154 files changed, 7711 insertions, 1800 deletions

diff --git a/drivers/Kconfig b/drivers/Kconfig
index 3a0e3549739f..80f0ec91e2cf 100644
--- a/drivers/Kconfig
+++ b/drivers/Kconfig
@@ -97,4 +97,6 @@ source "drivers/dca/Kconfig"
 source "drivers/auxdisplay/Kconfig"
 
 source "drivers/uio/Kconfig"
+
+source "drivers/xen/Kconfig"
 endmenu
diff --git a/drivers/block/xen-blkfront.c b/drivers/block/xen-blkfront.c
index 9c6f3f99208d..d771da816d95 100644
--- a/drivers/block/xen-blkfront.c
+++ b/drivers/block/xen-blkfront.c
@@ -47,6 +47,7 @@
 
 #include <xen/interface/grant_table.h>
 #include <xen/interface/io/blkif.h>
+#include <xen/interface/io/protocols.h>
 
 #include <asm/xen/hypervisor.h>
 
@@ -74,7 +75,6 @@ static struct block_device_operations xlvbd_block_fops;
 struct blkfront_info
 {
         struct xenbus_device *xbdev;
-        dev_t dev;
         struct gendisk *gd;
         int vdevice;
         blkif_vdev_t handle;
@@ -88,6 +88,7 @@ struct blkfront_info
         struct blk_shadow shadow[BLK_RING_SIZE];
         unsigned long shadow_free;
         int feature_barrier;
+        int is_ready;
 
         /**
          * The number of people holding this device open.  We won't allow a
@@ -614,6 +615,12 @@ again:
                 message = "writing event-channel";
                 goto abort_transaction;
         }
+        err = xenbus_printf(xbt, dev->nodename, "protocol", "%s",
+                            XEN_IO_PROTO_ABI_NATIVE);
+        if (err) {
+                message = "writing protocol";
+                goto abort_transaction;
+        }
 
         err = xenbus_transaction_end(xbt, 0);
         if (err) {
@@ -833,6 +840,8 @@ static void blkfront_connect(struct blkfront_info *info)
         spin_unlock_irq(&blkif_io_lock);
 
         add_disk(info->gd);
+
+        info->is_ready = 1;
 }
 
 /**
@@ -896,7 +905,7 @@ static void backend_changed(struct xenbus_device *dev,
                 break;
 
         case XenbusStateClosing:
-                bd = bdget(info->dev);
+                bd = bdget_disk(info->gd, 0);
                 if (bd == NULL)
                         xenbus_dev_fatal(dev, -ENODEV, "bdget failed");
 
@@ -925,6 +934,13 @@ static int blkfront_remove(struct xenbus_device *dev)
         return 0;
 }
 
+static int blkfront_is_ready(struct xenbus_device *dev)
+{
+        struct blkfront_info *info = dev->dev.driver_data;
+
+        return info->is_ready;
+}
+
 static int blkif_open(struct inode *inode, struct file *filep)
 {
         struct blkfront_info *info = inode->i_bdev->bd_disk->private_data;
@@ -971,6 +987,7 @@ static struct xenbus_driver blkfront = {
         .remove = blkfront_remove,
         .resume = blkfront_resume,
         .otherend_changed = backend_changed,
+        .is_ready = blkfront_is_ready,
 };
 
 static int __init xlblk_init(void)
@@ -998,3 +1015,5 @@ module_exit(xlblk_exit);
 MODULE_DESCRIPTION("Xen virtual block device frontend");
 MODULE_LICENSE("GPL");
 MODULE_ALIAS_BLOCKDEV_MAJOR(XENVBD_MAJOR);
+MODULE_ALIAS("xen:vbd");
+MODULE_ALIAS("xenblk");
diff --git a/drivers/ieee1394/dv1394.c b/drivers/ieee1394/dv1394.c
index 6228fadacd38..9d19aec5820a 100644
--- a/drivers/ieee1394/dv1394.c
+++ b/drivers/ieee1394/dv1394.c
@@ -2167,6 +2167,7 @@ static const struct file_operations dv1394_fops=
 /*
  * Export information about protocols/devices supported by this driver.
  */
+#ifdef MODULE
 static struct ieee1394_device_id dv1394_id_table[] = {
         {
                 .match_flags    = IEEE1394_MATCH_SPECIFIER_ID | IEEE1394_MATCH_VERSION,
@@ -2177,6 +2178,7 @@ static struct ieee1394_device_id dv1394_id_table[] = {
 };
 
 MODULE_DEVICE_TABLE(ieee1394, dv1394_id_table);
+#endif /* MODULE */
 
 static struct hpsb_protocol_driver dv1394_driver = {
         .name = "dv1394",
diff --git a/drivers/ieee1394/iso.h b/drivers/ieee1394/iso.h
index b94e55e6eaa5..b5de5f21ef78 100644
--- a/drivers/ieee1394/iso.h
+++ b/drivers/ieee1394/iso.h
@@ -123,6 +123,8 @@ struct hpsb_iso {
 
         /* how many times the buffer has overflowed or underflowed */
         atomic_t overflows;
+        /* how many cycles were skipped for a given context */
+        atomic_t skips;
 
         /* Current number of bytes lost in discarded packets */
         int bytes_discarded;
diff --git a/drivers/ieee1394/ohci1394.c b/drivers/ieee1394/ohci1394.c
index 0690469fcecf..e509e13cb7a7 100644
--- a/drivers/ieee1394/ohci1394.c
+++ b/drivers/ieee1394/ohci1394.c
@@ -1723,6 +1723,8 @@ struct ohci_iso_xmit {
         struct dma_prog_region prog;
         struct ohci1394_iso_tasklet task;
         int task_active;
+        int last_cycle;
+        atomic_t skips;
 
         u32 ContextControlSet;
         u32 ContextControlClear;
@@ -1759,6 +1761,8 @@ static int ohci_iso_xmit_init(struct hpsb_iso *iso)
         iso->hostdata = xmit;
         xmit->ohci = iso->host->hostdata;
         xmit->task_active = 0;
+        xmit->last_cycle = -1;
+        atomic_set(&iso->skips, 0);
 
         dma_prog_region_init(&xmit->prog);
 
@@ -1856,6 +1860,26 @@ static void ohci_iso_xmit_task(unsigned long data)
                 /* parse cycle */
                 cycle = le32_to_cpu(cmd->output_last.status) & 0x1FFF;
 
+                if (xmit->last_cycle > -1) {
+                        int cycle_diff = cycle - xmit->last_cycle;
+                        int skip;
+
+                        /* unwrap */
+                        if (cycle_diff < 0) {
+                                cycle_diff += 8000;
+                                if (cycle_diff < 0)
+                                        PRINT(KERN_ERR, "bogus cycle diff %d\n",
+                                              cycle_diff);
+                        }
+
+                        skip = cycle_diff - 1;
+                        if (skip > 0) {
+                                DBGMSG("skipped %d cycles without packet loss", skip);
+                                atomic_add(skip, &iso->skips);
+                        }
+                }
+                xmit->last_cycle = cycle;
+
                 /* tell the subsystem the packet has gone out */
                 hpsb_iso_packet_sent(iso, cycle, event != 0x11);
 
@@ -1943,6 +1967,16 @@ static int ohci_iso_xmit_queue(struct hpsb_iso *iso, struct hpsb_iso_packet_info
         prev->output_last.branchAddress = cpu_to_le32(
                 dma_prog_region_offset_to_bus(&xmit->prog, sizeof(struct iso_xmit_cmd) * next_i) | 3);
 
+        /*
+         * Link the skip address to this descriptor itself. This causes a
+         * context to skip a cycle whenever lost cycles or FIFO overruns occur,
+         * without dropping the data at that point the application should then
+         * decide whether this is an error condition or not. Some protocols
+         * can deal with this by dropping some rate-matching padding packets.
+         */
+        next->output_more_immediate.branchAddress =
+                        prev->output_last.branchAddress;
+
         /* disable interrupt, unless required by the IRQ interval */
         if (prev_i % iso->irq_interval) {
                 prev->output_last.control &= cpu_to_le32(~(3 << 20)); /* no interrupt */
diff --git a/drivers/ieee1394/raw1394.c b/drivers/ieee1394/raw1394.c
index 04e96ba56e09..ec2a0adbedb2 100644
--- a/drivers/ieee1394/raw1394.c
+++ b/drivers/ieee1394/raw1394.c
@@ -2356,13 +2356,16 @@ static void rawiso_activity_cb(struct hpsb_iso *iso)
 static void raw1394_iso_fill_status(struct hpsb_iso *iso,
                                     struct raw1394_iso_status *stat)
 {
+        int overflows = atomic_read(&iso->overflows);
+        int skips = atomic_read(&iso->skips);
+
         stat->config.data_buf_size = iso->buf_size;
         stat->config.buf_packets = iso->buf_packets;
         stat->config.channel = iso->channel;
         stat->config.speed = iso->speed;
         stat->config.irq_interval = iso->irq_interval;
         stat->n_packets = hpsb_iso_n_ready(iso);
-        stat->overflows = atomic_read(&iso->overflows);
+        stat->overflows = ((skips & 0xFFFF) << 16) | ((overflows & 0xFFFF));
         stat->xmit_cycle = iso->xmit_cycle;
 }
 
@@ -2437,6 +2440,8 @@ static int raw1394_iso_get_status(struct file_info *fi, void __user * uaddr)
 
         /* reset overflow counter */
         atomic_set(&iso->overflows, 0);
+        /* reset skip counter */
+        atomic_set(&iso->skips, 0);
 
         return 0;
 }
@@ -2935,6 +2940,7 @@ static int raw1394_release(struct inode *inode, struct file *file)
 /*
  * Export information about protocols/devices supported by this driver.
  */
+#ifdef MODULE
 static struct ieee1394_device_id raw1394_id_table[] = {
         {
          .match_flags = IEEE1394_MATCH_SPECIFIER_ID | IEEE1394_MATCH_VERSION,
@@ -2956,6 +2962,7 @@ static struct ieee1394_device_id raw1394_id_table[] = {
 };
 
 MODULE_DEVICE_TABLE(ieee1394, raw1394_id_table);
+#endif /* MODULE */
 
 static struct hpsb_protocol_driver raw1394_driver = {
         .name = "raw1394",
diff --git a/drivers/ieee1394/video1394.c b/drivers/ieee1394/video1394.c
index e03024eeeac1..e24772d336e1 100644
--- a/drivers/ieee1394/video1394.c
+++ b/drivers/ieee1394/video1394.c
@@ -1293,6 +1293,7 @@ static const struct file_operations video1394_fops=
 /*
  * Export information about protocols/devices supported by this driver.
  */
+#ifdef MODULE
 static struct ieee1394_device_id video1394_id_table[] = {
         {
                 .match_flags    = IEEE1394_MATCH_SPECIFIER_ID | IEEE1394_MATCH_VERSION,
@@ -1313,6 +1314,7 @@ static struct ieee1394_device_id video1394_id_table[] = {
 };
 
 MODULE_DEVICE_TABLE(ieee1394, video1394_id_table);
+#endif /* MODULE */
 
 static struct hpsb_protocol_driver video1394_driver = {
         .name = VIDEO1394_DRIVER_NAME,
diff --git a/drivers/input/Kconfig b/drivers/input/Kconfig
index 9dea14db724c..5f9d860925a1 100644
--- a/drivers/input/Kconfig
+++ b/drivers/input/Kconfig
@@ -149,6 +149,15 @@ config INPUT_APMPOWER
           To compile this driver as a module, choose M here: the
           module will be called apm-power.
 
+config XEN_KBDDEV_FRONTEND
+        tristate "Xen virtual keyboard and mouse support"
+        depends on XEN_FBDEV_FRONTEND
+        default y
+        help
+          This driver implements the front-end of the Xen virtual
+          keyboard and mouse device driver.  It communicates with a back-end
+          in another domain.
+
 comment "Input Device Drivers"
 
 source "drivers/input/keyboard/Kconfig"
diff --git a/drivers/input/Makefile b/drivers/input/Makefile
index 2ae87b19caa8..98c4f9a77876 100644
--- a/drivers/input/Makefile
+++ b/drivers/input/Makefile
@@ -23,3 +23,5 @@ obj-$(CONFIG_INPUT_TOUCHSCREEN)	+= touchscreen/
 obj-$(CONFIG_INPUT_MISC)        += misc/
 
 obj-$(CONFIG_INPUT_APMPOWER)    += apm-power.o
+
+obj-$(CONFIG_XEN_KBDDEV_FRONTEND)       += xen-kbdfront.o
diff --git a/drivers/input/xen-kbdfront.c b/drivers/input/xen-kbdfront.c
new file mode 100644
index 000000000000..0f47f4697cdf
--- /dev/null
+++ b/drivers/input/xen-kbdfront.c
@@ -0,0 +1,340 @@
+/*
+ * Xen para-virtual input device
+ *
+ * Copyright (C) 2005 Anthony Liguori <aliguori@us.ibm.com>
+ * Copyright (C) 2006-2008 Red Hat, Inc., Markus Armbruster <armbru@redhat.com>
+ *
+ *  Based on linux/drivers/input/mouse/sermouse.c
+ *
+ *  This file is subject to the terms and conditions of the GNU General Public
+ *  License. See the file COPYING in the main directory of this archive for
+ *  more details.
+ */
+
+/*
+ * TODO:
+ *
+ * Switch to grant tables together with xen-fbfront.c.
+ */
+
+#include <linux/kernel.h>
+#include <linux/errno.h>
+#include <linux/module.h>
+#include <linux/input.h>
+#include <asm/xen/hypervisor.h>
+#include <xen/events.h>
+#include <xen/page.h>
+#include <xen/interface/io/fbif.h>
+#include <xen/interface/io/kbdif.h>
+#include <xen/xenbus.h>
+
+struct xenkbd_info {
+        struct input_dev *kbd;
+        struct input_dev *ptr;
+        struct xenkbd_page *page;
+        int irq;
+        struct xenbus_device *xbdev;
+        char phys[32];
+};
+
+static int xenkbd_remove(struct xenbus_device *);
+static int xenkbd_connect_backend(struct xenbus_device *, struct xenkbd_info *);
+static void xenkbd_disconnect_backend(struct xenkbd_info *);
+
+/*
+ * Note: if you need to send out events, see xenfb_do_update() for how
+ * to do that.
+ */
+
+static irqreturn_t input_handler(int rq, void *dev_id)
+{
+        struct xenkbd_info *info = dev_id;
+        struct xenkbd_page *page = info->page;
+        __u32 cons, prod;
+
+        prod = page->in_prod;
+        if (prod == page->in_cons)
+                return IRQ_HANDLED;
+        rmb();                  /* ensure we see ring contents up to prod */
+        for (cons = page->in_cons; cons != prod; cons++) {
+                union xenkbd_in_event *event;
+                struct input_dev *dev;
+                event = &XENKBD_IN_RING_REF(page, cons);
+
+                dev = info->ptr;
+                switch (event->type) {
+                case XENKBD_TYPE_MOTION:
+                        input_report_rel(dev, REL_X, event->motion.rel_x);
+                        input_report_rel(dev, REL_Y, event->motion.rel_y);
+                        break;
+                case XENKBD_TYPE_KEY:
+                        dev = NULL;
+                        if (test_bit(event->key.keycode, info->kbd->keybit))
+                                dev = info->kbd;
+                        if (test_bit(event->key.keycode, info->ptr->keybit))
+                                dev = info->ptr;
+                        if (dev)
+                                input_report_key(dev, event->key.keycode,
+                                                 event->key.pressed);
+                        else
+                                printk(KERN_WARNING
+                                       "xenkbd: unhandled keycode 0x%x\n",
+                                       event->key.keycode);
+                        break;
+                case XENKBD_TYPE_POS:
+                        input_report_abs(dev, ABS_X, event->pos.abs_x);
+                        input_report_abs(dev, ABS_Y, event->pos.abs_y);
+                        break;
+                }
+                if (dev)
+                        input_sync(dev);
+        }
+        mb();                   /* ensure we got ring contents */
+        page->in_cons = cons;
+        notify_remote_via_irq(info->irq);
+
+        return IRQ_HANDLED;
+}
+
+static int __devinit xenkbd_probe(struct xenbus_device *dev,
+                                  const struct xenbus_device_id *id)
+{
+        int ret, i;
+        struct xenkbd_info *info;
+        struct input_dev *kbd, *ptr;
+
+        info = kzalloc(sizeof(*info), GFP_KERNEL);
+        if (!info) {
+                xenbus_dev_fatal(dev, -ENOMEM, "allocating info structure");
+                return -ENOMEM;
+        }
+        dev->dev.driver_data = info;
+        info->xbdev = dev;
+        info->irq = -1;
+        snprintf(info->phys, sizeof(info->phys), "xenbus/%s", dev->nodename);
+
+        info->page = (void *)__get_free_page(GFP_KERNEL | __GFP_ZERO);
+        if (!info->page)
+                goto error_nomem;
+
+        /* keyboard */
+        kbd = input_allocate_device();
+        if (!kbd)
+                goto error_nomem;
+        kbd->name = "Xen Virtual Keyboard";
+        kbd->phys = info->phys;
+        kbd->id.bustype = BUS_PCI;
+        kbd->id.vendor = 0x5853;
+        kbd->id.product = 0xffff;
+        kbd->evbit[0] = BIT(EV_KEY);
+        for (i = KEY_ESC; i < KEY_UNKNOWN; i++)
+                set_bit(i, kbd->keybit);
+        for (i = KEY_OK; i < KEY_MAX; i++)
+                set_bit(i, kbd->keybit);
+
+        ret = input_register_device(kbd);
+        if (ret) {
+                input_free_device(kbd);
+                xenbus_dev_fatal(dev, ret, "input_register_device(kbd)");
+                goto error;
+        }
+        info->kbd = kbd;
+
+        /* pointing device */
+        ptr = input_allocate_device();
+        if (!ptr)
+                goto error_nomem;
+        ptr->name = "Xen Virtual Pointer";
+        ptr->phys = info->phys;
+        ptr->id.bustype = BUS_PCI;
+        ptr->id.vendor = 0x5853;
+        ptr->id.product = 0xfffe;
+        ptr->evbit[0] = BIT(EV_KEY) | BIT(EV_REL) | BIT(EV_ABS);
+        for (i = BTN_LEFT; i <= BTN_TASK; i++)
+                set_bit(i, ptr->keybit);
+        ptr->relbit[0] = BIT(REL_X) | BIT(REL_Y);
+        input_set_abs_params(ptr, ABS_X, 0, XENFB_WIDTH, 0, 0);
+        input_set_abs_params(ptr, ABS_Y, 0, XENFB_HEIGHT, 0, 0);
+
+        ret = input_register_device(ptr);
+        if (ret) {
+                input_free_device(ptr);
+                xenbus_dev_fatal(dev, ret, "input_register_device(ptr)");
+                goto error;
+        }
+        info->ptr = ptr;
+
+        ret = xenkbd_connect_backend(dev, info);
+        if (ret < 0)
+                goto error;
+
+        return 0;
+
+ error_nomem:
+        ret = -ENOMEM;
+        xenbus_dev_fatal(dev, ret, "allocating device memory");
+ error:
+        xenkbd_remove(dev);
+        return ret;
+}
+
+static int xenkbd_resume(struct xenbus_device *dev)
+{
+        struct xenkbd_info *info = dev->dev.driver_data;
+
+        xenkbd_disconnect_backend(info);
+        memset(info->page, 0, PAGE_SIZE);
+        return xenkbd_connect_backend(dev, info);
+}
+
+static int xenkbd_remove(struct xenbus_device *dev)
+{
+        struct xenkbd_info *info = dev->dev.driver_data;
+
+        xenkbd_disconnect_backend(info);
+        if (info->kbd)
+                input_unregister_device(info->kbd);
+        if (info->ptr)
+                input_unregister_device(info->ptr);
+        free_page((unsigned long)info->page);
+        kfree(info);
+        return 0;
+}
+
+static int xenkbd_connect_backend(struct xenbus_device *dev,
+                                  struct xenkbd_info *info)
+{
+        int ret, evtchn;
+        struct xenbus_transaction xbt;
+
+        ret = xenbus_alloc_evtchn(dev, &evtchn);
+        if (ret)
+                return ret;
+        ret = bind_evtchn_to_irqhandler(evtchn, input_handler,
+                                        0, dev->devicetype, info);
+        if (ret < 0) {
+                xenbus_free_evtchn(dev, evtchn);
+                xenbus_dev_fatal(dev, ret, "bind_evtchn_to_irqhandler");
+                return ret;
+        }
+        info->irq = ret;
+
+ again:
+        ret = xenbus_transaction_start(&xbt);
+        if (ret) {
+                xenbus_dev_fatal(dev, ret, "starting transaction");
+                return ret;
+        }
+        ret = xenbus_printf(xbt, dev->nodename, "page-ref", "%lu",
+                            virt_to_mfn(info->page));
+        if (ret)
+                goto error_xenbus;
+        ret = xenbus_printf(xbt, dev->nodename, "event-channel", "%u",
+                            evtchn);
+        if (ret)
+                goto error_xenbus;
+        ret = xenbus_transaction_end(xbt, 0);
+        if (ret) {
+                if (ret == -EAGAIN)
+                        goto again;
+                xenbus_dev_fatal(dev, ret, "completing transaction");
+                return ret;
+        }
+
+        xenbus_switch_state(dev, XenbusStateInitialised);
+        return 0;
+
+ error_xenbus:
+        xenbus_transaction_end(xbt, 1);
+        xenbus_dev_fatal(dev, ret, "writing xenstore");
+        return ret;
+}
+
+static void xenkbd_disconnect_backend(struct xenkbd_info *info)
+{
+        if (info->irq >= 0)
+                unbind_from_irqhandler(info->irq, info);
+        info->irq = -1;
+}
+
+static void xenkbd_backend_changed(struct xenbus_device *dev,
+                                   enum xenbus_state backend_state)
+{
+        struct xenkbd_info *info = dev->dev.driver_data;
+        int ret, val;
+
+        switch (backend_state) {
+        case XenbusStateInitialising:
+        case XenbusStateInitialised:
+        case XenbusStateUnknown:
+        case XenbusStateClosed:
+                break;
+
+        case XenbusStateInitWait:
+InitWait:
+                ret = xenbus_scanf(XBT_NIL, info->xbdev->otherend,
+                                   "feature-abs-pointer", "%d", &val);
+                if (ret < 0)
+                        val = 0;
+                if (val) {
+                        ret = xenbus_printf(XBT_NIL, info->xbdev->nodename,
+                                            "request-abs-pointer", "1");
+                        if (ret)
+                                printk(KERN_WARNING
+                                       "xenkbd: can't request abs-pointer");
+                }
+                xenbus_switch_state(dev, XenbusStateConnected);
+                break;
+
+        case XenbusStateConnected:
+                /*
+                 * Work around xenbus race condition: If backend goes
+                 * through InitWait to Connected fast enough, we can
+                 * get Connected twice here.
+                 */
+                if (dev->state != XenbusStateConnected)
+                        goto InitWait; /* no InitWait seen yet, fudge it */
+                break;
+
+        case XenbusStateClosing:
+                xenbus_frontend_closed(dev);
+                break;
+        }
+}
+
+static struct xenbus_device_id xenkbd_ids[] = {
+        { "vkbd" },
+        { "" }
+};
+
+static struct xenbus_driver xenkbd = {
+        .name = "vkbd",
+        .owner = THIS_MODULE,
+        .ids = xenkbd_ids,
+        .probe = xenkbd_probe,
+        .remove = xenkbd_remove,
+        .resume = xenkbd_resume,
+        .otherend_changed = xenkbd_backend_changed,
+};
+
+static int __init xenkbd_init(void)
+{
+        if (!is_running_on_xen())
+                return -ENODEV;
+
+        /* Nothing to do if running in dom0. */
+        if (is_initial_xendomain())
+                return -ENODEV;
+
+        return xenbus_register_frontend(&xenkbd);
+}
+
+static void __exit xenkbd_cleanup(void)
+{
+        xenbus_unregister_driver(&xenkbd);
+}
+
+module_init(xenkbd_init);
+module_exit(xenkbd_cleanup);
+
+MODULE_LICENSE("GPL");
diff --git a/drivers/md/Makefile b/drivers/md/Makefile
index d9aa7edb8780..7be09eeea293 100644
--- a/drivers/md/Makefile
+++ b/drivers/md/Makefile
@@ -3,10 +3,10 @@
 #
 
 dm-mod-objs     := dm.o dm-table.o dm-target.o dm-linear.o dm-stripe.o \
-                   dm-ioctl.o dm-io.o kcopyd.o
+                   dm-ioctl.o dm-io.o dm-kcopyd.o
 dm-multipath-objs := dm-hw-handler.o dm-path-selector.o dm-mpath.o
 dm-snapshot-objs := dm-snap.o dm-exception-store.o
-dm-mirror-objs  := dm-log.o dm-raid1.o
+dm-mirror-objs  := dm-raid1.o
 dm-rdac-objs    := dm-mpath-rdac.o
 dm-hp-sw-objs   := dm-mpath-hp-sw.o
 md-mod-objs     := md.o bitmap.o
@@ -39,7 +39,7 @@ obj-$(CONFIG_DM_MULTIPATH_EMC)	+= dm-emc.o
 obj-$(CONFIG_DM_MULTIPATH_HP)   += dm-hp-sw.o
 obj-$(CONFIG_DM_MULTIPATH_RDAC) += dm-rdac.o
 obj-$(CONFIG_DM_SNAPSHOT)       += dm-snapshot.o
-obj-$(CONFIG_DM_MIRROR)         += dm-mirror.o
+obj-$(CONFIG_DM_MIRROR)         += dm-mirror.o dm-log.o
 obj-$(CONFIG_DM_ZERO)           += dm-zero.o
 
 quiet_cmd_unroll = UNROLL  $@
diff --git a/drivers/md/dm-exception-store.c b/drivers/md/dm-exception-store.c
index 5bbce29f143a..41f408068a7c 100644
--- a/drivers/md/dm-exception-store.c
+++ b/drivers/md/dm-exception-store.c
@@ -9,13 +9,13 @@
 
 #include "dm.h"
 #include "dm-snap.h"
-#include "dm-io.h"
-#include "kcopyd.h"
 
 #include <linux/mm.h>
 #include <linux/pagemap.h>
 #include <linux/vmalloc.h>
 #include <linux/slab.h>
+#include <linux/dm-io.h>
+#include <linux/dm-kcopyd.h>
 
 #define DM_MSG_PREFIX "snapshots"
 #define DM_CHUNK_SIZE_DEFAULT_SECTORS 32        /* 16KB */
@@ -131,7 +131,7 @@ struct pstore {
 
 static unsigned sectors_to_pages(unsigned sectors)
 {
-        return sectors / (PAGE_SIZE >> 9);
+        return DIV_ROUND_UP(sectors, PAGE_SIZE >> 9);
 }
 
 static int alloc_area(struct pstore *ps)
@@ -159,7 +159,7 @@ static void free_area(struct pstore *ps)
 }
 
 struct mdata_req {
-        struct io_region *where;
+        struct dm_io_region *where;
         struct dm_io_request *io_req;
         struct work_struct work;
         int result;
@@ -177,7 +177,7 @@ static void do_metadata(struct work_struct *work)
  */
 static int chunk_io(struct pstore *ps, uint32_t chunk, int rw, int metadata)
 {
-        struct io_region where = {
+        struct dm_io_region where = {
                 .bdev = ps->snap->cow->bdev,
                 .sector = ps->snap->chunk_size * chunk,
                 .count = ps->snap->chunk_size,
diff --git a/drivers/md/dm-io.c b/drivers/md/dm-io.c
index 8f25f628ef16..4789c42d9a3a 100644
--- a/drivers/md/dm-io.c
+++ b/drivers/md/dm-io.c
@@ -5,13 +5,14 @@
  * This file is released under the GPL.
  */
 
-#include "dm-io.h"
+#include "dm.h"
 
 #include <linux/bio.h>
 #include <linux/mempool.h>
 #include <linux/module.h>
 #include <linux/sched.h>
 #include <linux/slab.h>
+#include <linux/dm-io.h>
 
 struct dm_io_client {
         mempool_t *pool;
@@ -20,7 +21,7 @@ struct dm_io_client {
 
 /* FIXME: can we shrink this ? */
 struct io {
-        unsigned long error;
+        unsigned long error_bits;
         atomic_t count;
         struct task_struct *sleeper;
         struct dm_io_client *client;
@@ -107,14 +108,14 @@ static inline unsigned bio_get_region(struct bio *bio)
 static void dec_count(struct io *io, unsigned int region, int error)
 {
         if (error)
-                set_bit(region, &io->error);
+                set_bit(region, &io->error_bits);
 
         if (atomic_dec_and_test(&io->count)) {
                 if (io->sleeper)
                         wake_up_process(io->sleeper);
 
                 else {
-                        unsigned long r = io->error;
+                        unsigned long r = io->error_bits;
                         io_notify_fn fn = io->callback;
                         void *context = io->context;
 
@@ -271,7 +272,7 @@ static void km_dp_init(struct dpages *dp, void *data)
 /*-----------------------------------------------------------------
  * IO routines that accept a list of pages.
  *---------------------------------------------------------------*/
-static void do_region(int rw, unsigned int region, struct io_region *where,
+static void do_region(int rw, unsigned region, struct dm_io_region *where,
                       struct dpages *dp, struct io *io)
 {
         struct bio *bio;
@@ -320,7 +321,7 @@ static void do_region(int rw, unsigned int region, struct io_region *where,
 }
 
 static void dispatch_io(int rw, unsigned int num_regions,
-                        struct io_region *where, struct dpages *dp,
+                        struct dm_io_region *where, struct dpages *dp,
                         struct io *io, int sync)
 {
         int i;
@@ -347,17 +348,17 @@ static void dispatch_io(int rw, unsigned int num_regions,
 }
 
 static int sync_io(struct dm_io_client *client, unsigned int num_regions,
-                   struct io_region *where, int rw, struct dpages *dp,
+                   struct dm_io_region *where, int rw, struct dpages *dp,
                    unsigned long *error_bits)
 {
         struct io io;
 
-        if (num_regions > 1 && rw != WRITE) {
+        if (num_regions > 1 && (rw & RW_MASK) != WRITE) {
                 WARN_ON(1);
                 return -EIO;
         }
 
-        io.error = 0;
+        io.error_bits = 0;
         atomic_set(&io.count, 1); /* see dispatch_io() */
         io.sleeper = current;
         io.client = client;
@@ -378,25 +379,25 @@ static int sync_io(struct dm_io_client *client, unsigned int num_regions,
                 return -EINTR;
 
         if (error_bits)
-                *error_bits = io.error;
+                *error_bits = io.error_bits;
 
-        return io.error ? -EIO : 0;
+        return io.error_bits ? -EIO : 0;
 }
 
 static int async_io(struct dm_io_client *client, unsigned int num_regions,
-                    struct io_region *where, int rw, struct dpages *dp,
+                    struct dm_io_region *where, int rw, struct dpages *dp,
                     io_notify_fn fn, void *context)
 {
         struct io *io;
 
-        if (num_regions > 1 && rw != WRITE) {
+        if (num_regions > 1 && (rw & RW_MASK) != WRITE) {
                 WARN_ON(1);
                 fn(1, context);
                 return -EIO;
         }
 
         io = mempool_alloc(client->pool, GFP_NOIO);
-        io->error = 0;
+        io->error_bits = 0;
         atomic_set(&io->count, 1); /* see dispatch_io() */
         io->sleeper = NULL;
         io->client = client;
@@ -435,10 +436,15 @@ static int dp_init(struct dm_io_request *io_req, struct dpages *dp)
 }
 
 /*
- * New collapsed (a)synchronous interface
+ * New collapsed (a)synchronous interface.
+ *
+ * If the IO is asynchronous (i.e. it has notify.fn), you must either unplug
+ * the queue with blk_unplug() some time later or set the BIO_RW_SYNC bit in
+ * io_req->bi_rw. If you fail to do one of these, the IO will be submitted to
+ * the disk after q->unplug_delay, which defaults to 3ms in blk-settings.c.
  */
 int dm_io(struct dm_io_request *io_req, unsigned num_regions,
-          struct io_region *where, unsigned long *sync_error_bits)
+          struct dm_io_region *where, unsigned long *sync_error_bits)
 {
         int r;
         struct dpages dp;
diff --git a/drivers/md/dm-io.h b/drivers/md/dm-io.h
deleted file mode 100644
index f647e2cceaa6..000000000000
--- a/drivers/md/dm-io.h
+++ /dev/null
@@ -1,79 +0,0 @@
-/*
- * Copyright (C) 2003 Sistina Software
- *
- * This file is released under the GPL.
- */
-
-#ifndef _DM_IO_H
-#define _DM_IO_H
-
-#include "dm.h"
-
-struct io_region {
-        struct block_device *bdev;
-        sector_t sector;
-        sector_t count;         /* If this is zero the region is ignored. */
-};
-
-struct page_list {
-        struct page_list *next;
-        struct page *page;
-};
-
-typedef void (*io_notify_fn)(unsigned long error, void *context);
-
-enum dm_io_mem_type {
-        DM_IO_PAGE_LIST,/* Page list */
-        DM_IO_BVEC,     /* Bio vector */
-        DM_IO_VMA,      /* Virtual memory area */
-        DM_IO_KMEM,     /* Kernel memory */
-};
-
-struct dm_io_memory {
-        enum dm_io_mem_type type;
-
-        union {
-                struct page_list *pl;
-                struct bio_vec *bvec;
-                void *vma;
-                void *addr;
-        } ptr;
-
-        unsigned offset;
-};
-
-struct dm_io_notify {
-        io_notify_fn fn;        /* Callback for asynchronous requests */
-        void *context;          /* Passed to callback */
-};
-
-/*
- * IO request structure
- */
-struct dm_io_client;
-struct dm_io_request {
-        int bi_rw;                      /* READ|WRITE - not READA */
-        struct dm_io_memory mem;        /* Memory to use for io */
-        struct dm_io_notify notify;     /* Synchronous if notify.fn is NULL */
-        struct dm_io_client *client;    /* Client memory handler */
-};
-
-/*
- * For async io calls, users can alternatively use the dm_io() function below
- * and dm_io_client_create() to create private mempools for the client.
- *
- * Create/destroy may block.
- */
-struct dm_io_client *dm_io_client_create(unsigned num_pages);
-int dm_io_client_resize(unsigned num_pages, struct dm_io_client *client);
-void dm_io_client_destroy(struct dm_io_client *client);
-
-/*
- * IO interface using private per-client pools.
- * Each bit in the optional 'sync_error_bits' bitset indicates whether an
- * error occurred doing io to the corresponding region.
- */
-int dm_io(struct dm_io_request *io_req, unsigned num_regions,
-          struct io_region *region, unsigned long *sync_error_bits);
-
-#endif
diff --git a/drivers/md/kcopyd.c b/drivers/md/dm-kcopyd.c
index e76b52ade690..996802b8a452 100644
--- a/drivers/md/kcopyd.c
+++ b/drivers/md/dm-kcopyd.c
@@ -9,9 +9,8 @@
  * completion notification.
  */
 
-#include <asm/types.h>
+#include <linux/types.h>
 #include <asm/atomic.h>
-
 #include <linux/blkdev.h>
 #include <linux/fs.h>
 #include <linux/init.h>
@@ -23,24 +22,15 @@
 #include <linux/vmalloc.h>
 #include <linux/workqueue.h>
 #include <linux/mutex.h>
+#include <linux/dm-kcopyd.h>
 
-#include "kcopyd.h"
-
-static struct workqueue_struct *_kcopyd_wq;
-static struct work_struct _kcopyd_work;
-
-static void wake(void)
-{
-        queue_work(_kcopyd_wq, &_kcopyd_work);
-}
+#include "dm.h"
 
 /*-----------------------------------------------------------------
  * Each kcopyd client has its own little pool of preallocated
  * pages for kcopyd io.
  *---------------------------------------------------------------*/
-struct kcopyd_client {
-        struct list_head list;
-
+struct dm_kcopyd_client {
         spinlock_t lock;
         struct page_list *pages;
         unsigned int nr_pages;
@@ -50,8 +40,32 @@ struct kcopyd_client {
 
         wait_queue_head_t destroyq;
         atomic_t nr_jobs;
+
+        mempool_t *job_pool;
+
+        struct workqueue_struct *kcopyd_wq;
+        struct work_struct kcopyd_work;
+
+/*
+ * We maintain three lists of jobs:
+ *
+ * i)   jobs waiting for pages
+ * ii)  jobs that have pages, and are waiting for the io to be issued.
+ * iii) jobs that have completed.
+ *
+ * All three of these are protected by job_lock.
+ */
+        spinlock_t job_lock;
+        struct list_head complete_jobs;
+        struct list_head io_jobs;
+        struct list_head pages_jobs;
 };
 
+static void wake(struct dm_kcopyd_client *kc)
+{
+        queue_work(kc->kcopyd_wq, &kc->kcopyd_work);
+}
+
 static struct page_list *alloc_pl(void)
 {
         struct page_list *pl;
@@ -75,7 +89,7 @@ static void free_pl(struct page_list *pl)
         kfree(pl);
 }
 
-static int kcopyd_get_pages(struct kcopyd_client *kc,
+static int kcopyd_get_pages(struct dm_kcopyd_client *kc,
                             unsigned int nr, struct page_list **pages)
 {
         struct page_list *pl;
@@ -98,7 +112,7 @@ static int kcopyd_get_pages(struct kcopyd_client *kc,
         return 0;
 }
 
-static void kcopyd_put_pages(struct kcopyd_client *kc, struct page_list *pl)
+static void kcopyd_put_pages(struct dm_kcopyd_client *kc, struct page_list *pl)
 {
         struct page_list *cursor;
 
@@ -126,7 +140,7 @@ static void drop_pages(struct page_list *pl)
         }
 }
 
-static int client_alloc_pages(struct kcopyd_client *kc, unsigned int nr)
+static int client_alloc_pages(struct dm_kcopyd_client *kc, unsigned int nr)
 {
         unsigned int i;
         struct page_list *pl = NULL, *next;
@@ -147,7 +161,7 @@ static int client_alloc_pages(struct kcopyd_client *kc, unsigned int nr)
         return 0;
 }
 
-static void client_free_pages(struct kcopyd_client *kc)
+static void client_free_pages(struct dm_kcopyd_client *kc)
 {
         BUG_ON(kc->nr_free_pages != kc->nr_pages);
         drop_pages(kc->pages);
@@ -161,7 +175,7 @@ static void client_free_pages(struct kcopyd_client *kc)
  * ever having to do io (which could cause a deadlock).
  *---------------------------------------------------------------*/
 struct kcopyd_job {
-        struct kcopyd_client *kc;
+        struct dm_kcopyd_client *kc;
         struct list_head list;
         unsigned long flags;
 
@@ -175,13 +189,13 @@ struct kcopyd_job {
          * Either READ or WRITE
          */
         int rw;
-        struct io_region source;
+        struct dm_io_region source;
 
         /*
          * The destinations for the transfer.
          */
         unsigned int num_dests;
-        struct io_region dests[KCOPYD_MAX_REGIONS];
+        struct dm_io_region dests[DM_KCOPYD_MAX_REGIONS];
 
         sector_t offset;
         unsigned int nr_pages;
@@ -191,7 +205,7 @@ struct kcopyd_job {
          * Set this to ensure you are notified when the job has
          * completed.  'context' is for callback to use.
          */
-        kcopyd_notify_fn fn;
+        dm_kcopyd_notify_fn fn;
         void *context;
 
         /*
@@ -207,47 +221,19 @@ struct kcopyd_job {
 #define MIN_JOBS 512
 
 static struct kmem_cache *_job_cache;
-static mempool_t *_job_pool;
 
-/*
- * We maintain three lists of jobs:
- *
- * i)   jobs waiting for pages
- * ii)  jobs that have pages, and are waiting for the io to be issued.
- * iii) jobs that have completed.
- *
- * All three of these are protected by job_lock.
- */
-static DEFINE_SPINLOCK(_job_lock);
-
-static LIST_HEAD(_complete_jobs);
-static LIST_HEAD(_io_jobs);
-static LIST_HEAD(_pages_jobs);
-
-static int jobs_init(void)
+int __init dm_kcopyd_init(void)
 {
         _job_cache = KMEM_CACHE(kcopyd_job, 0);
         if (!_job_cache)
                 return -ENOMEM;
 
-        _job_pool = mempool_create_slab_pool(MIN_JOBS, _job_cache);
-        if (!_job_pool) {
-                kmem_cache_destroy(_job_cache);
-                return -ENOMEM;
-        }
-
         return 0;
 }
 
-static void jobs_exit(void)
+void dm_kcopyd_exit(void)
 {
-        BUG_ON(!list_empty(&_complete_jobs));
-        BUG_ON(!list_empty(&_io_jobs));
-        BUG_ON(!list_empty(&_pages_jobs));
-
-        mempool_destroy(_job_pool);
         kmem_cache_destroy(_job_cache);
-        _job_pool = NULL;
         _job_cache = NULL;
 }
 
@@ -255,18 +241,19 @@ static void jobs_exit(void)
  * Functions to push and pop a job onto the head of a given job
  * list.
  */
-static struct kcopyd_job *pop(struct list_head *jobs)
+static struct kcopyd_job *pop(struct list_head *jobs,
+                              struct dm_kcopyd_client *kc)
 {
         struct kcopyd_job *job = NULL;
         unsigned long flags;
 
-        spin_lock_irqsave(&_job_lock, flags);
+        spin_lock_irqsave(&kc->job_lock, flags);
 
         if (!list_empty(jobs)) {
                 job = list_entry(jobs->next, struct kcopyd_job, list);
                 list_del(&job->list);
         }
-        spin_unlock_irqrestore(&_job_lock, flags);
+        spin_unlock_irqrestore(&kc->job_lock, flags);
 
         return job;
 }
@@ -274,10 +261,11 @@ static struct kcopyd_job *pop(struct list_head *jobs)
 static void push(struct list_head *jobs, struct kcopyd_job *job)
 {
         unsigned long flags;
+        struct dm_kcopyd_client *kc = job->kc;
 
-        spin_lock_irqsave(&_job_lock, flags);
+        spin_lock_irqsave(&kc->job_lock, flags);
         list_add_tail(&job->list, jobs);
-        spin_unlock_irqrestore(&_job_lock, flags);
+        spin_unlock_irqrestore(&kc->job_lock, flags);
 }
 
 /*
@@ -294,11 +282,11 @@ static int run_complete_job(struct kcopyd_job *job)
         void *context = job->context;
         int read_err = job->read_err;
         unsigned long write_err = job->write_err;
-        kcopyd_notify_fn fn = job->fn;
-        struct kcopyd_client *kc = job->kc;
+        dm_kcopyd_notify_fn fn = job->fn;
+        struct dm_kcopyd_client *kc = job->kc;
 
         kcopyd_put_pages(kc, job->pages);
-        mempool_free(job, _job_pool);
+        mempool_free(job, kc->job_pool);
         fn(read_err, write_err, context);
 
         if (atomic_dec_and_test(&kc->nr_jobs))
@@ -310,6 +298,7 @@ static int run_complete_job(struct kcopyd_job *job)
 static void complete_io(unsigned long error, void *context)
 {
         struct kcopyd_job *job = (struct kcopyd_job *) context;
+        struct dm_kcopyd_client *kc = job->kc;
 
         if (error) {
                 if (job->rw == WRITE)
@@ -317,22 +306,22 @@ static void complete_io(unsigned long error, void *context)
                 else
                         job->read_err = 1;
 
-                if (!test_bit(KCOPYD_IGNORE_ERROR, &job->flags)) {
-                        push(&_complete_jobs, job);
-                        wake();
+                if (!test_bit(DM_KCOPYD_IGNORE_ERROR, &job->flags)) {
+                        push(&kc->complete_jobs, job);
+                        wake(kc);
                         return;
                 }
         }
 
         if (job->rw == WRITE)
-                push(&_complete_jobs, job);
+                push(&kc->complete_jobs, job);
 
         else {
                 job->rw = WRITE;
-                push(&_io_jobs, job);
+                push(&kc->io_jobs, job);
         }
 
-        wake();
+        wake(kc);
 }
 
 /*
@@ -343,7 +332,7 @@ static int run_io_job(struct kcopyd_job *job)
 {
         int r;
         struct dm_io_request io_req = {
-                .bi_rw = job->rw,
+                .bi_rw = job->rw | (1 << BIO_RW_SYNC),
                 .mem.type = DM_IO_PAGE_LIST,
                 .mem.ptr.pl = job->pages,
                 .mem.offset = job->offset,
@@ -369,7 +358,7 @@ static int run_pages_job(struct kcopyd_job *job)
         r = kcopyd_get_pages(job->kc, job->nr_pages, &job->pages);
         if (!r) {
                 /* this job is ready for io */
-                push(&_io_jobs, job);
+                push(&job->kc->io_jobs, job);
                 return 0;
         }
 
@@ -384,12 +373,13 @@ static int run_pages_job(struct kcopyd_job *job)
  * Run through a list for as long as possible.  Returns the count
  * of successful jobs.
  */
-static int process_jobs(struct list_head *jobs, int (*fn) (struct kcopyd_job *))
+static int process_jobs(struct list_head *jobs, struct dm_kcopyd_client *kc,
+                        int (*fn) (struct kcopyd_job *))
 {
         struct kcopyd_job *job;
         int r, count = 0;
 
-        while ((job = pop(jobs))) {
+        while ((job = pop(jobs, kc))) {
 
                 r = fn(job);
 
@@ -399,7 +389,7 @@ static int process_jobs(struct list_head *jobs, int (*fn) (struct kcopyd_job *))
                                 job->write_err = (unsigned long) -1L;
                         else
                                 job->read_err = 1;
-                        push(&_complete_jobs, job);
+                        push(&kc->complete_jobs, job);
                         break;
                 }
 
@@ -421,8 +411,11 @@ static int process_jobs(struct list_head *jobs, int (*fn) (struct kcopyd_job *))
 /*
  * kcopyd does this every time it's woken up.
  */
-static void do_work(struct work_struct *ignored)
+static void do_work(struct work_struct *work)
 {
+        struct dm_kcopyd_client *kc = container_of(work,
+                                        struct dm_kcopyd_client, kcopyd_work);
+
         /*
          * The order that these are called is *very* important.
          * complete jobs can free some pages for pages jobs.
@@ -430,9 +423,9 @@ static void do_work(struct work_struct *ignored)
          * list.  io jobs call wake when they complete and it all
          * starts again.
          */
-        process_jobs(&_complete_jobs, run_complete_job);
-        process_jobs(&_pages_jobs, run_pages_job);
-        process_jobs(&_io_jobs, run_io_job);
+        process_jobs(&kc->complete_jobs, kc, run_complete_job);
+        process_jobs(&kc->pages_jobs, kc, run_pages_job);
+        process_jobs(&kc->io_jobs, kc, run_io_job);
 }
 
 /*
@@ -442,9 +435,10 @@ static void do_work(struct work_struct *ignored)
  */
 static void dispatch_job(struct kcopyd_job *job)
 {
-        atomic_inc(&job->kc->nr_jobs);
-        push(&_pages_jobs, job);
-        wake();
+        struct dm_kcopyd_client *kc = job->kc;
+        atomic_inc(&kc->nr_jobs);
+        push(&kc->pages_jobs, job);
+        wake(kc);
 }
 
 #define SUB_JOB_SIZE 128
@@ -469,7 +463,7 @@ static void segment_complete(int read_err, unsigned long write_err,
          * Only dispatch more work if there hasn't been an error.
          */
         if ((!job->read_err && !job->write_err) ||
-            test_bit(KCOPYD_IGNORE_ERROR, &job->flags)) {
+            test_bit(DM_KCOPYD_IGNORE_ERROR, &job->flags)) {
                 /* get the next chunk of work */
                 progress = job->progress;
                 count = job->source.count - progress;
@@ -484,7 +478,8 @@ static void segment_complete(int read_err, unsigned long write_err,
 
         if (count) {
                 int i;
-                struct kcopyd_job *sub_job = mempool_alloc(_job_pool, GFP_NOIO);
+                struct kcopyd_job *sub_job = mempool_alloc(job->kc->job_pool,
+                                                           GFP_NOIO);
 
                 *sub_job = *job;
                 sub_job->source.sector += progress;
@@ -508,7 +503,7 @@ static void segment_complete(int read_err, unsigned long write_err,
                  * after we've completed.
                  */
                 job->fn(read_err, write_err, job->context);
-                mempool_free(job, _job_pool);
+                mempool_free(job, job->kc->job_pool);
         }
 }
 
@@ -526,16 +521,16 @@ static void split_job(struct kcopyd_job *job)
                 segment_complete(0, 0u, job);
 }
 
-int kcopyd_copy(struct kcopyd_client *kc, struct io_region *from,
-                unsigned int num_dests, struct io_region *dests,
-                unsigned int flags, kcopyd_notify_fn fn, void *context)
+int dm_kcopyd_copy(struct dm_kcopyd_client *kc, struct dm_io_region *from,
+                   unsigned int num_dests, struct dm_io_region *dests,
+                   unsigned int flags, dm_kcopyd_notify_fn fn, void *context)
 {
         struct kcopyd_job *job;
 
         /*
          * Allocate a new job.
          */
-        job = mempool_alloc(_job_pool, GFP_NOIO);
+        job = mempool_alloc(kc->job_pool, GFP_NOIO);
 
         /*
          * set up for the read.
@@ -569,6 +564,7 @@ int kcopyd_copy(struct kcopyd_client *kc, struct io_region *from,
 
         return 0;
 }
+EXPORT_SYMBOL(dm_kcopyd_copy);
 
 /*
  * Cancels a kcopyd job, eg. someone might be deactivating a
@@ -583,126 +579,76 @@ int kcopyd_cancel(struct kcopyd_job *job, int block)
 #endif  /*  0  */
 
 /*-----------------------------------------------------------------
- * Unit setup
+ * Client setup
  *---------------------------------------------------------------*/
-static DEFINE_MUTEX(_client_lock);
-static LIST_HEAD(_clients);
-
-static void client_add(struct kcopyd_client *kc)
+int dm_kcopyd_client_create(unsigned int nr_pages,
+                            struct dm_kcopyd_client **result)
 {
-        mutex_lock(&_client_lock);
-        list_add(&kc->list, &_clients);
-        mutex_unlock(&_client_lock);
-}
-
-static void client_del(struct kcopyd_client *kc)
-{
-        mutex_lock(&_client_lock);
-        list_del(&kc->list);
-        mutex_unlock(&_client_lock);
-}
-
-static DEFINE_MUTEX(kcopyd_init_lock);
-static int kcopyd_clients = 0;
+        int r = -ENOMEM;
+        struct dm_kcopyd_client *kc;
 
-static int kcopyd_init(void)
-{
-        int r;
-
-        mutex_lock(&kcopyd_init_lock);
-
-        if (kcopyd_clients) {
-                /* Already initialized. */
-                kcopyd_clients++;
-                mutex_unlock(&kcopyd_init_lock);
-                return 0;
-        }
-
-        r = jobs_init();
-        if (r) {
-                mutex_unlock(&kcopyd_init_lock);
-                return r;
-        }
-
-        _kcopyd_wq = create_singlethread_workqueue("kcopyd");
-        if (!_kcopyd_wq) {
-                jobs_exit();
-                mutex_unlock(&kcopyd_init_lock);
+        kc = kmalloc(sizeof(*kc), GFP_KERNEL);
+        if (!kc)
                 return -ENOMEM;
-        }
-
-        kcopyd_clients++;
-        INIT_WORK(&_kcopyd_work, do_work);
-        mutex_unlock(&kcopyd_init_lock);
-        return 0;
-}
 
-static void kcopyd_exit(void)
-{
-        mutex_lock(&kcopyd_init_lock);
-        kcopyd_clients--;
-        if (!kcopyd_clients) {
-                jobs_exit();
-                destroy_workqueue(_kcopyd_wq);
-                _kcopyd_wq = NULL;
-        }
-        mutex_unlock(&kcopyd_init_lock);
-}
-
-int kcopyd_client_create(unsigned int nr_pages, struct kcopyd_client **result)
-{
-        int r = 0;
-        struct kcopyd_client *kc;
+        spin_lock_init(&kc->lock);
+        spin_lock_init(&kc->job_lock);
+        INIT_LIST_HEAD(&kc->complete_jobs);
+        INIT_LIST_HEAD(&kc->io_jobs);
+        INIT_LIST_HEAD(&kc->pages_jobs);
 
-        r = kcopyd_init();
-        if (r)
-                return r;
+        kc->job_pool = mempool_create_slab_pool(MIN_JOBS, _job_cache);
+        if (!kc->job_pool)
+                goto bad_slab;
 
-        kc = kmalloc(sizeof(*kc), GFP_KERNEL);
-        if (!kc) {
-                kcopyd_exit();
-                return -ENOMEM;
-        }
+        INIT_WORK(&kc->kcopyd_work, do_work);
+        kc->kcopyd_wq = create_singlethread_workqueue("kcopyd");
+        if (!kc->kcopyd_wq)
+                goto bad_workqueue;
 
-        spin_lock_init(&kc->lock);
         kc->pages = NULL;
         kc->nr_pages = kc->nr_free_pages = 0;
         r = client_alloc_pages(kc, nr_pages);
-        if (r) {
-                kfree(kc);
-                kcopyd_exit();
-                return r;
-        }
+        if (r)
+                goto bad_client_pages;
 
         kc->io_client = dm_io_client_create(nr_pages);
         if (IS_ERR(kc->io_client)) {
                 r = PTR_ERR(kc->io_client);
-                client_free_pages(kc);
-                kfree(kc);
-                kcopyd_exit();
-                return r;
+                goto bad_io_client;
         }
 
         init_waitqueue_head(&kc->destroyq);
         atomic_set(&kc->nr_jobs, 0);
 
-        client_add(kc);
         *result = kc;
         return 0;
+
+bad_io_client:
+        client_free_pages(kc);
+bad_client_pages:
+        destroy_workqueue(kc->kcopyd_wq);
+bad_workqueue:
+        mempool_destroy(kc->job_pool);
+bad_slab:
+        kfree(kc);
+
+        return r;
 }
+EXPORT_SYMBOL(dm_kcopyd_client_create);
 
-void kcopyd_client_destroy(struct kcopyd_client *kc)
+void dm_kcopyd_client_destroy(struct dm_kcopyd_client *kc)
 {
         /* Wait for completion of all jobs submitted by this client. */
         wait_event(kc->destroyq, !atomic_read(&kc->nr_jobs));
 
+        BUG_ON(!list_empty(&kc->complete_jobs));
+        BUG_ON(!list_empty(&kc->io_jobs));
+        BUG_ON(!list_empty(&kc->pages_jobs));
+        destroy_workqueue(kc->kcopyd_wq);
         dm_io_client_destroy(kc->io_client);
         client_free_pages(kc);
-        client_del(kc);
+        mempool_destroy(kc->job_pool);
         kfree(kc);
-        kcopyd_exit();
 }
-
-EXPORT_SYMBOL(kcopyd_client_create);
-EXPORT_SYMBOL(kcopyd_client_destroy);
-EXPORT_SYMBOL(kcopyd_copy);
+EXPORT_SYMBOL(dm_kcopyd_client_destroy);
diff --git a/drivers/md/dm-log.c b/drivers/md/dm-log.c
index 2a74b2142f50..67a6f31b7fc3 100644
--- a/drivers/md/dm-log.c
+++ b/drivers/md/dm-log.c
@@ -1,5 +1,6 @@
 /*
  * Copyright (C) 2003 Sistina Software
+ * Copyright (C) 2004-2008 Red Hat, Inc. All rights reserved.
  *
  * This file is released under the LGPL.
  */
@@ -8,64 +9,58 @@
 #include <linux/slab.h>
 #include <linux/module.h>
 #include <linux/vmalloc.h>
+#include <linux/dm-io.h>
+#include <linux/dm-dirty-log.h>
 
-#include "dm-log.h"
-#include "dm-io.h"
+#include "dm.h"
 
-#define DM_MSG_PREFIX "mirror log"
+#define DM_MSG_PREFIX "dirty region log"
 
-static LIST_HEAD(_log_types);
-static DEFINE_SPINLOCK(_lock);
+struct dm_dirty_log_internal {
+        struct dm_dirty_log_type *type;
 
-int dm_register_dirty_log_type(struct dirty_log_type *type)
-{
-        spin_lock(&_lock);
-        type->use_count = 0;
-        list_add(&type->list, &_log_types);
-        spin_unlock(&_lock);
+        struct list_head list;
+        long use;
+};
 
-        return 0;
-}
+static LIST_HEAD(_log_types);
+static DEFINE_SPINLOCK(_lock);
 
-int dm_unregister_dirty_log_type(struct dirty_log_type *type)
+static struct dm_dirty_log_internal *__find_dirty_log_type(const char *name)
 {
-        spin_lock(&_lock);
-
-        if (type->use_count)
-                DMWARN("Attempt to unregister a log type that is still in use");
-        else
-                list_del(&type->list);
+        struct dm_dirty_log_internal *log_type;
 
-        spin_unlock(&_lock);
+        list_for_each_entry(log_type, &_log_types, list)
+                if (!strcmp(name, log_type->type->name))
+                        return log_type;
 
-        return 0;
+        return NULL;
 }
 
-static struct dirty_log_type *_get_type(const char *type_name)
+static struct dm_dirty_log_internal *_get_dirty_log_type(const char *name)
 {
-        struct dirty_log_type *type;
+        struct dm_dirty_log_internal *log_type;
 
         spin_lock(&_lock);
-        list_for_each_entry (type, &_log_types, list)
-                if (!strcmp(type_name, type->name)) {
-                        if (!type->use_count && !try_module_get(type->module)){
-                                spin_unlock(&_lock);
-                                return NULL;
-                        }
-                        type->use_count++;
-                        spin_unlock(&_lock);
-                        return type;
-                }
+
+        log_type = __find_dirty_log_type(name);
+        if (log_type) {
+                if (!log_type->use && !try_module_get(log_type->type->module))
+                        log_type = NULL;
+                else
+                        log_type->use++;
+        }
 
         spin_unlock(&_lock);
-        return NULL;
+
+        return log_type;
 }
 
 /*
  * get_type
  * @type_name
  *
- * Attempt to retrieve the dirty_log_type by name.  If not already
+ * Attempt to retrieve the dm_dirty_log_type by name.  If not already
  * available, attempt to load the appropriate module.
  *
  * Log modules are named "dm-log-" followed by the 'type_name'.
@@ -78,14 +73,17 @@ static struct dirty_log_type *_get_type(const char *type_name)
  *
  * Returns: dirty_log_type* on success, NULL on failure
  */
-static struct dirty_log_type *get_type(const char *type_name)
+static struct dm_dirty_log_type *get_type(const char *type_name)
 {
         char *p, *type_name_dup;
-        struct dirty_log_type *type;
+        struct dm_dirty_log_internal *log_type;
+
+        if (!type_name)
+                return NULL;
 
-        type = _get_type(type_name);
-        if (type)
-                return type;
+        log_type = _get_dirty_log_type(type_name);
+        if (log_type)
+                return log_type->type;
 
         type_name_dup = kstrdup(type_name, GFP_KERNEL);
         if (!type_name_dup) {
@@ -95,34 +93,106 @@ static struct dirty_log_type *get_type(const char *type_name)
         }
 
         while (request_module("dm-log-%s", type_name_dup) ||
-               !(type = _get_type(type_name))) {
+               !(log_type = _get_dirty_log_type(type_name))) {
                 p = strrchr(type_name_dup, '-');
                 if (!p)
                         break;
                 p[0] = '\0';
         }
 
-        if (!type)
+        if (!log_type)
                 DMWARN("Module for logging type \"%s\" not found.", type_name);
 
         kfree(type_name_dup);
 
-        return type;
+        return log_type ? log_type->type : NULL;
 }
 
-static void put_type(struct dirty_log_type *type)
+static void put_type(struct dm_dirty_log_type *type)
 {
+        struct dm_dirty_log_internal *log_type;
+
+        if (!type)
+                return;
+
         spin_lock(&_lock);
-        if (!--type->use_count)
+        log_type = __find_dirty_log_type(type->name);
+        if (!log_type)
+                goto out;
+
+        if (!--log_type->use)
                 module_put(type->module);
+
+        BUG_ON(log_type->use < 0);
+
+out:
         spin_unlock(&_lock);
 }
 
-struct dirty_log *dm_create_dirty_log(const char *type_name, struct dm_target *ti,
-                                      unsigned int argc, char **argv)
+static struct dm_dirty_log_internal *_alloc_dirty_log_type(struct dm_dirty_log_type *type)
 {
-        struct dirty_log_type *type;
-        struct dirty_log *log;
+        struct dm_dirty_log_internal *log_type = kzalloc(sizeof(*log_type),
+                                                         GFP_KERNEL);
+
+        if (log_type)
+                log_type->type = type;
+
+        return log_type;
+}
+
+int dm_dirty_log_type_register(struct dm_dirty_log_type *type)
+{
+        struct dm_dirty_log_internal *log_type = _alloc_dirty_log_type(type);
+        int r = 0;
+
+        if (!log_type)
+                return -ENOMEM;
+
+        spin_lock(&_lock);
+        if (!__find_dirty_log_type(type->name))
+                list_add(&log_type->list, &_log_types);
+        else {
+                kfree(log_type);
+                r = -EEXIST;
+        }
+        spin_unlock(&_lock);
+
+        return r;
+}
+EXPORT_SYMBOL(dm_dirty_log_type_register);
+
+int dm_dirty_log_type_unregister(struct dm_dirty_log_type *type)
+{
+        struct dm_dirty_log_internal *log_type;
+
+        spin_lock(&_lock);
+
+        log_type = __find_dirty_log_type(type->name);
+        if (!log_type) {
+                spin_unlock(&_lock);
+                return -EINVAL;
+        }
+
+        if (log_type->use) {
+                spin_unlock(&_lock);
+                return -ETXTBSY;
+        }
+
+        list_del(&log_type->list);
+
+        spin_unlock(&_lock);
+        kfree(log_type);
+
+        return 0;
+}
+EXPORT_SYMBOL(dm_dirty_log_type_unregister);
+
+struct dm_dirty_log *dm_dirty_log_create(const char *type_name,
+                                         struct dm_target *ti,
+                                         unsigned int argc, char **argv)
+{
+        struct dm_dirty_log_type *type;
+        struct dm_dirty_log *log;
 
         log = kmalloc(sizeof(*log), GFP_KERNEL);
         if (!log)
@@ -143,13 +213,15 @@ struct dirty_log *dm_create_dirty_log(const char *type_name, struct dm_target *t
 
         return log;
 }
+EXPORT_SYMBOL(dm_dirty_log_create);
 
-void dm_destroy_dirty_log(struct dirty_log *log)
+void dm_dirty_log_destroy(struct dm_dirty_log *log)
 {
         log->type->dtr(log);
         put_type(log->type);
         kfree(log);
 }
+EXPORT_SYMBOL(dm_dirty_log_destroy);
 
 /*-----------------------------------------------------------------
  * Persistent and core logs share a lot of their implementation.
@@ -207,7 +279,7 @@ struct log_c {
         struct dm_dev *log_dev;
         struct log_header header;
 
-        struct io_region header_location;
+        struct dm_io_region header_location;
         struct log_header *disk_header;
 };
 
@@ -215,7 +287,7 @@ struct log_c {
  * The touched member needs to be updated every time we access
  * one of the bitsets.
  */
-static  inline int log_test_bit(uint32_t *bs, unsigned bit)
+static inline int log_test_bit(uint32_t *bs, unsigned bit)
 {
         return ext2_test_bit(bit, (unsigned long *) bs) ? 1 : 0;
 }
@@ -302,7 +374,7 @@ static inline int write_header(struct log_c *log)
  * argv contains region_size followed optionally by [no]sync
  *--------------------------------------------------------------*/
 #define BYTE_SHIFT 3
-static int create_log_context(struct dirty_log *log, struct dm_target *ti,
+static int create_log_context(struct dm_dirty_log *log, struct dm_target *ti,
                               unsigned int argc, char **argv,
                               struct dm_dev *dev)
 {
@@ -315,7 +387,7 @@ static int create_log_context(struct dirty_log *log, struct dm_target *ti,
         int r;
 
         if (argc < 1 || argc > 2) {
-                DMWARN("wrong number of arguments to mirror log");
+                DMWARN("wrong number of arguments to dirty region log");
                 return -EINVAL;
         }
 
@@ -325,8 +397,8 @@ static int create_log_context(struct dirty_log *log, struct dm_target *ti,
                 else if (!strcmp(argv[1], "nosync"))
                         sync = NOSYNC;
                 else {
-                        DMWARN("unrecognised sync argument to mirror log: %s",
-                               argv[1]);
+                        DMWARN("unrecognised sync argument to "
+                               "dirty region log: %s", argv[1]);
                         return -EINVAL;
                 }
         }
@@ -434,7 +506,7 @@ static int create_log_context(struct dirty_log *log, struct dm_target *ti,
         return 0;
 }
 
-static int core_ctr(struct dirty_log *log, struct dm_target *ti,
+static int core_ctr(struct dm_dirty_log *log, struct dm_target *ti,
                     unsigned int argc, char **argv)
 {
         return create_log_context(log, ti, argc, argv, NULL);
@@ -447,7 +519,7 @@ static void destroy_log_context(struct log_c *lc)
         kfree(lc);
 }
 
-static void core_dtr(struct dirty_log *log)
+static void core_dtr(struct dm_dirty_log *log)
 {
         struct log_c *lc = (struct log_c *) log->context;
 
@@ -460,14 +532,14 @@ static void core_dtr(struct dirty_log *log)
  *
  * argv contains log_device region_size followed optionally by [no]sync
  *--------------------------------------------------------------*/
-static int disk_ctr(struct dirty_log *log, struct dm_target *ti,
+static int disk_ctr(struct dm_dirty_log *log, struct dm_target *ti,
                     unsigned int argc, char **argv)
 {
         int r;
         struct dm_dev *dev;
 
         if (argc < 2 || argc > 3) {
-                DMWARN("wrong number of arguments to disk mirror log");
+                DMWARN("wrong number of arguments to disk dirty region log");
                 return -EINVAL;
         }
 
@@ -485,7 +557,7 @@ static int disk_ctr(struct dirty_log *log, struct dm_target *ti,
         return 0;
 }
 
-static void disk_dtr(struct dirty_log *log)
+static void disk_dtr(struct dm_dirty_log *log)
 {
         struct log_c *lc = (struct log_c *) log->context;
 
@@ -514,7 +586,7 @@ static void fail_log_device(struct log_c *lc)
         dm_table_event(lc->ti->table);
 }
 
-static int disk_resume(struct dirty_log *log)
+static int disk_resume(struct dm_dirty_log *log)
 {
         int r;
         unsigned i;
@@ -524,7 +596,7 @@ static int disk_resume(struct dirty_log *log)
         /* read the disk header */
         r = read_header(lc);
         if (r) {
-                DMWARN("%s: Failed to read header on mirror log device",
+                DMWARN("%s: Failed to read header on dirty region log device",
                        lc->log_dev->name);
                 fail_log_device(lc);
                 /*
@@ -562,7 +634,7 @@ static int disk_resume(struct dirty_log *log)
         /* write the new header */
         r = write_header(lc);
         if (r) {
-                DMWARN("%s: Failed to write header on mirror log device",
+                DMWARN("%s: Failed to write header on dirty region log device",
                        lc->log_dev->name);
                 fail_log_device(lc);
         }
@@ -570,38 +642,38 @@ static int disk_resume(struct dirty_log *log)
         return r;
 }
 
-static uint32_t core_get_region_size(struct dirty_log *log)
+static uint32_t core_get_region_size(struct dm_dirty_log *log)
 {
         struct log_c *lc = (struct log_c *) log->context;
         return lc->region_size;
 }
 
-static int core_resume(struct dirty_log *log)
+static int core_resume(struct dm_dirty_log *log)
 {
         struct log_c *lc = (struct log_c *) log->context;
         lc->sync_search = 0;
         return 0;
 }
 
-static int core_is_clean(struct dirty_log *log, region_t region)
+static int core_is_clean(struct dm_dirty_log *log, region_t region)
 {
         struct log_c *lc = (struct log_c *) log->context;
         return log_test_bit(lc->clean_bits, region);
 }
 
-static int core_in_sync(struct dirty_log *log, region_t region, int block)
+static int core_in_sync(struct dm_dirty_log *log, region_t region, int block)
 {
         struct log_c *lc = (struct log_c *) log->context;
         return log_test_bit(lc->sync_bits, region);
 }
 
-static int core_flush(struct dirty_log *log)
+static int core_flush(struct dm_dirty_log *log)
 {
         /* no op */
         return 0;
 }
 
-static int disk_flush(struct dirty_log *log)
+static int disk_flush(struct dm_dirty_log *log)
 {
         int r;
         struct log_c *lc = (struct log_c *) log->context;
@@ -619,19 +691,19 @@ static int disk_flush(struct dirty_log *log)
         return r;
 }
 
-static void core_mark_region(struct dirty_log *log, region_t region)
+static void core_mark_region(struct dm_dirty_log *log, region_t region)
 {
         struct log_c *lc = (struct log_c *) log->context;
         log_clear_bit(lc, lc->clean_bits, region);
 }
 
-static void core_clear_region(struct dirty_log *log, region_t region)
+static void core_clear_region(struct dm_dirty_log *log, region_t region)
 {
         struct log_c *lc = (struct log_c *) log->context;
         log_set_bit(lc, lc->clean_bits, region);
 }
 
-static int core_get_resync_work(struct dirty_log *log, region_t *region)
+static int core_get_resync_work(struct dm_dirty_log *log, region_t *region)
 {
         struct log_c *lc = (struct log_c *) log->context;
 
@@ -654,7 +726,7 @@ static int core_get_resync_work(struct dirty_log *log, region_t *region)
         return 1;
 }
 
-static void core_set_region_sync(struct dirty_log *log, region_t region,
+static void core_set_region_sync(struct dm_dirty_log *log, region_t region,
                                  int in_sync)
 {
         struct log_c *lc = (struct log_c *) log->context;
@@ -669,7 +741,7 @@ static void core_set_region_sync(struct dirty_log *log, region_t region,
         }
 }
 
-static region_t core_get_sync_count(struct dirty_log *log)
+static region_t core_get_sync_count(struct dm_dirty_log *log)
 {
         struct log_c *lc = (struct log_c *) log->context;
 
@@ -680,7 +752,7 @@ static region_t core_get_sync_count(struct dirty_log *log)
         if (lc->sync != DEFAULTSYNC) \
                 DMEMIT("%ssync ", lc->sync == NOSYNC ? "no" : "")
 
-static int core_status(struct dirty_log *log, status_type_t status,
+static int core_status(struct dm_dirty_log *log, status_type_t status,
                        char *result, unsigned int maxlen)
 {
         int sz = 0;
@@ -700,7 +772,7 @@ static int core_status(struct dirty_log *log, status_type_t status,
         return sz;
 }
 
-static int disk_status(struct dirty_log *log, status_type_t status,
+static int disk_status(struct dm_dirty_log *log, status_type_t status,
                        char *result, unsigned int maxlen)
 {
         int sz = 0;
@@ -722,7 +794,7 @@ static int disk_status(struct dirty_log *log, status_type_t status,
         return sz;
 }
 
-static struct dirty_log_type _core_type = {
+static struct dm_dirty_log_type _core_type = {
         .name = "core",
         .module = THIS_MODULE,
         .ctr = core_ctr,
@@ -740,7 +812,7 @@ static struct dirty_log_type _core_type = {
         .status = core_status,
 };
 
-static struct dirty_log_type _disk_type = {
+static struct dm_dirty_log_type _disk_type = {
         .name = "disk",
         .module = THIS_MODULE,
         .ctr = disk_ctr,
@@ -763,26 +835,28 @@ int __init dm_dirty_log_init(void)
 {
         int r;
 
-        r = dm_register_dirty_log_type(&_core_type);
+        r = dm_dirty_log_type_register(&_core_type);
         if (r)
                 DMWARN("couldn't register core log");
 
-        r = dm_register_dirty_log_type(&_disk_type);
+        r = dm_dirty_log_type_register(&_disk_type);
         if (r) {
                 DMWARN("couldn't register disk type");
-                dm_unregister_dirty_log_type(&_core_type);
+                dm_dirty_log_type_unregister(&_core_type);
         }
 
         return r;
 }
 
-void dm_dirty_log_exit(void)
+void __exit dm_dirty_log_exit(void)
 {
-        dm_unregister_dirty_log_type(&_disk_type);
-        dm_unregister_dirty_log_type(&_core_type);
+        dm_dirty_log_type_unregister(&_disk_type);
+        dm_dirty_log_type_unregister(&_core_type);
 }
 
-EXPORT_SYMBOL(dm_register_dirty_log_type);
-EXPORT_SYMBOL(dm_unregister_dirty_log_type);
-EXPORT_SYMBOL(dm_create_dirty_log);
-EXPORT_SYMBOL(dm_destroy_dirty_log);
+module_init(dm_dirty_log_init);
+module_exit(dm_dirty_log_exit);
+
+MODULE_DESCRIPTION(DM_NAME " dirty region log");
+MODULE_AUTHOR("Joe Thornber, Heinz Mauelshagen <dm-devel@redhat.com>");
+MODULE_LICENSE("GPL");
diff --git a/drivers/md/dm-log.h b/drivers/md/dm-log.h
deleted file mode 100644
index 3fae87eb5963..000000000000
--- a/drivers/md/dm-log.h
+++ /dev/null
@@ -1,131 +0,0 @@
-/*
- * Copyright (C) 2003 Sistina Software
- *
- * This file is released under the LGPL.
- */
-
-#ifndef DM_DIRTY_LOG
-#define DM_DIRTY_LOG
-
-#include "dm.h"
-
-typedef sector_t region_t;
-
-struct dirty_log_type;
-
-struct dirty_log {
-        struct dirty_log_type *type;
-        void *context;
-};
-
-struct dirty_log_type {
-        struct list_head list;
-        const char *name;
-        struct module *module;
-        unsigned int use_count;
-
-        int (*ctr)(struct dirty_log *log, struct dm_target *ti,
-                   unsigned int argc, char **argv);
-        void (*dtr)(struct dirty_log *log);
-
-        /*
-         * There are times when we don't want the log to touch
-         * the disk.
-         */
-        int (*presuspend)(struct dirty_log *log);
-        int (*postsuspend)(struct dirty_log *log);
-        int (*resume)(struct dirty_log *log);
-
-        /*
-         * Retrieves the smallest size of region that the log can
-         * deal with.
-         */
-        uint32_t (*get_region_size)(struct dirty_log *log);
-
-        /*
-         * A predicate to say whether a region is clean or not.
-         * May block.
-         */
-        int (*is_clean)(struct dirty_log *log, region_t region);
-
-        /*
-         *  Returns: 0, 1, -EWOULDBLOCK, < 0
-         *
-         * A predicate function to check the area given by
-         * [sector, sector + len) is in sync.
-         *
-         * If -EWOULDBLOCK is returned the state of the region is
-         * unknown, typically this will result in a read being
-         * passed to a daemon to deal with, since a daemon is
-         * allowed to block.
-         */
-        int (*in_sync)(struct dirty_log *log, region_t region, int can_block);
-
-        /*
-         * Flush the current log state (eg, to disk).  This
-         * function may block.
-         */
-        int (*flush)(struct dirty_log *log);
-
-        /*
-         * Mark an area as clean or dirty.  These functions may
-         * block, though for performance reasons blocking should
-         * be extremely rare (eg, allocating another chunk of
-         * memory for some reason).
-         */
-        void (*mark_region)(struct dirty_log *log, region_t region);
-        void (*clear_region)(struct dirty_log *log, region_t region);
-
-        /*
-         * Returns: <0 (error), 0 (no region), 1 (region)
-         *
-         * The mirrord will need perform recovery on regions of
-         * the mirror that are in the NOSYNC state.  This
-         * function asks the log to tell the caller about the
-         * next region that this machine should recover.
-         *
-         * Do not confuse this function with 'in_sync()', one
-         * tells you if an area is synchronised, the other
-         * assigns recovery work.
-        */
-        int (*get_resync_work)(struct dirty_log *log, region_t *region);
-
-        /*
-         * This notifies the log that the resync status of a region
-         * has changed.  It also clears the region from the recovering
-         * list (if present).
-         */
-        void (*set_region_sync)(struct dirty_log *log,
-                                region_t region, int in_sync);
-
-        /*
-         * Returns the number of regions that are in sync.
-         */
-        region_t (*get_sync_count)(struct dirty_log *log);
-
-        /*
-         * Support function for mirror status requests.
-         */
-        int (*status)(struct dirty_log *log, status_type_t status_type,
-                      char *result, unsigned int maxlen);
-};
-
-int dm_register_dirty_log_type(struct dirty_log_type *type);
-int dm_unregister_dirty_log_type(struct dirty_log_type *type);
-
-
-/*
- * Make sure you use these two functions, rather than calling
- * type->constructor/destructor() directly.
- */
-struct dirty_log *dm_create_dirty_log(const char *type_name, struct dm_target *ti,
-                                      unsigned int argc, char **argv);
-void dm_destroy_dirty_log(struct dirty_log *log);
-
-/*
- * init/exit functions.
- */
-int dm_dirty_log_init(void);
-void dm_dirty_log_exit(void);
-
-#endif
diff --git a/drivers/md/dm-raid1.c b/drivers/md/dm-raid1.c
index 762cb086bb7f..ff05fe893083 100644
--- a/drivers/md/dm-raid1.c
+++ b/drivers/md/dm-raid1.c
@@ -7,9 +7,6 @@
 #include "dm.h"
 #include "dm-bio-list.h"
 #include "dm-bio-record.h"
-#include "dm-io.h"
-#include "dm-log.h"
-#include "kcopyd.h"
 
 #include <linux/ctype.h>
 #include <linux/init.h>
@@ -22,6 +19,9 @@
 #include <linux/workqueue.h>
 #include <linux/log2.h>
 #include <linux/hardirq.h>
+#include <linux/dm-io.h>
+#include <linux/dm-dirty-log.h>
+#include <linux/dm-kcopyd.h>
 
 #define DM_MSG_PREFIX "raid1"
 #define DM_IO_PAGES 64
@@ -74,7 +74,7 @@ struct region_hash {
         unsigned region_shift;
 
         /* holds persistent region state */
-        struct dirty_log *log;
+        struct dm_dirty_log *log;
 
         /* hash table */
         rwlock_t hash_lock;
@@ -133,7 +133,7 @@ struct mirror_set {
         struct dm_target *ti;
         struct list_head list;
         struct region_hash rh;
-        struct kcopyd_client *kcopyd_client;
+        struct dm_kcopyd_client *kcopyd_client;
         uint64_t features;
 
         spinlock_t lock;        /* protects the lists */
@@ -154,6 +154,9 @@ struct mirror_set {
 
         struct workqueue_struct *kmirrord_wq;
         struct work_struct kmirrord_work;
+        struct timer_list timer;
+        unsigned long timer_pending;
+
         struct work_struct trigger_event;
 
         unsigned int nr_mirrors;
@@ -178,13 +181,32 @@ static void wake(struct mirror_set *ms)
         queue_work(ms->kmirrord_wq, &ms->kmirrord_work);
 }
 
+static void delayed_wake_fn(unsigned long data)
+{
+        struct mirror_set *ms = (struct mirror_set *) data;
+
+        clear_bit(0, &ms->timer_pending);
+        wake(ms);
+}
+
+static void delayed_wake(struct mirror_set *ms)
+{
+        if (test_and_set_bit(0, &ms->timer_pending))
+                return;
+
+        ms->timer.expires = jiffies + HZ / 5;
+        ms->timer.data = (unsigned long) ms;
+        ms->timer.function = delayed_wake_fn;
+        add_timer(&ms->timer);
+}
+
 /* FIXME move this */
 static void queue_bio(struct mirror_set *ms, struct bio *bio, int rw);
 
 #define MIN_REGIONS 64
 #define MAX_RECOVERY 1
 static int rh_init(struct region_hash *rh, struct mirror_set *ms,
-                   struct dirty_log *log, uint32_t region_size,
+                   struct dm_dirty_log *log, uint32_t region_size,
                    region_t nr_regions)
 {
         unsigned int nr_buckets, max_buckets;
@@ -249,7 +271,7 @@ static void rh_exit(struct region_hash *rh)
         }
 
         if (rh->log)
-                dm_destroy_dirty_log(rh->log);
+                dm_dirty_log_destroy(rh->log);
         if (rh->region_pool)
                 mempool_destroy(rh->region_pool);
         vfree(rh->buckets);
@@ -405,24 +427,22 @@ static void rh_update_states(struct region_hash *rh)
         write_lock_irq(&rh->hash_lock);
         spin_lock(&rh->region_lock);
         if (!list_empty(&rh->clean_regions)) {
-                list_splice(&rh->clean_regions, &clean);
-                INIT_LIST_HEAD(&rh->clean_regions);
+                list_splice_init(&rh->clean_regions, &clean);
 
                 list_for_each_entry(reg, &clean, list)
                         list_del(&reg->hash_list);
         }
 
         if (!list_empty(&rh->recovered_regions)) {
-                list_splice(&rh->recovered_regions, &recovered);
-                INIT_LIST_HEAD(&rh->recovered_regions);
+                list_splice_init(&rh->recovered_regions, &recovered);
 
                 list_for_each_entry (reg, &recovered, list)
                         list_del(&reg->hash_list);
         }
 
         if (!list_empty(&rh->failed_recovered_regions)) {
-                list_splice(&rh->failed_recovered_regions, &failed_recovered);
-                INIT_LIST_HEAD(&rh->failed_recovered_regions);
+                list_splice_init(&rh->failed_recovered_regions,
+                                 &failed_recovered);
 
                 list_for_each_entry(reg, &failed_recovered, list)
                         list_del(&reg->hash_list);
@@ -790,7 +810,7 @@ static int recover(struct mirror_set *ms, struct region *reg)
 {
         int r;
         unsigned int i;
-        struct io_region from, to[KCOPYD_MAX_REGIONS], *dest;
+        struct dm_io_region from, to[DM_KCOPYD_MAX_REGIONS], *dest;
         struct mirror *m;
         unsigned long flags = 0;
 
@@ -822,9 +842,9 @@ static int recover(struct mirror_set *ms, struct region *reg)
         }
 
         /* hand to kcopyd */
-        set_bit(KCOPYD_IGNORE_ERROR, &flags);
-        r = kcopyd_copy(ms->kcopyd_client, &from, ms->nr_mirrors - 1, to, flags,
-                        recovery_complete, reg);
+        set_bit(DM_KCOPYD_IGNORE_ERROR, &flags);
+        r = dm_kcopyd_copy(ms->kcopyd_client, &from, ms->nr_mirrors - 1, to,
+                           flags, recovery_complete, reg);
 
         return r;
 }
@@ -833,7 +853,7 @@ static void do_recovery(struct mirror_set *ms)
 {
         int r;
         struct region *reg;
-        struct dirty_log *log = ms->rh.log;
+        struct dm_dirty_log *log = ms->rh.log;
 
         /*
          * Start quiescing some regions.
@@ -909,7 +929,7 @@ static void map_bio(struct mirror *m, struct bio *bio)
         bio->bi_sector = map_sector(m, bio);
 }
 
-static void map_region(struct io_region *io, struct mirror *m,
+static void map_region(struct dm_io_region *io, struct mirror *m,
                        struct bio *bio)
 {
         io->bdev = m->dev->bdev;
@@ -951,7 +971,7 @@ static void read_callback(unsigned long error, void *context)
 /* Asynchronous read. */
 static void read_async_bio(struct mirror *m, struct bio *bio)
 {
-        struct io_region io;
+        struct dm_io_region io;
         struct dm_io_request io_req = {
                 .bi_rw = READ,
                 .mem.type = DM_IO_BVEC,
@@ -1019,7 +1039,7 @@ static void __bio_mark_nosync(struct mirror_set *ms,
 {
         unsigned long flags;
         struct region_hash *rh = &ms->rh;
-        struct dirty_log *log = ms->rh.log;
+        struct dm_dirty_log *log = ms->rh.log;
         struct region *reg;
         region_t region = bio_to_region(rh, bio);
         int recovering = 0;
@@ -1107,7 +1127,7 @@ out:
 static void do_write(struct mirror_set *ms, struct bio *bio)
 {
         unsigned int i;
-        struct io_region io[ms->nr_mirrors], *dest = io;
+        struct dm_io_region io[ms->nr_mirrors], *dest = io;
         struct mirror *m;
         struct dm_io_request io_req = {
                 .bi_rw = WRITE,
@@ -1182,6 +1202,7 @@ static void do_writes(struct mirror_set *ms, struct bio_list *writes)
                 spin_lock_irq(&ms->lock);
                 bio_list_merge(&ms->failures, &sync);
                 spin_unlock_irq(&ms->lock);
+                wake(ms);
         } else
                 while ((bio = bio_list_pop(&sync)))
                         do_write(ms, bio);
@@ -1241,7 +1262,7 @@ static void do_failures(struct mirror_set *ms, struct bio_list *failures)
         bio_list_merge(&ms->failures, failures);
         spin_unlock_irq(&ms->lock);
 
-        wake(ms);
+        delayed_wake(ms);
 }
 
 static void trigger_event(struct work_struct *work)
@@ -1255,7 +1276,7 @@ static void trigger_event(struct work_struct *work)
 /*-----------------------------------------------------------------
  * kmirrord
  *---------------------------------------------------------------*/
-static int _do_mirror(struct work_struct *work)
+static void do_mirror(struct work_struct *work)
 {
         struct mirror_set *ms =container_of(work, struct mirror_set,
                                             kmirrord_work);
@@ -1277,23 +1298,7 @@ static int _do_mirror(struct work_struct *work)
         do_writes(ms, &writes);
         do_failures(ms, &failures);
 
-        return (ms->failures.head) ? 1 : 0;
-}
-
-static void do_mirror(struct work_struct *work)
-{
-        /*
-         * If _do_mirror returns 1, we give it
-         * another shot.  This helps for cases like
-         * 'suspend' where we call flush_workqueue
-         * and expect all work to be finished.  If
-         * a failure happens during a suspend, we
-         * couldn't issue a 'wake' because it would
-         * not be honored.  Therefore, we return '1'
-         * from _do_mirror, and retry here.
-         */
-        while (_do_mirror(work))
-                schedule();
+        dm_table_unplug_all(ms->ti->table);
 }
 
 
@@ -1303,7 +1308,7 @@ static void do_mirror(struct work_struct *work)
 static struct mirror_set *alloc_context(unsigned int nr_mirrors,
                                         uint32_t region_size,
                                         struct dm_target *ti,
-                                        struct dirty_log *dl)
+                                        struct dm_dirty_log *dl)
 {
         size_t len;
         struct mirror_set *ms = NULL;
@@ -1403,12 +1408,12 @@ static int get_mirror(struct mirror_set *ms, struct dm_target *ti,
 /*
  * Create dirty log: log_type #log_params <log_params>
  */
-static struct dirty_log *create_dirty_log(struct dm_target *ti,
+static struct dm_dirty_log *create_dirty_log(struct dm_target *ti,
                                           unsigned int argc, char **argv,
                                           unsigned int *args_used)
 {
         unsigned int param_count;
-        struct dirty_log *dl;
+        struct dm_dirty_log *dl;
 
         if (argc < 2) {
                 ti->error = "Insufficient mirror log arguments";
@@ -1427,7 +1432,7 @@ static struct dirty_log *create_dirty_log(struct dm_target *ti,
                 return NULL;
         }
 
-        dl = dm_create_dirty_log(argv[0], ti, param_count, argv + 2);
+        dl = dm_dirty_log_create(argv[0], ti, param_count, argv + 2);
         if (!dl) {
                 ti->error = "Error creating mirror dirty log";
                 return NULL;
@@ -1435,7 +1440,7 @@ static struct dirty_log *create_dirty_log(struct dm_target *ti,
 
         if (!_check_region_size(ti, dl->type->get_region_size(dl))) {
                 ti->error = "Invalid region size";
-                dm_destroy_dirty_log(dl);
+                dm_dirty_log_destroy(dl);
                 return NULL;
         }
 
@@ -1496,7 +1501,7 @@ static int mirror_ctr(struct dm_target *ti, unsigned int argc, char **argv)
         int r;
         unsigned int nr_mirrors, m, args_used;
         struct mirror_set *ms;
-        struct dirty_log *dl;
+        struct dm_dirty_log *dl;
 
         dl = create_dirty_log(ti, argc, argv, &args_used);
         if (!dl)
@@ -1506,9 +1511,9 @@ static int mirror_ctr(struct dm_target *ti, unsigned int argc, char **argv)
         argc -= args_used;
 
         if (!argc || sscanf(argv[0], "%u", &nr_mirrors) != 1 ||
-            nr_mirrors < 2 || nr_mirrors > KCOPYD_MAX_REGIONS + 1) {
+            nr_mirrors < 2 || nr_mirrors > DM_KCOPYD_MAX_REGIONS + 1) {
                 ti->error = "Invalid number of mirrors";
-                dm_destroy_dirty_log(dl);
+                dm_dirty_log_destroy(dl);
                 return -EINVAL;
         }
 
@@ -1516,13 +1521,13 @@ static int mirror_ctr(struct dm_target *ti, unsigned int argc, char **argv)
 
         if (argc < nr_mirrors * 2) {
                 ti->error = "Too few mirror arguments";
-                dm_destroy_dirty_log(dl);
+                dm_dirty_log_destroy(dl);
                 return -EINVAL;
         }
 
         ms = alloc_context(nr_mirrors, dl->type->get_region_size(dl), ti, dl);
         if (!ms) {
-                dm_destroy_dirty_log(dl);
+                dm_dirty_log_destroy(dl);
                 return -ENOMEM;
         }
 
@@ -1547,6 +1552,8 @@ static int mirror_ctr(struct dm_target *ti, unsigned int argc, char **argv)
                 goto err_free_context;
         }
         INIT_WORK(&ms->kmirrord_work, do_mirror);
+        init_timer(&ms->timer);
+        ms->timer_pending = 0;
         INIT_WORK(&ms->trigger_event, trigger_event);
 
         r = parse_features(ms, argc, argv, &args_used);
@@ -1571,7 +1578,7 @@ static int mirror_ctr(struct dm_target *ti, unsigned int argc, char **argv)
                 goto err_destroy_wq;
         }
 
-        r = kcopyd_client_create(DM_IO_PAGES, &ms->kcopyd_client);
+        r = dm_kcopyd_client_create(DM_IO_PAGES, &ms->kcopyd_client);
         if (r)
                 goto err_destroy_wq;
 
@@ -1589,8 +1596,9 @@ static void mirror_dtr(struct dm_target *ti)
 {
         struct mirror_set *ms = (struct mirror_set *) ti->private;
 
+        del_timer_sync(&ms->timer);
         flush_workqueue(ms->kmirrord_wq);
-        kcopyd_client_destroy(ms->kcopyd_client);
+        dm_kcopyd_client_destroy(ms->kcopyd_client);
         destroy_workqueue(ms->kmirrord_wq);
         free_context(ms, ti, ms->nr_mirrors);
 }
@@ -1734,7 +1742,7 @@ out:
 static void mirror_presuspend(struct dm_target *ti)
 {
         struct mirror_set *ms = (struct mirror_set *) ti->private;
-        struct dirty_log *log = ms->rh.log;
+        struct dm_dirty_log *log = ms->rh.log;
 
         atomic_set(&ms->suspend, 1);
 
@@ -1763,7 +1771,7 @@ static void mirror_presuspend(struct dm_target *ti)
 static void mirror_postsuspend(struct dm_target *ti)
 {
         struct mirror_set *ms = ti->private;
-        struct dirty_log *log = ms->rh.log;
+        struct dm_dirty_log *log = ms->rh.log;
 
         if (log->type->postsuspend && log->type->postsuspend(log))
                 /* FIXME: need better error handling */
@@ -1773,7 +1781,7 @@ static void mirror_postsuspend(struct dm_target *ti)
 static void mirror_resume(struct dm_target *ti)
 {
         struct mirror_set *ms = ti->private;
-        struct dirty_log *log = ms->rh.log;
+        struct dm_dirty_log *log = ms->rh.log;
 
         atomic_set(&ms->suspend, 0);
         if (log->type->resume && log->type->resume(log))
@@ -1811,7 +1819,7 @@ static int mirror_status(struct dm_target *ti, status_type_t type,
 {
         unsigned int m, sz = 0;
         struct mirror_set *ms = (struct mirror_set *) ti->private;
-        struct dirty_log *log = ms->rh.log;
+        struct dm_dirty_log *log = ms->rh.log;
         char buffer[ms->nr_mirrors + 1];
 
         switch (type) {
@@ -1864,15 +1872,9 @@ static int __init dm_mirror_init(void)
 {
         int r;
 
-        r = dm_dirty_log_init();
-        if (r)
-                return r;
-
         r = dm_register_target(&mirror_target);
-        if (r < 0) {
+        if (r < 0)
                 DMERR("Failed to register mirror target");
-                dm_dirty_log_exit();
-        }
 
         return r;
 }
@@ -1884,8 +1886,6 @@ static void __exit dm_mirror_exit(void)
         r = dm_unregister_target(&mirror_target);
         if (r < 0)
                 DMERR("unregister failed %d", r);
-
-        dm_dirty_log_exit();
 }
 
 /* Module hooks */
diff --git a/drivers/md/dm-snap.c b/drivers/md/dm-snap.c
index 4dc8a43c034b..1ba8a47d61b1 100644
--- a/drivers/md/dm-snap.c
+++ b/drivers/md/dm-snap.c
@@ -18,10 +18,10 @@
 #include <linux/slab.h>
 #include <linux/vmalloc.h>
 #include <linux/log2.h>
+#include <linux/dm-kcopyd.h>
 
 #include "dm-snap.h"
 #include "dm-bio-list.h"
-#include "kcopyd.h"
 
 #define DM_MSG_PREFIX "snapshots"
 
@@ -36,9 +36,9 @@
 #define SNAPSHOT_COPY_PRIORITY 2
 
 /*
- * Each snapshot reserves this many pages for io
+ * Reserve 1MB for each snapshot initially (with minimum of 1 page).
  */
-#define SNAPSHOT_PAGES 256
+#define SNAPSHOT_PAGES (((1UL << 20) >> PAGE_SHIFT) ? : 1)
 
 static struct workqueue_struct *ksnapd;
 static void flush_queued_bios(struct work_struct *work);
@@ -536,7 +536,7 @@ static int snapshot_ctr(struct dm_target *ti, unsigned int argc, char **argv)
         s->last_percent = 0;
         init_rwsem(&s->lock);
         spin_lock_init(&s->pe_lock);
-        s->table = ti->table;
+        s->ti = ti;
 
         /* Allocate hash table for COW data */
         if (init_hash_tables(s)) {
@@ -558,7 +558,7 @@ static int snapshot_ctr(struct dm_target *ti, unsigned int argc, char **argv)
                 goto bad4;
         }
 
-        r = kcopyd_client_create(SNAPSHOT_PAGES, &s->kcopyd_client);
+        r = dm_kcopyd_client_create(SNAPSHOT_PAGES, &s->kcopyd_client);
         if (r) {
                 ti->error = "Could not create kcopyd client";
                 goto bad5;
@@ -591,7 +591,7 @@ static int snapshot_ctr(struct dm_target *ti, unsigned int argc, char **argv)
         return 0;
 
  bad6:
-        kcopyd_client_destroy(s->kcopyd_client);
+        dm_kcopyd_client_destroy(s->kcopyd_client);
 
  bad5:
         s->store.destroy(&s->store);
@@ -613,7 +613,7 @@ static int snapshot_ctr(struct dm_target *ti, unsigned int argc, char **argv)
 
 static void __free_exceptions(struct dm_snapshot *s)
 {
-        kcopyd_client_destroy(s->kcopyd_client);
+        dm_kcopyd_client_destroy(s->kcopyd_client);
         s->kcopyd_client = NULL;
 
         exit_exception_table(&s->pending, pending_cache);
@@ -699,7 +699,7 @@ static void __invalidate_snapshot(struct dm_snapshot *s, int err)
 
         s->valid = 0;
 
-        dm_table_event(s->table);
+        dm_table_event(s->ti->table);
 }
 
 static void get_pending_exception(struct dm_snap_pending_exception *pe)
@@ -824,7 +824,7 @@ static void copy_callback(int read_err, unsigned long write_err, void *context)
 static void start_copy(struct dm_snap_pending_exception *pe)
 {
         struct dm_snapshot *s = pe->snap;
-        struct io_region src, dest;
+        struct dm_io_region src, dest;
         struct block_device *bdev = s->origin->bdev;
         sector_t dev_size;
 
@@ -839,7 +839,7 @@ static void start_copy(struct dm_snap_pending_exception *pe)
         dest.count = src.count;
 
         /* Hand over to kcopyd */
-        kcopyd_copy(s->kcopyd_client,
+        dm_kcopyd_copy(s->kcopyd_client,
                     &src, 1, &dest, 0, copy_callback, pe);
 }
 
@@ -1060,7 +1060,7 @@ static int __origin_write(struct list_head *snapshots, struct bio *bio)
                         goto next_snapshot;
 
                 /* Nothing to do if writing beyond end of snapshot */
-                if (bio->bi_sector >= dm_table_get_size(snap->table))
+                if (bio->bi_sector >= dm_table_get_size(snap->ti->table))
                         goto next_snapshot;
 
                 /*
diff --git a/drivers/md/dm-snap.h b/drivers/md/dm-snap.h
index 93bce5d49742..24f9fb73b982 100644
--- a/drivers/md/dm-snap.h
+++ b/drivers/md/dm-snap.h
@@ -132,7 +132,7 @@ struct exception_store {
 
 struct dm_snapshot {
         struct rw_semaphore lock;
-        struct dm_table *table;
+        struct dm_target *ti;
 
         struct dm_dev *origin;
         struct dm_dev *cow;
@@ -169,7 +169,7 @@ struct dm_snapshot {
         /* The on disk metadata handler */
         struct exception_store store;
 
-        struct kcopyd_client *kcopyd_client;
+        struct dm_kcopyd_client *kcopyd_client;
 
         /* Queue of snapshot writes for ksnapd to flush */
         struct bio_list queued_bios;
diff --git a/drivers/md/dm-table.c b/drivers/md/dm-table.c
index e75b1437b58b..51be53344214 100644
--- a/drivers/md/dm-table.c
+++ b/drivers/md/dm-table.c
@@ -245,44 +245,6 @@ int dm_table_create(struct dm_table **result, int mode,
         return 0;
 }
 
-int dm_create_error_table(struct dm_table **result, struct mapped_device *md)
-{
-        struct dm_table *t;
-        sector_t dev_size = 1;
-        int r;
-
-        /*
-         * Find current size of device.
-         * Default to 1 sector if inactive.
-         */
-        t = dm_get_table(md);
-        if (t) {
-                dev_size = dm_table_get_size(t);
-                dm_table_put(t);
-        }
-
-        r = dm_table_create(&t, FMODE_READ, 1, md);
-        if (r)
-                return r;
-
-        r = dm_table_add_target(t, "error", 0, dev_size, NULL);
-        if (r)
-                goto out;
-
-        r = dm_table_complete(t);
-        if (r)
-                goto out;
-
-        *result = t;
-
-out:
-        if (r)
-                dm_table_put(t);
-
-        return r;
-}
-EXPORT_SYMBOL_GPL(dm_create_error_table);
-
 static void free_devices(struct list_head *devices)
 {
         struct list_head *tmp, *next;
@@ -954,7 +916,7 @@ void dm_table_presuspend_targets(struct dm_table *t)
         if (!t)
                 return;
 
-        return suspend_targets(t, 0);
+        suspend_targets(t, 0);
 }
 
 void dm_table_postsuspend_targets(struct dm_table *t)
@@ -962,7 +924,7 @@ void dm_table_postsuspend_targets(struct dm_table *t)
         if (!t)
                 return;
 
-        return suspend_targets(t, 1);
+        suspend_targets(t, 1);
 }
 
 int dm_table_resume_targets(struct dm_table *t)
diff --git a/drivers/md/dm.c b/drivers/md/dm.c
index 6617ce4af095..372369b1cc20 100644
--- a/drivers/md/dm.c
+++ b/drivers/md/dm.c
@@ -204,6 +204,7 @@ static int (*_inits[])(void) __initdata = {
         dm_target_init,
         dm_linear_init,
         dm_stripe_init,
+        dm_kcopyd_init,
         dm_interface_init,
 };
 
@@ -212,6 +213,7 @@ static void (*_exits[])(void) = {
         dm_target_exit,
         dm_linear_exit,
         dm_stripe_exit,
+        dm_kcopyd_exit,
         dm_interface_exit,
 };
 
@@ -922,7 +924,7 @@ static void free_minor(int minor)
 /*
  * See if the device with a specific minor # is free.
  */
-static int specific_minor(struct mapped_device *md, int minor)
+static int specific_minor(int minor)
 {
         int r, m;
 
@@ -955,7 +957,7 @@ out:
         return r;
 }
 
-static int next_free_minor(struct mapped_device *md, int *minor)
+static int next_free_minor(int *minor)
 {
         int r, m;
 
@@ -966,9 +968,8 @@ static int next_free_minor(struct mapped_device *md, int *minor)
         spin_lock(&_minor_lock);
 
         r = idr_get_new(&_minor_idr, MINOR_ALLOCED, &m);
-        if (r) {
+        if (r)
                 goto out;
-        }
 
         if (m >= (1 << MINORBITS)) {
                 idr_remove(&_minor_idr, m);
@@ -991,7 +992,7 @@ static struct block_device_operations dm_blk_dops;
 static struct mapped_device *alloc_dev(int minor)
 {
         int r;
-        struct mapped_device *md = kmalloc(sizeof(*md), GFP_KERNEL);
+        struct mapped_device *md = kzalloc(sizeof(*md), GFP_KERNEL);
         void *old_md;
 
         if (!md) {
@@ -1004,13 +1005,12 @@ static struct mapped_device *alloc_dev(int minor)
 
         /* get a minor number for the dev */
         if (minor == DM_ANY_MINOR)
-                r = next_free_minor(md, &minor);
+                r = next_free_minor(&minor);
         else
-                r = specific_minor(md, minor);
+                r = specific_minor(minor);
         if (r < 0)
                 goto bad_minor;
 
-        memset(md, 0, sizeof(*md));
         init_rwsem(&md->io_lock);
         mutex_init(&md->suspend_lock);
         spin_lock_init(&md->pushback_lock);
diff --git a/drivers/md/dm.h b/drivers/md/dm.h
index b4584a39383b..8c03b634e62e 100644
--- a/drivers/md/dm.h
+++ b/drivers/md/dm.h
@@ -16,67 +16,6 @@
 #include <linux/blkdev.h>
 #include <linux/hdreg.h>
 
-#define DM_NAME "device-mapper"
-
-#define DMERR(f, arg...) \
-        printk(KERN_ERR DM_NAME ": " DM_MSG_PREFIX ": " f "\n", ## arg)
-#define DMERR_LIMIT(f, arg...) \
-        do { \
-                if (printk_ratelimit()) \
-                        printk(KERN_ERR DM_NAME ": " DM_MSG_PREFIX ": " \
-                               f "\n", ## arg); \
-        } while (0)
-
-#define DMWARN(f, arg...) \
-        printk(KERN_WARNING DM_NAME ": " DM_MSG_PREFIX ": " f "\n", ## arg)
-#define DMWARN_LIMIT(f, arg...) \
-        do { \
-                if (printk_ratelimit()) \
-                        printk(KERN_WARNING DM_NAME ": " DM_MSG_PREFIX ": " \
-                               f "\n", ## arg); \
-        } while (0)
-
-#define DMINFO(f, arg...) \
-        printk(KERN_INFO DM_NAME ": " DM_MSG_PREFIX ": " f "\n", ## arg)
-#define DMINFO_LIMIT(f, arg...) \
-        do { \
-                if (printk_ratelimit()) \
-                        printk(KERN_INFO DM_NAME ": " DM_MSG_PREFIX ": " f \
-                               "\n", ## arg); \
-        } while (0)
-
-#ifdef CONFIG_DM_DEBUG
-#  define DMDEBUG(f, arg...) \
-        printk(KERN_DEBUG DM_NAME ": " DM_MSG_PREFIX " DEBUG: " f "\n", ## arg)
-#  define DMDEBUG_LIMIT(f, arg...) \
-        do { \
-                if (printk_ratelimit()) \
-                        printk(KERN_DEBUG DM_NAME ": " DM_MSG_PREFIX ": " f \
-                               "\n", ## arg); \
-        } while (0)
-#else
-#  define DMDEBUG(f, arg...) do {} while (0)
-#  define DMDEBUG_LIMIT(f, arg...) do {} while (0)
-#endif
-
-#define DMEMIT(x...) sz += ((sz >= maxlen) ? \
-                          0 : scnprintf(result + sz, maxlen - sz, x))
-
-#define SECTOR_SHIFT 9
-
-/*
- * Definitions of return values from target end_io function.
- */
-#define DM_ENDIO_INCOMPLETE     1
-#define DM_ENDIO_REQUEUE        2
-
-/*
- * Definitions of return values from target map function.
- */
-#define DM_MAPIO_SUBMITTED      0
-#define DM_MAPIO_REMAPPED       1
-#define DM_MAPIO_REQUEUE        DM_ENDIO_REQUEUE
-
 /*
  * Suspend feature flags
  */
@@ -136,34 +75,6 @@ static inline int array_too_big(unsigned long fixed, unsigned long obj,
         return (num > (ULONG_MAX - fixed) / obj);
 }
 
-/*
- * Ceiling(n / sz)
- */
-#define dm_div_up(n, sz) (((n) + (sz) - 1) / (sz))
-
-#define dm_sector_div_up(n, sz) ( \
-{ \
-        sector_t _r = ((n) + (sz) - 1); \
-        sector_div(_r, (sz)); \
-        _r; \
-} \
-)
-
-/*
- * ceiling(n / size) * size
- */
-#define dm_round_up(n, sz) (dm_div_up((n), (sz)) * (sz))
-
-static inline sector_t to_sector(unsigned long n)
-{
-        return (n >> 9);
-}
-
-static inline unsigned long to_bytes(sector_t n)
-{
-        return (n << 9);
-}
-
 int dm_split_args(int *argc, char ***argvp, char *input);
 
 /*
@@ -189,4 +100,13 @@ int dm_lock_for_deletion(struct mapped_device *md);
 
 void dm_kobject_uevent(struct mapped_device *md);
 
+/*
+ * Dirty log
+ */
+int dm_dirty_log_init(void);
+void dm_dirty_log_exit(void);
+
+int dm_kcopyd_init(void);
+void dm_kcopyd_exit(void);
+
 #endif
diff --git a/drivers/md/kcopyd.h b/drivers/md/kcopyd.h
deleted file mode 100644
index 4845f2a0c676..000000000000
--- a/drivers/md/kcopyd.h
+++ /dev/null
@@ -1,42 +0,0 @@
-/*
- * Copyright (C) 2001 Sistina Software
- *
- * This file is released under the GPL.
- *
- * Kcopyd provides a simple interface for copying an area of one
- * block-device to one or more other block-devices, with an asynchronous
- * completion notification.
- */
-
-#ifndef DM_KCOPYD_H
-#define DM_KCOPYD_H
-
-#include "dm-io.h"
-
-/* FIXME: make this configurable */
-#define KCOPYD_MAX_REGIONS 8
-
-#define KCOPYD_IGNORE_ERROR 1
-
-/*
- * To use kcopyd you must first create a kcopyd client object.
- */
-struct kcopyd_client;
-int kcopyd_client_create(unsigned int num_pages, struct kcopyd_client **result);
-void kcopyd_client_destroy(struct kcopyd_client *kc);
-
-/*
- * Submit a copy job to kcopyd.  This is built on top of the
- * previous three fns.
- *
- * read_err is a boolean,
- * write_err is a bitset, with 1 bit for each destination region
- */
-typedef void (*kcopyd_notify_fn)(int read_err, unsigned long write_err,
-                                 void *context);
-
-int kcopyd_copy(struct kcopyd_client *kc, struct io_region *from,
-                unsigned int num_dests, struct io_region *dests,
-                unsigned int flags, kcopyd_notify_fn fn, void *context);
-
-#endif
diff --git a/drivers/mtd/Kconfig b/drivers/mtd/Kconfig
index e8503341e3b1..eed06d068fd1 100644
--- a/drivers/mtd/Kconfig
+++ b/drivers/mtd/Kconfig
@@ -158,6 +158,12 @@ config MTD_OF_PARTS
           the partition map from the children of the flash node,
           as described in Documentation/powerpc/booting-without-of.txt.
 
+config MTD_AR7_PARTS
+        tristate "TI AR7 partitioning support"
+        depends on MTD_PARTITIONS
+        ---help---
+          TI AR7 partitioning support
+
 comment "User Modules And Translation Layers"
 
 config MTD_CHAR
diff --git a/drivers/mtd/Makefile b/drivers/mtd/Makefile
index 538e33d11d46..4b77335715f0 100644
--- a/drivers/mtd/Makefile
+++ b/drivers/mtd/Makefile
@@ -11,6 +11,7 @@ obj-$(CONFIG_MTD_CONCAT)	+= mtdconcat.o
 obj-$(CONFIG_MTD_REDBOOT_PARTS) += redboot.o
 obj-$(CONFIG_MTD_CMDLINE_PARTS) += cmdlinepart.o
 obj-$(CONFIG_MTD_AFS_PARTS)     += afs.o
+obj-$(CONFIG_MTD_AR7_PARTS)     += ar7part.o
 obj-$(CONFIG_MTD_OF_PARTS)      += ofpart.o
 
 # 'Users' - code which presents functionality to userspace.
diff --git a/drivers/mtd/ar7part.c b/drivers/mtd/ar7part.c
new file mode 100644
index 000000000000..ecf170b55c32
--- /dev/null
+++ b/drivers/mtd/ar7part.c
@@ -0,0 +1,151 @@
+/*
+ * Copyright © 2007 Eugene Konev <ejka@openwrt.org>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
+ *
+ * TI AR7 flash partition table.
+ * Based on ar7 map by Felix Fietkau <nbd@openwrt.org>
+ *
+ */
+
+#include <linux/kernel.h>
+#include <linux/slab.h>
+
+#include <linux/mtd/mtd.h>
+#include <linux/mtd/partitions.h>
+#include <linux/bootmem.h>
+#include <linux/magic.h>
+
+#define AR7_PARTS       4
+#define ROOT_OFFSET     0xe0000
+
+#define LOADER_MAGIC1   le32_to_cpu(0xfeedfa42)
+#define LOADER_MAGIC2   le32_to_cpu(0xfeed1281)
+
+#ifndef SQUASHFS_MAGIC
+#define SQUASHFS_MAGIC  0x73717368
+#endif
+
+struct ar7_bin_rec {
+        unsigned int checksum;
+        unsigned int length;
+        unsigned int address;
+};
+
+static struct mtd_partition ar7_parts[AR7_PARTS];
+
+static int create_mtd_partitions(struct mtd_info *master,
+                                 struct mtd_partition **pparts,
+                                 unsigned long origin)
+{
+        struct ar7_bin_rec header;
+        unsigned int offset;
+        size_t len;
+        unsigned int pre_size = master->erasesize, post_size = 0;
+        unsigned int root_offset = ROOT_OFFSET;
+
+        int retries = 10;
+
+        ar7_parts[0].name = "loader";
+        ar7_parts[0].offset = 0;
+        ar7_parts[0].size = master->erasesize;
+        ar7_parts[0].mask_flags = MTD_WRITEABLE;
+
+        ar7_parts[1].name = "config";
+        ar7_parts[1].offset = 0;
+        ar7_parts[1].size = master->erasesize;
+        ar7_parts[1].mask_flags = 0;
+
+        do { /* Try 10 blocks starting from master->erasesize */
+                offset = pre_size;
+                master->read(master, offset,
+                             sizeof(header), &len, (uint8_t *)&header);
+                if (!strncmp((char *)&header, "TIENV0.8", 8))
+                        ar7_parts[1].offset = pre_size;
+                if (header.checksum == LOADER_MAGIC1)
+                        break;
+                if (header.checksum == LOADER_MAGIC2)
+                        break;
+                pre_size += master->erasesize;
+        } while (retries--);
+
+        pre_size = offset;
+
+        if (!ar7_parts[1].offset) {
+                ar7_parts[1].offset = master->size - master->erasesize;
+                post_size = master->erasesize;
+        }
+
+        switch (header.checksum) {
+        case LOADER_MAGIC1:
+                while (header.length) {
+                        offset += sizeof(header) + header.length;
+                        master->read(master, offset, sizeof(header),
+                                     &len, (uint8_t *)&header);
+                }
+                root_offset = offset + sizeof(header) + 4;
+                break;
+        case LOADER_MAGIC2:
+                while (header.length) {
+                        offset += sizeof(header) + header.length;
+                        master->read(master, offset, sizeof(header),
+                                     &len, (uint8_t *)&header);
+                }
+                root_offset = offset + sizeof(header) + 4 + 0xff;
+                root_offset &= ~(uint32_t)0xff;
+                break;
+        default:
+                printk(KERN_WARNING "Unknown magic: %08x\n", header.checksum);
+                break;
+        }
+
+        master->read(master, root_offset,
+                sizeof(header), &len, (u8 *)&header);
+        if (header.checksum != SQUASHFS_MAGIC) {
+                root_offset += master->erasesize - 1;
+                root_offset &= ~(master->erasesize - 1);
+        }
+
+        ar7_parts[2].name = "linux";
+        ar7_parts[2].offset = pre_size;
+        ar7_parts[2].size = master->size - pre_size - post_size;
+        ar7_parts[2].mask_flags = 0;
+
+        ar7_parts[3].name = "rootfs";
+        ar7_parts[3].offset = root_offset;
+        ar7_parts[3].size = master->size - root_offset - post_size;
+        ar7_parts[3].mask_flags = 0;
+
+        *pparts = ar7_parts;
+        return AR7_PARTS;
+}
+
+static struct mtd_part_parser ar7_parser = {
+        .owner = THIS_MODULE,
+        .parse_fn = create_mtd_partitions,
+        .name = "ar7part",
+};
+
+static int __init ar7_parser_init(void)
+{
+        return register_mtd_parser(&ar7_parser);
+}
+
+module_init(ar7_parser_init);
+
+MODULE_LICENSE("GPL");
+MODULE_AUTHOR(  "Felix Fietkau <nbd@openwrt.org>, "
+                "Eugene Konev <ejka@openwrt.org>");
+MODULE_DESCRIPTION("MTD partitioning for TI AR7");
diff --git a/drivers/mtd/chips/cfi_cmdset_0001.c b/drivers/mtd/chips/cfi_cmdset_0001.c
index 0080452531d6..e812df607a5c 100644
--- a/drivers/mtd/chips/cfi_cmdset_0001.c
+++ b/drivers/mtd/chips/cfi_cmdset_0001.c
@@ -384,7 +384,7 @@ read_pri_intelext(struct map_info *map, __u16 adr)
                         if (extp_size > 4096) {
                                 printk(KERN_ERR
                                         "%s: cfi_pri_intelext is too fat\n",
-                                        __FUNCTION__);
+                                        __func__);
                                 return NULL;
                         }
                         goto again;
@@ -619,6 +619,9 @@ static int cfi_intelext_partition_fixup(struct mtd_info *mtd,
                                   sizeof(struct cfi_intelext_blockinfo);
                 }
 
+                if (!numparts)
+                        numparts = 1;
+
                 /* Programming Region info */
                 if (extp->MinorVersion >= '4') {
                         struct cfi_intelext_programming_regioninfo *prinfo;
@@ -641,7 +644,7 @@ static int cfi_intelext_partition_fixup(struct mtd_info *mtd,
                 if ((1 << partshift) < mtd->erasesize) {
                         printk( KERN_ERR
                                 "%s: bad number of hw partitions (%d)\n",
-                                __FUNCTION__, numparts);
+                                __func__, numparts);
                         return -EINVAL;
                 }
 
@@ -1071,10 +1074,10 @@ static int __xipram xip_wait_for_operation(
                         chip->state = newstate;
                         map_write(map, CMD(0xff), adr);
                         (void) map_read(map, adr);
-                        asm volatile (".rep 8; nop; .endr");
+                        xip_iprefetch();
                         local_irq_enable();
                         spin_unlock(chip->mutex);
-                        asm volatile (".rep 8; nop; .endr");
+                        xip_iprefetch();
                         cond_resched();
 
                         /*
@@ -2013,7 +2016,7 @@ static int cfi_intelext_lock(struct mtd_info *mtd, loff_t ofs, size_t len)
 
 #ifdef DEBUG_LOCK_BITS
         printk(KERN_DEBUG "%s: lock status before, ofs=0x%08llx, len=0x%08X\n",
-               __FUNCTION__, ofs, len);
+               __func__, ofs, len);
         cfi_varsize_frob(mtd, do_printlockstatus_oneblock,
                 ofs, len, NULL);
 #endif
@@ -2023,7 +2026,7 @@ static int cfi_intelext_lock(struct mtd_info *mtd, loff_t ofs, size_t len)
 
 #ifdef DEBUG_LOCK_BITS
         printk(KERN_DEBUG "%s: lock status after, ret=%d\n",
-               __FUNCTION__, ret);
+               __func__, ret);
         cfi_varsize_frob(mtd, do_printlockstatus_oneblock,
                 ofs, len, NULL);
 #endif
@@ -2037,7 +2040,7 @@ static int cfi_intelext_unlock(struct mtd_info *mtd, loff_t ofs, size_t len)
 
 #ifdef DEBUG_LOCK_BITS
         printk(KERN_DEBUG "%s: lock status before, ofs=0x%08llx, len=0x%08X\n",
-               __FUNCTION__, ofs, len);
+               __func__, ofs, len);
         cfi_varsize_frob(mtd, do_printlockstatus_oneblock,
                 ofs, len, NULL);
 #endif
@@ -2047,7 +2050,7 @@ static int cfi_intelext_unlock(struct mtd_info *mtd, loff_t ofs, size_t len)
 
 #ifdef DEBUG_LOCK_BITS
         printk(KERN_DEBUG "%s: lock status after, ret=%d\n",
-               __FUNCTION__, ret);
+               __func__, ret);
         cfi_varsize_frob(mtd, do_printlockstatus_oneblock,
                 ofs, len, NULL);
 #endif
diff --git a/drivers/mtd/chips/cfi_cmdset_0002.c b/drivers/mtd/chips/cfi_cmdset_0002.c
index 458d477614d6..f7fcc6389533 100644
--- a/drivers/mtd/chips/cfi_cmdset_0002.c
+++ b/drivers/mtd/chips/cfi_cmdset_0002.c
@@ -220,6 +220,28 @@ static void fixup_use_atmel_lock(struct mtd_info *mtd, void *param)
         mtd->flags |= MTD_POWERUP_LOCK;
 }
 
+static void fixup_s29gl064n_sectors(struct mtd_info *mtd, void *param)
+{
+        struct map_info *map = mtd->priv;
+        struct cfi_private *cfi = map->fldrv_priv;
+
+        if ((cfi->cfiq->EraseRegionInfo[0] & 0xffff) == 0x003f) {
+                cfi->cfiq->EraseRegionInfo[0] |= 0x0040;
+                pr_warning("%s: Bad S29GL064N CFI data, adjust from 64 to 128 sectors\n", mtd->name);
+        }
+}
+
+static void fixup_s29gl032n_sectors(struct mtd_info *mtd, void *param)
+{
+        struct map_info *map = mtd->priv;
+        struct cfi_private *cfi = map->fldrv_priv;
+
+        if ((cfi->cfiq->EraseRegionInfo[1] & 0xffff) == 0x007e) {
+                cfi->cfiq->EraseRegionInfo[1] &= ~0x0040;
+                pr_warning("%s: Bad S29GL032N CFI data, adjust from 127 to 63 sectors\n", mtd->name);
+        }
+}
+
 static struct cfi_fixup cfi_fixup_table[] = {
         { CFI_MFR_ATMEL, CFI_ID_ANY, fixup_convert_atmel_pri, NULL },
 #ifdef AMD_BOOTLOC_BUG
@@ -231,6 +253,10 @@ static struct cfi_fixup cfi_fixup_table[] = {
         { CFI_MFR_AMD, 0x0056, fixup_use_secsi, NULL, },
         { CFI_MFR_AMD, 0x005C, fixup_use_secsi, NULL, },
         { CFI_MFR_AMD, 0x005F, fixup_use_secsi, NULL, },
+        { CFI_MFR_AMD, 0x0c01, fixup_s29gl064n_sectors, NULL, },
+        { CFI_MFR_AMD, 0x1301, fixup_s29gl064n_sectors, NULL, },
+        { CFI_MFR_AMD, 0x1a00, fixup_s29gl032n_sectors, NULL, },
+        { CFI_MFR_AMD, 0x1a01, fixup_s29gl032n_sectors, NULL, },
 #if !FORCE_WORD_WRITE
         { CFI_MFR_ANY, CFI_ID_ANY, fixup_use_write_buffers, NULL, },
 #endif
@@ -723,10 +749,10 @@ static void __xipram xip_udelay(struct map_info *map, struct flchip *chip,
                         chip->erase_suspended = 1;
                         map_write(map, CMD(0xf0), adr);
                         (void) map_read(map, adr);
-                        asm volatile (".rep 8; nop; .endr");
+                        xip_iprefetch();
                         local_irq_enable();
                         spin_unlock(chip->mutex);
-                        asm volatile (".rep 8; nop; .endr");
+                        xip_iprefetch();
                         cond_resched();
 
                         /*
diff --git a/drivers/mtd/chips/cfi_cmdset_0020.c b/drivers/mtd/chips/cfi_cmdset_0020.c
index 492e2ab27420..1b720cc571f3 100644
--- a/drivers/mtd/chips/cfi_cmdset_0020.c
+++ b/drivers/mtd/chips/cfi_cmdset_0020.c
@@ -445,7 +445,7 @@ static inline int do_write_buffer(struct map_info *map, struct flchip *chip,
  retry:
 
 #ifdef DEBUG_CFI_FEATURES
-       printk("%s: chip->state[%d]\n", __FUNCTION__, chip->state);
+       printk("%s: chip->state[%d]\n", __func__, chip->state);
 #endif
         spin_lock_bh(chip->mutex);
 
@@ -463,7 +463,7 @@ static inline int do_write_buffer(struct map_info *map, struct flchip *chip,
                 map_write(map, CMD(0x70), cmd_adr);
                 chip->state = FL_STATUS;
 #ifdef DEBUG_CFI_FEATURES
-        printk("%s: 1 status[%x]\n", __FUNCTION__, map_read(map, cmd_adr));
+        printk("%s: 1 status[%x]\n", __func__, map_read(map, cmd_adr));
 #endif
 
         case FL_STATUS:
@@ -591,7 +591,7 @@ static inline int do_write_buffer(struct map_info *map, struct flchip *chip,
         /* check for errors: 'lock bit', 'VPP', 'dead cell'/'unerased cell' or 'incorrect cmd' -- saw */
         if (map_word_bitsset(map, status, CMD(0x3a))) {
 #ifdef DEBUG_CFI_FEATURES
-                printk("%s: 2 status[%lx]\n", __FUNCTION__, status.x[0]);
+                printk("%s: 2 status[%lx]\n", __func__, status.x[0]);
 #endif
                 /* clear status */
                 map_write(map, CMD(0x50), cmd_adr);
@@ -625,9 +625,9 @@ static int cfi_staa_write_buffers (struct mtd_info *mtd, loff_t to,
         ofs = to  - (chipnum << cfi->chipshift);
 
 #ifdef DEBUG_CFI_FEATURES
-        printk("%s: map_bankwidth(map)[%x]\n", __FUNCTION__, map_bankwidth(map));
-        printk("%s: chipnum[%x] wbufsize[%x]\n", __FUNCTION__, chipnum, wbufsize);
-        printk("%s: ofs[%x] len[%x]\n", __FUNCTION__, ofs, len);
+        printk("%s: map_bankwidth(map)[%x]\n", __func__, map_bankwidth(map));
+        printk("%s: chipnum[%x] wbufsize[%x]\n", __func__, chipnum, wbufsize);
+        printk("%s: ofs[%x] len[%x]\n", __func__, ofs, len);
 #endif
 
         /* Write buffer is worth it only if more than one word to write... */
@@ -893,7 +893,8 @@ retry:
         return ret;
 }
 
-int cfi_staa_erase_varsize(struct mtd_info *mtd, struct erase_info *instr)
+static int cfi_staa_erase_varsize(struct mtd_info *mtd,
+                                  struct erase_info *instr)
 {       struct map_info *map = mtd->priv;
         struct cfi_private *cfi = map->fldrv_priv;
         unsigned long adr, len;
diff --git a/drivers/mtd/chips/cfi_probe.c b/drivers/mtd/chips/cfi_probe.c
index f651b6ef1c5d..a4463a91ce31 100644
--- a/drivers/mtd/chips/cfi_probe.c
+++ b/drivers/mtd/chips/cfi_probe.c
@@ -39,7 +39,7 @@ struct mtd_info *cfi_probe(struct map_info *map);
 #define xip_allowed(base, map) \
 do { \
         (void) map_read(map, base); \
-        asm volatile (".rep 8; nop; .endr"); \
+        xip_iprefetch(); \
         local_irq_enable(); \
 } while (0)
 
@@ -232,6 +232,11 @@ static int __xipram cfi_chip_setup(struct map_info *map,
         cfi->mfr = cfi_read_query16(map, base);
         cfi->id = cfi_read_query16(map, base + ofs_factor);
 
+        /* Get AMD/Spansion extended JEDEC ID */
+        if (cfi->mfr == CFI_MFR_AMD && (cfi->id & 0xff) == 0x7e)
+                cfi->id = cfi_read_query(map, base + 0xe * ofs_factor) << 8 |
+                          cfi_read_query(map, base + 0xf * ofs_factor);
+
         /* Put it back into Read Mode */
         cfi_send_gen_cmd(0xF0, 0, base, map, cfi, cfi->device_type, NULL);
         /* ... even if it's an Intel chip */
diff --git a/drivers/mtd/chips/cfi_util.c b/drivers/mtd/chips/cfi_util.c
index 2e51496c248e..72e0022a47bf 100644
--- a/drivers/mtd/chips/cfi_util.c
+++ b/drivers/mtd/chips/cfi_util.c
@@ -65,7 +65,7 @@ __xipram cfi_read_pri(struct map_info *map, __u16 adr, __u16 size, const char* n
 
 #ifdef CONFIG_MTD_XIP
         (void) map_read(map, base);
-        asm volatile (".rep 8; nop; .endr");
+        xip_iprefetch();
         local_irq_enable();
 #endif
 
diff --git a/drivers/mtd/chips/jedec_probe.c b/drivers/mtd/chips/jedec_probe.c
index 4be51a86a85c..aa07575eb288 100644
--- a/drivers/mtd/chips/jedec_probe.c
+++ b/drivers/mtd/chips/jedec_probe.c
@@ -132,6 +132,8 @@
 #define M29F800AB       0x0058
 #define M29W800DT       0x00D7
 #define M29W800DB       0x005B
+#define M29W400DT       0x00EE
+#define M29W400DB       0x00EF
 #define M29W160DT       0x22C4
 #define M29W160DB       0x2249
 #define M29W040B        0x00E3
@@ -160,6 +162,7 @@
 #define SST49LF030A     0x001C
 #define SST49LF040A     0x0051
 #define SST49LF080A     0x005B
+#define SST36VF3203     0x7354
 
 /* Toshiba */
 #define TC58FVT160      0x00C2
@@ -1113,7 +1116,7 @@ static const struct amd_flash_info jedec_table[] = {
                 .regions        = {
                         ERASEINFO(0x10000,8),
                 }
-        }, {
+        }, {
                 .mfr_id         = MANUFACTURER_MACRONIX,
                 .dev_id         = MX29F016,
                 .name           = "Macronix MX29F016",
@@ -1125,7 +1128,7 @@ static const struct amd_flash_info jedec_table[] = {
                 .regions        = {
                         ERASEINFO(0x10000,32),
                 }
-        }, {
+        }, {
                 .mfr_id         = MANUFACTURER_MACRONIX,
                 .dev_id         = MX29F004T,
                 .name           = "Macronix MX29F004T",
@@ -1140,7 +1143,7 @@ static const struct amd_flash_info jedec_table[] = {
                         ERASEINFO(0x02000,2),
                         ERASEINFO(0x04000,1),
                 }
-        }, {
+        }, {
                 .mfr_id         = MANUFACTURER_MACRONIX,
                 .dev_id         = MX29F004B,
                 .name           = "Macronix MX29F004B",
@@ -1218,7 +1221,7 @@ static const struct amd_flash_info jedec_table[] = {
                 .regions        = {
                         ERASEINFO(0x40000,16),
                 }
-        }, {
+        }, {
                 .mfr_id         = MANUFACTURER_SST,
                 .dev_id         = SST39LF512,
                 .name           = "SST 39LF512",
@@ -1230,7 +1233,7 @@ static const struct amd_flash_info jedec_table[] = {
                 .regions        = {
                         ERASEINFO(0x01000,16),
                 }
-        }, {
+        }, {
                 .mfr_id         = MANUFACTURER_SST,
                 .dev_id         = SST39LF010,
                 .name           = "SST 39LF010",
@@ -1242,7 +1245,7 @@ static const struct amd_flash_info jedec_table[] = {
                 .regions        = {
                         ERASEINFO(0x01000,32),
                 }
-        }, {
+        }, {
                 .mfr_id         = MANUFACTURER_SST,
                 .dev_id         = SST29EE020,
                 .name           = "SST 29EE020",
@@ -1276,7 +1279,7 @@ static const struct amd_flash_info jedec_table[] = {
                 .regions        = {
                         ERASEINFO(0x01000,64),
                 }
-        }, {
+        }, {
                 .mfr_id         = MANUFACTURER_SST,
                 .dev_id         = SST39LF040,
                 .name           = "SST 39LF040",
@@ -1288,7 +1291,7 @@ static const struct amd_flash_info jedec_table[] = {
                 .regions        = {
                         ERASEINFO(0x01000,128),
                 }
-        }, {
+        }, {
                 .mfr_id         = MANUFACTURER_SST,
                 .dev_id         = SST39SF010A,
                 .name           = "SST 39SF010A",
@@ -1300,7 +1303,7 @@ static const struct amd_flash_info jedec_table[] = {
                 .regions        = {
                         ERASEINFO(0x01000,32),
                 }
-        }, {
+        }, {
                 .mfr_id         = MANUFACTURER_SST,
                 .dev_id         = SST39SF020A,
                 .name           = "SST 39SF020A",
@@ -1412,6 +1415,18 @@ static const struct amd_flash_info jedec_table[] = {
                         ERASEINFO(0x1000,256)
                 }
         }, {
+                .mfr_id         = MANUFACTURER_SST,
+                .dev_id         = SST36VF3203,
+                .name           = "SST 36VF3203",
+                .devtypes       = CFI_DEVICETYPE_X16|CFI_DEVICETYPE_X8,
+                .uaddr          = MTD_UADDR_0x0AAA_0x0555,
+                .dev_size       = SIZE_4MiB,
+                .cmd_set        = P_ID_AMD_STD,
+                .nr_regions     = 1,
+                .regions        = {
+                        ERASEINFO(0x10000,64),
+                }
+        }, {
                 .mfr_id         = MANUFACTURER_ST,
                 .dev_id         = M29F800AB,
                 .name           = "ST M29F800AB",
@@ -1426,7 +1441,7 @@ static const struct amd_flash_info jedec_table[] = {
                         ERASEINFO(0x08000,1),
                         ERASEINFO(0x10000,15),
                 }
-       }, {
+        }, {
                 .mfr_id         = MANUFACTURER_ST,      /* FIXME - CFI device? */
                 .dev_id         = M29W800DT,
                 .name           = "ST M29W800DT",
@@ -1456,6 +1471,36 @@ static const struct amd_flash_info jedec_table[] = {
                         ERASEINFO(0x08000,1),
                         ERASEINFO(0x10000,15)
                 }
+        },  {
+                .mfr_id         = MANUFACTURER_ST,
+                .dev_id         = M29W400DT,
+                .name           = "ST M29W400DT",
+                .devtypes       = CFI_DEVICETYPE_X16|CFI_DEVICETYPE_X8,
+                .uaddr          = MTD_UADDR_0x0AAA_0x0555,
+                .dev_size       = SIZE_512KiB,
+                .cmd_set        = P_ID_AMD_STD,
+                .nr_regions     = 4,
+                .regions        = {
+                        ERASEINFO(0x04000,7),
+                        ERASEINFO(0x02000,1),
+                        ERASEINFO(0x08000,2),
+                        ERASEINFO(0x10000,1)
+                }
+        }, {
+                .mfr_id         = MANUFACTURER_ST,
+                .dev_id         = M29W400DB,
+                .name           = "ST M29W400DB",
+                .devtypes       = CFI_DEVICETYPE_X16|CFI_DEVICETYPE_X8,
+                .uaddr          = MTD_UADDR_0x0AAA_0x0555,
+                .dev_size       = SIZE_512KiB,
+                .cmd_set        = P_ID_AMD_STD,
+                .nr_regions     = 4,
+                .regions        = {
+                        ERASEINFO(0x04000,1),
+                        ERASEINFO(0x02000,2),
+                        ERASEINFO(0x08000,1),
+                        ERASEINFO(0x10000,7)
+                }
         }, {
                 .mfr_id         = MANUFACTURER_ST,      /* FIXME - CFI device? */
                 .dev_id         = M29W160DT,
@@ -1486,7 +1531,7 @@ static const struct amd_flash_info jedec_table[] = {
                         ERASEINFO(0x08000,1),
                         ERASEINFO(0x10000,31)
                 }
-        }, {
+        }, {
                 .mfr_id         = MANUFACTURER_ST,
                 .dev_id         = M29W040B,
                 .name           = "ST M29W040B",
@@ -1498,7 +1543,7 @@ static const struct amd_flash_info jedec_table[] = {
                 .regions        = {
                         ERASEINFO(0x10000,8),
                 }
-        }, {
+        }, {
                 .mfr_id         = MANUFACTURER_ST,
                 .dev_id         = M50FW040,
                 .name           = "ST M50FW040",
@@ -1510,7 +1555,7 @@ static const struct amd_flash_info jedec_table[] = {
                 .regions        = {
                         ERASEINFO(0x10000,8),
                 }
-        }, {
+        }, {
                 .mfr_id         = MANUFACTURER_ST,
                 .dev_id         = M50FW080,
                 .name           = "ST M50FW080",
@@ -1522,7 +1567,7 @@ static const struct amd_flash_info jedec_table[] = {
                 .regions        = {
                         ERASEINFO(0x10000,16),
                 }
-        }, {
+        }, {
                 .mfr_id         = MANUFACTURER_ST,
                 .dev_id         = M50FW016,
                 .name           = "ST M50FW016",
diff --git a/drivers/mtd/cmdlinepart.c b/drivers/mtd/cmdlinepart.c
index b44292abd9f7..e472a0e9de9d 100644
--- a/drivers/mtd/cmdlinepart.c
+++ b/drivers/mtd/cmdlinepart.c
@@ -119,7 +119,8 @@ static struct mtd_partition * newpart(char *s,
                 char *p;
 
                 name = ++s;
-                if ((p = strchr(name, delim)) == 0)
+                p = strchr(name, delim);
+                if (!p)
                 {
                         printk(KERN_ERR ERRP "no closing %c found in partition name\n", delim);
                         return NULL;
@@ -159,9 +160,10 @@ static struct mtd_partition * newpart(char *s,
                         return NULL;
                 }
                 /* more partitions follow, parse them */
-                if ((parts = newpart(s + 1, &s, num_parts,
-                                     this_part + 1, &extra_mem, extra_mem_size)) == 0)
-                  return NULL;
+                parts = newpart(s + 1, &s, num_parts, this_part + 1,
+                                &extra_mem, extra_mem_size);
+                if (!parts)
+                        return NULL;
         }
         else
         {       /* this is the last partition: allocate space for all */
@@ -308,9 +310,6 @@ static int parse_cmdline_partitions(struct mtd_info *master,
         struct cmdline_mtd_partition *part;
         char *mtd_id = master->name;
 
-        if(!cmdline)
-                return -EINVAL;
-
         /* parse command line */
         if (!cmdline_parsed)
                 mtdpart_setup_real(cmdline);
@@ -341,7 +340,7 @@ static int parse_cmdline_partitions(struct mtd_info *master,
                         return part->num_parts;
                 }
         }
-        return -EINVAL;
+        return 0;
 }
 
 
diff --git a/drivers/mtd/devices/Kconfig b/drivers/mtd/devices/Kconfig
index 811d56fd890f..35ed1103dbb2 100644
--- a/drivers/mtd/devices/Kconfig
+++ b/drivers/mtd/devices/Kconfig
@@ -77,6 +77,13 @@ config MTD_M25P80
           if you want to specify device partitioning or to use a device which
           doesn't support the JEDEC ID instruction.
 
+config M25PXX_USE_FAST_READ
+        bool "Use FAST_READ OPCode allowing SPI CLK <= 50MHz"
+        depends on MTD_M25P80
+        default y
+        help
+          This option enables FAST_READ access supported by ST M25Pxx.
+
 config MTD_SLRAM
         tristate "Uncached system RAM"
         help
diff --git a/drivers/mtd/devices/block2mtd.c b/drivers/mtd/devices/block2mtd.c
index ad1880c67518..519d942e7940 100644
--- a/drivers/mtd/devices/block2mtd.c
+++ b/drivers/mtd/devices/block2mtd.c
@@ -305,7 +305,7 @@ static struct block2mtd_dev *add_device(char *devname, int erase_size)
         }
         list_add(&dev->list, &blkmtd_device_list);
         INFO("mtd%d: [%s] erase_size = %dKiB [%d]", dev->mtd.index,
-                        dev->mtd.name + strlen("blkmtd: "),
+                        dev->mtd.name + strlen("block2mtd: "),
                         dev->mtd.erasesize >> 10, dev->mtd.erasesize);
         return dev;
 
@@ -366,9 +366,9 @@ static inline void kill_final_newline(char *str)
 }
 
 
-#define parse_err(fmt, args...) do {            \
-        ERROR("block2mtd: " fmt "\n", ## args); \
-        return 0;                               \
+#define parse_err(fmt, args...) do {    \
+        ERROR(fmt, ## args);            \
+        return 0;                       \
 } while (0)
 
 #ifndef MODULE
@@ -473,7 +473,7 @@ static void __devexit block2mtd_exit(void)
                 block2mtd_sync(&dev->mtd);
                 del_mtd_device(&dev->mtd);
                 INFO("mtd%d: [%s] removed", dev->mtd.index,
-                                dev->mtd.name + strlen("blkmtd: "));
+                                dev->mtd.name + strlen("block2mtd: "));
                 list_del(&dev->list);
                 block2mtd_free_device(dev);
         }
diff --git a/drivers/mtd/devices/lart.c b/drivers/mtd/devices/lart.c
index 99fd210feaec..1d324e5c412d 100644
--- a/drivers/mtd/devices/lart.c
+++ b/drivers/mtd/devices/lart.c
@@ -275,7 +275,7 @@ static __u8 read8 (__u32 offset)
 {
    volatile __u8 *data = (__u8 *) (FLASH_OFFSET + offset);
 #ifdef LART_DEBUG
-   printk (KERN_DEBUG "%s(): 0x%.8x -> 0x%.2x\n",__FUNCTION__,offset,*data);
+   printk (KERN_DEBUG "%s(): 0x%.8x -> 0x%.2x\n", __func__, offset, *data);
 #endif
    return (*data);
 }
@@ -284,7 +284,7 @@ static __u32 read32 (__u32 offset)
 {
    volatile __u32 *data = (__u32 *) (FLASH_OFFSET + offset);
 #ifdef LART_DEBUG
-   printk (KERN_DEBUG "%s(): 0x%.8x -> 0x%.8x\n",__FUNCTION__,offset,*data);
+   printk (KERN_DEBUG "%s(): 0x%.8x -> 0x%.8x\n", __func__, offset, *data);
 #endif
    return (*data);
 }
@@ -294,7 +294,7 @@ static void write32 (__u32 x,__u32 offset)
    volatile __u32 *data = (__u32 *) (FLASH_OFFSET + offset);
    *data = x;
 #ifdef LART_DEBUG
-   printk (KERN_DEBUG "%s(): 0x%.8x <- 0x%.8x\n",__FUNCTION__,offset,*data);
+   printk (KERN_DEBUG "%s(): 0x%.8x <- 0x%.8x\n", __func__, offset, *data);
 #endif
 }
 
@@ -337,7 +337,7 @@ static inline int erase_block (__u32 offset)
    __u32 status;
 
 #ifdef LART_DEBUG
-   printk (KERN_DEBUG "%s(): 0x%.8x\n",__FUNCTION__,offset);
+   printk (KERN_DEBUG "%s(): 0x%.8x\n", __func__, offset);
 #endif
 
    /* erase and confirm */
@@ -371,7 +371,7 @@ static int flash_erase (struct mtd_info *mtd,struct erase_info *instr)
    int i,first;
 
 #ifdef LART_DEBUG
-   printk (KERN_DEBUG "%s(addr = 0x%.8x, len = %d)\n",__FUNCTION__,instr->addr,instr->len);
+   printk (KERN_DEBUG "%s(addr = 0x%.8x, len = %d)\n", __func__, instr->addr, instr->len);
 #endif
 
    /* sanity checks */
@@ -442,7 +442,7 @@ static int flash_erase (struct mtd_info *mtd,struct erase_info *instr)
 static int flash_read (struct mtd_info *mtd,loff_t from,size_t len,size_t *retlen,u_char *buf)
 {
 #ifdef LART_DEBUG
-   printk (KERN_DEBUG "%s(from = 0x%.8x, len = %d)\n",__FUNCTION__,(__u32) from,len);
+   printk (KERN_DEBUG "%s(from = 0x%.8x, len = %d)\n", __func__, (__u32)from, len);
 #endif
 
    /* sanity checks */
@@ -488,7 +488,7 @@ static inline int write_dword (__u32 offset,__u32 x)
    __u32 status;
 
 #ifdef LART_DEBUG
-   printk (KERN_DEBUG "%s(): 0x%.8x <- 0x%.8x\n",__FUNCTION__,offset,x);
+   printk (KERN_DEBUG "%s(): 0x%.8x <- 0x%.8x\n", __func__, offset, x);
 #endif
 
    /* setup writing */
@@ -524,7 +524,7 @@ static int flash_write (struct mtd_info *mtd,loff_t to,size_t len,size_t *retlen
    int i,n;
 
 #ifdef LART_DEBUG
-   printk (KERN_DEBUG "%s(to = 0x%.8x, len = %d)\n",__FUNCTION__,(__u32) to,len);
+   printk (KERN_DEBUG "%s(to = 0x%.8x, len = %d)\n", __func__, (__u32)to, len);
 #endif
 
    *retlen = 0;
diff --git a/drivers/mtd/devices/m25p80.c b/drivers/mtd/devices/m25p80.c
index 98df5bcc02f3..25efd331ef28 100644
--- a/drivers/mtd/devices/m25p80.c
+++ b/drivers/mtd/devices/m25p80.c
@@ -33,7 +33,7 @@
 /* Flash opcodes. */
 #define OPCODE_WREN             0x06    /* Write enable */
 #define OPCODE_RDSR             0x05    /* Read status register */
-#define OPCODE_READ             0x03    /* Read data bytes (low frequency) */
+#define OPCODE_NORM_READ        0x03    /* Read data bytes (low frequency) */
 #define OPCODE_FAST_READ        0x0b    /* Read data bytes (high frequency) */
 #define OPCODE_PP               0x02    /* Page program (up to 256 bytes) */
 #define OPCODE_BE_4K            0x20    /* Erase 4KiB block */
@@ -52,7 +52,15 @@
 
 /* Define max times to check status register before we give up. */
 #define MAX_READY_WAIT_COUNT    100000
+#define CMD_SIZE                4
 
+#ifdef CONFIG_M25PXX_USE_FAST_READ
+#define OPCODE_READ     OPCODE_FAST_READ
+#define FAST_READ_DUMMY_BYTE 1
+#else
+#define OPCODE_READ     OPCODE_NORM_READ
+#define FAST_READ_DUMMY_BYTE 0
+#endif
 
 #ifdef CONFIG_MTD_PARTITIONS
 #define mtd_has_partitions()    (1)
@@ -68,7 +76,7 @@ struct m25p {
         struct mtd_info         mtd;
         unsigned                partitioned:1;
         u8                      erase_opcode;
-        u8                      command[4];
+        u8                      command[CMD_SIZE + FAST_READ_DUMMY_BYTE];
 };
 
 static inline struct m25p *mtd_to_m25p(struct mtd_info *mtd)
@@ -151,7 +159,7 @@ static int wait_till_ready(struct m25p *flash)
 static int erase_sector(struct m25p *flash, u32 offset)
 {
         DEBUG(MTD_DEBUG_LEVEL3, "%s: %s %dKiB at 0x%08x\n",
-                        flash->spi->dev.bus_id, __FUNCTION__,
+                        flash->spi->dev.bus_id, __func__,
                         flash->mtd.erasesize / 1024, offset);
 
         /* Wait until finished previous write command. */
@@ -167,7 +175,7 @@ static int erase_sector(struct m25p *flash, u32 offset)
         flash->command[2] = offset >> 8;
         flash->command[3] = offset;
 
-        spi_write(flash->spi, flash->command, sizeof(flash->command));
+        spi_write(flash->spi, flash->command, CMD_SIZE);
 
         return 0;
 }
@@ -188,7 +196,7 @@ static int m25p80_erase(struct mtd_info *mtd, struct erase_info *instr)
         u32 addr,len;
 
         DEBUG(MTD_DEBUG_LEVEL2, "%s: %s %s 0x%08x, len %d\n",
-                        flash->spi->dev.bus_id, __FUNCTION__, "at",
+                        flash->spi->dev.bus_id, __func__, "at",
                         (u32)instr->addr, instr->len);
 
         /* sanity checks */
@@ -240,7 +248,7 @@ static int m25p80_read(struct mtd_info *mtd, loff_t from, size_t len,
         struct spi_message m;
 
         DEBUG(MTD_DEBUG_LEVEL2, "%s: %s %s 0x%08x, len %zd\n",
-                        flash->spi->dev.bus_id, __FUNCTION__, "from",
+                        flash->spi->dev.bus_id, __func__, "from",
                         (u32)from, len);
 
         /* sanity checks */
@@ -253,8 +261,12 @@ static int m25p80_read(struct mtd_info *mtd, loff_t from, size_t len,
         spi_message_init(&m);
         memset(t, 0, (sizeof t));
 
+        /* NOTE:
+         * OPCODE_FAST_READ (if available) is faster.
+         * Should add 1 byte DUMMY_BYTE.
+         */
         t[0].tx_buf = flash->command;
-        t[0].len = sizeof(flash->command);
+        t[0].len = CMD_SIZE + FAST_READ_DUMMY_BYTE;
         spi_message_add_tail(&t[0], &m);
 
         t[1].rx_buf = buf;
@@ -287,7 +299,7 @@ static int m25p80_read(struct mtd_info *mtd, loff_t from, size_t len,
 
         spi_sync(flash->spi, &m);
 
-        *retlen = m.actual_length - sizeof(flash->command);
+        *retlen = m.actual_length - CMD_SIZE - FAST_READ_DUMMY_BYTE;
 
         mutex_unlock(&flash->lock);
 
@@ -308,7 +320,7 @@ static int m25p80_write(struct mtd_info *mtd, loff_t to, size_t len,
         struct spi_message m;
 
         DEBUG(MTD_DEBUG_LEVEL2, "%s: %s %s 0x%08x, len %zd\n",
-                        flash->spi->dev.bus_id, __FUNCTION__, "to",
+                        flash->spi->dev.bus_id, __func__, "to",
                         (u32)to, len);
 
         if (retlen)
@@ -325,7 +337,7 @@ static int m25p80_write(struct mtd_info *mtd, loff_t to, size_t len,
         memset(t, 0, (sizeof t));
 
         t[0].tx_buf = flash->command;
-        t[0].len = sizeof(flash->command);
+        t[0].len = CMD_SIZE;
         spi_message_add_tail(&t[0], &m);
 
         t[1].tx_buf = buf;
@@ -354,7 +366,7 @@ static int m25p80_write(struct mtd_info *mtd, loff_t to, size_t len,
 
                 spi_sync(flash->spi, &m);
 
-                *retlen = m.actual_length - sizeof(flash->command);
+                *retlen = m.actual_length - CMD_SIZE;
         } else {
                 u32 i;
 
@@ -364,7 +376,7 @@ static int m25p80_write(struct mtd_info *mtd, loff_t to, size_t len,
                 t[1].len = page_size;
                 spi_sync(flash->spi, &m);
 
-                *retlen = m.actual_length - sizeof(flash->command);
+                *retlen = m.actual_length - CMD_SIZE;
 
                 /* write everything in PAGESIZE chunks */
                 for (i = page_size; i < len; i += page_size) {
@@ -387,8 +399,7 @@ static int m25p80_write(struct mtd_info *mtd, loff_t to, size_t len,
                         spi_sync(flash->spi, &m);
 
                         if (retlen)
-                                *retlen += m.actual_length
-                                        - sizeof(flash->command);
+                                *retlen += m.actual_length - CMD_SIZE;
                 }
         }
 
@@ -435,6 +446,7 @@ static struct flash_info __devinitdata m25p_data [] = {
         { "at25fs040",  0x1f6604, 64 * 1024, 8, SECT_4K, },
 
         { "at25df041a", 0x1f4401, 64 * 1024, 8, SECT_4K, },
+        { "at25df641",  0x1f4800, 64 * 1024, 128, SECT_4K, },
 
         { "at26f004",   0x1f0400, 64 * 1024, 8, SECT_4K, },
         { "at26df081a", 0x1f4501, 64 * 1024, 16, SECT_4K, },
diff --git a/drivers/mtd/devices/mtdram.c b/drivers/mtd/devices/mtdram.c
index e427c82d5f4c..bf485ff49457 100644
--- a/drivers/mtd/devices/mtdram.c
+++ b/drivers/mtd/devices/mtdram.c
@@ -17,6 +17,7 @@
 #include <linux/init.h>
 #include <linux/mtd/compatmac.h>
 #include <linux/mtd/mtd.h>
+#include <linux/mtd/mtdram.h>
 
 static unsigned long total_size = CONFIG_MTDRAM_TOTAL_SIZE;
 static unsigned long erase_size = CONFIG_MTDRAM_ERASE_SIZE;
diff --git a/drivers/mtd/devices/phram.c b/drivers/mtd/devices/phram.c
index 180298b92a7a..5f960182da95 100644
--- a/drivers/mtd/devices/phram.c
+++ b/drivers/mtd/devices/phram.c
@@ -282,7 +282,7 @@ static int phram_setup(const char *val, struct kernel_param *kp)
 }
 
 module_param_call(phram, phram_setup, NULL, NULL, 000);
-MODULE_PARM_DESC(phram,"Memory region to map. \"map=<name>,<start>,<length>\"");
+MODULE_PARM_DESC(phram, "Memory region to map. \"phram=<name>,<start>,<length>\"");
 
 
 static int __init init_phram(void)
diff --git a/drivers/mtd/ftl.c b/drivers/mtd/ftl.c
index c815d0f38577..4a79b187b568 100644
--- a/drivers/mtd/ftl.c
+++ b/drivers/mtd/ftl.c
@@ -136,8 +136,6 @@ typedef struct partition_t {
 #endif
 } partition_t;
 
-void ftl_freepart(partition_t *part);
-
 /* Partition state flags */
 #define FTL_FORMATTED   0x01
 
@@ -1014,7 +1012,7 @@ static int ftl_writesect(struct mtd_blktrans_dev *dev,
 
 /*====================================================================*/
 
-void ftl_freepart(partition_t *part)
+static void ftl_freepart(partition_t *part)
 {
         vfree(part->VirtualBlockMap);
         part->VirtualBlockMap = NULL;
@@ -1069,7 +1067,7 @@ static void ftl_remove_dev(struct mtd_blktrans_dev *dev)
         kfree(dev);
 }
 
-struct mtd_blktrans_ops ftl_tr = {
+static struct mtd_blktrans_ops ftl_tr = {
         .name           = "ftl",
         .major          = FTL_MAJOR,
         .part_bits      = PART_BITS,
diff --git a/drivers/mtd/inftlmount.c b/drivers/mtd/inftlmount.c
index b8917beeb650..c551d2f0779c 100644
--- a/drivers/mtd/inftlmount.c
+++ b/drivers/mtd/inftlmount.c
@@ -41,11 +41,6 @@
 
 char inftlmountrev[]="$Revision: 1.18 $";
 
-extern int inftl_read_oob(struct mtd_info *mtd, loff_t offs, size_t len,
-                          size_t *retlen, uint8_t *buf);
-extern int inftl_write_oob(struct mtd_info *mtd, loff_t offs, size_t len,
-                           size_t *retlen, uint8_t *buf);
-
 /*
  * find_boot_record: Find the INFTL Media Header and its Spare copy which
  *      contains the various device information of the INFTL partition and
diff --git a/drivers/mtd/maps/Kconfig b/drivers/mtd/maps/Kconfig
index 12c253664eb2..1bd69aa9e22a 100644
--- a/drivers/mtd/maps/Kconfig
+++ b/drivers/mtd/maps/Kconfig
@@ -21,6 +21,9 @@ config MTD_PHYSMAP
           particular board as well as the bus width, either statically
           with config options or at run-time.
 
+          To compile this driver as a module, choose M here: the
+          module will be called physmap.
+
 config MTD_PHYSMAP_START
         hex "Physical start address of flash mapping"
         depends on MTD_PHYSMAP
diff --git a/drivers/mtd/maps/bast-flash.c b/drivers/mtd/maps/bast-flash.c
index fc3b2672d1e2..1f492062f8ca 100644
--- a/drivers/mtd/maps/bast-flash.c
+++ b/drivers/mtd/maps/bast-flash.c
@@ -137,7 +137,7 @@ static int bast_flash_probe(struct platform_device *pdev)
         if (info->map.size > AREA_MAXSIZE)
                 info->map.size = AREA_MAXSIZE;
 
-        pr_debug("%s: area %08lx, size %ld\n", __FUNCTION__,
+        pr_debug("%s: area %08lx, size %ld\n", __func__,
                  info->map.phys, info->map.size);
 
         info->area = request_mem_region(res->start, info->map.size,
@@ -149,7 +149,7 @@ static int bast_flash_probe(struct platform_device *pdev)
         }
 
         info->map.virt = ioremap(res->start, info->map.size);
-        pr_debug("%s: virt at %08x\n", __FUNCTION__, (int)info->map.virt);
+        pr_debug("%s: virt at %08x\n", __func__, (int)info->map.virt);
 
         if (info->map.virt == 0) {
                 printk(KERN_ERR PFX "failed to ioremap() region\n");
@@ -223,3 +223,4 @@ module_exit(bast_flash_exit);
 MODULE_LICENSE("GPL");
 MODULE_AUTHOR("Ben Dooks <ben@simtec.co.uk>");
 MODULE_DESCRIPTION("BAST MTD Map driver");
+MODULE_ALIAS("platform:bast-nor");
diff --git a/drivers/mtd/maps/ck804xrom.c b/drivers/mtd/maps/ck804xrom.c
index 688ef495888a..59d8fb49270a 100644
--- a/drivers/mtd/maps/ck804xrom.c
+++ b/drivers/mtd/maps/ck804xrom.c
@@ -28,6 +28,9 @@
 
 #define ROM_PROBE_STEP_SIZE (64*1024)
 
+#define DEV_CK804 1
+#define DEV_MCP55 2
+
 struct ck804xrom_window {
         void __iomem *virt;
         unsigned long phys;
@@ -45,8 +48,9 @@ struct ck804xrom_map_info {
         char map_name[sizeof(MOD_NAME) + 2 + ADDRESS_NAME_LEN];
 };
 
-
-/* The 2 bits controlling the window size are often set to allow reading
+/*
+ * The following applies to ck804 only:
+ * The 2 bits controlling the window size are often set to allow reading
  * the BIOS, but too small to allow writing, since the lock registers are
  * 4MiB lower in the address space than the data.
  *
@@ -58,10 +62,17 @@ struct ck804xrom_map_info {
  * If only the 7 Bit is set, it is a 4MiB window.  Otherwise, a
  * 64KiB window.
  *
+ * The following applies to mcp55 only:
+ * The 15 bits controlling the window size are distributed as follows: 
+ * byte @0x88: bit 0..7
+ * byte @0x8c: bit 8..15
+ * word @0x90: bit 16..30
+ * If all bits are enabled, we have a 16? MiB window
+ * Please set win_size_bits to 0x7fffffff if you actually want to do something
  */
 static uint win_size_bits = 0;
 module_param(win_size_bits, uint, 0);
-MODULE_PARM_DESC(win_size_bits, "ROM window size bits override for 0x88 byte, normally set by BIOS.");
+MODULE_PARM_DESC(win_size_bits, "ROM window size bits override, normally set by BIOS.");
 
 static struct ck804xrom_window ck804xrom_window = {
         .maps = LIST_HEAD_INIT(ck804xrom_window.maps),
@@ -102,10 +113,11 @@ static void ck804xrom_cleanup(struct ck804xrom_window *window)
 
 
 static int __devinit ck804xrom_init_one (struct pci_dev *pdev,
-        const struct pci_device_id *ent)
+                                         const struct pci_device_id *ent)
 {
         static char *rom_probe_types[] = { "cfi_probe", "jedec_probe", NULL };
         u8 byte;
+        u16 word;
         struct ck804xrom_window *window = &ck804xrom_window;
         struct ck804xrom_map_info *map = NULL;
         unsigned long map_top;
@@ -113,26 +125,42 @@ static int __devinit ck804xrom_init_one (struct pci_dev *pdev,
         /* Remember the pci dev I find the window in */
         window->pdev = pci_dev_get(pdev);
 
-        /* Enable the selected rom window.  This is often incorrectly
-         * set up by the BIOS, and the 4MiB offset for the lock registers
-         * requires the full 5MiB of window space.
-         *
-         * This 'write, then read' approach leaves the bits for
-         * other uses of the hardware info.
-         */
-        pci_read_config_byte(pdev, 0x88, &byte);
-        pci_write_config_byte(pdev, 0x88, byte | win_size_bits );
-
-
-        /* Assume the rom window is properly setup, and find it's size */
-        pci_read_config_byte(pdev, 0x88, &byte);
-
-        if ((byte & ((1<<7)|(1<<6))) == ((1<<7)|(1<<6)))
-                window->phys = 0xffb00000; /* 5MiB */
-        else if ((byte & (1<<7)) == (1<<7))
-                window->phys = 0xffc00000; /* 4MiB */
-        else
-                window->phys = 0xffff0000; /* 64KiB */
+        switch (ent->driver_data) {
+        case DEV_CK804:
+                /* Enable the selected rom window.  This is often incorrectly
+                 * set up by the BIOS, and the 4MiB offset for the lock registers
+                 * requires the full 5MiB of window space.
+                 *
+                 * This 'write, then read' approach leaves the bits for
+                 * other uses of the hardware info.
+                 */
+                pci_read_config_byte(pdev, 0x88, &byte);
+                pci_write_config_byte(pdev, 0x88, byte | win_size_bits );
+
+                /* Assume the rom window is properly setup, and find it's size */
+                pci_read_config_byte(pdev, 0x88, &byte);
+
+                if ((byte & ((1<<7)|(1<<6))) == ((1<<7)|(1<<6)))
+                        window->phys = 0xffb00000; /* 5MiB */
+                else if ((byte & (1<<7)) == (1<<7))
+                        window->phys = 0xffc00000; /* 4MiB */
+                else
+                        window->phys = 0xffff0000; /* 64KiB */
+                break;
+
+        case DEV_MCP55:
+                pci_read_config_byte(pdev, 0x88, &byte);
+                pci_write_config_byte(pdev, 0x88, byte | (win_size_bits & 0xff));
+
+                pci_read_config_byte(pdev, 0x8c, &byte);
+                pci_write_config_byte(pdev, 0x8c, byte | ((win_size_bits & 0xff00) >> 8));
+
+                pci_read_config_word(pdev, 0x90, &word);
+                pci_write_config_word(pdev, 0x90, word | ((win_size_bits & 0x7fff0000) >> 16));
+
+                window->phys = 0xff000000; /* 16MiB, hardcoded for now */
+                break;
+        }
 
         window->size = 0xffffffffUL - window->phys + 1UL;
 
@@ -303,8 +331,15 @@ static void __devexit ck804xrom_remove_one (struct pci_dev *pdev)
 }
 
 static struct pci_device_id ck804xrom_pci_tbl[] = {
-        { PCI_VENDOR_ID_NVIDIA, 0x0051,
-        PCI_ANY_ID, PCI_ANY_ID, }, /* nvidia ck804 */
+        { PCI_VENDOR_ID_NVIDIA, 0x0051, PCI_ANY_ID, PCI_ANY_ID, DEV_CK804 },
+        { PCI_VENDOR_ID_NVIDIA, 0x0360, PCI_ANY_ID, PCI_ANY_ID, DEV_MCP55 },
+        { PCI_VENDOR_ID_NVIDIA, 0x0361, PCI_ANY_ID, PCI_ANY_ID, DEV_MCP55 },
+        { PCI_VENDOR_ID_NVIDIA, 0x0362, PCI_ANY_ID, PCI_ANY_ID, DEV_MCP55 },
+        { PCI_VENDOR_ID_NVIDIA, 0x0363, PCI_ANY_ID, PCI_ANY_ID, DEV_MCP55 },
+        { PCI_VENDOR_ID_NVIDIA, 0x0364, PCI_ANY_ID, PCI_ANY_ID, DEV_MCP55 },
+        { PCI_VENDOR_ID_NVIDIA, 0x0365, PCI_ANY_ID, PCI_ANY_ID, DEV_MCP55 },
+        { PCI_VENDOR_ID_NVIDIA, 0x0366, PCI_ANY_ID, PCI_ANY_ID, DEV_MCP55 },
+        { PCI_VENDOR_ID_NVIDIA, 0x0367, PCI_ANY_ID, PCI_ANY_ID, DEV_MCP55 },
         { 0, }
 };
 
@@ -332,7 +367,7 @@ static int __init init_ck804xrom(void)
                         break;
         }
         if (pdev) {
-                retVal = ck804xrom_init_one(pdev, &ck804xrom_pci_tbl[0]);
+                retVal = ck804xrom_init_one(pdev, id);
                 pci_dev_put(pdev);
                 return retVal;
         }
diff --git a/drivers/mtd/maps/integrator-flash.c b/drivers/mtd/maps/integrator-flash.c
index 6946d802e6f6..325c8880c437 100644
--- a/drivers/mtd/maps/integrator-flash.c
+++ b/drivers/mtd/maps/integrator-flash.c
@@ -190,6 +190,7 @@ static struct platform_driver armflash_driver = {
         .remove         = armflash_remove,
         .driver         = {
                 .name   = "armflash",
+                .owner  = THIS_MODULE,
         },
 };
 
@@ -209,3 +210,4 @@ module_exit(armflash_exit);
 MODULE_AUTHOR("ARM Ltd");
 MODULE_DESCRIPTION("ARM Integrator CFI map driver");
 MODULE_LICENSE("GPL");
+MODULE_ALIAS("platform:armflash");
diff --git a/drivers/mtd/maps/ixp2000.c b/drivers/mtd/maps/ixp2000.c
index c26488a1793a..c8396b8574c4 100644
--- a/drivers/mtd/maps/ixp2000.c
+++ b/drivers/mtd/maps/ixp2000.c
@@ -253,6 +253,7 @@ static struct platform_driver ixp2000_flash_driver = {
         .remove         = ixp2000_flash_remove,
         .driver         = {
                 .name   = "IXP2000-Flash",
+                .owner  = THIS_MODULE,
         },
 };
 
@@ -270,4 +271,4 @@ module_init(ixp2000_flash_init);
 module_exit(ixp2000_flash_exit);
 MODULE_LICENSE("GPL");
 MODULE_AUTHOR("Deepak Saxena <dsaxena@plexity.net>");
-
+MODULE_ALIAS("platform:IXP2000-Flash");
diff --git a/drivers/mtd/maps/ixp4xx.c b/drivers/mtd/maps/ixp4xx.c
index 7a828e3e6446..01f19a4714b5 100644
--- a/drivers/mtd/maps/ixp4xx.c
+++ b/drivers/mtd/maps/ixp4xx.c
@@ -275,6 +275,7 @@ static struct platform_driver ixp4xx_flash_driver = {
         .remove         = ixp4xx_flash_remove,
         .driver         = {
                 .name   = "IXP4XX-Flash",
+                .owner  = THIS_MODULE,
         },
 };
 
@@ -295,3 +296,4 @@ module_exit(ixp4xx_flash_exit);
 MODULE_LICENSE("GPL");
 MODULE_DESCRIPTION("MTD map driver for Intel IXP4xx systems");
 MODULE_AUTHOR("Deepak Saxena");
+MODULE_ALIAS("platform:IXP4XX-Flash");
diff --git a/drivers/mtd/maps/omap_nor.c b/drivers/mtd/maps/omap_nor.c
index e8d9ae535673..240b0e2d095d 100644
--- a/drivers/mtd/maps/omap_nor.c
+++ b/drivers/mtd/maps/omap_nor.c
@@ -70,7 +70,7 @@ static void omap_set_vpp(struct map_info *map, int enable)
         }
 }
 
-static int __devinit omapflash_probe(struct platform_device *pdev)
+static int __init omapflash_probe(struct platform_device *pdev)
 {
         int err;
         struct omapflash_info *info;
@@ -130,7 +130,7 @@ out_free_info:
         return err;
 }
 
-static int __devexit omapflash_remove(struct platform_device *pdev)
+static int __exit omapflash_remove(struct platform_device *pdev)
 {
         struct omapflash_info *info = platform_get_drvdata(pdev);
 
@@ -152,16 +152,16 @@ static int __devexit omapflash_remove(struct platform_device *pdev)
 }
 
 static struct platform_driver omapflash_driver = {
-        .probe  = omapflash_probe,
-        .remove = __devexit_p(omapflash_remove),
+        .remove = __exit_p(omapflash_remove),
         .driver = {
                 .name   = "omapflash",
+                .owner  = THIS_MODULE,
         },
 };
 
 static int __init omapflash_init(void)
 {
-        return platform_driver_register(&omapflash_driver);
+        return platform_driver_probe(&omapflash_driver, omapflash_probe);
 }
 
 static void __exit omapflash_exit(void)
@@ -174,4 +174,4 @@ module_exit(omapflash_exit);
 
 MODULE_LICENSE("GPL");
 MODULE_DESCRIPTION("MTD NOR map driver for TI OMAP boards");
-
+MODULE_ALIAS("platform:omapflash");
diff --git a/drivers/mtd/maps/pcmciamtd.c b/drivers/mtd/maps/pcmciamtd.c
index eaeb56a4070a..1912d968718b 100644
--- a/drivers/mtd/maps/pcmciamtd.c
+++ b/drivers/mtd/maps/pcmciamtd.c
@@ -33,7 +33,7 @@ MODULE_PARM_DESC(debug, "Set Debug Level 0=quiet, 5=noisy");
 #undef DEBUG
 #define DEBUG(n, format, arg...) \
         if (n <= debug) {        \
-                printk(KERN_DEBUG __FILE__ ":%s(): " format "\n", __FUNCTION__ , ## arg); \
+                printk(KERN_DEBUG __FILE__ ":%s(): " format "\n", __func__ , ## arg); \
         }
 
 #else
diff --git a/drivers/mtd/maps/physmap.c b/drivers/mtd/maps/physmap.c
index bc4649a17b9d..183255fcfdcb 100644
--- a/drivers/mtd/maps/physmap.c
+++ b/drivers/mtd/maps/physmap.c
@@ -242,6 +242,7 @@ static struct platform_driver physmap_flash_driver = {
         .shutdown       = physmap_flash_shutdown,
         .driver         = {
                 .name   = "physmap-flash",
+                .owner  = THIS_MODULE,
         },
 };
 
@@ -319,3 +320,10 @@ module_exit(physmap_exit);
 MODULE_LICENSE("GPL");
 MODULE_AUTHOR("David Woodhouse <dwmw2@infradead.org>");
 MODULE_DESCRIPTION("Generic configurable MTD map driver");
+
+/* legacy platform drivers can't hotplug or coldplg */
+#ifndef PHYSMAP_COMPAT
+/* work with hotplug and coldplug */
+MODULE_ALIAS("platform:physmap-flash");
+#endif
+
diff --git a/drivers/mtd/maps/plat-ram.c b/drivers/mtd/maps/plat-ram.c
index 894c0b271289..f0b10ca05029 100644
--- a/drivers/mtd/maps/plat-ram.c
+++ b/drivers/mtd/maps/plat-ram.c
@@ -47,6 +47,7 @@ struct platram_info {
         struct mtd_info         *mtd;
         struct map_info          map;
         struct mtd_partition    *partitions;
+        bool                    free_partitions;
         struct resource         *area;
         struct platdata_mtd_ram *pdata;
 };
@@ -98,7 +99,8 @@ static int platram_remove(struct platform_device *pdev)
 #ifdef CONFIG_MTD_PARTITIONS
                 if (info->partitions) {
                         del_mtd_partitions(info->mtd);
-                        kfree(info->partitions);
+                        if (info->free_partitions)
+                                kfree(info->partitions);
                 }
 #endif
                 del_mtd_device(info->mtd);
@@ -176,7 +178,8 @@ static int platram_probe(struct platform_device *pdev)
 
         info->map.phys = res->start;
         info->map.size = (res->end - res->start) + 1;
-        info->map.name = pdata->mapname != NULL ? pdata->mapname : (char *)pdev->name;
+        info->map.name = pdata->mapname != NULL ?
+                        (char *)pdata->mapname : (char *)pdev->name;
         info->map.bankwidth = pdata->bankwidth;
 
         /* register our usage of the memory area */
@@ -203,9 +206,19 @@ static int platram_probe(struct platform_device *pdev)
 
         dev_dbg(&pdev->dev, "initialised map, probing for mtd\n");
 
-        /* probe for the right mtd map driver */
+        /* probe for the right mtd map driver
+         * supplied by the platform_data struct */
+
+        if (pdata->map_probes != 0) {
+                const char **map_probes = pdata->map_probes;
+
+                for ( ; !info->mtd && *map_probes; map_probes++)
+                        info->mtd = do_map_probe(*map_probes , &info->map);
+        }
+        /* fallback to map_ram */
+        else
+                info->mtd = do_map_probe("map_ram", &info->map);
 
-        info->mtd = do_map_probe("map_ram" , &info->map);
         if (info->mtd == NULL) {
                 dev_err(&pdev->dev, "failed to probe for map_ram\n");
                 err = -ENOMEM;
@@ -220,19 +233,21 @@ static int platram_probe(struct platform_device *pdev)
          * to add this device whole */
 
 #ifdef CONFIG_MTD_PARTITIONS
-        if (pdata->nr_partitions > 0) {
-                const char **probes = { NULL };
-
-                if (pdata->probes)
-                        probes = (const char **)pdata->probes;
-
-                err = parse_mtd_partitions(info->mtd, probes,
+        if (!pdata->nr_partitions) {
+                /* try to probe using the supplied probe type */
+                if (pdata->probes) {
+                        err = parse_mtd_partitions(info->mtd, pdata->probes,
                                            &info->partitions, 0);
-                if (err > 0) {
-                        err = add_mtd_partitions(info->mtd, info->partitions,
-                                                 err);
+                        info->free_partitions = 1;
+                        if (err > 0)
+                                err = add_mtd_partitions(info->mtd,
+                                        info->partitions, err);
                 }
         }
+        /* use the static mapping */
+        else
+                err = add_mtd_partitions(info->mtd, pdata->partitions,
+                                pdata->nr_partitions);
 #endif /* CONFIG_MTD_PARTITIONS */
 
         if (add_mtd_device(info->mtd)) {
@@ -240,7 +255,9 @@ static int platram_probe(struct platform_device *pdev)
                 err = -ENOMEM;
         }
 
-        dev_info(&pdev->dev, "registered mtd device\n");
+        if (!err)
+                dev_info(&pdev->dev, "registered mtd device\n");
+
         return err;
 
  exit_free:
@@ -251,6 +268,9 @@ static int platram_probe(struct platform_device *pdev)
 
 /* device driver info */
 
+/* work with hotplug and coldplug */
+MODULE_ALIAS("platform:mtd-ram");
+
 static struct platform_driver platram_driver = {
         .probe          = platram_probe,
         .remove         = platram_remove,
diff --git a/drivers/mtd/maps/pmcmsp-flash.c b/drivers/mtd/maps/pmcmsp-flash.c
index 02bde8c982ec..f43ba2815cbb 100644
--- a/drivers/mtd/maps/pmcmsp-flash.c
+++ b/drivers/mtd/maps/pmcmsp-flash.c
@@ -46,7 +46,7 @@ static struct mtd_partition **msp_parts;
 static struct map_info *msp_maps;
 static int fcnt;
 
-#define DEBUG_MARKER printk(KERN_NOTICE "%s[%d]\n",__FUNCTION__,__LINE__)
+#define DEBUG_MARKER printk(KERN_NOTICE "%s[%d]\n", __func__, __LINE__)
 
 int __init init_msp_flash(void)
 {
diff --git a/drivers/mtd/maps/sa1100-flash.c b/drivers/mtd/maps/sa1100-flash.c
index f904e6bd02e0..c7d5a52a2d55 100644
--- a/drivers/mtd/maps/sa1100-flash.c
+++ b/drivers/mtd/maps/sa1100-flash.c
@@ -456,6 +456,7 @@ static struct platform_driver sa1100_mtd_driver = {
         .shutdown       = sa1100_mtd_shutdown,
         .driver         = {
                 .name   = "flash",
+                .owner  = THIS_MODULE,
         },
 };
 
@@ -475,3 +476,4 @@ module_exit(sa1100_mtd_exit);
 MODULE_AUTHOR("Nicolas Pitre");
 MODULE_DESCRIPTION("SA1100 CFI map driver");
 MODULE_LICENSE("GPL");
+MODULE_ALIAS("platform:flash");
diff --git a/drivers/mtd/maps/sharpsl-flash.c b/drivers/mtd/maps/sharpsl-flash.c
index 12fe53c0d2fc..917dc778f24e 100644
--- a/drivers/mtd/maps/sharpsl-flash.c
+++ b/drivers/mtd/maps/sharpsl-flash.c
@@ -92,7 +92,7 @@ int __init init_sharpsl(void)
         parts = sharpsl_partitions;
         nb_parts = ARRAY_SIZE(sharpsl_partitions);
 
-        printk(KERN_NOTICE "Using %s partision definition\n", part_type);
+        printk(KERN_NOTICE "Using %s partition definition\n", part_type);
         add_mtd_partitions(mymtd, parts, nb_parts);
 
         return 0;
diff --git a/drivers/mtd/maps/tqm8xxl.c b/drivers/mtd/maps/tqm8xxl.c
index 37e4ded9b600..521734057314 100644
--- a/drivers/mtd/maps/tqm8xxl.c
+++ b/drivers/mtd/maps/tqm8xxl.c
@@ -124,7 +124,7 @@ int __init init_tqm_mtd(void)
         //request maximum flash size address space
         start_scan_addr = ioremap(flash_addr, flash_size);
         if (!start_scan_addr) {
-                printk(KERN_WARNING "%s:Failed to ioremap address:0x%x\n", __FUNCTION__, flash_addr);
+                printk(KERN_WARNING "%s:Failed to ioremap address:0x%x\n", __func__, flash_addr);
                 return -EIO;
         }
 
@@ -132,7 +132,7 @@ int __init init_tqm_mtd(void)
                 if(mtd_size >= flash_size)
                         break;
 
-                printk(KERN_INFO "%s: chip probing count %d\n", __FUNCTION__, idx);
+                printk(KERN_INFO "%s: chip probing count %d\n", __func__, idx);
 
                 map_banks[idx] = kzalloc(sizeof(struct map_info), GFP_KERNEL);
                 if(map_banks[idx] == NULL) {
@@ -178,7 +178,7 @@ int __init init_tqm_mtd(void)
                         mtd_size += mtd_banks[idx]->size;
                         num_banks++;
 
-                        printk(KERN_INFO "%s: bank%d, name:%s, size:%dbytes \n", __FUNCTION__, num_banks,
+                        printk(KERN_INFO "%s: bank%d, name:%s, size:%dbytes \n", __func__, num_banks,
                         mtd_banks[idx]->name, mtd_banks[idx]->size);
                 }
         }
diff --git a/drivers/mtd/mtdoops.c b/drivers/mtd/mtdoops.c
index d3cf05012b46..5a680e1e61f1 100644
--- a/drivers/mtd/mtdoops.c
+++ b/drivers/mtd/mtdoops.c
@@ -35,7 +35,7 @@
 
 #define OOPS_PAGE_SIZE 4096
 
-struct mtdoops_context {
+static struct mtdoops_context {
         int mtd_index;
         struct work_struct work_erase;
         struct work_struct work_write;
diff --git a/drivers/mtd/nand/Kconfig b/drivers/mtd/nand/Kconfig
index 959fb86cda01..5076faf9ca66 100644
--- a/drivers/mtd/nand/Kconfig
+++ b/drivers/mtd/nand/Kconfig
@@ -278,6 +278,54 @@ config MTD_NAND_AT91
         help
           Enables support for NAND Flash / Smart Media Card interface
           on Atmel AT91 processors.
+choice
+        prompt "ECC management for NAND Flash / SmartMedia on AT91"
+        depends on MTD_NAND_AT91
+
+config MTD_NAND_AT91_ECC_HW
+        bool "Hardware ECC"
+        depends on ARCH_AT91SAM9263 || ARCH_AT91SAM9260
+        help
+          Uses hardware ECC provided by the at91sam9260/at91sam9263 chip
+          instead of software ECC.
+          The hardware ECC controller is capable of single bit error
+          correction and 2-bit random detection per page.
+
+          NB : hardware and software ECC schemes are incompatible.
+          If you switch from one to another, you'll have to erase your
+          mtd partition.
+
+          If unsure, say Y
+
+config MTD_NAND_AT91_ECC_SOFT
+        bool "Software ECC"
+        help
+          Uses software ECC.
+
+          NB : hardware and software ECC schemes are incompatible.
+          If you switch from one to another, you'll have to erase your
+          mtd partition.
+
+config MTD_NAND_AT91_ECC_NONE
+        bool "No ECC (testing only, DANGEROUS)"
+        depends on DEBUG_KERNEL
+        help
+          No ECC will be used.
+          It's not a good idea and it should be reserved for testing
+          purpose only.
+
+          If unsure, say N
+
+          endchoice
+
+endchoice
+
+config MTD_NAND_PXA3xx
+        bool "Support for NAND flash devices on PXA3xx"
+        depends on MTD_NAND && PXA3xx
+        help
+          This enables the driver for the NAND flash device found on
+          PXA3xx processors
 
 config MTD_NAND_CM_X270
         tristate "Support for NAND Flash on CM-X270 modules"
@@ -330,4 +378,12 @@ config MTD_NAND_FSL_ELBC
           Enabling this option will enable you to use this to control
           external NAND devices.
 
+config MTD_NAND_FSL_UPM
+        tristate "Support for NAND on Freescale UPM"
+        depends on MTD_NAND && OF_GPIO && (PPC_83xx || PPC_85xx)
+        select FSL_LBC
+        help
+          Enables support for NAND Flash chips wired onto Freescale PowerPC
+          processor localbus with User-Programmable Machine support.
+
 endif # MTD_NAND
diff --git a/drivers/mtd/nand/Makefile b/drivers/mtd/nand/Makefile
index 80d575eeee96..a6e74a46992a 100644
--- a/drivers/mtd/nand/Makefile
+++ b/drivers/mtd/nand/Makefile
@@ -27,10 +27,12 @@ obj-$(CONFIG_MTD_NAND_NDFC)		+= ndfc.o
 obj-$(CONFIG_MTD_NAND_AT91)             += at91_nand.o
 obj-$(CONFIG_MTD_NAND_CM_X270)          += cmx270_nand.o
 obj-$(CONFIG_MTD_NAND_BASLER_EXCITE)    += excite_nandflash.o
+obj-$(CONFIG_MTD_NAND_PXA3xx)           += pxa3xx_nand.o
 obj-$(CONFIG_MTD_NAND_PLATFORM)         += plat_nand.o
 obj-$(CONFIG_MTD_ALAUDA)                += alauda.o
 obj-$(CONFIG_MTD_NAND_PASEMI)           += pasemi_nand.o
 obj-$(CONFIG_MTD_NAND_ORION)            += orion_nand.o
 obj-$(CONFIG_MTD_NAND_FSL_ELBC)         += fsl_elbc_nand.o
+obj-$(CONFIG_MTD_NAND_FSL_UPM)          += fsl_upm.o
 
 nand-objs := nand_base.o nand_bbt.o
diff --git a/drivers/mtd/nand/at91_nand.c b/drivers/mtd/nand/at91_nand.c
index c9fb2acf4056..414ceaecdb3a 100644
--- a/drivers/mtd/nand/at91_nand.c
+++ b/drivers/mtd/nand/at91_nand.c
@@ -9,6 +9,15 @@
  *  Derived from drivers/mtd/spia.c
  *       Copyright (C) 2000 Steven J. Hill (sjhill@cotw.com)
  *
+ *
+ *  Add Hardware ECC support for AT91SAM9260 / AT91SAM9263
+ *     Richard Genoud (richard.genoud@gmail.com), Adeneo Copyright (C) 2007
+ *
+ *     Derived from Das U-Boot source code
+ *              (u-boot-1.1.5/board/atmel/at91sam9263ek/nand.c)
+ *     (C) Copyright 2006 ATMEL Rousset, Lacressonniere Nicolas
+ *
+ *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License version 2 as
  * published by the Free Software Foundation.
@@ -29,11 +38,59 @@
 #include <asm/arch/board.h>
 #include <asm/arch/gpio.h>
 
+#ifdef CONFIG_MTD_NAND_AT91_ECC_HW
+#define hard_ecc        1
+#else
+#define hard_ecc        0
+#endif
+
+#ifdef CONFIG_MTD_NAND_AT91_ECC_NONE
+#define no_ecc          1
+#else
+#define no_ecc          0
+#endif
+
+/* Register access macros */
+#define ecc_readl(add, reg)                             \
+        __raw_readl(add + AT91_ECC_##reg)
+#define ecc_writel(add, reg, value)                     \
+        __raw_writel((value), add + AT91_ECC_##reg)
+
+#include <asm/arch/at91_ecc.h> /* AT91SAM9260/3 ECC registers */
+
+/* oob layout for large page size
+ * bad block info is on bytes 0 and 1
+ * the bytes have to be consecutives to avoid
+ * several NAND_CMD_RNDOUT during read
+ */
+static struct nand_ecclayout at91_oobinfo_large = {
+        .eccbytes = 4,
+        .eccpos = {60, 61, 62, 63},
+        .oobfree = {
+                {2, 58}
+        },
+};
+
+/* oob layout for small page size
+ * bad block info is on bytes 4 and 5
+ * the bytes have to be consecutives to avoid
+ * several NAND_CMD_RNDOUT during read
+ */
+static struct nand_ecclayout at91_oobinfo_small = {
+        .eccbytes = 4,
+        .eccpos = {0, 1, 2, 3},
+        .oobfree = {
+                {6, 10}
+        },
+};
+
 struct at91_nand_host {
         struct nand_chip        nand_chip;
         struct mtd_info         mtd;
         void __iomem            *io_base;
         struct at91_nand_data   *board;
+        struct device           *dev;
+        void __iomem            *ecc;
 };
 
 /*
@@ -44,6 +101,12 @@ static void at91_nand_cmd_ctrl(struct mtd_info *mtd, int cmd, unsigned int ctrl)
         struct nand_chip *nand_chip = mtd->priv;
         struct at91_nand_host *host = nand_chip->priv;
 
+        if (host->board->enable_pin && (ctrl & NAND_CTRL_CHANGE)) {
+                if (ctrl & NAND_NCE)
+                        at91_set_gpio_value(host->board->enable_pin, 0);
+                else
+                        at91_set_gpio_value(host->board->enable_pin, 1);
+        }
         if (cmd == NAND_CMD_NONE)
                 return;
 
@@ -82,8 +145,217 @@ static void at91_nand_disable(struct at91_nand_host *host)
                 at91_set_gpio_value(host->board->enable_pin, 1);
 }
 
+/*
+ * write oob for small pages
+ */
+static int at91_nand_write_oob_512(struct mtd_info *mtd,
+                struct nand_chip *chip, int page)
+{
+        int chunk = chip->ecc.bytes + chip->ecc.prepad + chip->ecc.postpad;
+        int eccsize = chip->ecc.size, length = mtd->oobsize;
+        int len, pos, status = 0;
+        const uint8_t *bufpoi = chip->oob_poi;
+
+        pos = eccsize + chunk;
+
+        chip->cmdfunc(mtd, NAND_CMD_SEQIN, pos, page);
+        len = min_t(int, length, chunk);
+        chip->write_buf(mtd, bufpoi, len);
+        bufpoi += len;
+        length -= len;
+        if (length > 0)
+                chip->write_buf(mtd, bufpoi, length);
+
+        chip->cmdfunc(mtd, NAND_CMD_PAGEPROG, -1, -1);
+        status = chip->waitfunc(mtd, chip);
+
+        return status & NAND_STATUS_FAIL ? -EIO : 0;
+
+}
+
+/*
+ * read oob for small pages
+ */
+static int at91_nand_read_oob_512(struct mtd_info *mtd,
+                struct nand_chip *chip, int page, int sndcmd)
+{
+        if (sndcmd) {
+                chip->cmdfunc(mtd, NAND_CMD_READOOB, 0, page);
+                sndcmd = 0;
+        }
+        chip->read_buf(mtd, chip->oob_poi, mtd->oobsize);
+        return sndcmd;
+}
+
+/*
+ * Calculate HW ECC
+ *
+ * function called after a write
+ *
+ * mtd:        MTD block structure
+ * dat:        raw data (unused)
+ * ecc_code:   buffer for ECC
+ */
+static int at91_nand_calculate(struct mtd_info *mtd,
+                const u_char *dat, unsigned char *ecc_code)
+{
+        struct nand_chip *nand_chip = mtd->priv;
+        struct at91_nand_host *host = nand_chip->priv;
+        uint32_t *eccpos = nand_chip->ecc.layout->eccpos;
+        unsigned int ecc_value;
+
+        /* get the first 2 ECC bytes */
+        ecc_value = ecc_readl(host->ecc, PR);
+
+        ecc_code[eccpos[0]] = ecc_value & 0xFF;
+        ecc_code[eccpos[1]] = (ecc_value >> 8) & 0xFF;
+
+        /* get the last 2 ECC bytes */
+        ecc_value = ecc_readl(host->ecc, NPR) & AT91_ECC_NPARITY;
+
+        ecc_code[eccpos[2]] = ecc_value & 0xFF;
+        ecc_code[eccpos[3]] = (ecc_value >> 8) & 0xFF;
+
+        return 0;
+}
+
+/*
+ * HW ECC read page function
+ *
+ * mtd:        mtd info structure
+ * chip:       nand chip info structure
+ * buf:        buffer to store read data
+ */
+static int at91_nand_read_page(struct mtd_info *mtd,
+                struct nand_chip *chip, uint8_t *buf)
+{
+        int eccsize = chip->ecc.size;
+        int eccbytes = chip->ecc.bytes;
+        uint32_t *eccpos = chip->ecc.layout->eccpos;
+        uint8_t *p = buf;
+        uint8_t *oob = chip->oob_poi;
+        uint8_t *ecc_pos;
+        int stat;
+
+        /* read the page */
+        chip->read_buf(mtd, p, eccsize);
+
+        /* move to ECC position if needed */
+        if (eccpos[0] != 0) {
+                /* This only works on large pages
+                 * because the ECC controller waits for
+                 * NAND_CMD_RNDOUTSTART after the
+                 * NAND_CMD_RNDOUT.
+                 * anyway, for small pages, the eccpos[0] == 0
+                 */
+                chip->cmdfunc(mtd, NAND_CMD_RNDOUT,
+                                mtd->writesize + eccpos[0], -1);
+        }
+
+        /* the ECC controller needs to read the ECC just after the data */
+        ecc_pos = oob + eccpos[0];
+        chip->read_buf(mtd, ecc_pos, eccbytes);
+
+        /* check if there's an error */
+        stat = chip->ecc.correct(mtd, p, oob, NULL);
+
+        if (stat < 0)
+                mtd->ecc_stats.failed++;
+        else
+                mtd->ecc_stats.corrected += stat;
+
+        /* get back to oob start (end of page) */
+        chip->cmdfunc(mtd, NAND_CMD_RNDOUT, mtd->writesize, -1);
+
+        /* read the oob */
+        chip->read_buf(mtd, oob, mtd->oobsize);
+
+        return 0;
+}
+
+/*
+ * HW ECC Correction
+ *
+ * function called after a read
+ *
+ * mtd:        MTD block structure
+ * dat:        raw data read from the chip
+ * read_ecc:   ECC from the chip (unused)
+ * isnull:     unused
+ *
+ * Detect and correct a 1 bit error for a page
+ */
+static int at91_nand_correct(struct mtd_info *mtd, u_char *dat,
+                u_char *read_ecc, u_char *isnull)
+{
+        struct nand_chip *nand_chip = mtd->priv;
+        struct at91_nand_host *host = nand_chip->priv;
+        unsigned int ecc_status;
+        unsigned int ecc_word, ecc_bit;
+
+        /* get the status from the Status Register */
+        ecc_status = ecc_readl(host->ecc, SR);
+
+        /* if there's no error */
+        if (likely(!(ecc_status & AT91_ECC_RECERR)))
+                return 0;
+
+        /* get error bit offset (4 bits) */
+        ecc_bit = ecc_readl(host->ecc, PR) & AT91_ECC_BITADDR;
+        /* get word address (12 bits) */
+        ecc_word = ecc_readl(host->ecc, PR) & AT91_ECC_WORDADDR;
+        ecc_word >>= 4;
+
+        /* if there are multiple errors */
+        if (ecc_status & AT91_ECC_MULERR) {
+                /* check if it is a freshly erased block
+                 * (filled with 0xff) */
+                if ((ecc_bit == AT91_ECC_BITADDR)
+                                && (ecc_word == (AT91_ECC_WORDADDR >> 4))) {
+                        /* the block has just been erased, return OK */
+                        return 0;
+                }
+                /* it doesn't seems to be a freshly
+                 * erased block.
+                 * We can't correct so many errors */
+                dev_dbg(host->dev, "at91_nand : multiple errors detected."
+                                " Unable to correct.\n");
+                return -EIO;
+        }
+
+        /* if there's a single bit error : we can correct it */
+        if (ecc_status & AT91_ECC_ECCERR) {
+                /* there's nothing much to do here.
+                 * the bit error is on the ECC itself.
+                 */
+                dev_dbg(host->dev, "at91_nand : one bit error on ECC code."
+                                " Nothing to correct\n");
+                return 0;
+        }
+
+        dev_dbg(host->dev, "at91_nand : one bit error on data."
+                        " (word offset in the page :"
+                        " 0x%x bit offset : 0x%x)\n",
+                        ecc_word, ecc_bit);
+        /* correct the error */
+        if (nand_chip->options & NAND_BUSWIDTH_16) {
+                /* 16 bits words */
+                ((unsigned short *) dat)[ecc_word] ^= (1 << ecc_bit);
+        } else {
+                /* 8 bits words */
+                dat[ecc_word] ^= (1 << ecc_bit);
+        }
+        dev_dbg(host->dev, "at91_nand : error corrected\n");
+        return 1;
+}
+
+/*
+ * Enable HW ECC : unsused
+ */
+static void at91_nand_hwctl(struct mtd_info *mtd, int mode) { ; }
+
 #ifdef CONFIG_MTD_PARTITIONS
-const char *part_probes[] = { "cmdlinepart", NULL };
+static const char *part_probes[] = { "cmdlinepart", NULL };
 #endif
 
 /*
@@ -94,6 +366,8 @@ static int __init at91_nand_probe(struct platform_device *pdev)
         struct at91_nand_host *host;
         struct mtd_info *mtd;
         struct nand_chip *nand_chip;
+        struct resource *regs;
+        struct resource *mem;
         int res;
 
 #ifdef CONFIG_MTD_PARTITIONS
@@ -108,8 +382,13 @@ static int __init at91_nand_probe(struct platform_device *pdev)
                 return -ENOMEM;
         }
 
-        host->io_base = ioremap(pdev->resource[0].start,
-                                pdev->resource[0].end - pdev->resource[0].start + 1);
+        mem = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+        if (!mem) {
+                printk(KERN_ERR "at91_nand: can't get I/O resource mem\n");
+                return -ENXIO;
+        }
+
+        host->io_base = ioremap(mem->start, mem->end - mem->start + 1);
         if (host->io_base == NULL) {
                 printk(KERN_ERR "at91_nand: ioremap failed\n");
                 kfree(host);
@@ -119,6 +398,7 @@ static int __init at91_nand_probe(struct platform_device *pdev)
         mtd = &host->mtd;
         nand_chip = &host->nand_chip;
         host->board = pdev->dev.platform_data;
+        host->dev = &pdev->dev;
 
         nand_chip->priv = host;         /* link the private data structures */
         mtd->priv = nand_chip;
@@ -132,7 +412,32 @@ static int __init at91_nand_probe(struct platform_device *pdev)
         if (host->board->rdy_pin)
                 nand_chip->dev_ready = at91_nand_device_ready;
 
+        regs = platform_get_resource(pdev, IORESOURCE_MEM, 1);
+        if (!regs && hard_ecc) {
+                printk(KERN_ERR "at91_nand: can't get I/O resource "
+                                "regs\nFalling back on software ECC\n");
+        }
+
         nand_chip->ecc.mode = NAND_ECC_SOFT;    /* enable ECC */
+        if (no_ecc)
+                nand_chip->ecc.mode = NAND_ECC_NONE;
+        if (hard_ecc && regs) {
+                host->ecc = ioremap(regs->start, regs->end - regs->start + 1);
+                if (host->ecc == NULL) {
+                        printk(KERN_ERR "at91_nand: ioremap failed\n");
+                        res = -EIO;
+                        goto err_ecc_ioremap;
+                }
+                nand_chip->ecc.mode = NAND_ECC_HW_SYNDROME;
+                nand_chip->ecc.calculate = at91_nand_calculate;
+                nand_chip->ecc.correct = at91_nand_correct;
+                nand_chip->ecc.hwctl = at91_nand_hwctl;
+                nand_chip->ecc.read_page = at91_nand_read_page;
+                nand_chip->ecc.bytes = 4;
+                nand_chip->ecc.prepad = 0;
+                nand_chip->ecc.postpad = 0;
+        }
+
         nand_chip->chip_delay = 20;             /* 20us command delay time */
 
         if (host->board->bus_width_16)          /* 16-bit bus width */
@@ -149,8 +454,53 @@ static int __init at91_nand_probe(struct platform_device *pdev)
                 }
         }
 
-        /* Scan to find existance of the device */
-        if (nand_scan(mtd, 1)) {
+        /* first scan to find the device and get the page size */
+        if (nand_scan_ident(mtd, 1)) {
+                res = -ENXIO;
+                goto out;
+        }
+
+        if (nand_chip->ecc.mode == NAND_ECC_HW_SYNDROME) {
+                /* ECC is calculated for the whole page (1 step) */
+                nand_chip->ecc.size = mtd->writesize;
+
+                /* set ECC page size and oob layout */
+                switch (mtd->writesize) {
+                case 512:
+                        nand_chip->ecc.layout = &at91_oobinfo_small;
+                        nand_chip->ecc.read_oob = at91_nand_read_oob_512;
+                        nand_chip->ecc.write_oob = at91_nand_write_oob_512;
+                        ecc_writel(host->ecc, MR, AT91_ECC_PAGESIZE_528);
+                        break;
+                case 1024:
+                        nand_chip->ecc.layout = &at91_oobinfo_large;
+                        ecc_writel(host->ecc, MR, AT91_ECC_PAGESIZE_1056);
+                        break;
+                case 2048:
+                        nand_chip->ecc.layout = &at91_oobinfo_large;
+                        ecc_writel(host->ecc, MR, AT91_ECC_PAGESIZE_2112);
+                        break;
+                case 4096:
+                        nand_chip->ecc.layout = &at91_oobinfo_large;
+                        ecc_writel(host->ecc, MR, AT91_ECC_PAGESIZE_4224);
+                        break;
+                default:
+                        /* page size not handled by HW ECC */
+                        /* switching back to soft ECC */
+                        nand_chip->ecc.mode = NAND_ECC_SOFT;
+                        nand_chip->ecc.calculate = NULL;
+                        nand_chip->ecc.correct = NULL;
+                        nand_chip->ecc.hwctl = NULL;
+                        nand_chip->ecc.read_page = NULL;
+                        nand_chip->ecc.postpad = 0;
+                        nand_chip->ecc.prepad = 0;
+                        nand_chip->ecc.bytes = 0;
+                        break;
+                }
+        }
+
+        /* second phase scan */
+        if (nand_scan_tail(mtd)) {
                 res = -ENXIO;
                 goto out;
         }
@@ -179,9 +529,15 @@ static int __init at91_nand_probe(struct platform_device *pdev)
         if (!res)
                 return res;
 
+#ifdef CONFIG_MTD_PARTITIONS
 release:
+#endif
         nand_release(mtd);
+
 out:
+        iounmap(host->ecc);
+
+err_ecc_ioremap:
         at91_nand_disable(host);
         platform_set_drvdata(pdev, NULL);
         iounmap(host->io_base);
@@ -202,6 +558,7 @@ static int __devexit at91_nand_remove(struct platform_device *pdev)
         at91_nand_disable(host);
 
         iounmap(host->io_base);
+        iounmap(host->ecc);
         kfree(host);
 
         return 0;
@@ -233,4 +590,5 @@ module_exit(at91_nand_exit);
 
 MODULE_LICENSE("GPL");
 MODULE_AUTHOR("Rick Bronson");
-MODULE_DESCRIPTION("NAND/SmartMedia driver for AT91RM9200");
+MODULE_DESCRIPTION("NAND/SmartMedia driver for AT91RM9200 / AT91SAM9");
+MODULE_ALIAS("platform:at91_nand");
diff --git a/drivers/mtd/nand/bf5xx_nand.c b/drivers/mtd/nand/bf5xx_nand.c
index 747042ab094a..e87a57297328 100644
--- a/drivers/mtd/nand/bf5xx_nand.c
+++ b/drivers/mtd/nand/bf5xx_nand.c
@@ -1,6 +1,6 @@
 /* linux/drivers/mtd/nand/bf5xx_nand.c
  *
- * Copyright 2006-2007 Analog Devices Inc.
+ * Copyright 2006-2008 Analog Devices Inc.
  *      http://blackfin.uclinux.org/
  *      Bryan Wu <bryan.wu@analog.com>
  *
@@ -74,7 +74,7 @@ static int hardware_ecc = 1;
 static int hardware_ecc;
 #endif
 
-static unsigned short bfin_nfc_pin_req[] =
+static const unsigned short bfin_nfc_pin_req[] =
         {P_NAND_CE,
          P_NAND_RB,
          P_NAND_D0,
@@ -581,12 +581,6 @@ static int bf5xx_nand_hw_init(struct bf5xx_nand_info *info)
         bfin_write_NFC_IRQSTAT(val);
         SSYNC();
 
-        if (peripheral_request_list(bfin_nfc_pin_req, DRV_NAME)) {
-                printk(KERN_ERR DRV_NAME
-                ": Requesting Peripherals failed\n");
-                return -EFAULT;
-        }
-
         /* DMA initialization  */
         if (bf5xx_nand_dma_init(info))
                 err = -ENXIO;
@@ -654,6 +648,12 @@ static int bf5xx_nand_probe(struct platform_device *pdev)
 
         dev_dbg(&pdev->dev, "(%p)\n", pdev);
 
+        if (peripheral_request_list(bfin_nfc_pin_req, DRV_NAME)) {
+                printk(KERN_ERR DRV_NAME
+                ": Requesting Peripherals failed\n");
+                return -EFAULT;
+        }
+
         if (!plat) {
                 dev_err(&pdev->dev, "no platform specific information\n");
                 goto exit_error;
@@ -803,3 +803,4 @@ module_exit(bf5xx_nand_exit);
 MODULE_LICENSE("GPL");
 MODULE_AUTHOR(DRV_AUTHOR);
 MODULE_DESCRIPTION(DRV_DESC);
+MODULE_ALIAS("platform:" DRV_NAME);
diff --git a/drivers/mtd/nand/cs553x_nand.c b/drivers/mtd/nand/cs553x_nand.c
index 8dab69657b19..3370a800fd36 100644
--- a/drivers/mtd/nand/cs553x_nand.c
+++ b/drivers/mtd/nand/cs553x_nand.c
@@ -279,7 +279,7 @@ static int is_geode(void)
 
 
 #ifdef CONFIG_MTD_PARTITIONS
-const char *part_probes[] = { "cmdlinepart", NULL };
+static const char *part_probes[] = { "cmdlinepart", NULL };
 #endif
 
 
diff --git a/drivers/mtd/nand/fsl_elbc_nand.c b/drivers/mtd/nand/fsl_elbc_nand.c
index 378b7aa63812..4b69aacdf5ca 100644
--- a/drivers/mtd/nand/fsl_elbc_nand.c
+++ b/drivers/mtd/nand/fsl_elbc_nand.c
@@ -184,11 +184,11 @@ static int fsl_elbc_run_command(struct mtd_info *mtd)
                  in_be32(&lbc->fbar), in_be32(&lbc->fpar),
                  in_be32(&lbc->fbcr), priv->bank);
 
+        ctrl->irq_status = 0;
         /* execute special operation */
         out_be32(&lbc->lsor, priv->bank);
 
         /* wait for FCM complete flag or timeout */
-        ctrl->irq_status = 0;
         wait_event_timeout(ctrl->irq_wait, ctrl->irq_status,
                            FCM_TIMEOUT_MSECS * HZ/1000);
         ctrl->status = ctrl->irq_status;
@@ -346,19 +346,20 @@ static void fsl_elbc_cmdfunc(struct mtd_info *mtd, unsigned int command,
                 ctrl->column = column;
                 ctrl->oob = 0;
 
-                fcr = (NAND_CMD_PAGEPROG << FCR_CMD1_SHIFT) |
-                      (NAND_CMD_SEQIN << FCR_CMD2_SHIFT);
-
                 if (priv->page_size) {
+                        fcr = (NAND_CMD_SEQIN << FCR_CMD0_SHIFT) |
+                              (NAND_CMD_PAGEPROG << FCR_CMD1_SHIFT);
+
                         out_be32(&lbc->fir,
                                  (FIR_OP_CW0 << FIR_OP0_SHIFT) |
                                  (FIR_OP_CA  << FIR_OP1_SHIFT) |
                                  (FIR_OP_PA  << FIR_OP2_SHIFT) |
                                  (FIR_OP_WB  << FIR_OP3_SHIFT) |
                                  (FIR_OP_CW1 << FIR_OP4_SHIFT));
-
-                        fcr |= NAND_CMD_READ0 << FCR_CMD0_SHIFT;
                 } else {
+                        fcr = (NAND_CMD_PAGEPROG << FCR_CMD1_SHIFT) |
+                              (NAND_CMD_SEQIN << FCR_CMD2_SHIFT);
+
                         out_be32(&lbc->fir,
                                  (FIR_OP_CW0 << FIR_OP0_SHIFT) |
                                  (FIR_OP_CM2 << FIR_OP1_SHIFT) |
@@ -480,7 +481,7 @@ static void fsl_elbc_write_buf(struct mtd_info *mtd, const u8 *buf, int len)
         struct fsl_elbc_ctrl *ctrl = priv->ctrl;
         unsigned int bufsize = mtd->writesize + mtd->oobsize;
 
-        if (len < 0) {
+        if (len <= 0) {
                 dev_err(ctrl->dev, "write_buf of %d bytes", len);
                 ctrl->status = 0;
                 return;
@@ -495,6 +496,15 @@ static void fsl_elbc_write_buf(struct mtd_info *mtd, const u8 *buf, int len)
         }
 
         memcpy_toio(&ctrl->addr[ctrl->index], buf, len);
+        /*
+         * This is workaround for the weird elbc hangs during nand write,
+         * Scott Wood says: "...perhaps difference in how long it takes a
+         * write to make it through the localbus compared to a write to IMMR
+         * is causing problems, and sync isn't helping for some reason."
+         * Reading back the last byte helps though.
+         */
+        in_8(&ctrl->addr[ctrl->index] + len - 1);
+
         ctrl->index += len;
 }
 
@@ -666,7 +676,7 @@ static int fsl_elbc_chip_init_tail(struct mtd_info *mtd)
         /* adjust Option Register and ECC to match Flash page size */
         if (mtd->writesize == 512) {
                 priv->page_size = 0;
-                clrbits32(&lbc->bank[priv->bank].or, ~OR_FCM_PGS);
+                clrbits32(&lbc->bank[priv->bank].or, OR_FCM_PGS);
         } else if (mtd->writesize == 2048) {
                 priv->page_size = 1;
                 setbits32(&lbc->bank[priv->bank].or, OR_FCM_PGS);
@@ -687,11 +697,6 @@ static int fsl_elbc_chip_init_tail(struct mtd_info *mtd)
                 return -1;
         }
 
-        /* The default u-boot configuration on MPC8313ERDB causes errors;
-         * more delay is needed.  This should be safe for other boards
-         * as well.
-         */
-        setbits32(&lbc->bank[priv->bank].or, 0x70);
         return 0;
 }
 
@@ -779,6 +784,8 @@ static int fsl_elbc_chip_remove(struct fsl_elbc_mtd *priv)
 
         nand_release(&priv->mtd);
 
+        kfree(priv->mtd.name);
+
         if (priv->vbase)
                 iounmap(priv->vbase);
 
@@ -839,6 +846,12 @@ static int fsl_elbc_chip_probe(struct fsl_elbc_ctrl *ctrl,
                 goto err;
         }
 
+        priv->mtd.name = kasprintf(GFP_KERNEL, "%x.flash", res.start);
+        if (!priv->mtd.name) {
+                ret = -ENOMEM;
+                goto err;
+        }
+
         ret = fsl_elbc_chip_init(priv);
         if (ret)
                 goto err;
diff --git a/drivers/mtd/nand/fsl_upm.c b/drivers/mtd/nand/fsl_upm.c
new file mode 100644
index 000000000000..1ebfd87f00b4
--- /dev/null
+++ b/drivers/mtd/nand/fsl_upm.c
@@ -0,0 +1,291 @@
+/*
+ * Freescale UPM NAND driver.
+ *
+ * Copyright © 2007-2008  MontaVista Software, Inc.
+ *
+ * Author: Anton Vorontsov <avorontsov@ru.mvista.com>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ */
+
+#include <linux/kernel.h>
+#include <linux/module.h>
+#include <linux/mtd/nand.h>
+#include <linux/mtd/nand_ecc.h>
+#include <linux/mtd/partitions.h>
+#include <linux/mtd/mtd.h>
+#include <linux/of_platform.h>
+#include <linux/of_gpio.h>
+#include <linux/io.h>
+#include <asm/fsl_lbc.h>
+
+struct fsl_upm_nand {
+        struct device *dev;
+        struct mtd_info mtd;
+        struct nand_chip chip;
+        int last_ctrl;
+#ifdef CONFIG_MTD_PARTITIONS
+        struct mtd_partition *parts;
+#endif
+
+        struct fsl_upm upm;
+        uint8_t upm_addr_offset;
+        uint8_t upm_cmd_offset;
+        void __iomem *io_base;
+        int rnb_gpio;
+        const uint32_t *wait_pattern;
+        const uint32_t *wait_write;
+        int chip_delay;
+};
+
+#define to_fsl_upm_nand(mtd) container_of(mtd, struct fsl_upm_nand, mtd)
+
+static int fun_chip_ready(struct mtd_info *mtd)
+{
+        struct fsl_upm_nand *fun = to_fsl_upm_nand(mtd);
+
+        if (gpio_get_value(fun->rnb_gpio))
+                return 1;
+
+        dev_vdbg(fun->dev, "busy\n");
+        return 0;
+}
+
+static void fun_wait_rnb(struct fsl_upm_nand *fun)
+{
+        int cnt = 1000000;
+
+        if (fun->rnb_gpio >= 0) {
+                while (--cnt && !fun_chip_ready(&fun->mtd))
+                        cpu_relax();
+        }
+
+        if (!cnt)
+                dev_err(fun->dev, "tired waiting for RNB\n");
+}
+
+static void fun_cmd_ctrl(struct mtd_info *mtd, int cmd, unsigned int ctrl)
+{
+        struct fsl_upm_nand *fun = to_fsl_upm_nand(mtd);
+
+        if (!(ctrl & fun->last_ctrl)) {
+                fsl_upm_end_pattern(&fun->upm);
+
+                if (cmd == NAND_CMD_NONE)
+                        return;
+
+                fun->last_ctrl = ctrl & (NAND_ALE | NAND_CLE);
+        }
+
+        if (ctrl & NAND_CTRL_CHANGE) {
+                if (ctrl & NAND_ALE)
+                        fsl_upm_start_pattern(&fun->upm, fun->upm_addr_offset);
+                else if (ctrl & NAND_CLE)
+                        fsl_upm_start_pattern(&fun->upm, fun->upm_cmd_offset);
+        }
+
+        fsl_upm_run_pattern(&fun->upm, fun->io_base, cmd);
+
+        if (fun->wait_pattern)
+                fun_wait_rnb(fun);
+}
+
+static uint8_t fun_read_byte(struct mtd_info *mtd)
+{
+        struct fsl_upm_nand *fun = to_fsl_upm_nand(mtd);
+
+        return in_8(fun->chip.IO_ADDR_R);
+}
+
+static void fun_read_buf(struct mtd_info *mtd, uint8_t *buf, int len)
+{
+        struct fsl_upm_nand *fun = to_fsl_upm_nand(mtd);
+        int i;
+
+        for (i = 0; i < len; i++)
+                buf[i] = in_8(fun->chip.IO_ADDR_R);
+}
+
+static void fun_write_buf(struct mtd_info *mtd, const uint8_t *buf, int len)
+{
+        struct fsl_upm_nand *fun = to_fsl_upm_nand(mtd);
+        int i;
+
+        for (i = 0; i < len; i++) {
+                out_8(fun->chip.IO_ADDR_W, buf[i]);
+                if (fun->wait_write)
+                        fun_wait_rnb(fun);
+        }
+}
+
+static int __devinit fun_chip_init(struct fsl_upm_nand *fun)
+{
+        int ret;
+#ifdef CONFIG_MTD_PARTITIONS
+        static const char *part_types[] = { "cmdlinepart", NULL, };
+#endif
+
+        fun->chip.IO_ADDR_R = fun->io_base;
+        fun->chip.IO_ADDR_W = fun->io_base;
+        fun->chip.cmd_ctrl = fun_cmd_ctrl;
+        fun->chip.chip_delay = fun->chip_delay;
+        fun->chip.read_byte = fun_read_byte;
+        fun->chip.read_buf = fun_read_buf;
+        fun->chip.write_buf = fun_write_buf;
+        fun->chip.ecc.mode = NAND_ECC_SOFT;
+
+        if (fun->rnb_gpio >= 0)
+                fun->chip.dev_ready = fun_chip_ready;
+
+        fun->mtd.priv = &fun->chip;
+        fun->mtd.owner = THIS_MODULE;
+
+        ret = nand_scan(&fun->mtd, 1);
+        if (ret)
+                return ret;
+
+        fun->mtd.name = fun->dev->bus_id;
+
+#ifdef CONFIG_MTD_PARTITIONS
+        ret = parse_mtd_partitions(&fun->mtd, part_types, &fun->parts, 0);
+        if (ret > 0)
+                return add_mtd_partitions(&fun->mtd, fun->parts, ret);
+#endif
+        return add_mtd_device(&fun->mtd);
+}
+
+static int __devinit fun_probe(struct of_device *ofdev,
+                               const struct of_device_id *ofid)
+{
+        struct fsl_upm_nand *fun;
+        struct resource io_res;
+        const uint32_t *prop;
+        int ret;
+        int size;
+
+        fun = kzalloc(sizeof(*fun), GFP_KERNEL);
+        if (!fun)
+                return -ENOMEM;
+
+        ret = of_address_to_resource(ofdev->node, 0, &io_res);
+        if (ret) {
+                dev_err(&ofdev->dev, "can't get IO base\n");
+                goto err1;
+        }
+
+        ret = fsl_upm_find(io_res.start, &fun->upm);
+        if (ret) {
+                dev_err(&ofdev->dev, "can't find UPM\n");
+                goto err1;
+        }
+
+        prop = of_get_property(ofdev->node, "fsl,upm-addr-offset", &size);
+        if (!prop || size != sizeof(uint32_t)) {
+                dev_err(&ofdev->dev, "can't get UPM address offset\n");
+                ret = -EINVAL;
+                goto err2;
+        }
+        fun->upm_addr_offset = *prop;
+
+        prop = of_get_property(ofdev->node, "fsl,upm-cmd-offset", &size);
+        if (!prop || size != sizeof(uint32_t)) {
+                dev_err(&ofdev->dev, "can't get UPM command offset\n");
+                ret = -EINVAL;
+                goto err2;
+        }
+        fun->upm_cmd_offset = *prop;
+
+        fun->rnb_gpio = of_get_gpio(ofdev->node, 0);
+        if (fun->rnb_gpio >= 0) {
+                ret = gpio_request(fun->rnb_gpio, ofdev->dev.bus_id);
+                if (ret) {
+                        dev_err(&ofdev->dev, "can't request RNB gpio\n");
+                        goto err2;
+                }
+                gpio_direction_input(fun->rnb_gpio);
+        } else if (fun->rnb_gpio == -EINVAL) {
+                dev_err(&ofdev->dev, "specified RNB gpio is invalid\n");
+                goto err2;
+        }
+
+        fun->io_base = devm_ioremap_nocache(&ofdev->dev, io_res.start,
+                                          io_res.end - io_res.start + 1);
+        if (!fun->io_base) {
+                ret = -ENOMEM;
+                goto err2;
+        }
+
+        fun->dev = &ofdev->dev;
+        fun->last_ctrl = NAND_CLE;
+        fun->wait_pattern = of_get_property(ofdev->node, "fsl,wait-pattern",
+                                            NULL);
+        fun->wait_write = of_get_property(ofdev->node, "fsl,wait-write", NULL);
+
+        prop = of_get_property(ofdev->node, "chip-delay", NULL);
+        if (prop)
+                fun->chip_delay = *prop;
+        else
+                fun->chip_delay = 50;
+
+        ret = fun_chip_init(fun);
+        if (ret)
+                goto err2;
+
+        dev_set_drvdata(&ofdev->dev, fun);
+
+        return 0;
+err2:
+        if (fun->rnb_gpio >= 0)
+                gpio_free(fun->rnb_gpio);
+err1:
+        kfree(fun);
+
+        return ret;
+}
+
+static int __devexit fun_remove(struct of_device *ofdev)
+{
+        struct fsl_upm_nand *fun = dev_get_drvdata(&ofdev->dev);
+
+        nand_release(&fun->mtd);
+
+        if (fun->rnb_gpio >= 0)
+                gpio_free(fun->rnb_gpio);
+
+        kfree(fun);
+
+        return 0;
+}
+
+static struct of_device_id of_fun_match[] = {
+        { .compatible = "fsl,upm-nand" },
+        {},
+};
+MODULE_DEVICE_TABLE(of, of_fun_match);
+
+static struct of_platform_driver of_fun_driver = {
+        .name           = "fsl,upm-nand",
+        .match_table    = of_fun_match,
+        .probe          = fun_probe,
+        .remove         = __devexit_p(fun_remove),
+};
+
+static int __init fun_module_init(void)
+{
+        return of_register_platform_driver(&of_fun_driver);
+}
+module_init(fun_module_init);
+
+static void __exit fun_module_exit(void)
+{
+        of_unregister_platform_driver(&of_fun_driver);
+}
+module_exit(fun_module_exit);
+
+MODULE_LICENSE("GPL");
+MODULE_AUTHOR("Anton Vorontsov <avorontsov@ru.mvista.com>");
+MODULE_DESCRIPTION("Driver for NAND chips working through Freescale "
+                   "LocalBus User-Programmable Machine");
diff --git a/drivers/mtd/nand/nand_base.c b/drivers/mtd/nand/nand_base.c
index 7acb1a0e7409..ba1bdf787323 100644
--- a/drivers/mtd/nand/nand_base.c
+++ b/drivers/mtd/nand/nand_base.c
@@ -2229,6 +2229,7 @@ static struct nand_flash_dev *nand_get_flash_type(struct mtd_info *mtd,
 {
         struct nand_flash_dev *type = NULL;
         int i, dev_id, maf_idx;
+        int tmp_id, tmp_manf;
 
         /* Select the device */
         chip->select_chip(mtd, 0);
@@ -2240,6 +2241,26 @@ static struct nand_flash_dev *nand_get_flash_type(struct mtd_info *mtd,
         *maf_id = chip->read_byte(mtd);
         dev_id = chip->read_byte(mtd);
 
+        /* Try again to make sure, as some systems the bus-hold or other
+         * interface concerns can cause random data which looks like a
+         * possibly credible NAND flash to appear. If the two results do
+         * not match, ignore the device completely.
+         */
+
+        chip->cmdfunc(mtd, NAND_CMD_READID, 0x00, -1);
+
+        /* Read manufacturer and device IDs */
+
+        tmp_manf = chip->read_byte(mtd);
+        tmp_id = chip->read_byte(mtd);
+
+        if (tmp_manf != *maf_id || tmp_id != dev_id) {
+                printk(KERN_INFO "%s: second ID read did not match "
+                       "%02x,%02x against %02x,%02x\n", __func__,
+                       *maf_id, dev_id, tmp_manf, tmp_id);
+                return ERR_PTR(-ENODEV);
+        }
+
         /* Lookup the flash id */
         for (i = 0; nand_flash_ids[i].name != NULL; i++) {
                 if (dev_id == nand_flash_ids[i].id) {
diff --git a/drivers/mtd/nand/ndfc.c b/drivers/mtd/nand/ndfc.c
index 1c0e89f00e8d..955959eb02d4 100644
--- a/drivers/mtd/nand/ndfc.c
+++ b/drivers/mtd/nand/ndfc.c
@@ -317,3 +317,5 @@ module_exit(ndfc_nand_exit);
 MODULE_LICENSE("GPL");
 MODULE_AUTHOR("Thomas Gleixner <tglx@linutronix.de>");
 MODULE_DESCRIPTION("Platform driver for NDFC");
+MODULE_ALIAS("platform:ndfc-chip");
+MODULE_ALIAS("platform:ndfc-nand");
diff --git a/drivers/mtd/nand/orion_nand.c b/drivers/mtd/nand/orion_nand.c
index ec5ad28b237e..59e05a1c50cf 100644
--- a/drivers/mtd/nand/orion_nand.c
+++ b/drivers/mtd/nand/orion_nand.c
@@ -169,3 +169,4 @@ module_exit(orion_nand_exit);
 MODULE_LICENSE("GPL");
 MODULE_AUTHOR("Tzachi Perelstein");
 MODULE_DESCRIPTION("NAND glue for Orion platforms");
+MODULE_ALIAS("platform:orion_nand");
diff --git a/drivers/mtd/nand/plat_nand.c b/drivers/mtd/nand/plat_nand.c
index f6d5c2adc4fd..f674c5427b17 100644
--- a/drivers/mtd/nand/plat_nand.c
+++ b/drivers/mtd/nand/plat_nand.c
@@ -54,6 +54,7 @@ static int __init plat_nand_probe(struct platform_device *pdev)
         data->chip.priv = &data;
         data->mtd.priv = &data->chip;
         data->mtd.owner = THIS_MODULE;
+        data->mtd.name = pdev->dev.bus_id;
 
         data->chip.IO_ADDR_R = data->io_base;
         data->chip.IO_ADDR_W = data->io_base;
@@ -150,3 +151,4 @@ module_exit(plat_nand_exit);
 MODULE_LICENSE("GPL");
 MODULE_AUTHOR("Vitaly Wool");
 MODULE_DESCRIPTION("Simple generic NAND driver");
+MODULE_ALIAS("platform:gen_nand");
diff --git a/drivers/mtd/nand/pxa3xx_nand.c b/drivers/mtd/nand/pxa3xx_nand.c
new file mode 100644
index 000000000000..fceb468ccdec
--- /dev/null
+++ b/drivers/mtd/nand/pxa3xx_nand.c
@@ -0,0 +1,1249 @@
+/*
+ * drivers/mtd/nand/pxa3xx_nand.c
+ *
+ * Copyright © 2005 Intel Corporation
+ * Copyright © 2006 Marvell International Ltd.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+
+#include <linux/module.h>
+#include <linux/interrupt.h>
+#include <linux/platform_device.h>
+#include <linux/dma-mapping.h>
+#include <linux/delay.h>
+#include <linux/clk.h>
+#include <linux/mtd/mtd.h>
+#include <linux/mtd/nand.h>
+#include <linux/mtd/partitions.h>
+#include <linux/io.h>
+#include <linux/irq.h>
+#include <asm/dma.h>
+
+#include <asm/arch/pxa-regs.h>
+#include <asm/arch/pxa3xx_nand.h>
+
+#define CHIP_DELAY_TIMEOUT      (2 * HZ/10)
+
+/* registers and bit definitions */
+#define NDCR            (0x00) /* Control register */
+#define NDTR0CS0        (0x04) /* Timing Parameter 0 for CS0 */
+#define NDTR1CS0        (0x0C) /* Timing Parameter 1 for CS0 */
+#define NDSR            (0x14) /* Status Register */
+#define NDPCR           (0x18) /* Page Count Register */
+#define NDBDR0          (0x1C) /* Bad Block Register 0 */
+#define NDBDR1          (0x20) /* Bad Block Register 1 */
+#define NDDB            (0x40) /* Data Buffer */
+#define NDCB0           (0x48) /* Command Buffer0 */
+#define NDCB1           (0x4C) /* Command Buffer1 */
+#define NDCB2           (0x50) /* Command Buffer2 */
+
+#define NDCR_SPARE_EN           (0x1 << 31)
+#define NDCR_ECC_EN             (0x1 << 30)
+#define NDCR_DMA_EN             (0x1 << 29)
+#define NDCR_ND_RUN             (0x1 << 28)
+#define NDCR_DWIDTH_C           (0x1 << 27)
+#define NDCR_DWIDTH_M           (0x1 << 26)
+#define NDCR_PAGE_SZ            (0x1 << 24)
+#define NDCR_NCSX               (0x1 << 23)
+#define NDCR_ND_MODE            (0x3 << 21)
+#define NDCR_NAND_MODE          (0x0)
+#define NDCR_CLR_PG_CNT         (0x1 << 20)
+#define NDCR_CLR_ECC            (0x1 << 19)
+#define NDCR_RD_ID_CNT_MASK     (0x7 << 16)
+#define NDCR_RD_ID_CNT(x)       (((x) << 16) & NDCR_RD_ID_CNT_MASK)
+
+#define NDCR_RA_START           (0x1 << 15)
+#define NDCR_PG_PER_BLK         (0x1 << 14)
+#define NDCR_ND_ARB_EN          (0x1 << 12)
+
+#define NDSR_MASK               (0xfff)
+#define NDSR_RDY                (0x1 << 11)
+#define NDSR_CS0_PAGED          (0x1 << 10)
+#define NDSR_CS1_PAGED          (0x1 << 9)
+#define NDSR_CS0_CMDD           (0x1 << 8)
+#define NDSR_CS1_CMDD           (0x1 << 7)
+#define NDSR_CS0_BBD            (0x1 << 6)
+#define NDSR_CS1_BBD            (0x1 << 5)
+#define NDSR_DBERR              (0x1 << 4)
+#define NDSR_SBERR              (0x1 << 3)
+#define NDSR_WRDREQ             (0x1 << 2)
+#define NDSR_RDDREQ             (0x1 << 1)
+#define NDSR_WRCMDREQ           (0x1)
+
+#define NDCB0_AUTO_RS           (0x1 << 25)
+#define NDCB0_CSEL              (0x1 << 24)
+#define NDCB0_CMD_TYPE_MASK     (0x7 << 21)
+#define NDCB0_CMD_TYPE(x)       (((x) << 21) & NDCB0_CMD_TYPE_MASK)
+#define NDCB0_NC                (0x1 << 20)
+#define NDCB0_DBC               (0x1 << 19)
+#define NDCB0_ADDR_CYC_MASK     (0x7 << 16)
+#define NDCB0_ADDR_CYC(x)       (((x) << 16) & NDCB0_ADDR_CYC_MASK)
+#define NDCB0_CMD2_MASK         (0xff << 8)
+#define NDCB0_CMD1_MASK         (0xff)
+#define NDCB0_ADDR_CYC_SHIFT    (16)
+
+/* dma-able I/O address for the NAND data and commands */
+#define NDCB0_DMA_ADDR          (0x43100048)
+#define NDDB_DMA_ADDR           (0x43100040)
+
+/* macros for registers read/write */
+#define nand_writel(info, off, val)     \
+        __raw_writel((val), (info)->mmio_base + (off))
+
+#define nand_readl(info, off)           \
+        __raw_readl((info)->mmio_base + (off))
+
+/* error code and state */
+enum {
+        ERR_NONE        = 0,
+        ERR_DMABUSERR   = -1,
+        ERR_SENDCMD     = -2,
+        ERR_DBERR       = -3,
+        ERR_BBERR       = -4,
+};
+
+enum {
+        STATE_READY     = 0,
+        STATE_CMD_HANDLE,
+        STATE_DMA_READING,
+        STATE_DMA_WRITING,
+        STATE_DMA_DONE,
+        STATE_PIO_READING,
+        STATE_PIO_WRITING,
+};
+
+struct pxa3xx_nand_timing {
+        unsigned int    tCH;  /* Enable signal hold time */
+        unsigned int    tCS;  /* Enable signal setup time */
+        unsigned int    tWH;  /* ND_nWE high duration */
+        unsigned int    tWP;  /* ND_nWE pulse time */
+        unsigned int    tRH;  /* ND_nRE high duration */
+        unsigned int    tRP;  /* ND_nRE pulse width */
+        unsigned int    tR;   /* ND_nWE high to ND_nRE low for read */
+        unsigned int    tWHR; /* ND_nWE high to ND_nRE low for status read */
+        unsigned int    tAR;  /* ND_ALE low to ND_nRE low delay */
+};
+
+struct pxa3xx_nand_cmdset {
+        uint16_t        read1;
+        uint16_t        read2;
+        uint16_t        program;
+        uint16_t        read_status;
+        uint16_t        read_id;
+        uint16_t        erase;
+        uint16_t        reset;
+        uint16_t        lock;
+        uint16_t        unlock;
+        uint16_t        lock_status;
+};
+
+struct pxa3xx_nand_flash {
+        struct pxa3xx_nand_timing *timing; /* NAND Flash timing */
+        struct pxa3xx_nand_cmdset *cmdset;
+
+        uint32_t page_per_block;/* Pages per block (PG_PER_BLK) */
+        uint32_t page_size;     /* Page size in bytes (PAGE_SZ) */
+        uint32_t flash_width;   /* Width of Flash memory (DWIDTH_M) */
+        uint32_t dfc_width;     /* Width of flash controller(DWIDTH_C) */
+        uint32_t num_blocks;    /* Number of physical blocks in Flash */
+        uint32_t chip_id;
+
+        /* NOTE: these are automatically calculated, do not define */
+        size_t          oob_size;
+        size_t          read_id_bytes;
+
+        unsigned int    col_addr_cycles;
+        unsigned int    row_addr_cycles;
+};
+
+struct pxa3xx_nand_info {
+        struct nand_chip        nand_chip;
+
+        struct platform_device   *pdev;
+        struct pxa3xx_nand_flash *flash_info;
+
+        struct clk              *clk;
+        void __iomem            *mmio_base;
+
+        unsigned int            buf_start;
+        unsigned int            buf_count;
+
+        /* DMA information */
+        int                     drcmr_dat;
+        int                     drcmr_cmd;
+
+        unsigned char           *data_buff;
+        dma_addr_t              data_buff_phys;
+        size_t                  data_buff_size;
+        int                     data_dma_ch;
+        struct pxa_dma_desc     *data_desc;
+        dma_addr_t              data_desc_addr;
+
+        uint32_t                reg_ndcr;
+
+        /* saved column/page_addr during CMD_SEQIN */
+        int                     seqin_column;
+        int                     seqin_page_addr;
+
+        /* relate to the command */
+        unsigned int            state;
+
+        int                     use_ecc;        /* use HW ECC ? */
+        int                     use_dma;        /* use DMA ? */
+
+        size_t                  data_size;      /* data size in FIFO */
+        int                     retcode;
+        struct completion       cmd_complete;
+
+        /* generated NDCBx register values */
+        uint32_t                ndcb0;
+        uint32_t                ndcb1;
+        uint32_t                ndcb2;
+};
+
+static int use_dma = 1;
+module_param(use_dma, bool, 0444);
+MODULE_PARM_DESC(use_dma, "enable DMA for data transfering to/from NAND HW");
+
+static struct pxa3xx_nand_cmdset smallpage_cmdset = {
+        .read1          = 0x0000,
+        .read2          = 0x0050,
+        .program        = 0x1080,
+        .read_status    = 0x0070,
+        .read_id        = 0x0090,
+        .erase          = 0xD060,
+        .reset          = 0x00FF,
+        .lock           = 0x002A,
+        .unlock         = 0x2423,
+        .lock_status    = 0x007A,
+};
+
+static struct pxa3xx_nand_cmdset largepage_cmdset = {
+        .read1          = 0x3000,
+        .read2          = 0x0050,
+        .program        = 0x1080,
+        .read_status    = 0x0070,
+        .read_id        = 0x0090,
+        .erase          = 0xD060,
+        .reset          = 0x00FF,
+        .lock           = 0x002A,
+        .unlock         = 0x2423,
+        .lock_status    = 0x007A,
+};
+
+static struct pxa3xx_nand_timing samsung512MbX16_timing = {
+        .tCH    = 10,
+        .tCS    = 0,
+        .tWH    = 20,
+        .tWP    = 40,
+        .tRH    = 30,
+        .tRP    = 40,
+        .tR     = 11123,
+        .tWHR   = 110,
+        .tAR    = 10,
+};
+
+static struct pxa3xx_nand_flash samsung512MbX16 = {
+        .timing         = &samsung512MbX16_timing,
+        .cmdset         = &smallpage_cmdset,
+        .page_per_block = 32,
+        .page_size      = 512,
+        .flash_width    = 16,
+        .dfc_width      = 16,
+        .num_blocks     = 4096,
+        .chip_id        = 0x46ec,
+};
+
+static struct pxa3xx_nand_timing micron_timing = {
+        .tCH    = 10,
+        .tCS    = 25,
+        .tWH    = 15,
+        .tWP    = 25,
+        .tRH    = 15,
+        .tRP    = 25,
+        .tR     = 25000,
+        .tWHR   = 60,
+        .tAR    = 10,
+};
+
+static struct pxa3xx_nand_flash micron1GbX8 = {
+        .timing         = &micron_timing,
+        .cmdset         = &largepage_cmdset,
+        .page_per_block = 64,
+        .page_size      = 2048,
+        .flash_width    = 8,
+        .dfc_width      = 8,
+        .num_blocks     = 1024,
+        .chip_id        = 0xa12c,
+};
+
+static struct pxa3xx_nand_flash micron1GbX16 = {
+        .timing         = &micron_timing,
+        .cmdset         = &largepage_cmdset,
+        .page_per_block = 64,
+        .page_size      = 2048,
+        .flash_width    = 16,
+        .dfc_width      = 16,
+        .num_blocks     = 1024,
+        .chip_id        = 0xb12c,
+};
+
+static struct pxa3xx_nand_flash *builtin_flash_types[] = {
+        &samsung512MbX16,
+        &micron1GbX8,
+        &micron1GbX16,
+};
+
+#define NDTR0_tCH(c)    (min((c), 7) << 19)
+#define NDTR0_tCS(c)    (min((c), 7) << 16)
+#define NDTR0_tWH(c)    (min((c), 7) << 11)
+#define NDTR0_tWP(c)    (min((c), 7) << 8)
+#define NDTR0_tRH(c)    (min((c), 7) << 3)
+#define NDTR0_tRP(c)    (min((c), 7) << 0)
+
+#define NDTR1_tR(c)     (min((c), 65535) << 16)
+#define NDTR1_tWHR(c)   (min((c), 15) << 4)
+#define NDTR1_tAR(c)    (min((c), 15) << 0)
+
+/* convert nano-seconds to nand flash controller clock cycles */
+#define ns2cycle(ns, clk)       (int)(((ns) * (clk / 1000000) / 1000) + 1)
+
+static void pxa3xx_nand_set_timing(struct pxa3xx_nand_info *info,
+                                   struct pxa3xx_nand_timing *t)
+{
+        unsigned long nand_clk = clk_get_rate(info->clk);
+        uint32_t ndtr0, ndtr1;
+
+        ndtr0 = NDTR0_tCH(ns2cycle(t->tCH, nand_clk)) |
+                NDTR0_tCS(ns2cycle(t->tCS, nand_clk)) |
+                NDTR0_tWH(ns2cycle(t->tWH, nand_clk)) |
+                NDTR0_tWP(ns2cycle(t->tWP, nand_clk)) |
+                NDTR0_tRH(ns2cycle(t->tRH, nand_clk)) |
+                NDTR0_tRP(ns2cycle(t->tRP, nand_clk));
+
+        ndtr1 = NDTR1_tR(ns2cycle(t->tR, nand_clk)) |
+                NDTR1_tWHR(ns2cycle(t->tWHR, nand_clk)) |
+                NDTR1_tAR(ns2cycle(t->tAR, nand_clk));
+
+        nand_writel(info, NDTR0CS0, ndtr0);
+        nand_writel(info, NDTR1CS0, ndtr1);
+}
+
+#define WAIT_EVENT_TIMEOUT      10
+
+static int wait_for_event(struct pxa3xx_nand_info *info, uint32_t event)
+{
+        int timeout = WAIT_EVENT_TIMEOUT;
+        uint32_t ndsr;
+
+        while (timeout--) {
+                ndsr = nand_readl(info, NDSR) & NDSR_MASK;
+                if (ndsr & event) {
+                        nand_writel(info, NDSR, ndsr);
+                        return 0;
+                }
+                udelay(10);
+        }
+
+        return -ETIMEDOUT;
+}
+
+static int prepare_read_prog_cmd(struct pxa3xx_nand_info *info,
+                        uint16_t cmd, int column, int page_addr)
+{
+        struct pxa3xx_nand_flash *f = info->flash_info;
+        struct pxa3xx_nand_cmdset *cmdset = f->cmdset;
+
+        /* calculate data size */
+        switch (f->page_size) {
+        case 2048:
+                info->data_size = (info->use_ecc) ? 2088 : 2112;
+                break;
+        case 512:
+                info->data_size = (info->use_ecc) ? 520 : 528;
+                break;
+        default:
+                return -EINVAL;
+        }
+
+        /* generate values for NDCBx registers */
+        info->ndcb0 = cmd | ((cmd & 0xff00) ? NDCB0_DBC : 0);
+        info->ndcb1 = 0;
+        info->ndcb2 = 0;
+        info->ndcb0 |= NDCB0_ADDR_CYC(f->row_addr_cycles + f->col_addr_cycles);
+
+        if (f->col_addr_cycles == 2) {
+                /* large block, 2 cycles for column address
+                 * row address starts from 3rd cycle
+                 */
+                info->ndcb1 |= (page_addr << 16) | (column & 0xffff);
+                if (f->row_addr_cycles == 3)
+                        info->ndcb2 = (page_addr >> 16) & 0xff;
+        } else
+                /* small block, 1 cycles for column address
+                 * row address starts from 2nd cycle
+                 */
+                info->ndcb1 = (page_addr << 8) | (column & 0xff);
+
+        if (cmd == cmdset->program)
+                info->ndcb0 |= NDCB0_CMD_TYPE(1) | NDCB0_AUTO_RS;
+
+        return 0;
+}
+
+static int prepare_erase_cmd(struct pxa3xx_nand_info *info,
+                        uint16_t cmd, int page_addr)
+{
+        info->ndcb0 = cmd | ((cmd & 0xff00) ? NDCB0_DBC : 0);
+        info->ndcb0 |= NDCB0_CMD_TYPE(2) | NDCB0_AUTO_RS | NDCB0_ADDR_CYC(3);
+        info->ndcb1 = page_addr;
+        info->ndcb2 = 0;
+        return 0;
+}
+
+static int prepare_other_cmd(struct pxa3xx_nand_info *info, uint16_t cmd)
+{
+        struct pxa3xx_nand_cmdset *cmdset = info->flash_info->cmdset;
+
+        info->ndcb0 = cmd | ((cmd & 0xff00) ? NDCB0_DBC : 0);
+        info->ndcb1 = 0;
+        info->ndcb2 = 0;
+
+        if (cmd == cmdset->read_id) {
+                info->ndcb0 |= NDCB0_CMD_TYPE(3);
+                info->data_size = 8;
+        } else if (cmd == cmdset->read_status) {
+                info->ndcb0 |= NDCB0_CMD_TYPE(4);
+                info->data_size = 8;
+        } else if (cmd == cmdset->reset || cmd == cmdset->lock ||
+                   cmd == cmdset->unlock) {
+                info->ndcb0 |= NDCB0_CMD_TYPE(5);
+        } else
+                return -EINVAL;
+
+        return 0;
+}
+
+static void enable_int(struct pxa3xx_nand_info *info, uint32_t int_mask)
+{
+        uint32_t ndcr;
+
+        ndcr = nand_readl(info, NDCR);
+        nand_writel(info, NDCR, ndcr & ~int_mask);
+}
+
+static void disable_int(struct pxa3xx_nand_info *info, uint32_t int_mask)
+{
+        uint32_t ndcr;
+
+        ndcr = nand_readl(info, NDCR);
+        nand_writel(info, NDCR, ndcr | int_mask);
+}
+
+/* NOTE: it is a must to set ND_RUN firstly, then write command buffer
+ * otherwise, it does not work
+ */
+static int write_cmd(struct pxa3xx_nand_info *info)
+{
+        uint32_t ndcr;
+
+        /* clear status bits and run */
+        nand_writel(info, NDSR, NDSR_MASK);
+
+        ndcr = info->reg_ndcr;
+
+        ndcr |= info->use_ecc ? NDCR_ECC_EN : 0;
+        ndcr |= info->use_dma ? NDCR_DMA_EN : 0;
+        ndcr |= NDCR_ND_RUN;
+
+        nand_writel(info, NDCR, ndcr);
+
+        if (wait_for_event(info, NDSR_WRCMDREQ)) {
+                printk(KERN_ERR "timed out writing command\n");
+                return -ETIMEDOUT;
+        }
+
+        nand_writel(info, NDCB0, info->ndcb0);
+        nand_writel(info, NDCB0, info->ndcb1);
+        nand_writel(info, NDCB0, info->ndcb2);
+        return 0;
+}
+
+static int handle_data_pio(struct pxa3xx_nand_info *info)
+{
+        int ret, timeout = CHIP_DELAY_TIMEOUT;
+
+        switch (info->state) {
+        case STATE_PIO_WRITING:
+                __raw_writesl(info->mmio_base + NDDB, info->data_buff,
+                                info->data_size << 2);
+
+                enable_int(info, NDSR_CS0_BBD | NDSR_CS0_CMDD);
+
+                ret = wait_for_completion_timeout(&info->cmd_complete, timeout);
+                if (!ret) {
+                        printk(KERN_ERR "program command time out\n");
+                        return -1;
+                }
+                break;
+        case STATE_PIO_READING:
+                __raw_readsl(info->mmio_base + NDDB, info->data_buff,
+                                info->data_size << 2);
+                break;
+        default:
+                printk(KERN_ERR "%s: invalid state %d\n", __func__,
+                                info->state);
+                return -EINVAL;
+        }
+
+        info->state = STATE_READY;
+        return 0;
+}
+
+static void start_data_dma(struct pxa3xx_nand_info *info, int dir_out)
+{
+        struct pxa_dma_desc *desc = info->data_desc;
+        int dma_len = ALIGN(info->data_size, 32);
+
+        desc->ddadr = DDADR_STOP;
+        desc->dcmd = DCMD_ENDIRQEN | DCMD_WIDTH4 | DCMD_BURST32 | dma_len;
+
+        if (dir_out) {
+                desc->dsadr = info->data_buff_phys;
+                desc->dtadr = NDDB_DMA_ADDR;
+                desc->dcmd |= DCMD_INCSRCADDR | DCMD_FLOWTRG;
+        } else {
+                desc->dtadr = info->data_buff_phys;
+                desc->dsadr = NDDB_DMA_ADDR;
+                desc->dcmd |= DCMD_INCTRGADDR | DCMD_FLOWSRC;
+        }
+
+        DRCMR(info->drcmr_dat) = DRCMR_MAPVLD | info->data_dma_ch;
+        DDADR(info->data_dma_ch) = info->data_desc_addr;
+        DCSR(info->data_dma_ch) |= DCSR_RUN;
+}
+
+static void pxa3xx_nand_data_dma_irq(int channel, void *data)
+{
+        struct pxa3xx_nand_info *info = data;
+        uint32_t dcsr;
+
+        dcsr = DCSR(channel);
+        DCSR(channel) = dcsr;
+
+        if (dcsr & DCSR_BUSERR) {
+                info->retcode = ERR_DMABUSERR;
+                complete(&info->cmd_complete);
+        }
+
+        if (info->state == STATE_DMA_WRITING) {
+                info->state = STATE_DMA_DONE;
+                enable_int(info, NDSR_CS0_BBD | NDSR_CS0_CMDD);
+        } else {
+                info->state = STATE_READY;
+                complete(&info->cmd_complete);
+        }
+}
+
+static irqreturn_t pxa3xx_nand_irq(int irq, void *devid)
+{
+        struct pxa3xx_nand_info *info = devid;
+        unsigned int status;
+
+        status = nand_readl(info, NDSR);
+
+        if (status & (NDSR_RDDREQ | NDSR_DBERR)) {
+                if (status & NDSR_DBERR)
+                        info->retcode = ERR_DBERR;
+
+                disable_int(info, NDSR_RDDREQ | NDSR_DBERR);
+
+                if (info->use_dma) {
+                        info->state = STATE_DMA_READING;
+                        start_data_dma(info, 0);
+                } else {
+                        info->state = STATE_PIO_READING;
+                        complete(&info->cmd_complete);
+                }
+        } else if (status & NDSR_WRDREQ) {
+                disable_int(info, NDSR_WRDREQ);
+                if (info->use_dma) {
+                        info->state = STATE_DMA_WRITING;
+                        start_data_dma(info, 1);
+                } else {
+                        info->state = STATE_PIO_WRITING;
+                        complete(&info->cmd_complete);
+                }
+        } else if (status & (NDSR_CS0_BBD | NDSR_CS0_CMDD)) {
+                if (status & NDSR_CS0_BBD)
+                        info->retcode = ERR_BBERR;
+
+                disable_int(info, NDSR_CS0_BBD | NDSR_CS0_CMDD);
+                info->state = STATE_READY;
+                complete(&info->cmd_complete);
+        }
+        nand_writel(info, NDSR, status);
+        return IRQ_HANDLED;
+}
+
+static int pxa3xx_nand_do_cmd(struct pxa3xx_nand_info *info, uint32_t event)
+{
+        uint32_t ndcr;
+        int ret, timeout = CHIP_DELAY_TIMEOUT;
+
+        if (write_cmd(info)) {
+                info->retcode = ERR_SENDCMD;
+                goto fail_stop;
+        }
+
+        info->state = STATE_CMD_HANDLE;
+
+        enable_int(info, event);
+
+        ret = wait_for_completion_timeout(&info->cmd_complete, timeout);
+        if (!ret) {
+                printk(KERN_ERR "command execution timed out\n");
+                info->retcode = ERR_SENDCMD;
+                goto fail_stop;
+        }
+
+        if (info->use_dma == 0 && info->data_size > 0)
+                if (handle_data_pio(info))
+                        goto fail_stop;
+
+        return 0;
+
+fail_stop:
+        ndcr = nand_readl(info, NDCR);
+        nand_writel(info, NDCR, ndcr & ~NDCR_ND_RUN);
+        udelay(10);
+        return -ETIMEDOUT;
+}
+
+static int pxa3xx_nand_dev_ready(struct mtd_info *mtd)
+{
+        struct pxa3xx_nand_info *info = mtd->priv;
+        return (nand_readl(info, NDSR) & NDSR_RDY) ? 1 : 0;
+}
+
+static inline int is_buf_blank(uint8_t *buf, size_t len)
+{
+        for (; len > 0; len--)
+                if (*buf++ != 0xff)
+                        return 0;
+        return 1;
+}
+
+static void pxa3xx_nand_cmdfunc(struct mtd_info *mtd, unsigned command,
+                                int column, int page_addr)
+{
+        struct pxa3xx_nand_info *info = mtd->priv;
+        struct pxa3xx_nand_flash *flash_info = info->flash_info;
+        struct pxa3xx_nand_cmdset *cmdset = flash_info->cmdset;
+        int ret;
+
+        info->use_dma = (use_dma) ? 1 : 0;
+        info->use_ecc = 0;
+        info->data_size = 0;
+        info->state = STATE_READY;
+
+        init_completion(&info->cmd_complete);
+
+        switch (command) {
+        case NAND_CMD_READOOB:
+                /* disable HW ECC to get all the OOB data */
+                info->buf_count = mtd->writesize + mtd->oobsize;
+                info->buf_start = mtd->writesize + column;
+
+                if (prepare_read_prog_cmd(info, cmdset->read1, column, page_addr))
+                        break;
+
+                pxa3xx_nand_do_cmd(info, NDSR_RDDREQ | NDSR_DBERR);
+
+                /* We only are OOB, so if the data has error, does not matter */
+                if (info->retcode == ERR_DBERR)
+                        info->retcode = ERR_NONE;
+                break;
+
+        case NAND_CMD_READ0:
+                info->use_ecc = 1;
+                info->retcode = ERR_NONE;
+                info->buf_start = column;
+                info->buf_count = mtd->writesize + mtd->oobsize;
+                memset(info->data_buff, 0xFF, info->buf_count);
+
+                if (prepare_read_prog_cmd(info, cmdset->read1, column, page_addr))
+                        break;
+
+                pxa3xx_nand_do_cmd(info, NDSR_RDDREQ | NDSR_DBERR);
+
+                if (info->retcode == ERR_DBERR) {
+                        /* for blank page (all 0xff), HW will calculate its ECC as
+                         * 0, which is different from the ECC information within
+                         * OOB, ignore such double bit errors
+                         */
+                        if (is_buf_blank(info->data_buff, mtd->writesize))
+                                info->retcode = ERR_NONE;
+                }
+                break;
+        case NAND_CMD_SEQIN:
+                info->buf_start = column;
+                info->buf_count = mtd->writesize + mtd->oobsize;
+                memset(info->data_buff, 0xff, info->buf_count);
+
+                /* save column/page_addr for next CMD_PAGEPROG */
+                info->seqin_column = column;
+                info->seqin_page_addr = page_addr;
+                break;
+        case NAND_CMD_PAGEPROG:
+                info->use_ecc = (info->seqin_column >= mtd->writesize) ? 0 : 1;
+
+                if (prepare_read_prog_cmd(info, cmdset->program,
+                                info->seqin_column, info->seqin_page_addr))
+                        break;
+
+                pxa3xx_nand_do_cmd(info, NDSR_WRDREQ);
+                break;
+        case NAND_CMD_ERASE1:
+                if (prepare_erase_cmd(info, cmdset->erase, page_addr))
+                        break;
+
+                pxa3xx_nand_do_cmd(info, NDSR_CS0_BBD | NDSR_CS0_CMDD);
+                break;
+        case NAND_CMD_ERASE2:
+                break;
+        case NAND_CMD_READID:
+        case NAND_CMD_STATUS:
+                info->use_dma = 0;      /* force PIO read */
+                info->buf_start = 0;
+                info->buf_count = (command == NAND_CMD_READID) ?
+                                flash_info->read_id_bytes : 1;
+
+                if (prepare_other_cmd(info, (command == NAND_CMD_READID) ?
+                                cmdset->read_id : cmdset->read_status))
+                        break;
+
+                pxa3xx_nand_do_cmd(info, NDSR_RDDREQ);
+                break;
+        case NAND_CMD_RESET:
+                if (prepare_other_cmd(info, cmdset->reset))
+                        break;
+
+                ret = pxa3xx_nand_do_cmd(info, NDSR_CS0_CMDD);
+                if (ret == 0) {
+                        int timeout = 2;
+                        uint32_t ndcr;
+
+                        while (timeout--) {
+                                if (nand_readl(info, NDSR) & NDSR_RDY)
+                                        break;
+                                msleep(10);
+                        }
+
+                        ndcr = nand_readl(info, NDCR);
+                        nand_writel(info, NDCR, ndcr & ~NDCR_ND_RUN);
+                }
+                break;
+        default:
+                printk(KERN_ERR "non-supported command.\n");
+                break;
+        }
+
+        if (info->retcode == ERR_DBERR) {
+                printk(KERN_ERR "double bit error @ page %08x\n", page_addr);
+                info->retcode = ERR_NONE;
+        }
+}
+
+static uint8_t pxa3xx_nand_read_byte(struct mtd_info *mtd)
+{
+        struct pxa3xx_nand_info *info = mtd->priv;
+        char retval = 0xFF;
+
+        if (info->buf_start < info->buf_count)
+                /* Has just send a new command? */
+                retval = info->data_buff[info->buf_start++];
+
+        return retval;
+}
+
+static u16 pxa3xx_nand_read_word(struct mtd_info *mtd)
+{
+        struct pxa3xx_nand_info *info = mtd->priv;
+        u16 retval = 0xFFFF;
+
+        if (!(info->buf_start & 0x01) && info->buf_start < info->buf_count) {
+                retval = *((u16 *)(info->data_buff+info->buf_start));
+                info->buf_start += 2;
+        }
+        return retval;
+}
+
+static void pxa3xx_nand_read_buf(struct mtd_info *mtd, uint8_t *buf, int len)
+{
+        struct pxa3xx_nand_info *info = mtd->priv;
+        int real_len = min_t(size_t, len, info->buf_count - info->buf_start);
+
+        memcpy(buf, info->data_buff + info->buf_start, real_len);
+        info->buf_start += real_len;
+}
+
+static void pxa3xx_nand_write_buf(struct mtd_info *mtd,
+                const uint8_t *buf, int len)
+{
+        struct pxa3xx_nand_info *info = mtd->priv;
+        int real_len = min_t(size_t, len, info->buf_count - info->buf_start);
+
+        memcpy(info->data_buff + info->buf_start, buf, real_len);
+        info->buf_start += real_len;
+}
+
+static int pxa3xx_nand_verify_buf(struct mtd_info *mtd,
+                const uint8_t *buf, int len)
+{
+        return 0;
+}
+
+static void pxa3xx_nand_select_chip(struct mtd_info *mtd, int chip)
+{
+        return;
+}
+
+static int pxa3xx_nand_waitfunc(struct mtd_info *mtd, struct nand_chip *this)
+{
+        struct pxa3xx_nand_info *info = mtd->priv;
+
+        /* pxa3xx_nand_send_command has waited for command complete */
+        if (this->state == FL_WRITING || this->state == FL_ERASING) {
+                if (info->retcode == ERR_NONE)
+                        return 0;
+                else {
+                        /*
+                         * any error make it return 0x01 which will tell
+                         * the caller the erase and write fail
+                         */
+                        return 0x01;
+                }
+        }
+
+        return 0;
+}
+
+static void pxa3xx_nand_ecc_hwctl(struct mtd_info *mtd, int mode)
+{
+        return;
+}
+
+static int pxa3xx_nand_ecc_calculate(struct mtd_info *mtd,
+                const uint8_t *dat, uint8_t *ecc_code)
+{
+        return 0;
+}
+
+static int pxa3xx_nand_ecc_correct(struct mtd_info *mtd,
+                uint8_t *dat, uint8_t *read_ecc, uint8_t *calc_ecc)
+{
+        struct pxa3xx_nand_info *info = mtd->priv;
+        /*
+         * Any error include ERR_SEND_CMD, ERR_DBERR, ERR_BUSERR, we
+         * consider it as a ecc error which will tell the caller the
+         * read fail We have distinguish all the errors, but the
+         * nand_read_ecc only check this function return value
+         */
+        if (info->retcode != ERR_NONE)
+                return -1;
+
+        return 0;
+}
+
+static int __readid(struct pxa3xx_nand_info *info, uint32_t *id)
+{
+        struct pxa3xx_nand_flash *f = info->flash_info;
+        struct pxa3xx_nand_cmdset *cmdset = f->cmdset;
+        uint32_t ndcr;
+        uint8_t  id_buff[8];
+
+        if (prepare_other_cmd(info, cmdset->read_id)) {
+                printk(KERN_ERR "failed to prepare command\n");
+                return -EINVAL;
+        }
+
+        /* Send command */
+        if (write_cmd(info))
+                goto fail_timeout;
+
+        /* Wait for CMDDM(command done successfully) */
+        if (wait_for_event(info, NDSR_RDDREQ))
+                goto fail_timeout;
+
+        __raw_readsl(info->mmio_base + NDDB, id_buff, 2);
+        *id = id_buff[0] | (id_buff[1] << 8);
+        return 0;
+
+fail_timeout:
+        ndcr = nand_readl(info, NDCR);
+        nand_writel(info, NDCR, ndcr & ~NDCR_ND_RUN);
+        udelay(10);
+        return -ETIMEDOUT;
+}
+
+static int pxa3xx_nand_config_flash(struct pxa3xx_nand_info *info,
+                                    struct pxa3xx_nand_flash *f)
+{
+        struct platform_device *pdev = info->pdev;
+        struct pxa3xx_nand_platform_data *pdata = pdev->dev.platform_data;
+        uint32_t ndcr = 0x00000FFF; /* disable all interrupts */
+
+        if (f->page_size != 2048 && f->page_size != 512)
+                return -EINVAL;
+
+        if (f->flash_width != 16 && f->flash_width != 8)
+                return -EINVAL;
+
+        /* calculate flash information */
+        f->oob_size = (f->page_size == 2048) ? 64 : 16;
+        f->read_id_bytes = (f->page_size == 2048) ? 4 : 2;
+
+        /* calculate addressing information */
+        f->col_addr_cycles = (f->page_size == 2048) ? 2 : 1;
+
+        if (f->num_blocks * f->page_per_block > 65536)
+                f->row_addr_cycles = 3;
+        else
+                f->row_addr_cycles = 2;
+
+        ndcr |= (pdata->enable_arbiter) ? NDCR_ND_ARB_EN : 0;
+        ndcr |= (f->col_addr_cycles == 2) ? NDCR_RA_START : 0;
+        ndcr |= (f->page_per_block == 64) ? NDCR_PG_PER_BLK : 0;
+        ndcr |= (f->page_size == 2048) ? NDCR_PAGE_SZ : 0;
+        ndcr |= (f->flash_width == 16) ? NDCR_DWIDTH_M : 0;
+        ndcr |= (f->dfc_width == 16) ? NDCR_DWIDTH_C : 0;
+
+        ndcr |= NDCR_RD_ID_CNT(f->read_id_bytes);
+        ndcr |= NDCR_SPARE_EN; /* enable spare by default */
+
+        info->reg_ndcr = ndcr;
+
+        pxa3xx_nand_set_timing(info, f->timing);
+        info->flash_info = f;
+        return 0;
+}
+
+static int pxa3xx_nand_detect_flash(struct pxa3xx_nand_info *info)
+{
+        struct pxa3xx_nand_flash *f;
+        uint32_t id;
+        int i;
+
+        for (i = 0; i < ARRAY_SIZE(builtin_flash_types); i++) {
+
+                f = builtin_flash_types[i];
+
+                if (pxa3xx_nand_config_flash(info, f))
+                        continue;
+
+                if (__readid(info, &id))
+                        continue;
+
+                if (id == f->chip_id)
+                        return 0;
+        }
+
+        return -ENODEV;
+}
+
+/* the maximum possible buffer size for large page with OOB data
+ * is: 2048 + 64 = 2112 bytes, allocate a page here for both the
+ * data buffer and the DMA descriptor
+ */
+#define MAX_BUFF_SIZE   PAGE_SIZE
+
+static int pxa3xx_nand_init_buff(struct pxa3xx_nand_info *info)
+{
+        struct platform_device *pdev = info->pdev;
+        int data_desc_offset = MAX_BUFF_SIZE - sizeof(struct pxa_dma_desc);
+
+        if (use_dma == 0) {
+                info->data_buff = kmalloc(MAX_BUFF_SIZE, GFP_KERNEL);
+                if (info->data_buff == NULL)
+                        return -ENOMEM;
+                return 0;
+        }
+
+        info->data_buff = dma_alloc_coherent(&pdev->dev, MAX_BUFF_SIZE,
+                                &info->data_buff_phys, GFP_KERNEL);
+        if (info->data_buff == NULL) {
+                dev_err(&pdev->dev, "failed to allocate dma buffer\n");
+                return -ENOMEM;
+        }
+
+        info->data_buff_size = MAX_BUFF_SIZE;
+        info->data_desc = (void *)info->data_buff + data_desc_offset;
+        info->data_desc_addr = info->data_buff_phys + data_desc_offset;
+
+        info->data_dma_ch = pxa_request_dma("nand-data", DMA_PRIO_LOW,
+                                pxa3xx_nand_data_dma_irq, info);
+        if (info->data_dma_ch < 0) {
+                dev_err(&pdev->dev, "failed to request data dma\n");
+                dma_free_coherent(&pdev->dev, info->data_buff_size,
+                                info->data_buff, info->data_buff_phys);
+                return info->data_dma_ch;
+        }
+
+        return 0;
+}
+
+static struct nand_ecclayout hw_smallpage_ecclayout = {
+        .eccbytes = 6,
+        .eccpos = {8, 9, 10, 11, 12, 13 },
+        .oobfree = { {2, 6} }
+};
+
+static struct nand_ecclayout hw_largepage_ecclayout = {
+        .eccbytes = 24,
+        .eccpos = {
+                40, 41, 42, 43, 44, 45, 46, 47,
+                48, 49, 50, 51, 52, 53, 54, 55,
+                56, 57, 58, 59, 60, 61, 62, 63},
+        .oobfree = { {2, 38} }
+};
+
+static void pxa3xx_nand_init_mtd(struct mtd_info *mtd,
+                                 struct pxa3xx_nand_info *info)
+{
+        struct pxa3xx_nand_flash *f = info->flash_info;
+        struct nand_chip *this = &info->nand_chip;
+
+        this->options = (f->flash_width == 16) ? NAND_BUSWIDTH_16: 0;
+
+        this->waitfunc          = pxa3xx_nand_waitfunc;
+        this->select_chip       = pxa3xx_nand_select_chip;
+        this->dev_ready         = pxa3xx_nand_dev_ready;
+        this->cmdfunc           = pxa3xx_nand_cmdfunc;
+        this->read_word         = pxa3xx_nand_read_word;
+        this->read_byte         = pxa3xx_nand_read_byte;
+        this->read_buf          = pxa3xx_nand_read_buf;
+        this->write_buf         = pxa3xx_nand_write_buf;
+        this->verify_buf        = pxa3xx_nand_verify_buf;
+
+        this->ecc.mode          = NAND_ECC_HW;
+        this->ecc.hwctl         = pxa3xx_nand_ecc_hwctl;
+        this->ecc.calculate     = pxa3xx_nand_ecc_calculate;
+        this->ecc.correct       = pxa3xx_nand_ecc_correct;
+        this->ecc.size          = f->page_size;
+
+        if (f->page_size == 2048)
+                this->ecc.layout = &hw_largepage_ecclayout;
+        else
+                this->ecc.layout = &hw_smallpage_ecclayout;
+
+        this->chip_delay = 25;
+}
+
+static int pxa3xx_nand_probe(struct platform_device *pdev)
+{
+        struct pxa3xx_nand_platform_data *pdata;
+        struct pxa3xx_nand_info *info;
+        struct nand_chip *this;
+        struct mtd_info *mtd;
+        struct resource *r;
+        int ret = 0, irq;
+
+        pdata = pdev->dev.platform_data;
+
+        if (!pdata) {
+                dev_err(&pdev->dev, "no platform data defined\n");
+                return -ENODEV;
+        }
+
+        mtd = kzalloc(sizeof(struct mtd_info) + sizeof(struct pxa3xx_nand_info),
+                        GFP_KERNEL);
+        if (!mtd) {
+                dev_err(&pdev->dev, "failed to allocate memory\n");
+                return -ENOMEM;
+        }
+
+        info = (struct pxa3xx_nand_info *)(&mtd[1]);
+        info->pdev = pdev;
+
+        this = &info->nand_chip;
+        mtd->priv = info;
+
+        info->clk = clk_get(&pdev->dev, "NANDCLK");
+        if (IS_ERR(info->clk)) {
+                dev_err(&pdev->dev, "failed to get nand clock\n");
+                ret = PTR_ERR(info->clk);
+                goto fail_free_mtd;
+        }
+        clk_enable(info->clk);
+
+        r = platform_get_resource(pdev, IORESOURCE_DMA, 0);
+        if (r == NULL) {
+                dev_err(&pdev->dev, "no resource defined for data DMA\n");
+                ret = -ENXIO;
+                goto fail_put_clk;
+        }
+        info->drcmr_dat = r->start;
+
+        r = platform_get_resource(pdev, IORESOURCE_DMA, 1);
+        if (r == NULL) {
+                dev_err(&pdev->dev, "no resource defined for command DMA\n");
+                ret = -ENXIO;
+                goto fail_put_clk;
+        }
+        info->drcmr_cmd = r->start;
+
+        irq = platform_get_irq(pdev, 0);
+        if (irq < 0) {
+                dev_err(&pdev->dev, "no IRQ resource defined\n");
+                ret = -ENXIO;
+                goto fail_put_clk;
+        }
+
+        r = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+        if (r == NULL) {
+                dev_err(&pdev->dev, "no IO memory resource defined\n");
+                ret = -ENODEV;
+                goto fail_put_clk;
+        }
+
+        r = request_mem_region(r->start, r->end - r->start + 1, pdev->name);
+        if (r == NULL) {
+                dev_err(&pdev->dev, "failed to request memory resource\n");
+                ret = -EBUSY;
+                goto fail_put_clk;
+        }
+
+        info->mmio_base = ioremap(r->start, r->end - r->start + 1);
+        if (info->mmio_base == NULL) {
+                dev_err(&pdev->dev, "ioremap() failed\n");
+                ret = -ENODEV;
+                goto fail_free_res;
+        }
+
+        ret = pxa3xx_nand_init_buff(info);
+        if (ret)
+                goto fail_free_io;
+
+        ret = request_irq(IRQ_NAND, pxa3xx_nand_irq, IRQF_DISABLED,
+                                pdev->name, info);
+        if (ret < 0) {
+                dev_err(&pdev->dev, "failed to request IRQ\n");
+                goto fail_free_buf;
+        }
+
+        ret = pxa3xx_nand_detect_flash(info);
+        if (ret) {
+                dev_err(&pdev->dev, "failed to detect flash\n");
+                ret = -ENODEV;
+                goto fail_free_irq;
+        }
+
+        pxa3xx_nand_init_mtd(mtd, info);
+
+        platform_set_drvdata(pdev, mtd);
+
+        if (nand_scan(mtd, 1)) {
+                dev_err(&pdev->dev, "failed to scan nand\n");
+                ret = -ENXIO;
+                goto fail_free_irq;
+        }
+
+        return add_mtd_partitions(mtd, pdata->parts, pdata->nr_parts);
+
+fail_free_irq:
+        free_irq(IRQ_NAND, info);
+fail_free_buf:
+        if (use_dma) {
+                pxa_free_dma(info->data_dma_ch);
+                dma_free_coherent(&pdev->dev, info->data_buff_size,
+                        info->data_buff, info->data_buff_phys);
+        } else
+                kfree(info->data_buff);
+fail_free_io:
+        iounmap(info->mmio_base);
+fail_free_res:
+        release_mem_region(r->start, r->end - r->start + 1);
+fail_put_clk:
+        clk_disable(info->clk);
+        clk_put(info->clk);
+fail_free_mtd:
+        kfree(mtd);
+        return ret;
+}
+
+static int pxa3xx_nand_remove(struct platform_device *pdev)
+{
+        struct mtd_info *mtd = platform_get_drvdata(pdev);
+        struct pxa3xx_nand_info *info = mtd->priv;
+
+        platform_set_drvdata(pdev, NULL);
+
+        del_mtd_device(mtd);
+        del_mtd_partitions(mtd);
+        free_irq(IRQ_NAND, info);
+        if (use_dma) {
+                pxa_free_dma(info->data_dma_ch);
+                dma_free_writecombine(&pdev->dev, info->data_buff_size,
+                                info->data_buff, info->data_buff_phys);
+        } else
+                kfree(info->data_buff);
+        kfree(mtd);
+        return 0;
+}
+
+#ifdef CONFIG_PM
+static int pxa3xx_nand_suspend(struct platform_device *pdev, pm_message_t state)
+{
+        struct mtd_info *mtd = (struct mtd_info *)platform_get_drvdata(pdev);
+        struct pxa3xx_nand_info *info = mtd->priv;
+
+        if (info->state != STATE_READY) {
+                dev_err(&pdev->dev, "driver busy, state = %d\n", info->state);
+                return -EAGAIN;
+        }
+
+        return 0;
+}
+
+static int pxa3xx_nand_resume(struct platform_device *pdev)
+{
+        struct mtd_info *mtd = (struct mtd_info *)platform_get_drvdata(pdev);
+        struct pxa3xx_nand_info *info = mtd->priv;
+
+        clk_enable(info->clk);
+
+        return pxa3xx_nand_config_flash(info);
+}
+#else
+#define pxa3xx_nand_suspend     NULL
+#define pxa3xx_nand_resume      NULL
+#endif
+
+static struct platform_driver pxa3xx_nand_driver = {
+        .driver = {
+                .name   = "pxa3xx-nand",
+        },
+        .probe          = pxa3xx_nand_probe,
+        .remove         = pxa3xx_nand_remove,
+        .suspend        = pxa3xx_nand_suspend,
+        .resume         = pxa3xx_nand_resume,
+};
+
+static int __init pxa3xx_nand_init(void)
+{
+        return platform_driver_register(&pxa3xx_nand_driver);
+}
+module_init(pxa3xx_nand_init);
+
+static void __exit pxa3xx_nand_exit(void)
+{
+        platform_driver_unregister(&pxa3xx_nand_driver);
+}
+module_exit(pxa3xx_nand_exit);
+
+MODULE_LICENSE("GPL");
+MODULE_DESCRIPTION("PXA3xx NAND controller driver");
diff --git a/drivers/mtd/nand/rtc_from4.c b/drivers/mtd/nand/rtc_from4.c
index 0f6ac250f434..26f88215bc47 100644
--- a/drivers/mtd/nand/rtc_from4.c
+++ b/drivers/mtd/nand/rtc_from4.c
@@ -478,6 +478,7 @@ static int __init rtc_from4_init(void)
         struct nand_chip *this;
         unsigned short bcr1, bcr2, wcr2;
         int i;
+        int ret;
 
         /* Allocate memory for MTD device structure and private data */
         rtc_from4_mtd = kmalloc(sizeof(struct mtd_info) + sizeof(struct nand_chip), GFP_KERNEL);
@@ -537,6 +538,22 @@ static int __init rtc_from4_init(void)
         this->ecc.hwctl = rtc_from4_enable_hwecc;
         this->ecc.calculate = rtc_from4_calculate_ecc;
         this->ecc.correct = rtc_from4_correct_data;
+
+        /* We could create the decoder on demand, if memory is a concern.
+         * This way we have it handy, if an error happens
+         *
+         * Symbolsize is 10 (bits)
+         * Primitve polynomial is x^10+x^3+1
+         * first consecutive root is 0
+         * primitve element to generate roots = 1
+         * generator polinomial degree = 6
+         */
+        rs_decoder = init_rs(10, 0x409, 0, 1, 6);
+        if (!rs_decoder) {
+                printk(KERN_ERR "Could not create a RS decoder\n");
+                ret = -ENOMEM;
+                goto err_1;
+        }
 #else
         printk(KERN_INFO "rtc_from4_init: using software ECC detection.\n");
 
@@ -549,8 +566,8 @@ static int __init rtc_from4_init(void)
 
         /* Scan to find existence of the device */
         if (nand_scan(rtc_from4_mtd, RTC_FROM4_MAX_CHIPS)) {
-                kfree(rtc_from4_mtd);
-                return -ENXIO;
+                ret = -ENXIO;
+                goto err_2;
         }
 
         /* Perform 'device recovery' for each chip in case there was a power loss. */
@@ -566,28 +583,19 @@ static int __init rtc_from4_init(void)
 #endif
 
         /* Register the partitions */
-        add_mtd_partitions(rtc_from4_mtd, partition_info, NUM_PARTITIONS);
+        ret = add_mtd_partitions(rtc_from4_mtd, partition_info, NUM_PARTITIONS);
+        if (ret)
+                goto err_3;
 
-#ifdef RTC_FROM4_HWECC
-        /* We could create the decoder on demand, if memory is a concern.
-         * This way we have it handy, if an error happens
-         *
-         * Symbolsize is 10 (bits)
-         * Primitve polynomial is x^10+x^3+1
-         * first consecutive root is 0
-         * primitve element to generate roots = 1
-         * generator polinomial degree = 6
-         */
-        rs_decoder = init_rs(10, 0x409, 0, 1, 6);
-        if (!rs_decoder) {
-                printk(KERN_ERR "Could not create a RS decoder\n");
-                nand_release(rtc_from4_mtd);
-                kfree(rtc_from4_mtd);
-                return -ENOMEM;
-        }
-#endif
         /* Return happy */
         return 0;
+err_3:
+        nand_release(rtc_from4_mtd);
+err_2:
+        free_rs(rs_decoder);
+err_1:
+        kfree(rtc_from4_mtd);
+        return ret;
 }
 
 module_init(rtc_from4_init);
diff --git a/drivers/mtd/nand/s3c2410.c b/drivers/mtd/nand/s3c2410.c
index 9260ad947524..b34a460ab679 100644
--- a/drivers/mtd/nand/s3c2410.c
+++ b/drivers/mtd/nand/s3c2410.c
@@ -119,8 +119,7 @@ struct s3c2410_nand_info {
         void __iomem                    *sel_reg;
         int                             sel_bit;
         int                             mtd_count;
-
-        unsigned long                   save_nfconf;
+        unsigned long                   save_sel;
 
         enum s3c_cpu_type               cpu_type;
 };
@@ -358,6 +357,14 @@ static int s3c2410_nand_correct_data(struct mtd_info *mtd, u_char *dat,
         if (diff0 == 0 && diff1 == 0 && diff2 == 0)
                 return 0;               /* ECC is ok */
 
+        /* sometimes people do not think about using the ECC, so check
+         * to see if we have an 0xff,0xff,0xff read ECC and then ignore
+         * the error, on the assumption that this is an un-eccd page.
+         */
+        if (read_ecc[0] == 0xff && read_ecc[1] == 0xff && read_ecc[2] == 0xff
+            && info->platform->ignore_unset_ecc)
+                return 0;
+
         /* Can we correct this ECC (ie, one row and column change).
          * Note, this is similar to the 256 error code on smartmedia */
 
@@ -473,7 +480,7 @@ static int s3c2440_nand_calculate_ecc(struct mtd_info *mtd, const u_char *dat, u
         ecc_code[1] = ecc >> 8;
         ecc_code[2] = ecc >> 16;
 
-        pr_debug("%s: returning ecc %06lx\n", __func__, ecc);
+        pr_debug("%s: returning ecc %06lx\n", __func__, ecc & 0xffffff);
 
         return 0;
 }
@@ -644,9 +651,6 @@ static void s3c2410_nand_init_chip(struct s3c2410_nand_info *info,
                 chip->ecc.calculate = s3c2410_nand_calculate_ecc;
                 chip->ecc.correct   = s3c2410_nand_correct_data;
                 chip->ecc.mode      = NAND_ECC_HW;
-                chip->ecc.size      = 512;
-                chip->ecc.bytes     = 3;
-                chip->ecc.layout    = &nand_hw_eccoob;
 
                 switch (info->cpu_type) {
                 case TYPE_S3C2410:
@@ -668,6 +672,40 @@ static void s3c2410_nand_init_chip(struct s3c2410_nand_info *info,
         } else {
                 chip->ecc.mode      = NAND_ECC_SOFT;
         }
+
+        if (set->ecc_layout != NULL)
+                chip->ecc.layout = set->ecc_layout;
+
+        if (set->disable_ecc)
+                chip->ecc.mode  = NAND_ECC_NONE;
+}
+
+/* s3c2410_nand_update_chip
+ *
+ * post-probe chip update, to change any items, such as the
+ * layout for large page nand
+ */
+
+static void s3c2410_nand_update_chip(struct s3c2410_nand_info *info,
+                                     struct s3c2410_nand_mtd *nmtd)
+{
+        struct nand_chip *chip = &nmtd->chip;
+
+        printk("%s: chip %p: %d\n", __func__, chip, chip->page_shift);
+
+        if (hardware_ecc) {
+                /* change the behaviour depending on wether we are using
+                 * the large or small page nand device */
+
+                if (chip->page_shift > 10) {
+                        chip->ecc.size      = 256;
+                        chip->ecc.bytes     = 3;
+                } else {
+                        chip->ecc.size      = 512;
+                        chip->ecc.bytes     = 3;
+                        chip->ecc.layout    = &nand_hw_eccoob;
+                }
+        }
 }
 
 /* s3c2410_nand_probe
@@ -776,9 +814,12 @@ static int s3c24xx_nand_probe(struct platform_device *pdev,
 
                 s3c2410_nand_init_chip(info, nmtd, sets);
 
-                nmtd->scan_res = nand_scan(&nmtd->mtd, (sets) ? sets->nr_chips : 1);
+                nmtd->scan_res = nand_scan_ident(&nmtd->mtd,
+                                                 (sets) ? sets->nr_chips : 1);
 
                 if (nmtd->scan_res == 0) {
+                        s3c2410_nand_update_chip(info, nmtd);
+                        nand_scan_tail(&nmtd->mtd);
                         s3c2410_nand_add_partition(info, nmtd, sets);
                 }
 
@@ -810,15 +851,14 @@ static int s3c24xx_nand_suspend(struct platform_device *dev, pm_message_t pm)
         struct s3c2410_nand_info *info = platform_get_drvdata(dev);
 
         if (info) {
-                info->save_nfconf = readl(info->regs + S3C2410_NFCONF);
+                info->save_sel = readl(info->sel_reg);
 
                 /* For the moment, we must ensure nFCE is high during
                  * the time we are suspended. This really should be
                  * handled by suspending the MTDs we are using, but
                  * that is currently not the case. */
 
-                writel(info->save_nfconf | info->sel_bit,
-                       info->regs + S3C2410_NFCONF);
+                writel(info->save_sel | info->sel_bit, info->sel_reg);
 
                 if (!allow_clk_stop(info))
                         clk_disable(info->clk);
@@ -830,7 +870,7 @@ static int s3c24xx_nand_suspend(struct platform_device *dev, pm_message_t pm)
 static int s3c24xx_nand_resume(struct platform_device *dev)
 {
         struct s3c2410_nand_info *info = platform_get_drvdata(dev);
-        unsigned long nfconf;
+        unsigned long sel;
 
         if (info) {
                 clk_enable(info->clk);
@@ -838,10 +878,10 @@ static int s3c24xx_nand_resume(struct platform_device *dev)
 
                 /* Restore the state of the nFCE line. */
 
-                nfconf = readl(info->regs + S3C2410_NFCONF);
-                nfconf &= ~info->sel_bit;
-                nfconf |= info->save_nfconf & info->sel_bit;
-                writel(nfconf, info->regs + S3C2410_NFCONF);
+                sel = readl(info->sel_reg);
+                sel &= ~info->sel_bit;
+                sel |= info->save_sel & info->sel_bit;
+                writel(sel, info->sel_reg);
 
                 if (allow_clk_stop(info))
                         clk_disable(info->clk);
@@ -927,3 +967,6 @@ module_exit(s3c2410_nand_exit);
 MODULE_LICENSE("GPL");
 MODULE_AUTHOR("Ben Dooks <ben@simtec.co.uk>");
 MODULE_DESCRIPTION("S3C24XX MTD NAND driver");
+MODULE_ALIAS("platform:s3c2410-nand");
+MODULE_ALIAS("platform:s3c2412-nand");
+MODULE_ALIAS("platform:s3c2440-nand");
diff --git a/drivers/mtd/nftlmount.c b/drivers/mtd/nftlmount.c
index 0513cbc8834d..345e6eff89ce 100644
--- a/drivers/mtd/nftlmount.c
+++ b/drivers/mtd/nftlmount.c
@@ -33,11 +33,6 @@
 
 char nftlmountrev[]="$Revision: 1.41 $";
 
-extern int nftl_read_oob(struct mtd_info *mtd, loff_t offs, size_t len,
-                         size_t *retlen, uint8_t *buf);
-extern int nftl_write_oob(struct mtd_info *mtd, loff_t offs, size_t len,
-                          size_t *retlen, uint8_t *buf);
-
 /* find_boot_record: Find the NFTL Media Header and its Spare copy which contains the
  *      various device information of the NFTL partition and Bad Unit Table. Update
  *      the ReplUnitTable[] table accroding to the Bad Unit Table. ReplUnitTable[]
diff --git a/drivers/mtd/ofpart.c b/drivers/mtd/ofpart.c
index f86e06934cd8..4f80c2fd89af 100644
--- a/drivers/mtd/ofpart.c
+++ b/drivers/mtd/ofpart.c
@@ -72,3 +72,5 @@ int __devinit of_mtd_parse_partitions(struct device *dev,
         return nr_parts;
 }
 EXPORT_SYMBOL(of_mtd_parse_partitions);
+
+MODULE_LICENSE("GPL");
diff --git a/drivers/mtd/onenand/onenand_base.c b/drivers/mtd/onenand/onenand_base.c
index 8d7d21be1541..5d7965f7e9ce 100644
--- a/drivers/mtd/onenand/onenand_base.c
+++ b/drivers/mtd/onenand/onenand_base.c
@@ -329,6 +329,21 @@ static int onenand_wait(struct mtd_info *mtd, int state)
                 printk(KERN_ERR "onenand_wait: controller error = 0x%04x\n", ctrl);
                 if (ctrl & ONENAND_CTRL_LOCK)
                         printk(KERN_ERR "onenand_wait: it's locked error.\n");
+                if (state == FL_READING) {
+                        /*
+                         * A power loss while writing can result in a page
+                         * becoming unreadable.  When the device is mounted
+                         * again, reading that page gives controller errors.
+                         * Upper level software like JFFS2 treat -EIO as fatal,
+                         * refusing to mount at all.  That means it is necessary
+                         * to treat the error as an ECC error to allow recovery.
+                         * Note that typically in this case, the eraseblock can
+                         * still be erased and rewritten i.e. it has not become
+                         * a bad block.
+                         */
+                        mtd->ecc_stats.failed++;
+                        return -EBADMSG;
+                }
                 return -EIO;
         }
 
@@ -1336,7 +1351,7 @@ static int onenand_panic_write(struct mtd_info *mtd, loff_t to, size_t len,
         }
 
         /* Reject writes, which are not page aligned */
-        if (unlikely(NOTALIGNED(to)) || unlikely(NOTALIGNED(len))) {
+        if (unlikely(NOTALIGNED(to) || NOTALIGNED(len))) {
                 printk(KERN_ERR "onenand_panic_write: Attempt to write not page aligned data\n");
                 return -EINVAL;
         }
@@ -1466,7 +1481,7 @@ static int onenand_write_ops_nolock(struct mtd_info *mtd, loff_t to,
         }
 
         /* Reject writes, which are not page aligned */
-        if (unlikely(NOTALIGNED(to)) || unlikely(NOTALIGNED(len))) {
+        if (unlikely(NOTALIGNED(to) || NOTALIGNED(len))) {
                 printk(KERN_ERR "onenand_write_ops_nolock: Attempt to write not page aligned data\n");
                 return -EINVAL;
         }
@@ -2052,7 +2067,7 @@ static int onenand_unlock(struct mtd_info *mtd, loff_t ofs, size_t len)
  *
  * Check lock status
  */
-static void onenand_check_lock_status(struct onenand_chip *this)
+static int onenand_check_lock_status(struct onenand_chip *this)
 {
         unsigned int value, block, status;
         unsigned int end;
@@ -2070,9 +2085,13 @@ static void onenand_check_lock_status(struct onenand_chip *this)
 
                 /* Check lock status */
                 status = this->read_word(this->base + ONENAND_REG_WP_STATUS);
-                if (!(status & ONENAND_WP_US))
+                if (!(status & ONENAND_WP_US)) {
                         printk(KERN_ERR "block = %d, wp status = 0x%x\n", block, status);
+                        return 0;
+                }
         }
+
+        return 1;
 }
 
 /**
@@ -2081,9 +2100,11 @@ static void onenand_check_lock_status(struct onenand_chip *this)
  *
  * Unlock all blocks
  */
-static int onenand_unlock_all(struct mtd_info *mtd)
+static void onenand_unlock_all(struct mtd_info *mtd)
 {
         struct onenand_chip *this = mtd->priv;
+        loff_t ofs = 0;
+        size_t len = this->chipsize;
 
         if (this->options & ONENAND_HAS_UNLOCK_ALL) {
                 /* Set start block address */
@@ -2099,23 +2120,19 @@ static int onenand_unlock_all(struct mtd_info *mtd)
                     & ONENAND_CTRL_ONGO)
                         continue;
 
+                /* Check lock status */
+                if (onenand_check_lock_status(this))
+                        return;
+
                 /* Workaround for all block unlock in DDP */
                 if (ONENAND_IS_DDP(this)) {
-                        /* 1st block on another chip */
-                        loff_t ofs = this->chipsize >> 1;
-                        size_t len = mtd->erasesize;
-
-                        onenand_do_lock_cmd(mtd, ofs, len, ONENAND_CMD_UNLOCK);
+                        /* All blocks on another chip */
+                        ofs = this->chipsize >> 1;
+                        len = this->chipsize >> 1;
                 }
-
-                onenand_check_lock_status(this);
-
-                return 0;
         }
 
-        onenand_do_lock_cmd(mtd, 0x0, this->chipsize, ONENAND_CMD_UNLOCK);
-
-        return 0;
+        onenand_do_lock_cmd(mtd, ofs, len, ONENAND_CMD_UNLOCK);
 }
 
 #ifdef CONFIG_MTD_ONENAND_OTP
diff --git a/drivers/mtd/onenand/onenand_bbt.c b/drivers/mtd/onenand/onenand_bbt.c
index aecdd50a1781..2f53b51c6805 100644
--- a/drivers/mtd/onenand/onenand_bbt.c
+++ b/drivers/mtd/onenand/onenand_bbt.c
@@ -17,9 +17,6 @@
 #include <linux/mtd/onenand.h>
 #include <linux/mtd/compatmac.h>
 
-extern int onenand_bbt_read_oob(struct mtd_info *mtd, loff_t from,
-                                struct mtd_oob_ops *ops);
-
 /**
  * check_short_pattern - [GENERIC] check if a pattern is in the buffer
  * @param buf           the buffer to search
diff --git a/drivers/mtd/rfd_ftl.c b/drivers/mtd/rfd_ftl.c
index 823fba4e6d2f..c84e45465499 100644
--- a/drivers/mtd/rfd_ftl.c
+++ b/drivers/mtd/rfd_ftl.c
@@ -823,7 +823,7 @@ static void rfd_ftl_remove_dev(struct mtd_blktrans_dev *dev)
         kfree(part);
 }
 
-struct mtd_blktrans_ops rfd_ftl_tr = {
+static struct mtd_blktrans_ops rfd_ftl_tr = {
         .name           = "rfd",
         .major          = RFD_FTL_MAJOR,
         .part_bits      = PART_BITS,
diff --git a/drivers/mtd/ubi/Kconfig b/drivers/mtd/ubi/Kconfig
index b9daf159a4a7..3f063108e95f 100644
--- a/drivers/mtd/ubi/Kconfig
+++ b/drivers/mtd/ubi/Kconfig
@@ -24,8 +24,13 @@ config MTD_UBI_WL_THRESHOLD
           erase counter value and the lowest erase counter value of eraseblocks
           of UBI devices. When this threshold is exceeded, UBI starts performing
           wear leveling by means of moving data from eraseblock with low erase
-          counter to eraseblocks with high erase counter. Leave the default
-          value if unsure.
+          counter to eraseblocks with high erase counter.
+
+          The default value should be OK for SLC NAND flashes, NOR flashes and
+          other flashes which have eraseblock life-cycle 100000 or more.
+          However, in case of MLC NAND flashes which typically have eraseblock
+          life-cycle less then 10000, the threshold should be lessened (e.g.,
+          to 128 or 256, although it does not have to be power of 2).
 
 config MTD_UBI_BEB_RESERVE
         int "Percentage of reserved eraseblocks for bad eraseblocks handling"
diff --git a/drivers/mtd/ubi/build.c b/drivers/mtd/ubi/build.c
index 275960462970..961416ac0616 100644
--- a/drivers/mtd/ubi/build.c
+++ b/drivers/mtd/ubi/build.c
@@ -606,8 +606,16 @@ static int io_init(struct ubi_device *ubi)
                 ubi->ro_mode = 1;
         }
 
-        dbg_msg("leb_size         %d", ubi->leb_size);
-        dbg_msg("ro_mode          %d", ubi->ro_mode);
+        ubi_msg("physical eraseblock size:   %d bytes (%d KiB)",
+                ubi->peb_size, ubi->peb_size >> 10);
+        ubi_msg("logical eraseblock size:    %d bytes", ubi->leb_size);
+        ubi_msg("smallest flash I/O unit:    %d", ubi->min_io_size);
+        if (ubi->hdrs_min_io_size != ubi->min_io_size)
+                ubi_msg("sub-page size:              %d",
+                        ubi->hdrs_min_io_size);
+        ubi_msg("VID header offset:          %d (aligned %d)",
+                ubi->vid_hdr_offset, ubi->vid_hdr_aloffset);
+        ubi_msg("data offset:                %d", ubi->leb_start);
 
         /*
          * Note, ideally, we have to initialize ubi->bad_peb_count here. But
@@ -755,8 +763,7 @@ int ubi_attach_mtd_dev(struct mtd_info *mtd, int ubi_num, int vid_hdr_offset)
         mutex_init(&ubi->volumes_mutex);
         spin_lock_init(&ubi->volumes_lock);
 
-        dbg_msg("attaching mtd%d to ubi%d: VID header offset %d",
-                mtd->index, ubi_num, vid_hdr_offset);
+        ubi_msg("attaching mtd%d to ubi%d", mtd->index, ubi_num);
 
         err = io_init(ubi);
         if (err)
@@ -804,15 +811,8 @@ int ubi_attach_mtd_dev(struct mtd_info *mtd, int ubi_num, int vid_hdr_offset)
         ubi_msg("attached mtd%d to ubi%d", mtd->index, ubi_num);
         ubi_msg("MTD device name:            \"%s\"", mtd->name);
         ubi_msg("MTD device size:            %llu MiB", ubi->flash_size >> 20);
-        ubi_msg("physical eraseblock size:   %d bytes (%d KiB)",
-                ubi->peb_size, ubi->peb_size >> 10);
-        ubi_msg("logical eraseblock size:    %d bytes", ubi->leb_size);
         ubi_msg("number of good PEBs:        %d", ubi->good_peb_count);
         ubi_msg("number of bad PEBs:         %d", ubi->bad_peb_count);
-        ubi_msg("smallest flash I/O unit:    %d", ubi->min_io_size);
-        ubi_msg("VID header offset:          %d (aligned %d)",
-                ubi->vid_hdr_offset, ubi->vid_hdr_aloffset);
-        ubi_msg("data offset:                %d", ubi->leb_start);
         ubi_msg("max. allowed volumes:       %d", ubi->vtbl_slots);
         ubi_msg("wear-leveling threshold:    %d", CONFIG_MTD_UBI_WL_THRESHOLD);
         ubi_msg("number of internal volumes: %d", UBI_INT_VOL_COUNT);
@@ -950,8 +950,7 @@ static int __init ubi_init(void)
         BUILD_BUG_ON(sizeof(struct ubi_vid_hdr) != 64);
 
         if (mtd_devs > UBI_MAX_DEVICES) {
-                printk(KERN_ERR "UBI error: too many MTD devices, "
-                       "maximum is %d\n", UBI_MAX_DEVICES);
+                ubi_err("too many MTD devices, maximum is %d", UBI_MAX_DEVICES);
                 return -EINVAL;
         }
 
@@ -959,25 +958,25 @@ static int __init ubi_init(void)
         ubi_class = class_create(THIS_MODULE, UBI_NAME_STR);
         if (IS_ERR(ubi_class)) {
                 err = PTR_ERR(ubi_class);
-                printk(KERN_ERR "UBI error: cannot create UBI class\n");
+                ubi_err("cannot create UBI class");
                 goto out;
         }
 
         err = class_create_file(ubi_class, &ubi_version);
         if (err) {
-                printk(KERN_ERR "UBI error: cannot create sysfs file\n");
+                ubi_err("cannot create sysfs file");
                 goto out_class;
         }
 
         err = misc_register(&ubi_ctrl_cdev);
         if (err) {
-                printk(KERN_ERR "UBI error: cannot register device\n");
+                ubi_err("cannot register device");
                 goto out_version;
         }
 
         ubi_wl_entry_slab = kmem_cache_create("ubi_wl_entry_slab",
-                                                sizeof(struct ubi_wl_entry),
-                                                0, 0, NULL);
+                                              sizeof(struct ubi_wl_entry),
+                                              0, 0, NULL);
         if (!ubi_wl_entry_slab)
                 goto out_dev_unreg;
 
@@ -1000,8 +999,7 @@ static int __init ubi_init(void)
                 mutex_unlock(&ubi_devices_mutex);
                 if (err < 0) {
                         put_mtd_device(mtd);
-                        printk(KERN_ERR "UBI error: cannot attach mtd%d\n",
-                               mtd->index);
+                        ubi_err("cannot attach mtd%d", mtd->index);
                         goto out_detach;
                 }
         }
@@ -1023,7 +1021,7 @@ out_version:
 out_class:
         class_destroy(ubi_class);
 out:
-        printk(KERN_ERR "UBI error: cannot initialize UBI, error %d\n", err);
+        ubi_err("UBI error: cannot initialize UBI, error %d", err);
         return err;
 }
 module_init(ubi_init);
diff --git a/drivers/mtd/ubi/debug.h b/drivers/mtd/ubi/debug.h
index 51c40b17f1ec..8ea99d8c9e1f 100644
--- a/drivers/mtd/ubi/debug.h
+++ b/drivers/mtd/ubi/debug.h
@@ -41,7 +41,7 @@
 /* Generic debugging message */
 #define dbg_msg(fmt, ...)                                    \
         printk(KERN_DEBUG "UBI DBG (pid %d): %s: " fmt "\n", \
-               current->pid, __FUNCTION__, ##__VA_ARGS__)
+               current->pid, __func__, ##__VA_ARGS__)
 
 #define ubi_dbg_dump_stack() dump_stack()
 
@@ -99,8 +99,10 @@ void ubi_dbg_dump_mkvol_req(const struct ubi_mkvol_req *req);
 #ifdef CONFIG_MTD_UBI_DEBUG_MSG_BLD
 /* Initialization and build messages */
 #define dbg_bld(fmt, ...) dbg_msg(fmt, ##__VA_ARGS__)
+#define UBI_IO_DEBUG 1
 #else
 #define dbg_bld(fmt, ...) ({})
+#define UBI_IO_DEBUG 0
 #endif
 
 #ifdef CONFIG_MTD_UBI_DEBUG_EMULATE_BITFLIPS
diff --git a/drivers/mtd/ubi/gluebi.c b/drivers/mtd/ubi/gluebi.c
index d397219238d3..e909b390069a 100644
--- a/drivers/mtd/ubi/gluebi.c
+++ b/drivers/mtd/ubi/gluebi.c
@@ -291,11 +291,12 @@ int ubi_create_gluebi(struct ubi_device *ubi, struct ubi_volume *vol)
         /*
          * In case of dynamic volume, MTD device size is just volume size. In
          * case of a static volume the size is equivalent to the amount of data
-         * bytes, which is zero at this moment and will be changed after volume
-         * update.
+         * bytes.
          */
         if (vol->vol_type == UBI_DYNAMIC_VOLUME)
                 mtd->size = vol->usable_leb_size * vol->reserved_pebs;
+        else
+                mtd->size = vol->used_bytes;
 
         if (add_mtd_device(mtd)) {
                 ubi_err("cannot not add MTD device\n");
diff --git a/drivers/mtd/ubi/io.c b/drivers/mtd/ubi/io.c
index db3efdef2433..4ac11df7b048 100644
--- a/drivers/mtd/ubi/io.c
+++ b/drivers/mtd/ubi/io.c
@@ -631,6 +631,8 @@ int ubi_io_read_ec_hdr(struct ubi_device *ubi, int pnum,
 
         dbg_io("read EC header from PEB %d", pnum);
         ubi_assert(pnum >= 0 && pnum < ubi->peb_count);
+        if (UBI_IO_DEBUG)
+                verbose = 1;
 
         err = ubi_io_read(ubi, ec_hdr, pnum, 0, UBI_EC_HDR_SIZE);
         if (err) {
@@ -904,6 +906,8 @@ int ubi_io_read_vid_hdr(struct ubi_device *ubi, int pnum,
 
         dbg_io("read VID header from PEB %d", pnum);
         ubi_assert(pnum >= 0 &&  pnum < ubi->peb_count);
+        if (UBI_IO_DEBUG)
+                verbose = 1;
 
         p = (char *)vid_hdr - ubi->vid_hdr_shift;
         err = ubi_io_read(ubi, p, pnum, ubi->vid_hdr_aloffset,
diff --git a/drivers/mtd/ubi/scan.c b/drivers/mtd/ubi/scan.c
index 05aa3e7daba1..96d410e106ab 100644
--- a/drivers/mtd/ubi/scan.c
+++ b/drivers/mtd/ubi/scan.c
@@ -42,6 +42,7 @@
 
 #include <linux/err.h>
 #include <linux/crc32.h>
+#include <asm/div64.h>
 #include "ubi.h"
 
 #ifdef CONFIG_MTD_UBI_DEBUG_PARANOID
@@ -92,27 +93,6 @@ static int add_to_list(struct ubi_scan_info *si, int pnum, int ec,
 }
 
 /**
- * commit_to_mean_value - commit intermediate results to the final mean erase
- * counter value.
- * @si: scanning information
- *
- * This is a helper function which calculates partial mean erase counter mean
- * value and adds it to the resulting mean value. As we can work only in
- * integer arithmetic and we want to calculate the mean value of erase counter
- * accurately, we first sum erase counter values in @si->ec_sum variable and
- * count these components in @si->ec_count. If this temporary @si->ec_sum is
- * going to overflow, we calculate the partial mean value
- * (@si->ec_sum/@si->ec_count) and add it to @si->mean_ec.
- */
-static void commit_to_mean_value(struct ubi_scan_info *si)
-{
-        si->ec_sum /= si->ec_count;
-        if (si->ec_sum % si->ec_count >= si->ec_count / 2)
-                si->mean_ec += 1;
-        si->mean_ec += si->ec_sum;
-}
-
-/**
  * validate_vid_hdr - check that volume identifier header is correct and
  * consistent.
  * @vid_hdr: the volume identifier header to check
@@ -901,15 +881,8 @@ static int process_eb(struct ubi_device *ubi, struct ubi_scan_info *si, int pnum
 
 adjust_mean_ec:
         if (!ec_corr) {
-                if (si->ec_sum + ec < ec) {
-                        commit_to_mean_value(si);
-                        si->ec_sum = 0;
-                        si->ec_count = 0;
-                } else {
-                        si->ec_sum += ec;
-                        si->ec_count += 1;
-                }
-
+                si->ec_sum += ec;
+                si->ec_count += 1;
                 if (ec > si->max_ec)
                         si->max_ec = ec;
                 if (ec < si->min_ec)
@@ -965,9 +938,11 @@ struct ubi_scan_info *ubi_scan(struct ubi_device *ubi)
 
         dbg_msg("scanning is finished");
 
-        /* Finish mean erase counter calculations */
-        if (si->ec_count)
-                commit_to_mean_value(si);
+        /* Calculate mean erase counter */
+        if (si->ec_count) {
+                do_div(si->ec_sum, si->ec_count);
+                si->mean_ec = si->ec_sum;
+        }
 
         if (si->is_empty)
                 ubi_msg("empty MTD device detected");
diff --git a/drivers/mtd/ubi/scan.h b/drivers/mtd/ubi/scan.h
index 46d444af471a..966b9b682a42 100644
--- a/drivers/mtd/ubi/scan.h
+++ b/drivers/mtd/ubi/scan.h
@@ -124,7 +124,7 @@ struct ubi_scan_info {
         int max_ec;
         unsigned long long max_sqnum;
         int mean_ec;
-        int ec_sum;
+        uint64_t ec_sum;
         int ec_count;
 };
 
diff --git a/drivers/mtd/ubi/ubi-media.h b/drivers/mtd/ubi/ubi-media.h
new file mode 100644
index 000000000000..c3185d9fd048
--- /dev/null
+++ b/drivers/mtd/ubi/ubi-media.h
@@ -0,0 +1,372 @@
+/*
+ * Copyright (c) International Business Machines Corp., 2006
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See
+ * the GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
+ *
+ * Authors: Artem Bityutskiy (Битюцкий Артём)
+ *          Thomas Gleixner
+ *          Frank Haverkamp
+ *          Oliver Lohmann
+ *          Andreas Arnez
+ */
+
+/*
+ * This file defines the layout of UBI headers and all the other UBI on-flash
+ * data structures.
+ */
+
+#ifndef __UBI_MEDIA_H__
+#define __UBI_MEDIA_H__
+
+#include <asm/byteorder.h>
+
+/* The version of UBI images supported by this implementation */
+#define UBI_VERSION 1
+
+/* The highest erase counter value supported by this implementation */
+#define UBI_MAX_ERASECOUNTER 0x7FFFFFFF
+
+/* The initial CRC32 value used when calculating CRC checksums */
+#define UBI_CRC32_INIT 0xFFFFFFFFU
+
+/* Erase counter header magic number (ASCII "UBI#") */
+#define UBI_EC_HDR_MAGIC  0x55424923
+/* Volume identifier header magic number (ASCII "UBI!") */
+#define UBI_VID_HDR_MAGIC 0x55424921
+
+/*
+ * Volume type constants used in the volume identifier header.
+ *
+ * @UBI_VID_DYNAMIC: dynamic volume
+ * @UBI_VID_STATIC: static volume
+ */
+enum {
+        UBI_VID_DYNAMIC = 1,
+        UBI_VID_STATIC  = 2
+};
+
+/*
+ * Volume flags used in the volume table record.
+ *
+ * @UBI_VTBL_AUTORESIZE_FLG: auto-resize this volume
+ *
+ * %UBI_VTBL_AUTORESIZE_FLG flag can be set only for one volume in the volume
+ * table. UBI automatically re-sizes the volume which has this flag and makes
+ * the volume to be of largest possible size. This means that if after the
+ * initialization UBI finds out that there are available physical eraseblocks
+ * present on the device, it automatically appends all of them to the volume
+ * (the physical eraseblocks reserved for bad eraseblocks handling and other
+ * reserved physical eraseblocks are not taken). So, if there is a volume with
+ * the %UBI_VTBL_AUTORESIZE_FLG flag set, the amount of available logical
+ * eraseblocks will be zero after UBI is loaded, because all of them will be
+ * reserved for this volume. Note, the %UBI_VTBL_AUTORESIZE_FLG bit is cleared
+ * after the volume had been initialized.
+ *
+ * The auto-resize feature is useful for device production purposes. For
+ * example, different NAND flash chips may have different amount of initial bad
+ * eraseblocks, depending of particular chip instance. Manufacturers of NAND
+ * chips usually guarantee that the amount of initial bad eraseblocks does not
+ * exceed certain percent, e.g. 2%. When one creates an UBI image which will be
+ * flashed to the end devices in production, he does not know the exact amount
+ * of good physical eraseblocks the NAND chip on the device will have, but this
+ * number is required to calculate the volume sized and put them to the volume
+ * table of the UBI image. In this case, one of the volumes (e.g., the one
+ * which will store the root file system) is marked as "auto-resizable", and
+ * UBI will adjust its size on the first boot if needed.
+ *
+ * Note, first UBI reserves some amount of physical eraseblocks for bad
+ * eraseblock handling, and then re-sizes the volume, not vice-versa. This
+ * means that the pool of reserved physical eraseblocks will always be present.
+ */
+enum {
+        UBI_VTBL_AUTORESIZE_FLG = 0x01,
+};
+
+/*
+ * Compatibility constants used by internal volumes.
+ *
+ * @UBI_COMPAT_DELETE: delete this internal volume before anything is written
+ * to the flash
+ * @UBI_COMPAT_RO: attach this device in read-only mode
+ * @UBI_COMPAT_PRESERVE: preserve this internal volume - do not touch its
+ * physical eraseblocks, don't allow the wear-leveling unit to move them
+ * @UBI_COMPAT_REJECT: reject this UBI image
+ */
+enum {
+        UBI_COMPAT_DELETE   = 1,
+        UBI_COMPAT_RO       = 2,
+        UBI_COMPAT_PRESERVE = 4,
+        UBI_COMPAT_REJECT   = 5
+};
+
+/* Sizes of UBI headers */
+#define UBI_EC_HDR_SIZE  sizeof(struct ubi_ec_hdr)
+#define UBI_VID_HDR_SIZE sizeof(struct ubi_vid_hdr)
+
+/* Sizes of UBI headers without the ending CRC */
+#define UBI_EC_HDR_SIZE_CRC  (UBI_EC_HDR_SIZE  - sizeof(__be32))
+#define UBI_VID_HDR_SIZE_CRC (UBI_VID_HDR_SIZE - sizeof(__be32))
+
+/**
+ * struct ubi_ec_hdr - UBI erase counter header.
+ * @magic: erase counter header magic number (%UBI_EC_HDR_MAGIC)
+ * @version: version of UBI implementation which is supposed to accept this
+ * UBI image
+ * @padding1: reserved for future, zeroes
+ * @ec: the erase counter
+ * @vid_hdr_offset: where the VID header starts
+ * @data_offset: where the user data start
+ * @padding2: reserved for future, zeroes
+ * @hdr_crc: erase counter header CRC checksum
+ *
+ * The erase counter header takes 64 bytes and has a plenty of unused space for
+ * future usage. The unused fields are zeroed. The @version field is used to
+ * indicate the version of UBI implementation which is supposed to be able to
+ * work with this UBI image. If @version is greater then the current UBI
+ * version, the image is rejected. This may be useful in future if something
+ * is changed radically. This field is duplicated in the volume identifier
+ * header.
+ *
+ * The @vid_hdr_offset and @data_offset fields contain the offset of the the
+ * volume identifier header and user data, relative to the beginning of the
+ * physical eraseblock. These values have to be the same for all physical
+ * eraseblocks.
+ */
+struct ubi_ec_hdr {
+        __be32  magic;
+        __u8    version;
+        __u8    padding1[3];
+        __be64  ec; /* Warning: the current limit is 31-bit anyway! */
+        __be32  vid_hdr_offset;
+        __be32  data_offset;
+        __u8    padding2[36];
+        __be32  hdr_crc;
+} __attribute__ ((packed));
+
+/**
+ * struct ubi_vid_hdr - on-flash UBI volume identifier header.
+ * @magic: volume identifier header magic number (%UBI_VID_HDR_MAGIC)
+ * @version: UBI implementation version which is supposed to accept this UBI
+ * image (%UBI_VERSION)
+ * @vol_type: volume type (%UBI_VID_DYNAMIC or %UBI_VID_STATIC)
+ * @copy_flag: if this logical eraseblock was copied from another physical
+ * eraseblock (for wear-leveling reasons)
+ * @compat: compatibility of this volume (%0, %UBI_COMPAT_DELETE,
+ * %UBI_COMPAT_IGNORE, %UBI_COMPAT_PRESERVE, or %UBI_COMPAT_REJECT)
+ * @vol_id: ID of this volume
+ * @lnum: logical eraseblock number
+ * @leb_ver: version of this logical eraseblock (IMPORTANT: obsolete, to be
+ * removed, kept only for not breaking older UBI users)
+ * @data_size: how many bytes of data this logical eraseblock contains
+ * @used_ebs: total number of used logical eraseblocks in this volume
+ * @data_pad: how many bytes at the end of this physical eraseblock are not
+ * used
+ * @data_crc: CRC checksum of the data stored in this logical eraseblock
+ * @padding1: reserved for future, zeroes
+ * @sqnum: sequence number
+ * @padding2: reserved for future, zeroes
+ * @hdr_crc: volume identifier header CRC checksum
+ *
+ * The @sqnum is the value of the global sequence counter at the time when this
+ * VID header was created. The global sequence counter is incremented each time
+ * UBI writes a new VID header to the flash, i.e. when it maps a logical
+ * eraseblock to a new physical eraseblock. The global sequence counter is an
+ * unsigned 64-bit integer and we assume it never overflows. The @sqnum
+ * (sequence number) is used to distinguish between older and newer versions of
+ * logical eraseblocks.
+ *
+ * There are 2 situations when there may be more then one physical eraseblock
+ * corresponding to the same logical eraseblock, i.e., having the same @vol_id
+ * and @lnum values in the volume identifier header. Suppose we have a logical
+ * eraseblock L and it is mapped to the physical eraseblock P.
+ *
+ * 1. Because UBI may erase physical eraseblocks asynchronously, the following
+ * situation is possible: L is asynchronously erased, so P is scheduled for
+ * erasure, then L is written to,i.e. mapped to another physical eraseblock P1,
+ * so P1 is written to, then an unclean reboot happens. Result - there are 2
+ * physical eraseblocks P and P1 corresponding to the same logical eraseblock
+ * L. But P1 has greater sequence number, so UBI picks P1 when it attaches the
+ * flash.
+ *
+ * 2. From time to time UBI moves logical eraseblocks to other physical
+ * eraseblocks for wear-leveling reasons. If, for example, UBI moves L from P
+ * to P1, and an unclean reboot happens before P is physically erased, there
+ * are two physical eraseblocks P and P1 corresponding to L and UBI has to
+ * select one of them when the flash is attached. The @sqnum field says which
+ * PEB is the original (obviously P will have lower @sqnum) and the copy. But
+ * it is not enough to select the physical eraseblock with the higher sequence
+ * number, because the unclean reboot could have happen in the middle of the
+ * copying process, so the data in P is corrupted. It is also not enough to
+ * just select the physical eraseblock with lower sequence number, because the
+ * data there may be old (consider a case if more data was added to P1 after
+ * the copying). Moreover, the unclean reboot may happen when the erasure of P
+ * was just started, so it result in unstable P, which is "mostly" OK, but
+ * still has unstable bits.
+ *
+ * UBI uses the @copy_flag field to indicate that this logical eraseblock is a
+ * copy. UBI also calculates data CRC when the data is moved and stores it at
+ * the @data_crc field of the copy (P1). So when UBI needs to pick one physical
+ * eraseblock of two (P or P1), the @copy_flag of the newer one (P1) is
+ * examined. If it is cleared, the situation* is simple and the newer one is
+ * picked. If it is set, the data CRC of the copy (P1) is examined. If the CRC
+ * checksum is correct, this physical eraseblock is selected (P1). Otherwise
+ * the older one (P) is selected.
+ *
+ * Note, there is an obsolete @leb_ver field which was used instead of @sqnum
+ * in the past. But it is not used anymore and we keep it in order to be able
+ * to deal with old UBI images. It will be removed at some point.
+ *
+ * There are 2 sorts of volumes in UBI: user volumes and internal volumes.
+ * Internal volumes are not seen from outside and are used for various internal
+ * UBI purposes. In this implementation there is only one internal volume - the
+ * layout volume. Internal volumes are the main mechanism of UBI extensions.
+ * For example, in future one may introduce a journal internal volume. Internal
+ * volumes have their own reserved range of IDs.
+ *
+ * The @compat field is only used for internal volumes and contains the "degree
+ * of their compatibility". It is always zero for user volumes. This field
+ * provides a mechanism to introduce UBI extensions and to be still compatible
+ * with older UBI binaries. For example, if someone introduced a journal in
+ * future, he would probably use %UBI_COMPAT_DELETE compatibility for the
+ * journal volume.  And in this case, older UBI binaries, which know nothing
+ * about the journal volume, would just delete this volume and work perfectly
+ * fine. This is similar to what Ext2fs does when it is fed by an Ext3fs image
+ * - it just ignores the Ext3fs journal.
+ *
+ * The @data_crc field contains the CRC checksum of the contents of the logical
+ * eraseblock if this is a static volume. In case of dynamic volumes, it does
+ * not contain the CRC checksum as a rule. The only exception is when the
+ * data of the physical eraseblock was moved by the wear-leveling unit, then
+ * the wear-leveling unit calculates the data CRC and stores it in the
+ * @data_crc field. And of course, the @copy_flag is %in this case.
+ *
+ * The @data_size field is used only for static volumes because UBI has to know
+ * how many bytes of data are stored in this eraseblock. For dynamic volumes,
+ * this field usually contains zero. The only exception is when the data of the
+ * physical eraseblock was moved to another physical eraseblock for
+ * wear-leveling reasons. In this case, UBI calculates CRC checksum of the
+ * contents and uses both @data_crc and @data_size fields. In this case, the
+ * @data_size field contains data size.
+ *
+ * The @used_ebs field is used only for static volumes and indicates how many
+ * eraseblocks the data of the volume takes. For dynamic volumes this field is
+ * not used and always contains zero.
+ *
+ * The @data_pad is calculated when volumes are created using the alignment
+ * parameter. So, effectively, the @data_pad field reduces the size of logical
+ * eraseblocks of this volume. This is very handy when one uses block-oriented
+ * software (say, cramfs) on top of the UBI volume.
+ */
+struct ubi_vid_hdr {
+        __be32  magic;
+        __u8    version;
+        __u8    vol_type;
+        __u8    copy_flag;
+        __u8    compat;
+        __be32  vol_id;
+        __be32  lnum;
+        __be32  leb_ver; /* obsolete, to be removed, don't use */
+        __be32  data_size;
+        __be32  used_ebs;
+        __be32  data_pad;
+        __be32  data_crc;
+        __u8    padding1[4];
+        __be64  sqnum;
+        __u8    padding2[12];
+        __be32  hdr_crc;
+} __attribute__ ((packed));
+
+/* Internal UBI volumes count */
+#define UBI_INT_VOL_COUNT 1
+
+/*
+ * Starting ID of internal volumes. There is reserved room for 4096 internal
+ * volumes.
+ */
+#define UBI_INTERNAL_VOL_START (0x7FFFFFFF - 4096)
+
+/* The layout volume contains the volume table */
+
+#define UBI_LAYOUT_VOLUME_ID     UBI_INTERNAL_VOL_START
+#define UBI_LAYOUT_VOLUME_TYPE   UBI_VID_DYNAMIC
+#define UBI_LAYOUT_VOLUME_ALIGN  1
+#define UBI_LAYOUT_VOLUME_EBS    2
+#define UBI_LAYOUT_VOLUME_NAME   "layout volume"
+#define UBI_LAYOUT_VOLUME_COMPAT UBI_COMPAT_REJECT
+
+/* The maximum number of volumes per one UBI device */
+#define UBI_MAX_VOLUMES 128
+
+/* The maximum volume name length */
+#define UBI_VOL_NAME_MAX 127
+
+/* Size of the volume table record */
+#define UBI_VTBL_RECORD_SIZE sizeof(struct ubi_vtbl_record)
+
+/* Size of the volume table record without the ending CRC */
+#define UBI_VTBL_RECORD_SIZE_CRC (UBI_VTBL_RECORD_SIZE - sizeof(__be32))
+
+/**
+ * struct ubi_vtbl_record - a record in the volume table.
+ * @reserved_pebs: how many physical eraseblocks are reserved for this volume
+ * @alignment: volume alignment
+ * @data_pad: how many bytes are unused at the end of the each physical
+ * eraseblock to satisfy the requested alignment
+ * @vol_type: volume type (%UBI_DYNAMIC_VOLUME or %UBI_STATIC_VOLUME)
+ * @upd_marker: if volume update was started but not finished
+ * @name_len: volume name length
+ * @name: the volume name
+ * @flags: volume flags (%UBI_VTBL_AUTORESIZE_FLG)
+ * @padding: reserved, zeroes
+ * @crc: a CRC32 checksum of the record
+ *
+ * The volume table records are stored in the volume table, which is stored in
+ * the layout volume. The layout volume consists of 2 logical eraseblock, each
+ * of which contains a copy of the volume table (i.e., the volume table is
+ * duplicated). The volume table is an array of &struct ubi_vtbl_record
+ * objects indexed by the volume ID.
+ *
+ * If the size of the logical eraseblock is large enough to fit
+ * %UBI_MAX_VOLUMES records, the volume table contains %UBI_MAX_VOLUMES
+ * records. Otherwise, it contains as many records as it can fit (i.e., size of
+ * logical eraseblock divided by sizeof(struct ubi_vtbl_record)).
+ *
+ * The @upd_marker flag is used to implement volume update. It is set to %1
+ * before update and set to %0 after the update. So if the update operation was
+ * interrupted, UBI knows that the volume is corrupted.
+ *
+ * The @alignment field is specified when the volume is created and cannot be
+ * later changed. It may be useful, for example, when a block-oriented file
+ * system works on top of UBI. The @data_pad field is calculated using the
+ * logical eraseblock size and @alignment. The alignment must be multiple to the
+ * minimal flash I/O unit. If @alignment is 1, all the available space of
+ * the physical eraseblocks is used.
+ *
+ * Empty records contain all zeroes and the CRC checksum of those zeroes.
+ */
+struct ubi_vtbl_record {
+        __be32  reserved_pebs;
+        __be32  alignment;
+        __be32  data_pad;
+        __u8    vol_type;
+        __u8    upd_marker;
+        __be16  name_len;
+        __u8    name[UBI_VOL_NAME_MAX+1];
+        __u8    flags;
+        __u8    padding[23];
+        __be32  crc;
+} __attribute__ ((packed));
+
+#endif /* !__UBI_MEDIA_H__ */
diff --git a/drivers/mtd/ubi/ubi.h b/drivers/mtd/ubi/ubi.h
index a548c1d28fa8..67dcbd11c15c 100644
--- a/drivers/mtd/ubi/ubi.h
+++ b/drivers/mtd/ubi/ubi.h
@@ -37,10 +37,9 @@
 #include <linux/string.h>
 #include <linux/vmalloc.h>
 #include <linux/mtd/mtd.h>
-
-#include <mtd/ubi-header.h>
 #include <linux/mtd/ubi.h>
 
+#include "ubi-media.h"
 #include "scan.h"
 #include "debug.h"
 
@@ -54,10 +53,10 @@
 #define ubi_msg(fmt, ...) printk(KERN_NOTICE "UBI: " fmt "\n", ##__VA_ARGS__)
 /* UBI warning messages */
 #define ubi_warn(fmt, ...) printk(KERN_WARNING "UBI warning: %s: " fmt "\n", \
-                                  __FUNCTION__, ##__VA_ARGS__)
+                                  __func__, ##__VA_ARGS__)
 /* UBI error messages */
 #define ubi_err(fmt, ...) printk(KERN_ERR "UBI error: %s: " fmt "\n", \
-                                 __FUNCTION__, ##__VA_ARGS__)
+                                 __func__, ##__VA_ARGS__)
 
 /* Lowest number PEBs reserved for bad PEB handling */
 #define MIN_RESEVED_PEBS 2
diff --git a/drivers/net/arm/at91_ether.c b/drivers/net/arm/at91_ether.c
index 978e20a1791b..1e39e78f1778 100644
--- a/drivers/net/arm/at91_ether.c
+++ b/drivers/net/arm/at91_ether.c
@@ -1248,3 +1248,4 @@ module_exit(at91ether_exit)
 MODULE_LICENSE("GPL");
 MODULE_DESCRIPTION("AT91RM9200 EMAC Ethernet driver");
 MODULE_AUTHOR("Andrew Victor");
+MODULE_ALIAS("platform:" DRV_NAME);
diff --git a/drivers/net/arm/ep93xx_eth.c b/drivers/net/arm/ep93xx_eth.c
index 91a6590d107b..ecd8fc6146e9 100644
--- a/drivers/net/arm/ep93xx_eth.c
+++ b/drivers/net/arm/ep93xx_eth.c
@@ -897,6 +897,7 @@ static struct platform_driver ep93xx_eth_driver = {
         .remove         = ep93xx_eth_remove,
         .driver         = {
                 .name   = "ep93xx-eth",
+                .owner  = THIS_MODULE,
         },
 };
 
@@ -914,3 +915,4 @@ static void __exit ep93xx_eth_cleanup_module(void)
 module_init(ep93xx_eth_init_module);
 module_exit(ep93xx_eth_cleanup_module);
 MODULE_LICENSE("GPL");
+MODULE_ALIAS("platform:ep93xx-eth");
diff --git a/drivers/net/atlx/atl1.c b/drivers/net/atlx/atl1.c
index 5586fc624688..0afe522b8f7b 100644
--- a/drivers/net/atlx/atl1.c
+++ b/drivers/net/atlx/atl1.c
@@ -91,6 +91,144 @@
 #include "atlx.c"
 
 /*
+ * This is the only thing that needs to be changed to adjust the
+ * maximum number of ports that the driver can manage.
+ */
+#define ATL1_MAX_NIC 4
+
+#define OPTION_UNSET    -1
+#define OPTION_DISABLED 0
+#define OPTION_ENABLED  1
+
+#define ATL1_PARAM_INIT { [0 ... ATL1_MAX_NIC] = OPTION_UNSET }
+
+/*
+ * Interrupt Moderate Timer in units of 2 us
+ *
+ * Valid Range: 10-65535
+ *
+ * Default Value: 100 (200us)
+ */
+static int __devinitdata int_mod_timer[ATL1_MAX_NIC+1] = ATL1_PARAM_INIT;
+static int num_int_mod_timer;
+module_param_array_named(int_mod_timer, int_mod_timer, int,
+        &num_int_mod_timer, 0);
+MODULE_PARM_DESC(int_mod_timer, "Interrupt moderator timer");
+
+#define DEFAULT_INT_MOD_CNT     100     /* 200us */
+#define MAX_INT_MOD_CNT         65000
+#define MIN_INT_MOD_CNT         50
+
+struct atl1_option {
+        enum { enable_option, range_option, list_option } type;
+        char *name;
+        char *err;
+        int def;
+        union {
+                struct {        /* range_option info */
+                        int min;
+                        int max;
+                } r;
+                struct {        /* list_option info */
+                        int nr;
+                        struct atl1_opt_list {
+                                int i;
+                                char *str;
+                        } *p;
+                } l;
+        } arg;
+};
+
+static int __devinit atl1_validate_option(int *value, struct atl1_option *opt,
+        struct pci_dev *pdev)
+{
+        if (*value == OPTION_UNSET) {
+                *value = opt->def;
+                return 0;
+        }
+
+        switch (opt->type) {
+        case enable_option:
+                switch (*value) {
+                case OPTION_ENABLED:
+                        dev_info(&pdev->dev, "%s enabled\n", opt->name);
+                        return 0;
+                case OPTION_DISABLED:
+                        dev_info(&pdev->dev, "%s disabled\n", opt->name);
+                        return 0;
+                }
+                break;
+        case range_option:
+                if (*value >= opt->arg.r.min && *value <= opt->arg.r.max) {
+                        dev_info(&pdev->dev, "%s set to %i\n", opt->name,
+                                *value);
+                        return 0;
+                }
+                break;
+        case list_option:{
+                        int i;
+                        struct atl1_opt_list *ent;
+
+                        for (i = 0; i < opt->arg.l.nr; i++) {
+                                ent = &opt->arg.l.p[i];
+                                if (*value == ent->i) {
+                                        if (ent->str[0] != '\0')
+                                                dev_info(&pdev->dev, "%s\n",
+                                                        ent->str);
+                                        return 0;
+                                }
+                        }
+                }
+                break;
+
+        default:
+                break;
+        }
+
+        dev_info(&pdev->dev, "invalid %s specified (%i) %s\n",
+                opt->name, *value, opt->err);
+        *value = opt->def;
+        return -1;
+}
+
+/*
+ * atl1_check_options - Range Checking for Command Line Parameters
+ * @adapter: board private structure
+ *
+ * This routine checks all command line parameters for valid user
+ * input.  If an invalid value is given, or if no user specified
+ * value exists, a default value is used.  The final value is stored
+ * in a variable in the adapter structure.
+ */
+void __devinit atl1_check_options(struct atl1_adapter *adapter)
+{
+        struct pci_dev *pdev = adapter->pdev;
+        int bd = adapter->bd_number;
+        if (bd >= ATL1_MAX_NIC) {
+                dev_notice(&pdev->dev, "no configuration for board#%i\n", bd);
+                dev_notice(&pdev->dev, "using defaults for all values\n");
+        }
+        {                       /* Interrupt Moderate Timer */
+                struct atl1_option opt = {
+                        .type = range_option,
+                        .name = "Interrupt Moderator Timer",
+                        .err = "using default of "
+                                __MODULE_STRING(DEFAULT_INT_MOD_CNT),
+                        .def = DEFAULT_INT_MOD_CNT,
+                        .arg = {.r = {.min = MIN_INT_MOD_CNT,
+                                        .max = MAX_INT_MOD_CNT} }
+                };
+                int val;
+                if (num_int_mod_timer > bd) {
+                        val = int_mod_timer[bd];
+                        atl1_validate_option(&val, &opt, pdev);
+                        adapter->imt = (u16) val;
+                } else
+                        adapter->imt = (u16) (opt.def);
+        }
+}
+
+/*
  * atl1_pci_tbl - PCI Device ID Table
  */
 static const struct pci_device_id atl1_pci_tbl[] = {
diff --git a/drivers/net/atlx/atlx.c b/drivers/net/atlx/atlx.c
index 4186326d1b94..f06b854e2501 100644
--- a/drivers/net/atlx/atlx.c
+++ b/drivers/net/atlx/atlx.c
@@ -253,181 +253,4 @@ static void atlx_restore_vlan(struct atlx_adapter *adapter)
         atlx_vlan_rx_register(adapter->netdev, adapter->vlgrp);
 }
 
-/*
- * This is the only thing that needs to be changed to adjust the
- * maximum number of ports that the driver can manage.
- */
-#define ATL1_MAX_NIC 4
-
-#define OPTION_UNSET    -1
-#define OPTION_DISABLED 0
-#define OPTION_ENABLED  1
-
-#define ATL1_PARAM_INIT { [0 ... ATL1_MAX_NIC] = OPTION_UNSET }
-
-/*
- * Interrupt Moderate Timer in units of 2 us
- *
- * Valid Range: 10-65535
- *
- * Default Value: 100 (200us)
- */
-static int __devinitdata int_mod_timer[ATL1_MAX_NIC+1] = ATL1_PARAM_INIT;
-static int num_int_mod_timer;
-module_param_array_named(int_mod_timer, int_mod_timer, int,
-        &num_int_mod_timer, 0);
-MODULE_PARM_DESC(int_mod_timer, "Interrupt moderator timer");
-
-/*
- * flash_vendor
- *
- * Valid Range: 0-2
- *
- * 0 - Atmel
- * 1 - SST
- * 2 - ST
- *
- * Default Value: 0
- */
-static int __devinitdata flash_vendor[ATL1_MAX_NIC+1] = ATL1_PARAM_INIT;
-static int num_flash_vendor;
-module_param_array_named(flash_vendor, flash_vendor, int, &num_flash_vendor, 0);
-MODULE_PARM_DESC(flash_vendor, "SPI flash vendor");
-
-#define DEFAULT_INT_MOD_CNT     100     /* 200us */
-#define MAX_INT_MOD_CNT         65000
-#define MIN_INT_MOD_CNT         50
-
-#define FLASH_VENDOR_DEFAULT    0
-#define FLASH_VENDOR_MIN        0
-#define FLASH_VENDOR_MAX        2
-
-struct atl1_option {
-        enum { enable_option, range_option, list_option } type;
-        char *name;
-        char *err;
-        int def;
-        union {
-                struct {        /* range_option info */
-                        int min;
-                        int max;
-                } r;
-                struct {        /* list_option info */
-                        int nr;
-                        struct atl1_opt_list {
-                                int i;
-                                char *str;
-                        } *p;
-                } l;
-        } arg;
-};
-
-static int __devinit atl1_validate_option(int *value, struct atl1_option *opt,
-        struct pci_dev *pdev)
-{
-        if (*value == OPTION_UNSET) {
-                *value = opt->def;
-                return 0;
-        }
-
-        switch (opt->type) {
-        case enable_option:
-                switch (*value) {
-                case OPTION_ENABLED:
-                        dev_info(&pdev->dev, "%s enabled\n", opt->name);
-                        return 0;
-                case OPTION_DISABLED:
-                        dev_info(&pdev->dev, "%s disabled\n", opt->name);
-                        return 0;
-                }
-                break;
-        case range_option:
-                if (*value >= opt->arg.r.min && *value <= opt->arg.r.max) {
-                        dev_info(&pdev->dev, "%s set to %i\n", opt->name,
-                                *value);
-                        return 0;
-                }
-                break;
-        case list_option:{
-                        int i;
-                        struct atl1_opt_list *ent;
-
-                        for (i = 0; i < opt->arg.l.nr; i++) {
-                                ent = &opt->arg.l.p[i];
-                                if (*value == ent->i) {
-                                        if (ent->str[0] != '\0')
-                                                dev_info(&pdev->dev, "%s\n",
-                                                        ent->str);
-                                        return 0;
-                                }
-                        }
-                }
-                break;
-
-        default:
-                break;
-        }
-
-        dev_info(&pdev->dev, "invalid %s specified (%i) %s\n",
-                opt->name, *value, opt->err);
-        *value = opt->def;
-        return -1;
-}
-
-/*
- * atl1_check_options - Range Checking for Command Line Parameters
- * @adapter: board private structure
- *
- * This routine checks all command line parameters for valid user
- * input.  If an invalid value is given, or if no user specified
- * value exists, a default value is used.  The final value is stored
- * in a variable in the adapter structure.
- */
-void __devinit atl1_check_options(struct atl1_adapter *adapter)
-{
-        struct pci_dev *pdev = adapter->pdev;
-        int bd = adapter->bd_number;
-        if (bd >= ATL1_MAX_NIC) {
-                dev_notice(&pdev->dev, "no configuration for board#%i\n", bd);
-                dev_notice(&pdev->dev, "using defaults for all values\n");
-        }
-        {                       /* Interrupt Moderate Timer */
-                struct atl1_option opt = {
-                        .type = range_option,
-                        .name = "Interrupt Moderator Timer",
-                        .err = "using default of "
-                                __MODULE_STRING(DEFAULT_INT_MOD_CNT),
-                        .def = DEFAULT_INT_MOD_CNT,
-                        .arg = {.r = {.min = MIN_INT_MOD_CNT,
-                                        .max = MAX_INT_MOD_CNT} }
-                };
-                int val;
-                if (num_int_mod_timer > bd) {
-                        val = int_mod_timer[bd];
-                        atl1_validate_option(&val, &opt, pdev);
-                        adapter->imt = (u16) val;
-                } else
-                        adapter->imt = (u16) (opt.def);
-        }
-
-        {                       /* Flash Vendor */
-                struct atl1_option opt = {
-                        .type = range_option,
-                        .name = "SPI Flash Vendor",
-                        .err = "using default of "
-                                __MODULE_STRING(FLASH_VENDOR_DEFAULT),
-                        .def = DEFAULT_INT_MOD_CNT,
-                        .arg = {.r = {.min = FLASH_VENDOR_MIN,
-                                        .max = FLASH_VENDOR_MAX} }
-                };
-                int val;
-                if (num_flash_vendor > bd) {
-                        val = flash_vendor[bd];
-                        atl1_validate_option(&val, &opt, pdev);
-                        adapter->hw.flash_vendor = (u8) val;
-                } else
-                        adapter->hw.flash_vendor = (u8) (opt.def);
-        }
-}
-
 #endif /* ATLX_C */
diff --git a/drivers/net/ax88796.c b/drivers/net/ax88796.c
index 194949afacd0..0b4adf4a0f7d 100644
--- a/drivers/net/ax88796.c
+++ b/drivers/net/ax88796.c
@@ -1005,3 +1005,4 @@ module_exit(axdrv_exit);
 MODULE_DESCRIPTION("AX88796 10/100 Ethernet platform driver");
 MODULE_AUTHOR("Ben Dooks, <ben@simtec.co.uk>");
 MODULE_LICENSE("GPL v2");
+MODULE_ALIAS("platform:ax88796");
diff --git a/drivers/net/bfin_mac.c b/drivers/net/bfin_mac.c
index 717dcc1aa1e9..4fec8581bfd7 100644
--- a/drivers/net/bfin_mac.c
+++ b/drivers/net/bfin_mac.c
@@ -47,6 +47,7 @@
 MODULE_AUTHOR(DRV_AUTHOR);
 MODULE_LICENSE("GPL");
 MODULE_DESCRIPTION(DRV_DESC);
+MODULE_ALIAS("platform:bfin_mac");
 
 #if defined(CONFIG_BFIN_MAC_USE_L1)
 # define bfin_mac_alloc(dma_handle, size)  l1_data_sram_zalloc(size)
@@ -1089,8 +1090,9 @@ static struct platform_driver bfin_mac_driver = {
         .resume = bfin_mac_resume,
         .suspend = bfin_mac_suspend,
         .driver = {
-                   .name = DRV_NAME,
-                   },
+                .name = DRV_NAME,
+                .owner  = THIS_MODULE,
+        },
 };
 
 static int __init bfin_mac_init(void)
@@ -1106,3 +1108,4 @@ static void __exit bfin_mac_cleanup(void)
 }
 
 module_exit(bfin_mac_cleanup);
+
diff --git a/drivers/net/cpmac.c b/drivers/net/cpmac.c
index 9da7ff437031..2b5740b3d182 100644
--- a/drivers/net/cpmac.c
+++ b/drivers/net/cpmac.c
@@ -42,6 +42,7 @@
 MODULE_AUTHOR("Eugene Konev <ejka@imfi.kspu.ru>");
 MODULE_DESCRIPTION("TI AR7 ethernet driver (CPMAC)");
 MODULE_LICENSE("GPL");
+MODULE_ALIAS("platform:cpmac");
 
 static int debug_level = 8;
 static int dumb_switch;
@@ -1103,6 +1104,7 @@ static int __devexit cpmac_remove(struct platform_device *pdev)
 
 static struct platform_driver cpmac_driver = {
         .driver.name = "cpmac",
+        .driver.owner = THIS_MODULE,
         .probe = cpmac_probe,
         .remove = __devexit_p(cpmac_remove),
 };
diff --git a/drivers/net/dm9000.c b/drivers/net/dm9000.c
index d63cc93f055d..e6fe2614ea6d 100644
--- a/drivers/net/dm9000.c
+++ b/drivers/net/dm9000.c
@@ -1418,3 +1418,4 @@ module_exit(dm9000_cleanup);
 MODULE_AUTHOR("Sascha Hauer, Ben Dooks");
 MODULE_DESCRIPTION("Davicom DM9000 network driver");
 MODULE_LICENSE("GPL");
+MODULE_ALIAS("platform:dm9000");
diff --git a/drivers/net/e1000e/82571.c b/drivers/net/e1000e/82571.c
index 01c88664bad3..462351ca2c81 100644
--- a/drivers/net/e1000e/82571.c
+++ b/drivers/net/e1000e/82571.c
@@ -1326,12 +1326,10 @@ struct e1000_info e1000_82571_info = {
         .mac                    = e1000_82571,
         .flags                  = FLAG_HAS_HW_VLAN_FILTER
                                   | FLAG_HAS_JUMBO_FRAMES
-                                  | FLAG_HAS_STATS_PTC_PRC
                                   | FLAG_HAS_WOL
                                   | FLAG_APME_IN_CTRL3
                                   | FLAG_RX_CSUM_ENABLED
                                   | FLAG_HAS_CTRLEXT_ON_LOAD
-                                  | FLAG_HAS_STATS_ICR_ICT
                                   | FLAG_HAS_SMART_POWER_DOWN
                                   | FLAG_RESET_OVERWRITES_LAA /* errata */
                                   | FLAG_TARC_SPEED_MODE_BIT /* errata */
@@ -1347,12 +1345,10 @@ struct e1000_info e1000_82572_info = {
         .mac                    = e1000_82572,
         .flags                  = FLAG_HAS_HW_VLAN_FILTER
                                   | FLAG_HAS_JUMBO_FRAMES
-                                  | FLAG_HAS_STATS_PTC_PRC
                                   | FLAG_HAS_WOL
                                   | FLAG_APME_IN_CTRL3
                                   | FLAG_RX_CSUM_ENABLED
                                   | FLAG_HAS_CTRLEXT_ON_LOAD
-                                  | FLAG_HAS_STATS_ICR_ICT
                                   | FLAG_TARC_SPEED_MODE_BIT, /* errata */
         .pba                    = 38,
         .get_variants           = e1000_get_variants_82571,
@@ -1365,11 +1361,9 @@ struct e1000_info e1000_82573_info = {
         .mac                    = e1000_82573,
         .flags                  = FLAG_HAS_HW_VLAN_FILTER
                                   | FLAG_HAS_JUMBO_FRAMES
-                                  | FLAG_HAS_STATS_PTC_PRC
                                   | FLAG_HAS_WOL
                                   | FLAG_APME_IN_CTRL3
                                   | FLAG_RX_CSUM_ENABLED
-                                  | FLAG_HAS_STATS_ICR_ICT
                                   | FLAG_HAS_SMART_POWER_DOWN
                                   | FLAG_HAS_AMT
                                   | FLAG_HAS_ERT
diff --git a/drivers/net/e1000e/defines.h b/drivers/net/e1000e/defines.h
index 572cfd44397a..2a53875cddbf 100644
--- a/drivers/net/e1000e/defines.h
+++ b/drivers/net/e1000e/defines.h
@@ -184,6 +184,7 @@
 #define E1000_SWFW_EEP_SM   0x1
 #define E1000_SWFW_PHY0_SM  0x2
 #define E1000_SWFW_PHY1_SM  0x4
+#define E1000_SWFW_CSR_SM   0x8
 
 /* Device Control */
 #define E1000_CTRL_FD       0x00000001  /* Full duplex.0=half; 1=full */
@@ -527,8 +528,10 @@
 #define PHY_ID2          0x03 /* Phy Id Reg (word 2) */
 #define PHY_AUTONEG_ADV  0x04 /* Autoneg Advertisement */
 #define PHY_LP_ABILITY   0x05 /* Link Partner Ability (Base Page) */
+#define PHY_AUTONEG_EXP  0x06 /* Autoneg Expansion Reg */
 #define PHY_1000T_CTRL   0x09 /* 1000Base-T Control Reg */
 #define PHY_1000T_STATUS 0x0A /* 1000Base-T Status Reg */
+#define PHY_EXT_STATUS   0x0F /* Extended Status Reg */
 
 /* NVM Control */
 #define E1000_EECD_SK        0x00000001 /* NVM Clock */
diff --git a/drivers/net/e1000e/e1000.h b/drivers/net/e1000e/e1000.h
index 5a89dff52264..38bfd0d261fe 100644
--- a/drivers/net/e1000e/e1000.h
+++ b/drivers/net/e1000e/e1000.h
@@ -64,11 +64,14 @@ struct e1000_info;
 /* Tx/Rx descriptor defines */
 #define E1000_DEFAULT_TXD               256
 #define E1000_MAX_TXD                   4096
-#define E1000_MIN_TXD                   80
+#define E1000_MIN_TXD                   64
 
 #define E1000_DEFAULT_RXD               256
 #define E1000_MAX_RXD                   4096
-#define E1000_MIN_RXD                   80
+#define E1000_MIN_RXD                   64
+
+#define E1000_MIN_ITR_USECS             10 /* 100000 irq/sec */
+#define E1000_MAX_ITR_USECS             10000 /* 100    irq/sec */
 
 /* Early Receive defines */
 #define E1000_ERT_2048                  0x100
@@ -147,6 +150,18 @@ struct e1000_ring {
         struct e1000_queue_stats stats;
 };
 
+/* PHY register snapshot values */
+struct e1000_phy_regs {
+        u16 bmcr;               /* basic mode control register    */
+        u16 bmsr;               /* basic mode status register     */
+        u16 advertise;          /* auto-negotiation advertisement */
+        u16 lpa;                /* link partner ability register  */
+        u16 expansion;          /* auto-negotiation expansion reg */
+        u16 ctrl1000;           /* 1000BASE-T control register    */
+        u16 stat1000;           /* 1000BASE-T status register     */
+        u16 estatus;            /* extended status register       */
+};
+
 /* board specific private data structure */
 struct e1000_adapter {
         struct timer_list watchdog_timer;
@@ -202,8 +217,8 @@ struct e1000_adapter {
         /* Tx stats */
         u64 tpt_old;
         u64 colc_old;
-        u64 gotcl_old;
-        u32 gotcl;
+        u32 gotc;
+        u64 gotc_old;
         u32 tx_timeout_count;
         u32 tx_fifo_head;
         u32 tx_head_addr;
@@ -227,8 +242,8 @@ struct e1000_adapter {
         u64 hw_csum_err;
         u64 hw_csum_good;
         u64 rx_hdr_split;
-        u64 gorcl_old;
-        u32 gorcl;
+        u32 gorc;
+        u64 gorc_old;
         u32 alloc_rx_buff_failed;
         u32 rx_dma_failed;
 
@@ -250,6 +265,9 @@ struct e1000_adapter {
         struct e1000_phy_info phy_info;
         struct e1000_phy_stats phy_stats;
 
+        /* Snapshot of PHY registers */
+        struct e1000_phy_regs phy_regs;
+
         struct e1000_ring test_tx_ring;
         struct e1000_ring test_rx_ring;
         u32 test_icr;
@@ -286,8 +304,6 @@ struct e1000_info {
 #define FLAG_HAS_CTRLEXT_ON_LOAD          (1 << 5)
 #define FLAG_HAS_SWSM_ON_LOAD             (1 << 6)
 #define FLAG_HAS_JUMBO_FRAMES             (1 << 7)
-#define FLAG_HAS_STATS_ICR_ICT            (1 << 9)
-#define FLAG_HAS_STATS_PTC_PRC            (1 << 10)
 #define FLAG_HAS_SMART_POWER_DOWN         (1 << 11)
 #define FLAG_IS_QUAD_PORT_A               (1 << 12)
 #define FLAG_IS_QUAD_PORT                 (1 << 13)
@@ -433,6 +449,8 @@ extern s32 e1000e_read_kmrn_reg(struct e1000_hw *hw, u32 offset, u16 *data);
 extern s32 e1000e_phy_has_link_generic(struct e1000_hw *hw, u32 iterations,
                                u32 usec_interval, bool *success);
 extern s32 e1000e_phy_reset_dsp(struct e1000_hw *hw);
+extern s32 e1000e_read_phy_reg_mdic(struct e1000_hw *hw, u32 offset, u16 *data);
+extern s32 e1000e_write_phy_reg_mdic(struct e1000_hw *hw, u32 offset, u16 data);
 extern s32 e1000e_check_downshift(struct e1000_hw *hw);
 
 static inline s32 e1000_phy_hw_reset(struct e1000_hw *hw)
diff --git a/drivers/net/e1000e/es2lan.c b/drivers/net/e1000e/es2lan.c
index d59a99ae44be..dc552d7d6fac 100644
--- a/drivers/net/e1000e/es2lan.c
+++ b/drivers/net/e1000e/es2lan.c
@@ -41,6 +41,7 @@
 #define E1000_KMRNCTRLSTA_OFFSET_FIFO_CTRL       0x00
 #define E1000_KMRNCTRLSTA_OFFSET_INB_CTRL        0x02
 #define E1000_KMRNCTRLSTA_OFFSET_HD_CTRL         0x10
+#define E1000_KMRNCTRLSTA_OFFSET_MAC2PHY_OPMODE  0x1F
 
 #define E1000_KMRNCTRLSTA_FIFO_CTRL_RX_BYPASS    0x0008
 #define E1000_KMRNCTRLSTA_FIFO_CTRL_TX_BYPASS    0x0800
@@ -48,6 +49,7 @@
 
 #define E1000_KMRNCTRLSTA_HD_CTRL_10_100_DEFAULT 0x0004
 #define E1000_KMRNCTRLSTA_HD_CTRL_1000_DEFAULT   0x0000
+#define E1000_KMRNCTRLSTA_OPMODE_E_IDLE          0x2000
 
 #define E1000_TCTL_EXT_GCEX_MASK 0x000FFC00 /* Gigabit Carry Extend Padding */
 #define DEFAULT_TCTL_EXT_GCEX_80003ES2LAN        0x00010000
@@ -85,6 +87,9 @@
 /* Kumeran Mode Control Register (Page 193, Register 16) */
 #define GG82563_KMCR_PASS_FALSE_CARRIER          0x0800
 
+/* Max number of times Kumeran read/write should be validated */
+#define GG82563_MAX_KMRN_RETRY  0x5
+
 /* Power Management Control Register (Page 193, Register 20) */
 #define GG82563_PMCR_ENABLE_ELECTRICAL_IDLE      0x0001
                                            /* 1=Enable SERDES Electrical Idle */
@@ -270,6 +275,7 @@ static s32 e1000_acquire_phy_80003es2lan(struct e1000_hw *hw)
         u16 mask;
 
         mask = hw->bus.func ? E1000_SWFW_PHY1_SM : E1000_SWFW_PHY0_SM;
+        mask |= E1000_SWFW_CSR_SM;
 
         return e1000_acquire_swfw_sync_80003es2lan(hw, mask);
 }
@@ -286,6 +292,8 @@ static void e1000_release_phy_80003es2lan(struct e1000_hw *hw)
         u16 mask;
 
         mask = hw->bus.func ? E1000_SWFW_PHY1_SM : E1000_SWFW_PHY0_SM;
+        mask |= E1000_SWFW_CSR_SM;
+
         e1000_release_swfw_sync_80003es2lan(hw, mask);
 }
 
@@ -410,20 +418,27 @@ static s32 e1000_read_phy_reg_gg82563_80003es2lan(struct e1000_hw *hw,
         u32 page_select;
         u16 temp;
 
+        ret_val = e1000_acquire_phy_80003es2lan(hw);
+        if (ret_val)
+                return ret_val;
+
         /* Select Configuration Page */
-        if ((offset & MAX_PHY_REG_ADDRESS) < GG82563_MIN_ALT_REG)
+        if ((offset & MAX_PHY_REG_ADDRESS) < GG82563_MIN_ALT_REG) {
                 page_select = GG82563_PHY_PAGE_SELECT;
-        else
+        } else {
                 /*
                  * Use Alternative Page Select register to access
                  * registers 30 and 31
                  */
                 page_select = GG82563_PHY_PAGE_SELECT_ALT;
+        }
 
         temp = (u16)((u16)offset >> GG82563_PAGE_SHIFT);
-        ret_val = e1000e_write_phy_reg_m88(hw, page_select, temp);
-        if (ret_val)
+        ret_val = e1000e_write_phy_reg_mdic(hw, page_select, temp);
+        if (ret_val) {
+                e1000_release_phy_80003es2lan(hw);
                 return ret_val;
+        }
 
         /*
          * The "ready" bit in the MDIC register may be incorrectly set
@@ -433,20 +448,21 @@ static s32 e1000_read_phy_reg_gg82563_80003es2lan(struct e1000_hw *hw,
         udelay(200);
 
         /* ...and verify the command was successful. */
-        ret_val = e1000e_read_phy_reg_m88(hw, page_select, &temp);
+        ret_val = e1000e_read_phy_reg_mdic(hw, page_select, &temp);
 
         if (((u16)offset >> GG82563_PAGE_SHIFT) != temp) {
                 ret_val = -E1000_ERR_PHY;
+                e1000_release_phy_80003es2lan(hw);
                 return ret_val;
         }
 
         udelay(200);
 
-        ret_val = e1000e_read_phy_reg_m88(hw,
-                                         MAX_PHY_REG_ADDRESS & offset,
-                                         data);
+        ret_val = e1000e_read_phy_reg_mdic(hw, MAX_PHY_REG_ADDRESS & offset,
+                                           data);
 
         udelay(200);
+        e1000_release_phy_80003es2lan(hw);
 
         return ret_val;
 }
@@ -467,20 +483,27 @@ static s32 e1000_write_phy_reg_gg82563_80003es2lan(struct e1000_hw *hw,
         u32 page_select;
         u16 temp;
 
+        ret_val = e1000_acquire_phy_80003es2lan(hw);
+        if (ret_val)
+                return ret_val;
+
         /* Select Configuration Page */
-        if ((offset & MAX_PHY_REG_ADDRESS) < GG82563_MIN_ALT_REG)
+        if ((offset & MAX_PHY_REG_ADDRESS) < GG82563_MIN_ALT_REG) {
                 page_select = GG82563_PHY_PAGE_SELECT;
-        else
+        } else {
                 /*
                  * Use Alternative Page Select register to access
                  * registers 30 and 31
                  */
                 page_select = GG82563_PHY_PAGE_SELECT_ALT;
+        }
 
         temp = (u16)((u16)offset >> GG82563_PAGE_SHIFT);
-        ret_val = e1000e_write_phy_reg_m88(hw, page_select, temp);
-        if (ret_val)
+        ret_val = e1000e_write_phy_reg_mdic(hw, page_select, temp);
+        if (ret_val) {
+                e1000_release_phy_80003es2lan(hw);
                 return ret_val;
+        }
 
 
         /*
@@ -491,18 +514,20 @@ static s32 e1000_write_phy_reg_gg82563_80003es2lan(struct e1000_hw *hw,
         udelay(200);
 
         /* ...and verify the command was successful. */
-        ret_val = e1000e_read_phy_reg_m88(hw, page_select, &temp);
+        ret_val = e1000e_read_phy_reg_mdic(hw, page_select, &temp);
 
-        if (((u16)offset >> GG82563_PAGE_SHIFT) != temp)
+        if (((u16)offset >> GG82563_PAGE_SHIFT) != temp) {
+                e1000_release_phy_80003es2lan(hw);
                 return -E1000_ERR_PHY;
+        }
 
         udelay(200);
 
-        ret_val = e1000e_write_phy_reg_m88(hw,
-                                          MAX_PHY_REG_ADDRESS & offset,
-                                          data);
+        ret_val = e1000e_write_phy_reg_mdic(hw, MAX_PHY_REG_ADDRESS & offset,
+                                            data);
 
         udelay(200);
+        e1000_release_phy_80003es2lan(hw);
 
         return ret_val;
 }
@@ -882,10 +907,10 @@ static s32 e1000_copper_link_setup_gg82563_80003es2lan(struct e1000_hw *hw)
         struct e1000_phy_info *phy = &hw->phy;
         s32 ret_val;
         u32 ctrl_ext;
-        u16 data;
+        u32 i = 0;
+        u16 data, data2;
 
-        ret_val = e1e_rphy(hw, GG82563_PHY_MAC_SPEC_CTRL,
-                                     &data);
+        ret_val = e1e_rphy(hw, GG82563_PHY_MAC_SPEC_CTRL, &data);
         if (ret_val)
                 return ret_val;
 
@@ -893,8 +918,7 @@ static s32 e1000_copper_link_setup_gg82563_80003es2lan(struct e1000_hw *hw)
         /* Use 25MHz for both link down and 1000Base-T for Tx clock. */
         data |= GG82563_MSCR_TX_CLK_1000MBPS_25;
 
-        ret_val = e1e_wphy(hw, GG82563_PHY_MAC_SPEC_CTRL,
-                                      data);
+        ret_val = e1e_wphy(hw, GG82563_PHY_MAC_SPEC_CTRL, data);
         if (ret_val)
                 return ret_val;
 
@@ -954,6 +978,18 @@ static s32 e1000_copper_link_setup_gg82563_80003es2lan(struct e1000_hw *hw)
         if (ret_val)
                 return ret_val;
 
+        ret_val = e1000e_read_kmrn_reg(hw,
+                                       E1000_KMRNCTRLSTA_OFFSET_MAC2PHY_OPMODE,
+                                       &data);
+        if (ret_val)
+                return ret_val;
+        data |= E1000_KMRNCTRLSTA_OPMODE_E_IDLE;
+        ret_val = e1000e_write_kmrn_reg(hw,
+                                        E1000_KMRNCTRLSTA_OFFSET_MAC2PHY_OPMODE,
+                                        data);
+        if (ret_val)
+                return ret_val;
+
         ret_val = e1e_rphy(hw, GG82563_PHY_SPEC_CTRL_2, &data);
         if (ret_val)
                 return ret_val;
@@ -983,9 +1019,18 @@ static s32 e1000_copper_link_setup_gg82563_80003es2lan(struct e1000_hw *hw)
                 if (ret_val)
                         return ret_val;
 
-                ret_val = e1e_rphy(hw, GG82563_PHY_KMRN_MODE_CTRL, &data);
-                if (ret_val)
-                        return ret_val;
+                do {
+                        ret_val = e1e_rphy(hw, GG82563_PHY_KMRN_MODE_CTRL,
+                                           &data);
+                        if (ret_val)
+                                return ret_val;
+
+                        ret_val = e1e_rphy(hw, GG82563_PHY_KMRN_MODE_CTRL,
+                                           &data2);
+                        if (ret_val)
+                                return ret_val;
+                        i++;
+                } while ((data != data2) && (i < GG82563_MAX_KMRN_RETRY));
 
                 data &= ~GG82563_KMCR_PASS_FALSE_CARRIER;
                 ret_val = e1e_wphy(hw, GG82563_PHY_KMRN_MODE_CTRL, data);
@@ -1074,7 +1119,8 @@ static s32 e1000_cfg_kmrn_10_100_80003es2lan(struct e1000_hw *hw, u16 duplex)
 {
         s32 ret_val;
         u32 tipg;
-        u16 reg_data;
+        u32 i = 0;
+        u16 reg_data, reg_data2;
 
         reg_data = E1000_KMRNCTRLSTA_HD_CTRL_10_100_DEFAULT;
         ret_val = e1000e_write_kmrn_reg(hw, E1000_KMRNCTRLSTA_OFFSET_HD_CTRL,
@@ -1088,9 +1134,16 @@ static s32 e1000_cfg_kmrn_10_100_80003es2lan(struct e1000_hw *hw, u16 duplex)
         tipg |= DEFAULT_TIPG_IPGT_10_100_80003ES2LAN;
         ew32(TIPG, tipg);
 
-        ret_val = e1e_rphy(hw, GG82563_PHY_KMRN_MODE_CTRL, &reg_data);
-        if (ret_val)
-                return ret_val;
+        do {
+                ret_val = e1e_rphy(hw, GG82563_PHY_KMRN_MODE_CTRL, &reg_data);
+                if (ret_val)
+                        return ret_val;
+
+                ret_val = e1e_rphy(hw, GG82563_PHY_KMRN_MODE_CTRL, &reg_data2);
+                if (ret_val)
+                        return ret_val;
+                i++;
+        } while ((reg_data != reg_data2) && (i < GG82563_MAX_KMRN_RETRY));
 
         if (duplex == HALF_DUPLEX)
                 reg_data |= GG82563_KMCR_PASS_FALSE_CARRIER;
@@ -1112,8 +1165,9 @@ static s32 e1000_cfg_kmrn_10_100_80003es2lan(struct e1000_hw *hw, u16 duplex)
 static s32 e1000_cfg_kmrn_1000_80003es2lan(struct e1000_hw *hw)
 {
         s32 ret_val;
-        u16 reg_data;
+        u16 reg_data, reg_data2;
         u32 tipg;
+        u32 i = 0;
 
         reg_data = E1000_KMRNCTRLSTA_HD_CTRL_1000_DEFAULT;
         ret_val = e1000e_write_kmrn_reg(hw, E1000_KMRNCTRLSTA_OFFSET_HD_CTRL,
@@ -1127,9 +1181,16 @@ static s32 e1000_cfg_kmrn_1000_80003es2lan(struct e1000_hw *hw)
         tipg |= DEFAULT_TIPG_IPGT_1000_80003ES2LAN;
         ew32(TIPG, tipg);
 
-        ret_val = e1e_rphy(hw, GG82563_PHY_KMRN_MODE_CTRL, &reg_data);
-        if (ret_val)
-                return ret_val;
+        do {
+                ret_val = e1e_rphy(hw, GG82563_PHY_KMRN_MODE_CTRL, &reg_data);
+                if (ret_val)
+                        return ret_val;
+
+                ret_val = e1e_rphy(hw, GG82563_PHY_KMRN_MODE_CTRL, &reg_data2);
+                if (ret_val)
+                        return ret_val;
+                i++;
+        } while ((reg_data != reg_data2) && (i < GG82563_MAX_KMRN_RETRY));
 
         reg_data &= ~GG82563_KMCR_PASS_FALSE_CARRIER;
         ret_val = e1e_wphy(hw, GG82563_PHY_KMRN_MODE_CTRL, reg_data);
@@ -1231,12 +1292,10 @@ struct e1000_info e1000_es2_info = {
         .mac                    = e1000_80003es2lan,
         .flags                  = FLAG_HAS_HW_VLAN_FILTER
                                   | FLAG_HAS_JUMBO_FRAMES
-                                  | FLAG_HAS_STATS_PTC_PRC
                                   | FLAG_HAS_WOL
                                   | FLAG_APME_IN_CTRL3
                                   | FLAG_RX_CSUM_ENABLED
                                   | FLAG_HAS_CTRLEXT_ON_LOAD
-                                  | FLAG_HAS_STATS_ICR_ICT
                                   | FLAG_RX_NEEDS_RESTART /* errata */
                                   | FLAG_TARC_SET_BIT_ZERO /* errata */
                                   | FLAG_APME_CHECK_PORT_B
diff --git a/drivers/net/e1000e/ethtool.c b/drivers/net/e1000e/ethtool.c
index 6d1b257bbda6..ce045acce63e 100644
--- a/drivers/net/e1000e/ethtool.c
+++ b/drivers/net/e1000e/ethtool.c
@@ -46,8 +46,8 @@ struct e1000_stats {
 static const struct e1000_stats e1000_gstrings_stats[] = {
         { "rx_packets", E1000_STAT(stats.gprc) },
         { "tx_packets", E1000_STAT(stats.gptc) },
-        { "rx_bytes", E1000_STAT(stats.gorcl) },
-        { "tx_bytes", E1000_STAT(stats.gotcl) },
+        { "rx_bytes", E1000_STAT(stats.gorc) },
+        { "tx_bytes", E1000_STAT(stats.gotc) },
         { "rx_broadcast", E1000_STAT(stats.bprc) },
         { "tx_broadcast", E1000_STAT(stats.bptc) },
         { "rx_multicast", E1000_STAT(stats.mprc) },
@@ -83,7 +83,7 @@ static const struct e1000_stats e1000_gstrings_stats[] = {
         { "rx_flow_control_xoff", E1000_STAT(stats.xoffrxc) },
         { "tx_flow_control_xon", E1000_STAT(stats.xontxc) },
         { "tx_flow_control_xoff", E1000_STAT(stats.xofftxc) },
-        { "rx_long_byte_count", E1000_STAT(stats.gorcl) },
+        { "rx_long_byte_count", E1000_STAT(stats.gorc) },
         { "rx_csum_offload_good", E1000_STAT(hw_csum_good) },
         { "rx_csum_offload_errors", E1000_STAT(hw_csum_err) },
         { "rx_header_split", E1000_STAT(rx_hdr_split) },
@@ -1770,6 +1770,47 @@ static int e1000_phys_id(struct net_device *netdev, u32 data)
         return 0;
 }
 
+static int e1000_get_coalesce(struct net_device *netdev,
+                              struct ethtool_coalesce *ec)
+{
+        struct e1000_adapter *adapter = netdev_priv(netdev);
+
+        if (adapter->itr_setting <= 3)
+                ec->rx_coalesce_usecs = adapter->itr_setting;
+        else
+                ec->rx_coalesce_usecs = 1000000 / adapter->itr_setting;
+
+        return 0;
+}
+
+static int e1000_set_coalesce(struct net_device *netdev,
+                              struct ethtool_coalesce *ec)
+{
+        struct e1000_adapter *adapter = netdev_priv(netdev);
+        struct e1000_hw *hw = &adapter->hw;
+
+        if ((ec->rx_coalesce_usecs > E1000_MAX_ITR_USECS) ||
+            ((ec->rx_coalesce_usecs > 3) &&
+             (ec->rx_coalesce_usecs < E1000_MIN_ITR_USECS)) ||
+            (ec->rx_coalesce_usecs == 2))
+                return -EINVAL;
+
+        if (ec->rx_coalesce_usecs <= 3) {
+                adapter->itr = 20000;
+                adapter->itr_setting = ec->rx_coalesce_usecs;
+        } else {
+                adapter->itr = (1000000 / ec->rx_coalesce_usecs);
+                adapter->itr_setting = adapter->itr & ~3;
+        }
+
+        if (adapter->itr_setting != 0)
+                ew32(ITR, 1000000000 / (adapter->itr * 256));
+        else
+                ew32(ITR, 0);
+
+        return 0;
+}
+
 static int e1000_nway_reset(struct net_device *netdev)
 {
         struct e1000_adapter *adapter = netdev_priv(netdev);
@@ -1845,6 +1886,8 @@ static const struct ethtool_ops e1000_ethtool_ops = {
         .phys_id                = e1000_phys_id,
         .get_ethtool_stats      = e1000_get_ethtool_stats,
         .get_sset_count         = e1000e_get_sset_count,
+        .get_coalesce           = e1000_get_coalesce,
+        .set_coalesce           = e1000_set_coalesce,
 };
 
 void e1000e_set_ethtool_ops(struct net_device *netdev)
diff --git a/drivers/net/e1000e/hw.h b/drivers/net/e1000e/hw.h
index 53f1ac6327fa..a930e6d9cf02 100644
--- a/drivers/net/e1000e/hw.h
+++ b/drivers/net/e1000e/hw.h
@@ -592,10 +592,8 @@ struct e1000_hw_stats {
         u64 bprc;
         u64 mprc;
         u64 gptc;
-        u64 gorcl;
-        u64 gorch;
-        u64 gotcl;
-        u64 gotch;
+        u64 gorc;
+        u64 gotc;
         u64 rnbc;
         u64 ruc;
         u64 rfc;
@@ -604,10 +602,8 @@ struct e1000_hw_stats {
         u64 mgprc;
         u64 mgpdc;
         u64 mgptc;
-        u64 torl;
-        u64 torh;
-        u64 totl;
-        u64 toth;
+        u64 tor;
+        u64 tot;
         u64 tpr;
         u64 tpt;
         u64 ptc64;
diff --git a/drivers/net/e1000e/netdev.c b/drivers/net/e1000e/netdev.c
index c8dc47fd132a..8991ab8911e2 100644
--- a/drivers/net/e1000e/netdev.c
+++ b/drivers/net/e1000e/netdev.c
@@ -46,7 +46,7 @@
 
 #include "e1000.h"
 
-#define DRV_VERSION "0.2.0"
+#define DRV_VERSION "0.2.1"
 char e1000e_driver_name[] = "e1000e";
 const char e1000e_driver_version[] = DRV_VERSION;
 
@@ -466,10 +466,10 @@ next_desc:
         if (cleaned_count)
                 adapter->alloc_rx_buf(adapter, cleaned_count);
 
-        adapter->total_rx_packets += total_rx_packets;
         adapter->total_rx_bytes += total_rx_bytes;
-        adapter->net_stats.rx_packets += total_rx_packets;
+        adapter->total_rx_packets += total_rx_packets;
         adapter->net_stats.rx_bytes += total_rx_bytes;
+        adapter->net_stats.rx_packets += total_rx_packets;
         return cleaned;
 }
 
@@ -606,8 +606,8 @@ static bool e1000_clean_tx_irq(struct e1000_adapter *adapter)
         }
         adapter->total_tx_bytes += total_tx_bytes;
         adapter->total_tx_packets += total_tx_packets;
-        adapter->net_stats.tx_packets += total_tx_packets;
         adapter->net_stats.tx_bytes += total_tx_bytes;
+        adapter->net_stats.tx_packets += total_tx_packets;
         return cleaned;
 }
 
@@ -775,10 +775,10 @@ next_desc:
         if (cleaned_count)
                 adapter->alloc_rx_buf(adapter, cleaned_count);
 
-        adapter->total_rx_packets += total_rx_packets;
         adapter->total_rx_bytes += total_rx_bytes;
-        adapter->net_stats.rx_packets += total_rx_packets;
+        adapter->total_rx_packets += total_rx_packets;
         adapter->net_stats.rx_bytes += total_rx_bytes;
+        adapter->net_stats.rx_packets += total_rx_packets;
         return cleaned;
 }
 
@@ -2506,56 +2506,27 @@ void e1000e_update_stats(struct e1000_adapter *adapter)
 
         adapter->stats.crcerrs += er32(CRCERRS);
         adapter->stats.gprc += er32(GPRC);
-        adapter->stats.gorcl += er32(GORCL);
-        adapter->stats.gorch += er32(GORCH);
+        adapter->stats.gorc += er32(GORCL);
+        er32(GORCH); /* Clear gorc */
         adapter->stats.bprc += er32(BPRC);
         adapter->stats.mprc += er32(MPRC);
         adapter->stats.roc += er32(ROC);
 
-        if (adapter->flags & FLAG_HAS_STATS_PTC_PRC) {
-                adapter->stats.prc64 += er32(PRC64);
-                adapter->stats.prc127 += er32(PRC127);
-                adapter->stats.prc255 += er32(PRC255);
-                adapter->stats.prc511 += er32(PRC511);
-                adapter->stats.prc1023 += er32(PRC1023);
-                adapter->stats.prc1522 += er32(PRC1522);
-                adapter->stats.symerrs += er32(SYMERRS);
-                adapter->stats.sec += er32(SEC);
-        }
-
         adapter->stats.mpc += er32(MPC);
         adapter->stats.scc += er32(SCC);
         adapter->stats.ecol += er32(ECOL);
         adapter->stats.mcc += er32(MCC);
         adapter->stats.latecol += er32(LATECOL);
         adapter->stats.dc += er32(DC);
-        adapter->stats.rlec += er32(RLEC);
         adapter->stats.xonrxc += er32(XONRXC);
         adapter->stats.xontxc += er32(XONTXC);
         adapter->stats.xoffrxc += er32(XOFFRXC);
         adapter->stats.xofftxc += er32(XOFFTXC);
-        adapter->stats.fcruc += er32(FCRUC);
         adapter->stats.gptc += er32(GPTC);
-        adapter->stats.gotcl += er32(GOTCL);
-        adapter->stats.gotch += er32(GOTCH);
+        adapter->stats.gotc += er32(GOTCL);
+        er32(GOTCH); /* Clear gotc */
         adapter->stats.rnbc += er32(RNBC);
         adapter->stats.ruc += er32(RUC);
-        adapter->stats.rfc += er32(RFC);
-        adapter->stats.rjc += er32(RJC);
-        adapter->stats.torl += er32(TORL);
-        adapter->stats.torh += er32(TORH);
-        adapter->stats.totl += er32(TOTL);
-        adapter->stats.toth += er32(TOTH);
-        adapter->stats.tpr += er32(TPR);
-
-        if (adapter->flags & FLAG_HAS_STATS_PTC_PRC) {
-                adapter->stats.ptc64 += er32(PTC64);
-                adapter->stats.ptc127 += er32(PTC127);
-                adapter->stats.ptc255 += er32(PTC255);
-                adapter->stats.ptc511 += er32(PTC511);
-                adapter->stats.ptc1023 += er32(PTC1023);
-                adapter->stats.ptc1522 += er32(PTC1522);
-        }
 
         adapter->stats.mptc += er32(MPTC);
         adapter->stats.bptc += er32(BPTC);
@@ -2574,19 +2545,6 @@ void e1000e_update_stats(struct e1000_adapter *adapter)
         adapter->stats.tsctc += er32(TSCTC);
         adapter->stats.tsctfc += er32(TSCTFC);
 
-        adapter->stats.iac += er32(IAC);
-
-        if (adapter->flags & FLAG_HAS_STATS_ICR_ICT) {
-                adapter->stats.icrxoc += er32(ICRXOC);
-                adapter->stats.icrxptc += er32(ICRXPTC);
-                adapter->stats.icrxatc += er32(ICRXATC);
-                adapter->stats.ictxptc += er32(ICTXPTC);
-                adapter->stats.ictxatc += er32(ICTXATC);
-                adapter->stats.ictxqec += er32(ICTXQEC);
-                adapter->stats.ictxqmtc += er32(ICTXQMTC);
-                adapter->stats.icrxdmtc += er32(ICRXDMTC);
-        }
-
         /* Fill out the OS statistics structure */
         adapter->net_stats.multicast = adapter->stats.mprc;
         adapter->net_stats.collisions = adapter->stats.colc;
@@ -2633,6 +2591,54 @@ void e1000e_update_stats(struct e1000_adapter *adapter)
         spin_unlock_irqrestore(&adapter->stats_lock, irq_flags);
 }
 
+/**
+ * e1000_phy_read_status - Update the PHY register status snapshot
+ * @adapter: board private structure
+ **/
+static void e1000_phy_read_status(struct e1000_adapter *adapter)
+{
+        struct e1000_hw *hw = &adapter->hw;
+        struct e1000_phy_regs *phy = &adapter->phy_regs;
+        int ret_val;
+        unsigned long irq_flags;
+
+
+        spin_lock_irqsave(&adapter->stats_lock, irq_flags);
+
+        if ((er32(STATUS) & E1000_STATUS_LU) &&
+            (adapter->hw.phy.media_type == e1000_media_type_copper)) {
+                ret_val  = e1e_rphy(hw, PHY_CONTROL, &phy->bmcr);
+                ret_val |= e1e_rphy(hw, PHY_STATUS, &phy->bmsr);
+                ret_val |= e1e_rphy(hw, PHY_AUTONEG_ADV, &phy->advertise);
+                ret_val |= e1e_rphy(hw, PHY_LP_ABILITY, &phy->lpa);
+                ret_val |= e1e_rphy(hw, PHY_AUTONEG_EXP, &phy->expansion);
+                ret_val |= e1e_rphy(hw, PHY_1000T_CTRL, &phy->ctrl1000);
+                ret_val |= e1e_rphy(hw, PHY_1000T_STATUS, &phy->stat1000);
+                ret_val |= e1e_rphy(hw, PHY_EXT_STATUS, &phy->estatus);
+                if (ret_val)
+                        ndev_warn(adapter->netdev,
+                                  "Error reading PHY register\n");
+        } else {
+                /*
+                 * Do not read PHY registers if link is not up
+                 * Set values to typical power-on defaults
+                 */
+                phy->bmcr = (BMCR_SPEED1000 | BMCR_ANENABLE | BMCR_FULLDPLX);
+                phy->bmsr = (BMSR_100FULL | BMSR_100HALF | BMSR_10FULL |
+                             BMSR_10HALF | BMSR_ESTATEN | BMSR_ANEGCAPABLE |
+                             BMSR_ERCAP);
+                phy->advertise = (ADVERTISE_PAUSE_ASYM | ADVERTISE_PAUSE_CAP |
+                                  ADVERTISE_ALL | ADVERTISE_CSMA);
+                phy->lpa = 0;
+                phy->expansion = EXPANSION_ENABLENPAGE;
+                phy->ctrl1000 = ADVERTISE_1000FULL;
+                phy->stat1000 = 0;
+                phy->estatus = (ESTATUS_1000_TFULL | ESTATUS_1000_THALF);
+        }
+
+        spin_unlock_irqrestore(&adapter->stats_lock, irq_flags);
+}
+
 static void e1000_print_link_info(struct e1000_adapter *adapter)
 {
         struct e1000_hw *hw = &adapter->hw;
@@ -2745,6 +2751,7 @@ static void e1000_watchdog_task(struct work_struct *work)
                 if (!netif_carrier_ok(netdev)) {
                         bool txb2b = 1;
                         /* update snapshot of PHY registers on LSC */
+                        e1000_phy_read_status(adapter);
                         mac->ops.get_link_up_info(&adapter->hw,
                                                    &adapter->link_speed,
                                                    &adapter->link_duplex);
@@ -2842,10 +2849,10 @@ link_up:
         mac->collision_delta = adapter->stats.colc - adapter->colc_old;
         adapter->colc_old = adapter->stats.colc;
 
-        adapter->gorcl = adapter->stats.gorcl - adapter->gorcl_old;
-        adapter->gorcl_old = adapter->stats.gorcl;
-        adapter->gotcl = adapter->stats.gotcl - adapter->gotcl_old;
-        adapter->gotcl_old = adapter->stats.gotcl;
+        adapter->gorc = adapter->stats.gorc - adapter->gorc_old;
+        adapter->gorc_old = adapter->stats.gorc;
+        adapter->gotc = adapter->stats.gotc - adapter->gotc_old;
+        adapter->gotc_old = adapter->stats.gotc;
 
         e1000e_update_adaptive(&adapter->hw);
 
@@ -3500,7 +3507,6 @@ static int e1000_mii_ioctl(struct net_device *netdev, struct ifreq *ifr,
 {
         struct e1000_adapter *adapter = netdev_priv(netdev);
         struct mii_ioctl_data *data = if_mii(ifr);
-        unsigned long irq_flags;
 
         if (adapter->hw.phy.media_type != e1000_media_type_copper)
                 return -EOPNOTSUPP;
@@ -3512,13 +3518,40 @@ static int e1000_mii_ioctl(struct net_device *netdev, struct ifreq *ifr,
         case SIOCGMIIREG:
                 if (!capable(CAP_NET_ADMIN))
                         return -EPERM;
-                spin_lock_irqsave(&adapter->stats_lock, irq_flags);
-                if (e1e_rphy(&adapter->hw, data->reg_num & 0x1F,
-                                   &data->val_out)) {
-                        spin_unlock_irqrestore(&adapter->stats_lock, irq_flags);
+                switch (data->reg_num & 0x1F) {
+                case MII_BMCR:
+                        data->val_out = adapter->phy_regs.bmcr;
+                        break;
+                case MII_BMSR:
+                        data->val_out = adapter->phy_regs.bmsr;
+                        break;
+                case MII_PHYSID1:
+                        data->val_out = (adapter->hw.phy.id >> 16);
+                        break;
+                case MII_PHYSID2:
+                        data->val_out = (adapter->hw.phy.id & 0xFFFF);
+                        break;
+                case MII_ADVERTISE:
+                        data->val_out = adapter->phy_regs.advertise;
+                        break;
+                case MII_LPA:
+                        data->val_out = adapter->phy_regs.lpa;
+                        break;
+                case MII_EXPANSION:
+                        data->val_out = adapter->phy_regs.expansion;
+                        break;
+                case MII_CTRL1000:
+                        data->val_out = adapter->phy_regs.ctrl1000;
+                        break;
+                case MII_STAT1000:
+                        data->val_out = adapter->phy_regs.stat1000;
+                        break;
+                case MII_ESTATUS:
+                        data->val_out = adapter->phy_regs.estatus;
+                        break;
+                default:
                         return -EIO;
                 }
-                spin_unlock_irqrestore(&adapter->stats_lock, irq_flags);
                 break;
         case SIOCSMIIREG:
         default:
@@ -3774,6 +3807,7 @@ static pci_ers_result_t e1000_io_slot_reset(struct pci_dev *pdev)
                 return PCI_ERS_RESULT_DISCONNECT;
         }
         pci_set_master(pdev);
+        pci_restore_state(pdev);
 
         pci_enable_wake(pdev, PCI_D3hot, 0);
         pci_enable_wake(pdev, PCI_D3cold, 0);
@@ -3900,6 +3934,7 @@ static int __devinit e1000_probe(struct pci_dev *pdev,
                 goto err_pci_reg;
 
         pci_set_master(pdev);
+        pci_save_state(pdev);
 
         err = -ENOMEM;
         netdev = alloc_etherdev(sizeof(struct e1000_adapter));
diff --git a/drivers/net/e1000e/phy.c b/drivers/net/e1000e/phy.c
index 3a4574caa75b..e102332a6bee 100644
--- a/drivers/net/e1000e/phy.c
+++ b/drivers/net/e1000e/phy.c
@@ -116,7 +116,7 @@ s32 e1000e_phy_reset_dsp(struct e1000_hw *hw)
 }
 
 /**
- *  e1000_read_phy_reg_mdic - Read MDI control register
+ *  e1000e_read_phy_reg_mdic - Read MDI control register
  *  @hw: pointer to the HW structure
  *  @offset: register offset to be read
  *  @data: pointer to the read data
@@ -124,7 +124,7 @@ s32 e1000e_phy_reset_dsp(struct e1000_hw *hw)
  *  Reads the MDI control register in the PHY at offset and stores the
  *  information read to data.
  **/
-static s32 e1000_read_phy_reg_mdic(struct e1000_hw *hw, u32 offset, u16 *data)
+s32 e1000e_read_phy_reg_mdic(struct e1000_hw *hw, u32 offset, u16 *data)
 {
         struct e1000_phy_info *phy = &hw->phy;
         u32 i, mdic = 0;
@@ -150,7 +150,7 @@ static s32 e1000_read_phy_reg_mdic(struct e1000_hw *hw, u32 offset, u16 *data)
          * Increasing the time out as testing showed failures with
          * the lower time out
          */
-        for (i = 0; i < 64; i++) {
+        for (i = 0; i < (E1000_GEN_POLL_TIMEOUT * 3); i++) {
                 udelay(50);
                 mdic = er32(MDIC);
                 if (mdic & E1000_MDIC_READY)
@@ -170,14 +170,14 @@ static s32 e1000_read_phy_reg_mdic(struct e1000_hw *hw, u32 offset, u16 *data)
 }
 
 /**
- *  e1000_write_phy_reg_mdic - Write MDI control register
+ *  e1000e_write_phy_reg_mdic - Write MDI control register
  *  @hw: pointer to the HW structure
  *  @offset: register offset to write to
  *  @data: data to write to register at offset
  *
  *  Writes data to MDI control register in the PHY at offset.
  **/
-static s32 e1000_write_phy_reg_mdic(struct e1000_hw *hw, u32 offset, u16 data)
+s32 e1000e_write_phy_reg_mdic(struct e1000_hw *hw, u32 offset, u16 data)
 {
         struct e1000_phy_info *phy = &hw->phy;
         u32 i, mdic = 0;
@@ -199,9 +199,13 @@ static s32 e1000_write_phy_reg_mdic(struct e1000_hw *hw, u32 offset, u16 data)
 
         ew32(MDIC, mdic);
 
-        /* Poll the ready bit to see if the MDI read completed */
-        for (i = 0; i < E1000_GEN_POLL_TIMEOUT; i++) {
-                udelay(5);
+        /*
+         * Poll the ready bit to see if the MDI read completed
+         * Increasing the time out as testing showed failures with
+         * the lower time out
+         */
+        for (i = 0; i < (E1000_GEN_POLL_TIMEOUT * 3); i++) {
+                udelay(50);
                 mdic = er32(MDIC);
                 if (mdic & E1000_MDIC_READY)
                         break;
@@ -210,6 +214,10 @@ static s32 e1000_write_phy_reg_mdic(struct e1000_hw *hw, u32 offset, u16 data)
                 hw_dbg(hw, "MDI Write did not complete\n");
                 return -E1000_ERR_PHY;
         }
+        if (mdic & E1000_MDIC_ERROR) {
+                hw_dbg(hw, "MDI Error\n");
+                return -E1000_ERR_PHY;
+        }
 
         return 0;
 }
@@ -232,9 +240,8 @@ s32 e1000e_read_phy_reg_m88(struct e1000_hw *hw, u32 offset, u16 *data)
         if (ret_val)
                 return ret_val;
 
-        ret_val = e1000_read_phy_reg_mdic(hw,
-                                          MAX_PHY_REG_ADDRESS & offset,
-                                          data);
+        ret_val = e1000e_read_phy_reg_mdic(hw, MAX_PHY_REG_ADDRESS & offset,
+                                           data);
 
         hw->phy.ops.release_phy(hw);
 
@@ -258,9 +265,8 @@ s32 e1000e_write_phy_reg_m88(struct e1000_hw *hw, u32 offset, u16 data)
         if (ret_val)
                 return ret_val;
 
-        ret_val = e1000_write_phy_reg_mdic(hw,
-                                           MAX_PHY_REG_ADDRESS & offset,
-                                           data);
+        ret_val = e1000e_write_phy_reg_mdic(hw, MAX_PHY_REG_ADDRESS & offset,
+                                            data);
 
         hw->phy.ops.release_phy(hw);
 
@@ -286,18 +292,17 @@ s32 e1000e_read_phy_reg_igp(struct e1000_hw *hw, u32 offset, u16 *data)
                 return ret_val;
 
         if (offset > MAX_PHY_MULTI_PAGE_REG) {
-                ret_val = e1000_write_phy_reg_mdic(hw,
-                                                   IGP01E1000_PHY_PAGE_SELECT,
-                                                   (u16)offset);
+                ret_val = e1000e_write_phy_reg_mdic(hw,
+                                                    IGP01E1000_PHY_PAGE_SELECT,
+                                                    (u16)offset);
                 if (ret_val) {
                         hw->phy.ops.release_phy(hw);
                         return ret_val;
                 }
         }
 
-        ret_val = e1000_read_phy_reg_mdic(hw,
-                                          MAX_PHY_REG_ADDRESS & offset,
-                                          data);
+        ret_val = e1000e_read_phy_reg_mdic(hw, MAX_PHY_REG_ADDRESS & offset,
+                                           data);
 
         hw->phy.ops.release_phy(hw);
 
@@ -322,18 +327,17 @@ s32 e1000e_write_phy_reg_igp(struct e1000_hw *hw, u32 offset, u16 data)
                 return ret_val;
 
         if (offset > MAX_PHY_MULTI_PAGE_REG) {
-                ret_val = e1000_write_phy_reg_mdic(hw,
-                                                   IGP01E1000_PHY_PAGE_SELECT,
-                                                   (u16)offset);
+                ret_val = e1000e_write_phy_reg_mdic(hw,
+                                                    IGP01E1000_PHY_PAGE_SELECT,
+                                                    (u16)offset);
                 if (ret_val) {
                         hw->phy.ops.release_phy(hw);
                         return ret_val;
                 }
         }
 
-        ret_val = e1000_write_phy_reg_mdic(hw,
-                                           MAX_PHY_REG_ADDRESS & offset,
-                                           data);
+        ret_val = e1000e_write_phy_reg_mdic(hw, MAX_PHY_REG_ADDRESS & offset,
+                                            data);
 
         hw->phy.ops.release_phy(hw);
 
@@ -420,7 +424,9 @@ s32 e1000e_copper_link_setup_m88(struct e1000_hw *hw)
         if (ret_val)
                 return ret_val;
 
-        phy_data |= M88E1000_PSCR_ASSERT_CRS_ON_TX;
+        /* For newer PHYs this bit is downshift enable */
+        if (phy->type == e1000_phy_m88)
+                phy_data |= M88E1000_PSCR_ASSERT_CRS_ON_TX;
 
         /*
          * Options:
@@ -463,7 +469,7 @@ s32 e1000e_copper_link_setup_m88(struct e1000_hw *hw)
         if (ret_val)
                 return ret_val;
 
-        if (phy->revision < 4) {
+        if ((phy->type == e1000_phy_m88) && (phy->revision < 4)) {
                 /*
                  * Force TX_CLK in the Extended PHY Specific Control Register
                  * to 25MHz clock.
@@ -518,8 +524,11 @@ s32 e1000e_copper_link_setup_igp(struct e1000_hw *hw)
                 return ret_val;
         }
 
-        /* Wait 15ms for MAC to configure PHY from NVM settings. */
-        msleep(15);
+        /*
+         * Wait 100ms for MAC to configure PHY from NVM settings, to avoid
+         * timeout issues when LFS is enabled.
+         */
+        msleep(100);
 
         /* disable lplu d0 during driver init */
         ret_val = e1000_set_d0_lplu_state(hw, 0);
@@ -1152,9 +1161,7 @@ s32 e1000e_set_d3_lplu_state(struct e1000_hw *hw, bool active)
 
         if (!active) {
                 data &= ~IGP02E1000_PM_D3_LPLU;
-                ret_val = e1e_wphy(hw,
-                                             IGP02E1000_PHY_POWER_MGMT,
-                                             data);
+                ret_val = e1e_wphy(hw, IGP02E1000_PHY_POWER_MGMT, data);
                 if (ret_val)
                         return ret_val;
                 /*
diff --git a/drivers/net/ehea/ehea_main.c b/drivers/net/ehea/ehea_main.c
index 9ff7538b7595..f9bc21c74b59 100644
--- a/drivers/net/ehea/ehea_main.c
+++ b/drivers/net/ehea/ehea_main.c
@@ -2611,7 +2611,7 @@ static int ehea_stop(struct net_device *dev)
         return ret;
 }
 
-void ehea_purge_sq(struct ehea_qp *orig_qp)
+static void ehea_purge_sq(struct ehea_qp *orig_qp)
 {
         struct ehea_qp qp = *orig_qp;
         struct ehea_qp_init_attr *init_attr = &qp.init_attr;
@@ -2625,7 +2625,7 @@ void ehea_purge_sq(struct ehea_qp *orig_qp)
         }
 }
 
-void ehea_flush_sq(struct ehea_port *port)
+static void ehea_flush_sq(struct ehea_port *port)
 {
         int i;
 
diff --git a/drivers/net/forcedeth.c b/drivers/net/forcedeth.c
index 8c4214b0ee1f..35f66d4a4595 100644
--- a/drivers/net/forcedeth.c
+++ b/drivers/net/forcedeth.c
@@ -96,6 +96,7 @@
 #define DEV_HAS_PAUSEFRAME_TX_V2   0x10000  /* device supports tx pause frames version 2 */
 #define DEV_HAS_PAUSEFRAME_TX_V3   0x20000  /* device supports tx pause frames version 3 */
 #define DEV_NEED_TX_LIMIT          0x40000  /* device needs to limit tx */
+#define DEV_HAS_GEAR_MODE          0x80000  /* device supports gear mode */
 
 enum {
         NvRegIrqStatus = 0x000,
@@ -174,11 +175,13 @@ enum {
         NvRegReceiverStatus = 0x98,
 #define NVREG_RCVSTAT_BUSY      0x01
 
-        NvRegRandomSeed = 0x9c,
-#define NVREG_RNDSEED_MASK      0x00ff
-#define NVREG_RNDSEED_FORCE     0x7f00
-#define NVREG_RNDSEED_FORCE2    0x2d00
-#define NVREG_RNDSEED_FORCE3    0x7400
+        NvRegSlotTime = 0x9c,
+#define NVREG_SLOTTIME_LEGBF_ENABLED    0x80000000
+#define NVREG_SLOTTIME_10_100_FULL      0x00007f00
+#define NVREG_SLOTTIME_1000_FULL        0x0003ff00
+#define NVREG_SLOTTIME_HALF             0x0000ff00
+#define NVREG_SLOTTIME_DEFAULT          0x00007f00
+#define NVREG_SLOTTIME_MASK             0x000000ff
 
         NvRegTxDeferral = 0xA0,
 #define NVREG_TX_DEFERRAL_DEFAULT               0x15050f
@@ -201,6 +204,11 @@ enum {
 
         NvRegPhyInterface = 0xC0,
 #define PHY_RGMII               0x10000000
+        NvRegBackOffControl = 0xC4,
+#define NVREG_BKOFFCTRL_DEFAULT                 0x70000000
+#define NVREG_BKOFFCTRL_SEED_MASK               0x000003ff
+#define NVREG_BKOFFCTRL_SELECT                  24
+#define NVREG_BKOFFCTRL_GEAR                    12
 
         NvRegTxRingPhysAddr = 0x100,
         NvRegRxRingPhysAddr = 0x104,
@@ -352,6 +360,7 @@ union ring_type {
 
 #define NV_TX_LASTPACKET        (1<<16)
 #define NV_TX_RETRYERROR        (1<<19)
+#define NV_TX_RETRYCOUNT_MASK   (0xF<<20)
 #define NV_TX_FORCED_INTERRUPT  (1<<24)
 #define NV_TX_DEFERRED          (1<<26)
 #define NV_TX_CARRIERLOST       (1<<27)
@@ -362,6 +371,7 @@ union ring_type {
 
 #define NV_TX2_LASTPACKET       (1<<29)
 #define NV_TX2_RETRYERROR       (1<<18)
+#define NV_TX2_RETRYCOUNT_MASK  (0xF<<19)
 #define NV_TX2_FORCED_INTERRUPT (1<<30)
 #define NV_TX2_DEFERRED         (1<<25)
 #define NV_TX2_CARRIERLOST      (1<<26)
@@ -473,16 +483,22 @@ union ring_type {
 #define DESC_VER_3      3
 
 /* PHY defines */
-#define PHY_OUI_MARVELL 0x5043
-#define PHY_OUI_CICADA  0x03f1
-#define PHY_OUI_VITESSE 0x01c1
-#define PHY_OUI_REALTEK 0x0732
+#define PHY_OUI_MARVELL         0x5043
+#define PHY_OUI_CICADA          0x03f1
+#define PHY_OUI_VITESSE         0x01c1
+#define PHY_OUI_REALTEK         0x0732
+#define PHY_OUI_REALTEK2        0x0020
 #define PHYID1_OUI_MASK 0x03ff
 #define PHYID1_OUI_SHFT 6
 #define PHYID2_OUI_MASK 0xfc00
 #define PHYID2_OUI_SHFT 10
 #define PHYID2_MODEL_MASK               0x03f0
-#define PHY_MODEL_MARVELL_E3016         0x220
+#define PHY_MODEL_REALTEK_8211          0x0110
+#define PHY_REV_MASK                    0x0001
+#define PHY_REV_REALTEK_8211B           0x0000
+#define PHY_REV_REALTEK_8211C           0x0001
+#define PHY_MODEL_REALTEK_8201          0x0200
+#define PHY_MODEL_MARVELL_E3016         0x0220
 #define PHY_MARVELL_E3016_INITMASK      0x0300
 #define PHY_CICADA_INIT1        0x0f000
 #define PHY_CICADA_INIT2        0x0e00
@@ -509,10 +525,18 @@ union ring_type {
 #define PHY_REALTEK_INIT_REG1   0x1f
 #define PHY_REALTEK_INIT_REG2   0x19
 #define PHY_REALTEK_INIT_REG3   0x13
+#define PHY_REALTEK_INIT_REG4   0x14
+#define PHY_REALTEK_INIT_REG5   0x18
+#define PHY_REALTEK_INIT_REG6   0x11
 #define PHY_REALTEK_INIT1       0x0000
 #define PHY_REALTEK_INIT2       0x8e00
 #define PHY_REALTEK_INIT3       0x0001
 #define PHY_REALTEK_INIT4       0xad17
+#define PHY_REALTEK_INIT5       0xfb54
+#define PHY_REALTEK_INIT6       0xf5c7
+#define PHY_REALTEK_INIT7       0x1000
+#define PHY_REALTEK_INIT8       0x0003
+#define PHY_REALTEK_INIT_MSK1   0x0003
 
 #define PHY_GIGABIT     0x0100
 
@@ -691,6 +715,7 @@ struct fe_priv {
         int wolenabled;
         unsigned int phy_oui;
         unsigned int phy_model;
+        unsigned int phy_rev;
         u16 gigabit;
         int intr_test;
         int recover_error;
@@ -704,6 +729,7 @@ struct fe_priv {
         u32 txrxctl_bits;
         u32 vlanctl_bits;
         u32 driver_data;
+        u32 device_id;
         u32 register_size;
         int rx_csum;
         u32 mac_in_use;
@@ -814,6 +840,16 @@ enum {
 };
 static int dma_64bit = NV_DMA_64BIT_ENABLED;
 
+/*
+ * Crossover Detection
+ * Realtek 8201 phy + some OEM boards do not work properly.
+ */
+enum {
+        NV_CROSSOVER_DETECTION_DISABLED,
+        NV_CROSSOVER_DETECTION_ENABLED
+};
+static int phy_cross = NV_CROSSOVER_DETECTION_DISABLED;
+
 static inline struct fe_priv *get_nvpriv(struct net_device *dev)
 {
         return netdev_priv(dev);
@@ -1078,25 +1114,53 @@ static int phy_init(struct net_device *dev)
                 }
         }
         if (np->phy_oui == PHY_OUI_REALTEK) {
-                if (mii_rw(dev, np->phyaddr, PHY_REALTEK_INIT_REG1, PHY_REALTEK_INIT1)) {
-                        printk(KERN_INFO "%s: phy init failed.\n", pci_name(np->pci_dev));
-                        return PHY_ERROR;
-                }
-                if (mii_rw(dev, np->phyaddr, PHY_REALTEK_INIT_REG2, PHY_REALTEK_INIT2)) {
-                        printk(KERN_INFO "%s: phy init failed.\n", pci_name(np->pci_dev));
-                        return PHY_ERROR;
-                }
-                if (mii_rw(dev, np->phyaddr, PHY_REALTEK_INIT_REG1, PHY_REALTEK_INIT3)) {
-                        printk(KERN_INFO "%s: phy init failed.\n", pci_name(np->pci_dev));
-                        return PHY_ERROR;
-                }
-                if (mii_rw(dev, np->phyaddr, PHY_REALTEK_INIT_REG3, PHY_REALTEK_INIT4)) {
-                        printk(KERN_INFO "%s: phy init failed.\n", pci_name(np->pci_dev));
-                        return PHY_ERROR;
+                if (np->phy_model == PHY_MODEL_REALTEK_8211 &&
+                    np->phy_rev == PHY_REV_REALTEK_8211B) {
+                        if (mii_rw(dev, np->phyaddr, PHY_REALTEK_INIT_REG1, PHY_REALTEK_INIT1)) {
+                                printk(KERN_INFO "%s: phy init failed.\n", pci_name(np->pci_dev));
+                                return PHY_ERROR;
+                        }
+                        if (mii_rw(dev, np->phyaddr, PHY_REALTEK_INIT_REG2, PHY_REALTEK_INIT2)) {
+                                printk(KERN_INFO "%s: phy init failed.\n", pci_name(np->pci_dev));
+                                return PHY_ERROR;
+                        }
+                        if (mii_rw(dev, np->phyaddr, PHY_REALTEK_INIT_REG1, PHY_REALTEK_INIT3)) {
+                                printk(KERN_INFO "%s: phy init failed.\n", pci_name(np->pci_dev));
+                                return PHY_ERROR;
+                        }
+                        if (mii_rw(dev, np->phyaddr, PHY_REALTEK_INIT_REG3, PHY_REALTEK_INIT4)) {
+                                printk(KERN_INFO "%s: phy init failed.\n", pci_name(np->pci_dev));
+                                return PHY_ERROR;
+                        }
+                        if (mii_rw(dev, np->phyaddr, PHY_REALTEK_INIT_REG4, PHY_REALTEK_INIT5)) {
+                                printk(KERN_INFO "%s: phy init failed.\n", pci_name(np->pci_dev));
+                                return PHY_ERROR;
+                        }
+                        if (mii_rw(dev, np->phyaddr, PHY_REALTEK_INIT_REG5, PHY_REALTEK_INIT6)) {
+                                printk(KERN_INFO "%s: phy init failed.\n", pci_name(np->pci_dev));
+                                return PHY_ERROR;
+                        }
+                        if (mii_rw(dev, np->phyaddr, PHY_REALTEK_INIT_REG1, PHY_REALTEK_INIT1)) {
+                                printk(KERN_INFO "%s: phy init failed.\n", pci_name(np->pci_dev));
+                                return PHY_ERROR;
+                        }
                 }
-                if (mii_rw(dev, np->phyaddr, PHY_REALTEK_INIT_REG1, PHY_REALTEK_INIT1)) {
-                        printk(KERN_INFO "%s: phy init failed.\n", pci_name(np->pci_dev));
-                        return PHY_ERROR;
+                if (np->phy_model == PHY_MODEL_REALTEK_8201) {
+                        if (np->device_id == PCI_DEVICE_ID_NVIDIA_NVENET_32 ||
+                            np->device_id == PCI_DEVICE_ID_NVIDIA_NVENET_33 ||
+                            np->device_id == PCI_DEVICE_ID_NVIDIA_NVENET_34 ||
+                            np->device_id == PCI_DEVICE_ID_NVIDIA_NVENET_35 ||
+                            np->device_id == PCI_DEVICE_ID_NVIDIA_NVENET_36 ||
+                            np->device_id == PCI_DEVICE_ID_NVIDIA_NVENET_37 ||
+                            np->device_id == PCI_DEVICE_ID_NVIDIA_NVENET_38 ||
+                            np->device_id == PCI_DEVICE_ID_NVIDIA_NVENET_39) {
+                                phy_reserved = mii_rw(dev, np->phyaddr, PHY_REALTEK_INIT_REG6, MII_READ);
+                                phy_reserved |= PHY_REALTEK_INIT7;
+                                if (mii_rw(dev, np->phyaddr, PHY_REALTEK_INIT_REG6, phy_reserved)) {
+                                        printk(KERN_INFO "%s: phy init failed.\n", pci_name(np->pci_dev));
+                                        return PHY_ERROR;
+                                }
+                        }
                 }
         }
 
@@ -1236,26 +1300,71 @@ static int phy_init(struct net_device *dev)
                 }
         }
         if (np->phy_oui == PHY_OUI_REALTEK) {
-                /* reset could have cleared these out, set them back */
-                if (mii_rw(dev, np->phyaddr, PHY_REALTEK_INIT_REG1, PHY_REALTEK_INIT1)) {
-                        printk(KERN_INFO "%s: phy init failed.\n", pci_name(np->pci_dev));
-                        return PHY_ERROR;
-                }
-                if (mii_rw(dev, np->phyaddr, PHY_REALTEK_INIT_REG2, PHY_REALTEK_INIT2)) {
-                        printk(KERN_INFO "%s: phy init failed.\n", pci_name(np->pci_dev));
-                        return PHY_ERROR;
-                }
-                if (mii_rw(dev, np->phyaddr, PHY_REALTEK_INIT_REG1, PHY_REALTEK_INIT3)) {
-                        printk(KERN_INFO "%s: phy init failed.\n", pci_name(np->pci_dev));
-                        return PHY_ERROR;
-                }
-                if (mii_rw(dev, np->phyaddr, PHY_REALTEK_INIT_REG3, PHY_REALTEK_INIT4)) {
-                        printk(KERN_INFO "%s: phy init failed.\n", pci_name(np->pci_dev));
-                        return PHY_ERROR;
+                if (np->phy_model == PHY_MODEL_REALTEK_8211 &&
+                    np->phy_rev == PHY_REV_REALTEK_8211B) {
+                        /* reset could have cleared these out, set them back */
+                        if (mii_rw(dev, np->phyaddr, PHY_REALTEK_INIT_REG1, PHY_REALTEK_INIT1)) {
+                                printk(KERN_INFO "%s: phy init failed.\n", pci_name(np->pci_dev));
+                                return PHY_ERROR;
+                        }
+                        if (mii_rw(dev, np->phyaddr, PHY_REALTEK_INIT_REG2, PHY_REALTEK_INIT2)) {
+                                printk(KERN_INFO "%s: phy init failed.\n", pci_name(np->pci_dev));
+                                return PHY_ERROR;
+                        }
+                        if (mii_rw(dev, np->phyaddr, PHY_REALTEK_INIT_REG1, PHY_REALTEK_INIT3)) {
+                                printk(KERN_INFO "%s: phy init failed.\n", pci_name(np->pci_dev));
+                                return PHY_ERROR;
+                        }
+                        if (mii_rw(dev, np->phyaddr, PHY_REALTEK_INIT_REG3, PHY_REALTEK_INIT4)) {
+                                printk(KERN_INFO "%s: phy init failed.\n", pci_name(np->pci_dev));
+                                return PHY_ERROR;
+                        }
+                        if (mii_rw(dev, np->phyaddr, PHY_REALTEK_INIT_REG4, PHY_REALTEK_INIT5)) {
+                                printk(KERN_INFO "%s: phy init failed.\n", pci_name(np->pci_dev));
+                                return PHY_ERROR;
+                        }
+                        if (mii_rw(dev, np->phyaddr, PHY_REALTEK_INIT_REG5, PHY_REALTEK_INIT6)) {
+                                printk(KERN_INFO "%s: phy init failed.\n", pci_name(np->pci_dev));
+                                return PHY_ERROR;
+                        }
+                        if (mii_rw(dev, np->phyaddr, PHY_REALTEK_INIT_REG1, PHY_REALTEK_INIT1)) {
+                                printk(KERN_INFO "%s: phy init failed.\n", pci_name(np->pci_dev));
+                                return PHY_ERROR;
+                        }
                 }
-                if (mii_rw(dev, np->phyaddr, PHY_REALTEK_INIT_REG1, PHY_REALTEK_INIT1)) {
-                        printk(KERN_INFO "%s: phy init failed.\n", pci_name(np->pci_dev));
-                        return PHY_ERROR;
+                if (np->phy_model == PHY_MODEL_REALTEK_8201) {
+                        if (np->device_id == PCI_DEVICE_ID_NVIDIA_NVENET_32 ||
+                            np->device_id == PCI_DEVICE_ID_NVIDIA_NVENET_33 ||
+                            np->device_id == PCI_DEVICE_ID_NVIDIA_NVENET_34 ||
+                            np->device_id == PCI_DEVICE_ID_NVIDIA_NVENET_35 ||
+                            np->device_id == PCI_DEVICE_ID_NVIDIA_NVENET_36 ||
+                            np->device_id == PCI_DEVICE_ID_NVIDIA_NVENET_37 ||
+                            np->device_id == PCI_DEVICE_ID_NVIDIA_NVENET_38 ||
+                            np->device_id == PCI_DEVICE_ID_NVIDIA_NVENET_39) {
+                                phy_reserved = mii_rw(dev, np->phyaddr, PHY_REALTEK_INIT_REG6, MII_READ);
+                                phy_reserved |= PHY_REALTEK_INIT7;
+                                if (mii_rw(dev, np->phyaddr, PHY_REALTEK_INIT_REG6, phy_reserved)) {
+                                        printk(KERN_INFO "%s: phy init failed.\n", pci_name(np->pci_dev));
+                                        return PHY_ERROR;
+                                }
+                        }
+                        if (phy_cross == NV_CROSSOVER_DETECTION_DISABLED) {
+                                if (mii_rw(dev, np->phyaddr, PHY_REALTEK_INIT_REG1, PHY_REALTEK_INIT3)) {
+                                        printk(KERN_INFO "%s: phy init failed.\n", pci_name(np->pci_dev));
+                                        return PHY_ERROR;
+                                }
+                                phy_reserved = mii_rw(dev, np->phyaddr, PHY_REALTEK_INIT_REG2, MII_READ);
+                                phy_reserved &= ~PHY_REALTEK_INIT_MSK1;
+                                phy_reserved |= PHY_REALTEK_INIT3;
+                                if (mii_rw(dev, np->phyaddr, PHY_REALTEK_INIT_REG2, phy_reserved)) {
+                                        printk(KERN_INFO "%s: phy init failed.\n", pci_name(np->pci_dev));
+                                        return PHY_ERROR;
+                                }
+                                if (mii_rw(dev, np->phyaddr, PHY_REALTEK_INIT_REG1, PHY_REALTEK_INIT1)) {
+                                        printk(KERN_INFO "%s: phy init failed.\n", pci_name(np->pci_dev));
+                                        return PHY_ERROR;
+                                }
+                        }
                 }
         }
 
@@ -1769,6 +1878,115 @@ static inline u32 nv_get_empty_tx_slots(struct fe_priv *np)
         return (u32)(np->tx_ring_size - ((np->tx_ring_size + (np->put_tx_ctx - np->get_tx_ctx)) % np->tx_ring_size));
 }
 
+static void nv_legacybackoff_reseed(struct net_device *dev)
+{
+        u8 __iomem *base = get_hwbase(dev);
+        u32 reg;
+        u32 low;
+        int tx_status = 0;
+
+        reg = readl(base + NvRegSlotTime) & ~NVREG_SLOTTIME_MASK;
+        get_random_bytes(&low, sizeof(low));
+        reg |= low & NVREG_SLOTTIME_MASK;
+
+        /* Need to stop tx before change takes effect.
+         * Caller has already gained np->lock.
+         */
+        tx_status = readl(base + NvRegTransmitterControl) & NVREG_XMITCTL_START;
+        if (tx_status)
+                nv_stop_tx(dev);
+        nv_stop_rx(dev);
+        writel(reg, base + NvRegSlotTime);
+        if (tx_status)
+                nv_start_tx(dev);
+        nv_start_rx(dev);
+}
+
+/* Gear Backoff Seeds */
+#define BACKOFF_SEEDSET_ROWS    8
+#define BACKOFF_SEEDSET_LFSRS   15
+
+/* Known Good seed sets */
+static const u32 main_seedset[BACKOFF_SEEDSET_ROWS][BACKOFF_SEEDSET_LFSRS] = {
+    {145, 155, 165, 175, 185, 196, 235, 245, 255, 265, 275, 285, 660, 690, 874},
+    {245, 255, 265, 575, 385, 298, 335, 345, 355, 366, 375, 385, 761, 790, 974},
+    {145, 155, 165, 175, 185, 196, 235, 245, 255, 265, 275, 285, 660, 690, 874},
+    {245, 255, 265, 575, 385, 298, 335, 345, 355, 366, 375, 386, 761, 790, 974},
+    {266, 265, 276, 585, 397, 208, 345, 355, 365, 376, 385, 396, 771, 700, 984},
+    {266, 265, 276, 586, 397, 208, 346, 355, 365, 376, 285, 396, 771, 700, 984},
+    {366, 365, 376, 686, 497, 308, 447, 455, 466, 476, 485, 496, 871, 800,  84},
+    {466, 465, 476, 786, 597, 408, 547, 555, 566, 576, 585, 597, 971, 900, 184}};
+
+static const u32 gear_seedset[BACKOFF_SEEDSET_ROWS][BACKOFF_SEEDSET_LFSRS] = {
+    {251, 262, 273, 324, 319, 508, 375, 364, 341, 371, 398, 193, 375,  30, 295},
+    {351, 375, 373, 469, 551, 639, 477, 464, 441, 472, 498, 293, 476, 130, 395},
+    {351, 375, 373, 469, 551, 639, 477, 464, 441, 472, 498, 293, 476, 130, 397},
+    {251, 262, 273, 324, 319, 508, 375, 364, 341, 371, 398, 193, 375,  30, 295},
+    {251, 262, 273, 324, 319, 508, 375, 364, 341, 371, 398, 193, 375,  30, 295},
+    {351, 375, 373, 469, 551, 639, 477, 464, 441, 472, 498, 293, 476, 130, 395},
+    {351, 375, 373, 469, 551, 639, 477, 464, 441, 472, 498, 293, 476, 130, 395},
+    {351, 375, 373, 469, 551, 639, 477, 464, 441, 472, 498, 293, 476, 130, 395}};
+
+static void nv_gear_backoff_reseed(struct net_device *dev)
+{
+        u8 __iomem *base = get_hwbase(dev);
+        u32 miniseed1, miniseed2, miniseed2_reversed, miniseed3, miniseed3_reversed;
+        u32 temp, seedset, combinedSeed;
+        int i;
+
+        /* Setup seed for free running LFSR */
+        /* We are going to read the time stamp counter 3 times
+           and swizzle bits around to increase randomness */
+        get_random_bytes(&miniseed1, sizeof(miniseed1));
+        miniseed1 &= 0x0fff;
+        if (miniseed1 == 0)
+                miniseed1 = 0xabc;
+
+        get_random_bytes(&miniseed2, sizeof(miniseed2));
+        miniseed2 &= 0x0fff;
+        if (miniseed2 == 0)
+                miniseed2 = 0xabc;
+        miniseed2_reversed =
+                ((miniseed2 & 0xF00) >> 8) |
+                 (miniseed2 & 0x0F0) |
+                 ((miniseed2 & 0x00F) << 8);
+
+        get_random_bytes(&miniseed3, sizeof(miniseed3));
+        miniseed3 &= 0x0fff;
+        if (miniseed3 == 0)
+                miniseed3 = 0xabc;
+        miniseed3_reversed =
+                ((miniseed3 & 0xF00) >> 8) |
+                 (miniseed3 & 0x0F0) |
+                 ((miniseed3 & 0x00F) << 8);
+
+        combinedSeed = ((miniseed1 ^ miniseed2_reversed) << 12) |
+                       (miniseed2 ^ miniseed3_reversed);
+
+        /* Seeds can not be zero */
+        if ((combinedSeed & NVREG_BKOFFCTRL_SEED_MASK) == 0)
+                combinedSeed |= 0x08;
+        if ((combinedSeed & (NVREG_BKOFFCTRL_SEED_MASK << NVREG_BKOFFCTRL_GEAR)) == 0)
+                combinedSeed |= 0x8000;
+
+        /* No need to disable tx here */
+        temp = NVREG_BKOFFCTRL_DEFAULT | (0 << NVREG_BKOFFCTRL_SELECT);
+        temp |= combinedSeed & NVREG_BKOFFCTRL_SEED_MASK;
+        temp |= combinedSeed >> NVREG_BKOFFCTRL_GEAR;
+        writel(temp,base + NvRegBackOffControl);
+
+        /* Setup seeds for all gear LFSRs. */
+        get_random_bytes(&seedset, sizeof(seedset));
+        seedset = seedset % BACKOFF_SEEDSET_ROWS;
+        for (i = 1; i <= BACKOFF_SEEDSET_LFSRS; i++)
+        {
+                temp = NVREG_BKOFFCTRL_DEFAULT | (i << NVREG_BKOFFCTRL_SELECT);
+                temp |= main_seedset[seedset][i-1] & 0x3ff;
+                temp |= ((gear_seedset[seedset][i-1] & 0x3ff) << NVREG_BKOFFCTRL_GEAR);
+                writel(temp, base + NvRegBackOffControl);
+        }
+}
+
 /*
  * nv_start_xmit: dev->hard_start_xmit function
  * Called with netif_tx_lock held.
@@ -2088,6 +2306,8 @@ static void nv_tx_done(struct net_device *dev)
                                                 dev->stats.tx_fifo_errors++;
                                         if (flags & NV_TX_CARRIERLOST)
                                                 dev->stats.tx_carrier_errors++;
+                                        if ((flags & NV_TX_RETRYERROR) && !(flags & NV_TX_RETRYCOUNT_MASK))
+                                                nv_legacybackoff_reseed(dev);
                                         dev->stats.tx_errors++;
                                 } else {
                                         dev->stats.tx_packets++;
@@ -2103,6 +2323,8 @@ static void nv_tx_done(struct net_device *dev)
                                                 dev->stats.tx_fifo_errors++;
                                         if (flags & NV_TX2_CARRIERLOST)
                                                 dev->stats.tx_carrier_errors++;
+                                        if ((flags & NV_TX2_RETRYERROR) && !(flags & NV_TX2_RETRYCOUNT_MASK))
+                                                nv_legacybackoff_reseed(dev);
                                         dev->stats.tx_errors++;
                                 } else {
                                         dev->stats.tx_packets++;
@@ -2144,6 +2366,15 @@ static void nv_tx_done_optimized(struct net_device *dev, int limit)
                 if (flags & NV_TX2_LASTPACKET) {
                         if (!(flags & NV_TX2_ERROR))
                                 dev->stats.tx_packets++;
+                        else {
+                                if ((flags & NV_TX2_RETRYERROR) && !(flags & NV_TX2_RETRYCOUNT_MASK)) {
+                                        if (np->driver_data & DEV_HAS_GEAR_MODE)
+                                                nv_gear_backoff_reseed(dev);
+                                        else
+                                                nv_legacybackoff_reseed(dev);
+                                }
+                        }
+
                         dev_kfree_skb_any(np->get_tx_ctx->skb);
                         np->get_tx_ctx->skb = NULL;
 
@@ -2905,15 +3136,14 @@ set_speed:
         }
 
         if (np->gigabit == PHY_GIGABIT) {
-                phyreg = readl(base + NvRegRandomSeed);
+                phyreg = readl(base + NvRegSlotTime);
                 phyreg &= ~(0x3FF00);
-                if ((np->linkspeed & 0xFFF) == NVREG_LINKSPEED_10)
-                        phyreg |= NVREG_RNDSEED_FORCE3;
-                else if ((np->linkspeed & 0xFFF) == NVREG_LINKSPEED_100)
-                        phyreg |= NVREG_RNDSEED_FORCE2;
+                if (((np->linkspeed & 0xFFF) == NVREG_LINKSPEED_10) ||
+                    ((np->linkspeed & 0xFFF) == NVREG_LINKSPEED_100))
+                        phyreg |= NVREG_SLOTTIME_10_100_FULL;
                 else if ((np->linkspeed & 0xFFF) == NVREG_LINKSPEED_1000)
-                        phyreg |= NVREG_RNDSEED_FORCE;
-                writel(phyreg, base + NvRegRandomSeed);
+                        phyreg |= NVREG_SLOTTIME_1000_FULL;
+                writel(phyreg, base + NvRegSlotTime);
         }
 
         phyreg = readl(base + NvRegPhyInterface);
@@ -4843,6 +5073,7 @@ static int nv_open(struct net_device *dev)
         u8 __iomem *base = get_hwbase(dev);
         int ret = 1;
         int oom, i;
+        u32 low;
 
         dprintk(KERN_DEBUG "nv_open: begin\n");
 
@@ -4902,8 +5133,20 @@ static int nv_open(struct net_device *dev)
         writel(np->rx_buf_sz, base + NvRegOffloadConfig);
 
         writel(readl(base + NvRegReceiverStatus), base + NvRegReceiverStatus);
-        get_random_bytes(&i, sizeof(i));
-        writel(NVREG_RNDSEED_FORCE | (i&NVREG_RNDSEED_MASK), base + NvRegRandomSeed);
+
+        get_random_bytes(&low, sizeof(low));
+        low &= NVREG_SLOTTIME_MASK;
+        if (np->desc_ver == DESC_VER_1) {
+                writel(low|NVREG_SLOTTIME_DEFAULT, base + NvRegSlotTime);
+        } else {
+                if (!(np->driver_data & DEV_HAS_GEAR_MODE)) {
+                        /* setup legacy backoff */
+                        writel(NVREG_SLOTTIME_LEGBF_ENABLED|NVREG_SLOTTIME_10_100_FULL|low, base + NvRegSlotTime);
+                } else {
+                        writel(NVREG_SLOTTIME_10_100_FULL, base + NvRegSlotTime);
+                        nv_gear_backoff_reseed(dev);
+                }
+        }
         writel(NVREG_TX_DEFERRAL_DEFAULT, base + NvRegTxDeferral);
         writel(NVREG_RX_DEFERRAL_DEFAULT, base + NvRegRxDeferral);
         if (poll_interval == -1) {
@@ -5110,6 +5353,8 @@ static int __devinit nv_probe(struct pci_dev *pci_dev, const struct pci_device_i
 
         /* copy of driver data */
         np->driver_data = id->driver_data;
+        /* copy of device id */
+        np->device_id = id->device;
 
         /* handle different descriptor versions */
         if (id->driver_data & DEV_HAS_HIGH_DMA) {
@@ -5399,6 +5644,14 @@ static int __devinit nv_probe(struct pci_dev *pci_dev, const struct pci_device_i
                         pci_name(pci_dev), id1, id2, phyaddr);
                 np->phyaddr = phyaddr;
                 np->phy_oui = id1 | id2;
+
+                /* Realtek hardcoded phy id1 to all zero's on certain phys */
+                if (np->phy_oui == PHY_OUI_REALTEK2)
+                        np->phy_oui = PHY_OUI_REALTEK;
+                /* Setup phy revision for Realtek */
+                if (np->phy_oui == PHY_OUI_REALTEK && np->phy_model == PHY_MODEL_REALTEK_8211)
+                        np->phy_rev = mii_rw(dev, phyaddr, MII_RESV1, MII_READ) & PHY_REV_MASK;
+
                 break;
         }
         if (i == 33) {
@@ -5477,6 +5730,28 @@ out:
         return err;
 }
 
+static void nv_restore_phy(struct net_device *dev)
+{
+        struct fe_priv *np = netdev_priv(dev);
+        u16 phy_reserved, mii_control;
+
+        if (np->phy_oui == PHY_OUI_REALTEK &&
+            np->phy_model == PHY_MODEL_REALTEK_8201 &&
+            phy_cross == NV_CROSSOVER_DETECTION_DISABLED) {
+                mii_rw(dev, np->phyaddr, PHY_REALTEK_INIT_REG1, PHY_REALTEK_INIT3);
+                phy_reserved = mii_rw(dev, np->phyaddr, PHY_REALTEK_INIT_REG2, MII_READ);
+                phy_reserved &= ~PHY_REALTEK_INIT_MSK1;
+                phy_reserved |= PHY_REALTEK_INIT8;
+                mii_rw(dev, np->phyaddr, PHY_REALTEK_INIT_REG2, phy_reserved);
+                mii_rw(dev, np->phyaddr, PHY_REALTEK_INIT_REG1, PHY_REALTEK_INIT1);
+
+                /* restart auto negotiation */
+                mii_control = mii_rw(dev, np->phyaddr, MII_BMCR, MII_READ);
+                mii_control |= (BMCR_ANRESTART | BMCR_ANENABLE);
+                mii_rw(dev, np->phyaddr, MII_BMCR, mii_control);
+        }
+}
+
 static void __devexit nv_remove(struct pci_dev *pci_dev)
 {
         struct net_device *dev = pci_get_drvdata(pci_dev);
@@ -5493,6 +5768,9 @@ static void __devexit nv_remove(struct pci_dev *pci_dev)
         writel(readl(base + NvRegTransmitPoll) & ~NVREG_TRANSMITPOLL_MAC_ADDR_REV,
                base + NvRegTransmitPoll);
 
+        /* restore any phy related changes */
+        nv_restore_phy(dev);
+
         /* free all structures */
         free_rings(dev);
         iounmap(get_hwbase(dev));
@@ -5632,83 +5910,83 @@ static struct pci_device_id pci_tbl[] = {
         },
         {       /* MCP65 Ethernet Controller */
                 PCI_DEVICE(PCI_VENDOR_ID_NVIDIA, PCI_DEVICE_ID_NVIDIA_NVENET_20),
-                .driver_data = DEV_NEED_TIMERIRQ|DEV_NEED_LINKTIMER|DEV_HAS_LARGEDESC|DEV_HAS_HIGH_DMA|DEV_HAS_POWER_CNTRL|DEV_HAS_MSI|DEV_HAS_PAUSEFRAME_TX_V1|DEV_HAS_STATISTICS_V2|DEV_HAS_TEST_EXTENDED|DEV_HAS_MGMT_UNIT|DEV_HAS_CORRECT_MACADDR|DEV_NEED_TX_LIMIT|DEV_NEED_TX_LIMIT,
+                .driver_data = DEV_NEED_TIMERIRQ|DEV_NEED_LINKTIMER|DEV_HAS_LARGEDESC|DEV_HAS_HIGH_DMA|DEV_HAS_POWER_CNTRL|DEV_HAS_MSI|DEV_HAS_PAUSEFRAME_TX_V1|DEV_HAS_STATISTICS_V2|DEV_HAS_TEST_EXTENDED|DEV_HAS_MGMT_UNIT|DEV_HAS_CORRECT_MACADDR|DEV_NEED_TX_LIMIT|DEV_NEED_TX_LIMIT|DEV_HAS_GEAR_MODE,
         },
         {       /* MCP65 Ethernet Controller */
                 PCI_DEVICE(PCI_VENDOR_ID_NVIDIA, PCI_DEVICE_ID_NVIDIA_NVENET_21),
-                .driver_data = DEV_NEED_TIMERIRQ|DEV_NEED_LINKTIMER|DEV_HAS_LARGEDESC|DEV_HAS_HIGH_DMA|DEV_HAS_POWER_CNTRL|DEV_HAS_MSI|DEV_HAS_PAUSEFRAME_TX_V1|DEV_HAS_STATISTICS_V2|DEV_HAS_TEST_EXTENDED|DEV_HAS_MGMT_UNIT|DEV_HAS_CORRECT_MACADDR|DEV_NEED_TX_LIMIT,
+                .driver_data = DEV_NEED_TIMERIRQ|DEV_NEED_LINKTIMER|DEV_HAS_LARGEDESC|DEV_HAS_HIGH_DMA|DEV_HAS_POWER_CNTRL|DEV_HAS_MSI|DEV_HAS_PAUSEFRAME_TX_V1|DEV_HAS_STATISTICS_V2|DEV_HAS_TEST_EXTENDED|DEV_HAS_MGMT_UNIT|DEV_HAS_CORRECT_MACADDR|DEV_NEED_TX_LIMIT|DEV_HAS_GEAR_MODE,
         },
         {       /* MCP65 Ethernet Controller */
                 PCI_DEVICE(PCI_VENDOR_ID_NVIDIA, PCI_DEVICE_ID_NVIDIA_NVENET_22),
-                .driver_data = DEV_NEED_TIMERIRQ|DEV_NEED_LINKTIMER|DEV_HAS_LARGEDESC|DEV_HAS_HIGH_DMA|DEV_HAS_POWER_CNTRL|DEV_HAS_MSI|DEV_HAS_PAUSEFRAME_TX_V1|DEV_HAS_STATISTICS_V2|DEV_HAS_TEST_EXTENDED|DEV_HAS_MGMT_UNIT|DEV_HAS_CORRECT_MACADDR|DEV_NEED_TX_LIMIT,
+                .driver_data = DEV_NEED_TIMERIRQ|DEV_NEED_LINKTIMER|DEV_HAS_LARGEDESC|DEV_HAS_HIGH_DMA|DEV_HAS_POWER_CNTRL|DEV_HAS_MSI|DEV_HAS_PAUSEFRAME_TX_V1|DEV_HAS_STATISTICS_V2|DEV_HAS_TEST_EXTENDED|DEV_HAS_MGMT_UNIT|DEV_HAS_CORRECT_MACADDR|DEV_NEED_TX_LIMIT|DEV_HAS_GEAR_MODE,
         },
         {       /* MCP65 Ethernet Controller */
                 PCI_DEVICE(PCI_VENDOR_ID_NVIDIA, PCI_DEVICE_ID_NVIDIA_NVENET_23),
-                .driver_data = DEV_NEED_TIMERIRQ|DEV_NEED_LINKTIMER|DEV_HAS_LARGEDESC|DEV_HAS_HIGH_DMA|DEV_HAS_POWER_CNTRL|DEV_HAS_MSI|DEV_HAS_PAUSEFRAME_TX_V1|DEV_HAS_STATISTICS_V2|DEV_HAS_TEST_EXTENDED|DEV_HAS_MGMT_UNIT|DEV_HAS_CORRECT_MACADDR|DEV_NEED_TX_LIMIT,
+                .driver_data = DEV_NEED_TIMERIRQ|DEV_NEED_LINKTIMER|DEV_HAS_LARGEDESC|DEV_HAS_HIGH_DMA|DEV_HAS_POWER_CNTRL|DEV_HAS_MSI|DEV_HAS_PAUSEFRAME_TX_V1|DEV_HAS_STATISTICS_V2|DEV_HAS_TEST_EXTENDED|DEV_HAS_MGMT_UNIT|DEV_HAS_CORRECT_MACADDR|DEV_NEED_TX_LIMIT|DEV_HAS_GEAR_MODE,
         },
         {       /* MCP67 Ethernet Controller */
                 PCI_DEVICE(PCI_VENDOR_ID_NVIDIA, PCI_DEVICE_ID_NVIDIA_NVENET_24),
-                .driver_data = DEV_NEED_TIMERIRQ|DEV_NEED_LINKTIMER|DEV_HAS_HIGH_DMA|DEV_HAS_POWER_CNTRL|DEV_HAS_MSI|DEV_HAS_PAUSEFRAME_TX_V1|DEV_HAS_STATISTICS_V2|DEV_HAS_TEST_EXTENDED|DEV_HAS_MGMT_UNIT|DEV_HAS_CORRECT_MACADDR,
+                .driver_data = DEV_NEED_TIMERIRQ|DEV_NEED_LINKTIMER|DEV_HAS_HIGH_DMA|DEV_HAS_POWER_CNTRL|DEV_HAS_MSI|DEV_HAS_PAUSEFRAME_TX_V1|DEV_HAS_STATISTICS_V2|DEV_HAS_TEST_EXTENDED|DEV_HAS_MGMT_UNIT|DEV_HAS_CORRECT_MACADDR|DEV_HAS_GEAR_MODE,
         },
         {       /* MCP67 Ethernet Controller */
                 PCI_DEVICE(PCI_VENDOR_ID_NVIDIA, PCI_DEVICE_ID_NVIDIA_NVENET_25),
-                .driver_data = DEV_NEED_TIMERIRQ|DEV_NEED_LINKTIMER|DEV_HAS_HIGH_DMA|DEV_HAS_POWER_CNTRL|DEV_HAS_MSI|DEV_HAS_PAUSEFRAME_TX_V1|DEV_HAS_STATISTICS_V2|DEV_HAS_TEST_EXTENDED|DEV_HAS_MGMT_UNIT|DEV_HAS_CORRECT_MACADDR,
+                .driver_data = DEV_NEED_TIMERIRQ|DEV_NEED_LINKTIMER|DEV_HAS_HIGH_DMA|DEV_HAS_POWER_CNTRL|DEV_HAS_MSI|DEV_HAS_PAUSEFRAME_TX_V1|DEV_HAS_STATISTICS_V2|DEV_HAS_TEST_EXTENDED|DEV_HAS_MGMT_UNIT|DEV_HAS_CORRECT_MACADDR|DEV_HAS_GEAR_MODE,
         },
         {       /* MCP67 Ethernet Controller */
                 PCI_DEVICE(PCI_VENDOR_ID_NVIDIA, PCI_DEVICE_ID_NVIDIA_NVENET_26),
-                .driver_data = DEV_NEED_TIMERIRQ|DEV_NEED_LINKTIMER|DEV_HAS_HIGH_DMA|DEV_HAS_POWER_CNTRL|DEV_HAS_MSI|DEV_HAS_PAUSEFRAME_TX_V1|DEV_HAS_STATISTICS_V2|DEV_HAS_TEST_EXTENDED|DEV_HAS_MGMT_UNIT|DEV_HAS_CORRECT_MACADDR,
+                .driver_data = DEV_NEED_TIMERIRQ|DEV_NEED_LINKTIMER|DEV_HAS_HIGH_DMA|DEV_HAS_POWER_CNTRL|DEV_HAS_MSI|DEV_HAS_PAUSEFRAME_TX_V1|DEV_HAS_STATISTICS_V2|DEV_HAS_TEST_EXTENDED|DEV_HAS_MGMT_UNIT|DEV_HAS_CORRECT_MACADDR|DEV_HAS_GEAR_MODE,
         },
         {       /* MCP67 Ethernet Controller */
                 PCI_DEVICE(PCI_VENDOR_ID_NVIDIA, PCI_DEVICE_ID_NVIDIA_NVENET_27),
-                .driver_data = DEV_NEED_TIMERIRQ|DEV_NEED_LINKTIMER|DEV_HAS_HIGH_DMA|DEV_HAS_POWER_CNTRL|DEV_HAS_MSI|DEV_HAS_PAUSEFRAME_TX_V1|DEV_HAS_STATISTICS_V2|DEV_HAS_TEST_EXTENDED|DEV_HAS_MGMT_UNIT|DEV_HAS_CORRECT_MACADDR,
+                .driver_data = DEV_NEED_TIMERIRQ|DEV_NEED_LINKTIMER|DEV_HAS_HIGH_DMA|DEV_HAS_POWER_CNTRL|DEV_HAS_MSI|DEV_HAS_PAUSEFRAME_TX_V1|DEV_HAS_STATISTICS_V2|DEV_HAS_TEST_EXTENDED|DEV_HAS_MGMT_UNIT|DEV_HAS_CORRECT_MACADDR|DEV_HAS_GEAR_MODE,
         },
         {       /* MCP73 Ethernet Controller */
                 PCI_DEVICE(PCI_VENDOR_ID_NVIDIA, PCI_DEVICE_ID_NVIDIA_NVENET_28),
-                .driver_data = DEV_NEED_TIMERIRQ|DEV_NEED_LINKTIMER|DEV_HAS_HIGH_DMA|DEV_HAS_POWER_CNTRL|DEV_HAS_MSI|DEV_HAS_PAUSEFRAME_TX_V1|DEV_HAS_STATISTICS_V2|DEV_HAS_TEST_EXTENDED|DEV_HAS_MGMT_UNIT|DEV_HAS_CORRECT_MACADDR|DEV_HAS_COLLISION_FIX,
+                .driver_data = DEV_NEED_TIMERIRQ|DEV_NEED_LINKTIMER|DEV_HAS_HIGH_DMA|DEV_HAS_POWER_CNTRL|DEV_HAS_MSI|DEV_HAS_PAUSEFRAME_TX_V1|DEV_HAS_STATISTICS_V2|DEV_HAS_TEST_EXTENDED|DEV_HAS_MGMT_UNIT|DEV_HAS_CORRECT_MACADDR|DEV_HAS_COLLISION_FIX|DEV_HAS_GEAR_MODE,
         },
         {       /* MCP73 Ethernet Controller */
                 PCI_DEVICE(PCI_VENDOR_ID_NVIDIA, PCI_DEVICE_ID_NVIDIA_NVENET_29),
-                .driver_data = DEV_NEED_TIMERIRQ|DEV_NEED_LINKTIMER|DEV_HAS_HIGH_DMA|DEV_HAS_POWER_CNTRL|DEV_HAS_MSI|DEV_HAS_PAUSEFRAME_TX_V1|DEV_HAS_STATISTICS_V2|DEV_HAS_TEST_EXTENDED|DEV_HAS_MGMT_UNIT|DEV_HAS_CORRECT_MACADDR|DEV_HAS_COLLISION_FIX,
+                .driver_data = DEV_NEED_TIMERIRQ|DEV_NEED_LINKTIMER|DEV_HAS_HIGH_DMA|DEV_HAS_POWER_CNTRL|DEV_HAS_MSI|DEV_HAS_PAUSEFRAME_TX_V1|DEV_HAS_STATISTICS_V2|DEV_HAS_TEST_EXTENDED|DEV_HAS_MGMT_UNIT|DEV_HAS_CORRECT_MACADDR|DEV_HAS_COLLISION_FIX|DEV_HAS_GEAR_MODE,
         },
         {       /* MCP73 Ethernet Controller */
                 PCI_DEVICE(PCI_VENDOR_ID_NVIDIA, PCI_DEVICE_ID_NVIDIA_NVENET_30),
-                .driver_data = DEV_NEED_TIMERIRQ|DEV_NEED_LINKTIMER|DEV_HAS_HIGH_DMA|DEV_HAS_POWER_CNTRL|DEV_HAS_MSI|DEV_HAS_PAUSEFRAME_TX_V1|DEV_HAS_STATISTICS_V2|DEV_HAS_TEST_EXTENDED|DEV_HAS_MGMT_UNIT|DEV_HAS_CORRECT_MACADDR|DEV_HAS_COLLISION_FIX,
+                .driver_data = DEV_NEED_TIMERIRQ|DEV_NEED_LINKTIMER|DEV_HAS_HIGH_DMA|DEV_HAS_POWER_CNTRL|DEV_HAS_MSI|DEV_HAS_PAUSEFRAME_TX_V1|DEV_HAS_STATISTICS_V2|DEV_HAS_TEST_EXTENDED|DEV_HAS_MGMT_UNIT|DEV_HAS_CORRECT_MACADDR|DEV_HAS_COLLISION_FIX|DEV_HAS_GEAR_MODE,
         },
         {       /* MCP73 Ethernet Controller */
                 PCI_DEVICE(PCI_VENDOR_ID_NVIDIA, PCI_DEVICE_ID_NVIDIA_NVENET_31),
-                .driver_data = DEV_NEED_TIMERIRQ|DEV_NEED_LINKTIMER|DEV_HAS_HIGH_DMA|DEV_HAS_POWER_CNTRL|DEV_HAS_MSI|DEV_HAS_PAUSEFRAME_TX_V1|DEV_HAS_STATISTICS_V2|DEV_HAS_TEST_EXTENDED|DEV_HAS_MGMT_UNIT|DEV_HAS_CORRECT_MACADDR|DEV_HAS_COLLISION_FIX,
+                .driver_data = DEV_NEED_TIMERIRQ|DEV_NEED_LINKTIMER|DEV_HAS_HIGH_DMA|DEV_HAS_POWER_CNTRL|DEV_HAS_MSI|DEV_HAS_PAUSEFRAME_TX_V1|DEV_HAS_STATISTICS_V2|DEV_HAS_TEST_EXTENDED|DEV_HAS_MGMT_UNIT|DEV_HAS_CORRECT_MACADDR|DEV_HAS_COLLISION_FIX|DEV_HAS_GEAR_MODE,
         },
         {       /* MCP77 Ethernet Controller */
                 PCI_DEVICE(PCI_VENDOR_ID_NVIDIA, PCI_DEVICE_ID_NVIDIA_NVENET_32),
-                .driver_data = DEV_NEED_TIMERIRQ|DEV_NEED_LINKTIMER|DEV_HAS_CHECKSUM|DEV_HAS_HIGH_DMA|DEV_HAS_MSI|DEV_HAS_POWER_CNTRL|DEV_HAS_PAUSEFRAME_TX_V2|DEV_HAS_STATISTICS_V2|DEV_HAS_TEST_EXTENDED|DEV_HAS_MGMT_UNIT|DEV_HAS_CORRECT_MACADDR|DEV_HAS_COLLISION_FIX|DEV_NEED_TX_LIMIT,
+                .driver_data = DEV_NEED_TIMERIRQ|DEV_NEED_LINKTIMER|DEV_HAS_CHECKSUM|DEV_HAS_HIGH_DMA|DEV_HAS_MSI|DEV_HAS_POWER_CNTRL|DEV_HAS_PAUSEFRAME_TX_V2|DEV_HAS_STATISTICS_V2|DEV_HAS_TEST_EXTENDED|DEV_HAS_MGMT_UNIT|DEV_HAS_CORRECT_MACADDR|DEV_HAS_COLLISION_FIX|DEV_NEED_TX_LIMIT|DEV_HAS_GEAR_MODE,
         },
         {       /* MCP77 Ethernet Controller */
                 PCI_DEVICE(PCI_VENDOR_ID_NVIDIA, PCI_DEVICE_ID_NVIDIA_NVENET_33),
-                .driver_data = DEV_NEED_TIMERIRQ|DEV_NEED_LINKTIMER|DEV_HAS_CHECKSUM|DEV_HAS_HIGH_DMA|DEV_HAS_MSI|DEV_HAS_POWER_CNTRL|DEV_HAS_PAUSEFRAME_TX_V2|DEV_HAS_STATISTICS_V2|DEV_HAS_TEST_EXTENDED|DEV_HAS_MGMT_UNIT|DEV_HAS_CORRECT_MACADDR|DEV_HAS_COLLISION_FIX|DEV_NEED_TX_LIMIT,
+                .driver_data = DEV_NEED_TIMERIRQ|DEV_NEED_LINKTIMER|DEV_HAS_CHECKSUM|DEV_HAS_HIGH_DMA|DEV_HAS_MSI|DEV_HAS_POWER_CNTRL|DEV_HAS_PAUSEFRAME_TX_V2|DEV_HAS_STATISTICS_V2|DEV_HAS_TEST_EXTENDED|DEV_HAS_MGMT_UNIT|DEV_HAS_CORRECT_MACADDR|DEV_HAS_COLLISION_FIX|DEV_NEED_TX_LIMIT|DEV_HAS_GEAR_MODE,
         },
         {       /* MCP77 Ethernet Controller */
                 PCI_DEVICE(PCI_VENDOR_ID_NVIDIA, PCI_DEVICE_ID_NVIDIA_NVENET_34),
-                .driver_data = DEV_NEED_TIMERIRQ|DEV_NEED_LINKTIMER|DEV_HAS_CHECKSUM|DEV_HAS_HIGH_DMA|DEV_HAS_MSI|DEV_HAS_POWER_CNTRL|DEV_HAS_PAUSEFRAME_TX_V2|DEV_HAS_STATISTICS_V2|DEV_HAS_TEST_EXTENDED|DEV_HAS_MGMT_UNIT|DEV_HAS_CORRECT_MACADDR|DEV_HAS_COLLISION_FIX|DEV_NEED_TX_LIMIT,
+                .driver_data = DEV_NEED_TIMERIRQ|DEV_NEED_LINKTIMER|DEV_HAS_CHECKSUM|DEV_HAS_HIGH_DMA|DEV_HAS_MSI|DEV_HAS_POWER_CNTRL|DEV_HAS_PAUSEFRAME_TX_V2|DEV_HAS_STATISTICS_V2|DEV_HAS_TEST_EXTENDED|DEV_HAS_MGMT_UNIT|DEV_HAS_CORRECT_MACADDR|DEV_HAS_COLLISION_FIX|DEV_NEED_TX_LIMIT|DEV_HAS_GEAR_MODE,
         },
         {       /* MCP77 Ethernet Controller */
                 PCI_DEVICE(PCI_VENDOR_ID_NVIDIA, PCI_DEVICE_ID_NVIDIA_NVENET_35),
-                .driver_data = DEV_NEED_TIMERIRQ|DEV_NEED_LINKTIMER|DEV_HAS_CHECKSUM|DEV_HAS_HIGH_DMA|DEV_HAS_MSI|DEV_HAS_POWER_CNTRL|DEV_HAS_PAUSEFRAME_TX_V2|DEV_HAS_STATISTICS_V2|DEV_HAS_TEST_EXTENDED|DEV_HAS_MGMT_UNIT|DEV_HAS_CORRECT_MACADDR|DEV_HAS_COLLISION_FIX|DEV_NEED_TX_LIMIT,
+                .driver_data = DEV_NEED_TIMERIRQ|DEV_NEED_LINKTIMER|DEV_HAS_CHECKSUM|DEV_HAS_HIGH_DMA|DEV_HAS_MSI|DEV_HAS_POWER_CNTRL|DEV_HAS_PAUSEFRAME_TX_V2|DEV_HAS_STATISTICS_V2|DEV_HAS_TEST_EXTENDED|DEV_HAS_MGMT_UNIT|DEV_HAS_CORRECT_MACADDR|DEV_HAS_COLLISION_FIX|DEV_NEED_TX_LIMIT|DEV_HAS_GEAR_MODE,
         },
         {       /* MCP79 Ethernet Controller */
                 PCI_DEVICE(PCI_VENDOR_ID_NVIDIA, PCI_DEVICE_ID_NVIDIA_NVENET_36),
-                .driver_data = DEV_NEED_TIMERIRQ|DEV_NEED_LINKTIMER|DEV_HAS_CHECKSUM|DEV_HAS_HIGH_DMA|DEV_HAS_MSI|DEV_HAS_POWER_CNTRL|DEV_HAS_PAUSEFRAME_TX_V3|DEV_HAS_STATISTICS_V2|DEV_HAS_TEST_EXTENDED|DEV_HAS_MGMT_UNIT|DEV_HAS_CORRECT_MACADDR|DEV_HAS_COLLISION_FIX|DEV_NEED_TX_LIMIT,
+                .driver_data = DEV_NEED_TIMERIRQ|DEV_NEED_LINKTIMER|DEV_HAS_CHECKSUM|DEV_HAS_HIGH_DMA|DEV_HAS_MSI|DEV_HAS_POWER_CNTRL|DEV_HAS_PAUSEFRAME_TX_V3|DEV_HAS_STATISTICS_V2|DEV_HAS_TEST_EXTENDED|DEV_HAS_MGMT_UNIT|DEV_HAS_CORRECT_MACADDR|DEV_HAS_COLLISION_FIX|DEV_NEED_TX_LIMIT|DEV_HAS_GEAR_MODE,
         },
         {       /* MCP79 Ethernet Controller */
                 PCI_DEVICE(PCI_VENDOR_ID_NVIDIA, PCI_DEVICE_ID_NVIDIA_NVENET_37),
-                .driver_data = DEV_NEED_TIMERIRQ|DEV_NEED_LINKTIMER|DEV_HAS_CHECKSUM|DEV_HAS_HIGH_DMA|DEV_HAS_MSI|DEV_HAS_POWER_CNTRL|DEV_HAS_PAUSEFRAME_TX_V3|DEV_HAS_STATISTICS_V2|DEV_HAS_TEST_EXTENDED|DEV_HAS_MGMT_UNIT|DEV_HAS_CORRECT_MACADDR|DEV_HAS_COLLISION_FIX|DEV_NEED_TX_LIMIT,
+                .driver_data = DEV_NEED_TIMERIRQ|DEV_NEED_LINKTIMER|DEV_HAS_CHECKSUM|DEV_HAS_HIGH_DMA|DEV_HAS_MSI|DEV_HAS_POWER_CNTRL|DEV_HAS_PAUSEFRAME_TX_V3|DEV_HAS_STATISTICS_V2|DEV_HAS_TEST_EXTENDED|DEV_HAS_MGMT_UNIT|DEV_HAS_CORRECT_MACADDR|DEV_HAS_COLLISION_FIX|DEV_NEED_TX_LIMIT|DEV_HAS_GEAR_MODE,
         },
         {       /* MCP79 Ethernet Controller */
                 PCI_DEVICE(PCI_VENDOR_ID_NVIDIA, PCI_DEVICE_ID_NVIDIA_NVENET_38),
-                .driver_data = DEV_NEED_TIMERIRQ|DEV_NEED_LINKTIMER|DEV_HAS_CHECKSUM|DEV_HAS_HIGH_DMA|DEV_HAS_MSI|DEV_HAS_POWER_CNTRL|DEV_HAS_PAUSEFRAME_TX_V3|DEV_HAS_STATISTICS_V2|DEV_HAS_TEST_EXTENDED|DEV_HAS_MGMT_UNIT|DEV_HAS_CORRECT_MACADDR|DEV_HAS_COLLISION_FIX|DEV_NEED_TX_LIMIT,
+                .driver_data = DEV_NEED_TIMERIRQ|DEV_NEED_LINKTIMER|DEV_HAS_CHECKSUM|DEV_HAS_HIGH_DMA|DEV_HAS_MSI|DEV_HAS_POWER_CNTRL|DEV_HAS_PAUSEFRAME_TX_V3|DEV_HAS_STATISTICS_V2|DEV_HAS_TEST_EXTENDED|DEV_HAS_MGMT_UNIT|DEV_HAS_CORRECT_MACADDR|DEV_HAS_COLLISION_FIX|DEV_NEED_TX_LIMIT|DEV_HAS_GEAR_MODE,
         },
         {       /* MCP79 Ethernet Controller */
                 PCI_DEVICE(PCI_VENDOR_ID_NVIDIA, PCI_DEVICE_ID_NVIDIA_NVENET_39),
-                .driver_data = DEV_NEED_TIMERIRQ|DEV_NEED_LINKTIMER|DEV_HAS_CHECKSUM|DEV_HAS_HIGH_DMA|DEV_HAS_MSI|DEV_HAS_POWER_CNTRL|DEV_HAS_PAUSEFRAME_TX_V3|DEV_HAS_STATISTICS_V2|DEV_HAS_TEST_EXTENDED|DEV_HAS_MGMT_UNIT|DEV_HAS_CORRECT_MACADDR|DEV_HAS_COLLISION_FIX|DEV_NEED_TX_LIMIT,
+                .driver_data = DEV_NEED_TIMERIRQ|DEV_NEED_LINKTIMER|DEV_HAS_CHECKSUM|DEV_HAS_HIGH_DMA|DEV_HAS_MSI|DEV_HAS_POWER_CNTRL|DEV_HAS_PAUSEFRAME_TX_V3|DEV_HAS_STATISTICS_V2|DEV_HAS_TEST_EXTENDED|DEV_HAS_MGMT_UNIT|DEV_HAS_CORRECT_MACADDR|DEV_HAS_COLLISION_FIX|DEV_NEED_TX_LIMIT|DEV_HAS_GEAR_MODE,
         },
         {0,},
 };
@@ -5744,6 +6022,8 @@ module_param(msix, int, 0);
 MODULE_PARM_DESC(msix, "MSIX interrupts are enabled by setting to 1 and disabled by setting to 0.");
 module_param(dma_64bit, int, 0);
 MODULE_PARM_DESC(dma_64bit, "High DMA is enabled by setting to 1 and disabled by setting to 0.");
+module_param(phy_cross, int, 0);
+MODULE_PARM_DESC(phy_cross, "Phy crossover detection for Realtek 8201 phy is enabled by setting to 1 and disabled by setting to 0.");
 
 MODULE_AUTHOR("Manfred Spraul <manfred@colorfullife.com>");
 MODULE_DESCRIPTION("Reverse Engineered nForce ethernet driver");
diff --git a/drivers/net/gianfar.c b/drivers/net/gianfar.c
index c8c3df737d73..99a4b990939f 100644
--- a/drivers/net/gianfar.c
+++ b/drivers/net/gianfar.c
@@ -98,7 +98,6 @@
 #include "gianfar_mii.h"
 
 #define TX_TIMEOUT      (1*HZ)
-#define SKB_ALLOC_TIMEOUT 1000000
 #undef BRIEF_GFAR_ERRORS
 #undef VERBOSE_GFAR_ERRORS
 
@@ -115,7 +114,9 @@ static int gfar_enet_open(struct net_device *dev);
 static int gfar_start_xmit(struct sk_buff *skb, struct net_device *dev);
 static void gfar_timeout(struct net_device *dev);
 static int gfar_close(struct net_device *dev);
-struct sk_buff *gfar_new_skb(struct net_device *dev, struct rxbd8 *bdp);
+struct sk_buff *gfar_new_skb(struct net_device *dev);
+static void gfar_new_rxbdp(struct net_device *dev, struct rxbd8 *bdp,
+                struct sk_buff *skb);
 static int gfar_set_mac_address(struct net_device *dev);
 static int gfar_change_mtu(struct net_device *dev, int new_mtu);
 static irqreturn_t gfar_error(int irq, void *dev_id);
@@ -783,14 +784,21 @@ int startup_gfar(struct net_device *dev)
 
         rxbdp = priv->rx_bd_base;
         for (i = 0; i < priv->rx_ring_size; i++) {
-                struct sk_buff *skb = NULL;
+                struct sk_buff *skb;
 
-                rxbdp->status = 0;
+                skb = gfar_new_skb(dev);
 
-                skb = gfar_new_skb(dev, rxbdp);
+                if (!skb) {
+                        printk(KERN_ERR "%s: Can't allocate RX buffers\n",
+                                        dev->name);
+
+                        goto err_rxalloc_fail;
+                }
 
                 priv->rx_skbuff[i] = skb;
 
+                gfar_new_rxbdp(dev, rxbdp, skb);
+
                 rxbdp++;
         }
 
@@ -916,6 +924,7 @@ rx_irq_fail:
 tx_irq_fail:
         free_irq(priv->interruptError, dev);
 err_irq_fail:
+err_rxalloc_fail:       
 rx_skb_fail:
         free_skb_resources(priv);
 tx_skb_fail:
@@ -1328,18 +1337,37 @@ static irqreturn_t gfar_transmit(int irq, void *dev_id)
         return IRQ_HANDLED;
 }
 
-struct sk_buff * gfar_new_skb(struct net_device *dev, struct rxbd8 *bdp)
+static void gfar_new_rxbdp(struct net_device *dev, struct rxbd8 *bdp,
+                struct sk_buff *skb)
+{
+        struct gfar_private *priv = netdev_priv(dev);
+        u32 * status_len = (u32 *)bdp;
+        u16 flags;
+
+        bdp->bufPtr = dma_map_single(&dev->dev, skb->data,
+                        priv->rx_buffer_size, DMA_FROM_DEVICE);
+
+        flags = RXBD_EMPTY | RXBD_INTERRUPT;
+
+        if (bdp == priv->rx_bd_base + priv->rx_ring_size - 1)
+                flags |= RXBD_WRAP;
+
+        eieio();
+
+        *status_len = (u32)flags << 16;
+}
+
+
+struct sk_buff * gfar_new_skb(struct net_device *dev)
 {
         unsigned int alignamount;
         struct gfar_private *priv = netdev_priv(dev);
         struct sk_buff *skb = NULL;
-        unsigned int timeout = SKB_ALLOC_TIMEOUT;
 
         /* We have to allocate the skb, so keep trying till we succeed */
-        while ((!skb) && timeout--)
-                skb = dev_alloc_skb(priv->rx_buffer_size + RXBUF_ALIGNMENT);
+        skb = netdev_alloc_skb(dev, priv->rx_buffer_size + RXBUF_ALIGNMENT);
 
-        if (NULL == skb)
+        if (!skb)
                 return NULL;
 
         alignamount = RXBUF_ALIGNMENT -
@@ -1350,15 +1378,6 @@ struct sk_buff * gfar_new_skb(struct net_device *dev, struct rxbd8 *bdp)
          */
         skb_reserve(skb, alignamount);
 
-        bdp->bufPtr = dma_map_single(&dev->dev, skb->data,
-                        priv->rx_buffer_size, DMA_FROM_DEVICE);
-
-        bdp->length = 0;
-
-        /* Mark the buffer empty */
-        eieio();
-        bdp->status |= (RXBD_EMPTY | RXBD_INTERRUPT);
-
         return skb;
 }
 
@@ -1544,10 +1563,31 @@ int gfar_clean_rx_ring(struct net_device *dev, int rx_work_limit)
         bdp = priv->cur_rx;
 
         while (!((bdp->status & RXBD_EMPTY) || (--rx_work_limit < 0))) {
+                struct sk_buff *newskb;
                 rmb();
+
+                /* Add another skb for the future */
+                newskb = gfar_new_skb(dev);
+
                 skb = priv->rx_skbuff[priv->skb_currx];
 
-                if ((bdp->status & RXBD_LAST) && !(bdp->status & RXBD_ERR)) {
+                /* We drop the frame if we failed to allocate a new buffer */
+                if (unlikely(!newskb || !(bdp->status & RXBD_LAST) ||
+                                 bdp->status & RXBD_ERR)) {
+                        count_errors(bdp->status, dev);
+
+                        if (unlikely(!newskb))
+                                newskb = skb;
+
+                        if (skb) {
+                                dma_unmap_single(&priv->dev->dev,
+                                                bdp->bufPtr,
+                                                priv->rx_buffer_size,
+                                                DMA_FROM_DEVICE);
+
+                                dev_kfree_skb_any(skb);
+                        }
+                } else {
                         /* Increment the number of packets */
                         dev->stats.rx_packets++;
                         howmany++;
@@ -1558,23 +1598,14 @@ int gfar_clean_rx_ring(struct net_device *dev, int rx_work_limit)
                         gfar_process_frame(dev, skb, pkt_len);
 
                         dev->stats.rx_bytes += pkt_len;
-                } else {
-                        count_errors(bdp->status, dev);
-
-                        if (skb)
-                                dev_kfree_skb_any(skb);
-
-                        priv->rx_skbuff[priv->skb_currx] = NULL;
                 }
 
                 dev->last_rx = jiffies;
 
-                /* Clear the status flags for this buffer */
-                bdp->status &= ~RXBD_STATS;
+                priv->rx_skbuff[priv->skb_currx] = newskb;
 
-                /* Add another skb for the future */
-                skb = gfar_new_skb(dev, bdp);
-                priv->rx_skbuff[priv->skb_currx] = skb;
+                /* Setup the new bdp */
+                gfar_new_rxbdp(dev, bdp, newskb);
 
                 /* Update to the next pointer */
                 if (bdp->status & RXBD_WRAP)
@@ -1584,9 +1615,8 @@ int gfar_clean_rx_ring(struct net_device *dev, int rx_work_limit)
 
                 /* update to point at the next skb */
                 priv->skb_currx =
-                    (priv->skb_currx +
-                     1) & RX_RING_MOD_MASK(priv->rx_ring_size);
-
+                    (priv->skb_currx + 1) &
+                    RX_RING_MOD_MASK(priv->rx_ring_size);
         }
 
         /* Update the current rxbd pointer to be the next one */
@@ -2001,12 +2031,16 @@ static irqreturn_t gfar_error(int irq, void *dev_id)
         return IRQ_HANDLED;
 }
 
+/* work with hotplug and coldplug */
+MODULE_ALIAS("platform:fsl-gianfar");
+
 /* Structure for a device driver */
 static struct platform_driver gfar_driver = {
         .probe = gfar_probe,
         .remove = gfar_remove,
         .driver = {
                 .name = "fsl-gianfar",
+                .owner = THIS_MODULE,
         },
 };
 
diff --git a/drivers/net/ibm_newemac/core.c b/drivers/net/ibm_newemac/core.c
index 378a23963495..5d2108c5ac7c 100644
--- a/drivers/net/ibm_newemac/core.c
+++ b/drivers/net/ibm_newemac/core.c
@@ -43,6 +43,8 @@
 #include <asm/io.h>
 #include <asm/dma.h>
 #include <asm/uaccess.h>
+#include <asm/dcr.h>
+#include <asm/dcr-regs.h>
 
 #include "core.h"
 
@@ -127,10 +129,35 @@ static struct device_node *emac_boot_list[EMAC_BOOT_LIST_SIZE];
 static inline void emac_report_timeout_error(struct emac_instance *dev,
                                              const char *error)
 {
-        if (net_ratelimit())
+        if (emac_has_feature(dev, EMAC_FTR_440GX_PHY_CLK_FIX |
+                                  EMAC_FTR_440EP_PHY_CLK_FIX))
+                DBG(dev, "%s" NL, error);
+        else if (net_ratelimit())
                 printk(KERN_ERR "%s: %s\n", dev->ndev->name, error);
 }
 
+/* EMAC PHY clock workaround:
+ * 440EP/440GR has more sane SDR0_MFR register implementation than 440GX,
+ * which allows controlling each EMAC clock
+ */
+static inline void emac_rx_clk_tx(struct emac_instance *dev)
+{
+#ifdef CONFIG_PPC_DCR_NATIVE
+        if (emac_has_feature(dev, EMAC_FTR_440EP_PHY_CLK_FIX))
+                dcri_clrset(SDR0, SDR0_MFR,
+                            0, SDR0_MFR_ECS >> dev->cell_index);
+#endif
+}
+
+static inline void emac_rx_clk_default(struct emac_instance *dev)
+{
+#ifdef CONFIG_PPC_DCR_NATIVE
+        if (emac_has_feature(dev, EMAC_FTR_440EP_PHY_CLK_FIX))
+                dcri_clrset(SDR0, SDR0_MFR,
+                            SDR0_MFR_ECS >> dev->cell_index, 0);
+#endif
+}
+
 /* PHY polling intervals */
 #define PHY_POLL_LINK_ON        HZ
 #define PHY_POLL_LINK_OFF       (HZ / 5)
@@ -524,7 +551,10 @@ static int emac_configure(struct emac_instance *dev)
                 rx_size = dev->rx_fifo_size_gige;
 
                 if (dev->ndev->mtu > ETH_DATA_LEN) {
-                        mr1 |= EMAC_MR1_JPSM;
+                        if (emac_has_feature(dev, EMAC_FTR_EMAC4))
+                                mr1 |= EMAC4_MR1_JPSM;
+                        else
+                                mr1 |= EMAC_MR1_JPSM;
                         dev->stop_timeout = STOP_TIMEOUT_1000_JUMBO;
                 } else
                         dev->stop_timeout = STOP_TIMEOUT_1000;
@@ -708,7 +738,7 @@ static int __emac_mdio_read(struct emac_instance *dev, u8 id, u8 reg)
                 rgmii_get_mdio(dev->rgmii_dev, dev->rgmii_port);
 
         /* Wait for management interface to become idle */
-        n = 10;
+        n = 20;
         while (!emac_phy_done(dev, in_be32(&p->stacr))) {
                 udelay(1);
                 if (!--n) {
@@ -733,7 +763,7 @@ static int __emac_mdio_read(struct emac_instance *dev, u8 id, u8 reg)
         out_be32(&p->stacr, r);
 
         /* Wait for read to complete */
-        n = 100;
+        n = 200;
         while (!emac_phy_done(dev, (r = in_be32(&p->stacr)))) {
                 udelay(1);
                 if (!--n) {
@@ -780,7 +810,7 @@ static void __emac_mdio_write(struct emac_instance *dev, u8 id, u8 reg,
                 rgmii_get_mdio(dev->rgmii_dev, dev->rgmii_port);
 
         /* Wait for management interface to be idle */
-        n = 10;
+        n = 20;
         while (!emac_phy_done(dev, in_be32(&p->stacr))) {
                 udelay(1);
                 if (!--n) {
@@ -806,7 +836,7 @@ static void __emac_mdio_write(struct emac_instance *dev, u8 id, u8 reg,
         out_be32(&p->stacr, r);
 
         /* Wait for write to complete */
-        n = 100;
+        n = 200;
         while (!emac_phy_done(dev, in_be32(&p->stacr))) {
                 udelay(1);
                 if (!--n) {
@@ -1094,9 +1124,11 @@ static int emac_open(struct net_device *ndev)
                 int link_poll_interval;
                 if (dev->phy.def->ops->poll_link(&dev->phy)) {
                         dev->phy.def->ops->read_link(&dev->phy);
+                        emac_rx_clk_default(dev);
                         netif_carrier_on(dev->ndev);
                         link_poll_interval = PHY_POLL_LINK_ON;
                 } else {
+                        emac_rx_clk_tx(dev);
                         netif_carrier_off(dev->ndev);
                         link_poll_interval = PHY_POLL_LINK_OFF;
                 }
@@ -1174,6 +1206,7 @@ static void emac_link_timer(struct work_struct *work)
 
         if (dev->phy.def->ops->poll_link(&dev->phy)) {
                 if (!netif_carrier_ok(dev->ndev)) {
+                        emac_rx_clk_default(dev);
                         /* Get new link parameters */
                         dev->phy.def->ops->read_link(&dev->phy);
 
@@ -1186,6 +1219,7 @@ static void emac_link_timer(struct work_struct *work)
                 link_poll_interval = PHY_POLL_LINK_ON;
         } else {
                 if (netif_carrier_ok(dev->ndev)) {
+                        emac_rx_clk_tx(dev);
                         netif_carrier_off(dev->ndev);
                         netif_tx_disable(dev->ndev);
                         emac_reinitialize(dev);
@@ -2237,7 +2271,7 @@ static int __devinit emac_of_bus_notify(struct notifier_block *nb,
         return 0;
 }
 
-static struct notifier_block emac_of_bus_notifier = {
+static struct notifier_block emac_of_bus_notifier __devinitdata = {
         .notifier_call = emac_of_bus_notify
 };
 
@@ -2330,6 +2364,19 @@ static int __devinit emac_init_phy(struct emac_instance *dev)
         dev->phy.mdio_read = emac_mdio_read;
         dev->phy.mdio_write = emac_mdio_write;
 
+        /* Enable internal clock source */
+#ifdef CONFIG_PPC_DCR_NATIVE
+        if (emac_has_feature(dev, EMAC_FTR_440GX_PHY_CLK_FIX))
+                dcri_clrset(SDR0, SDR0_MFR, 0, SDR0_MFR_ECS);
+#endif
+        /* PHY clock workaround */
+        emac_rx_clk_tx(dev);
+
+        /* Enable internal clock source on 440GX*/
+#ifdef CONFIG_PPC_DCR_NATIVE
+        if (emac_has_feature(dev, EMAC_FTR_440GX_PHY_CLK_FIX))
+                dcri_clrset(SDR0, SDR0_MFR, 0, SDR0_MFR_ECS);
+#endif
         /* Configure EMAC with defaults so we can at least use MDIO
          * This is needed mostly for 440GX
          */
@@ -2362,6 +2409,12 @@ static int __devinit emac_init_phy(struct emac_instance *dev)
                         if (!emac_mii_phy_probe(&dev->phy, i))
                                 break;
                 }
+
+        /* Enable external clock source */
+#ifdef CONFIG_PPC_DCR_NATIVE
+        if (emac_has_feature(dev, EMAC_FTR_440GX_PHY_CLK_FIX))
+                dcri_clrset(SDR0, SDR0_MFR, SDR0_MFR_ECS, 0);
+#endif
         mutex_unlock(&emac_phy_map_lock);
         if (i == 0x20) {
                 printk(KERN_WARNING "%s: can't find PHY!\n", np->full_name);
@@ -2487,8 +2540,15 @@ static int __devinit emac_init_config(struct emac_instance *dev)
         }
 
         /* Check EMAC version */
-        if (of_device_is_compatible(np, "ibm,emac4"))
+        if (of_device_is_compatible(np, "ibm,emac4")) {
                 dev->features |= EMAC_FTR_EMAC4;
+                if (of_device_is_compatible(np, "ibm,emac-440gx"))
+                        dev->features |= EMAC_FTR_440GX_PHY_CLK_FIX;
+        } else {
+                if (of_device_is_compatible(np, "ibm,emac-440ep") ||
+                    of_device_is_compatible(np, "ibm,emac-440gr"))
+                        dev->features |= EMAC_FTR_440EP_PHY_CLK_FIX;
+        }
 
         /* Fixup some feature bits based on the device tree */
         if (of_get_property(np, "has-inverted-stacr-oc", NULL))
@@ -2559,8 +2619,11 @@ static int __devinit emac_probe(struct of_device *ofdev,
         struct device_node **blist = NULL;
         int err, i;
 
-        /* Skip unused/unwired EMACS */
-        if (of_get_property(np, "unused", NULL))
+        /* Skip unused/unwired EMACS.  We leave the check for an unused
+         * property here for now, but new flat device trees should set a
+         * status property to "disabled" instead.
+         */
+        if (of_get_property(np, "unused", NULL) || !of_device_is_available(np))
                 return -ENODEV;
 
         /* Find ourselves in the bootlist if we are there */
diff --git a/drivers/net/ibm_newemac/core.h b/drivers/net/ibm_newemac/core.h
index 4e74d8287c65..1683db9870a4 100644
--- a/drivers/net/ibm_newemac/core.h
+++ b/drivers/net/ibm_newemac/core.h
@@ -301,6 +301,14 @@ struct emac_instance {
  * Set if we have new type STACR with STAOPC
  */
 #define EMAC_FTR_HAS_NEW_STACR          0x00000040
+/*
+ * Set if we need phy clock workaround for 440gx
+ */
+#define EMAC_FTR_440GX_PHY_CLK_FIX      0x00000080
+/*
+ * Set if we need phy clock workaround for 440ep or 440gr
+ */
+#define EMAC_FTR_440EP_PHY_CLK_FIX      0x00000100
 
 
 /* Right now, we don't quite handle the always/possible masks on the
@@ -312,8 +320,8 @@ enum {
 
         EMAC_FTRS_POSSIBLE      =
 #ifdef CONFIG_IBM_NEW_EMAC_EMAC4
-            EMAC_FTR_EMAC4      | EMAC_FTR_HAS_NEW_STACR        |
-            EMAC_FTR_STACR_OC_INVERT    |
+            EMAC_FTR_EMAC4 | EMAC_FTR_HAS_NEW_STACR |
+            EMAC_FTR_STACR_OC_INVERT | EMAC_FTR_440GX_PHY_CLK_FIX |
 #endif
 #ifdef CONFIG_IBM_NEW_EMAC_TAH
             EMAC_FTR_HAS_TAH    |
@@ -324,7 +332,7 @@ enum {
 #ifdef CONFIG_IBM_NEW_EMAC_RGMII
             EMAC_FTR_HAS_RGMII  |
 #endif
-            0,
+        EMAC_FTR_440EP_PHY_CLK_FIX,
 };
 
 static inline int emac_has_feature(struct emac_instance *dev,
diff --git a/drivers/net/ibm_newemac/mal.c b/drivers/net/ibm_newemac/mal.c
index 6869f08c9dcb..10c267b2b961 100644
--- a/drivers/net/ibm_newemac/mal.c
+++ b/drivers/net/ibm_newemac/mal.c
@@ -61,8 +61,8 @@ int __devinit mal_register_commac(struct mal_instance	*mal,
         return 0;
 }
 
-void __devexit mal_unregister_commac(struct mal_instance        *mal,
-                                     struct mal_commac          *commac)
+void mal_unregister_commac(struct mal_instance  *mal,
+                struct mal_commac *commac)
 {
         unsigned long flags;
 
@@ -136,6 +136,14 @@ void mal_enable_rx_channel(struct mal_instance *mal, int channel)
 {
         unsigned long flags;
 
+        /*
+         * On some 4xx PPC's (e.g. 460EX/GT), the rx channel is a multiple
+         * of 8, but enabling in MAL_RXCASR needs the divided by 8 value
+         * for the bitmask
+         */
+        if (!(channel % 8))
+                channel >>= 3;
+
         spin_lock_irqsave(&mal->lock, flags);
 
         MAL_DBG(mal, "enable_rx(%d)" NL, channel);
@@ -148,6 +156,14 @@ void mal_enable_rx_channel(struct mal_instance *mal, int channel)
 
 void mal_disable_rx_channel(struct mal_instance *mal, int channel)
 {
+        /*
+         * On some 4xx PPC's (e.g. 460EX/GT), the rx channel is a multiple
+         * of 8, but enabling in MAL_RXCASR needs the divided by 8 value
+         * for the bitmask
+         */
+        if (!(channel % 8))
+                channel >>= 3;
+
         set_mal_dcrn(mal, MAL_RXCARR, MAL_CHAN_MASK(channel));
 
         MAL_DBG(mal, "disable_rx(%d)" NL, channel);
diff --git a/drivers/net/ibm_newemac/rgmii.c b/drivers/net/ibm_newemac/rgmii.c
index 5757788227be..e32da3de2695 100644
--- a/drivers/net/ibm_newemac/rgmii.c
+++ b/drivers/net/ibm_newemac/rgmii.c
@@ -179,7 +179,7 @@ void rgmii_put_mdio(struct of_device *ofdev, int input)
         mutex_unlock(&dev->lock);
 }
 
-void __devexit rgmii_detach(struct of_device *ofdev, int input)
+void rgmii_detach(struct of_device *ofdev, int input)
 {
         struct rgmii_instance *dev = dev_get_drvdata(&ofdev->dev);
         struct rgmii_regs __iomem *p = dev->base;
diff --git a/drivers/net/ibm_newemac/tah.c b/drivers/net/ibm_newemac/tah.c
index b023d10d7e1c..30173a9fb557 100644
--- a/drivers/net/ibm_newemac/tah.c
+++ b/drivers/net/ibm_newemac/tah.c
@@ -35,7 +35,7 @@ int __devinit tah_attach(struct of_device *ofdev, int channel)
         return 0;
 }
 
-void __devexit tah_detach(struct of_device *ofdev, int channel)
+void tah_detach(struct of_device *ofdev, int channel)
 {
         struct tah_instance *dev = dev_get_drvdata(&ofdev->dev);
 
diff --git a/drivers/net/ibm_newemac/zmii.c b/drivers/net/ibm_newemac/zmii.c
index 2ea472aeab06..17b154124943 100644
--- a/drivers/net/ibm_newemac/zmii.c
+++ b/drivers/net/ibm_newemac/zmii.c
@@ -189,7 +189,7 @@ void zmii_set_speed(struct of_device *ofdev, int input, int speed)
         mutex_unlock(&dev->lock);
 }
 
-void __devexit zmii_detach(struct of_device *ofdev, int input)
+void zmii_detach(struct of_device *ofdev, int input)
 {
         struct zmii_instance *dev = dev_get_drvdata(&ofdev->dev);
 
diff --git a/drivers/net/igb/igb_main.c b/drivers/net/igb/igb_main.c
index aaee02e9e3f0..ae398f04c7b4 100644
--- a/drivers/net/igb/igb_main.c
+++ b/drivers/net/igb/igb_main.c
@@ -871,6 +871,7 @@ static int __devinit igb_probe(struct pci_dev *pdev,
                 goto err_pci_reg;
 
         pci_set_master(pdev);
+        pci_save_state(pdev);
 
         err = -ENOMEM;
         netdev = alloc_etherdev(sizeof(struct igb_adapter));
@@ -4079,6 +4080,7 @@ static pci_ers_result_t igb_io_slot_reset(struct pci_dev *pdev)
                 return PCI_ERS_RESULT_DISCONNECT;
         }
         pci_set_master(pdev);
+        pci_restore_state(pdev);
 
         pci_enable_wake(pdev, PCI_D3hot, 0);
         pci_enable_wake(pdev, PCI_D3cold, 0);
diff --git a/drivers/net/irda/ali-ircc.c b/drivers/net/irda/ali-ircc.c
index 9f584521304a..083b0dd70fef 100644
--- a/drivers/net/irda/ali-ircc.c
+++ b/drivers/net/irda/ali-ircc.c
@@ -60,6 +60,7 @@ static struct platform_driver ali_ircc_driver = {
         .resume         = ali_ircc_resume,
         .driver         = {
                 .name   = ALI_IRCC_DRIVER_NAME,
+                .owner  = THIS_MODULE,
         },
 };
 
@@ -2256,6 +2257,7 @@ static void FIR2SIR(int iobase)
 MODULE_AUTHOR("Benjamin Kong <benjamin_kong@ali.com.tw>");
 MODULE_DESCRIPTION("ALi FIR Controller Driver");
 MODULE_LICENSE("GPL");
+MODULE_ALIAS("platform:" ALI_IRCC_DRIVER_NAME);
 
 
 module_param_array(io, int, NULL, 0);
diff --git a/drivers/net/irda/pxaficp_ir.c b/drivers/net/irda/pxaficp_ir.c
index 8db71ab20456..d5c2d27f3ea4 100644
--- a/drivers/net/irda/pxaficp_ir.c
+++ b/drivers/net/irda/pxaficp_ir.c
@@ -908,6 +908,7 @@ static int pxa_irda_remove(struct platform_device *_dev)
 static struct platform_driver pxa_ir_driver = {
         .driver         = {
                 .name   = "pxa2xx-ir",
+                .owner  = THIS_MODULE,
         },
         .probe          = pxa_irda_probe,
         .remove         = pxa_irda_remove,
@@ -929,3 +930,4 @@ module_init(pxa_irda_init);
 module_exit(pxa_irda_exit);
 
 MODULE_LICENSE("GPL");
+MODULE_ALIAS("platform:pxa2xx-ir");
diff --git a/drivers/net/irda/sa1100_ir.c b/drivers/net/irda/sa1100_ir.c
index 056639f72bec..1bc8518f9197 100644
--- a/drivers/net/irda/sa1100_ir.c
+++ b/drivers/net/irda/sa1100_ir.c
@@ -1008,6 +1008,7 @@ static struct platform_driver sa1100ir_driver = {
         .resume         = sa1100_irda_resume,
         .driver         = {
                 .name   = "sa11x0-ir",
+                .owner  = THIS_MODULE,
         },
 };
 
@@ -1041,3 +1042,4 @@ MODULE_LICENSE("GPL");
 MODULE_PARM_DESC(power_level, "IrDA power level, 1 (low) to 3 (high)");
 MODULE_PARM_DESC(tx_lpm, "Enable transmitter low power (1.6us) mode");
 MODULE_PARM_DESC(max_rate, "Maximum baud rate (4000000, 115200, 57600, 38400, 19200, 9600)");
+MODULE_ALIAS("platform:sa11x0-ir");
diff --git a/drivers/net/ixgbe/ixgbe_main.c b/drivers/net/ixgbe/ixgbe_main.c
index cb371a8c24a7..7b859220c255 100644
--- a/drivers/net/ixgbe/ixgbe_main.c
+++ b/drivers/net/ixgbe/ixgbe_main.c
@@ -3431,6 +3431,7 @@ static int __devinit ixgbe_probe(struct pci_dev *pdev,
         }
 
         pci_set_master(pdev);
+        pci_save_state(pdev);
 
 #ifdef CONFIG_NETDEVICES_MULTIQUEUE
         netdev = alloc_etherdev_mq(sizeof(struct ixgbe_adapter), MAX_TX_QUEUES);
@@ -3721,6 +3722,7 @@ static pci_ers_result_t ixgbe_io_slot_reset(struct pci_dev *pdev)
                 return PCI_ERS_RESULT_DISCONNECT;
         }
         pci_set_master(pdev);
+        pci_restore_state(pdev);
 
         pci_enable_wake(pdev, PCI_D3hot, 0);
         pci_enable_wake(pdev, PCI_D3cold, 0);
diff --git a/drivers/net/jazzsonic.c b/drivers/net/jazzsonic.c
index 5c154fe13859..07944820f745 100644
--- a/drivers/net/jazzsonic.c
+++ b/drivers/net/jazzsonic.c
@@ -249,6 +249,7 @@ out:
 MODULE_DESCRIPTION("Jazz SONIC ethernet driver");
 module_param(sonic_debug, int, 0);
 MODULE_PARM_DESC(sonic_debug, "jazzsonic debug level (1-4)");
+MODULE_ALIAS("platform:jazzsonic");
 
 #include "sonic.c"
 
@@ -271,6 +272,7 @@ static struct platform_driver jazz_sonic_driver = {
         .remove = __devexit_p(jazz_sonic_device_remove),
         .driver = {
                 .name   = jazz_sonic_string,
+                .owner  = THIS_MODULE,
         },
 };
 
diff --git a/drivers/net/korina.c b/drivers/net/korina.c
index 1d24a73a0e1a..e18576316bda 100644
--- a/drivers/net/korina.c
+++ b/drivers/net/korina.c
@@ -883,7 +883,7 @@ static int korina_init(struct net_device *dev)
 static int korina_restart(struct net_device *dev)
 {
         struct korina_private *lp = netdev_priv(dev);
-        int ret = 0;
+        int ret;
 
         /*
          * Disable interrupts
@@ -987,7 +987,7 @@ static void korina_poll_controller(struct net_device *dev)
 static int korina_open(struct net_device *dev)
 {
         struct korina_private *lp = netdev_priv(dev);
-        int ret = 0;
+        int ret;
 
         /* Initialize */
         ret = korina_init(dev);
@@ -1031,6 +1031,8 @@ static int korina_open(struct net_device *dev)
                     dev->name, lp->und_irq);
                 goto err_free_ovr_irq;
         }
+out:
+        return ret;
 
 err_free_ovr_irq:
         free_irq(lp->ovr_irq, dev);
@@ -1041,8 +1043,6 @@ err_free_rx_irq:
 err_release:
         korina_free_ring(dev);
         goto out;
-out:
-        return ret;
 }
 
 static int korina_close(struct net_device *dev)
@@ -1082,7 +1082,7 @@ static int korina_probe(struct platform_device *pdev)
         struct korina_private *lp;
         struct net_device *dev;
         struct resource *r;
-        int retval, err;
+        int rc;
 
         dev = alloc_etherdev(sizeof(struct korina_private));
         if (!dev) {
@@ -1106,7 +1106,7 @@ static int korina_probe(struct platform_device *pdev)
         lp->eth_regs = ioremap_nocache(r->start, r->end - r->start);
         if (!lp->eth_regs) {
                 printk(KERN_ERR DRV_NAME "cannot remap registers\n");
-                retval = -ENXIO;
+                rc = -ENXIO;
                 goto probe_err_out;
         }
 
@@ -1114,7 +1114,7 @@ static int korina_probe(struct platform_device *pdev)
         lp->rx_dma_regs = ioremap_nocache(r->start, r->end - r->start);
         if (!lp->rx_dma_regs) {
                 printk(KERN_ERR DRV_NAME "cannot remap Rx DMA registers\n");
-                retval = -ENXIO;
+                rc = -ENXIO;
                 goto probe_err_dma_rx;
         }
 
@@ -1122,14 +1122,14 @@ static int korina_probe(struct platform_device *pdev)
         lp->tx_dma_regs = ioremap_nocache(r->start, r->end - r->start);
         if (!lp->tx_dma_regs) {
                 printk(KERN_ERR DRV_NAME "cannot remap Tx DMA registers\n");
-                retval = -ENXIO;
+                rc = -ENXIO;
                 goto probe_err_dma_tx;
         }
 
         lp->td_ring = kmalloc(TD_RING_SIZE + RD_RING_SIZE, GFP_KERNEL);
         if (!lp->td_ring) {
                 printk(KERN_ERR DRV_NAME "cannot allocate descriptors\n");
-                retval = -ENOMEM;
+                rc = -ENXIO;
                 goto probe_err_td_ring;
         }
 
@@ -1166,14 +1166,14 @@ static int korina_probe(struct platform_device *pdev)
         lp->mii_if.phy_id_mask = 0x1f;
         lp->mii_if.reg_num_mask = 0x1f;
 
-        err = register_netdev(dev);
-        if (err) {
+        rc = register_netdev(dev);
+        if (rc < 0) {
                 printk(KERN_ERR DRV_NAME
-                        ": cannot register net device %d\n", err);
-                retval = -EINVAL;
+                        ": cannot register net device %d\n", rc);
                 goto probe_err_register;
         }
-        return 0;
+out:
+        return rc;
 
 probe_err_register:
         kfree(lp->td_ring);
@@ -1185,7 +1185,7 @@ probe_err_dma_rx:
         iounmap(lp->eth_regs);
 probe_err_out:
         free_netdev(dev);
-        return retval;
+        goto out;
 }
 
 static int korina_remove(struct platform_device *pdev)
@@ -1193,12 +1193,9 @@ static int korina_remove(struct platform_device *pdev)
         struct korina_device *bif = platform_get_drvdata(pdev);
         struct korina_private *lp = netdev_priv(bif->dev);
 
-        if (lp->eth_regs)
-                iounmap(lp->eth_regs);
-        if (lp->rx_dma_regs)
-                iounmap(lp->rx_dma_regs);
-        if (lp->tx_dma_regs)
-                iounmap(lp->tx_dma_regs);
+        iounmap(lp->eth_regs);
+        iounmap(lp->rx_dma_regs);
+        iounmap(lp->tx_dma_regs);
 
         platform_set_drvdata(pdev, NULL);
         unregister_netdev(bif->dev);
diff --git a/drivers/net/macb.c b/drivers/net/macb.c
index d513bb8a4902..92dccd43bdca 100644
--- a/drivers/net/macb.c
+++ b/drivers/net/macb.c
@@ -1281,6 +1281,7 @@ static struct platform_driver macb_driver = {
         .remove         = __exit_p(macb_remove),
         .driver         = {
                 .name           = "macb",
+                .owner  = THIS_MODULE,
         },
 };
 
@@ -1300,3 +1301,4 @@ module_exit(macb_exit);
 MODULE_LICENSE("GPL");
 MODULE_DESCRIPTION("Atmel MACB Ethernet driver");
 MODULE_AUTHOR("Haavard Skinnemoen <hskinnemoen@atmel.com>");
+MODULE_ALIAS("platform:macb");
diff --git a/drivers/net/meth.c b/drivers/net/meth.c
index cdaa8fc21809..0b32648a2136 100644
--- a/drivers/net/meth.c
+++ b/drivers/net/meth.c
@@ -830,6 +830,7 @@ static struct platform_driver meth_driver = {
         .remove = __devexit_p(meth_remove),
         .driver = {
                 .name   = "meth",
+                .owner  = THIS_MODULE,
         }
 };
 
@@ -855,3 +856,4 @@ module_exit(meth_exit_module);
 MODULE_AUTHOR("Ilya Volynets <ilya@theIlya.com>");
 MODULE_DESCRIPTION("SGI O2 Builtin Fast Ethernet driver");
 MODULE_LICENSE("GPL");
+MODULE_ALIAS("platform:meth");
diff --git a/drivers/net/mv643xx_eth.c b/drivers/net/mv643xx_eth.c
index 601ffd69ebc8..381b36e5f64c 100644
--- a/drivers/net/mv643xx_eth.c
+++ b/drivers/net/mv643xx_eth.c
@@ -2030,6 +2030,7 @@ static struct platform_driver mv643xx_eth_driver = {
         .shutdown = mv643xx_eth_shutdown,
         .driver = {
                 .name = MV643XX_ETH_NAME,
+                .owner  = THIS_MODULE,
         },
 };
 
@@ -2038,6 +2039,7 @@ static struct platform_driver mv643xx_eth_shared_driver = {
         .remove = mv643xx_eth_shared_remove,
         .driver = {
                 .name = MV643XX_ETH_SHARED_NAME,
+                .owner  = THIS_MODULE,
         },
 };
 
@@ -2085,7 +2087,8 @@ MODULE_LICENSE("GPL");
 MODULE_AUTHOR(  "Rabeeh Khoury, Assaf Hoffman, Matthew Dharm, Manish Lachwani"
                 " and Dale Farnsworth");
 MODULE_DESCRIPTION("Ethernet driver for Marvell MV643XX");
-MODULE_ALIAS("platform:mv643xx_eth");
+MODULE_ALIAS("platform:" MV643XX_ETH_NAME);
+MODULE_ALIAS("platform:" MV643XX_ETH_SHARED_NAME);
 
 /*
  * The second part is the low level driver of the gigE ethernet ports.
diff --git a/drivers/net/netx-eth.c b/drivers/net/netx-eth.c
index 78d34af13a1c..dc442e370850 100644
--- a/drivers/net/netx-eth.c
+++ b/drivers/net/netx-eth.c
@@ -502,4 +502,4 @@ module_exit(netx_eth_cleanup);
 
 MODULE_AUTHOR("Sascha Hauer, Pengutronix");
 MODULE_LICENSE("GPL");
-
+MODULE_ALIAS("platform:" CARDNAME);
diff --git a/drivers/net/netxen/netxen_nic_hw.c b/drivers/net/netxen/netxen_nic_hw.c
index 05748ca6f216..af7356468251 100644
--- a/drivers/net/netxen/netxen_nic_hw.c
+++ b/drivers/net/netxen/netxen_nic_hw.c
@@ -1132,8 +1132,8 @@ void netxen_nic_flash_print(struct netxen_adapter *adapter)
         u32 fw_minor = 0;
         u32 fw_build = 0;
         char brd_name[NETXEN_MAX_SHORT_NAME];
-        struct netxen_new_user_info user_info;
-        int i, addr = NETXEN_USER_START;
+        char serial_num[32];
+        int i, addr;
         __le32 *ptr32;
 
         struct netxen_board_info *board_info = &(adapter->ahw.boardcfg);
@@ -1150,10 +1150,10 @@ void netxen_nic_flash_print(struct netxen_adapter *adapter)
                 valid = 0;
         }
         if (valid) {
-                ptr32 = (u32 *) & user_info;
-                for (i = 0;
-                     i < sizeof(struct netxen_new_user_info) / sizeof(u32);
-                     i++) {
+                ptr32 = (u32 *)&serial_num;
+                addr = NETXEN_USER_START +
+                       offsetof(struct netxen_new_user_info, serial_num);
+                for (i = 0; i < 8; i++) {
                         if (netxen_rom_fast_read(adapter, addr, ptr32) == -1) {
                                 printk("%s: ERROR reading %s board userarea.\n",
                                        netxen_nic_driver_name,
@@ -1163,10 +1163,11 @@ void netxen_nic_flash_print(struct netxen_adapter *adapter)
                         ptr32++;
                         addr += sizeof(u32);
                 }
+
                 get_brd_name_by_type(board_info->board_type, brd_name);
 
                 printk("NetXen %s Board S/N %s  Chip id 0x%x\n",
-                       brd_name, user_info.serial_num, board_info->chip_id);
+                       brd_name, serial_num, board_info->chip_id);
 
                 printk("NetXen %s Board #%d, Chip id 0x%x\n",
                        board_info->board_type == 0x0b ? "XGB" : "GBE",
diff --git a/drivers/net/niu.c b/drivers/net/niu.c
index 7565c2d7f30e..4009c4ce96b4 100644
--- a/drivers/net/niu.c
+++ b/drivers/net/niu.c
@@ -33,8 +33,8 @@
 
 #define DRV_MODULE_NAME         "niu"
 #define PFX DRV_MODULE_NAME     ": "
-#define DRV_MODULE_VERSION      "0.7"
-#define DRV_MODULE_RELDATE      "February 18, 2008"
+#define DRV_MODULE_VERSION      "0.8"
+#define DRV_MODULE_RELDATE      "April 24, 2008"
 
 static char version[] __devinitdata =
         DRV_MODULE_NAME ".c:v" DRV_MODULE_VERSION " (" DRV_MODULE_RELDATE ")\n";
@@ -673,11 +673,16 @@ static int serdes_init_10g(struct niu *np)
         }
 
         if ((sig & mask) != val) {
+                if (np->flags & NIU_FLAGS_HOTPLUG_PHY) {
+                        np->flags &= ~NIU_FLAGS_HOTPLUG_PHY_PRESENT;
+                        return 0;
+                }
                 dev_err(np->device, PFX "Port %u signal bits [%08x] are not "
                         "[%08x]\n", np->port, (int) (sig & mask), (int) val);
                 return -ENODEV;
         }
-
+        if (np->flags & NIU_FLAGS_HOTPLUG_PHY)
+                np->flags |= NIU_FLAGS_HOTPLUG_PHY_PRESENT;
         return 0;
 }
 
@@ -998,6 +1003,28 @@ static int bcm8704_user_dev3_readback(struct niu *np, int reg)
         return 0;
 }
 
+static int bcm8706_init_user_dev3(struct niu *np)
+{
+        int err;
+
+
+        err = mdio_read(np, np->phy_addr, BCM8704_USER_DEV3_ADDR,
+                        BCM8704_USER_OPT_DIGITAL_CTRL);
+        if (err < 0)
+                return err;
+        err &= ~USER_ODIG_CTRL_GPIOS;
+        err |= (0x3 << USER_ODIG_CTRL_GPIOS_SHIFT);
+        err |=  USER_ODIG_CTRL_RESV2;
+        err = mdio_write(np, np->phy_addr, BCM8704_USER_DEV3_ADDR,
+                         BCM8704_USER_OPT_DIGITAL_CTRL, err);
+        if (err)
+                return err;
+
+        mdelay(1000);
+
+        return 0;
+}
+
 static int bcm8704_init_user_dev3(struct niu *np)
 {
         int err;
@@ -1127,33 +1154,11 @@ static int xcvr_init_10g_mrvl88x2011(struct niu *np)
                           MRVL88X2011_10G_PMD_TX_DIS, MRVL88X2011_ENA_PMDTX);
 }
 
-static int xcvr_init_10g_bcm8704(struct niu *np)
+
+static int xcvr_diag_bcm870x(struct niu *np)
 {
-        struct niu_link_config *lp = &np->link_config;
         u16 analog_stat0, tx_alarm_status;
-        int err;
-
-        err = bcm8704_reset(np);
-        if (err)
-                return err;
-
-        err = bcm8704_init_user_dev3(np);
-        if (err)
-                return err;
-
-        err = mdio_read(np, np->phy_addr, BCM8704_PCS_DEV_ADDR,
-                        MII_BMCR);
-        if (err < 0)
-                return err;
-        err &= ~BMCR_LOOPBACK;
-
-        if (lp->loopback_mode == LOOPBACK_MAC)
-                err |= BMCR_LOOPBACK;
-
-        err = mdio_write(np, np->phy_addr, BCM8704_PCS_DEV_ADDR,
-                         MII_BMCR, err);
-        if (err)
-                return err;
+        int err = 0;
 
 #if 1
         err = mdio_read(np, np->phy_addr, BCM8704_PMA_PMD_DEV_ADDR,
@@ -1211,6 +1216,89 @@ static int xcvr_init_10g_bcm8704(struct niu *np)
         return 0;
 }
 
+static int xcvr_10g_set_lb_bcm870x(struct niu *np)
+{
+        struct niu_link_config *lp = &np->link_config;
+        int err;
+
+        err = mdio_read(np, np->phy_addr, BCM8704_PCS_DEV_ADDR,
+                        MII_BMCR);
+        if (err < 0)
+                return err;
+
+        err &= ~BMCR_LOOPBACK;
+
+        if (lp->loopback_mode == LOOPBACK_MAC)
+                err |= BMCR_LOOPBACK;
+
+        err = mdio_write(np, np->phy_addr, BCM8704_PCS_DEV_ADDR,
+                         MII_BMCR, err);
+        if (err)
+                return err;
+
+        return 0;
+}
+
+static int xcvr_init_10g_bcm8706(struct niu *np)
+{
+        int err = 0;
+        u64 val;
+
+        if ((np->flags & NIU_FLAGS_HOTPLUG_PHY) &&
+            (np->flags & NIU_FLAGS_HOTPLUG_PHY_PRESENT) == 0)
+                        return err;
+
+        val = nr64_mac(XMAC_CONFIG);
+        val &= ~XMAC_CONFIG_LED_POLARITY;
+        val |= XMAC_CONFIG_FORCE_LED_ON;
+        nw64_mac(XMAC_CONFIG, val);
+
+        val = nr64(MIF_CONFIG);
+        val |= MIF_CONFIG_INDIRECT_MODE;
+        nw64(MIF_CONFIG, val);
+
+        err = bcm8704_reset(np);
+        if (err)
+                return err;
+
+        err = xcvr_10g_set_lb_bcm870x(np);
+        if (err)
+                return err;
+
+        err = bcm8706_init_user_dev3(np);
+        if (err)
+                return err;
+
+        err = xcvr_diag_bcm870x(np);
+        if (err)
+                return err;
+
+        return 0;
+}
+
+static int xcvr_init_10g_bcm8704(struct niu *np)
+{
+        int err;
+
+        err = bcm8704_reset(np);
+        if (err)
+                return err;
+
+        err = bcm8704_init_user_dev3(np);
+        if (err)
+                return err;
+
+        err = xcvr_10g_set_lb_bcm870x(np);
+        if (err)
+                return err;
+
+        err =  xcvr_diag_bcm870x(np);
+        if (err)
+                return err;
+
+        return 0;
+}
+
 static int xcvr_init_10g(struct niu *np)
 {
         int phy_id, err;
@@ -1548,6 +1636,59 @@ out:
         return err;
 }
 
+static int link_status_10g_bcm8706(struct niu *np, int *link_up_p)
+{
+        int err, link_up;
+        link_up = 0;
+
+        err = mdio_read(np, np->phy_addr, BCM8704_PMA_PMD_DEV_ADDR,
+                        BCM8704_PMD_RCV_SIGDET);
+        if (err < 0)
+                goto out;
+        if (!(err & PMD_RCV_SIGDET_GLOBAL)) {
+                err = 0;
+                goto out;
+        }
+
+        err = mdio_read(np, np->phy_addr, BCM8704_PCS_DEV_ADDR,
+                        BCM8704_PCS_10G_R_STATUS);
+        if (err < 0)
+                goto out;
+
+        if (!(err & PCS_10G_R_STATUS_BLK_LOCK)) {
+                err = 0;
+                goto out;
+        }
+
+        err = mdio_read(np, np->phy_addr, BCM8704_PHYXS_DEV_ADDR,
+                        BCM8704_PHYXS_XGXS_LANE_STAT);
+        if (err < 0)
+                goto out;
+        if (err != (PHYXS_XGXS_LANE_STAT_ALINGED |
+                    PHYXS_XGXS_LANE_STAT_MAGIC |
+                    PHYXS_XGXS_LANE_STAT_PATTEST |
+                    PHYXS_XGXS_LANE_STAT_LANE3 |
+                    PHYXS_XGXS_LANE_STAT_LANE2 |
+                    PHYXS_XGXS_LANE_STAT_LANE1 |
+                    PHYXS_XGXS_LANE_STAT_LANE0)) {
+                err = 0;
+                np->link_config.active_speed = SPEED_INVALID;
+                np->link_config.active_duplex = DUPLEX_INVALID;
+                goto out;
+        }
+
+        link_up = 1;
+        np->link_config.active_speed = SPEED_10000;
+        np->link_config.active_duplex = DUPLEX_FULL;
+        err = 0;
+
+out:
+        *link_up_p = link_up;
+        if (np->flags & NIU_FLAGS_HOTPLUG_PHY)
+                err = 0;
+        return err;
+}
+
 static int link_status_10g_bcom(struct niu *np, int *link_up_p)
 {
         int err, link_up;
@@ -1627,6 +1768,82 @@ static int link_status_10g(struct niu *np, int *link_up_p)
         return err;
 }
 
+static int niu_10g_phy_present(struct niu *np)
+{
+        u64 sig, mask, val;
+
+        sig = nr64(ESR_INT_SIGNALS);
+        switch (np->port) {
+        case 0:
+                mask = ESR_INT_SIGNALS_P0_BITS;
+                val = (ESR_INT_SRDY0_P0 |
+                       ESR_INT_DET0_P0 |
+                       ESR_INT_XSRDY_P0 |
+                       ESR_INT_XDP_P0_CH3 |
+                       ESR_INT_XDP_P0_CH2 |
+                       ESR_INT_XDP_P0_CH1 |
+                       ESR_INT_XDP_P0_CH0);
+                break;
+
+        case 1:
+                mask = ESR_INT_SIGNALS_P1_BITS;
+                val = (ESR_INT_SRDY0_P1 |
+                       ESR_INT_DET0_P1 |
+                       ESR_INT_XSRDY_P1 |
+                       ESR_INT_XDP_P1_CH3 |
+                       ESR_INT_XDP_P1_CH2 |
+                       ESR_INT_XDP_P1_CH1 |
+                       ESR_INT_XDP_P1_CH0);
+                break;
+
+        default:
+                return 0;
+        }
+
+        if ((sig & mask) != val)
+                return 0;
+        return 1;
+}
+
+static int link_status_10g_hotplug(struct niu *np, int *link_up_p)
+{
+        unsigned long flags;
+        int err = 0;
+        int phy_present;
+        int phy_present_prev;
+
+        spin_lock_irqsave(&np->lock, flags);
+
+        if (np->link_config.loopback_mode == LOOPBACK_DISABLED) {
+                phy_present_prev = (np->flags & NIU_FLAGS_HOTPLUG_PHY_PRESENT) ?
+                        1 : 0;
+                phy_present = niu_10g_phy_present(np);
+                if (phy_present != phy_present_prev) {
+                        /* state change */
+                        if (phy_present) {
+                                np->flags |= NIU_FLAGS_HOTPLUG_PHY_PRESENT;
+                                if (np->phy_ops->xcvr_init)
+                                        err = np->phy_ops->xcvr_init(np);
+                                if (err) {
+                                        /* debounce */
+                                        np->flags &= ~NIU_FLAGS_HOTPLUG_PHY_PRESENT;
+                                }
+                        } else {
+                                np->flags &= ~NIU_FLAGS_HOTPLUG_PHY_PRESENT;
+                                *link_up_p = 0;
+                                niuwarn(LINK, "%s: Hotplug PHY Removed\n",
+                                        np->dev->name);
+                        }
+                }
+                if (np->flags & NIU_FLAGS_HOTPLUG_PHY_PRESENT)
+                        err = link_status_10g_bcm8706(np, link_up_p);
+        }
+
+        spin_unlock_irqrestore(&np->lock, flags);
+
+        return err;
+}
+
 static int link_status_1g(struct niu *np, int *link_up_p)
 {
         struct niu_link_config *lp = &np->link_config;
@@ -1761,6 +1978,12 @@ static const struct niu_phy_ops phy_ops_10g_fiber = {
         .link_status            = link_status_10g,
 };
 
+static const struct niu_phy_ops phy_ops_10g_fiber_hotplug = {
+        .serdes_init            = serdes_init_10g,
+        .xcvr_init              = xcvr_init_10g_bcm8706,
+        .link_status            = link_status_10g_hotplug,
+};
+
 static const struct niu_phy_ops phy_ops_10g_copper = {
         .serdes_init            = serdes_init_10g,
         .link_status            = link_status_10g, /* XXX */
@@ -1792,6 +2015,11 @@ static const struct niu_phy_template phy_template_10g_fiber = {
         .phy_addr_base  = 8,
 };
 
+static const struct niu_phy_template phy_template_10g_fiber_hotplug = {
+        .ops            = &phy_ops_10g_fiber_hotplug,
+        .phy_addr_base  = 8,
+};
+
 static const struct niu_phy_template phy_template_10g_copper = {
         .ops            = &phy_ops_10g_copper,
         .phy_addr_base  = 10,
@@ -1996,6 +2224,13 @@ static int niu_determine_phy_disposition(struct niu *np)
                             plat_type == PLAT_TYPE_VF_P1)
                                 phy_addr_off = 8;
                         phy_addr_off += np->port;
+                        if (np->flags & NIU_FLAGS_HOTPLUG_PHY) {
+                                tp = &phy_template_10g_fiber_hotplug;
+                                if (np->port == 0)
+                                        phy_addr_off = 8;
+                                if (np->port == 1)
+                                        phy_addr_off = 12;
+                        }
                         break;
 
                 case NIU_FLAGS_10G | NIU_FLAGS_XCVR_SERDES:
@@ -6773,6 +7008,37 @@ static int __devinit niu_phy_type_prop_decode(struct niu *np,
         return 0;
 }
 
+/* niu board models have a trailing dash version incremented
+ * with HW rev change. Need to ingnore the  dash version while
+ * checking for match
+ *
+ * for example, for the 10G card the current vpd.board_model
+ * is 501-5283-04, of which -04 is the  dash version and have
+ * to be ignored
+ */
+static int niu_board_model_match(struct niu *np, const char *model)
+{
+        return !strncmp(np->vpd.board_model, model, strlen(model));
+}
+
+static int niu_pci_vpd_get_nports(struct niu *np)
+{
+        int ports = 0;
+
+        if ((niu_board_model_match(np, NIU_QGC_LP_BM_STR)) ||
+            (niu_board_model_match(np, NIU_QGC_PEM_BM_STR)) ||
+            (niu_board_model_match(np, NIU_ALONSO_BM_STR))) {
+                ports = 4;
+        } else if ((niu_board_model_match(np, NIU_2XGF_LP_BM_STR)) ||
+                   (niu_board_model_match(np, NIU_2XGF_PEM_BM_STR)) ||
+                   (niu_board_model_match(np, NIU_FOXXY_BM_STR)) ||
+                   (niu_board_model_match(np, NIU_2XGF_MRVL_BM_STR))) {
+                ports = 2;
+        }
+
+        return ports;
+}
+
 static void __devinit niu_pci_vpd_validate(struct niu *np)
 {
         struct net_device *dev = np->dev;
@@ -6799,6 +7065,9 @@ static void __devinit niu_pci_vpd_validate(struct niu *np)
                 }
                 if (np->flags & NIU_FLAGS_10G)
                          np->mac_xcvr = MAC_XCVR_XPCS;
+        } else if (niu_board_model_match(np, NIU_FOXXY_BM_STR)) {
+                np->flags |= (NIU_FLAGS_10G | NIU_FLAGS_FIBER |
+                              NIU_FLAGS_HOTPLUG_PHY);
         } else if (niu_phy_type_prop_decode(np, np->vpd.phy_type)) {
                 dev_err(np->device, PFX "Illegal phy string [%s].\n",
                         np->vpd.phy_type);
@@ -6987,11 +7256,17 @@ static int __devinit niu_get_and_validate_port(struct niu *np)
                 if (parent->plat_type == PLAT_TYPE_NIU) {
                         parent->num_ports = 2;
                 } else {
-                        parent->num_ports = nr64(ESPC_NUM_PORTS_MACS) &
-                                ESPC_NUM_PORTS_MACS_VAL;
-
-                        if (!parent->num_ports)
-                                parent->num_ports = 4;
+                        parent->num_ports = niu_pci_vpd_get_nports(np);
+                        if (!parent->num_ports) {
+                                /* Fall back to SPROM as last resort.
+                                 * This will fail on most cards.
+                                 */
+                                parent->num_ports = nr64(ESPC_NUM_PORTS_MACS) &
+                                        ESPC_NUM_PORTS_MACS_VAL;
+
+                                if (!parent->num_ports)
+                                        return -ENODEV;
+                        }
                 }
         }
 
@@ -7015,7 +7290,8 @@ static int __devinit phy_record(struct niu_parent *parent,
                 return 0;
         if (type == PHY_TYPE_PMA_PMD || type == PHY_TYPE_PCS) {
                 if (((id & NIU_PHY_ID_MASK) != NIU_PHY_ID_BCM8704) &&
-                    ((id & NIU_PHY_ID_MASK) != NIU_PHY_ID_MRVL88X2011))
+                    ((id & NIU_PHY_ID_MASK) != NIU_PHY_ID_MRVL88X2011) &&
+                    ((id & NIU_PHY_ID_MASK) != NIU_PHY_ID_BCM8706))
                         return 0;
         } else {
                 if ((id & NIU_PHY_ID_MASK) != NIU_PHY_ID_BCM5464R)
@@ -7262,7 +7538,6 @@ static int __devinit walk_phys(struct niu *np, struct niu_parent *parent)
         u32 val;
         int err;
 
-
         if (!strcmp(np->vpd.model, "SUNW,CP3220") ||
             !strcmp(np->vpd.model, "SUNW,CP3260")) {
                 num_10g = 0;
@@ -7273,6 +7548,12 @@ static int __devinit walk_phys(struct niu *np, struct niu_parent *parent)
                        phy_encode(PORT_TYPE_1G, 1) |
                        phy_encode(PORT_TYPE_1G, 2) |
                        phy_encode(PORT_TYPE_1G, 3));
+        } else if (niu_board_model_match(np, NIU_FOXXY_BM_STR)) {
+                num_10g = 2;
+                num_1g = 0;
+                parent->num_ports = 2;
+                val = (phy_encode(PORT_TYPE_10G, 0) |
+                       phy_encode(PORT_TYPE_10G, 1));
         } else {
                 err = fill_phy_probe_info(np, parent, info);
                 if (err)
@@ -7733,15 +8014,16 @@ static int __devinit niu_get_invariants(struct niu *np)
 
         have_props = !err;
 
-        err = niu_get_and_validate_port(np);
-        if (err)
-                return err;
-
         err = niu_init_mac_ipp_pcs_base(np);
         if (err)
                 return err;
 
-        if (!have_props) {
+        if (have_props) {
+                err = niu_get_and_validate_port(np);
+                if (err)
+                        return err;
+
+        } else  {
                 if (np->parent->plat_type == PLAT_TYPE_NIU)
                         return -EINVAL;
 
@@ -7753,10 +8035,17 @@ static int __devinit niu_get_invariants(struct niu *np)
                         niu_pci_vpd_fetch(np, offset);
                 nw64(ESPC_PIO_EN, 0);
 
-                if (np->flags & NIU_FLAGS_VPD_VALID)
+                if (np->flags & NIU_FLAGS_VPD_VALID) {
                         niu_pci_vpd_validate(np);
+                        err = niu_get_and_validate_port(np);
+                        if (err)
+                                return err;
+                }
 
                 if (!(np->flags & NIU_FLAGS_VPD_VALID)) {
+                        err = niu_get_and_validate_port(np);
+                        if (err)
+                                return err;
                         err = niu_pci_probe_sprom(np);
                         if (err)
                                 return err;
diff --git a/drivers/net/niu.h b/drivers/net/niu.h
index 336aed08b275..97ffbe137bcb 100644
--- a/drivers/net/niu.h
+++ b/drivers/net/niu.h
@@ -2537,6 +2537,7 @@ struct fcram_hash_ipv6 {
 
 #define NIU_PHY_ID_MASK                 0xfffff0f0
 #define NIU_PHY_ID_BCM8704              0x00206030
+#define NIU_PHY_ID_BCM8706              0x00206035
 #define NIU_PHY_ID_BCM5464R             0x002060b0
 #define NIU_PHY_ID_MRVL88X2011          0x01410020
 
@@ -2937,6 +2938,15 @@ struct rx_ring_info {
 
 #define NIU_MAX_MTU             9216
 
+/* VPD strings */
+#define NIU_QGC_LP_BM_STR       "501-7606"
+#define NIU_2XGF_LP_BM_STR      "501-7283"
+#define NIU_QGC_PEM_BM_STR      "501-7765"
+#define NIU_2XGF_PEM_BM_STR     "501-7626"
+#define NIU_ALONSO_BM_STR       "373-0202"
+#define NIU_FOXXY_BM_STR        "501-7961"
+#define NIU_2XGF_MRVL_BM_STR    "SK-6E82"
+
 #define NIU_VPD_MIN_MAJOR       3
 #define NIU_VPD_MIN_MINOR       4
 
@@ -3199,6 +3209,8 @@ struct niu {
         struct niu_parent               *parent;
 
         u32                             flags;
+#define NIU_FLAGS_HOTPLUG_PHY_PRESENT   0x02000000 /* Removebale PHY detected*/
+#define NIU_FLAGS_HOTPLUG_PHY           0x01000000 /* Removebale PHY */
 #define NIU_FLAGS_VPD_VALID             0x00800000 /* VPD has valid version */
 #define NIU_FLAGS_MSIX                  0x00400000 /* MSI-X in use */
 #define NIU_FLAGS_MCAST                 0x00200000 /* multicast filter enabled */
diff --git a/drivers/net/phy/mdio_bus.c b/drivers/net/phy/mdio_bus.c
index 963630c65ca9..94e0b7ed76f1 100644
--- a/drivers/net/phy/mdio_bus.c
+++ b/drivers/net/phy/mdio_bus.c
@@ -89,6 +89,9 @@ int mdiobus_register(struct mii_bus *bus)
 
                         phydev->bus = bus;
 
+                        /* Run all of the fixups for this PHY */
+                        phy_scan_fixups(phydev);
+
                         err = device_register(&phydev->dev);
 
                         if (err) {
diff --git a/drivers/net/phy/phy.c b/drivers/net/phy/phy.c
index 12fccb1c76dc..3c18bb594957 100644
--- a/drivers/net/phy/phy.c
+++ b/drivers/net/phy/phy.c
@@ -406,8 +406,10 @@ int phy_mii_ioctl(struct phy_device *phydev,
                 
                 if (mii_data->reg_num == MII_BMCR 
                                 && val & BMCR_RESET
-                                && phydev->drv->config_init)
+                                && phydev->drv->config_init) {
+                        phy_scan_fixups(phydev);
                         phydev->drv->config_init(phydev);
+                }
                 break;
 
         default:
diff --git a/drivers/net/phy/phy_device.c b/drivers/net/phy/phy_device.c
index 8b1121b02f98..ddf8d51832a6 100644
--- a/drivers/net/phy/phy_device.c
+++ b/drivers/net/phy/phy_device.c
@@ -53,6 +53,96 @@ static void phy_device_release(struct device *dev)
         phy_device_free(to_phy_device(dev));
 }
 
+static LIST_HEAD(phy_fixup_list);
+static DEFINE_MUTEX(phy_fixup_lock);
+
+/*
+ * Creates a new phy_fixup and adds it to the list
+ * @bus_id: A string which matches phydev->dev.bus_id (or PHY_ANY_ID)
+ * @phy_uid: Used to match against phydev->phy_id (the UID of the PHY)
+ *      It can also be PHY_ANY_UID
+ * @phy_uid_mask: Applied to phydev->phy_id and fixup->phy_uid before
+ *      comparison
+ * @run: The actual code to be run when a matching PHY is found
+ */
+int phy_register_fixup(const char *bus_id, u32 phy_uid, u32 phy_uid_mask,
+                int (*run)(struct phy_device *))
+{
+        struct phy_fixup *fixup;
+
+        fixup = kzalloc(sizeof(struct phy_fixup), GFP_KERNEL);
+        if (!fixup)
+                return -ENOMEM;
+
+        strncpy(fixup->bus_id, bus_id, BUS_ID_SIZE);
+        fixup->phy_uid = phy_uid;
+        fixup->phy_uid_mask = phy_uid_mask;
+        fixup->run = run;
+
+        mutex_lock(&phy_fixup_lock);
+        list_add_tail(&fixup->list, &phy_fixup_list);
+        mutex_unlock(&phy_fixup_lock);
+
+        return 0;
+}
+EXPORT_SYMBOL(phy_register_fixup);
+
+/* Registers a fixup to be run on any PHY with the UID in phy_uid */
+int phy_register_fixup_for_uid(u32 phy_uid, u32 phy_uid_mask,
+                int (*run)(struct phy_device *))
+{
+        return phy_register_fixup(PHY_ANY_ID, phy_uid, phy_uid_mask, run);
+}
+EXPORT_SYMBOL(phy_register_fixup_for_uid);
+
+/* Registers a fixup to be run on the PHY with id string bus_id */
+int phy_register_fixup_for_id(const char *bus_id,
+                int (*run)(struct phy_device *))
+{
+        return phy_register_fixup(bus_id, PHY_ANY_UID, 0xffffffff, run);
+}
+EXPORT_SYMBOL(phy_register_fixup_for_id);
+
+/*
+ * Returns 1 if fixup matches phydev in bus_id and phy_uid.
+ * Fixups can be set to match any in one or more fields.
+ */
+static int phy_needs_fixup(struct phy_device *phydev, struct phy_fixup *fixup)
+{
+        if (strcmp(fixup->bus_id, phydev->dev.bus_id) != 0)
+                if (strcmp(fixup->bus_id, PHY_ANY_ID) != 0)
+                        return 0;
+
+        if ((fixup->phy_uid & fixup->phy_uid_mask) !=
+                        (phydev->phy_id & fixup->phy_uid_mask))
+                if (fixup->phy_uid != PHY_ANY_UID)
+                        return 0;
+
+        return 1;
+}
+
+/* Runs any matching fixups for this phydev */
+int phy_scan_fixups(struct phy_device *phydev)
+{
+        struct phy_fixup *fixup;
+
+        mutex_lock(&phy_fixup_lock);
+        list_for_each_entry(fixup, &phy_fixup_list, list) {
+                if (phy_needs_fixup(phydev, fixup)) {
+                        int err;
+
+                        err = fixup->run(phydev);
+
+                        if (err < 0)
+                                return err;
+                }
+        }
+        mutex_unlock(&phy_fixup_lock);
+
+        return 0;
+}
+EXPORT_SYMBOL(phy_scan_fixups);
+
 struct phy_device* phy_device_create(struct mii_bus *bus, int addr, int phy_id)
 {
         struct phy_device *dev;
@@ -179,13 +269,13 @@ void phy_prepare_link(struct phy_device *phydev,
  *   choose to call only the subset of functions which provide
  *   the desired functionality.
  */
-struct phy_device * phy_connect(struct net_device *dev, const char *phy_id,
+struct phy_device * phy_connect(struct net_device *dev, const char *bus_id,
                 void (*handler)(struct net_device *), u32 flags,
                 phy_interface_t interface)
 {
         struct phy_device *phydev;
 
-        phydev = phy_attach(dev, phy_id, flags, interface);
+        phydev = phy_attach(dev, bus_id, flags, interface);
 
         if (IS_ERR(phydev))
                 return phydev;
@@ -226,7 +316,7 @@ static int phy_compare_id(struct device *dev, void *data)
 /**
  * phy_attach - attach a network device to a particular PHY device
  * @dev: network device to attach
- * @phy_id: PHY device to attach
+ * @bus_id: PHY device to attach
  * @flags: PHY device's dev_flags
  * @interface: PHY device's interface
  *
@@ -238,7 +328,7 @@ static int phy_compare_id(struct device *dev, void *data)
  *     change.  The phy_device is returned to the attaching driver.
  */
 struct phy_device *phy_attach(struct net_device *dev,
-                const char *phy_id, u32 flags, phy_interface_t interface)
+                const char *bus_id, u32 flags, phy_interface_t interface)
 {
         struct bus_type *bus = &mdio_bus_type;
         struct phy_device *phydev;
@@ -246,12 +336,12 @@ struct phy_device *phy_attach(struct net_device *dev,
 
         /* Search the list of PHY devices on the mdio bus for the
          * PHY with the requested name */
-        d = bus_find_device(bus, NULL, (void *)phy_id, phy_compare_id);
+        d = bus_find_device(bus, NULL, (void *)bus_id, phy_compare_id);
 
         if (d) {
                 phydev = to_phy_device(d);
         } else {
-                printk(KERN_ERR "%s not found\n", phy_id);
+                printk(KERN_ERR "%s not found\n", bus_id);
                 return ERR_PTR(-ENODEV);
         }
 
@@ -271,7 +361,7 @@ struct phy_device *phy_attach(struct net_device *dev,
 
         if (phydev->attached_dev) {
                 printk(KERN_ERR "%s: %s already attached\n",
-                                dev->name, phy_id);
+                                dev->name, bus_id);
                 return ERR_PTR(-EBUSY);
         }
 
@@ -287,6 +377,11 @@ struct phy_device *phy_attach(struct net_device *dev,
         if (phydev->drv->config_init) {
                 int err;
 
+                err = phy_scan_fixups(phydev);
+
+                if (err < 0)
+                        return ERR_PTR(err);
+
                 err = phydev->drv->config_init(phydev);
 
                 if (err < 0)
@@ -395,6 +490,7 @@ EXPORT_SYMBOL(genphy_config_advert);
  */
 int genphy_setup_forced(struct phy_device *phydev)
 {
+        int err;
         int ctl = 0;
 
         phydev->pause = phydev->asym_pause = 0;
@@ -407,17 +503,26 @@ int genphy_setup_forced(struct phy_device *phydev)
         if (DUPLEX_FULL == phydev->duplex)
                 ctl |= BMCR_FULLDPLX;
         
-        ctl = phy_write(phydev, MII_BMCR, ctl);
+        err = phy_write(phydev, MII_BMCR, ctl);
 
-        if (ctl < 0)
-                return ctl;
+        if (err < 0)
+                return err;
+
+        /*
+         * Run the fixups on this PHY, just in case the
+         * board code needs to change something after a reset
+         */
+        err = phy_scan_fixups(phydev);
+
+        if (err < 0)
+                return err;
 
         /* We just reset the device, so we'd better configure any
          * settings the PHY requires to operate */
         if (phydev->drv->config_init)
-                ctl = phydev->drv->config_init(phydev);
+                err = phydev->drv->config_init(phydev);
 
-        return ctl;
+        return err;
 }
 
 
diff --git a/drivers/net/s2io.c b/drivers/net/s2io.c
index dcbe01b0ca0d..157fd932e951 100644
--- a/drivers/net/s2io.c
+++ b/drivers/net/s2io.c
@@ -86,7 +86,7 @@
 #include "s2io.h"
 #include "s2io-regs.h"
 
-#define DRV_VERSION "2.0.26.20"
+#define DRV_VERSION "2.0.26.22"
 
 /* S2io Driver name & version. */
 static char s2io_driver_name[] = "Neterion";
@@ -117,20 +117,6 @@ static inline int RXD_IS_UP2DT(struct RxD_t *rxdp)
 
 #define LINK_IS_UP(val64) (!(val64 & (ADAPTER_STATUS_RMAC_REMOTE_FAULT | \
                                       ADAPTER_STATUS_RMAC_LOCAL_FAULT)))
-#define TASKLET_IN_USE test_and_set_bit(0, (&sp->tasklet_status))
-#define PANIC   1
-#define LOW     2
-static inline int rx_buffer_level(struct s2io_nic * sp, int rxb_size, int ring)
-{
-        struct mac_info *mac_control;
-
-        mac_control = &sp->mac_control;
-        if (rxb_size <= rxd_count[sp->rxd_mode])
-                return PANIC;
-        else if ((mac_control->rings[ring].pkt_cnt - rxb_size) > 16)
-                return  LOW;
-        return 0;
-}
 
 static inline int is_s2io_card_up(const struct s2io_nic * sp)
 {
@@ -2458,7 +2444,7 @@ static void free_tx_buffers(struct s2io_nic *nic)
         for (i = 0; i < config->tx_fifo_num; i++) {
                 unsigned long flags;
                 spin_lock_irqsave(&mac_control->fifos[i].tx_lock, flags);
-                for (j = 0; j < config->tx_cfg[i].fifo_len - 1; j++) {
+                for (j = 0; j < config->tx_cfg[i].fifo_len; j++) {
                         txdp = (struct TxD *) \
                         mac_control->fifos[i].list_info[j].list_virt_addr;
                         skb = s2io_txdl_getskb(&mac_control->fifos[i], txdp, j);
@@ -2544,7 +2530,6 @@ static int fill_rx_buffers(struct s2io_nic *nic, int ring_no)
         struct config_param *config;
         u64 tmp;
         struct buffAdd *ba;
-        unsigned long flags;
         struct RxD_t *first_rxdp = NULL;
         u64 Buffer0_ptr = 0, Buffer1_ptr = 0;
         struct RxD1 *rxdp1;
@@ -2592,15 +2577,7 @@ static int fill_rx_buffers(struct s2io_nic *nic, int ring_no)
                         DBG_PRINT(INTR_DBG, "%s: Next block at: %p\n",
                                   dev->name, rxdp);
                 }
-                if(!napi) {
-                        spin_lock_irqsave(&nic->put_lock, flags);
-                        mac_control->rings[ring_no].put_pos =
-                        (block_no * (rxd_count[nic->rxd_mode] + 1)) + off;
-                        spin_unlock_irqrestore(&nic->put_lock, flags);
-                } else {
-                        mac_control->rings[ring_no].put_pos =
-                        (block_no * (rxd_count[nic->rxd_mode] + 1)) + off;
-                }
+
                 if ((rxdp->Control_1 & RXD_OWN_XENA) &&
                         ((nic->rxd_mode == RXD_MODE_3B) &&
                                 (rxdp->Control_2 & s2BIT(0)))) {
@@ -2978,7 +2955,7 @@ static void rx_intr_handler(struct ring_info *ring_data)
 {
         struct s2io_nic *nic = ring_data->nic;
         struct net_device *dev = (struct net_device *) nic->dev;
-        int get_block, put_block, put_offset;
+        int get_block, put_block;
         struct rx_curr_get_info get_info, put_info;
         struct RxD_t *rxdp;
         struct sk_buff *skb;
@@ -2987,19 +2964,11 @@ static void rx_intr_handler(struct ring_info *ring_data)
         struct RxD1* rxdp1;
         struct RxD3* rxdp3;
 
-        spin_lock(&nic->rx_lock);
-
         get_info = ring_data->rx_curr_get_info;
         get_block = get_info.block_index;
         memcpy(&put_info, &ring_data->rx_curr_put_info, sizeof(put_info));
         put_block = put_info.block_index;
         rxdp = ring_data->rx_blocks[get_block].rxds[get_info.offset].virt_addr;
-        if (!napi) {
-                spin_lock(&nic->put_lock);
-                put_offset = ring_data->put_pos;
-                spin_unlock(&nic->put_lock);
-        } else
-                put_offset = ring_data->put_pos;
 
         while (RXD_IS_UP2DT(rxdp)) {
                 /*
@@ -3016,7 +2985,6 @@ static void rx_intr_handler(struct ring_info *ring_data)
                         DBG_PRINT(ERR_DBG, "%s: The skb is ",
                                   dev->name);
                         DBG_PRINT(ERR_DBG, "Null in Rx Intr\n");
-                        spin_unlock(&nic->rx_lock);
                         return;
                 }
                 if (nic->rxd_mode == RXD_MODE_1) {
@@ -3072,8 +3040,6 @@ static void rx_intr_handler(struct ring_info *ring_data)
                         }
                 }
         }
-
-        spin_unlock(&nic->rx_lock);
 }
 
 /**
@@ -4105,7 +4071,6 @@ static int s2io_close(struct net_device *dev)
                         do_s2io_delete_unicast_mc(sp, tmp64);
         }
 
-        /* Reset card, kill tasklet and free Tx and Rx buffers. */
         s2io_card_down(sp);
 
         return 0;
@@ -4370,29 +4335,9 @@ s2io_alarm_handle(unsigned long data)
 
 static int s2io_chk_rx_buffers(struct s2io_nic *sp, int rng_n)
 {
-        int rxb_size, level;
-
-        if (!sp->lro) {
-                rxb_size = atomic_read(&sp->rx_bufs_left[rng_n]);
-                level = rx_buffer_level(sp, rxb_size, rng_n);
-
-                if ((level == PANIC) && (!TASKLET_IN_USE)) {
-                        int ret;
-                        DBG_PRINT(INTR_DBG, "%s: Rx BD hit ", __FUNCTION__);
-                        DBG_PRINT(INTR_DBG, "PANIC levels\n");
-                        if ((ret = fill_rx_buffers(sp, rng_n)) == -ENOMEM) {
-                                DBG_PRINT(INFO_DBG, "Out of memory in %s",
-                                          __FUNCTION__);
-                                clear_bit(0, (&sp->tasklet_status));
-                                return -1;
-                        }
-                        clear_bit(0, (&sp->tasklet_status));
-                } else if (level == LOW)
-                        tasklet_schedule(&sp->task);
-
-        } else if (fill_rx_buffers(sp, rng_n) == -ENOMEM) {
-                        DBG_PRINT(INFO_DBG, "%s:Out of memory", sp->dev->name);
-                        DBG_PRINT(INFO_DBG, " in Rx Intr!!\n");
+        if (fill_rx_buffers(sp, rng_n) == -ENOMEM) {
+                DBG_PRINT(INFO_DBG, "%s:Out of memory", sp->dev->name);
+                DBG_PRINT(INFO_DBG, " in Rx Intr!!\n");
         }
         return 0;
 }
@@ -6770,49 +6715,6 @@ static int s2io_change_mtu(struct net_device *dev, int new_mtu)
 }
 
 /**
- *  s2io_tasklet - Bottom half of the ISR.
- *  @dev_adr : address of the device structure in dma_addr_t format.
- *  Description:
- *  This is the tasklet or the bottom half of the ISR. This is
- *  an extension of the ISR which is scheduled by the scheduler to be run
- *  when the load on the CPU is low. All low priority tasks of the ISR can
- *  be pushed into the tasklet. For now the tasklet is used only to
- *  replenish the Rx buffers in the Rx buffer descriptors.
- *  Return value:
- *  void.
- */
-
-static void s2io_tasklet(unsigned long dev_addr)
-{
-        struct net_device *dev = (struct net_device *) dev_addr;
-        struct s2io_nic *sp = dev->priv;
-        int i, ret;
-        struct mac_info *mac_control;
-        struct config_param *config;
-
-        mac_control = &sp->mac_control;
-        config = &sp->config;
-
-        if (!TASKLET_IN_USE) {
-                for (i = 0; i < config->rx_ring_num; i++) {
-                        ret = fill_rx_buffers(sp, i);
-                        if (ret == -ENOMEM) {
-                                DBG_PRINT(INFO_DBG, "%s: Out of ",
-                                          dev->name);
-                                DBG_PRINT(INFO_DBG, "memory in tasklet\n");
-                                break;
-                        } else if (ret == -EFILL) {
-                                DBG_PRINT(INFO_DBG,
-                                          "%s: Rx Ring %d is full\n",
-                                          dev->name, i);
-                                break;
-                        }
-                }
-                clear_bit(0, (&sp->tasklet_status));
-        }
-}
-
-/**
  * s2io_set_link - Set the LInk status
  * @data: long pointer to device private structue
  * Description: Sets the link status for the adapter
@@ -7161,7 +7063,6 @@ static void do_s2io_card_down(struct s2io_nic * sp, int do_io)
 {
         int cnt = 0;
         struct XENA_dev_config __iomem *bar0 = sp->bar0;
-        unsigned long flags;
         register u64 val64 = 0;
         struct config_param *config;
         config = &sp->config;
@@ -7186,9 +7087,6 @@ static void do_s2io_card_down(struct s2io_nic * sp, int do_io)
 
         s2io_rem_isr(sp);
 
-        /* Kill tasklet. */
-        tasklet_kill(&sp->task);
-
         /* Check if the device is Quiescent and then Reset the NIC */
         while(do_io) {
                 /* As per the HW requirement we need to replenish the
@@ -7223,9 +7121,7 @@ static void do_s2io_card_down(struct s2io_nic * sp, int do_io)
         free_tx_buffers(sp);
 
         /* Free all Rx buffers */
-        spin_lock_irqsave(&sp->rx_lock, flags);
         free_rx_buffers(sp);
-        spin_unlock_irqrestore(&sp->rx_lock, flags);
 
         clear_bit(__S2IO_STATE_LINK_TASK, &(sp->state));
 }
@@ -7314,9 +7210,6 @@ static int s2io_card_up(struct s2io_nic * sp)
 
         S2IO_TIMER_CONF(sp->alarm_timer, s2io_alarm_handle, sp, (HZ/2));
 
-        /* Enable tasklet for the device */
-        tasklet_init(&sp->task, s2io_tasklet, (unsigned long) dev);
-
         /*  Enable select interrupts */
         en_dis_err_alarms(sp, ENA_ALL_INTRS, ENABLE_INTRS);
         if (sp->config.intr_type != INTA)
@@ -8119,20 +8012,15 @@ s2io_init_nic(struct pci_dev *pdev, const struct pci_device_id *pre)
         s2io_reset(sp);
 
         /*
-         * Initialize the tasklet status and link state flags
+         * Initialize link state flags
          * and the card state parameter
          */
-        sp->tasklet_status = 0;
         sp->state = 0;
 
         /* Initialize spinlocks */
         for (i = 0; i < sp->config.tx_fifo_num; i++)
                 spin_lock_init(&mac_control->fifos[i].tx_lock);
 
-        if (!napi)
-                spin_lock_init(&sp->put_lock);
-        spin_lock_init(&sp->rx_lock);
-
         /*
          * SXE-002: Configure link and activity LED to init state
          * on driver load.
diff --git a/drivers/net/s2io.h b/drivers/net/s2io.h
index e68fdf7e4260..ce53a02105f2 100644
--- a/drivers/net/s2io.h
+++ b/drivers/net/s2io.h
@@ -703,9 +703,6 @@ struct ring_info {
          */
         struct rx_curr_get_info rx_curr_get_info;
 
-        /* Index to the absolute position of the put pointer of Rx ring */
-        int put_pos;
-
         /* Buffer Address store. */
         struct buffAdd **ba;
         struct s2io_nic *nic;
@@ -868,8 +865,6 @@ struct s2io_nic {
         int device_enabled_once;
 
         char name[60];
-        struct tasklet_struct task;
-        volatile unsigned long tasklet_status;
 
         /* Timer that handles I/O errors/exceptions */
         struct timer_list alarm_timer;
@@ -879,8 +874,6 @@ struct s2io_nic {
 
         atomic_t rx_bufs_left[MAX_RX_RINGS];
 
-        spinlock_t put_lock;
-
 #define PROMISC     1
 #define ALL_MULTI   2
 
@@ -964,7 +957,6 @@ struct s2io_nic {
         u8              lro;
         u16             lro_max_aggr_per_sess;
         volatile unsigned long state;
-        spinlock_t      rx_lock;
         u64             general_int_mask;
 #define VPD_STRING_LEN 80
         u8  product_name[VPD_STRING_LEN];
@@ -1094,7 +1086,6 @@ static void s2io_handle_errors(void * dev_id);
 static int s2io_starter(void);
 static void s2io_closer(void);
 static void s2io_tx_watchdog(struct net_device *dev);
-static void s2io_tasklet(unsigned long dev_addr);
 static void s2io_set_multicast(struct net_device *dev);
 static int rx_osm_handler(struct ring_info *ring_data, struct RxD_t * rxdp);
 static void s2io_link(struct s2io_nic * sp, int link);
diff --git a/drivers/net/sgiseeq.c b/drivers/net/sgiseeq.c
index 78994ede0cb0..6261201403cd 100644
--- a/drivers/net/sgiseeq.c
+++ b/drivers/net/sgiseeq.c
@@ -825,7 +825,8 @@ static struct platform_driver sgiseeq_driver = {
         .probe  = sgiseeq_probe,
         .remove = __devexit_p(sgiseeq_remove),
         .driver = {
-                .name   = "sgiseeq"
+                .name   = "sgiseeq",
+                .owner  = THIS_MODULE,
         }
 };
 
@@ -850,3 +851,4 @@ module_exit(sgiseeq_module_exit);
 MODULE_DESCRIPTION("SGI Seeq 8003 driver");
 MODULE_AUTHOR("Linux/MIPS Mailing List <linux-mips@linux-mips.org>");
 MODULE_LICENSE("GPL");
+MODULE_ALIAS("platform:sgiseeq");
diff --git a/drivers/net/smc911x.c b/drivers/net/smc911x.c
index 76cc1d3adf71..4e2800205189 100644
--- a/drivers/net/smc911x.c
+++ b/drivers/net/smc911x.c
@@ -92,6 +92,7 @@ module_param(tx_fifo_kb, int, 0400);
 MODULE_PARM_DESC(tx_fifo_kb,"transmit FIFO size in KB (1<x<15)(default=8)");
 
 MODULE_LICENSE("GPL");
+MODULE_ALIAS("platform:smc911x");
 
 /*
  * The internal workings of the driver.  If you are changing anything
@@ -243,7 +244,7 @@ static void smc911x_reset(struct net_device *dev)
                 do {
                         udelay(10);
                         reg = SMC_GET_PMT_CTRL() & PMT_CTRL_READY_;
-                } while ( timeout-- && !reg);
+                } while (--timeout && !reg);
                 if (timeout == 0) {
                         PRINTK("%s: smc911x_reset timeout waiting for PM restore\n", dev->name);
                         return;
@@ -267,7 +268,7 @@ static void smc911x_reset(struct net_device *dev)
                                 resets++;
                                 break;
                         }
-                } while ( timeout-- && (reg & HW_CFG_SRST_));
+                } while (--timeout && (reg & HW_CFG_SRST_));
         }
         if (timeout == 0) {
                 PRINTK("%s: smc911x_reset timeout waiting for reset\n", dev->name);
@@ -413,7 +414,7 @@ static inline void smc911x_drop_pkt(struct net_device *dev)
                 do {
                         udelay(10);
                         reg = SMC_GET_RX_DP_CTRL() & RX_DP_CTRL_FFWD_BUSY_;
-                } while ( timeout-- && reg);
+                } while (--timeout && reg);
                 if (timeout == 0) {
                         PRINTK("%s: timeout waiting for RX fast forward\n", dev->name);
                 }
@@ -2262,6 +2263,7 @@ static struct platform_driver smc911x_driver = {
         .resume  = smc911x_drv_resume,
         .driver  = {
                 .name    = CARDNAME,
+                .owner  = THIS_MODULE,
         },
 };
 
diff --git a/drivers/net/smc91x.c b/drivers/net/smc91x.c
index 600b92af3334..a188e33484e6 100644
--- a/drivers/net/smc91x.c
+++ b/drivers/net/smc91x.c
@@ -132,6 +132,7 @@ module_param(watchdog, int, 0400);
 MODULE_PARM_DESC(watchdog, "transmit timeout in milliseconds");
 
 MODULE_LICENSE("GPL");
+MODULE_ALIAS("platform:smc91x");
 
 /*
  * The internal workings of the driver.  If you are changing anything
@@ -2308,6 +2309,7 @@ static struct platform_driver smc_driver = {
         .resume         = smc_drv_resume,
         .driver         = {
                 .name   = CARDNAME,
+                .owner  = THIS_MODULE,
         },
 };
 
diff --git a/drivers/net/sni_82596.c b/drivers/net/sni_82596.c
index 2cf6794acb4f..854ccf2b4105 100644
--- a/drivers/net/sni_82596.c
+++ b/drivers/net/sni_82596.c
@@ -44,6 +44,7 @@ static const char sni_82596_string[] = "snirm_82596";
 MODULE_AUTHOR("Thomas Bogendoerfer");
 MODULE_DESCRIPTION("i82596 driver");
 MODULE_LICENSE("GPL");
+MODULE_ALIAS("platform:snirm_82596");
 module_param(i596_debug, int, 0);
 MODULE_PARM_DESC(i596_debug, "82596 debug mask");
 
@@ -166,6 +167,7 @@ static struct platform_driver sni_82596_driver = {
         .remove = __devexit_p(sni_82596_driver_remove),
         .driver = {
                 .name   = sni_82596_string,
+                .owner  = THIS_MODULE,
         },
 };
 
diff --git a/drivers/net/tehuti.c b/drivers/net/tehuti.c
index 17585e5eed53..e83b166aa6b9 100644
--- a/drivers/net/tehuti.c
+++ b/drivers/net/tehuti.c
@@ -625,6 +625,12 @@ static void __init bdx_firmware_endianess(void)
                 s_firmLoad[i] = CPU_CHIP_SWAP32(s_firmLoad[i]);
 }
 
+static int bdx_range_check(struct bdx_priv *priv, u32 offset)
+{
+        return (offset > (u32) (BDX_REGS_SIZE / priv->nic->port_num)) ?
+                -EINVAL : 0;
+}
+
 static int bdx_ioctl_priv(struct net_device *ndev, struct ifreq *ifr, int cmd)
 {
         struct bdx_priv *priv = ndev->priv;
@@ -643,9 +649,15 @@ static int bdx_ioctl_priv(struct net_device *ndev, struct ifreq *ifr, int cmd)
                 DBG("%d 0x%x 0x%x\n", data[0], data[1], data[2]);
         }
 
+        if (!capable(CAP_NET_ADMIN))
+                return -EPERM;
+
         switch (data[0]) {
 
         case BDX_OP_READ:
+                error = bdx_range_check(priv, data[1]);
+                if (error < 0)
+                        return error;
                 data[2] = READ_REG(priv, data[1]);
                 DBG("read_reg(0x%x)=0x%x (dec %d)\n", data[1], data[2],
                     data[2]);
@@ -655,6 +667,9 @@ static int bdx_ioctl_priv(struct net_device *ndev, struct ifreq *ifr, int cmd)
                 break;
 
         case BDX_OP_WRITE:
+                error = bdx_range_check(priv, data[1]);
+                if (error < 0)
+                        return error;
                 WRITE_REG(priv, data[1], data[2]);
                 DBG("write_reg(0x%x, 0x%x)\n", data[1], data[2]);
                 break;
diff --git a/drivers/net/tg3.c b/drivers/net/tg3.c
index bc4c62b8e81a..e3f74c9f78bd 100644
--- a/drivers/net/tg3.c
+++ b/drivers/net/tg3.c
@@ -4017,6 +4017,8 @@ static int tg3_halt(struct tg3 *, int, int);
  * Invoked with tp->lock held.
  */
 static int tg3_restart_hw(struct tg3 *tp, int reset_phy)
+        __releases(tp->lock)
+        __acquires(tp->lock)
 {
         int err;
 
diff --git a/drivers/net/tsi108_eth.c b/drivers/net/tsi108_eth.c
index 6f33f84d37b0..6017d5267d08 100644
--- a/drivers/net/tsi108_eth.c
+++ b/drivers/net/tsi108_eth.c
@@ -162,6 +162,7 @@ static struct platform_driver tsi_eth_driver = {
         .remove = tsi108_ether_remove,
         .driver = {
                 .name = "tsi-ethernet",
+                .owner = THIS_MODULE,
         },
 };
 
@@ -1729,3 +1730,4 @@ module_exit(tsi108_ether_exit);
 MODULE_AUTHOR("Tundra Semiconductor Corporation");
 MODULE_DESCRIPTION("Tsi108 Gigabit Ethernet driver");
 MODULE_LICENSE("GPL");
+MODULE_ALIAS("platform:tsi-ethernet");
diff --git a/drivers/net/typhoon.c b/drivers/net/typhoon.c
index 333961bb7873..c0dd25ba7a18 100644
--- a/drivers/net/typhoon.c
+++ b/drivers/net/typhoon.c
@@ -2183,7 +2183,6 @@ typhoon_resume(struct pci_dev *pdev)
         }
 
         netif_device_attach(dev);
-        netif_start_queue(dev);
         return 0;
 
 reset:
diff --git a/drivers/net/ucc_geth.c b/drivers/net/ucc_geth.c
index 2f11254bcc07..281ce3d39532 100644
--- a/drivers/net/ucc_geth.c
+++ b/drivers/net/ucc_geth.c
@@ -3932,7 +3932,7 @@ static int ucc_geth_probe(struct of_device* ofdev, const struct of_device_id *ma
         ug_info->uf_info.irq = irq_of_parse_and_map(np, 0);
         fixed_link = of_get_property(np, "fixed-link", NULL);
         if (fixed_link) {
-                ug_info->mdio_bus = 0;
+                snprintf(ug_info->mdio_bus, MII_BUS_ID_SIZE, "0");
                 ug_info->phy_address = fixed_link[0];
                 phy = NULL;
         } else {
diff --git a/drivers/net/via-velocity.c b/drivers/net/via-velocity.c
index ed1afaf683a4..6b8d882d197b 100644
--- a/drivers/net/via-velocity.c
+++ b/drivers/net/via-velocity.c
@@ -605,7 +605,6 @@ static void __devinit velocity_get_options(struct velocity_opt *opts, int index,
 static void velocity_init_cam_filter(struct velocity_info *vptr)
 {
         struct mac_regs __iomem * regs = vptr->mac_regs;
-        unsigned short vid;
 
         /* Turn on MCFG_PQEN, turn off MCFG_RTGOPT */
         WORD_REG_BITS_SET(MCFG_PQEN, MCFG_RTGOPT, &regs->MCFG);
@@ -617,29 +616,33 @@ static void velocity_init_cam_filter(struct velocity_info *vptr)
         mac_set_vlan_cam_mask(regs, vptr->vCAMmask);
         mac_set_cam_mask(regs, vptr->mCAMmask);
 
-        /* Enable first VCAM */
+        /* Enable VCAMs */
         if (vptr->vlgrp) {
-                for (vid = 0; vid < VLAN_VID_MASK; vid++) {
-                        if (vlan_group_get_device(vptr->vlgrp, vid)) {
-                                /* If Tagging option is enabled and
-                                   VLAN ID is not zero, then
-                                   turn on MCFG_RTGOPT also */
-                                if (vid != 0)
-                                        WORD_REG_BITS_ON(MCFG_RTGOPT, &regs->MCFG);
+                unsigned int vid, i = 0;
+
+                if (!vlan_group_get_device(vptr->vlgrp, 0))
+                        WORD_REG_BITS_ON(MCFG_RTGOPT, &regs->MCFG);
 
-                                mac_set_vlan_cam(regs, 0, (u8 *) &vid);
+                for (vid = 1; (vid < VLAN_VID_MASK); vid++) {
+                        if (vlan_group_get_device(vptr->vlgrp, vid)) {
+                                mac_set_vlan_cam(regs, i, (u8 *) &vid);
+                                vptr->vCAMmask[i / 8] |= 0x1 << (i % 8);
+                                if (++i >= VCAM_SIZE)
+                                        break;
                         }
                 }
-                vptr->vCAMmask[0] |= 1;
                 mac_set_vlan_cam_mask(regs, vptr->vCAMmask);
-        } else {
-                u16 temp = 0;
-                mac_set_vlan_cam(regs, 0, (u8 *) &temp);
-                temp = 1;
-                mac_set_vlan_cam_mask(regs, (u8 *) &temp);
         }
 }
 
+static void velocity_vlan_rx_register(struct net_device *dev,
+                                      struct vlan_group *grp)
+{
+        struct velocity_info *vptr = netdev_priv(dev);
+
+        vptr->vlgrp = grp;
+}
+
 static void velocity_vlan_rx_add_vid(struct net_device *dev, unsigned short vid)
 {
         struct velocity_info *vptr = netdev_priv(dev);
@@ -959,11 +962,13 @@ static int __devinit velocity_found1(struct pci_dev *pdev, const struct pci_devi
 
         dev->vlan_rx_add_vid = velocity_vlan_rx_add_vid;
         dev->vlan_rx_kill_vid = velocity_vlan_rx_kill_vid;
+        dev->vlan_rx_register = velocity_vlan_rx_register;
 
 #ifdef  VELOCITY_ZERO_COPY_SUPPORT
         dev->features |= NETIF_F_SG;
 #endif
-        dev->features |= NETIF_F_HW_VLAN_TX | NETIF_F_HW_VLAN_FILTER;
+        dev->features |= NETIF_F_HW_VLAN_TX | NETIF_F_HW_VLAN_FILTER |
+                NETIF_F_HW_VLAN_RX;
 
         if (vptr->flags & VELOCITY_FLAGS_TX_CSUM)
                 dev->features |= NETIF_F_IP_CSUM;
@@ -1597,8 +1602,13 @@ static int velocity_receive_frame(struct velocity_info *vptr, int idx)
         skb_put(skb, pkt_len - 4);
         skb->protocol = eth_type_trans(skb, vptr->dev);
 
+        if (vptr->vlgrp && (rd->rdesc0.RSR & RSR_DETAG)) {
+                vlan_hwaccel_rx(skb, vptr->vlgrp,
+                                swab16(le16_to_cpu(rd->rdesc1.PQTAG)));
+        } else
+                netif_rx(skb);
+
         stats->rx_bytes += pkt_len;
-        netif_rx(skb);
 
         return 0;
 }
diff --git a/drivers/net/wan/c101.c b/drivers/net/wan/c101.c
index c4c8eab8574f..c2cc42f723d5 100644
--- a/drivers/net/wan/c101.c
+++ b/drivers/net/wan/c101.c
@@ -402,7 +402,7 @@ static int __init c101_init(void)
 #ifdef MODULE
                 printk(KERN_INFO "c101: no card initialized\n");
 #endif
-                return -ENOSYS; /* no parameters specified, abort */
+                return -EINVAL; /* no parameters specified, abort */
         }
 
         printk(KERN_INFO "%s\n", version);
@@ -420,11 +420,11 @@ static int __init c101_init(void)
                         c101_run(irq, ram);
 
                 if (*hw == '\x0')
-                        return first_card ? 0 : -ENOSYS;
+                        return first_card ? 0 : -EINVAL;
         }while(*hw++ == ':');
 
         printk(KERN_ERR "c101: invalid hardware parameters\n");
-        return first_card ? 0 : -ENOSYS;
+        return first_card ? 0 : -EINVAL;
 }
 
 
diff --git a/drivers/net/wan/hdlc_fr.c b/drivers/net/wan/hdlc_fr.c
index c4ab0326f911..520bb0b1a9a2 100644
--- a/drivers/net/wan/hdlc_fr.c
+++ b/drivers/net/wan/hdlc_fr.c
@@ -1090,10 +1090,6 @@ static int fr_add_pvc(struct net_device *frad, unsigned int dlci, int type)
         pvc_device *pvc = NULL;
         struct net_device *dev;
         int result, used;
-        char * prefix = "pvc%d";
-
-        if (type == ARPHRD_ETHER)
-                prefix = "pvceth%d";
 
         if ((pvc = add_pvc(frad, dlci)) == NULL) {
                 printk(KERN_WARNING "%s: Memory squeeze on fr_add_pvc()\n",
diff --git a/drivers/net/xen-netfront.c b/drivers/net/xen-netfront.c
index 7483d45bc5bc..e62018a36133 100644
--- a/drivers/net/xen-netfront.c
+++ b/drivers/net/xen-netfront.c
@@ -1809,3 +1809,5 @@ module_exit(netif_exit);
 
 MODULE_DESCRIPTION("Xen virtual network device frontend");
 MODULE_LICENSE("GPL");
+MODULE_ALIAS("xen:vif");
+MODULE_ALIAS("xennet");
diff --git a/drivers/video/Kconfig b/drivers/video/Kconfig
index 1bd5fb30237d..e3dc8f8d0c3e 100644
--- a/drivers/video/Kconfig
+++ b/drivers/video/Kconfig
@@ -1930,6 +1930,20 @@ config FB_VIRTUAL
 
           If unsure, say N.
 
+config XEN_FBDEV_FRONTEND
+        tristate "Xen virtual frame buffer support"
+        depends on FB && XEN
+        select FB_SYS_FILLRECT
+        select FB_SYS_COPYAREA
+        select FB_SYS_IMAGEBLIT
+        select FB_SYS_FOPS
+        select FB_DEFERRED_IO
+        default y
+        help
+          This driver implements the front-end of the Xen virtual
+          frame buffer driver.  It communicates with a back-end
+          in another domain.
+
 source "drivers/video/omap/Kconfig"
 
 source "drivers/video/backlight/Kconfig"
diff --git a/drivers/video/Makefile b/drivers/video/Makefile
index 11c0e5e05f21..f172b9b73314 100644
--- a/drivers/video/Makefile
+++ b/drivers/video/Makefile
@@ -114,6 +114,7 @@ obj-$(CONFIG_FB_PS3)		  += ps3fb.o
 obj-$(CONFIG_FB_SM501)            += sm501fb.o
 obj-$(CONFIG_FB_XILINX)           += xilinxfb.o
 obj-$(CONFIG_FB_OMAP)             += omap/
+obj-$(CONFIG_XEN_FBDEV_FRONTEND)  += xen-fbfront.o
 
 # Platform or fallback drivers go here
 obj-$(CONFIG_FB_UVESA)            += uvesafb.o
diff --git a/drivers/video/xen-fbfront.c b/drivers/video/xen-fbfront.c
new file mode 100644
index 000000000000..619a6f8d65a2
--- /dev/null
+++ b/drivers/video/xen-fbfront.c
@@ -0,0 +1,550 @@
+/*
+ * Xen para-virtual frame buffer device
+ *
+ * Copyright (C) 2005-2006 Anthony Liguori <aliguori@us.ibm.com>
+ * Copyright (C) 2006-2008 Red Hat, Inc., Markus Armbruster <armbru@redhat.com>
+ *
+ *  Based on linux/drivers/video/q40fb.c
+ *
+ *  This file is subject to the terms and conditions of the GNU General Public
+ *  License. See the file COPYING in the main directory of this archive for
+ *  more details.
+ */
+
+/*
+ * TODO:
+ *
+ * Switch to grant tables when they become capable of dealing with the
+ * frame buffer.
+ */
+
+#include <linux/kernel.h>
+#include <linux/errno.h>
+#include <linux/fb.h>
+#include <linux/module.h>
+#include <linux/vmalloc.h>
+#include <linux/mm.h>
+#include <asm/xen/hypervisor.h>
+#include <xen/events.h>
+#include <xen/page.h>
+#include <xen/interface/io/fbif.h>
+#include <xen/interface/io/protocols.h>
+#include <xen/xenbus.h>
+
+struct xenfb_info {
+        unsigned char           *fb;
+        struct fb_info          *fb_info;
+        int                     x1, y1, x2, y2; /* dirty rectangle,
+                                                   protected by dirty_lock */
+        spinlock_t              dirty_lock;
+        int                     nr_pages;
+        int                     irq;
+        struct xenfb_page       *page;
+        unsigned long           *mfns;
+        int                     update_wanted; /* XENFB_TYPE_UPDATE wanted */
+
+        struct xenbus_device    *xbdev;
+};
+
+static u32 xenfb_mem_len = XENFB_WIDTH * XENFB_HEIGHT * XENFB_DEPTH / 8;
+
+static int xenfb_remove(struct xenbus_device *);
+static void xenfb_init_shared_page(struct xenfb_info *);
+static int xenfb_connect_backend(struct xenbus_device *, struct xenfb_info *);
+static void xenfb_disconnect_backend(struct xenfb_info *);
+
+static void xenfb_do_update(struct xenfb_info *info,
+                            int x, int y, int w, int h)
+{
+        union xenfb_out_event event;
+        u32 prod;
+
+        event.type = XENFB_TYPE_UPDATE;
+        event.update.x = x;
+        event.update.y = y;
+        event.update.width = w;
+        event.update.height = h;
+
+        prod = info->page->out_prod;
+        /* caller ensures !xenfb_queue_full() */
+        mb();                   /* ensure ring space available */
+        XENFB_OUT_RING_REF(info->page, prod) = event;
+        wmb();                  /* ensure ring contents visible */
+        info->page->out_prod = prod + 1;
+
+        notify_remote_via_irq(info->irq);
+}
+
+static int xenfb_queue_full(struct xenfb_info *info)
+{
+        u32 cons, prod;
+
+        prod = info->page->out_prod;
+        cons = info->page->out_cons;
+        return prod - cons == XENFB_OUT_RING_LEN;
+}
+
+static void xenfb_refresh(struct xenfb_info *info,
+                          int x1, int y1, int w, int h)
+{
+        unsigned long flags;
+        int y2 = y1 + h - 1;
+        int x2 = x1 + w - 1;
+
+        if (!info->update_wanted)
+                return;
+
+        spin_lock_irqsave(&info->dirty_lock, flags);
+
+        /* Combine with dirty rectangle: */
+        if (info->y1 < y1)
+                y1 = info->y1;
+        if (info->y2 > y2)
+                y2 = info->y2;
+        if (info->x1 < x1)
+                x1 = info->x1;
+        if (info->x2 > x2)
+                x2 = info->x2;
+
+        if (xenfb_queue_full(info)) {
+                /* Can't send right now, stash it in the dirty rectangle */
+                info->x1 = x1;
+                info->x2 = x2;
+                info->y1 = y1;
+                info->y2 = y2;
+                spin_unlock_irqrestore(&info->dirty_lock, flags);
+                return;
+        }
+
+        /* Clear dirty rectangle: */
+        info->x1 = info->y1 = INT_MAX;
+        info->x2 = info->y2 = 0;
+
+        spin_unlock_irqrestore(&info->dirty_lock, flags);
+
+        if (x1 <= x2 && y1 <= y2)
+                xenfb_do_update(info, x1, y1, x2 - x1 + 1, y2 - y1 + 1);
+}
+
+static void xenfb_deferred_io(struct fb_info *fb_info,
+                              struct list_head *pagelist)
+{
+        struct xenfb_info *info = fb_info->par;
+        struct page *page;
+        unsigned long beg, end;
+        int y1, y2, miny, maxy;
+
+        miny = INT_MAX;
+        maxy = 0;
+        list_for_each_entry(page, pagelist, lru) {
+                beg = page->index << PAGE_SHIFT;
+                end = beg + PAGE_SIZE - 1;
+                y1 = beg / fb_info->fix.line_length;
+                y2 = end / fb_info->fix.line_length;
+                if (y2 >= fb_info->var.yres)
+                        y2 = fb_info->var.yres - 1;
+                if (miny > y1)
+                        miny = y1;
+                if (maxy < y2)
+                        maxy = y2;
+        }
+        xenfb_refresh(info, 0, miny, fb_info->var.xres, maxy - miny + 1);
+}
+
+static struct fb_deferred_io xenfb_defio = {
+        .delay          = HZ / 20,
+        .deferred_io    = xenfb_deferred_io,
+};
+
+static int xenfb_setcolreg(unsigned regno, unsigned red, unsigned green,
+                           unsigned blue, unsigned transp,
+                           struct fb_info *info)
+{
+        u32 v;
+
+        if (regno > info->cmap.len)
+                return 1;
+
+#define CNVT_TOHW(val, width) ((((val)<<(width))+0x7FFF-(val))>>16)
+        red = CNVT_TOHW(red, info->var.red.length);
+        green = CNVT_TOHW(green, info->var.green.length);
+        blue = CNVT_TOHW(blue, info->var.blue.length);
+        transp = CNVT_TOHW(transp, info->var.transp.length);
+#undef CNVT_TOHW
+
+        v = (red << info->var.red.offset) |
+            (green << info->var.green.offset) |
+            (blue << info->var.blue.offset);
+
+        switch (info->var.bits_per_pixel) {
+        case 16:
+        case 24:
+        case 32:
+                ((u32 *)info->pseudo_palette)[regno] = v;
+                break;
+        }
+
+        return 0;
+}
+
+static void xenfb_fillrect(struct fb_info *p, const struct fb_fillrect *rect)
+{
+        struct xenfb_info *info = p->par;
+
+        sys_fillrect(p, rect);
+        xenfb_refresh(info, rect->dx, rect->dy, rect->width, rect->height);
+}
+
+static void xenfb_imageblit(struct fb_info *p, const struct fb_image *image)
+{
+        struct xenfb_info *info = p->par;
+
+        sys_imageblit(p, image);
+        xenfb_refresh(info, image->dx, image->dy, image->width, image->height);
+}
+
+static void xenfb_copyarea(struct fb_info *p, const struct fb_copyarea *area)
+{
+        struct xenfb_info *info = p->par;
+
+        sys_copyarea(p, area);
+        xenfb_refresh(info, area->dx, area->dy, area->width, area->height);
+}
+
+static ssize_t xenfb_write(struct fb_info *p, const char __user *buf,
+                        size_t count, loff_t *ppos)
+{
+        struct xenfb_info *info = p->par;
+        ssize_t res;
+
+        res = fb_sys_write(p, buf, count, ppos);
+        xenfb_refresh(info, 0, 0, info->page->width, info->page->height);
+        return res;
+}
+
+static struct fb_ops xenfb_fb_ops = {
+        .owner          = THIS_MODULE,
+        .fb_read        = fb_sys_read,
+        .fb_write       = xenfb_write,
+        .fb_setcolreg   = xenfb_setcolreg,
+        .fb_fillrect    = xenfb_fillrect,
+        .fb_copyarea    = xenfb_copyarea,
+        .fb_imageblit   = xenfb_imageblit,
+};
+
+static irqreturn_t xenfb_event_handler(int rq, void *dev_id)
+{
+        /*
+         * No in events recognized, simply ignore them all.
+         * If you need to recognize some, see xen-kbdfront's
+         * input_handler() for how to do that.
+         */
+        struct xenfb_info *info = dev_id;
+        struct xenfb_page *page = info->page;
+
+        if (page->in_cons != page->in_prod) {
+                info->page->in_cons = info->page->in_prod;
+                notify_remote_via_irq(info->irq);
+        }
+
+        /* Flush dirty rectangle: */
+        xenfb_refresh(info, INT_MAX, INT_MAX, -INT_MAX, -INT_MAX);
+
+        return IRQ_HANDLED;
+}
+
+static int __devinit xenfb_probe(struct xenbus_device *dev,
+                                 const struct xenbus_device_id *id)
+{
+        struct xenfb_info *info;
+        struct fb_info *fb_info;
+        int ret;
+
+        info = kzalloc(sizeof(*info), GFP_KERNEL);
+        if (info == NULL) {
+                xenbus_dev_fatal(dev, -ENOMEM, "allocating info structure");
+                return -ENOMEM;
+        }
+        dev->dev.driver_data = info;
+        info->xbdev = dev;
+        info->irq = -1;
+        info->x1 = info->y1 = INT_MAX;
+        spin_lock_init(&info->dirty_lock);
+
+        info->fb = vmalloc(xenfb_mem_len);
+        if (info->fb == NULL)
+                goto error_nomem;
+        memset(info->fb, 0, xenfb_mem_len);
+
+        info->nr_pages = (xenfb_mem_len + PAGE_SIZE - 1) >> PAGE_SHIFT;
+
+        info->mfns = vmalloc(sizeof(unsigned long) * info->nr_pages);
+        if (!info->mfns)
+                goto error_nomem;
+
+        /* set up shared page */
+        info->page = (void *)__get_free_page(GFP_KERNEL | __GFP_ZERO);
+        if (!info->page)
+                goto error_nomem;
+
+        xenfb_init_shared_page(info);
+
+        /* abusing framebuffer_alloc() to allocate pseudo_palette */
+        fb_info = framebuffer_alloc(sizeof(u32) * 256, NULL);
+        if (fb_info == NULL)
+                goto error_nomem;
+
+        /* complete the abuse: */
+        fb_info->pseudo_palette = fb_info->par;
+        fb_info->par = info;
+
+        fb_info->screen_base = info->fb;
+
+        fb_info->fbops = &xenfb_fb_ops;
+        fb_info->var.xres_virtual = fb_info->var.xres = info->page->width;
+        fb_info->var.yres_virtual = fb_info->var.yres = info->page->height;
+        fb_info->var.bits_per_pixel = info->page->depth;
+
+        fb_info->var.red = (struct fb_bitfield){16, 8, 0};
+        fb_info->var.green = (struct fb_bitfield){8, 8, 0};
+        fb_info->var.blue = (struct fb_bitfield){0, 8, 0};
+
+        fb_info->var.activate = FB_ACTIVATE_NOW;
+        fb_info->var.height = -1;
+        fb_info->var.width = -1;
+        fb_info->var.vmode = FB_VMODE_NONINTERLACED;
+
+        fb_info->fix.visual = FB_VISUAL_TRUECOLOR;
+        fb_info->fix.line_length = info->page->line_length;
+        fb_info->fix.smem_start = 0;
+        fb_info->fix.smem_len = xenfb_mem_len;
+        strcpy(fb_info->fix.id, "xen");
+        fb_info->fix.type = FB_TYPE_PACKED_PIXELS;
+        fb_info->fix.accel = FB_ACCEL_NONE;
+
+        fb_info->flags = FBINFO_FLAG_DEFAULT;
+
+        ret = fb_alloc_cmap(&fb_info->cmap, 256, 0);
+        if (ret < 0) {
+                framebuffer_release(fb_info);
+                xenbus_dev_fatal(dev, ret, "fb_alloc_cmap");
+                goto error;
+        }
+
+        fb_info->fbdefio = &xenfb_defio;
+        fb_deferred_io_init(fb_info);
+
+        ret = register_framebuffer(fb_info);
+        if (ret) {
+                fb_deferred_io_cleanup(fb_info);
+                fb_dealloc_cmap(&fb_info->cmap);
+                framebuffer_release(fb_info);
+                xenbus_dev_fatal(dev, ret, "register_framebuffer");
+                goto error;
+        }
+        info->fb_info = fb_info;
+
+        ret = xenfb_connect_backend(dev, info);
+        if (ret < 0)
+                goto error;
+
+        return 0;
+
+ error_nomem:
+        ret = -ENOMEM;
+        xenbus_dev_fatal(dev, ret, "allocating device memory");
+ error:
+        xenfb_remove(dev);
+        return ret;
+}
+
+static int xenfb_resume(struct xenbus_device *dev)
+{
+        struct xenfb_info *info = dev->dev.driver_data;
+
+        xenfb_disconnect_backend(info);
+        xenfb_init_shared_page(info);
+        return xenfb_connect_backend(dev, info);
+}
+
+static int xenfb_remove(struct xenbus_device *dev)
+{
+        struct xenfb_info *info = dev->dev.driver_data;
+
+        xenfb_disconnect_backend(info);
+        if (info->fb_info) {
+                fb_deferred_io_cleanup(info->fb_info);
+                unregister_framebuffer(info->fb_info);
+                fb_dealloc_cmap(&info->fb_info->cmap);
+                framebuffer_release(info->fb_info);
+        }
+        free_page((unsigned long)info->page);
+        vfree(info->mfns);
+        vfree(info->fb);
+        kfree(info);
+
+        return 0;
+}
+
+static unsigned long vmalloc_to_mfn(void *address)
+{
+        return pfn_to_mfn(vmalloc_to_pfn(address));
+}
+
+static void xenfb_init_shared_page(struct xenfb_info *info)
+{
+        int i;
+
+        for (i = 0; i < info->nr_pages; i++)
+                info->mfns[i] = vmalloc_to_mfn(info->fb + i * PAGE_SIZE);
+
+        info->page->pd[0] = vmalloc_to_mfn(info->mfns);
+        info->page->pd[1] = 0;
+        info->page->width = XENFB_WIDTH;
+        info->page->height = XENFB_HEIGHT;
+        info->page->depth = XENFB_DEPTH;
+        info->page->line_length = (info->page->depth / 8) * info->page->width;
+        info->page->mem_length = xenfb_mem_len;
+        info->page->in_cons = info->page->in_prod = 0;
+        info->page->out_cons = info->page->out_prod = 0;
+}
+
+static int xenfb_connect_backend(struct xenbus_device *dev,
+                                 struct xenfb_info *info)
+{
+        int ret, evtchn;
+        struct xenbus_transaction xbt;
+
+        ret = xenbus_alloc_evtchn(dev, &evtchn);
+        if (ret)
+                return ret;
+        ret = bind_evtchn_to_irqhandler(evtchn, xenfb_event_handler,
+                                        0, dev->devicetype, info);
+        if (ret < 0) {
+                xenbus_free_evtchn(dev, evtchn);
+                xenbus_dev_fatal(dev, ret, "bind_evtchn_to_irqhandler");
+                return ret;
+        }
+        info->irq = ret;
+
+ again:
+        ret = xenbus_transaction_start(&xbt);
+        if (ret) {
+                xenbus_dev_fatal(dev, ret, "starting transaction");
+                return ret;
+        }
+        ret = xenbus_printf(xbt, dev->nodename, "page-ref", "%lu",
+                            virt_to_mfn(info->page));
+        if (ret)
+                goto error_xenbus;
+        ret = xenbus_printf(xbt, dev->nodename, "event-channel", "%u",
+                            evtchn);
+        if (ret)
+                goto error_xenbus;
+        ret = xenbus_printf(xbt, dev->nodename, "protocol", "%s",
+                            XEN_IO_PROTO_ABI_NATIVE);
+        if (ret)
+                goto error_xenbus;
+        ret = xenbus_printf(xbt, dev->nodename, "feature-update", "1");
+        if (ret)
+                goto error_xenbus;
+        ret = xenbus_transaction_end(xbt, 0);
+        if (ret) {
+                if (ret == -EAGAIN)
+                        goto again;
+                xenbus_dev_fatal(dev, ret, "completing transaction");
+                return ret;
+        }
+
+        xenbus_switch_state(dev, XenbusStateInitialised);
+        return 0;
+
+ error_xenbus:
+        xenbus_transaction_end(xbt, 1);
+        xenbus_dev_fatal(dev, ret, "writing xenstore");
+        return ret;
+}
+
+static void xenfb_disconnect_backend(struct xenfb_info *info)
+{
+        if (info->irq >= 0)
+                unbind_from_irqhandler(info->irq, info);
+        info->irq = -1;
+}
+
+static void xenfb_backend_changed(struct xenbus_device *dev,
+                                  enum xenbus_state backend_state)
+{
+        struct xenfb_info *info = dev->dev.driver_data;
+        int val;
+
+        switch (backend_state) {
+        case XenbusStateInitialising:
+        case XenbusStateInitialised:
+        case XenbusStateUnknown:
+        case XenbusStateClosed:
+                break;
+
+        case XenbusStateInitWait:
+InitWait:
+                xenbus_switch_state(dev, XenbusStateConnected);
+                break;
+
+        case XenbusStateConnected:
+                /*
+                 * Work around xenbus race condition: If backend goes
+                 * through InitWait to Connected fast enough, we can
+                 * get Connected twice here.
+                 */
+                if (dev->state != XenbusStateConnected)
+                        goto InitWait; /* no InitWait seen yet, fudge it */
+
+                if (xenbus_scanf(XBT_NIL, info->xbdev->otherend,
+                                 "request-update", "%d", &val) < 0)
+                        val = 0;
+                if (val)
+                        info->update_wanted = 1;
+                break;
+
+        case XenbusStateClosing:
+                xenbus_frontend_closed(dev);
+                break;
+        }
+}
+
+static struct xenbus_device_id xenfb_ids[] = {
+        { "vfb" },
+        { "" }
+};
+
+static struct xenbus_driver xenfb = {
+        .name = "vfb",
+        .owner = THIS_MODULE,
+        .ids = xenfb_ids,
+        .probe = xenfb_probe,
+        .remove = xenfb_remove,
+        .resume = xenfb_resume,
+        .otherend_changed = xenfb_backend_changed,
+};
+
+static int __init xenfb_init(void)
+{
+        if (!is_running_on_xen())
+                return -ENODEV;
+
+        /* Nothing to do if running in dom0. */
+        if (is_initial_xendomain())
+                return -ENODEV;
+
+        return xenbus_register_frontend(&xenfb);
+}
+
+static void __exit xenfb_cleanup(void)
+{
+        xenbus_unregister_driver(&xenfb);
+}
+
+module_init(xenfb_init);
+module_exit(xenfb_cleanup);
+
+MODULE_LICENSE("GPL");
diff --git a/drivers/xen/Kconfig b/drivers/xen/Kconfig
new file mode 100644
index 000000000000..4b75a16de009
--- /dev/null
+++ b/drivers/xen/Kconfig
@@ -0,0 +1,19 @@
+config XEN_BALLOON
+        bool "Xen memory balloon driver"
+        depends on XEN
+        default y
+        help
+          The balloon driver allows the Xen domain to request more memory from
+          the system to expand the domain's memory allocation, or alternatively
+          return unneeded memory to the system.
+
+config XEN_SCRUB_PAGES
+        bool "Scrub pages before returning them to system"
+        depends on XEN_BALLOON
+        default y
+        help
+          Scrub pages before returning them to the system for reuse by
+          other domains.  This makes sure that any confidential data
+          is not accidentally visible to other domains.  Is it more
+          secure, but slightly less efficient.
+          If in doubt, say yes.
diff --git a/drivers/xen/Makefile b/drivers/xen/Makefile
index 56592f0d6cef..37af04f1ffd9 100644
--- a/drivers/xen/Makefile
+++ b/drivers/xen/Makefile
@@ -1,2 +1,4 @@
-obj-y   += grant-table.o
+obj-y   += grant-table.o features.o events.o
 obj-y   += xenbus/
+obj-$(CONFIG_XEN_XENCOMM)       += xencomm.o
+obj-$(CONFIG_XEN_BALLOON)       += balloon.o
diff --git a/drivers/xen/balloon.c b/drivers/xen/balloon.c
new file mode 100644
index 000000000000..ab25ba6cbbb9
--- /dev/null
+++ b/drivers/xen/balloon.c
@@ -0,0 +1,712 @@
+/******************************************************************************
+ * balloon.c
+ *
+ * Xen balloon driver - enables returning/claiming memory to/from Xen.
+ *
+ * Copyright (c) 2003, B Dragovic
+ * Copyright (c) 2003-2004, M Williamson, K Fraser
+ * Copyright (c) 2005 Dan M. Smith, IBM Corporation
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License version 2
+ * as published by the Free Software Foundation; or, when distributed
+ * separately from the Linux kernel or incorporated into other
+ * software packages, subject to the following license:
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy
+ * of this source file (the "Software"), to deal in the Software without
+ * restriction, including without limitation the rights to use, copy, modify,
+ * merge, publish, distribute, sublicense, and/or sell copies of the Software,
+ * and to permit persons to whom the Software is furnished to do so, subject to
+ * the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+ * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
+ * FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS
+ * IN THE SOFTWARE.
+ */
+
+#include <linux/kernel.h>
+#include <linux/module.h>
+#include <linux/sched.h>
+#include <linux/errno.h>
+#include <linux/mm.h>
+#include <linux/bootmem.h>
+#include <linux/pagemap.h>
+#include <linux/highmem.h>
+#include <linux/mutex.h>
+#include <linux/highmem.h>
+#include <linux/list.h>
+#include <linux/sysdev.h>
+
+#include <asm/xen/hypervisor.h>
+#include <asm/page.h>
+#include <asm/pgalloc.h>
+#include <asm/pgtable.h>
+#include <asm/uaccess.h>
+#include <asm/tlb.h>
+
+#include <xen/interface/memory.h>
+#include <xen/balloon.h>
+#include <xen/xenbus.h>
+#include <xen/features.h>
+#include <xen/page.h>
+
+#define PAGES2KB(_p) ((_p)<<(PAGE_SHIFT-10))
+
+#define BALLOON_CLASS_NAME "memory"
+
+struct balloon_stats {
+        /* We aim for 'current allocation' == 'target allocation'. */
+        unsigned long current_pages;
+        unsigned long target_pages;
+        /* We may hit the hard limit in Xen. If we do then we remember it. */
+        unsigned long hard_limit;
+        /*
+         * Drivers may alter the memory reservation independently, but they
+         * must inform the balloon driver so we avoid hitting the hard limit.
+         */
+        unsigned long driver_pages;
+        /* Number of pages in high- and low-memory balloons. */
+        unsigned long balloon_low;
+        unsigned long balloon_high;
+};
+
+static DEFINE_MUTEX(balloon_mutex);
+
+static struct sys_device balloon_sysdev;
+
+static int register_balloon(struct sys_device *sysdev);
+
+/*
+ * Protects atomic reservation decrease/increase against concurrent increases.
+ * Also protects non-atomic updates of current_pages and driver_pages, and
+ * balloon lists.
+ */
+static DEFINE_SPINLOCK(balloon_lock);
+
+static struct balloon_stats balloon_stats;
+
+/* We increase/decrease in batches which fit in a page */
+static unsigned long frame_list[PAGE_SIZE / sizeof(unsigned long)];
+
+/* VM /proc information for memory */
+extern unsigned long totalram_pages;
+
+#ifdef CONFIG_HIGHMEM
+extern unsigned long totalhigh_pages;
+#define inc_totalhigh_pages() (totalhigh_pages++)
+#define dec_totalhigh_pages() (totalhigh_pages--)
+#else
+#define inc_totalhigh_pages() do {} while(0)
+#define dec_totalhigh_pages() do {} while(0)
+#endif
+
+/* List of ballooned pages, threaded through the mem_map array. */
+static LIST_HEAD(ballooned_pages);
+
+/* Main work function, always executed in process context. */
+static void balloon_process(struct work_struct *work);
+static DECLARE_WORK(balloon_worker, balloon_process);
+static struct timer_list balloon_timer;
+
+/* When ballooning out (allocating memory to return to Xen) we don't really
+   want the kernel to try too hard since that can trigger the oom killer. */
+#define GFP_BALLOON \
+        (GFP_HIGHUSER | __GFP_NOWARN | __GFP_NORETRY | __GFP_NOMEMALLOC)
+
+static void scrub_page(struct page *page)
+{
+#ifdef CONFIG_XEN_SCRUB_PAGES
+        if (PageHighMem(page)) {
+                void *v = kmap(page);
+                clear_page(v);
+                kunmap(v);
+        } else {
+                void *v = page_address(page);
+                clear_page(v);
+        }
+#endif
+}
+
+/* balloon_append: add the given page to the balloon. */
+static void balloon_append(struct page *page)
+{
+        /* Lowmem is re-populated first, so highmem pages go at list tail. */
+        if (PageHighMem(page)) {
+                list_add_tail(&page->lru, &ballooned_pages);
+                balloon_stats.balloon_high++;
+                dec_totalhigh_pages();
+        } else {
+                list_add(&page->lru, &ballooned_pages);
+                balloon_stats.balloon_low++;
+        }
+}
+
+/* balloon_retrieve: rescue a page from the balloon, if it is not empty. */
+static struct page *balloon_retrieve(void)
+{
+        struct page *page;
+
+        if (list_empty(&ballooned_pages))
+                return NULL;
+
+        page = list_entry(ballooned_pages.next, struct page, lru);
+        list_del(&page->lru);
+
+        if (PageHighMem(page)) {
+                balloon_stats.balloon_high--;
+                inc_totalhigh_pages();
+        }
+        else
+                balloon_stats.balloon_low--;
+
+        return page;
+}
+
+static struct page *balloon_first_page(void)
+{
+        if (list_empty(&ballooned_pages))
+                return NULL;
+        return list_entry(ballooned_pages.next, struct page, lru);
+}
+
+static struct page *balloon_next_page(struct page *page)
+{
+        struct list_head *next = page->lru.next;
+        if (next == &ballooned_pages)
+                return NULL;
+        return list_entry(next, struct page, lru);
+}
+
+static void balloon_alarm(unsigned long unused)
+{
+        schedule_work(&balloon_worker);
+}
+
+static unsigned long current_target(void)
+{
+        unsigned long target = min(balloon_stats.target_pages, balloon_stats.hard_limit);
+
+        target = min(target,
+                     balloon_stats.current_pages +
+                     balloon_stats.balloon_low +
+                     balloon_stats.balloon_high);
+
+        return target;
+}
+
+static int increase_reservation(unsigned long nr_pages)
+{
+        unsigned long  pfn, i, flags;
+        struct page   *page;
+        long           rc;
+        struct xen_memory_reservation reservation = {
+                .address_bits = 0,
+                .extent_order = 0,
+                .domid        = DOMID_SELF
+        };
+
+        if (nr_pages > ARRAY_SIZE(frame_list))
+                nr_pages = ARRAY_SIZE(frame_list);
+
+        spin_lock_irqsave(&balloon_lock, flags);
+
+        page = balloon_first_page();
+        for (i = 0; i < nr_pages; i++) {
+                BUG_ON(page == NULL);
+                frame_list[i] = page_to_pfn(page);;
+                page = balloon_next_page(page);
+        }
+
+        reservation.extent_start = (unsigned long)frame_list;
+        reservation.nr_extents   = nr_pages;
+        rc = HYPERVISOR_memory_op(
+                XENMEM_populate_physmap, &reservation);
+        if (rc < nr_pages) {
+                if (rc > 0) {
+                        int ret;
+
+                        /* We hit the Xen hard limit: reprobe. */
+                        reservation.nr_extents = rc;
+                        ret = HYPERVISOR_memory_op(XENMEM_decrease_reservation,
+                                        &reservation);
+                        BUG_ON(ret != rc);
+                }
+                if (rc >= 0)
+                        balloon_stats.hard_limit = (balloon_stats.current_pages + rc -
+                                                    balloon_stats.driver_pages);
+                goto out;
+        }
+
+        for (i = 0; i < nr_pages; i++) {
+                page = balloon_retrieve();
+                BUG_ON(page == NULL);
+
+                pfn = page_to_pfn(page);
+                BUG_ON(!xen_feature(XENFEAT_auto_translated_physmap) &&
+                       phys_to_machine_mapping_valid(pfn));
+
+                set_phys_to_machine(pfn, frame_list[i]);
+
+                /* Link back into the page tables if not highmem. */
+                if (pfn < max_low_pfn) {
+                        int ret;
+                        ret = HYPERVISOR_update_va_mapping(
+                                (unsigned long)__va(pfn << PAGE_SHIFT),
+                                mfn_pte(frame_list[i], PAGE_KERNEL),
+                                0);
+                        BUG_ON(ret);
+                }
+
+                /* Relinquish the page back to the allocator. */
+                ClearPageReserved(page);
+                init_page_count(page);
+                __free_page(page);
+        }
+
+        balloon_stats.current_pages += nr_pages;
+        totalram_pages = balloon_stats.current_pages;
+
+ out:
+        spin_unlock_irqrestore(&balloon_lock, flags);
+
+        return 0;
+}
+
+static int decrease_reservation(unsigned long nr_pages)
+{
+        unsigned long  pfn, i, flags;
+        struct page   *page;
+        int            need_sleep = 0;
+        int ret;
+        struct xen_memory_reservation reservation = {
+                .address_bits = 0,
+                .extent_order = 0,
+                .domid        = DOMID_SELF
+        };
+
+        if (nr_pages > ARRAY_SIZE(frame_list))
+                nr_pages = ARRAY_SIZE(frame_list);
+
+        for (i = 0; i < nr_pages; i++) {
+                if ((page = alloc_page(GFP_BALLOON)) == NULL) {
+                        nr_pages = i;
+                        need_sleep = 1;
+                        break;
+                }
+
+                pfn = page_to_pfn(page);
+                frame_list[i] = pfn_to_mfn(pfn);
+
+                scrub_page(page);
+        }
+
+        /* Ensure that ballooned highmem pages don't have kmaps. */
+        kmap_flush_unused();
+        flush_tlb_all();
+
+        spin_lock_irqsave(&balloon_lock, flags);
+
+        /* No more mappings: invalidate P2M and add to balloon. */
+        for (i = 0; i < nr_pages; i++) {
+                pfn = mfn_to_pfn(frame_list[i]);
+                set_phys_to_machine(pfn, INVALID_P2M_ENTRY);
+                balloon_append(pfn_to_page(pfn));
+        }
+
+        reservation.extent_start = (unsigned long)frame_list;
+        reservation.nr_extents   = nr_pages;
+        ret = HYPERVISOR_memory_op(XENMEM_decrease_reservation, &reservation);
+        BUG_ON(ret != nr_pages);
+
+        balloon_stats.current_pages -= nr_pages;
+        totalram_pages = balloon_stats.current_pages;
+
+        spin_unlock_irqrestore(&balloon_lock, flags);
+
+        return need_sleep;
+}
+
+/*
+ * We avoid multiple worker processes conflicting via the balloon mutex.
+ * We may of course race updates of the target counts (which are protected
+ * by the balloon lock), or with changes to the Xen hard limit, but we will
+ * recover from these in time.
+ */
+static void balloon_process(struct work_struct *work)
+{
+        int need_sleep = 0;
+        long credit;
+
+        mutex_lock(&balloon_mutex);
+
+        do {
+                credit = current_target() - balloon_stats.current_pages;
+                if (credit > 0)
+                        need_sleep = (increase_reservation(credit) != 0);
+                if (credit < 0)
+                        need_sleep = (decrease_reservation(-credit) != 0);
+
+#ifndef CONFIG_PREEMPT
+                if (need_resched())
+                        schedule();
+#endif
+        } while ((credit != 0) && !need_sleep);
+
+        /* Schedule more work if there is some still to be done. */
+        if (current_target() != balloon_stats.current_pages)
+                mod_timer(&balloon_timer, jiffies + HZ);
+
+        mutex_unlock(&balloon_mutex);
+}
+
+/* Resets the Xen limit, sets new target, and kicks off processing. */
+void balloon_set_new_target(unsigned long target)
+{
+        /* No need for lock. Not read-modify-write updates. */
+        balloon_stats.hard_limit   = ~0UL;
+        balloon_stats.target_pages = target;
+        schedule_work(&balloon_worker);
+}
+
+static struct xenbus_watch target_watch =
+{
+        .node = "memory/target"
+};
+
+/* React to a change in the target key */
+static void watch_target(struct xenbus_watch *watch,
+                         const char **vec, unsigned int len)
+{
+        unsigned long long new_target;
+        int err;
+
+        err = xenbus_scanf(XBT_NIL, "memory", "target", "%llu", &new_target);
+        if (err != 1) {
+                /* This is ok (for domain0 at least) - so just return */
+                return;
+        }
+
+        /* The given memory/target value is in KiB, so it needs converting to
+         * pages. PAGE_SHIFT converts bytes to pages, hence PAGE_SHIFT - 10.
+         */
+        balloon_set_new_target(new_target >> (PAGE_SHIFT - 10));
+}
+
+static int balloon_init_watcher(struct notifier_block *notifier,
+                                unsigned long event,
+                                void *data)
+{
+        int err;
+
+        err = register_xenbus_watch(&target_watch);
+        if (err)
+                printk(KERN_ERR "Failed to set balloon watcher\n");
+
+        return NOTIFY_DONE;
+}
+
+static struct notifier_block xenstore_notifier;
+
+static int __init balloon_init(void)
+{
+        unsigned long pfn;
+        struct page *page;
+
+        if (!is_running_on_xen())
+                return -ENODEV;
+
+        pr_info("xen_balloon: Initialising balloon driver.\n");
+
+        balloon_stats.current_pages = min(xen_start_info->nr_pages, max_pfn);
+        totalram_pages   = balloon_stats.current_pages;
+        balloon_stats.target_pages  = balloon_stats.current_pages;
+        balloon_stats.balloon_low   = 0;
+        balloon_stats.balloon_high  = 0;
+        balloon_stats.driver_pages  = 0UL;
+        balloon_stats.hard_limit    = ~0UL;
+
+        init_timer(&balloon_timer);
+        balloon_timer.data = 0;
+        balloon_timer.function = balloon_alarm;
+
+        register_balloon(&balloon_sysdev);
+
+        /* Initialise the balloon with excess memory space. */
+        for (pfn = xen_start_info->nr_pages; pfn < max_pfn; pfn++) {
+                page = pfn_to_page(pfn);
+                if (!PageReserved(page))
+                        balloon_append(page);
+        }
+
+        target_watch.callback = watch_target;
+        xenstore_notifier.notifier_call = balloon_init_watcher;
+
+        register_xenstore_notifier(&xenstore_notifier);
+
+        return 0;
+}
+
+subsys_initcall(balloon_init);
+
+static void balloon_exit(void)
+{
+    /* XXX - release balloon here */
+    return;
+}
+
+module_exit(balloon_exit);
+
+static void balloon_update_driver_allowance(long delta)
+{
+        unsigned long flags;
+
+        spin_lock_irqsave(&balloon_lock, flags);
+        balloon_stats.driver_pages += delta;
+        spin_unlock_irqrestore(&balloon_lock, flags);
+}
+
+static int dealloc_pte_fn(
+        pte_t *pte, struct page *pmd_page, unsigned long addr, void *data)
+{
+        unsigned long mfn = pte_mfn(*pte);
+        int ret;
+        struct xen_memory_reservation reservation = {
+                .nr_extents   = 1,
+                .extent_order = 0,
+                .domid        = DOMID_SELF
+        };
+        reservation.extent_start = (unsigned long)&mfn;
+        set_pte_at(&init_mm, addr, pte, __pte_ma(0ull));
+        set_phys_to_machine(__pa(addr) >> PAGE_SHIFT, INVALID_P2M_ENTRY);
+        ret = HYPERVISOR_memory_op(XENMEM_decrease_reservation, &reservation);
+        BUG_ON(ret != 1);
+        return 0;
+}
+
+static struct page **alloc_empty_pages_and_pagevec(int nr_pages)
+{
+        unsigned long vaddr, flags;
+        struct page *page, **pagevec;
+        int i, ret;
+
+        pagevec = kmalloc(sizeof(page) * nr_pages, GFP_KERNEL);
+        if (pagevec == NULL)
+                return NULL;
+
+        for (i = 0; i < nr_pages; i++) {
+                page = pagevec[i] = alloc_page(GFP_KERNEL);
+                if (page == NULL)
+                        goto err;
+
+                vaddr = (unsigned long)page_address(page);
+
+                scrub_page(page);
+
+                spin_lock_irqsave(&balloon_lock, flags);
+
+                if (xen_feature(XENFEAT_auto_translated_physmap)) {
+                        unsigned long gmfn = page_to_pfn(page);
+                        struct xen_memory_reservation reservation = {
+                                .nr_extents   = 1,
+                                .extent_order = 0,
+                                .domid        = DOMID_SELF
+                        };
+                        reservation.extent_start = (unsigned long)&gmfn;
+                        ret = HYPERVISOR_memory_op(XENMEM_decrease_reservation,
+                                                   &reservation);
+                        if (ret == 1)
+                                ret = 0; /* success */
+                } else {
+                        ret = apply_to_page_range(&init_mm, vaddr, PAGE_SIZE,
+                                                  dealloc_pte_fn, NULL);
+                }
+
+                if (ret != 0) {
+                        spin_unlock_irqrestore(&balloon_lock, flags);
+                        __free_page(page);
+                        goto err;
+                }
+
+                totalram_pages = --balloon_stats.current_pages;
+
+                spin_unlock_irqrestore(&balloon_lock, flags);
+        }
+
+ out:
+        schedule_work(&balloon_worker);
+        flush_tlb_all();
+        return pagevec;
+
+ err:
+        spin_lock_irqsave(&balloon_lock, flags);
+        while (--i >= 0)
+                balloon_append(pagevec[i]);
+        spin_unlock_irqrestore(&balloon_lock, flags);
+        kfree(pagevec);
+        pagevec = NULL;
+        goto out;
+}
+
+static void free_empty_pages_and_pagevec(struct page **pagevec, int nr_pages)
+{
+        unsigned long flags;
+        int i;
+
+        if (pagevec == NULL)
+                return;
+
+        spin_lock_irqsave(&balloon_lock, flags);
+        for (i = 0; i < nr_pages; i++) {
+                BUG_ON(page_count(pagevec[i]) != 1);
+                balloon_append(pagevec[i]);
+        }
+        spin_unlock_irqrestore(&balloon_lock, flags);
+
+        kfree(pagevec);
+
+        schedule_work(&balloon_worker);
+}
+
+static void balloon_release_driver_page(struct page *page)
+{
+        unsigned long flags;
+
+        spin_lock_irqsave(&balloon_lock, flags);
+        balloon_append(page);
+        balloon_stats.driver_pages--;
+        spin_unlock_irqrestore(&balloon_lock, flags);
+
+        schedule_work(&balloon_worker);
+}
+
+
+#define BALLOON_SHOW(name, format, args...)                     \
+        static ssize_t show_##name(struct sys_device *dev,      \
+                                   char *buf)                   \
+        {                                                       \
+                return sprintf(buf, format, ##args);            \
+        }                                                       \
+        static SYSDEV_ATTR(name, S_IRUGO, show_##name, NULL)
+
+BALLOON_SHOW(current_kb, "%lu\n", PAGES2KB(balloon_stats.current_pages));
+BALLOON_SHOW(low_kb, "%lu\n", PAGES2KB(balloon_stats.balloon_low));
+BALLOON_SHOW(high_kb, "%lu\n", PAGES2KB(balloon_stats.balloon_high));
+BALLOON_SHOW(hard_limit_kb,
+             (balloon_stats.hard_limit!=~0UL) ? "%lu\n" : "???\n",
+             (balloon_stats.hard_limit!=~0UL) ? PAGES2KB(balloon_stats.hard_limit) : 0);
+BALLOON_SHOW(driver_kb, "%lu\n", PAGES2KB(balloon_stats.driver_pages));
+
+static ssize_t show_target_kb(struct sys_device *dev, char *buf)
+{
+        return sprintf(buf, "%lu\n", PAGES2KB(balloon_stats.target_pages));
+}
+
+static ssize_t store_target_kb(struct sys_device *dev,
+                               const char *buf,
+                               size_t count)
+{
+        char memstring[64], *endchar;
+        unsigned long long target_bytes;
+
+        if (!capable(CAP_SYS_ADMIN))
+                return -EPERM;
+
+        if (count <= 1)
+                return -EBADMSG; /* runt */
+        if (count > sizeof(memstring))
+                return -EFBIG;   /* too long */
+        strcpy(memstring, buf);
+
+        target_bytes = memparse(memstring, &endchar);
+        balloon_set_new_target(target_bytes >> PAGE_SHIFT);
+
+        return count;
+}
+
+static SYSDEV_ATTR(target_kb, S_IRUGO | S_IWUSR,
+                   show_target_kb, store_target_kb);
+
+static struct sysdev_attribute *balloon_attrs[] = {
+        &attr_target_kb,
+};
+
+static struct attribute *balloon_info_attrs[] = {
+        &attr_current_kb.attr,
+        &attr_low_kb.attr,
+        &attr_high_kb.attr,
+        &attr_hard_limit_kb.attr,
+        &attr_driver_kb.attr,
+        NULL
+};
+
+static struct attribute_group balloon_info_group = {
+        .name = "info",
+        .attrs = balloon_info_attrs,
+};
+
+static struct sysdev_class balloon_sysdev_class = {
+        .name = BALLOON_CLASS_NAME,
+};
+
+static int register_balloon(struct sys_device *sysdev)
+{
+        int i, error;
+
+        error = sysdev_class_register(&balloon_sysdev_class);
+        if (error)
+                return error;
+
+        sysdev->id = 0;
+        sysdev->cls = &balloon_sysdev_class;
+
+        error = sysdev_register(sysdev);
+        if (error) {
+                sysdev_class_unregister(&balloon_sysdev_class);
+                return error;
+        }
+
+        for (i = 0; i < ARRAY_SIZE(balloon_attrs); i++) {
+                error = sysdev_create_file(sysdev, balloon_attrs[i]);
+                if (error)
+                        goto fail;
+        }
+
+        error = sysfs_create_group(&sysdev->kobj, &balloon_info_group);
+        if (error)
+                goto fail;
+
+        return 0;
+
+ fail:
+        while (--i >= 0)
+                sysdev_remove_file(sysdev, balloon_attrs[i]);
+        sysdev_unregister(sysdev);
+        sysdev_class_unregister(&balloon_sysdev_class);
+        return error;
+}
+
+static void unregister_balloon(struct sys_device *sysdev)
+{
+        int i;
+
+        sysfs_remove_group(&sysdev->kobj, &balloon_info_group);
+        for (i = 0; i < ARRAY_SIZE(balloon_attrs); i++)
+                sysdev_remove_file(sysdev, balloon_attrs[i]);
+        sysdev_unregister(sysdev);
+        sysdev_class_unregister(&balloon_sysdev_class);
+}
+
+static void balloon_sysfs_exit(void)
+{
+        unregister_balloon(&balloon_sysdev);
+}
+
+MODULE_LICENSE("GPL");
diff --git a/drivers/xen/events.c b/drivers/xen/events.c
new file mode 100644
index 000000000000..4f0f22b020ea
--- /dev/null
+++ b/drivers/xen/events.c
@@ -0,0 +1,674 @@
+/*
+ * Xen event channels
+ *
+ * Xen models interrupts with abstract event channels.  Because each
+ * domain gets 1024 event channels, but NR_IRQ is not that large, we
+ * must dynamically map irqs<->event channels.  The event channels
+ * interface with the rest of the kernel by defining a xen interrupt
+ * chip.  When an event is recieved, it is mapped to an irq and sent
+ * through the normal interrupt processing path.
+ *
+ * There are four kinds of events which can be mapped to an event
+ * channel:
+ *
+ * 1. Inter-domain notifications.  This includes all the virtual
+ *    device events, since they're driven by front-ends in another domain
+ *    (typically dom0).
+ * 2. VIRQs, typically used for timers.  These are per-cpu events.
+ * 3. IPIs.
+ * 4. Hardware interrupts. Not supported at present.
+ *
+ * Jeremy Fitzhardinge <jeremy@xensource.com>, XenSource Inc, 2007
+ */
+
+#include <linux/linkage.h>
+#include <linux/interrupt.h>
+#include <linux/irq.h>
+#include <linux/module.h>
+#include <linux/string.h>
+
+#include <asm/ptrace.h>
+#include <asm/irq.h>
+#include <asm/sync_bitops.h>
+#include <asm/xen/hypercall.h>
+#include <asm/xen/hypervisor.h>
+
+#include <xen/xen-ops.h>
+#include <xen/events.h>
+#include <xen/interface/xen.h>
+#include <xen/interface/event_channel.h>
+
+/*
+ * This lock protects updates to the following mapping and reference-count
+ * arrays. The lock does not need to be acquired to read the mapping tables.
+ */
+static DEFINE_SPINLOCK(irq_mapping_update_lock);
+
+/* IRQ <-> VIRQ mapping. */
+static DEFINE_PER_CPU(int, virq_to_irq[NR_VIRQS]) = {[0 ... NR_VIRQS-1] = -1};
+
+/* IRQ <-> IPI mapping */
+static DEFINE_PER_CPU(int, ipi_to_irq[XEN_NR_IPIS]) = {[0 ... XEN_NR_IPIS-1] = -1};
+
+/* Packed IRQ information: binding type, sub-type index, and event channel. */
+struct packed_irq
+{
+        unsigned short evtchn;
+        unsigned char index;
+        unsigned char type;
+};
+
+static struct packed_irq irq_info[NR_IRQS];
+
+/* Binding types. */
+enum {
+        IRQT_UNBOUND,
+        IRQT_PIRQ,
+        IRQT_VIRQ,
+        IRQT_IPI,
+        IRQT_EVTCHN
+};
+
+/* Convenient shorthand for packed representation of an unbound IRQ. */
+#define IRQ_UNBOUND     mk_irq_info(IRQT_UNBOUND, 0, 0)
+
+static int evtchn_to_irq[NR_EVENT_CHANNELS] = {
+        [0 ... NR_EVENT_CHANNELS-1] = -1
+};
+static unsigned long cpu_evtchn_mask[NR_CPUS][NR_EVENT_CHANNELS/BITS_PER_LONG];
+static u8 cpu_evtchn[NR_EVENT_CHANNELS];
+
+/* Reference counts for bindings to IRQs. */
+static int irq_bindcount[NR_IRQS];
+
+/* Xen will never allocate port zero for any purpose. */
+#define VALID_EVTCHN(chn)       ((chn) != 0)
+
+/*
+ * Force a proper event-channel callback from Xen after clearing the
+ * callback mask. We do this in a very simple manner, by making a call
+ * down into Xen. The pending flag will be checked by Xen on return.
+ */
+void force_evtchn_callback(void)
+{
+        (void)HYPERVISOR_xen_version(0, NULL);
+}
+EXPORT_SYMBOL_GPL(force_evtchn_callback);
+
+static struct irq_chip xen_dynamic_chip;
+
+/* Constructor for packed IRQ information. */
+static inline struct packed_irq mk_irq_info(u32 type, u32 index, u32 evtchn)
+{
+        return (struct packed_irq) { evtchn, index, type };
+}
+
+/*
+ * Accessors for packed IRQ information.
+ */
+static inline unsigned int evtchn_from_irq(int irq)
+{
+        return irq_info[irq].evtchn;
+}
+
+static inline unsigned int index_from_irq(int irq)
+{
+        return irq_info[irq].index;
+}
+
+static inline unsigned int type_from_irq(int irq)
+{
+        return irq_info[irq].type;
+}
+
+static inline unsigned long active_evtchns(unsigned int cpu,
+                                           struct shared_info *sh,
+                                           unsigned int idx)
+{
+        return (sh->evtchn_pending[idx] &
+                cpu_evtchn_mask[cpu][idx] &
+                ~sh->evtchn_mask[idx]);
+}
+
+static void bind_evtchn_to_cpu(unsigned int chn, unsigned int cpu)
+{
+        int irq = evtchn_to_irq[chn];
+
+        BUG_ON(irq == -1);
+#ifdef CONFIG_SMP
+        irq_desc[irq].affinity = cpumask_of_cpu(cpu);
+#endif
+
+        __clear_bit(chn, cpu_evtchn_mask[cpu_evtchn[chn]]);
+        __set_bit(chn, cpu_evtchn_mask[cpu]);
+
+        cpu_evtchn[chn] = cpu;
+}
+
+static void init_evtchn_cpu_bindings(void)
+{
+#ifdef CONFIG_SMP
+        int i;
+        /* By default all event channels notify CPU#0. */
+        for (i = 0; i < NR_IRQS; i++)
+                irq_desc[i].affinity = cpumask_of_cpu(0);
+#endif
+
+        memset(cpu_evtchn, 0, sizeof(cpu_evtchn));
+        memset(cpu_evtchn_mask[0], ~0, sizeof(cpu_evtchn_mask[0]));
+}
+
+static inline unsigned int cpu_from_evtchn(unsigned int evtchn)
+{
+        return cpu_evtchn[evtchn];
+}
+
+static inline void clear_evtchn(int port)
+{
+        struct shared_info *s = HYPERVISOR_shared_info;
+        sync_clear_bit(port, &s->evtchn_pending[0]);
+}
+
+static inline void set_evtchn(int port)
+{
+        struct shared_info *s = HYPERVISOR_shared_info;
+        sync_set_bit(port, &s->evtchn_pending[0]);
+}
+
+
+/**
+ * notify_remote_via_irq - send event to remote end of event channel via irq
+ * @irq: irq of event channel to send event to
+ *
+ * Unlike notify_remote_via_evtchn(), this is safe to use across
+ * save/restore. Notifications on a broken connection are silently
+ * dropped.
+ */
+void notify_remote_via_irq(int irq)
+{
+        int evtchn = evtchn_from_irq(irq);
+
+        if (VALID_EVTCHN(evtchn))
+                notify_remote_via_evtchn(evtchn);
+}
+EXPORT_SYMBOL_GPL(notify_remote_via_irq);
+
+static void mask_evtchn(int port)
+{
+        struct shared_info *s = HYPERVISOR_shared_info;
+        sync_set_bit(port, &s->evtchn_mask[0]);
+}
+
+static void unmask_evtchn(int port)
+{
+        struct shared_info *s = HYPERVISOR_shared_info;
+        unsigned int cpu = get_cpu();
+
+        BUG_ON(!irqs_disabled());
+
+        /* Slow path (hypercall) if this is a non-local port. */
+        if (unlikely(cpu != cpu_from_evtchn(port))) {
+                struct evtchn_unmask unmask = { .port = port };
+                (void)HYPERVISOR_event_channel_op(EVTCHNOP_unmask, &unmask);
+        } else {
+                struct vcpu_info *vcpu_info = __get_cpu_var(xen_vcpu);
+
+                sync_clear_bit(port, &s->evtchn_mask[0]);
+
+                /*
+                 * The following is basically the equivalent of
+                 * 'hw_resend_irq'. Just like a real IO-APIC we 'lose
+                 * the interrupt edge' if the channel is masked.
+                 */
+                if (sync_test_bit(port, &s->evtchn_pending[0]) &&
+                    !sync_test_and_set_bit(port / BITS_PER_LONG,
+                                           &vcpu_info->evtchn_pending_sel))
+                        vcpu_info->evtchn_upcall_pending = 1;
+        }
+
+        put_cpu();
+}
+
+static int find_unbound_irq(void)
+{
+        int irq;
+
+        /* Only allocate from dynirq range */
+        for (irq = 0; irq < NR_IRQS; irq++)
+                if (irq_bindcount[irq] == 0)
+                        break;
+
+        if (irq == NR_IRQS)
+                panic("No available IRQ to bind to: increase NR_IRQS!\n");
+
+        return irq;
+}
+
+int bind_evtchn_to_irq(unsigned int evtchn)
+{
+        int irq;
+
+        spin_lock(&irq_mapping_update_lock);
+
+        irq = evtchn_to_irq[evtchn];
+
+        if (irq == -1) {
+                irq = find_unbound_irq();
+
+                dynamic_irq_init(irq);
+                set_irq_chip_and_handler_name(irq, &xen_dynamic_chip,
+                                              handle_level_irq, "event");
+
+                evtchn_to_irq[evtchn] = irq;
+                irq_info[irq] = mk_irq_info(IRQT_EVTCHN, 0, evtchn);
+        }
+
+        irq_bindcount[irq]++;
+
+        spin_unlock(&irq_mapping_update_lock);
+
+        return irq;
+}
+EXPORT_SYMBOL_GPL(bind_evtchn_to_irq);
+
+static int bind_ipi_to_irq(unsigned int ipi, unsigned int cpu)
+{
+        struct evtchn_bind_ipi bind_ipi;
+        int evtchn, irq;
+
+        spin_lock(&irq_mapping_update_lock);
+
+        irq = per_cpu(ipi_to_irq, cpu)[ipi];
+        if (irq == -1) {
+                irq = find_unbound_irq();
+                if (irq < 0)
+                        goto out;
+
+                dynamic_irq_init(irq);
+                set_irq_chip_and_handler_name(irq, &xen_dynamic_chip,
+                                              handle_level_irq, "ipi");
+
+                bind_ipi.vcpu = cpu;
+                if (HYPERVISOR_event_channel_op(EVTCHNOP_bind_ipi,
+                                                &bind_ipi) != 0)
+                        BUG();
+                evtchn = bind_ipi.port;
+
+                evtchn_to_irq[evtchn] = irq;
+                irq_info[irq] = mk_irq_info(IRQT_IPI, ipi, evtchn);
+
+                per_cpu(ipi_to_irq, cpu)[ipi] = irq;
+
+                bind_evtchn_to_cpu(evtchn, cpu);
+        }
+
+        irq_bindcount[irq]++;
+
+ out:
+        spin_unlock(&irq_mapping_update_lock);
+        return irq;
+}
+
+
+static int bind_virq_to_irq(unsigned int virq, unsigned int cpu)
+{
+        struct evtchn_bind_virq bind_virq;
+        int evtchn, irq;
+
+        spin_lock(&irq_mapping_update_lock);
+
+        irq = per_cpu(virq_to_irq, cpu)[virq];
+
+        if (irq == -1) {
+                bind_virq.virq = virq;
+                bind_virq.vcpu = cpu;
+                if (HYPERVISOR_event_channel_op(EVTCHNOP_bind_virq,
+                                                &bind_virq) != 0)
+                        BUG();
+                evtchn = bind_virq.port;
+
+                irq = find_unbound_irq();
+
+                dynamic_irq_init(irq);
+                set_irq_chip_and_handler_name(irq, &xen_dynamic_chip,
+                                              handle_level_irq, "virq");
+
+                evtchn_to_irq[evtchn] = irq;
+                irq_info[irq] = mk_irq_info(IRQT_VIRQ, virq, evtchn);
+
+                per_cpu(virq_to_irq, cpu)[virq] = irq;
+
+                bind_evtchn_to_cpu(evtchn, cpu);
+        }
+
+        irq_bindcount[irq]++;
+
+        spin_unlock(&irq_mapping_update_lock);
+
+        return irq;
+}
+
+static void unbind_from_irq(unsigned int irq)
+{
+        struct evtchn_close close;
+        int evtchn = evtchn_from_irq(irq);
+
+        spin_lock(&irq_mapping_update_lock);
+
+        if (VALID_EVTCHN(evtchn) && (--irq_bindcount[irq] == 0)) {
+                close.port = evtchn;
+                if (HYPERVISOR_event_channel_op(EVTCHNOP_close, &close) != 0)
+                        BUG();
+
+                switch (type_from_irq(irq)) {
+                case IRQT_VIRQ:
+                        per_cpu(virq_to_irq, cpu_from_evtchn(evtchn))
+                                [index_from_irq(irq)] = -1;
+                        break;
+                default:
+                        break;
+                }
+
+                /* Closed ports are implicitly re-bound to VCPU0. */
+                bind_evtchn_to_cpu(evtchn, 0);
+
+                evtchn_to_irq[evtchn] = -1;
+                irq_info[irq] = IRQ_UNBOUND;
+
+                dynamic_irq_init(irq);
+        }
+
+        spin_unlock(&irq_mapping_update_lock);
+}
+
+int bind_evtchn_to_irqhandler(unsigned int evtchn,
+                              irq_handler_t handler,
+                              unsigned long irqflags,
+                              const char *devname, void *dev_id)
+{
+        unsigned int irq;
+        int retval;
+
+        irq = bind_evtchn_to_irq(evtchn);
+        retval = request_irq(irq, handler, irqflags, devname, dev_id);
+        if (retval != 0) {
+                unbind_from_irq(irq);
+                return retval;
+        }
+
+        return irq;
+}
+EXPORT_SYMBOL_GPL(bind_evtchn_to_irqhandler);
+
+int bind_virq_to_irqhandler(unsigned int virq, unsigned int cpu,
+                            irq_handler_t handler,
+                            unsigned long irqflags, const char *devname, void *dev_id)
+{
+        unsigned int irq;
+        int retval;
+
+        irq = bind_virq_to_irq(virq, cpu);
+        retval = request_irq(irq, handler, irqflags, devname, dev_id);
+        if (retval != 0) {
+                unbind_from_irq(irq);
+                return retval;
+        }
+
+        return irq;
+}
+EXPORT_SYMBOL_GPL(bind_virq_to_irqhandler);
+
+int bind_ipi_to_irqhandler(enum ipi_vector ipi,
+                           unsigned int cpu,
+                           irq_handler_t handler,
+                           unsigned long irqflags,
+                           const char *devname,
+                           void *dev_id)
+{
+        int irq, retval;
+
+        irq = bind_ipi_to_irq(ipi, cpu);
+        if (irq < 0)
+                return irq;
+
+        retval = request_irq(irq, handler, irqflags, devname, dev_id);
+        if (retval != 0) {
+                unbind_from_irq(irq);
+                return retval;
+        }
+
+        return irq;
+}
+
+void unbind_from_irqhandler(unsigned int irq, void *dev_id)
+{
+        free_irq(irq, dev_id);
+        unbind_from_irq(irq);
+}
+EXPORT_SYMBOL_GPL(unbind_from_irqhandler);
+
+void xen_send_IPI_one(unsigned int cpu, enum ipi_vector vector)
+{
+        int irq = per_cpu(ipi_to_irq, cpu)[vector];
+        BUG_ON(irq < 0);
+        notify_remote_via_irq(irq);
+}
+
+irqreturn_t xen_debug_interrupt(int irq, void *dev_id)
+{
+        struct shared_info *sh = HYPERVISOR_shared_info;
+        int cpu = smp_processor_id();
+        int i;
+        unsigned long flags;
+        static DEFINE_SPINLOCK(debug_lock);
+
+        spin_lock_irqsave(&debug_lock, flags);
+
+        printk("vcpu %d\n  ", cpu);
+
+        for_each_online_cpu(i) {
+                struct vcpu_info *v = per_cpu(xen_vcpu, i);
+                printk("%d: masked=%d pending=%d event_sel %08lx\n  ", i,
+                        (get_irq_regs() && i == cpu) ? xen_irqs_disabled(get_irq_regs()) : v->evtchn_upcall_mask,
+                        v->evtchn_upcall_pending,
+                        v->evtchn_pending_sel);
+        }
+        printk("pending:\n   ");
+        for(i = ARRAY_SIZE(sh->evtchn_pending)-1; i >= 0; i--)
+                printk("%08lx%s", sh->evtchn_pending[i],
+                        i % 8 == 0 ? "\n   " : " ");
+        printk("\nmasks:\n   ");
+        for(i = ARRAY_SIZE(sh->evtchn_mask)-1; i >= 0; i--)
+                printk("%08lx%s", sh->evtchn_mask[i],
+                        i % 8 == 0 ? "\n   " : " ");
+
+        printk("\nunmasked:\n   ");
+        for(i = ARRAY_SIZE(sh->evtchn_mask)-1; i >= 0; i--)
+                printk("%08lx%s", sh->evtchn_pending[i] & ~sh->evtchn_mask[i],
+                        i % 8 == 0 ? "\n   " : " ");
+
+        printk("\npending list:\n");
+        for(i = 0; i < NR_EVENT_CHANNELS; i++) {
+                if (sync_test_bit(i, sh->evtchn_pending)) {
+                        printk("  %d: event %d -> irq %d\n",
+                                cpu_evtchn[i], i,
+                                evtchn_to_irq[i]);
+                }
+        }
+
+        spin_unlock_irqrestore(&debug_lock, flags);
+
+        return IRQ_HANDLED;
+}
+
+
+/*
+ * Search the CPUs pending events bitmasks.  For each one found, map
+ * the event number to an irq, and feed it into do_IRQ() for
+ * handling.
+ *
+ * Xen uses a two-level bitmap to speed searching.  The first level is
+ * a bitset of words which contain pending event bits.  The second
+ * level is a bitset of pending events themselves.
+ */
+void xen_evtchn_do_upcall(struct pt_regs *regs)
+{
+        int cpu = get_cpu();
+        struct shared_info *s = HYPERVISOR_shared_info;
+        struct vcpu_info *vcpu_info = __get_cpu_var(xen_vcpu);
+        static DEFINE_PER_CPU(unsigned, nesting_count);
+        unsigned count;
+
+        do {
+                unsigned long pending_words;
+
+                vcpu_info->evtchn_upcall_pending = 0;
+
+                if (__get_cpu_var(nesting_count)++)
+                        goto out;
+
+#ifndef CONFIG_X86 /* No need for a barrier -- XCHG is a barrier on x86. */
+                /* Clear master flag /before/ clearing selector flag. */
+                rmb();
+#endif
+                pending_words = xchg(&vcpu_info->evtchn_pending_sel, 0);
+                while (pending_words != 0) {
+                        unsigned long pending_bits;
+                        int word_idx = __ffs(pending_words);
+                        pending_words &= ~(1UL << word_idx);
+
+                        while ((pending_bits = active_evtchns(cpu, s, word_idx)) != 0) {
+                                int bit_idx = __ffs(pending_bits);
+                                int port = (word_idx * BITS_PER_LONG) + bit_idx;
+                                int irq = evtchn_to_irq[port];
+
+                                if (irq != -1)
+                                        xen_do_IRQ(irq, regs);
+                        }
+                }
+
+                BUG_ON(!irqs_disabled());
+
+                count = __get_cpu_var(nesting_count);
+                __get_cpu_var(nesting_count) = 0;
+        } while(count != 1);
+
+out:
+        put_cpu();
+}
+
+/* Rebind an evtchn so that it gets delivered to a specific cpu */
+static void rebind_irq_to_cpu(unsigned irq, unsigned tcpu)
+{
+        struct evtchn_bind_vcpu bind_vcpu;
+        int evtchn = evtchn_from_irq(irq);
+
+        if (!VALID_EVTCHN(evtchn))
+                return;
+
+        /* Send future instances of this interrupt to other vcpu. */
+        bind_vcpu.port = evtchn;
+        bind_vcpu.vcpu = tcpu;
+
+        /*
+         * If this fails, it usually just indicates that we're dealing with a
+         * virq or IPI channel, which don't actually need to be rebound. Ignore
+         * it, but don't do the xenlinux-level rebind in that case.
+         */
+        if (HYPERVISOR_event_channel_op(EVTCHNOP_bind_vcpu, &bind_vcpu) >= 0)
+                bind_evtchn_to_cpu(evtchn, tcpu);
+}
+
+
+static void set_affinity_irq(unsigned irq, cpumask_t dest)
+{
+        unsigned tcpu = first_cpu(dest);
+        rebind_irq_to_cpu(irq, tcpu);
+}
+
+int resend_irq_on_evtchn(unsigned int irq)
+{
+        int masked, evtchn = evtchn_from_irq(irq);
+        struct shared_info *s = HYPERVISOR_shared_info;
+
+        if (!VALID_EVTCHN(evtchn))
+                return 1;
+
+        masked = sync_test_and_set_bit(evtchn, s->evtchn_mask);
+        sync_set_bit(evtchn, s->evtchn_pending);
+        if (!masked)
+                unmask_evtchn(evtchn);
+
+        return 1;
+}
+
+static void enable_dynirq(unsigned int irq)
+{
+        int evtchn = evtchn_from_irq(irq);
+
+        if (VALID_EVTCHN(evtchn))
+                unmask_evtchn(evtchn);
+}
+
+static void disable_dynirq(unsigned int irq)
+{
+        int evtchn = evtchn_from_irq(irq);
+
+        if (VALID_EVTCHN(evtchn))
+                mask_evtchn(evtchn);
+}
+
+static void ack_dynirq(unsigned int irq)
+{
+        int evtchn = evtchn_from_irq(irq);
+
+        move_native_irq(irq);
+
+        if (VALID_EVTCHN(evtchn))
+                clear_evtchn(evtchn);
+}
+
+static int retrigger_dynirq(unsigned int irq)
+{
+        int evtchn = evtchn_from_irq(irq);
+        struct shared_info *sh = HYPERVISOR_shared_info;
+        int ret = 0;
+
+        if (VALID_EVTCHN(evtchn)) {
+                int masked;
+
+                masked = sync_test_and_set_bit(evtchn, sh->evtchn_mask);
+                sync_set_bit(evtchn, sh->evtchn_pending);
+                if (!masked)
+                        unmask_evtchn(evtchn);
+                ret = 1;
+        }
+
+        return ret;
+}
+
+static struct irq_chip xen_dynamic_chip __read_mostly = {
+        .name           = "xen-dyn",
+        .mask           = disable_dynirq,
+        .unmask         = enable_dynirq,
+        .ack            = ack_dynirq,
+        .set_affinity   = set_affinity_irq,
+        .retrigger      = retrigger_dynirq,
+};
+
+void __init xen_init_IRQ(void)
+{
+        int i;
+
+        init_evtchn_cpu_bindings();
+
+        /* No event channels are 'live' right now. */
+        for (i = 0; i < NR_EVENT_CHANNELS; i++)
+                mask_evtchn(i);
+
+        /* Dynamic IRQ space is currently unbound. Zero the refcnts. */
+        for (i = 0; i < NR_IRQS; i++)
+                irq_bindcount[i] = 0;
+
+        irq_ctx_init(smp_processor_id());
+}
diff --git a/drivers/xen/features.c b/drivers/xen/features.c
new file mode 100644
index 000000000000..0707714e40d6
--- /dev/null
+++ b/drivers/xen/features.c
@@ -0,0 +1,29 @@
+/******************************************************************************
+ * features.c
+ *
+ * Xen feature flags.
+ *
+ * Copyright (c) 2006, Ian Campbell, XenSource Inc.
+ */
+#include <linux/types.h>
+#include <linux/cache.h>
+#include <linux/module.h>
+#include <asm/xen/hypervisor.h>
+#include <xen/features.h>
+
+u8 xen_features[XENFEAT_NR_SUBMAPS * 32] __read_mostly;
+EXPORT_SYMBOL_GPL(xen_features);
+
+void xen_setup_features(void)
+{
+        struct xen_feature_info fi;
+        int i, j;
+
+        for (i = 0; i < XENFEAT_NR_SUBMAPS; i++) {
+                fi.submap_idx = i;
+                if (HYPERVISOR_xen_version(XENVER_get_features, &fi) < 0)
+                        break;
+                for (j = 0; j < 32; j++)
+                        xen_features[i * 32 + j] = !!(fi.submap & 1<<j);
+        }
+}
diff --git a/drivers/xen/grant-table.c b/drivers/xen/grant-table.c
index d85dc6d41c2a..52b6b41b909d 100644
--- a/drivers/xen/grant-table.c
+++ b/drivers/xen/grant-table.c
@@ -439,24 +439,6 @@ static inline unsigned int max_nr_grant_frames(void)
         return xen_max;
 }
 
-static int map_pte_fn(pte_t *pte, struct page *pmd_page,
-                      unsigned long addr, void *data)
-{
-        unsigned long **frames = (unsigned long **)data;
-
-        set_pte_at(&init_mm, addr, pte, mfn_pte((*frames)[0], PAGE_KERNEL));
-        (*frames)++;
-        return 0;
-}
-
-static int unmap_pte_fn(pte_t *pte, struct page *pmd_page,
-                        unsigned long addr, void *data)
-{
-
-        set_pte_at(&init_mm, addr, pte, __pte(0));
-        return 0;
-}
-
 static int gnttab_map(unsigned int start_idx, unsigned int end_idx)
 {
         struct gnttab_setup_table setup;
@@ -470,7 +452,7 @@ static int gnttab_map(unsigned int start_idx, unsigned int end_idx)
 
         setup.dom        = DOMID_SELF;
         setup.nr_frames  = nr_gframes;
-        setup.frame_list = frames;
+        set_xen_guest_handle(setup.frame_list, frames);
 
         rc = HYPERVISOR_grant_table_op(GNTTABOP_setup_table, &setup, 1);
         if (rc == -ENOSYS) {
@@ -480,17 +462,9 @@ static int gnttab_map(unsigned int start_idx, unsigned int end_idx)
 
         BUG_ON(rc || setup.status);
 
-        if (shared == NULL) {
-                struct vm_struct *area;
-                area = alloc_vm_area(PAGE_SIZE * max_nr_grant_frames());
-                BUG_ON(area == NULL);
-                shared = area->addr;
-        }
-        rc = apply_to_page_range(&init_mm, (unsigned long)shared,
-                                 PAGE_SIZE * nr_gframes,
-                                 map_pte_fn, &frames);
+        rc = arch_gnttab_map_shared(frames, nr_gframes, max_nr_grant_frames(),
+                                    &shared);
         BUG_ON(rc);
-        frames -= nr_gframes; /* adjust after map_pte_fn() */
 
         kfree(frames);
 
@@ -506,10 +480,7 @@ static int gnttab_resume(void)
 
 static int gnttab_suspend(void)
 {
-        apply_to_page_range(&init_mm, (unsigned long)shared,
-                            PAGE_SIZE * nr_grant_frames,
-                            unmap_pte_fn, NULL);
-
+        arch_gnttab_unmap_shared(shared, nr_grant_frames);
         return 0;
 }
 
diff --git a/drivers/xen/xenbus/xenbus_client.c b/drivers/xen/xenbus/xenbus_client.c
index 9fd2f70ab46d..0f86b0ff7879 100644
--- a/drivers/xen/xenbus/xenbus_client.c
+++ b/drivers/xen/xenbus/xenbus_client.c
@@ -399,7 +399,7 @@ int xenbus_map_ring_valloc(struct xenbus_device *dev, int gnt_ref, void **vaddr)
 
         *vaddr = NULL;
 
-        area = alloc_vm_area(PAGE_SIZE);
+        area = xen_alloc_vm_area(PAGE_SIZE);
         if (!area)
                 return -ENOMEM;
 
@@ -409,7 +409,7 @@ int xenbus_map_ring_valloc(struct xenbus_device *dev, int gnt_ref, void **vaddr)
                 BUG();
 
         if (op.status != GNTST_okay) {
-                free_vm_area(area);
+                xen_free_vm_area(area);
                 xenbus_dev_fatal(dev, op.status,
                                  "mapping in shared page %d from domain %d",
                                  gnt_ref, dev->otherend_id);
@@ -508,7 +508,7 @@ int xenbus_unmap_ring_vfree(struct xenbus_device *dev, void *vaddr)
                 BUG();
 
         if (op.status == GNTST_okay)
-                free_vm_area(area);
+                xen_free_vm_area(area);
         else
                 xenbus_dev_error(dev, op.status,
                                  "unmapping page at handle %d error %d",
diff --git a/drivers/xen/xenbus/xenbus_probe.c b/drivers/xen/xenbus/xenbus_probe.c
index 4750de316ad3..57ceb5346b74 100644
--- a/drivers/xen/xenbus/xenbus_probe.c
+++ b/drivers/xen/xenbus/xenbus_probe.c
@@ -88,6 +88,16 @@ int xenbus_match(struct device *_dev, struct device_driver *_drv)
         return match_device(drv->ids, to_xenbus_device(_dev)) != NULL;
 }
 
+static int xenbus_uevent(struct device *_dev, struct kobj_uevent_env *env)
+{
+        struct xenbus_device *dev = to_xenbus_device(_dev);
+
+        if (add_uevent_var(env, "MODALIAS=xen:%s", dev->devicetype))
+                return -ENOMEM;
+
+        return 0;
+}
+
 /* device/<type>/<id> => <type>-<id> */
 static int frontend_bus_id(char bus_id[BUS_ID_SIZE], const char *nodename)
 {
@@ -166,6 +176,7 @@ static struct xen_bus_type xenbus_frontend = {
         .bus = {
                 .name     = "xen",
                 .match    = xenbus_match,
+                .uevent   = xenbus_uevent,
                 .probe    = xenbus_dev_probe,
                 .remove   = xenbus_dev_remove,
                 .shutdown = xenbus_dev_shutdown,
@@ -438,6 +449,12 @@ static ssize_t xendev_show_devtype(struct device *dev,
 }
 DEVICE_ATTR(devtype, S_IRUSR | S_IRGRP | S_IROTH, xendev_show_devtype, NULL);
 
+static ssize_t xendev_show_modalias(struct device *dev,
+                                    struct device_attribute *attr, char *buf)
+{
+        return sprintf(buf, "xen:%s\n", to_xenbus_device(dev)->devicetype);
+}
+DEVICE_ATTR(modalias, S_IRUSR | S_IRGRP | S_IROTH, xendev_show_modalias, NULL);
 
 int xenbus_probe_node(struct xen_bus_type *bus,
                       const char *type,
@@ -492,10 +509,16 @@ int xenbus_probe_node(struct xen_bus_type *bus,
 
         err = device_create_file(&xendev->dev, &dev_attr_devtype);
         if (err)
-                goto fail_remove_file;
+                goto fail_remove_nodename;
+
+        err = device_create_file(&xendev->dev, &dev_attr_modalias);
+        if (err)
+                goto fail_remove_devtype;
 
         return 0;
-fail_remove_file:
+fail_remove_devtype:
+        device_remove_file(&xendev->dev, &dev_attr_devtype);
+fail_remove_nodename:
         device_remove_file(&xendev->dev, &dev_attr_nodename);
 fail_unregister:
         device_unregister(&xendev->dev);
@@ -846,6 +869,7 @@ static int is_disconnected_device(struct device *dev, void *data)
 {
         struct xenbus_device *xendev = to_xenbus_device(dev);
         struct device_driver *drv = data;
+        struct xenbus_driver *xendrv;
 
         /*
          * A device with no driver will never connect. We care only about
@@ -858,7 +882,9 @@ static int is_disconnected_device(struct device *dev, void *data)
         if (drv && (dev->driver != drv))
                 return 0;
 
-        return (xendev->state != XenbusStateConnected);
+        xendrv = to_xenbus_driver(dev->driver);
+        return (xendev->state != XenbusStateConnected ||
+                (xendrv->is_ready && !xendrv->is_ready(xendev)));
 }
 
 static int exists_disconnected_device(struct device_driver *drv)
diff --git a/drivers/xen/xencomm.c b/drivers/xen/xencomm.c
new file mode 100644
index 000000000000..797cb4e31f07
--- /dev/null
+++ b/drivers/xen/xencomm.c
@@ -0,0 +1,232 @@
+/*
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307 USA
+ *
+ * Copyright (C) IBM Corp. 2006
+ *
+ * Authors: Hollis Blanchard <hollisb@us.ibm.com>
+ */
+
+#include <linux/gfp.h>
+#include <linux/mm.h>
+#include <asm/page.h>
+#include <xen/xencomm.h>
+#include <xen/interface/xen.h>
+#ifdef __ia64__
+#include <asm/xen/xencomm.h>    /* for is_kern_addr() */
+#endif
+
+#ifdef HAVE_XEN_PLATFORM_COMPAT_H
+#include <xen/platform-compat.h>
+#endif
+
+static int xencomm_init(struct xencomm_desc *desc,
+                        void *buffer, unsigned long bytes)
+{
+        unsigned long recorded = 0;
+        int i = 0;
+
+        while ((recorded < bytes) && (i < desc->nr_addrs)) {
+                unsigned long vaddr = (unsigned long)buffer + recorded;
+                unsigned long paddr;
+                int offset;
+                int chunksz;
+
+                offset = vaddr % PAGE_SIZE; /* handle partial pages */
+                chunksz = min(PAGE_SIZE - offset, bytes - recorded);
+
+                paddr = xencomm_vtop(vaddr);
+                if (paddr == ~0UL) {
+                        printk(KERN_DEBUG "%s: couldn't translate vaddr %lx\n",
+                               __func__, vaddr);
+                        return -EINVAL;
+                }
+
+                desc->address[i++] = paddr;
+                recorded += chunksz;
+        }
+
+        if (recorded < bytes) {
+                printk(KERN_DEBUG
+                       "%s: could only translate %ld of %ld bytes\n",
+                       __func__, recorded, bytes);
+                return -ENOSPC;
+        }
+
+        /* mark remaining addresses invalid (just for safety) */
+        while (i < desc->nr_addrs)
+                desc->address[i++] = XENCOMM_INVALID;
+
+        desc->magic = XENCOMM_MAGIC;
+
+        return 0;
+}
+
+static struct xencomm_desc *xencomm_alloc(gfp_t gfp_mask,
+                                          void *buffer, unsigned long bytes)
+{
+        struct xencomm_desc *desc;
+        unsigned long buffer_ulong = (unsigned long)buffer;
+        unsigned long start = buffer_ulong & PAGE_MASK;
+        unsigned long end = (buffer_ulong + bytes) | ~PAGE_MASK;
+        unsigned long nr_addrs = (end - start + 1) >> PAGE_SHIFT;
+        unsigned long size = sizeof(*desc) +
+                sizeof(desc->address[0]) * nr_addrs;
+
+        /*
+         * slab allocator returns at least sizeof(void*) aligned pointer.
+         * When sizeof(*desc) > sizeof(void*), struct xencomm_desc might
+         * cross page boundary.
+         */
+        if (sizeof(*desc) > sizeof(void *)) {
+                unsigned long order = get_order(size);
+                desc = (struct xencomm_desc *)__get_free_pages(gfp_mask,
+                                                               order);
+                if (desc == NULL)
+                        return NULL;
+
+                desc->nr_addrs =
+                        ((PAGE_SIZE << order) - sizeof(struct xencomm_desc)) /
+                        sizeof(*desc->address);
+        } else {
+                desc = kmalloc(size, gfp_mask);
+                if (desc == NULL)
+                        return NULL;
+
+                desc->nr_addrs = nr_addrs;
+        }
+        return desc;
+}
+
+void xencomm_free(struct xencomm_handle *desc)
+{
+        if (desc && !((ulong)desc & XENCOMM_INLINE_FLAG)) {
+                struct xencomm_desc *desc__ = (struct xencomm_desc *)desc;
+                if (sizeof(*desc__) > sizeof(void *)) {
+                        unsigned long size = sizeof(*desc__) +
+                                sizeof(desc__->address[0]) * desc__->nr_addrs;
+                        unsigned long order = get_order(size);
+                        free_pages((unsigned long)__va(desc), order);
+                } else
+                        kfree(__va(desc));
+        }
+}
+
+static int xencomm_create(void *buffer, unsigned long bytes,
+                          struct xencomm_desc **ret, gfp_t gfp_mask)
+{
+        struct xencomm_desc *desc;
+        int rc;
+
+        pr_debug("%s: %p[%ld]\n", __func__, buffer, bytes);
+
+        if (bytes == 0) {
+                /* don't create a descriptor; Xen recognizes NULL. */
+                BUG_ON(buffer != NULL);
+                *ret = NULL;
+                return 0;
+        }
+
+        BUG_ON(buffer == NULL); /* 'bytes' is non-zero */
+
+        desc = xencomm_alloc(gfp_mask, buffer, bytes);
+        if (!desc) {
+                printk(KERN_DEBUG "%s failure\n", "xencomm_alloc");
+                return -ENOMEM;
+        }
+
+        rc = xencomm_init(desc, buffer, bytes);
+        if (rc) {
+                printk(KERN_DEBUG "%s failure: %d\n", "xencomm_init", rc);
+                xencomm_free((struct xencomm_handle *)__pa(desc));
+                return rc;
+        }
+
+        *ret = desc;
+        return 0;
+}
+
+/* check if memory address is within VMALLOC region  */
+static int is_phys_contiguous(unsigned long addr)
+{
+        if (!is_kernel_addr(addr))
+                return 0;
+
+        return (addr < VMALLOC_START) || (addr >= VMALLOC_END);
+}
+
+static struct xencomm_handle *xencomm_create_inline(void *ptr)
+{
+        unsigned long paddr;
+
+        BUG_ON(!is_phys_contiguous((unsigned long)ptr));
+
+        paddr = (unsigned long)xencomm_pa(ptr);
+        BUG_ON(paddr & XENCOMM_INLINE_FLAG);
+        return (struct xencomm_handle *)(paddr | XENCOMM_INLINE_FLAG);
+}
+
+/* "mini" routine, for stack-based communications: */
+static int xencomm_create_mini(void *buffer,
+        unsigned long bytes, struct xencomm_mini *xc_desc,
+        struct xencomm_desc **ret)
+{
+        int rc = 0;
+        struct xencomm_desc *desc;
+        BUG_ON(((unsigned long)xc_desc) % sizeof(*xc_desc) != 0);
+
+        desc = (void *)xc_desc;
+
+        desc->nr_addrs = XENCOMM_MINI_ADDRS;
+
+        rc = xencomm_init(desc, buffer, bytes);
+        if (!rc)
+                *ret = desc;
+
+        return rc;
+}
+
+struct xencomm_handle *xencomm_map(void *ptr, unsigned long bytes)
+{
+        int rc;
+        struct xencomm_desc *desc;
+
+        if (is_phys_contiguous((unsigned long)ptr))
+                return xencomm_create_inline(ptr);
+
+        rc = xencomm_create(ptr, bytes, &desc, GFP_KERNEL);
+
+        if (rc || desc == NULL)
+                return NULL;
+
+        return xencomm_pa(desc);
+}
+
+struct xencomm_handle *__xencomm_map_no_alloc(void *ptr, unsigned long bytes,
+                        struct xencomm_mini *xc_desc)
+{
+        int rc;
+        struct xencomm_desc *desc = NULL;
+
+        if (is_phys_contiguous((unsigned long)ptr))
+                return xencomm_create_inline(ptr);
+
+        rc = xencomm_create_mini(ptr, bytes, xc_desc,
+                                &desc);
+
+        if (rc)
+                return NULL;
+
+        return xencomm_pa(desc);
+}