI_MOSI|AUREON_SPI_CLK|
+                                         AUREON_WM_RW|AUREON_WM_CS|
+                                         AUREON_CS8415_CS));
+        tmp |= AUREON_WM_RW;
+        tmp |= AUREON_CS8415_CS | AUREON_WM_CS; /* disable SPI devices */
+
+        tmp &= ~AUREON_SPI_MOSI;
+        tmp &= ~AUREON_SPI_CLK;
+        snd_ice1712_gpio_write(ice, tmp);
+        udelay(50);
+
+        /* 
+         * send i2c stop condition and start condition
+         * to obtain sane state
+         */
+        tmp |= AUREON_SPI_CLK;
+        snd_ice1712_gpio_write(ice, tmp);
+        udelay(50);
+        tmp |= AUREON_SPI_MOSI;
+        snd_ice1712_gpio_write(ice, tmp);
+        udelay(100);
+        tmp &= ~AUREON_SPI_MOSI;
+        snd_ice1712_gpio_write(ice, tmp);
+        udelay(50);
+        tmp &= ~AUREON_SPI_CLK;
+        snd_ice1712_gpio_write(ice, tmp);
+        udelay(100);
+        /*
+         * send device address, command and value,
+         * skipping ack cycles inbetween
+         */
+        for (j = 0; j < 3; j++) {
+                switch(j) {
+                case 0: val = dev; break;
+                case 1: val = reg; break;
+                case 2: val = data; break;
+                }
+                for (i = 7; i >= 0; i--) {
+                        tmp &= ~AUREON_SPI_CLK;
+                        snd_ice1712_gpio_write(ice, tmp);
+                        udelay(40);
+                        if (val & (1 << i))
+                                tmp |= AUREON_SPI_MOSI;
+                        else
+                                tmp &= ~AUREON_SPI_MOSI;
+                        snd_ice1712_gpio_write(ice, tmp);
+                        udelay(40);
+                        tmp |= AUREON_SPI_CLK;
+                        snd_ice1712_gpio_write(ice, tmp);
+                        udelay(40);
+                }
+                tmp &= ~AUREON_SPI_CLK;
+                snd_ice1712_gpio_write(ice, tmp);
+                udelay(40);
+                tmp |= AUREON_SPI_CLK;
+                snd_ice1712_gpio_write(ice, tmp);
+                udelay(40);
+                tmp &= ~AUREON_SPI_CLK;
+                snd_ice1712_gpio_write(ice, tmp);
+                udelay(40);
+        }
+        tmp &= ~AUREON_SPI_CLK;
+        snd_ice1712_gpio_write(ice, tmp);
+        udelay(40);
+        tmp &= ~AUREON_SPI_MOSI;
+        snd_ice1712_gpio_write(ice, tmp);
+        udelay(40);
+        tmp |= AUREON_SPI_CLK;
+        snd_ice1712_gpio_write(ice, tmp);
+        udelay(50);
+        tmp |= AUREON_SPI_MOSI;
+        snd_ice1712_gpio_write(ice, tmp);
+        udelay(100);
+}
+
+static int aureon_universe_inmux_info(struct snd_kcontrol *kcontrol,
+                                      struct snd_ctl_elem_info *uinfo)
+{
+        char *texts[3] = {"Internal Aux", "Wavetable", "Rear Line-In"};
+
+        uinfo->type = SNDRV_CTL_ELEM_TYPE_ENUMERATED;
+        uinfo->count = 1;
+        uinfo->value.enumerated.items = 3;
+        if(uinfo->value.enumerated.item >= uinfo->value.enumerated.items)
+                uinfo->value.enumerated.item = uinfo->value.enumerated.items - 1;
+        strcpy(uinfo->value.enumerated.name, texts[uinfo->value.enumerated.item]);
+        return 0;
+}
+
+static int aureon_universe_inmux_get(struct snd_kcontrol *kcontrol,
+                                     struct snd_ctl_elem_value *ucontrol)
+{
+        struct snd_ice1712 *ice = snd_kcontrol_chip(kcontrol);
+        ucontrol->value.integer.value[0] = ice->spec.aureon.pca9554_out;
+        return 0;
+}
+
+static int aureon_universe_inmux_put(struct snd_kcontrol *kcontrol,
+                                     struct snd_ctl_elem_value *ucontrol)
+{
+        struct snd_ice1712 *ice = snd_kcontrol_chip(kcontrol);
+        unsigned char oval, nval;
+        int change;
+
+        snd_ice1712_save_gpio_status(ice);
+        
+        oval = ice->spec.aureon.pca9554_out;
+        nval = ucontrol->value.integer.value[0];
+        if ((change = (oval != nval))) {
+                aureon_pca9554_write(ice, PCA9554_OUT, nval);
+                ice->spec.aureon.pca9554_out = nval;
+        }
+        snd_ice1712_restore_gpio_status(ice);
+        
+        return change;
+}
+
+
+static void aureon_ac97_write(struct snd_ice1712 *ice, unsigned short reg,
+                              unsigned short val)
+{
         unsigned int tmp;
 
         /* Send address to XILINX chip */
@@ -146,7 +290,8 @@ static unsigned short aureon_ac97_read(struct snd_ice1712 *ice, unsigned short r
 /*
  * Initialize STAC9744 chip
  */
-static int aureon_ac97_init (struct snd_ice1712 *ice) {
+static int aureon_ac97_init (struct snd_ice1712 *ice)
+{
         int i;
         static unsigned short ac97_defaults[] = {
                 0x00, 0x9640,
@@ -1598,7 +1743,15 @@ static struct snd_kcontrol_new universe_ac97_controls[] __devinitdata = {
                 .get = aureon_ac97_vol_get,
                 .put = aureon_ac97_vol_put,
                 .private_value = AC97_VIDEO|AUREON_AC97_STEREO
-        }
+        },
+        {
+                .iface = SNDRV_CTL_ELEM_IFACE_MIXER,
+                .name = "Aux Source",
+                .info = aureon_universe_inmux_info,
+                .get = aureon_universe_inmux_get,
+                .put = aureon_universe_inmux_put
+        }
+
 };
 
         
@@ -1856,6 +2009,10 @@ static int __devinit aureon_init(struct snd_ice1712 *ice)
         }
 
         snd_ice1712_restore_gpio_status(ice);
+
+        /* initialize PCA9554 pin directions & set default input*/
+        aureon_pca9554_write(ice, PCA9554_DIR, 0x00);
+        aureon_pca9554_write(ice, PCA9554_OUT, 0x00);   /* internal AUX */
         
         ice->spec.aureon.master[0] = WM_VOL_MUTE;
         ice->spec.aureon.master[1] = WM_VOL_MUTE;
diff --git a/sound/pci/ice1712/ice1712.c b/sound/pci/ice1712/ice1712.c
index b88eeba2f5d1..32f8415558a5 100644
--- a/sound/pci/ice1712/ice1712.c
+++ b/sound/pci/ice1712/ice1712.c
@@ -2402,7 +2402,7 @@ static int __devinit snd_ice1712_chip_init(struct snd_ice1712 *ice)
         if (ice->eeprom.subvendor == ICE1712_SUBDEVICE_DMX6FIRE && !ice->dxr_enable) {
                 /* Limit active ADCs and DACs to 6;  */
                 /* Note: DXR extension not supported */
-                pci_write_config_byte(ice->pci, 0x60, 0x0a);
+                pci_write_config_byte(ice->pci, 0x60, 0x2a);
         } else {
                 pci_write_config_byte(ice->pci, 0x60, ice->eeprom.data[ICE_EEP1_CODEC]);
         }
diff --git a/sound/pci/ice1712/ice1712.h b/sound/pci/ice1712/ice1712.h
index f9b22d4a3932..053f8e56fd68 100644
--- a/sound/pci/ice1712/ice1712.h
+++ b/sound/pci/ice1712/ice1712.h
@@ -373,6 +373,7 @@ struct snd_ice1712 {
                         unsigned int cs8415_mux;
                         unsigned short master[2];
                         unsigned short vol[8];
+                        unsigned char pca9554_out;
                 } aureon;
                 /* AC97 register cache for Phase28 */
                 struct phase28_spec {
diff --git a/sound/pci/maestro3.c b/sound/pci/maestro3.c
index 44393e190929..9c90d901e6b9 100644
--- a/sound/pci/maestro3.c
+++ b/sound/pci/maestro3.c
@@ -831,8 +831,8 @@ struct snd_m3 {
         struct snd_pcm *pcm;
 
         struct pci_dev *pci;
-        struct m3_quirk *quirk;
-        struct m3_hv_quirk *hv_quirk;
+        const struct m3_quirk *quirk;
+        const struct m3_hv_quirk *hv_quirk;
 
         int dacs_active;
         int timer_users;
@@ -892,7 +892,7 @@ static struct pci_device_id snd_m3_ids[] = {
 
 MODULE_DEVICE_TABLE(pci, snd_m3_ids);
 
-static struct m3_quirk m3_quirk_list[] = {
+static const struct m3_quirk m3_quirk_list[] = {
         /* panasonic CF-28 "toughbook" */
         {
                 .name = "Panasonic CF-28",
@@ -950,7 +950,7 @@ static struct m3_quirk m3_quirk_list[] = {
 };
 
 /* These values came from the Windows driver. */
-static struct m3_hv_quirk m3_hv_quirk_list[] = {
+static const struct m3_hv_quirk m3_hv_quirk_list[] = {
         /* Allegro chips */
         { 0x125D, 0x1988, 0x0E11, 0x002E, HV_CTRL_ENABLE | HV_BUTTON_FROM_GD, 0 },
         { 0x125D, 0x1988, 0x0E11, 0x0094, HV_CTRL_ENABLE | HV_BUTTON_FROM_GD, 0 },
@@ -1361,7 +1361,7 @@ static void snd_m3_pcm_setup2(struct snd_m3 *chip, struct m3_dma *s,
 }
 
 
-static struct play_vals {
+static const struct play_vals {
         u16 addr, val;
 } pv[] = {
         {CDATA_LEFT_VOLUME, ARB_VOLUME},
@@ -1428,7 +1428,7 @@ snd_m3_playback_setup(struct snd_m3 *chip, struct m3_dma *s,
 /*
  *    Native record driver 
  */
-static struct rec_vals {
+static const struct rec_vals {
         u16 addr, val;
 } rv[] = {
         {CDATA_LEFT_VOLUME, ARB_VOLUME},
@@ -1598,12 +1598,26 @@ static void snd_m3_update_ptr(struct snd_m3 *chip, struct m3_dma *s)
         if (! s->running)
                 return;
 
-        hwptr = snd_m3_get_pointer(chip, s, subs) % s->dma_size;
-        diff = (s->dma_size + hwptr - s->hwptr) % s->dma_size;
+        hwptr = snd_m3_get_pointer(chip, s, subs);
+
+        /* try to avoid expensive modulo divisions */
+        if (hwptr >= s->dma_size)
+                hwptr %= s->dma_size;
+
+        diff = s->dma_size + hwptr - s->hwptr;
+        if (diff >= s->dma_size)
+                diff %= s->dma_size;
+
         s->hwptr = hwptr;
         s->count += diff;
+
         if (s->count >= (signed)s->period_size) {
-                s->count %= s->period_size;
+
+                if (s->count < 2 * (signed)s->period_size)
+                        s->count -= (signed)s->period_size;
+                else
+                        s->count %= s->period_size;
+
                 spin_unlock(&chip->reg_lock);
                 snd_pcm_period_elapsed(subs);
                 spin_lock(&chip->reg_lock);
@@ -1942,6 +1956,7 @@ static int snd_m3_ac97_wait(struct snd_m3 *chip)
         do {
                 if (! (snd_m3_inb(chip, 0x30) & 1))
                         return 0;
+                cpu_relax();
         } while (i-- > 0);
 
         snd_printk(KERN_ERR "ac97 serial bus busy\n");
@@ -1953,16 +1968,18 @@ snd_m3_ac97_read(struct snd_ac97 *ac97, unsigned short reg)
 {
         struct snd_m3 *chip = ac97->private_data;
         unsigned long flags;
-        unsigned short data;
+        unsigned short data = 0xffff;
 
         if (snd_m3_ac97_wait(chip))
-                return 0xffff;
+                goto fail;
         spin_lock_irqsave(&chip->ac97_lock, flags);
         snd_m3_outb(chip, 0x80 | (reg & 0x7f), CODEC_COMMAND);
         if (snd_m3_ac97_wait(chip))
-                return 0xffff;
+                goto fail_unlock;
         data = snd_m3_inw(chip, CODEC_DATA);
+fail_unlock:
         spin_unlock_irqrestore(&chip->ac97_lock, flags);
+fail:
         return data;
 }
 
@@ -2121,7 +2138,7 @@ static int __devinit snd_m3_mixer(struct snd_m3 *chip)
  * DSP Code images
  */
 
-static u16 assp_kernel_image[] __devinitdata = {
+static const u16 assp_kernel_image[] __devinitdata = {
     0x7980, 0x0030, 0x7980, 0x03B4, 0x7980, 0x03B4, 0x7980, 0x00FB, 0x7980, 0x00DD, 0x7980, 0x03B4, 
     0x7980, 0x0332, 0x7980, 0x0287, 0x7980, 0x03B4, 0x7980, 0x03B4, 0x7980, 0x03B4, 0x7980, 0x03B4, 
     0x7980, 0x031A, 0x7980, 0x03B4, 0x7980, 0x022F, 0x7980, 0x03B4, 0x7980, 0x03B4, 0x7980, 0x03B4, 
@@ -2208,7 +2225,7 @@ static u16 assp_kernel_image[] __devinitdata = {
  * Mini sample rate converter code image
  * that is to be loaded at 0x400 on the DSP.
  */
-static u16 assp_minisrc_image[] __devinitdata = {
+static const u16 assp_minisrc_image[] __devinitdata = {
 
     0xBF80, 0x101E, 0x906E, 0x006E, 0x8B88, 0x6980, 0xEF88, 0x906F, 0x0D6F, 0x6900, 0xEB08, 0x0412, 
     0xBC20, 0x696E, 0xB801, 0x906E, 0x7980, 0x0403, 0xB90E, 0x8807, 0xBE43, 0xBF01, 0xBE47, 0xBE41, 
@@ -2251,7 +2268,7 @@ static u16 assp_minisrc_image[] __devinitdata = {
  */
 
 #define MINISRC_LPF_LEN 10
-static u16 minisrc_lpf[MINISRC_LPF_LEN] __devinitdata = {
+static const u16 minisrc_lpf[MINISRC_LPF_LEN] __devinitdata = {
         0X0743, 0X1104, 0X0A4C, 0XF88D, 0X242C,
         0X1023, 0X1AA9, 0X0B60, 0XEFDD, 0X186F
 };
@@ -2358,7 +2375,7 @@ static int __devinit snd_m3_assp_client_init(struct snd_m3 *chip, struct m3_dma
          */
 
         /*
-         * align instance address to 256 bytes so that it's
+         * align instance address to 256 bytes so that its
          * shifted list address is aligned.
          * list address = (mem address >> 1) >> 7;
          */
@@ -2647,8 +2664,8 @@ snd_m3_create(struct snd_card *card, struct pci_dev *pci,
 {
         struct snd_m3 *chip;
         int i, err;
-        struct m3_quirk *quirk;
-        struct m3_hv_quirk *hv_quirk;
+        const struct m3_quirk *quirk;
+        const struct m3_hv_quirk *hv_quirk;
         static struct snd_device_ops ops = {
                 .dev_free =     snd_m3_dev_free,
         };
@@ -2843,12 +2860,12 @@ snd_m3_probe(struct pci_dev *pci, const struct pci_device_id *pci_id)
         }
 
 #if 0 /* TODO: not supported yet */
-        /* TODO enable midi irq and i/o */
+        /* TODO enable MIDI IRQ and I/O */
         err = snd_mpu401_uart_new(chip->card, 0, MPU401_HW_MPU401,
                                   chip->iobase + MPU401_DATA_PORT, 1,
                                   chip->irq, 0, &chip->rmidi);
         if (err < 0)
-                printk(KERN_WARNING "maestro3: no midi support.\n");
+                printk(KERN_WARNING "maestro3: no MIDI support.\n");
 #endif
 
         pci_set_drvdata(pci, card);
diff --git a/sound/pci/pcxhr/pcxhr_core.c b/sound/pci/pcxhr/pcxhr_core.c
index fdc652c6992d..c40f59062684 100644
--- a/sound/pci/pcxhr/pcxhr_core.c
+++ b/sound/pci/pcxhr/pcxhr_core.c
@@ -274,12 +274,9 @@ int pcxhr_load_xilinx_binary(struct pcxhr_mgr *mgr, const struct firmware *xilin
 
         /* test first xilinx */
         chipsc = PCXHR_INPL(mgr, PCXHR_PLX_CHIPSC);
-        if (!second) {
-                if (chipsc & PCXHR_CHIPSC_GPI_USERI) {
-                        snd_printdd("no need to load first xilinx\n");
-                        return 0; /* first xilinx is already present and cannot be reset */
-                }
-        } else {
+        /* REV01 cards do not support the PCXHR_CHIPSC_GPI_USERI bit anymore */
+        /* this bit will always be 1; no possibility to test presence of first xilinx */
+        if(second) {
                 if ((chipsc & PCXHR_CHIPSC_GPI_USERI) == 0) {
                         snd_printk(KERN_ERR "error loading first xilinx\n");
                         return -EINVAL;
diff --git a/sound/pci/riptide/Makefile b/sound/pci/riptide/Makefile
new file mode 100644
index 000000000000..dcd2e64e4818
--- /dev/null
+++ b/sound/pci/riptide/Makefile
@@ -0,0 +1,3 @@
+snd-riptide-objs := riptide.o
+
+obj-$(CONFIG_SND_RIPTIDE) += snd-riptide.o
diff --git a/sound/pci/riptide/riptide.c b/sound/pci/riptide/riptide.c
new file mode 100644
index 000000000000..f148ee434a6b
--- /dev/null
+++ b/sound/pci/riptide/riptide.c
@@ -0,0 +1,2223 @@
+/*
+ *   Driver for the Conexant Riptide Soundchip
+ *
+ *      Copyright (c) 2004 Peter Gruber <nokos@gmx.net>
+ *
+ *   This program is free software; you can redistribute it and/or modify
+ *   it under the terms of the GNU General Public License as published by
+ *   the Free Software Foundation; either version 2 of the License, or
+ *   (at your option) any later version.
+ *
+ *   This program is distributed in the hope that it will be useful,
+ *   but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ *   GNU General Public License for more details.
+ *
+ *   You should have received a copy of the GNU General Public License
+ *   along with this program; if not, write to the Free Software
+ *   Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307 USA
+ *
+ */
+/*
+  History:
+   - 02/15/2004 first release
+   
+  This Driver is based on the OSS Driver version from Linuxant (riptide-0.6lnxtbeta03111100)
+  credits from the original files:
+  
+  MODULE NAME:        cnxt_rt.h                       
+  AUTHOR:             K. Lazarev  (Transcribed by KNL)
+  HISTORY:         Major Revision               Date        By
+            -----------------------------     --------     -----
+            Created                           02/1/2000     KNL
+
+  MODULE NAME:     int_mdl.c                       
+  AUTHOR:          Konstantin Lazarev    (Transcribed by KNL)
+  HISTORY:         Major Revision               Date        By
+            -----------------------------     --------     -----
+            Created                           10/01/99      KNL
+            
+  MODULE NAME:        riptide.h                       
+  AUTHOR:             O. Druzhinin  (Transcribed by OLD)
+  HISTORY:         Major Revision               Date        By
+            -----------------------------     --------     -----
+            Created                           10/16/97      OLD
+
+  MODULE NAME:        Rp_Cmdif.cpp                       
+  AUTHOR:             O. Druzhinin  (Transcribed by OLD)
+                      K. Lazarev    (Transcribed by KNL)
+  HISTORY:         Major Revision               Date        By
+            -----------------------------     --------     -----
+            Adopted from NT4 driver            6/22/99      OLD
+            Ported to Linux                    9/01/99      KNL
+
+  MODULE NAME:        rt_hw.c                       
+  AUTHOR:             O. Druzhinin  (Transcribed by OLD)
+                      C. Lazarev    (Transcribed by CNL)
+  HISTORY:         Major Revision               Date        By
+            -----------------------------     --------     -----
+            Created                           11/18/97      OLD
+            Hardware functions for RipTide    11/24/97      CNL
+            (ES1) are coded
+            Hardware functions for RipTide    12/24/97      CNL
+            (A0) are coded
+            Hardware functions for RipTide    03/20/98      CNL
+            (A1) are coded
+            Boot loader is included           05/07/98      CNL
+            Redesigned for WDM                07/27/98      CNL
+            Redesigned for Linux              09/01/99      CNL
+
+  MODULE NAME:        rt_hw.h
+  AUTHOR:             C. Lazarev    (Transcribed by CNL)
+  HISTORY:         Major Revision               Date        By
+            -----------------------------     --------     -----
+            Created                           11/18/97      CNL
+
+  MODULE NAME:     rt_mdl.c                       
+  AUTHOR:          Konstantin Lazarev    (Transcribed by KNL)
+  HISTORY:         Major Revision               Date        By
+            -----------------------------     --------     -----
+            Created                           10/01/99      KNL
+
+  MODULE NAME:        mixer.h                        
+  AUTHOR:             K. Kenney
+  HISTORY:         Major Revision                   Date          By
+            -----------------------------          --------     -----
+            Created from MS W95 Sample             11/28/95      KRS
+            RipTide                                10/15/97      KRS
+            Adopted for Windows NT driver          01/20/98      CNL
+*/
+
+#include <sound/driver.h>
+#include <linux/delay.h>
+#include <linux/init.h>
+#include <linux/interrupt.h>
+#include <linux/pci.h>
+#include <linux/slab.h>
+#include <linux/wait.h>
+#include <linux/gameport.h>
+#include <linux/device.h>
+#include <linux/firmware.h>
+#include <asm/io.h>
+#include <sound/core.h>
+#include <sound/info.h>
+#include <sound/control.h>
+#include <sound/pcm.h>
+#include <sound/pcm_params.h>
+#include <sound/ac97_codec.h>
+#include <sound/mpu401.h>
+#include <sound/opl3.h>
+#include <sound/initval.h>
+
+#if defined(CONFIG_GAMEPORT) || (defined(MODULE) && defined(CONFIG_GAMEPORT_MODULE))
+#define SUPPORT_JOYSTICK 1
+#endif
+
+MODULE_AUTHOR("Peter Gruber <nokos@gmx.net>");
+MODULE_DESCRIPTION("riptide");
+MODULE_LICENSE("GPL");
+MODULE_SUPPORTED_DEVICE("{{Conexant,Riptide}}");
+
+static int index[SNDRV_CARDS] = SNDRV_DEFAULT_IDX;
+static char *id[SNDRV_CARDS] = SNDRV_DEFAULT_STR;
+static int enable[SNDRV_CARDS] = SNDRV_DEFAULT_ENABLE;
+
+#ifdef SUPPORT_JOYSTICK
+static int joystick_port[SNDRV_CARDS] = { [0 ... (SNDRV_CARDS - 1)] = 0x200 };
+#endif
+static int mpu_port[SNDRV_CARDS] = { [0 ... (SNDRV_CARDS - 1)] = 0x330 };
+static int opl3_port[SNDRV_CARDS] = { [0 ... (SNDRV_CARDS - 1)] = 0x388 };
+
+module_param_array(index, int, NULL, 0444);
+MODULE_PARM_DESC(index, "Index value for Riptide soundcard.");
+module_param_array(id, charp, NULL, 0444);
+MODULE_PARM_DESC(id, "ID string for Riptide soundcard.");
+module_param_array(enable, bool, NULL, 0444);
+MODULE_PARM_DESC(enable, "Enable Riptide soundcard.");
+#ifdef SUPPORT_JOYSTICK
+module_param_array(joystick_port, int, NULL, 0444);
+MODULE_PARM_DESC(joystick_port, "Joystick port # for Riptide soundcard.");
+#endif
+module_param_array(mpu_port, int, NULL, 0444);
+MODULE_PARM_DESC(mpu_port, "MPU401 port # for Riptide driver.");
+module_param_array(opl3_port, int, NULL, 0444);
+MODULE_PARM_DESC(opl3_port, "OPL3 port # for Riptide driver.");
+
+/*
+ */
+
+#define MPU401_HW_RIPTIDE MPU401_HW_MPU401
+#define OPL3_HW_RIPTIDE   OPL3_HW_OPL3
+
+#define PCI_EXT_CapId       0x40
+#define PCI_EXT_NextCapPrt  0x41
+#define PCI_EXT_PWMC        0x42
+#define PCI_EXT_PWSCR       0x44
+#define PCI_EXT_Data00      0x46
+#define PCI_EXT_PMSCR_BSE   0x47
+#define PCI_EXT_SB_Base     0x48
+#define PCI_EXT_FM_Base     0x4a
+#define PCI_EXT_MPU_Base    0x4C
+#define PCI_EXT_Game_Base   0x4E
+#define PCI_EXT_Legacy_Mask 0x50
+#define PCI_EXT_AsicRev     0x52
+#define PCI_EXT_Reserved3   0x53
+
+#define LEGACY_ENABLE_ALL      0x8000   /* legacy device options */
+#define LEGACY_ENABLE_SB       0x4000
+#define LEGACY_ENABLE_FM       0x2000
+#define LEGACY_ENABLE_MPU_INT  0x1000
+#define LEGACY_ENABLE_MPU      0x0800
+#define LEGACY_ENABLE_GAMEPORT 0x0400
+
+#define MAX_WRITE_RETRY  10     /* cmd interface limits */
+#define MAX_ERROR_COUNT  10
+#define CMDIF_TIMEOUT    500000
+#define RESET_TRIES      5
+
+#define READ_PORT_ULONG(p)     inl((unsigned long)&(p))
+#define WRITE_PORT_ULONG(p,x)  outl(x,(unsigned long)&(p))
+
+#define READ_AUDIO_CONTROL(p)     READ_PORT_ULONG(p->audio_control)
+#define WRITE_AUDIO_CONTROL(p,x)  WRITE_PORT_ULONG(p->audio_control,x)
+#define UMASK_AUDIO_CONTROL(p,x)  WRITE_PORT_ULONG(p->audio_control,READ_PORT_ULONG(p->audio_control)|x)
+#define MASK_AUDIO_CONTROL(p,x)   WRITE_PORT_ULONG(p->audio_control,READ_PORT_ULONG(p->audio_control)&x)
+#define READ_AUDIO_STATUS(p)      READ_PORT_ULONG(p->audio_status)
+
+#define SET_GRESET(p)     UMASK_AUDIO_CONTROL(p,0x0001) /* global reset switch */
+#define UNSET_GRESET(p)   MASK_AUDIO_CONTROL(p,~0x0001)
+#define SET_AIE(p)        UMASK_AUDIO_CONTROL(p,0x0004) /* interrupt enable */
+#define UNSET_AIE(p)      MASK_AUDIO_CONTROL(p,~0x0004)
+#define SET_AIACK(p)      UMASK_AUDIO_CONTROL(p,0x0008) /* interrupt acknowledge */
+#define UNSET_AIACKT(p)   MASKAUDIO_CONTROL(p,~0x0008)
+#define SET_ECMDAE(p)     UMASK_AUDIO_CONTROL(p,0x0010)
+#define UNSET_ECMDAE(p)   MASK_AUDIO_CONTROL(p,~0x0010)
+#define SET_ECMDBE(p)     UMASK_AUDIO_CONTROL(p,0x0020)
+#define UNSET_ECMDBE(p)   MASK_AUDIO_CONTROL(p,~0x0020)
+#define SET_EDATAF(p)     UMASK_AUDIO_CONTROL(p,0x0040)
+#define UNSET_EDATAF(p)   MASK_AUDIO_CONTROL(p,~0x0040)
+#define SET_EDATBF(p)     UMASK_AUDIO_CONTROL(p,0x0080)
+#define UNSET_EDATBF(p)   MASK_AUDIO_CONTROL(p,~0x0080)
+#define SET_ESBIRQON(p)   UMASK_AUDIO_CONTROL(p,0x0100)
+#define UNSET_ESBIRQON(p) MASK_AUDIO_CONTROL(p,~0x0100)
+#define SET_EMPUIRQ(p)    UMASK_AUDIO_CONTROL(p,0x0200)
+#define UNSET_EMPUIRQ(p)  MASK_AUDIO_CONTROL(p,~0x0200)
+#define IS_CMDE(a)        (READ_PORT_ULONG(a->stat)&0x1)        /* cmd empty */
+#define IS_DATF(a)        (READ_PORT_ULONG(a->stat)&0x2)        /* data filled */
+#define IS_READY(p)       (READ_AUDIO_STATUS(p)&0x0001)
+#define IS_DLREADY(p)     (READ_AUDIO_STATUS(p)&0x0002)
+#define IS_DLERR(p)       (READ_AUDIO_STATUS(p)&0x0004)
+#define IS_GERR(p)        (READ_AUDIO_STATUS(p)&0x0008) /* error ! */
+#define IS_CMDAEIRQ(p)    (READ_AUDIO_STATUS(p)&0x0010)
+#define IS_CMDBEIRQ(p)    (READ_AUDIO_STATUS(p)&0x0020)
+#define IS_DATAFIRQ(p)    (READ_AUDIO_STATUS(p)&0x0040)
+#define IS_DATBFIRQ(p)    (READ_AUDIO_STATUS(p)&0x0080)
+#define IS_EOBIRQ(p)      (READ_AUDIO_STATUS(p)&0x0100) /* interrupt status */
+#define IS_EOSIRQ(p)      (READ_AUDIO_STATUS(p)&0x0200)
+#define IS_EOCIRQ(p)      (READ_AUDIO_STATUS(p)&0x0400)
+#define IS_UNSLIRQ(p)     (READ_AUDIO_STATUS(p)&0x0800)
+#define IS_SBIRQ(p)       (READ_AUDIO_STATUS(p)&0x1000)
+#define IS_MPUIRQ(p)      (READ_AUDIO_STATUS(p)&0x2000)
+
+#define RESP 0x00000001         /* command flags */
+#define PARM 0x00000002
+#define CMDA 0x00000004
+#define CMDB 0x00000008
+#define NILL 0x00000000
+
+#define LONG0(a)   ((u32)a)     /* shifts and masks */
+#define BYTE0(a)   (LONG0(a)&0xff)
+#define BYTE1(a)   (BYTE0(a)<<8)
+#define BYTE2(a)   (BYTE0(a)<<16)
+#define BYTE3(a)   (BYTE0(a)<<24)
+#define WORD0(a)   (LONG0(a)&0xffff)
+#define WORD1(a)   (WORD0(a)<<8)
+#define WORD2(a)   (WORD0(a)<<16)
+#define TRINIB0(a) (LONG0(a)&0xffffff)
+#define TRINIB1(a) (TRINIB0(a)<<8)
+
+#define RET(a)     ((union cmdret *)(a))
+
+#define SEND_GETV(p,b)             sendcmd(p,RESP,GETV,0,RET(b))        /* get version */
+#define SEND_GETC(p,b,c)           sendcmd(p,PARM|RESP,GETC,c,RET(b))
+#define SEND_GUNS(p,b)             sendcmd(p,RESP,GUNS,0,RET(b))
+#define SEND_SCID(p,b)             sendcmd(p,RESP,SCID,0,RET(b))
+#define SEND_RMEM(p,b,c,d)         sendcmd(p,PARM|RESP,RMEM|BYTE1(b),LONG0(c),RET(d))   /* memory access for firmware write */
+#define SEND_SMEM(p,b,c)           sendcmd(p,PARM,SMEM|BYTE1(b),LONG0(c),RET(0))        /* memory access for firmware write */
+#define SEND_WMEM(p,b,c)           sendcmd(p,PARM,WMEM|BYTE1(b),LONG0(c),RET(0))        /* memory access for firmware write */
+#define SEND_SDTM(p,b,c)           sendcmd(p,PARM|RESP,SDTM|TRINIB1(b),0,RET(c))        /* memory access for firmware write */
+#define SEND_GOTO(p,b)             sendcmd(p,PARM,GOTO,LONG0(b),RET(0)) /* memory access for firmware write */
+#define SEND_SETDPLL(p)            sendcmd(p,0,ARM_SETDPLL,0,RET(0))
+#define SEND_SSTR(p,b,c)           sendcmd(p,PARM,SSTR|BYTE3(b),LONG0(c),RET(0))        /* start stream */
+#define SEND_PSTR(p,b)             sendcmd(p,PARM,PSTR,BYTE3(b),RET(0)) /* pause stream */
+#define SEND_KSTR(p,b)             sendcmd(p,PARM,KSTR,BYTE3(b),RET(0)) /* stop stream */
+#define SEND_KDMA(p)               sendcmd(p,0,KDMA,0,RET(0))   /* stop all dma */
+#define SEND_GPOS(p,b,c,d)         sendcmd(p,PARM|RESP,GPOS,BYTE3(c)|BYTE2(b),RET(d))   /* get position in dma */
+#define SEND_SETF(p,b,c,d,e,f,g)   sendcmd(p,PARM,SETF|WORD1(b)|BYTE3(c),d|BYTE1(e)|BYTE2(f)|BYTE3(g),RET(0))   /* set sample format at mixer */
+#define SEND_GSTS(p,b,c,d)         sendcmd(p,PARM|RESP,GSTS,BYTE3(c)|BYTE2(b),RET(d))
+#define SEND_NGPOS(p,b,c,d)        sendcmd(p,PARM|RESP,NGPOS,BYTE3(c)|BYTE2(b),RET(d))
+#define SEND_PSEL(p,b,c)           sendcmd(p,PARM,PSEL,BYTE2(b)|BYTE3(c),RET(0))        /* activate lbus path */
+#define SEND_PCLR(p,b,c)           sendcmd(p,PARM,PCLR,BYTE2(b)|BYTE3(c),RET(0))        /* deactivate lbus path */
+#define SEND_PLST(p,b)             sendcmd(p,PARM,PLST,BYTE3(b),RET(0))
+#define SEND_RSSV(p,b,c,d)         sendcmd(p,PARM|RESP,RSSV,BYTE2(b)|BYTE3(c),RET(d))
+#define SEND_LSEL(p,b,c,d,e,f,g,h) sendcmd(p,PARM,LSEL|BYTE1(b)|BYTE2(c)|BYTE3(d),BYTE0(e)|BYTE1(f)|BYTE2(g)|BYTE3(h),RET(0))   /* select paths for internal connections */
+#define SEND_SSRC(p,b,c,d,e)       sendcmd(p,PARM,SSRC|BYTE1(b)|WORD2(c),WORD0(d)|WORD2(e),RET(0))      /* configure source */
+#define SEND_SLST(p,b)             sendcmd(p,PARM,SLST,BYTE3(b),RET(0))
+#define SEND_RSRC(p,b,c)           sendcmd(p,RESP,RSRC|BYTE1(b),0,RET(c))       /* read source config */
+#define SEND_SSRB(p,b,c)           sendcmd(p,PARM,SSRB|BYTE1(b),WORD2(c),RET(0))
+#define SEND_SDGV(p,b,c,d,e)       sendcmd(p,PARM,SDGV|BYTE2(b)|BYTE3(c),WORD0(d)|WORD2(e),RET(0))      /* set digital mixer */
+#define SEND_RDGV(p,b,c,d)         sendcmd(p,PARM|RESP,RDGV|BYTE2(b)|BYTE3(c),0,RET(d)) /* read digital mixer */
+#define SEND_DLST(p,b)             sendcmd(p,PARM,DLST,BYTE3(b),RET(0))
+#define SEND_SACR(p,b,c)           sendcmd(p,PARM,SACR,WORD0(b)|WORD2(c),RET(0))        /* set AC97 register */
+#define SEND_RACR(p,b,c)           sendcmd(p,PARM|RESP,RACR,WORD2(b),RET(c))    /* get AC97 register */
+#define SEND_ALST(p,b)             sendcmd(p,PARM,ALST,BYTE3(b),RET(0))
+#define SEND_TXAC(p,b,c,d,e,f)     sendcmd(p,PARM,TXAC|BYTE1(b)|WORD2(c),WORD0(d)|BYTE2(e)|BYTE3(f),RET(0))
+#define SEND_RXAC(p,b,c,d)         sendcmd(p,PARM|RESP,RXAC,BYTE2(b)|BYTE3(c),RET(d))
+#define SEND_SI2S(p,b)             sendcmd(p,PARM,SI2S,WORD2(b),RET(0))
+
+#define EOB_STATUS         0x80000000   /* status flags : block boundary */
+#define EOS_STATUS         0x40000000   /*              : stoppped */
+#define EOC_STATUS         0x20000000   /*              : stream end */
+#define ERR_STATUS         0x10000000
+#define EMPTY_STATUS       0x08000000
+
+#define IEOB_ENABLE        0x1  /* enable interrupts for status notification above */
+#define IEOS_ENABLE        0x2
+#define IEOC_ENABLE        0x4
+#define RDONCE             0x8
+#define DESC_MAX_MASK      0xff
+
+#define ST_PLAY  0x1            /* stream states */
+#define ST_STOP  0x2
+#define ST_PAUSE 0x4
+
+#define I2S_INTDEC     3        /* config for I2S link */
+#define I2S_MERGER     0
+#define I2S_SPLITTER   0
+#define I2S_MIXER      7
+#define I2S_RATE       44100
+
+#define MODEM_INTDEC   4        /* config for modem link */
+#define MODEM_MERGER   3
+#define MODEM_SPLITTER 0
+#define MODEM_MIXER    11
+
+#define FM_INTDEC      3        /* config for FM/OPL3 link */
+#define FM_MERGER      0
+#define FM_SPLITTER    0
+#define FM_MIXER       9
+
+#define SPLIT_PATH  0x80        /* path splitting flag */
+
+enum FIRMWARE {
+        DATA_REC = 0, EXT_END_OF_FILE, EXT_SEG_ADDR_REC, EXT_GOTO_CMD_REC,
+        EXT_LIN_ADDR_REC,
+};
+
+enum CMDS {
+        GETV = 0x00, GETC, GUNS, SCID, RMEM =
+            0x10, SMEM, WMEM, SDTM, GOTO, SSTR =
+            0x20, PSTR, KSTR, KDMA, GPOS, SETF, GSTS, NGPOS, PSEL =
+            0x30, PCLR, PLST, RSSV, LSEL, SSRC = 0x40, SLST, RSRC, SSRB, SDGV =
+            0x50, RDGV, DLST, SACR = 0x60, RACR, ALST, TXAC, RXAC, SI2S =
+            0x70, ARM_SETDPLL = 0x72,
+};
+
+enum E1SOURCE {
+        ARM2LBUS_FIFO0 = 0, ARM2LBUS_FIFO1, ARM2LBUS_FIFO2, ARM2LBUS_FIFO3,
+        ARM2LBUS_FIFO4, ARM2LBUS_FIFO5, ARM2LBUS_FIFO6, ARM2LBUS_FIFO7,
+        ARM2LBUS_FIFO8, ARM2LBUS_FIFO9, ARM2LBUS_FIFO10, ARM2LBUS_FIFO11,
+        ARM2LBUS_FIFO12, ARM2LBUS_FIFO13, ARM2LBUS_FIFO14, ARM2LBUS_FIFO15,
+        INTER0_OUT, INTER1_OUT, INTER2_OUT, INTER3_OUT, INTER4_OUT,
+        INTERM0_OUT, INTERM1_OUT, INTERM2_OUT, INTERM3_OUT, INTERM4_OUT,
+        INTERM5_OUT, INTERM6_OUT, DECIMM0_OUT, DECIMM1_OUT, DECIMM2_OUT,
+        DECIMM3_OUT, DECIM0_OUT, SR3_4_OUT, OPL3_SAMPLE, ASRC0, ASRC1,
+        ACLNK2PADC, ACLNK2MODEM0RX, ACLNK2MIC, ACLNK2MODEM1RX, ACLNK2HNDMIC,
+        DIGITAL_MIXER_OUT0, GAINFUNC0_OUT, GAINFUNC1_OUT, GAINFUNC2_OUT,
+        GAINFUNC3_OUT, GAINFUNC4_OUT, SOFTMODEMTX, SPLITTER0_OUTL,
+        SPLITTER0_OUTR, SPLITTER1_OUTL, SPLITTER1_OUTR, SPLITTER2_OUTL,
+        SPLITTER2_OUTR, SPLITTER3_OUTL, SPLITTER3_OUTR, MERGER0_OUT,
+        MERGER1_OUT, MERGER2_OUT, MERGER3_OUT, ARM2LBUS_FIFO_DIRECT, NO_OUT
+};
+
+enum E2SINK {
+        LBUS2ARM_FIFO0 = 0, LBUS2ARM_FIFO1, LBUS2ARM_FIFO2, LBUS2ARM_FIFO3,
+        LBUS2ARM_FIFO4, LBUS2ARM_FIFO5, LBUS2ARM_FIFO6, LBUS2ARM_FIFO7,
+        INTER0_IN, INTER1_IN, INTER2_IN, INTER3_IN, INTER4_IN, INTERM0_IN,
+        INTERM1_IN, INTERM2_IN, INTERM3_IN, INTERM4_IN, INTERM5_IN, INTERM6_IN,
+        DECIMM0_IN, DECIMM1_IN, DECIMM2_IN, DECIMM3_IN, DECIM0_IN, SR3_4_IN,
+        PDAC2ACLNK, MODEM0TX2ACLNK, MODEM1TX2ACLNK, HNDSPK2ACLNK,
+        DIGITAL_MIXER_IN0, DIGITAL_MIXER_IN1, DIGITAL_MIXER_IN2,
+        DIGITAL_MIXER_IN3, DIGITAL_MIXER_IN4, DIGITAL_MIXER_IN5,
+        DIGITAL_MIXER_IN6, DIGITAL_MIXER_IN7, DIGITAL_MIXER_IN8,
+        DIGITAL_MIXER_IN9, DIGITAL_MIXER_IN10, DIGITAL_MIXER_IN11,
+        GAINFUNC0_IN, GAINFUNC1_IN, GAINFUNC2_IN, GAINFUNC3_IN, GAINFUNC4_IN,
+        SOFTMODEMRX, SPLITTER0_IN, SPLITTER1_IN, SPLITTER2_IN, SPLITTER3_IN,
+        MERGER0_INL, MERGER0_INR, MERGER1_INL, MERGER1_INR, MERGER2_INL,
+        MERGER2_INR, MERGER3_INL, MERGER3_INR, E2SINK_MAX
+};
+
+enum LBUS_SINK {
+        LS_SRC_INTERPOLATOR = 0, LS_SRC_INTERPOLATORM, LS_SRC_DECIMATOR,
+        LS_SRC_DECIMATORM, LS_MIXER_IN, LS_MIXER_GAIN_FUNCTION,
+        LS_SRC_SPLITTER, LS_SRC_MERGER, LS_NONE1, LS_NONE2,
+};
+
+enum RT_CHANNEL_IDS {
+        M0TX = 0, M1TX, TAMTX, HSSPKR, PDAC, DSNDTX0, DSNDTX1, DSNDTX2,
+        DSNDTX3, DSNDTX4, DSNDTX5, DSNDTX6, DSNDTX7, WVSTRTX, COP3DTX, SPARE,
+        M0RX, HSMIC, M1RX, CLEANRX, MICADC, PADC, COPRX1, COPRX2,
+        CHANNEL_ID_COUNTER
+};
+
+enum { SB_CMD = 0, MODEM_CMD, I2S_CMD0, I2S_CMD1, FM_CMD, MAX_CMD };
+
+struct lbuspath {
+        unsigned char *noconv;
+        unsigned char *stereo;
+        unsigned char *mono;
+};
+
+struct cmdport {
+        u32 data1;              /* cmd,param */
+        u32 data2;              /* param */
+        u32 stat;               /* status */
+        u32 pad[5];
+};
+
+struct riptideport {
+        u32 audio_control;      /* status registers */
+        u32 audio_status;
+        u32 pad[2];
+        struct cmdport port[2]; /* command ports */
+};
+
+struct cmdif {
+        struct riptideport *hwport;
+        spinlock_t lock;
+        unsigned int cmdcnt;    /* cmd statistics */
+        unsigned int cmdtime;
+        unsigned int cmdtimemax;
+        unsigned int cmdtimemin;
+        unsigned int errcnt;
+        int is_reset;
+};
+
+struct riptide_firmware {
+        u16 ASIC;
+        u16 CODEC;
+        u16 AUXDSP;
+        u16 PROG;
+};
+
+union cmdret {
+        u8 retbytes[8];
+        u16 retwords[4];
+        u32 retlongs[2];
+};
+
+union firmware_version {
+        union cmdret ret;
+        struct riptide_firmware firmware;
+};
+
+#define get_pcmhwdev(substream) (struct pcmhw *)(substream->runtime->private_data)
+
+#define PLAYBACK_SUBSTREAMS 3
+struct snd_riptide {
+        struct snd_card *card;
+        struct pci_dev *pci;
+        const struct firmware *fw_entry;
+
+        struct cmdif *cif;
+
+        struct snd_pcm *pcm;
+        struct snd_pcm *pcm_i2s;
+        struct snd_rawmidi *rmidi;
+        struct snd_opl3 *opl3;
+        struct snd_ac97 *ac97;
+        struct snd_ac97_bus *ac97_bus;
+
+        struct snd_pcm_substream *playback_substream[PLAYBACK_SUBSTREAMS];
+        struct snd_pcm_substream *capture_substream;
+
+        int openstreams;
+
+        int irq;
+        unsigned long port;
+        unsigned short mpuaddr;
+        unsigned short opladdr;
+#ifdef SUPPORT_JOYSTICK
+        unsigned short gameaddr;
+#endif
+        struct resource *res_port;
+
+        unsigned short device_id;
+
+        union firmware_version firmware;
+
+        spinlock_t lock;
+        struct tasklet_struct riptide_tq;
+        struct snd_info_entry *proc_entry;
+
+        unsigned long received_irqs;
+        unsigned long handled_irqs;
+#ifdef CONFIG_PM
+        int in_suspend;
+#endif
+};
+
+struct sgd {                    /* scatter gather desriptor */
+        u32 dwNextLink;
+        u32 dwSegPtrPhys;
+        u32 dwSegLen;
+        u32 dwStat_Ctl;
+};
+
+struct pcmhw {                  /* pcm descriptor */
+        struct lbuspath paths;
+        unsigned char *lbuspath;
+        unsigned char source;
+        unsigned char intdec[2];
+        unsigned char mixer;
+        unsigned char id;
+        unsigned char state;
+        unsigned int rate;
+        unsigned int channels;
+        snd_pcm_format_t format;
+        struct snd_dma_buffer sgdlist;
+        struct sgd *sgdbuf;
+        unsigned int size;
+        unsigned int pages;
+        unsigned int oldpos;
+        unsigned int pointer;
+};
+
+#define CMDRET_ZERO (union cmdret){{(u32)0, (u32) 0}}
+
+static int sendcmd(struct cmdif *cif, u32 flags, u32 cmd, u32 parm,
+                   union cmdret *ret);
+static int getsourcesink(struct cmdif *cif, unsigned char source,
+                         unsigned char sink, unsigned char *a,
+                         unsigned char *b);
+static int snd_riptide_initialize(struct snd_riptide *chip);
+static int riptide_reset(struct cmdif *cif, struct snd_riptide *chip);
+
+/*
+ */
+
+static struct pci_device_id snd_riptide_ids[] = {
+        {
+         .vendor = 0x127a,.device = 0x4310,
+         .subvendor = PCI_ANY_ID,.subdevice = PCI_ANY_ID,
+         },
+        {
+         .vendor = 0x127a,.device = 0x4320,
+         .subvendor = PCI_ANY_ID,.subdevice = PCI_ANY_ID,
+         },
+        {
+         .vendor = 0x127a,.device = 0x4330,
+         .subvendor = PCI_ANY_ID,.subdevice = PCI_ANY_ID,
+         },
+        {
+         .vendor = 0x127a,.device = 0x4340,
+         .subvendor = PCI_ANY_ID,.subdevice = PCI_ANY_ID,
+         },
+        {0,},
+};
+
+#ifdef SUPPORT_JOYSTICK
+static struct pci_device_id snd_riptide_joystick_ids[] = {
+        {
+         .vendor = 0x127a,.device = 0x4312,
+         .subvendor = PCI_ANY_ID,.subdevice = PCI_ANY_ID,
+         },
+        {
+         .vendor = 0x127a,.device = 0x4322,
+         .subvendor = PCI_ANY_ID,.subdevice = PCI_ANY_ID,
+         },
+        {.vendor = 0x127a,.device = 0x4332,
+         .subvendor = PCI_ANY_ID,.subdevice = PCI_ANY_ID,
+         },
+        {.vendor = 0x127a,.device = 0x4342,
+         .subvendor = PCI_ANY_ID,.subdevice = PCI_ANY_ID,
+         },
+        {0,},
+};
+#endif
+
+MODULE_DEVICE_TABLE(pci, snd_riptide_ids);
+
+/*
+ */
+
+static unsigned char lbusin2out[E2SINK_MAX + 1][2] = {
+        {NO_OUT, LS_NONE1}, {NO_OUT, LS_NONE2}, {NO_OUT, LS_NONE1}, {NO_OUT,
+                                                                     LS_NONE2},
+        {NO_OUT, LS_NONE1}, {NO_OUT, LS_NONE2}, {NO_OUT, LS_NONE1}, {NO_OUT,
+                                                                     LS_NONE2},
+        {INTER0_OUT, LS_SRC_INTERPOLATOR}, {INTER1_OUT, LS_SRC_INTERPOLATOR},
+        {INTER2_OUT, LS_SRC_INTERPOLATOR}, {INTER3_OUT, LS_SRC_INTERPOLATOR},
+        {INTER4_OUT, LS_SRC_INTERPOLATOR}, {INTERM0_OUT, LS_SRC_INTERPOLATORM},
+        {INTERM1_OUT, LS_SRC_INTERPOLATORM}, {INTERM2_OUT,
+                                              LS_SRC_INTERPOLATORM},
+        {INTERM3_OUT, LS_SRC_INTERPOLATORM}, {INTERM4_OUT,
+                                              LS_SRC_INTERPOLATORM},
+        {INTERM5_OUT, LS_SRC_INTERPOLATORM}, {INTERM6_OUT,
+                                              LS_SRC_INTERPOLATORM},
+        {DECIMM0_OUT, LS_SRC_DECIMATORM}, {DECIMM1_OUT, LS_SRC_DECIMATORM},
+        {DECIMM2_OUT, LS_SRC_DECIMATORM}, {DECIMM3_OUT, LS_SRC_DECIMATORM},
+        {DECIM0_OUT, LS_SRC_DECIMATOR}, {SR3_4_OUT, LS_NONE1}, {NO_OUT,
+                                                                LS_NONE2},
+        {NO_OUT, LS_NONE1}, {NO_OUT, LS_NONE2}, {NO_OUT, LS_NONE1},
+        {DIGITAL_MIXER_OUT0, LS_MIXER_IN}, {DIGITAL_MIXER_OUT0, LS_MIXER_IN},
+        {DIGITAL_MIXER_OUT0, LS_MIXER_IN}, {DIGITAL_MIXER_OUT0, LS_MIXER_IN},
+        {DIGITAL_MIXER_OUT0, LS_MIXER_IN}, {DIGITAL_MIXER_OUT0, LS_MIXER_IN},
+        {DIGITAL_MIXER_OUT0, LS_MIXER_IN}, {DIGITAL_MIXER_OUT0, LS_MIXER_IN},
+        {DIGITAL_MIXER_OUT0, LS_MIXER_IN}, {DIGITAL_MIXER_OUT0, LS_MIXER_IN},
+        {DIGITAL_MIXER_OUT0, LS_MIXER_IN}, {DIGITAL_MIXER_OUT0, LS_MIXER_IN},
+        {GAINFUNC0_OUT, LS_MIXER_GAIN_FUNCTION}, {GAINFUNC1_OUT,
+                                                  LS_MIXER_GAIN_FUNCTION},
+        {GAINFUNC2_OUT, LS_MIXER_GAIN_FUNCTION}, {GAINFUNC3_OUT,
+                                                  LS_MIXER_GAIN_FUNCTION},
+        {GAINFUNC4_OUT, LS_MIXER_GAIN_FUNCTION}, {SOFTMODEMTX, LS_NONE1},
+        {SPLITTER0_OUTL, LS_SRC_SPLITTER}, {SPLITTER1_OUTL, LS_SRC_SPLITTER},
+        {SPLITTER2_OUTL, LS_SRC_SPLITTER}, {SPLITTER3_OUTL, LS_SRC_SPLITTER},
+        {MERGER0_OUT, LS_SRC_MERGER}, {MERGER0_OUT, LS_SRC_MERGER},
+        {MERGER1_OUT, LS_SRC_MERGER},
+        {MERGER1_OUT, LS_SRC_MERGER}, {MERGER2_OUT, LS_SRC_MERGER},
+        {MERGER2_OUT, LS_SRC_MERGER},
+        {MERGER3_OUT, LS_SRC_MERGER}, {MERGER3_OUT, LS_SRC_MERGER}, {NO_OUT,
+                                                                     LS_NONE2},
+};
+
+static unsigned char lbus_play_opl3[] = {
+        DIGITAL_MIXER_IN0 + FM_MIXER, 0xff
+};
+static unsigned char lbus_play_modem[] = {
+        DIGITAL_MIXER_IN0 + MODEM_MIXER, 0xff
+};
+static unsigned char lbus_play_i2s[] = {
+        INTER0_IN + I2S_INTDEC, DIGITAL_MIXER_IN0 + I2S_MIXER, 0xff
+};
+static unsigned char lbus_play_out[] = {
+        PDAC2ACLNK, 0xff
+};
+static unsigned char lbus_play_outhp[] = {
+        HNDSPK2ACLNK, 0xff
+};
+static unsigned char lbus_play_noconv1[] = {
+        DIGITAL_MIXER_IN0, 0xff
+};
+static unsigned char lbus_play_stereo1[] = {
+        INTER0_IN, DIGITAL_MIXER_IN0, 0xff
+};
+static unsigned char lbus_play_mono1[] = {
+        INTERM0_IN, DIGITAL_MIXER_IN0, 0xff
+};
+static unsigned char lbus_play_noconv2[] = {
+        DIGITAL_MIXER_IN1, 0xff
+};
+static unsigned char lbus_play_stereo2[] = {
+        INTER1_IN, DIGITAL_MIXER_IN1, 0xff
+};
+static unsigned char lbus_play_mono2[] = {
+        INTERM1_IN, DIGITAL_MIXER_IN1, 0xff
+};
+static unsigned char lbus_play_noconv3[] = {
+        DIGITAL_MIXER_IN2, 0xff
+};
+static unsigned char lbus_play_stereo3[] = {
+        INTER2_IN, DIGITAL_MIXER_IN2, 0xff
+};
+static unsigned char lbus_play_mono3[] = {
+        INTERM2_IN, DIGITAL_MIXER_IN2, 0xff
+};
+static unsigned char lbus_rec_noconv1[] = {
+        LBUS2ARM_FIFO5, 0xff
+};
+static unsigned char lbus_rec_stereo1[] = {
+        DECIM0_IN, LBUS2ARM_FIFO5, 0xff
+};
+static unsigned char lbus_rec_mono1[] = {
+        DECIMM3_IN, LBUS2ARM_FIFO5, 0xff
+};
+
+static unsigned char play_ids[] = { 4, 1, 2, };
+static unsigned char play_sources[] = {
+        ARM2LBUS_FIFO4, ARM2LBUS_FIFO1, ARM2LBUS_FIFO2,
+};
+static struct lbuspath lbus_play_paths[] = {
+        {
+         .noconv = lbus_play_noconv1,
+         .stereo = lbus_play_stereo1,
+         .mono = lbus_play_mono1,
+         },
+        {
+         .noconv = lbus_play_noconv2,
+         .stereo = lbus_play_stereo2,
+         .mono = lbus_play_mono2,
+         },
+        {
+         .noconv = lbus_play_noconv3,
+         .stereo = lbus_play_stereo3,
+         .mono = lbus_play_mono3,
+         },
+};
+static struct lbuspath lbus_rec_path = {
+        .noconv = lbus_rec_noconv1,
+        .stereo = lbus_rec_stereo1,
+        .mono = lbus_rec_mono1,
+};
+
+#define FIRMWARE_VERSIONS 1
+static union firmware_version firmware_versions[] = {
+        {
+         .firmware.ASIC = 3,.firmware.CODEC = 2,
+         .firmware.AUXDSP = 3,.firmware.PROG = 773,
+         },
+};
+
+static u32 atoh(unsigned char *in, unsigned int len)
+{
+        u32 sum = 0;
+        unsigned int mult = 1;
+        unsigned char c;
+
+        while (len) {
+                c = in[len - 1];
+                if ((c >= '0') && (c <= '9'))
+                        sum += mult * (c - '0');
+                else if ((c >= 'A') && (c <= 'F'))
+                        sum += mult * (c - ('A' - 10));
+                else if ((c >= 'a') && (c <= 'f'))
+                        sum += mult * (c - ('a' - 10));
+                mult *= 16;
+                --len;
+        }
+        return sum;
+}
+
+static int senddata(struct cmdif *cif, unsigned char *in, u32 offset)
+{
+        u32 addr;
+        u32 data;
+        u32 i;
+        unsigned char *p;
+
+        i = atoh(&in[1], 2);
+        addr = offset + atoh(&in[3], 4);
+        if (SEND_SMEM(cif, 0, addr) != 0)
+                return -EACCES;
+        p = in + 9;
+        while (i) {
+                data = atoh(p, 8);
+                if (SEND_WMEM(cif, 2,
+                              ((data & 0x0f0f0f0f) << 4) | ((data & 0xf0f0f0f0)
+                                                            >> 4)))
+                        return -EACCES;
+                i -= 4;
+                p += 8;
+        }
+        return 0;
+}
+
+static int loadfirmware(struct cmdif *cif, unsigned char *img,
+                        unsigned int size)
+{
+        unsigned char *in;
+        u32 laddr, saddr, t, val;
+        int err = 0;
+
+        laddr = saddr = 0;
+        while (size > 0 && err == 0) {
+                in = img;
+                if (in[0] == ':') {
+                        t = atoh(&in[7], 2);
+                        switch (t) {
+                        case DATA_REC:
+                                err = senddata(cif, in, laddr + saddr);
+                                break;
+                        case EXT_SEG_ADDR_REC:
+                                saddr = atoh(&in[9], 4) << 4;
+                                break;
+                        case EXT_LIN_ADDR_REC:
+                                laddr = atoh(&in[9], 4) << 16;
+                                break;
+                        case EXT_GOTO_CMD_REC:
+                                val = atoh(&in[9], 8);
+                                if (SEND_GOTO(cif, val) != 0)
+                                        err = -EACCES;
+                                break;
+                        case EXT_END_OF_FILE:
+                                size = 0;
+                                break;
+                        default:
+                                break;
+                        }
+                        while (size > 0) {
+                                size--;
+                                if (*img++ == '\n')
+                                        break;
+                        }
+                }
+        }
+        snd_printdd("load firmware return %d\n", err);
+        return err;
+}
+
+static void
+alloclbuspath(struct cmdif *cif, unsigned char source,
+              unsigned char *path, unsigned char *mixer, unsigned char *s)
+{
+        while (*path != 0xff) {
+                unsigned char sink, type;
+
+                sink = *path & (~SPLIT_PATH);
+                if (sink != E2SINK_MAX) {
+                        snd_printdd("alloc path 0x%x->0x%x\n", source, sink);
+                        SEND_PSEL(cif, source, sink);
+                        source = lbusin2out[sink][0];
+                        type = lbusin2out[sink][1];
+                        if (type == LS_MIXER_IN) {
+                                if (mixer)
+                                        *mixer = sink - DIGITAL_MIXER_IN0;
+                        }
+                        if (type == LS_SRC_DECIMATORM ||
+                            type == LS_SRC_DECIMATOR ||
+                            type == LS_SRC_INTERPOLATORM ||
+                            type == LS_SRC_INTERPOLATOR) {
+                                if (s) {
+                                        if (s[0] != 0xff)
+                                                s[1] = sink;
+                                        else
+                                                s[0] = sink;
+                                }
+                        }
+                }
+                if (*path++ & SPLIT_PATH) {
+                        unsigned char *npath = path;
+
+                        while (*npath != 0xff)
+                                npath++;
+                        alloclbuspath(cif, source + 1, ++npath, mixer, s);
+                }
+        }
+}
+
+static void
+freelbuspath(struct cmdif *cif, unsigned char source, unsigned char *path)
+{
+        while (*path != 0xff) {
+                unsigned char sink;
+
+                sink = *path & (~SPLIT_PATH);
+                if (sink != E2SINK_MAX) {
+                        snd_printdd("free path 0x%x->0x%x\n", source, sink);
+                        SEND_PCLR(cif, source, sink);
+                        source = lbusin2out[sink][0];
+                }
+                if (*path++ & SPLIT_PATH) {
+                        unsigned char *npath = path;
+
+                        while (*npath != 0xff)
+                                npath++;
+                        freelbuspath(cif, source + 1, ++npath);
+                }
+        }
+}
+
+static int writearm(struct cmdif *cif, u32 addr, u32 data, u32 mask)
+{
+        union cmdret rptr = CMDRET_ZERO;
+        unsigned int i = MAX_WRITE_RETRY;
+        int flag = 1;
+
+        SEND_RMEM(cif, 0x02, addr, &rptr);
+        rptr.retlongs[0] &= (~mask);
+
+        while (--i) {
+                SEND_SMEM(cif, 0x01, addr);
+                SEND_WMEM(cif, 0x02, (rptr.retlongs[0] | data));
+                SEND_RMEM(cif, 0x02, addr, &rptr);
+                if ((rptr.retlongs[0] & data) == data) {
+                        flag = 0;
+                        break;
+                } else
+                        rptr.retlongs[0] &= ~mask;
+        }
+        snd_printdd("send arm 0x%x 0x%x 0x%x return %d\n", addr, data, mask,
+                    flag);
+        return flag;
+}
+
+static int sendcmd(struct cmdif *cif, u32 flags, u32 cmd, u32 parm,
+                   union cmdret *ret)
+{
+        int i, j;
+        int err;
+        unsigned int time = 0;
+        unsigned long irqflags;
+        struct riptideport *hwport;
+        struct cmdport *cmdport = NULL;
+
+        snd_assert(cif, return -EINVAL);
+
+        hwport = cif->hwport;
+        if (cif->errcnt > MAX_ERROR_COUNT) {
+                if (cif->is_reset) {
+                        snd_printk(KERN_ERR
+                                   "Riptide: Too many failed cmds, reinitializing\n");
+                        if (riptide_reset(cif, NULL) == 0) {
+                                cif->errcnt = 0;
+                                return -EIO;
+                        }
+                }
+                snd_printk(KERN_ERR "Riptide: Initialization failed.\n");
+                return -EINVAL;
+        }
+        if (ret) {
+                ret->retlongs[0] = 0;
+                ret->retlongs[1] = 0;
+        }
+        i = 0;
+        spin_lock_irqsave(&cif->lock, irqflags);
+        while (i++ < CMDIF_TIMEOUT && !IS_READY(cif->hwport))
+                udelay(10);
+        if (i >= CMDIF_TIMEOUT) {
+                err = -EBUSY;
+                goto errout;
+        }
+
+        err = 0;
+        for (j = 0, time = 0; time < CMDIF_TIMEOUT; j++, time += 2) {
+                cmdport = &(hwport->port[j % 2]);
+                if (IS_DATF(cmdport)) { /* free pending data */
+                        READ_PORT_ULONG(cmdport->data1);
+                        READ_PORT_ULONG(cmdport->data2);
+                }
+                if (IS_CMDE(cmdport)) {
+                        if (flags & PARM)       /* put data */
+                                WRITE_PORT_ULONG(cmdport->data2, parm);
+                        WRITE_PORT_ULONG(cmdport->data1, cmd);  /* write cmd */
+                        if ((flags & RESP) && ret) {
+                                while (!IS_DATF(cmdport) &&
+                                       time++ < CMDIF_TIMEOUT)
+                                        udelay(10);
+                                if (time < CMDIF_TIMEOUT) {     /* read response */
+                                        ret->retlongs[0] =
+                                            READ_PORT_ULONG(cmdport->data1);
+                                        ret->retlongs[1] =
+                                            READ_PORT_ULONG(cmdport->data2);
+                                } else {
+                                        err = -ENOSYS;
+                                        goto errout;
+                                }
+                        }
+                        break;
+                }
+                udelay(20);
+        }
+        if (time == CMDIF_TIMEOUT) {
+                err = -ENODATA;
+                goto errout;
+        }
+        spin_unlock_irqrestore(&cif->lock, irqflags);
+
+        cif->cmdcnt++;          /* update command statistics */
+        cif->cmdtime += time;
+        if (time > cif->cmdtimemax)
+                cif->cmdtimemax = time;
+        if (time < cif->cmdtimemin)
+                cif->cmdtimemin = time;
+        if ((cif->cmdcnt) % 1000 == 0)
+                snd_printdd
+                    ("send cmd %d time: %d mintime: %d maxtime %d err: %d\n",
+                     cif->cmdcnt, cif->cmdtime, cif->cmdtimemin,
+                     cif->cmdtimemax, cif->errcnt);
+        return 0;
+
+      errout:
+        cif->errcnt++;
+        spin_unlock_irqrestore(&cif->lock, irqflags);
+        snd_printdd
+            ("send cmd %d hw: 0x%x flag: 0x%x cmd: 0x%x parm: 0x%x ret: 0x%x 0x%x CMDE: %d DATF: %d failed %d\n",
+             cif->cmdcnt, (int)((void *)&(cmdport->stat) - (void *)hwport),
+             flags, cmd, parm, ret ? ret->retlongs[0] : 0,
+             ret ? ret->retlongs[1] : 0, IS_CMDE(cmdport), IS_DATF(cmdport),
+             err);
+        return err;
+}
+
+static int
+setmixer(struct cmdif *cif, short num, unsigned short rval, unsigned short lval)
+{
+        union cmdret rptr = CMDRET_ZERO;
+        int i = 0;
+
+        snd_printdd("sent mixer %d: 0x%d 0x%d\n", num, rval, lval);
+        do {
+                SEND_SDGV(cif, num, num, rval, lval);
+                SEND_RDGV(cif, num, num, &rptr);
+                if (rptr.retwords[0] == lval && rptr.retwords[1] == rval)
+                        return 0;
+        } while (i++ < MAX_WRITE_RETRY);
+        snd_printdd("sent mixer failed\n");
+        return -EIO;
+}
+
+static int getpaths(struct cmdif *cif, unsigned char *o)
+{
+        unsigned char src[E2SINK_MAX];
+        unsigned char sink[E2SINK_MAX];
+        int i, j = 0;
+
+        for (i = 0; i < E2SINK_MAX; i++) {
+                getsourcesink(cif, i, i, &src[i], &sink[i]);
+                if (sink[i] < E2SINK_MAX) {
+                        o[j++] = sink[i];
+                        o[j++] = i;
+                }
+        }
+        return j;
+}
+
+static int
+getsourcesink(struct cmdif *cif, unsigned char source, unsigned char sink,
+              unsigned char *a, unsigned char *b)
+{
+        union cmdret rptr = CMDRET_ZERO;
+
+        if (SEND_RSSV(cif, source, sink, &rptr) &&
+            SEND_RSSV(cif, source, sink, &rptr))
+                return -EIO;
+        *a = rptr.retbytes[0];
+        *b = rptr.retbytes[1];
+        snd_printdd("getsourcesink 0x%x 0x%x\n", *a, *b);
+        return 0;
+}
+
+static int
+getsamplerate(struct cmdif *cif, unsigned char *intdec, unsigned int *rate)
+{
+        unsigned char *s;
+        unsigned int p[2] = { 0, 0 };
+        int i;
+        union cmdret rptr = CMDRET_ZERO;
+
+        s = intdec;
+        for (i = 0; i < 2; i++) {
+                if (*s != 0xff) {
+                        if (SEND_RSRC(cif, *s, &rptr) &&
+                            SEND_RSRC(cif, *s, &rptr))
+                                return -EIO;
+                        p[i] += rptr.retwords[1];
+                        p[i] *= rptr.retwords[2];
+                        p[i] += rptr.retwords[3];
+                        p[i] /= 65536;
+                }
+                s++;
+        }
+        if (p[0]) {
+                if (p[1] != p[0])
+                        snd_printdd("rates differ %d %d\n", p[0], p[1]);
+                *rate = (unsigned int)p[0];
+        } else
+                *rate = (unsigned int)p[1];
+        snd_printdd("getsampleformat %d %d %d\n", intdec[0], intdec[1], *rate);
+        return 0;
+}
+
+static int
+setsampleformat(struct cmdif *cif,
+                unsigned char mixer, unsigned char id,
+                unsigned char channels, unsigned char format)
+{
+        unsigned char w, ch, sig, order;
+
+        snd_printdd
+            ("setsampleformat mixer: %d id: %d channels: %d format: %d\n",
+             mixer, id, channels, format);
+        ch = channels == 1;
+        w = snd_pcm_format_width(format) == 8;
+        sig = snd_pcm_format_unsigned(format) != 0;
+        order = snd_pcm_format_big_endian(format) != 0;
+
+        if (SEND_SETF(cif, mixer, w, ch, order, sig, id) &&
+            SEND_SETF(cif, mixer, w, ch, order, sig, id)) {
+                snd_printdd("setsampleformat failed\n");
+                return -EIO;
+        }
+        return 0;
+}
+
+static int
+setsamplerate(struct cmdif *cif, unsigned char *intdec, unsigned int rate)
+{
+        u32 D, M, N;
+        union cmdret rptr = CMDRET_ZERO;
+        int i;
+
+        snd_printdd("setsamplerate intdec: %d,%d rate: %d\n", intdec[0],
+                    intdec[1], rate);
+        D = 48000;
+        M = ((rate == 48000) ? 47999 : rate) * 65536;
+        N = M % D;
+        M /= D;
+        for (i = 0; i < 2; i++) {
+                if (*intdec != 0xff) {
+                        do {
+                                SEND_SSRC(cif, *intdec, D, M, N);
+                                SEND_RSRC(cif, *intdec, &rptr);
+                        } while (rptr.retwords[1] != D &&
+                                 rptr.retwords[2] != M &&
+                                 rptr.retwords[3] != N &&
+                                 i++ < MAX_WRITE_RETRY);
+                        if (i == MAX_WRITE_RETRY) {
+                                snd_printdd("sent samplerate %d: %d failed\n",
+                                            *intdec, rate);
+                                return -EIO;
+                        }
+                }
+                intdec++;
+        }
+        return 0;
+}
+
+static int
+getmixer(struct cmdif *cif, short num, unsigned short *rval,
+         unsigned short *lval)
+{
+        union cmdret rptr = CMDRET_ZERO;
+
+        if (SEND_RDGV(cif, num, num, &rptr) && SEND_RDGV(cif, num, num, &rptr))
+                return -EIO;
+        *rval = rptr.retwords[0];
+        *lval = rptr.retwords[1];
+        snd_printdd("got mixer %d: 0x%d 0x%d\n", num, *rval, *lval);
+        return 0;
+}
+
+static void riptide_handleirq(unsigned long dev_id)
+{
+        struct snd_riptide *chip = (void *)dev_id;
+        struct cmdif *cif = chip->cif;
+        struct snd_pcm_substream *substream[PLAYBACK_SUBSTREAMS + 1];
+        struct snd_pcm_runtime *runtime;
+        struct pcmhw *data = NULL;
+        unsigned int pos, period_bytes;
+        struct sgd *c;
+        int i, j;
+        unsigned int flag;
+
+        if (!cif)
+                return;
+
+        for (i = 0; i < PLAYBACK_SUBSTREAMS; i++)
+                substream[i] = chip->playback_substream[i];
+        substream[i] = chip->capture_substream;
+        for (i = 0; i < PLAYBACK_SUBSTREAMS + 1; i++) {
+                if (substream[i] &&
+                    (runtime = substream[i]->runtime) &&
+                    (data = runtime->private_data) && data->state != ST_STOP) {
+                        pos = 0;
+                        for (j = 0; j < data->pages; j++) {
+                                c = &data->sgdbuf[j];
+                                flag = le32_to_cpu(c->dwStat_Ctl);
+                                if (flag & EOB_STATUS)
+                                        pos += le32_to_cpu(c->dwSegLen);
+                                if (flag & EOC_STATUS)
+                                        pos += le32_to_cpu(c->dwSegLen);
+                                if ((flag & EOS_STATUS)
+                                    && (data->state == ST_PLAY)) {
+                                        data->state = ST_STOP;
+                                        snd_printk(KERN_ERR
+                                                   "Riptide: DMA stopped unexpectedly\n");
+                                }
+                                c->dwStat_Ctl =
+                                    cpu_to_le32(flag &
+                                                ~(EOS_STATUS | EOB_STATUS |
+                                                  EOC_STATUS));
+                        }
+                        data->pointer += pos;
+                        pos += data->oldpos;
+                        if (data->state != ST_STOP) {
+                                period_bytes =
+                                    frames_to_bytes(runtime,
+                                                    runtime->period_size);
+                                snd_printdd
+                                    ("interrupt 0x%x after 0x%lx of 0x%lx frames in period\n",
+                                     READ_AUDIO_STATUS(cif->hwport),
+                                     bytes_to_frames(runtime, pos),
+                                     runtime->period_size);
+                                j = 0;
+                                if (pos >= period_bytes) {
+                                        j++;
+                                        while (pos >= period_bytes)
+                                                pos -= period_bytes;
+                                }
+                                data->oldpos = pos;
+                                if (j > 0)
+                                        snd_pcm_period_elapsed(substream[i]);
+                        }
+                }
+        }
+}
+
+#ifdef CONFIG_PM
+static int riptide_suspend(struct pci_dev *pci, pm_message_t state)
+{
+        struct snd_card *card = pci_get_drvdata(pci);
+        struct snd_riptide *chip = card->private_data;
+
+        chip->in_suspend = 1;
+        snd_power_change_state(card, SNDRV_CTL_POWER_D3hot);
+        snd_pcm_suspend_all(chip->pcm);
+        snd_ac97_suspend(chip->ac97);
+        pci_set_power_state(pci, PCI_D3hot);
+        pci_disable_device(pci);
+        pci_save_state(pci);
+        return 0;
+}
+
+static int riptide_resume(struct pci_dev *pci)
+{
+        struct snd_card *card = pci_get_drvdata(pci);
+        struct snd_riptide *chip = card->private_data;
+
+        pci_restore_state(pci);
+        pci_enable_device(pci);
+        pci_set_power_state(pci, PCI_D0);
+        pci_set_master(pci);
+        snd_riptide_initialize(chip);
+        snd_ac97_resume(chip->ac97);
+        snd_power_change_state(card, SNDRV_CTL_POWER_D0);
+        chip->in_suspend = 0;
+        return 0;
+}
+#endif
+
+static int riptide_reset(struct cmdif *cif, struct snd_riptide *chip)
+{
+        int timeout, tries;
+        union cmdret rptr = CMDRET_ZERO;
+        union firmware_version firmware;
+        int i, j, err, has_firmware;
+
+        if (!cif)
+                return -EINVAL;
+
+        cif->cmdcnt = 0;
+        cif->cmdtime = 0;
+        cif->cmdtimemax = 0;
+        cif->cmdtimemin = 0xffffffff;
+        cif->errcnt = 0;
+        cif->is_reset = 0;
+
+        tries = RESET_TRIES;
+        has_firmware = 0;
+        while (has_firmware == 0 && tries-- > 0) {
+                for (i = 0; i < 2; i++) {
+                        WRITE_PORT_ULONG(cif->hwport->port[i].data1, 0);
+                        WRITE_PORT_ULONG(cif->hwport->port[i].data2, 0);
+                }
+                SET_GRESET(cif->hwport);
+                udelay(100);
+                UNSET_GRESET(cif->hwport);
+                udelay(100);
+
+                for (timeout = 100000; --timeout; udelay(10)) {
+                        if (IS_READY(cif->hwport) && !IS_GERR(cif->hwport))
+                                break;
+                }
+                if (timeout == 0) {
+                        snd_printk(KERN_ERR
+                                   "Riptide: device not ready, audio status: 0x%x ready: %d gerr: %d\n",
+                                   READ_AUDIO_STATUS(cif->hwport),
+                                   IS_READY(cif->hwport), IS_GERR(cif->hwport));
+                        return -EIO;
+                } else {
+                        snd_printdd
+                            ("Riptide: audio status: 0x%x ready: %d gerr: %d\n",
+                             READ_AUDIO_STATUS(cif->hwport),
+                             IS_READY(cif->hwport), IS_GERR(cif->hwport));
+                }
+
+                SEND_GETV(cif, &rptr);
+                for (i = 0; i < 4; i++)
+                        firmware.ret.retwords[i] = rptr.retwords[i];
+
+                snd_printdd
+                    ("Firmware version: ASIC: %d CODEC %d AUXDSP %d PROG %d\n",
+                     firmware.firmware.ASIC, firmware.firmware.CODEC,
+                     firmware.firmware.AUXDSP, firmware.firmware.PROG);
+
+                for (j = 0; j < FIRMWARE_VERSIONS; j++) {
+                        has_firmware = 1;
+                        for (i = 0; i < 4; i++) {
+                                if (firmware_versions[j].ret.retwords[i] !=
+                                    firmware.ret.retwords[i])
+                                        has_firmware = 0;
+                        }
+                        if (has_firmware)
+                                break;
+                }
+
+                if (chip != NULL && has_firmware == 0) {
+                        snd_printdd("Writing Firmware\n");
+                        if (!chip->fw_entry) {
+                                if ((err =
+                                     request_firmware(&chip->fw_entry,
+                                                      "riptide.hex",
+                                                      &chip->pci->dev)) != 0) {
+                                        snd_printk(KERN_ERR
+                                                   "Riptide: Firmware not available %d\n",
+                                                   err);
+                                        return -EIO;
+                                }
+                        }
+                        err = loadfirmware(cif, chip->fw_entry->data,
+                                           chip->fw_entry->size);
+                        if (err)
+                                snd_printk(KERN_ERR
+                                           "Riptide: Could not load firmware %d\n",
+                                           err);
+                }
+        }
+
+        SEND_SACR(cif, 0, AC97_RESET);
+        SEND_RACR(cif, AC97_RESET, &rptr);
+        snd_printdd("AC97: 0x%x 0x%x\n", rptr.retlongs[0], rptr.retlongs[1]);
+
+        SEND_PLST(cif, 0);
+        SEND_SLST(cif, 0);
+        SEND_DLST(cif, 0);
+        SEND_ALST(cif, 0);
+        SEND_KDMA(cif);
+
+        writearm(cif, 0x301F8, 1, 1);
+        writearm(cif, 0x301F4, 1, 1);
+
+        SEND_LSEL(cif, MODEM_CMD, 0, 0, MODEM_INTDEC, MODEM_MERGER,
+                  MODEM_SPLITTER, MODEM_MIXER);
+        setmixer(cif, MODEM_MIXER, 0x7fff, 0x7fff);
+        alloclbuspath(cif, ARM2LBUS_FIFO13, lbus_play_modem, NULL, NULL);
+
+        SEND_LSEL(cif, FM_CMD, 0, 0, FM_INTDEC, FM_MERGER, FM_SPLITTER,
+                  FM_MIXER);
+        setmixer(cif, FM_MIXER, 0x7fff, 0x7fff);
+        writearm(cif, 0x30648 + FM_MIXER * 4, 0x01, 0x00000005);
+        writearm(cif, 0x301A8, 0x02, 0x00000002);
+        writearm(cif, 0x30264, 0x08, 0xffffffff);
+        alloclbuspath(cif, OPL3_SAMPLE, lbus_play_opl3, NULL, NULL);
+
+        SEND_SSRC(cif, I2S_INTDEC, 48000,
+                  ((u32) I2S_RATE * 65536) / 48000,
+                  ((u32) I2S_RATE * 65536) % 48000);
+        SEND_LSEL(cif, I2S_CMD0, 0, 0, I2S_INTDEC, I2S_MERGER, I2S_SPLITTER,
+                  I2S_MIXER);
+        SEND_SI2S(cif, 1);
+        alloclbuspath(cif, ARM2LBUS_FIFO0, lbus_play_i2s, NULL, NULL);
+        alloclbuspath(cif, DIGITAL_MIXER_OUT0, lbus_play_out, NULL, NULL);
+        alloclbuspath(cif, DIGITAL_MIXER_OUT0, lbus_play_outhp, NULL, NULL);
+
+        SET_AIACK(cif->hwport);
+        SET_AIE(cif->hwport);
+        SET_AIACK(cif->hwport);
+        cif->is_reset = 1;
+        if (chip) {
+                for (i = 0; i < 4; i++)
+                        chip->firmware.ret.retwords[i] =
+                            firmware.ret.retwords[i];
+        }
+
+        return 0;
+}
+
+static struct snd_pcm_hardware snd_riptide_playback = {
+        .info = (SNDRV_PCM_INFO_MMAP | SNDRV_PCM_INFO_INTERLEAVED |
+                 SNDRV_PCM_INFO_BLOCK_TRANSFER |
+                 SNDRV_PCM_INFO_PAUSE | SNDRV_PCM_INFO_MMAP_VALID),
+        .formats =
+            SNDRV_PCM_FMTBIT_U8 | SNDRV_PCM_FMTBIT_S16_LE | SNDRV_PCM_FMTBIT_S8
+            | SNDRV_PCM_FMTBIT_U16_LE,
+        .rates = SNDRV_PCM_RATE_KNOT | SNDRV_PCM_RATE_8000_48000,
+        .rate_min = 5500,
+        .rate_max = 48000,
+        .channels_min = 1,
+        .channels_max = 2,
+        .buffer_bytes_max = (64 * 1024),
+        .period_bytes_min = PAGE_SIZE >> 1,
+        .period_bytes_max = PAGE_SIZE << 8,
+        .periods_min = 2,
+        .periods_max = 64,
+        .fifo_size = 0,
+};
+static struct snd_pcm_hardware snd_riptide_capture = {
+        .info = (SNDRV_PCM_INFO_MMAP | SNDRV_PCM_INFO_INTERLEAVED |
+                 SNDRV_PCM_INFO_BLOCK_TRANSFER |
+                 SNDRV_PCM_INFO_PAUSE | SNDRV_PCM_INFO_MMAP_VALID),
+        .formats =
+            SNDRV_PCM_FMTBIT_U8 | SNDRV_PCM_FMTBIT_S16_LE | SNDRV_PCM_FMTBIT_S8
+            | SNDRV_PCM_FMTBIT_U16_LE,
+        .rates = SNDRV_PCM_RATE_KNOT | SNDRV_PCM_RATE_8000_48000,
+        .rate_min = 5500,
+        .rate_max = 48000,
+        .channels_min = 1,
+        .channels_max = 2,
+        .buffer_bytes_max = (64 * 1024),
+        .period_bytes_min = PAGE_SIZE >> 1,
+        .period_bytes_max = PAGE_SIZE << 3,
+        .periods_min = 2,
+        .periods_max = 64,
+        .fifo_size = 0,
+};
+
+static snd_pcm_uframes_t snd_riptide_pointer(struct snd_pcm_substream
+                                             *substream)
+{
+        struct snd_riptide *chip = snd_pcm_substream_chip(substream);
+        struct snd_pcm_runtime *runtime = substream->runtime;
+        struct pcmhw *data = get_pcmhwdev(substream);
+        struct cmdif *cif = chip->cif;
+        union cmdret rptr = CMDRET_ZERO;
+        snd_pcm_uframes_t ret;
+
+        SEND_GPOS(cif, 0, data->id, &rptr);
+        if (data->size && runtime->period_size) {
+                snd_printdd
+                    ("pointer stream %d position 0x%x(0x%x in buffer) bytes 0x%lx(0x%lx in period) frames\n",
+                     data->id, rptr.retlongs[1], rptr.retlongs[1] % data->size,
+                     bytes_to_frames(runtime, rptr.retlongs[1]),
+                     bytes_to_frames(runtime,
+                                     rptr.retlongs[1]) % runtime->period_size);
+                if (rptr.retlongs[1] > data->pointer)
+                        ret =
+                            bytes_to_frames(runtime,
+                                            rptr.retlongs[1] % data->size);
+                else
+                        ret =
+                            bytes_to_frames(runtime,
+                                            data->pointer % data->size);
+        } else {
+                snd_printdd("stream not started or strange parms (%d %ld)\n",
+                            data->size, runtime->period_size);
+                ret = bytes_to_frames(runtime, 0);
+        }
+        return ret;
+}
+
+static int snd_riptide_trigger(struct snd_pcm_substream *substream, int cmd)
+{
+        int i, j;
+        struct snd_riptide *chip = snd_pcm_substream_chip(substream);
+        struct pcmhw *data = get_pcmhwdev(substream);
+        struct cmdif *cif = chip->cif;
+        union cmdret rptr = CMDRET_ZERO;
+
+        spin_lock(&chip->lock);
+        switch (cmd) {
+        case SNDRV_PCM_TRIGGER_START:
+        case SNDRV_PCM_TRIGGER_RESUME:
+                if (!(data->state & ST_PLAY)) {
+                        SEND_SSTR(cif, data->id, data->sgdlist.addr);
+                        SET_AIE(cif->hwport);
+                        data->state = ST_PLAY;
+                        if (data->mixer != 0xff)
+                                setmixer(cif, data->mixer, 0x7fff, 0x7fff);
+                        chip->openstreams++;
+                        data->oldpos = 0;
+                        data->pointer = 0;
+                }
+                break;
+        case SNDRV_PCM_TRIGGER_STOP:
+        case SNDRV_PCM_TRIGGER_SUSPEND:
+                if (data->mixer != 0xff)
+                        setmixer(cif, data->mixer, 0, 0);
+                setmixer(cif, data->mixer, 0, 0);
+                SEND_KSTR(cif, data->id);
+                data->state = ST_STOP;
+                chip->openstreams--;
+                j = 0;
+                do {
+                        i = rptr.retlongs[1];
+                        SEND_GPOS(cif, 0, data->id, &rptr);
+                        udelay(1);
+                } while (i != rptr.retlongs[1] && j++ < MAX_WRITE_RETRY);
+                if (j >= MAX_WRITE_RETRY)
+                        snd_printk(KERN_ERR "Riptide: Could not stop stream!");
+                break;
+        case SNDRV_PCM_TRIGGER_PAUSE_PUSH:
+                if (!(data->state & ST_PAUSE)) {
+                        SEND_PSTR(cif, data->id);
+                        data->state |= ST_PAUSE;
+                        chip->openstreams--;
+                }
+                break;
+        case SNDRV_PCM_TRIGGER_PAUSE_RELEASE:
+                if (data->state & ST_PAUSE) {
+                        SEND_SSTR(cif, data->id, data->sgdlist.addr);
+                        data->state &= ~ST_PAUSE;
+                        chip->openstreams++;
+                }
+                break;
+        default:
+                spin_unlock(&chip->lock);
+                return -EINVAL;
+        }
+        spin_unlock(&chip->lock);
+        return 0;
+}
+
+static int snd_riptide_prepare(struct snd_pcm_substream *substream)
+{
+        struct snd_riptide *chip = snd_pcm_substream_chip(substream);
+        struct snd_pcm_runtime *runtime = substream->runtime;
+        struct snd_sg_buf *sgbuf = snd_pcm_substream_sgbuf(substream);
+        struct pcmhw *data = get_pcmhwdev(substream);
+        struct cmdif *cif = chip->cif;
+        unsigned char *lbuspath = NULL;
+        unsigned int rate, channels;
+        int err = 0;
+        snd_pcm_format_t format;
+
+        snd_assert(cif && data, return -EINVAL);
+
+        snd_printdd("prepare id %d ch: %d f:0x%x r:%d\n", data->id,
+                    runtime->channels, runtime->format, runtime->rate);
+
+        spin_lock_irq(&chip->lock);
+        channels = runtime->channels;
+        format = runtime->format;
+        rate = runtime->rate;
+        switch (channels) {
+        case 1:
+                if (rate == 48000 && format == SNDRV_PCM_FORMAT_S16_LE)
+                        lbuspath = data->paths.noconv;
+                else
+                        lbuspath = data->paths.mono;
+                break;
+        case 2:
+                if (rate == 48000 && format == SNDRV_PCM_FORMAT_S16_LE)
+                        lbuspath = data->paths.noconv;
+                else
+                        lbuspath = data->paths.stereo;
+                break;
+        }
+        snd_printdd("use sgdlist at 0x%p and buffer at 0x%p\n",
+                    data->sgdlist.area, sgbuf);
+        if (data->sgdlist.area && sgbuf) {
+                unsigned int i, j, size, pages, f, pt, period;
+                struct sgd *c, *p = NULL;
+
+                size = frames_to_bytes(runtime, runtime->buffer_size);
+                period = frames_to_bytes(runtime, runtime->period_size);
+                f = PAGE_SIZE;
+                while ((size + (f >> 1) - 1) <= (f << 7) && (f << 1) > period)
+                        f = f >> 1;
+                pages = (size + f - 1) / f;
+                data->size = size;
+                data->pages = pages;
+                snd_printdd
+                    ("create sgd size: 0x%x pages %d of size 0x%x for period 0x%x\n",
+                     size, pages, f, period);
+                pt = 0;
+                j = 0;
+                for (i = 0; i < pages; i++) {
+                        c = &data->sgdbuf[i];
+                        if (p)
+                                p->dwNextLink = cpu_to_le32(data->sgdlist.addr +
+                                                            (i *
+                                                             sizeof(struct
+                                                                    sgd)));
+                        c->dwNextLink = cpu_to_le32(data->sgdlist.addr);
+                        c->dwSegPtrPhys =
+                            cpu_to_le32(sgbuf->table[j].addr + pt);
+                        pt = (pt + f) % PAGE_SIZE;
+                        if (pt == 0)
+                                j++;
+                        c->dwSegLen = cpu_to_le32(f);
+                        c->dwStat_Ctl =
+                            cpu_to_le32(IEOB_ENABLE | IEOS_ENABLE |
+                                        IEOC_ENABLE);
+                        p = c;
+                        size -= f;
+                }
+                data->sgdbuf[i].dwSegLen = cpu_to_le32(size);
+        }
+        if (lbuspath && lbuspath != data->lbuspath) {
+                if (data->lbuspath)
+                        freelbuspath(cif, data->source, data->lbuspath);
+                alloclbuspath(cif, data->source, lbuspath,
+                              &data->mixer, data->intdec);
+                data->lbuspath = lbuspath;
+                data->rate = 0;
+        }
+        if (data->rate != rate || data->format != format ||
+            data->channels != channels) {
+                data->rate = rate;
+                data->format = format;
+                data->channels = channels;
+                if (setsampleformat
+                    (cif, data->mixer, data->id, channels, format)
+                    || setsamplerate(cif, data->intdec, rate))
+                        err = -EIO;
+        }
+        spin_unlock_irq(&chip->lock);
+        return err;
+}
+
+static int
+snd_riptide_hw_params(struct snd_pcm_substream *substream,
+                      struct snd_pcm_hw_params *hw_params)
+{
+        struct snd_riptide *chip = snd_pcm_substream_chip(substream);
+        struct pcmhw *data = get_pcmhwdev(substream);
+        struct snd_dma_buffer *sgdlist = &data->sgdlist;
+        int err;
+
+        snd_printdd("hw params id %d (sgdlist: 0x%p 0x%lx %d)\n", data->id,
+                    sgdlist->area, (unsigned long)sgdlist->addr,
+                    (int)sgdlist->bytes);
+        if (sgdlist->area)
+                snd_dma_free_pages(sgdlist);
+        if ((err = snd_dma_alloc_pages(SNDRV_DMA_TYPE_DEV,
+                                       snd_dma_pci_data(chip->pci),
+                                       sizeof(struct sgd) * (DESC_MAX_MASK + 1),
+                                       sgdlist)) < 0) {
+                snd_printk(KERN_ERR "Riptide: failed to alloc %d dma bytes\n",
+                           (int)sizeof(struct sgd) * (DESC_MAX_MASK + 1));
+                return err;
+        }
+        data->sgdbuf = (struct sgd *)sgdlist->area;
+        return snd_pcm_lib_malloc_pages(substream,
+                                        params_buffer_bytes(hw_params));
+}
+
+static int snd_riptide_hw_free(struct snd_pcm_substream *substream)
+{
+        struct snd_riptide *chip = snd_pcm_substream_chip(substream);
+        struct pcmhw *data = get_pcmhwdev(substream);
+        struct cmdif *cif = chip->cif;
+
+        if (cif && data) {
+                if (data->lbuspath)
+                        freelbuspath(cif, data->source, data->lbuspath);
+                data->lbuspath = NULL;
+                data->source = 0xff;
+                data->intdec[0] = 0xff;
+                data->intdec[1] = 0xff;
+
+                if (data->sgdlist.area) {
+                        snd_dma_free_pages(&data->sgdlist);
+                        data->sgdlist.area = NULL;
+                }
+        }
+        return snd_pcm_lib_free_pages(substream);
+}
+
+static int snd_riptide_playback_open(struct snd_pcm_substream *substream)
+{
+        struct snd_riptide *chip = snd_pcm_substream_chip(substream);
+        struct snd_pcm_runtime *runtime = substream->runtime;
+        struct pcmhw *data;
+        int index = substream->number;
+
+        chip->playback_substream[index] = substream;
+        runtime->hw = snd_riptide_playback;
+        data = kzalloc(sizeof(struct pcmhw), GFP_KERNEL);
+        data->paths = lbus_play_paths[index];
+        data->id = play_ids[index];
+        data->source = play_sources[index];
+        data->intdec[0] = 0xff;
+        data->intdec[1] = 0xff;
+        data->state = ST_STOP;
+        runtime->private_data = data;
+        return snd_pcm_hw_constraint_integer(runtime,
+                                             SNDRV_PCM_HW_PARAM_PERIODS);
+}
+
+static int snd_riptide_capture_open(struct snd_pcm_substream *substream)
+{
+        struct snd_riptide *chip = snd_pcm_substream_chip(substream);
+        struct snd_pcm_runtime *runtime = substream->runtime;
+        struct pcmhw *data;
+
+        chip->capture_substream = substream;
+        runtime->hw = snd_riptide_capture;
+        data = kzalloc(sizeof(struct pcmhw), GFP_KERNEL);
+        data->paths = lbus_rec_path;
+        data->id = PADC;
+        data->source = ACLNK2PADC;
+        data->intdec[0] = 0xff;
+        data->intdec[1] = 0xff;
+        data->state = ST_STOP;
+        runtime->private_data = data;
+        return snd_pcm_hw_constraint_integer(runtime,
+                                             SNDRV_PCM_HW_PARAM_PERIODS);
+}
+
+static int snd_riptide_playback_close(struct snd_pcm_substream *substream)
+{
+        struct snd_riptide *chip = snd_pcm_substream_chip(substream);
+        struct pcmhw *data = get_pcmhwdev(substream);
+        int index = substream->number;
+
+        substream->runtime->private_data = NULL;
+        chip->playback_substream[index] = NULL;
+        kfree(data);
+        return 0;
+}
+
+static int snd_riptide_capture_close(struct snd_pcm_substream *substream)
+{
+        struct snd_riptide *chip = snd_pcm_substream_chip(substream);
+        struct pcmhw *data = get_pcmhwdev(substream);
+
+        substream->runtime->private_data = NULL;
+        chip->capture_substream = NULL;
+        kfree(data);
+        return 0;
+}
+
+static struct snd_pcm_ops snd_riptide_playback_ops = {
+        .open = snd_riptide_playback_open,
+        .close = snd_riptide_playback_close,
+        .ioctl = snd_pcm_lib_ioctl,
+        .hw_params = snd_riptide_hw_params,
+        .hw_free = snd_riptide_hw_free,
+        .prepare = snd_riptide_prepare,
+        .page = snd_pcm_sgbuf_ops_page,
+        .trigger = snd_riptide_trigger,
+        .pointer = snd_riptide_pointer,
+};
+static struct snd_pcm_ops snd_riptide_capture_ops = {
+        .open = snd_riptide_capture_open,
+        .close = snd_riptide_capture_close,
+        .ioctl = snd_pcm_lib_ioctl,
+        .hw_params = snd_riptide_hw_params,
+        .hw_free = snd_riptide_hw_free,
+        .prepare = snd_riptide_prepare,
+        .page = snd_pcm_sgbuf_ops_page,
+        .trigger = snd_riptide_trigger,
+        .pointer = snd_riptide_pointer,
+};
+
+static int __devinit
+snd_riptide_pcm(struct snd_riptide *chip, int device, struct snd_pcm **rpcm)
+{
+        struct snd_pcm *pcm;
+        int err;
+
+        if (rpcm)
+                *rpcm = NULL;
+        if ((err =
+             snd_pcm_new(chip->card, "RIPTIDE", device, PLAYBACK_SUBSTREAMS, 1,
+                         &pcm)) < 0)
+                return err;
+        snd_pcm_set_ops(pcm, SNDRV_PCM_STREAM_PLAYBACK,
+                        &snd_riptide_playback_ops);
+        snd_pcm_set_ops(pcm, SNDRV_PCM_STREAM_CAPTURE,
+                        &snd_riptide_capture_ops);
+        pcm->private_data = chip;
+        pcm->info_flags = 0;
+        strcpy(pcm->name, "RIPTIDE");
+        chip->pcm = pcm;
+        snd_pcm_lib_preallocate_pages_for_all(pcm, SNDRV_DMA_TYPE_DEV_SG,
+                                              snd_dma_pci_data(chip->pci),
+                                              64 * 1024, 128 * 1024);
+        if (rpcm)
+                *rpcm = pcm;
+        return 0;
+}
+
+static irqreturn_t
+snd_riptide_interrupt(int irq, void *dev_id, struct pt_regs *regs)
+{
+        struct snd_riptide *chip = dev_id;
+        struct cmdif *cif = chip->cif;
+
+        if (cif) {
+                chip->received_irqs++;
+                if (IS_EOBIRQ(cif->hwport) || IS_EOSIRQ(cif->hwport) ||
+                    IS_EOCIRQ(cif->hwport)) {
+                        chip->handled_irqs++;
+                        tasklet_hi_schedule(&chip->riptide_tq);
+                }
+                if (chip->rmidi && IS_MPUIRQ(cif->hwport)) {
+                        chip->handled_irqs++;
+                        snd_mpu401_uart_interrupt(irq,
+                                                  chip->rmidi->private_data,
+                                                  regs);
+                }
+                SET_AIACK(cif->hwport);
+        }
+        return IRQ_HANDLED;
+}
+
+static void
+snd_riptide_codec_write(struct snd_ac97 *ac97, unsigned short reg,
+                        unsigned short val)
+{
+        struct snd_riptide *chip = ac97->private_data;
+        struct cmdif *cif = chip->cif;
+        union cmdret rptr = CMDRET_ZERO;
+        int i = 0;
+
+        snd_assert(cif, return);
+
+        snd_printdd("Write AC97 reg 0x%x 0x%x\n", reg, val);
+        do {
+                SEND_SACR(cif, val, reg);
+                SEND_RACR(cif, reg, &rptr);
+        } while (rptr.retwords[1] != val && i++ < MAX_WRITE_RETRY);
+        if (i == MAX_WRITE_RETRY)
+                snd_printdd("Write AC97 reg failed\n");
+}
+
+static unsigned short snd_riptide_codec_read(struct snd_ac97 *ac97,
+                                             unsigned short reg)
+{
+        struct snd_riptide *chip = ac97->private_data;
+        struct cmdif *cif = chip->cif;
+        union cmdret rptr = CMDRET_ZERO;
+
+        snd_assert(cif, return 0);
+
+        if (SEND_RACR(cif, reg, &rptr) != 0)
+                SEND_RACR(cif, reg, &rptr);
+        snd_printdd("Read AC97 reg 0x%x got 0x%x\n", reg, rptr.retwords[1]);
+        return rptr.retwords[1];
+}
+
+static int snd_riptide_initialize(struct snd_riptide *chip)
+{
+        struct cmdif *cif;
+        unsigned int device_id;
+        int err;
+
+        snd_assert(chip, return -EINVAL);
+
+        cif = chip->cif;
+        if (!cif) {
+                if ((cif = kzalloc(sizeof(struct cmdif), GFP_KERNEL)) == NULL)
+                        return -ENOMEM;
+                cif->hwport = (struct riptideport *)chip->port;
+                spin_lock_init(&cif->lock);
+                chip->cif = cif;
+        }
+        cif->is_reset = 0;
+        if ((err = riptide_reset(cif, chip)) != 0)
+                return err;
+        device_id = chip->device_id;
+        switch (device_id) {
+        case 0x4310:
+        case 0x4320:
+        case 0x4330:
+                snd_printdd("Modem enable?\n");
+                SEND_SETDPLL(cif);
+                break;
+        }
+        snd_printdd("Enabling MPU IRQs\n");
+        if (chip->rmidi)
+                SET_EMPUIRQ(cif->hwport);
+        return err;
+}
+
+static int snd_riptide_free(struct snd_riptide *chip)
+{
+        struct cmdif *cif;
+
+        snd_assert(chip, return 0);
+
+        if ((cif = chip->cif)) {
+                SET_GRESET(cif->hwport);
+                udelay(100);
+                UNSET_GRESET(cif->hwport);
+                kfree(chip->cif);
+        }
+        if (chip->fw_entry)
+                release_firmware(chip->fw_entry);
+        release_and_free_resource(chip->res_port);
+        if (chip->irq >= 0)
+                free_irq(chip->irq, chip);
+        kfree(chip);
+        return 0;
+}
+
+static int snd_riptide_dev_free(struct snd_device *device)
+{
+        struct snd_riptide *chip = device->device_data;
+
+        return snd_riptide_free(chip);
+}
+
+static int __devinit
+snd_riptide_create(struct snd_card *card, struct pci_dev *pci,
+                   struct snd_riptide **rchip)
+{
+        struct snd_riptide *chip;
+        struct riptideport *hwport;
+        int err;
+        static struct snd_device_ops ops = {
+                .dev_free = snd_riptide_dev_free,
+        };
+
+        *rchip = NULL;
+        if ((err = pci_enable_device(pci)) < 0)
+                return err;
+        if (!(chip = kzalloc(sizeof(struct snd_riptide), GFP_KERNEL)))
+                return -ENOMEM;
+
+        spin_lock_init(&chip->lock);
+        chip->card = card;
+        chip->pci = pci;
+        chip->irq = -1;
+        chip->openstreams = 0;
+        chip->port = pci_resource_start(pci, 0);
+        chip->received_irqs = 0;
+        chip->handled_irqs = 0;
+        chip->cif = NULL;
+        tasklet_init(&chip->riptide_tq, riptide_handleirq, (unsigned long)chip);
+
+        if ((chip->res_port =
+             request_region(chip->port, 64, "RIPTIDE")) == NULL) {
+                snd_printk(KERN_ERR
+                           "Riptide: unable to grab region 0x%lx-0x%lx\n",
+                           chip->port, chip->port + 64 - 1);
+                snd_riptide_free(chip);
+                return -EBUSY;
+        }
+        hwport = (struct riptideport *)chip->port;
+        UNSET_AIE(hwport);
+
+        if (request_irq
+            (pci->irq, snd_riptide_interrupt, SA_INTERRUPT | SA_SHIRQ,
+             "RIPTIDE", chip)) {
+                snd_printk(KERN_ERR "Riptide: unable to grab IRQ %d\n",
+                           pci->irq);
+                snd_riptide_free(chip);
+                return -EBUSY;
+        }
+        chip->irq = pci->irq;
+        chip->device_id = pci->device;
+        pci_set_master(pci);
+        if ((err = snd_riptide_initialize(chip)) < 0) {
+                snd_riptide_free(chip);
+                return err;
+        }
+
+        if ((err = snd_device_new(card, SNDRV_DEV_LOWLEVEL, chip, &ops)) < 0) {
+                snd_riptide_free(chip);
+                return err;
+        }
+
+        *rchip = chip;
+        return 0;
+}
+
+static void
+snd_riptide_proc_read(struct snd_info_entry *entry,
+                      struct snd_info_buffer *buffer)
+{
+        struct snd_riptide *chip = entry->private_data;
+        struct pcmhw *data;
+        int i;
+        struct cmdif *cif = NULL;
+        unsigned char p[256];
+        unsigned short rval = 0, lval = 0;
+        unsigned int rate;
+
+        if (!chip)
+                return;
+
+        snd_iprintf(buffer, "%s\n\n", chip->card->longname);
+        snd_iprintf(buffer, "Device ID: 0x%x\nReceived IRQs: (%ld)%ld\nPorts:",
+                    chip->device_id, chip->handled_irqs, chip->received_irqs);
+        for (i = 0; i < 64; i += 4)
+                snd_iprintf(buffer, "%c%02x: %08x",
+                            (i % 16) ? ' ' : '\n', i, inl(chip->port + i));
+        if ((cif = chip->cif)) {
+                snd_iprintf(buffer,
+                            "\nVersion: ASIC: %d CODEC: %d AUXDSP: %d PROG: %d",
+                            chip->firmware.firmware.ASIC,
+                            chip->firmware.firmware.CODEC,
+                            chip->firmware.firmware.AUXDSP,
+                            chip->firmware.firmware.PROG);
+                snd_iprintf(buffer, "\nDigital mixer:");
+                for (i = 0; i < 12; i++) {
+                        getmixer(cif, i, &rval, &lval);
+                        snd_iprintf(buffer, "\n %d: %d %d", i, rval, lval);
+                }
+                snd_iprintf(buffer,
+                            "\nARM Commands num: %d failed: %d time: %d max: %d min: %d",
+                            cif->cmdcnt, cif->errcnt,
+                            cif->cmdtime, cif->cmdtimemax, cif->cmdtimemin);
+        }
+        snd_iprintf(buffer, "\nOpen streams %d:\n", chip->openstreams);
+        for (i = 0; i < PLAYBACK_SUBSTREAMS; i++) {
+                if (chip->playback_substream[i]
+                    && chip->playback_substream[i]->runtime
+                    && (data =
+                        chip->playback_substream[i]->runtime->private_data)) {
+                        snd_iprintf(buffer,
+                                    "stream: %d mixer: %d source: %d (%d,%d)\n",
+                                    data->id, data->mixer, data->source,
+                                    data->intdec[0], data->intdec[1]);
+                        if (!(getsamplerate(cif, data->intdec, &rate)))
+                                snd_iprintf(buffer, "rate: %d\n", rate);
+                }
+        }
+        if (chip->capture_substream
+            && chip->capture_substream->runtime
+            && (data = chip->capture_substream->runtime->private_data)) {
+                snd_iprintf(buffer,
+                            "stream: %d mixer: %d source: %d (%d,%d)\n",
+                            data->id, data->mixer,
+                            data->source, data->intdec[0], data->intdec[1]);
+                if (!(getsamplerate(cif, data->intdec, &rate)))
+                        snd_iprintf(buffer, "rate: %d\n", rate);
+        }
+        snd_iprintf(buffer, "Paths:\n");
+        i = getpaths(cif, p);
+        while (i--) {
+                snd_iprintf(buffer, "%x->%x ", p[i - 1], p[i]);
+                i--;
+        }
+        snd_iprintf(buffer, "\n");
+}
+
+static void __devinit snd_riptide_proc_init(struct snd_riptide *chip)
+{
+        struct snd_info_entry *entry;
+
+        if (!snd_card_proc_new(chip->card, "riptide", &entry))
+                snd_info_set_text_ops(entry, chip, 4096, snd_riptide_proc_read);
+}
+
+static int __devinit snd_riptide_mixer(struct snd_riptide *chip)
+{
+        struct snd_ac97_bus *pbus;
+        struct snd_ac97_template ac97;
+        int err = 0;
+        static struct snd_ac97_bus_ops ops = {
+                .write = snd_riptide_codec_write,
+                .read = snd_riptide_codec_read,
+        };
+
+        memset(&ac97, 0, sizeof(ac97));
+        ac97.private_data = chip;
+        ac97.scaps = AC97_SCAP_SKIP_MODEM;
+
+        if ((err = snd_ac97_bus(chip->card, 0, &ops, chip, &pbus)) < 0)
+                return err;
+
+        chip->ac97_bus = pbus;
+        ac97.pci = chip->pci;
+        if ((err = snd_ac97_mixer(pbus, &ac97, &chip->ac97)) < 0)
+                return err;
+        return err;
+}
+
+#ifdef SUPPORT_JOYSTICK
+static int have_joystick;
+static struct pci_dev *riptide_gameport_pci;
+static struct gameport *riptide_gameport;
+
+static int __devinit
+snd_riptide_joystick_probe(struct pci_dev *pci, const struct pci_device_id *id)
+{
+        static int dev;
+
+        if (dev >= SNDRV_CARDS)
+                return -ENODEV;
+        if (!enable[dev]) {
+                dev++;
+                return -ENOENT;
+        }
+
+        if (joystick_port[dev]) {
+                riptide_gameport = gameport_allocate_port();
+                if (riptide_gameport) {
+                        if (!request_region
+                            (joystick_port[dev], 8, "Riptide gameport")) {
+                                snd_printk(KERN_WARNING
+                                           "Riptide: cannot grab gameport 0x%x\n",
+                                           joystick_port[dev]);
+                                gameport_free_port(riptide_gameport);
+                                riptide_gameport = NULL;
+                        } else {
+                                riptide_gameport_pci = pci;
+                                riptide_gameport->io = joystick_port[dev];
+                                gameport_register_port(riptide_gameport);
+                        }
+                }
+        }
+        dev++;
+        return 0;
+}
+
+static void __devexit snd_riptide_joystick_remove(struct pci_dev *pci)
+{
+        if (riptide_gameport) {
+                if (riptide_gameport_pci == pci) {
+                        release_region(riptide_gameport->io, 8);
+                        riptide_gameport_pci = NULL;
+                        gameport_unregister_port(riptide_gameport);
+                        riptide_gameport = NULL;
+                }
+        }
+}
+#endif
+
+static int __devinit
+snd_card_riptide_probe(struct pci_dev *pci, const struct pci_device_id *pci_id)
+{
+        static int dev;
+        struct snd_card *card;
+        struct snd_riptide *chip;
+        unsigned short addr;
+        int err = 0;
+
+        if (dev >= SNDRV_CARDS)
+                return -ENODEV;
+        if (!enable[dev]) {
+                dev++;
+                return -ENOENT;
+        }
+
+        card = snd_card_new(index[dev], id[dev], THIS_MODULE, 0);
+        if (card == NULL)
+                return -ENOMEM;
+        if ((err = snd_riptide_create(card, pci, &chip)) < 0) {
+                snd_card_free(card);
+                return err;
+        }
+        card->private_data = chip;
+        if ((err = snd_riptide_pcm(chip, 0, NULL)) < 0) {
+                snd_card_free(card);
+                return err;
+        }
+        if ((err = snd_riptide_mixer(chip)) < 0) {
+                snd_card_free(card);
+                return err;
+        }
+        pci_write_config_word(chip->pci, PCI_EXT_Legacy_Mask, LEGACY_ENABLE_ALL
+                              | (opl3_port[dev] ? LEGACY_ENABLE_FM : 0)
+#ifdef SUPPORT_JOYSTICK
+                              | (joystick_port[dev] ? LEGACY_ENABLE_GAMEPORT :
+                                 0)
+#endif
+                              | (mpu_port[dev]
+                                 ? (LEGACY_ENABLE_MPU_INT | LEGACY_ENABLE_MPU) :
+                                 0)
+                              | ((chip->irq << 4) & 0xF0));
+        if ((addr = mpu_port[dev]) != 0) {
+                pci_write_config_word(chip->pci, PCI_EXT_MPU_Base, addr);
+                if ((err = snd_mpu401_uart_new(card, 0, MPU401_HW_RIPTIDE,
+                                               addr, 0, chip->irq, 0,
+                                               &chip->rmidi)) < 0)
+                        snd_printk(KERN_WARNING
+                                   "Riptide: Can't Allocate MPU at 0x%x\n",
+                                   addr);
+                else
+                        chip->mpuaddr = addr;
+        }
+        if ((addr = opl3_port[dev]) != 0) {
+                pci_write_config_word(chip->pci, PCI_EXT_FM_Base, addr);
+                if ((err = snd_opl3_create(card, addr, addr + 2,
+                                           OPL3_HW_RIPTIDE, 0,
+                                           &chip->opl3)) < 0)
+                        snd_printk(KERN_WARNING
+                                   "Riptide: Can't Allocate OPL3 at 0x%x\n",
+                                   addr);
+                else {
+                        chip->opladdr = addr;
+                        if ((err =
+                             snd_opl3_hwdep_new(chip->opl3, 0, 1, NULL)) < 0)
+                                snd_printk(KERN_WARNING
+                                           "Riptide: Can't Allocate OPL3-HWDEP\n");
+                }
+        }
+#ifdef SUPPORT_JOYSTICK
+        if ((addr = joystick_port[dev]) != 0) {
+                pci_write_config_word(chip->pci, PCI_EXT_Game_Base, addr);
+                chip->gameaddr = addr;
+        }
+#endif
+
+        strcpy(card->driver, "RIPTIDE");
+        strcpy(card->shortname, "Riptide");
+#ifdef SUPPORT_JOYSTICK
+        snprintf(card->longname, sizeof(card->longname),
+                 "%s at 0x%lx, irq %i mpu 0x%x opl3 0x%x gameport 0x%x",
+                 card->shortname, chip->port, chip->irq, chip->mpuaddr,
+                 chip->opladdr, chip->gameaddr);
+#else
+        snprintf(card->longname, sizeof(card->longname),
+                 "%s at 0x%lx, irq %i mpu 0x%x opl3 0x%x",
+                 card->shortname, chip->port, chip->irq, chip->mpuaddr,
+                 chip->opladdr);
+#endif
+        snd_riptide_proc_init(chip);
+        if ((err = snd_card_register(card)) < 0) {
+                snd_card_free(card);
+                return err;
+        }
+        pci_set_drvdata(pci, card);
+        dev++;
+        return 0;
+}
+
+static void __devexit snd_card_riptide_remove(struct pci_dev *pci)
+{
+        snd_card_free(pci_get_drvdata(pci));
+        pci_set_drvdata(pci, NULL);
+}
+
+static struct pci_driver driver = {
+        .name = "RIPTIDE",
+        .id_table = snd_riptide_ids,
+        .probe = snd_card_riptide_probe,
+        .remove = __devexit_p(snd_card_riptide_remove),
+#ifdef CONFIG_PM
+        .suspend = riptide_suspend,
+        .resume = riptide_resume,
+#endif
+};
+
+#ifdef SUPPORT_JOYSTICK
+static struct pci_driver joystick_driver = {
+        .name = "Riptide Joystick",
+        .id_table = snd_riptide_joystick_ids,
+        .probe = snd_riptide_joystick_probe,
+        .remove = __devexit_p(snd_riptide_joystick_remove),
+};
+#endif
+
+static int __init alsa_card_riptide_init(void)
+{
+        int err;
+        if ((err = pci_register_driver(&driver)) < 0)
+                return err;
+#if defined(SUPPORT_JOYSTICK)
+        if (pci_register_driver(&joystick_driver) < 0) {
+                have_joystick = 0;
+                snd_printk(KERN_INFO "no joystick found\n");
+        } else
+                have_joystick = 1;
+#endif
+        return 0;
+}
+
+static void __exit alsa_card_riptide_exit(void)
+{
+        pci_unregister_driver(&driver);
+#if defined(SUPPORT_JOYSTICK)
+        if (have_joystick)
+                pci_unregister_driver(&joystick_driver);
+#endif
+}
+
+module_init(alsa_card_riptide_init);
+module_exit(alsa_card_riptide_exit);
diff --git a/sound/pci/via82xx.c b/sound/pci/via82xx.c
index 1957d29c119e..1e7398de2865 100644
--- a/sound/pci/via82xx.c
+++ b/sound/pci/via82xx.c
@@ -2373,6 +2373,7 @@ static int __devinit check_dxs_list(struct pci_dev *pci)
                 { .subvendor = 0x161f, .subdevice = 0x2032, .action = VIA_DXS_48K }, /* m680x machines */
                 { .subvendor = 0x1631, .subdevice = 0xe004, .action = VIA_DXS_ENABLE }, /* Easy Note 3174, Packard Bell */
                 { .subvendor = 0x1695, .subdevice = 0x3005, .action = VIA_DXS_ENABLE }, /* EPoX EP-8K9A */
+                { .subvendor = 0x1695, .subdevice = 0x300c, .action = VIA_DXS_SRC }, /* EPoX EP-8KRAI */
                 { .subvendor = 0x1695, .subdevice = 0x300e, .action = VIA_DXS_SRC }, /* EPoX 9HEAI */
                 { .subvendor = 0x16f3, .subdevice = 0x6405, .action = VIA_DXS_SRC }, /* Jetway K8M8MS */
                 { .subvendor = 0x1734, .subdevice = 0x1078, .action = VIA_DXS_SRC }, /* FSC Amilo L7300 */
diff --git a/sound/pcmcia/pdaudiocf/pdaudiocf.c b/sound/pcmcia/pdaudiocf/pdaudiocf.c
index 77caf43a3109..adfdce7499d1 100644
--- a/sound/pcmcia/pdaudiocf/pdaudiocf.c
+++ b/sound/pcmcia/pdaudiocf/pdaudiocf.c
@@ -57,18 +57,12 @@ static struct snd_card *card_list[SNDRV_CARDS];
 /*
  * prototypes
  */
-static void pdacf_config(dev_link_t *link);
+static int pdacf_config(struct pcmcia_device *link);
 static void snd_pdacf_detach(struct pcmcia_device *p_dev);
 
-static void pdacf_release(dev_link_t *link)
+static void pdacf_release(struct pcmcia_device *link)
 {
-        if (link->state & DEV_CONFIG) {
-                /* release cs resources */
-                pcmcia_release_configuration(link->handle);
-                pcmcia_release_io(link->handle, &link->io);
-                pcmcia_release_irq(link->handle, &link->irq);
-                link->state &= ~DEV_CONFIG;
-        }
+        pcmcia_disable_device(link);
 }
 
 /*
@@ -76,7 +70,7 @@ static void pdacf_release(dev_link_t *link)
  */
 static int snd_pdacf_free(struct snd_pdacf *pdacf)
 {
-        dev_link_t *link = &pdacf->link;
+        struct pcmcia_device *link = pdacf->p_dev;
 
         pdacf_release(link);
 
@@ -96,10 +90,9 @@ static int snd_pdacf_dev_free(struct snd_device *device)
 /*
  * snd_pdacf_attach - attach callback for cs
  */
-static int snd_pdacf_attach(struct pcmcia_device *p_dev)
+static int snd_pdacf_probe(struct pcmcia_device *link)
 {
         int i;
-        dev_link_t *link;               /* Info for cardmgr */
         struct snd_pdacf *pdacf;
         struct snd_card *card;
         static struct snd_device_ops ops = {
@@ -139,7 +132,7 @@ static int snd_pdacf_attach(struct pcmcia_device *p_dev)
         pdacf->index = i;
         card_list[i] = card;
 
-        link = &pdacf->link;
+        pdacf->p_dev = link;
         link->priv = pdacf;
 
         link->io.Attributes1 = IO_DATA_PATH_WIDTH_AUTO;
@@ -156,13 +149,7 @@ static int snd_pdacf_attach(struct pcmcia_device *p_dev)
         link->conf.ConfigIndex = 1;
         link->conf.Present = PRESENT_OPTION;
 
-        /* Chain drivers */
-        link->next = NULL;
-
-        link->handle = p_dev;
-        pdacf_config(link);
-
-        return 0;
+        return pdacf_config(link);
 }
 
 
@@ -209,9 +196,8 @@ static int snd_pdacf_assign_resources(struct snd_pdacf *pdacf, int port, int irq
 /*
  * snd_pdacf_detach - detach callback for cs
  */
-static void snd_pdacf_detach(struct pcmcia_device *p_dev)
+static void snd_pdacf_detach(struct pcmcia_device *link)
 {
-        dev_link_t *link = dev_to_instance(p_dev);
         struct snd_pdacf *chip = link->priv;
 
         snd_printdd(KERN_DEBUG "pdacf_detach called\n");
@@ -230,13 +216,11 @@ static void snd_pdacf_detach(struct pcmcia_device *p_dev)
 #define CS_CHECK(fn, ret) \
 do { last_fn = (fn); if ((last_ret = (ret)) != 0) goto cs_failed; } while (0)
 
-static void pdacf_config(dev_link_t *link)
+static int pdacf_config(struct pcmcia_device *link)
 {
-        client_handle_t handle = link->handle;
         struct snd_pdacf *pdacf = link->priv;
         tuple_t tuple;
         cisparse_t *parse = NULL;
-        config_info_t conf;
         u_short buf[32];
         int last_fn, last_ret;
 
@@ -244,7 +228,7 @@ static void pdacf_config(dev_link_t *link)
         parse = kmalloc(sizeof(*parse), GFP_KERNEL);
         if (! parse) {
                 snd_printk(KERN_ERR "pdacf_config: cannot allocate\n");
-                return;
+                return -ENOMEM;
         }
         tuple.DesiredTuple = CISTPL_CFTABLE_ENTRY;
         tuple.Attributes = 0;
@@ -252,71 +236,51 @@ static void pdacf_config(dev_link_t *link)
         tuple.TupleDataMax = sizeof(buf);
         tuple.TupleOffset = 0;
         tuple.DesiredTuple = CISTPL_CONFIG;
-        CS_CHECK(GetFirstTuple, pcmcia_get_first_tuple(handle, &tuple));
-        CS_CHECK(GetTupleData, pcmcia_get_tuple_data(handle, &tuple));
-        CS_CHECK(ParseTuple, pcmcia_parse_tuple(handle, &tuple, parse));
+        CS_CHECK(GetFirstTuple, pcmcia_get_first_tuple(link, &tuple));
+        CS_CHECK(GetTupleData, pcmcia_get_tuple_data(link, &tuple));
+        CS_CHECK(ParseTuple, pcmcia_parse_tuple(link, &tuple, parse));
         link->conf.ConfigBase = parse->config.base;
         link->conf.ConfigIndex = 0x5;
         kfree(parse);
 
-        CS_CHECK(GetConfigurationInfo, pcmcia_get_configuration_info(handle, &conf));
-        link->conf.Vcc = conf.Vcc;
-
-        /* Configure card */
-        link->state |= DEV_CONFIG;
-
-        CS_CHECK(RequestIO, pcmcia_request_io(handle, &link->io));
-        CS_CHECK(RequestIRQ, pcmcia_request_irq(link->handle, &link->irq));
-        CS_CHECK(RequestConfiguration, pcmcia_request_configuration(link->handle, &link->conf));
+        CS_CHECK(RequestIO, pcmcia_request_io(link, &link->io));
+        CS_CHECK(RequestIRQ, pcmcia_request_irq(link, &link->irq));
+        CS_CHECK(RequestConfiguration, pcmcia_request_configuration(link, &link->conf));
 
         if (snd_pdacf_assign_resources(pdacf, link->io.BasePort1, link->irq.AssignedIRQ) < 0)
                 goto failed;
 
-        link->dev = &pdacf->node;
-        link->state &= ~DEV_CONFIG_PENDING;
-        return;
+        link->dev_node = &pdacf->node;
+        return 0;
 
 cs_failed:
-        cs_error(link->handle, last_fn, last_ret);
+        cs_error(link, last_fn, last_ret);
 failed:
-        pcmcia_release_configuration(link->handle);
-        pcmcia_release_io(link->handle, &link->io);
-        pcmcia_release_irq(link->handle, &link->irq);
+        pcmcia_disable_device(link);
+        return -ENODEV;
 }
 
 #ifdef CONFIG_PM
 
-static int pdacf_suspend(struct pcmcia_device *dev)
+static int pdacf_suspend(struct pcmcia_device *link)
 {
-        dev_link_t *link = dev_to_instance(dev);
         struct snd_pdacf *chip = link->priv;
 
         snd_printdd(KERN_DEBUG "SUSPEND\n");
-        link->state |= DEV_SUSPEND;
         if (chip) {
                 snd_printdd(KERN_DEBUG "snd_pdacf_suspend calling\n");
                 snd_pdacf_suspend(chip, PMSG_SUSPEND);
         }
 
-        snd_printdd(KERN_DEBUG "RESET_PHYSICAL\n");
-        if (link->state & DEV_CONFIG)
-                pcmcia_release_configuration(link->handle);
-
         return 0;
 }
 
-static int pdacf_resume(struct pcmcia_device *dev)
+static int pdacf_resume(struct pcmcia_device *link)
 {
-        dev_link_t *link = dev_to_instance(dev);
         struct snd_pdacf *chip = link->priv;
 
         snd_printdd(KERN_DEBUG "RESUME\n");
-        link->state &= ~DEV_SUSPEND;
-
-        snd_printdd(KERN_DEBUG "CARD_RESET\n");
-        if (DEV_OK(link)) {
-                snd_printdd(KERN_DEBUG "requestconfig...\n");
-                pcmcia_request_configuration(link->handle, &link->conf);
+        if (pcmcia_dev_present(link)) {
                 if (chip) {
                         snd_printdd(KERN_DEBUG "calling snd_pdacf_resume\n");
                         snd_pdacf_resume(chip);
@@ -343,7 +307,7 @@ static struct pcmcia_driver pdacf_cs_driver = {
         .drv            = {
                 .name   = "snd-pdaudiocf",
         },
-        .probe          = snd_pdacf_attach,
+        .probe          = snd_pdacf_probe,
         .remove         = snd_pdacf_detach,
         .id_table       = snd_pdacf_ids,
 #ifdef CONFIG_PM
diff --git a/sound/pcmcia/pdaudiocf/pdaudiocf.h b/sound/pcmcia/pdaudiocf/pdaudiocf.h
index 2744f189a613..9a14a4f64bd3 100644
--- a/sound/pcmcia/pdaudiocf/pdaudiocf.h
+++ b/sound/pcmcia/pdaudiocf/pdaudiocf.h
@@ -116,7 +116,7 @@ struct snd_pdacf {
         void *pcm_area;
         
         /* pcmcia stuff */
-        dev_link_t link;
+        struct pcmcia_device    *p_dev;
         dev_node_t node;
 };
 
diff --git a/sound/pcmcia/vx/vxpocket.c b/sound/pcmcia/vx/vxpocket.c
index 66900d20a42f..7e0cda2b6ef9 100644
--- a/sound/pcmcia/vx/vxpocket.c
+++ b/sound/pcmcia/vx/vxpocket.c
@@ -59,15 +59,9 @@ static unsigned int card_alloc;
 
 /*
  */
-static void vxpocket_release(dev_link_t *link)
+static void vxpocket_release(struct pcmcia_device *link)
 {
-        if (link->state & DEV_CONFIG) {
-                /* release cs resources */
-                pcmcia_release_configuration(link->handle);
-                pcmcia_release_io(link->handle, &link->io);
-                pcmcia_release_irq(link->handle, &link->irq);
-                link->state &= ~DEV_CONFIG;
-        }
+        pcmcia_disable_device(link);
 }
 
 /*
@@ -132,9 +126,9 @@ static struct snd_vx_hardware vxp440_hw = {
 /*
  * create vxpocket instance
  */
-static struct snd_vxpocket *snd_vxpocket_new(struct snd_card *card, int ibl)
+static struct snd_vxpocket *snd_vxpocket_new(struct snd_card *card, int ibl,
+                                             struct pcmcia_device *link)
 {
-        dev_link_t *link;               /* Info for cardmgr */
         struct vx_core *chip;
         struct snd_vxpocket *vxp;
         static struct snd_device_ops ops = {
@@ -154,7 +148,7 @@ static struct snd_vxpocket *snd_vxpocket_new(struct snd_card *card, int ibl)
 
         vxp = (struct snd_vxpocket *)chip;
 
-        link = &vxp->link;
+        vxp->p_dev = link;
         link->priv = chip;
 
         link->io.Attributes1 = IO_DATA_PATH_WIDTH_AUTO;
@@ -167,7 +161,6 @@ static struct snd_vxpocket *snd_vxpocket_new(struct snd_card *card, int ibl)
         link->irq.Instance = chip;
 
         link->conf.Attributes = CONF_ENABLE_IRQ;
-        link->conf.Vcc = 50;
         link->conf.IntType = INT_MEMORY_AND_IO;
         link->conf.ConfigIndex = 1;
         link->conf.Present = PRESENT_OPTION;
@@ -215,9 +208,8 @@ static int snd_vxpocket_assign_resources(struct vx_core *chip, int port, int irq
 #define CS_CHECK(fn, ret) \
 do { last_fn = (fn); if ((last_ret = (ret)) != 0) goto cs_failed; } while (0)
 
-static void vxpocket_config(dev_link_t *link)
+static int vxpocket_config(struct pcmcia_device *link)
 {
-        client_handle_t handle = link->handle;
         struct vx_core *chip = link->priv;
         struct snd_vxpocket *vxp = (struct snd_vxpocket *)chip;
         tuple_t tuple;
@@ -229,24 +221,24 @@ static void vxpocket_config(dev_link_t *link)
         parse = kmalloc(sizeof(*parse), GFP_KERNEL);
         if (! parse) {
                 snd_printk(KERN_ERR "vx: cannot allocate\n");
-                return;
+                return -ENOMEM;
         }
         tuple.Attributes = 0;
         tuple.TupleData = (cisdata_t *)buf;
         tuple.TupleDataMax = sizeof(buf);
         tuple.TupleOffset = 0;
         tuple.DesiredTuple = CISTPL_CONFIG;
-        CS_CHECK(GetFirstTuple, pcmcia_get_first_tuple(handle, &tuple));
-        CS_CHECK(GetTupleData, pcmcia_get_tuple_data(handle, &tuple));
-        CS_CHECK(ParseTuple, pcmcia_parse_tuple(handle, &tuple, parse));
+        CS_CHECK(GetFirstTuple, pcmcia_get_first_tuple(link, &tuple));
+        CS_CHECK(GetTupleData, pcmcia_get_tuple_data(link, &tuple));
+        CS_CHECK(ParseTuple, pcmcia_parse_tuple(link, &tuple, parse));
         link->conf.ConfigBase = parse->config.base;
         link->conf.Present = parse->config.rmask[0];
 
         /* redefine hardware record according to the VERSION1 string */
         tuple.DesiredTuple = CISTPL_VERS_1;
-        CS_CHECK(GetFirstTuple, pcmcia_get_first_tuple(handle, &tuple));
-        CS_CHECK(GetTupleData, pcmcia_get_tuple_data(handle, &tuple));
-        CS_CHECK(ParseTuple, pcmcia_parse_tuple(handle, &tuple, parse));
+        CS_CHECK(GetFirstTuple, pcmcia_get_first_tuple(link, &tuple));
+        CS_CHECK(GetTupleData, pcmcia_get_tuple_data(link, &tuple));
+        CS_CHECK(ParseTuple, pcmcia_parse_tuple(link, &tuple, parse));
         if (! strcmp(parse->version_1.str + parse->version_1.ofs[1], "VX-POCKET")) {
                 snd_printdd("VX-pocket is detected\n");
         } else {
@@ -257,67 +249,50 @@ static void vxpocket_config(dev_link_t *link)
                 strcpy(chip->card->driver, vxp440_hw.name);
         }
 
-        /* Configure card */
-        link->state |= DEV_CONFIG;
-
-        CS_CHECK(RequestIO, pcmcia_request_io(handle, &link->io));
-        CS_CHECK(RequestIRQ, pcmcia_request_irq(link->handle, &link->irq));
-        CS_CHECK(RequestConfiguration, pcmcia_request_configuration(link->handle, &link->conf));
+        CS_CHECK(RequestIO, pcmcia_request_io(link, &link->io));
+        CS_CHECK(RequestIRQ, pcmcia_request_irq(link, &link->irq));
+        CS_CHECK(RequestConfiguration, pcmcia_request_configuration(link, &link->conf));
 
-        chip->dev = &handle_to_dev(link->handle);
+        chip->dev = &handle_to_dev(link);
         snd_card_set_dev(chip->card, chip->dev);
 
         if (snd_vxpocket_assign_resources(chip, link->io.BasePort1, link->irq.AssignedIRQ) < 0)
                 goto failed;
 
-        link->dev = &vxp->node;
-        link->state &= ~DEV_CONFIG_PENDING;
+        link->dev_node = &vxp->node;
         kfree(parse);
-        return;
+        return 9;
 
 cs_failed:
-        cs_error(link->handle, last_fn, last_ret);
+        cs_error(link, last_fn, last_ret);
 failed:
-        pcmcia_release_configuration(link->handle);
-        pcmcia_release_io(link->handle, &link->io);
-        pcmcia_release_irq(link->handle, &link->irq);
-        link->state &= ~DEV_CONFIG;
+        pcmcia_disable_device(link);
         kfree(parse);
+        return -ENODEV;
 }
 
 #ifdef CONFIG_PM
 
-static int vxp_suspend(struct pcmcia_device *dev)
+static int vxp_suspend(struct pcmcia_device *link)
 {
-        dev_link_t *link = dev_to_instance(dev);
         struct vx_core *chip = link->priv;
 
         snd_printdd(KERN_DEBUG "SUSPEND\n");
-        link->state |= DEV_SUSPEND;
         if (chip) {
                 snd_printdd(KERN_DEBUG "snd_vx_suspend calling\n");
                 snd_vx_suspend(chip, PMSG_SUSPEND);
         }
-        snd_printdd(KERN_DEBUG "RESET_PHYSICAL\n");
-        if (link->state & DEV_CONFIG)
-                pcmcia_release_configuration(link->handle);
 
         return 0;
 }
 
-static int vxp_resume(struct pcmcia_device *dev)
+static int vxp_resume(struct pcmcia_device *link)
 {
-        dev_link_t *link = dev_to_instance(dev);
         struct vx_core *chip = link->priv;
 
         snd_printdd(KERN_DEBUG "RESUME\n");
-        link->state &= ~DEV_SUSPEND;
-
-        snd_printdd(KERN_DEBUG "CARD_RESET\n");
-        if (DEV_OK(link)) {
+        if (pcmcia_dev_present(link)) {
                 //struct snd_vxpocket *vxp = (struct snd_vxpocket *)chip;
-                snd_printdd(KERN_DEBUG "requestconfig...\n");
-                pcmcia_request_configuration(link->handle, &link->conf);
                 if (chip) {
                         snd_printdd(KERN_DEBUG "calling snd_vx_resume\n");
                         snd_vx_resume(chip);
@@ -333,7 +308,7 @@ static int vxp_resume(struct pcmcia_device *dev)
 
 /*
  */
-static int vxpocket_attach(struct pcmcia_device *p_dev)
+static int vxpocket_probe(struct pcmcia_device *p_dev)
 {
         struct snd_card *card;
         struct snd_vxpocket *vxp;
@@ -358,7 +333,7 @@ static int vxpocket_attach(struct pcmcia_device *p_dev)
                 return -ENOMEM;
         }
 
-        vxp = snd_vxpocket_new(card, ibl[i]);
+        vxp = snd_vxpocket_new(card, ibl[i], p_dev);
         if (! vxp) {
                 snd_card_free(card);
                 return -ENODEV;
@@ -368,20 +343,13 @@ static int vxpocket_attach(struct pcmcia_device *p_dev)
         vxp->index = i;
         card_alloc |= 1 << i;
 
-        /* Chain drivers */
-        vxp->link.next = NULL;
-
-        vxp->link.handle = p_dev;
-        vxp->link.state |= DEV_PRESENT | DEV_CONFIG_PENDING;
-        p_dev->instance = &vxp->link;
-        vxpocket_config(&vxp->link);
+        vxp->p_dev = p_dev;
 
-        return 0;
+        return vxpocket_config(p_dev);
 }
 
-static void vxpocket_detach(struct pcmcia_device *p_dev)
+static void vxpocket_detach(struct pcmcia_device *link)
 {
-        dev_link_t *link = dev_to_instance(p_dev);
         struct snd_vxpocket *vxp;
         struct vx_core *chip;
 
@@ -413,7 +381,7 @@ static struct pcmcia_driver vxp_cs_driver = {
         .drv            = {
                 .name   = "snd-vxpocket",
         },
-        .probe          = vxpocket_attach,
+        .probe          = vxpocket_probe,
         .remove         = vxpocket_detach,
         .id_table       = vxp_ids,
 #ifdef CONFIG_PM
diff --git a/sound/pcmcia/vx/vxpocket.h b/sound/pcmcia/vx/vxpocket.h
index 67efae3f6c8d..27ea002294c0 100644
--- a/sound/pcmcia/vx/vxpocket.h
+++ b/sound/pcmcia/vx/vxpocket.h
@@ -42,7 +42,7 @@ struct snd_vxpocket {
         int index;      /* card index */
 
         /* pcmcia stuff */
-        dev_link_t link;
+        struct pcmcia_device    *p_dev;
         dev_node_t node;
 };
 
diff --git a/sound/usb/usbmixer.c b/sound/usb/usbmixer.c
index 8d08b34a1cb5..ce86283ee0fa 100644
--- a/sound/usb/usbmixer.c
+++ b/sound/usb/usbmixer.c
@@ -306,8 +306,8 @@ static int get_relative_value(struct usb_mixer_elem_info *cval, int val)
                 cval->res = 1;
         if (val < cval->min)
                 return 0;
-        else if (val > cval->max)
-                return (cval->max - cval->min) / cval->res;
+        else if (val >= cval->max)
+                return (cval->max - cval->min + cval->res - 1) / cval->res;
         else
                 return (val - cval->min) / cval->res;
 }
@@ -670,6 +670,36 @@ static int get_min_max(struct usb_mixer_elem_info *cval, int default_min)
                 }
                 if (cval->res == 0)
                         cval->res = 1;
+
+                /* Additional checks for the proper resolution
+                 *
+                 * Some devices report smaller resolutions than actually
+                 * reacting.  They don't return errors but simply clip
+                 * to the lower aligned value.
+                 */
+                if (cval->min + cval->res < cval->max) {
+                        int last_valid_res = cval->res;
+                        int saved, test, check;
+                        get_cur_mix_value(cval, minchn, &saved);
+                        for (;;) {
+                                test = saved;
+                                if (test < cval->max)
+                                        test += cval->res;
+                                else
+                                        test -= cval->res;
+                                if (test < cval->min || test > cval->max ||
+                                    set_cur_mix_value(cval, minchn, test) ||
+                                    get_cur_mix_value(cval, minchn, &check)) {
+                                        cval->res = last_valid_res;
+                                        break;
+                                }
+                                if (test == check)
+                                        break;
+                                cval->res *= 2;
+                        }
+                        set_cur_mix_value(cval, minchn, saved);
+                }
+
                 cval->initialized = 1;
         }
         return 0;
@@ -695,7 +725,8 @@ static int mixer_ctl_feature_info(struct snd_kcontrol *kcontrol, struct snd_ctl_
                 if (! cval->initialized)
                         get_min_max(cval,  0);
                 uinfo->value.integer.min = 0;
-                uinfo->value.integer.max = (cval->max - cval->min) / cval->res;
+                uinfo->value.integer.max =
+                        (cval->max - cval->min + cval->res - 1) / cval->res;
         }
         return 0;
 }
diff --git a/usr/Makefile b/usr/Makefile
index e2129cb570bb..19d74e6f2685 100644
--- a/usr/Makefile
+++ b/usr/Makefile
@@ -1,65 +1,48 @@
+#
+# kbuild file for usr/ - including initramfs image
+#
 
-obj-y := initramfs_data.o
-
-hostprogs-y  := gen_init_cpio
+klibcdirs:;
 
-clean-files := initramfs_data.cpio.gz initramfs_list
+# Generate builtin.o based on initramfs_data.o
+obj-y := initramfs_data.o
 
 # initramfs_data.o contains the initramfs_data.cpio.gz image.
 # The image is included using .incbin, a dependency which is not
 # tracked automatically.
 $(obj)/initramfs_data.o: $(obj)/initramfs_data.cpio.gz FORCE
 
-ifdef CONFIG_INITRAMFS_ROOT_UID
-gen_initramfs_args += -u $(CONFIG_INITRAMFS_ROOT_UID)
-endif
-
-ifdef CONFIG_INITRAMFS_ROOT_GID
-gen_initramfs_args += -g $(CONFIG_INITRAMFS_ROOT_GID)
-endif
-
-# The $(shell echo $(CONFIG_INITRAMFS_SOURCE)) is to remove the
-# gratuitous begin and end quotes from the Kconfig string type.
-# Internal, escaped quotes in the Kconfig string will loose the
-# escape and become active quotes.
-quotefixed_initramfs_source := $(shell echo $(CONFIG_INITRAMFS_SOURCE))
-
-filechk_initramfs_list = $(CONFIG_SHELL) \
- $(srctree)/scripts/gen_initramfs_list.sh $(gen_initramfs_args) $(quotefixed_initramfs_source)
-
-$(obj)/initramfs_list: $(obj)/Makefile FORCE
-        $(call filechk,initramfs_list)
-
-quiet_cmd_cpio = CPIO    $@
-      cmd_cpio = ./$< $(obj)/initramfs_list > $@
-
-
-# Check if the INITRAMFS_SOURCE is a cpio archive
-ifneq (,$(findstring .cpio,$(quotefixed_initramfs_source)))
-
-# INITRAMFS_SOURCE has a cpio archive - verify that it's a single file
-ifneq (1,$(words $(quotefixed_initramfs_source)))
-$(error Only a single file may be specified in CONFIG_INITRAMFS_SOURCE (="$(quotefixed_initramfs_source)") when a cpio archive is directly specified.)
-endif
-# Now use the cpio archive directly
-initramfs_data_cpio = $(quotefixed_initramfs_source)
-targets += $(quotefixed_initramfs_source)
-
-else
-
-# INITRAMFS_SOURCE is not a cpio archive - create one
-$(obj)/initramfs_data.cpio: $(obj)/gen_init_cpio \
-                            $(initramfs-y) $(obj)/initramfs_list FORCE
-        $(call if_changed,cpio)
-
-targets += initramfs_data.cpio
-initramfs_data_cpio = $(obj)/initramfs_data.cpio
-
+#####
+# Generate the initramfs cpio archive
+
+hostprogs-y := gen_init_cpio
+initramfs   := $(CONFIG_SHELL) $(srctree)/scripts/gen_initramfs_list.sh
+ramfs-input := $(if $(filter-out "",$(CONFIG_INITRAMFS_SOURCE)), \
+                    $(CONFIG_INITRAMFS_SOURCE),-d)
+ramfs-args  := \
+        $(if $(CONFIG_INITRAMFS_ROOT_UID), -u $(CONFIG_INITRAMFS_ROOT_UID)) \
+        $(if $(CONFIG_INITRAMFS_ROOT_GID), -g $(CONFIG_INITRAMFS_ROOT_GID)) \
+        $(ramfs-input)
+
+# .initramfs_data.cpio.gz.d is used to identify all files included
+# in initramfs and to detect if any files are added/removed.
+# Removed files are identified by directory timestamp being updated
+# The dependency list is generated by gen_initramfs.sh -l
+ifneq ($(wildcard $(obj)/.initramfs_data.cpio.gz.d),)
+        include $(obj)/.initramfs_data.cpio.gz.d
 endif
 
-
-$(obj)/initramfs_data.cpio.gz: $(initramfs_data_cpio) FORCE
-        $(call if_changed,gzip)
-
-targets += initramfs_data.cpio.gz
+quiet_cmd_initfs = GEN     $@
+      cmd_initfs = $(initramfs) -o $@ $(ramfs-args) $(ramfs-input)
+
+targets := initramfs_data.cpio.gz
+$(deps_initramfs): klibcdirs
+# We rebuild initramfs_data.cpio.gz if:
+# 1) Any included file is newer then initramfs_data.cpio.gz
+# 2) There are changes in which files are included (added or deleted)
+# 3) If gen_init_cpio are newer than initramfs_data.cpio.gz
+# 4) arguments to gen_initramfs.sh changes
+$(obj)/initramfs_data.cpio.gz: $(obj)/gen_init_cpio $(deps_initramfs) klibcdirs
+        $(Q)$(initramfs) -l $(ramfs-input) > $(obj)/.initramfs_data.cpio.gz.d
+        $(call if_changed,initfs)