162 files changed, 11101 insertions, 2139 deletions

diff --git a/drivers/block/as-iosched.c b/drivers/block/as-iosched.c
index 91aeb678135d..95c0a3690b0f 100644
--- a/drivers/block/as-iosched.c
+++ b/drivers/block/as-iosched.c
@@ -1935,23 +1935,15 @@ struct as_fs_entry {
 static ssize_t
 as_var_show(unsigned int var, char *page)
 {
-        var = (var * 1000) / HZ;
         return sprintf(page, "%d\n", var);
 }
 
 static ssize_t
 as_var_store(unsigned long *var, const char *page, size_t count)
 {
-        unsigned long tmp;
         char *p = (char *) page;
 
-        tmp = simple_strtoul(p, &p, 10);
-        if (tmp != 0) {
-                tmp = (tmp * HZ) / 1000;
-                if (tmp == 0)
-                        tmp = 1;
-        }
-        *var = tmp;
+        *var = simple_strtoul(p, &p, 10);
         return count;
 }
 
diff --git a/drivers/block/sx8.c b/drivers/block/sx8.c
index 9db0a9e3e59c..d57007b92f77 100644
--- a/drivers/block/sx8.c
+++ b/drivers/block/sx8.c
@@ -1582,7 +1582,7 @@ static int carm_init_one (struct pci_dev *pdev, const struct pci_device_id *ent)
         if (rc)
                 goto err_out;
 
-#if IF_64BIT_DMA_IS_POSSIBLE /* grrrr... */
+#ifdef IF_64BIT_DMA_IS_POSSIBLE /* grrrr... */
         rc = pci_set_dma_mask(pdev, DMA_64BIT_MASK);
         if (!rc) {
                 rc = pci_set_consistent_dma_mask(pdev, DMA_64BIT_MASK);
@@ -1601,7 +1601,7 @@ static int carm_init_one (struct pci_dev *pdev, const struct pci_device_id *ent)
                         goto err_out_regions;
                 }
                 pci_dac = 0;
-#if IF_64BIT_DMA_IS_POSSIBLE /* grrrr... */
+#ifdef IF_64BIT_DMA_IS_POSSIBLE /* grrrr... */
         }
 #endif
 
diff --git a/drivers/block/ub.c b/drivers/block/ub.c
index 685f061e69b2..a026567f5d18 100644
--- a/drivers/block/ub.c
+++ b/drivers/block/ub.c
@@ -23,6 +23,7 @@
  *  -- Exterminate P3 printks
  *  -- Resove XXX's
  *  -- Redo "benh's retries", perhaps have spin-up code to handle them. V:D=?
+ *  -- CLEAR, CLR2STS, CLRRS seem to be ripe for refactoring.
  */
 #include <linux/kernel.h>
 #include <linux/module.h>
@@ -38,6 +39,73 @@
 #define UB_MAJOR 180
 
 /*
+ * The command state machine is the key model for understanding of this driver.
+ *
+ * The general rule is that all transitions are done towards the bottom
+ * of the diagram, thus preventing any loops.
+ *
+ * An exception to that is how the STAT state is handled. A counter allows it
+ * to be re-entered along the path marked with [C].
+ *
+ *       +--------+
+ *       ! INIT   !
+ *       +--------+
+ *           !
+ *        ub_scsi_cmd_start fails ->--------------------------------------\
+ *           !                                                            !
+ *           V                                                            !
+ *       +--------+                                                       !
+ *       ! CMD    !                                                       !
+ *       +--------+                                                       !
+ *           !                                            +--------+      !
+ *         was -EPIPE -->-------------------------------->! CLEAR  !      !
+ *           !                                            +--------+      !
+ *           !                                                !           !
+ *         was error -->------------------------------------- ! --------->\
+ *           !                                                !           !
+ *  /--<-- cmd->dir == NONE ?                                 !           !
+ *  !        !                                                !           !
+ *  !        V                                                !           !
+ *  !    +--------+                                           !           !
+ *  !    ! DATA   !                                           !           !
+ *  !    +--------+                                           !           !
+ *  !        !                           +---------+          !           !
+ *  !      was -EPIPE -->--------------->! CLR2STS !          !           !
+ *  !        !                           +---------+          !           !
+ *  !        !                                !               !           !
+ *  !        !                              was error -->---- ! --------->\
+ *  !      was error -->--------------------- ! ------------- ! --------->\
+ *  !        !                                !               !           !
+ *  !        V                                !               !           !
+ *  \--->+--------+                           !               !           !
+ *       ! STAT   !<--------------------------/               !           !
+ *  /--->+--------+                                           !           !
+ *  !        !                                                !           !
+ * [C]     was -EPIPE -->-----------\                         !           !
+ *  !        !                      !                         !           !
+ *  +<---- len == 0                 !                         !           !
+ *  !        !                      !                         !           !
+ *  !      was error -->--------------------------------------!---------->\
+ *  !        !                      !                         !           !
+ *  +<---- bad CSW                  !                         !           !
+ *  +<---- bad tag                  !                         !           !
+ *  !        !                      V                         !           !
+ *  !        !                 +--------+                     !           !
+ *  !        !                 ! CLRRS  !                     !           !
+ *  !        !                 +--------+                     !           !
+ *  !        !                      !                         !           !
+ *  \------- ! --------------------[C]--------\               !           !
+ *           !                                !               !           !
+ *         cmd->error---\                +--------+           !           !
+ *           !          +--------------->! SENSE  !<----------/           !
+ *         STAT_FAIL----/                +--------+                       !
+ *           !                                !                           V
+ *           !                                V                      +--------+
+ *           \--------------------------------\--------------------->! DONE   !
+ *                                                                   +--------+
+ */
+
+/*
  * Definitions which have to be scattered once we understand the layout better.
  */
 
@@ -91,8 +159,6 @@ struct bulk_cs_wrap {
 
 #define US_BULK_CS_WRAP_LEN     13
 #define US_BULK_CS_SIGN         0x53425355      /* spells out 'USBS' */
-/* This is for Olympus Camedia digital cameras */
-#define US_BULK_CS_OLYMPUS_SIGN 0x55425355      /* spells out 'USBU' */
 #define US_BULK_STAT_OK         0
 #define US_BULK_STAT_FAIL       1
 #define US_BULK_STAT_PHASE      2
@@ -135,6 +201,7 @@ enum ub_scsi_cmd_state {
         UB_CMDST_CLR2STS,               /* Clearing before requesting status */
         UB_CMDST_STAT,                  /* Status phase */
         UB_CMDST_CLEAR,                 /* Clearing a stall (halt, actually) */
+        UB_CMDST_CLRRS,                 /* Clearing before retrying status */
         UB_CMDST_SENSE,                 /* Sending Request Sense */
         UB_CMDST_DONE                   /* Final state */
 };
@@ -146,6 +213,7 @@ static char *ub_scsi_cmd_stname[] = {
         "c2s",
         "sts",
         "clr",
+        "crs",
         "Sen",
         "fin"
 };
@@ -316,6 +384,7 @@ struct ub_dev {
         struct urb work_urb;
         struct timer_list work_timer;
         int last_pipe;                  /* What might need clearing */
+        __le32 signature;               /* Learned signature */
         struct bulk_cb_wrap work_bcb;
         struct bulk_cs_wrap work_bcs;
         struct usb_ctrlrequest work_cr;
@@ -339,8 +408,9 @@ static void ub_scsi_action(unsigned long _dev);
 static void ub_scsi_dispatch(struct ub_dev *sc);
 static void ub_scsi_urb_compl(struct ub_dev *sc, struct ub_scsi_cmd *cmd);
 static void ub_state_done(struct ub_dev *sc, struct ub_scsi_cmd *cmd, int rc);
-static void __ub_state_stat(struct ub_dev *sc, struct ub_scsi_cmd *cmd);
+static int __ub_state_stat(struct ub_dev *sc, struct ub_scsi_cmd *cmd);
 static void ub_state_stat(struct ub_dev *sc, struct ub_scsi_cmd *cmd);
+static void ub_state_stat_counted(struct ub_dev *sc, struct ub_scsi_cmd *cmd);
 static void ub_state_sense(struct ub_dev *sc, struct ub_scsi_cmd *cmd);
 static int ub_submit_clear_stall(struct ub_dev *sc, struct ub_scsi_cmd *cmd,
     int stalled_pipe);
@@ -1085,6 +1155,28 @@ static void ub_scsi_urb_compl(struct ub_dev *sc, struct ub_scsi_cmd *cmd)
 
                 ub_state_stat(sc, cmd);
 
+        } else if (cmd->state == UB_CMDST_CLRRS) {
+                if (urb->status == -EPIPE) {
+                        /*
+                         * STALL while clearning STALL.
+                         * The control pipe clears itself - nothing to do.
+                         * XXX Might try to reset the device here and retry.
+                         */
+                        printk(KERN_NOTICE "%s: stall on control pipe\n",
+                            sc->name);
+                        goto Bad_End;
+                }
+
+                /*
+                 * We ignore the result for the halt clear.
+                 */
+
+                /* reset the endpoint toggle */
+                usb_settoggle(sc->dev, usb_pipeendpoint(sc->last_pipe),
+                        usb_pipeout(sc->last_pipe), 0);
+
+                ub_state_stat_counted(sc, cmd);
+
         } else if (cmd->state == UB_CMDST_CMD) {
                 if (urb->status == -EPIPE) {
                         rc = ub_submit_clear_stall(sc, cmd, sc->last_pipe);
@@ -1190,52 +1282,57 @@ static void ub_scsi_urb_compl(struct ub_dev *sc, struct ub_scsi_cmd *cmd)
                                  */
                                 goto Bad_End;
                         }
-                        cmd->state = UB_CMDST_CLEAR;
+
+                        /*
+                         * Having a stall when getting CSW is an error, so
+                         * make sure uppper levels are not oblivious to it.
+                         */
+                        cmd->error = -EIO;              /* A cheap trick... */
+
+                        cmd->state = UB_CMDST_CLRRS;
                         ub_cmdtr_state(sc, cmd);
                         return;
                 }
+                if (urb->status == -EOVERFLOW) {
+                        /*
+                         * XXX We are screwed here. Retrying is pointless,
+                         * because the pipelined data will not get in until
+                         * we read with a big enough buffer. We must reset XXX.
+                         */
+                        goto Bad_End;
+                }
                 if (urb->status != 0)
                         goto Bad_End;
 
                 if (urb->actual_length == 0) {
-                        /*
-                         * Some broken devices add unnecessary zero-length
-                         * packets to the end of their data transfers.
-                         * Such packets show up as 0-length CSWs. If we
-                         * encounter such a thing, try to read the CSW again.
-                         */
-                        if (++cmd->stat_count >= 4) {
-                                printk(KERN_NOTICE "%s: unable to get CSW\n",
-                                    sc->name);
-                                goto Bad_End;
-                        }
-                        __ub_state_stat(sc, cmd);
+                        ub_state_stat_counted(sc, cmd);
                         return;
                 }
 
                 /*
                  * Check the returned Bulk protocol status.
+                 * The status block has to be validated first.
                  */
 
                 bcs = &sc->work_bcs;
-                rc = le32_to_cpu(bcs->Residue);
-                if (rc != cmd->len - cmd->act_len) {
+
+                if (sc->signature == cpu_to_le32(0)) {
                         /*
-                         * It is all right to transfer less, the caller has
-                         * to check. But it's not all right if the device
-                         * counts disagree with our counts.
+                         * This is the first reply, so do not perform the check.
+                         * Instead, remember the signature the device uses
+                         * for future checks. But do not allow a nul.
                          */
-                        /* P3 */ printk("%s: resid %d len %d act %d\n",
-                            sc->name, rc, cmd->len, cmd->act_len);
-                        goto Bad_End;
-                }
-
-#if 0
-                if (bcs->Signature != cpu_to_le32(US_BULK_CS_SIGN) &&
-                    bcs->Signature != cpu_to_le32(US_BULK_CS_OLYMPUS_SIGN)) {
-                        /* Windows ignores signatures, so do we. */
+                        sc->signature = bcs->Signature;
+                        if (sc->signature == cpu_to_le32(0)) {
+                                ub_state_stat_counted(sc, cmd);
+                                return;
+                        }
+                } else {
+                        if (bcs->Signature != sc->signature) {
+                                ub_state_stat_counted(sc, cmd);
+                                return;
+                        }
                 }
-#endif
 
                 if (bcs->Tag != cmd->tag) {
                         /*
@@ -1245,16 +1342,22 @@ static void ub_scsi_urb_compl(struct ub_dev *sc, struct ub_scsi_cmd *cmd)
                          * commands and reply at commands we timed out before.
                          * Without flushing these replies we loop forever.
                          */
-                        if (++cmd->stat_count >= 4) {
-                                printk(KERN_NOTICE "%s: "
-                                    "tag mismatch orig 0x%x reply 0x%x\n",
-                                    sc->name, cmd->tag, bcs->Tag);
-                                goto Bad_End;
-                        }
-                        __ub_state_stat(sc, cmd);
+                        ub_state_stat_counted(sc, cmd);
                         return;
                 }
 
+                rc = le32_to_cpu(bcs->Residue);
+                if (rc != cmd->len - cmd->act_len) {
+                        /*
+                         * It is all right to transfer less, the caller has
+                         * to check. But it's not all right if the device
+                         * counts disagree with our counts.
+                         */
+                        /* P3 */ printk("%s: resid %d len %d act %d\n",
+                            sc->name, rc, cmd->len, cmd->act_len);
+                        goto Bad_End;
+                }
+
                 switch (bcs->Status) {
                 case US_BULK_STAT_OK:
                         break;
@@ -1272,6 +1375,10 @@ static void ub_scsi_urb_compl(struct ub_dev *sc, struct ub_scsi_cmd *cmd)
                 }
 
                 /* Not zeroing error to preserve a babble indicator */
+                if (cmd->error != 0) {
+                        ub_state_sense(sc, cmd);
+                        return;
+                }
                 cmd->state = UB_CMDST_DONE;
                 ub_cmdtr_state(sc, cmd);
                 ub_cmdq_pop(sc);
@@ -1310,7 +1417,7 @@ static void ub_state_done(struct ub_dev *sc, struct ub_scsi_cmd *cmd, int rc)
  * Factorization helper for the command state machine:
  * Submit a CSW read.
  */
-static void __ub_state_stat(struct ub_dev *sc, struct ub_scsi_cmd *cmd)
+static int __ub_state_stat(struct ub_dev *sc, struct ub_scsi_cmd *cmd)
 {
         int rc;
 
@@ -1328,11 +1435,12 @@ static void __ub_state_stat(struct ub_dev *sc, struct ub_scsi_cmd *cmd)
                 /* XXX Clear stalls */
                 ub_complete(&sc->work_done);
                 ub_state_done(sc, cmd, rc);
-                return;
+                return -1;
         }
 
         sc->work_timer.expires = jiffies + UB_STAT_TIMEOUT;
         add_timer(&sc->work_timer);
+        return 0;
 }
 
 /*
@@ -1341,7 +1449,9 @@ static void __ub_state_stat(struct ub_dev *sc, struct ub_scsi_cmd *cmd)
  */
 static void ub_state_stat(struct ub_dev *sc, struct ub_scsi_cmd *cmd)
 {
-        __ub_state_stat(sc, cmd);
+
+        if (__ub_state_stat(sc, cmd) != 0)
+                return;
 
         cmd->stat_count = 0;
         cmd->state = UB_CMDST_STAT;
@@ -1350,6 +1460,25 @@ static void ub_state_stat(struct ub_dev *sc, struct ub_scsi_cmd *cmd)
 
 /*
  * Factorization helper for the command state machine:
+ * Submit a CSW read and go to STAT state with counter (along [C] path).
+ */
+static void ub_state_stat_counted(struct ub_dev *sc, struct ub_scsi_cmd *cmd)
+{
+
+        if (++cmd->stat_count >= 4) {
+                ub_state_sense(sc, cmd);
+                return;
+        }
+
+        if (__ub_state_stat(sc, cmd) != 0)
+                return;
+
+        cmd->state = UB_CMDST_STAT;
+        ub_cmdtr_state(sc, cmd);
+}
+
+/*
+ * Factorization helper for the command state machine:
  * Submit a REQUEST SENSE and go to SENSE state.
  */
 static void ub_state_sense(struct ub_dev *sc, struct ub_scsi_cmd *cmd)
diff --git a/drivers/cdrom/isp16.c b/drivers/cdrom/isp16.c
index 8e68d858ce64..db0fd9a240e3 100644
--- a/drivers/cdrom/isp16.c
+++ b/drivers/cdrom/isp16.c
@@ -18,7 +18,7 @@
  *
  *     19 June 2004     -- check_region() converted to request_region()
  *                         and return statement cleanups.
- *                         Jesper Juhl <juhl-lkml@dif.dk>
+ *                          - Jesper Juhl
  *
  *    Detect cdrom interface on ISP16 sound card.
  *    Configure cdrom interface.
diff --git a/drivers/cdrom/mcdx.c b/drivers/cdrom/mcdx.c
index 07bbd24e3c18..b89420e6d704 100644
--- a/drivers/cdrom/mcdx.c
+++ b/drivers/cdrom/mcdx.c
@@ -51,7 +51,7 @@
  */
 
 
-#if RCS
+#ifdef RCS
 static const char *mcdx_c_version
     = "$Id: mcdx.c,v 1.21 1997/01/26 07:12:59 davem Exp $";
 #endif
@@ -706,7 +706,7 @@ static int mcdx_open(struct cdrom_device_info *cdi, int purpose)
                 xtrace(OPENCLOSE, "open() init irq generation\n");
                 if (-1 == mcdx_config(stuffp, 1))
                         return -EIO;
-#if FALLBACK
+#ifdef FALLBACK
                 /* Set the read speed */
                 xwarn("AAA %x AAA\n", stuffp->readcmd);
                 if (stuffp->readerrs)
@@ -1216,7 +1216,7 @@ static int __init mcdx_init_drive(int drive)
         }
 
 
-#if WE_KNOW_WHY
+#ifdef WE_KNOW_WHY
         /* irq 11 -> channel register */
         outb(0x50, stuffp->wreg_chn);
 #endif
@@ -1294,7 +1294,7 @@ static int mcdx_transfer(struct s_drive_stuff *stuffp,
 
         ans = mcdx_xfer(stuffp, p, sector, nr_sectors);
         return ans;
-#if FALLBACK
+#ifdef FALLBACK
         if (-1 == ans)
                 stuffp->readerrs++;
         else
diff --git a/drivers/cdrom/optcd.c b/drivers/cdrom/optcd.c
index 7e69c54568bf..351a01dd503a 100644
--- a/drivers/cdrom/optcd.c
+++ b/drivers/cdrom/optcd.c
@@ -245,7 +245,7 @@ module_param(optcd_port, short, 0);
 
 
 /* Busy wait until FLAG goes low. Return 0 on timeout. */
-inline static int flag_low(int flag, unsigned long timeout)
+static inline int flag_low(int flag, unsigned long timeout)
 {
         int flag_high;
         unsigned long count = 0;
@@ -381,7 +381,7 @@ static int send_seek_params(struct cdrom_msf *params)
 
 /* Wait for command execution status. Choice between busy waiting
    and sleeping. Return value <0 indicates timeout. */
-inline static int get_exec_status(int busy_waiting)
+static inline int get_exec_status(int busy_waiting)
 {
         unsigned char exec_status;
 
@@ -398,7 +398,7 @@ inline static int get_exec_status(int busy_waiting)
 
 /* Wait busy for extra byte of data that a command returns.
    Return value <0 indicates timeout. */
-inline static int get_data(int short_timeout)
+static inline int get_data(int short_timeout)
 {
         unsigned char data;
 
@@ -441,14 +441,14 @@ static int reset_drive(void)
 /* Facilities for asynchronous operation */
 
 /* Read status/data availability flags FL_STEN and FL_DTEN */
-inline static int stdt_flags(void)
+static inline int stdt_flags(void)
 {
         return inb(STATUS_PORT) & FL_STDT;
 }
 
 
 /* Fetch status that has previously been waited for. <0 means not available */
-inline static int fetch_status(void)
+static inline int fetch_status(void)
 {
         unsigned char status;
 
@@ -462,7 +462,7 @@ inline static int fetch_status(void)
 
 
 /* Fetch data that has previously been waited for. */
-inline static void fetch_data(char *buf, int n)
+static inline void fetch_data(char *buf, int n)
 {
         insb(DATA_PORT, buf, n);
         DEBUG((DEBUG_DRIVE_IF, "fetched 0x%x bytes", n));
@@ -470,7 +470,7 @@ inline static void fetch_data(char *buf, int n)
 
 
 /* Flush status and data fifos */
-inline static void flush_data(void)
+static inline void flush_data(void)
 {
         while ((inb(STATUS_PORT) & FL_STDT) != FL_STDT)
                 inb(DATA_PORT);
@@ -482,7 +482,7 @@ inline static void flush_data(void)
 
 /* Send a simple command and wait for response. Command codes < COMFETCH
    are quick response commands */
-inline static int exec_cmd(int cmd)
+static inline int exec_cmd(int cmd)
 {
         int ack = send_cmd(cmd);
         if (ack < 0)
@@ -493,7 +493,7 @@ inline static int exec_cmd(int cmd)
 
 /* Send a command with parameters. Don't wait for the response,
  * which consists of data blocks read from the CD. */
-inline static int exec_read_cmd(int cmd, struct cdrom_msf *params)
+static inline int exec_read_cmd(int cmd, struct cdrom_msf *params)
 {
         int ack = send_cmd(cmd);
         if (ack < 0)
@@ -503,7 +503,7 @@ inline static int exec_read_cmd(int cmd, struct cdrom_msf *params)
 
 
 /* Send a seek command with parameters and wait for response */
-inline static int exec_seek_cmd(int cmd, struct cdrom_msf *params)
+static inline int exec_seek_cmd(int cmd, struct cdrom_msf *params)
 {
         int ack = send_cmd(cmd);
         if (ack < 0)
@@ -516,7 +516,7 @@ inline static int exec_seek_cmd(int cmd, struct cdrom_msf *params)
 
 
 /* Send a command with parameters and wait for response */
-inline static int exec_long_cmd(int cmd, struct cdrom_msf *params)
+static inline int exec_long_cmd(int cmd, struct cdrom_msf *params)
 {
         int ack = exec_read_cmd(cmd, params);
         if (ack < 0)
@@ -528,7 +528,7 @@ inline static int exec_long_cmd(int cmd, struct cdrom_msf *params)
 
 
 /* Binary to BCD (2 digits) */
-inline static void single_bin2bcd(u_char *p)
+static inline void single_bin2bcd(u_char *p)
 {
         DEBUG((DEBUG_CONV, "bin2bcd %02d", *p));
         *p = (*p % 10) | ((*p / 10) << 4);
@@ -565,7 +565,7 @@ static void lba2msf(int lba, struct cdrom_msf *msf)
 
 
 /* Two BCD digits to binary */
-inline static u_char bcd2bin(u_char bcd)
+static inline u_char bcd2bin(u_char bcd)
 {
         DEBUG((DEBUG_CONV, "bcd2bin %x%02x", bcd));
         return (bcd >> 4) * 10 + (bcd & 0x0f);
@@ -988,7 +988,7 @@ static char buf[CD_FRAMESIZE * N_BUFS];
 static volatile int buf_bn[N_BUFS], next_bn;
 static volatile int buf_in = 0, buf_out = NOBUF;
 
-inline static void opt_invalidate_buffers(void)
+static inline void opt_invalidate_buffers(void)
 {
         int i;
 
diff --git a/drivers/char/Kconfig b/drivers/char/Kconfig
index 43d0cb19ef6a..4f27e5519296 100644
--- a/drivers/char/Kconfig
+++ b/drivers/char/Kconfig
@@ -735,7 +735,7 @@ config SGI_IP27_RTC
 
 config GEN_RTC
         tristate "Generic /dev/rtc emulation"
-        depends on RTC!=y && !IA64 && !ARM
+        depends on RTC!=y && !IA64 && !ARM && !PPC64
         ---help---
           If you say Y here and create a character special file /dev/rtc with
           major number 10 and minor number 135 using mknod ("man mknod"), you
diff --git a/drivers/char/drm/via_dma.c b/drivers/char/drm/via_dma.c
index 82f839451622..4f60f7f4193d 100644
--- a/drivers/char/drm/via_dma.c
+++ b/drivers/char/drm/via_dma.c
@@ -231,7 +231,7 @@ int via_dma_init(DRM_IOCTL_ARGS)
         drm_via_dma_init_t init;
         int retcode = 0;
 
-        DRM_COPY_FROM_USER_IOCTL(init, (drm_via_dma_init_t *) data,
+        DRM_COPY_FROM_USER_IOCTL(init, (drm_via_dma_init_t __user *) data,
                                  sizeof(init));
 
         switch (init.func) {
@@ -343,7 +343,7 @@ int via_cmdbuffer(DRM_IOCTL_ARGS)
 
         LOCK_TEST_WITH_RETURN( dev, filp );
 
-        DRM_COPY_FROM_USER_IOCTL(cmdbuf, (drm_via_cmdbuffer_t *) data,
+        DRM_COPY_FROM_USER_IOCTL(cmdbuf, (drm_via_cmdbuffer_t __user *) data,
                                  sizeof(cmdbuf));
 
         DRM_DEBUG("via cmdbuffer, buf %p size %lu\n", cmdbuf.buf, cmdbuf.size);
@@ -386,7 +386,7 @@ int via_pci_cmdbuffer(DRM_IOCTL_ARGS)
 
         LOCK_TEST_WITH_RETURN( dev, filp );
 
-        DRM_COPY_FROM_USER_IOCTL(cmdbuf, (drm_via_cmdbuffer_t *) data,
+        DRM_COPY_FROM_USER_IOCTL(cmdbuf, (drm_via_cmdbuffer_t __user *) data,
                                  sizeof(cmdbuf));
 
         DRM_DEBUG("via_pci_cmdbuffer, buf %p size %lu\n", cmdbuf.buf,
@@ -701,7 +701,7 @@ via_cmdbuf_size(DRM_IOCTL_ARGS)
                 return DRM_ERR(EFAULT);
         }
 
-        DRM_COPY_FROM_USER_IOCTL(d_siz, (drm_via_cmdbuf_size_t *) data,
+        DRM_COPY_FROM_USER_IOCTL(d_siz, (drm_via_cmdbuf_size_t __user *) data,
                                  sizeof(d_siz));
 
 
@@ -735,7 +735,7 @@ via_cmdbuf_size(DRM_IOCTL_ARGS)
         }
         d_siz.size = tmp_size;
 
-        DRM_COPY_TO_USER_IOCTL((drm_via_cmdbuf_size_t *) data, d_siz,
+        DRM_COPY_TO_USER_IOCTL((drm_via_cmdbuf_size_t __user *) data, d_siz,
                                sizeof(d_siz));
         return ret;
 }
diff --git a/drivers/char/drm/via_drm.h b/drivers/char/drm/via_drm.h
index 4588c9bd1816..be346bb0a26a 100644
--- a/drivers/char/drm/via_drm.h
+++ b/drivers/char/drm/via_drm.h
@@ -158,7 +158,7 @@ typedef struct _drm_via_dma_init {
 } drm_via_dma_init_t;
 
 typedef struct _drm_via_cmdbuffer {
-        char *buf;
+        char __user *buf;
         unsigned long size;
 } drm_via_cmdbuffer_t;
 
diff --git a/drivers/char/drm/via_ds.c b/drivers/char/drm/via_ds.c
index daf3df75a20e..5c71e089246c 100644
--- a/drivers/char/drm/via_ds.c
+++ b/drivers/char/drm/via_ds.c
@@ -133,7 +133,7 @@ memHeap_t *via_mmInit(int ofs, int size)
         PMemBlock blocks;
 
         if (size <= 0)
-                return 0;
+                return NULL;
 
         blocks = (TMemBlock *) drm_calloc(1, sizeof(TMemBlock), DRM_MEM_DRIVER);
 
@@ -143,7 +143,7 @@ memHeap_t *via_mmInit(int ofs, int size)
                 blocks->free = 1;
                 return (memHeap_t *) blocks;
         } else
-                return 0;
+                return NULL;
 }
 
 static TMemBlock *SliceBlock(TMemBlock * p,
diff --git a/drivers/char/drm/via_ds.h b/drivers/char/drm/via_ds.h
index be9c7f9f1aee..d2bb9f37ca38 100644
--- a/drivers/char/drm/via_ds.h
+++ b/drivers/char/drm/via_ds.h
@@ -61,8 +61,8 @@ struct mem_block_t {
         struct mem_block_t *heap;
         int ofs, size;
         int align;
-        int free:1;
-        int reserved:1;
+        unsigned int free:1;
+        unsigned int reserved:1;
 };
 typedef struct mem_block_t TMemBlock;
 typedef struct mem_block_t *PMemBlock;
diff --git a/drivers/char/drm/via_map.c b/drivers/char/drm/via_map.c
index 0be829b6ec65..bb171139e737 100644
--- a/drivers/char/drm/via_map.c
+++ b/drivers/char/drm/via_map.c
@@ -95,7 +95,8 @@ int via_map_init(DRM_IOCTL_ARGS)
 
         DRM_DEBUG("%s\n", __FUNCTION__);
 
-        DRM_COPY_FROM_USER_IOCTL(init, (drm_via_init_t *) data, sizeof(init));
+        DRM_COPY_FROM_USER_IOCTL(init, (drm_via_init_t __user *) data,
+                                 sizeof(init));
 
         switch (init.func) {
         case VIA_INIT_MAP:
diff --git a/drivers/char/drm/via_mm.c b/drivers/char/drm/via_mm.c
index c22712f44d42..13921f3c0ec2 100644
--- a/drivers/char/drm/via_mm.c
+++ b/drivers/char/drm/via_mm.c
@@ -76,7 +76,8 @@ int via_agp_init(DRM_IOCTL_ARGS)
 {
         drm_via_agp_t agp;
 
-        DRM_COPY_FROM_USER_IOCTL(agp, (drm_via_agp_t *) data, sizeof(agp));
+        DRM_COPY_FROM_USER_IOCTL(agp, (drm_via_agp_t __user *) data,
+                                 sizeof(agp));
 
         AgpHeap = via_mmInit(agp.offset, agp.size);
 
@@ -92,7 +93,7 @@ int via_fb_init(DRM_IOCTL_ARGS)
 {
         drm_via_fb_t fb;
 
-        DRM_COPY_FROM_USER_IOCTL(fb, (drm_via_fb_t *) data, sizeof(fb));
+        DRM_COPY_FROM_USER_IOCTL(fb, (drm_via_fb_t __user *) data, sizeof(fb));
 
         FBHeap = via_mmInit(fb.offset, fb.size);
 
@@ -193,19 +194,20 @@ int via_mem_alloc(DRM_IOCTL_ARGS)
 {
         drm_via_mem_t mem;
 
-        DRM_COPY_FROM_USER_IOCTL(mem, (drm_via_mem_t *) data, sizeof(mem));
+        DRM_COPY_FROM_USER_IOCTL(mem, (drm_via_mem_t __user *) data,
+                                 sizeof(mem));
 
         switch (mem.type) {
         case VIDEO:
                 if (via_fb_alloc(&mem) < 0)
                         return -EFAULT;
-                DRM_COPY_TO_USER_IOCTL((drm_via_mem_t *) data, mem,
+                DRM_COPY_TO_USER_IOCTL((drm_via_mem_t __user *) data, mem,
                                        sizeof(mem));
                 return 0;
         case AGP:
                 if (via_agp_alloc(&mem) < 0)
                         return -EFAULT;
-                DRM_COPY_TO_USER_IOCTL((drm_via_mem_t *) data, mem,
+                DRM_COPY_TO_USER_IOCTL((drm_via_mem_t __user *) data, mem,
                                        sizeof(mem));
                 return 0;
         }
@@ -289,7 +291,8 @@ int via_mem_free(DRM_IOCTL_ARGS)
 {
         drm_via_mem_t mem;
 
-        DRM_COPY_FROM_USER_IOCTL(mem, (drm_via_mem_t *) data, sizeof(mem));
+        DRM_COPY_FROM_USER_IOCTL(mem, (drm_via_mem_t __user *) data,
+                                 sizeof(mem));
 
         switch (mem.type) {
 
diff --git a/drivers/char/drm/via_video.c b/drivers/char/drm/via_video.c
index 37a61c67b292..1e2d444587bf 100644
--- a/drivers/char/drm/via_video.c
+++ b/drivers/char/drm/via_video.c
@@ -76,7 +76,8 @@ via_decoder_futex(DRM_IOCTL_ARGS)
 
         DRM_DEBUG("%s\n", __FUNCTION__);
 
-        DRM_COPY_FROM_USER_IOCTL(fx, (drm_via_futex_t *) data, sizeof(fx));
+        DRM_COPY_FROM_USER_IOCTL(fx, (drm_via_futex_t __user *) data,
+                                 sizeof(fx));
 
         if (fx.lock > VIA_NR_XVMC_LOCKS)
                 return -EFAULT;
diff --git a/drivers/char/ipmi/ipmi_si_intf.c b/drivers/char/ipmi/ipmi_si_intf.c
index 298574e16061..a44b97304e95 100644
--- a/drivers/char/ipmi/ipmi_si_intf.c
+++ b/drivers/char/ipmi/ipmi_si_intf.c
@@ -1726,7 +1726,7 @@ static int dmi_table(u32 base, int len, int num)
         return status;
 }
 
-inline static int dmi_checksum(u8 *buf)
+static inline int dmi_checksum(u8 *buf)
 {
         u8   sum=0;
         int  a;
diff --git a/drivers/char/ipmi/ipmi_watchdog.c b/drivers/char/ipmi/ipmi_watchdog.c
index fcd1c02a32cb..d35a953961cb 100644
--- a/drivers/char/ipmi/ipmi_watchdog.c
+++ b/drivers/char/ipmi/ipmi_watchdog.c
@@ -131,11 +131,7 @@
 #define WDIOC_GET_PRETIMEOUT     _IOW(WATCHDOG_IOCTL_BASE, 22, int)
 #endif
 
-#ifdef CONFIG_WATCHDOG_NOWAYOUT
-static int nowayout = 1;
-#else
-static int nowayout;
-#endif
+static int nowayout = WATCHDOG_NOWAYOUT;
 
 static ipmi_user_t watchdog_user = NULL;
 
diff --git a/drivers/char/rio/rioboot.c b/drivers/char/rio/rioboot.c
index a8be11dfcba3..34cbb13aad4b 100644
--- a/drivers/char/rio/rioboot.c
+++ b/drivers/char/rio/rioboot.c
@@ -902,7 +902,7 @@ static int RIOBootComplete( struct rio_info *p, struct Host *HostP, uint Rup, st
                (HostP->Mapping[entry].RtaUniqueNum==RtaUniq))
             {
                 HostP->Mapping[entry].Flags |= RTA_BOOTED|RTA_NEWBOOT;
-#if NEED_TO_FIX
+#ifdef NEED_TO_FIX
                 RIO_SV_BROADCAST(HostP->svFlags[entry]);
 #endif
                 if ( (sysport=HostP->Mapping[entry].SysPort) != NO_PORT )
@@ -918,7 +918,7 @@ static int RIOBootComplete( struct rio_info *p, struct Host *HostP, uint Rup, st
                    {
                         entry2 = HostP->Mapping[entry].ID2 - 1;
                         HostP->Mapping[entry2].Flags |= RTA_BOOTED|RTA_NEWBOOT;
-#if NEED_TO_FIX
+#ifdef NEED_TO_FIX
                         RIO_SV_BROADCAST(HostP->svFlags[entry2]);
 #endif
                         sysport = HostP->Mapping[entry2].SysPort;
@@ -1143,7 +1143,7 @@ static int RIOBootComplete( struct rio_info *p, struct Host *HostP, uint Rup, st
                     CCOPY( MapP->Name, HostP->Mapping[entry].Name, MAX_NAME_LEN );
                     HostP->Mapping[entry].Flags =
                      SLOT_IN_USE | RTA_BOOTED | RTA_NEWBOOT;
-#if NEED_TO_FIX
+#ifdef NEED_TO_FIX
                     RIO_SV_BROADCAST(HostP->svFlags[entry]);
 #endif
                     RIOReMapPorts( p, HostP, &HostP->Mapping[entry] );
@@ -1159,7 +1159,7 @@ static int RIOBootComplete( struct rio_info *p, struct Host *HostP, uint Rup, st
    "This RTA has a tentative entry on another host - delete that entry (1)\n");
                     HostP->Mapping[entry].Flags =
                      SLOT_TENTATIVE | RTA_BOOTED | RTA_NEWBOOT;
-#if NEED_TO_FIX
+#ifdef NEED_TO_FIX
                     RIO_SV_BROADCAST(HostP->svFlags[entry]);
 #endif
                 }
@@ -1169,7 +1169,7 @@ static int RIOBootComplete( struct rio_info *p, struct Host *HostP, uint Rup, st
                     {
                         HostP->Mapping[entry2].Flags = SLOT_IN_USE |
                          RTA_BOOTED | RTA_NEWBOOT | RTA16_SECOND_SLOT;
-#if NEED_TO_FIX
+#ifdef NEED_TO_FIX
                         RIO_SV_BROADCAST(HostP->svFlags[entry2]);
 #endif
                         HostP->Mapping[entry2].SysPort = MapP2->SysPort;
@@ -1188,7 +1188,7 @@ static int RIOBootComplete( struct rio_info *p, struct Host *HostP, uint Rup, st
                     else
                         HostP->Mapping[entry2].Flags = SLOT_TENTATIVE |
                          RTA_BOOTED | RTA_NEWBOOT | RTA16_SECOND_SLOT;
-#if NEED_TO_FIX
+#ifdef NEED_TO_FIX
                         RIO_SV_BROADCAST(HostP->svFlags[entry2]);
 #endif
                     bzero( (caddr_t)MapP2, sizeof(struct Map) );
diff --git a/drivers/char/rio/rioroute.c b/drivers/char/rio/rioroute.c
index 106b31f48a21..e9564c9fb37c 100644
--- a/drivers/char/rio/rioroute.c
+++ b/drivers/char/rio/rioroute.c
@@ -1023,7 +1023,7 @@ RIOFreeDisconnected(struct rio_info *p, struct Host *HostP, int unit)
     if (link < LINKS_PER_UNIT)
             return 1;
 
-#if NEED_TO_FIX_THIS
+#ifdef NEED_TO_FIX_THIS
     /* Ok so all the links are disconnected. But we may have only just
     ** made this slot tentative and not yet received a topology update.
     ** Lets check how long ago we made it tentative.
diff --git a/drivers/char/rio/riotable.c b/drivers/char/rio/riotable.c
index 8fb26ad2aa12..e45bc275907a 100644
--- a/drivers/char/rio/riotable.c
+++ b/drivers/char/rio/riotable.c
@@ -771,7 +771,7 @@ int RIOAssignRta( struct rio_info *p, struct Map *MapP )
             if ((MapP->Flags & RTA16_SECOND_SLOT) == 0)
               CCOPY( MapP->Name, HostMapP->Name, MAX_NAME_LEN );
             HostMapP->Flags = SLOT_IN_USE | RTA_BOOTED;
-#if NEED_TO_FIX
+#ifdef NEED_TO_FIX
             RIO_SV_BROADCAST(p->RIOHosts[host].svFlags[MapP->ID-1]);
 #endif
             if (MapP->Flags & RTA16_SECOND_SLOT)
diff --git a/drivers/char/tpm/Kconfig b/drivers/char/tpm/Kconfig
index 7a969778915a..94a3b3e20bf9 100644
--- a/drivers/char/tpm/Kconfig
+++ b/drivers/char/tpm/Kconfig
@@ -35,5 +35,16 @@ config TCG_ATMEL
           will be accessible from within Linux.  To compile this driver 
           as a module, choose M here; the module will be called tpm_atmel.
 
+config TCG_INFINEON
+        tristate "Infineon Technologies SLD 9630 TPM Interface"
+        depends on TCG_TPM
+        ---help---
+          If you have a TPM security chip from Infineon Technologies
+          say Yes and it will be accessible from within Linux.  To
+          compile this driver as a module, choose M here; the module
+          will be called tpm_infineon.
+          Further information on this driver and the supported hardware
+          can be found at http://www.prosec.rub.de/tpm
+
 endmenu
 
diff --git a/drivers/char/tpm/Makefile b/drivers/char/tpm/Makefile
index 736d3df266f5..2392e404e8d1 100644
--- a/drivers/char/tpm/Makefile
+++ b/drivers/char/tpm/Makefile
@@ -4,4 +4,4 @@
 obj-$(CONFIG_TCG_TPM) += tpm.o
 obj-$(CONFIG_TCG_NSC) += tpm_nsc.o
 obj-$(CONFIG_TCG_ATMEL) += tpm_atmel.o
-
+obj-$(CONFIG_TCG_INFINEON) += tpm_infineon.o
diff --git a/drivers/char/tpm/tpm_infineon.c b/drivers/char/tpm/tpm_infineon.c
new file mode 100644
index 000000000000..0e3241645c19
--- /dev/null
+++ b/drivers/char/tpm/tpm_infineon.c
@@ -0,0 +1,467 @@
+/*
+ * Description:
+ * Device Driver for the Infineon Technologies
+ * SLD 9630 TT Trusted Platform Module
+ * Specifications at www.trustedcomputinggroup.org
+ *
+ * Copyright (C) 2005, Marcel Selhorst <selhorst@crypto.rub.de>
+ * Applied Data Security Group, Ruhr-University Bochum, Germany
+ * Project-Homepage: http://www.prosec.rub.de/tpm
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License as
+ * published by the Free Software Foundation, version 2 of the
+ * License.
+ *
+ */
+
+#include "tpm.h"
+
+/* Infineon specific definitions */
+/* maximum number of WTX-packages */
+#define TPM_MAX_WTX_PACKAGES    50
+/* msleep-Time for WTX-packages */
+#define TPM_WTX_MSLEEP_TIME     20
+/* msleep-Time --> Interval to check status register */
+#define TPM_MSLEEP_TIME         3
+/* gives number of max. msleep()-calls before throwing timeout */
+#define TPM_MAX_TRIES           5000
+#define TCPA_INFINEON_DEV_VEN_VALUE     0x15D1
+#define TPM_DATA                        (TPM_ADDR + 1) & 0xff
+
+/* TPM header definitions */
+enum infineon_tpm_header {
+        TPM_VL_VER = 0x01,
+        TPM_VL_CHANNEL_CONTROL = 0x07,
+        TPM_VL_CHANNEL_PERSONALISATION = 0x0A,
+        TPM_VL_CHANNEL_TPM = 0x0B,
+        TPM_VL_CONTROL = 0x00,
+        TPM_INF_NAK = 0x15,
+        TPM_CTRL_WTX = 0x10,
+        TPM_CTRL_WTX_ABORT = 0x18,
+        TPM_CTRL_WTX_ABORT_ACK = 0x18,
+        TPM_CTRL_ERROR = 0x20,
+        TPM_CTRL_CHAININGACK = 0x40,
+        TPM_CTRL_CHAINING = 0x80,
+        TPM_CTRL_DATA = 0x04,
+        TPM_CTRL_DATA_CHA = 0x84,
+        TPM_CTRL_DATA_CHA_ACK = 0xC4
+};
+
+enum infineon_tpm_register {
+        WRFIFO = 0x00,
+        RDFIFO = 0x01,
+        STAT = 0x02,
+        CMD = 0x03
+};
+
+enum infineon_tpm_command_bits {
+        CMD_DIS = 0x00,
+        CMD_LP = 0x01,
+        CMD_RES = 0x02,
+        CMD_IRQC = 0x06
+};
+
+enum infineon_tpm_status_bits {
+        STAT_XFE = 0x00,
+        STAT_LPA = 0x01,
+        STAT_FOK = 0x02,
+        STAT_TOK = 0x03,
+        STAT_IRQA = 0x06,
+        STAT_RDA = 0x07
+};
+
+/* some outgoing values */
+enum infineon_tpm_values {
+        CHIP_ID1 = 0x20,
+        CHIP_ID2 = 0x21,
+        TPM_DAR = 0x30,
+        RESET_LP_IRQC_DISABLE = 0x41,
+        ENABLE_REGISTER_PAIR = 0x55,
+        IOLIMH = 0x60,
+        IOLIML = 0x61,
+        DISABLE_REGISTER_PAIR = 0xAA,
+        IDVENL = 0xF1,
+        IDVENH = 0xF2,
+        IDPDL = 0xF3,
+        IDPDH = 0xF4
+};
+
+static int number_of_wtx;
+
+static int empty_fifo(struct tpm_chip *chip, int clear_wrfifo)
+{
+        int status;
+        int check = 0;
+        int i;
+
+        if (clear_wrfifo) {
+                for (i = 0; i < 4096; i++) {
+                        status = inb(chip->vendor->base + WRFIFO);
+                        if (status == 0xff) {
+                                if (check == 5)
+                                        break;
+                                else
+                                        check++;
+                        }
+                }
+        }
+        /* Note: The values which are currently in the FIFO of the TPM
+           are thrown away since there is no usage for them. Usually,
+           this has nothing to say, since the TPM will give its answer
+           immediately or will be aborted anyway, so the data here is
+           usually garbage and useless.
+           We have to clean this, because the next communication with
+           the TPM would be rubbish, if there is still some old data
+           in the Read FIFO.
+         */
+        i = 0;
+        do {
+                status = inb(chip->vendor->base + RDFIFO);
+                status = inb(chip->vendor->base + STAT);
+                i++;
+                if (i == TPM_MAX_TRIES)
+                        return -EIO;
+        } while ((status & (1 << STAT_RDA)) != 0);
+        return 0;
+}
+
+static int wait(struct tpm_chip *chip, int wait_for_bit)
+{
+        int status;
+        int i;
+        for (i = 0; i < TPM_MAX_TRIES; i++) {
+                status = inb(chip->vendor->base + STAT);
+                /* check the status-register if wait_for_bit is set */
+                if (status & 1 << wait_for_bit)
+                        break;
+                msleep(TPM_MSLEEP_TIME);
+        }
+        if (i == TPM_MAX_TRIES) {       /* timeout occurs */
+                if (wait_for_bit == STAT_XFE)
+                        dev_err(&chip->pci_dev->dev,
+                                "Timeout in wait(STAT_XFE)\n");
+                if (wait_for_bit == STAT_RDA)
+                        dev_err(&chip->pci_dev->dev,
+                                "Timeout in wait(STAT_RDA)\n");
+                return -EIO;
+        }
+        return 0;
+};
+
+static void wait_and_send(struct tpm_chip *chip, u8 sendbyte)
+{
+        wait(chip, STAT_XFE);
+        outb(sendbyte, chip->vendor->base + WRFIFO);
+}
+
+    /* Note: WTX means Waiting-Time-Extension. Whenever the TPM needs more
+       calculation time, it sends a WTX-package, which has to be acknowledged
+       or aborted. This usually occurs if you are hammering the TPM with key
+       creation. Set the maximum number of WTX-packages in the definitions
+       above, if the number is reached, the waiting-time will be denied
+       and the TPM command has to be resend.
+     */
+
+static void tpm_wtx(struct tpm_chip *chip)
+{
+        number_of_wtx++;
+        dev_info(&chip->pci_dev->dev, "Granting WTX (%02d / %02d)\n",
+                 number_of_wtx, TPM_MAX_WTX_PACKAGES);
+        wait_and_send(chip, TPM_VL_VER);
+        wait_and_send(chip, TPM_CTRL_WTX);
+        wait_and_send(chip, 0x00);
+        wait_and_send(chip, 0x00);
+        msleep(TPM_WTX_MSLEEP_TIME);
+}
+
+static void tpm_wtx_abort(struct tpm_chip *chip)
+{
+        dev_info(&chip->pci_dev->dev, "Aborting WTX\n");
+        wait_and_send(chip, TPM_VL_VER);
+        wait_and_send(chip, TPM_CTRL_WTX_ABORT);
+        wait_and_send(chip, 0x00);
+        wait_and_send(chip, 0x00);
+        number_of_wtx = 0;
+        msleep(TPM_WTX_MSLEEP_TIME);
+}
+
+static int tpm_inf_recv(struct tpm_chip *chip, u8 * buf, size_t count)
+{
+        int i;
+        int ret;
+        u32 size = 0;
+
+recv_begin:
+        /* start receiving header */
+        for (i = 0; i < 4; i++) {
+                ret = wait(chip, STAT_RDA);
+                if (ret)
+                        return -EIO;
+                buf[i] = inb(chip->vendor->base + RDFIFO);
+        }
+
+        if (buf[0] != TPM_VL_VER) {
+                dev_err(&chip->pci_dev->dev,
+                        "Wrong transport protocol implementation!\n");
+                return -EIO;
+        }
+
+        if (buf[1] == TPM_CTRL_DATA) {
+                /* size of the data received */
+                size = ((buf[2] << 8) | buf[3]);
+
+                for (i = 0; i < size; i++) {
+                        wait(chip, STAT_RDA);
+                        buf[i] = inb(chip->vendor->base + RDFIFO);
+                }
+
+                if ((size == 0x6D00) && (buf[1] == 0x80)) {
+                        dev_err(&chip->pci_dev->dev,
+                                "Error handling on vendor layer!\n");
+                        return -EIO;
+                }
+
+                for (i = 0; i < size; i++)
+                        buf[i] = buf[i + 6];
+
+                size = size - 6;
+                return size;
+        }
+
+        if (buf[1] == TPM_CTRL_WTX) {
+                dev_info(&chip->pci_dev->dev, "WTX-package received\n");
+                if (number_of_wtx < TPM_MAX_WTX_PACKAGES) {
+                        tpm_wtx(chip);
+                        goto recv_begin;
+                } else {
+                        tpm_wtx_abort(chip);
+                        goto recv_begin;
+                }
+        }
+
+        if (buf[1] == TPM_CTRL_WTX_ABORT_ACK) {
+                dev_info(&chip->pci_dev->dev, "WTX-abort acknowledged\n");
+                return size;
+        }
+
+        if (buf[1] == TPM_CTRL_ERROR) {
+                dev_err(&chip->pci_dev->dev, "ERROR-package received:\n");
+                if (buf[4] == TPM_INF_NAK)
+                        dev_err(&chip->pci_dev->dev,
+                                "-> Negative acknowledgement"
+                                " - retransmit command!\n");
+                return -EIO;
+        }
+        return -EIO;
+}
+
+static int tpm_inf_send(struct tpm_chip *chip, u8 * buf, size_t count)
+{
+        int i;
+        int ret;
+        u8 count_high, count_low, count_4, count_3, count_2, count_1;
+
+        /* Disabling Reset, LP and IRQC */
+        outb(RESET_LP_IRQC_DISABLE, chip->vendor->base + CMD);
+
+        ret = empty_fifo(chip, 1);
+        if (ret) {
+                dev_err(&chip->pci_dev->dev, "Timeout while clearing FIFO\n");
+                return -EIO;
+        }
+
+        ret = wait(chip, STAT_XFE);
+        if (ret)
+                return -EIO;
+
+        count_4 = (count & 0xff000000) >> 24;
+        count_3 = (count & 0x00ff0000) >> 16;
+        count_2 = (count & 0x0000ff00) >> 8;
+        count_1 = (count & 0x000000ff);
+        count_high = ((count + 6) & 0xffffff00) >> 8;
+        count_low = ((count + 6) & 0x000000ff);
+
+        /* Sending Header */
+        wait_and_send(chip, TPM_VL_VER);
+        wait_and_send(chip, TPM_CTRL_DATA);
+        wait_and_send(chip, count_high);
+        wait_and_send(chip, count_low);
+
+        /* Sending Data Header */
+        wait_and_send(chip, TPM_VL_VER);
+        wait_and_send(chip, TPM_VL_CHANNEL_TPM);
+        wait_and_send(chip, count_4);
+        wait_and_send(chip, count_3);
+        wait_and_send(chip, count_2);
+        wait_and_send(chip, count_1);
+
+        /* Sending Data */
+        for (i = 0; i < count; i++) {
+                wait_and_send(chip, buf[i]);
+        }
+        return count;
+}
+
+static void tpm_inf_cancel(struct tpm_chip *chip)
+{
+        /* Nothing yet!
+           This has something to do with the internal functions
+           of the TPM. Abort isn't really necessary...
+         */
+}
+
+static DEVICE_ATTR(pubek, S_IRUGO, tpm_show_pubek, NULL);
+static DEVICE_ATTR(pcrs, S_IRUGO, tpm_show_pcrs, NULL);
+static DEVICE_ATTR(caps, S_IRUGO, tpm_show_caps, NULL);
+static DEVICE_ATTR(cancel, S_IWUSR | S_IWGRP, NULL, tpm_store_cancel);
+
+static struct attribute *inf_attrs[] = {
+        &dev_attr_pubek.attr,
+        &dev_attr_pcrs.attr,
+        &dev_attr_caps.attr,
+        &dev_attr_cancel.attr,
+        NULL,
+};
+
+static struct attribute_group inf_attr_grp = {.attrs = inf_attrs };
+
+static struct file_operations inf_ops = {
+        .owner = THIS_MODULE,
+        .llseek = no_llseek,
+        .open = tpm_open,
+        .read = tpm_read,
+        .write = tpm_write,
+        .release = tpm_release,
+};
+
+static struct tpm_vendor_specific tpm_inf = {
+        .recv = tpm_inf_recv,
+        .send = tpm_inf_send,
+        .cancel = tpm_inf_cancel,
+        .req_complete_mask = 0,
+        .req_complete_val = 0,
+        .attr_group = &inf_attr_grp,
+        .miscdev = {.fops = &inf_ops,},
+};
+
+static int __devinit tpm_inf_probe(struct pci_dev *pci_dev,
+                                   const struct pci_device_id *pci_id)
+{
+        int rc = 0;
+        u8 iol, ioh;
+        int vendorid[2];
+        int version[2];
+        int productid[2];
+
+        if (pci_enable_device(pci_dev))
+                return -EIO;
+
+        dev_info(&pci_dev->dev, "LPC-bus found at 0x%x\n", pci_id->device);
+
+        /* query chip for its vendor, its version number a.s.o. */
+        outb(ENABLE_REGISTER_PAIR, TPM_ADDR);
+        outb(IDVENL, TPM_ADDR);
+        vendorid[1] = inb(TPM_DATA);
+        outb(IDVENH, TPM_ADDR);
+        vendorid[0] = inb(TPM_DATA);
+        outb(IDPDL, TPM_ADDR);
+        productid[1] = inb(TPM_DATA);
+        outb(IDPDH, TPM_ADDR);
+        productid[0] = inb(TPM_DATA);
+        outb(CHIP_ID1, TPM_ADDR);
+        version[1] = inb(TPM_DATA);
+        outb(CHIP_ID2, TPM_ADDR);
+        version[0] = inb(TPM_DATA);
+
+        if ((vendorid[0] << 8 | vendorid[1]) == (TCPA_INFINEON_DEV_VEN_VALUE)) {
+
+                /* read IO-ports from TPM */
+                outb(IOLIMH, TPM_ADDR);
+                ioh = inb(TPM_DATA);
+                outb(IOLIML, TPM_ADDR);
+                iol = inb(TPM_DATA);
+                tpm_inf.base = (ioh << 8) | iol;
+
+                if (tpm_inf.base == 0) {
+                        dev_err(&pci_dev->dev, "No IO-ports set!\n");
+                        pci_disable_device(pci_dev);
+                        return -ENODEV;
+                }
+
+                /* activate register */
+                outb(TPM_DAR, TPM_ADDR);
+                outb(0x01, TPM_DATA);
+                outb(DISABLE_REGISTER_PAIR, TPM_ADDR);
+
+                /* disable RESET, LP and IRQC */
+                outb(RESET_LP_IRQC_DISABLE, tpm_inf.base + CMD);
+
+                /* Finally, we're done, print some infos */
+                dev_info(&pci_dev->dev, "TPM found: "
+                         "io base 0x%x, "
+                         "chip version %02x%02x, "
+                         "vendor id %x%x (Infineon), "
+                         "product id %02x%02x"
+                         "%s\n",
+                         tpm_inf.base,
+                         version[0], version[1],
+                         vendorid[0], vendorid[1],
+                         productid[0], productid[1], ((productid[0] == 0)
+                                                      && (productid[1] ==
+                                                          6)) ?
+                         " (SLD 9630 TT 1.1)" : "");
+
+                rc = tpm_register_hardware(pci_dev, &tpm_inf);
+                if (rc < 0) {
+                        pci_disable_device(pci_dev);
+                        return -ENODEV;
+                }
+                return 0;
+        } else {
+                dev_info(&pci_dev->dev, "No Infineon TPM found!\n");
+                pci_disable_device(pci_dev);
+                return -ENODEV;
+        }
+}
+
+static struct pci_device_id tpm_pci_tbl[] __devinitdata = {
+        {PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_82801BA_0)},
+        {PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_82801CA_12)},
+        {PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_82801DB_0)},
+        {PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_82801DB_12)},
+        {PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_82801EB_0)},
+        {PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_ICH6_0)},
+        {PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_ICH6_1)},
+        {PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_ICH6_2)},
+        {0,}
+};
+
+MODULE_DEVICE_TABLE(pci, tpm_pci_tbl);
+
+static struct pci_driver inf_pci_driver = {
+        .name = "tpm_inf",
+        .id_table = tpm_pci_tbl,
+        .probe = tpm_inf_probe,
+        .remove = __devexit_p(tpm_remove),
+        .suspend = tpm_pm_suspend,
+        .resume = tpm_pm_resume,
+};
+
+static int __init init_inf(void)
+{
+        return pci_register_driver(&inf_pci_driver);
+}
+
+static void __exit cleanup_inf(void)
+{
+        pci_unregister_driver(&inf_pci_driver);
+}
+
+module_init(init_inf);
+module_exit(cleanup_inf);
+
+MODULE_AUTHOR("Marcel Selhorst <selhorst@crypto.rub.de>");
+MODULE_DESCRIPTION("Driver for Infineon TPM SLD 9630 TT");
+MODULE_VERSION("1.4");
+MODULE_LICENSE("GPL");
diff --git a/drivers/char/watchdog/acquirewdt.c b/drivers/char/watchdog/acquirewdt.c
index 8f302121741b..7289f4af93d0 100644
--- a/drivers/char/watchdog/acquirewdt.c
+++ b/drivers/char/watchdog/acquirewdt.c
@@ -82,12 +82,7 @@ static int wdt_start = 0x443;
 module_param(wdt_start, int, 0);
 MODULE_PARM_DESC(wdt_start, "Acquire WDT 'start' io port (default 0x443)");
 
-#ifdef CONFIG_WATCHDOG_NOWAYOUT
-static int nowayout = 1;
-#else
-static int nowayout = 0;
-#endif
-
+static int nowayout = WATCHDOG_NOWAYOUT;
 module_param(nowayout, int, 0);
 MODULE_PARM_DESC(nowayout, "Watchdog cannot be stopped once started (default=CONFIG_WATCHDOG_NOWAYOUT)");
 
diff --git a/drivers/char/watchdog/advantechwdt.c b/drivers/char/watchdog/advantechwdt.c
index ea73c8379bdd..194a3fd36b91 100644
--- a/drivers/char/watchdog/advantechwdt.c
+++ b/drivers/char/watchdog/advantechwdt.c
@@ -73,12 +73,7 @@ static int timeout = WATCHDOG_TIMEOUT;	/* in seconds */
 module_param(timeout, int, 0);
 MODULE_PARM_DESC(timeout, "Watchdog timeout in seconds. 1<= timeout <=63, default=" __MODULE_STRING(WATCHDOG_TIMEOUT) ".");
 
-#ifdef CONFIG_WATCHDOG_NOWAYOUT
-static int nowayout = 1;
-#else
-static int nowayout = 0;
-#endif
-
+static int nowayout = WATCHDOG_NOWAYOUT;
 module_param(nowayout, int, 0);
 MODULE_PARM_DESC(nowayout, "Watchdog cannot be stopped once started (default=CONFIG_WATCHDOG_NOWAYOUT)");
 
diff --git a/drivers/char/watchdog/alim1535_wdt.c b/drivers/char/watchdog/alim1535_wdt.c
index 35dcbf8be7d1..8338ca300e2e 100644
--- a/drivers/char/watchdog/alim1535_wdt.c
+++ b/drivers/char/watchdog/alim1535_wdt.c
@@ -38,12 +38,7 @@ static int timeout = WATCHDOG_TIMEOUT;
 module_param(timeout, int, 0);
 MODULE_PARM_DESC(timeout, "Watchdog timeout in seconds. (0<timeout<18000, default=" __MODULE_STRING(WATCHDOG_TIMEOUT) ")");
 
-#ifdef CONFIG_WATCHDOG_NOWAYOUT
-static int nowayout = 1;
-#else
-static int nowayout = 0;
-#endif
-
+static int nowayout = WATCHDOG_NOWAYOUT;
 module_param(nowayout, int, 0);
 MODULE_PARM_DESC(nowayout, "Watchdog cannot be stopped once started (default=CONFIG_WATCHDOG_NOWAYOUT)");
 
@@ -317,7 +312,7 @@ static int ali_notify_sys(struct notifier_block *this, unsigned long code, void
  */
 
 static struct pci_device_id ali_pci_tbl[] = {
-        { PCI_VENDOR_ID_AL, 1535, PCI_ANY_ID, PCI_ANY_ID,},
+        { PCI_VENDOR_ID_AL, 0x1535, PCI_ANY_ID, PCI_ANY_ID,},
         { 0, },
 };
 MODULE_DEVICE_TABLE(pci, ali_pci_tbl);
diff --git a/drivers/char/watchdog/alim7101_wdt.c b/drivers/char/watchdog/alim7101_wdt.c
index 90c091d9e0f5..c05ac188a4d7 100644
--- a/drivers/char/watchdog/alim7101_wdt.c
+++ b/drivers/char/watchdog/alim7101_wdt.c
@@ -75,12 +75,7 @@ static unsigned long wdt_is_open;
 static char wdt_expect_close;
 static struct pci_dev *alim7101_pmu;
 
-#ifdef CONFIG_WATCHDOG_NOWAYOUT
-static int nowayout = 1;
-#else
-static int nowayout = 0;
-#endif
-
+static int nowayout = WATCHDOG_NOWAYOUT;
 module_param(nowayout, int, 0);
 MODULE_PARM_DESC(nowayout, "Watchdog cannot be stopped once started (default=CONFIG_WATCHDOG_NOWAYOUT)");
 
diff --git a/drivers/char/watchdog/eurotechwdt.c b/drivers/char/watchdog/eurotechwdt.c
index 2a29a511df7f..25c2f2575611 100644
--- a/drivers/char/watchdog/eurotechwdt.c
+++ b/drivers/char/watchdog/eurotechwdt.c
@@ -72,12 +72,7 @@ static char *ev = "int";
 
 #define WDT_TIMEOUT             60                /* 1 minute */
 
-#ifdef CONFIG_WATCHDOG_NOWAYOUT
-static int nowayout = 1;
-#else
-static int nowayout = 0;
-#endif
-
+static int nowayout = WATCHDOG_NOWAYOUT;
 module_param(nowayout, int, 0);
 MODULE_PARM_DESC(nowayout, "Watchdog cannot be stopped once started (default=CONFIG_WATCHDOG_NOWAYOUT)");
 
diff --git a/drivers/char/watchdog/i8xx_tco.c b/drivers/char/watchdog/i8xx_tco.c
index 5d07ee59679d..f975dab1ddf9 100644
--- a/drivers/char/watchdog/i8xx_tco.c
+++ b/drivers/char/watchdog/i8xx_tco.c
@@ -105,12 +105,7 @@ static int heartbeat = WATCHDOG_HEARTBEAT;  /* in seconds */
 module_param(heartbeat, int, 0);
 MODULE_PARM_DESC(heartbeat, "Watchdog heartbeat in seconds. (2<heartbeat<39, default=" __MODULE_STRING(WATCHDOG_HEARTBEAT) ")");
 
-#ifdef CONFIG_WATCHDOG_NOWAYOUT
-static int nowayout = 1;
-#else
-static int nowayout = 0;
-#endif
-
+static int nowayout = WATCHDOG_NOWAYOUT;
 module_param(nowayout, int, 0);
 MODULE_PARM_DESC(nowayout, "Watchdog cannot be stopped once started (default=CONFIG_WATCHDOG_NOWAYOUT)");
 
diff --git a/drivers/char/watchdog/ib700wdt.c b/drivers/char/watchdog/ib700wdt.c
index d974f16e84d2..cf60329eec85 100644
--- a/drivers/char/watchdog/ib700wdt.c
+++ b/drivers/char/watchdog/ib700wdt.c
@@ -117,12 +117,7 @@ static int wd_times[] = {
 
 static int wd_margin = WD_TIMO;
 
-#ifdef CONFIG_WATCHDOG_NOWAYOUT
-static int nowayout = 1;
-#else
-static int nowayout = 0;
-#endif
-
+static int nowayout = WATCHDOG_NOWAYOUT;
 module_param(nowayout, int, 0);
 MODULE_PARM_DESC(nowayout, "Watchdog cannot be stopped once started (default=CONFIG_WATCHDOG_NOWAYOUT)");
 
diff --git a/drivers/char/watchdog/indydog.c b/drivers/char/watchdog/indydog.c
index 6af2c799b57e..b4b94daba67e 100644
--- a/drivers/char/watchdog/indydog.c
+++ b/drivers/char/watchdog/indydog.c
@@ -29,14 +29,9 @@
 #define PFX "indydog: "
 static int indydog_alive;
 
-#ifdef CONFIG_WATCHDOG_NOWAYOUT
-static int nowayout = 1;
-#else
-static int nowayout = 0;
-#endif
-
 #define WATCHDOG_TIMEOUT 30             /* 30 sec default timeout */
 
+static int nowayout = WATCHDOG_NOWAYOUT;
 module_param(nowayout, int, 0);
 MODULE_PARM_DESC(nowayout, "Watchdog cannot be stopped once started (default=CONFIG_WATCHDOG_NOWAYOUT)");
 
diff --git a/drivers/char/watchdog/ixp2000_wdt.c b/drivers/char/watchdog/ixp2000_wdt.c
index 4b039516cc86..e7640bc4904b 100644
--- a/drivers/char/watchdog/ixp2000_wdt.c
+++ b/drivers/char/watchdog/ixp2000_wdt.c
@@ -30,11 +30,7 @@
 #include <asm/hardware.h>
 #include <asm/uaccess.h>
 
-#ifdef CONFIG_WATCHDOG_NOWAYOUT
-static int nowayout = 1;
-#else
-static int nowayout = 0;
-#endif
+static int nowayout = WATCHDOG_NOWAYOUT;
 static unsigned int heartbeat = 60;     /* (secs) Default is 1 minute */
 static unsigned long wdt_status;
 
diff --git a/drivers/char/watchdog/ixp4xx_wdt.c b/drivers/char/watchdog/ixp4xx_wdt.c
index 83df369113a4..8d916afbf4fa 100644
--- a/drivers/char/watchdog/ixp4xx_wdt.c
+++ b/drivers/char/watchdog/ixp4xx_wdt.c
@@ -27,11 +27,7 @@
 #include <asm/hardware.h>
 #include <asm/uaccess.h>
 
-#ifdef CONFIG_WATCHDOG_NOWAYOUT
-static int nowayout = 1;
-#else
-static int nowayout = 0;
-#endif
+static int nowayout = WATCHDOG_NOWAYOUT;
 static int heartbeat = 60;      /* (secs) Default is 1 minute */
 static unsigned long wdt_status;
 static unsigned long boot_status;
diff --git a/drivers/char/watchdog/machzwd.c b/drivers/char/watchdog/machzwd.c
index 9da395fa7794..a9a20aad61e7 100644
--- a/drivers/char/watchdog/machzwd.c
+++ b/drivers/char/watchdog/machzwd.c
@@ -94,12 +94,7 @@ MODULE_DESCRIPTION("MachZ ZF-Logic Watchdog driver");
 MODULE_LICENSE("GPL");
 MODULE_ALIAS_MISCDEV(WATCHDOG_MINOR);
 
-#ifdef CONFIG_WATCHDOG_NOWAYOUT
-static int nowayout = 1;
-#else
-static int nowayout = 0;
-#endif
-
+static int nowayout = WATCHDOG_NOWAYOUT;
 module_param(nowayout, int, 0);
 MODULE_PARM_DESC(nowayout, "Watchdog cannot be stopped once started (default=CONFIG_WATCHDOG_NOWAYOUT)");
 
diff --git a/drivers/char/watchdog/mixcomwd.c b/drivers/char/watchdog/mixcomwd.c
index 3143e4a07535..c9b301dccec3 100644
--- a/drivers/char/watchdog/mixcomwd.c
+++ b/drivers/char/watchdog/mixcomwd.c
@@ -62,12 +62,7 @@ static int mixcomwd_timer_alive;
 static struct timer_list mixcomwd_timer = TIMER_INITIALIZER(NULL, 0, 0);
 static char expect_close;
 
-#ifdef CONFIG_WATCHDOG_NOWAYOUT
-static int nowayout = 1;
-#else
-static int nowayout = 0;
-#endif
-
+static int nowayout = WATCHDOG_NOWAYOUT;
 module_param(nowayout, int, 0);
 MODULE_PARM_DESC(nowayout, "Watchdog cannot be stopped once started (default=CONFIG_WATCHDOG_NOWAYOUT)");
 
diff --git a/drivers/char/watchdog/pcwd.c b/drivers/char/watchdog/pcwd.c
index 6ebce3f2ef9c..427ad51b7a35 100644
--- a/drivers/char/watchdog/pcwd.c
+++ b/drivers/char/watchdog/pcwd.c
@@ -146,12 +146,7 @@ static int heartbeat = WATCHDOG_HEARTBEAT;
 module_param(heartbeat, int, 0);
 MODULE_PARM_DESC(heartbeat, "Watchdog heartbeat in seconds. (2<=heartbeat<=7200, default=" __MODULE_STRING(WATCHDOG_HEARTBEAT) ")");
 
-#ifdef CONFIG_WATCHDOG_NOWAYOUT
-static int nowayout = 1;
-#else
-static int nowayout = 0;
-#endif
-
+static int nowayout = WATCHDOG_NOWAYOUT;
 module_param(nowayout, int, 0);
 MODULE_PARM_DESC(nowayout, "Watchdog cannot be stopped once started (default=CONFIG_WATCHDOG_NOWAYOUT)");
 
diff --git a/drivers/char/watchdog/pcwd_pci.c b/drivers/char/watchdog/pcwd_pci.c
index 8ce066627326..2b13afb09c5d 100644
--- a/drivers/char/watchdog/pcwd_pci.c
+++ b/drivers/char/watchdog/pcwd_pci.c
@@ -103,12 +103,7 @@ static int heartbeat = WATCHDOG_HEARTBEAT;
 module_param(heartbeat, int, 0);
 MODULE_PARM_DESC(heartbeat, "Watchdog heartbeat in seconds. (0<heartbeat<65536, default=" __MODULE_STRING(WATCHDOG_HEARTBEAT) ")");
 
-#ifdef CONFIG_WATCHDOG_NOWAYOUT
-static int nowayout = 1;
-#else
-static int nowayout = 0;
-#endif
-
+static int nowayout = WATCHDOG_NOWAYOUT;
 module_param(nowayout, int, 0);
 MODULE_PARM_DESC(nowayout, "Watchdog cannot be stopped once started (default=CONFIG_WATCHDOG_NOWAYOUT)");
 
diff --git a/drivers/char/watchdog/pcwd_usb.c b/drivers/char/watchdog/pcwd_usb.c
index 1127201d73b8..092e9b133750 100644
--- a/drivers/char/watchdog/pcwd_usb.c
+++ b/drivers/char/watchdog/pcwd_usb.c
@@ -79,12 +79,7 @@ static int heartbeat = WATCHDOG_HEARTBEAT;
 module_param(heartbeat, int, 0);
 MODULE_PARM_DESC(heartbeat, "Watchdog heartbeat in seconds. (0<heartbeat<65536, default=" __MODULE_STRING(WATCHDOG_HEARTBEAT) ")");
 
-#ifdef CONFIG_WATCHDOG_NOWAYOUT
-static int nowayout = 1;
-#else
-static int nowayout = 0;
-#endif
-
+static int nowayout = WATCHDOG_NOWAYOUT;
 module_param(nowayout, int, 0);
 MODULE_PARM_DESC(nowayout, "Watchdog cannot be stopped once started (default=CONFIG_WATCHDOG_NOWAYOUT)");
 
diff --git a/drivers/char/watchdog/s3c2410_wdt.c b/drivers/char/watchdog/s3c2410_wdt.c
index 1699d2c28ce5..f85ac898a49a 100644
--- a/drivers/char/watchdog/s3c2410_wdt.c
+++ b/drivers/char/watchdog/s3c2410_wdt.c
@@ -62,12 +62,7 @@
 #define CONFIG_S3C2410_WATCHDOG_ATBOOT          (0)
 #define CONFIG_S3C2410_WATCHDOG_DEFAULT_TIME    (15)
 
-#ifdef CONFIG_WATCHDOG_NOWAYOUT
-static int nowayout = 1;
-#else
-static int nowayout = 0;
-#endif
-
+static int nowayout = WATCHDOG_NOWAYOUT;
 static int tmr_margin   = CONFIG_S3C2410_WATCHDOG_DEFAULT_TIME;
 static int tmr_atboot   = CONFIG_S3C2410_WATCHDOG_ATBOOT;
 static int soft_noboot  = 0;
diff --git a/drivers/char/watchdog/sa1100_wdt.c b/drivers/char/watchdog/sa1100_wdt.c
index 34e8f7b15e30..1b2132617dc3 100644
--- a/drivers/char/watchdog/sa1100_wdt.c
+++ b/drivers/char/watchdog/sa1100_wdt.c
@@ -42,11 +42,7 @@ static unsigned long sa1100wdt_users;
 static int expect_close;
 static int pre_margin;
 static int boot_status;
-#ifdef CONFIG_WATCHDOG_NOWAYOUT
-static int nowayout = 1;
-#else
-static int nowayout = 0;
-#endif
+static int nowayout = WATCHDOG_NOWAYOUT;
 
 /*
  *      Allow only one person to hold it open
diff --git a/drivers/char/watchdog/sbc60xxwdt.c b/drivers/char/watchdog/sbc60xxwdt.c
index d7de9880605a..ed0bd55fbfc1 100644
--- a/drivers/char/watchdog/sbc60xxwdt.c
+++ b/drivers/char/watchdog/sbc60xxwdt.c
@@ -98,12 +98,7 @@ static int timeout = WATCHDOG_TIMEOUT;	/* in seconds, will be multiplied by HZ t
 module_param(timeout, int, 0);
 MODULE_PARM_DESC(timeout, "Watchdog timeout in seconds. (1<=timeout<=3600, default=" __MODULE_STRING(WATCHDOG_TIMEOUT) ")");
 
-#ifdef CONFIG_WATCHDOG_NOWAYOUT
-static int nowayout = 1;
-#else
-static int nowayout = 0;
-#endif
-
+static int nowayout = WATCHDOG_NOWAYOUT;
 module_param(nowayout, int, 0);
 MODULE_PARM_DESC(nowayout, "Watchdog cannot be stopped once started (default=CONFIG_WATCHDOG_NOWAYOUT)");
 
diff --git a/drivers/char/watchdog/sc1200wdt.c b/drivers/char/watchdog/sc1200wdt.c
index 24401e84729e..515ce7572049 100644
--- a/drivers/char/watchdog/sc1200wdt.c
+++ b/drivers/char/watchdog/sc1200wdt.c
@@ -91,12 +91,7 @@ MODULE_PARM_DESC(io, "io port");
 module_param(timeout, int, 0);
 MODULE_PARM_DESC(timeout, "range is 0-255 minutes, default is 1");
 
-#ifdef CONFIG_WATCHDOG_NOWAYOUT
-static int nowayout = 1;
-#else
-static int nowayout = 0;
-#endif
-
+static int nowayout = WATCHDOG_NOWAYOUT;
 module_param(nowayout, int, 0);
 MODULE_PARM_DESC(nowayout, "Watchdog cannot be stopped once started (default=CONFIG_WATCHDOG_NOWAYOUT)");
 
diff --git a/drivers/char/watchdog/sc520_wdt.c b/drivers/char/watchdog/sc520_wdt.c
index f6d143e1900d..72501be79b0c 100644
--- a/drivers/char/watchdog/sc520_wdt.c
+++ b/drivers/char/watchdog/sc520_wdt.c
@@ -94,12 +94,7 @@ static int timeout = WATCHDOG_TIMEOUT;	/* in seconds, will be multiplied by HZ t
 module_param(timeout, int, 0);
 MODULE_PARM_DESC(timeout, "Watchdog timeout in seconds. (1<=timeout<=3600, default=" __MODULE_STRING(WATCHDOG_TIMEOUT) ")");
 
-#ifdef CONFIG_WATCHDOG_NOWAYOUT
-static int nowayout = 1;
-#else
-static int nowayout = 0;
-#endif
-
+static int nowayout = WATCHDOG_NOWAYOUT;
 module_param(nowayout, int, 0);
 MODULE_PARM_DESC(nowayout, "Watchdog cannot be stopped once started (default=CONFIG_WATCHDOG_NOWAYOUT)");
 
diff --git a/drivers/char/watchdog/scx200_wdt.c b/drivers/char/watchdog/scx200_wdt.c
index b569670e4ed5..c4568569f3a8 100644
--- a/drivers/char/watchdog/scx200_wdt.c
+++ b/drivers/char/watchdog/scx200_wdt.c
@@ -39,15 +39,11 @@ MODULE_DESCRIPTION("NatSemi SCx200 Watchdog Driver");
 MODULE_LICENSE("GPL");
 MODULE_ALIAS_MISCDEV(WATCHDOG_MINOR);
 
-#ifndef CONFIG_WATCHDOG_NOWAYOUT
-#define CONFIG_WATCHDOG_NOWAYOUT 0
-#endif
-
 static int margin = 60;         /* in seconds */
 module_param(margin, int, 0);
 MODULE_PARM_DESC(margin, "Watchdog margin in seconds");
 
-static int nowayout = CONFIG_WATCHDOG_NOWAYOUT;
+static int nowayout = WATCHDOG_NOWAYOUT;
 module_param(nowayout, int, 0);
 MODULE_PARM_DESC(nowayout, "Disable watchdog shutdown on close");
 
diff --git a/drivers/char/watchdog/shwdt.c b/drivers/char/watchdog/shwdt.c
index 3bc9272a474c..1f4cab55b2ef 100644
--- a/drivers/char/watchdog/shwdt.c
+++ b/drivers/char/watchdog/shwdt.c
@@ -75,11 +75,7 @@ static unsigned long next_heartbeat;
 #define WATCHDOG_HEARTBEAT 30                   /* 30 sec default heartbeat */
 static int heartbeat = WATCHDOG_HEARTBEAT;      /* in seconds */
 
-#ifdef CONFIG_WATCHDOG_NOWAYOUT
-static int nowayout = 1;
-#else
-static int nowayout = 0;
-#endif
+static int nowayout = WATCHDOG_NOWAYOUT;
 
 /**
  *      sh_wdt_start - Start the Watchdog
diff --git a/drivers/char/watchdog/softdog.c b/drivers/char/watchdog/softdog.c
index 98c7578740e2..4d7ed931f5c6 100644
--- a/drivers/char/watchdog/softdog.c
+++ b/drivers/char/watchdog/softdog.c
@@ -56,12 +56,7 @@ static int soft_margin = TIMER_MARGIN;	/* in seconds */
 module_param(soft_margin, int, 0);
 MODULE_PARM_DESC(soft_margin, "Watchdog soft_margin in seconds. (0<soft_margin<65536, default=" __MODULE_STRING(TIMER_MARGIN) ")");
 
-#ifdef CONFIG_WATCHDOG_NOWAYOUT
-static int nowayout = 1;
-#else
-static int nowayout = 0;
-#endif
-
+static int nowayout = WATCHDOG_NOWAYOUT;
 module_param(nowayout, int, 0);
 MODULE_PARM_DESC(nowayout, "Watchdog cannot be stopped once started (default=CONFIG_WATCHDOG_NOWAYOUT)");
 
diff --git a/drivers/char/watchdog/w83627hf_wdt.c b/drivers/char/watchdog/w83627hf_wdt.c
index 813c97038f84..465e0fd0423d 100644
--- a/drivers/char/watchdog/w83627hf_wdt.c
+++ b/drivers/char/watchdog/w83627hf_wdt.c
@@ -54,12 +54,7 @@ static int timeout = WATCHDOG_TIMEOUT;	/* in seconds */
 module_param(timeout, int, 0);
 MODULE_PARM_DESC(timeout, "Watchdog timeout in seconds. 1<= timeout <=63, default=" __MODULE_STRING(WATCHDOG_TIMEOUT) ".");
 
-#ifdef CONFIG_WATCHDOG_NOWAYOUT
-static int nowayout = 1;
-#else
-static int nowayout = 0;
-#endif
-
+static int nowayout = WATCHDOG_NOWAYOUT;
 module_param(nowayout, int, 0);
 MODULE_PARM_DESC(nowayout, "Watchdog cannot be stopped once started (default=CONFIG_WATCHDOG_NOWAYOUT)");
 
diff --git a/drivers/char/watchdog/w83877f_wdt.c b/drivers/char/watchdog/w83877f_wdt.c
index bccbd4d6ac2d..52a8bd0a5988 100644
--- a/drivers/char/watchdog/w83877f_wdt.c
+++ b/drivers/char/watchdog/w83877f_wdt.c
@@ -85,12 +85,7 @@ module_param(timeout, int, 0);
 MODULE_PARM_DESC(timeout, "Watchdog timeout in seconds. (1<=timeout<=3600, default=" __MODULE_STRING(WATCHDOG_TIMEOUT) ")");
 
 
-#ifdef CONFIG_WATCHDOG_NOWAYOUT
-static int nowayout = 1;
-#else
-static int nowayout = 0;
-#endif
-
+static int nowayout = WATCHDOG_NOWAYOUT;
 module_param(nowayout, int, 0);
 MODULE_PARM_DESC(nowayout, "Watchdog cannot be stopped once started (default=CONFIG_WATCHDOG_NOWAYOUT)");
 
diff --git a/drivers/char/watchdog/wafer5823wdt.c b/drivers/char/watchdog/wafer5823wdt.c
index abb0bea45c02..7cf6c9bbf486 100644
--- a/drivers/char/watchdog/wafer5823wdt.c
+++ b/drivers/char/watchdog/wafer5823wdt.c
@@ -63,12 +63,7 @@ static int timeout = WD_TIMO;  /* in seconds */
 module_param(timeout, int, 0);
 MODULE_PARM_DESC(timeout, "Watchdog timeout in seconds. 1<= timeout <=255, default=" __MODULE_STRING(WD_TIMO) ".");
 
-#ifdef CONFIG_WATCHDOG_NOWAYOUT
-static int nowayout = 1;
-#else
-static int nowayout = 0;
-#endif
-
+static int nowayout = WATCHDOG_NOWAYOUT;
 module_param(nowayout, int, 0);
 MODULE_PARM_DESC(nowayout, "Watchdog cannot be stopped once started (default=CONFIG_WATCHDOG_NOWAYOUT)");
 
diff --git a/drivers/char/watchdog/wdt.c b/drivers/char/watchdog/wdt.c
index 1210ca0c425b..ec7e401228ee 100644
--- a/drivers/char/watchdog/wdt.c
+++ b/drivers/char/watchdog/wdt.c
@@ -63,12 +63,7 @@ static int wd_heartbeat;
 module_param(heartbeat, int, 0);
 MODULE_PARM_DESC(heartbeat, "Watchdog heartbeat in seconds. (0<heartbeat<65536, default=" __MODULE_STRING(WD_TIMO) ")");
 
-#ifdef CONFIG_WATCHDOG_NOWAYOUT
-static int nowayout = 1;
-#else
-static int nowayout = 0;
-#endif
-
+static int nowayout = WATCHDOG_NOWAYOUT;
 module_param(nowayout, int, 0);
 MODULE_PARM_DESC(nowayout, "Watchdog cannot be stopped once started (default=CONFIG_WATCHDOG_NOWAYOUT)");
 
diff --git a/drivers/char/watchdog/wdt977.c b/drivers/char/watchdog/wdt977.c
index 072e9b214759..44d49dfacbb3 100644
--- a/drivers/char/watchdog/wdt977.c
+++ b/drivers/char/watchdog/wdt977.c
@@ -53,12 +53,7 @@ MODULE_PARM_DESC(timeout,"Watchdog timeout in seconds (60..15300), default=" __M
 module_param(testmode, int, 0);
 MODULE_PARM_DESC(testmode,"Watchdog testmode (1 = no reboot), default=0");
 
-#ifdef CONFIG_WATCHDOG_NOWAYOUT
-static int nowayout = 1;
-#else
-static int nowayout = 0;
-#endif
-
+static int nowayout = WATCHDOG_NOWAYOUT;
 module_param(nowayout, int, 0);
 MODULE_PARM_DESC(nowayout, "Watchdog cannot be stopped once started (default=CONFIG_WATCHDOG_NOWAYOUT)");
 
diff --git a/drivers/char/watchdog/wdt_pci.c b/drivers/char/watchdog/wdt_pci.c
index c80cb77b92fb..4b3311993d48 100644
--- a/drivers/char/watchdog/wdt_pci.c
+++ b/drivers/char/watchdog/wdt_pci.c
@@ -89,12 +89,7 @@ static int wd_heartbeat;
 module_param(heartbeat, int, 0);
 MODULE_PARM_DESC(heartbeat, "Watchdog heartbeat in seconds. (0<heartbeat<65536, default=" __MODULE_STRING(WD_TIMO) ")");
 
-#ifdef CONFIG_WATCHDOG_NOWAYOUT
-static int nowayout = 1;
-#else
-static int nowayout = 0;
-#endif
-
+static int nowayout = WATCHDOG_NOWAYOUT;
 module_param(nowayout, int, 0);
 MODULE_PARM_DESC(nowayout, "Watchdog cannot be stopped once started (default=CONFIG_WATCHDOG_NOWAYOUT)");
 
diff --git a/drivers/i2c/busses/i2c-mpc.c b/drivers/i2c/busses/i2c-mpc.c
index 03c23ce98edb..9ad3e9262e8a 100644
--- a/drivers/i2c/busses/i2c-mpc.c
+++ b/drivers/i2c/busses/i2c-mpc.c
@@ -288,6 +288,100 @@ static struct i2c_adapter mpc_ops = {
         .retries = 1
 };
 
+static int fsl_i2c_probe(struct device *device)
+{
+        int result = 0;
+        struct mpc_i2c *i2c;
+        struct platform_device *pdev = to_platform_device(device);
+        struct fsl_i2c_platform_data *pdata;
+        struct resource *r = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+
+        pdata = (struct fsl_i2c_platform_data *) pdev->dev.platform_data;
+
+        if (!(i2c = kmalloc(sizeof(*i2c), GFP_KERNEL))) {
+                return -ENOMEM;
+        }
+        memset(i2c, 0, sizeof(*i2c));
+
+        i2c->irq = platform_get_irq(pdev, 0);
+        i2c->flags = pdata->device_flags;
+        init_waitqueue_head(&i2c->queue);
+
+        i2c->base = ioremap((phys_addr_t)r->start, MPC_I2C_REGION);
+
+        if (!i2c->base) {
+                printk(KERN_ERR "i2c-mpc - failed to map controller\n");
+                result = -ENOMEM;
+                goto fail_map;
+        }
+
+        if (i2c->irq != 0)
+                if ((result = request_irq(i2c->irq, mpc_i2c_isr,
+                                          SA_SHIRQ, "i2c-mpc", i2c)) < 0) {
+                        printk(KERN_ERR
+                               "i2c-mpc - failed to attach interrupt\n");
+                        goto fail_irq;
+                }
+
+        mpc_i2c_setclock(i2c);
+        dev_set_drvdata(device, i2c);
+
+        i2c->adap = mpc_ops;
+        i2c_set_adapdata(&i2c->adap, i2c);
+        i2c->adap.dev.parent = &pdev->dev;
+        if ((result = i2c_add_adapter(&i2c->adap)) < 0) {
+                printk(KERN_ERR "i2c-mpc - failed to add adapter\n");
+                goto fail_add;
+        }
+
+        return result;
+
+      fail_add:
+        if (i2c->irq != 0)
+                free_irq(i2c->irq, NULL);
+      fail_irq:
+        iounmap(i2c->base);
+      fail_map:
+        kfree(i2c);
+        return result;
+};
+
+static int fsl_i2c_remove(struct device *device)
+{
+        struct mpc_i2c *i2c = dev_get_drvdata(device);
+
+        i2c_del_adapter(&i2c->adap);
+        dev_set_drvdata(device, NULL);
+
+        if (i2c->irq != 0)
+                free_irq(i2c->irq, i2c);
+
+        iounmap(i2c->base);
+        kfree(i2c);
+        return 0;
+};
+
+/* Structure for a device driver */
+static struct device_driver fsl_i2c_driver = {
+        .name = "fsl-i2c",
+        .bus = &platform_bus_type,
+        .probe = fsl_i2c_probe,
+        .remove = fsl_i2c_remove,
+};
+
+static int __init fsl_i2c_init(void)
+{
+        return driver_register(&fsl_i2c_driver);
+}
+
+static void __exit fsl_i2c_exit(void)
+{
+        driver_unregister(&fsl_i2c_driver);
+}
+
+module_init(fsl_i2c_init);
+module_exit(fsl_i2c_exit);
+
 MODULE_AUTHOR("Adrian Cox <adrian@humboldt.co.uk>");
 MODULE_DESCRIPTION
     ("I2C-Bus adapter for MPC107 bridge and MPC824x/85xx/52xx processors");
diff --git a/drivers/ide/cris/Makefile b/drivers/ide/cris/Makefile
index fdc294325d00..6176e8d6b2e6 100644
--- a/drivers/ide/cris/Makefile
+++ b/drivers/ide/cris/Makefile
@@ -1,3 +1,3 @@
 EXTRA_CFLAGS                            += -Idrivers/ide
 
-obj-$(CONFIG_ETRAX_ARCH_V10)            += ide-v10.o
+obj-y                                   += ide-cris.o
diff --git a/drivers/ide/cris/ide-cris.c b/drivers/ide/cris/ide-cris.c
new file mode 100644
index 000000000000..cd15e6260510
--- /dev/null
+++ b/drivers/ide/cris/ide-cris.c
@@ -0,0 +1,1107 @@
+/* $Id: cris-ide-driver.patch,v 1.1 2005/06/29 21:39:07 akpm Exp $
+ *
+ * Etrax specific IDE functions, like init and PIO-mode setting etc.
+ * Almost the entire ide.c is used for the rest of the Etrax ATA driver.
+ * Copyright (c) 2000-2005 Axis Communications AB
+ *
+ * Authors:    Bjorn Wesen        (initial version)
+ *             Mikael Starvik     (crisv32 port)
+ */
+
+/* Regarding DMA:
+ *
+ * There are two forms of DMA - "DMA handshaking" between the interface and the drive,
+ * and DMA between the memory and the interface. We can ALWAYS use the latter, since it's
+ * something built-in in the Etrax. However only some drives support the DMA-mode handshaking
+ * on the ATA-bus. The normal PC driver and Triton interface disables memory-if DMA when the
+ * device can't do DMA handshaking for some stupid reason. We don't need to do that.
+ */
+
+#undef REALLY_SLOW_IO           /* most systems can safely undef this */
+
+#include <linux/config.h>
+#include <linux/types.h>
+#include <linux/kernel.h>
+#include <linux/timer.h>
+#include <linux/mm.h>
+#include <linux/interrupt.h>
+#include <linux/delay.h>
+#include <linux/blkdev.h>
+#include <linux/hdreg.h>
+#include <linux/ide.h>
+#include <linux/init.h>
+
+#include <asm/io.h>
+#include <asm/dma.h>
+
+/* number of DMA descriptors */
+#define MAX_DMA_DESCRS 64
+
+/* number of times to retry busy-flags when reading/writing IDE-registers
+ * this can't be too high because a hung harddisk might cause the watchdog
+ * to trigger (sometimes INB and OUTB are called with irq's disabled)
+ */
+
+#define IDE_REGISTER_TIMEOUT 300
+
+#define LOWDB(x)
+#define D(x)
+
+enum /* Transfer types */
+{
+        TYPE_PIO,
+        TYPE_DMA,
+        TYPE_UDMA
+};
+
+/* CRISv32 specifics */
+#ifdef CONFIG_ETRAX_ARCH_V32
+#include <asm/arch/hwregs/ata_defs.h>
+#include <asm/arch/hwregs/dma_defs.h>
+#include <asm/arch/hwregs/dma.h>
+#include <asm/arch/pinmux.h>
+
+#define ATA_UDMA2_CYC    2
+#define ATA_UDMA2_DVS    3
+#define ATA_UDMA1_CYC    2
+#define ATA_UDMA1_DVS    4
+#define ATA_UDMA0_CYC    4
+#define ATA_UDMA0_DVS    6
+#define ATA_DMA2_STROBE  7
+#define ATA_DMA2_HOLD    1
+#define ATA_DMA1_STROBE  8
+#define ATA_DMA1_HOLD    3
+#define ATA_DMA0_STROBE 25
+#define ATA_DMA0_HOLD   19
+#define ATA_PIO4_SETUP   3
+#define ATA_PIO4_STROBE  7
+#define ATA_PIO4_HOLD    1
+#define ATA_PIO3_SETUP   3
+#define ATA_PIO3_STROBE  9
+#define ATA_PIO3_HOLD    3
+#define ATA_PIO2_SETUP   3
+#define ATA_PIO2_STROBE 13
+#define ATA_PIO2_HOLD    5
+#define ATA_PIO1_SETUP   5
+#define ATA_PIO1_STROBE 23
+#define ATA_PIO1_HOLD    9
+#define ATA_PIO0_SETUP   9
+#define ATA_PIO0_STROBE 39
+#define ATA_PIO0_HOLD    9
+
+int
+cris_ide_ack_intr(ide_hwif_t* hwif)
+{
+        reg_ata_rw_ctrl2 ctrl2 = REG_TYPE_CONV(reg_ata_rw_ctrl2,
+                                 int, hwif->io_ports[0]);
+        REG_WR_INT(ata, regi_ata, rw_ack_intr, 1 << ctrl2.sel);
+        return 1;
+}
+
+static inline int
+cris_ide_busy(void)
+{
+        reg_ata_rs_stat_data stat_data;
+        stat_data = REG_RD(ata, regi_ata, rs_stat_data);
+        return stat_data.busy;
+}
+
+static inline int
+cris_ide_ready(void)
+{
+        return !cris_ide_busy();
+}
+
+static inline int
+cris_ide_data_available(unsigned short* data)
+{
+        reg_ata_rs_stat_data stat_data;
+        stat_data = REG_RD(ata, regi_ata, rs_stat_data);
+        *data = stat_data.data;
+        return stat_data.dav;
+}
+
+static void
+cris_ide_write_command(unsigned long command)
+{
+        REG_WR_INT(ata, regi_ata, rw_ctrl2, command); /* write data to the drive's register */
+}
+
+static void
+cris_ide_set_speed(int type, int setup, int strobe, int hold)
+{
+        reg_ata_rw_ctrl0 ctrl0 = REG_RD(ata, regi_ata, rw_ctrl0);
+        reg_ata_rw_ctrl1 ctrl1 = REG_RD(ata, regi_ata, rw_ctrl1);
+
+        if (type == TYPE_PIO) {
+                ctrl0.pio_setup = setup;
+                ctrl0.pio_strb = strobe;
+                ctrl0.pio_hold = hold;
+        } else if (type == TYPE_DMA) {
+                ctrl0.dma_strb = strobe;
+                ctrl0.dma_hold = hold;
+        } else if (type == TYPE_UDMA) {
+                ctrl1.udma_tcyc = setup;
+                ctrl1.udma_tdvs = strobe;
+        }
+        REG_WR(ata, regi_ata, rw_ctrl0, ctrl0);
+        REG_WR(ata, regi_ata, rw_ctrl1, ctrl1);
+}
+
+static unsigned long
+cris_ide_base_address(int bus)
+{
+        reg_ata_rw_ctrl2 ctrl2 = {0};
+        ctrl2.sel = bus;
+        return REG_TYPE_CONV(int, reg_ata_rw_ctrl2, ctrl2);
+}
+
+static unsigned long
+cris_ide_reg_addr(unsigned long addr, int cs0, int cs1)
+{
+        reg_ata_rw_ctrl2 ctrl2 = {0};
+        ctrl2.addr = addr;
+        ctrl2.cs1 = cs1;
+        ctrl2.cs0 = cs0;
+        return REG_TYPE_CONV(int, reg_ata_rw_ctrl2, ctrl2);
+}
+
+static __init void
+cris_ide_reset(unsigned val)
+{
+        reg_ata_rw_ctrl0 ctrl0 = {0};
+        ctrl0.rst = val ? regk_ata_active : regk_ata_inactive;
+        REG_WR(ata, regi_ata, rw_ctrl0, ctrl0);
+}
+
+static __init void
+cris_ide_init(void)
+{
+        reg_ata_rw_ctrl0 ctrl0 = {0};
+        reg_ata_rw_intr_mask intr_mask = {0};
+
+        ctrl0.en = regk_ata_yes;
+        REG_WR(ata, regi_ata, rw_ctrl0, ctrl0);
+
+        intr_mask.bus0 = regk_ata_yes;
+        intr_mask.bus1 = regk_ata_yes;
+        intr_mask.bus2 = regk_ata_yes;
+        intr_mask.bus3 = regk_ata_yes;
+
+        REG_WR(ata, regi_ata, rw_intr_mask, intr_mask);
+
+        crisv32_request_dma(2, "ETRAX FS built-in ATA", DMA_VERBOSE_ON_ERROR, 0, dma_ata);
+        crisv32_request_dma(3, "ETRAX FS built-in ATA", DMA_VERBOSE_ON_ERROR, 0, dma_ata);
+
+        crisv32_pinmux_alloc_fixed(pinmux_ata);
+        crisv32_pinmux_alloc_fixed(pinmux_ata0);
+        crisv32_pinmux_alloc_fixed(pinmux_ata1);
+        crisv32_pinmux_alloc_fixed(pinmux_ata2);
+        crisv32_pinmux_alloc_fixed(pinmux_ata3);
+
+        DMA_RESET(regi_dma2);
+        DMA_ENABLE(regi_dma2);
+        DMA_RESET(regi_dma3);
+        DMA_ENABLE(regi_dma3);
+
+        DMA_WR_CMD (regi_dma2, regk_dma_set_w_size2);
+        DMA_WR_CMD (regi_dma3, regk_dma_set_w_size2);
+}
+
+static dma_descr_context mycontext __attribute__ ((__aligned__(32)));
+
+#define cris_dma_descr_type dma_descr_data
+#define cris_pio_read regk_ata_rd
+#define cris_ultra_mask 0x7
+#define MAX_DESCR_SIZE 0xffffffffUL
+
+static unsigned long
+cris_ide_get_reg(unsigned long reg)
+{
+        return (reg & 0x0e000000) >> 25;
+}
+
+static void
+cris_ide_fill_descriptor(cris_dma_descr_type *d, void* buf, unsigned int len, int last)
+{
+        d->buf = (char*)virt_to_phys(buf);
+        d->after = d->buf + len;
+        d->eol = last;
+}
+
+static void
+cris_ide_start_dma(ide_drive_t *drive, cris_dma_descr_type *d, int dir,int type,int len)
+{
+        reg_ata_rw_ctrl2 ctrl2 = REG_TYPE_CONV(reg_ata_rw_ctrl2, int, IDE_DATA_REG);
+        reg_ata_rw_trf_cnt trf_cnt = {0};
+
+        mycontext.saved_data = (dma_descr_data*)virt_to_phys(d);
+        mycontext.saved_data_buf = d->buf;
+        /* start the dma channel */
+        DMA_START_CONTEXT(dir ? regi_dma3 : regi_dma2, virt_to_phys(&mycontext));
+
+        /* initiate a multi word dma read using PIO handshaking */
+        trf_cnt.cnt = len >> 1;
+        /* Due to a "feature" the transfer count has to be one extra word for UDMA. */
+        if (type == TYPE_UDMA)
+                trf_cnt.cnt++;
+        REG_WR(ata, regi_ata, rw_trf_cnt, trf_cnt);
+
+        ctrl2.rw = dir ? regk_ata_rd : regk_ata_wr;
+        ctrl2.trf_mode = regk_ata_dma;
+        ctrl2.hsh = type == TYPE_PIO ? regk_ata_pio :
+                    type == TYPE_DMA ? regk_ata_dma : regk_ata_udma;
+        ctrl2.multi = regk_ata_yes;
+        ctrl2.dma_size = regk_ata_word;
+        REG_WR(ata, regi_ata, rw_ctrl2, ctrl2);
+}
+
+static void
+cris_ide_wait_dma(int dir)
+{
+        reg_dma_rw_stat status;
+        do
+        {
+                status = REG_RD(dma, dir ? regi_dma3 : regi_dma2, rw_stat);
+        } while(status.list_state != regk_dma_data_at_eol);
+}
+
+static int cris_dma_test_irq(ide_drive_t *drive)
+{
+        int intr = REG_RD_INT(ata, regi_ata, r_intr);
+        reg_ata_rw_ctrl2 ctrl2 = REG_TYPE_CONV(reg_ata_rw_ctrl2, int, IDE_DATA_REG);
+        return intr & (1 << ctrl2.sel) ? 1 : 0;
+}
+
+static void cris_ide_initialize_dma(int dir)
+{
+}
+
+#else
+/* CRISv10 specifics */
+#include <asm/arch/svinto.h>
+#include <asm/arch/io_interface_mux.h>
+
+/* PIO timing (in R_ATA_CONFIG)
+ *
+ *                        _____________________________
+ * ADDRESS :     ________/
+ *
+ *                            _______________
+ * DIOR    :     ____________/               \__________
+ *
+ *                               _______________
+ * DATA    :     XXXXXXXXXXXXXXXX_______________XXXXXXXX
+ *
+ *
+ * DIOR is unbuffered while address and data is buffered.
+ * This creates two problems:
+ * 1. The DIOR pulse is to early (because it is unbuffered)
+ * 2. The rise time of DIOR is long
+ *
+ * There are at least three different plausible solutions
+ * 1. Use a pad capable of larger currents in Etrax
+ * 2. Use an external buffer
+ * 3. Make the strobe pulse longer
+ *
+ * Some of the strobe timings below are modified to compensate
+ * for this. This implies a slight performance decrease.
+ *
+ * THIS SHOULD NEVER BE CHANGED!
+ *
+ * TODO: Is this true for the latest LX boards still ?
+ */
+
+#define ATA_UDMA2_CYC    0 /* No UDMA supported, just to make it compile. */
+#define ATA_UDMA2_DVS    0
+#define ATA_UDMA1_CYC    0
+#define ATA_UDMA1_DVS    0
+#define ATA_UDMA0_CYC    0
+#define ATA_UDMA0_DVS    0
+#define ATA_DMA2_STROBE  4
+#define ATA_DMA2_HOLD    0
+#define ATA_DMA1_STROBE  4
+#define ATA_DMA1_HOLD    1
+#define ATA_DMA0_STROBE 12
+#define ATA_DMA0_HOLD    9
+#define ATA_PIO4_SETUP   1
+#define ATA_PIO4_STROBE  5
+#define ATA_PIO4_HOLD    0
+#define ATA_PIO3_SETUP   1
+#define ATA_PIO3_STROBE  5
+#define ATA_PIO3_HOLD    1
+#define ATA_PIO2_SETUP   1
+#define ATA_PIO2_STROBE  6
+#define ATA_PIO2_HOLD    2
+#define ATA_PIO1_SETUP   2
+#define ATA_PIO1_STROBE 11
+#define ATA_PIO1_HOLD    4
+#define ATA_PIO0_SETUP   4
+#define ATA_PIO0_STROBE 19
+#define ATA_PIO0_HOLD    4
+
+int
+cris_ide_ack_intr(ide_hwif_t* hwif)
+{
+        return 1;
+}
+
+static inline int
+cris_ide_busy(void)
+{
+        return *R_ATA_STATUS_DATA & IO_MASK(R_ATA_STATUS_DATA, busy) ;
+}
+
+static inline int
+cris_ide_ready(void)
+{
+        return *R_ATA_STATUS_DATA & IO_MASK(R_ATA_STATUS_DATA, tr_rdy) ;
+}
+
+static inline int
+cris_ide_data_available(unsigned short* data)
+{
+        unsigned long status = *R_ATA_STATUS_DATA;
+        *data = (unsigned short)status;
+        return status & IO_MASK(R_ATA_STATUS_DATA, dav);
+}
+
+static void
+cris_ide_write_command(unsigned long command)
+{
+        *R_ATA_CTRL_DATA = command;
+}
+
+static void
+cris_ide_set_speed(int type, int setup, int strobe, int hold)
+{
+        static int pio_setup = ATA_PIO4_SETUP;
+        static int pio_strobe = ATA_PIO4_STROBE;
+        static int pio_hold = ATA_PIO4_HOLD;
+        static int dma_strobe = ATA_DMA2_STROBE;
+        static int dma_hold = ATA_DMA2_HOLD;
+
+        if (type == TYPE_PIO) {
+                pio_setup = setup;
+                pio_strobe = strobe;
+                pio_hold = hold;
+        } else if (type == TYPE_DMA) {
+                dma_strobe = strobe;
+          dma_hold = hold;
+        }
+        *R_ATA_CONFIG = ( IO_FIELD( R_ATA_CONFIG, enable, 1 ) |
+          IO_FIELD( R_ATA_CONFIG, dma_strobe, dma_strobe ) |
+                IO_FIELD( R_ATA_CONFIG, dma_hold,   dma_hold ) |
+                IO_FIELD( R_ATA_CONFIG, pio_setup,  pio_setup ) |
+                IO_FIELD( R_ATA_CONFIG, pio_strobe, pio_strobe ) |
+                IO_FIELD( R_ATA_CONFIG, pio_hold,   pio_hold ) );
+}
+
+static unsigned long
+cris_ide_base_address(int bus)
+{
+        return IO_FIELD(R_ATA_CTRL_DATA, sel, bus);
+}
+
+static unsigned long
+cris_ide_reg_addr(unsigned long addr, int cs0, int cs1)
+{
+        return IO_FIELD(R_ATA_CTRL_DATA, addr, addr) |
+               IO_FIELD(R_ATA_CTRL_DATA, cs0, cs0) |
+               IO_FIELD(R_ATA_CTRL_DATA, cs1, cs1);
+}
+
+static __init void
+cris_ide_reset(unsigned val)
+{
+#ifdef CONFIG_ETRAX_IDE_G27_RESET
+        REG_SHADOW_SET(R_PORT_G_DATA, port_g_data_shadow, 27, val);
+#endif
+#ifdef CONFIG_ETRAX_IDE_CSE1_16_RESET
+        REG_SHADOW_SET(port_cse1_addr, port_cse1_shadow, 16, val);
+#endif
+#ifdef CONFIG_ETRAX_IDE_CSP0_8_RESET
+        REG_SHADOW_SET(port_csp0_addr, port_csp0_shadow, 8, val);
+#endif
+#ifdef CONFIG_ETRAX_IDE_PB7_RESET
+        port_pb_dir_shadow = port_pb_dir_shadow |
+                IO_STATE(R_PORT_PB_DIR, dir7, output);
+        *R_PORT_PB_DIR = port_pb_dir_shadow;
+        REG_SHADOW_SET(R_PORT_PB_DATA, port_pb_data_shadow, 7, val);
+#endif
+}
+
+static __init void
+cris_ide_init(void)
+{
+        volatile unsigned int dummy;
+
+        *R_ATA_CTRL_DATA = 0;
+        *R_ATA_TRANSFER_CNT = 0;
+        *R_ATA_CONFIG = 0;
+
+        if (cris_request_io_interface(if_ata, "ETRAX100LX IDE")) {
+                printk(KERN_CRIT "ide: Failed to get IO interface\n");
+                return;
+        } else if (cris_request_dma(ATA_TX_DMA_NBR,
+                                          "ETRAX100LX IDE TX",
+                                          DMA_VERBOSE_ON_ERROR,
+                                          dma_ata)) {
+                cris_free_io_interface(if_ata);
+                printk(KERN_CRIT "ide: Failed to get Tx DMA channel\n");
+                return;
+        } else if (cris_request_dma(ATA_RX_DMA_NBR,
+                                          "ETRAX100LX IDE RX",
+                                          DMA_VERBOSE_ON_ERROR,
+                                          dma_ata)) {
+                cris_free_dma(ATA_TX_DMA_NBR, "ETRAX100LX IDE Tx");
+                cris_free_io_interface(if_ata);
+                printk(KERN_CRIT "ide: Failed to get Rx DMA channel\n");
+                return;
+        }
+
+        /* make a dummy read to set the ata controller in a proper state */
+        dummy = *R_ATA_STATUS_DATA;
+
+        *R_ATA_CONFIG = ( IO_FIELD( R_ATA_CONFIG, enable, 1 ));
+        *R_ATA_CTRL_DATA = ( IO_STATE( R_ATA_CTRL_DATA, rw,   read) |
+                             IO_FIELD( R_ATA_CTRL_DATA, addr, 1   ) );
+
+        while(*R_ATA_STATUS_DATA & IO_MASK(R_ATA_STATUS_DATA, busy)); /* wait for busy flag*/
+
+        *R_IRQ_MASK0_SET = ( IO_STATE( R_IRQ_MASK0_SET, ata_irq0, set ) |
+                             IO_STATE( R_IRQ_MASK0_SET, ata_irq1, set ) |
+                             IO_STATE( R_IRQ_MASK0_SET, ata_irq2, set ) |
+                             IO_STATE( R_IRQ_MASK0_SET, ata_irq3, set ) );
+
+        /* reset the dma channels we will use */
+
+        RESET_DMA(ATA_TX_DMA_NBR);
+        RESET_DMA(ATA_RX_DMA_NBR);
+        WAIT_DMA(ATA_TX_DMA_NBR);
+        WAIT_DMA(ATA_RX_DMA_NBR);
+}
+
+#define cris_dma_descr_type etrax_dma_descr
+#define cris_pio_read IO_STATE(R_ATA_CTRL_DATA, rw, read)
+#define cris_ultra_mask 0x0
+#define MAX_DESCR_SIZE 0x10000UL
+
+static unsigned long
+cris_ide_get_reg(unsigned long reg)
+{
+        return (reg & 0x0e000000) >> 25;
+}
+
+static void
+cris_ide_fill_descriptor(cris_dma_descr_type *d, void* buf, unsigned int len, int last)
+{
+        d->buf = virt_to_phys(buf);
+        d->sw_len = len == MAX_DESCR_SIZE ? 0 : len;
+        if (last)
+                d->ctrl |= d_eol;
+}
+
+static void cris_ide_start_dma(ide_drive_t *drive, cris_dma_descr_type *d, int dir, int type, int len)
+{
+        unsigned long cmd;
+
+        if (dir) {
+                /* need to do this before RX DMA due to a chip bug
+                 * it is enough to just flush the part of the cache that
+                 * corresponds to the buffers we start, but since HD transfers
+                 * usually are more than 8 kB, it is easier to optimize for the
+                 * normal case and just flush the entire cache. its the only
+                 * way to be sure! (OB movie quote)
+                 */
+                flush_etrax_cache();
+                *R_DMA_CH3_FIRST = virt_to_phys(d);
+                *R_DMA_CH3_CMD   = IO_STATE(R_DMA_CH3_CMD, cmd, start);
+
+        } else {
+                *R_DMA_CH2_FIRST = virt_to_phys(d);
+                *R_DMA_CH2_CMD   = IO_STATE(R_DMA_CH2_CMD, cmd, start);
+        }
+
+        /* initiate a multi word dma read using DMA handshaking */
+
+        *R_ATA_TRANSFER_CNT =
+                IO_FIELD(R_ATA_TRANSFER_CNT, count, len >> 1);
+
+        cmd = dir ? IO_STATE(R_ATA_CTRL_DATA, rw, read) : IO_STATE(R_ATA_CTRL_DATA, rw, write);
+        cmd |= type == TYPE_PIO ? IO_STATE(R_ATA_CTRL_DATA, handsh, pio) :
+                                  IO_STATE(R_ATA_CTRL_DATA, handsh, dma);
+        *R_ATA_CTRL_DATA =
+                cmd |
+                IO_FIELD(R_ATA_CTRL_DATA, data, IDE_DATA_REG) |
+                IO_STATE(R_ATA_CTRL_DATA, src_dst,  dma)  |
+                IO_STATE(R_ATA_CTRL_DATA, multi,    on)   |
+                IO_STATE(R_ATA_CTRL_DATA, dma_size, word);
+}
+
+static void
+cris_ide_wait_dma(int dir)
+{
+        if (dir)
+                WAIT_DMA(ATA_RX_DMA_NBR);
+        else
+                WAIT_DMA(ATA_TX_DMA_NBR);
+}
+
+static int cris_dma_test_irq(ide_drive_t *drive)
+{
+        int intr = *R_IRQ_MASK0_RD;
+        int bus = IO_EXTRACT(R_ATA_CTRL_DATA, sel, IDE_DATA_REG);
+        return intr & (1 << (bus + IO_BITNR(R_IRQ_MASK0_RD, ata_irq0))) ? 1 : 0;
+}
+
+
+static void cris_ide_initialize_dma(int dir)
+{
+        if (dir)
+        {
+                RESET_DMA(ATA_RX_DMA_NBR); /* sometimes the DMA channel get stuck so we need to do this */
+                WAIT_DMA(ATA_RX_DMA_NBR);
+        }
+        else
+        {
+                RESET_DMA(ATA_TX_DMA_NBR); /* sometimes the DMA channel get stuck so we need to do this */
+                WAIT_DMA(ATA_TX_DMA_NBR);
+        }
+}
+
+#endif
+
+void
+cris_ide_outw(unsigned short data, unsigned long reg) {
+        int timeleft;
+
+        LOWDB(printk("ow: data 0x%x, reg 0x%x\n", data, reg));
+
+        /* note the lack of handling any timeouts. we stop waiting, but we don't
+         * really notify anybody.
+         */
+
+        timeleft = IDE_REGISTER_TIMEOUT;
+        /* wait for busy flag */
+        do {
+                timeleft--;
+        } while(timeleft && cris_ide_busy());
+
+        /*
+         * Fall through at a timeout, so the ongoing command will be
+         * aborted by the write below, which is expected to be a dummy
+         * command to the command register.  This happens when a faulty
+         * drive times out on a command.  See comment on timeout in
+         * INB.
+         */
+        if(!timeleft)
+                printk("ATA timeout reg 0x%lx := 0x%x\n", reg, data);
+
+        cris_ide_write_command(reg|data); /* write data to the drive's register */
+
+        timeleft = IDE_REGISTER_TIMEOUT;
+        /* wait for transmitter ready */
+        do {
+                timeleft--;
+        } while(timeleft && !cris_ide_ready());
+}
+
+void
+cris_ide_outb(unsigned char data, unsigned long reg)
+{
+        cris_ide_outw(data, reg);
+}
+
+void
+cris_ide_outbsync(ide_drive_t *drive, u8 addr, unsigned long port)
+{
+        cris_ide_outw(addr, port);
+}
+
+unsigned short
+cris_ide_inw(unsigned long reg) {
+        int timeleft;
+        unsigned short val;
+
+        timeleft = IDE_REGISTER_TIMEOUT;
+        /* wait for busy flag */
+        do {
+                timeleft--;
+        } while(timeleft && cris_ide_busy());
+
+        if(!timeleft) {
+                /*
+                 * If we're asked to read the status register, like for
+                 * example when a command does not complete for an
+                 * extended time, but the ATA interface is stuck in a
+                 * busy state at the *ETRAX* ATA interface level (as has
+                 * happened repeatedly with at least one bad disk), then
+                 * the best thing to do is to pretend that we read
+                 * "busy" in the status register, so the IDE driver will
+                 * time-out, abort the ongoing command and perform a
+                 * reset sequence.  Note that the subsequent OUT_BYTE
+                 * call will also timeout on busy, but as long as the
+                 * write is still performed, everything will be fine.
+                 */
+                if (cris_ide_get_reg(reg) == IDE_STATUS_OFFSET)
+                        return BUSY_STAT;
+                else
+                        /* For other rare cases we assume 0 is good enough.  */
+                        return 0;
+        }
+
+        cris_ide_write_command(reg | cris_pio_read);
+
+        timeleft = IDE_REGISTER_TIMEOUT;
+        /* wait for available */
+        do {
+                timeleft--;
+        } while(timeleft && !cris_ide_data_available(&val));
+
+        if(!timeleft)
+                return 0;
+
+        LOWDB(printk("inb: 0x%x from reg 0x%x\n", val & 0xff, reg));
+
+        return val;
+}
+
+unsigned char
+cris_ide_inb(unsigned long reg)
+{
+        return (unsigned char)cris_ide_inw(reg);
+}
+
+static int cris_dma_check (ide_drive_t *drive);
+static int cris_dma_end (ide_drive_t *drive);
+static int cris_dma_setup (ide_drive_t *drive);
+static void cris_dma_exec_cmd (ide_drive_t *drive, u8 command);
+static int cris_dma_test_irq(ide_drive_t *drive);
+static void cris_dma_start(ide_drive_t *drive);
+static void cris_ide_input_data (ide_drive_t *drive, void *, unsigned int);
+static void cris_ide_output_data (ide_drive_t *drive, void *, unsigned int);
+static void cris_atapi_input_bytes(ide_drive_t *drive, void *, unsigned int);
+static void cris_atapi_output_bytes(ide_drive_t *drive, void *, unsigned int);
+static int cris_dma_off (ide_drive_t *drive);
+static int cris_dma_on (ide_drive_t *drive);
+
+static void tune_cris_ide(ide_drive_t *drive, u8 pio)
+{
+        int setup, strobe, hold;
+
+        switch(pio)
+        {
+                case 0:
+                        setup = ATA_PIO0_SETUP;
+                        strobe = ATA_PIO0_STROBE;
+                        hold = ATA_PIO0_HOLD;
+                        break;
+                case 1:
+                        setup = ATA_PIO1_SETUP;
+                        strobe = ATA_PIO1_STROBE;
+                        hold = ATA_PIO1_HOLD;
+                        break;
+                case 2:
+                        setup = ATA_PIO2_SETUP;
+                        strobe = ATA_PIO2_STROBE;
+                        hold = ATA_PIO2_HOLD;
+                        break;
+                case 3:
+                        setup = ATA_PIO3_SETUP;
+                        strobe = ATA_PIO3_STROBE;
+                        hold = ATA_PIO3_HOLD;
+                        break;
+                case 4:
+                        setup = ATA_PIO4_SETUP;
+                        strobe = ATA_PIO4_STROBE;
+                        hold = ATA_PIO4_HOLD;
+                        break;
+                default:
+                        return;
+        }
+
+        cris_ide_set_speed(TYPE_PIO, setup, strobe, hold);
+}
+
+static int speed_cris_ide(ide_drive_t *drive, u8 speed)
+{
+        int cyc = 0, dvs = 0, strobe = 0, hold = 0;
+
+        if (speed >= XFER_PIO_0 && speed <= XFER_PIO_4) {
+                tune_cris_ide(drive, speed - XFER_PIO_0);
+                return 0;
+        }
+
+        switch(speed)
+        {
+                case XFER_UDMA_0:
+                        cyc = ATA_UDMA0_CYC;
+                        dvs = ATA_UDMA0_DVS;
+                        break;
+                case XFER_UDMA_1:
+                        cyc = ATA_UDMA1_CYC;
+                        dvs = ATA_UDMA1_DVS;
+                        break;
+                case XFER_UDMA_2:
+                        cyc = ATA_UDMA2_CYC;
+                        dvs = ATA_UDMA2_DVS;
+                        break;
+                case XFER_MW_DMA_0:
+                        strobe = ATA_DMA0_STROBE;
+                        hold = ATA_DMA0_HOLD;
+                        break;
+                case XFER_MW_DMA_1:
+                        strobe = ATA_DMA1_STROBE;
+                        hold = ATA_DMA1_HOLD;
+                        break;
+                case XFER_MW_DMA_2:
+                        strobe = ATA_DMA2_STROBE;
+                        hold = ATA_DMA2_HOLD;
+                        break;
+                default:
+                        return 0;
+        }
+
+        if (speed >= XFER_UDMA_0)
+                cris_ide_set_speed(TYPE_UDMA, cyc, dvs, 0);
+        else
+                cris_ide_set_speed(TYPE_DMA, 0, strobe, hold);
+
+        return 0;
+}
+
+void __init
+init_e100_ide (void)
+{
+        hw_regs_t hw;
+        int ide_offsets[IDE_NR_PORTS];
+        int h;
+        int i;
+
+        printk("ide: ETRAX FS built-in ATA DMA controller\n");
+
+        for (i = IDE_DATA_OFFSET; i <= IDE_STATUS_OFFSET; i++)
+                ide_offsets[i] = cris_ide_reg_addr(i, 0, 1);
+
+        /* the IDE control register is at ATA address 6, with CS1 active instead of CS0 */
+        ide_offsets[IDE_CONTROL_OFFSET] = cris_ide_reg_addr(6, 1, 0);
+
+        /* first fill in some stuff in the ide_hwifs fields */
+
+        for(h = 0; h < MAX_HWIFS; h++) {
+                ide_hwif_t *hwif = &ide_hwifs[h];
+                ide_setup_ports(&hw, cris_ide_base_address(h),
+                                ide_offsets,
+                                0, 0, cris_ide_ack_intr,
+                                ide_default_irq(0));
+                ide_register_hw(&hw, &hwif);
+                hwif->mmio = 2;
+                hwif->chipset = ide_etrax100;
+                hwif->tuneproc = &tune_cris_ide;
+                hwif->speedproc = &speed_cris_ide;
+                hwif->ata_input_data = &cris_ide_input_data;
+                hwif->ata_output_data = &cris_ide_output_data;
+                hwif->atapi_input_bytes = &cris_atapi_input_bytes;
+                hwif->atapi_output_bytes = &cris_atapi_output_bytes;
+                hwif->ide_dma_check = &cris_dma_check;
+                hwif->ide_dma_end = &cris_dma_end;
+                hwif->dma_setup = &cris_dma_setup;
+                hwif->dma_exec_cmd = &cris_dma_exec_cmd;
+                hwif->ide_dma_test_irq = &cris_dma_test_irq;
+                hwif->dma_start = &cris_dma_start;
+                hwif->OUTB = &cris_ide_outb;
+                hwif->OUTW = &cris_ide_outw;
+                hwif->OUTBSYNC = &cris_ide_outbsync;
+                hwif->INB = &cris_ide_inb;
+                hwif->INW = &cris_ide_inw;
+                hwif->ide_dma_host_off = &cris_dma_off;
+                hwif->ide_dma_host_on = &cris_dma_on;
+                hwif->ide_dma_off_quietly = &cris_dma_off;
+                hwif->udma_four = 0;
+                hwif->ultra_mask = cris_ultra_mask;
+                hwif->mwdma_mask = 0x07; /* Multiword DMA 0-2 */
+                hwif->swdma_mask = 0x07; /* Singleword DMA 0-2 */
+        }
+
+        /* Reset pulse */
+        cris_ide_reset(0);
+        udelay(25);
+        cris_ide_reset(1);
+
+        cris_ide_init();
+
+        cris_ide_set_speed(TYPE_PIO, ATA_PIO4_SETUP, ATA_PIO4_STROBE, ATA_PIO4_HOLD);
+        cris_ide_set_speed(TYPE_DMA, 0, ATA_DMA2_STROBE, ATA_DMA2_HOLD);
+        cris_ide_set_speed(TYPE_UDMA, ATA_UDMA2_CYC, ATA_UDMA2_DVS, 0);
+}
+
+static int cris_dma_off (ide_drive_t *drive)
+{
+        return 0;
+}
+
+static int cris_dma_on (ide_drive_t *drive)
+{
+        return 0;
+}
+
+
+static cris_dma_descr_type mydescr __attribute__ ((__aligned__(16)));
+
+/*
+ * The following routines are mainly used by the ATAPI drivers.
+ *
+ * These routines will round up any request for an odd number of bytes,
+ * so if an odd bytecount is specified, be sure that there's at least one
+ * extra byte allocated for the buffer.
+ */
+static void
+cris_atapi_input_bytes (ide_drive_t *drive, void *buffer, unsigned int bytecount)
+{
+        D(printk("atapi_input_bytes, buffer 0x%x, count %d\n",
+                 buffer, bytecount));
+
+        if(bytecount & 1) {
+                printk("warning, odd bytecount in cdrom_in_bytes = %d.\n", bytecount);
+                bytecount++; /* to round off */
+        }
+
+        /* setup DMA and start transfer */
+
+        cris_ide_fill_descriptor(&mydescr, buffer, bytecount, 1);
+        cris_ide_start_dma(drive, &mydescr, 1, TYPE_PIO, bytecount);
+
+        /* wait for completion */
+        LED_DISK_READ(1);
+        cris_ide_wait_dma(1);
+        LED_DISK_READ(0);
+}
+
+static void
+cris_atapi_output_bytes (ide_drive_t *drive, void *buffer, unsigned int bytecount)
+{
+        D(printk("atapi_output_bytes, buffer 0x%x, count %d\n",
+                 buffer, bytecount));
+
+        if(bytecount & 1) {
+                printk("odd bytecount %d in atapi_out_bytes!\n", bytecount);
+                bytecount++;
+        }
+
+        cris_ide_fill_descriptor(&mydescr, buffer, bytecount, 1);
+        cris_ide_start_dma(drive, &mydescr, 0, TYPE_PIO, bytecount);
+
+        /* wait for completion */
+
+        LED_DISK_WRITE(1);
+        LED_DISK_READ(1);
+        cris_ide_wait_dma(0);
+        LED_DISK_WRITE(0);
+}
+
+/*
+ * This is used for most PIO data transfers *from* the IDE interface
+ */
+static void
+cris_ide_input_data (ide_drive_t *drive, void *buffer, unsigned int wcount)
+{
+        cris_atapi_input_bytes(drive, buffer, wcount << 2);
+}
+
+/*
+ * This is used for most PIO data transfers *to* the IDE interface
+ */
+static void
+cris_ide_output_data (ide_drive_t *drive, void *buffer, unsigned int wcount)
+{
+        cris_atapi_output_bytes(drive, buffer, wcount << 2);
+}
+
+/* we only have one DMA channel on the chip for ATA, so we can keep these statically */
+static cris_dma_descr_type ata_descrs[MAX_DMA_DESCRS] __attribute__ ((__aligned__(16)));
+static unsigned int ata_tot_size;
+
+/*
+ * cris_ide_build_dmatable() prepares a dma request.
+ * Returns 0 if all went okay, returns 1 otherwise.
+ */
+static int cris_ide_build_dmatable (ide_drive_t *drive)
+{
+        ide_hwif_t *hwif = drive->hwif;
+        struct scatterlist* sg;
+        struct request *rq  = drive->hwif->hwgroup->rq;
+        unsigned long size, addr;
+        unsigned int count = 0;
+        int i = 0;
+
+        sg = hwif->sg_table;
+
+        ata_tot_size = 0;
+
+        ide_map_sg(drive, rq);
+        i = hwif->sg_nents;
+
+        while(i) {
+                /*
+                 * Determine addr and size of next buffer area.  We assume that
+                 * individual virtual buffers are always composed linearly in
+                 * physical memory.  For example, we assume that any 8kB buffer
+                 * is always composed of two adjacent physical 4kB pages rather
+                 * than two possibly non-adjacent physical 4kB pages.
+                 */
+                /* group sequential buffers into one large buffer */
+                addr = page_to_phys(sg->page) + sg->offset;
+                size = sg_dma_len(sg);
+                while (sg++, --i) {
+                        if ((addr + size) != page_to_phys(sg->page) + sg->offset)
+                                break;
+                        size += sg_dma_len(sg);
+                }
+
+                /* did we run out of descriptors? */
+
+                if(count >= MAX_DMA_DESCRS) {
+                        printk("%s: too few DMA descriptors\n", drive->name);
+                        return 1;
+                }
+
+                /* however, this case is more difficult - rw_trf_cnt cannot be more
+                   than 65536 words per transfer, so in that case we need to either
+                   1) use a DMA interrupt to re-trigger rw_trf_cnt and continue with
+                      the descriptors, or
+                   2) simply do the request here, and get dma_intr to only ide_end_request on
+                      those blocks that were actually set-up for transfer.
+                */
+
+                if(ata_tot_size + size > 131072) {
+                        printk("too large total ATA DMA request, %d + %d!\n", ata_tot_size, (int)size);
+                        return 1;
+                }
+
+                /* If size > MAX_DESCR_SIZE it has to be splitted into new descriptors. Since we
+                   don't handle size > 131072 only one split is necessary */
+
+                if(size > MAX_DESCR_SIZE) {
+                        cris_ide_fill_descriptor(&ata_descrs[count], (void*)addr, MAX_DESCR_SIZE, 0);
+                        count++;
+                        ata_tot_size += MAX_DESCR_SIZE;
+                        size -= MAX_DESCR_SIZE;
+                        addr += MAX_DESCR_SIZE;
+                }
+
+                cris_ide_fill_descriptor(&ata_descrs[count], (void*)addr, size,i ? 0 : 1);
+                count++;
+                ata_tot_size += size;
+        }
+
+        if (count) {
+                /* return and say all is ok */
+                return 0;
+        }
+
+        printk("%s: empty DMA table?\n", drive->name);
+        return 1;       /* let the PIO routines handle this weirdness */
+}
+
+static int cris_config_drive_for_dma (ide_drive_t *drive)
+{
+        u8 speed = ide_dma_speed(drive, 1);
+
+        if (!speed)
+                return 0;
+
+        speed_cris_ide(drive, speed);
+        ide_config_drive_speed(drive, speed);
+
+        return ide_dma_enable(drive);
+}
+
+/*
+ * cris_dma_intr() is the handler for disk read/write DMA interrupts
+ */
+static ide_startstop_t cris_dma_intr (ide_drive_t *drive)
+{
+        LED_DISK_READ(0);
+        LED_DISK_WRITE(0);
+
+        return ide_dma_intr(drive);
+}
+
+/*
+ * Functions below initiates/aborts DMA read/write operations on a drive.
+ *
+ * The caller is assumed to have selected the drive and programmed the drive's
+ * sector address using CHS or LBA.  All that remains is to prepare for DMA
+ * and then issue the actual read/write DMA/PIO command to the drive.
+ *
+ * For ATAPI devices, we just prepare for DMA and return. The caller should
+ * then issue the packet command to the drive and call us again with
+ * cris_dma_start afterwards.
+ *
+ * Returns 0 if all went well.
+ * Returns 1 if DMA read/write could not be started, in which case
+ * the caller should revert to PIO for the current request.
+ */
+
+static int cris_dma_check(ide_drive_t *drive)
+{
+        ide_hwif_t *hwif = drive->hwif;
+        struct hd_driveid* id = drive->id;
+
+        if (id && (id->capability & 1)) {
+                if (ide_use_dma(drive)) {
+                        if (cris_config_drive_for_dma(drive))
+                                return hwif->ide_dma_on(drive);
+                }
+        }
+
+        return hwif->ide_dma_off_quietly(drive);
+}
+
+static int cris_dma_end(ide_drive_t *drive)
+{
+        drive->waiting_for_dma = 0;
+        return 0;
+}
+
+static int cris_dma_setup(ide_drive_t *drive)
+{
+        struct request *rq = drive->hwif->hwgroup->rq;
+
+        cris_ide_initialize_dma(!rq_data_dir(rq));
+        if (cris_ide_build_dmatable (drive)) {
+                ide_map_sg(drive, rq);
+                return 1;
+        }
+
+        drive->waiting_for_dma = 1;
+        return 0;
+}
+
+static void cris_dma_exec_cmd(ide_drive_t *drive, u8 command)
+{
+        /* set the irq handler which will finish the request when DMA is done */
+        ide_set_handler(drive, &cris_dma_intr, WAIT_CMD, NULL);
+
+        /* issue cmd to drive */
+        cris_ide_outb(command, IDE_COMMAND_REG);
+}
+
+static void cris_dma_start(ide_drive_t *drive)
+{
+        struct request *rq = drive->hwif->hwgroup->rq;
+        int writing = rq_data_dir(rq);
+        int type = TYPE_DMA;
+
+        if (drive->current_speed >= XFER_UDMA_0)
+                type = TYPE_UDMA;
+
+        cris_ide_start_dma(drive, &ata_descrs[0], writing ? 0 : 1, type, ata_tot_size);
+
+        if (writing) {
+                LED_DISK_WRITE(1);
+        } else {
+                LED_DISK_READ(1);
+        }
+}
diff --git a/drivers/ide/cris/ide-v10.c b/drivers/ide/cris/ide-v10.c
deleted file mode 100644
index 5b40220d3ddc..000000000000
--- a/drivers/ide/cris/ide-v10.c
+++ /dev/null
@@ -1,842 +0,0 @@
-/* $Id: ide.c,v 1.4 2004/10/12 07:55:48 starvik Exp $
- *
- * Etrax specific IDE functions, like init and PIO-mode setting etc.
- * Almost the entire ide.c is used for the rest of the Etrax ATA driver.
- * Copyright (c) 2000-2004 Axis Communications AB
- *
- * Authors:    Bjorn Wesen        (initial version)
- *             Mikael Starvik     (pio setup stuff, Linux 2.6 port)
- */
-
-/* Regarding DMA:
- *
- * There are two forms of DMA - "DMA handshaking" between the interface and the drive,
- * and DMA between the memory and the interface. We can ALWAYS use the latter, since it's
- * something built-in in the Etrax. However only some drives support the DMA-mode handshaking
- * on the ATA-bus. The normal PC driver and Triton interface disables memory-if DMA when the
- * device can't do DMA handshaking for some stupid reason. We don't need to do that.
- */
-
-#undef REALLY_SLOW_IO           /* most systems can safely undef this */
-
-#include <linux/config.h>
-#include <linux/types.h>
-#include <linux/kernel.h>
-#include <linux/timer.h>
-#include <linux/mm.h>
-#include <linux/interrupt.h>
-#include <linux/delay.h>
-#include <linux/blkdev.h>
-#include <linux/hdreg.h>
-#include <linux/ide.h>
-#include <linux/init.h>
-#include <linux/scatterlist.h>
-
-#include <asm/io.h>
-#include <asm/arch/svinto.h>
-#include <asm/dma.h>
-
-/* number of Etrax DMA descriptors */
-#define MAX_DMA_DESCRS 64
-
-/* number of times to retry busy-flags when reading/writing IDE-registers
- * this can't be too high because a hung harddisk might cause the watchdog
- * to trigger (sometimes INB and OUTB are called with irq's disabled)
- */
-
-#define IDE_REGISTER_TIMEOUT 300
-
-static int e100_read_command = 0;
-
-#define LOWDB(x)
-#define D(x)
-
-static int e100_ide_build_dmatable (ide_drive_t *drive);
-static ide_startstop_t etrax_dma_intr (ide_drive_t *drive);
-
-void
-etrax100_ide_outw(unsigned short data, unsigned long reg) {
-        int timeleft;
-        LOWDB(printk("ow: data 0x%x, reg 0x%x\n", data, reg));
-
-        /* note the lack of handling any timeouts. we stop waiting, but we don't
-         * really notify anybody.
-         */
-
-        timeleft = IDE_REGISTER_TIMEOUT;
-        /* wait for busy flag */
-        while(timeleft && (*R_ATA_STATUS_DATA & IO_MASK(R_ATA_STATUS_DATA, busy)))
-                timeleft--;
-
-        /*
-         * Fall through at a timeout, so the ongoing command will be
-         * aborted by the write below, which is expected to be a dummy
-         * command to the command register.  This happens when a faulty
-         * drive times out on a command.  See comment on timeout in
-         * INB.
-         */
-        if(!timeleft)
-                printk("ATA timeout reg 0x%lx := 0x%x\n", reg, data);
-
-        *R_ATA_CTRL_DATA = reg | data; /* write data to the drive's register */
-
-        timeleft = IDE_REGISTER_TIMEOUT;
-        /* wait for transmitter ready */
-        while(timeleft && !(*R_ATA_STATUS_DATA &
-                            IO_MASK(R_ATA_STATUS_DATA, tr_rdy)))
-                timeleft--;
-}
-
-void
-etrax100_ide_outb(unsigned char data, unsigned long reg)
-{
-        etrax100_ide_outw(data, reg);
-}
-
-void
-etrax100_ide_outbsync(ide_drive_t *drive, u8 addr, unsigned long port)
-{
-        etrax100_ide_outw(addr, port);
-}
-
-unsigned short
-etrax100_ide_inw(unsigned long reg) {
-        int status;
-        int timeleft;
-
-        timeleft = IDE_REGISTER_TIMEOUT;
-        /* wait for busy flag */
-        while(timeleft && (*R_ATA_STATUS_DATA & IO_MASK(R_ATA_STATUS_DATA, busy)))
-                timeleft--;
-
-        if(!timeleft) {
-                /*
-                 * If we're asked to read the status register, like for
-                 * example when a command does not complete for an
-                 * extended time, but the ATA interface is stuck in a
-                 * busy state at the *ETRAX* ATA interface level (as has
-                 * happened repeatedly with at least one bad disk), then
-                 * the best thing to do is to pretend that we read
-                 * "busy" in the status register, so the IDE driver will
-                 * time-out, abort the ongoing command and perform a
-                 * reset sequence.  Note that the subsequent OUT_BYTE
-                 * call will also timeout on busy, but as long as the
-                 * write is still performed, everything will be fine.
-                 */
-                if ((reg & IO_MASK (R_ATA_CTRL_DATA, addr))
-                    == IO_FIELD (R_ATA_CTRL_DATA, addr, IDE_STATUS_OFFSET))
-                        return BUSY_STAT;
-                else
-                        /* For other rare cases we assume 0 is good enough.  */
-                        return 0;
-        }
-
-        *R_ATA_CTRL_DATA = reg | IO_STATE(R_ATA_CTRL_DATA, rw, read); /* read data */
-
-        timeleft = IDE_REGISTER_TIMEOUT;
-        /* wait for available */
-        while(timeleft && !((status = *R_ATA_STATUS_DATA) &
-                            IO_MASK(R_ATA_STATUS_DATA, dav)))
-                timeleft--;
-
-        if(!timeleft)
-                return 0;
-
-        LOWDB(printk("inb: 0x%x from reg 0x%x\n", status & 0xff, reg));
-
-        return (unsigned short)status;
-}
-
-unsigned char
-etrax100_ide_inb(unsigned long reg)
-{
-        return (unsigned char)etrax100_ide_inw(reg);
-}
-
-/* PIO timing (in R_ATA_CONFIG)
- *
- *                        _____________________________
- * ADDRESS :     ________/
- *
- *                            _______________
- * DIOR    :     ____________/               \__________
- *
- *                               _______________
- * DATA    :     XXXXXXXXXXXXXXXX_______________XXXXXXXX
- *
- *
- * DIOR is unbuffered while address and data is buffered.
- * This creates two problems:
- * 1. The DIOR pulse is to early (because it is unbuffered)
- * 2. The rise time of DIOR is long
- *
- * There are at least three different plausible solutions
- * 1. Use a pad capable of larger currents in Etrax
- * 2. Use an external buffer
- * 3. Make the strobe pulse longer
- *
- * Some of the strobe timings below are modified to compensate
- * for this. This implies a slight performance decrease.
- *
- * THIS SHOULD NEVER BE CHANGED!
- *
- * TODO: Is this true for the latest LX boards still ?
- */
-
-#define ATA_DMA2_STROBE  4
-#define ATA_DMA2_HOLD    0
-#define ATA_DMA1_STROBE  4
-#define ATA_DMA1_HOLD    1
-#define ATA_DMA0_STROBE 12
-#define ATA_DMA0_HOLD    9
-#define ATA_PIO4_SETUP   1
-#define ATA_PIO4_STROBE  5
-#define ATA_PIO4_HOLD    0
-#define ATA_PIO3_SETUP   1
-#define ATA_PIO3_STROBE  5
-#define ATA_PIO3_HOLD    1
-#define ATA_PIO2_SETUP   1
-#define ATA_PIO2_STROBE  6
-#define ATA_PIO2_HOLD    2
-#define ATA_PIO1_SETUP   2
-#define ATA_PIO1_STROBE 11
-#define ATA_PIO1_HOLD    4
-#define ATA_PIO0_SETUP   4
-#define ATA_PIO0_STROBE 19
-#define ATA_PIO0_HOLD    4
-
-static int e100_dma_check (ide_drive_t *drive);
-static void e100_dma_start(ide_drive_t *drive);
-static int e100_dma_end (ide_drive_t *drive);
-static void e100_ide_input_data (ide_drive_t *drive, void *, unsigned int);
-static void e100_ide_output_data (ide_drive_t *drive, void *, unsigned int);
-static void e100_atapi_input_bytes(ide_drive_t *drive, void *, unsigned int);
-static void e100_atapi_output_bytes(ide_drive_t *drive, void *, unsigned int);
-static int e100_dma_off (ide_drive_t *drive);
-
-
-/*
- * good_dma_drives() lists the model names (from "hdparm -i")
- * of drives which do not support mword2 DMA but which are
- * known to work fine with this interface under Linux.
- */
-
-const char *good_dma_drives[] = {"Micropolis 2112A",
-                                 "CONNER CTMA 4000",
-                                 "CONNER CTT8000-A",
-                                 NULL};
-
-static void tune_e100_ide(ide_drive_t *drive, byte pio)
-{
-        pio = 4;
-        /* pio = ide_get_best_pio_mode(drive, pio, 4, NULL); */
-
-        /* set pio mode! */
-
-        switch(pio) {
-                case 0:
-                        *R_ATA_CONFIG = ( IO_FIELD( R_ATA_CONFIG, enable,     1 ) |
-                                          IO_FIELD( R_ATA_CONFIG, dma_strobe, ATA_DMA2_STROBE ) |
-                                          IO_FIELD( R_ATA_CONFIG, dma_hold,   ATA_DMA2_HOLD ) |
-                                          IO_FIELD( R_ATA_CONFIG, pio_setup,  ATA_PIO0_SETUP ) |
-                                          IO_FIELD( R_ATA_CONFIG, pio_strobe, ATA_PIO0_STROBE ) |
-                                          IO_FIELD( R_ATA_CONFIG, pio_hold,   ATA_PIO0_HOLD ) );
-                        break;
-                case 1:
-                        *R_ATA_CONFIG = ( IO_FIELD( R_ATA_CONFIG, enable,     1 ) |
-                                          IO_FIELD( R_ATA_CONFIG, dma_strobe, ATA_DMA2_STROBE ) |
-                                          IO_FIELD( R_ATA_CONFIG, dma_hold,   ATA_DMA2_HOLD ) |
-                                          IO_FIELD( R_ATA_CONFIG, pio_setup,  ATA_PIO1_SETUP ) |
-                                          IO_FIELD( R_ATA_CONFIG, pio_strobe, ATA_PIO1_STROBE ) |
-                                          IO_FIELD( R_ATA_CONFIG, pio_hold,   ATA_PIO1_HOLD ) );
-                        break;
-                case 2:
-                        *R_ATA_CONFIG = ( IO_FIELD( R_ATA_CONFIG, enable,     1 ) |
-                                          IO_FIELD( R_ATA_CONFIG, dma_strobe, ATA_DMA2_STROBE ) |
-                                          IO_FIELD( R_ATA_CONFIG, dma_hold,   ATA_DMA2_HOLD ) |
-                                          IO_FIELD( R_ATA_CONFIG, pio_setup,  ATA_PIO2_SETUP ) |
-                                          IO_FIELD( R_ATA_CONFIG, pio_strobe, ATA_PIO2_STROBE ) |
-                                          IO_FIELD( R_ATA_CONFIG, pio_hold,   ATA_PIO2_HOLD ) );
-                        break;
-                case 3:
-                        *R_ATA_CONFIG = ( IO_FIELD( R_ATA_CONFIG, enable,     1 ) |
-                                          IO_FIELD( R_ATA_CONFIG, dma_strobe, ATA_DMA2_STROBE ) |
-                                          IO_FIELD( R_ATA_CONFIG, dma_hold,   ATA_DMA2_HOLD ) |
-                                          IO_FIELD( R_ATA_CONFIG, pio_setup,  ATA_PIO3_SETUP ) |
-                                          IO_FIELD( R_ATA_CONFIG, pio_strobe, ATA_PIO3_STROBE ) |
-                                          IO_FIELD( R_ATA_CONFIG, pio_hold,   ATA_PIO3_HOLD ) );
-                        break;
-                case 4:
-                        *R_ATA_CONFIG = ( IO_FIELD( R_ATA_CONFIG, enable,     1 ) |
-                                          IO_FIELD( R_ATA_CONFIG, dma_strobe, ATA_DMA2_STROBE ) |
-                                          IO_FIELD( R_ATA_CONFIG, dma_hold,   ATA_DMA2_HOLD ) |
-                                          IO_FIELD( R_ATA_CONFIG, pio_setup,  ATA_PIO4_SETUP ) |
-                                          IO_FIELD( R_ATA_CONFIG, pio_strobe, ATA_PIO4_STROBE ) |
-                                          IO_FIELD( R_ATA_CONFIG, pio_hold,   ATA_PIO4_HOLD ) );
-                        break;
-        }
-}
-
-static int e100_dma_setup(ide_drive_t *drive)
-{
-        struct request *rq = drive->hwif->hwgroup->rq;
-
-        if (rq_data_dir(rq)) {
-                e100_read_command = 0;
-
-                RESET_DMA(ATA_TX_DMA_NBR); /* sometimes the DMA channel get stuck so we need to do this */
-                WAIT_DMA(ATA_TX_DMA_NBR);
-        } else {
-                e100_read_command = 1;
-
-                RESET_DMA(ATA_RX_DMA_NBR); /* sometimes the DMA channel get stuck so we need to do this */
-                WAIT_DMA(ATA_RX_DMA_NBR);
-        }
-
-        /* set up the Etrax DMA descriptors */
-        if (e100_ide_build_dmatable(drive)) {
-                ide_map_sg(drive, rq);
-                return 1;
-        }
-
-        return 0;
-}
-
-static void e100_dma_exec_cmd(ide_drive_t *drive, u8 command)
-{
-        /* set the irq handler which will finish the request when DMA is done */
-        ide_set_handler(drive, &etrax_dma_intr, WAIT_CMD, NULL);
-
-        /* issue cmd to drive */
-        etrax100_ide_outb(command, IDE_COMMAND_REG);
-}
-
-void __init
-init_e100_ide (void)
-{
-        volatile unsigned int dummy;
-        int h;
-
-        printk("ide: ETRAX 100LX built-in ATA DMA controller\n");
-
-        /* first fill in some stuff in the ide_hwifs fields */
-
-        for(h = 0; h < MAX_HWIFS; h++) {
-                ide_hwif_t *hwif = &ide_hwifs[h];
-                hwif->mmio = 2;
-                hwif->chipset = ide_etrax100;
-                hwif->tuneproc = &tune_e100_ide;
-                hwif->ata_input_data = &e100_ide_input_data;
-                hwif->ata_output_data = &e100_ide_output_data;
-                hwif->atapi_input_bytes = &e100_atapi_input_bytes;
-                hwif->atapi_output_bytes = &e100_atapi_output_bytes;
-                hwif->ide_dma_check = &e100_dma_check;
-                hwif->ide_dma_end = &e100_dma_end;
-                hwif->dma_setup = &e100_dma_setup;
-                hwif->dma_exec_cmd = &e100_dma_exec_cmd;
-                hwif->dma_start = &e100_dma_start;
-                hwif->OUTB = &etrax100_ide_outb;
-                hwif->OUTW = &etrax100_ide_outw;
-                hwif->OUTBSYNC = &etrax100_ide_outbsync;
-                hwif->INB = &etrax100_ide_inb;
-                hwif->INW = &etrax100_ide_inw;
-                hwif->ide_dma_off_quietly = &e100_dma_off;
-        }
-
-        /* actually reset and configure the etrax100 ide/ata interface */
-
-        *R_ATA_CTRL_DATA = 0;
-        *R_ATA_TRANSFER_CNT = 0;
-        *R_ATA_CONFIG = 0;
-
-        genconfig_shadow = (genconfig_shadow &
-                            ~IO_MASK(R_GEN_CONFIG, dma2) &
-                            ~IO_MASK(R_GEN_CONFIG, dma3) &
-                            ~IO_MASK(R_GEN_CONFIG, ata)) |
-                ( IO_STATE( R_GEN_CONFIG, dma3, ata    ) |
-                  IO_STATE( R_GEN_CONFIG, dma2, ata    ) |
-                  IO_STATE( R_GEN_CONFIG, ata,  select ) );
-
-        *R_GEN_CONFIG = genconfig_shadow;
-
-        /* pull the chosen /reset-line low */
-
-#ifdef CONFIG_ETRAX_IDE_G27_RESET
-        REG_SHADOW_SET(R_PORT_G_DATA, port_g_data_shadow, 27, 0);
-#endif
-#ifdef CONFIG_ETRAX_IDE_CSE1_16_RESET
-        REG_SHADOW_SET(port_cse1_addr, port_cse1_shadow, 16, 0);
-#endif
-#ifdef CONFIG_ETRAX_IDE_CSP0_8_RESET
-        REG_SHADOW_SET(port_csp0_addr, port_csp0_shadow, 8, 0);
-#endif
-#ifdef CONFIG_ETRAX_IDE_PB7_RESET
-        port_pb_dir_shadow = port_pb_dir_shadow |
-                IO_STATE(R_PORT_PB_DIR, dir7, output);
-        *R_PORT_PB_DIR = port_pb_dir_shadow;
-        REG_SHADOW_SET(R_PORT_PB_DATA, port_pb_data_shadow, 7, 1);
-#endif
-
-        /* wait some */
-
-        udelay(25);
-
-        /* de-assert bus-reset */
-
-#ifdef CONFIG_ETRAX_IDE_CSE1_16_RESET
-        REG_SHADOW_SET(port_cse1_addr, port_cse1_shadow, 16, 1);
-#endif
-#ifdef CONFIG_ETRAX_IDE_CSP0_8_RESET
-        REG_SHADOW_SET(port_csp0_addr, port_csp0_shadow, 8, 1);
-#endif
-#ifdef CONFIG_ETRAX_IDE_G27_RESET
-        REG_SHADOW_SET(R_PORT_G_DATA, port_g_data_shadow, 27, 1);
-#endif
-
-        /* make a dummy read to set the ata controller in a proper state */
-        dummy = *R_ATA_STATUS_DATA;
-
-        *R_ATA_CONFIG = ( IO_FIELD( R_ATA_CONFIG, enable,     1 ) |
-                          IO_FIELD( R_ATA_CONFIG, dma_strobe, ATA_DMA2_STROBE ) |
-                          IO_FIELD( R_ATA_CONFIG, dma_hold,   ATA_DMA2_HOLD ) |
-                          IO_FIELD( R_ATA_CONFIG, pio_setup,  ATA_PIO4_SETUP ) |
-                          IO_FIELD( R_ATA_CONFIG, pio_strobe, ATA_PIO4_STROBE ) |
-                          IO_FIELD( R_ATA_CONFIG, pio_hold,   ATA_PIO4_HOLD ) );
-
-        *R_ATA_CTRL_DATA = ( IO_STATE( R_ATA_CTRL_DATA, rw,   read) |
-                             IO_FIELD( R_ATA_CTRL_DATA, addr, 1   ) );
-
-        while(*R_ATA_STATUS_DATA & IO_MASK(R_ATA_STATUS_DATA, busy)); /* wait for busy flag*/
-
-        *R_IRQ_MASK0_SET = ( IO_STATE( R_IRQ_MASK0_SET, ata_irq0, set ) |
-                             IO_STATE( R_IRQ_MASK0_SET, ata_irq1, set ) |
-                             IO_STATE( R_IRQ_MASK0_SET, ata_irq2, set ) |
-                             IO_STATE( R_IRQ_MASK0_SET, ata_irq3, set ) );
-
-        printk("ide: waiting %d seconds for drives to regain consciousness\n",
-               CONFIG_ETRAX_IDE_DELAY);
-
-        h = jiffies + (CONFIG_ETRAX_IDE_DELAY * HZ);
-        while(time_before(jiffies, h)) /* nothing */ ;
-
-        /* reset the dma channels we will use */
-
-        RESET_DMA(ATA_TX_DMA_NBR);
-        RESET_DMA(ATA_RX_DMA_NBR);
-        WAIT_DMA(ATA_TX_DMA_NBR);
-        WAIT_DMA(ATA_RX_DMA_NBR);
-
-}
-
-static int e100_dma_off (ide_drive_t *drive)
-{
-        return 0;
-}
-
-static etrax_dma_descr mydescr;
-
-/*
- * The following routines are mainly used by the ATAPI drivers.
- *
- * These routines will round up any request for an odd number of bytes,
- * so if an odd bytecount is specified, be sure that there's at least one
- * extra byte allocated for the buffer.
- */
-static void
-e100_atapi_input_bytes (ide_drive_t *drive, void *buffer, unsigned int bytecount)
-{
-        unsigned long data_reg = IDE_DATA_REG;
-
-        D(printk("atapi_input_bytes, dreg 0x%x, buffer 0x%x, count %d\n",
-                 data_reg, buffer, bytecount));
-
-        if(bytecount & 1) {
-                printk("warning, odd bytecount in cdrom_in_bytes = %d.\n", bytecount);
-                bytecount++; /* to round off */
-        }
-
-        /* make sure the DMA channel is available */
-        RESET_DMA(ATA_RX_DMA_NBR);
-        WAIT_DMA(ATA_RX_DMA_NBR);
-
-        /* setup DMA descriptor */
-
-        mydescr.sw_len = bytecount;
-        mydescr.ctrl   = d_eol;
-        mydescr.buf    = virt_to_phys(buffer);
-
-        /* start the dma channel */
-
-        *R_DMA_CH3_FIRST = virt_to_phys(&mydescr);
-        *R_DMA_CH3_CMD   = IO_STATE(R_DMA_CH3_CMD, cmd, start);
-
-        /* initiate a multi word dma read using PIO handshaking */
-
-        *R_ATA_TRANSFER_CNT = IO_FIELD(R_ATA_TRANSFER_CNT, count, bytecount >> 1);
-
-        *R_ATA_CTRL_DATA = data_reg |
-                IO_STATE(R_ATA_CTRL_DATA, rw,       read) |
-                IO_STATE(R_ATA_CTRL_DATA, src_dst,  dma) |
-                IO_STATE(R_ATA_CTRL_DATA, handsh,   pio) |
-                IO_STATE(R_ATA_CTRL_DATA, multi,    on) |
-                IO_STATE(R_ATA_CTRL_DATA, dma_size, word);
-
-        /* wait for completion */
-
-        LED_DISK_READ(1);
-        WAIT_DMA(ATA_RX_DMA_NBR);
-        LED_DISK_READ(0);
-
-#if 0
-        /* old polled transfer code
-         * this should be moved into a new function that can do polled
-         * transfers if DMA is not available
-         */
-
-        /* initiate a multi word read */
-
-        *R_ATA_TRANSFER_CNT = wcount << 1;
-
-        *R_ATA_CTRL_DATA = data_reg |
-                IO_STATE(R_ATA_CTRL_DATA, rw,       read) |
-                IO_STATE(R_ATA_CTRL_DATA, src_dst,  register) |
-                IO_STATE(R_ATA_CTRL_DATA, handsh,   pio) |
-                IO_STATE(R_ATA_CTRL_DATA, multi,    on) |
-                IO_STATE(R_ATA_CTRL_DATA, dma_size, word);
-
-        /* svinto has a latency until the busy bit actually is set */
-
-        nop(); nop();
-        nop(); nop();
-        nop(); nop();
-        nop(); nop();
-        nop(); nop();
-
-        /* unit should be busy during multi transfer */
-        while((status = *R_ATA_STATUS_DATA) & IO_MASK(R_ATA_STATUS_DATA, busy)) {
-                while(!(status & IO_MASK(R_ATA_STATUS_DATA, dav)))
-                        status = *R_ATA_STATUS_DATA;
-                *ptr++ = (unsigned short)(status & 0xffff);
-        }
-#endif
-}
-
-static void
-e100_atapi_output_bytes (ide_drive_t *drive, void *buffer, unsigned int bytecount)
-{
-        unsigned long data_reg = IDE_DATA_REG;
-
-        D(printk("atapi_output_bytes, dreg 0x%x, buffer 0x%x, count %d\n",
-                 data_reg, buffer, bytecount));
-
-        if(bytecount & 1) {
-                printk("odd bytecount %d in atapi_out_bytes!\n", bytecount);
-                bytecount++;
-        }
-
-        /* make sure the DMA channel is available */
-        RESET_DMA(ATA_TX_DMA_NBR);
-        WAIT_DMA(ATA_TX_DMA_NBR);
-
-        /* setup DMA descriptor */
-
-        mydescr.sw_len = bytecount;
-        mydescr.ctrl   = d_eol;
-        mydescr.buf    = virt_to_phys(buffer);
-
-        /* start the dma channel */
-
-        *R_DMA_CH2_FIRST = virt_to_phys(&mydescr);
-        *R_DMA_CH2_CMD   = IO_STATE(R_DMA_CH2_CMD, cmd, start);
-
-        /* initiate a multi word dma write using PIO handshaking */
-
-        *R_ATA_TRANSFER_CNT = IO_FIELD(R_ATA_TRANSFER_CNT, count, bytecount >> 1);
-
-        *R_ATA_CTRL_DATA = data_reg |
-                IO_STATE(R_ATA_CTRL_DATA, rw,       write) |
-                IO_STATE(R_ATA_CTRL_DATA, src_dst,  dma) |
-                IO_STATE(R_ATA_CTRL_DATA, handsh,   pio) |
-                IO_STATE(R_ATA_CTRL_DATA, multi,    on) |
-                IO_STATE(R_ATA_CTRL_DATA, dma_size, word);
-
-        /* wait for completion */
-
-        LED_DISK_WRITE(1);
-        WAIT_DMA(ATA_TX_DMA_NBR);
-        LED_DISK_WRITE(0);
-
-#if 0
-        /* old polled write code - see comment in input_bytes */
-
-        /* wait for busy flag */
-        while(*R_ATA_STATUS_DATA & IO_MASK(R_ATA_STATUS_DATA, busy));
-
-        /* initiate a multi word write */
-
-        *R_ATA_TRANSFER_CNT = bytecount >> 1;
-
-        ctrl = data_reg |
-                IO_STATE(R_ATA_CTRL_DATA, rw,       write) |
-                IO_STATE(R_ATA_CTRL_DATA, src_dst,  register) |
-                IO_STATE(R_ATA_CTRL_DATA, handsh,   pio) |
-                IO_STATE(R_ATA_CTRL_DATA, multi,    on) |
-                IO_STATE(R_ATA_CTRL_DATA, dma_size, word);
-
-        LED_DISK_WRITE(1);
-
-        /* Etrax will set busy = 1 until the multi pio transfer has finished
-         * and tr_rdy = 1 after each successful word transfer.
-         * When the last byte has been transferred Etrax will first set tr_tdy = 1
-         * and then busy = 0 (not in the same cycle). If we read busy before it
-         * has been set to 0 we will think that we should transfer more bytes
-         * and then tr_rdy would be 0 forever. This is solved by checking busy
-         * in the inner loop.
-         */
-
-        do {
-                *R_ATA_CTRL_DATA = ctrl | *ptr++;
-                while(!(*R_ATA_STATUS_DATA & IO_MASK(R_ATA_STATUS_DATA, tr_rdy)) &&
-                      (*R_ATA_STATUS_DATA & IO_MASK(R_ATA_STATUS_DATA, busy)));
-        } while(*R_ATA_STATUS_DATA & IO_MASK(R_ATA_STATUS_DATA, busy));
-
-        LED_DISK_WRITE(0);
-#endif
-
-}
-
-/*
- * This is used for most PIO data transfers *from* the IDE interface
- */
-static void
-e100_ide_input_data (ide_drive_t *drive, void *buffer, unsigned int wcount)
-{
-        e100_atapi_input_bytes(drive, buffer, wcount << 2);
-}
-
-/*
- * This is used for most PIO data transfers *to* the IDE interface
- */
-static void
-e100_ide_output_data (ide_drive_t *drive, void *buffer, unsigned int wcount)
-{
-        e100_atapi_output_bytes(drive, buffer, wcount << 2);
-}
-
-/* we only have one DMA channel on the chip for ATA, so we can keep these statically */
-static etrax_dma_descr ata_descrs[MAX_DMA_DESCRS];
-static unsigned int ata_tot_size;
-
-/*
- * e100_ide_build_dmatable() prepares a dma request.
- * Returns 0 if all went okay, returns 1 otherwise.
- */
-static int e100_ide_build_dmatable (ide_drive_t *drive)
-{
-        ide_hwif_t *hwif = HWIF(drive);
-        struct scatterlist* sg;
-        struct request *rq  = HWGROUP(drive)->rq;
-        unsigned long size, addr;
-        unsigned int count = 0;
-        int i = 0;
-
-        sg = hwif->sg_table;
-
-        ata_tot_size = 0;
-
-        ide_map_sg(drive, rq);
-
-        i = hwif->sg_nents;
-
-        while(i) {
-                /*
-                 * Determine addr and size of next buffer area.  We assume that
-                 * individual virtual buffers are always composed linearly in
-                 * physical memory.  For example, we assume that any 8kB buffer
-                 * is always composed of two adjacent physical 4kB pages rather
-                 * than two possibly non-adjacent physical 4kB pages.
-                 */
-                /* group sequential buffers into one large buffer */
-                addr = page_to_phys(sg->page) + sg->offset;
-                size = sg_dma_len(sg);
-                while (sg++, --i) {
-                        if ((addr + size) != page_to_phys(sg->page) + sg->offset)
-                                break;
-                        size += sg_dma_len(sg);
-                }
-
-                /* did we run out of descriptors? */
-
-                if(count >= MAX_DMA_DESCRS) {
-                        printk("%s: too few DMA descriptors\n", drive->name);
-                        return 1;
-                }
-
-                /* however, this case is more difficult - R_ATA_TRANSFER_CNT cannot be more
-                   than 65536 words per transfer, so in that case we need to either
-                   1) use a DMA interrupt to re-trigger R_ATA_TRANSFER_CNT and continue with
-                      the descriptors, or
-                   2) simply do the request here, and get dma_intr to only ide_end_request on
-                      those blocks that were actually set-up for transfer.
-                */
-
-                if(ata_tot_size + size > 131072) {
-                        printk("too large total ATA DMA request, %d + %d!\n", ata_tot_size, (int)size);
-                        return 1;
-                }
-
-                /* If size > 65536 it has to be splitted into new descriptors. Since we don't handle
-                   size > 131072 only one split is necessary */
-
-                if(size > 65536) {
-                        /* ok we want to do IO at addr, size bytes. set up a new descriptor entry */
-                        ata_descrs[count].sw_len = 0;  /* 0 means 65536, this is a 16-bit field */
-                        ata_descrs[count].ctrl = 0;
-                        ata_descrs[count].buf = addr;
-                        ata_descrs[count].next = virt_to_phys(&ata_descrs[count + 1]);
-                        count++;
-                        ata_tot_size += 65536;
-                        /* size and addr should refere to not handled data */
-                        size -= 65536;
-                        addr += 65536;
-                }
-                /* ok we want to do IO at addr, size bytes. set up a new descriptor entry */
-                if(size == 65536) {
-                        ata_descrs[count].sw_len = 0;  /* 0 means 65536, this is a 16-bit field */
-                } else {
-                        ata_descrs[count].sw_len = size;
-                }
-                ata_descrs[count].ctrl = 0;
-                ata_descrs[count].buf = addr;
-                ata_descrs[count].next = virt_to_phys(&ata_descrs[count + 1]);
-                count++;
-                ata_tot_size += size;
-        }
-
-        if (count) {
-                /* set the end-of-list flag on the last descriptor */
-                ata_descrs[count - 1].ctrl |= d_eol;
-                /* return and say all is ok */
-                return 0;
-        }
-
-        printk("%s: empty DMA table?\n", drive->name);
-        return 1;       /* let the PIO routines handle this weirdness */
-}
-
-static int config_drive_for_dma (ide_drive_t *drive)
-{
-        const char **list;
-        struct hd_driveid *id = drive->id;
-
-        if (id && (id->capability & 1)) {
-                /* Enable DMA on any drive that supports mword2 DMA */
-                if ((id->field_valid & 2) && (id->dma_mword & 0x404) == 0x404) {
-                        drive->using_dma = 1;
-                        return 0;               /* DMA enabled */
-                }
-
-                /* Consult the list of known "good" drives */
-                list = good_dma_drives;
-                while (*list) {
-                        if (!strcmp(*list++,id->model)) {
-                                drive->using_dma = 1;
-                                return 0;       /* DMA enabled */
-                        }
-                }
-        }
-        return 1;       /* DMA not enabled */
-}
-
-/*
- * etrax_dma_intr() is the handler for disk read/write DMA interrupts
- */
-static ide_startstop_t etrax_dma_intr (ide_drive_t *drive)
-{
-        LED_DISK_READ(0);
-        LED_DISK_WRITE(0);
-
-        return ide_dma_intr(drive);
-}
-
-/*
- * Functions below initiates/aborts DMA read/write operations on a drive.
- *
- * The caller is assumed to have selected the drive and programmed the drive's
- * sector address using CHS or LBA.  All that remains is to prepare for DMA
- * and then issue the actual read/write DMA/PIO command to the drive.
- *
- * Returns 0 if all went well.
- * Returns 1 if DMA read/write could not be started, in which case
- * the caller should revert to PIO for the current request.
- */
-
-static int e100_dma_check(ide_drive_t *drive)
-{
-        return config_drive_for_dma (drive);
-}
-
-static int e100_dma_end(ide_drive_t *drive)
-{
-        /* TODO: check if something went wrong with the DMA */
-        return 0;
-}
-
-static void e100_dma_start(ide_drive_t *drive)
-{
-        if (e100_read_command) {
-                /* begin DMA */
-
-                /* need to do this before RX DMA due to a chip bug
-                 * it is enough to just flush the part of the cache that
-                 * corresponds to the buffers we start, but since HD transfers
-                 * usually are more than 8 kB, it is easier to optimize for the
-                 * normal case and just flush the entire cache. its the only
-                 * way to be sure! (OB movie quote)
-                 */
-                flush_etrax_cache();
-                *R_DMA_CH3_FIRST = virt_to_phys(ata_descrs);
-                *R_DMA_CH3_CMD   = IO_STATE(R_DMA_CH3_CMD, cmd, start);
-
-                /* initiate a multi word dma read using DMA handshaking */
-
-                *R_ATA_TRANSFER_CNT =
-                        IO_FIELD(R_ATA_TRANSFER_CNT, count, ata_tot_size >> 1);
-
-                *R_ATA_CTRL_DATA =
-                        IO_FIELD(R_ATA_CTRL_DATA, data, IDE_DATA_REG) |
-                        IO_STATE(R_ATA_CTRL_DATA, rw,       read) |
-                        IO_STATE(R_ATA_CTRL_DATA, src_dst,  dma)  |
-                        IO_STATE(R_ATA_CTRL_DATA, handsh,   dma)  |
-                        IO_STATE(R_ATA_CTRL_DATA, multi,    on)   |
-                        IO_STATE(R_ATA_CTRL_DATA, dma_size, word);
-
-                LED_DISK_READ(1);
-
-                D(printk("dma read of %d bytes.\n", ata_tot_size));
-
-        } else {
-                /* writing */
-                /* begin DMA */
-
-                *R_DMA_CH2_FIRST = virt_to_phys(ata_descrs);
-                *R_DMA_CH2_CMD   = IO_STATE(R_DMA_CH2_CMD, cmd, start);
-
-                /* initiate a multi word dma write using DMA handshaking */
-
-                *R_ATA_TRANSFER_CNT =
-                        IO_FIELD(R_ATA_TRANSFER_CNT, count, ata_tot_size >> 1);
-
-                *R_ATA_CTRL_DATA =
-                        IO_FIELD(R_ATA_CTRL_DATA, data,     IDE_DATA_REG) |
-                        IO_STATE(R_ATA_CTRL_DATA, rw,       write) |
-                        IO_STATE(R_ATA_CTRL_DATA, src_dst,  dma) |
-                        IO_STATE(R_ATA_CTRL_DATA, handsh,   dma) |
-                        IO_STATE(R_ATA_CTRL_DATA, multi,    on) |
-                        IO_STATE(R_ATA_CTRL_DATA, dma_size, word);
-
-                LED_DISK_WRITE(1);
-
-                D(printk("dma write of %d bytes.\n", ata_tot_size));
-        }
-}
diff --git a/drivers/ide/pci/cmd640.c b/drivers/ide/pci/cmd640.c
index 92a2b7caed58..11d035f1983d 100644
--- a/drivers/ide/pci/cmd640.c
+++ b/drivers/ide/pci/cmd640.c
@@ -487,7 +487,7 @@ static void display_clocks (unsigned int index)
  * Pack active and recovery counts into single byte representation
  * used by controller
  */
-inline static u8 pack_nibbles (u8 upper, u8 lower)
+static inline u8 pack_nibbles (u8 upper, u8 lower)
 {
         return ((upper & 0x0f) << 4) | (lower & 0x0f);
 }
diff --git a/drivers/ide/pci/trm290.c b/drivers/ide/pci/trm290.c
index 8b5eea5405ef..c26c8ca90dd4 100644
--- a/drivers/ide/pci/trm290.c
+++ b/drivers/ide/pci/trm290.c
@@ -5,7 +5,7 @@
  *  May be copied or modified under the terms of the GNU General Public License
  *
  *  June 22, 2004 - get rid of check_region
- *                  Jesper Juhl <juhl-lkml@dif.dk>
+ *                   - Jesper Juhl
  *
  */
 
diff --git a/drivers/ieee1394/sbp2.c b/drivers/ieee1394/sbp2.c
index fe3e1703fa61..627af507643a 100644
--- a/drivers/ieee1394/sbp2.c
+++ b/drivers/ieee1394/sbp2.c
@@ -169,6 +169,7 @@ MODULE_DEVICE_TABLE(ieee1394, sbp2_id_table);
  * Debug levels, configured via kernel config, or enable here.
  */
 
+#define CONFIG_IEEE1394_SBP2_DEBUG 0
 /* #define CONFIG_IEEE1394_SBP2_DEBUG_ORBS */
 /* #define CONFIG_IEEE1394_SBP2_DEBUG_DMA */
 /* #define CONFIG_IEEE1394_SBP2_DEBUG 1 */
diff --git a/drivers/infiniband/core/Makefile b/drivers/infiniband/core/Makefile
index e1a7cf3e8636..10be36731ed7 100644
--- a/drivers/infiniband/core/Makefile
+++ b/drivers/infiniband/core/Makefile
@@ -1,15 +1,20 @@
 EXTRA_CFLAGS += -Idrivers/infiniband/include
 
-obj-$(CONFIG_INFINIBAND) +=             ib_core.o ib_mad.o ib_sa.o ib_umad.o
+obj-$(CONFIG_INFINIBAND) +=             ib_core.o ib_mad.o ib_sa.o \
+                                        ib_cm.o ib_umad.o ib_ucm.o
 obj-$(CONFIG_INFINIBAND_USER_VERBS) +=  ib_uverbs.o
 
 ib_core-y :=                    packer.o ud_header.o verbs.o sysfs.o \
                                 device.o fmr_pool.o cache.o
 
-ib_mad-y :=                     mad.o smi.o agent.o
+ib_mad-y :=                     mad.o smi.o agent.o mad_rmpp.o
 
 ib_sa-y :=                      sa_query.o
 
+ib_cm-y :=                      cm.o
+
 ib_umad-y :=                    user_mad.o
 
+ib_ucm-y :=                     ucm.o
+
 ib_uverbs-y :=                  uverbs_main.o uverbs_cmd.o uverbs_mem.o
diff --git a/drivers/infiniband/core/agent.c b/drivers/infiniband/core/agent.c
index 23d1957c4b29..729f0b0d983a 100644
--- a/drivers/infiniband/core/agent.c
+++ b/drivers/infiniband/core/agent.c
@@ -134,7 +134,7 @@ static int agent_mad_send(struct ib_mad_agent *mad_agent,
                                           sizeof(mad_priv->mad),
                                           DMA_TO_DEVICE);
         gather_list.length = sizeof(mad_priv->mad);
-        gather_list.lkey = (*port_priv->mr).lkey;
+        gather_list.lkey = mad_agent->mr->lkey;
 
         send_wr.next = NULL;
         send_wr.opcode = IB_WR_SEND;
@@ -156,10 +156,10 @@ static int agent_mad_send(struct ib_mad_agent *mad_agent,
                         /* Should sgid be looked up ? */
                         ah_attr.grh.sgid_index = 0;
                         ah_attr.grh.hop_limit = grh->hop_limit;
-                        ah_attr.grh.flow_label = be32_to_cpup(
-                                &grh->version_tclass_flow)  & 0xfffff;
-                        ah_attr.grh.traffic_class = (be32_to_cpup(
-                                &grh->version_tclass_flow) >> 20) & 0xff;
+                        ah_attr.grh.flow_label = be32_to_cpu(
+                                grh->version_tclass_flow)  & 0xfffff;
+                        ah_attr.grh.traffic_class = (be32_to_cpu(
+                                grh->version_tclass_flow) >> 20) & 0xff;
                         memcpy(ah_attr.grh.dgid.raw,
                                grh->sgid.raw,
                                sizeof(ah_attr.grh.dgid));
@@ -322,22 +322,12 @@ int ib_agent_port_open(struct ib_device *device, int port_num)
                 goto error3;
         }
 
-        port_priv->mr = ib_get_dma_mr(port_priv->smp_agent->qp->pd,
-                                      IB_ACCESS_LOCAL_WRITE);
-        if (IS_ERR(port_priv->mr)) {
-                printk(KERN_ERR SPFX "Couldn't get DMA MR\n");
-                ret = PTR_ERR(port_priv->mr);
-                goto error4;
-        }
-
         spin_lock_irqsave(&ib_agent_port_list_lock, flags);
         list_add_tail(&port_priv->port_list, &ib_agent_port_list);
         spin_unlock_irqrestore(&ib_agent_port_list_lock, flags);
 
         return 0;
 
-error4:
-        ib_unregister_mad_agent(port_priv->perf_mgmt_agent);
 error3:
         ib_unregister_mad_agent(port_priv->smp_agent);
 error2:
@@ -361,8 +351,6 @@ int ib_agent_port_close(struct ib_device *device, int port_num)
         list_del(&port_priv->port_list);
         spin_unlock_irqrestore(&ib_agent_port_list_lock, flags);
 
-        ib_dereg_mr(port_priv->mr);
-
         ib_unregister_mad_agent(port_priv->perf_mgmt_agent);
         ib_unregister_mad_agent(port_priv->smp_agent);
         kfree(port_priv);
diff --git a/drivers/infiniband/core/agent_priv.h b/drivers/infiniband/core/agent_priv.h
index 17a0cce5813c..17435af1e914 100644
--- a/drivers/infiniband/core/agent_priv.h
+++ b/drivers/infiniband/core/agent_priv.h
@@ -33,7 +33,7 @@
  * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
  * SOFTWARE.
  *
- * $Id: agent_priv.h 1389 2004-12-27 22:56:47Z roland $
+ * $Id: agent_priv.h 1640 2005-01-24 22:39:02Z halr $
  */
 
 #ifndef __IB_AGENT_PRIV_H__
@@ -57,7 +57,6 @@ struct ib_agent_port_private {
         int port_num;
         struct ib_mad_agent *smp_agent;       /* SM class */
         struct ib_mad_agent *perf_mgmt_agent; /* PerfMgmt class */
-        struct ib_mr *mr;
 };
 
 #endif  /* __IB_AGENT_PRIV_H__ */
diff --git a/drivers/infiniband/core/cm.c b/drivers/infiniband/core/cm.c
new file mode 100644
index 000000000000..403ed125d8f4
--- /dev/null
+++ b/drivers/infiniband/core/cm.c
@@ -0,0 +1,3324 @@
+/*
+ * Copyright (c) 2004, 2005 Intel Corporation.  All rights reserved.
+ * Copyright (c) 2004 Topspin Corporation.  All rights reserved.
+ * Copyright (c) 2004, 2005 Voltaire Corporation.  All rights reserved.
+ * Copyright (c) 2005 Sun Microsystems, Inc. All rights reserved.
+ *
+ * This software is available to you under a choice of one of two
+ * licenses.  You may choose to be licensed under the terms of the GNU
+ * General Public License (GPL) Version 2, available from the file
+ * COPYING in the main directory of this source tree, or the
+ * OpenIB.org BSD license below:
+ *
+ *     Redistribution and use in source and binary forms, with or
+ *     without modification, are permitted provided that the following
+ *     conditions are met:
+ *
+ *      - Redistributions of source code must retain the above
+ *        copyright notice, this list of conditions and the following
+ *        disclaimer.
+ *
+ *      - Redistributions in binary form must reproduce the above
+ *        copyright notice, this list of conditions and the following
+ *        disclaimer in the documentation and/or other materials
+ *        provided with the distribution.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+ * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+ * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+ * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
+ * BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
+ * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
+ * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+ * SOFTWARE.
+ *
+ * $Id: cm.c 2821 2005-07-08 17:07:28Z sean.hefty $
+ */
+#include <linux/dma-mapping.h>
+#include <linux/err.h>
+#include <linux/idr.h>
+#include <linux/interrupt.h>
+#include <linux/pci.h>
+#include <linux/rbtree.h>
+#include <linux/spinlock.h>
+#include <linux/workqueue.h>
+
+#include <ib_cache.h>
+#include <ib_cm.h>
+#include "cm_msgs.h"
+
+MODULE_AUTHOR("Sean Hefty");
+MODULE_DESCRIPTION("InfiniBand CM");
+MODULE_LICENSE("Dual BSD/GPL");
+
+static void cm_add_one(struct ib_device *device);
+static void cm_remove_one(struct ib_device *device);
+
+static struct ib_client cm_client = {
+        .name   = "cm",
+        .add    = cm_add_one,
+        .remove = cm_remove_one
+};
+
+static struct ib_cm {
+        spinlock_t lock;
+        struct list_head device_list;
+        rwlock_t device_lock;
+        struct rb_root listen_service_table;
+        u64 listen_service_id;
+        /* struct rb_root peer_service_table; todo: fix peer to peer */
+        struct rb_root remote_qp_table;
+        struct rb_root remote_id_table;
+        struct rb_root remote_sidr_table;
+        struct idr local_id_table;
+        struct workqueue_struct *wq;
+} cm;
+
+struct cm_port {
+        struct cm_device *cm_dev;
+        struct ib_mad_agent *mad_agent;
+        u8 port_num;
+};
+
+struct cm_device {
+        struct list_head list;
+        struct ib_device *device;
+        u64 ca_guid;
+        struct cm_port port[0];
+};
+
+struct cm_av {
+        struct cm_port *port;
+        union ib_gid dgid;
+        struct ib_ah_attr ah_attr;
+        u16 pkey_index;
+        u8 packet_life_time;
+};
+
+struct cm_work {
+        struct work_struct work;
+        struct list_head list;
+        struct cm_port *port;
+        struct ib_mad_recv_wc *mad_recv_wc;     /* Received MADs */
+        u32 local_id;                           /* Established / timewait */
+        u32 remote_id;
+        struct ib_cm_event cm_event;
+        struct ib_sa_path_rec path[0];
+};
+
+struct cm_timewait_info {
+        struct cm_work work;                    /* Must be first. */
+        struct rb_node remote_qp_node;
+        struct rb_node remote_id_node;
+        u64 remote_ca_guid;
+        u32 remote_qpn;
+        u8 inserted_remote_qp;
+        u8 inserted_remote_id;
+};
+
+struct cm_id_private {
+        struct ib_cm_id id;
+
+        struct rb_node service_node;
+        struct rb_node sidr_id_node;
+        spinlock_t lock;
+        wait_queue_head_t wait;
+        atomic_t refcount;
+
+        struct ib_mad_send_buf *msg;
+        struct cm_timewait_info *timewait_info;
+        /* todo: use alternate port on send failure */
+        struct cm_av av;
+        struct cm_av alt_av;
+
+        void *private_data;
+        u64 tid;
+        u32 local_qpn;
+        u32 remote_qpn;
+        u32 sq_psn;
+        u32 rq_psn;
+        int timeout_ms;
+        enum ib_mtu path_mtu;
+        u8 private_data_len;
+        u8 max_cm_retries;
+        u8 peer_to_peer;
+        u8 responder_resources;
+        u8 initiator_depth;
+        u8 local_ack_timeout;
+        u8 retry_count;
+        u8 rnr_retry_count;
+        u8 service_timeout;
+
+        struct list_head work_list;
+        atomic_t work_count;
+};
+
+static void cm_work_handler(void *data);
+
+static inline void cm_deref_id(struct cm_id_private *cm_id_priv)
+{
+        if (atomic_dec_and_test(&cm_id_priv->refcount))
+                wake_up(&cm_id_priv->wait);
+}
+
+static int cm_alloc_msg(struct cm_id_private *cm_id_priv,
+                        struct ib_mad_send_buf **msg)
+{
+        struct ib_mad_agent *mad_agent;
+        struct ib_mad_send_buf *m;
+        struct ib_ah *ah;
+
+        mad_agent = cm_id_priv->av.port->mad_agent;
+        ah = ib_create_ah(mad_agent->qp->pd, &cm_id_priv->av.ah_attr);
+        if (IS_ERR(ah))
+                return PTR_ERR(ah);
+
+        m = ib_create_send_mad(mad_agent, 1, cm_id_priv->av.pkey_index,
+                               ah, 0, sizeof(struct ib_mad_hdr),
+                               sizeof(struct ib_mad)-sizeof(struct ib_mad_hdr),
+                               GFP_ATOMIC);
+        if (IS_ERR(m)) {
+                ib_destroy_ah(ah);
+                return PTR_ERR(m);
+        }
+
+        /* Timeout set by caller if response is expected. */
+        m->send_wr.wr.ud.retries = cm_id_priv->max_cm_retries;
+
+        atomic_inc(&cm_id_priv->refcount);
+        m->context[0] = cm_id_priv;
+        *msg = m;
+        return 0;
+}
+
+static int cm_alloc_response_msg(struct cm_port *port,
+                                 struct ib_mad_recv_wc *mad_recv_wc,
+                                 struct ib_mad_send_buf **msg)
+{
+        struct ib_mad_send_buf *m;
+        struct ib_ah *ah;
+
+        ah = ib_create_ah_from_wc(port->mad_agent->qp->pd, mad_recv_wc->wc,
+                                  mad_recv_wc->recv_buf.grh, port->port_num);
+        if (IS_ERR(ah))
+                return PTR_ERR(ah);
+
+        m = ib_create_send_mad(port->mad_agent, 1, mad_recv_wc->wc->pkey_index,
+                               ah, 0, sizeof(struct ib_mad_hdr),
+                               sizeof(struct ib_mad)-sizeof(struct ib_mad_hdr),
+                               GFP_ATOMIC);
+        if (IS_ERR(m)) {
+                ib_destroy_ah(ah);
+                return PTR_ERR(m);
+        }
+        *msg = m;
+        return 0;
+}
+
+static void cm_free_msg(struct ib_mad_send_buf *msg)
+{
+        ib_destroy_ah(msg->send_wr.wr.ud.ah);
+        if (msg->context[0])
+                cm_deref_id(msg->context[0]);
+        ib_free_send_mad(msg);
+}
+
+static void * cm_copy_private_data(const void *private_data,
+                                   u8 private_data_len)
+{
+        void *data;
+
+        if (!private_data || !private_data_len)
+                return NULL;
+
+        data = kmalloc(private_data_len, GFP_KERNEL);
+        if (!data)
+                return ERR_PTR(-ENOMEM);
+
+        memcpy(data, private_data, private_data_len);
+        return data;
+}
+
+static void cm_set_private_data(struct cm_id_private *cm_id_priv,
+                                 void *private_data, u8 private_data_len)
+{
+        if (cm_id_priv->private_data && cm_id_priv->private_data_len)
+                kfree(cm_id_priv->private_data);
+
+        cm_id_priv->private_data = private_data;
+        cm_id_priv->private_data_len = private_data_len;
+}
+
+static void cm_set_ah_attr(struct ib_ah_attr *ah_attr, u8 port_num,
+                           u16 dlid, u8 sl, u16 src_path_bits)
+{
+        memset(ah_attr, 0, sizeof ah_attr);
+        ah_attr->dlid = be16_to_cpu(dlid);
+        ah_attr->sl = sl;
+        ah_attr->src_path_bits = src_path_bits;
+        ah_attr->port_num = port_num;
+}
+
+static void cm_init_av_for_response(struct cm_port *port,
+                                    struct ib_wc *wc, struct cm_av *av)
+{
+        av->port = port;
+        av->pkey_index = wc->pkey_index;
+        cm_set_ah_attr(&av->ah_attr, port->port_num, cpu_to_be16(wc->slid),
+                       wc->sl, wc->dlid_path_bits);
+}
+
+static int cm_init_av_by_path(struct ib_sa_path_rec *path, struct cm_av *av)
+{
+        struct cm_device *cm_dev;
+        struct cm_port *port = NULL;
+        unsigned long flags;
+        int ret;
+        u8 p;
+
+        read_lock_irqsave(&cm.device_lock, flags);
+        list_for_each_entry(cm_dev, &cm.device_list, list) {
+                if (!ib_find_cached_gid(cm_dev->device, &path->sgid,
+                                        &p, NULL)) {
+                        port = &cm_dev->port[p-1];
+                        break;
+                }
+        }
+        read_unlock_irqrestore(&cm.device_lock, flags);
+
+        if (!port)
+                return -EINVAL;
+
+        ret = ib_find_cached_pkey(cm_dev->device, port->port_num,
+                                  be16_to_cpu(path->pkey), &av->pkey_index);
+        if (ret)
+                return ret;
+
+        av->port = port;
+        cm_set_ah_attr(&av->ah_attr, av->port->port_num, path->dlid,
+                       path->sl, path->slid & 0x7F);
+        av->packet_life_time = path->packet_life_time;
+        return 0;
+}
+
+static int cm_alloc_id(struct cm_id_private *cm_id_priv)
+{
+        unsigned long flags;
+        int ret;
+
+        do {
+                spin_lock_irqsave(&cm.lock, flags);
+                ret = idr_get_new_above(&cm.local_id_table, cm_id_priv, 1,
+                                        (int *) &cm_id_priv->id.local_id);
+                spin_unlock_irqrestore(&cm.lock, flags);
+        } while( (ret == -EAGAIN) && idr_pre_get(&cm.local_id_table, GFP_KERNEL) );
+        return ret;
+}
+
+static void cm_free_id(u32 local_id)
+{
+        unsigned long flags;
+
+        spin_lock_irqsave(&cm.lock, flags);
+        idr_remove(&cm.local_id_table, (int) local_id);
+        spin_unlock_irqrestore(&cm.lock, flags);
+}
+
+static struct cm_id_private * cm_get_id(u32 local_id, u32 remote_id)
+{
+        struct cm_id_private *cm_id_priv;
+
+        cm_id_priv = idr_find(&cm.local_id_table, (int) local_id);
+        if (cm_id_priv) {
+                if (cm_id_priv->id.remote_id == remote_id)
+                        atomic_inc(&cm_id_priv->refcount);
+                else
+                        cm_id_priv = NULL;
+        }
+
+        return cm_id_priv;
+}
+
+static struct cm_id_private * cm_acquire_id(u32 local_id, u32 remote_id)
+{
+        struct cm_id_private *cm_id_priv;
+        unsigned long flags;
+
+        spin_lock_irqsave(&cm.lock, flags);
+        cm_id_priv = cm_get_id(local_id, remote_id);
+        spin_unlock_irqrestore(&cm.lock, flags);
+
+        return cm_id_priv;
+}
+
+static struct cm_id_private * cm_insert_listen(struct cm_id_private *cm_id_priv)
+{
+        struct rb_node **link = &cm.listen_service_table.rb_node;
+        struct rb_node *parent = NULL;
+        struct cm_id_private *cur_cm_id_priv;
+        u64 service_id = cm_id_priv->id.service_id;
+        u64 service_mask = cm_id_priv->id.service_mask;
+
+        while (*link) {
+                parent = *link;
+                cur_cm_id_priv = rb_entry(parent, struct cm_id_private,
+                                          service_node);
+                if ((cur_cm_id_priv->id.service_mask & service_id) ==
+                    (service_mask & cur_cm_id_priv->id.service_id))
+                        return cm_id_priv;
+                if (service_id < cur_cm_id_priv->id.service_id)
+                        link = &(*link)->rb_left;
+                else
+                        link = &(*link)->rb_right;
+        }
+        rb_link_node(&cm_id_priv->service_node, parent, link);
+        rb_insert_color(&cm_id_priv->service_node, &cm.listen_service_table);
+        return NULL;
+}
+
+static struct cm_id_private * cm_find_listen(u64 service_id)
+{
+        struct rb_node *node = cm.listen_service_table.rb_node;
+        struct cm_id_private *cm_id_priv;
+
+        while (node) {
+                cm_id_priv = rb_entry(node, struct cm_id_private, service_node);
+                if ((cm_id_priv->id.service_mask & service_id) ==
+                    (cm_id_priv->id.service_mask & cm_id_priv->id.service_id))
+                        return cm_id_priv;
+                if (service_id < cm_id_priv->id.service_id)
+                        node = node->rb_left;
+                else
+                        node = node->rb_right;
+        }
+        return NULL;
+}
+
+static struct cm_timewait_info * cm_insert_remote_id(struct cm_timewait_info
+                                                     *timewait_info)
+{
+        struct rb_node **link = &cm.remote_id_table.rb_node;
+        struct rb_node *parent = NULL;
+        struct cm_timewait_info *cur_timewait_info;
+        u64 remote_ca_guid = timewait_info->remote_ca_guid;
+        u32 remote_id = timewait_info->work.remote_id;
+
+        while (*link) {
+                parent = *link;
+                cur_timewait_info = rb_entry(parent, struct cm_timewait_info,
+                                             remote_id_node);
+                if (remote_id < cur_timewait_info->work.remote_id)
+                        link = &(*link)->rb_left;
+                else if (remote_id > cur_timewait_info->work.remote_id)
+                        link = &(*link)->rb_right;
+                else if (remote_ca_guid < cur_timewait_info->remote_ca_guid)
+                        link = &(*link)->rb_left;
+                else if (remote_ca_guid > cur_timewait_info->remote_ca_guid)
+                        link = &(*link)->rb_right;
+                else
+                        return cur_timewait_info;
+        }
+        timewait_info->inserted_remote_id = 1;
+        rb_link_node(&timewait_info->remote_id_node, parent, link);
+        rb_insert_color(&timewait_info->remote_id_node, &cm.remote_id_table);
+        return NULL;
+}
+
+static struct cm_timewait_info * cm_find_remote_id(u64 remote_ca_guid,
+                                                   u32 remote_id)
+{
+        struct rb_node *node = cm.remote_id_table.rb_node;
+        struct cm_timewait_info *timewait_info;
+
+        while (node) {
+                timewait_info = rb_entry(node, struct cm_timewait_info,
+                                         remote_id_node);
+                if (remote_id < timewait_info->work.remote_id)
+                        node = node->rb_left;
+                else if (remote_id > timewait_info->work.remote_id)
+                        node = node->rb_right;
+                else if (remote_ca_guid < timewait_info->remote_ca_guid)
+                        node = node->rb_left;
+                else if (remote_ca_guid > timewait_info->remote_ca_guid)
+                        node = node->rb_right;
+                else
+                        return timewait_info;
+        }
+        return NULL;
+}
+
+static struct cm_timewait_info * cm_insert_remote_qpn(struct cm_timewait_info
+                                                      *timewait_info)
+{
+        struct rb_node **link = &cm.remote_qp_table.rb_node;
+        struct rb_node *parent = NULL;
+        struct cm_timewait_info *cur_timewait_info;
+        u64 remote_ca_guid = timewait_info->remote_ca_guid;
+        u32 remote_qpn = timewait_info->remote_qpn;
+
+        while (*link) {
+                parent = *link;
+                cur_timewait_info = rb_entry(parent, struct cm_timewait_info,
+                                             remote_qp_node);
+                if (remote_qpn < cur_timewait_info->remote_qpn)
+                        link = &(*link)->rb_left;
+                else if (remote_qpn > cur_timewait_info->remote_qpn)
+                        link = &(*link)->rb_right;
+                else if (remote_ca_guid < cur_timewait_info->remote_ca_guid)
+                        link = &(*link)->rb_left;
+                else if (remote_ca_guid > cur_timewait_info->remote_ca_guid)
+                        link = &(*link)->rb_right;
+                else
+                        return cur_timewait_info;
+        }
+        timewait_info->inserted_remote_qp = 1;
+        rb_link_node(&timewait_info->remote_qp_node, parent, link);
+        rb_insert_color(&timewait_info->remote_qp_node, &cm.remote_qp_table);
+        return NULL;
+}
+
+static struct cm_id_private * cm_insert_remote_sidr(struct cm_id_private
+                                                    *cm_id_priv)
+{
+        struct rb_node **link = &cm.remote_sidr_table.rb_node;
+        struct rb_node *parent = NULL;
+        struct cm_id_private *cur_cm_id_priv;
+        union ib_gid *port_gid = &cm_id_priv->av.dgid;
+        u32 remote_id = cm_id_priv->id.remote_id;
+
+        while (*link) {
+                parent = *link;
+                cur_cm_id_priv = rb_entry(parent, struct cm_id_private,
+                                          sidr_id_node);
+                if (remote_id < cur_cm_id_priv->id.remote_id)
+                        link = &(*link)->rb_left;
+                else if (remote_id > cur_cm_id_priv->id.remote_id)
+                        link = &(*link)->rb_right;
+                else {
+                        int cmp;
+                        cmp = memcmp(port_gid, &cur_cm_id_priv->av.dgid,
+                                     sizeof *port_gid);
+                        if (cmp < 0)
+                                link = &(*link)->rb_left;
+                        else if (cmp > 0)
+                                link = &(*link)->rb_right;
+                        else
+                                return cur_cm_id_priv;
+                }
+        }
+        rb_link_node(&cm_id_priv->sidr_id_node, parent, link);
+        rb_insert_color(&cm_id_priv->sidr_id_node, &cm.remote_sidr_table);
+        return NULL;
+}
+
+static void cm_reject_sidr_req(struct cm_id_private *cm_id_priv,
+                               enum ib_cm_sidr_status status)
+{
+        struct ib_cm_sidr_rep_param param;
+
+        memset(&param, 0, sizeof param);
+        param.status = status;
+        ib_send_cm_sidr_rep(&cm_id_priv->id, &param);
+}
+
+struct ib_cm_id *ib_create_cm_id(ib_cm_handler cm_handler,
+                                 void *context)
+{
+        struct cm_id_private *cm_id_priv;
+        int ret;
+
+        cm_id_priv = kmalloc(sizeof *cm_id_priv, GFP_KERNEL);
+        if (!cm_id_priv)
+                return ERR_PTR(-ENOMEM);
+
+        memset(cm_id_priv, 0, sizeof *cm_id_priv);
+        cm_id_priv->id.state = IB_CM_IDLE;
+        cm_id_priv->id.cm_handler = cm_handler;
+        cm_id_priv->id.context = context;
+        ret = cm_alloc_id(cm_id_priv);
+        if (ret)
+                goto error;
+
+        spin_lock_init(&cm_id_priv->lock);
+        init_waitqueue_head(&cm_id_priv->wait);
+        INIT_LIST_HEAD(&cm_id_priv->work_list);
+        atomic_set(&cm_id_priv->work_count, -1);
+        atomic_set(&cm_id_priv->refcount, 1);
+        return &cm_id_priv->id;
+
+error:
+        kfree(cm_id_priv);
+        return ERR_PTR(-ENOMEM);
+}
+EXPORT_SYMBOL(ib_create_cm_id);
+
+static struct cm_work * cm_dequeue_work(struct cm_id_private *cm_id_priv)
+{
+        struct cm_work *work;
+
+        if (list_empty(&cm_id_priv->work_list))
+                return NULL;
+
+        work = list_entry(cm_id_priv->work_list.next, struct cm_work, list);
+        list_del(&work->list);
+        return work;
+}
+
+static void cm_free_work(struct cm_work *work)
+{
+        if (work->mad_recv_wc)
+                ib_free_recv_mad(work->mad_recv_wc);
+        kfree(work);
+}
+
+static inline int cm_convert_to_ms(int iba_time)
+{
+        /* approximate conversion to ms from 4.096us x 2^iba_time */
+        return 1 << max(iba_time - 8, 0);
+}
+
+static void cm_cleanup_timewait(struct cm_timewait_info *timewait_info)
+{
+        unsigned long flags;
+
+        if (!timewait_info->inserted_remote_id &&
+            !timewait_info->inserted_remote_qp)
+            return;
+
+        spin_lock_irqsave(&cm.lock, flags);
+        if (timewait_info->inserted_remote_id) {
+                rb_erase(&timewait_info->remote_id_node, &cm.remote_id_table);
+                timewait_info->inserted_remote_id = 0;
+        }
+
+        if (timewait_info->inserted_remote_qp) {
+                rb_erase(&timewait_info->remote_qp_node, &cm.remote_qp_table);
+                timewait_info->inserted_remote_qp = 0;
+        }
+        spin_unlock_irqrestore(&cm.lock, flags);
+}
+
+static struct cm_timewait_info * cm_create_timewait_info(u32 local_id)
+{
+        struct cm_timewait_info *timewait_info;
+
+        timewait_info = kmalloc(sizeof *timewait_info, GFP_KERNEL);
+        if (!timewait_info)
+                return ERR_PTR(-ENOMEM);
+        memset(timewait_info, 0, sizeof *timewait_info);
+
+        timewait_info->work.local_id = local_id;
+        INIT_WORK(&timewait_info->work.work, cm_work_handler,
+                  &timewait_info->work);
+        timewait_info->work.cm_event.event = IB_CM_TIMEWAIT_EXIT;
+        return timewait_info;
+}
+
+static void cm_enter_timewait(struct cm_id_private *cm_id_priv)
+{
+        int wait_time;
+
+        /*
+         * The cm_id could be destroyed by the user before we exit timewait.
+         * To protect against this, we search for the cm_id after exiting
+         * timewait before notifying the user that we've exited timewait.
+         */
+        cm_id_priv->id.state = IB_CM_TIMEWAIT;
+        wait_time = cm_convert_to_ms(cm_id_priv->local_ack_timeout);
+        queue_delayed_work(cm.wq, &cm_id_priv->timewait_info->work.work,
+                           msecs_to_jiffies(wait_time));
+        cm_id_priv->timewait_info = NULL;
+}
+
+static void cm_reset_to_idle(struct cm_id_private *cm_id_priv)
+{
+        cm_id_priv->id.state = IB_CM_IDLE;
+        if (cm_id_priv->timewait_info) {
+                cm_cleanup_timewait(cm_id_priv->timewait_info);
+                kfree(cm_id_priv->timewait_info);
+                cm_id_priv->timewait_info = NULL;
+        }
+}
+
+void ib_destroy_cm_id(struct ib_cm_id *cm_id)
+{
+        struct cm_id_private *cm_id_priv;
+        struct cm_work *work;
+        unsigned long flags;
+
+        cm_id_priv = container_of(cm_id, struct cm_id_private, id);
+retest:
+        spin_lock_irqsave(&cm_id_priv->lock, flags);
+        switch (cm_id->state) {
+        case IB_CM_LISTEN:
+                cm_id->state = IB_CM_IDLE;
+                spin_unlock_irqrestore(&cm_id_priv->lock, flags);
+                spin_lock_irqsave(&cm.lock, flags);
+                rb_erase(&cm_id_priv->service_node, &cm.listen_service_table);
+                spin_unlock_irqrestore(&cm.lock, flags);
+                break;
+        case IB_CM_SIDR_REQ_SENT:
+                cm_id->state = IB_CM_IDLE;
+                ib_cancel_mad(cm_id_priv->av.port->mad_agent,
+                              (unsigned long) cm_id_priv->msg);
+                spin_unlock_irqrestore(&cm_id_priv->lock, flags);
+                break;
+        case IB_CM_SIDR_REQ_RCVD:
+                spin_unlock_irqrestore(&cm_id_priv->lock, flags);
+                cm_reject_sidr_req(cm_id_priv, IB_SIDR_REJECT);
+                break;
+        case IB_CM_REQ_SENT:
+        case IB_CM_MRA_REQ_RCVD:
+        case IB_CM_REP_SENT:
+        case IB_CM_MRA_REP_RCVD:
+                ib_cancel_mad(cm_id_priv->av.port->mad_agent,
+                              (unsigned long) cm_id_priv->msg);
+                /* Fall through */
+        case IB_CM_REQ_RCVD:
+        case IB_CM_MRA_REQ_SENT:
+        case IB_CM_REP_RCVD:
+        case IB_CM_MRA_REP_SENT:
+                spin_unlock_irqrestore(&cm_id_priv->lock, flags);
+                ib_send_cm_rej(cm_id, IB_CM_REJ_TIMEOUT,
+                               &cm_id_priv->av.port->cm_dev->ca_guid,
+                               sizeof cm_id_priv->av.port->cm_dev->ca_guid,
+                               NULL, 0);
+                break;
+        case IB_CM_ESTABLISHED:
+                spin_unlock_irqrestore(&cm_id_priv->lock, flags);
+                ib_send_cm_dreq(cm_id, NULL, 0);
+                goto retest;
+        case IB_CM_DREQ_SENT:
+                ib_cancel_mad(cm_id_priv->av.port->mad_agent,
+                              (unsigned long) cm_id_priv->msg);
+                cm_enter_timewait(cm_id_priv);
+                spin_unlock_irqrestore(&cm_id_priv->lock, flags);
+                break;
+        case IB_CM_DREQ_RCVD:
+                spin_unlock_irqrestore(&cm_id_priv->lock, flags);
+                ib_send_cm_drep(cm_id, NULL, 0);
+                break;
+        default:
+                spin_unlock_irqrestore(&cm_id_priv->lock, flags);
+                break;
+        }
+
+        cm_free_id(cm_id->local_id);
+        atomic_dec(&cm_id_priv->refcount);
+        wait_event(cm_id_priv->wait, !atomic_read(&cm_id_priv->refcount));
+        while ((work = cm_dequeue_work(cm_id_priv)) != NULL)
+                cm_free_work(work);
+        if (cm_id_priv->private_data && cm_id_priv->private_data_len)
+                kfree(cm_id_priv->private_data);
+        kfree(cm_id_priv);
+}
+EXPORT_SYMBOL(ib_destroy_cm_id);
+
+int ib_cm_listen(struct ib_cm_id *cm_id,
+                 u64 service_id,
+                 u64 service_mask)
+{
+        struct cm_id_private *cm_id_priv, *cur_cm_id_priv;
+        unsigned long flags;
+        int ret = 0;
+
+        service_mask = service_mask ? service_mask : ~0ULL;
+        service_id &= service_mask;
+        if ((service_id & IB_SERVICE_ID_AGN_MASK) == IB_CM_ASSIGN_SERVICE_ID &&
+            (service_id != IB_CM_ASSIGN_SERVICE_ID))
+                return -EINVAL;
+
+        cm_id_priv = container_of(cm_id, struct cm_id_private, id);
+        BUG_ON(cm_id->state != IB_CM_IDLE);
+
+        cm_id->state = IB_CM_LISTEN;
+
+        spin_lock_irqsave(&cm.lock, flags);
+        if (service_id == IB_CM_ASSIGN_SERVICE_ID) {
+                cm_id->service_id = __cpu_to_be64(cm.listen_service_id++);
+                cm_id->service_mask = ~0ULL;
+        } else {
+                cm_id->service_id = service_id;
+                cm_id->service_mask = service_mask;
+        }
+        cur_cm_id_priv = cm_insert_listen(cm_id_priv);
+        spin_unlock_irqrestore(&cm.lock, flags);
+
+        if (cur_cm_id_priv) {
+                cm_id->state = IB_CM_IDLE;
+                ret = -EBUSY;
+        }
+        return ret;
+}
+EXPORT_SYMBOL(ib_cm_listen);
+
+static u64 cm_form_tid(struct cm_id_private *cm_id_priv,
+                       enum cm_msg_sequence msg_seq)
+{
+        u64 hi_tid, low_tid;
+
+        hi_tid   = ((u64) cm_id_priv->av.port->mad_agent->hi_tid) << 32;
+        low_tid  = (u64) (cm_id_priv->id.local_id | (msg_seq << 30));
+        return cpu_to_be64(hi_tid | low_tid);
+}
+
+static void cm_format_mad_hdr(struct ib_mad_hdr *hdr,
+                              enum cm_msg_attr_id attr_id, u64 tid)
+{
+        hdr->base_version  = IB_MGMT_BASE_VERSION;
+        hdr->mgmt_class    = IB_MGMT_CLASS_CM;
+        hdr->class_version = IB_CM_CLASS_VERSION;
+        hdr->method        = IB_MGMT_METHOD_SEND;
+        hdr->attr_id       = attr_id;
+        hdr->tid           = tid;
+}
+
+static void cm_format_req(struct cm_req_msg *req_msg,
+                          struct cm_id_private *cm_id_priv,
+                          struct ib_cm_req_param *param)
+{
+        cm_format_mad_hdr(&req_msg->hdr, CM_REQ_ATTR_ID,
+                          cm_form_tid(cm_id_priv, CM_MSG_SEQUENCE_REQ));
+
+        req_msg->local_comm_id = cm_id_priv->id.local_id;
+        req_msg->service_id = param->service_id;
+        req_msg->local_ca_guid = cm_id_priv->av.port->cm_dev->ca_guid;
+        cm_req_set_local_qpn(req_msg, cpu_to_be32(param->qp_num));
+        cm_req_set_resp_res(req_msg, param->responder_resources);
+        cm_req_set_init_depth(req_msg, param->initiator_depth);
+        cm_req_set_remote_resp_timeout(req_msg,
+                                       param->remote_cm_response_timeout);
+        cm_req_set_qp_type(req_msg, param->qp_type);
+        cm_req_set_flow_ctrl(req_msg, param->flow_control);
+        cm_req_set_starting_psn(req_msg, cpu_to_be32(param->starting_psn));
+        cm_req_set_local_resp_timeout(req_msg,
+                                      param->local_cm_response_timeout);
+        cm_req_set_retry_count(req_msg, param->retry_count);
+        req_msg->pkey = param->primary_path->pkey;
+        cm_req_set_path_mtu(req_msg, param->primary_path->mtu);
+        cm_req_set_rnr_retry_count(req_msg, param->rnr_retry_count);
+        cm_req_set_max_cm_retries(req_msg, param->max_cm_retries);
+        cm_req_set_srq(req_msg, param->srq);
+
+        req_msg->primary_local_lid = param->primary_path->slid;
+        req_msg->primary_remote_lid = param->primary_path->dlid;
+        req_msg->primary_local_gid = param->primary_path->sgid;
+        req_msg->primary_remote_gid = param->primary_path->dgid;
+        cm_req_set_primary_flow_label(req_msg, param->primary_path->flow_label);
+        cm_req_set_primary_packet_rate(req_msg, param->primary_path->rate);
+        req_msg->primary_traffic_class = param->primary_path->traffic_class;
+        req_msg->primary_hop_limit = param->primary_path->hop_limit;
+        cm_req_set_primary_sl(req_msg, param->primary_path->sl);
+        cm_req_set_primary_subnet_local(req_msg, 1); /* local only... */
+        cm_req_set_primary_local_ack_timeout(req_msg,
+                min(31, param->primary_path->packet_life_time + 1));
+
+        if (param->alternate_path) {
+                req_msg->alt_local_lid = param->alternate_path->slid;
+                req_msg->alt_remote_lid = param->alternate_path->dlid;
+                req_msg->alt_local_gid = param->alternate_path->sgid;
+                req_msg->alt_remote_gid = param->alternate_path->dgid;
+                cm_req_set_alt_flow_label(req_msg,
+                                          param->alternate_path->flow_label);
+                cm_req_set_alt_packet_rate(req_msg, param->alternate_path->rate);
+                req_msg->alt_traffic_class = param->alternate_path->traffic_class;
+                req_msg->alt_hop_limit = param->alternate_path->hop_limit;
+                cm_req_set_alt_sl(req_msg, param->alternate_path->sl);
+                cm_req_set_alt_subnet_local(req_msg, 1); /* local only... */
+                cm_req_set_alt_local_ack_timeout(req_msg,
+                        min(31, param->alternate_path->packet_life_time + 1));
+        }
+
+        if (param->private_data && param->private_data_len)
+                memcpy(req_msg->private_data, param->private_data,
+                       param->private_data_len);
+}
+
+static inline int cm_validate_req_param(struct ib_cm_req_param *param)
+{
+        /* peer-to-peer not supported */
+        if (param->peer_to_peer)
+                return -EINVAL;
+
+        if (!param->primary_path)
+                return -EINVAL;
+
+        if (param->qp_type != IB_QPT_RC && param->qp_type != IB_QPT_UC)
+                return -EINVAL;
+
+        if (param->private_data &&
+            param->private_data_len > IB_CM_REQ_PRIVATE_DATA_SIZE)
+                return -EINVAL;
+
+        if (param->alternate_path &&
+            (param->alternate_path->pkey != param->primary_path->pkey ||
+             param->alternate_path->mtu != param->primary_path->mtu))
+                return -EINVAL;
+
+        return 0;
+}
+
+int ib_send_cm_req(struct ib_cm_id *cm_id,
+                   struct ib_cm_req_param *param)
+{
+        struct cm_id_private *cm_id_priv;
+        struct ib_send_wr *bad_send_wr;
+        struct cm_req_msg *req_msg;
+        unsigned long flags;
+        int ret;
+
+        ret = cm_validate_req_param(param);
+        if (ret)
+                return ret;
+
+        /* Verify that we're not in timewait. */
+        cm_id_priv = container_of(cm_id, struct cm_id_private, id);
+        spin_lock_irqsave(&cm_id_priv->lock, flags);
+        if (cm_id->state != IB_CM_IDLE) {
+                spin_unlock_irqrestore(&cm_id_priv->lock, flags);
+                ret = -EINVAL;
+                goto out;
+        }
+        spin_unlock_irqrestore(&cm_id_priv->lock, flags);
+
+        cm_id_priv->timewait_info = cm_create_timewait_info(cm_id_priv->
+                                                            id.local_id);
+        if (IS_ERR(cm_id_priv->timewait_info))
+                goto out;
+
+        ret = cm_init_av_by_path(param->primary_path, &cm_id_priv->av);
+        if (ret)
+                goto error1;
+        if (param->alternate_path) {
+                ret = cm_init_av_by_path(param->alternate_path,
+                                         &cm_id_priv->alt_av);
+                if (ret)
+                        goto error1;
+        }
+        cm_id->service_id = param->service_id;
+        cm_id->service_mask = ~0ULL;
+        cm_id_priv->timeout_ms = cm_convert_to_ms(
+                                    param->primary_path->packet_life_time) * 2 +
+                                 cm_convert_to_ms(
+                                    param->remote_cm_response_timeout);
+        cm_id_priv->max_cm_retries = param->max_cm_retries;
+        cm_id_priv->initiator_depth = param->initiator_depth;
+        cm_id_priv->responder_resources = param->responder_resources;
+        cm_id_priv->retry_count = param->retry_count;
+        cm_id_priv->path_mtu = param->primary_path->mtu;
+
+        ret = cm_alloc_msg(cm_id_priv, &cm_id_priv->msg);
+        if (ret)
+                goto error1;
+
+        req_msg = (struct cm_req_msg *) cm_id_priv->msg->mad;
+        cm_format_req(req_msg, cm_id_priv, param);
+        cm_id_priv->tid = req_msg->hdr.tid;
+        cm_id_priv->msg->send_wr.wr.ud.timeout_ms = cm_id_priv->timeout_ms;
+        cm_id_priv->msg->context[1] = (void *) (unsigned long) IB_CM_REQ_SENT;
+
+        cm_id_priv->local_qpn = cm_req_get_local_qpn(req_msg);
+        cm_id_priv->rq_psn = cm_req_get_starting_psn(req_msg);
+        cm_id_priv->local_ack_timeout =
+                                cm_req_get_primary_local_ack_timeout(req_msg);
+
+        spin_lock_irqsave(&cm_id_priv->lock, flags);
+        ret = ib_post_send_mad(cm_id_priv->av.port->mad_agent,
+                                &cm_id_priv->msg->send_wr, &bad_send_wr);
+        if (ret) {
+                spin_unlock_irqrestore(&cm_id_priv->lock, flags);
+                goto error2;
+        }
+        BUG_ON(cm_id->state != IB_CM_IDLE);
+        cm_id->state = IB_CM_REQ_SENT;
+        spin_unlock_irqrestore(&cm_id_priv->lock, flags);
+        return 0;
+
+error2: cm_free_msg(cm_id_priv->msg);
+error1: kfree(cm_id_priv->timewait_info);
+out:    return ret;
+}
+EXPORT_SYMBOL(ib_send_cm_req);
+
+static int cm_issue_rej(struct cm_port *port,
+                        struct ib_mad_recv_wc *mad_recv_wc,
+                        enum ib_cm_rej_reason reason,
+                        enum cm_msg_response msg_rejected,
+                        void *ari, u8 ari_length)
+{
+        struct ib_mad_send_buf *msg = NULL;
+        struct ib_send_wr *bad_send_wr;
+        struct cm_rej_msg *rej_msg, *rcv_msg;
+        int ret;
+
+        ret = cm_alloc_response_msg(port, mad_recv_wc, &msg);
+        if (ret)
+                return ret;
+
+        /* We just need common CM header information.  Cast to any message. */
+        rcv_msg = (struct cm_rej_msg *) mad_recv_wc->recv_buf.mad;
+        rej_msg = (struct cm_rej_msg *) msg->mad;
+
+        cm_format_mad_hdr(&rej_msg->hdr, CM_REJ_ATTR_ID, rcv_msg->hdr.tid);
+        rej_msg->remote_comm_id = rcv_msg->local_comm_id;
+        rej_msg->local_comm_id = rcv_msg->remote_comm_id;
+        cm_rej_set_msg_rejected(rej_msg, msg_rejected);
+        rej_msg->reason = reason;
+
+        if (ari && ari_length) {
+                cm_rej_set_reject_info_len(rej_msg, ari_length);
+                memcpy(rej_msg->ari, ari, ari_length);
+        }
+
+        ret = ib_post_send_mad(port->mad_agent, &msg->send_wr, &bad_send_wr);
+        if (ret)
+                cm_free_msg(msg);
+
+        return ret;
+}
+
+static inline int cm_is_active_peer(u64 local_ca_guid, u64 remote_ca_guid,
+                                    u32 local_qpn, u32 remote_qpn)
+{
+        return (be64_to_cpu(local_ca_guid) > be64_to_cpu(remote_ca_guid) ||
+                ((local_ca_guid == remote_ca_guid) &&
+                 (be32_to_cpu(local_qpn) > be32_to_cpu(remote_qpn))));
+}
+
+static inline void cm_format_paths_from_req(struct cm_req_msg *req_msg,
+                                            struct ib_sa_path_rec *primary_path,
+                                            struct ib_sa_path_rec *alt_path)
+{
+        memset(primary_path, 0, sizeof *primary_path);
+        primary_path->dgid = req_msg->primary_local_gid;
+        primary_path->sgid = req_msg->primary_remote_gid;
+        primary_path->dlid = req_msg->primary_local_lid;
+        primary_path->slid = req_msg->primary_remote_lid;
+        primary_path->flow_label = cm_req_get_primary_flow_label(req_msg);
+        primary_path->hop_limit = req_msg->primary_hop_limit;
+        primary_path->traffic_class = req_msg->primary_traffic_class;
+        primary_path->reversible = 1;
+        primary_path->pkey = req_msg->pkey;
+        primary_path->sl = cm_req_get_primary_sl(req_msg);
+        primary_path->mtu_selector = IB_SA_EQ;
+        primary_path->mtu = cm_req_get_path_mtu(req_msg);
+        primary_path->rate_selector = IB_SA_EQ;
+        primary_path->rate = cm_req_get_primary_packet_rate(req_msg);
+        primary_path->packet_life_time_selector = IB_SA_EQ;
+        primary_path->packet_life_time =
+                cm_req_get_primary_local_ack_timeout(req_msg);
+        primary_path->packet_life_time -= (primary_path->packet_life_time > 0);
+
+        if (req_msg->alt_local_lid) {
+                memset(alt_path, 0, sizeof *alt_path);
+                alt_path->dgid = req_msg->alt_local_gid;
+                alt_path->sgid = req_msg->alt_remote_gid;
+                alt_path->dlid = req_msg->alt_local_lid;
+                alt_path->slid = req_msg->alt_remote_lid;
+                alt_path->flow_label = cm_req_get_alt_flow_label(req_msg);
+                alt_path->hop_limit = req_msg->alt_hop_limit;
+                alt_path->traffic_class = req_msg->alt_traffic_class;
+                alt_path->reversible = 1;
+                alt_path->pkey = req_msg->pkey;
+                alt_path->sl = cm_req_get_alt_sl(req_msg);
+                alt_path->mtu_selector = IB_SA_EQ;
+                alt_path->mtu = cm_req_get_path_mtu(req_msg);
+                alt_path->rate_selector = IB_SA_EQ;
+                alt_path->rate = cm_req_get_alt_packet_rate(req_msg);
+                alt_path->packet_life_time_selector = IB_SA_EQ;
+                alt_path->packet_life_time =
+                        cm_req_get_alt_local_ack_timeout(req_msg);
+                alt_path->packet_life_time -= (alt_path->packet_life_time > 0);
+        }
+}
+
+static void cm_format_req_event(struct cm_work *work,
+                                struct cm_id_private *cm_id_priv,
+                                struct ib_cm_id *listen_id)
+{
+        struct cm_req_msg *req_msg;
+        struct ib_cm_req_event_param *param;
+
+        req_msg = (struct cm_req_msg *)work->mad_recv_wc->recv_buf.mad;
+        param = &work->cm_event.param.req_rcvd;
+        param->listen_id = listen_id;
+        param->device = cm_id_priv->av.port->mad_agent->device;
+        param->port = cm_id_priv->av.port->port_num;
+        param->primary_path = &work->path[0];
+        if (req_msg->alt_local_lid)
+                param->alternate_path = &work->path[1];
+        else
+                param->alternate_path = NULL;
+        param->remote_ca_guid = req_msg->local_ca_guid;
+        param->remote_qkey = be32_to_cpu(req_msg->local_qkey);
+        param->remote_qpn = be32_to_cpu(cm_req_get_local_qpn(req_msg));
+        param->qp_type = cm_req_get_qp_type(req_msg);
+        param->starting_psn = be32_to_cpu(cm_req_get_starting_psn(req_msg));
+        param->responder_resources = cm_req_get_init_depth(req_msg);
+        param->initiator_depth = cm_req_get_resp_res(req_msg);
+        param->local_cm_response_timeout =
+                                        cm_req_get_remote_resp_timeout(req_msg);
+        param->flow_control = cm_req_get_flow_ctrl(req_msg);
+        param->remote_cm_response_timeout =
+                                        cm_req_get_local_resp_timeout(req_msg);
+        param->retry_count = cm_req_get_retry_count(req_msg);
+        param->rnr_retry_count = cm_req_get_rnr_retry_count(req_msg);
+        param->srq = cm_req_get_srq(req_msg);
+        work->cm_event.private_data = &req_msg->private_data;
+}
+
+static void cm_process_work(struct cm_id_private *cm_id_priv,
+                            struct cm_work *work)
+{
+        unsigned long flags;
+        int ret;
+
+        /* We will typically only have the current event to report. */
+        ret = cm_id_priv->id.cm_handler(&cm_id_priv->id, &work->cm_event);
+        cm_free_work(work);
+
+        while (!ret && !atomic_add_negative(-1, &cm_id_priv->work_count)) {
+                spin_lock_irqsave(&cm_id_priv->lock, flags);
+                work = cm_dequeue_work(cm_id_priv);
+                spin_unlock_irqrestore(&cm_id_priv->lock, flags);
+                BUG_ON(!work);
+                ret = cm_id_priv->id.cm_handler(&cm_id_priv->id,
+                                                &work->cm_event);
+                cm_free_work(work);
+        }
+        cm_deref_id(cm_id_priv);
+        if (ret)
+                ib_destroy_cm_id(&cm_id_priv->id);
+}
+
+static void cm_format_mra(struct cm_mra_msg *mra_msg,
+                          struct cm_id_private *cm_id_priv,
+                          enum cm_msg_response msg_mraed, u8 service_timeout,
+                          const void *private_data, u8 private_data_len)
+{
+        cm_format_mad_hdr(&mra_msg->hdr, CM_MRA_ATTR_ID, cm_id_priv->tid);
+        cm_mra_set_msg_mraed(mra_msg, msg_mraed);
+        mra_msg->local_comm_id = cm_id_priv->id.local_id;
+        mra_msg->remote_comm_id = cm_id_priv->id.remote_id;
+        cm_mra_set_service_timeout(mra_msg, service_timeout);
+
+        if (private_data && private_data_len)
+                memcpy(mra_msg->private_data, private_data, private_data_len);
+}
+
+static void cm_format_rej(struct cm_rej_msg *rej_msg,
+                          struct cm_id_private *cm_id_priv,
+                          enum ib_cm_rej_reason reason,
+                          void *ari,
+                          u8 ari_length,
+                          const void *private_data,
+                          u8 private_data_len)
+{
+        cm_format_mad_hdr(&rej_msg->hdr, CM_REJ_ATTR_ID, cm_id_priv->tid);
+        rej_msg->remote_comm_id = cm_id_priv->id.remote_id;
+
+        switch(cm_id_priv->id.state) {
+        case IB_CM_REQ_RCVD:
+                rej_msg->local_comm_id = 0;
+                cm_rej_set_msg_rejected(rej_msg, CM_MSG_RESPONSE_REQ);
+                break;
+        case IB_CM_MRA_REQ_SENT:
+                rej_msg->local_comm_id = cm_id_priv->id.local_id;
+                cm_rej_set_msg_rejected(rej_msg, CM_MSG_RESPONSE_REQ);
+                break;
+        case IB_CM_REP_RCVD:
+        case IB_CM_MRA_REP_SENT:
+                rej_msg->local_comm_id = cm_id_priv->id.local_id;
+                cm_rej_set_msg_rejected(rej_msg, CM_MSG_RESPONSE_REP);
+                break;
+        default:
+                rej_msg->local_comm_id = cm_id_priv->id.local_id;
+                cm_rej_set_msg_rejected(rej_msg, CM_MSG_RESPONSE_OTHER);
+                break;
+        }
+
+        rej_msg->reason = reason;
+        if (ari && ari_length) {
+                cm_rej_set_reject_info_len(rej_msg, ari_length);
+                memcpy(rej_msg->ari, ari, ari_length);
+        }
+
+        if (private_data && private_data_len)
+                memcpy(rej_msg->private_data, private_data, private_data_len);
+}
+
+static void cm_dup_req_handler(struct cm_work *work,
+                               struct cm_id_private *cm_id_priv)
+{
+        struct ib_mad_send_buf *msg = NULL;
+        struct ib_send_wr *bad_send_wr;
+        unsigned long flags;
+        int ret;
+
+        /* Quick state check to discard duplicate REQs. */
+        if (cm_id_priv->id.state == IB_CM_REQ_RCVD)
+                return;
+
+        ret = cm_alloc_response_msg(work->port, work->mad_recv_wc, &msg);
+        if (ret)
+                return;
+
+        spin_lock_irqsave(&cm_id_priv->lock, flags);
+        switch (cm_id_priv->id.state) {
+        case IB_CM_MRA_REQ_SENT:
+                cm_format_mra((struct cm_mra_msg *) msg->mad, cm_id_priv,
+                              CM_MSG_RESPONSE_REQ, cm_id_priv->service_timeout,
+                              cm_id_priv->private_data,
+                              cm_id_priv->private_data_len);
+                break;
+        case IB_CM_TIMEWAIT:
+                cm_format_rej((struct cm_rej_msg *) msg->mad, cm_id_priv,
+                              IB_CM_REJ_STALE_CONN, NULL, 0, NULL, 0);
+                break;
+        default:
+                goto unlock;
+        }
+        spin_unlock_irqrestore(&cm_id_priv->lock, flags);
+
+        ret = ib_post_send_mad(cm_id_priv->av.port->mad_agent, &msg->send_wr,
+                               &bad_send_wr);
+        if (ret)
+                goto free;
+        return;
+
+unlock: spin_unlock_irqrestore(&cm_id_priv->lock, flags);
+free:   cm_free_msg(msg);
+}
+
+static struct cm_id_private * cm_match_req(struct cm_work *work,
+                                           struct cm_id_private *cm_id_priv)
+{
+        struct cm_id_private *listen_cm_id_priv, *cur_cm_id_priv;
+        struct cm_timewait_info *timewait_info;
+        struct cm_req_msg *req_msg;
+        unsigned long flags;
+
+        req_msg = (struct cm_req_msg *)work->mad_recv_wc->recv_buf.mad;
+
+        /* Check for duplicate REQ and stale connections. */
+        spin_lock_irqsave(&cm.lock, flags);
+        timewait_info = cm_insert_remote_id(cm_id_priv->timewait_info);
+        if (!timewait_info)
+                timewait_info = cm_insert_remote_qpn(cm_id_priv->timewait_info);
+
+        if (timewait_info) {
+                cur_cm_id_priv = cm_get_id(timewait_info->work.local_id,
+                                           timewait_info->work.remote_id);
+                spin_unlock_irqrestore(&cm.lock, flags);
+                if (cur_cm_id_priv) {
+                        cm_dup_req_handler(work, cur_cm_id_priv);
+                        cm_deref_id(cur_cm_id_priv);
+                } else
+                        cm_issue_rej(work->port, work->mad_recv_wc,
+                                     IB_CM_REJ_STALE_CONN, CM_MSG_RESPONSE_REQ,
+                                     NULL, 0);
+                goto error;
+        }
+
+        /* Find matching listen request. */
+        listen_cm_id_priv = cm_find_listen(req_msg->service_id);
+        if (!listen_cm_id_priv) {
+                spin_unlock_irqrestore(&cm.lock, flags);
+                cm_issue_rej(work->port, work->mad_recv_wc,
+                             IB_CM_REJ_INVALID_SERVICE_ID, CM_MSG_RESPONSE_REQ,
+                             NULL, 0);
+                goto error;
+        }
+        atomic_inc(&listen_cm_id_priv->refcount);
+        atomic_inc(&cm_id_priv->refcount);
+        cm_id_priv->id.state = IB_CM_REQ_RCVD;
+        atomic_inc(&cm_id_priv->work_count);
+        spin_unlock_irqrestore(&cm.lock, flags);
+        return listen_cm_id_priv;
+
+error:  cm_cleanup_timewait(cm_id_priv->timewait_info);
+        return NULL;
+}
+
+static int cm_req_handler(struct cm_work *work)
+{
+        struct ib_cm_id *cm_id;
+        struct cm_id_private *cm_id_priv, *listen_cm_id_priv;
+        struct cm_req_msg *req_msg;
+        int ret;
+
+        req_msg = (struct cm_req_msg *)work->mad_recv_wc->recv_buf.mad;
+
+        cm_id = ib_create_cm_id(NULL, NULL);
+        if (IS_ERR(cm_id))
+                return PTR_ERR(cm_id);
+
+        cm_id_priv = container_of(cm_id, struct cm_id_private, id);
+        cm_id_priv->id.remote_id = req_msg->local_comm_id;
+        cm_init_av_for_response(work->port, work->mad_recv_wc->wc,
+                                &cm_id_priv->av);
+        cm_id_priv->timewait_info = cm_create_timewait_info(cm_id_priv->
+                                                            id.local_id);
+        if (IS_ERR(cm_id_priv->timewait_info)) {
+                ret = PTR_ERR(cm_id_priv->timewait_info);
+                goto error1;
+        }
+        cm_id_priv->timewait_info->work.remote_id = req_msg->local_comm_id;
+        cm_id_priv->timewait_info->remote_ca_guid = req_msg->local_ca_guid;
+        cm_id_priv->timewait_info->remote_qpn = cm_req_get_local_qpn(req_msg);
+
+        listen_cm_id_priv = cm_match_req(work, cm_id_priv);
+        if (!listen_cm_id_priv) {
+                ret = -EINVAL;
+                goto error2;
+        }
+
+        cm_id_priv->id.cm_handler = listen_cm_id_priv->id.cm_handler;
+        cm_id_priv->id.context = listen_cm_id_priv->id.context;
+        cm_id_priv->id.service_id = req_msg->service_id;
+        cm_id_priv->id.service_mask = ~0ULL;
+
+        cm_format_paths_from_req(req_msg, &work->path[0], &work->path[1]);
+        ret = cm_init_av_by_path(&work->path[0], &cm_id_priv->av);
+        if (ret)
+                goto error3;
+        if (req_msg->alt_local_lid) {
+                ret = cm_init_av_by_path(&work->path[1], &cm_id_priv->alt_av);
+                if (ret)
+                        goto error3;
+        }
+        cm_id_priv->tid = req_msg->hdr.tid;
+        cm_id_priv->timeout_ms = cm_convert_to_ms(
+                                        cm_req_get_local_resp_timeout(req_msg));
+        cm_id_priv->max_cm_retries = cm_req_get_max_cm_retries(req_msg);
+        cm_id_priv->remote_qpn = cm_req_get_local_qpn(req_msg);
+        cm_id_priv->initiator_depth = cm_req_get_resp_res(req_msg);
+        cm_id_priv->responder_resources = cm_req_get_init_depth(req_msg);
+        cm_id_priv->path_mtu = cm_req_get_path_mtu(req_msg);
+        cm_id_priv->sq_psn = cm_req_get_starting_psn(req_msg);
+        cm_id_priv->local_ack_timeout =
+                                cm_req_get_primary_local_ack_timeout(req_msg);
+        cm_id_priv->retry_count = cm_req_get_retry_count(req_msg);
+        cm_id_priv->rnr_retry_count = cm_req_get_rnr_retry_count(req_msg);
+
+        cm_format_req_event(work, cm_id_priv, &listen_cm_id_priv->id);
+        cm_process_work(cm_id_priv, work);
+        cm_deref_id(listen_cm_id_priv);
+        return 0;
+
+error3: atomic_dec(&cm_id_priv->refcount);
+        cm_deref_id(listen_cm_id_priv);
+        cm_cleanup_timewait(cm_id_priv->timewait_info);
+error2: kfree(cm_id_priv->timewait_info);
+error1: ib_destroy_cm_id(&cm_id_priv->id);
+        return ret;
+}
+
+static void cm_format_rep(struct cm_rep_msg *rep_msg,
+                          struct cm_id_private *cm_id_priv,
+                          struct ib_cm_rep_param *param)
+{
+        cm_format_mad_hdr(&rep_msg->hdr, CM_REP_ATTR_ID, cm_id_priv->tid);
+        rep_msg->local_comm_id = cm_id_priv->id.local_id;
+        rep_msg->remote_comm_id = cm_id_priv->id.remote_id;
+        cm_rep_set_local_qpn(rep_msg, cpu_to_be32(param->qp_num));
+        cm_rep_set_starting_psn(rep_msg, cpu_to_be32(param->starting_psn));
+        rep_msg->resp_resources = param->responder_resources;
+        rep_msg->initiator_depth = param->initiator_depth;
+        cm_rep_set_target_ack_delay(rep_msg, param->target_ack_delay);
+        cm_rep_set_failover(rep_msg, param->failover_accepted);
+        cm_rep_set_flow_ctrl(rep_msg, param->flow_control);
+        cm_rep_set_rnr_retry_count(rep_msg, param->rnr_retry_count);
+        cm_rep_set_srq(rep_msg, param->srq);
+        rep_msg->local_ca_guid = cm_id_priv->av.port->cm_dev->ca_guid;
+
+        if (param->private_data && param->private_data_len)
+                memcpy(rep_msg->private_data, param->private_data,
+                       param->private_data_len);
+}
+
+int ib_send_cm_rep(struct ib_cm_id *cm_id,
+                   struct ib_cm_rep_param *param)
+{
+        struct cm_id_private *cm_id_priv;
+        struct ib_mad_send_buf *msg;
+        struct cm_rep_msg *rep_msg;
+        struct ib_send_wr *bad_send_wr;
+        unsigned long flags;
+        int ret;
+
+        if (param->private_data &&
+            param->private_data_len > IB_CM_REP_PRIVATE_DATA_SIZE)
+                return -EINVAL;
+
+        cm_id_priv = container_of(cm_id, struct cm_id_private, id);
+        spin_lock_irqsave(&cm_id_priv->lock, flags);
+        if (cm_id->state != IB_CM_REQ_RCVD &&
+            cm_id->state != IB_CM_MRA_REQ_SENT) {
+                ret = -EINVAL;
+                goto out;
+        }
+
+        ret = cm_alloc_msg(cm_id_priv, &msg);
+        if (ret)
+                goto out;
+
+        rep_msg = (struct cm_rep_msg *) msg->mad;
+        cm_format_rep(rep_msg, cm_id_priv, param);
+        msg->send_wr.wr.ud.timeout_ms = cm_id_priv->timeout_ms;
+        msg->context[1] = (void *) (unsigned long) IB_CM_REP_SENT;
+
+        ret = ib_post_send_mad(cm_id_priv->av.port->mad_agent,
+                               &msg->send_wr, &bad_send_wr);
+        if (ret) {
+                spin_unlock_irqrestore(&cm_id_priv->lock, flags);
+                cm_free_msg(msg);
+                return ret;
+        }
+
+        cm_id->state = IB_CM_REP_SENT;
+        cm_id_priv->msg = msg;
+        cm_id_priv->initiator_depth = param->initiator_depth;
+        cm_id_priv->responder_resources = param->responder_resources;
+        cm_id_priv->rq_psn = cm_rep_get_starting_psn(rep_msg);
+        cm_id_priv->local_qpn = cm_rep_get_local_qpn(rep_msg);
+
+out:    spin_unlock_irqrestore(&cm_id_priv->lock, flags);
+        return ret;
+}
+EXPORT_SYMBOL(ib_send_cm_rep);
+
+static void cm_format_rtu(struct cm_rtu_msg *rtu_msg,
+                          struct cm_id_private *cm_id_priv,
+                          const void *private_data,
+                          u8 private_data_len)
+{
+        cm_format_mad_hdr(&rtu_msg->hdr, CM_RTU_ATTR_ID, cm_id_priv->tid);
+        rtu_msg->local_comm_id = cm_id_priv->id.local_id;
+        rtu_msg->remote_comm_id = cm_id_priv->id.remote_id;
+
+        if (private_data && private_data_len)
+                memcpy(rtu_msg->private_data, private_data, private_data_len);
+}
+
+int ib_send_cm_rtu(struct ib_cm_id *cm_id,
+                   const void *private_data,
+                   u8 private_data_len)
+{
+        struct cm_id_private *cm_id_priv;
+        struct ib_mad_send_buf *msg;
+        struct ib_send_wr *bad_send_wr;
+        unsigned long flags;
+        void *data;
+        int ret;
+
+        if (private_data && private_data_len > IB_CM_RTU_PRIVATE_DATA_SIZE)
+                return -EINVAL;
+
+        data = cm_copy_private_data(private_data, private_data_len);
+        if (IS_ERR(data))
+                return PTR_ERR(data);
+
+        cm_id_priv = container_of(cm_id, struct cm_id_private, id);
+        spin_lock_irqsave(&cm_id_priv->lock, flags);
+        if (cm_id->state != IB_CM_REP_RCVD &&
+            cm_id->state != IB_CM_MRA_REP_SENT) {
+                ret = -EINVAL;
+                goto error;
+        }
+
+        ret = cm_alloc_msg(cm_id_priv, &msg);
+        if (ret)
+                goto error;
+
+        cm_format_rtu((struct cm_rtu_msg *) msg->mad, cm_id_priv,
+                      private_data, private_data_len);
+
+        ret = ib_post_send_mad(cm_id_priv->av.port->mad_agent,
+                               &msg->send_wr, &bad_send_wr);
+        if (ret) {
+                spin_unlock_irqrestore(&cm_id_priv->lock, flags);
+                cm_free_msg(msg);
+                kfree(data);
+                return ret;
+        }
+
+        cm_id->state = IB_CM_ESTABLISHED;
+        cm_set_private_data(cm_id_priv, data, private_data_len);
+        spin_unlock_irqrestore(&cm_id_priv->lock, flags);
+        return 0;
+
+error:  spin_unlock_irqrestore(&cm_id_priv->lock, flags);
+        kfree(data);
+        return ret;
+}
+EXPORT_SYMBOL(ib_send_cm_rtu);
+
+static void cm_format_rep_event(struct cm_work *work)
+{
+        struct cm_rep_msg *rep_msg;
+        struct ib_cm_rep_event_param *param;
+
+        rep_msg = (struct cm_rep_msg *)work->mad_recv_wc->recv_buf.mad;
+        param = &work->cm_event.param.rep_rcvd;
+        param->remote_ca_guid = rep_msg->local_ca_guid;
+        param->remote_qkey = be32_to_cpu(rep_msg->local_qkey);
+        param->remote_qpn = be32_to_cpu(cm_rep_get_local_qpn(rep_msg));
+        param->starting_psn = be32_to_cpu(cm_rep_get_starting_psn(rep_msg));
+        param->responder_resources = rep_msg->initiator_depth;
+        param->initiator_depth = rep_msg->resp_resources;
+        param->target_ack_delay = cm_rep_get_target_ack_delay(rep_msg);
+        param->failover_accepted = cm_rep_get_failover(rep_msg);
+        param->flow_control = cm_rep_get_flow_ctrl(rep_msg);
+        param->rnr_retry_count = cm_rep_get_rnr_retry_count(rep_msg);
+        param->srq = cm_rep_get_srq(rep_msg);
+        work->cm_event.private_data = &rep_msg->private_data;
+}
+
+static void cm_dup_rep_handler(struct cm_work *work)
+{
+        struct cm_id_private *cm_id_priv;
+        struct cm_rep_msg *rep_msg;
+        struct ib_mad_send_buf *msg = NULL;
+        struct ib_send_wr *bad_send_wr;
+        unsigned long flags;
+        int ret;
+
+        rep_msg = (struct cm_rep_msg *) work->mad_recv_wc->recv_buf.mad;
+        cm_id_priv = cm_acquire_id(rep_msg->remote_comm_id,
+                                   rep_msg->local_comm_id);
+        if (!cm_id_priv)
+                return;
+
+        ret = cm_alloc_response_msg(work->port, work->mad_recv_wc, &msg);
+        if (ret)
+                goto deref;
+
+        spin_lock_irqsave(&cm_id_priv->lock, flags);
+        if (cm_id_priv->id.state == IB_CM_ESTABLISHED)
+                cm_format_rtu((struct cm_rtu_msg *) msg->mad, cm_id_priv,
+                              cm_id_priv->private_data,
+                              cm_id_priv->private_data_len);
+        else if (cm_id_priv->id.state == IB_CM_MRA_REP_SENT)
+                cm_format_mra((struct cm_mra_msg *) msg->mad, cm_id_priv,
+                              CM_MSG_RESPONSE_REP, cm_id_priv->service_timeout,
+                              cm_id_priv->private_data,
+                              cm_id_priv->private_data_len);
+        else
+                goto unlock;
+        spin_unlock_irqrestore(&cm_id_priv->lock, flags);
+
+        ret = ib_post_send_mad(cm_id_priv->av.port->mad_agent, &msg->send_wr,
+                               &bad_send_wr);
+        if (ret)
+                goto free;
+        goto deref;
+
+unlock: spin_unlock_irqrestore(&cm_id_priv->lock, flags);
+free:   cm_free_msg(msg);
+deref:  cm_deref_id(cm_id_priv);
+}
+
+static int cm_rep_handler(struct cm_work *work)
+{
+        struct cm_id_private *cm_id_priv;
+        struct cm_rep_msg *rep_msg;
+        unsigned long flags;
+        int ret;
+
+        rep_msg = (struct cm_rep_msg *)work->mad_recv_wc->recv_buf.mad;
+        cm_id_priv = cm_acquire_id(rep_msg->remote_comm_id, 0);
+        if (!cm_id_priv) {
+                cm_dup_rep_handler(work);
+                return -EINVAL;
+        }
+
+        cm_id_priv->timewait_info->work.remote_id = rep_msg->local_comm_id;
+        cm_id_priv->timewait_info->remote_ca_guid = rep_msg->local_ca_guid;
+        cm_id_priv->timewait_info->remote_qpn = cm_rep_get_local_qpn(rep_msg);
+
+        spin_lock_irqsave(&cm.lock, flags);
+        /* Check for duplicate REP. */
+        if (cm_insert_remote_id(cm_id_priv->timewait_info)) {
+                spin_unlock_irqrestore(&cm.lock, flags);
+                ret = -EINVAL;
+                goto error;
+        }
+        /* Check for a stale connection. */
+        if (cm_insert_remote_qpn(cm_id_priv->timewait_info)) {
+                spin_unlock_irqrestore(&cm.lock, flags);
+                cm_issue_rej(work->port, work->mad_recv_wc,
+                             IB_CM_REJ_STALE_CONN, CM_MSG_RESPONSE_REP,
+                             NULL, 0);
+                ret = -EINVAL;
+                goto error;
+        }
+        spin_unlock_irqrestore(&cm.lock, flags);
+
+        cm_format_rep_event(work);
+
+        spin_lock_irqsave(&cm_id_priv->lock, flags);
+        switch (cm_id_priv->id.state) {
+        case IB_CM_REQ_SENT:
+        case IB_CM_MRA_REQ_RCVD:
+                break;
+        default:
+                spin_unlock_irqrestore(&cm_id_priv->lock, flags);
+                ret = -EINVAL;
+                goto error;
+        }
+        cm_id_priv->id.state = IB_CM_REP_RCVD;
+        cm_id_priv->id.remote_id = rep_msg->local_comm_id;
+        cm_id_priv->remote_qpn = cm_rep_get_local_qpn(rep_msg);
+        cm_id_priv->initiator_depth = rep_msg->resp_resources;
+        cm_id_priv->responder_resources = rep_msg->initiator_depth;
+        cm_id_priv->sq_psn = cm_rep_get_starting_psn(rep_msg);
+        cm_id_priv->rnr_retry_count = cm_rep_get_rnr_retry_count(rep_msg);
+
+        /* todo: handle peer_to_peer */
+
+        ib_cancel_mad(cm_id_priv->av.port->mad_agent,
+                      (unsigned long) cm_id_priv->msg);
+        ret = atomic_inc_and_test(&cm_id_priv->work_count);
+        if (!ret)
+                list_add_tail(&work->list, &cm_id_priv->work_list);
+        spin_unlock_irqrestore(&cm_id_priv->lock, flags);
+
+        if (ret)
+                cm_process_work(cm_id_priv, work);
+        else
+                cm_deref_id(cm_id_priv);
+        return 0;
+
+error:  cm_cleanup_timewait(cm_id_priv->timewait_info);
+        cm_deref_id(cm_id_priv);
+        return ret;
+}
+
+static int cm_establish_handler(struct cm_work *work)
+{
+        struct cm_id_private *cm_id_priv;
+        unsigned long flags;
+        int ret;
+
+        /* See comment in ib_cm_establish about lookup. */
+        cm_id_priv = cm_acquire_id(work->local_id, work->remote_id);
+        if (!cm_id_priv)
+                return -EINVAL;
+
+        spin_lock_irqsave(&cm_id_priv->lock, flags);
+        if (cm_id_priv->id.state != IB_CM_ESTABLISHED) {
+                spin_unlock_irqrestore(&cm_id_priv->lock, flags);
+                goto out;
+        }
+
+        ib_cancel_mad(cm_id_priv->av.port->mad_agent,
+                      (unsigned long) cm_id_priv->msg);
+        ret = atomic_inc_and_test(&cm_id_priv->work_count);
+        if (!ret)
+                list_add_tail(&work->list, &cm_id_priv->work_list);
+        spin_unlock_irqrestore(&cm_id_priv->lock, flags);
+
+        if (ret)
+                cm_process_work(cm_id_priv, work);
+        else
+                cm_deref_id(cm_id_priv);
+        return 0;
+out:
+        cm_deref_id(cm_id_priv);
+        return -EINVAL;
+}
+
+static int cm_rtu_handler(struct cm_work *work)
+{
+        struct cm_id_private *cm_id_priv;
+        struct cm_rtu_msg *rtu_msg;
+        unsigned long flags;
+        int ret;
+
+        rtu_msg = (struct cm_rtu_msg *)work->mad_recv_wc->recv_buf.mad;
+        cm_id_priv = cm_acquire_id(rtu_msg->remote_comm_id,
+                                   rtu_msg->local_comm_id);
+        if (!cm_id_priv)
+                return -EINVAL;
+
+        work->cm_event.private_data = &rtu_msg->private_data;
+
+        spin_lock_irqsave(&cm_id_priv->lock, flags);
+        if (cm_id_priv->id.state != IB_CM_REP_SENT &&
+            cm_id_priv->id.state != IB_CM_MRA_REP_RCVD) {
+                spin_unlock_irqrestore(&cm_id_priv->lock, flags);
+                goto out;
+        }
+        cm_id_priv->id.state = IB_CM_ESTABLISHED;
+
+        ib_cancel_mad(cm_id_priv->av.port->mad_agent,
+                      (unsigned long) cm_id_priv->msg);
+        ret = atomic_inc_and_test(&cm_id_priv->work_count);
+        if (!ret)
+                list_add_tail(&work->list, &cm_id_priv->work_list);
+        spin_unlock_irqrestore(&cm_id_priv->lock, flags);
+
+        if (ret)
+                cm_process_work(cm_id_priv, work);
+        else
+                cm_deref_id(cm_id_priv);
+        return 0;
+out:
+        cm_deref_id(cm_id_priv);
+        return -EINVAL;
+}
+
+static void cm_format_dreq(struct cm_dreq_msg *dreq_msg,
+                          struct cm_id_private *cm_id_priv,
+                          const void *private_data,
+                          u8 private_data_len)
+{
+        cm_format_mad_hdr(&dreq_msg->hdr, CM_DREQ_ATTR_ID,
+                          cm_form_tid(cm_id_priv, CM_MSG_SEQUENCE_DREQ));
+        dreq_msg->local_comm_id = cm_id_priv->id.local_id;
+        dreq_msg->remote_comm_id = cm_id_priv->id.remote_id;
+        cm_dreq_set_remote_qpn(dreq_msg, cm_id_priv->remote_qpn);
+
+        if (private_data && private_data_len)
+                memcpy(dreq_msg->private_data, private_data, private_data_len);
+}
+
+int ib_send_cm_dreq(struct ib_cm_id *cm_id,
+                    const void *private_data,
+                    u8 private_data_len)
+{
+        struct cm_id_private *cm_id_priv;
+        struct ib_mad_send_buf *msg;
+        struct ib_send_wr *bad_send_wr;
+        unsigned long flags;
+        int ret;
+
+        if (private_data && private_data_len > IB_CM_DREQ_PRIVATE_DATA_SIZE)
+                return -EINVAL;
+
+        cm_id_priv = container_of(cm_id, struct cm_id_private, id);
+        spin_lock_irqsave(&cm_id_priv->lock, flags);
+        if (cm_id->state != IB_CM_ESTABLISHED) {
+                ret = -EINVAL;
+                goto out;
+        }
+
+        ret = cm_alloc_msg(cm_id_priv, &msg);
+        if (ret) {
+                cm_enter_timewait(cm_id_priv);
+                goto out;
+        }
+
+        cm_format_dreq((struct cm_dreq_msg *) msg->mad, cm_id_priv,
+                       private_data, private_data_len);
+        msg->send_wr.wr.ud.timeout_ms = cm_id_priv->timeout_ms;
+        msg->context[1] = (void *) (unsigned long) IB_CM_DREQ_SENT;
+
+        ret = ib_post_send_mad(cm_id_priv->av.port->mad_agent,
+                               &msg->send_wr, &bad_send_wr);
+        if (ret) {
+                cm_enter_timewait(cm_id_priv);
+                spin_unlock_irqrestore(&cm_id_priv->lock, flags);
+                cm_free_msg(msg);
+                return ret;
+        }
+
+        cm_id->state = IB_CM_DREQ_SENT;
+        cm_id_priv->msg = msg;
+out:    spin_unlock_irqrestore(&cm_id_priv->lock, flags);
+        return ret;
+}
+EXPORT_SYMBOL(ib_send_cm_dreq);
+
+static void cm_format_drep(struct cm_drep_msg *drep_msg,
+                          struct cm_id_private *cm_id_priv,
+                          const void *private_data,
+                          u8 private_data_len)
+{
+        cm_format_mad_hdr(&drep_msg->hdr, CM_DREP_ATTR_ID, cm_id_priv->tid);
+        drep_msg->local_comm_id = cm_id_priv->id.local_id;
+        drep_msg->remote_comm_id = cm_id_priv->id.remote_id;
+
+        if (private_data && private_data_len)
+                memcpy(drep_msg->private_data, private_data, private_data_len);
+}
+
+int ib_send_cm_drep(struct ib_cm_id *cm_id,
+                    const void *private_data,
+                    u8 private_data_len)
+{
+        struct cm_id_private *cm_id_priv;
+        struct ib_mad_send_buf *msg;
+        struct ib_send_wr *bad_send_wr;
+        unsigned long flags;
+        void *data;
+        int ret;
+
+        if (private_data && private_data_len > IB_CM_DREP_PRIVATE_DATA_SIZE)
+                return -EINVAL;
+
+        data = cm_copy_private_data(private_data, private_data_len);
+        if (IS_ERR(data))
+                return PTR_ERR(data);
+
+        cm_id_priv = container_of(cm_id, struct cm_id_private, id);
+        spin_lock_irqsave(&cm_id_priv->lock, flags);
+        if (cm_id->state != IB_CM_DREQ_RCVD) {
+                spin_unlock_irqrestore(&cm_id_priv->lock, flags);
+                kfree(data);
+                return -EINVAL;
+        }
+
+        cm_set_private_data(cm_id_priv, data, private_data_len);
+        cm_enter_timewait(cm_id_priv);
+
+        ret = cm_alloc_msg(cm_id_priv, &msg);
+        if (ret)
+                goto out;
+
+        cm_format_drep((struct cm_drep_msg *) msg->mad, cm_id_priv,
+                       private_data, private_data_len);
+
+        ret = ib_post_send_mad(cm_id_priv->av.port->mad_agent, &msg->send_wr,
+                               &bad_send_wr);
+        if (ret) {
+                spin_unlock_irqrestore(&cm_id_priv->lock, flags);
+                cm_free_msg(msg);
+                return ret;
+        }
+
+out:    spin_unlock_irqrestore(&cm_id_priv->lock, flags);
+        return ret;
+}
+EXPORT_SYMBOL(ib_send_cm_drep);
+
+static int cm_dreq_handler(struct cm_work *work)
+{
+        struct cm_id_private *cm_id_priv;
+        struct cm_dreq_msg *dreq_msg;
+        struct ib_mad_send_buf *msg = NULL;
+        struct ib_send_wr *bad_send_wr;
+        unsigned long flags;
+        int ret;
+
+        dreq_msg = (struct cm_dreq_msg *)work->mad_recv_wc->recv_buf.mad;
+        cm_id_priv = cm_acquire_id(dreq_msg->remote_comm_id,
+                                   dreq_msg->local_comm_id);
+        if (!cm_id_priv)
+                return -EINVAL;
+
+        work->cm_event.private_data = &dreq_msg->private_data;
+
+        spin_lock_irqsave(&cm_id_priv->lock, flags);
+        if (cm_id_priv->local_qpn != cm_dreq_get_remote_qpn(dreq_msg))
+                goto unlock;
+
+        switch (cm_id_priv->id.state) {
+        case IB_CM_REP_SENT:
+        case IB_CM_DREQ_SENT:
+                ib_cancel_mad(cm_id_priv->av.port->mad_agent,
+                              (unsigned long) cm_id_priv->msg);
+                break;
+        case IB_CM_ESTABLISHED:
+        case IB_CM_MRA_REP_RCVD:
+                break;
+        case IB_CM_TIMEWAIT:
+                if (cm_alloc_response_msg(work->port, work->mad_recv_wc, &msg))
+                        goto unlock;
+
+                cm_format_drep((struct cm_drep_msg *) msg->mad, cm_id_priv,
+                               cm_id_priv->private_data,
+                               cm_id_priv->private_data_len);
+                spin_unlock_irqrestore(&cm_id_priv->lock, flags);
+
+                if (ib_post_send_mad(cm_id_priv->av.port->mad_agent,
+                                     &msg->send_wr, &bad_send_wr))
+                        cm_free_msg(msg);
+                goto deref;
+        default:
+                goto unlock;
+        }
+        cm_id_priv->id.state = IB_CM_DREQ_RCVD;
+        cm_id_priv->tid = dreq_msg->hdr.tid;
+        ret = atomic_inc_and_test(&cm_id_priv->work_count);
+        if (!ret)
+                list_add_tail(&work->list, &cm_id_priv->work_list);
+        spin_unlock_irqrestore(&cm_id_priv->lock, flags);
+
+        if (ret)
+                cm_process_work(cm_id_priv, work);
+        else
+                cm_deref_id(cm_id_priv);
+        return 0;
+
+unlock: spin_unlock_irqrestore(&cm_id_priv->lock, flags);
+deref:  cm_deref_id(cm_id_priv);
+        return -EINVAL;
+}
+
+static int cm_drep_handler(struct cm_work *work)
+{
+        struct cm_id_private *cm_id_priv;
+        struct cm_drep_msg *drep_msg;
+        unsigned long flags;
+        int ret;
+
+        drep_msg = (struct cm_drep_msg *)work->mad_recv_wc->recv_buf.mad;
+        cm_id_priv = cm_acquire_id(drep_msg->remote_comm_id,
+                                   drep_msg->local_comm_id);
+        if (!cm_id_priv)
+                return -EINVAL;
+
+        work->cm_event.private_data = &drep_msg->private_data;
+
+        spin_lock_irqsave(&cm_id_priv->lock, flags);
+        if (cm_id_priv->id.state != IB_CM_DREQ_SENT &&
+            cm_id_priv->id.state != IB_CM_DREQ_RCVD) {
+                spin_unlock_irqrestore(&cm_id_priv->lock, flags);
+                goto out;
+        }
+        cm_enter_timewait(cm_id_priv);
+
+        ib_cancel_mad(cm_id_priv->av.port->mad_agent,
+                      (unsigned long) cm_id_priv->msg);
+        ret = atomic_inc_and_test(&cm_id_priv->work_count);
+        if (!ret)
+                list_add_tail(&work->list, &cm_id_priv->work_list);
+        spin_unlock_irqrestore(&cm_id_priv->lock, flags);
+
+        if (ret)
+                cm_process_work(cm_id_priv, work);
+        else
+                cm_deref_id(cm_id_priv);
+        return 0;
+out:
+        cm_deref_id(cm_id_priv);
+        return -EINVAL;
+}
+
+int ib_send_cm_rej(struct ib_cm_id *cm_id,
+                   enum ib_cm_rej_reason reason,
+                   void *ari,
+                   u8 ari_length,
+                   const void *private_data,
+                   u8 private_data_len)
+{
+        struct cm_id_private *cm_id_priv;
+        struct ib_mad_send_buf *msg;
+        struct ib_send_wr *bad_send_wr;
+        unsigned long flags;
+        int ret;
+
+        if ((private_data && private_data_len > IB_CM_REJ_PRIVATE_DATA_SIZE) ||
+            (ari && ari_length > IB_CM_REJ_ARI_LENGTH))
+                return -EINVAL;
+
+        cm_id_priv = container_of(cm_id, struct cm_id_private, id);
+
+        spin_lock_irqsave(&cm_id_priv->lock, flags);
+        switch (cm_id->state) {
+        case IB_CM_REQ_SENT:
+        case IB_CM_MRA_REQ_RCVD:
+        case IB_CM_REQ_RCVD:
+        case IB_CM_MRA_REQ_SENT:
+        case IB_CM_REP_RCVD:
+        case IB_CM_MRA_REP_SENT:
+                ret = cm_alloc_msg(cm_id_priv, &msg);
+                if (!ret)
+                        cm_format_rej((struct cm_rej_msg *) msg->mad,
+                                      cm_id_priv, reason, ari, ari_length,
+                                      private_data, private_data_len);
+
+                cm_reset_to_idle(cm_id_priv);
+                break;
+        case IB_CM_REP_SENT:
+        case IB_CM_MRA_REP_RCVD:
+                ret = cm_alloc_msg(cm_id_priv, &msg);
+                if (!ret)
+                        cm_format_rej((struct cm_rej_msg *) msg->mad,
+                                      cm_id_priv, reason, ari, ari_length,
+                                      private_data, private_data_len);
+
+                cm_enter_timewait(cm_id_priv);
+                break;
+        default:
+                ret = -EINVAL;
+                goto out;
+        }
+
+        if (ret)
+                goto out;
+
+        ret = ib_post_send_mad(cm_id_priv->av.port->mad_agent,
+                               &msg->send_wr, &bad_send_wr);
+        if (ret)
+                cm_free_msg(msg);
+
+out:    spin_unlock_irqrestore(&cm_id_priv->lock, flags);
+        return ret;
+}
+EXPORT_SYMBOL(ib_send_cm_rej);
+
+static void cm_format_rej_event(struct cm_work *work)
+{
+        struct cm_rej_msg *rej_msg;
+        struct ib_cm_rej_event_param *param;
+
+        rej_msg = (struct cm_rej_msg *)work->mad_recv_wc->recv_buf.mad;
+        param = &work->cm_event.param.rej_rcvd;
+        param->ari = rej_msg->ari;
+        param->ari_length = cm_rej_get_reject_info_len(rej_msg);
+        param->reason = rej_msg->reason;
+        work->cm_event.private_data = &rej_msg->private_data;
+}
+
+static struct cm_id_private * cm_acquire_rejected_id(struct cm_rej_msg *rej_msg)
+{
+        struct cm_timewait_info *timewait_info;
+        struct cm_id_private *cm_id_priv;
+        unsigned long flags;
+        u32 remote_id;
+
+        remote_id = rej_msg->local_comm_id;
+
+        if (rej_msg->reason == IB_CM_REJ_TIMEOUT) {
+                spin_lock_irqsave(&cm.lock, flags);
+                timewait_info = cm_find_remote_id( *((u64 *) rej_msg->ari),
+                                                  remote_id);
+                if (!timewait_info) {
+                        spin_unlock_irqrestore(&cm.lock, flags);
+                        return NULL;
+                }
+                cm_id_priv = idr_find(&cm.local_id_table,
+                                      (int) timewait_info->work.local_id);
+                if (cm_id_priv) {
+                        if (cm_id_priv->id.remote_id == remote_id)
+                                atomic_inc(&cm_id_priv->refcount);
+                        else
+                                cm_id_priv = NULL;
+                }
+                spin_unlock_irqrestore(&cm.lock, flags);
+        } else if (cm_rej_get_msg_rejected(rej_msg) == CM_MSG_RESPONSE_REQ)
+                cm_id_priv = cm_acquire_id(rej_msg->remote_comm_id, 0);
+        else
+                cm_id_priv = cm_acquire_id(rej_msg->remote_comm_id, remote_id);
+
+        return cm_id_priv;
+}
+
+static int cm_rej_handler(struct cm_work *work)
+{
+        struct cm_id_private *cm_id_priv;
+        struct cm_rej_msg *rej_msg;
+        unsigned long flags;
+        int ret;
+
+        rej_msg = (struct cm_rej_msg *)work->mad_recv_wc->recv_buf.mad;
+        cm_id_priv = cm_acquire_rejected_id(rej_msg);
+        if (!cm_id_priv)
+                return -EINVAL;
+
+        cm_format_rej_event(work);
+
+        spin_lock_irqsave(&cm_id_priv->lock, flags);
+        switch (cm_id_priv->id.state) {
+        case IB_CM_REQ_SENT:
+        case IB_CM_MRA_REQ_RCVD:
+        case IB_CM_REP_SENT:
+        case IB_CM_MRA_REP_RCVD:
+                ib_cancel_mad(cm_id_priv->av.port->mad_agent,
+                              (unsigned long) cm_id_priv->msg);
+                /* fall through */
+        case IB_CM_REQ_RCVD:
+        case IB_CM_MRA_REQ_SENT:
+                if (rej_msg->reason == IB_CM_REJ_STALE_CONN)
+                        cm_enter_timewait(cm_id_priv);
+                else
+                        cm_reset_to_idle(cm_id_priv);
+                break;
+        case IB_CM_DREQ_SENT:
+                ib_cancel_mad(cm_id_priv->av.port->mad_agent,
+                              (unsigned long) cm_id_priv->msg);
+                /* fall through */
+        case IB_CM_REP_RCVD:
+        case IB_CM_MRA_REP_SENT:
+        case IB_CM_ESTABLISHED:
+                cm_enter_timewait(cm_id_priv);
+                break;
+        default:
+                spin_unlock_irqrestore(&cm_id_priv->lock, flags);
+                ret = -EINVAL;
+                goto out;
+        }
+
+        ret = atomic_inc_and_test(&cm_id_priv->work_count);
+        if (!ret)
+                list_add_tail(&work->list, &cm_id_priv->work_list);
+        spin_unlock_irqrestore(&cm_id_priv->lock, flags);
+
+        if (ret)
+                cm_process_work(cm_id_priv, work);
+        else
+                cm_deref_id(cm_id_priv);
+        return 0;
+out:
+        cm_deref_id(cm_id_priv);
+        return -EINVAL;
+}
+
+int ib_send_cm_mra(struct ib_cm_id *cm_id,
+                   u8 service_timeout,
+                   const void *private_data,
+                   u8 private_data_len)
+{
+        struct cm_id_private *cm_id_priv;
+        struct ib_mad_send_buf *msg;
+        struct ib_send_wr *bad_send_wr;
+        void *data;
+        unsigned long flags;
+        int ret;
+
+        if (private_data && private_data_len > IB_CM_MRA_PRIVATE_DATA_SIZE)
+                return -EINVAL;
+
+        data = cm_copy_private_data(private_data, private_data_len);
+        if (IS_ERR(data))
+                return PTR_ERR(data);
+
+        cm_id_priv = container_of(cm_id, struct cm_id_private, id);
+
+        spin_lock_irqsave(&cm_id_priv->lock, flags);
+        switch(cm_id_priv->id.state) {
+        case IB_CM_REQ_RCVD:
+                ret = cm_alloc_msg(cm_id_priv, &msg);
+                if (ret)
+                        goto error1;
+
+                cm_format_mra((struct cm_mra_msg *) msg->mad, cm_id_priv,
+                              CM_MSG_RESPONSE_REQ, service_timeout,
+                              private_data, private_data_len);
+                ret = ib_post_send_mad(cm_id_priv->av.port->mad_agent,
+                                       &msg->send_wr, &bad_send_wr);
+                if (ret)
+                        goto error2;
+                cm_id->state = IB_CM_MRA_REQ_SENT;
+                break;
+        case IB_CM_REP_RCVD:
+                ret = cm_alloc_msg(cm_id_priv, &msg);
+                if (ret)
+                        goto error1;
+
+                cm_format_mra((struct cm_mra_msg *) msg->mad, cm_id_priv,
+                              CM_MSG_RESPONSE_REP, service_timeout,
+                              private_data, private_data_len);
+                ret = ib_post_send_mad(cm_id_priv->av.port->mad_agent,
+                                       &msg->send_wr, &bad_send_wr);
+                if (ret)
+                        goto error2;
+                cm_id->state = IB_CM_MRA_REP_SENT;
+                break;
+        case IB_CM_ESTABLISHED:
+                ret = cm_alloc_msg(cm_id_priv, &msg);
+                if (ret)
+                        goto error1;
+
+                cm_format_mra((struct cm_mra_msg *) msg->mad, cm_id_priv,
+                              CM_MSG_RESPONSE_OTHER, service_timeout,
+                              private_data, private_data_len);
+                ret = ib_post_send_mad(cm_id_priv->av.port->mad_agent,
+                                       &msg->send_wr, &bad_send_wr);
+                if (ret)
+                        goto error2;
+                cm_id->lap_state = IB_CM_MRA_LAP_SENT;
+                break;
+        default:
+                ret = -EINVAL;
+                goto error1;
+        }
+        cm_id_priv->service_timeout = service_timeout;
+        cm_set_private_data(cm_id_priv, data, private_data_len);
+        spin_unlock_irqrestore(&cm_id_priv->lock, flags);
+        return 0;
+
+error1: spin_unlock_irqrestore(&cm_id_priv->lock, flags);
+        kfree(data);
+        return ret;
+
+error2: spin_unlock_irqrestore(&cm_id_priv->lock, flags);
+        kfree(data);
+        cm_free_msg(msg);
+        return ret;
+}
+EXPORT_SYMBOL(ib_send_cm_mra);
+
+static struct cm_id_private * cm_acquire_mraed_id(struct cm_mra_msg *mra_msg)
+{
+        switch (cm_mra_get_msg_mraed(mra_msg)) {
+        case CM_MSG_RESPONSE_REQ:
+                return cm_acquire_id(mra_msg->remote_comm_id, 0);
+        case CM_MSG_RESPONSE_REP:
+        case CM_MSG_RESPONSE_OTHER:
+                return cm_acquire_id(mra_msg->remote_comm_id,
+                                     mra_msg->local_comm_id);
+        default:
+                return NULL;
+        }
+}
+
+static int cm_mra_handler(struct cm_work *work)
+{
+        struct cm_id_private *cm_id_priv;
+        struct cm_mra_msg *mra_msg;
+        unsigned long flags;
+        int timeout, ret;
+
+        mra_msg = (struct cm_mra_msg *)work->mad_recv_wc->recv_buf.mad;
+        cm_id_priv = cm_acquire_mraed_id(mra_msg);
+        if (!cm_id_priv)
+                return -EINVAL;
+
+        work->cm_event.private_data = &mra_msg->private_data;
+        work->cm_event.param.mra_rcvd.service_timeout =
+                                        cm_mra_get_service_timeout(mra_msg);
+        timeout = cm_convert_to_ms(cm_mra_get_service_timeout(mra_msg)) +
+                  cm_convert_to_ms(cm_id_priv->av.packet_life_time);
+
+        spin_lock_irqsave(&cm_id_priv->lock, flags);
+        switch (cm_id_priv->id.state) {
+        case IB_CM_REQ_SENT:
+                if (cm_mra_get_msg_mraed(mra_msg) != CM_MSG_RESPONSE_REQ ||
+                    ib_modify_mad(cm_id_priv->av.port->mad_agent,
+                                  (unsigned long) cm_id_priv->msg, timeout))
+                        goto out;
+                cm_id_priv->id.state = IB_CM_MRA_REQ_RCVD;
+                break;
+        case IB_CM_REP_SENT:
+                if (cm_mra_get_msg_mraed(mra_msg) != CM_MSG_RESPONSE_REP ||
+                    ib_modify_mad(cm_id_priv->av.port->mad_agent,
+                                  (unsigned long) cm_id_priv->msg, timeout))
+                        goto out;
+                cm_id_priv->id.state = IB_CM_MRA_REP_RCVD;
+                break;
+        case IB_CM_ESTABLISHED:
+                if (cm_mra_get_msg_mraed(mra_msg) != CM_MSG_RESPONSE_OTHER ||
+                    cm_id_priv->id.lap_state != IB_CM_LAP_SENT ||
+                    ib_modify_mad(cm_id_priv->av.port->mad_agent,
+                                  (unsigned long) cm_id_priv->msg, timeout))
+                        goto out;
+                cm_id_priv->id.lap_state = IB_CM_MRA_LAP_RCVD;
+                break;
+        default:
+                goto out;
+        }
+
+        cm_id_priv->msg->context[1] = (void *) (unsigned long)
+                                      cm_id_priv->id.state;
+        ret = atomic_inc_and_test(&cm_id_priv->work_count);
+        if (!ret)
+                list_add_tail(&work->list, &cm_id_priv->work_list);
+        spin_unlock_irqrestore(&cm_id_priv->lock, flags);
+
+        if (ret)
+                cm_process_work(cm_id_priv, work);
+        else
+                cm_deref_id(cm_id_priv);
+        return 0;
+out:
+        spin_unlock_irqrestore(&cm_id_priv->lock, flags);
+        cm_deref_id(cm_id_priv);
+        return -EINVAL;
+}
+
+static void cm_format_lap(struct cm_lap_msg *lap_msg,
+                          struct cm_id_private *cm_id_priv,
+                          struct ib_sa_path_rec *alternate_path,
+                          const void *private_data,
+                          u8 private_data_len)
+{
+        cm_format_mad_hdr(&lap_msg->hdr, CM_LAP_ATTR_ID,
+                          cm_form_tid(cm_id_priv, CM_MSG_SEQUENCE_LAP));
+        lap_msg->local_comm_id = cm_id_priv->id.local_id;
+        lap_msg->remote_comm_id = cm_id_priv->id.remote_id;
+        cm_lap_set_remote_qpn(lap_msg, cm_id_priv->remote_qpn);
+        /* todo: need remote CM response timeout */
+        cm_lap_set_remote_resp_timeout(lap_msg, 0x1F);
+        lap_msg->alt_local_lid = alternate_path->slid;
+        lap_msg->alt_remote_lid = alternate_path->dlid;
+        lap_msg->alt_local_gid = alternate_path->sgid;
+        lap_msg->alt_remote_gid = alternate_path->dgid;
+        cm_lap_set_flow_label(lap_msg, alternate_path->flow_label);
+        cm_lap_set_traffic_class(lap_msg, alternate_path->traffic_class);
+        lap_msg->alt_hop_limit = alternate_path->hop_limit;
+        cm_lap_set_packet_rate(lap_msg, alternate_path->rate);
+        cm_lap_set_sl(lap_msg, alternate_path->sl);
+        cm_lap_set_subnet_local(lap_msg, 1); /* local only... */
+        cm_lap_set_local_ack_timeout(lap_msg,
+                min(31, alternate_path->packet_life_time + 1));
+
+        if (private_data && private_data_len)
+                memcpy(lap_msg->private_data, private_data, private_data_len);
+}
+
+int ib_send_cm_lap(struct ib_cm_id *cm_id,
+                   struct ib_sa_path_rec *alternate_path,
+                   const void *private_data,
+                   u8 private_data_len)
+{
+        struct cm_id_private *cm_id_priv;
+        struct ib_mad_send_buf *msg;
+        struct ib_send_wr *bad_send_wr;
+        unsigned long flags;
+        int ret;
+
+        if (private_data && private_data_len > IB_CM_LAP_PRIVATE_DATA_SIZE)
+                return -EINVAL;
+
+        cm_id_priv = container_of(cm_id, struct cm_id_private, id);
+        spin_lock_irqsave(&cm_id_priv->lock, flags);
+        if (cm_id->state != IB_CM_ESTABLISHED ||
+            cm_id->lap_state != IB_CM_LAP_IDLE) {
+                ret = -EINVAL;
+                goto out;
+        }
+
+        ret = cm_alloc_msg(cm_id_priv, &msg);
+        if (ret)
+                goto out;
+
+        cm_format_lap((struct cm_lap_msg *) msg->mad, cm_id_priv,
+                      alternate_path, private_data, private_data_len);
+        msg->send_wr.wr.ud.timeout_ms = cm_id_priv->timeout_ms;
+        msg->context[1] = (void *) (unsigned long) IB_CM_ESTABLISHED;
+
+        ret = ib_post_send_mad(cm_id_priv->av.port->mad_agent,
+                               &msg->send_wr, &bad_send_wr);
+        if (ret) {
+                spin_unlock_irqrestore(&cm_id_priv->lock, flags);
+                cm_free_msg(msg);
+                return ret;
+        }
+
+        cm_id->lap_state = IB_CM_LAP_SENT;
+        cm_id_priv->msg = msg;
+
+out:    spin_unlock_irqrestore(&cm_id_priv->lock, flags);
+        return ret;
+}
+EXPORT_SYMBOL(ib_send_cm_lap);
+
+static void cm_format_path_from_lap(struct ib_sa_path_rec *path,
+                                    struct cm_lap_msg *lap_msg)
+{
+        memset(path, 0, sizeof *path);
+        path->dgid = lap_msg->alt_local_gid;
+        path->sgid = lap_msg->alt_remote_gid;
+        path->dlid = lap_msg->alt_local_lid;
+        path->slid = lap_msg->alt_remote_lid;
+        path->flow_label = cm_lap_get_flow_label(lap_msg);
+        path->hop_limit = lap_msg->alt_hop_limit;
+        path->traffic_class = cm_lap_get_traffic_class(lap_msg);
+        path->reversible = 1;
+        /* pkey is same as in REQ */
+        path->sl = cm_lap_get_sl(lap_msg);
+        path->mtu_selector = IB_SA_EQ;
+        /* mtu is same as in REQ */
+        path->rate_selector = IB_SA_EQ;
+        path->rate = cm_lap_get_packet_rate(lap_msg);
+        path->packet_life_time_selector = IB_SA_EQ;
+        path->packet_life_time = cm_lap_get_local_ack_timeout(lap_msg);
+        path->packet_life_time -= (path->packet_life_time > 0);
+}
+
+static int cm_lap_handler(struct cm_work *work)
+{
+        struct cm_id_private *cm_id_priv;
+        struct cm_lap_msg *lap_msg;
+        struct ib_cm_lap_event_param *param;
+        struct ib_mad_send_buf *msg = NULL;
+        struct ib_send_wr *bad_send_wr;
+        unsigned long flags;
+        int ret;
+
+        /* todo: verify LAP request and send reject APR if invalid. */
+        lap_msg = (struct cm_lap_msg *)work->mad_recv_wc->recv_buf.mad;
+        cm_id_priv = cm_acquire_id(lap_msg->remote_comm_id,
+                                   lap_msg->local_comm_id);
+        if (!cm_id_priv)
+                return -EINVAL;
+
+        param = &work->cm_event.param.lap_rcvd;
+        param->alternate_path = &work->path[0];
+        cm_format_path_from_lap(param->alternate_path, lap_msg);
+        work->cm_event.private_data = &lap_msg->private_data;
+
+        spin_lock_irqsave(&cm_id_priv->lock, flags);
+        if (cm_id_priv->id.state != IB_CM_ESTABLISHED)
+                goto unlock;
+
+        switch (cm_id_priv->id.lap_state) {
+        case IB_CM_LAP_IDLE:
+                break;
+        case IB_CM_MRA_LAP_SENT:
+                if (cm_alloc_response_msg(work->port, work->mad_recv_wc, &msg))
+                        goto unlock;
+
+                cm_format_mra((struct cm_mra_msg *) msg->mad, cm_id_priv,
+                              CM_MSG_RESPONSE_OTHER,
+                              cm_id_priv->service_timeout,
+                              cm_id_priv->private_data,
+                              cm_id_priv->private_data_len);
+                spin_unlock_irqrestore(&cm_id_priv->lock, flags);
+
+                if (ib_post_send_mad(cm_id_priv->av.port->mad_agent,
+                                     &msg->send_wr, &bad_send_wr))
+                        cm_free_msg(msg);
+                goto deref;
+        default:
+                goto unlock;
+        }
+
+        cm_id_priv->id.lap_state = IB_CM_LAP_RCVD;
+        cm_id_priv->tid = lap_msg->hdr.tid;
+        ret = atomic_inc_and_test(&cm_id_priv->work_count);
+        if (!ret)
+                list_add_tail(&work->list, &cm_id_priv->work_list);
+        spin_unlock_irqrestore(&cm_id_priv->lock, flags);
+
+        if (ret)
+                cm_process_work(cm_id_priv, work);
+        else
+                cm_deref_id(cm_id_priv);
+        return 0;
+
+unlock: spin_unlock_irqrestore(&cm_id_priv->lock, flags);
+deref:  cm_deref_id(cm_id_priv);
+        return -EINVAL;
+}
+
+static void cm_format_apr(struct cm_apr_msg *apr_msg,
+                          struct cm_id_private *cm_id_priv,
+                          enum ib_cm_apr_status status,
+                          void *info,
+                          u8 info_length,
+                          const void *private_data,
+                          u8 private_data_len)
+{
+        cm_format_mad_hdr(&apr_msg->hdr, CM_APR_ATTR_ID, cm_id_priv->tid);
+        apr_msg->local_comm_id = cm_id_priv->id.local_id;
+        apr_msg->remote_comm_id = cm_id_priv->id.remote_id;
+        apr_msg->ap_status = (u8) status;
+
+        if (info && info_length) {
+                apr_msg->info_length = info_length;
+                memcpy(apr_msg->info, info, info_length);
+        }
+
+        if (private_data && private_data_len)
+                memcpy(apr_msg->private_data, private_data, private_data_len);
+}
+
+int ib_send_cm_apr(struct ib_cm_id *cm_id,
+                   enum ib_cm_apr_status status,
+                   void *info,
+                   u8 info_length,
+                   const void *private_data,
+                   u8 private_data_len)
+{
+        struct cm_id_private *cm_id_priv;
+        struct ib_mad_send_buf *msg;
+        struct ib_send_wr *bad_send_wr;
+        unsigned long flags;
+        int ret;
+
+        if ((private_data && private_data_len > IB_CM_APR_PRIVATE_DATA_SIZE) ||
+            (info && info_length > IB_CM_APR_INFO_LENGTH))
+                return -EINVAL;
+
+        cm_id_priv = container_of(cm_id, struct cm_id_private, id);
+        spin_lock_irqsave(&cm_id_priv->lock, flags);
+        if (cm_id->state != IB_CM_ESTABLISHED ||
+            (cm_id->lap_state != IB_CM_LAP_RCVD &&
+             cm_id->lap_state != IB_CM_MRA_LAP_SENT)) {
+                ret = -EINVAL;
+                goto out;
+        }
+
+        ret = cm_alloc_msg(cm_id_priv, &msg);
+        if (ret)
+                goto out;
+
+        cm_format_apr((struct cm_apr_msg *) msg->mad, cm_id_priv, status,
+                      info, info_length, private_data, private_data_len);
+        ret = ib_post_send_mad(cm_id_priv->av.port->mad_agent,
+                               &msg->send_wr, &bad_send_wr);
+        if (ret) {
+                spin_unlock_irqrestore(&cm_id_priv->lock, flags);
+                cm_free_msg(msg);
+                return ret;
+        }
+
+        cm_id->lap_state = IB_CM_LAP_IDLE;
+out:    spin_unlock_irqrestore(&cm_id_priv->lock, flags);
+        return ret;
+}
+EXPORT_SYMBOL(ib_send_cm_apr);
+
+static int cm_apr_handler(struct cm_work *work)
+{
+        struct cm_id_private *cm_id_priv;
+        struct cm_apr_msg *apr_msg;
+        unsigned long flags;
+        int ret;
+
+        apr_msg = (struct cm_apr_msg *)work->mad_recv_wc->recv_buf.mad;
+        cm_id_priv = cm_acquire_id(apr_msg->remote_comm_id,
+                                   apr_msg->local_comm_id);
+        if (!cm_id_priv)
+                return -EINVAL; /* Unmatched reply. */
+
+        work->cm_event.param.apr_rcvd.ap_status = apr_msg->ap_status;
+        work->cm_event.param.apr_rcvd.apr_info = &apr_msg->info;
+        work->cm_event.param.apr_rcvd.info_len = apr_msg->info_length;
+        work->cm_event.private_data = &apr_msg->private_data;
+
+        spin_lock_irqsave(&cm_id_priv->lock, flags);
+        if (cm_id_priv->id.state != IB_CM_ESTABLISHED ||
+            (cm_id_priv->id.lap_state != IB_CM_LAP_SENT &&
+             cm_id_priv->id.lap_state != IB_CM_MRA_LAP_RCVD)) {
+                spin_unlock_irqrestore(&cm_id_priv->lock, flags);
+                goto out;
+        }
+        cm_id_priv->id.lap_state = IB_CM_LAP_IDLE;
+        ib_cancel_mad(cm_id_priv->av.port->mad_agent,
+                      (unsigned long) cm_id_priv->msg);
+        cm_id_priv->msg = NULL;
+
+        ret = atomic_inc_and_test(&cm_id_priv->work_count);
+        if (!ret)
+                list_add_tail(&work->list, &cm_id_priv->work_list);
+        spin_unlock_irqrestore(&cm_id_priv->lock, flags);
+
+        if (ret)
+                cm_process_work(cm_id_priv, work);
+        else
+                cm_deref_id(cm_id_priv);
+        return 0;
+out:
+        cm_deref_id(cm_id_priv);
+        return -EINVAL;
+}
+
+static int cm_timewait_handler(struct cm_work *work)
+{
+        struct cm_timewait_info *timewait_info;
+        struct cm_id_private *cm_id_priv;
+        unsigned long flags;
+        int ret;
+
+        timewait_info = (struct cm_timewait_info *)work;
+        cm_cleanup_timewait(timewait_info);
+
+        cm_id_priv = cm_acquire_id(timewait_info->work.local_id,
+                                   timewait_info->work.remote_id);
+        if (!cm_id_priv)
+                return -EINVAL;
+
+        spin_lock_irqsave(&cm_id_priv->lock, flags);
+        if (cm_id_priv->id.state != IB_CM_TIMEWAIT ||
+            cm_id_priv->remote_qpn != timewait_info->remote_qpn) {
+                spin_unlock_irqrestore(&cm_id_priv->lock, flags);
+                goto out;
+        }
+        cm_id_priv->id.state = IB_CM_IDLE;
+        ret = atomic_inc_and_test(&cm_id_priv->work_count);
+        if (!ret)
+                list_add_tail(&work->list, &cm_id_priv->work_list);
+        spin_unlock_irqrestore(&cm_id_priv->lock, flags);
+
+        if (ret)
+                cm_process_work(cm_id_priv, work);
+        else
+                cm_deref_id(cm_id_priv);
+        return 0;
+out:
+        cm_deref_id(cm_id_priv);
+        return -EINVAL;
+}
+
+static void cm_format_sidr_req(struct cm_sidr_req_msg *sidr_req_msg,
+                               struct cm_id_private *cm_id_priv,
+                               struct ib_cm_sidr_req_param *param)
+{
+        cm_format_mad_hdr(&sidr_req_msg->hdr, CM_SIDR_REQ_ATTR_ID,
+                          cm_form_tid(cm_id_priv, CM_MSG_SEQUENCE_SIDR));
+        sidr_req_msg->request_id = cm_id_priv->id.local_id;
+        sidr_req_msg->pkey = param->pkey;
+        sidr_req_msg->service_id = param->service_id;
+
+        if (param->private_data && param->private_data_len)
+                memcpy(sidr_req_msg->private_data, param->private_data,
+                       param->private_data_len);
+}
+
+int ib_send_cm_sidr_req(struct ib_cm_id *cm_id,
+                        struct ib_cm_sidr_req_param *param)
+{
+        struct cm_id_private *cm_id_priv;
+        struct ib_mad_send_buf *msg;
+        struct ib_send_wr *bad_send_wr;
+        unsigned long flags;
+        int ret;
+
+        if (!param->path || (param->private_data &&
+             param->private_data_len > IB_CM_SIDR_REQ_PRIVATE_DATA_SIZE))
+                return -EINVAL;
+
+        cm_id_priv = container_of(cm_id, struct cm_id_private, id);
+        ret = cm_init_av_by_path(param->path, &cm_id_priv->av);
+        if (ret)
+                goto out;
+
+        cm_id->service_id = param->service_id;
+        cm_id->service_mask = ~0ULL;
+        cm_id_priv->timeout_ms = param->timeout_ms;
+        cm_id_priv->max_cm_retries = param->max_cm_retries;
+        ret = cm_alloc_msg(cm_id_priv, &msg);
+        if (ret)
+                goto out;
+
+        cm_format_sidr_req((struct cm_sidr_req_msg *) msg->mad, cm_id_priv,
+                           param);
+        msg->send_wr.wr.ud.timeout_ms = cm_id_priv->timeout_ms;
+        msg->context[1] = (void *) (unsigned long) IB_CM_SIDR_REQ_SENT;
+
+        spin_lock_irqsave(&cm_id_priv->lock, flags);
+        if (cm_id->state == IB_CM_IDLE)
+                ret = ib_post_send_mad(cm_id_priv->av.port->mad_agent,
+                                       &msg->send_wr, &bad_send_wr);
+        else
+                ret = -EINVAL;
+
+        if (ret) {
+                spin_unlock_irqrestore(&cm_id_priv->lock, flags);
+                cm_free_msg(msg);
+                goto out;
+        }
+        cm_id->state = IB_CM_SIDR_REQ_SENT;
+        cm_id_priv->msg = msg;
+        spin_unlock_irqrestore(&cm_id_priv->lock, flags);
+out:
+        return ret;
+}
+EXPORT_SYMBOL(ib_send_cm_sidr_req);
+
+static void cm_format_sidr_req_event(struct cm_work *work,
+                                     struct ib_cm_id *listen_id)
+{
+        struct cm_sidr_req_msg *sidr_req_msg;
+        struct ib_cm_sidr_req_event_param *param;
+
+        sidr_req_msg = (struct cm_sidr_req_msg *)
+                                work->mad_recv_wc->recv_buf.mad;
+        param = &work->cm_event.param.sidr_req_rcvd;
+        param->pkey = sidr_req_msg->pkey;
+        param->listen_id = listen_id;
+        param->device = work->port->mad_agent->device;
+        param->port = work->port->port_num;
+        work->cm_event.private_data = &sidr_req_msg->private_data;
+}
+
+static int cm_sidr_req_handler(struct cm_work *work)
+{
+        struct ib_cm_id *cm_id;
+        struct cm_id_private *cm_id_priv, *cur_cm_id_priv;
+        struct cm_sidr_req_msg *sidr_req_msg;
+        struct ib_wc *wc;
+        unsigned long flags;
+
+        cm_id = ib_create_cm_id(NULL, NULL);
+        if (IS_ERR(cm_id))
+                return PTR_ERR(cm_id);
+        cm_id_priv = container_of(cm_id, struct cm_id_private, id);
+
+        /* Record SGID/SLID and request ID for lookup. */
+        sidr_req_msg = (struct cm_sidr_req_msg *)
+                                work->mad_recv_wc->recv_buf.mad;
+        wc = work->mad_recv_wc->wc;
+        cm_id_priv->av.dgid.global.subnet_prefix = wc->slid;
+        cm_id_priv->av.dgid.global.interface_id = 0;
+        cm_init_av_for_response(work->port, work->mad_recv_wc->wc,
+                                &cm_id_priv->av);
+        cm_id_priv->id.remote_id = sidr_req_msg->request_id;
+        cm_id_priv->id.state = IB_CM_SIDR_REQ_RCVD;
+        cm_id_priv->tid = sidr_req_msg->hdr.tid;
+        atomic_inc(&cm_id_priv->work_count);
+
+        spin_lock_irqsave(&cm.lock, flags);
+        cur_cm_id_priv = cm_insert_remote_sidr(cm_id_priv);
+        if (cur_cm_id_priv) {
+                spin_unlock_irqrestore(&cm.lock, flags);
+                goto out; /* Duplicate message. */
+        }
+        cur_cm_id_priv = cm_find_listen(sidr_req_msg->service_id);
+        if (!cur_cm_id_priv) {
+                rb_erase(&cm_id_priv->sidr_id_node, &cm.remote_sidr_table);
+                spin_unlock_irqrestore(&cm.lock, flags);
+                /* todo: reply with no match */
+                goto out; /* No match. */
+        }
+        atomic_inc(&cur_cm_id_priv->refcount);
+        spin_unlock_irqrestore(&cm.lock, flags);
+
+        cm_id_priv->id.cm_handler = cur_cm_id_priv->id.cm_handler;
+        cm_id_priv->id.context = cur_cm_id_priv->id.context;
+        cm_id_priv->id.service_id = sidr_req_msg->service_id;
+        cm_id_priv->id.service_mask = ~0ULL;
+
+        cm_format_sidr_req_event(work, &cur_cm_id_priv->id);
+        cm_process_work(cm_id_priv, work);
+        cm_deref_id(cur_cm_id_priv);
+        return 0;
+out:
+        ib_destroy_cm_id(&cm_id_priv->id);
+        return -EINVAL;
+}
+
+static void cm_format_sidr_rep(struct cm_sidr_rep_msg *sidr_rep_msg,
+                               struct cm_id_private *cm_id_priv,
+                               struct ib_cm_sidr_rep_param *param)
+{
+        cm_format_mad_hdr(&sidr_rep_msg->hdr, CM_SIDR_REP_ATTR_ID,
+                          cm_id_priv->tid);
+        sidr_rep_msg->request_id = cm_id_priv->id.remote_id;
+        sidr_rep_msg->status = param->status;
+        cm_sidr_rep_set_qpn(sidr_rep_msg, cpu_to_be32(param->qp_num));
+        sidr_rep_msg->service_id = cm_id_priv->id.service_id;
+        sidr_rep_msg->qkey = cpu_to_be32(param->qkey);
+
+        if (param->info && param->info_length)
+                memcpy(sidr_rep_msg->info, param->info, param->info_length);
+
+        if (param->private_data && param->private_data_len)
+                memcpy(sidr_rep_msg->private_data, param->private_data,
+                       param->private_data_len);
+}
+
+int ib_send_cm_sidr_rep(struct ib_cm_id *cm_id,
+                        struct ib_cm_sidr_rep_param *param)
+{
+        struct cm_id_private *cm_id_priv;
+        struct ib_mad_send_buf *msg;
+        struct ib_send_wr *bad_send_wr;
+        unsigned long flags;
+        int ret;
+
+        if ((param->info && param->info_length > IB_CM_SIDR_REP_INFO_LENGTH) ||
+            (param->private_data &&
+             param->private_data_len > IB_CM_SIDR_REP_PRIVATE_DATA_SIZE))
+                return -EINVAL;
+
+        cm_id_priv = container_of(cm_id, struct cm_id_private, id);
+        spin_lock_irqsave(&cm_id_priv->lock, flags);
+        if (cm_id->state != IB_CM_SIDR_REQ_RCVD) {
+                ret = -EINVAL;
+                goto error;
+        }
+
+        ret = cm_alloc_msg(cm_id_priv, &msg);
+        if (ret)
+                goto error;
+
+        cm_format_sidr_rep((struct cm_sidr_rep_msg *) msg->mad, cm_id_priv,
+                           param);
+        ret = ib_post_send_mad(cm_id_priv->av.port->mad_agent,
+                               &msg->send_wr, &bad_send_wr);
+        if (ret) {
+                spin_unlock_irqrestore(&cm_id_priv->lock, flags);
+                cm_free_msg(msg);
+                return ret;
+        }
+        cm_id->state = IB_CM_IDLE;
+        spin_unlock_irqrestore(&cm_id_priv->lock, flags);
+
+        spin_lock_irqsave(&cm.lock, flags);
+        rb_erase(&cm_id_priv->sidr_id_node, &cm.remote_sidr_table);
+        spin_unlock_irqrestore(&cm.lock, flags);
+        return 0;
+
+error:  spin_unlock_irqrestore(&cm_id_priv->lock, flags);
+        return ret;
+}
+EXPORT_SYMBOL(ib_send_cm_sidr_rep);
+
+static void cm_format_sidr_rep_event(struct cm_work *work)
+{
+        struct cm_sidr_rep_msg *sidr_rep_msg;
+        struct ib_cm_sidr_rep_event_param *param;
+
+        sidr_rep_msg = (struct cm_sidr_rep_msg *)
+                                work->mad_recv_wc->recv_buf.mad;
+        param = &work->cm_event.param.sidr_rep_rcvd;
+        param->status = sidr_rep_msg->status;
+        param->qkey = be32_to_cpu(sidr_rep_msg->qkey);
+        param->qpn = be32_to_cpu(cm_sidr_rep_get_qpn(sidr_rep_msg));
+        param->info = &sidr_rep_msg->info;
+        param->info_len = sidr_rep_msg->info_length;
+        work->cm_event.private_data = &sidr_rep_msg->private_data;
+}
+
+static int cm_sidr_rep_handler(struct cm_work *work)
+{
+        struct cm_sidr_rep_msg *sidr_rep_msg;
+        struct cm_id_private *cm_id_priv;
+        unsigned long flags;
+
+        sidr_rep_msg = (struct cm_sidr_rep_msg *)
+                                work->mad_recv_wc->recv_buf.mad;
+        cm_id_priv = cm_acquire_id(sidr_rep_msg->request_id, 0);
+        if (!cm_id_priv)
+                return -EINVAL; /* Unmatched reply. */
+
+        spin_lock_irqsave(&cm_id_priv->lock, flags);
+        if (cm_id_priv->id.state != IB_CM_SIDR_REQ_SENT) {
+                spin_unlock_irqrestore(&cm_id_priv->lock, flags);
+                goto out;
+        }
+        cm_id_priv->id.state = IB_CM_IDLE;
+        ib_cancel_mad(cm_id_priv->av.port->mad_agent,
+                      (unsigned long) cm_id_priv->msg);
+        spin_unlock_irqrestore(&cm_id_priv->lock, flags);
+
+        cm_format_sidr_rep_event(work);
+        cm_process_work(cm_id_priv, work);
+        return 0;
+out:
+        cm_deref_id(cm_id_priv);
+        return -EINVAL;
+}
+
+static void cm_process_send_error(struct ib_mad_send_buf *msg,
+                                  enum ib_wc_status wc_status)
+{
+        struct cm_id_private *cm_id_priv;
+        struct ib_cm_event cm_event;
+        enum ib_cm_state state;
+        unsigned long flags;
+        int ret;
+
+        memset(&cm_event, 0, sizeof cm_event);
+        cm_id_priv = msg->context[0];
+
+        /* Discard old sends or ones without a response. */
+        spin_lock_irqsave(&cm_id_priv->lock, flags);
+        state = (enum ib_cm_state) (unsigned long) msg->context[1];
+        if (msg != cm_id_priv->msg || state != cm_id_priv->id.state)
+                goto discard;
+
+        switch (state) {
+        case IB_CM_REQ_SENT:
+        case IB_CM_MRA_REQ_RCVD:
+                cm_reset_to_idle(cm_id_priv);
+                cm_event.event = IB_CM_REQ_ERROR;
+                break;
+        case IB_CM_REP_SENT:
+        case IB_CM_MRA_REP_RCVD:
+                cm_reset_to_idle(cm_id_priv);
+                cm_event.event = IB_CM_REP_ERROR;
+                break;
+        case IB_CM_DREQ_SENT:
+                cm_enter_timewait(cm_id_priv);
+                cm_event.event = IB_CM_DREQ_ERROR;
+                break;
+        case IB_CM_SIDR_REQ_SENT:
+                cm_id_priv->id.state = IB_CM_IDLE;
+                cm_event.event = IB_CM_SIDR_REQ_ERROR;
+                break;
+        default:
+                goto discard;
+        }
+        spin_unlock_irqrestore(&cm_id_priv->lock, flags);
+        cm_event.param.send_status = wc_status;
+
+        /* No other events can occur on the cm_id at this point. */
+        ret = cm_id_priv->id.cm_handler(&cm_id_priv->id, &cm_event);
+        cm_free_msg(msg);
+        if (ret)
+                ib_destroy_cm_id(&cm_id_priv->id);
+        return;
+discard:
+        spin_unlock_irqrestore(&cm_id_priv->lock, flags);
+        cm_free_msg(msg);
+}
+
+static void cm_send_handler(struct ib_mad_agent *mad_agent,
+                            struct ib_mad_send_wc *mad_send_wc)
+{
+        struct ib_mad_send_buf *msg;
+
+        msg = (struct ib_mad_send_buf *)(unsigned long)mad_send_wc->wr_id;
+
+        switch (mad_send_wc->status) {
+        case IB_WC_SUCCESS:
+        case IB_WC_WR_FLUSH_ERR:
+                cm_free_msg(msg);
+                break;
+        default:
+                if (msg->context[0] && msg->context[1])
+                        cm_process_send_error(msg, mad_send_wc->status);
+                else
+                        cm_free_msg(msg);
+                break;
+        }
+}
+
+static void cm_work_handler(void *data)
+{
+        struct cm_work *work = data;
+        int ret;
+
+        switch (work->cm_event.event) {
+        case IB_CM_REQ_RECEIVED:
+                ret = cm_req_handler(work);
+                break;
+        case IB_CM_MRA_RECEIVED:
+                ret = cm_mra_handler(work);
+                break;
+        case IB_CM_REJ_RECEIVED:
+                ret = cm_rej_handler(work);
+                break;
+        case IB_CM_REP_RECEIVED:
+                ret = cm_rep_handler(work);
+                break;
+        case IB_CM_RTU_RECEIVED:
+                ret = cm_rtu_handler(work);
+                break;
+        case IB_CM_USER_ESTABLISHED:
+                ret = cm_establish_handler(work);
+                break;
+        case IB_CM_DREQ_RECEIVED:
+                ret = cm_dreq_handler(work);
+                break;
+        case IB_CM_DREP_RECEIVED:
+                ret = cm_drep_handler(work);
+                break;
+        case IB_CM_SIDR_REQ_RECEIVED:
+                ret = cm_sidr_req_handler(work);
+                break;
+        case IB_CM_SIDR_REP_RECEIVED:
+                ret = cm_sidr_rep_handler(work);
+                break;
+        case IB_CM_LAP_RECEIVED:
+                ret = cm_lap_handler(work);
+                break;
+        case IB_CM_APR_RECEIVED:
+                ret = cm_apr_handler(work);
+                break;
+        case IB_CM_TIMEWAIT_EXIT:
+                ret = cm_timewait_handler(work);
+                break;
+        default:
+                ret = -EINVAL;
+                break;
+        }
+        if (ret)
+                cm_free_work(work);
+}
+
+int ib_cm_establish(struct ib_cm_id *cm_id)
+{
+        struct cm_id_private *cm_id_priv;
+        struct cm_work *work;
+        unsigned long flags;
+        int ret = 0;
+
+        work = kmalloc(sizeof *work, GFP_ATOMIC);
+        if (!work)
+                return -ENOMEM;
+
+        cm_id_priv = container_of(cm_id, struct cm_id_private, id);
+        spin_lock_irqsave(&cm_id_priv->lock, flags);
+        switch (cm_id->state)
+        {
+        case IB_CM_REP_SENT:
+        case IB_CM_MRA_REP_RCVD:
+                cm_id->state = IB_CM_ESTABLISHED;
+                break;
+        case IB_CM_ESTABLISHED:
+                ret = -EISCONN;
+                break;
+        default:
+                ret = -EINVAL;
+                break;
+        }
+        spin_unlock_irqrestore(&cm_id_priv->lock, flags);
+
+        if (ret) {
+                kfree(work);
+                goto out;
+        }
+
+        /*
+         * The CM worker thread may try to destroy the cm_id before it
+         * can execute this work item.  To prevent potential deadlock,
+         * we need to find the cm_id once we're in the context of the
+         * worker thread, rather than holding a reference on it.
+         */
+        INIT_WORK(&work->work, cm_work_handler, work);
+        work->local_id = cm_id->local_id;
+        work->remote_id = cm_id->remote_id;
+        work->mad_recv_wc = NULL;
+        work->cm_event.event = IB_CM_USER_ESTABLISHED;
+        queue_work(cm.wq, &work->work);
+out:
+        return ret;
+}
+EXPORT_SYMBOL(ib_cm_establish);
+
+static void cm_recv_handler(struct ib_mad_agent *mad_agent,
+                            struct ib_mad_recv_wc *mad_recv_wc)
+{
+        struct cm_work *work;
+        enum ib_cm_event_type event;
+        int paths = 0;
+
+        switch (mad_recv_wc->recv_buf.mad->mad_hdr.attr_id) {
+        case CM_REQ_ATTR_ID:
+                paths = 1 + (((struct cm_req_msg *) mad_recv_wc->recv_buf.mad)->
+                                                    alt_local_lid != 0);
+                event = IB_CM_REQ_RECEIVED;
+                break;
+        case CM_MRA_ATTR_ID:
+                event = IB_CM_MRA_RECEIVED;
+                break;
+        case CM_REJ_ATTR_ID:
+                event = IB_CM_REJ_RECEIVED;
+                break;
+        case CM_REP_ATTR_ID:
+                event = IB_CM_REP_RECEIVED;
+                break;
+        case CM_RTU_ATTR_ID:
+                event = IB_CM_RTU_RECEIVED;
+                break;
+        case CM_DREQ_ATTR_ID:
+                event = IB_CM_DREQ_RECEIVED;
+                break;
+        case CM_DREP_ATTR_ID:
+                event = IB_CM_DREP_RECEIVED;
+                break;
+        case CM_SIDR_REQ_ATTR_ID:
+                event = IB_CM_SIDR_REQ_RECEIVED;
+                break;
+        case CM_SIDR_REP_ATTR_ID:
+                event = IB_CM_SIDR_REP_RECEIVED;
+                break;
+        case CM_LAP_ATTR_ID:
+                paths = 1;
+                event = IB_CM_LAP_RECEIVED;
+                break;
+        case CM_APR_ATTR_ID:
+                event = IB_CM_APR_RECEIVED;
+                break;
+        default:
+                ib_free_recv_mad(mad_recv_wc);
+                return;
+        }
+
+        work = kmalloc(sizeof *work + sizeof(struct ib_sa_path_rec) * paths,
+                       GFP_KERNEL);
+        if (!work) {
+                ib_free_recv_mad(mad_recv_wc);
+                return;
+        }
+
+        INIT_WORK(&work->work, cm_work_handler, work);
+        work->cm_event.event = event;
+        work->mad_recv_wc = mad_recv_wc;
+        work->port = (struct cm_port *)mad_agent->context;
+        queue_work(cm.wq, &work->work);
+}
+
+static int cm_init_qp_init_attr(struct cm_id_private *cm_id_priv,
+                                struct ib_qp_attr *qp_attr,
+                                int *qp_attr_mask)
+{
+        unsigned long flags;
+        int ret;
+
+        spin_lock_irqsave(&cm_id_priv->lock, flags);
+        switch (cm_id_priv->id.state) {
+        case IB_CM_REQ_SENT:
+        case IB_CM_MRA_REQ_RCVD:
+        case IB_CM_REQ_RCVD:
+        case IB_CM_MRA_REQ_SENT:
+        case IB_CM_REP_RCVD:
+        case IB_CM_MRA_REP_SENT:
+        case IB_CM_REP_SENT:
+        case IB_CM_MRA_REP_RCVD:
+        case IB_CM_ESTABLISHED:
+                *qp_attr_mask = IB_QP_STATE | IB_QP_ACCESS_FLAGS |
+                                IB_QP_PKEY_INDEX | IB_QP_PORT;
+                qp_attr->qp_access_flags = IB_ACCESS_LOCAL_WRITE;
+                if (cm_id_priv->responder_resources)
+                        qp_attr->qp_access_flags |= IB_ACCESS_REMOTE_WRITE |
+                                                    IB_ACCESS_REMOTE_READ;
+                qp_attr->pkey_index = cm_id_priv->av.pkey_index;
+                qp_attr->port_num = cm_id_priv->av.port->port_num;
+                ret = 0;
+                break;
+        default:
+                ret = -EINVAL;
+                break;
+        }
+        spin_unlock_irqrestore(&cm_id_priv->lock, flags);
+        return ret;
+}
+
+static int cm_init_qp_rtr_attr(struct cm_id_private *cm_id_priv,
+                               struct ib_qp_attr *qp_attr,
+                               int *qp_attr_mask)
+{
+        unsigned long flags;
+        int ret;
+
+        spin_lock_irqsave(&cm_id_priv->lock, flags);
+        switch (cm_id_priv->id.state) {
+        case IB_CM_REQ_RCVD:
+        case IB_CM_MRA_REQ_SENT:
+        case IB_CM_REP_RCVD:
+        case IB_CM_MRA_REP_SENT:
+        case IB_CM_REP_SENT:
+        case IB_CM_MRA_REP_RCVD:
+        case IB_CM_ESTABLISHED:
+                *qp_attr_mask = IB_QP_STATE | IB_QP_AV | IB_QP_PATH_MTU |
+                                IB_QP_DEST_QPN | IB_QP_RQ_PSN |
+                                IB_QP_MAX_DEST_RD_ATOMIC | IB_QP_MIN_RNR_TIMER;
+                qp_attr->ah_attr = cm_id_priv->av.ah_attr;
+                qp_attr->path_mtu = cm_id_priv->path_mtu;
+                qp_attr->dest_qp_num = be32_to_cpu(cm_id_priv->remote_qpn);
+                qp_attr->rq_psn = be32_to_cpu(cm_id_priv->rq_psn);
+                qp_attr->max_dest_rd_atomic = cm_id_priv->responder_resources;
+                qp_attr->min_rnr_timer = 0;
+                if (cm_id_priv->alt_av.ah_attr.dlid) {
+                        *qp_attr_mask |= IB_QP_ALT_PATH;
+                        qp_attr->alt_ah_attr = cm_id_priv->alt_av.ah_attr;
+                }
+                ret = 0;
+                break;
+        default:
+                ret = -EINVAL;
+                break;
+        }
+        spin_unlock_irqrestore(&cm_id_priv->lock, flags);
+        return ret;
+}
+
+static int cm_init_qp_rts_attr(struct cm_id_private *cm_id_priv,
+                               struct ib_qp_attr *qp_attr,
+                               int *qp_attr_mask)
+{
+        unsigned long flags;
+        int ret;
+
+        spin_lock_irqsave(&cm_id_priv->lock, flags);
+        switch (cm_id_priv->id.state) {
+        case IB_CM_REP_RCVD:
+        case IB_CM_MRA_REP_SENT:
+        case IB_CM_REP_SENT:
+        case IB_CM_MRA_REP_RCVD:
+        case IB_CM_ESTABLISHED:
+                *qp_attr_mask = IB_QP_STATE | IB_QP_TIMEOUT | IB_QP_RETRY_CNT |
+                                IB_QP_RNR_RETRY | IB_QP_SQ_PSN |
+                                IB_QP_MAX_QP_RD_ATOMIC;
+                qp_attr->timeout = cm_id_priv->local_ack_timeout;
+                qp_attr->retry_cnt = cm_id_priv->retry_count;
+                qp_attr->rnr_retry = cm_id_priv->rnr_retry_count;
+                qp_attr->sq_psn = be32_to_cpu(cm_id_priv->sq_psn);
+                qp_attr->max_rd_atomic = cm_id_priv->initiator_depth;
+                if (cm_id_priv->alt_av.ah_attr.dlid) {
+                        *qp_attr_mask |= IB_QP_PATH_MIG_STATE;
+                        qp_attr->path_mig_state = IB_MIG_REARM;
+                }
+                ret = 0;
+                break;
+        default:
+                ret = -EINVAL;
+                break;
+        }
+        spin_unlock_irqrestore(&cm_id_priv->lock, flags);
+        return ret;
+}
+
+int ib_cm_init_qp_attr(struct ib_cm_id *cm_id,
+                       struct ib_qp_attr *qp_attr,
+                       int *qp_attr_mask)
+{
+        struct cm_id_private *cm_id_priv;
+        int ret;
+
+        cm_id_priv = container_of(cm_id, struct cm_id_private, id);
+        switch (qp_attr->qp_state) {
+        case IB_QPS_INIT:
+                ret = cm_init_qp_init_attr(cm_id_priv, qp_attr, qp_attr_mask);
+                break;
+        case IB_QPS_RTR:
+                ret = cm_init_qp_rtr_attr(cm_id_priv, qp_attr, qp_attr_mask);
+                break;
+        case IB_QPS_RTS:
+                ret = cm_init_qp_rts_attr(cm_id_priv, qp_attr, qp_attr_mask);
+                break;
+        default:
+                ret = -EINVAL;
+                break;
+        }
+        return ret;
+}
+EXPORT_SYMBOL(ib_cm_init_qp_attr);
+
+static u64 cm_get_ca_guid(struct ib_device *device)
+{
+        struct ib_device_attr *device_attr;
+        u64 guid;
+        int ret;
+
+        device_attr = kmalloc(sizeof *device_attr, GFP_KERNEL);
+        if (!device_attr)
+                return 0;
+
+        ret = ib_query_device(device, device_attr);
+        guid = ret ? 0 : device_attr->node_guid;
+        kfree(device_attr);
+        return guid;
+}
+
+static void cm_add_one(struct ib_device *device)
+{
+        struct cm_device *cm_dev;
+        struct cm_port *port;
+        struct ib_mad_reg_req reg_req = {
+                .mgmt_class = IB_MGMT_CLASS_CM,
+                .mgmt_class_version = IB_CM_CLASS_VERSION
+        };
+        struct ib_port_modify port_modify = {
+                .set_port_cap_mask = IB_PORT_CM_SUP
+        };
+        unsigned long flags;
+        int ret;
+        u8 i;
+
+        cm_dev = kmalloc(sizeof(*cm_dev) + sizeof(*port) *
+                         device->phys_port_cnt, GFP_KERNEL);
+        if (!cm_dev)
+                return;
+
+        cm_dev->device = device;
+        cm_dev->ca_guid = cm_get_ca_guid(device);
+        if (!cm_dev->ca_guid)
+                goto error1;
+
+        set_bit(IB_MGMT_METHOD_SEND, reg_req.method_mask);
+        for (i = 1; i <= device->phys_port_cnt; i++) {
+                port = &cm_dev->port[i-1];
+                port->cm_dev = cm_dev;
+                port->port_num = i;
+                port->mad_agent = ib_register_mad_agent(device, i,
+                                                        IB_QPT_GSI,
+                                                        &reg_req,
+                                                        0,
+                                                        cm_send_handler,
+                                                        cm_recv_handler,
+                                                        port);
+                if (IS_ERR(port->mad_agent))
+                        goto error2;
+
+                ret = ib_modify_port(device, i, 0, &port_modify);
+                if (ret)
+                        goto error3;
+        }
+        ib_set_client_data(device, &cm_client, cm_dev);
+
+        write_lock_irqsave(&cm.device_lock, flags);
+        list_add_tail(&cm_dev->list, &cm.device_list);
+        write_unlock_irqrestore(&cm.device_lock, flags);
+        return;
+
+error3:
+        ib_unregister_mad_agent(port->mad_agent);
+error2:
+        port_modify.set_port_cap_mask = 0;
+        port_modify.clr_port_cap_mask = IB_PORT_CM_SUP;
+        while (--i) {
+                port = &cm_dev->port[i-1];
+                ib_modify_port(device, port->port_num, 0, &port_modify);
+                ib_unregister_mad_agent(port->mad_agent);
+        }
+error1:
+        kfree(cm_dev);
+}
+
+static void cm_remove_one(struct ib_device *device)
+{
+        struct cm_device *cm_dev;
+        struct cm_port *port;
+        struct ib_port_modify port_modify = {
+                .clr_port_cap_mask = IB_PORT_CM_SUP
+        };
+        unsigned long flags;
+        int i;
+
+        cm_dev = ib_get_client_data(device, &cm_client);
+        if (!cm_dev)
+                return;
+
+        write_lock_irqsave(&cm.device_lock, flags);
+        list_del(&cm_dev->list);
+        write_unlock_irqrestore(&cm.device_lock, flags);
+
+        for (i = 1; i <= device->phys_port_cnt; i++) {
+                port = &cm_dev->port[i-1];
+                ib_modify_port(device, port->port_num, 0, &port_modify);
+                ib_unregister_mad_agent(port->mad_agent);
+        }
+        kfree(cm_dev);
+}
+
+static int __init ib_cm_init(void)
+{
+        int ret;
+
+        memset(&cm, 0, sizeof cm);
+        INIT_LIST_HEAD(&cm.device_list);
+        rwlock_init(&cm.device_lock);
+        spin_lock_init(&cm.lock);
+        cm.listen_service_table = RB_ROOT;
+        cm.listen_service_id = __constant_be64_to_cpu(IB_CM_ASSIGN_SERVICE_ID);
+        cm.remote_id_table = RB_ROOT;
+        cm.remote_qp_table = RB_ROOT;
+        cm.remote_sidr_table = RB_ROOT;
+        idr_init(&cm.local_id_table);
+        idr_pre_get(&cm.local_id_table, GFP_KERNEL);
+
+        cm.wq = create_workqueue("ib_cm");
+        if (!cm.wq)
+                return -ENOMEM;
+
+        ret = ib_register_client(&cm_client);
+        if (ret)
+                goto error;
+
+        return 0;
+error:
+        destroy_workqueue(cm.wq);
+        return ret;
+}
+
+static void __exit ib_cm_cleanup(void)
+{
+        flush_workqueue(cm.wq);
+        destroy_workqueue(cm.wq);
+        ib_unregister_client(&cm_client);
+}
+
+module_init(ib_cm_init);
+module_exit(ib_cm_cleanup);
+
diff --git a/drivers/infiniband/core/cm_msgs.h b/drivers/infiniband/core/cm_msgs.h
new file mode 100644
index 000000000000..15a309a77b2b
--- /dev/null
+++ b/drivers/infiniband/core/cm_msgs.h
@@ -0,0 +1,819 @@
+/*
+ * Copyright (c) 2004 Intel Corporation.  All rights reserved.
+ * Copyright (c) 2004 Topspin Corporation.  All rights reserved.
+ * Copyright (c) 2004 Voltaire Corporation.  All rights reserved.
+ *
+ * This software is available to you under a choice of one of two
+ * licenses.  You may choose to be licensed under the terms of the GNU
+ * General Public License (GPL) Version 2, available from the file
+ * COPYING the madirectory of this source tree, or the
+ * OpenIB.org BSD license below:
+ *
+ *     Redistribution and use source and binary forms, with or
+ *     withmodification, are permitted provided that the following
+ *     conditions are met:
+ *
+ *      - Redistributions of source code must retathe above
+ *        copyright notice, this list of conditions and the following
+ *        disclaimer.
+ *
+ *      - Redistributions binary form must reproduce the above
+ *        copyright notice, this list of conditions and the following
+ *        disclaimer the documentation and/or other materials
+ *        provided with the distribution.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHWARRANTY OF ANY KIND,
+ * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+ * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+ * NONINFRINGEMENT. NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
+ * BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER AN
+ * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OF OR IN
+ * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS THE
+ * SOFTWARE.
+ */
+#if !defined(CM_MSGS_H)
+#define CM_MSGS_H
+
+#include <ib_mad.h>
+
+/*
+ * Parameters to routines below should be in network-byte order, and values
+ * are returned in network-byte order.
+ */
+
+#define IB_CM_CLASS_VERSION     2 /* IB specification 1.2 */
+
+enum cm_msg_attr_id {
+        CM_REQ_ATTR_ID      = __constant_htons(0x0010),
+        CM_MRA_ATTR_ID      = __constant_htons(0x0011),
+        CM_REJ_ATTR_ID      = __constant_htons(0x0012),
+        CM_REP_ATTR_ID      = __constant_htons(0x0013),
+        CM_RTU_ATTR_ID      = __constant_htons(0x0014),
+        CM_DREQ_ATTR_ID     = __constant_htons(0x0015),
+        CM_DREP_ATTR_ID     = __constant_htons(0x0016),
+        CM_SIDR_REQ_ATTR_ID = __constant_htons(0x0017),
+        CM_SIDR_REP_ATTR_ID = __constant_htons(0x0018),
+        CM_LAP_ATTR_ID      = __constant_htons(0x0019),
+        CM_APR_ATTR_ID      = __constant_htons(0x001A)
+};
+
+enum cm_msg_sequence {
+        CM_MSG_SEQUENCE_REQ,
+        CM_MSG_SEQUENCE_LAP,
+        CM_MSG_SEQUENCE_DREQ,
+        CM_MSG_SEQUENCE_SIDR
+};
+
+struct cm_req_msg {
+        struct ib_mad_hdr hdr;
+
+        u32 local_comm_id;
+        u32 rsvd4;
+        u64 service_id;
+        u64 local_ca_guid;
+        u32 rsvd24;
+        u32 local_qkey;
+        /* local QPN:24, responder resources:8 */
+        u32 offset32;
+        /* local EECN:24, initiator depth:8 */
+        u32 offset36;
+        /*
+         * remote EECN:24, remote CM response timeout:5,
+         * transport service type:2, end-to-end flow control:1
+         */
+        u32 offset40;
+        /* starting PSN:24, local CM response timeout:5, retry count:3 */
+        u32 offset44;
+        u16 pkey;
+        /* path MTU:4, RDC exists:1, RNR retry count:3. */
+        u8 offset50;
+        /* max CM Retries:4, SRQ:1, rsvd:3 */
+        u8 offset51;
+
+        u16 primary_local_lid;
+        u16 primary_remote_lid;
+        union ib_gid primary_local_gid;
+        union ib_gid primary_remote_gid;
+        /* flow label:20, rsvd:6, packet rate:6 */
+        u32 primary_offset88;
+        u8 primary_traffic_class;
+        u8 primary_hop_limit;
+        /* SL:4, subnet local:1, rsvd:3 */
+        u8 primary_offset94;
+        /* local ACK timeout:5, rsvd:3 */
+        u8 primary_offset95;
+
+        u16 alt_local_lid;
+        u16 alt_remote_lid;
+        union ib_gid alt_local_gid;
+        union ib_gid alt_remote_gid;
+        /* flow label:20, rsvd:6, packet rate:6 */
+        u32 alt_offset132;
+        u8 alt_traffic_class;
+        u8 alt_hop_limit;
+        /* SL:4, subnet local:1, rsvd:3 */
+        u8 alt_offset138;
+        /* local ACK timeout:5, rsvd:3 */
+        u8 alt_offset139;
+
+        u8 private_data[IB_CM_REQ_PRIVATE_DATA_SIZE];
+
+} __attribute__ ((packed));
+
+static inline u32 cm_req_get_local_qpn(struct cm_req_msg *req_msg)
+{
+        return cpu_to_be32(be32_to_cpu(req_msg->offset32) >> 8);
+}
+
+static inline void cm_req_set_local_qpn(struct cm_req_msg *req_msg, u32 qpn)
+{
+        req_msg->offset32 = cpu_to_be32((be32_to_cpu(qpn) << 8) |
+                                         (be32_to_cpu(req_msg->offset32) &
+                                          0x000000FF));
+}
+
+static inline u8 cm_req_get_resp_res(struct cm_req_msg *req_msg)
+{
+        return (u8) be32_to_cpu(req_msg->offset32);
+}
+
+static inline void cm_req_set_resp_res(struct cm_req_msg *req_msg, u8 resp_res)
+{
+        req_msg->offset32 = cpu_to_be32(resp_res |
+                                        (be32_to_cpu(req_msg->offset32) &
+                                         0xFFFFFF00));
+}
+
+static inline u8 cm_req_get_init_depth(struct cm_req_msg *req_msg)
+{
+        return (u8) be32_to_cpu(req_msg->offset36);
+}
+
+static inline void cm_req_set_init_depth(struct cm_req_msg *req_msg,
+                                         u8 init_depth)
+{
+        req_msg->offset36 = cpu_to_be32(init_depth |
+                                        (be32_to_cpu(req_msg->offset36) &
+                                         0xFFFFFF00));
+}
+
+static inline u8 cm_req_get_remote_resp_timeout(struct cm_req_msg *req_msg)
+{
+        return (u8) ((be32_to_cpu(req_msg->offset40) & 0xF8) >> 3);
+}
+
+static inline void cm_req_set_remote_resp_timeout(struct cm_req_msg *req_msg,
+                                                  u8 resp_timeout)
+{
+        req_msg->offset40 = cpu_to_be32((resp_timeout << 3) |
+                                         (be32_to_cpu(req_msg->offset40) &
+                                          0xFFFFFF07));
+}
+
+static inline enum ib_qp_type cm_req_get_qp_type(struct cm_req_msg *req_msg)
+{
+        u8 transport_type = (u8) (be32_to_cpu(req_msg->offset40) & 0x06) >> 1;
+        switch(transport_type) {
+        case 0: return IB_QPT_RC;
+        case 1: return IB_QPT_UC;
+        default: return 0;
+        }
+}
+
+static inline void cm_req_set_qp_type(struct cm_req_msg *req_msg,
+                                      enum ib_qp_type qp_type)
+{
+        switch(qp_type) {
+        case IB_QPT_UC:
+                req_msg->offset40 = cpu_to_be32((be32_to_cpu(
+                                                  req_msg->offset40) &
+                                                   0xFFFFFFF9) | 0x2);
+        default:
+                req_msg->offset40 = cpu_to_be32(be32_to_cpu(
+                                                 req_msg->offset40) &
+                                                  0xFFFFFFF9);
+        }
+}
+
+static inline u8 cm_req_get_flow_ctrl(struct cm_req_msg *req_msg)
+{
+        return be32_to_cpu(req_msg->offset40) & 0x1;
+}
+
+static inline void cm_req_set_flow_ctrl(struct cm_req_msg *req_msg,
+                                        u8 flow_ctrl)
+{
+        req_msg->offset40 = cpu_to_be32((flow_ctrl & 0x1) |
+                                         (be32_to_cpu(req_msg->offset40) &
+                                          0xFFFFFFFE));
+}
+
+static inline u32 cm_req_get_starting_psn(struct cm_req_msg *req_msg)
+{
+        return cpu_to_be32(be32_to_cpu(req_msg->offset44) >> 8);
+}
+
+static inline void cm_req_set_starting_psn(struct cm_req_msg *req_msg,
+                                           u32 starting_psn)
+{
+        req_msg->offset44 = cpu_to_be32((be32_to_cpu(starting_psn) << 8) |
+                            (be32_to_cpu(req_msg->offset44) & 0x000000FF));
+}
+
+static inline u8 cm_req_get_local_resp_timeout(struct cm_req_msg *req_msg)
+{
+        return (u8) ((be32_to_cpu(req_msg->offset44) & 0xF8) >> 3);
+}
+
+static inline void cm_req_set_local_resp_timeout(struct cm_req_msg *req_msg,
+                                                 u8 resp_timeout)
+{
+        req_msg->offset44 = cpu_to_be32((resp_timeout << 3) |
+                            (be32_to_cpu(req_msg->offset44) & 0xFFFFFF07));
+}
+
+static inline u8 cm_req_get_retry_count(struct cm_req_msg *req_msg)
+{
+        return (u8) (be32_to_cpu(req_msg->offset44) & 0x7);
+}
+
+static inline void cm_req_set_retry_count(struct cm_req_msg *req_msg,
+                                          u8 retry_count)
+{
+        req_msg->offset44 = cpu_to_be32((retry_count & 0x7) |
+                            (be32_to_cpu(req_msg->offset44) & 0xFFFFFFF8));
+}
+
+static inline u8 cm_req_get_path_mtu(struct cm_req_msg *req_msg)
+{
+        return req_msg->offset50 >> 4;
+}
+
+static inline void cm_req_set_path_mtu(struct cm_req_msg *req_msg, u8 path_mtu)
+{
+        req_msg->offset50 = (u8) ((req_msg->offset50 & 0xF) | (path_mtu << 4));
+}
+
+static inline u8 cm_req_get_rnr_retry_count(struct cm_req_msg *req_msg)
+{
+        return req_msg->offset50 & 0x7;
+}
+
+static inline void cm_req_set_rnr_retry_count(struct cm_req_msg *req_msg,
+                                              u8 rnr_retry_count)
+{
+        req_msg->offset50 = (u8) ((req_msg->offset50 & 0xF8) |
+                                  (rnr_retry_count & 0x7));
+}
+
+static inline u8 cm_req_get_max_cm_retries(struct cm_req_msg *req_msg)
+{
+        return req_msg->offset51 >> 4;
+}
+
+static inline void cm_req_set_max_cm_retries(struct cm_req_msg *req_msg,
+                                             u8 retries)
+{
+        req_msg->offset51 = (u8) ((req_msg->offset51 & 0xF) | (retries << 4));
+}
+
+static inline u8 cm_req_get_srq(struct cm_req_msg *req_msg)
+{
+        return (req_msg->offset51 & 0x8) >> 3;
+}
+
+static inline void cm_req_set_srq(struct cm_req_msg *req_msg, u8 srq)
+{
+        req_msg->offset51 = (u8) ((req_msg->offset51 & 0xF7) |
+                                  ((srq & 0x1) << 3));
+}
+
+static inline u32 cm_req_get_primary_flow_label(struct cm_req_msg *req_msg)
+{
+        return cpu_to_be32((be32_to_cpu(req_msg->primary_offset88) >> 12));
+}
+
+static inline void cm_req_set_primary_flow_label(struct cm_req_msg *req_msg,
+                                                 u32 flow_label)
+{
+        req_msg->primary_offset88 = cpu_to_be32(
+                                    (be32_to_cpu(req_msg->primary_offset88) &
+                                     0x00000FFF) |
+                                     (be32_to_cpu(flow_label) << 12));
+}
+
+static inline u8 cm_req_get_primary_packet_rate(struct cm_req_msg *req_msg)
+{
+        return (u8) (be32_to_cpu(req_msg->primary_offset88) & 0x3F);
+}
+
+static inline void cm_req_set_primary_packet_rate(struct cm_req_msg *req_msg,
+                                                  u8 rate)
+{
+        req_msg->primary_offset88 = cpu_to_be32(
+                                    (be32_to_cpu(req_msg->primary_offset88) &
+                                     0xFFFFFFC0) | (rate & 0x3F));
+}
+
+static inline u8 cm_req_get_primary_sl(struct cm_req_msg *req_msg)
+{
+        return (u8) (req_msg->primary_offset94 >> 4);
+}
+
+static inline void cm_req_set_primary_sl(struct cm_req_msg *req_msg, u8 sl)
+{
+        req_msg->primary_offset94 = (u8) ((req_msg->primary_offset94 & 0x0F) |
+                                          (sl << 4));
+}
+
+static inline u8 cm_req_get_primary_subnet_local(struct cm_req_msg *req_msg)
+{
+        return (u8) ((req_msg->primary_offset94 & 0x08) >> 3);
+}
+
+static inline void cm_req_set_primary_subnet_local(struct cm_req_msg *req_msg,
+                                                   u8 subnet_local)
+{
+        req_msg->primary_offset94 = (u8) ((req_msg->primary_offset94 & 0xF7) |
+                                          ((subnet_local & 0x1) << 3));
+}
+
+static inline u8 cm_req_get_primary_local_ack_timeout(struct cm_req_msg *req_msg)
+{
+        return (u8) (req_msg->primary_offset95 >> 3);
+}
+
+static inline void cm_req_set_primary_local_ack_timeout(struct cm_req_msg *req_msg,
+                                                        u8 local_ack_timeout)
+{
+        req_msg->primary_offset95 = (u8) ((req_msg->primary_offset95 & 0x07) |
+                                          (local_ack_timeout << 3));
+}
+
+static inline u32 cm_req_get_alt_flow_label(struct cm_req_msg *req_msg)
+{
+        return cpu_to_be32((be32_to_cpu(req_msg->alt_offset132) >> 12));
+}
+
+static inline void cm_req_set_alt_flow_label(struct cm_req_msg *req_msg,
+                                             u32 flow_label)
+{
+        req_msg->alt_offset132 = cpu_to_be32(
+                                 (be32_to_cpu(req_msg->alt_offset132) &
+                                  0x00000FFF) |
+                                  (be32_to_cpu(flow_label) << 12));
+}
+
+static inline u8 cm_req_get_alt_packet_rate(struct cm_req_msg *req_msg)
+{
+        return (u8) (be32_to_cpu(req_msg->alt_offset132) & 0x3F);
+}
+
+static inline void cm_req_set_alt_packet_rate(struct cm_req_msg *req_msg,
+                                              u8 rate)
+{
+        req_msg->alt_offset132 = cpu_to_be32(
+                                 (be32_to_cpu(req_msg->alt_offset132) &
+                                  0xFFFFFFC0) | (rate & 0x3F));
+}
+
+static inline u8 cm_req_get_alt_sl(struct cm_req_msg *req_msg)
+{
+        return (u8) (req_msg->alt_offset138 >> 4);
+}
+
+static inline void cm_req_set_alt_sl(struct cm_req_msg *req_msg, u8 sl)
+{
+        req_msg->alt_offset138 = (u8) ((req_msg->alt_offset138 & 0x0F) |
+                                       (sl << 4));
+}
+
+static inline u8 cm_req_get_alt_subnet_local(struct cm_req_msg *req_msg)
+{
+        return (u8) ((req_msg->alt_offset138 & 0x08) >> 3);
+}
+
+static inline void cm_req_set_alt_subnet_local(struct cm_req_msg *req_msg,
+                                               u8 subnet_local)
+{
+        req_msg->alt_offset138 = (u8) ((req_msg->alt_offset138 & 0xF7) |
+                                       ((subnet_local & 0x1) << 3));
+}
+
+static inline u8 cm_req_get_alt_local_ack_timeout(struct cm_req_msg *req_msg)
+{
+        return (u8) (req_msg->alt_offset139 >> 3);
+}
+
+static inline void cm_req_set_alt_local_ack_timeout(struct cm_req_msg *req_msg,
+                                                    u8 local_ack_timeout)
+{
+        req_msg->alt_offset139 = (u8) ((req_msg->alt_offset139 & 0x07) |
+                                       (local_ack_timeout << 3));
+}
+
+/* Message REJected or MRAed */
+enum cm_msg_response {
+        CM_MSG_RESPONSE_REQ = 0x0,
+        CM_MSG_RESPONSE_REP = 0x1,
+        CM_MSG_RESPONSE_OTHER = 0x2
+};
+
+ struct cm_mra_msg {
+        struct ib_mad_hdr hdr;
+
+        u32 local_comm_id;
+        u32 remote_comm_id;
+        /* message MRAed:2, rsvd:6 */
+        u8 offset8;
+        /* service timeout:5, rsvd:3 */
+        u8 offset9;
+
+        u8 private_data[IB_CM_MRA_PRIVATE_DATA_SIZE];
+
+} __attribute__ ((packed));
+
+static inline u8 cm_mra_get_msg_mraed(struct cm_mra_msg *mra_msg)
+{
+        return (u8) (mra_msg->offset8 >> 6);
+}
+
+static inline void cm_mra_set_msg_mraed(struct cm_mra_msg *mra_msg, u8 msg)
+{
+        mra_msg->offset8 = (u8) ((mra_msg->offset8 & 0x3F) | (msg << 6));
+}
+
+static inline u8 cm_mra_get_service_timeout(struct cm_mra_msg *mra_msg)
+{
+        return (u8) (mra_msg->offset9 >> 3);
+}
+
+static inline void cm_mra_set_service_timeout(struct cm_mra_msg *mra_msg,
+                                              u8 service_timeout)
+{
+        mra_msg->offset9 = (u8) ((mra_msg->offset9 & 0x07) |
+                                 (service_timeout << 3));
+}
+
+struct cm_rej_msg {
+        struct ib_mad_hdr hdr;
+
+        u32 local_comm_id;
+        u32 remote_comm_id;
+        /* message REJected:2, rsvd:6 */
+        u8 offset8;
+        /* reject info length:7, rsvd:1. */
+        u8 offset9;
+        u16 reason;
+        u8 ari[IB_CM_REJ_ARI_LENGTH];
+
+        u8 private_data[IB_CM_REJ_PRIVATE_DATA_SIZE];
+
+} __attribute__ ((packed));
+
+static inline u8 cm_rej_get_msg_rejected(struct cm_rej_msg *rej_msg)
+{
+        return (u8) (rej_msg->offset8 >> 6);
+}
+
+static inline void cm_rej_set_msg_rejected(struct cm_rej_msg *rej_msg, u8 msg)
+{
+        rej_msg->offset8 = (u8) ((rej_msg->offset8 & 0x3F) | (msg << 6));
+}
+
+static inline u8 cm_rej_get_reject_info_len(struct cm_rej_msg *rej_msg)
+{
+        return (u8) (rej_msg->offset9 >> 1);
+}
+
+static inline void cm_rej_set_reject_info_len(struct cm_rej_msg *rej_msg,
+                                              u8 len)
+{
+        rej_msg->offset9 = (u8) ((rej_msg->offset9 & 0x1) | (len << 1));
+}
+
+struct cm_rep_msg {
+        struct ib_mad_hdr hdr;
+
+        u32 local_comm_id;
+        u32 remote_comm_id;
+        u32 local_qkey;
+        /* local QPN:24, rsvd:8 */
+        u32 offset12;
+        /* local EECN:24, rsvd:8 */
+        u32 offset16;
+        /* starting PSN:24 rsvd:8 */
+        u32 offset20;
+        u8 resp_resources;
+        u8 initiator_depth;
+        /* target ACK delay:5, failover accepted:2, end-to-end flow control:1 */
+        u8 offset26;
+        /* RNR retry count:3, SRQ:1, rsvd:5 */
+        u8 offset27;
+        u64 local_ca_guid;
+
+        u8 private_data[IB_CM_REP_PRIVATE_DATA_SIZE];
+
+} __attribute__ ((packed));
+
+static inline u32 cm_rep_get_local_qpn(struct cm_rep_msg *rep_msg)
+{
+        return cpu_to_be32(be32_to_cpu(rep_msg->offset12) >> 8);
+}
+
+static inline void cm_rep_set_local_qpn(struct cm_rep_msg *rep_msg, u32 qpn)
+{
+        rep_msg->offset12 = cpu_to_be32((be32_to_cpu(qpn) << 8) |
+                            (be32_to_cpu(rep_msg->offset12) & 0x000000FF));
+}
+
+static inline u32 cm_rep_get_starting_psn(struct cm_rep_msg *rep_msg)
+{
+        return cpu_to_be32(be32_to_cpu(rep_msg->offset20) >> 8);
+}
+
+static inline void cm_rep_set_starting_psn(struct cm_rep_msg *rep_msg,
+                                           u32 starting_psn)
+{
+        rep_msg->offset20 = cpu_to_be32((be32_to_cpu(starting_psn) << 8) |
+                            (be32_to_cpu(rep_msg->offset20) & 0x000000FF));
+}
+
+static inline u8 cm_rep_get_target_ack_delay(struct cm_rep_msg *rep_msg)
+{
+        return (u8) (rep_msg->offset26 >> 3);
+}
+
+static inline void cm_rep_set_target_ack_delay(struct cm_rep_msg *rep_msg,
+                                               u8 target_ack_delay)
+{
+        rep_msg->offset26 = (u8) ((rep_msg->offset26 & 0x07) |
+                                  (target_ack_delay << 3));
+}
+
+static inline u8 cm_rep_get_failover(struct cm_rep_msg *rep_msg)
+{
+        return (u8) ((rep_msg->offset26 & 0x06) >> 1);
+}
+
+static inline void cm_rep_set_failover(struct cm_rep_msg *rep_msg, u8 failover)
+{
+        rep_msg->offset26 = (u8) ((rep_msg->offset26 & 0xF9) |
+                                  ((failover & 0x3) << 1));
+}
+
+static inline u8 cm_rep_get_flow_ctrl(struct cm_rep_msg *rep_msg)
+{
+        return (u8) (rep_msg->offset26 & 0x01);
+}
+
+static inline void cm_rep_set_flow_ctrl(struct cm_rep_msg *rep_msg,
+                                            u8 flow_ctrl)
+{
+        rep_msg->offset26 = (u8) ((rep_msg->offset26 & 0xFE) |
+                                  (flow_ctrl & 0x1));
+}
+
+static inline u8 cm_rep_get_rnr_retry_count(struct cm_rep_msg *rep_msg)
+{
+        return (u8) (rep_msg->offset27 >> 5);
+}
+
+static inline void cm_rep_set_rnr_retry_count(struct cm_rep_msg *rep_msg,
+                                              u8 rnr_retry_count)
+{
+        rep_msg->offset27 = (u8) ((rep_msg->offset27 & 0x1F) |
+                                  (rnr_retry_count << 5));
+}
+
+static inline u8 cm_rep_get_srq(struct cm_rep_msg *rep_msg)
+{
+        return (u8) ((rep_msg->offset27 >> 4) & 0x1);
+}
+
+static inline void cm_rep_set_srq(struct cm_rep_msg *rep_msg, u8 srq)
+{
+        rep_msg->offset27 = (u8) ((rep_msg->offset27 & 0xEF) |
+                                  ((srq & 0x1) << 4));
+}
+
+struct cm_rtu_msg {
+        struct ib_mad_hdr hdr;
+
+        u32 local_comm_id;
+        u32 remote_comm_id;
+
+        u8 private_data[IB_CM_RTU_PRIVATE_DATA_SIZE];
+
+} __attribute__ ((packed));
+
+struct cm_dreq_msg {
+        struct ib_mad_hdr hdr;
+
+        u32 local_comm_id;
+        u32 remote_comm_id;
+        /* remote QPN/EECN:24, rsvd:8 */
+        u32 offset8;
+
+        u8 private_data[IB_CM_DREQ_PRIVATE_DATA_SIZE];
+
+} __attribute__ ((packed));
+
+static inline u32 cm_dreq_get_remote_qpn(struct cm_dreq_msg *dreq_msg)
+{
+        return cpu_to_be32(be32_to_cpu(dreq_msg->offset8) >> 8);
+}
+
+static inline void cm_dreq_set_remote_qpn(struct cm_dreq_msg *dreq_msg, u32 qpn)
+{
+        dreq_msg->offset8 = cpu_to_be32((be32_to_cpu(qpn) << 8) |
+                            (be32_to_cpu(dreq_msg->offset8) & 0x000000FF));
+}
+
+struct cm_drep_msg {
+        struct ib_mad_hdr hdr;
+
+        u32 local_comm_id;
+        u32 remote_comm_id;
+
+        u8 private_data[IB_CM_DREP_PRIVATE_DATA_SIZE];
+
+} __attribute__ ((packed));
+
+struct cm_lap_msg {
+        struct ib_mad_hdr hdr;
+
+        u32 local_comm_id;
+        u32 remote_comm_id;
+
+        u32 rsvd8;
+        /* remote QPN/EECN:24, remote CM response timeout:5, rsvd:3 */
+        u32 offset12;
+        u32 rsvd16;
+
+        u16 alt_local_lid;
+        u16 alt_remote_lid;
+        union ib_gid alt_local_gid;
+        union ib_gid alt_remote_gid;
+        /* flow label:20, rsvd:4, traffic class:8 */
+        u32 offset56;
+        u8 alt_hop_limit;
+        /* rsvd:2, packet rate:6 */
+        uint8_t offset61;
+        /* SL:4, subnet local:1, rsvd:3 */
+        uint8_t offset62;
+        /* local ACK timeout:5, rsvd:3 */
+        uint8_t offset63;
+
+        u8 private_data[IB_CM_LAP_PRIVATE_DATA_SIZE];
+} __attribute__  ((packed));
+
+static inline u32 cm_lap_get_remote_qpn(struct cm_lap_msg *lap_msg)
+{
+        return cpu_to_be32(be32_to_cpu(lap_msg->offset12) >> 8);
+}
+
+static inline void cm_lap_set_remote_qpn(struct cm_lap_msg *lap_msg, u32 qpn)
+{
+        lap_msg->offset12 = cpu_to_be32((be32_to_cpu(qpn) << 8) |
+                                         (be32_to_cpu(lap_msg->offset12) &
+                                          0x000000FF));
+}
+
+static inline u8 cm_lap_get_remote_resp_timeout(struct cm_lap_msg *lap_msg)
+{
+        return (u8) ((be32_to_cpu(lap_msg->offset12) & 0xF8) >> 3);
+}
+
+static inline void cm_lap_set_remote_resp_timeout(struct cm_lap_msg *lap_msg,
+                                                  u8 resp_timeout)
+{
+        lap_msg->offset12 = cpu_to_be32((resp_timeout << 3) |
+                                         (be32_to_cpu(lap_msg->offset12) &
+                                          0xFFFFFF07));
+}
+
+static inline u32 cm_lap_get_flow_label(struct cm_lap_msg *lap_msg)
+{
+        return be32_to_cpu(lap_msg->offset56) >> 12;
+}
+
+static inline void cm_lap_set_flow_label(struct cm_lap_msg *lap_msg,
+                                         u32 flow_label)
+{
+        lap_msg->offset56 = cpu_to_be32((flow_label << 12) |
+                                         (be32_to_cpu(lap_msg->offset56) &
+                                          0x00000FFF));
+}
+
+static inline u8 cm_lap_get_traffic_class(struct cm_lap_msg *lap_msg)
+{
+        return (u8) be32_to_cpu(lap_msg->offset56);
+}
+
+static inline void cm_lap_set_traffic_class(struct cm_lap_msg *lap_msg,
+                                            u8 traffic_class)
+{
+        lap_msg->offset56 = cpu_to_be32(traffic_class |
+                                         (be32_to_cpu(lap_msg->offset56) &
+                                          0xFFFFFF00));
+}
+
+static inline u8 cm_lap_get_packet_rate(struct cm_lap_msg *lap_msg)
+{
+        return lap_msg->offset61 & 0x3F;
+}
+
+static inline void cm_lap_set_packet_rate(struct cm_lap_msg *lap_msg,
+                                          u8 packet_rate)
+{
+        lap_msg->offset61 = (packet_rate & 0x3F) | (lap_msg->offset61 & 0xC0);
+}
+
+static inline u8 cm_lap_get_sl(struct cm_lap_msg *lap_msg)
+{
+        return lap_msg->offset62 >> 4;
+}
+
+static inline void cm_lap_set_sl(struct cm_lap_msg *lap_msg, u8 sl)
+{
+        lap_msg->offset62 = (sl << 4) | (lap_msg->offset62 & 0x0F);
+}
+
+static inline u8 cm_lap_get_subnet_local(struct cm_lap_msg *lap_msg)
+{
+        return (lap_msg->offset62 >> 3) & 0x1;
+}
+
+static inline void cm_lap_set_subnet_local(struct cm_lap_msg *lap_msg,
+                                           u8 subnet_local)
+{
+        lap_msg->offset62 = ((subnet_local & 0x1) << 3) |
+                             (lap_msg->offset61 & 0xF7);
+}
+static inline u8 cm_lap_get_local_ack_timeout(struct cm_lap_msg *lap_msg)
+{
+        return lap_msg->offset63 >> 3;
+}
+
+static inline void cm_lap_set_local_ack_timeout(struct cm_lap_msg *lap_msg,
+                                                u8 local_ack_timeout)
+{
+        lap_msg->offset63 = (local_ack_timeout << 3) |
+                            (lap_msg->offset63 & 0x07);
+}
+
+struct cm_apr_msg {
+        struct ib_mad_hdr hdr;
+
+        u32 local_comm_id;
+        u32 remote_comm_id;
+
+        u8 info_length;
+        u8 ap_status;
+        u8 info[IB_CM_APR_INFO_LENGTH];
+
+        u8 private_data[IB_CM_APR_PRIVATE_DATA_SIZE];
+} __attribute__ ((packed));
+
+struct cm_sidr_req_msg {
+        struct ib_mad_hdr hdr;
+
+        u32 request_id;
+        u16 pkey;
+        u16 rsvd;
+        u64 service_id;
+
+        u8 private_data[IB_CM_SIDR_REQ_PRIVATE_DATA_SIZE];
+} __attribute__ ((packed));
+
+struct cm_sidr_rep_msg {
+        struct ib_mad_hdr hdr;
+
+        u32 request_id;
+        u8 status;
+        u8 info_length;
+        u16 rsvd;
+        /* QPN:24, rsvd:8 */
+        u32 offset8;
+        u64 service_id;
+        u32 qkey;
+        u8 info[IB_CM_SIDR_REP_INFO_LENGTH];
+
+        u8 private_data[IB_CM_SIDR_REP_PRIVATE_DATA_SIZE];
+} __attribute__ ((packed));
+
+static inline u32 cm_sidr_rep_get_qpn(struct cm_sidr_rep_msg *sidr_rep_msg)
+{
+        return cpu_to_be32(be32_to_cpu(sidr_rep_msg->offset8) >> 8);
+}
+
+static inline void cm_sidr_rep_set_qpn(struct cm_sidr_rep_msg *sidr_rep_msg,
+                                       u32 qpn)
+{
+        sidr_rep_msg->offset8 = cpu_to_be32((be32_to_cpu(qpn) << 8) |
+                                        (be32_to_cpu(sidr_rep_msg->offset8) &
+                                         0x000000FF));
+}
+
+#endif /* CM_MSGS_H */
diff --git a/drivers/infiniband/core/fmr_pool.c b/drivers/infiniband/core/fmr_pool.c
index 328feae2a5be..7763b31abba7 100644
--- a/drivers/infiniband/core/fmr_pool.c
+++ b/drivers/infiniband/core/fmr_pool.c
@@ -1,5 +1,6 @@
 /*
  * Copyright (c) 2004 Topspin Communications.  All rights reserved.
+ * Copyright (c) 2005 Sun Microsystems, Inc. All rights reserved.
  *
  * This software is available to you under a choice of one of two
  * licenses.  You may choose to be licensed under the terms of the GNU
@@ -29,7 +30,7 @@
  * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
  * SOFTWARE.
  *
- * $Id: fmr_pool.c 1349 2004-12-16 21:09:43Z roland $
+ * $Id: fmr_pool.c 2730 2005-06-28 16:43:03Z sean.hefty $
  */
 
 #include <linux/errno.h>
@@ -329,7 +330,7 @@ EXPORT_SYMBOL(ib_create_fmr_pool);
  *
  * Destroy an FMR pool and free all associated resources.
  */
-int ib_destroy_fmr_pool(struct ib_fmr_pool *pool)
+void ib_destroy_fmr_pool(struct ib_fmr_pool *pool)
 {
         struct ib_pool_fmr *fmr;
         struct ib_pool_fmr *tmp;
@@ -352,8 +353,6 @@ int ib_destroy_fmr_pool(struct ib_fmr_pool *pool)
 
         kfree(pool->cache_bucket);
         kfree(pool);
-
-        return 0;
 }
 EXPORT_SYMBOL(ib_destroy_fmr_pool);
 
diff --git a/drivers/infiniband/core/mad.c b/drivers/infiniband/core/mad.c
index 23628c622a50..b97e210ce9c8 100644
--- a/drivers/infiniband/core/mad.c
+++ b/drivers/infiniband/core/mad.c
@@ -1,5 +1,7 @@
 /*
  * Copyright (c) 2004, 2005 Voltaire, Inc. All rights reserved.
+ * Copyright (c) 2005 Intel Corporation.  All rights reserved.
+ * Copyright (c) 2005 Mellanox Technologies Ltd.  All rights reserved.
  *
  * This software is available to you under a choice of one of two
  * licenses.  You may choose to be licensed under the terms of the GNU
@@ -29,12 +31,12 @@
  * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
  * SOFTWARE.
  *
- * $Id: mad.c 1389 2004-12-27 22:56:47Z roland $
+ * $Id: mad.c 2817 2005-07-07 11:29:26Z halr $
  */
-
 #include <linux/dma-mapping.h>
 
 #include "mad_priv.h"
+#include "mad_rmpp.h"
 #include "smi.h"
 #include "agent.h"
 
@@ -45,6 +47,7 @@ MODULE_AUTHOR("Sean Hefty");
 
 
 kmem_cache_t *ib_mad_cache;
+
 static struct list_head ib_mad_port_list;
 static u32 ib_mad_client_id = 0;
 
@@ -58,16 +61,12 @@ static int method_in_use(struct ib_mad_mgmt_method_table **method,
 static void remove_mad_reg_req(struct ib_mad_agent_private *priv);
 static struct ib_mad_agent_private *find_mad_agent(
                                         struct ib_mad_port_private *port_priv,
-                                        struct ib_mad *mad, int solicited);
+                                        struct ib_mad *mad);
 static int ib_mad_post_receive_mads(struct ib_mad_qp_info *qp_info,
                                     struct ib_mad_private *mad);
 static void cancel_mads(struct ib_mad_agent_private *mad_agent_priv);
-static void ib_mad_complete_send_wr(struct ib_mad_send_wr_private *mad_send_wr,
-                                    struct ib_mad_send_wc *mad_send_wc);
 static void timeout_sends(void *data);
-static void cancel_sends(void *data);
 static void local_completions(void *data);
-static int solicited_mad(struct ib_mad *mad);
 static int add_nonoui_reg_req(struct ib_mad_reg_req *mad_reg_req,
                               struct ib_mad_agent_private *agent_priv,
                               u8 mgmt_class);
@@ -197,8 +196,8 @@ struct ib_mad_agent *ib_register_mad_agent(struct ib_device *device,
         if (qpn == -1)
                 goto error1;
 
-        if (rmpp_version)
-                goto error1;    /* XXX: until RMPP implemented */
+        if (rmpp_version && rmpp_version != IB_MGMT_RMPP_VERSION)
+                goto error1;
 
         /* Validate MAD registration request if supplied */
         if (mad_reg_req) {
@@ -261,22 +260,29 @@ struct ib_mad_agent *ib_register_mad_agent(struct ib_device *device,
                 ret = ERR_PTR(-ENOMEM);
                 goto error1;
         }
+        memset(mad_agent_priv, 0, sizeof *mad_agent_priv);
+
+        mad_agent_priv->agent.mr = ib_get_dma_mr(port_priv->qp_info[qpn].qp->pd,
+                                                 IB_ACCESS_LOCAL_WRITE);
+        if (IS_ERR(mad_agent_priv->agent.mr)) {
+                ret = ERR_PTR(-ENOMEM);
+                goto error2;
+        }
 
         if (mad_reg_req) {
                 reg_req = kmalloc(sizeof *reg_req, GFP_KERNEL);
                 if (!reg_req) {
                         ret = ERR_PTR(-ENOMEM);
-                        goto error2;
+                        goto error3;
                 }
                 /* Make a copy of the MAD registration request */
                 memcpy(reg_req, mad_reg_req, sizeof *reg_req);
         }
 
         /* Now, fill in the various structures */
-        memset(mad_agent_priv, 0, sizeof *mad_agent_priv);
         mad_agent_priv->qp_info = &port_priv->qp_info[qpn];
         mad_agent_priv->reg_req = reg_req;
-        mad_agent_priv->rmpp_version = rmpp_version;
+        mad_agent_priv->agent.rmpp_version = rmpp_version;
         mad_agent_priv->agent.device = device;
         mad_agent_priv->agent.recv_handler = recv_handler;
         mad_agent_priv->agent.send_handler = send_handler;
@@ -301,7 +307,7 @@ struct ib_mad_agent *ib_register_mad_agent(struct ib_device *device,
                                 if (method) {
                                         if (method_in_use(&method,
                                                            mad_reg_req))
-                                                goto error3;
+                                                goto error4;
                                 }
                         }
                         ret2 = add_nonoui_reg_req(mad_reg_req, mad_agent_priv,
@@ -317,14 +323,14 @@ struct ib_mad_agent *ib_register_mad_agent(struct ib_device *device,
                                         if (is_vendor_method_in_use(
                                                         vendor_class,
                                                         mad_reg_req))
-                                                goto error3;
+                                                goto error4;
                                 }
                         }
                         ret2 = add_oui_reg_req(mad_reg_req, mad_agent_priv);
                 }
                 if (ret2) {
                         ret = ERR_PTR(ret2);
-                        goto error3;
+                        goto error4;
                 }
         }
 
@@ -335,22 +341,24 @@ struct ib_mad_agent *ib_register_mad_agent(struct ib_device *device,
         spin_lock_init(&mad_agent_priv->lock);
         INIT_LIST_HEAD(&mad_agent_priv->send_list);
         INIT_LIST_HEAD(&mad_agent_priv->wait_list);
+        INIT_LIST_HEAD(&mad_agent_priv->done_list);
+        INIT_LIST_HEAD(&mad_agent_priv->rmpp_list);
         INIT_WORK(&mad_agent_priv->timed_work, timeout_sends, mad_agent_priv);
         INIT_LIST_HEAD(&mad_agent_priv->local_list);
         INIT_WORK(&mad_agent_priv->local_work, local_completions,
                    mad_agent_priv);
-        INIT_LIST_HEAD(&mad_agent_priv->canceled_list);
-        INIT_WORK(&mad_agent_priv->canceled_work, cancel_sends, mad_agent_priv);
         atomic_set(&mad_agent_priv->refcount, 1);
         init_waitqueue_head(&mad_agent_priv->wait);
 
         return &mad_agent_priv->agent;
 
-error3:
+error4:
         spin_unlock_irqrestore(&port_priv->reg_lock, flags);
         kfree(reg_req);
-error2:
+error3:
         kfree(mad_agent_priv);
+error2:
+        ib_dereg_mr(mad_agent_priv->agent.mr);
 error1:
         return ret;
 }
@@ -487,18 +495,16 @@ static void unregister_mad_agent(struct ib_mad_agent_private *mad_agent_priv)
          * MADs, preventing us from queuing additional work
          */
         cancel_mads(mad_agent_priv);
-
         port_priv = mad_agent_priv->qp_info->port_priv;
-
         cancel_delayed_work(&mad_agent_priv->timed_work);
-        flush_workqueue(port_priv->wq);
 
         spin_lock_irqsave(&port_priv->reg_lock, flags);
         remove_mad_reg_req(mad_agent_priv);
         list_del(&mad_agent_priv->agent_list);
         spin_unlock_irqrestore(&port_priv->reg_lock, flags);
 
-        /* XXX: Cleanup pending RMPP receives for this agent */
+        flush_workqueue(port_priv->wq);
+        ib_cancel_rmpp_recvs(mad_agent_priv);
 
         atomic_dec(&mad_agent_priv->refcount);
         wait_event(mad_agent_priv->wait,
@@ -506,6 +512,7 @@ static void unregister_mad_agent(struct ib_mad_agent_private *mad_agent_priv)
 
         if (mad_agent_priv->reg_req)
                 kfree(mad_agent_priv->reg_req);
+        ib_dereg_mr(mad_agent_priv->agent.mr);
         kfree(mad_agent_priv);
 }
 
@@ -551,6 +558,13 @@ int ib_unregister_mad_agent(struct ib_mad_agent *mad_agent)
 }
 EXPORT_SYMBOL(ib_unregister_mad_agent);
 
+static inline int response_mad(struct ib_mad *mad)
+{
+        /* Trap represses are responses although response bit is reset */
+        return ((mad->mad_hdr.method == IB_MGMT_METHOD_TRAP_REPRESS) ||
+                (mad->mad_hdr.method & IB_MGMT_METHOD_RESP));
+}
+
 static void dequeue_mad(struct ib_mad_list_head *mad_list)
 {
         struct ib_mad_queue *mad_queue;
@@ -643,7 +657,7 @@ static int handle_outgoing_dr_smp(struct ib_mad_agent_private *mad_agent_priv,
                                   struct ib_smp *smp,
                                   struct ib_send_wr *send_wr)
 {
-        int ret, solicited;
+        int ret;
         unsigned long flags;
         struct ib_mad_local_private *local;
         struct ib_mad_private *mad_priv;
@@ -689,11 +703,7 @@ static int handle_outgoing_dr_smp(struct ib_mad_agent_private *mad_agent_priv,
         switch (ret)
         {
         case IB_MAD_RESULT_SUCCESS | IB_MAD_RESULT_REPLY:
-                /*
-                 * See if response is solicited and
-                 * there is a recv handler
-                 */
-                if (solicited_mad(&mad_priv->mad.mad) &&
+                if (response_mad(&mad_priv->mad.mad) &&
                     mad_agent_priv->agent.recv_handler) {
                         local->mad_priv = mad_priv;
                         local->recv_mad_agent = mad_agent_priv;
@@ -710,15 +720,13 @@ static int handle_outgoing_dr_smp(struct ib_mad_agent_private *mad_agent_priv,
                 break;
         case IB_MAD_RESULT_SUCCESS:
                 /* Treat like an incoming receive MAD */
-                solicited = solicited_mad(&mad_priv->mad.mad);
                 port_priv = ib_get_mad_port(mad_agent_priv->agent.device,
                                             mad_agent_priv->agent.port_num);
                 if (port_priv) {
                         mad_priv->mad.mad.mad_hdr.tid =
                                 ((struct ib_mad *)smp)->mad_hdr.tid;
                         recv_mad_agent = find_mad_agent(port_priv,
-                                                       &mad_priv->mad.mad,
-                                                        solicited);
+                                                        &mad_priv->mad.mad);
                 }
                 if (!port_priv || !recv_mad_agent) {
                         kmem_cache_free(ib_mad_cache, mad_priv);
@@ -750,43 +758,133 @@ static int handle_outgoing_dr_smp(struct ib_mad_agent_private *mad_agent_priv,
         list_add_tail(&local->completion_list, &mad_agent_priv->local_list);
         spin_unlock_irqrestore(&mad_agent_priv->lock, flags);
         queue_work(mad_agent_priv->qp_info->port_priv->wq,
-                  &mad_agent_priv->local_work);
+                   &mad_agent_priv->local_work);
         ret = 1;
 out:
         return ret;
 }
 
-static int ib_send_mad(struct ib_mad_agent_private *mad_agent_priv,
-                       struct ib_mad_send_wr_private *mad_send_wr)
+static int get_buf_length(int hdr_len, int data_len)
+{
+        int seg_size, pad;
+
+        seg_size = sizeof(struct ib_mad) - hdr_len;
+        if (data_len && seg_size) {
+                pad = seg_size - data_len % seg_size;
+                if (pad == seg_size)
+                        pad = 0;
+        } else
+                pad = seg_size;
+        return hdr_len + data_len + pad;
+}
+
+struct ib_mad_send_buf * ib_create_send_mad(struct ib_mad_agent *mad_agent,
+                                            u32 remote_qpn, u16 pkey_index,
+                                            struct ib_ah *ah, int rmpp_active,
+                                            int hdr_len, int data_len,
+                                            unsigned int __nocast gfp_mask)
+{
+        struct ib_mad_agent_private *mad_agent_priv;
+        struct ib_mad_send_buf *send_buf;
+        int buf_size;
+        void *buf;
+
+        mad_agent_priv = container_of(mad_agent,
+                                      struct ib_mad_agent_private, agent);
+        buf_size = get_buf_length(hdr_len, data_len);
+
+        if ((!mad_agent->rmpp_version &&
+             (rmpp_active || buf_size > sizeof(struct ib_mad))) ||
+            (!rmpp_active && buf_size > sizeof(struct ib_mad)))
+                return ERR_PTR(-EINVAL);
+
+        buf = kmalloc(sizeof *send_buf + buf_size, gfp_mask);
+        if (!buf)
+                return ERR_PTR(-ENOMEM);
+        memset(buf, 0, sizeof *send_buf + buf_size);
+
+        send_buf = buf + buf_size;
+        send_buf->mad = buf;
+
+        send_buf->sge.addr = dma_map_single(mad_agent->device->dma_device,
+                                            buf, buf_size, DMA_TO_DEVICE);
+        pci_unmap_addr_set(send_buf, mapping, send_buf->sge.addr);
+        send_buf->sge.length = buf_size;
+        send_buf->sge.lkey = mad_agent->mr->lkey;
+
+        send_buf->send_wr.wr_id = (unsigned long) send_buf;
+        send_buf->send_wr.sg_list = &send_buf->sge;
+        send_buf->send_wr.num_sge = 1;
+        send_buf->send_wr.opcode = IB_WR_SEND;
+        send_buf->send_wr.send_flags = IB_SEND_SIGNALED;
+        send_buf->send_wr.wr.ud.ah = ah;
+        send_buf->send_wr.wr.ud.mad_hdr = &send_buf->mad->mad_hdr;
+        send_buf->send_wr.wr.ud.remote_qpn = remote_qpn;
+        send_buf->send_wr.wr.ud.remote_qkey = IB_QP_SET_QKEY;
+        send_buf->send_wr.wr.ud.pkey_index = pkey_index;
+
+        if (rmpp_active) {
+                struct ib_rmpp_mad *rmpp_mad;
+                rmpp_mad = (struct ib_rmpp_mad *)send_buf->mad;
+                rmpp_mad->rmpp_hdr.paylen_newwin = cpu_to_be32(hdr_len -
+                        offsetof(struct ib_rmpp_mad, data) + data_len);
+                rmpp_mad->rmpp_hdr.rmpp_version = mad_agent->rmpp_version;
+                rmpp_mad->rmpp_hdr.rmpp_type = IB_MGMT_RMPP_TYPE_DATA;
+                ib_set_rmpp_flags(&rmpp_mad->rmpp_hdr,
+                                  IB_MGMT_RMPP_FLAG_ACTIVE);
+        }
+
+        send_buf->mad_agent = mad_agent;
+        atomic_inc(&mad_agent_priv->refcount);
+        return send_buf;
+}
+EXPORT_SYMBOL(ib_create_send_mad);
+
+void ib_free_send_mad(struct ib_mad_send_buf *send_buf)
+{
+        struct ib_mad_agent_private *mad_agent_priv;
+
+        mad_agent_priv = container_of(send_buf->mad_agent,
+                                      struct ib_mad_agent_private, agent);
+
+        dma_unmap_single(send_buf->mad_agent->device->dma_device,
+                         pci_unmap_addr(send_buf, mapping),
+                         send_buf->sge.length, DMA_TO_DEVICE);
+        kfree(send_buf->mad);
+
+        if (atomic_dec_and_test(&mad_agent_priv->refcount))
+                wake_up(&mad_agent_priv->wait);
+}
+EXPORT_SYMBOL(ib_free_send_mad);
+
+int ib_send_mad(struct ib_mad_send_wr_private *mad_send_wr)
 {
         struct ib_mad_qp_info *qp_info;
         struct ib_send_wr *bad_send_wr;
+        struct list_head *list;
         unsigned long flags;
         int ret;
 
-        /* Replace user's WR ID with our own to find WR upon completion */
-        qp_info = mad_agent_priv->qp_info;
-        mad_send_wr->wr_id = mad_send_wr->send_wr.wr_id;
+        /* Set WR ID to find mad_send_wr upon completion */
+        qp_info = mad_send_wr->mad_agent_priv->qp_info;
         mad_send_wr->send_wr.wr_id = (unsigned long)&mad_send_wr->mad_list;
         mad_send_wr->mad_list.mad_queue = &qp_info->send_queue;
 
         spin_lock_irqsave(&qp_info->send_queue.lock, flags);
-        if (qp_info->send_queue.count++ < qp_info->send_queue.max_active) {
-                list_add_tail(&mad_send_wr->mad_list.list,
-                              &qp_info->send_queue.list);
-                spin_unlock_irqrestore(&qp_info->send_queue.lock, flags);
-                ret = ib_post_send(mad_agent_priv->agent.qp,
+        if (qp_info->send_queue.count < qp_info->send_queue.max_active) {
+                ret = ib_post_send(mad_send_wr->mad_agent_priv->agent.qp,
                                    &mad_send_wr->send_wr, &bad_send_wr);
-                if (ret) {
-                        printk(KERN_ERR PFX "ib_post_send failed: %d\n", ret);
-                        dequeue_mad(&mad_send_wr->mad_list);
-                }
+                list = &qp_info->send_queue.list;
         } else {
-                list_add_tail(&mad_send_wr->mad_list.list,
-                              &qp_info->overflow_list);
-                spin_unlock_irqrestore(&qp_info->send_queue.lock, flags);
                 ret = 0;
+                list = &qp_info->overflow_list;
         }
+
+        if (!ret) {
+                qp_info->send_queue.count++;
+                list_add_tail(&mad_send_wr->mad_list.list, list);
+        }
+        spin_unlock_irqrestore(&qp_info->send_queue.lock, flags);
         return ret;
 }
 
@@ -860,18 +958,19 @@ int ib_post_send_mad(struct ib_mad_agent *mad_agent,
                         ret = -ENOMEM;
                         goto error2;
                 }
+                memset(mad_send_wr, 0, sizeof *mad_send_wr);
 
                 mad_send_wr->send_wr = *send_wr;
                 mad_send_wr->send_wr.sg_list = mad_send_wr->sg_list;
                 memcpy(mad_send_wr->sg_list, send_wr->sg_list,
                        sizeof *send_wr->sg_list * send_wr->num_sge);
-                mad_send_wr->send_wr.next = NULL;
+                mad_send_wr->wr_id = send_wr->wr_id;
                 mad_send_wr->tid = send_wr->wr.ud.mad_hdr->tid;
-                mad_send_wr->agent = mad_agent;
+                mad_send_wr->mad_agent_priv = mad_agent_priv;
                 /* Timeout will be updated after send completes */
                 mad_send_wr->timeout = msecs_to_jiffies(send_wr->wr.
                                                         ud.timeout_ms);
-                mad_send_wr->retry = 0;
+                mad_send_wr->retries = mad_send_wr->send_wr.wr.ud.retries;
                 /* One reference for each work request to QP + response */
                 mad_send_wr->refcount = 1 + (mad_send_wr->timeout > 0);
                 mad_send_wr->status = IB_WC_SUCCESS;
@@ -883,8 +982,13 @@ int ib_post_send_mad(struct ib_mad_agent *mad_agent,
                               &mad_agent_priv->send_list);
                 spin_unlock_irqrestore(&mad_agent_priv->lock, flags);
 
-                ret = ib_send_mad(mad_agent_priv, mad_send_wr);
-                if (ret) {
+                if (mad_agent_priv->agent.rmpp_version) {
+                        ret = ib_send_rmpp_mad(mad_send_wr);
+                        if (ret >= 0 && ret != IB_RMPP_RESULT_CONSUMED)
+                                ret = ib_send_mad(mad_send_wr);
+                } else
+                        ret = ib_send_mad(mad_send_wr);
+                if (ret < 0) {
                         /* Fail send request */
                         spin_lock_irqsave(&mad_agent_priv->lock, flags);
                         list_del(&mad_send_wr->agent_list);
@@ -910,41 +1014,28 @@ EXPORT_SYMBOL(ib_post_send_mad);
  */
 void ib_free_recv_mad(struct ib_mad_recv_wc *mad_recv_wc)
 {
-        struct ib_mad_recv_buf *entry;
+        struct ib_mad_recv_buf *mad_recv_buf, *temp_recv_buf;
         struct ib_mad_private_header *mad_priv_hdr;
         struct ib_mad_private *priv;
+        struct list_head free_list;
 
-        mad_priv_hdr = container_of(mad_recv_wc,
-                                    struct ib_mad_private_header,
-                                    recv_wc);
-        priv = container_of(mad_priv_hdr, struct ib_mad_private, header);
+        INIT_LIST_HEAD(&free_list);
+        list_splice_init(&mad_recv_wc->rmpp_list, &free_list);
 
-        /*
-         * Walk receive buffer list associated with this WC
-         * No need to remove them from list of receive buffers
-         */
-        list_for_each_entry(entry, &mad_recv_wc->recv_buf.list, list) {
-                /* Free previous receive buffer */
-                kmem_cache_free(ib_mad_cache, priv);
+        list_for_each_entry_safe(mad_recv_buf, temp_recv_buf,
+                                        &free_list, list) {
+                mad_recv_wc = container_of(mad_recv_buf, struct ib_mad_recv_wc,
+                                           recv_buf);
                 mad_priv_hdr = container_of(mad_recv_wc,
                                             struct ib_mad_private_header,
                                             recv_wc);
                 priv = container_of(mad_priv_hdr, struct ib_mad_private,
                                     header);
+                kmem_cache_free(ib_mad_cache, priv);
         }
-
-        /* Free last buffer */
-        kmem_cache_free(ib_mad_cache, priv);
 }
 EXPORT_SYMBOL(ib_free_recv_mad);
 
-void ib_coalesce_recv_mad(struct ib_mad_recv_wc *mad_recv_wc,
-                          void *buf)
-{
-        printk(KERN_ERR PFX "ib_coalesce_recv_mad() not implemented yet\n");
-}
-EXPORT_SYMBOL(ib_coalesce_recv_mad);
-
 struct ib_mad_agent *ib_redirect_mad_qp(struct ib_qp *qp,
                                         u8 rmpp_version,
                                         ib_mad_send_handler send_handler,
@@ -1338,42 +1429,15 @@ out:
         return;
 }
 
-static int response_mad(struct ib_mad *mad)
-{
-        /* Trap represses are responses although response bit is reset */
-        return ((mad->mad_hdr.method == IB_MGMT_METHOD_TRAP_REPRESS) ||
-                (mad->mad_hdr.method & IB_MGMT_METHOD_RESP));
-}
-
-static int solicited_mad(struct ib_mad *mad)
-{
-        /* CM MADs are never solicited */
-        if (mad->mad_hdr.mgmt_class == IB_MGMT_CLASS_CM) {
-                return 0;
-        }
-
-        /* XXX: Determine whether MAD is using RMPP */
-
-        /* Not using RMPP */
-        /* Is this MAD a response to a previous MAD ? */
-        return response_mad(mad);
-}
-
 static struct ib_mad_agent_private *
 find_mad_agent(struct ib_mad_port_private *port_priv,
-               struct ib_mad *mad,
-               int solicited)
+               struct ib_mad *mad)
 {
         struct ib_mad_agent_private *mad_agent = NULL;
         unsigned long flags;
 
         spin_lock_irqsave(&port_priv->reg_lock, flags);
-
-        /*
-         * Whether MAD was solicited determines type of routing to
-         * MAD client.
-         */
-        if (solicited) {
+        if (response_mad(mad)) {
                 u32 hi_tid;
                 struct ib_mad_agent_private *entry;
 
@@ -1477,21 +1541,20 @@ out:
         return valid;
 }
 
-/*
- * Return start of fully reassembled MAD, or NULL, if MAD isn't assembled yet
- */
-static struct ib_mad_private *
-reassemble_recv(struct ib_mad_agent_private *mad_agent_priv,
-                struct ib_mad_private *recv)
+static int is_data_mad(struct ib_mad_agent_private *mad_agent_priv,
+                       struct ib_mad_hdr *mad_hdr)
 {
-        /* Until we have RMPP, all receives are reassembled!... */
-        INIT_LIST_HEAD(&recv->header.recv_wc.recv_buf.list);
-        return recv;
+        struct ib_rmpp_mad *rmpp_mad;
+
+        rmpp_mad = (struct ib_rmpp_mad *)mad_hdr;
+        return !mad_agent_priv->agent.rmpp_version ||
+                !(ib_get_rmpp_flags(&rmpp_mad->rmpp_hdr) &
+                                    IB_MGMT_RMPP_FLAG_ACTIVE) ||
+                (rmpp_mad->rmpp_hdr.rmpp_type == IB_MGMT_RMPP_TYPE_DATA);
 }
 
-static struct ib_mad_send_wr_private*
-find_send_req(struct ib_mad_agent_private *mad_agent_priv,
-              u64 tid)
+struct ib_mad_send_wr_private*
+ib_find_send_mad(struct ib_mad_agent_private *mad_agent_priv, u64 tid)
 {
         struct ib_mad_send_wr_private *mad_send_wr;
 
@@ -1507,7 +1570,9 @@ find_send_req(struct ib_mad_agent_private *mad_agent_priv,
          */
         list_for_each_entry(mad_send_wr, &mad_agent_priv->send_list,
                             agent_list) {
-                if (mad_send_wr->tid == tid && mad_send_wr->timeout) {
+                if (is_data_mad(mad_agent_priv,
+                                mad_send_wr->send_wr.wr.ud.mad_hdr) &&
+                    mad_send_wr->tid == tid && mad_send_wr->timeout) {
                         /* Verify request has not been canceled */
                         return (mad_send_wr->status == IB_WC_SUCCESS) ?
                                 mad_send_wr : NULL;
@@ -1516,43 +1581,55 @@ find_send_req(struct ib_mad_agent_private *mad_agent_priv,
         return NULL;
 }
 
+void ib_mark_mad_done(struct ib_mad_send_wr_private *mad_send_wr)
+{
+        mad_send_wr->timeout = 0;
+        if (mad_send_wr->refcount == 1) {
+                list_del(&mad_send_wr->agent_list);
+                list_add_tail(&mad_send_wr->agent_list,
+                              &mad_send_wr->mad_agent_priv->done_list);
+        }
+}
+
 static void ib_mad_complete_recv(struct ib_mad_agent_private *mad_agent_priv,
-                                 struct ib_mad_private *recv,
-                                 int solicited)
+                                 struct ib_mad_recv_wc *mad_recv_wc)
 {
         struct ib_mad_send_wr_private *mad_send_wr;
         struct ib_mad_send_wc mad_send_wc;
         unsigned long flags;
-
-        /* Fully reassemble receive before processing */
-        recv = reassemble_recv(mad_agent_priv, recv);
-        if (!recv) {
-                if (atomic_dec_and_test(&mad_agent_priv->refcount))
-                        wake_up(&mad_agent_priv->wait);
-                return;
+        u64 tid;
+
+        INIT_LIST_HEAD(&mad_recv_wc->rmpp_list);
+        list_add(&mad_recv_wc->recv_buf.list, &mad_recv_wc->rmpp_list);
+        if (mad_agent_priv->agent.rmpp_version) {
+                mad_recv_wc = ib_process_rmpp_recv_wc(mad_agent_priv,
+                                                      mad_recv_wc);
+                if (!mad_recv_wc) {
+                        if (atomic_dec_and_test(&mad_agent_priv->refcount))
+                                wake_up(&mad_agent_priv->wait);
+                        return;
+                }
         }
 
         /* Complete corresponding request */
-        if (solicited) {
+        if (response_mad(mad_recv_wc->recv_buf.mad)) {
+                tid = mad_recv_wc->recv_buf.mad->mad_hdr.tid;
                 spin_lock_irqsave(&mad_agent_priv->lock, flags);
-                mad_send_wr = find_send_req(mad_agent_priv,
-                                            recv->mad.mad.mad_hdr.tid);
+                mad_send_wr = ib_find_send_mad(mad_agent_priv, tid);
                 if (!mad_send_wr) {
                         spin_unlock_irqrestore(&mad_agent_priv->lock, flags);
-                        ib_free_recv_mad(&recv->header.recv_wc);
+                        ib_free_recv_mad(mad_recv_wc);
                         if (atomic_dec_and_test(&mad_agent_priv->refcount))
                                 wake_up(&mad_agent_priv->wait);
                         return;
                 }
-                /* Timeout = 0 means that we won't wait for a response */
-                mad_send_wr->timeout = 0;
+                ib_mark_mad_done(mad_send_wr);
                 spin_unlock_irqrestore(&mad_agent_priv->lock, flags);
 
                 /* Defined behavior is to complete response before request */
-                recv->header.recv_wc.wc->wr_id = mad_send_wr->wr_id;
-                mad_agent_priv->agent.recv_handler(
-                                                &mad_agent_priv->agent,
-                                                &recv->header.recv_wc);
+                mad_recv_wc->wc->wr_id = mad_send_wr->wr_id;
+                mad_agent_priv->agent.recv_handler(&mad_agent_priv->agent,
+                                                   mad_recv_wc);
                 atomic_dec(&mad_agent_priv->refcount);
 
                 mad_send_wc.status = IB_WC_SUCCESS;
@@ -1560,9 +1637,8 @@ static void ib_mad_complete_recv(struct ib_mad_agent_private *mad_agent_priv,
                 mad_send_wc.wr_id = mad_send_wr->wr_id;
                 ib_mad_complete_send_wr(mad_send_wr, &mad_send_wc);
         } else {
-                mad_agent_priv->agent.recv_handler(
-                                                &mad_agent_priv->agent,
-                                                &recv->header.recv_wc);
+                mad_agent_priv->agent.recv_handler(&mad_agent_priv->agent,
+                                                   mad_recv_wc);
                 if (atomic_dec_and_test(&mad_agent_priv->refcount))
                         wake_up(&mad_agent_priv->wait);
         }
@@ -1576,7 +1652,6 @@ static void ib_mad_recv_done_handler(struct ib_mad_port_private *port_priv,
         struct ib_mad_private *recv, *response;
         struct ib_mad_list_head *mad_list;
         struct ib_mad_agent_private *mad_agent;
-        int solicited;
 
         response = kmem_cache_alloc(ib_mad_cache, GFP_KERNEL);
         if (!response)
@@ -1662,11 +1737,9 @@ local:
                 }
         }
 
-        /* Determine corresponding MAD agent for incoming receive MAD */
-        solicited = solicited_mad(&recv->mad.mad);
-        mad_agent = find_mad_agent(port_priv, &recv->mad.mad, solicited);
+        mad_agent = find_mad_agent(port_priv, &recv->mad.mad);
         if (mad_agent) {
-                ib_mad_complete_recv(mad_agent, recv, solicited);
+                ib_mad_complete_recv(mad_agent, &recv->header.recv_wc);
                 /*
                  * recv is freed up in error cases in ib_mad_complete_recv
                  * or via recv_handler in ib_mad_complete_recv()
@@ -1710,26 +1783,31 @@ static void adjust_timeout(struct ib_mad_agent_private *mad_agent_priv)
         }
 }
 
-static void wait_for_response(struct ib_mad_agent_private *mad_agent_priv,
-                              struct ib_mad_send_wr_private *mad_send_wr )
+static void wait_for_response(struct ib_mad_send_wr_private *mad_send_wr)
 {
+        struct ib_mad_agent_private *mad_agent_priv;
         struct ib_mad_send_wr_private *temp_mad_send_wr;
         struct list_head *list_item;
         unsigned long delay;
 
+        mad_agent_priv = mad_send_wr->mad_agent_priv;
         list_del(&mad_send_wr->agent_list);
 
         delay = mad_send_wr->timeout;
         mad_send_wr->timeout += jiffies;
 
-        list_for_each_prev(list_item, &mad_agent_priv->wait_list) {
-                temp_mad_send_wr = list_entry(list_item,
-                                              struct ib_mad_send_wr_private,
-                                              agent_list);
-                if (time_after(mad_send_wr->timeout,
-                               temp_mad_send_wr->timeout))
-                        break;
+        if (delay) {
+                list_for_each_prev(list_item, &mad_agent_priv->wait_list) {
+                        temp_mad_send_wr = list_entry(list_item,
+                                                struct ib_mad_send_wr_private,
+                                                agent_list);
+                        if (time_after(mad_send_wr->timeout,
+                                       temp_mad_send_wr->timeout))
+                                break;
+                }
         }
+        else
+                list_item = &mad_agent_priv->wait_list;
         list_add(&mad_send_wr->agent_list, list_item);
 
         /* Reschedule a work item if we have a shorter timeout */
@@ -1740,19 +1818,32 @@ static void wait_for_response(struct ib_mad_agent_private *mad_agent_priv,
         }
 }
 
+void ib_reset_mad_timeout(struct ib_mad_send_wr_private *mad_send_wr,
+                          int timeout_ms)
+{
+        mad_send_wr->timeout = msecs_to_jiffies(timeout_ms);
+        wait_for_response(mad_send_wr);
+}
+
 /*
  * Process a send work completion
  */
-static void ib_mad_complete_send_wr(struct ib_mad_send_wr_private *mad_send_wr,
-                                    struct ib_mad_send_wc *mad_send_wc)
+void ib_mad_complete_send_wr(struct ib_mad_send_wr_private *mad_send_wr,
+                             struct ib_mad_send_wc *mad_send_wc)
 {
         struct ib_mad_agent_private     *mad_agent_priv;
         unsigned long                   flags;
+        int                             ret;
 
-        mad_agent_priv = container_of(mad_send_wr->agent,
-                                      struct ib_mad_agent_private, agent);
-
+        mad_agent_priv = mad_send_wr->mad_agent_priv;
         spin_lock_irqsave(&mad_agent_priv->lock, flags);
+        if (mad_agent_priv->agent.rmpp_version) {
+                ret = ib_process_rmpp_send_wc(mad_send_wr, mad_send_wc);
+                if (ret == IB_RMPP_RESULT_CONSUMED)
+                        goto done;
+        } else
+                ret = IB_RMPP_RESULT_UNHANDLED;
+
         if (mad_send_wc->status != IB_WC_SUCCESS &&
             mad_send_wr->status == IB_WC_SUCCESS) {
                 mad_send_wr->status = mad_send_wc->status;
@@ -1762,10 +1853,9 @@ static void ib_mad_complete_send_wr(struct ib_mad_send_wr_private *mad_send_wr,
         if (--mad_send_wr->refcount > 0) {
                 if (mad_send_wr->refcount == 1 && mad_send_wr->timeout &&
                     mad_send_wr->status == IB_WC_SUCCESS) {
-                        wait_for_response(mad_agent_priv, mad_send_wr);
+                        wait_for_response(mad_send_wr);
                 }
-                spin_unlock_irqrestore(&mad_agent_priv->lock, flags);
-                return;
+                goto done;
         }
 
         /* Remove send from MAD agent and notify client of completion */
@@ -1775,14 +1865,18 @@ static void ib_mad_complete_send_wr(struct ib_mad_send_wr_private *mad_send_wr,
 
         if (mad_send_wr->status != IB_WC_SUCCESS )
                 mad_send_wc->status = mad_send_wr->status;
-        mad_agent_priv->agent.send_handler(&mad_agent_priv->agent,
-                                            mad_send_wc);
+        if (ret != IB_RMPP_RESULT_INTERNAL)
+                mad_agent_priv->agent.send_handler(&mad_agent_priv->agent,
+                                                   mad_send_wc);
 
         /* Release reference on agent taken when sending */
         if (atomic_dec_and_test(&mad_agent_priv->refcount))
                 wake_up(&mad_agent_priv->wait);
 
         kfree(mad_send_wr);
+        return;
+done:
+        spin_unlock_irqrestore(&mad_agent_priv->lock, flags);
 }
 
 static void ib_mad_send_done_handler(struct ib_mad_port_private *port_priv,
@@ -1961,6 +2055,8 @@ static void cancel_mads(struct ib_mad_agent_private *mad_agent_priv)
 
         /* Empty wait list to prevent receives from finding a request */
         list_splice_init(&mad_agent_priv->wait_list, &cancel_list);
+        /* Empty local completion list as well */
+        list_splice_init(&mad_agent_priv->local_list, &cancel_list);
         spin_unlock_irqrestore(&mad_agent_priv->lock, flags);
 
         /* Report all cancelled requests */
@@ -1980,8 +2076,7 @@ static void cancel_mads(struct ib_mad_agent_private *mad_agent_priv)
 }
 
 static struct ib_mad_send_wr_private*
-find_send_by_wr_id(struct ib_mad_agent_private *mad_agent_priv,
-                   u64 wr_id)
+find_send_by_wr_id(struct ib_mad_agent_private *mad_agent_priv, u64 wr_id)
 {
         struct ib_mad_send_wr_private *mad_send_wr;
 
@@ -1993,79 +2088,50 @@ find_send_by_wr_id(struct ib_mad_agent_private *mad_agent_priv,
 
         list_for_each_entry(mad_send_wr, &mad_agent_priv->send_list,
                             agent_list) {
-                if (mad_send_wr->wr_id == wr_id)
+                if (is_data_mad(mad_agent_priv,
+                                mad_send_wr->send_wr.wr.ud.mad_hdr) &&
+                    mad_send_wr->wr_id == wr_id)
                         return mad_send_wr;
         }
         return NULL;
 }
 
-void cancel_sends(void *data)
-{
-        struct ib_mad_agent_private *mad_agent_priv;
-        struct ib_mad_send_wr_private *mad_send_wr;
-        struct ib_mad_send_wc mad_send_wc;
-        unsigned long flags;
-
-        mad_agent_priv = data;
-
-        mad_send_wc.status = IB_WC_WR_FLUSH_ERR;
-        mad_send_wc.vendor_err = 0;
-
-        spin_lock_irqsave(&mad_agent_priv->lock, flags);
-        while (!list_empty(&mad_agent_priv->canceled_list)) {
-                mad_send_wr = list_entry(mad_agent_priv->canceled_list.next,
-                                         struct ib_mad_send_wr_private,
-                                         agent_list);
-
-                list_del(&mad_send_wr->agent_list);
-                spin_unlock_irqrestore(&mad_agent_priv->lock, flags);
-
-                mad_send_wc.wr_id = mad_send_wr->wr_id;
-                mad_agent_priv->agent.send_handler(&mad_agent_priv->agent,
-                                                   &mad_send_wc);
-
-                kfree(mad_send_wr);
-                if (atomic_dec_and_test(&mad_agent_priv->refcount))
-                        wake_up(&mad_agent_priv->wait);
-                spin_lock_irqsave(&mad_agent_priv->lock, flags);
-        }
-        spin_unlock_irqrestore(&mad_agent_priv->lock, flags);
-}
-
-void ib_cancel_mad(struct ib_mad_agent *mad_agent,
-                  u64 wr_id)
+int ib_modify_mad(struct ib_mad_agent *mad_agent, u64 wr_id, u32 timeout_ms)
 {
         struct ib_mad_agent_private *mad_agent_priv;
         struct ib_mad_send_wr_private *mad_send_wr;
         unsigned long flags;
+        int active;
 
         mad_agent_priv = container_of(mad_agent, struct ib_mad_agent_private,
                                       agent);
         spin_lock_irqsave(&mad_agent_priv->lock, flags);
         mad_send_wr = find_send_by_wr_id(mad_agent_priv, wr_id);
-        if (!mad_send_wr) {
+        if (!mad_send_wr || mad_send_wr->status != IB_WC_SUCCESS) {
                 spin_unlock_irqrestore(&mad_agent_priv->lock, flags);
-                goto out;
+                return -EINVAL;
         }
 
-        if (mad_send_wr->status == IB_WC_SUCCESS)
-                mad_send_wr->refcount -= (mad_send_wr->timeout > 0);
-
-        if (mad_send_wr->refcount != 0) {
+        active = (!mad_send_wr->timeout || mad_send_wr->refcount > 1);
+        if (!timeout_ms) {
                 mad_send_wr->status = IB_WC_WR_FLUSH_ERR;
-                spin_unlock_irqrestore(&mad_agent_priv->lock, flags);
-                goto out;
+                mad_send_wr->refcount -= (mad_send_wr->timeout > 0);
         }
 
-        list_del(&mad_send_wr->agent_list);
-        list_add_tail(&mad_send_wr->agent_list, &mad_agent_priv->canceled_list);
-        adjust_timeout(mad_agent_priv);
+        mad_send_wr->send_wr.wr.ud.timeout_ms = timeout_ms;
+        if (active)
+                mad_send_wr->timeout = msecs_to_jiffies(timeout_ms);
+        else
+                ib_reset_mad_timeout(mad_send_wr, timeout_ms);
+
         spin_unlock_irqrestore(&mad_agent_priv->lock, flags);
+        return 0;
+}
+EXPORT_SYMBOL(ib_modify_mad);
 
-        queue_work(mad_agent_priv->qp_info->port_priv->wq,
-                   &mad_agent_priv->canceled_work);
-out:
-        return;
+void ib_cancel_mad(struct ib_mad_agent *mad_agent, u64 wr_id)
+{
+        ib_modify_mad(mad_agent, wr_id, 0);
 }
 EXPORT_SYMBOL(ib_cancel_mad);
 
@@ -2075,6 +2141,7 @@ static void local_completions(void *data)
         struct ib_mad_local_private *local;
         struct ib_mad_agent_private *recv_mad_agent;
         unsigned long flags;
+        int recv = 0;
         struct ib_wc wc;
         struct ib_mad_send_wc mad_send_wc;
 
@@ -2090,10 +2157,10 @@ static void local_completions(void *data)
                         recv_mad_agent = local->recv_mad_agent;
                         if (!recv_mad_agent) {
                                 printk(KERN_ERR PFX "No receive MAD agent for local completion\n");
-                                kmem_cache_free(ib_mad_cache, local->mad_priv);
                                 goto local_send_completion;
                         }
 
+                        recv = 1;
                         /*
                          * Defined behavior is to complete response
                          * before request
@@ -2105,7 +2172,9 @@ static void local_completions(void *data)
                         local->mad_priv->header.recv_wc.wc = &wc;
                         local->mad_priv->header.recv_wc.mad_len =
                                                 sizeof(struct ib_mad);
-                        INIT_LIST_HEAD(&local->mad_priv->header.recv_wc.recv_buf.list);
+                        INIT_LIST_HEAD(&local->mad_priv->header.recv_wc.rmpp_list);
+                        list_add(&local->mad_priv->header.recv_wc.recv_buf.list,
+                                 &local->mad_priv->header.recv_wc.rmpp_list);
                         local->mad_priv->header.recv_wc.recv_buf.grh = NULL;
                         local->mad_priv->header.recv_wc.recv_buf.mad =
                                                 &local->mad_priv->mad.mad;
@@ -2136,11 +2205,47 @@ local_send_completion:
                 spin_lock_irqsave(&mad_agent_priv->lock, flags);
                 list_del(&local->completion_list);
                 atomic_dec(&mad_agent_priv->refcount);
+                if (!recv)
+                        kmem_cache_free(ib_mad_cache, local->mad_priv);
                 kfree(local);
         }
         spin_unlock_irqrestore(&mad_agent_priv->lock, flags);
 }
 
+static int retry_send(struct ib_mad_send_wr_private *mad_send_wr)
+{
+        int ret;
+
+        if (!mad_send_wr->retries--)
+                return -ETIMEDOUT;
+
+        mad_send_wr->timeout = msecs_to_jiffies(mad_send_wr->send_wr.
+                                                wr.ud.timeout_ms);
+
+        if (mad_send_wr->mad_agent_priv->agent.rmpp_version) {
+                ret = ib_retry_rmpp(mad_send_wr);
+                switch (ret) {
+                case IB_RMPP_RESULT_UNHANDLED:
+                        ret = ib_send_mad(mad_send_wr);
+                        break;
+                case IB_RMPP_RESULT_CONSUMED:
+                        ret = 0;
+                        break;
+                default:
+                        ret = -ECOMM;
+                        break;
+                }
+        } else
+                ret = ib_send_mad(mad_send_wr);
+
+        if (!ret) {
+                mad_send_wr->refcount++;
+                list_add_tail(&mad_send_wr->agent_list,
+                              &mad_send_wr->mad_agent_priv->send_list);
+        }
+        return ret;
+}
+
 static void timeout_sends(void *data)
 {
         struct ib_mad_agent_private *mad_agent_priv;
@@ -2149,8 +2254,6 @@ static void timeout_sends(void *data)
         unsigned long flags, delay;
 
         mad_agent_priv = (struct ib_mad_agent_private *)data;
-
-        mad_send_wc.status = IB_WC_RESP_TIMEOUT_ERR;
         mad_send_wc.vendor_err = 0;
 
         spin_lock_irqsave(&mad_agent_priv->lock, flags);
@@ -2170,8 +2273,16 @@ static void timeout_sends(void *data)
                 }
 
                 list_del(&mad_send_wr->agent_list);
+                if (mad_send_wr->status == IB_WC_SUCCESS &&
+                    !retry_send(mad_send_wr))
+                        continue;
+
                 spin_unlock_irqrestore(&mad_agent_priv->lock, flags);
 
+                if (mad_send_wr->status == IB_WC_SUCCESS)
+                        mad_send_wc.status = IB_WC_RESP_TIMEOUT_ERR;
+                else
+                        mad_send_wc.status = mad_send_wr->status;
                 mad_send_wc.wr_id = mad_send_wr->wr_id;
                 mad_agent_priv->agent.send_handler(&mad_agent_priv->agent,
                                                    &mad_send_wc);
@@ -2447,14 +2558,6 @@ static int ib_mad_port_open(struct ib_device *device,
         unsigned long flags;
         char name[sizeof "ib_mad123"];
 
-        /* First, check if port already open at MAD layer */
-        port_priv = ib_get_mad_port(device, port_num);
-        if (port_priv) {
-                printk(KERN_DEBUG PFX "%s port %d already open\n",
-                       device->name, port_num);
-                return 0;
-        }
-
         /* Create new device info */
         port_priv = kmalloc(sizeof *port_priv, GFP_KERNEL);
         if (!port_priv) {
@@ -2579,7 +2682,7 @@ static int ib_mad_port_close(struct ib_device *device, int port_num)
 
 static void ib_mad_init_device(struct ib_device *device)
 {
-        int ret, num_ports, cur_port, i, ret2;
+        int num_ports, cur_port, i;
 
         if (device->node_type == IB_NODE_SWITCH) {
                 num_ports = 1;
@@ -2589,47 +2692,37 @@ static void ib_mad_init_device(struct ib_device *device)
                 cur_port = 1;
         }
         for (i = 0; i < num_ports; i++, cur_port++) {
-                ret = ib_mad_port_open(device, cur_port);
-                if (ret) {
+                if (ib_mad_port_open(device, cur_port)) {
                         printk(KERN_ERR PFX "Couldn't open %s port %d\n",
                                device->name, cur_port);
                         goto error_device_open;
                 }
-                ret = ib_agent_port_open(device, cur_port);
-                if (ret) {
+                if (ib_agent_port_open(device, cur_port)) {
                         printk(KERN_ERR PFX "Couldn't open %s port %d "
                                "for agents\n",
                                device->name, cur_port);
                         goto error_device_open;
                 }
         }
-
-        goto error_device_query;
+        return;
 
 error_device_open:
         while (i > 0) {
                 cur_port--;
-                ret2 = ib_agent_port_close(device, cur_port);
-                if (ret2) {
+                if (ib_agent_port_close(device, cur_port))
                         printk(KERN_ERR PFX "Couldn't close %s port %d "
                                "for agents\n",
                                device->name, cur_port);
-                }
-                ret2 = ib_mad_port_close(device, cur_port);
-                if (ret2) {
+                if (ib_mad_port_close(device, cur_port))
                         printk(KERN_ERR PFX "Couldn't close %s port %d\n",
                                device->name, cur_port);
-                }
                 i--;
         }
-
-error_device_query:
-        return;
 }
 
 static void ib_mad_remove_device(struct ib_device *device)
 {
-        int ret = 0, i, num_ports, cur_port, ret2;
+        int i, num_ports, cur_port;
 
         if (device->node_type == IB_NODE_SWITCH) {
                 num_ports = 1;
@@ -2639,21 +2732,13 @@ static void ib_mad_remove_device(struct ib_device *device)
                 cur_port = 1;
         }
         for (i = 0; i < num_ports; i++, cur_port++) {
-                ret2 = ib_agent_port_close(device, cur_port);
-                if (ret2) {
+                if (ib_agent_port_close(device, cur_port))
                         printk(KERN_ERR PFX "Couldn't close %s port %d "
                                "for agents\n",
                                device->name, cur_port);
-                        if (!ret)
-                                ret = ret2;
-                }
-                ret2 = ib_mad_port_close(device, cur_port);
-                if (ret2) {
+                if (ib_mad_port_close(device, cur_port))
                         printk(KERN_ERR PFX "Couldn't close %s port %d\n",
                                device->name, cur_port);
-                        if (!ret)
-                                ret = ret2;
-                }
         }
 }
 
@@ -2709,3 +2794,4 @@ static void __exit ib_mad_cleanup_module(void)
 
 module_init(ib_mad_init_module);
 module_exit(ib_mad_cleanup_module);
+
diff --git a/drivers/infiniband/core/mad_priv.h b/drivers/infiniband/core/mad_priv.h
index 008cbcb94b15..568da10b05ab 100644
--- a/drivers/infiniband/core/mad_priv.h
+++ b/drivers/infiniband/core/mad_priv.h
@@ -1,5 +1,7 @@
 /*
  * Copyright (c) 2004, 2005, Voltaire, Inc. All rights reserved.
+ * Copyright (c) 2005 Intel Corporation. All rights reserved.
+ * Copyright (c) 2005 Sun Microsystems, Inc. All rights reserved.
  *
  * This software is available to you under a choice of one of two
  * licenses.  You may choose to be licensed under the terms of the GNU
@@ -29,7 +31,7 @@
  * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
  * SOFTWARE.
  *
- * $Id: mad_priv.h 1389 2004-12-27 22:56:47Z roland $
+ * $Id: mad_priv.h 2730 2005-06-28 16:43:03Z sean.hefty $
  */
 
 #ifndef __IB_MAD_PRIV_H__
@@ -92,16 +94,15 @@ struct ib_mad_agent_private {
         spinlock_t lock;
         struct list_head send_list;
         struct list_head wait_list;
+        struct list_head done_list;
         struct work_struct timed_work;
         unsigned long timeout;
         struct list_head local_list;
         struct work_struct local_work;
-        struct list_head canceled_list;
-        struct work_struct canceled_work;
+        struct list_head rmpp_list;
 
         atomic_t refcount;
         wait_queue_head_t wait;
-        u8 rmpp_version;
 };
 
 struct ib_mad_snoop_private {
@@ -116,15 +117,24 @@ struct ib_mad_snoop_private {
 struct ib_mad_send_wr_private {
         struct ib_mad_list_head mad_list;
         struct list_head agent_list;
-        struct ib_mad_agent *agent;
+        struct ib_mad_agent_private *mad_agent_priv;
         struct ib_send_wr send_wr;
         struct ib_sge sg_list[IB_MAD_SEND_REQ_MAX_SG];
         u64 wr_id;                      /* client WR ID */
         u64 tid;
         unsigned long timeout;
+        int retries;
         int retry;
         int refcount;
         enum ib_wc_status status;
+
+        /* RMPP control */
+        int last_ack;
+        int seg_num;
+        int newwin;
+        int total_seg;
+        int data_offset;
+        int pad;
 };
 
 struct ib_mad_local_private {
@@ -197,4 +207,17 @@ struct ib_mad_port_private {
 
 extern kmem_cache_t *ib_mad_cache;
 
+int ib_send_mad(struct ib_mad_send_wr_private *mad_send_wr);
+
+struct ib_mad_send_wr_private *
+ib_find_send_mad(struct ib_mad_agent_private *mad_agent_priv, u64 tid);
+
+void ib_mad_complete_send_wr(struct ib_mad_send_wr_private *mad_send_wr,
+                             struct ib_mad_send_wc *mad_send_wc);
+
+void ib_mark_mad_done(struct ib_mad_send_wr_private *mad_send_wr);
+
+void ib_reset_mad_timeout(struct ib_mad_send_wr_private *mad_send_wr,
+                          int timeout_ms);
+
 #endif  /* __IB_MAD_PRIV_H__ */
diff --git a/drivers/infiniband/core/mad_rmpp.c b/drivers/infiniband/core/mad_rmpp.c
new file mode 100644
index 000000000000..8f1eb80e421f
--- /dev/null
+++ b/drivers/infiniband/core/mad_rmpp.c
@@ -0,0 +1,765 @@
+/*
+ * Copyright (c) 2005 Intel Inc. All rights reserved.
+ * Copyright (c) 2005 Voltaire, Inc. All rights reserved.
+ *
+ * This software is available to you under a choice of one of two
+ * licenses.  You may choose to be licensed under the terms of the GNU
+ * General Public License (GPL) Version 2, available from the file
+ * COPYING in the main directory of this source tree, or the
+ * OpenIB.org BSD license below:
+ *
+ *     Redistribution and use in source and binary forms, with or
+ *     without modification, are permitted provided that the following
+ *     conditions are met:
+ *
+ *      - Redistributions of source code must retain the above
+ *        copyright notice, this list of conditions and the following
+ *        disclaimer.
+ *
+ *      - Redistributions in binary form must reproduce the above
+ *        copyright notice, this list of conditions and the following
+ *        disclaimer in the documentation and/or other materials
+ *        provided with the distribution.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+ * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+ * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+ * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
+ * BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
+ * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
+ * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+ * SOFTWARE.
+ *
+ * $Id: mad_rmpp.c 1921 2005-03-02 22:58:44Z sean.hefty $
+ */
+
+#include <linux/dma-mapping.h>
+
+#include "mad_priv.h"
+#include "mad_rmpp.h"
+
+enum rmpp_state {
+        RMPP_STATE_ACTIVE,
+        RMPP_STATE_TIMEOUT,
+        RMPP_STATE_COMPLETE
+};
+
+struct mad_rmpp_recv {
+        struct ib_mad_agent_private *agent;
+        struct list_head list;
+        struct work_struct timeout_work;
+        struct work_struct cleanup_work;
+        wait_queue_head_t wait;
+        enum rmpp_state state;
+        spinlock_t lock;
+        atomic_t refcount;
+
+        struct ib_ah *ah;
+        struct ib_mad_recv_wc *rmpp_wc;
+        struct ib_mad_recv_buf *cur_seg_buf;
+        int last_ack;
+        int seg_num;
+        int newwin;
+
+        u64 tid;
+        u32 src_qp;
+        u16 slid;
+        u8 mgmt_class;
+        u8 class_version;
+        u8 method;
+};
+
+static void destroy_rmpp_recv(struct mad_rmpp_recv *rmpp_recv)
+{
+        atomic_dec(&rmpp_recv->refcount);
+        wait_event(rmpp_recv->wait, !atomic_read(&rmpp_recv->refcount));
+        ib_destroy_ah(rmpp_recv->ah);
+        kfree(rmpp_recv);
+}
+
+void ib_cancel_rmpp_recvs(struct ib_mad_agent_private *agent)
+{
+        struct mad_rmpp_recv *rmpp_recv, *temp_rmpp_recv;
+        unsigned long flags;
+
+        spin_lock_irqsave(&agent->lock, flags);
+        list_for_each_entry(rmpp_recv, &agent->rmpp_list, list) {
+                cancel_delayed_work(&rmpp_recv->timeout_work);
+                cancel_delayed_work(&rmpp_recv->cleanup_work);
+        }
+        spin_unlock_irqrestore(&agent->lock, flags);
+
+        flush_workqueue(agent->qp_info->port_priv->wq);
+
+        list_for_each_entry_safe(rmpp_recv, temp_rmpp_recv,
+                                 &agent->rmpp_list, list) {
+                list_del(&rmpp_recv->list);
+                if (rmpp_recv->state != RMPP_STATE_COMPLETE)
+                        ib_free_recv_mad(rmpp_recv->rmpp_wc);
+                destroy_rmpp_recv(rmpp_recv);
+        }
+}
+
+static void recv_timeout_handler(void *data)
+{
+        struct mad_rmpp_recv *rmpp_recv = data;
+        struct ib_mad_recv_wc *rmpp_wc;
+        unsigned long flags;
+
+        spin_lock_irqsave(&rmpp_recv->agent->lock, flags);
+        if (rmpp_recv->state != RMPP_STATE_ACTIVE) {
+                spin_unlock_irqrestore(&rmpp_recv->agent->lock, flags);
+                return;
+        }
+        rmpp_recv->state = RMPP_STATE_TIMEOUT;
+        list_del(&rmpp_recv->list);
+        spin_unlock_irqrestore(&rmpp_recv->agent->lock, flags);
+
+        /* TODO: send abort. */
+        rmpp_wc = rmpp_recv->rmpp_wc;
+        destroy_rmpp_recv(rmpp_recv);
+        ib_free_recv_mad(rmpp_wc);
+}
+
+static void recv_cleanup_handler(void *data)
+{
+        struct mad_rmpp_recv *rmpp_recv = data;
+        unsigned long flags;
+
+        spin_lock_irqsave(&rmpp_recv->agent->lock, flags);
+        list_del(&rmpp_recv->list);
+        spin_unlock_irqrestore(&rmpp_recv->agent->lock, flags);
+        destroy_rmpp_recv(rmpp_recv);
+}
+
+static struct mad_rmpp_recv *
+create_rmpp_recv(struct ib_mad_agent_private *agent,
+                 struct ib_mad_recv_wc *mad_recv_wc)
+{
+        struct mad_rmpp_recv *rmpp_recv;
+        struct ib_mad_hdr *mad_hdr;
+
+        rmpp_recv = kmalloc(sizeof *rmpp_recv, GFP_KERNEL);
+        if (!rmpp_recv)
+                return NULL;
+
+        rmpp_recv->ah = ib_create_ah_from_wc(agent->agent.qp->pd,
+                                             mad_recv_wc->wc,
+                                             mad_recv_wc->recv_buf.grh,
+                                             agent->agent.port_num);
+        if (IS_ERR(rmpp_recv->ah))
+                goto error;
+
+        rmpp_recv->agent = agent;
+        init_waitqueue_head(&rmpp_recv->wait);
+        INIT_WORK(&rmpp_recv->timeout_work, recv_timeout_handler, rmpp_recv);
+        INIT_WORK(&rmpp_recv->cleanup_work, recv_cleanup_handler, rmpp_recv);
+        spin_lock_init(&rmpp_recv->lock);
+        rmpp_recv->state = RMPP_STATE_ACTIVE;
+        atomic_set(&rmpp_recv->refcount, 1);
+
+        rmpp_recv->rmpp_wc = mad_recv_wc;
+        rmpp_recv->cur_seg_buf = &mad_recv_wc->recv_buf;
+        rmpp_recv->newwin = 1;
+        rmpp_recv->seg_num = 1;
+        rmpp_recv->last_ack = 0;
+
+        mad_hdr = &mad_recv_wc->recv_buf.mad->mad_hdr;
+        rmpp_recv->tid = mad_hdr->tid;
+        rmpp_recv->src_qp = mad_recv_wc->wc->src_qp;
+        rmpp_recv->slid = mad_recv_wc->wc->slid;
+        rmpp_recv->mgmt_class = mad_hdr->mgmt_class;
+        rmpp_recv->class_version = mad_hdr->class_version;
+        rmpp_recv->method  = mad_hdr->method;
+        return rmpp_recv;
+
+error:  kfree(rmpp_recv);
+        return NULL;
+}
+
+static inline void deref_rmpp_recv(struct mad_rmpp_recv *rmpp_recv)
+{
+        if (atomic_dec_and_test(&rmpp_recv->refcount))
+                wake_up(&rmpp_recv->wait);
+}
+
+static struct mad_rmpp_recv *
+find_rmpp_recv(struct ib_mad_agent_private *agent,
+               struct ib_mad_recv_wc *mad_recv_wc)
+{
+        struct mad_rmpp_recv *rmpp_recv;
+        struct ib_mad_hdr *mad_hdr = &mad_recv_wc->recv_buf.mad->mad_hdr;
+
+        list_for_each_entry(rmpp_recv, &agent->rmpp_list, list) {
+                if (rmpp_recv->tid == mad_hdr->tid &&
+                    rmpp_recv->src_qp == mad_recv_wc->wc->src_qp &&
+                    rmpp_recv->slid == mad_recv_wc->wc->slid &&
+                    rmpp_recv->mgmt_class == mad_hdr->mgmt_class &&
+                    rmpp_recv->class_version == mad_hdr->class_version &&
+                    rmpp_recv->method == mad_hdr->method)
+                        return rmpp_recv;
+        }
+        return NULL;
+}
+
+static struct mad_rmpp_recv *
+acquire_rmpp_recv(struct ib_mad_agent_private *agent,
+                  struct ib_mad_recv_wc *mad_recv_wc)
+{
+        struct mad_rmpp_recv *rmpp_recv;
+        unsigned long flags;
+
+        spin_lock_irqsave(&agent->lock, flags);
+        rmpp_recv = find_rmpp_recv(agent, mad_recv_wc);
+        if (rmpp_recv)
+                atomic_inc(&rmpp_recv->refcount);
+        spin_unlock_irqrestore(&agent->lock, flags);
+        return rmpp_recv;
+}
+
+static struct mad_rmpp_recv *
+insert_rmpp_recv(struct ib_mad_agent_private *agent,
+                 struct mad_rmpp_recv *rmpp_recv)
+{
+        struct mad_rmpp_recv *cur_rmpp_recv;
+
+        cur_rmpp_recv = find_rmpp_recv(agent, rmpp_recv->rmpp_wc);
+        if (!cur_rmpp_recv)
+                list_add_tail(&rmpp_recv->list, &agent->rmpp_list);
+
+        return cur_rmpp_recv;
+}
+
+static int data_offset(u8 mgmt_class)
+{
+        if (mgmt_class == IB_MGMT_CLASS_SUBN_ADM)
+                return offsetof(struct ib_sa_mad, data);
+        else if ((mgmt_class >= IB_MGMT_CLASS_VENDOR_RANGE2_START) &&
+                 (mgmt_class <= IB_MGMT_CLASS_VENDOR_RANGE2_END))
+                return offsetof(struct ib_vendor_mad, data);
+        else
+                return offsetof(struct ib_rmpp_mad, data);
+}
+
+static void format_ack(struct ib_rmpp_mad *ack,
+                       struct ib_rmpp_mad *data,
+                       struct mad_rmpp_recv *rmpp_recv)
+{
+        unsigned long flags;
+
+        memcpy(&ack->mad_hdr, &data->mad_hdr,
+               data_offset(data->mad_hdr.mgmt_class));
+
+        ack->mad_hdr.method ^= IB_MGMT_METHOD_RESP;
+        ack->rmpp_hdr.rmpp_type = IB_MGMT_RMPP_TYPE_ACK;
+        ib_set_rmpp_flags(&ack->rmpp_hdr, IB_MGMT_RMPP_FLAG_ACTIVE);
+
+        spin_lock_irqsave(&rmpp_recv->lock, flags);
+        rmpp_recv->last_ack = rmpp_recv->seg_num;
+        ack->rmpp_hdr.seg_num = cpu_to_be32(rmpp_recv->seg_num);
+        ack->rmpp_hdr.paylen_newwin = cpu_to_be32(rmpp_recv->newwin);
+        spin_unlock_irqrestore(&rmpp_recv->lock, flags);
+}
+
+static void ack_recv(struct mad_rmpp_recv *rmpp_recv,
+                     struct ib_mad_recv_wc *recv_wc)
+{
+        struct ib_mad_send_buf *msg;
+        struct ib_send_wr *bad_send_wr;
+        int hdr_len, ret;
+
+        hdr_len = sizeof(struct ib_mad_hdr) + sizeof(struct ib_rmpp_hdr);
+        msg = ib_create_send_mad(&rmpp_recv->agent->agent, recv_wc->wc->src_qp,
+                                 recv_wc->wc->pkey_index, rmpp_recv->ah, 1,
+                                 hdr_len, sizeof(struct ib_rmpp_mad) - hdr_len,
+                                 GFP_KERNEL);
+        if (!msg)
+                return;
+
+        format_ack((struct ib_rmpp_mad *) msg->mad,
+                   (struct ib_rmpp_mad *) recv_wc->recv_buf.mad, rmpp_recv);
+        ret = ib_post_send_mad(&rmpp_recv->agent->agent, &msg->send_wr,
+                               &bad_send_wr);
+        if (ret)
+                ib_free_send_mad(msg);
+}
+
+static inline int get_last_flag(struct ib_mad_recv_buf *seg)
+{
+        struct ib_rmpp_mad *rmpp_mad;
+
+        rmpp_mad = (struct ib_rmpp_mad *) seg->mad;
+        return ib_get_rmpp_flags(&rmpp_mad->rmpp_hdr) & IB_MGMT_RMPP_FLAG_LAST;
+}
+
+static inline int get_seg_num(struct ib_mad_recv_buf *seg)
+{
+        struct ib_rmpp_mad *rmpp_mad;
+
+        rmpp_mad = (struct ib_rmpp_mad *) seg->mad;
+        return be32_to_cpu(rmpp_mad->rmpp_hdr.seg_num);
+}
+
+static inline struct ib_mad_recv_buf * get_next_seg(struct list_head *rmpp_list,
+                                                    struct ib_mad_recv_buf *seg)
+{
+        if (seg->list.next == rmpp_list)
+                return NULL;
+
+        return container_of(seg->list.next, struct ib_mad_recv_buf, list);
+}
+
+static inline int window_size(struct ib_mad_agent_private *agent)
+{
+        return max(agent->qp_info->recv_queue.max_active >> 3, 1);
+}
+
+static struct ib_mad_recv_buf * find_seg_location(struct list_head *rmpp_list,
+                                                  int seg_num)
+{
+        struct ib_mad_recv_buf *seg_buf;
+        int cur_seg_num;
+
+        list_for_each_entry_reverse(seg_buf, rmpp_list, list) {
+                cur_seg_num = get_seg_num(seg_buf);
+                if (seg_num > cur_seg_num)
+                        return seg_buf;
+                if (seg_num == cur_seg_num)
+                        break;
+        }
+        return NULL;
+}
+
+static void update_seg_num(struct mad_rmpp_recv *rmpp_recv,
+                           struct ib_mad_recv_buf *new_buf)
+{
+        struct list_head *rmpp_list = &rmpp_recv->rmpp_wc->rmpp_list;
+
+        while (new_buf && (get_seg_num(new_buf) == rmpp_recv->seg_num + 1)) {
+                rmpp_recv->cur_seg_buf = new_buf;
+                rmpp_recv->seg_num++;
+                new_buf = get_next_seg(rmpp_list, new_buf);
+        }
+}
+
+static inline int get_mad_len(struct mad_rmpp_recv *rmpp_recv)
+{
+        struct ib_rmpp_mad *rmpp_mad;
+        int hdr_size, data_size, pad;
+
+        rmpp_mad = (struct ib_rmpp_mad *)rmpp_recv->cur_seg_buf->mad;
+
+        hdr_size = data_offset(rmpp_mad->mad_hdr.mgmt_class);
+        data_size = sizeof(struct ib_rmpp_mad) - hdr_size;
+        pad = data_size - be32_to_cpu(rmpp_mad->rmpp_hdr.paylen_newwin);
+        if (pad > data_size || pad < 0)
+                pad = 0;
+
+        return hdr_size + rmpp_recv->seg_num * data_size - pad;
+}
+
+static struct ib_mad_recv_wc * complete_rmpp(struct mad_rmpp_recv *rmpp_recv)
+{
+        struct ib_mad_recv_wc *rmpp_wc;
+
+        ack_recv(rmpp_recv, rmpp_recv->rmpp_wc);
+        if (rmpp_recv->seg_num > 1)
+                cancel_delayed_work(&rmpp_recv->timeout_work);
+
+        rmpp_wc = rmpp_recv->rmpp_wc;
+        rmpp_wc->mad_len = get_mad_len(rmpp_recv);
+        /* 10 seconds until we can find the packet lifetime */
+        queue_delayed_work(rmpp_recv->agent->qp_info->port_priv->wq,
+                           &rmpp_recv->cleanup_work, msecs_to_jiffies(10000));
+        return rmpp_wc;
+}
+
+void ib_coalesce_recv_mad(struct ib_mad_recv_wc *mad_recv_wc, void *buf)
+{
+        struct ib_mad_recv_buf *seg_buf;
+        struct ib_rmpp_mad *rmpp_mad;
+        void *data;
+        int size, len, offset;
+        u8 flags;
+
+        len = mad_recv_wc->mad_len;
+        if (len <= sizeof(struct ib_mad)) {
+                memcpy(buf, mad_recv_wc->recv_buf.mad, len);
+                return;
+        }
+
+        offset = data_offset(mad_recv_wc->recv_buf.mad->mad_hdr.mgmt_class);
+
+        list_for_each_entry(seg_buf, &mad_recv_wc->rmpp_list, list) {
+                rmpp_mad = (struct ib_rmpp_mad *)seg_buf->mad;
+                flags = ib_get_rmpp_flags(&rmpp_mad->rmpp_hdr);
+
+                if (flags & IB_MGMT_RMPP_FLAG_FIRST) {
+                        data = rmpp_mad;
+                        size = sizeof(*rmpp_mad);
+                } else {
+                        data = (void *) rmpp_mad + offset;
+                        if (flags & IB_MGMT_RMPP_FLAG_LAST)
+                                size = len;
+                        else
+                                size = sizeof(*rmpp_mad) - offset;
+                }
+
+                memcpy(buf, data, size);
+                len -= size;
+                buf += size;
+        }
+}
+EXPORT_SYMBOL(ib_coalesce_recv_mad);
+
+static struct ib_mad_recv_wc *
+continue_rmpp(struct ib_mad_agent_private *agent,
+              struct ib_mad_recv_wc *mad_recv_wc)
+{
+        struct mad_rmpp_recv *rmpp_recv;
+        struct ib_mad_recv_buf *prev_buf;
+        struct ib_mad_recv_wc *done_wc;
+        int seg_num;
+        unsigned long flags;
+
+        rmpp_recv = acquire_rmpp_recv(agent, mad_recv_wc);
+        if (!rmpp_recv)
+                goto drop1;
+
+        seg_num = get_seg_num(&mad_recv_wc->recv_buf);
+
+        spin_lock_irqsave(&rmpp_recv->lock, flags);
+        if ((rmpp_recv->state == RMPP_STATE_TIMEOUT) ||
+            (seg_num > rmpp_recv->newwin))
+                goto drop3;
+
+        if ((seg_num <= rmpp_recv->last_ack) ||
+            (rmpp_recv->state == RMPP_STATE_COMPLETE)) {
+                spin_unlock_irqrestore(&rmpp_recv->lock, flags);
+                ack_recv(rmpp_recv, mad_recv_wc);
+                goto drop2;
+        }
+
+        prev_buf = find_seg_location(&rmpp_recv->rmpp_wc->rmpp_list, seg_num);
+        if (!prev_buf)
+                goto drop3;
+
+        done_wc = NULL;
+        list_add(&mad_recv_wc->recv_buf.list, &prev_buf->list);
+        if (rmpp_recv->cur_seg_buf == prev_buf) {
+                update_seg_num(rmpp_recv, &mad_recv_wc->recv_buf);
+                if (get_last_flag(rmpp_recv->cur_seg_buf)) {
+                        rmpp_recv->state = RMPP_STATE_COMPLETE;
+                        spin_unlock_irqrestore(&rmpp_recv->lock, flags);
+                        done_wc = complete_rmpp(rmpp_recv);
+                        goto out;
+                } else if (rmpp_recv->seg_num == rmpp_recv->newwin) {
+                        rmpp_recv->newwin += window_size(agent);
+                        spin_unlock_irqrestore(&rmpp_recv->lock, flags);
+                        ack_recv(rmpp_recv, mad_recv_wc);
+                        goto out;
+                }
+        }
+        spin_unlock_irqrestore(&rmpp_recv->lock, flags);
+out:
+        deref_rmpp_recv(rmpp_recv);
+        return done_wc;
+
+drop3:  spin_unlock_irqrestore(&rmpp_recv->lock, flags);
+drop2:  deref_rmpp_recv(rmpp_recv);
+drop1:  ib_free_recv_mad(mad_recv_wc);
+        return NULL;
+}
+
+static struct ib_mad_recv_wc *
+start_rmpp(struct ib_mad_agent_private *agent,
+           struct ib_mad_recv_wc *mad_recv_wc)
+{
+        struct mad_rmpp_recv *rmpp_recv;
+        unsigned long flags;
+
+        rmpp_recv = create_rmpp_recv(agent, mad_recv_wc);
+        if (!rmpp_recv) {
+                ib_free_recv_mad(mad_recv_wc);
+                return NULL;
+        }
+
+        spin_lock_irqsave(&agent->lock, flags);
+        if (insert_rmpp_recv(agent, rmpp_recv)) {
+                spin_unlock_irqrestore(&agent->lock, flags);
+                /* duplicate first MAD */
+                destroy_rmpp_recv(rmpp_recv);
+                return continue_rmpp(agent, mad_recv_wc);
+        }
+        atomic_inc(&rmpp_recv->refcount);
+
+        if (get_last_flag(&mad_recv_wc->recv_buf)) {
+                rmpp_recv->state = RMPP_STATE_COMPLETE;
+                spin_unlock_irqrestore(&agent->lock, flags);
+                complete_rmpp(rmpp_recv);
+        } else {
+                spin_unlock_irqrestore(&agent->lock, flags);
+                /* 40 seconds until we can find the packet lifetimes */
+                queue_delayed_work(agent->qp_info->port_priv->wq,
+                                   &rmpp_recv->timeout_work,
+                                   msecs_to_jiffies(40000));
+                rmpp_recv->newwin += window_size(agent);
+                ack_recv(rmpp_recv, mad_recv_wc);
+                mad_recv_wc = NULL;
+        }
+        deref_rmpp_recv(rmpp_recv);
+        return mad_recv_wc;
+}
+
+static inline u64 get_seg_addr(struct ib_mad_send_wr_private *mad_send_wr)
+{
+        return mad_send_wr->sg_list[0].addr + mad_send_wr->data_offset +
+               (sizeof(struct ib_rmpp_mad) - mad_send_wr->data_offset) *
+               (mad_send_wr->seg_num - 1);
+}
+
+static int send_next_seg(struct ib_mad_send_wr_private *mad_send_wr)
+{
+        struct ib_rmpp_mad *rmpp_mad;
+        int timeout;
+
+        rmpp_mad = (struct ib_rmpp_mad *)mad_send_wr->send_wr.wr.ud.mad_hdr;
+        ib_set_rmpp_flags(&rmpp_mad->rmpp_hdr, IB_MGMT_RMPP_FLAG_ACTIVE);
+        rmpp_mad->rmpp_hdr.seg_num = cpu_to_be32(mad_send_wr->seg_num);
+
+        if (mad_send_wr->seg_num == 1) {
+                rmpp_mad->rmpp_hdr.rmpp_rtime_flags |= IB_MGMT_RMPP_FLAG_FIRST;
+                rmpp_mad->rmpp_hdr.paylen_newwin =
+                        cpu_to_be32(mad_send_wr->total_seg *
+                                    (sizeof(struct ib_rmpp_mad) -
+                                       offsetof(struct ib_rmpp_mad, data)));
+                mad_send_wr->sg_list[0].length = sizeof(struct ib_rmpp_mad);
+        } else {
+                mad_send_wr->send_wr.num_sge = 2;
+                mad_send_wr->sg_list[0].length = mad_send_wr->data_offset;
+                mad_send_wr->sg_list[1].addr = get_seg_addr(mad_send_wr);
+                mad_send_wr->sg_list[1].length = sizeof(struct ib_rmpp_mad) -
+                                                 mad_send_wr->data_offset;
+                mad_send_wr->sg_list[1].lkey = mad_send_wr->sg_list[0].lkey;
+        }
+
+        if (mad_send_wr->seg_num == mad_send_wr->total_seg) {
+                rmpp_mad->rmpp_hdr.rmpp_rtime_flags |= IB_MGMT_RMPP_FLAG_LAST;
+                rmpp_mad->rmpp_hdr.paylen_newwin =
+                        cpu_to_be32(sizeof(struct ib_rmpp_mad) -
+                                    offsetof(struct ib_rmpp_mad, data) -
+                                    mad_send_wr->pad);
+        }
+
+        /* 2 seconds for an ACK until we can find the packet lifetime */
+        timeout = mad_send_wr->send_wr.wr.ud.timeout_ms;
+        if (!timeout || timeout > 2000)
+                mad_send_wr->timeout = msecs_to_jiffies(2000);
+        mad_send_wr->seg_num++;
+        return ib_send_mad(mad_send_wr);
+}
+
+static void process_rmpp_ack(struct ib_mad_agent_private *agent,
+                             struct ib_mad_recv_wc *mad_recv_wc)
+{
+        struct ib_mad_send_wr_private *mad_send_wr;
+        struct ib_rmpp_mad *rmpp_mad;
+        unsigned long flags;
+        int seg_num, newwin, ret;
+
+        rmpp_mad = (struct ib_rmpp_mad *)mad_recv_wc->recv_buf.mad;
+        if (rmpp_mad->rmpp_hdr.rmpp_status)
+                return;
+
+        seg_num = be32_to_cpu(rmpp_mad->rmpp_hdr.seg_num);
+        newwin = be32_to_cpu(rmpp_mad->rmpp_hdr.paylen_newwin);
+
+        spin_lock_irqsave(&agent->lock, flags);
+        mad_send_wr = ib_find_send_mad(agent, rmpp_mad->mad_hdr.tid);
+        if (!mad_send_wr)
+                goto out;       /* Unmatched ACK */
+
+        if ((mad_send_wr->last_ack == mad_send_wr->total_seg) ||
+            (!mad_send_wr->timeout) || (mad_send_wr->status != IB_WC_SUCCESS))
+                goto out;       /* Send is already done */
+
+        if (seg_num > mad_send_wr->total_seg)
+                goto out;       /* Bad ACK */
+
+        if (newwin < mad_send_wr->newwin || seg_num < mad_send_wr->last_ack)
+                goto out;       /* Old ACK */
+
+        if (seg_num > mad_send_wr->last_ack) {
+                mad_send_wr->last_ack = seg_num;
+                mad_send_wr->retries = mad_send_wr->send_wr.wr.ud.retries;
+        }
+        mad_send_wr->newwin = newwin;
+        if (mad_send_wr->last_ack == mad_send_wr->total_seg) {
+                /* If no response is expected, the ACK completes the send */
+                if (!mad_send_wr->send_wr.wr.ud.timeout_ms) {
+                        struct ib_mad_send_wc wc;
+
+                        ib_mark_mad_done(mad_send_wr);
+                        spin_unlock_irqrestore(&agent->lock, flags);
+
+                        wc.status = IB_WC_SUCCESS;
+                        wc.vendor_err = 0;
+                        wc.wr_id = mad_send_wr->wr_id;
+                        ib_mad_complete_send_wr(mad_send_wr, &wc);
+                        return;
+                }
+                if (mad_send_wr->refcount == 1)
+                        ib_reset_mad_timeout(mad_send_wr, mad_send_wr->
+                                             send_wr.wr.ud.timeout_ms);
+        } else if (mad_send_wr->refcount == 1 &&
+                   mad_send_wr->seg_num < mad_send_wr->newwin &&
+                   mad_send_wr->seg_num <= mad_send_wr->total_seg) {
+                /* Send failure will just result in a timeout/retry */
+                ret = send_next_seg(mad_send_wr);
+                if (ret)
+                        goto out;
+
+                mad_send_wr->refcount++;
+                list_del(&mad_send_wr->agent_list);
+                list_add_tail(&mad_send_wr->agent_list,
+                              &mad_send_wr->mad_agent_priv->send_list);
+        }
+out:
+        spin_unlock_irqrestore(&agent->lock, flags);
+}
+
+struct ib_mad_recv_wc *
+ib_process_rmpp_recv_wc(struct ib_mad_agent_private *agent,
+                        struct ib_mad_recv_wc *mad_recv_wc)
+{
+        struct ib_rmpp_mad *rmpp_mad;
+
+        rmpp_mad = (struct ib_rmpp_mad *)mad_recv_wc->recv_buf.mad;
+        if (!(rmpp_mad->rmpp_hdr.rmpp_rtime_flags & IB_MGMT_RMPP_FLAG_ACTIVE))
+                return mad_recv_wc;
+
+        if (rmpp_mad->rmpp_hdr.rmpp_version != IB_MGMT_RMPP_VERSION)
+                goto out;
+
+        switch (rmpp_mad->rmpp_hdr.rmpp_type) {
+        case IB_MGMT_RMPP_TYPE_DATA:
+                if (rmpp_mad->rmpp_hdr.seg_num == __constant_htonl(1))
+                        return start_rmpp(agent, mad_recv_wc);
+                else
+                        return continue_rmpp(agent, mad_recv_wc);
+        case IB_MGMT_RMPP_TYPE_ACK:
+                process_rmpp_ack(agent, mad_recv_wc);
+                break;
+        case IB_MGMT_RMPP_TYPE_STOP:
+        case IB_MGMT_RMPP_TYPE_ABORT:
+                /* TODO: process_rmpp_nack(agent, mad_recv_wc); */
+                break;
+        default:
+                break;
+        }
+out:
+        ib_free_recv_mad(mad_recv_wc);
+        return NULL;
+}
+
+int ib_send_rmpp_mad(struct ib_mad_send_wr_private *mad_send_wr)
+{
+        struct ib_rmpp_mad *rmpp_mad;
+        int i, total_len, ret;
+
+        rmpp_mad = (struct ib_rmpp_mad *)mad_send_wr->send_wr.wr.ud.mad_hdr;
+        if (!(ib_get_rmpp_flags(&rmpp_mad->rmpp_hdr) &
+              IB_MGMT_RMPP_FLAG_ACTIVE))
+                return IB_RMPP_RESULT_UNHANDLED;
+
+        if (rmpp_mad->rmpp_hdr.rmpp_type != IB_MGMT_RMPP_TYPE_DATA)
+                return IB_RMPP_RESULT_INTERNAL;
+
+        if (mad_send_wr->send_wr.num_sge > 1)
+                return -EINVAL;         /* TODO: support num_sge > 1 */
+
+        mad_send_wr->seg_num = 1;
+        mad_send_wr->newwin = 1;
+        mad_send_wr->data_offset = data_offset(rmpp_mad->mad_hdr.mgmt_class);
+
+        total_len = 0;
+        for (i = 0; i < mad_send_wr->send_wr.num_sge; i++)
+                total_len += mad_send_wr->send_wr.sg_list[i].length;
+
+        mad_send_wr->total_seg = (total_len - mad_send_wr->data_offset) /
+                        (sizeof(struct ib_rmpp_mad) - mad_send_wr->data_offset);
+        mad_send_wr->pad = total_len - offsetof(struct ib_rmpp_mad, data) -
+                           be32_to_cpu(rmpp_mad->rmpp_hdr.paylen_newwin);
+
+        /* We need to wait for the final ACK even if there isn't a response */
+        mad_send_wr->refcount += (mad_send_wr->timeout == 0);
+        ret = send_next_seg(mad_send_wr);
+        if (!ret)
+                return IB_RMPP_RESULT_CONSUMED;
+        return ret;
+}
+
+int ib_process_rmpp_send_wc(struct ib_mad_send_wr_private *mad_send_wr,
+                            struct ib_mad_send_wc *mad_send_wc)
+{
+        struct ib_rmpp_mad *rmpp_mad;
+        struct ib_mad_send_buf *msg;
+        int ret;
+
+        rmpp_mad = (struct ib_rmpp_mad *)mad_send_wr->send_wr.wr.ud.mad_hdr;
+        if (!(ib_get_rmpp_flags(&rmpp_mad->rmpp_hdr) &
+              IB_MGMT_RMPP_FLAG_ACTIVE))
+                return IB_RMPP_RESULT_UNHANDLED; /* RMPP not active */
+
+        if (rmpp_mad->rmpp_hdr.rmpp_type != IB_MGMT_RMPP_TYPE_DATA) {
+                msg = (struct ib_mad_send_buf *) (unsigned long)
+                      mad_send_wc->wr_id;
+                ib_free_send_mad(msg);
+                return IB_RMPP_RESULT_INTERNAL;  /* ACK, STOP, or ABORT */
+        }
+
+        if (mad_send_wc->status != IB_WC_SUCCESS ||
+            mad_send_wr->status != IB_WC_SUCCESS)
+                return IB_RMPP_RESULT_PROCESSED; /* Canceled or send error */
+
+        if (!mad_send_wr->timeout)
+                return IB_RMPP_RESULT_PROCESSED; /* Response received */
+
+        if (mad_send_wr->last_ack == mad_send_wr->total_seg) {
+                mad_send_wr->timeout =
+                        msecs_to_jiffies(mad_send_wr->send_wr.wr.ud.timeout_ms);
+                return IB_RMPP_RESULT_PROCESSED; /* Send done */
+        }
+
+        if (mad_send_wr->seg_num > mad_send_wr->newwin ||
+            mad_send_wr->seg_num > mad_send_wr->total_seg)
+                return IB_RMPP_RESULT_PROCESSED; /* Wait for ACK */
+
+        ret = send_next_seg(mad_send_wr);
+        if (ret) {
+                mad_send_wc->status = IB_WC_GENERAL_ERR;
+                return IB_RMPP_RESULT_PROCESSED;
+        }
+        return IB_RMPP_RESULT_CONSUMED;
+}
+
+int ib_retry_rmpp(struct ib_mad_send_wr_private *mad_send_wr)
+{
+        struct ib_rmpp_mad *rmpp_mad;
+        int ret;
+
+        rmpp_mad = (struct ib_rmpp_mad *)mad_send_wr->send_wr.wr.ud.mad_hdr;
+        if (!(ib_get_rmpp_flags(&rmpp_mad->rmpp_hdr) &
+              IB_MGMT_RMPP_FLAG_ACTIVE))
+                return IB_RMPP_RESULT_UNHANDLED; /* RMPP not active */
+
+        if (mad_send_wr->last_ack == mad_send_wr->total_seg)
+                return IB_RMPP_RESULT_PROCESSED;
+
+        mad_send_wr->seg_num = mad_send_wr->last_ack + 1;
+        ret = send_next_seg(mad_send_wr);
+        if (ret)
+                return IB_RMPP_RESULT_PROCESSED;
+
+        return IB_RMPP_RESULT_CONSUMED;
+}
diff --git a/drivers/infiniband/core/mad_rmpp.h b/drivers/infiniband/core/mad_rmpp.h
new file mode 100644
index 000000000000..c4924dfb8e75
--- /dev/null
+++ b/drivers/infiniband/core/mad_rmpp.h
@@ -0,0 +1,58 @@
+/*
+ * Copyright (c) 2005 Intel Inc. All rights reserved.
+ *
+ * This software is available to you under a choice of one of two
+ * licenses.  You may choose to be licensed under the terms of the GNU
+ * General Public License (GPL) Version 2, available from the file
+ * COPYING in the main directory of this source tree, or the
+ * OpenIB.org BSD license below:
+ *
+ *     Redistribution and use in source and binary forms, with or
+ *     without modification, are permitted provided that the following
+ *     conditions are met:
+ *
+ *      - Redistributions of source code must retain the above
+ *        copyright notice, this list of conditions and the following
+ *        disclaimer.
+ *
+ *      - Redistributions in binary form must reproduce the above
+ *        copyright notice, this list of conditions and the following
+ *        disclaimer in the documentation and/or other materials
+ *        provided with the distribution.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+ * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+ * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+ * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
+ * BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
+ * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
+ * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+ * SOFTWARE.
+ *
+ * $Id: mad_rmpp.h 1921 2005-02-25 22:58:44Z sean.hefty $
+ */
+
+#ifndef __MAD_RMPP_H__
+#define __MAD_RMPP_H__
+
+enum {
+        IB_RMPP_RESULT_PROCESSED,
+        IB_RMPP_RESULT_CONSUMED,
+        IB_RMPP_RESULT_INTERNAL,
+        IB_RMPP_RESULT_UNHANDLED
+};
+
+int ib_send_rmpp_mad(struct ib_mad_send_wr_private *mad_send_wr);
+
+struct ib_mad_recv_wc *
+ib_process_rmpp_recv_wc(struct ib_mad_agent_private *agent,
+                        struct ib_mad_recv_wc *mad_recv_wc);
+
+int ib_process_rmpp_send_wc(struct ib_mad_send_wr_private *mad_send_wr,
+                            struct ib_mad_send_wc *mad_send_wc);
+
+void ib_cancel_rmpp_recvs(struct ib_mad_agent_private *agent);
+
+int ib_retry_rmpp(struct ib_mad_send_wr_private *mad_send_wr);
+
+#endif  /* __MAD_RMPP_H__ */
diff --git a/drivers/infiniband/core/sa_query.c b/drivers/infiniband/core/sa_query.c
index 5a08e81fa827..795184931c83 100644
--- a/drivers/infiniband/core/sa_query.c
+++ b/drivers/infiniband/core/sa_query.c
@@ -1,5 +1,6 @@
 /*
  * Copyright (c) 2004 Topspin Communications.  All rights reserved.
+ * Copyright (c) 2005 Voltaire, Inc.  All rights reserved.
  *
  * This software is available to you under a choice of one of two
  * licenses.  You may choose to be licensed under the terms of the GNU
@@ -29,7 +30,7 @@
  * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
  * SOFTWARE.
  *
- * $Id: sa_query.c 1389 2004-12-27 22:56:47Z roland $
+ * $Id: sa_query.c 2811 2005-07-06 18:11:43Z halr $
  */
 
 #include <linux/module.h>
@@ -50,26 +51,6 @@ MODULE_AUTHOR("Roland Dreier");
 MODULE_DESCRIPTION("InfiniBand subnet administration query support");
 MODULE_LICENSE("Dual BSD/GPL");
 
-/*
- * These two structures must be packed because they have 64-bit fields
- * that are only 32-bit aligned.  64-bit architectures will lay them
- * out wrong otherwise.  (And unfortunately they are sent on the wire
- * so we can't change the layout)
- */
-struct ib_sa_hdr {
-        u64                     sm_key;
-        u16                     attr_offset;
-        u16                     reserved;
-        ib_sa_comp_mask         comp_mask;
-} __attribute__ ((packed));
-
-struct ib_sa_mad {
-        struct ib_mad_hdr       mad_hdr;
-        struct ib_rmpp_hdr      rmpp_hdr;
-        struct ib_sa_hdr        sa_hdr;
-        u8                      data[200];
-} __attribute__ ((packed));
-
 struct ib_sa_sm_ah {
         struct ib_ah        *ah;
         struct kref          ref;
@@ -77,7 +58,6 @@ struct ib_sa_sm_ah {
 
 struct ib_sa_port {
         struct ib_mad_agent *agent;
-        struct ib_mr        *mr;
         struct ib_sa_sm_ah  *sm_ah;
         struct work_struct   update_task;
         spinlock_t           ah_lock;
@@ -100,6 +80,12 @@ struct ib_sa_query {
         int                 id;
 };
 
+struct ib_sa_service_query {
+        void (*callback)(int, struct ib_sa_service_rec *, void *);
+        void *context;
+        struct ib_sa_query sa_query;
+};
+
 struct ib_sa_path_query {
         void (*callback)(int, struct ib_sa_path_rec *, void *);
         void *context;
@@ -341,6 +327,54 @@ static const struct ib_field mcmember_rec_table[] = {
           .size_bits    = 23 },
 };
 
+#define SERVICE_REC_FIELD(field) \
+        .struct_offset_bytes = offsetof(struct ib_sa_service_rec, field),       \
+        .struct_size_bytes   = sizeof ((struct ib_sa_service_rec *) 0)->field,  \
+        .field_name          = "sa_service_rec:" #field
+
+static const struct ib_field service_rec_table[] = {
+        { SERVICE_REC_FIELD(id),
+          .offset_words = 0,
+          .offset_bits  = 0,
+          .size_bits    = 64 },
+        { SERVICE_REC_FIELD(gid),
+          .offset_words = 2,
+          .offset_bits  = 0,
+          .size_bits    = 128 },
+        { SERVICE_REC_FIELD(pkey),
+          .offset_words = 6,
+          .offset_bits  = 0,
+          .size_bits    = 16 },
+        { SERVICE_REC_FIELD(lease),
+          .offset_words = 7,
+          .offset_bits  = 0,
+          .size_bits    = 32 },
+        { SERVICE_REC_FIELD(key),
+          .offset_words = 8,
+          .offset_bits  = 0,
+          .size_bits    = 128 },
+        { SERVICE_REC_FIELD(name),
+          .offset_words = 12,
+          .offset_bits  = 0,
+          .size_bits    = 64*8 },
+        { SERVICE_REC_FIELD(data8),
+          .offset_words = 28,
+          .offset_bits  = 0,
+          .size_bits    = 16*8 },
+        { SERVICE_REC_FIELD(data16),
+          .offset_words = 32,
+          .offset_bits  = 0,
+          .size_bits    = 8*16 },
+        { SERVICE_REC_FIELD(data32),
+          .offset_words = 36,
+          .offset_bits  = 0,
+          .size_bits    = 4*32 },
+        { SERVICE_REC_FIELD(data64),
+          .offset_words = 40,
+          .offset_bits  = 0,
+          .size_bits    = 2*64 },
+};
+
 static void free_sm_ah(struct kref *kref)
 {
         struct ib_sa_sm_ah *sm_ah = container_of(kref, struct ib_sa_sm_ah, ref);
@@ -463,7 +497,7 @@ static int send_mad(struct ib_sa_query *query, int timeout_ms)
                                  .mad_hdr     = &query->mad->mad_hdr,
                                  .remote_qpn  = 1,
                                  .remote_qkey = IB_QP1_QKEY,
-                                 .timeout_ms  = timeout_ms
+                                 .timeout_ms  = timeout_ms,
                          }
                  }
         };
@@ -492,7 +526,7 @@ retry:
                                             sizeof (struct ib_sa_mad),
                                             DMA_TO_DEVICE);
         gather_list.length = sizeof (struct ib_sa_mad);
-        gather_list.lkey   = port->mr->lkey;
+        gather_list.lkey   = port->agent->mr->lkey;
         pci_unmap_addr_set(query, mapping, gather_list.addr);
 
         ret = ib_post_send_mad(port->agent, &wr, &bad_wr);
@@ -566,7 +600,7 @@ static void ib_sa_path_rec_release(struct ib_sa_query *sa_query)
 int ib_sa_path_rec_get(struct ib_device *device, u8 port_num,
                        struct ib_sa_path_rec *rec,
                        ib_sa_comp_mask comp_mask,
-                       int timeout_ms, int gfp_mask,
+                       int timeout_ms, unsigned int __nocast gfp_mask,
                        void (*callback)(int status,
                                         struct ib_sa_path_rec *resp,
                                         void *context),
@@ -616,6 +650,114 @@ int ib_sa_path_rec_get(struct ib_device *device, u8 port_num,
 }
 EXPORT_SYMBOL(ib_sa_path_rec_get);
 
+static void ib_sa_service_rec_callback(struct ib_sa_query *sa_query,
+                                    int status,
+                                    struct ib_sa_mad *mad)
+{
+        struct ib_sa_service_query *query =
+                container_of(sa_query, struct ib_sa_service_query, sa_query);
+
+        if (mad) {
+                struct ib_sa_service_rec rec;
+
+                ib_unpack(service_rec_table, ARRAY_SIZE(service_rec_table),
+                          mad->data, &rec);
+                query->callback(status, &rec, query->context);
+        } else
+                query->callback(status, NULL, query->context);
+}
+
+static void ib_sa_service_rec_release(struct ib_sa_query *sa_query)
+{
+        kfree(sa_query->mad);
+        kfree(container_of(sa_query, struct ib_sa_service_query, sa_query));
+}
+
+/**
+ * ib_sa_service_rec_query - Start Service Record operation
+ * @device:device to send request on
+ * @port_num: port number to send request on
+ * @method:SA method - should be get, set, or delete
+ * @rec:Service Record to send in request
+ * @comp_mask:component mask to send in request
+ * @timeout_ms:time to wait for response
+ * @gfp_mask:GFP mask to use for internal allocations
+ * @callback:function called when request completes, times out or is
+ * canceled
+ * @context:opaque user context passed to callback
+ * @sa_query:request context, used to cancel request
+ *
+ * Send a Service Record set/get/delete to the SA to register,
+ * unregister or query a service record.
+ * The callback function will be called when the request completes (or
+ * fails); status is 0 for a successful response, -EINTR if the query
+ * is canceled, -ETIMEDOUT is the query timed out, or -EIO if an error
+ * occurred sending the query.  The resp parameter of the callback is
+ * only valid if status is 0.
+ *
+ * If the return value of ib_sa_service_rec_query() is negative, it is an
+ * error code.  Otherwise it is a request ID that can be used to cancel
+ * the query.
+ */
+int ib_sa_service_rec_query(struct ib_device *device, u8 port_num, u8 method,
+                            struct ib_sa_service_rec *rec,
+                            ib_sa_comp_mask comp_mask,
+                            int timeout_ms, unsigned int __nocast gfp_mask,
+                            void (*callback)(int status,
+                                             struct ib_sa_service_rec *resp,
+                                             void *context),
+                            void *context,
+                            struct ib_sa_query **sa_query)
+{
+        struct ib_sa_service_query *query;
+        struct ib_sa_device *sa_dev = ib_get_client_data(device, &sa_client);
+        struct ib_sa_port   *port   = &sa_dev->port[port_num - sa_dev->start_port];
+        struct ib_mad_agent *agent  = port->agent;
+        int ret;
+
+        if (method != IB_MGMT_METHOD_GET &&
+            method != IB_MGMT_METHOD_SET &&
+            method != IB_SA_METHOD_DELETE)
+                return -EINVAL;
+
+        query = kmalloc(sizeof *query, gfp_mask);
+        if (!query)
+                return -ENOMEM;
+        query->sa_query.mad = kmalloc(sizeof *query->sa_query.mad, gfp_mask);
+        if (!query->sa_query.mad) {
+                kfree(query);
+                return -ENOMEM;
+        }
+
+        query->callback = callback;
+        query->context  = context;
+
+        init_mad(query->sa_query.mad, agent);
+
+        query->sa_query.callback              = callback ? ib_sa_service_rec_callback : NULL;
+        query->sa_query.release               = ib_sa_service_rec_release;
+        query->sa_query.port                  = port;
+        query->sa_query.mad->mad_hdr.method   = method;
+        query->sa_query.mad->mad_hdr.attr_id  =
+                                cpu_to_be16(IB_SA_ATTR_SERVICE_REC);
+        query->sa_query.mad->sa_hdr.comp_mask = comp_mask;
+
+        ib_pack(service_rec_table, ARRAY_SIZE(service_rec_table),
+                rec, query->sa_query.mad->data);
+
+        *sa_query = &query->sa_query;
+
+        ret = send_mad(&query->sa_query, timeout_ms);
+        if (ret < 0) {
+                *sa_query = NULL;
+                kfree(query->sa_query.mad);
+                kfree(query);
+        }
+
+        return ret;
+}
+EXPORT_SYMBOL(ib_sa_service_rec_query);
+
 static void ib_sa_mcmember_rec_callback(struct ib_sa_query *sa_query,
                                         int status,
                                         struct ib_sa_mad *mad)
@@ -643,7 +785,7 @@ int ib_sa_mcmember_rec_query(struct ib_device *device, u8 port_num,
                              u8 method,
                              struct ib_sa_mcmember_rec *rec,
                              ib_sa_comp_mask comp_mask,
-                             int timeout_ms, int gfp_mask,
+                             int timeout_ms, unsigned int __nocast gfp_mask,
                              void (*callback)(int status,
                                               struct ib_sa_mcmember_rec *resp,
                                               void *context),
@@ -780,7 +922,6 @@ static void ib_sa_add_one(struct ib_device *device)
         sa_dev->end_port   = e;
 
         for (i = 0; i <= e - s; ++i) {
-                sa_dev->port[i].mr       = NULL;
                 sa_dev->port[i].sm_ah    = NULL;
                 sa_dev->port[i].port_num = i + s;
                 spin_lock_init(&sa_dev->port[i].ah_lock);
@@ -792,13 +933,6 @@ static void ib_sa_add_one(struct ib_device *device)
                 if (IS_ERR(sa_dev->port[i].agent))
                         goto err;
 
-                sa_dev->port[i].mr = ib_get_dma_mr(sa_dev->port[i].agent->qp->pd,
-                                                   IB_ACCESS_LOCAL_WRITE);
-                if (IS_ERR(sa_dev->port[i].mr)) {
-                        ib_unregister_mad_agent(sa_dev->port[i].agent);
-                        goto err;
-                }
-
                 INIT_WORK(&sa_dev->port[i].update_task,
                           update_sm_ah, &sa_dev->port[i]);
         }
@@ -822,10 +956,8 @@ static void ib_sa_add_one(struct ib_device *device)
         return;
 
 err:
-        while (--i >= 0) {
-                ib_dereg_mr(sa_dev->port[i].mr);
+        while (--i >= 0)
                 ib_unregister_mad_agent(sa_dev->port[i].agent);
-        }
 
         kfree(sa_dev);
 
diff --git a/drivers/infiniband/core/ucm.c b/drivers/infiniband/core/ucm.c
new file mode 100644
index 000000000000..546ec61c407f
--- /dev/null
+++ b/drivers/infiniband/core/ucm.c
@@ -0,0 +1,1393 @@
+/*
+ * Copyright (c) 2005 Topspin Communications.  All rights reserved.
+ *
+ * This software is available to you under a choice of one of two
+ * licenses.  You may choose to be licensed under the terms of the GNU
+ * General Public License (GPL) Version 2, available from the file
+ * COPYING in the main directory of this source tree, or the
+ * OpenIB.org BSD license below:
+ *
+ *     Redistribution and use in source and binary forms, with or
+ *     without modification, are permitted provided that the following
+ *     conditions are met:
+ *
+ *      - Redistributions of source code must retain the above
+ *      copyright notice, this list of conditions and the following
+ *      disclaimer.
+ *
+ *      - Redistributions in binary form must reproduce the above
+ *      copyright notice, this list of conditions and the following
+ *      disclaimer in the documentation and/or other materials
+ *      provided with the distribution.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+ * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+ * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+ * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
+ * BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
+ * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
+ * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+ * SOFTWARE.
+ *
+ * $Id: ucm.c 2594 2005-06-13 19:46:02Z libor $
+ */
+#include <linux/init.h>
+#include <linux/fs.h>
+#include <linux/module.h>
+#include <linux/device.h>
+#include <linux/err.h>
+#include <linux/poll.h>
+#include <linux/file.h>
+#include <linux/mount.h>
+#include <linux/cdev.h>
+
+#include <asm/uaccess.h>
+
+#include "ucm.h"
+
+MODULE_AUTHOR("Libor Michalek");
+MODULE_DESCRIPTION("InfiniBand userspace Connection Manager access");
+MODULE_LICENSE("Dual BSD/GPL");
+
+enum {
+        IB_UCM_MAJOR = 231,
+        IB_UCM_MINOR = 255
+};
+
+#define IB_UCM_DEV MKDEV(IB_UCM_MAJOR, IB_UCM_MINOR)
+
+static struct semaphore ctx_id_mutex;
+static struct idr       ctx_id_table;
+static int              ctx_id_rover = 0;
+
+static struct ib_ucm_context *ib_ucm_ctx_get(int id)
+{
+        struct ib_ucm_context *ctx;
+
+        down(&ctx_id_mutex);
+        ctx = idr_find(&ctx_id_table, id);
+        if (ctx)
+                ctx->ref++;
+        up(&ctx_id_mutex);
+
+        return ctx;
+}
+
+static void ib_ucm_ctx_put(struct ib_ucm_context *ctx)
+{
+        struct ib_ucm_event *uevent;
+
+        down(&ctx_id_mutex);
+
+        ctx->ref--;
+        if (!ctx->ref)
+                idr_remove(&ctx_id_table, ctx->id);
+
+        up(&ctx_id_mutex);
+
+        if (ctx->ref)
+                return;
+
+        down(&ctx->file->mutex);
+
+        list_del(&ctx->file_list);
+        while (!list_empty(&ctx->events)) {
+
+                uevent = list_entry(ctx->events.next,
+                                    struct ib_ucm_event, ctx_list);
+                list_del(&uevent->file_list);
+                list_del(&uevent->ctx_list);
+
+                /* clear incoming connections. */
+                if (uevent->cm_id)
+                        ib_destroy_cm_id(uevent->cm_id);
+
+                kfree(uevent);
+        }
+
+        up(&ctx->file->mutex);
+
+        printk(KERN_ERR "UCM: Destroyed CM ID <%d>\n", ctx->id);
+
+        ib_destroy_cm_id(ctx->cm_id);
+        kfree(ctx);
+}
+
+static struct ib_ucm_context *ib_ucm_ctx_alloc(struct ib_ucm_file *file)
+{
+        struct ib_ucm_context *ctx;
+        int result;
+
+        ctx = kmalloc(sizeof(*ctx), GFP_KERNEL);
+        if (!ctx)
+                return NULL;
+
+        ctx->ref  = 1; /* user reference */
+        ctx->file = file;
+
+        INIT_LIST_HEAD(&ctx->events);
+        init_MUTEX(&ctx->mutex);
+
+        list_add_tail(&ctx->file_list, &file->ctxs);
+
+        ctx_id_rover = (ctx_id_rover + 1) & INT_MAX;
+retry:
+        result = idr_pre_get(&ctx_id_table, GFP_KERNEL);
+        if (!result)
+                goto error;
+
+        down(&ctx_id_mutex);
+        result = idr_get_new_above(&ctx_id_table, ctx, ctx_id_rover, &ctx->id);
+        up(&ctx_id_mutex);
+
+        if (result == -EAGAIN)
+                goto retry;
+        if (result)
+                goto error;
+
+        printk(KERN_ERR "UCM: Allocated CM ID <%d>\n", ctx->id);
+
+        return ctx;
+error:
+        list_del(&ctx->file_list);
+        kfree(ctx);
+
+        return NULL;
+}
+/*
+ * Event portion of the API, handle CM events
+ * and allow event polling.
+ */
+static void ib_ucm_event_path_get(struct ib_ucm_path_rec *upath,
+                                  struct ib_sa_path_rec  *kpath)
+{
+        if (!kpath || !upath)
+                return;
+
+        memcpy(upath->dgid, kpath->dgid.raw, sizeof(union ib_gid));
+        memcpy(upath->sgid, kpath->sgid.raw, sizeof(union ib_gid));
+
+        upath->dlid             = kpath->dlid;
+        upath->slid             = kpath->slid;
+        upath->raw_traffic      = kpath->raw_traffic;
+        upath->flow_label       = kpath->flow_label;
+        upath->hop_limit        = kpath->hop_limit;
+        upath->traffic_class    = kpath->traffic_class;
+        upath->reversible       = kpath->reversible;
+        upath->numb_path        = kpath->numb_path;
+        upath->pkey             = kpath->pkey;
+        upath->sl               = kpath->sl;
+        upath->mtu_selector     = kpath->mtu_selector;
+        upath->mtu              = kpath->mtu;
+        upath->rate_selector    = kpath->rate_selector;
+        upath->rate             = kpath->rate;
+        upath->packet_life_time = kpath->packet_life_time;
+        upath->preference       = kpath->preference;
+
+        upath->packet_life_time_selector =
+                kpath->packet_life_time_selector;
+}
+
+static void ib_ucm_event_req_get(struct ib_ucm_req_event_resp *ureq,
+                                 struct ib_cm_req_event_param *kreq)
+{
+        ureq->listen_id = (long)kreq->listen_id->context;
+
+        ureq->remote_ca_guid             = kreq->remote_ca_guid;
+        ureq->remote_qkey                = kreq->remote_qkey;
+        ureq->remote_qpn                 = kreq->remote_qpn;
+        ureq->qp_type                    = kreq->qp_type;
+        ureq->starting_psn               = kreq->starting_psn;
+        ureq->responder_resources        = kreq->responder_resources;
+        ureq->initiator_depth            = kreq->initiator_depth;
+        ureq->local_cm_response_timeout  = kreq->local_cm_response_timeout;
+        ureq->flow_control               = kreq->flow_control;
+        ureq->remote_cm_response_timeout = kreq->remote_cm_response_timeout;
+        ureq->retry_count                = kreq->retry_count;
+        ureq->rnr_retry_count            = kreq->rnr_retry_count;
+        ureq->srq                        = kreq->srq;
+
+        ib_ucm_event_path_get(&ureq->primary_path, kreq->primary_path);
+        ib_ucm_event_path_get(&ureq->alternate_path, kreq->alternate_path);
+}
+
+static void ib_ucm_event_rep_get(struct ib_ucm_rep_event_resp *urep,
+                                 struct ib_cm_rep_event_param *krep)
+{
+        urep->remote_ca_guid      = krep->remote_ca_guid;
+        urep->remote_qkey         = krep->remote_qkey;
+        urep->remote_qpn          = krep->remote_qpn;
+        urep->starting_psn        = krep->starting_psn;
+        urep->responder_resources = krep->responder_resources;
+        urep->initiator_depth     = krep->initiator_depth;
+        urep->target_ack_delay    = krep->target_ack_delay;
+        urep->failover_accepted   = krep->failover_accepted;
+        urep->flow_control        = krep->flow_control;
+        urep->rnr_retry_count     = krep->rnr_retry_count;
+        urep->srq                 = krep->srq;
+}
+
+static void ib_ucm_event_rej_get(struct ib_ucm_rej_event_resp *urej,
+                                 struct ib_cm_rej_event_param *krej)
+{
+        urej->reason = krej->reason;
+}
+
+static void ib_ucm_event_mra_get(struct ib_ucm_mra_event_resp *umra,
+                                 struct ib_cm_mra_event_param *kmra)
+{
+        umra->timeout = kmra->service_timeout;
+}
+
+static void ib_ucm_event_lap_get(struct ib_ucm_lap_event_resp *ulap,
+                                 struct ib_cm_lap_event_param *klap)
+{
+        ib_ucm_event_path_get(&ulap->path, klap->alternate_path);
+}
+
+static void ib_ucm_event_apr_get(struct ib_ucm_apr_event_resp *uapr,
+                                 struct ib_cm_apr_event_param *kapr)
+{
+        uapr->status = kapr->ap_status;
+}
+
+static void ib_ucm_event_sidr_req_get(struct ib_ucm_sidr_req_event_resp *ureq,
+                                      struct ib_cm_sidr_req_event_param *kreq)
+{
+        ureq->listen_id = (long)kreq->listen_id->context;
+        ureq->pkey      = kreq->pkey;
+}
+
+static void ib_ucm_event_sidr_rep_get(struct ib_ucm_sidr_rep_event_resp *urep,
+                                      struct ib_cm_sidr_rep_event_param *krep)
+{
+        urep->status = krep->status;
+        urep->qkey   = krep->qkey;
+        urep->qpn    = krep->qpn;
+};
+
+static int ib_ucm_event_process(struct ib_cm_event *evt,
+                                struct ib_ucm_event *uvt)
+{
+        void *info = NULL;
+        int result;
+
+        switch (evt->event) {
+        case IB_CM_REQ_RECEIVED:
+                ib_ucm_event_req_get(&uvt->resp.u.req_resp,
+                                     &evt->param.req_rcvd);
+                uvt->data_len      = IB_CM_REQ_PRIVATE_DATA_SIZE;
+                uvt->resp.present |= (evt->param.req_rcvd.primary_path ?
+                                      IB_UCM_PRES_PRIMARY : 0);
+                uvt->resp.present |= (evt->param.req_rcvd.alternate_path ?
+                                      IB_UCM_PRES_ALTERNATE : 0);
+                break;
+        case IB_CM_REP_RECEIVED:
+                ib_ucm_event_rep_get(&uvt->resp.u.rep_resp,
+                                     &evt->param.rep_rcvd);
+                uvt->data_len = IB_CM_REP_PRIVATE_DATA_SIZE;
+
+                break;
+        case IB_CM_RTU_RECEIVED:
+                uvt->data_len = IB_CM_RTU_PRIVATE_DATA_SIZE;
+                uvt->resp.u.send_status = evt->param.send_status;
+
+                break;
+        case IB_CM_DREQ_RECEIVED:
+                uvt->data_len = IB_CM_DREQ_PRIVATE_DATA_SIZE;
+                uvt->resp.u.send_status = evt->param.send_status;
+
+                break;
+        case IB_CM_DREP_RECEIVED:
+                uvt->data_len = IB_CM_DREP_PRIVATE_DATA_SIZE;
+                uvt->resp.u.send_status = evt->param.send_status;
+
+                break;
+        case IB_CM_MRA_RECEIVED:
+                ib_ucm_event_mra_get(&uvt->resp.u.mra_resp,
+                                     &evt->param.mra_rcvd);
+                uvt->data_len = IB_CM_MRA_PRIVATE_DATA_SIZE;
+
+                break;
+        case IB_CM_REJ_RECEIVED:
+                ib_ucm_event_rej_get(&uvt->resp.u.rej_resp,
+                                     &evt->param.rej_rcvd);
+                uvt->data_len = IB_CM_REJ_PRIVATE_DATA_SIZE;
+                uvt->info_len = evt->param.rej_rcvd.ari_length;
+                info          = evt->param.rej_rcvd.ari;
+
+                break;
+        case IB_CM_LAP_RECEIVED:
+                ib_ucm_event_lap_get(&uvt->resp.u.lap_resp,
+                                     &evt->param.lap_rcvd);
+                uvt->data_len = IB_CM_LAP_PRIVATE_DATA_SIZE;
+                uvt->resp.present |= (evt->param.lap_rcvd.alternate_path ?
+                                      IB_UCM_PRES_ALTERNATE : 0);
+                break;
+        case IB_CM_APR_RECEIVED:
+                ib_ucm_event_apr_get(&uvt->resp.u.apr_resp,
+                                     &evt->param.apr_rcvd);
+                uvt->data_len = IB_CM_APR_PRIVATE_DATA_SIZE;
+                uvt->info_len = evt->param.apr_rcvd.info_len;
+                info          = evt->param.apr_rcvd.apr_info;
+
+                break;
+        case IB_CM_SIDR_REQ_RECEIVED:
+                ib_ucm_event_sidr_req_get(&uvt->resp.u.sidr_req_resp,
+                                          &evt->param.sidr_req_rcvd);
+                uvt->data_len = IB_CM_SIDR_REQ_PRIVATE_DATA_SIZE;
+
+                break;
+        case IB_CM_SIDR_REP_RECEIVED:
+                ib_ucm_event_sidr_rep_get(&uvt->resp.u.sidr_rep_resp,
+                                          &evt->param.sidr_rep_rcvd);
+                uvt->data_len = IB_CM_SIDR_REP_PRIVATE_DATA_SIZE;
+                uvt->info_len = evt->param.sidr_rep_rcvd.info_len;
+                info          = evt->param.sidr_rep_rcvd.info;
+
+                break;
+        default:
+                uvt->resp.u.send_status = evt->param.send_status;
+
+                break;
+        }
+
+        if (uvt->data_len && evt->private_data) {
+
+                uvt->data = kmalloc(uvt->data_len, GFP_KERNEL);
+                if (!uvt->data) {
+                        result = -ENOMEM;
+                        goto error;
+                }
+
+                memcpy(uvt->data, evt->private_data, uvt->data_len);
+                uvt->resp.present |= IB_UCM_PRES_DATA;
+        }
+
+        if (uvt->info_len && info) {
+
+                uvt->info = kmalloc(uvt->info_len, GFP_KERNEL);
+                if (!uvt->info) {
+                        result = -ENOMEM;
+                        goto error;
+                }
+
+                memcpy(uvt->info, info, uvt->info_len);
+                uvt->resp.present |= IB_UCM_PRES_INFO;
+        }
+
+        return 0;
+error:
+        if (uvt->info)
+                kfree(uvt->info);
+        if (uvt->data)
+                kfree(uvt->data);
+        return result;
+}
+
+static int ib_ucm_event_handler(struct ib_cm_id *cm_id,
+                                struct ib_cm_event *event)
+{
+        struct ib_ucm_event *uevent;
+        struct ib_ucm_context *ctx;
+        int result = 0;
+        int id;
+        /*
+         * lookup correct context based on event type.
+         */
+        switch (event->event) {
+        case IB_CM_REQ_RECEIVED:
+                id = (long)event->param.req_rcvd.listen_id->context;
+                break;
+        case IB_CM_SIDR_REQ_RECEIVED:
+                id = (long)event->param.sidr_req_rcvd.listen_id->context;
+                break;
+        default:
+                id = (long)cm_id->context;
+                break;
+        }
+
+        printk(KERN_ERR "UCM: Event. CM ID <%d> event <%d>\n",
+               id, event->event);
+
+        ctx = ib_ucm_ctx_get(id);
+        if (!ctx)
+                return -ENOENT;
+
+        if (event->event == IB_CM_REQ_RECEIVED ||
+            event->event == IB_CM_SIDR_REQ_RECEIVED)
+                id = IB_UCM_CM_ID_INVALID;
+
+        uevent = kmalloc(sizeof(*uevent), GFP_KERNEL);
+        if (!uevent) {
+                result = -ENOMEM;
+                goto done;
+        }
+
+        memset(uevent, 0, sizeof(*uevent));
+
+        uevent->resp.id    = id;
+        uevent->resp.event = event->event;
+
+        result = ib_ucm_event_process(event, uevent);
+        if (result)
+                goto done;
+
+        uevent->ctx   = ctx;
+        uevent->cm_id = ((event->event == IB_CM_REQ_RECEIVED ||
+                          event->event == IB_CM_SIDR_REQ_RECEIVED ) ?
+                         cm_id : NULL);
+
+        down(&ctx->file->mutex);
+
+        list_add_tail(&uevent->file_list, &ctx->file->events);
+        list_add_tail(&uevent->ctx_list, &ctx->events);
+
+        wake_up_interruptible(&ctx->file->poll_wait);
+
+        up(&ctx->file->mutex);
+done:
+        ctx->error = result;
+        ib_ucm_ctx_put(ctx); /* func reference */
+        return result;
+}
+
+static ssize_t ib_ucm_event(struct ib_ucm_file *file,
+                            const char __user *inbuf,
+                            int in_len, int out_len)
+{
+        struct ib_ucm_context *ctx;
+        struct ib_ucm_event_get cmd;
+        struct ib_ucm_event *uevent = NULL;
+        int result = 0;
+        DEFINE_WAIT(wait);
+
+        if (out_len < sizeof(struct ib_ucm_event_resp))
+                return -ENOSPC;
+
+        if (copy_from_user(&cmd, inbuf, sizeof(cmd)))
+                return -EFAULT;
+        /*
+         * wait
+         */
+        down(&file->mutex);
+
+        while (list_empty(&file->events)) {
+
+                if (file->filp->f_flags & O_NONBLOCK) {
+                        result = -EAGAIN;
+                        break;
+                }
+
+                if (signal_pending(current)) {
+                        result = -ERESTARTSYS;
+                        break;
+                }
+
+                prepare_to_wait(&file->poll_wait, &wait, TASK_INTERRUPTIBLE);
+
+                up(&file->mutex);
+                schedule();
+                down(&file->mutex);
+
+                finish_wait(&file->poll_wait, &wait);
+        }
+
+        if (result)
+                goto done;
+
+        uevent = list_entry(file->events.next, struct ib_ucm_event, file_list);
+
+        if (!uevent->cm_id)
+                goto user;
+
+        ctx = ib_ucm_ctx_alloc(file);
+        if (!ctx) {
+                result = -ENOMEM;
+                goto done;
+        }
+
+        ctx->cm_id             = uevent->cm_id;
+        ctx->cm_id->cm_handler = ib_ucm_event_handler;
+        ctx->cm_id->context    = (void *)(unsigned long)ctx->id;
+
+        uevent->resp.id = ctx->id;
+
+user:
+        if (copy_to_user((void __user *)(unsigned long)cmd.response,
+                         &uevent->resp, sizeof(uevent->resp))) {
+                result = -EFAULT;
+                goto done;
+        }
+
+        if (uevent->data) {
+
+                if (cmd.data_len < uevent->data_len) {
+                        result = -ENOMEM;
+                        goto done;
+                }
+
+                if (copy_to_user((void __user *)(unsigned long)cmd.data,
+                                 uevent->data, uevent->data_len)) {
+                        result = -EFAULT;
+                        goto done;
+                }
+        }
+
+        if (uevent->info) {
+
+                if (cmd.info_len < uevent->info_len) {
+                        result = -ENOMEM;
+                        goto done;
+                }
+
+                if (copy_to_user((void __user *)(unsigned long)cmd.info,
+                                 uevent->info, uevent->info_len)) {
+                        result = -EFAULT;
+                        goto done;
+                }
+        }
+
+        list_del(&uevent->file_list);
+        list_del(&uevent->ctx_list);
+
+        if (uevent->data)
+                kfree(uevent->data);
+        if (uevent->info)
+                kfree(uevent->info);
+        kfree(uevent);
+done:
+        up(&file->mutex);
+        return result;
+}
+
+
+static ssize_t ib_ucm_create_id(struct ib_ucm_file *file,
+                                const char __user *inbuf,
+                                int in_len, int out_len)
+{
+        struct ib_ucm_create_id cmd;
+        struct ib_ucm_create_id_resp resp;
+        struct ib_ucm_context *ctx;
+        int result;
+
+        if (out_len < sizeof(resp))
+                return -ENOSPC;
+
+        if (copy_from_user(&cmd, inbuf, sizeof(cmd)))
+                return -EFAULT;
+
+        ctx = ib_ucm_ctx_alloc(file);
+        if (!ctx)
+                return -ENOMEM;
+
+        ctx->cm_id = ib_create_cm_id(ib_ucm_event_handler,
+                                     (void *)(unsigned long)ctx->id);
+        if (!ctx->cm_id) {
+                result = -ENOMEM;
+                goto err_cm;
+        }
+
+        resp.id = ctx->id;
+        if (copy_to_user((void __user *)(unsigned long)cmd.response,
+                         &resp, sizeof(resp))) {
+                result = -EFAULT;
+                goto err_ret;
+        }
+
+        return 0;
+err_ret:
+        ib_destroy_cm_id(ctx->cm_id);
+err_cm:
+        ib_ucm_ctx_put(ctx); /* user reference */
+
+        return result;
+}
+
+static ssize_t ib_ucm_destroy_id(struct ib_ucm_file *file,
+                                 const char __user *inbuf,
+                                 int in_len, int out_len)
+{
+        struct ib_ucm_destroy_id cmd;
+        struct ib_ucm_context *ctx;
+
+        if (copy_from_user(&cmd, inbuf, sizeof(cmd)))
+                return -EFAULT;
+
+        ctx = ib_ucm_ctx_get(cmd.id);
+        if (!ctx)
+                return -ENOENT;
+
+        ib_ucm_ctx_put(ctx); /* user reference */
+        ib_ucm_ctx_put(ctx); /* func reference */
+
+        return 0;
+}
+
+static ssize_t ib_ucm_attr_id(struct ib_ucm_file *file,
+                              const char __user *inbuf,
+                              int in_len, int out_len)
+{
+        struct ib_ucm_attr_id_resp resp;
+        struct ib_ucm_attr_id cmd;
+        struct ib_ucm_context *ctx;
+        int result = 0;
+
+        if (out_len < sizeof(resp))
+                return -ENOSPC;
+
+        if (copy_from_user(&cmd, inbuf, sizeof(cmd)))
+                return -EFAULT;
+
+        ctx = ib_ucm_ctx_get(cmd.id);
+        if (!ctx)
+                return -ENOENT;
+
+        down(&ctx->file->mutex);
+        if (ctx->file != file) {
+                result = -EINVAL;
+                goto done;
+        }
+
+        resp.service_id   = ctx->cm_id->service_id;
+        resp.service_mask = ctx->cm_id->service_mask;
+        resp.local_id     = ctx->cm_id->local_id;
+        resp.remote_id    = ctx->cm_id->remote_id;
+
+        if (copy_to_user((void __user *)(unsigned long)cmd.response,
+                         &resp, sizeof(resp)))
+                result = -EFAULT;
+
+done:
+        up(&ctx->file->mutex);
+        ib_ucm_ctx_put(ctx); /* func reference */
+        return result;
+}
+
+static ssize_t ib_ucm_listen(struct ib_ucm_file *file,
+                             const char __user *inbuf,
+                             int in_len, int out_len)
+{
+        struct ib_ucm_listen cmd;
+        struct ib_ucm_context *ctx;
+        int result;
+
+        if (copy_from_user(&cmd, inbuf, sizeof(cmd)))
+                return -EFAULT;
+
+        ctx = ib_ucm_ctx_get(cmd.id);
+        if (!ctx)
+                return -ENOENT;
+
+        down(&ctx->file->mutex);
+        if (ctx->file != file)
+                result = -EINVAL;
+        else
+                result = ib_cm_listen(ctx->cm_id, cmd.service_id,
+                                      cmd.service_mask);
+
+        up(&ctx->file->mutex);
+        ib_ucm_ctx_put(ctx); /* func reference */
+        return result;
+}
+
+static ssize_t ib_ucm_establish(struct ib_ucm_file *file,
+                                const char __user *inbuf,
+                                int in_len, int out_len)
+{
+        struct ib_ucm_establish cmd;
+        struct ib_ucm_context *ctx;
+        int result;
+
+        if (copy_from_user(&cmd, inbuf, sizeof(cmd)))
+                return -EFAULT;
+
+        ctx = ib_ucm_ctx_get(cmd.id);
+        if (!ctx)
+                return -ENOENT;
+
+        down(&ctx->file->mutex);
+        if (ctx->file != file)
+                result = -EINVAL;
+        else
+                result = ib_cm_establish(ctx->cm_id);
+
+        up(&ctx->file->mutex);
+        ib_ucm_ctx_put(ctx); /* func reference */
+        return result;
+}
+
+static int ib_ucm_alloc_data(const void **dest, u64 src, u32 len)
+{
+        void *data;
+
+        *dest = NULL;
+
+        if (!len)
+                return 0;
+
+        data = kmalloc(len, GFP_KERNEL);
+        if (!data)
+                return -ENOMEM;
+
+        if (copy_from_user(data, (void __user *)(unsigned long)src, len)) {
+                kfree(data);
+                return -EFAULT;
+        }
+
+        *dest = data;
+        return 0;
+}
+
+static int ib_ucm_path_get(struct ib_sa_path_rec **path, u64 src)
+{
+        struct ib_ucm_path_rec ucm_path;
+        struct ib_sa_path_rec  *sa_path;
+
+        *path = NULL;
+
+        if (!src)
+                return 0;
+
+        sa_path = kmalloc(sizeof(*sa_path), GFP_KERNEL);
+        if (!sa_path)
+                return -ENOMEM;
+
+        if (copy_from_user(&ucm_path, (void __user *)(unsigned long)src,
+                           sizeof(ucm_path))) {
+
+                kfree(sa_path);
+                return -EFAULT;
+        }
+
+        memcpy(sa_path->dgid.raw, ucm_path.dgid, sizeof(union ib_gid));
+        memcpy(sa_path->sgid.raw, ucm_path.sgid, sizeof(union ib_gid));
+
+        sa_path->dlid             = ucm_path.dlid;
+        sa_path->slid             = ucm_path.slid;
+        sa_path->raw_traffic      = ucm_path.raw_traffic;
+        sa_path->flow_label       = ucm_path.flow_label;
+        sa_path->hop_limit        = ucm_path.hop_limit;
+        sa_path->traffic_class    = ucm_path.traffic_class;
+        sa_path->reversible       = ucm_path.reversible;
+        sa_path->numb_path        = ucm_path.numb_path;
+        sa_path->pkey             = ucm_path.pkey;
+        sa_path->sl               = ucm_path.sl;
+        sa_path->mtu_selector     = ucm_path.mtu_selector;
+        sa_path->mtu              = ucm_path.mtu;
+        sa_path->rate_selector    = ucm_path.rate_selector;
+        sa_path->rate             = ucm_path.rate;
+        sa_path->packet_life_time = ucm_path.packet_life_time;
+        sa_path->preference       = ucm_path.preference;
+
+        sa_path->packet_life_time_selector =
+                ucm_path.packet_life_time_selector;
+
+        *path = sa_path;
+        return 0;
+}
+
+static ssize_t ib_ucm_send_req(struct ib_ucm_file *file,
+                               const char __user *inbuf,
+                               int in_len, int out_len)
+{
+        struct ib_cm_req_param param;
+        struct ib_ucm_context *ctx;
+        struct ib_ucm_req cmd;
+        int result;
+
+        param.private_data   = NULL;
+        param.primary_path   = NULL;
+        param.alternate_path = NULL;
+
+        if (copy_from_user(&cmd, inbuf, sizeof(cmd)))
+                return -EFAULT;
+
+        result = ib_ucm_alloc_data(&param.private_data, cmd.data, cmd.len);
+        if (result)
+                goto done;
+
+        result = ib_ucm_path_get(&param.primary_path, cmd.primary_path);
+        if (result)
+                goto done;
+
+        result = ib_ucm_path_get(&param.alternate_path, cmd.alternate_path);
+        if (result)
+                goto done;
+
+        param.private_data_len           = cmd.len;
+        param.service_id                 = cmd.sid;
+        param.qp_num                     = cmd.qpn;
+        param.qp_type                    = cmd.qp_type;
+        param.starting_psn               = cmd.psn;
+        param.peer_to_peer               = cmd.peer_to_peer;
+        param.responder_resources        = cmd.responder_resources;
+        param.initiator_depth            = cmd.initiator_depth;
+        param.remote_cm_response_timeout = cmd.remote_cm_response_timeout;
+        param.flow_control               = cmd.flow_control;
+        param.local_cm_response_timeout  = cmd.local_cm_response_timeout;
+        param.retry_count                = cmd.retry_count;
+        param.rnr_retry_count            = cmd.rnr_retry_count;
+        param.max_cm_retries             = cmd.max_cm_retries;
+        param.srq                        = cmd.srq;
+
+        ctx = ib_ucm_ctx_get(cmd.id);
+        if (!ctx) {
+                result = -ENOENT;
+                goto done;
+        }
+
+        down(&ctx->file->mutex);
+        if (ctx->file != file)
+                result = -EINVAL;
+        else
+                result = ib_send_cm_req(ctx->cm_id, &param);
+
+        up(&ctx->file->mutex);
+        ib_ucm_ctx_put(ctx); /* func reference */
+done:
+        if (param.private_data)
+                kfree(param.private_data);
+        if (param.primary_path)
+                kfree(param.primary_path);
+        if (param.alternate_path)
+                kfree(param.alternate_path);
+
+        return result;
+}
+
+static ssize_t ib_ucm_send_rep(struct ib_ucm_file *file,
+                               const char __user *inbuf,
+                               int in_len, int out_len)
+{
+        struct ib_cm_rep_param param;
+        struct ib_ucm_context *ctx;
+        struct ib_ucm_rep cmd;
+        int result;
+
+        param.private_data = NULL;
+
+        if (copy_from_user(&cmd, inbuf, sizeof(cmd)))
+                return -EFAULT;
+
+        result = ib_ucm_alloc_data(&param.private_data, cmd.data, cmd.len);
+        if (result)
+                return result;
+
+        param.qp_num              = cmd.qpn;
+        param.starting_psn        = cmd.psn;
+        param.private_data_len    = cmd.len;
+        param.responder_resources = cmd.responder_resources;
+        param.initiator_depth     = cmd.initiator_depth;
+        param.target_ack_delay    = cmd.target_ack_delay;
+        param.failover_accepted   = cmd.failover_accepted;
+        param.flow_control        = cmd.flow_control;
+        param.rnr_retry_count     = cmd.rnr_retry_count;
+        param.srq                 = cmd.srq;
+
+        ctx = ib_ucm_ctx_get(cmd.id);
+        if (!ctx) {
+                result = -ENOENT;
+                goto done;
+        }
+
+        down(&ctx->file->mutex);
+        if (ctx->file != file)
+                result = -EINVAL;
+        else
+                result = ib_send_cm_rep(ctx->cm_id, &param);
+
+        up(&ctx->file->mutex);
+        ib_ucm_ctx_put(ctx); /* func reference */
+done:
+        if (param.private_data)
+                kfree(param.private_data);
+
+        return result;
+}
+
+static ssize_t ib_ucm_send_private_data(struct ib_ucm_file *file,
+                                        const char __user *inbuf, int in_len,
+                                        int (*func)(struct ib_cm_id *cm_id,
+                                                    const void *private_data,
+                                                    u8 private_data_len))
+{
+        struct ib_ucm_private_data cmd;
+        struct ib_ucm_context *ctx;
+        const void *private_data = NULL;
+        int result;
+
+        if (copy_from_user(&cmd, inbuf, sizeof(cmd)))
+                return -EFAULT;
+
+        result = ib_ucm_alloc_data(&private_data, cmd.data, cmd.len);
+        if (result)
+                return result;
+
+        ctx = ib_ucm_ctx_get(cmd.id);
+        if (!ctx) {
+                result = -ENOENT;
+                goto done;
+        }
+
+        down(&ctx->file->mutex);
+        if (ctx->file != file)
+                result = -EINVAL;
+        else
+                result = func(ctx->cm_id, private_data, cmd.len);
+
+        up(&ctx->file->mutex);
+        ib_ucm_ctx_put(ctx); /* func reference */
+done:
+        if (private_data)
+                kfree(private_data);
+
+        return result;
+}
+
+static ssize_t ib_ucm_send_rtu(struct ib_ucm_file *file,
+                               const char __user *inbuf,
+                               int in_len, int out_len)
+{
+        return ib_ucm_send_private_data(file, inbuf, in_len, ib_send_cm_rtu);
+}
+
+static ssize_t ib_ucm_send_dreq(struct ib_ucm_file *file,
+                                const char __user *inbuf,
+                                int in_len, int out_len)
+{
+        return ib_ucm_send_private_data(file, inbuf, in_len, ib_send_cm_dreq);
+}
+
+static ssize_t ib_ucm_send_drep(struct ib_ucm_file *file,
+                                const char __user *inbuf,
+                                int in_len, int out_len)
+{
+        return ib_ucm_send_private_data(file, inbuf, in_len, ib_send_cm_drep);
+}
+
+static ssize_t ib_ucm_send_info(struct ib_ucm_file *file,
+                                const char __user *inbuf, int in_len,
+                                int (*func)(struct ib_cm_id *cm_id,
+                                            int status,
+                                            const void *info,
+                                            u8 info_len,
+                                            const void *data,
+                                            u8 data_len))
+{
+        struct ib_ucm_context *ctx;
+        struct ib_ucm_info cmd;
+        const void *data = NULL;
+        const void *info = NULL;
+        int result;
+
+        if (copy_from_user(&cmd, inbuf, sizeof(cmd)))
+                return -EFAULT;
+
+        result = ib_ucm_alloc_data(&data, cmd.data, cmd.data_len);
+        if (result)
+                goto done;
+
+        result = ib_ucm_alloc_data(&info, cmd.info, cmd.info_len);
+        if (result)
+                goto done;
+
+        ctx = ib_ucm_ctx_get(cmd.id);
+        if (!ctx) {
+                result = -ENOENT;
+                goto done;
+        }
+
+        down(&ctx->file->mutex);
+        if (ctx->file != file)
+                result = -EINVAL;
+        else
+                result = func(ctx->cm_id, cmd.status,
+                              info, cmd.info_len,
+                              data, cmd.data_len);
+
+        up(&ctx->file->mutex);
+        ib_ucm_ctx_put(ctx); /* func reference */
+done:
+        if (data)
+                kfree(data);
+        if (info)
+                kfree(info);
+
+        return result;
+}
+
+static ssize_t ib_ucm_send_rej(struct ib_ucm_file *file,
+                               const char __user *inbuf,
+                               int in_len, int out_len)
+{
+        return ib_ucm_send_info(file, inbuf, in_len, (void *)ib_send_cm_rej);
+}
+
+static ssize_t ib_ucm_send_apr(struct ib_ucm_file *file,
+                               const char __user *inbuf,
+                               int in_len, int out_len)
+{
+        return ib_ucm_send_info(file, inbuf, in_len, (void *)ib_send_cm_apr);
+}
+
+static ssize_t ib_ucm_send_mra(struct ib_ucm_file *file,
+                               const char __user *inbuf,
+                               int in_len, int out_len)
+{
+        struct ib_ucm_context *ctx;
+        struct ib_ucm_mra cmd;
+        const void *data = NULL;
+        int result;
+
+        if (copy_from_user(&cmd, inbuf, sizeof(cmd)))
+                return -EFAULT;
+
+        result = ib_ucm_alloc_data(&data, cmd.data, cmd.len);
+        if (result)
+                return result;
+
+        ctx = ib_ucm_ctx_get(cmd.id);
+        if (!ctx) {
+                result = -ENOENT;
+                goto done;
+        }
+
+        down(&ctx->file->mutex);
+        if (ctx->file != file)
+                result = -EINVAL;
+        else
+                result = ib_send_cm_mra(ctx->cm_id, cmd.timeout,
+                                        data, cmd.len);
+
+        up(&ctx->file->mutex);
+        ib_ucm_ctx_put(ctx); /* func reference */
+done:
+        if (data)
+                kfree(data);
+
+        return result;
+}
+
+static ssize_t ib_ucm_send_lap(struct ib_ucm_file *file,
+                               const char __user *inbuf,
+                               int in_len, int out_len)
+{
+        struct ib_ucm_context *ctx;
+        struct ib_sa_path_rec *path = NULL;
+        struct ib_ucm_lap cmd;
+        const void *data = NULL;
+        int result;
+
+        if (copy_from_user(&cmd, inbuf, sizeof(cmd)))
+                return -EFAULT;
+
+        result = ib_ucm_alloc_data(&data, cmd.data, cmd.len);
+        if (result)
+                goto done;
+
+        result = ib_ucm_path_get(&path, cmd.path);
+        if (result)
+                goto done;
+
+        ctx = ib_ucm_ctx_get(cmd.id);
+        if (!ctx) {
+                result = -ENOENT;
+                goto done;
+        }
+
+        down(&ctx->file->mutex);
+        if (ctx->file != file)
+                result = -EINVAL;
+        else
+                result = ib_send_cm_lap(ctx->cm_id, path, data, cmd.len);
+
+        up(&ctx->file->mutex);
+        ib_ucm_ctx_put(ctx); /* func reference */
+done:
+        if (data)
+                kfree(data);
+        if (path)
+                kfree(path);
+
+        return result;
+}
+
+static ssize_t ib_ucm_send_sidr_req(struct ib_ucm_file *file,
+                                    const char __user *inbuf,
+                                    int in_len, int out_len)
+{
+        struct ib_cm_sidr_req_param param;
+        struct ib_ucm_context *ctx;
+        struct ib_ucm_sidr_req cmd;
+        int result;
+
+        param.private_data = NULL;
+        param.path = NULL;
+
+        if (copy_from_user(&cmd, inbuf, sizeof(cmd)))
+                return -EFAULT;
+
+        result = ib_ucm_alloc_data(&param.private_data, cmd.data, cmd.len);
+        if (result)
+                goto done;
+
+        result = ib_ucm_path_get(&param.path, cmd.path);
+        if (result)
+                goto done;
+
+        param.private_data_len = cmd.len;
+        param.service_id       = cmd.sid;
+        param.timeout_ms       = cmd.timeout;
+        param.max_cm_retries   = cmd.max_cm_retries;
+        param.pkey             = cmd.pkey;
+
+        ctx = ib_ucm_ctx_get(cmd.id);
+        if (!ctx) {
+                result = -ENOENT;
+                goto done;
+        }
+
+        down(&ctx->file->mutex);
+        if (ctx->file != file)
+                result = -EINVAL;
+        else
+                result = ib_send_cm_sidr_req(ctx->cm_id, &param);
+
+        up(&ctx->file->mutex);
+        ib_ucm_ctx_put(ctx); /* func reference */
+done:
+        if (param.private_data)
+                kfree(param.private_data);
+        if (param.path)
+                kfree(param.path);
+
+        return result;
+}
+
+static ssize_t ib_ucm_send_sidr_rep(struct ib_ucm_file *file,
+                                    const char __user *inbuf,
+                                    int in_len, int out_len)
+{
+        struct ib_cm_sidr_rep_param param;
+        struct ib_ucm_sidr_rep cmd;
+        struct ib_ucm_context *ctx;
+        int result;
+
+        param.info = NULL;
+
+        if (copy_from_user(&cmd, inbuf, sizeof(cmd)))
+                return -EFAULT;
+
+        result = ib_ucm_alloc_data(&param.private_data,
+                                   cmd.data, cmd.data_len);
+        if (result)
+                goto done;
+
+        result = ib_ucm_alloc_data(&param.info, cmd.info, cmd.info_len);
+        if (result)
+                goto done;
+
+        param.qp_num       = cmd.qpn;
+        param.qkey           = cmd.qkey;
+        param.status       = cmd.status;
+        param.info_length      = cmd.info_len;
+        param.private_data_len = cmd.data_len;
+
+        ctx = ib_ucm_ctx_get(cmd.id);
+        if (!ctx) {
+                result = -ENOENT;
+                goto done;
+        }
+
+        down(&ctx->file->mutex);
+        if (ctx->file != file)
+                result = -EINVAL;
+        else
+                result = ib_send_cm_sidr_rep(ctx->cm_id, &param);
+
+        up(&ctx->file->mutex);
+        ib_ucm_ctx_put(ctx); /* func reference */
+done:
+        if (param.private_data)
+                kfree(param.private_data);
+        if (param.info)
+                kfree(param.info);
+
+        return result;
+}
+
+static ssize_t (*ucm_cmd_table[])(struct ib_ucm_file *file,
+                                  const char __user *inbuf,
+                                  int in_len, int out_len) = {
+        [IB_USER_CM_CMD_CREATE_ID]     = ib_ucm_create_id,
+        [IB_USER_CM_CMD_DESTROY_ID]    = ib_ucm_destroy_id,
+        [IB_USER_CM_CMD_ATTR_ID]       = ib_ucm_attr_id,
+        [IB_USER_CM_CMD_LISTEN]        = ib_ucm_listen,
+        [IB_USER_CM_CMD_ESTABLISH]     = ib_ucm_establish,
+        [IB_USER_CM_CMD_SEND_REQ]      = ib_ucm_send_req,
+        [IB_USER_CM_CMD_SEND_REP]      = ib_ucm_send_rep,
+        [IB_USER_CM_CMD_SEND_RTU]      = ib_ucm_send_rtu,
+        [IB_USER_CM_CMD_SEND_DREQ]     = ib_ucm_send_dreq,
+        [IB_USER_CM_CMD_SEND_DREP]     = ib_ucm_send_drep,
+        [IB_USER_CM_CMD_SEND_REJ]      = ib_ucm_send_rej,
+        [IB_USER_CM_CMD_SEND_MRA]      = ib_ucm_send_mra,
+        [IB_USER_CM_CMD_SEND_LAP]      = ib_ucm_send_lap,
+        [IB_USER_CM_CMD_SEND_APR]      = ib_ucm_send_apr,
+        [IB_USER_CM_CMD_SEND_SIDR_REQ] = ib_ucm_send_sidr_req,
+        [IB_USER_CM_CMD_SEND_SIDR_REP] = ib_ucm_send_sidr_rep,
+        [IB_USER_CM_CMD_EVENT]         = ib_ucm_event,
+};
+
+static ssize_t ib_ucm_write(struct file *filp, const char __user *buf,
+                            size_t len, loff_t *pos)
+{
+        struct ib_ucm_file *file = filp->private_data;
+        struct ib_ucm_cmd_hdr hdr;
+        ssize_t result;
+
+        if (len < sizeof(hdr))
+                return -EINVAL;
+
+        if (copy_from_user(&hdr, buf, sizeof(hdr)))
+                return -EFAULT;
+
+        printk(KERN_ERR "UCM: Write. cmd <%d> in <%d> out <%d> len <%Zu>\n",
+               hdr.cmd, hdr.in, hdr.out, len);
+
+        if (hdr.cmd < 0 || hdr.cmd >= ARRAY_SIZE(ucm_cmd_table))
+                return -EINVAL;
+
+        if (hdr.in + sizeof(hdr) > len)
+                return -EINVAL;
+
+        result = ucm_cmd_table[hdr.cmd](file, buf + sizeof(hdr),
+                                        hdr.in, hdr.out);
+        if (!result)
+                result = len;
+
+        return result;
+}
+
+static unsigned int ib_ucm_poll(struct file *filp,
+                                struct poll_table_struct *wait)
+{
+        struct ib_ucm_file *file = filp->private_data;
+        unsigned int mask = 0;
+
+        poll_wait(filp, &file->poll_wait, wait);
+
+        if (!list_empty(&file->events))
+                mask = POLLIN | POLLRDNORM;
+
+        return mask;
+}
+
+static int ib_ucm_open(struct inode *inode, struct file *filp)
+{
+        struct ib_ucm_file *file;
+
+        file = kmalloc(sizeof(*file), GFP_KERNEL);
+        if (!file)
+                return -ENOMEM;
+
+        INIT_LIST_HEAD(&file->events);
+        INIT_LIST_HEAD(&file->ctxs);
+        init_waitqueue_head(&file->poll_wait);
+
+        init_MUTEX(&file->mutex);
+
+        filp->private_data = file;
+        file->filp = filp;
+
+        printk(KERN_ERR "UCM: Created struct\n");
+
+        return 0;
+}
+
+static int ib_ucm_close(struct inode *inode, struct file *filp)
+{
+        struct ib_ucm_file *file = filp->private_data;
+        struct ib_ucm_context *ctx;
+
+        down(&file->mutex);
+
+        while (!list_empty(&file->ctxs)) {
+
+                ctx = list_entry(file->ctxs.next,
+                                 struct ib_ucm_context, file_list);
+
+                up(&ctx->file->mutex);
+                ib_ucm_ctx_put(ctx); /* user reference */
+                down(&file->mutex);
+        }
+
+        up(&file->mutex);
+
+        kfree(file);
+
+        printk(KERN_ERR "UCM: Deleted struct\n");
+        return 0;
+}
+
+static struct file_operations ib_ucm_fops = {
+        .owner   = THIS_MODULE,
+        .open    = ib_ucm_open,
+        .release = ib_ucm_close,
+        .write   = ib_ucm_write,
+        .poll    = ib_ucm_poll,
+};
+
+
+static struct class *ib_ucm_class;
+static struct cdev        ib_ucm_cdev;
+
+static int __init ib_ucm_init(void)
+{
+        int result;
+
+        result = register_chrdev_region(IB_UCM_DEV, 1, "infiniband_cm");
+        if (result) {
+                printk(KERN_ERR "UCM: Error <%d> registering dev\n", result);
+                goto err_chr;
+        }
+
+        cdev_init(&ib_ucm_cdev, &ib_ucm_fops);
+
+        result = cdev_add(&ib_ucm_cdev, IB_UCM_DEV, 1);
+        if (result) {
+                printk(KERN_ERR "UCM: Error <%d> adding cdev\n", result);
+                goto err_cdev;
+        }
+
+        ib_ucm_class = class_create(THIS_MODULE, "infiniband_cm");
+        if (IS_ERR(ib_ucm_class)) {
+                result = PTR_ERR(ib_ucm_class);
+                printk(KERN_ERR "UCM: Error <%d> creating class\n", result);
+                goto err_class;
+        }
+
+        class_device_create(ib_ucm_class, IB_UCM_DEV, NULL, "ucm");
+
+        idr_init(&ctx_id_table);
+        init_MUTEX(&ctx_id_mutex);
+
+        return 0;
+err_class:
+        cdev_del(&ib_ucm_cdev);
+err_cdev:
+        unregister_chrdev_region(IB_UCM_DEV, 1);
+err_chr:
+        return result;
+}
+
+static void __exit ib_ucm_cleanup(void)
+{
+        class_device_destroy(ib_ucm_class, IB_UCM_DEV);
+        class_destroy(ib_ucm_class);
+        cdev_del(&ib_ucm_cdev);
+        unregister_chrdev_region(IB_UCM_DEV, 1);
+}
+
+module_init(ib_ucm_init);
+module_exit(ib_ucm_cleanup);
diff --git a/drivers/infiniband/core/ucm.h b/drivers/infiniband/core/ucm.h
new file mode 100644
index 000000000000..6d36606151b2
--- /dev/null
+++ b/drivers/infiniband/core/ucm.h
@@ -0,0 +1,89 @@
+/*
+ * Copyright (c) 2005 Topspin Communications.  All rights reserved.
+ *
+ * This software is available to you under a choice of one of two
+ * licenses.  You may choose to be licensed under the terms of the GNU
+ * General Public License (GPL) Version 2, available from the file
+ * COPYING in the main directory of this source tree, or the
+ * OpenIB.org BSD license below:
+ *
+ *     Redistribution and use in source and binary forms, with or
+ *     without modification, are permitted provided that the following
+ *     conditions are met:
+ *
+ *      - Redistributions of source code must retain the above
+ *        copyright notice, this list of conditions and the following
+ *        disclaimer.
+ *
+ *      - Redistributions in binary form must reproduce the above
+ *        copyright notice, this list of conditions and the following
+ *        disclaimer in the documentation and/or other materials
+ *        provided with the distribution.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+ * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+ * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+ * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
+ * BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
+ * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
+ * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+ * SOFTWARE.
+ *
+ * $Id: ucm.h 2208 2005-04-22 23:24:31Z libor $
+ */
+
+#ifndef UCM_H
+#define UCM_H
+
+#include <linux/fs.h>
+#include <linux/device.h>
+#include <linux/cdev.h>
+#include <linux/idr.h>
+
+#include <ib_cm.h>
+#include <ib_user_cm.h>
+
+#define IB_UCM_CM_ID_INVALID 0xffffffff
+
+struct ib_ucm_file {
+        struct semaphore mutex;
+        struct file *filp;
+        /*
+         * list of pending events
+         */
+        struct list_head  ctxs;   /* list of active connections */
+        struct list_head  events; /* list of pending events */
+        wait_queue_head_t poll_wait;
+};
+
+struct ib_ucm_context {
+        int                 id;
+        int                 ref;
+        int                 error;
+
+        struct ib_ucm_file *file;
+        struct ib_cm_id    *cm_id;
+        struct semaphore    mutex;
+
+        struct list_head    events;    /* list of pending events. */
+        struct list_head    file_list; /* member in file ctx list */
+};
+
+struct ib_ucm_event {
+        struct ib_ucm_context *ctx;
+        struct list_head file_list; /* member in file event list */
+        struct list_head ctx_list;  /* member in ctx event list */
+
+        struct ib_ucm_event_resp resp;
+        void *data;
+        void *info;
+        int data_len;
+        int info_len;
+        /*
+         * new connection identifiers needs to be saved until
+         * userspace can get a handle on them.
+         */
+        struct ib_cm_id *cm_id;
+};
+
+#endif /* UCM_H */
diff --git a/drivers/infiniband/core/user_mad.c b/drivers/infiniband/core/user_mad.c
index 9d912d6877ff..2e38792df533 100644
--- a/drivers/infiniband/core/user_mad.c
+++ b/drivers/infiniband/core/user_mad.c
@@ -1,5 +1,7 @@
 /*
  * Copyright (c) 2004 Topspin Communications.  All rights reserved.
+ * Copyright (c) 2005 Voltaire, Inc. All rights reserved.
+ * Copyright (c) 2005 Sun Microsystems, Inc. All rights reserved.
  *
  * This software is available to you under a choice of one of two
  * licenses.  You may choose to be licensed under the terms of the GNU
@@ -29,7 +31,7 @@
  * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
  * SOFTWARE.
  *
- * $Id: user_mad.c 1389 2004-12-27 22:56:47Z roland $
+ * $Id: user_mad.c 2814 2005-07-06 19:14:09Z halr $
  */
 
 #include <linux/module.h>
@@ -94,10 +96,12 @@ struct ib_umad_file {
 };
 
 struct ib_umad_packet {
-        struct ib_user_mad mad;
         struct ib_ah      *ah;
+        struct ib_mad_send_buf *msg;
         struct list_head   list;
+        int                length;
         DECLARE_PCI_UNMAP_ADDR(mapping)
+        struct ib_user_mad mad;
 };
 
 static const dev_t base_dev = MKDEV(IB_UMAD_MAJOR, IB_UMAD_MINOR_BASE);
@@ -114,10 +118,10 @@ static int queue_packet(struct ib_umad_file *file,
         int ret = 1;
 
         down_read(&file->agent_mutex);
-        for (packet->mad.id = 0;
-             packet->mad.id < IB_UMAD_MAX_AGENTS;
-             packet->mad.id++)
-                if (agent == file->agent[packet->mad.id]) {
+        for (packet->mad.hdr.id = 0;
+             packet->mad.hdr.id < IB_UMAD_MAX_AGENTS;
+             packet->mad.hdr.id++)
+                if (agent == file->agent[packet->mad.hdr.id]) {
                         spin_lock_irq(&file->recv_lock);
                         list_add_tail(&packet->list, &file->recv_list);
                         spin_unlock_irq(&file->recv_lock);
@@ -135,22 +139,30 @@ static void send_handler(struct ib_mad_agent *agent,
                          struct ib_mad_send_wc *send_wc)
 {
         struct ib_umad_file *file = agent->context;
-        struct ib_umad_packet *packet =
+        struct ib_umad_packet *timeout, *packet =
                 (void *) (unsigned long) send_wc->wr_id;
 
-        dma_unmap_single(agent->device->dma_device,
-                         pci_unmap_addr(packet, mapping),
-                         sizeof packet->mad.data,
-                         DMA_TO_DEVICE);
-        ib_destroy_ah(packet->ah);
+        ib_destroy_ah(packet->msg->send_wr.wr.ud.ah);
+        ib_free_send_mad(packet->msg);
 
         if (send_wc->status == IB_WC_RESP_TIMEOUT_ERR) {
-                packet->mad.status = ETIMEDOUT;
+                timeout = kmalloc(sizeof *timeout + sizeof (struct ib_mad_hdr),
+                                  GFP_KERNEL);
+                if (!timeout)
+                        goto out;
 
-                if (!queue_packet(file, agent, packet))
-                        return;
-        }
+                memset(timeout, 0, sizeof *timeout + sizeof (struct ib_mad_hdr));
 
+                timeout->length = sizeof (struct ib_mad_hdr);
+                timeout->mad.hdr.id = packet->mad.hdr.id;
+                timeout->mad.hdr.status = ETIMEDOUT;
+                memcpy(timeout->mad.data, packet->mad.data,
+                       sizeof (struct ib_mad_hdr));
+
+                if (!queue_packet(file, agent, timeout))
+                                return;
+        }
+out:
         kfree(packet);
 }
 
@@ -159,30 +171,35 @@ static void recv_handler(struct ib_mad_agent *agent,
 {
         struct ib_umad_file *file = agent->context;
         struct ib_umad_packet *packet;
+        int length;
 
         if (mad_recv_wc->wc->status != IB_WC_SUCCESS)
                 goto out;
 
-        packet = kmalloc(sizeof *packet, GFP_KERNEL);
+        length = mad_recv_wc->mad_len;
+        packet = kmalloc(sizeof *packet + length, GFP_KERNEL);
         if (!packet)
                 goto out;
 
-        memset(packet, 0, sizeof *packet);
+        memset(packet, 0, sizeof *packet + length);
+        packet->length = length;
+
+        ib_coalesce_recv_mad(mad_recv_wc, packet->mad.data);
 
-        memcpy(packet->mad.data, mad_recv_wc->recv_buf.mad, sizeof packet->mad.data);
-        packet->mad.status        = 0;
-        packet->mad.qpn           = cpu_to_be32(mad_recv_wc->wc->src_qp);
-        packet->mad.lid           = cpu_to_be16(mad_recv_wc->wc->slid);
-        packet->mad.sl            = mad_recv_wc->wc->sl;
-        packet->mad.path_bits     = mad_recv_wc->wc->dlid_path_bits;
-        packet->mad.grh_present   = !!(mad_recv_wc->wc->wc_flags & IB_WC_GRH);
-        if (packet->mad.grh_present) {
+        packet->mad.hdr.status    = 0;
+        packet->mad.hdr.length    = length + sizeof (struct ib_user_mad);
+        packet->mad.hdr.qpn       = cpu_to_be32(mad_recv_wc->wc->src_qp);
+        packet->mad.hdr.lid       = cpu_to_be16(mad_recv_wc->wc->slid);
+        packet->mad.hdr.sl        = mad_recv_wc->wc->sl;
+        packet->mad.hdr.path_bits = mad_recv_wc->wc->dlid_path_bits;
+        packet->mad.hdr.grh_present = !!(mad_recv_wc->wc->wc_flags & IB_WC_GRH);
+        if (packet->mad.hdr.grh_present) {
                 /* XXX parse GRH */
-                packet->mad.gid_index     = 0;
-                packet->mad.hop_limit     = 0;
-                packet->mad.traffic_class = 0;
-                memset(packet->mad.gid, 0, 16);
-                packet->mad.flow_label    = 0;
+                packet->mad.hdr.gid_index       = 0;
+                packet->mad.hdr.hop_limit       = 0;
+                packet->mad.hdr.traffic_class   = 0;
+                memset(packet->mad.hdr.gid, 0, 16);
+                packet->mad.hdr.flow_label      = 0;
         }
 
         if (queue_packet(file, agent, packet))
@@ -199,7 +216,7 @@ static ssize_t ib_umad_read(struct file *filp, char __user *buf,
         struct ib_umad_packet *packet;
         ssize_t ret;
 
-        if (count < sizeof (struct ib_user_mad))
+        if (count < sizeof (struct ib_user_mad) + sizeof (struct ib_mad))
                 return -EINVAL;
 
         spin_lock_irq(&file->recv_lock);
@@ -222,12 +239,25 @@ static ssize_t ib_umad_read(struct file *filp, char __user *buf,
 
         spin_unlock_irq(&file->recv_lock);
 
-        if (copy_to_user(buf, &packet->mad, sizeof packet->mad))
+        if (count < packet->length + sizeof (struct ib_user_mad)) {
+                /* Return length needed (and first RMPP segment) if too small */
+                if (copy_to_user(buf, &packet->mad,
+                                 sizeof (struct ib_user_mad) + sizeof (struct ib_mad)))
+                        ret = -EFAULT;
+                else
+                        ret = -ENOSPC;
+        } else if (copy_to_user(buf, &packet->mad,
+                              packet->length + sizeof (struct ib_user_mad)))
                 ret = -EFAULT;
         else
-                ret = sizeof packet->mad;
-
-        kfree(packet);
+                ret = packet->length + sizeof (struct ib_user_mad);
+        if (ret < 0) {
+                /* Requeue packet */
+                spin_lock_irq(&file->recv_lock);
+                list_add(&packet->list, &file->recv_list);
+                spin_unlock_irq(&file->recv_lock);
+        } else
+                kfree(packet);
         return ret;
 }
 
@@ -238,69 +268,57 @@ static ssize_t ib_umad_write(struct file *filp, const char __user *buf,
         struct ib_umad_packet *packet;
         struct ib_mad_agent *agent;
         struct ib_ah_attr ah_attr;
-        struct ib_sge      gather_list;
-        struct ib_send_wr *bad_wr, wr = {
-                .opcode      = IB_WR_SEND,
-                .sg_list     = &gather_list,
-                .num_sge     = 1,
-                .send_flags  = IB_SEND_SIGNALED,
-        };
+        struct ib_send_wr *bad_wr;
+        struct ib_rmpp_mad *rmpp_mad;
         u8 method;
         u64 *tid;
-        int ret;
+        int ret, length, hdr_len, data_len, rmpp_hdr_size;
+        int rmpp_active = 0;
 
         if (count < sizeof (struct ib_user_mad))
                 return -EINVAL;
 
-        packet = kmalloc(sizeof *packet, GFP_KERNEL);
+        length = count - sizeof (struct ib_user_mad);
+        packet = kmalloc(sizeof *packet + sizeof(struct ib_mad_hdr) +
+                         sizeof(struct ib_rmpp_hdr), GFP_KERNEL);
         if (!packet)
                 return -ENOMEM;
 
-        if (copy_from_user(&packet->mad, buf, sizeof packet->mad)) {
-                kfree(packet);
-                return -EFAULT;
+        if (copy_from_user(&packet->mad, buf,
+                            sizeof (struct ib_user_mad) +
+                            sizeof(struct ib_mad_hdr) +
+                            sizeof(struct ib_rmpp_hdr))) {
+                ret = -EFAULT;
+                goto err;
         }
 
-        if (packet->mad.id < 0 || packet->mad.id >= IB_UMAD_MAX_AGENTS) {
+        if (packet->mad.hdr.id < 0 ||
+            packet->mad.hdr.id >= IB_UMAD_MAX_AGENTS) {
                 ret = -EINVAL;
                 goto err;
         }
 
+        packet->length = length;
+
         down_read(&file->agent_mutex);
 
-        agent = file->agent[packet->mad.id];
+        agent = file->agent[packet->mad.hdr.id];
         if (!agent) {
                 ret = -EINVAL;
                 goto err_up;
         }
 
-        /*
-         * If userspace is generating a request that will generate a
-         * response, we need to make sure the high-order part of the
-         * transaction ID matches the agent being used to send the
-         * MAD.
-         */
-        method = ((struct ib_mad_hdr *) packet->mad.data)->method;
-
-        if (!(method & IB_MGMT_METHOD_RESP)       &&
-            method != IB_MGMT_METHOD_TRAP_REPRESS &&
-            method != IB_MGMT_METHOD_SEND) {
-                tid = &((struct ib_mad_hdr *) packet->mad.data)->tid;
-                *tid = cpu_to_be64(((u64) agent->hi_tid) << 32 |
-                                   (be64_to_cpup(tid) & 0xffffffff));
-        }
-
         memset(&ah_attr, 0, sizeof ah_attr);
-        ah_attr.dlid          = be16_to_cpu(packet->mad.lid);
-        ah_attr.sl            = packet->mad.sl;
-        ah_attr.src_path_bits = packet->mad.path_bits;
+        ah_attr.dlid          = be16_to_cpu(packet->mad.hdr.lid);
+        ah_attr.sl            = packet->mad.hdr.sl;
+        ah_attr.src_path_bits = packet->mad.hdr.path_bits;
         ah_attr.port_num      = file->port->port_num;
-        if (packet->mad.grh_present) {
+        if (packet->mad.hdr.grh_present) {
                 ah_attr.ah_flags = IB_AH_GRH;
-                memcpy(ah_attr.grh.dgid.raw, packet->mad.gid, 16);
-                ah_attr.grh.flow_label     = packet->mad.flow_label;
-                ah_attr.grh.hop_limit      = packet->mad.hop_limit;
-                ah_attr.grh.traffic_class  = packet->mad.traffic_class;
+                memcpy(ah_attr.grh.dgid.raw, packet->mad.hdr.gid, 16);
+                ah_attr.grh.flow_label     = packet->mad.hdr.flow_label;
+                ah_attr.grh.hop_limit      = packet->mad.hdr.hop_limit;
+                ah_attr.grh.traffic_class  = packet->mad.hdr.traffic_class;
         }
 
         packet->ah = ib_create_ah(agent->qp->pd, &ah_attr);
@@ -309,34 +327,104 @@ static ssize_t ib_umad_write(struct file *filp, const char __user *buf,
                 goto err_up;
         }
 
-        gather_list.addr = dma_map_single(agent->device->dma_device,
-                                          packet->mad.data,
-                                          sizeof packet->mad.data,
-                                          DMA_TO_DEVICE);
-        gather_list.length = sizeof packet->mad.data;
-        gather_list.lkey   = file->mr[packet->mad.id]->lkey;
-        pci_unmap_addr_set(packet, mapping, gather_list.addr);
+        rmpp_mad = (struct ib_rmpp_mad *) packet->mad.data;
+        if (ib_get_rmpp_flags(&rmpp_mad->rmpp_hdr) & IB_MGMT_RMPP_FLAG_ACTIVE) {
+                /* RMPP active */
+                if (!agent->rmpp_version) {
+                        ret = -EINVAL;
+                        goto err_ah;
+                }
+                /* Validate that management class can support RMPP */
+                if (rmpp_mad->mad_hdr.mgmt_class == IB_MGMT_CLASS_SUBN_ADM) {
+                        hdr_len = offsetof(struct ib_sa_mad, data);
+                        data_len = length;
+                } else if ((rmpp_mad->mad_hdr.mgmt_class >= IB_MGMT_CLASS_VENDOR_RANGE2_START) &&
+                            (rmpp_mad->mad_hdr.mgmt_class <= IB_MGMT_CLASS_VENDOR_RANGE2_END)) {
+                                hdr_len = offsetof(struct ib_vendor_mad, data);
+                                data_len = length - hdr_len;
+                } else {
+                        ret = -EINVAL;
+                        goto err_ah;
+                }
+                rmpp_active = 1;
+        } else {
+                if (length > sizeof(struct ib_mad)) {
+                        ret = -EINVAL;
+                        goto err_ah;
+                }
+                hdr_len = offsetof(struct ib_mad, data);
+                data_len = length - hdr_len;
+        }
+
+        packet->msg = ib_create_send_mad(agent,
+                                         be32_to_cpu(packet->mad.hdr.qpn),
+                                         0, packet->ah, rmpp_active,
+                                         hdr_len, data_len,
+                                         GFP_KERNEL);
+        if (IS_ERR(packet->msg)) {
+                ret = PTR_ERR(packet->msg);
+                goto err_ah;
+        }
 
-        wr.wr.ud.mad_hdr     = (struct ib_mad_hdr *) packet->mad.data;
-        wr.wr.ud.ah          = packet->ah;
-        wr.wr.ud.remote_qpn  = be32_to_cpu(packet->mad.qpn);
-        wr.wr.ud.remote_qkey = be32_to_cpu(packet->mad.qkey);
-        wr.wr.ud.timeout_ms  = packet->mad.timeout_ms;
+        packet->msg->send_wr.wr.ud.timeout_ms  = packet->mad.hdr.timeout_ms;
+        packet->msg->send_wr.wr.ud.retries = packet->mad.hdr.retries;
 
-        wr.wr_id            = (unsigned long) packet;
+        /* Override send WR WRID initialized in ib_create_send_mad */
+        packet->msg->send_wr.wr_id = (unsigned long) packet;
 
-        ret = ib_post_send_mad(agent, &wr, &bad_wr);
-        if (ret) {
-                dma_unmap_single(agent->device->dma_device,
-                                 pci_unmap_addr(packet, mapping),
-                                 sizeof packet->mad.data,
-                                 DMA_TO_DEVICE);
-                goto err_up;
+        if (!rmpp_active) {
+                /* Copy message from user into send buffer */
+                if (copy_from_user(packet->msg->mad,
+                                   buf + sizeof(struct ib_user_mad), length)) {
+                        ret = -EFAULT;
+                        goto err_msg;
+                }
+        } else {
+                rmpp_hdr_size = sizeof(struct ib_mad_hdr) +
+                                sizeof(struct ib_rmpp_hdr);
+
+                /* Only copy MAD headers (RMPP header in place) */
+                memcpy(packet->msg->mad, packet->mad.data,
+                       sizeof(struct ib_mad_hdr));
+
+                /* Now, copy rest of message from user into send buffer */
+                if (copy_from_user(((struct ib_rmpp_mad *) packet->msg->mad)->data,
+                                   buf + sizeof (struct ib_user_mad) + rmpp_hdr_size,
+                                   length - rmpp_hdr_size)) {
+                        ret = -EFAULT;
+                        goto err_msg;
+                }
+        }
+
+        /*
+         * If userspace is generating a request that will generate a
+         * response, we need to make sure the high-order part of the
+         * transaction ID matches the agent being used to send the
+         * MAD.
+         */
+        method = packet->msg->mad->mad_hdr.method;
+
+        if (!(method & IB_MGMT_METHOD_RESP)       &&
+            method != IB_MGMT_METHOD_TRAP_REPRESS &&
+            method != IB_MGMT_METHOD_SEND) {
+                tid = &packet->msg->mad->mad_hdr.tid;
+                *tid = cpu_to_be64(((u64) agent->hi_tid) << 32 |
+                                   (be64_to_cpup(tid) & 0xffffffff));
         }
 
+        ret = ib_post_send_mad(agent, &packet->msg->send_wr, &bad_wr);
+        if (ret)
+                goto err_msg;
+
         up_read(&file->agent_mutex);
 
-        return sizeof packet->mad;
+        return sizeof (struct ib_user_mad_hdr) + packet->length;
+
+err_msg:
+        ib_free_send_mad(packet->msg);
+
+err_ah:
+        ib_destroy_ah(packet->ah);
 
 err_up:
         up_read(&file->agent_mutex);
@@ -399,7 +487,8 @@ found:
         agent = ib_register_mad_agent(file->port->ib_dev, file->port->port_num,
                                       ureq.qpn ? IB_QPT_GSI : IB_QPT_SMI,
                                       ureq.mgmt_class ? &req : NULL,
-                                      0, send_handler, recv_handler, file);
+                                      ureq.rmpp_version,
+                                      send_handler, recv_handler, file);
         if (IS_ERR(agent)) {
                 ret = PTR_ERR(agent);
                 goto out;
@@ -460,8 +549,8 @@ out:
         return ret;
 }
 
-static long ib_umad_ioctl(struct file *filp,
-                         unsigned int cmd, unsigned long arg)
+static long ib_umad_ioctl(struct file *filp, unsigned int cmd,
+                          unsigned long arg)
 {
         switch (cmd) {
         case IB_USER_MAD_REGISTER_AGENT:
@@ -517,14 +606,14 @@ static int ib_umad_close(struct inode *inode, struct file *filp)
 }
 
 static struct file_operations umad_fops = {
-        .owner          = THIS_MODULE,
-        .read           = ib_umad_read,
-        .write          = ib_umad_write,
-        .poll           = ib_umad_poll,
+        .owner          = THIS_MODULE,
+        .read           = ib_umad_read,
+        .write          = ib_umad_write,
+        .poll           = ib_umad_poll,
         .unlocked_ioctl = ib_umad_ioctl,
-        .compat_ioctl   = ib_umad_ioctl,
-        .open           = ib_umad_open,
-        .release        = ib_umad_close
+        .compat_ioctl   = ib_umad_ioctl,
+        .open           = ib_umad_open,
+        .release        = ib_umad_close
 };
 
 static int ib_umad_sm_open(struct inode *inode, struct file *filp)
diff --git a/drivers/infiniband/core/verbs.c b/drivers/infiniband/core/verbs.c
index 2516f9646515..506fdf1f2a26 100644
--- a/drivers/infiniband/core/verbs.c
+++ b/drivers/infiniband/core/verbs.c
@@ -41,6 +41,7 @@
 #include <linux/err.h>
 
 #include <ib_verbs.h>
+#include <ib_cache.h>
 
 /* Protection domains */
 
@@ -88,6 +89,40 @@ struct ib_ah *ib_create_ah(struct ib_pd *pd, struct ib_ah_attr *ah_attr)
 }
 EXPORT_SYMBOL(ib_create_ah);
 
+struct ib_ah *ib_create_ah_from_wc(struct ib_pd *pd, struct ib_wc *wc,
+                                   struct ib_grh *grh, u8 port_num)
+{
+        struct ib_ah_attr ah_attr;
+        u32 flow_class;
+        u16 gid_index;
+        int ret;
+
+        memset(&ah_attr, 0, sizeof ah_attr);
+        ah_attr.dlid = wc->slid;
+        ah_attr.sl = wc->sl;
+        ah_attr.src_path_bits = wc->dlid_path_bits;
+        ah_attr.port_num = port_num;
+
+        if (wc->wc_flags & IB_WC_GRH) {
+                ah_attr.ah_flags = IB_AH_GRH;
+                ah_attr.grh.dgid = grh->dgid;
+
+                ret = ib_find_cached_gid(pd->device, &grh->sgid, &port_num,
+                                         &gid_index);
+                if (ret)
+                        return ERR_PTR(ret);
+
+                ah_attr.grh.sgid_index = (u8) gid_index;
+                flow_class = be32_to_cpu(grh->version_tclass_flow);
+                ah_attr.grh.flow_label = flow_class & 0xFFFFF;
+                ah_attr.grh.traffic_class = (flow_class >> 20) & 0xFF;
+                ah_attr.grh.hop_limit = grh->hop_limit;
+        }
+
+        return ib_create_ah(pd, &ah_attr);
+}
+EXPORT_SYMBOL(ib_create_ah_from_wc);
+
 int ib_modify_ah(struct ib_ah *ah, struct ib_ah_attr *ah_attr)
 {
         return ah->device->modify_ah ?
diff --git a/drivers/infiniband/include/ib_cm.h b/drivers/infiniband/include/ib_cm.h
new file mode 100644
index 000000000000..e5d74a730a70
--- /dev/null
+++ b/drivers/infiniband/include/ib_cm.h
@@ -0,0 +1,568 @@
+/*
+ * Copyright (c) 2004 Intel Corporation.  All rights reserved.
+ * Copyright (c) 2004 Topspin Corporation.  All rights reserved.
+ * Copyright (c) 2004 Voltaire Corporation.  All rights reserved.
+ * Copyright (c) 2005 Sun Microsystems, Inc. All rights reserved.
+ *
+ * This software is available to you under a choice of one of two
+ * licenses.  You may choose to be licensed under the terms of the GNU
+ * General Public License (GPL) Version 2, available from the file
+ * COPYING in the main directory of this source tree, or the
+ * OpenIB.org BSD license below:
+ *
+ *     Redistribution and use in source and binary forms, with or
+ *     without modification, are permitted provided that the following
+ *     conditions are met:
+ *
+ *      - Redistributions of source code must retain the above
+ *        copyright notice, this list of conditions and the following
+ *        disclaimer.
+ *
+ *      - Redistributions in binary form must reproduce the above
+ *        copyright notice, this list of conditions and the following
+ *        disclaimer in the documentation and/or other materials
+ *        provided with the distribution.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+ * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+ * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+ * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
+ * BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
+ * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
+ * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+ * SOFTWARE.
+ *
+ * $Id: ib_cm.h 2730 2005-06-28 16:43:03Z sean.hefty $
+ */
+#if !defined(IB_CM_H)
+#define IB_CM_H
+
+#include <ib_mad.h>
+#include <ib_sa.h>
+
+enum ib_cm_state {
+        IB_CM_IDLE,
+        IB_CM_LISTEN,
+        IB_CM_REQ_SENT,
+        IB_CM_REQ_RCVD,
+        IB_CM_MRA_REQ_SENT,
+        IB_CM_MRA_REQ_RCVD,
+        IB_CM_REP_SENT,
+        IB_CM_REP_RCVD,
+        IB_CM_MRA_REP_SENT,
+        IB_CM_MRA_REP_RCVD,
+        IB_CM_ESTABLISHED,
+        IB_CM_DREQ_SENT,
+        IB_CM_DREQ_RCVD,
+        IB_CM_TIMEWAIT,
+        IB_CM_SIDR_REQ_SENT,
+        IB_CM_SIDR_REQ_RCVD
+};
+
+enum ib_cm_lap_state {
+        IB_CM_LAP_IDLE,
+        IB_CM_LAP_SENT,
+        IB_CM_LAP_RCVD,
+        IB_CM_MRA_LAP_SENT,
+        IB_CM_MRA_LAP_RCVD,
+};
+
+enum ib_cm_event_type {
+        IB_CM_REQ_ERROR,
+        IB_CM_REQ_RECEIVED,
+        IB_CM_REP_ERROR,
+        IB_CM_REP_RECEIVED,
+        IB_CM_RTU_RECEIVED,
+        IB_CM_USER_ESTABLISHED,
+        IB_CM_DREQ_ERROR,
+        IB_CM_DREQ_RECEIVED,
+        IB_CM_DREP_RECEIVED,
+        IB_CM_TIMEWAIT_EXIT,
+        IB_CM_MRA_RECEIVED,
+        IB_CM_REJ_RECEIVED,
+        IB_CM_LAP_ERROR,
+        IB_CM_LAP_RECEIVED,
+        IB_CM_APR_RECEIVED,
+        IB_CM_SIDR_REQ_ERROR,
+        IB_CM_SIDR_REQ_RECEIVED,
+        IB_CM_SIDR_REP_RECEIVED
+};
+
+enum ib_cm_data_size {
+        IB_CM_REQ_PRIVATE_DATA_SIZE      = 92,
+        IB_CM_MRA_PRIVATE_DATA_SIZE      = 222,
+        IB_CM_REJ_PRIVATE_DATA_SIZE      = 148,
+        IB_CM_REP_PRIVATE_DATA_SIZE      = 196,
+        IB_CM_RTU_PRIVATE_DATA_SIZE      = 224,
+        IB_CM_DREQ_PRIVATE_DATA_SIZE     = 220,
+        IB_CM_DREP_PRIVATE_DATA_SIZE     = 224,
+        IB_CM_REJ_ARI_LENGTH             = 72,
+        IB_CM_LAP_PRIVATE_DATA_SIZE      = 168,
+        IB_CM_APR_PRIVATE_DATA_SIZE      = 148,
+        IB_CM_APR_INFO_LENGTH            = 72,
+        IB_CM_SIDR_REQ_PRIVATE_DATA_SIZE = 216,
+        IB_CM_SIDR_REP_PRIVATE_DATA_SIZE = 136,
+        IB_CM_SIDR_REP_INFO_LENGTH       = 72
+};
+
+struct ib_cm_id;
+
+struct ib_cm_req_event_param {
+        struct ib_cm_id         *listen_id;
+        struct ib_device        *device;
+        u8                      port;
+
+        struct ib_sa_path_rec   *primary_path;
+        struct ib_sa_path_rec   *alternate_path;
+
+        u64                     remote_ca_guid;
+        u32                     remote_qkey;
+        u32                     remote_qpn;
+        enum ib_qp_type         qp_type;
+
+        u32                     starting_psn;
+        u8                      responder_resources;
+        u8                      initiator_depth;
+        unsigned int            local_cm_response_timeout:5;
+        unsigned int            flow_control:1;
+        unsigned int            remote_cm_response_timeout:5;
+        unsigned int            retry_count:3;
+        unsigned int            rnr_retry_count:3;
+        unsigned int            srq:1;
+};
+
+struct ib_cm_rep_event_param {
+        u64                     remote_ca_guid;
+        u32                     remote_qkey;
+        u32                     remote_qpn;
+        u32                     starting_psn;
+        u8                      responder_resources;
+        u8                      initiator_depth;
+        unsigned int            target_ack_delay:5;
+        unsigned int            failover_accepted:2;
+        unsigned int            flow_control:1;
+        unsigned int            rnr_retry_count:3;
+        unsigned int            srq:1;
+};
+
+enum ib_cm_rej_reason {
+        IB_CM_REJ_NO_QP                         = __constant_htons(1),
+        IB_CM_REJ_NO_EEC                        = __constant_htons(2),
+        IB_CM_REJ_NO_RESOURCES                  = __constant_htons(3),
+        IB_CM_REJ_TIMEOUT                       = __constant_htons(4),
+        IB_CM_REJ_UNSUPPORTED                   = __constant_htons(5),
+        IB_CM_REJ_INVALID_COMM_ID               = __constant_htons(6),
+        IB_CM_REJ_INVALID_COMM_INSTANCE         = __constant_htons(7),
+        IB_CM_REJ_INVALID_SERVICE_ID            = __constant_htons(8),
+        IB_CM_REJ_INVALID_TRANSPORT_TYPE        = __constant_htons(9),
+        IB_CM_REJ_STALE_CONN                    = __constant_htons(10),
+        IB_CM_REJ_RDC_NOT_EXIST                 = __constant_htons(11),
+        IB_CM_REJ_INVALID_GID                   = __constant_htons(12),
+        IB_CM_REJ_INVALID_LID                   = __constant_htons(13),
+        IB_CM_REJ_INVALID_SL                    = __constant_htons(14),
+        IB_CM_REJ_INVALID_TRAFFIC_CLASS         = __constant_htons(15),
+        IB_CM_REJ_INVALID_HOP_LIMIT             = __constant_htons(16),
+        IB_CM_REJ_INVALID_PACKET_RATE           = __constant_htons(17),
+        IB_CM_REJ_INVALID_ALT_GID               = __constant_htons(18),
+        IB_CM_REJ_INVALID_ALT_LID               = __constant_htons(19),
+        IB_CM_REJ_INVALID_ALT_SL                = __constant_htons(20),
+        IB_CM_REJ_INVALID_ALT_TRAFFIC_CLASS     = __constant_htons(21),
+        IB_CM_REJ_INVALID_ALT_HOP_LIMIT         = __constant_htons(22),
+        IB_CM_REJ_INVALID_ALT_PACKET_RATE       = __constant_htons(23),
+        IB_CM_REJ_PORT_REDIRECT                 = __constant_htons(24),
+        IB_CM_REJ_INVALID_MTU                   = __constant_htons(26),
+        IB_CM_REJ_INSUFFICIENT_RESP_RESOURCES   = __constant_htons(27),
+        IB_CM_REJ_CONSUMER_DEFINED              = __constant_htons(28),
+        IB_CM_REJ_INVALID_RNR_RETRY             = __constant_htons(29),
+        IB_CM_REJ_DUPLICATE_LOCAL_COMM_ID       = __constant_htons(30),
+        IB_CM_REJ_INVALID_CLASS_VERSION         = __constant_htons(31),
+        IB_CM_REJ_INVALID_FLOW_LABEL            = __constant_htons(32),
+        IB_CM_REJ_INVALID_ALT_FLOW_LABEL        = __constant_htons(33)
+};
+
+struct ib_cm_rej_event_param {
+        enum ib_cm_rej_reason   reason;
+        void                    *ari;
+        u8                      ari_length;
+};
+
+struct ib_cm_mra_event_param {
+        u8      service_timeout;
+};
+
+struct ib_cm_lap_event_param {
+        struct ib_sa_path_rec   *alternate_path;
+};
+
+enum ib_cm_apr_status {
+        IB_CM_APR_SUCCESS,
+        IB_CM_APR_INVALID_COMM_ID,
+        IB_CM_APR_UNSUPPORTED,
+        IB_CM_APR_REJECT,
+        IB_CM_APR_REDIRECT,
+        IB_CM_APR_IS_CURRENT,
+        IB_CM_APR_INVALID_QPN_EECN,
+        IB_CM_APR_INVALID_LID,
+        IB_CM_APR_INVALID_GID,
+        IB_CM_APR_INVALID_FLOW_LABEL,
+        IB_CM_APR_INVALID_TCLASS,
+        IB_CM_APR_INVALID_HOP_LIMIT,
+        IB_CM_APR_INVALID_PACKET_RATE,
+        IB_CM_APR_INVALID_SL
+};
+
+struct ib_cm_apr_event_param {
+        enum ib_cm_apr_status   ap_status;
+        void                    *apr_info;
+        u8                      info_len;
+};
+
+struct ib_cm_sidr_req_event_param {
+        struct ib_cm_id         *listen_id;
+        struct ib_device        *device;
+        u8                      port;
+
+        u16     pkey;
+};
+
+enum ib_cm_sidr_status {
+        IB_SIDR_SUCCESS,
+        IB_SIDR_UNSUPPORTED,
+        IB_SIDR_REJECT,
+        IB_SIDR_NO_QP,
+        IB_SIDR_REDIRECT,
+        IB_SIDR_UNSUPPORTED_VERSION
+};
+
+struct ib_cm_sidr_rep_event_param {
+        enum ib_cm_sidr_status  status;
+        u32                     qkey;
+        u32                     qpn;
+        void                    *info;
+        u8                      info_len;
+
+};
+
+struct ib_cm_event {
+        enum ib_cm_event_type   event;
+        union {
+                struct ib_cm_req_event_param    req_rcvd;
+                struct ib_cm_rep_event_param    rep_rcvd;
+                /* No data for RTU received events. */
+                struct ib_cm_rej_event_param    rej_rcvd;
+                struct ib_cm_mra_event_param    mra_rcvd;
+                struct ib_cm_lap_event_param    lap_rcvd;
+                struct ib_cm_apr_event_param    apr_rcvd;
+                /* No data for DREQ/DREP received events. */
+                struct ib_cm_sidr_req_event_param sidr_req_rcvd;
+                struct ib_cm_sidr_rep_event_param sidr_rep_rcvd;
+                enum ib_wc_status               send_status;
+        } param;
+
+        void                    *private_data;
+};
+
+/**
+ * ib_cm_handler - User-defined callback to process communication events.
+ * @cm_id: Communication identifier associated with the reported event.
+ * @event: Information about the communication event.
+ *
+ * IB_CM_REQ_RECEIVED and IB_CM_SIDR_REQ_RECEIVED communication events
+ * generated as a result of listen requests result in the allocation of a
+ * new @cm_id.  The new @cm_id is returned to the user through this callback.
+ * Clients are responsible for destroying the new @cm_id.  For peer-to-peer
+ * IB_CM_REQ_RECEIVED and all other events, the returned @cm_id corresponds
+ * to a user's existing communication identifier.
+ *
+ * Users may not call ib_destroy_cm_id while in the context of this callback;
+ * however, returning a non-zero value instructs the communication manager to
+ * destroy the @cm_id after the callback completes.
+ */
+typedef int (*ib_cm_handler)(struct ib_cm_id *cm_id,
+                             struct ib_cm_event *event);
+
+struct ib_cm_id {
+        ib_cm_handler           cm_handler;
+        void                    *context;
+        u64                     service_id;
+        u64                     service_mask;
+        enum ib_cm_state        state;          /* internal CM/debug use */
+        enum ib_cm_lap_state    lap_state;      /* internal CM/debug use */
+        u32                     local_id;
+        u32                     remote_id;
+};
+
+/**
+ * ib_create_cm_id - Allocate a communication identifier.
+ * @cm_handler: Callback invoked to notify the user of CM events.
+ * @context: User specified context associated with the communication
+ *   identifier.
+ *
+ * Communication identifiers are used to track connection states, service
+ * ID resolution requests, and listen requests.
+ */
+struct ib_cm_id *ib_create_cm_id(ib_cm_handler cm_handler,
+                                 void *context);
+
+/**
+ * ib_destroy_cm_id - Destroy a connection identifier.
+ * @cm_id: Connection identifier to destroy.
+ *
+ * This call blocks until the connection identifier is destroyed.
+ */
+void ib_destroy_cm_id(struct ib_cm_id *cm_id);
+
+#define IB_SERVICE_ID_AGN_MASK  __constant_cpu_to_be64(0xFF00000000000000ULL)
+#define IB_CM_ASSIGN_SERVICE_ID __constant_cpu_to_be64(0x0200000000000000ULL)
+
+/**
+ * ib_cm_listen - Initiates listening on the specified service ID for
+ *   connection and service ID resolution requests.
+ * @cm_id: Connection identifier associated with the listen request.
+ * @service_id: Service identifier matched against incoming connection
+ *   and service ID resolution requests.  The service ID should be specified
+ *   network-byte order.  If set to IB_CM_ASSIGN_SERVICE_ID, the CM will
+ *   assign a service ID to the caller.
+ * @service_mask: Mask applied to service ID used to listen across a
+ *   range of service IDs.  If set to 0, the service ID is matched
+ *   exactly.  This parameter is ignored if %service_id is set to
+ *   IB_CM_ASSIGN_SERVICE_ID.
+ */
+int ib_cm_listen(struct ib_cm_id *cm_id,
+                 u64 service_id,
+                 u64 service_mask);
+
+struct ib_cm_req_param {
+        struct ib_sa_path_rec   *primary_path;
+        struct ib_sa_path_rec   *alternate_path;
+        u64                     service_id;
+        u32                     qp_num;
+        enum ib_qp_type         qp_type;
+        u32                     starting_psn;
+        const void              *private_data;
+        u8                      private_data_len;
+        u8                      peer_to_peer;
+        u8                      responder_resources;
+        u8                      initiator_depth;
+        u8                      remote_cm_response_timeout;
+        u8                      flow_control;
+        u8                      local_cm_response_timeout;
+        u8                      retry_count;
+        u8                      rnr_retry_count;
+        u8                      max_cm_retries;
+        u8                      srq;
+};
+
+/**
+ * ib_send_cm_req - Sends a connection request to the remote node.
+ * @cm_id: Connection identifier that will be associated with the
+ *   connection request.
+ * @param: Connection request information needed to establish the
+ *   connection.
+ */
+int ib_send_cm_req(struct ib_cm_id *cm_id,
+                   struct ib_cm_req_param *param);
+
+struct ib_cm_rep_param {
+        u32             qp_num;
+        u32             starting_psn;
+        const void      *private_data;
+        u8              private_data_len;
+        u8              responder_resources;
+        u8              initiator_depth;
+        u8              target_ack_delay;
+        u8              failover_accepted;
+        u8              flow_control;
+        u8              rnr_retry_count;
+        u8              srq;
+};
+
+/**
+ * ib_send_cm_rep - Sends a connection reply in response to a connection
+ *   request.
+ * @cm_id: Connection identifier that will be associated with the
+ *   connection request.
+ * @param: Connection reply information needed to establish the
+ *   connection.
+ */
+int ib_send_cm_rep(struct ib_cm_id *cm_id,
+                   struct ib_cm_rep_param *param);
+
+/**
+ * ib_send_cm_rtu - Sends a connection ready to use message in response
+ *   to a connection reply message.
+ * @cm_id: Connection identifier associated with the connection request.
+ * @private_data: Optional user-defined private data sent with the
+ *   ready to use message.
+ * @private_data_len: Size of the private data buffer, in bytes.
+ */
+int ib_send_cm_rtu(struct ib_cm_id *cm_id,
+                   const void *private_data,
+                   u8 private_data_len);
+
+/**
+ * ib_send_cm_dreq - Sends a disconnection request for an existing
+ *   connection.
+ * @cm_id: Connection identifier associated with the connection being
+ *   released.
+ * @private_data: Optional user-defined private data sent with the
+ *   disconnection request message.
+ * @private_data_len: Size of the private data buffer, in bytes.
+ */
+int ib_send_cm_dreq(struct ib_cm_id *cm_id,
+                    const void *private_data,
+                    u8 private_data_len);
+
+/**
+ * ib_send_cm_drep - Sends a disconnection reply to a disconnection request.
+ * @cm_id: Connection identifier associated with the connection being
+ *   released.
+ * @private_data: Optional user-defined private data sent with the
+ *   disconnection reply message.
+ * @private_data_len: Size of the private data buffer, in bytes.
+ *
+ * If the cm_id is in the correct state, the CM will transition the connection
+ * to the timewait state, even if an error occurs sending the DREP message.
+ */
+int ib_send_cm_drep(struct ib_cm_id *cm_id,
+                    const void *private_data,
+                    u8 private_data_len);
+
+/**
+ * ib_cm_establish - Forces a connection state to established.
+ * @cm_id: Connection identifier to transition to established.
+ *
+ * This routine should be invoked by users who receive messages on a
+ * connected QP before an RTU has been received.
+ */
+int ib_cm_establish(struct ib_cm_id *cm_id);
+
+/**
+ * ib_send_cm_rej - Sends a connection rejection message to the
+ *   remote node.
+ * @cm_id: Connection identifier associated with the connection being
+ *   rejected.
+ * @reason: Reason for the connection request rejection.
+ * @ari: Optional additional rejection information.
+ * @ari_length: Size of the additional rejection information, in bytes.
+ * @private_data: Optional user-defined private data sent with the
+ *   rejection message.
+ * @private_data_len: Size of the private data buffer, in bytes.
+ */
+int ib_send_cm_rej(struct ib_cm_id *cm_id,
+                   enum ib_cm_rej_reason reason,
+                   void *ari,
+                   u8 ari_length,
+                   const void *private_data,
+                   u8 private_data_len);
+
+/**
+ * ib_send_cm_mra - Sends a message receipt acknowledgement to a connection
+ *   message.
+ * @cm_id: Connection identifier associated with the connection message.
+ * @service_timeout: The maximum time required for the sender to reply to
+ *   to the connection message.
+ * @private_data: Optional user-defined private data sent with the
+ *   message receipt acknowledgement.
+ * @private_data_len: Size of the private data buffer, in bytes.
+ */
+int ib_send_cm_mra(struct ib_cm_id *cm_id,
+                   u8 service_timeout,
+                   const void *private_data,
+                   u8 private_data_len);
+
+/**
+ * ib_send_cm_lap - Sends a load alternate path request.
+ * @cm_id: Connection identifier associated with the load alternate path
+ *   message.
+ * @alternate_path: A path record that identifies the alternate path to
+ *   load.
+ * @private_data: Optional user-defined private data sent with the
+ *   load alternate path message.
+ * @private_data_len: Size of the private data buffer, in bytes.
+ */
+int ib_send_cm_lap(struct ib_cm_id *cm_id,
+                   struct ib_sa_path_rec *alternate_path,
+                   const void *private_data,
+                   u8 private_data_len);
+
+/**
+ * ib_cm_init_qp_attr - Initializes the QP attributes for use in transitioning
+ *   to a specified QP state.
+ * @cm_id: Communication identifier associated with the QP attributes to
+ *   initialize.
+ * @qp_attr: On input, specifies the desired QP state.  On output, the
+ *   mandatory and desired optional attributes will be set in order to
+ *   modify the QP to the specified state.
+ * @qp_attr_mask: The QP attribute mask that may be used to transition the
+ *   QP to the specified state.
+ *
+ * Users must set the @qp_attr->qp_state to the desired QP state.  This call
+ * will set all required attributes for the given transition, along with
+ * known optional attributes.  Users may override the attributes returned from
+ * this call before calling ib_modify_qp.
+ */
+int ib_cm_init_qp_attr(struct ib_cm_id *cm_id,
+                       struct ib_qp_attr *qp_attr,
+                       int *qp_attr_mask);
+
+/**
+ * ib_send_cm_apr - Sends an alternate path response message in response to
+ *   a load alternate path request.
+ * @cm_id: Connection identifier associated with the alternate path response.
+ * @status: Reply status sent with the alternate path response.
+ * @info: Optional additional information sent with the alternate path
+ *   response.
+ * @info_length: Size of the additional information, in bytes.
+ * @private_data: Optional user-defined private data sent with the
+ *   alternate path response message.
+ * @private_data_len: Size of the private data buffer, in bytes.
+ */
+int ib_send_cm_apr(struct ib_cm_id *cm_id,
+                   enum ib_cm_apr_status status,
+                   void *info,
+                   u8 info_length,
+                   const void *private_data,
+                   u8 private_data_len);
+
+struct ib_cm_sidr_req_param {
+        struct ib_sa_path_rec   *path;
+        u64                     service_id;
+        int                     timeout_ms;
+        const void              *private_data;
+        u8                      private_data_len;
+        u8                      max_cm_retries;
+        u16                     pkey;
+};
+
+/**
+ * ib_send_cm_sidr_req - Sends a service ID resolution request to the
+ *   remote node.
+ * @cm_id: Communication identifier that will be associated with the
+ *   service ID resolution request.
+ * @param: Service ID resolution request information.
+ */
+int ib_send_cm_sidr_req(struct ib_cm_id *cm_id,
+                        struct ib_cm_sidr_req_param *param);
+
+struct ib_cm_sidr_rep_param {
+        u32                     qp_num;
+        u32                     qkey;
+        enum ib_cm_sidr_status  status;
+        const void              *info;
+        u8                      info_length;
+        const void              *private_data;
+        u8                      private_data_len;
+};
+
+/**
+ * ib_send_cm_sidr_rep - Sends a service ID resolution request to the
+ *   remote node.
+ * @cm_id: Communication identifier associated with the received service ID
+ *   resolution request.
+ * @param: Service ID resolution reply information.
+ */
+int ib_send_cm_sidr_rep(struct ib_cm_id *cm_id,
+                        struct ib_cm_sidr_rep_param *param);
+
+#endif /* IB_CM_H */
diff --git a/drivers/infiniband/include/ib_fmr_pool.h b/drivers/infiniband/include/ib_fmr_pool.h
index e8769657cbbb..6c9e24d6e144 100644
--- a/drivers/infiniband/include/ib_fmr_pool.h
+++ b/drivers/infiniband/include/ib_fmr_pool.h
@@ -1,5 +1,6 @@
 /*
  * Copyright (c) 2004 Topspin Corporation.  All rights reserved.
+ * Copyright (c) 2005 Sun Microsystems, Inc. All rights reserved.
  *
  * This software is available to you under a choice of one of two
  * licenses.  You may choose to be licensed under the terms of the GNU
@@ -29,7 +30,7 @@
  * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
  * SOFTWARE.
  *
- * $Id: ib_fmr_pool.h 1349 2004-12-16 21:09:43Z roland $
+ * $Id: ib_fmr_pool.h 2730 2005-06-28 16:43:03Z sean.hefty $
  */
 
 #if !defined(IB_FMR_POOL_H)
@@ -78,7 +79,7 @@ struct ib_pool_fmr {
 struct ib_fmr_pool *ib_create_fmr_pool(struct ib_pd             *pd,
                                        struct ib_fmr_pool_param *params);
 
-int ib_destroy_fmr_pool(struct ib_fmr_pool *pool);
+void ib_destroy_fmr_pool(struct ib_fmr_pool *pool);
 
 int ib_flush_fmr_pool(struct ib_fmr_pool *pool);
 
diff --git a/drivers/infiniband/include/ib_mad.h b/drivers/infiniband/include/ib_mad.h
index 4a6bf6763a97..491b6f25b3b8 100644
--- a/drivers/infiniband/include/ib_mad.h
+++ b/drivers/infiniband/include/ib_mad.h
@@ -33,12 +33,14 @@
  * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
  * SOFTWARE.
  *
- * $Id: ib_mad.h 1389 2004-12-27 22:56:47Z roland $
+ * $Id: ib_mad.h 2775 2005-07-02 13:42:12Z halr $
  */
 
 #if !defined( IB_MAD_H )
 #define IB_MAD_H
 
+#include <linux/pci.h>
+
 #include <ib_verbs.h>
 
 /* Management base version */
@@ -56,6 +58,8 @@
 #define IB_MGMT_CLASS_VENDOR_RANGE2_START       0x30
 #define IB_MGMT_CLASS_VENDOR_RANGE2_END         0x4F
 
+#define IB_OPENIB_OUI                           (0x001405)
+
 /* Management methods */
 #define IB_MGMT_METHOD_GET                      0x01
 #define IB_MGMT_METHOD_SET                      0x02
@@ -70,18 +74,37 @@
 
 #define IB_MGMT_MAX_METHODS                     128
 
+/* RMPP information */
+#define IB_MGMT_RMPP_VERSION                    1
+
+#define IB_MGMT_RMPP_TYPE_DATA                  1
+#define IB_MGMT_RMPP_TYPE_ACK                   2
+#define IB_MGMT_RMPP_TYPE_STOP                  3
+#define IB_MGMT_RMPP_TYPE_ABORT                 4
+
+#define IB_MGMT_RMPP_FLAG_ACTIVE                1
+#define IB_MGMT_RMPP_FLAG_FIRST                 (1<<1)
+#define IB_MGMT_RMPP_FLAG_LAST                  (1<<2)
+
+#define IB_MGMT_RMPP_NO_RESPTIME                0x1F
+
+#define IB_MGMT_RMPP_STATUS_SUCCESS             0
+#define IB_MGMT_RMPP_STATUS_RESX                1
+#define IB_MGMT_RMPP_STATUS_T2L                 118
+#define IB_MGMT_RMPP_STATUS_BAD_LEN             119
+#define IB_MGMT_RMPP_STATUS_BAD_SEG             120
+#define IB_MGMT_RMPP_STATUS_BADT                121
+#define IB_MGMT_RMPP_STATUS_W2S                 122
+#define IB_MGMT_RMPP_STATUS_S2B                 123
+#define IB_MGMT_RMPP_STATUS_BAD_STATUS          124
+#define IB_MGMT_RMPP_STATUS_UNV                 125
+#define IB_MGMT_RMPP_STATUS_TMR                 126
+#define IB_MGMT_RMPP_STATUS_UNSPEC              127
+
 #define IB_QP0          0
 #define IB_QP1          __constant_htonl(1)
 #define IB_QP1_QKEY     0x80010000
-
-struct ib_grh {
-        u32             version_tclass_flow;
-        u16             paylen;
-        u8              next_hdr;
-        u8              hop_limit;
-        union ib_gid    sgid;
-        union ib_gid    dgid;
-} __attribute__ ((packed));
+#define IB_QP_SET_QKEY  0x80000000
 
 struct ib_mad_hdr {
         u8      base_version;
@@ -94,7 +117,7 @@ struct ib_mad_hdr {
         u16     attr_id;
         u16     resv;
         u32     attr_mod;
-} __attribute__ ((packed));
+};
 
 struct ib_rmpp_hdr {
         u8      rmpp_version;
@@ -103,17 +126,41 @@ struct ib_rmpp_hdr {
         u8      rmpp_status;
         u32     seg_num;
         u32     paylen_newwin;
+};
+
+typedef u64 __bitwise ib_sa_comp_mask;
+
+#define IB_SA_COMP_MASK(n) ((__force ib_sa_comp_mask) cpu_to_be64(1ull << n))
+
+/*
+ * ib_sa_hdr and ib_sa_mad structures must be packed because they have
+ * 64-bit fields that are only 32-bit aligned. 64-bit architectures will
+ * lay them out wrong otherwise.  (And unfortunately they are sent on
+ * the wire so we can't change the layout)
+ */
+struct ib_sa_hdr {
+        u64                     sm_key;
+        u16                     attr_offset;
+        u16                     reserved;
+        ib_sa_comp_mask         comp_mask;
 } __attribute__ ((packed));
 
 struct ib_mad {
         struct ib_mad_hdr       mad_hdr;
         u8                      data[232];
-} __attribute__ ((packed));
+};
 
 struct ib_rmpp_mad {
         struct ib_mad_hdr       mad_hdr;
         struct ib_rmpp_hdr      rmpp_hdr;
         u8                      data[220];
+};
+
+struct ib_sa_mad {
+        struct ib_mad_hdr       mad_hdr;
+        struct ib_rmpp_hdr      rmpp_hdr;
+        struct ib_sa_hdr        sa_hdr;
+        u8                      data[200];
 } __attribute__ ((packed));
 
 struct ib_vendor_mad {
@@ -122,7 +169,70 @@ struct ib_vendor_mad {
         u8                      reserved;
         u8                      oui[3];
         u8                      data[216];
-} __attribute__ ((packed));
+};
+
+/**
+ * ib_mad_send_buf - MAD data buffer and work request for sends.
+ * @mad: References an allocated MAD data buffer.  The size of the data
+ *   buffer is specified in the @send_wr.length field.
+ * @mapping: DMA mapping information.
+ * @mad_agent: MAD agent that allocated the buffer.
+ * @context: User-controlled context fields.
+ * @send_wr: An initialized work request structure used when sending the MAD.
+ *   The wr_id field of the work request is initialized to reference this
+ *   data structure.
+ * @sge: A scatter-gather list referenced by the work request.
+ *
+ * Users are responsible for initializing the MAD buffer itself, with the
+ * exception of specifying the payload length field in any RMPP MAD.
+ */
+struct ib_mad_send_buf {
+        struct ib_mad           *mad;
+        DECLARE_PCI_UNMAP_ADDR(mapping)
+        struct ib_mad_agent     *mad_agent;
+        void                    *context[2];
+        struct ib_send_wr       send_wr;
+        struct ib_sge           sge;
+};
+
+/**
+ * ib_get_rmpp_resptime - Returns the RMPP response time.
+ * @rmpp_hdr: An RMPP header.
+ */
+static inline u8 ib_get_rmpp_resptime(struct ib_rmpp_hdr *rmpp_hdr)
+{
+        return rmpp_hdr->rmpp_rtime_flags >> 3;
+}
+
+/**
+ * ib_get_rmpp_flags - Returns the RMPP flags.
+ * @rmpp_hdr: An RMPP header.
+ */
+static inline u8 ib_get_rmpp_flags(struct ib_rmpp_hdr *rmpp_hdr)
+{
+        return rmpp_hdr->rmpp_rtime_flags & 0x7;
+}
+
+/**
+ * ib_set_rmpp_resptime - Sets the response time in an RMPP header.
+ * @rmpp_hdr: An RMPP header.
+ * @rtime: The response time to set.
+ */
+static inline void ib_set_rmpp_resptime(struct ib_rmpp_hdr *rmpp_hdr, u8 rtime)
+{
+        rmpp_hdr->rmpp_rtime_flags = ib_get_rmpp_flags(rmpp_hdr) | (rtime << 3);
+}
+
+/**
+ * ib_set_rmpp_flags - Sets the flags in an RMPP header.
+ * @rmpp_hdr: An RMPP header.
+ * @flags: The flags to set.
+ */
+static inline void ib_set_rmpp_flags(struct ib_rmpp_hdr *rmpp_hdr, u8 flags)
+{
+        rmpp_hdr->rmpp_rtime_flags = (rmpp_hdr->rmpp_rtime_flags & 0xF1) |
+                                     (flags & 0x7);
+}
 
 struct ib_mad_agent;
 struct ib_mad_send_wc;
@@ -168,6 +278,7 @@ typedef void (*ib_mad_recv_handler)(struct ib_mad_agent *mad_agent,
  * ib_mad_agent - Used to track MAD registration with the access layer.
  * @device: Reference to device registration is on.
  * @qp: Reference to QP used for sending and receiving MADs.
+ * @mr: Memory region for system memory usable for DMA.
  * @recv_handler: Callback handler for a received MAD.
  * @send_handler: Callback handler for a sent MAD.
  * @snoop_handler: Callback handler for snooped sent MADs.
@@ -176,16 +287,19 @@ typedef void (*ib_mad_recv_handler)(struct ib_mad_agent *mad_agent,
  *   Unsolicited MADs sent by this client will have the upper 32-bits
  *   of their TID set to this value.
  * @port_num: Port number on which QP is registered
+ * @rmpp_version: If set, indicates the RMPP version used by this agent.
  */
 struct ib_mad_agent {
         struct ib_device        *device;
         struct ib_qp            *qp;
+        struct ib_mr            *mr;
         ib_mad_recv_handler     recv_handler;
         ib_mad_send_handler     send_handler;
         ib_mad_snoop_handler    snoop_handler;
         void                    *context;
         u32                     hi_tid;
         u8                      port_num;
+        u8                      rmpp_version;
 };
 
 /**
@@ -219,6 +333,7 @@ struct ib_mad_recv_buf {
  * ib_mad_recv_wc - received MAD information.
  * @wc: Completion information for the received data.
  * @recv_buf: Specifies the location of the received data buffer(s).
+ * @rmpp_list: Specifies a list of RMPP reassembled received MAD buffers.
  * @mad_len: The length of the received MAD, without duplicated headers.
  *
  * For received response, the wr_id field of the wc is set to the wr_id
@@ -227,6 +342,7 @@ struct ib_mad_recv_buf {
 struct ib_mad_recv_wc {
         struct ib_wc            *wc;
         struct ib_mad_recv_buf  recv_buf;
+        struct list_head        rmpp_list;
         int                     mad_len;
 };
 
@@ -322,6 +438,16 @@ int ib_unregister_mad_agent(struct ib_mad_agent *mad_agent);
  * @bad_send_wr: Specifies the MAD on which an error was encountered.
  *
  * Sent MADs are not guaranteed to complete in the order that they were posted.
+ *
+ * If the MAD requires RMPP, the data buffer should contain a single copy
+ * of the common MAD, RMPP, and class specific headers, followed by the class
+ * defined data.  If the class defined data would not divide evenly into
+ * RMPP segments, then space must be allocated at the end of the referenced
+ * buffer for any required padding.  To indicate the amount of class defined
+ * data being transferred, the paylen_newwin field in the RMPP header should
+ * be set to the size of the class specific header plus the amount of class
+ * defined data being transferred.  The paylen_newwin field should be
+ * specified in network-byte order.
  */
 int ib_post_send_mad(struct ib_mad_agent *mad_agent,
                      struct ib_send_wr *send_wr,
@@ -334,15 +460,13 @@ int ib_post_send_mad(struct ib_mad_agent *mad_agent,
  *   referenced buffer should be at least the size of the mad_len specified
  *   by @mad_recv_wc.
  *
- * This call copies a chain of received RMPP MADs into a single data buffer,
+ * This call copies a chain of received MAD segments into a single data buffer,
  * removing duplicated headers.
  */
-void ib_coalesce_recv_mad(struct ib_mad_recv_wc *mad_recv_wc,
-                          void *buf);
+void ib_coalesce_recv_mad(struct ib_mad_recv_wc *mad_recv_wc, void *buf);
 
 /**
- * ib_free_recv_mad - Returns data buffers used to receive a MAD to the
- *   access layer.
+ * ib_free_recv_mad - Returns data buffers used to receive a MAD.
  * @mad_recv_wc: Work completion information for a received MAD.
  *
  * Clients receiving MADs through their ib_mad_recv_handler must call this
@@ -358,8 +482,18 @@ void ib_free_recv_mad(struct ib_mad_recv_wc *mad_recv_wc);
  * MADs will be returned to the user through the corresponding
  * ib_mad_send_handler.
  */
-void ib_cancel_mad(struct ib_mad_agent *mad_agent,
-                   u64 wr_id);
+void ib_cancel_mad(struct ib_mad_agent *mad_agent, u64 wr_id);
+
+/**
+ * ib_modify_mad - Modifies an outstanding send MAD operation.
+ * @mad_agent: Specifies the registration associated with sent MAD.
+ * @wr_id: Indicates the work request identifier of the MAD to modify.
+ * @timeout_ms: New timeout value for sent MAD.
+ *
+ * This call will reset the timeout value for a sent MAD to the specified
+ * value.
+ */
+int ib_modify_mad(struct ib_mad_agent *mad_agent, u64 wr_id, u32 timeout_ms);
 
 /**
  * ib_redirect_mad_qp - Registers a QP for MAD services.
@@ -401,4 +535,43 @@ struct ib_mad_agent *ib_redirect_mad_qp(struct ib_qp *qp,
 int ib_process_mad_wc(struct ib_mad_agent *mad_agent,
                       struct ib_wc *wc);
 
+/**
+ * ib_create_send_mad - Allocate and initialize a data buffer and work request
+ *   for sending a MAD.
+ * @mad_agent: Specifies the registered MAD service to associate with the MAD.
+ * @remote_qpn: Specifies the QPN of the receiving node.
+ * @pkey_index: Specifies which PKey the MAD will be sent using.  This field
+ *   is valid only if the remote_qpn is QP 1.
+ * @ah: References the address handle used to transfer to the remote node.
+ * @rmpp_active: Indicates if the send will enable RMPP.
+ * @hdr_len: Indicates the size of the data header of the MAD.  This length
+ *   should include the common MAD header, RMPP header, plus any class
+ *   specific header.
+ * @data_len: Indicates the size of any user-transferred data.  The call will
+ *   automatically adjust the allocated buffer size to account for any
+ *   additional padding that may be necessary.
+ * @gfp_mask: GFP mask used for the memory allocation.
+ *
+ * This is a helper routine that may be used to allocate a MAD.  Users are
+ * not required to allocate outbound MADs using this call.  The returned
+ * MAD send buffer will reference a data buffer usable for sending a MAD, along
+ * with an initialized work request structure.  Users may modify the returned
+ * MAD data buffer or work request before posting the send.
+ *
+ * The returned data buffer will be cleared.  Users are responsible for
+ * initializing the common MAD and any class specific headers.  If @rmpp_active
+ * is set, the RMPP header will be initialized for sending.
+ */
+struct ib_mad_send_buf * ib_create_send_mad(struct ib_mad_agent *mad_agent,
+                                            u32 remote_qpn, u16 pkey_index,
+                                            struct ib_ah *ah, int rmpp_active,
+                                            int hdr_len, int data_len,
+                                            unsigned int __nocast gfp_mask);
+
+/**
+ * ib_free_send_mad - Returns data buffers used to send a MAD.
+ * @send_buf: Previously allocated send data buffer.
+ */
+void ib_free_send_mad(struct ib_mad_send_buf *send_buf);
+
 #endif /* IB_MAD_H */
diff --git a/drivers/infiniband/include/ib_sa.h b/drivers/infiniband/include/ib_sa.h
index 00222285eb9a..6d999f7b5d93 100644
--- a/drivers/infiniband/include/ib_sa.h
+++ b/drivers/infiniband/include/ib_sa.h
@@ -1,5 +1,6 @@
 /*
  * Copyright (c) 2004 Topspin Communications.  All rights reserved.
+ * Copyright (c) 2005 Voltaire, Inc.  All rights reserved.
  *
  * This software is available to you under a choice of one of two
  * licenses.  You may choose to be licensed under the terms of the GNU
@@ -29,7 +30,7 @@
  * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
  * SOFTWARE.
  *
- * $Id: ib_sa.h 1389 2004-12-27 22:56:47Z roland $
+ * $Id: ib_sa.h 2811 2005-07-06 18:11:43Z halr $
  */
 
 #ifndef IB_SA_H
@@ -41,9 +42,11 @@
 #include <ib_mad.h>
 
 enum {
-        IB_SA_CLASS_VERSION     = 2,    /* IB spec version 1.1/1.2 */
+        IB_SA_CLASS_VERSION             = 2,    /* IB spec version 1.1/1.2 */
 
-        IB_SA_METHOD_DELETE     = 0x15
+        IB_SA_METHOD_GET_TABLE          = 0x12,
+        IB_SA_METHOD_GET_TABLE_RESP     = 0x92,
+        IB_SA_METHOD_DELETE             = 0x15
 };
 
 enum ib_sa_selector {
@@ -87,10 +90,6 @@ static inline int ib_sa_rate_enum_to_int(enum ib_sa_rate rate)
         }
 }
 
-typedef u64 __bitwise ib_sa_comp_mask;
-
-#define IB_SA_COMP_MASK(n)      ((__force ib_sa_comp_mask) cpu_to_be64(1ull << n))
-
 /*
  * Structures for SA records are named "struct ib_sa_xxx_rec."  No
  * attempt is made to pack structures to match the physical layout of
@@ -195,6 +194,61 @@ struct ib_sa_mcmember_rec {
         int          proxy_join;
 };
 
+/* Service Record Component Mask Sec 15.2.5.14 Ver 1.1  */
+#define IB_SA_SERVICE_REC_SERVICE_ID                    IB_SA_COMP_MASK( 0)
+#define IB_SA_SERVICE_REC_SERVICE_GID                   IB_SA_COMP_MASK( 1)
+#define IB_SA_SERVICE_REC_SERVICE_PKEY                  IB_SA_COMP_MASK( 2)
+/* reserved:                                                             3 */
+#define IB_SA_SERVICE_REC_SERVICE_LEASE                 IB_SA_COMP_MASK( 4)
+#define IB_SA_SERVICE_REC_SERVICE_KEY                   IB_SA_COMP_MASK( 5)
+#define IB_SA_SERVICE_REC_SERVICE_NAME                  IB_SA_COMP_MASK( 6)
+#define IB_SA_SERVICE_REC_SERVICE_DATA8_0               IB_SA_COMP_MASK( 7)
+#define IB_SA_SERVICE_REC_SERVICE_DATA8_1               IB_SA_COMP_MASK( 8)
+#define IB_SA_SERVICE_REC_SERVICE_DATA8_2               IB_SA_COMP_MASK( 9)
+#define IB_SA_SERVICE_REC_SERVICE_DATA8_3               IB_SA_COMP_MASK(10)
+#define IB_SA_SERVICE_REC_SERVICE_DATA8_4               IB_SA_COMP_MASK(11)
+#define IB_SA_SERVICE_REC_SERVICE_DATA8_5               IB_SA_COMP_MASK(12)
+#define IB_SA_SERVICE_REC_SERVICE_DATA8_6               IB_SA_COMP_MASK(13)
+#define IB_SA_SERVICE_REC_SERVICE_DATA8_7               IB_SA_COMP_MASK(14)
+#define IB_SA_SERVICE_REC_SERVICE_DATA8_8               IB_SA_COMP_MASK(15)
+#define IB_SA_SERVICE_REC_SERVICE_DATA8_9               IB_SA_COMP_MASK(16)
+#define IB_SA_SERVICE_REC_SERVICE_DATA8_10              IB_SA_COMP_MASK(17)
+#define IB_SA_SERVICE_REC_SERVICE_DATA8_11              IB_SA_COMP_MASK(18)
+#define IB_SA_SERVICE_REC_SERVICE_DATA8_12              IB_SA_COMP_MASK(19)
+#define IB_SA_SERVICE_REC_SERVICE_DATA8_13              IB_SA_COMP_MASK(20)
+#define IB_SA_SERVICE_REC_SERVICE_DATA8_14              IB_SA_COMP_MASK(21)
+#define IB_SA_SERVICE_REC_SERVICE_DATA8_15              IB_SA_COMP_MASK(22)
+#define IB_SA_SERVICE_REC_SERVICE_DATA16_0              IB_SA_COMP_MASK(23)
+#define IB_SA_SERVICE_REC_SERVICE_DATA16_1              IB_SA_COMP_MASK(24)
+#define IB_SA_SERVICE_REC_SERVICE_DATA16_2              IB_SA_COMP_MASK(25)
+#define IB_SA_SERVICE_REC_SERVICE_DATA16_3              IB_SA_COMP_MASK(26)
+#define IB_SA_SERVICE_REC_SERVICE_DATA16_4              IB_SA_COMP_MASK(27)
+#define IB_SA_SERVICE_REC_SERVICE_DATA16_5              IB_SA_COMP_MASK(28)
+#define IB_SA_SERVICE_REC_SERVICE_DATA16_6              IB_SA_COMP_MASK(29)
+#define IB_SA_SERVICE_REC_SERVICE_DATA16_7              IB_SA_COMP_MASK(30)
+#define IB_SA_SERVICE_REC_SERVICE_DATA32_0              IB_SA_COMP_MASK(31)
+#define IB_SA_SERVICE_REC_SERVICE_DATA32_1              IB_SA_COMP_MASK(32)
+#define IB_SA_SERVICE_REC_SERVICE_DATA32_2              IB_SA_COMP_MASK(33)
+#define IB_SA_SERVICE_REC_SERVICE_DATA32_3              IB_SA_COMP_MASK(34)
+#define IB_SA_SERVICE_REC_SERVICE_DATA64_0              IB_SA_COMP_MASK(35)
+#define IB_SA_SERVICE_REC_SERVICE_DATA64_1              IB_SA_COMP_MASK(36)
+
+#define IB_DEFAULT_SERVICE_LEASE        0xFFFFFFFF
+
+struct ib_sa_service_rec {
+        u64             id;
+        union ib_gid    gid;
+        u16             pkey;
+        /* reserved */
+        u32             lease;
+        u8              key[16];
+        u8              name[64];
+        u8              data8[16];
+        u16             data16[8];
+        u32             data32[4];
+        u64             data64[2];
+};
+
 struct ib_sa_query;
 
 void ib_sa_cancel_query(int id, struct ib_sa_query *query);
@@ -202,7 +256,7 @@ void ib_sa_cancel_query(int id, struct ib_sa_query *query);
 int ib_sa_path_rec_get(struct ib_device *device, u8 port_num,
                        struct ib_sa_path_rec *rec,
                        ib_sa_comp_mask comp_mask,
-                       int timeout_ms, int gfp_mask,
+                       int timeout_ms, unsigned int __nocast gfp_mask,
                        void (*callback)(int status,
                                         struct ib_sa_path_rec *resp,
                                         void *context),
@@ -213,13 +267,24 @@ int ib_sa_mcmember_rec_query(struct ib_device *device, u8 port_num,
                              u8 method,
                              struct ib_sa_mcmember_rec *rec,
                              ib_sa_comp_mask comp_mask,
-                             int timeout_ms, int gfp_mask,
+                             int timeout_ms, unsigned int __nocast gfp_mask,
                              void (*callback)(int status,
                                               struct ib_sa_mcmember_rec *resp,
                                               void *context),
                              void *context,
                              struct ib_sa_query **query);
 
+int ib_sa_service_rec_query(struct ib_device *device, u8 port_num,
+                         u8 method,
+                         struct ib_sa_service_rec *rec,
+                         ib_sa_comp_mask comp_mask,
+                         int timeout_ms, unsigned int __nocast gfp_mask,
+                         void (*callback)(int status,
+                                          struct ib_sa_service_rec *resp,
+                                          void *context),
+                         void *context,
+                         struct ib_sa_query **sa_query);
+
 /**
  * ib_sa_mcmember_rec_set - Start an MCMember set query
  * @device:device to send query on
@@ -248,7 +313,7 @@ static inline int
 ib_sa_mcmember_rec_set(struct ib_device *device, u8 port_num,
                        struct ib_sa_mcmember_rec *rec,
                        ib_sa_comp_mask comp_mask,
-                       int timeout_ms, int gfp_mask,
+                       int timeout_ms, unsigned int __nocast gfp_mask,
                        void (*callback)(int status,
                                         struct ib_sa_mcmember_rec *resp,
                                         void *context),
@@ -290,7 +355,7 @@ static inline int
 ib_sa_mcmember_rec_delete(struct ib_device *device, u8 port_num,
                           struct ib_sa_mcmember_rec *rec,
                           ib_sa_comp_mask comp_mask,
-                          int timeout_ms, int gfp_mask,
+                          int timeout_ms, unsigned int __nocast gfp_mask,
                           void (*callback)(int status,
                                            struct ib_sa_mcmember_rec *resp,
                                            void *context),
diff --git a/drivers/infiniband/include/ib_user_cm.h b/drivers/infiniband/include/ib_user_cm.h
new file mode 100644
index 000000000000..500b1af6ff77
--- /dev/null
+++ b/drivers/infiniband/include/ib_user_cm.h
@@ -0,0 +1,328 @@
+/*
+ * Copyright (c) 2005 Topspin Communications.  All rights reserved.
+ *
+ * This software is available to you under a choice of one of two
+ * licenses.  You may choose to be licensed under the terms of the GNU
+ * General Public License (GPL) Version 2, available from the file
+ * COPYING in the main directory of this source tree, or the
+ * OpenIB.org BSD license below:
+ *
+ *     Redistribution and use in source and binary forms, with or
+ *     without modification, are permitted provided that the following
+ *     conditions are met:
+ *
+ *      - Redistributions of source code must retain the above
+ *        copyright notice, this list of conditions and the following
+ *        disclaimer.
+ *
+ *      - Redistributions in binary form must reproduce the above
+ *        copyright notice, this list of conditions and the following
+ *        disclaimer in the documentation and/or other materials
+ *        provided with the distribution.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+ * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+ * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+ * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
+ * BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
+ * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
+ * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+ * SOFTWARE.
+ *
+ * $Id: ib_user_cm.h 2576 2005-06-09 17:00:30Z libor $
+ */
+
+#ifndef IB_USER_CM_H
+#define IB_USER_CM_H
+
+#include <linux/types.h>
+
+#define IB_USER_CM_ABI_VERSION 1
+
+enum {
+        IB_USER_CM_CMD_CREATE_ID,
+        IB_USER_CM_CMD_DESTROY_ID,
+        IB_USER_CM_CMD_ATTR_ID,
+
+        IB_USER_CM_CMD_LISTEN,
+        IB_USER_CM_CMD_ESTABLISH,
+
+        IB_USER_CM_CMD_SEND_REQ,
+        IB_USER_CM_CMD_SEND_REP,
+        IB_USER_CM_CMD_SEND_RTU,
+        IB_USER_CM_CMD_SEND_DREQ,
+        IB_USER_CM_CMD_SEND_DREP,
+        IB_USER_CM_CMD_SEND_REJ,
+        IB_USER_CM_CMD_SEND_MRA,
+        IB_USER_CM_CMD_SEND_LAP,
+        IB_USER_CM_CMD_SEND_APR,
+        IB_USER_CM_CMD_SEND_SIDR_REQ,
+        IB_USER_CM_CMD_SEND_SIDR_REP,
+
+        IB_USER_CM_CMD_EVENT,
+};
+/*
+ * command ABI structures.
+ */
+struct ib_ucm_cmd_hdr {
+        __u32 cmd;
+        __u16 in;
+        __u16 out;
+};
+
+struct ib_ucm_create_id {
+        __u64 response;
+};
+
+struct ib_ucm_create_id_resp {
+        __u32 id;
+};
+
+struct ib_ucm_destroy_id {
+        __u32 id;
+};
+
+struct ib_ucm_attr_id {
+        __u64 response;
+        __u32 id;
+};
+
+struct ib_ucm_attr_id_resp {
+        __u64 service_id;
+        __u64 service_mask;
+        __u32 local_id;
+        __u32 remote_id;
+};
+
+struct ib_ucm_listen {
+        __u64 service_id;
+        __u64 service_mask;
+        __u32 id;
+};
+
+struct ib_ucm_establish {
+        __u32 id;
+};
+
+struct ib_ucm_private_data {
+        __u64 data;
+        __u32 id;
+        __u8  len;
+        __u8  reserved[3];
+};
+
+struct ib_ucm_path_rec {
+        __u8  dgid[16];
+        __u8  sgid[16];
+        __u16 dlid;
+        __u16 slid;
+        __u32 raw_traffic;
+        __u32 flow_label;
+        __u32 reversible;
+        __u32 mtu;
+        __u16 pkey;
+        __u8  hop_limit;
+        __u8  traffic_class;
+        __u8  numb_path;
+        __u8  sl;
+        __u8  mtu_selector;
+        __u8  rate_selector;
+        __u8  rate;
+        __u8  packet_life_time_selector;
+        __u8  packet_life_time;
+        __u8  preference;
+};
+
+struct ib_ucm_req {
+        __u32 id;
+        __u32 qpn;
+        __u32 qp_type;
+        __u32 psn;
+        __u64 sid;
+        __u64 data;
+        __u64 primary_path;
+        __u64 alternate_path;
+        __u8  len;
+        __u8  peer_to_peer;
+        __u8  responder_resources;
+        __u8  initiator_depth;
+        __u8  remote_cm_response_timeout;
+        __u8  flow_control;
+        __u8  local_cm_response_timeout;
+        __u8  retry_count;
+        __u8  rnr_retry_count;
+        __u8  max_cm_retries;
+        __u8  srq;
+        __u8  reserved[1];
+};
+
+struct ib_ucm_rep {
+        __u64 data;
+        __u32 id;
+        __u32 qpn;
+        __u32 psn;
+        __u8  len;
+        __u8  responder_resources;
+        __u8  initiator_depth;
+        __u8  target_ack_delay;
+        __u8  failover_accepted;
+        __u8  flow_control;
+        __u8  rnr_retry_count;
+        __u8  srq;
+};
+
+struct ib_ucm_info {
+        __u32 id;
+        __u32 status;
+        __u64 info;
+        __u64 data;
+        __u8  info_len;
+        __u8  data_len;
+        __u8  reserved[2];
+};
+
+struct ib_ucm_mra {
+        __u64 data;
+        __u32 id;
+        __u8  len;
+        __u8  timeout;
+        __u8  reserved[2];
+};
+
+struct ib_ucm_lap {
+        __u64 path;
+        __u64 data;
+        __u32 id;
+        __u8  len;
+        __u8  reserved[3];
+};
+
+struct ib_ucm_sidr_req {
+        __u32 id;
+        __u32 timeout;
+        __u64 sid;
+        __u64 data;
+        __u64 path;
+        __u16 pkey;
+        __u8  len;
+        __u8  max_cm_retries;
+};
+
+struct ib_ucm_sidr_rep {
+        __u32 id;
+        __u32 qpn;
+        __u32 qkey;
+        __u32 status;
+        __u64 info;
+        __u64 data;
+        __u8  info_len;
+        __u8  data_len;
+        __u8  reserved[2];
+};
+/*
+ * event notification ABI structures.
+ */
+struct ib_ucm_event_get {
+        __u64 response;
+        __u64 data;
+        __u64 info;
+        __u8  data_len;
+        __u8  info_len;
+        __u8  reserved[2];
+};
+
+struct ib_ucm_req_event_resp {
+        __u32                  listen_id;
+        /* device */
+        /* port */
+        struct ib_ucm_path_rec primary_path;
+        struct ib_ucm_path_rec alternate_path;
+        __u64                  remote_ca_guid;
+        __u32                  remote_qkey;
+        __u32                  remote_qpn;
+        __u32                  qp_type;
+        __u32                  starting_psn;
+        __u8  responder_resources;
+        __u8  initiator_depth;
+        __u8  local_cm_response_timeout;
+        __u8  flow_control;
+        __u8  remote_cm_response_timeout;
+        __u8  retry_count;
+        __u8  rnr_retry_count;
+        __u8  srq;
+};
+
+struct ib_ucm_rep_event_resp {
+        __u64 remote_ca_guid;
+        __u32 remote_qkey;
+        __u32 remote_qpn;
+        __u32 starting_psn;
+        __u8  responder_resources;
+        __u8  initiator_depth;
+        __u8  target_ack_delay;
+        __u8  failover_accepted;
+        __u8  flow_control;
+        __u8  rnr_retry_count;
+        __u8  srq;
+        __u8  reserved[1];
+};
+
+struct ib_ucm_rej_event_resp {
+        __u32 reason;
+        /* ari in ib_ucm_event_get info field. */
+};
+
+struct ib_ucm_mra_event_resp {
+        __u8  timeout;
+        __u8  reserved[3];
+};
+
+struct ib_ucm_lap_event_resp {
+        struct ib_ucm_path_rec path;
+};
+
+struct ib_ucm_apr_event_resp {
+        __u32 status;
+        /* apr info in ib_ucm_event_get info field. */
+};
+
+struct ib_ucm_sidr_req_event_resp {
+        __u32 listen_id;
+        /* device */
+        /* port */
+        __u16 pkey;
+        __u8  reserved[2];
+};
+
+struct ib_ucm_sidr_rep_event_resp {
+        __u32 status;
+        __u32 qkey;
+        __u32 qpn;
+        /* info in ib_ucm_event_get info field. */
+};
+
+#define IB_UCM_PRES_DATA      0x01
+#define IB_UCM_PRES_INFO      0x02
+#define IB_UCM_PRES_PRIMARY   0x04
+#define IB_UCM_PRES_ALTERNATE 0x08
+
+struct ib_ucm_event_resp {
+        __u32 id;
+        __u32 event;
+        __u32 present;
+        union {
+                struct ib_ucm_req_event_resp req_resp;
+                struct ib_ucm_rep_event_resp rep_resp;
+                struct ib_ucm_rej_event_resp rej_resp;
+                struct ib_ucm_mra_event_resp mra_resp;
+                struct ib_ucm_lap_event_resp lap_resp;
+                struct ib_ucm_apr_event_resp apr_resp;
+
+                struct ib_ucm_sidr_req_event_resp sidr_req_resp;
+                struct ib_ucm_sidr_rep_event_resp sidr_rep_resp;
+
+                __u32                             send_status;
+        } u;
+};
+
+#endif /* IB_USER_CM_H */
diff --git a/drivers/infiniband/include/ib_user_mad.h b/drivers/infiniband/include/ib_user_mad.h
index 06ad4a6075fa..a9a56b50aacc 100644
--- a/drivers/infiniband/include/ib_user_mad.h
+++ b/drivers/infiniband/include/ib_user_mad.h
@@ -1,5 +1,6 @@
 /*
  * Copyright (c) 2004 Topspin Communications.  All rights reserved.
+ * Copyright (c) 2005 Voltaire, Inc. All rights reserved.
  *
  * This software is available to you under a choice of one of two
  * licenses.  You may choose to be licensed under the terms of the GNU
@@ -29,7 +30,7 @@
  * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
  * SOFTWARE.
  *
- * $Id: ib_user_mad.h 1389 2004-12-27 22:56:47Z roland $
+ * $Id: ib_user_mad.h 2814 2005-07-06 19:14:09Z halr $
  */
 
 #ifndef IB_USER_MAD_H
@@ -42,7 +43,7 @@
  * Increment this value if any changes that break userspace ABI
  * compatibility are made.
  */
-#define IB_USER_MAD_ABI_VERSION 2
+#define IB_USER_MAD_ABI_VERSION 5
 
 /*
  * Make sure that all structs defined in this file remain laid out so
@@ -51,13 +52,13 @@
  */
 
 /**
- * ib_user_mad - MAD packet
- * @data - Contents of MAD
+ * ib_user_mad_hdr - MAD packet header
  * @id - ID of agent MAD received with/to be sent with
  * @status - 0 on successful receive, ETIMEDOUT if no response
  *   received (transaction ID in data[] will be set to TID of original
  *   request) (ignored on send)
  * @timeout_ms - Milliseconds to wait for response (unset on receive)
+ * @retries - Number of automatic retries to attempt
  * @qpn - Remote QP number received from/to be sent to
  * @qkey - Remote Q_Key to be sent with (unset on receive)
  * @lid - Remote lid received from/to be sent to
@@ -72,11 +73,12 @@
  *
  * All multi-byte quantities are stored in network (big endian) byte order.
  */
-struct ib_user_mad {
-        __u8    data[256];
+struct ib_user_mad_hdr {
         __u32   id;
         __u32   status;
         __u32   timeout_ms;
+        __u32   retries;
+        __u32   length;
         __u32   qpn;
         __u32   qkey;
         __u16   lid;
@@ -91,6 +93,17 @@ struct ib_user_mad {
 };
 
 /**
+ * ib_user_mad - MAD packet
+ * @hdr - MAD packet header
+ * @data - Contents of MAD
+ *
+ */
+struct ib_user_mad {
+        struct ib_user_mad_hdr hdr;
+        __u8    data[0];
+};
+
+/**
  * ib_user_mad_reg_req - MAD registration request
  * @id - Set by the kernel; used to identify agent in future requests.
  * @qpn - Queue pair number; must be 0 or 1.
@@ -103,6 +116,8 @@ struct ib_user_mad {
  *   management class to receive.
  * @oui: Indicates IEEE OUI when mgmt_class is a vendor class
  *   in the range from 0x30 to 0x4f. Otherwise not used.
+ * @rmpp_version: If set, indicates the RMPP version used.
+ *
  */
 struct ib_user_mad_reg_req {
         __u32   id;
@@ -111,6 +126,7 @@ struct ib_user_mad_reg_req {
         __u8    mgmt_class;
         __u8    mgmt_class_version;
         __u8    oui[3];
+        __u8    rmpp_version;
 };
 
 #define IB_IOCTL_MAGIC          0x1b
diff --git a/drivers/infiniband/include/ib_verbs.h b/drivers/infiniband/include/ib_verbs.h
index e5bd9a10c201..5d24edaa66e6 100644
--- a/drivers/infiniband/include/ib_verbs.h
+++ b/drivers/infiniband/include/ib_verbs.h
@@ -289,6 +289,15 @@ struct ib_global_route {
         u8              traffic_class;
 };
 
+struct ib_grh {
+        u32             version_tclass_flow;
+        u16             paylen;
+        u8              next_hdr;
+        u8              hop_limit;
+        union ib_gid    sgid;
+        union ib_gid    dgid;
+};
+
 enum {
         IB_MULTICAST_QPN = 0xffffff
 };
@@ -566,6 +575,7 @@ struct ib_send_wr {
                         u32     remote_qpn;
                         u32     remote_qkey;
                         int     timeout_ms; /* valid for MADs only */
+                        int     retries;    /* valid for MADs only */
                         u16     pkey_index; /* valid for GSI only */
                         u8      port_num;   /* valid for DR SMPs on switch only */
                 } ud;
@@ -990,6 +1000,21 @@ int ib_dealloc_pd(struct ib_pd *pd);
 struct ib_ah *ib_create_ah(struct ib_pd *pd, struct ib_ah_attr *ah_attr);
 
 /**
+ * ib_create_ah_from_wc - Creates an address handle associated with the
+ *   sender of the specified work completion.
+ * @pd: The protection domain associated with the address handle.
+ * @wc: Work completion information associated with a received message.
+ * @grh: References the received global route header.  This parameter is
+ *   ignored unless the work completion indicates that the GRH is valid.
+ * @port_num: The outbound port number to associate with the address.
+ *
+ * The address handle is used to reference a local or global destination
+ * in all UD QP post sends.
+ */
+struct ib_ah *ib_create_ah_from_wc(struct ib_pd *pd, struct ib_wc *wc,
+                                   struct ib_grh *grh, u8 port_num);
+
+/**
  * ib_modify_ah - Modifies the address vector associated with an address
  *   handle.
  * @ah: The address handle to modify.
diff --git a/drivers/isdn/hisax/avm_a1.c b/drivers/isdn/hisax/avm_a1.c
index 8f028d42fd2f..9a8b02557ff9 100644
--- a/drivers/isdn/hisax/avm_a1.c
+++ b/drivers/isdn/hisax/avm_a1.c
@@ -135,7 +135,7 @@ avm_a1_interrupt(int intno, void *dev_id, struct pt_regs *regs)
         return IRQ_HANDLED;
 }
 
-inline static void
+static inline void
 release_ioregs(struct IsdnCardState *cs, int mask)
 {
         release_region(cs->hw.avm.cfg_reg, 8);
diff --git a/drivers/isdn/hisax/config.c b/drivers/isdn/hisax/config.c
index c542e6fb2bde..fbaab4352902 100644
--- a/drivers/isdn/hisax/config.c
+++ b/drivers/isdn/hisax/config.c
@@ -1900,6 +1900,7 @@ static struct pci_device_id hisax_pci_tbl[] __initdata = {
         {PCI_VENDOR_ID_PLX,      PCI_DEVICE_ID_PLX_R685,         PCI_ANY_ID, PCI_ANY_ID},
         {PCI_VENDOR_ID_PLX,      PCI_DEVICE_ID_PLX_R753,         PCI_ANY_ID, PCI_ANY_ID},
         {PCI_VENDOR_ID_PLX,      PCI_DEVICE_ID_PLX_DJINN_ITOO,   PCI_ANY_ID, PCI_ANY_ID},
+        {PCI_VENDOR_ID_PLX,      PCI_DEVICE_ID_PLX_OLITEC,       PCI_ANY_ID, PCI_ANY_ID},
 #endif
 #ifdef CONFIG_HISAX_QUADRO
         {PCI_VENDOR_ID_PLX,      PCI_DEVICE_ID_PLX_9050,         PCI_ANY_ID, PCI_ANY_ID},
diff --git a/drivers/isdn/hisax/gazel.c b/drivers/isdn/hisax/gazel.c
index 352b45ac5347..60b04c6d9e7d 100644
--- a/drivers/isdn/hisax/gazel.c
+++ b/drivers/isdn/hisax/gazel.c
@@ -546,8 +546,9 @@ setup_gazelpci(struct IsdnCardState *cs)
 
         found = 0;
         seekcard = PCI_DEVICE_ID_PLX_R685;
-        for (nbseek = 0; nbseek < 3; nbseek++) {
-                if ((dev_tel = pci_find_device(PCI_VENDOR_ID_PLX, seekcard, dev_tel))) {
+        for (nbseek = 0; nbseek < 4; nbseek++) {
+                if ((dev_tel = pci_find_device(PCI_VENDOR_ID_PLX,
+                                        seekcard, dev_tel))) {
                         if (pci_enable_device(dev_tel))
                                 return 1;
                         pci_irq = dev_tel->irq;
@@ -565,6 +566,9 @@ setup_gazelpci(struct IsdnCardState *cs)
                                 case PCI_DEVICE_ID_PLX_R753:
                                         seekcard = PCI_DEVICE_ID_PLX_DJINN_ITOO;
                                         break;
+                                case PCI_DEVICE_ID_PLX_DJINN_ITOO:
+                                        seekcard = PCI_DEVICE_ID_PLX_OLITEC;
+                                        break;
                         }
                 }
         }
@@ -605,6 +609,7 @@ setup_gazelpci(struct IsdnCardState *cs)
                         break;
                 case PCI_DEVICE_ID_PLX_R753:
                 case PCI_DEVICE_ID_PLX_DJINN_ITOO:
+                case PCI_DEVICE_ID_PLX_OLITEC:
                         printk(KERN_INFO "Gazel: Card PCI R753 found\n");
                         cs->subtyp = R753;
                         test_and_set_bit(HW_IPAC, &cs->HW_Flags);
diff --git a/drivers/isdn/hisax/isdnl2.c b/drivers/isdn/hisax/isdnl2.c
index 1615c1a76ab8..6d0431725555 100644
--- a/drivers/isdn/hisax/isdnl2.c
+++ b/drivers/isdn/hisax/isdnl2.c
@@ -213,7 +213,7 @@ sethdraddr(struct Layer2 *l2, u_char * header, int rsp)
         }
 }
 
-inline static void
+static inline void
 enqueue_super(struct PStack *st,
               struct sk_buff *skb)
 {
diff --git a/drivers/isdn/hisax/l3dss1.c b/drivers/isdn/hisax/l3dss1.c
index a6d2abdb478a..e96845cdd4f6 100644
--- a/drivers/isdn/hisax/l3dss1.c
+++ b/drivers/isdn/hisax/l3dss1.c
@@ -353,7 +353,7 @@ l3dss1_parse_facility(struct PStack *st, struct l3_process *pc,
                                  { l3dss1_dummy_invoke(st, cr, id, ident, p, nlen);
                                    return;
                                  } 
-#if HISAX_DE_AOC
+#ifdef HISAX_DE_AOC
                         {
 
 #define FOO1(s,a,b) \
@@ -977,7 +977,7 @@ l3dss1_release_cmpl(struct l3_process *pc, u_char pr, void *arg)
         dss1_release_l3_process(pc);
 }
 
-#if EXT_BEARER_CAPS
+#ifdef EXT_BEARER_CAPS
 
 static u_char *
 EncodeASyncParams(u_char * p, u_char si2)
@@ -1369,7 +1369,7 @@ l3dss1_setup_req(struct l3_process *pc, u_char pr,
                                 *p++ = *sub++ & 0x7f;
                 }
         }
-#if EXT_BEARER_CAPS
+#ifdef EXT_BEARER_CAPS
         if ((pc->para.setup.si2 >= 160) && (pc->para.setup.si2 <= 175)) {       // sync. Bitratenadaption, V.110/X.30
 
                 *p++ = IE_LLC;
@@ -1609,7 +1609,7 @@ l3dss1_setup(struct l3_process *pc, u_char pr, void *arg)
                                 case 0x08: /* Unrestricted digital information */
                                         pc->para.setup.si1 = 7;
 /* JIM, 05.11.97 I wanna set service indicator 2 */
-#if EXT_BEARER_CAPS
+#ifdef EXT_BEARER_CAPS
                                         pc->para.setup.si2 = DecodeSI2(skb);
 #endif
                                         break;
diff --git a/drivers/isdn/hisax/teles3.c b/drivers/isdn/hisax/teles3.c
index adeaad62d35c..a3eaf4d65707 100644
--- a/drivers/isdn/hisax/teles3.c
+++ b/drivers/isdn/hisax/teles3.c
@@ -143,7 +143,7 @@ teles3_interrupt(int intno, void *dev_id, struct pt_regs *regs)
         return IRQ_HANDLED;
 }
 
-inline static void
+static inline void
 release_ioregs(struct IsdnCardState *cs, int mask)
 {
         if (mask & 1)
diff --git a/drivers/macintosh/Kconfig b/drivers/macintosh/Kconfig
index 91691a6c004e..65ab64c43b3e 100644
--- a/drivers/macintosh/Kconfig
+++ b/drivers/macintosh/Kconfig
@@ -4,7 +4,7 @@ menu "Macintosh device drivers"
 
 config ADB
         bool "Apple Desktop Bus (ADB) support"
-        depends on MAC || PPC_PMAC
+        depends on MAC || (PPC_PMAC && PPC32)
         help
           Apple Desktop Bus (ADB) support is for support of devices which
           are connected to an ADB port.  ADB devices tend to have 4 pins.
diff --git a/drivers/md/bitmap.c b/drivers/md/bitmap.c
index 0c2ed99a3832..70bca955e0de 100644
--- a/drivers/md/bitmap.c
+++ b/drivers/md/bitmap.c
@@ -108,7 +108,7 @@ static unsigned char *bitmap_alloc_page(struct bitmap *bitmap)
 {
         unsigned char *page;
 
-#if INJECT_FAULTS_1
+#ifdef INJECT_FAULTS_1
         page = NULL;
 #else
         page = kmalloc(PAGE_SIZE, GFP_NOIO);
@@ -843,7 +843,7 @@ static int bitmap_init_from_disk(struct bitmap *bitmap, int in_sync)
 
         BUG_ON(!file && !bitmap->offset);
 
-#if INJECT_FAULTS_3
+#ifdef INJECT_FAULTS_3
         outofdate = 1;
 #else
         outofdate = bitmap->flags & BITMAP_STALE;
@@ -1187,7 +1187,7 @@ static int bitmap_start_daemon(struct bitmap *bitmap, mdk_thread_t **ptr,
 
         spin_unlock_irqrestore(&bitmap->lock, flags);
 
-#if INJECT_FATAL_FAULT_2
+#ifdef INJECT_FATAL_FAULT_2
         daemon = NULL;
 #else
         sprintf(namebuf, "%%s_%s", name);
@@ -1552,7 +1552,7 @@ int bitmap_create(mddev_t *mddev)
 
         bitmap->syncchunk = ~0UL;
 
-#if INJECT_FATAL_FAULT_1
+#ifdef INJECT_FATAL_FAULT_1
         bitmap->bp = NULL;
 #else
         bitmap->bp = kmalloc(pages * sizeof(*bitmap->bp), GFP_KERNEL);
diff --git a/drivers/md/md.c b/drivers/md/md.c
index 4a0c57db2b67..6580e0fa4a47 100644
--- a/drivers/md/md.c
+++ b/drivers/md/md.c
@@ -284,7 +284,7 @@ static mdk_rdev_t * find_rdev(mddev_t * mddev, dev_t dev)
         return NULL;
 }
 
-inline static sector_t calc_dev_sboffset(struct block_device *bdev)
+static inline sector_t calc_dev_sboffset(struct block_device *bdev)
 {
         sector_t size = bdev->bd_inode->i_size >> BLOCK_SIZE_BITS;
         return MD_NEW_SIZE_BLOCKS(size);
diff --git a/drivers/md/raid1.c b/drivers/md/raid1.c
index 5f253ee536bb..d3a64a04a6d8 100644
--- a/drivers/md/raid1.c
+++ b/drivers/md/raid1.c
@@ -1468,6 +1468,7 @@ static int raid1_resize(mddev_t *mddev, sector_t sectors)
                 set_bit(MD_RECOVERY_NEEDED, &mddev->recovery);
         }
         mddev->size = mddev->array_size;
+        mddev->resync_max_sectors = sectors;
         return 0;
 }
 
diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c
index 93a9726cc2d6..4698d5f79575 100644
--- a/drivers/md/raid5.c
+++ b/drivers/md/raid5.c
@@ -1931,6 +1931,7 @@ static int raid5_resize(mddev_t *mddev, sector_t sectors)
                 set_bit(MD_RECOVERY_NEEDED, &mddev->recovery);
         }
         mddev->size = sectors /2;
+        mddev->resync_max_sectors = sectors;
         return 0;
 }
 
diff --git a/drivers/md/raid6main.c b/drivers/md/raid6main.c
index f62ea1a73d0d..f5ee16805111 100644
--- a/drivers/md/raid6main.c
+++ b/drivers/md/raid6main.c
@@ -2095,6 +2095,7 @@ static int raid6_resize(mddev_t *mddev, sector_t sectors)
                 set_bit(MD_RECOVERY_NEEDED, &mddev->recovery);
         }
         mddev->size = sectors /2;
+        mddev->resync_max_sectors = sectors;
         return 0;
 }
 
diff --git a/drivers/media/dvb/frontends/Kconfig b/drivers/media/dvb/frontends/Kconfig
index d847c62bd837..e83256d0fd14 100644
--- a/drivers/media/dvb/frontends/Kconfig
+++ b/drivers/media/dvb/frontends/Kconfig
@@ -187,8 +187,8 @@ config DVB_BCM3510
           An ATSC 8VSB/16VSB and QAM64/256 tuner module. Say Y when you want to
           support this frontend.
 
-config DVB_LGDT3302
-        tristate "LGDT3302 based (DViCO FusionHDTV3 Gold)"
+config DVB_LGDT330X
+        tristate "LGDT3302 or LGDT3303 based (DViCO FusionHDTV Gold)"
         depends on DVB_CORE
         help
           An ATSC 8VSB and QAM64/256 tuner module. Say Y when you want
diff --git a/drivers/media/dvb/frontends/Makefile b/drivers/media/dvb/frontends/Makefile
index de5e240cba7f..ad8658ffd60a 100644
--- a/drivers/media/dvb/frontends/Makefile
+++ b/drivers/media/dvb/frontends/Makefile
@@ -30,4 +30,4 @@ obj-$(CONFIG_DVB_OR51211) += or51211.o
 obj-$(CONFIG_DVB_OR51132) += or51132.o
 obj-$(CONFIG_DVB_BCM3510) += bcm3510.o
 obj-$(CONFIG_DVB_S5H1420) += s5h1420.o
-obj-$(CONFIG_DVB_LGDT3302) += lgdt3302.o
+obj-$(CONFIG_DVB_LGDT330X) += lgdt330x.o
diff --git a/drivers/media/dvb/frontends/dvb-pll.c b/drivers/media/dvb/frontends/dvb-pll.c
index 5afeaa9b43b4..5264310c070e 100644
--- a/drivers/media/dvb/frontends/dvb-pll.c
+++ b/drivers/media/dvb/frontends/dvb-pll.c
@@ -82,13 +82,14 @@ struct dvb_pll_desc dvb_pll_lg_z201 = {
         .name  = "LG z201",
         .min   = 174000000,
         .max   = 862000000,
-        .count = 5,
+        .count = 6,
         .entries = {
                 {          0, 36166667, 166666, 0xbc, 0x03 },
-                {  443250000, 36166667, 166666, 0xbc, 0x01 },
-                {  542000000, 36166667, 166666, 0xbc, 0x02 },
-                {  830000000, 36166667, 166666, 0xf4, 0x02 },
-                {  999999999, 36166667, 166666, 0xfc, 0x02 },
+                {  157500000, 36166667, 166666, 0xbc, 0x01 },
+                {  443250000, 36166667, 166666, 0xbc, 0x02 },
+                {  542000000, 36166667, 166666, 0xbc, 0x04 },
+                {  830000000, 36166667, 166666, 0xf4, 0x04 },
+                {  999999999, 36166667, 166666, 0xfc, 0x04 },
         },
 };
 EXPORT_SYMBOL(dvb_pll_lg_z201);
diff --git a/drivers/media/dvb/frontends/lgdt3302.c b/drivers/media/dvb/frontends/lgdt330x.c
index c85a2a99df42..e94dee50eecd 100644
--- a/drivers/media/dvb/frontends/lgdt3302.c
+++ b/drivers/media/dvb/frontends/lgdt330x.c
@@ -1,5 +1,5 @@
 /*
- *    Support for LGDT3302 (DViCO FustionHDTV 3 Gold) - VSB/QAM
+ *    Support for LGDT3302 & LGDT3303 (DViCO FusionHDTV Gold) - VSB/QAM
  *
  *    Copyright (C) 2005 Wilson Michaels <wilsonmichaels@earthlink.net>
  *
@@ -25,10 +25,11 @@
 /*
  *                      NOTES ABOUT THIS DRIVER
  *
- * This driver supports DViCO FusionHDTV 3 Gold under Linux.
+ * This driver supports DViCO FusionHDTV Gold under Linux.
  *
  * TODO:
  * BER and signal strength always return 0.
+ * Include support for LGDT3303
  *
  */
 
@@ -41,24 +42,24 @@
 
 #include "dvb_frontend.h"
 #include "dvb-pll.h"
-#include "lgdt3302_priv.h"
-#include "lgdt3302.h"
+#include "lgdt330x_priv.h"
+#include "lgdt330x.h"
 
 static int debug = 0;
 module_param(debug, int, 0644);
-MODULE_PARM_DESC(debug,"Turn on/off lgdt3302 frontend debugging (default:off).");
+MODULE_PARM_DESC(debug,"Turn on/off lgdt330x frontend debugging (default:off).");
 #define dprintk(args...) \
 do { \
-if (debug) printk(KERN_DEBUG "lgdt3302: " args); \
+if (debug) printk(KERN_DEBUG "lgdt330x: " args); \
 } while (0)
 
-struct lgdt3302_state
+struct lgdt330x_state
 {
         struct i2c_adapter* i2c;
         struct dvb_frontend_ops ops;
 
         /* Configuration settings */
-        const struct lgdt3302_config* config;
+        const struct lgdt330x_config* config;
 
         struct dvb_frontend frontend;
 
@@ -69,45 +70,33 @@ struct lgdt3302_state
         u32 current_frequency;
 };
 
-static int i2c_writebytes (struct lgdt3302_state* state,
+static int i2c_writebytes (struct lgdt330x_state* state,
                            u8 addr, /* demod_address or pll_address */
                            u8 *buf, /* data bytes to send */
                            int len  /* number of bytes to send */ )
 {
-        if (addr == state->config->pll_address) {
-                struct i2c_msg msg =
-                        { .addr = addr, .flags = 0, .buf = buf,  .len = len };
-                int err;
+        u8 tmp[] = { buf[0], buf[1] };
+        struct i2c_msg msg =
+                { .addr = addr, .flags = 0, .buf = tmp,  .len = 2 };
+        int err;
+        int i;
 
+        for (i=1; i<len; i++) {
+                tmp[1] = buf[i];
                 if ((err = i2c_transfer(state->i2c, &msg, 1)) != 1) {
-                        printk(KERN_WARNING "lgdt3302: %s error (addr %02x <- %02x, err == %i)\n", __FUNCTION__, addr, buf[0], err);
+                        printk(KERN_WARNING "lgdt330x: %s error (addr %02x <- %02x, err == %i)\n", __FUNCTION__, addr, buf[0], err);
                         if (err < 0)
                                 return err;
                         else
                                 return -EREMOTEIO;
                 }
-        } else {
-                u8 tmp[] = { buf[0], buf[1] };
-                struct i2c_msg msg =
-                        { .addr = addr, .flags = 0, .buf = tmp,  .len = 2 };
-                int err;
-                int i;
-
-                for (i=1; i<len; i++) {
-                        tmp[1] = buf[i];
-                        if ((err = i2c_transfer(state->i2c, &msg, 1)) != 1) {
-                                printk(KERN_WARNING "lgdt3302: %s error (addr %02x <- %02x, err == %i)\n", __FUNCTION__, addr, buf[0], err);
-                                if (err < 0)
-                                        return err;
-                                else
-                                        return -EREMOTEIO;
-                        }
-                        tmp[0]++;
-                }
+                tmp[0]++;
         }
         return 0;
 }
-static int i2c_readbytes (struct lgdt3302_state* state,
+
+#if 0
+static int i2c_readbytes (struct lgdt330x_state* state,
                           u8 addr, /* demod_address or pll_address */
                           u8 *buf, /* holds data bytes read */
                           int len  /* number of bytes to read */ )
@@ -117,18 +106,19 @@ static int i2c_readbytes (struct lgdt3302_state* state,
         int err;
 
         if ((err = i2c_transfer(state->i2c, &msg, 1)) != 1) {
-                printk(KERN_WARNING "lgdt3302: %s error (addr %02x, err == %i)\n", __FUNCTION__, addr, err);
+                printk(KERN_WARNING "lgdt330x: %s error (addr %02x, err == %i)\n", __FUNCTION__, addr, err);
                 return -EREMOTEIO;
         }
         return 0;
 }
+#endif
 
 /*
  * This routine writes the register (reg) to the demod bus
  * then reads the data returned for (len) bytes.
  */
 
-static u8 i2c_selectreadbytes (struct lgdt3302_state* state,
+static u8 i2c_selectreadbytes (struct lgdt330x_state* state,
                                enum I2C_REG reg, u8* buf, int len)
 {
         u8 wr [] = { reg };
@@ -141,7 +131,7 @@ static u8 i2c_selectreadbytes (struct lgdt3302_state* state,
         int ret;
         ret = i2c_transfer(state->i2c, msg, 2);
         if (ret != 2) {
-                printk(KERN_WARNING "lgdt3302: %s: addr 0x%02x select 0x%02x error (ret == %i)\n", __FUNCTION__, state->config->demod_address, reg, ret);
+                printk(KERN_WARNING "lgdt330x: %s: addr 0x%02x select 0x%02x error (ret == %i)\n", __FUNCTION__, state->config->demod_address, reg, ret);
         } else {
                 ret = 0;
         }
@@ -149,7 +139,7 @@ static u8 i2c_selectreadbytes (struct lgdt3302_state* state,
 }
 
 /* Software reset */
-int lgdt3302_SwReset(struct lgdt3302_state* state)
+int lgdt330x_SwReset(struct lgdt330x_state* state)
 {
         u8 ret;
         u8 reset[] = {
@@ -175,7 +165,7 @@ int lgdt3302_SwReset(struct lgdt3302_state* state)
         return ret;
 }
 
-static int lgdt3302_init(struct dvb_frontend* fe)
+static int lgdt330x_init(struct dvb_frontend* fe)
 {
         /* Hardware reset is done using gpio[0] of cx23880x chip.
          * I'd like to do it here, but don't know how to find chip address.
@@ -184,18 +174,18 @@ static int lgdt3302_init(struct dvb_frontend* fe)
          * the caller of this function needs to do it. */
 
         dprintk("%s entered\n", __FUNCTION__);
-        return lgdt3302_SwReset((struct lgdt3302_state*) fe->demodulator_priv);
+        return lgdt330x_SwReset((struct lgdt330x_state*) fe->demodulator_priv);
 }
 
-static int lgdt3302_read_ber(struct dvb_frontend* fe, u32* ber)
+static int lgdt330x_read_ber(struct dvb_frontend* fe, u32* ber)
 {
         *ber = 0; /* Dummy out for now */
         return 0;
 }
 
-static int lgdt3302_read_ucblocks(struct dvb_frontend* fe, u32* ucblocks)
+static int lgdt330x_read_ucblocks(struct dvb_frontend* fe, u32* ucblocks)
 {
-        struct lgdt3302_state* state = (struct lgdt3302_state*) fe->demodulator_priv;
+        struct lgdt330x_state* state = (struct lgdt330x_state*) fe->demodulator_priv;
         u8 buf[2];
 
         i2c_selectreadbytes(state, PACKET_ERR_COUNTER1, buf, sizeof(buf));
@@ -204,12 +194,11 @@ static int lgdt3302_read_ucblocks(struct dvb_frontend* fe, u32* ucblocks)
         return 0;
 }
 
-static int lgdt3302_set_parameters(struct dvb_frontend* fe,
+static int lgdt330x_set_parameters(struct dvb_frontend* fe,
                                    struct dvb_frontend_parameters *param)
 {
-        u8 buf[4];
-        struct lgdt3302_state* state =
-                (struct lgdt3302_state*) fe->demodulator_priv;
+        struct lgdt330x_state* state =
+                (struct lgdt330x_state*) fe->demodulator_priv;
 
         /* Use 50MHz parameter values from spec sheet since xtal is 50 */
         static u8 top_ctrl_cfg[]   = { TOP_CONTROL, 0x03 };
@@ -228,6 +217,10 @@ static int lgdt3302_set_parameters(struct dvb_frontend* fe,
 
                         /* Select VSB mode and serial MPEG interface */
                         top_ctrl_cfg[1] = 0x07;
+
+                        /* Select ANT connector if supported by card */
+                        if (state->config->pll_rf_set)
+                                state->config->pll_rf_set(fe, 1);
                         break;
 
                 case QAM_64:
@@ -235,6 +228,10 @@ static int lgdt3302_set_parameters(struct dvb_frontend* fe,
 
                         /* Select QAM_64 mode and serial MPEG interface */
                         top_ctrl_cfg[1] = 0x04;
+
+                        /* Select CABLE connector if supported by card */
+                        if (state->config->pll_rf_set)
+                                state->config->pll_rf_set(fe, 0);
                         break;
 
                 case QAM_256:
@@ -242,9 +239,13 @@ static int lgdt3302_set_parameters(struct dvb_frontend* fe,
 
                         /* Select QAM_256 mode and serial MPEG interface */
                         top_ctrl_cfg[1] = 0x05;
+
+                        /* Select CABLE connector if supported by card */
+                        if (state->config->pll_rf_set)
+                                state->config->pll_rf_set(fe, 0);
                         break;
                 default:
-                        printk(KERN_WARNING "lgdt3302: %s: Modulation type(%d) UNSUPPORTED\n", __FUNCTION__, param->u.vsb.modulation);
+                        printk(KERN_WARNING "lgdt330x: %s: Modulation type(%d) UNSUPPORTED\n", __FUNCTION__, param->u.vsb.modulation);
                         return -1;
                 }
                 /* Initializations common to all modes */
@@ -290,44 +291,50 @@ static int lgdt3302_set_parameters(struct dvb_frontend* fe,
 
         /* Change only if we are actually changing the channel */
         if (state->current_frequency != param->frequency) {
-                dvb_pll_configure(state->config->pll_desc, buf,
-                                  param->frequency, 0);
-                dprintk("%s: tuner bytes: 0x%02x 0x%02x "
-                        "0x%02x 0x%02x\n", __FUNCTION__, buf[0],buf[1],buf[2],buf[3]);
-                i2c_writebytes(state, state->config->pll_address ,buf, 4);
+                u8 buf[5];
+                struct i2c_msg msg = { .flags = 0, .buf = &buf[1], .len = 4 };
+                int err;
 
-                /* Check the status of the tuner pll */
-                i2c_readbytes(state, state->config->pll_address, buf, 1);
-                dprintk("%s: tuner status byte = 0x%02x\n", __FUNCTION__, buf[0]);
+                state->config->pll_set(fe, param, buf);
+                msg.addr = buf[0];
 
+                dprintk("%s: tuner at 0x%02x bytes: 0x%02x 0x%02x "
+                        "0x%02x 0x%02x\n", __FUNCTION__,
+                        buf[0],buf[1],buf[2],buf[3],buf[4]);
+                if ((err = i2c_transfer(state->i2c, &msg, 1)) != 1) {
+                        printk(KERN_WARNING "lgdt330x: %s error (addr %02x <- %02x, err = %i)\n", __FUNCTION__, buf[0], buf[1], err);
+                        if (err < 0)
+                                return err;
+                        else
+                                return -EREMOTEIO;
+                }
+#if 0
+                /* Check the status of the tuner pll */
+                i2c_readbytes(state, buf[0], &buf[1], 1);
+                dprintk("%s: tuner status byte = 0x%02x\n", __FUNCTION__, buf[1]);
+#endif
                 /* Update current frequency */
                 state->current_frequency = param->frequency;
         }
-        lgdt3302_SwReset(state);
+        lgdt330x_SwReset(state);
         return 0;
 }
 
-static int lgdt3302_get_frontend(struct dvb_frontend* fe,
+static int lgdt330x_get_frontend(struct dvb_frontend* fe,
                                  struct dvb_frontend_parameters* param)
 {
-        struct lgdt3302_state *state = fe->demodulator_priv;
+        struct lgdt330x_state *state = fe->demodulator_priv;
         param->frequency = state->current_frequency;
         return 0;
 }
 
-static int lgdt3302_read_status(struct dvb_frontend* fe, fe_status_t* status)
+static int lgdt330x_read_status(struct dvb_frontend* fe, fe_status_t* status)
 {
-        struct lgdt3302_state* state = (struct lgdt3302_state*) fe->demodulator_priv;
+        struct lgdt330x_state* state = (struct lgdt330x_state*) fe->demodulator_priv;
         u8 buf[3];
 
         *status = 0; /* Reset status result */
 
-        /* Check the status of the tuner pll */
-        i2c_readbytes(state, state->config->pll_address, buf, 1);
-        dprintk("%s: tuner status byte = 0x%02x\n", __FUNCTION__, buf[0]);
-        if ((buf[0] & 0xc0) != 0x40)
-                return 0; /* Tuner PLL not locked or not powered on */
-
         /*
          * You must set the Mask bits to 1 in the IRQ_MASK in order
          * to see that status bit in the IRQ_STATUS register.
@@ -383,19 +390,19 @@ static int lgdt3302_read_status(struct dvb_frontend* fe, fe_status_t* status)
                         *status |= FE_HAS_CARRIER;
                 break;
         default:
-                printk("KERN_WARNING lgdt3302: %s: Modulation set to unsupported value\n", __FUNCTION__);
+                printk("KERN_WARNING lgdt330x: %s: Modulation set to unsupported value\n", __FUNCTION__);
         }
 
         return 0;
 }
 
-static int lgdt3302_read_signal_strength(struct dvb_frontend* fe, u16* strength)
+static int lgdt330x_read_signal_strength(struct dvb_frontend* fe, u16* strength)
 {
         /* not directly available. */
         return 0;
 }
 
-static int lgdt3302_read_snr(struct dvb_frontend* fe, u16* snr)
+static int lgdt330x_read_snr(struct dvb_frontend* fe, u16* snr)
 {
 #ifdef SNR_IN_DB
         /*
@@ -450,7 +457,7 @@ static int lgdt3302_read_snr(struct dvb_frontend* fe, u16* snr)
         static u8 buf[5];/* read data buffer */
         static u32 noise;   /* noise value */
         static u32 snr_db;  /* index into SNR_EQ[] */
-        struct lgdt3302_state* state = (struct lgdt3302_state*) fe->demodulator_priv;
+        struct lgdt330x_state* state = (struct lgdt330x_state*) fe->demodulator_priv;
 
         /* read both equalizer and pase tracker noise data */
         i2c_selectreadbytes(state, EQPH_ERR0, buf, sizeof(buf));
@@ -486,7 +493,7 @@ static int lgdt3302_read_snr(struct dvb_frontend* fe, u16* snr)
         /* Return the raw noise value */
         static u8 buf[5];/* read data buffer */
         static u32 noise;   /* noise value */
-        struct lgdt3302_state* state = (struct lgdt3302_state*) fe->demodulator_priv;
+        struct lgdt330x_state* state = (struct lgdt330x_state*) fe->demodulator_priv;
 
         /* read both equalizer and pase tracker noise data */
         i2c_selectreadbytes(state, EQPH_ERR0, buf, sizeof(buf));
@@ -509,7 +516,7 @@ static int lgdt3302_read_snr(struct dvb_frontend* fe, u16* snr)
         return 0;
 }
 
-static int lgdt3302_get_tune_settings(struct dvb_frontend* fe, struct dvb_frontend_tune_settings* fe_tune_settings)
+static int lgdt330x_get_tune_settings(struct dvb_frontend* fe, struct dvb_frontend_tune_settings* fe_tune_settings)
 {
         /* I have no idea about this - it may not be needed */
         fe_tune_settings->min_delay_ms = 500;
@@ -518,22 +525,22 @@ static int lgdt3302_get_tune_settings(struct dvb_frontend* fe, struct dvb_fronte
         return 0;
 }
 
-static void lgdt3302_release(struct dvb_frontend* fe)
+static void lgdt330x_release(struct dvb_frontend* fe)
 {
-        struct lgdt3302_state* state = (struct lgdt3302_state*) fe->demodulator_priv;
+        struct lgdt330x_state* state = (struct lgdt330x_state*) fe->demodulator_priv;
         kfree(state);
 }
 
-static struct dvb_frontend_ops lgdt3302_ops;
+static struct dvb_frontend_ops lgdt330x_ops;
 
-struct dvb_frontend* lgdt3302_attach(const struct lgdt3302_config* config,
+struct dvb_frontend* lgdt330x_attach(const struct lgdt330x_config* config,
                                      struct i2c_adapter* i2c)
 {
-        struct lgdt3302_state* state = NULL;
+        struct lgdt330x_state* state = NULL;
         u8 buf[1];
 
         /* Allocate memory for the internal state */
-        state = (struct lgdt3302_state*) kmalloc(sizeof(struct lgdt3302_state), GFP_KERNEL);
+        state = (struct lgdt330x_state*) kmalloc(sizeof(struct lgdt330x_state), GFP_KERNEL);
         if (state == NULL)
                 goto error;
         memset(state,0,sizeof(*state));
@@ -541,7 +548,7 @@ struct dvb_frontend* lgdt3302_attach(const struct lgdt3302_config* config,
         /* Setup the state */
         state->config = config;
         state->i2c = i2c;
-        memcpy(&state->ops, &lgdt3302_ops, sizeof(struct dvb_frontend_ops));
+        memcpy(&state->ops, &lgdt330x_ops, sizeof(struct dvb_frontend_ops));
         /* Verify communication with demod chip */
         if (i2c_selectreadbytes(state, 2, buf, 1))
                 goto error;
@@ -561,9 +568,9 @@ error:
         return NULL;
 }
 
-static struct dvb_frontend_ops lgdt3302_ops = {
+static struct dvb_frontend_ops lgdt330x_ops = {
         .info = {
-                .name= "LG Electronics LGDT3302 VSB/QAM Frontend",
+                .name= "LG Electronics lgdt330x VSB/QAM Frontend",
                 .type = FE_ATSC,
                 .frequency_min= 54000000,
                 .frequency_max= 858000000,
@@ -573,23 +580,23 @@ static struct dvb_frontend_ops lgdt3302_ops = {
                 .symbol_rate_max    = 10762000,
                 .caps = FE_CAN_QAM_64 | FE_CAN_QAM_256 | FE_CAN_8VSB
         },
-        .init                 = lgdt3302_init,
-        .set_frontend         = lgdt3302_set_parameters,
-        .get_frontend         = lgdt3302_get_frontend,
-        .get_tune_settings    = lgdt3302_get_tune_settings,
-        .read_status          = lgdt3302_read_status,
-        .read_ber             = lgdt3302_read_ber,
-        .read_signal_strength = lgdt3302_read_signal_strength,
-        .read_snr             = lgdt3302_read_snr,
-        .read_ucblocks        = lgdt3302_read_ucblocks,
-        .release              = lgdt3302_release,
+        .init                 = lgdt330x_init,
+        .set_frontend         = lgdt330x_set_parameters,
+        .get_frontend         = lgdt330x_get_frontend,
+        .get_tune_settings    = lgdt330x_get_tune_settings,
+        .read_status          = lgdt330x_read_status,
+        .read_ber             = lgdt330x_read_ber,
+        .read_signal_strength = lgdt330x_read_signal_strength,
+        .read_snr             = lgdt330x_read_snr,
+        .read_ucblocks        = lgdt330x_read_ucblocks,
+        .release              = lgdt330x_release,
 };
 
-MODULE_DESCRIPTION("LGDT3302 [DViCO FusionHDTV 3 Gold] (ATSC 8VSB & ITU-T J.83 AnnexB 64/256 QAM) Demodulator Driver");
+MODULE_DESCRIPTION("lgdt330x [DViCO FusionHDTV 3 Gold] (ATSC 8VSB & ITU-T J.83 AnnexB 64/256 QAM) Demodulator Driver");
 MODULE_AUTHOR("Wilson Michaels");
 MODULE_LICENSE("GPL");
 
-EXPORT_SYMBOL(lgdt3302_attach);
+EXPORT_SYMBOL(lgdt330x_attach);
 
 /*
  * Local variables:
diff --git a/drivers/media/dvb/frontends/lgdt3302.h b/drivers/media/dvb/frontends/lgdt330x.h
index 81587a40032b..04986f8e7565 100644
--- a/drivers/media/dvb/frontends/lgdt3302.h
+++ b/drivers/media/dvb/frontends/lgdt330x.h
@@ -1,7 +1,5 @@
 /*
- * $Id: lgdt3302.h,v 1.2 2005/06/28 23:50:48 mkrufky Exp $
- *
- *    Support for LGDT3302 (DViCO FustionHDTV 3 Gold) - VSB/QAM
+ *    Support for LGDT3302 & LGDT3303 (DViCO FustionHDTV Gold) - VSB/QAM
  *
  *    Copyright (C) 2005 Wilson Michaels <wilsonmichaels@earthlink.net>
  *
@@ -21,26 +19,28 @@
  *
  */
 
-#ifndef LGDT3302_H
-#define LGDT3302_H
+#ifndef LGDT330X_H
+#define LGDT330X_H
 
 #include <linux/dvb/frontend.h>
 
-struct lgdt3302_config
+struct lgdt330x_config
 {
         /* The demodulator's i2c address */
         u8 demod_address;
-        u8 pll_address;
-        struct dvb_pll_desc *pll_desc;
+
+        /* PLL interface */
+        int (*pll_rf_set) (struct dvb_frontend* fe, int index);
+        int (*pll_set)(struct dvb_frontend* fe, struct dvb_frontend_parameters* params, u8* pll_address);
 
         /* Need to set device param for start_dma */
         int (*set_ts_params)(struct dvb_frontend* fe, int is_punctured);
 };
 
-extern struct dvb_frontend* lgdt3302_attach(const struct lgdt3302_config* config,
+extern struct dvb_frontend* lgdt330x_attach(const struct lgdt330x_config* config,
                                             struct i2c_adapter* i2c);
 
-#endif /* LGDT3302_H */
+#endif /* LGDT330X_H */
 
 /*
  * Local variables:
diff --git a/drivers/media/dvb/frontends/lgdt3302_priv.h b/drivers/media/dvb/frontends/lgdt330x_priv.h
index 6193fa7a569d..4143ce8f1a95 100644
--- a/drivers/media/dvb/frontends/lgdt3302_priv.h
+++ b/drivers/media/dvb/frontends/lgdt330x_priv.h
@@ -1,7 +1,5 @@
 /*
- * $Id: lgdt3302_priv.h,v 1.2 2005/06/28 23:50:48 mkrufky Exp $
- *
- *    Support for LGDT3302 (DViCO FustionHDTV 3 Gold) - VSB/QAM
+ *    Support for LGDT3302 & LGDT3303 (DViCO FustionHDTV Gold) - VSB/QAM
  *
  *    Copyright (C) 2005 Wilson Michaels <wilsonmichaels@earthlink.net>
  *
@@ -21,8 +19,8 @@
  *
  */
 
-#ifndef _LGDT3302_PRIV_
-#define _LGDT3302_PRIV_
+#ifndef _LGDT330X_PRIV_
+#define _LGDT330X_PRIV_
 
 /* i2c control register addresses */
 enum I2C_REG {
@@ -63,7 +61,7 @@ enum I2C_REG {
         PACKET_ERR_COUNTER2= 0x6b,
 };
 
-#endif /* _LGDT3302_PRIV_ */
+#endif /* _LGDT330X_PRIV_ */
 
 /*
  * Local variables:
diff --git a/drivers/media/radio/radio-maestro.c b/drivers/media/radio/radio-maestro.c
index e62147e4ed1b..e5e2021a7312 100644
--- a/drivers/media/radio/radio-maestro.c
+++ b/drivers/media/radio/radio-maestro.c
@@ -154,7 +154,7 @@ static void radio_bits_set(struct radio_device *dev, __u32 data)
         msleep(125);
 }
 
-inline static int radio_function(struct inode *inode, struct file *file,
+static inline int radio_function(struct inode *inode, struct file *file,
                                  unsigned int cmd, void *arg)
 {
         struct video_device *dev = video_devdata(file);
@@ -283,7 +283,7 @@ static int __init maestro_radio_init(void)
 module_init(maestro_radio_init);
 module_exit(maestro_radio_exit);
 
-inline static __u16 radio_power_on(struct radio_device *dev)
+static inline __u16 radio_power_on(struct radio_device *dev)
 {
         register __u16 io=dev->io;
         register __u32 ofreq;
diff --git a/drivers/media/radio/radio-maxiradio.c b/drivers/media/radio/radio-maxiradio.c
index 5b748a48ce72..02d39a50d5ed 100644
--- a/drivers/media/radio/radio-maxiradio.c
+++ b/drivers/media/radio/radio-maxiradio.c
@@ -166,7 +166,7 @@ static int get_tune(__u16 io)
 }
 
 
-inline static int radio_function(struct inode *inode, struct file *file,
+static inline int radio_function(struct inode *inode, struct file *file,
                                  unsigned int cmd, void *arg)
 {
         struct video_device *dev = video_devdata(file);
diff --git a/drivers/media/video/Kconfig b/drivers/media/video/Kconfig
index f461750c7646..ac81e5e01a9a 100644
--- a/drivers/media/video/Kconfig
+++ b/drivers/media/video/Kconfig
@@ -236,7 +236,7 @@ config VIDEO_MEYE
 
 config VIDEO_SAA7134
         tristate "Philips SAA7134 support"
-        depends on VIDEO_DEV && PCI && I2C
+        depends on VIDEO_DEV && PCI && I2C && SOUND
         select VIDEO_BUF
         select VIDEO_IR
         select VIDEO_TUNER
@@ -331,7 +331,7 @@ config VIDEO_CX88_DVB
         select DVB_MT352
         select DVB_OR51132
         select DVB_CX22702
-        select DVB_LGDT3302
+        select DVB_LGDT330X
         ---help---
           This adds support for DVB/ATSC cards based on the
           Connexant 2388x chip.
diff --git a/drivers/media/video/bttv-cards.c b/drivers/media/video/bttv-cards.c
index 2dbf5ec43abd..6c52fd0bb7df 100644
--- a/drivers/media/video/bttv-cards.c
+++ b/drivers/media/video/bttv-cards.c
@@ -1,5 +1,5 @@
 /*
-    $Id: bttv-cards.c,v 1.53 2005/07/05 17:37:35 nsh Exp $
+    $Id: bttv-cards.c,v 1.54 2005/07/19 18:26:46 mkrufky Exp $
 
     bttv-cards.c
 
@@ -2772,8 +2772,6 @@ void __devinit bttv_init_card2(struct bttv *btv)
         }
         btv->pll.pll_current = -1;
 
-        bttv_reset_audio(btv);
-
         /* tuner configuration (from card list / autodetect / insmod option) */
         if (UNSET != bttv_tvcards[btv->c.type].tuner_type)
                 if(UNSET == btv->tuner_type)
diff --git a/drivers/media/video/cx88/Makefile b/drivers/media/video/cx88/Makefile
index 606d0348da2c..107e48645e3a 100644
--- a/drivers/media/video/cx88/Makefile
+++ b/drivers/media/video/cx88/Makefile
@@ -9,3 +9,15 @@ obj-$(CONFIG_VIDEO_CX88_DVB) += cx88-dvb.o
 EXTRA_CFLAGS += -I$(src)/..
 EXTRA_CFLAGS += -I$(srctree)/drivers/media/dvb/dvb-core
 EXTRA_CFLAGS += -I$(srctree)/drivers/media/dvb/frontends
+ifneq ($(CONFIG_DVB_CX22702),n)
+ EXTRA_CFLAGS += -DHAVE_CX22702=1
+endif
+ifneq ($(CONFIG_DVB_OR51132),n)
+ EXTRA_CFLAGS += -DHAVE_OR51132=1
+endif
+ifneq ($(CONFIG_DVB_LGDT330X),n)
+ EXTRA_CFLAGS += -DHAVE_LGDT330X=1
+endif
+ifneq ($(CONFIG_DVB_MT352),n)
+ EXTRA_CFLAGS += -DHAVE_MT352=1
+endif
diff --git a/drivers/media/video/cx88/cx88-dvb.c b/drivers/media/video/cx88/cx88-dvb.c
index 6ad1458ab652..ef0e9a85c359 100644
--- a/drivers/media/video/cx88/cx88-dvb.c
+++ b/drivers/media/video/cx88/cx88-dvb.c
@@ -1,5 +1,5 @@
 /*
- * $Id: cx88-dvb.c,v 1.42 2005/07/12 15:44:55 mkrufky Exp $
+ * $Id: cx88-dvb.c,v 1.54 2005/07/25 05:13:50 mkrufky Exp $
  *
  * device driver for Conexant 2388x based TV cards
  * MPEG Transport Stream (DVB) routines
@@ -29,27 +29,23 @@
 #include <linux/kthread.h>
 #include <linux/file.h>
 #include <linux/suspend.h>
-
-#define CONFIG_DVB_MT352 1
-#define CONFIG_DVB_CX22702 1
-#define CONFIG_DVB_OR51132 1
-#define CONFIG_DVB_LGDT3302 1
+#include <linux/config.h>
 
 #include "cx88.h"
 #include "dvb-pll.h"
 
-#if CONFIG_DVB_MT352
+#ifdef HAVE_MT352
 # include "mt352.h"
 # include "mt352_priv.h"
 #endif
-#if CONFIG_DVB_CX22702
+#ifdef HAVE_CX22702
 # include "cx22702.h"
 #endif
-#if CONFIG_DVB_OR51132
+#ifdef HAVE_OR51132
 # include "or51132.h"
 #endif
-#if CONFIG_DVB_LGDT3302
-# include "lgdt3302.h"
+#ifdef HAVE_LGDT330X
+# include "lgdt330x.h"
 #endif
 
 MODULE_DESCRIPTION("driver for cx2388x based DVB cards");
@@ -107,7 +103,7 @@ static struct videobuf_queue_ops dvb_qops = {
 
 /* ------------------------------------------------------------------ */
 
-#if CONFIG_DVB_MT352
+#ifdef HAVE_MT352
 static int dvico_fusionhdtv_demod_init(struct dvb_frontend* fe)
 {
         static u8 clock_config []  = { CLOCK_CTL,  0x38, 0x39 };
@@ -177,7 +173,7 @@ static struct mt352_config dntv_live_dvbt_config = {
 };
 #endif
 
-#if CONFIG_DVB_CX22702
+#ifdef HAVE_CX22702
 static struct cx22702_config connexant_refboard_config = {
         .demod_address = 0x43,
         .output_mode   = CX22702_SERIAL_OUTPUT,
@@ -193,7 +189,7 @@ static struct cx22702_config hauppauge_novat_config = {
 };
 #endif
 
-#if CONFIG_DVB_OR51132
+#ifdef HAVE_OR51132
 static int or51132_set_ts_param(struct dvb_frontend* fe,
                                 int is_punctured)
 {
@@ -210,8 +206,33 @@ static struct or51132_config pchdtv_hd3000 = {
 };
 #endif
 
-#if CONFIG_DVB_LGDT3302
-static int lgdt3302_set_ts_param(struct dvb_frontend* fe, int is_punctured)
+#ifdef HAVE_LGDT330X
+static int lgdt330x_pll_set(struct dvb_frontend* fe,
+                            struct dvb_frontend_parameters* params,
+                            u8* pllbuf)
+{
+        struct cx8802_dev *dev= fe->dvb->priv;
+
+        pllbuf[0] = dev->core->pll_addr;
+        dvb_pll_configure(dev->core->pll_desc, &pllbuf[1],
+                          params->frequency, 0);
+        return 0;
+}
+
+static int lgdt330x_pll_rf_set(struct dvb_frontend* fe, int index)
+{
+        struct cx8802_dev *dev= fe->dvb->priv;
+        struct cx88_core *core = dev->core;
+
+        dprintk(1, "%s: index = %d\n", __FUNCTION__, index);
+        if (index == 0)
+                cx_clear(MO_GP0_IO, 8);
+        else
+                cx_set(MO_GP0_IO, 8);
+        return 0;
+}
+
+static int lgdt330x_set_ts_param(struct dvb_frontend* fe, int is_punctured)
 {
         struct cx8802_dev *dev= fe->dvb->priv;
         if (is_punctured)
@@ -221,18 +242,10 @@ static int lgdt3302_set_ts_param(struct dvb_frontend* fe, int is_punctured)
         return 0;
 }
 
-static struct lgdt3302_config fusionhdtv_3_gold_q = {
+static struct lgdt330x_config fusionhdtv_3_gold = {
         .demod_address    = 0x0e,
-        .pll_address      = 0x61,
-        .pll_desc         = &dvb_pll_microtune_4042,
-        .set_ts_params    = lgdt3302_set_ts_param,
-};
-
-static struct lgdt3302_config fusionhdtv_3_gold_t = {
-        .demod_address    = 0x0e,
-        .pll_address      = 0x61,
-        .pll_desc         = &dvb_pll_thomson_dtt7611,
-        .set_ts_params    = lgdt3302_set_ts_param,
+        .pll_set          = lgdt330x_pll_set,
+        .set_ts_params    = lgdt330x_set_ts_param,
 };
 #endif
 
@@ -244,7 +257,7 @@ static int dvb_register(struct cx8802_dev *dev)
 
         /* init frontend */
         switch (dev->core->board) {
-#if CONFIG_DVB_CX22702
+#ifdef HAVE_CX22702
         case CX88_BOARD_HAUPPAUGE_DVB_T1:
                 dev->dvb.frontend = cx22702_attach(&hauppauge_novat_config,
                                                    &dev->core->i2c_adap);
@@ -255,7 +268,7 @@ static int dvb_register(struct cx8802_dev *dev)
                                                    &dev->core->i2c_adap);
                 break;
 #endif
-#if CONFIG_DVB_MT352
+#ifdef HAVE_MT352
         case CX88_BOARD_DVICO_FUSIONHDTV_DVB_T1:
                 dev->core->pll_addr = 0x61;
                 dev->core->pll_desc = &dvb_pll_lg_z201;
@@ -277,13 +290,13 @@ static int dvb_register(struct cx8802_dev *dev)
                                                  &dev->core->i2c_adap);
                 break;
 #endif
-#if CONFIG_DVB_OR51132
+#ifdef HAVE_OR51132
         case CX88_BOARD_PCHDTV_HD3000:
                 dev->dvb.frontend = or51132_attach(&pchdtv_hd3000,
                                                  &dev->core->i2c_adap);
                 break;
 #endif
-#if CONFIG_DVB_LGDT3302
+#ifdef HAVE_LGDT330X
         case CX88_BOARD_DVICO_FUSIONHDTV_3_GOLD_Q:
                 dev->ts_gen_cntrl = 0x08;
                 {
@@ -292,9 +305,14 @@ static int dvb_register(struct cx8802_dev *dev)
 
                 cx_clear(MO_GP0_IO, 1);
                 mdelay(100);
-                cx_set(MO_GP0_IO, 9); // ANT connector too FIXME
+                cx_set(MO_GP0_IO, 1);
                 mdelay(200);
-                dev->dvb.frontend = lgdt3302_attach(&fusionhdtv_3_gold_q,
+
+                /* Select RF connector callback */
+                fusionhdtv_3_gold.pll_rf_set = lgdt330x_pll_rf_set;
+                dev->core->pll_addr = 0x61;
+                dev->core->pll_desc = &dvb_pll_microtune_4042;
+                dev->dvb.frontend = lgdt330x_attach(&fusionhdtv_3_gold,
                                                     &dev->core->i2c_adap);
                 }
                 break;
@@ -306,9 +324,11 @@ static int dvb_register(struct cx8802_dev *dev)
 
                 cx_clear(MO_GP0_IO, 1);
                 mdelay(100);
-                cx_set(MO_GP0_IO, 9); /* ANT connector too FIXME */
+                cx_set(MO_GP0_IO, 9);
                 mdelay(200);
-                dev->dvb.frontend = lgdt3302_attach(&fusionhdtv_3_gold_t,
+                dev->core->pll_addr = 0x61;
+                dev->core->pll_desc = &dvb_pll_thomson_dtt7611;
+                dev->dvb.frontend = lgdt330x_attach(&fusionhdtv_3_gold,
                                                     &dev->core->i2c_adap);
                 }
                 break;
diff --git a/drivers/media/video/cx88/cx88-i2c.c b/drivers/media/video/cx88/cx88-i2c.c
index 8403c4e95050..a628a55299c6 100644
--- a/drivers/media/video/cx88/cx88-i2c.c
+++ b/drivers/media/video/cx88/cx88-i2c.c
@@ -1,5 +1,5 @@
 /*
-    $Id: cx88-i2c.c,v 1.28 2005/07/05 17:37:35 nsh Exp $
+    $Id: cx88-i2c.c,v 1.30 2005/07/25 05:10:13 mkrufky Exp $
 
     cx88-i2c.c  --  all the i2c code is here
 
@@ -164,7 +164,7 @@ static struct i2c_client cx8800_i2c_client_template = {
 };
 
 static char *i2c_devs[128] = {
-        [ 0x1c >> 1 ] = "lgdt3302",
+        [ 0x1c >> 1 ] = "lgdt330x",
         [ 0x86 >> 1 ] = "tda9887/cx22702",
         [ 0xa0 >> 1 ] = "eeprom",
         [ 0xc0 >> 1 ] = "tuner (analog)",
diff --git a/drivers/media/video/mxb.c b/drivers/media/video/mxb.c
index 486234d41b56..d04793fb80fc 100644
--- a/drivers/media/video/mxb.c
+++ b/drivers/media/video/mxb.c
@@ -142,8 +142,8 @@ struct mxb
 
         int     cur_mode;       /* current audio mode (mono, stereo, ...) */
         int     cur_input;      /* current input */
-        int     cur_freq;       /* current frequency the tuner is tuned to */
         int     cur_mute;       /* current mute status */
+        struct v4l2_frequency   cur_freq;       /* current frequency the tuner is tuned to */
 };
 
 static struct saa7146_extension extension;
@@ -352,9 +352,15 @@ static int mxb_init_done(struct saa7146_dev* dev)
         /* select a tuner type */
         tun_setup.mode_mask = T_ANALOG_TV;
         tun_setup.addr = ADDR_UNSET;
-        tun_setup.type = 5;
+        tun_setup.type = TUNER_PHILIPS_PAL;
         mxb->tuner->driver->command(mxb->tuner,TUNER_SET_TYPE_ADDR, &tun_setup);
-        
+        /* tune in some frequency on tuner */
+        mxb->cur_freq.tuner = 0;
+        mxb->cur_freq.type = V4L2_TUNER_ANALOG_TV;
+        mxb->cur_freq.frequency = freq;
+        mxb->tuner->driver->command(mxb->tuner, VIDIOC_S_FREQUENCY,
+                                        &mxb->cur_freq);
+
         /* mute audio on tea6420s */
         mxb->tea6420_1->driver->command(mxb->tea6420_1,TEA6420_SWITCH, &TEA6420_line[6][0]);
         mxb->tea6420_2->driver->command(mxb->tea6420_2,TEA6420_SWITCH, &TEA6420_line[6][1]);
@@ -371,12 +377,8 @@ static int mxb_init_done(struct saa7146_dev* dev)
         vm.out = 13;
         mxb->tea6415c->driver->command(mxb->tea6415c,TEA6415C_SWITCH, &vm);
                                 
-        /* tune in some frequency on tuner */
-        mxb->tuner->driver->command(mxb->tuner, VIDIOCSFREQ, &freq);
-
         /* the rest for mxb */
         mxb->cur_input = 0;
-        mxb->cur_freq = freq;
         mxb->cur_mute = 1;
 
         mxb->cur_mode = V4L2_TUNER_MODE_STEREO;
@@ -819,18 +821,14 @@ static int mxb_ioctl(struct saa7146_fh *fh, unsigned int cmd, void *arg)
                         return -EINVAL;
                 }
 
-                memset(f,0,sizeof(*f));
-                f->type = V4L2_TUNER_ANALOG_TV;
-                f->frequency =  mxb->cur_freq;
+                *f = mxb->cur_freq;
 
-                DEB_EE(("VIDIOC_G_FREQ: freq:0x%08x.\n", mxb->cur_freq));
+                DEB_EE(("VIDIOC_G_FREQ: freq:0x%08x.\n", mxb->cur_freq.frequency));
                 return 0;
         }
         case VIDIOC_S_FREQUENCY:
         {
                 struct v4l2_frequency *f = arg;
-                int t_locked = 0;
-                int v_byte = 0;
 
                 if (0 != f->tuner)
                         return -EINVAL;
@@ -843,20 +841,11 @@ static int mxb_ioctl(struct saa7146_fh *fh, unsigned int cmd, void *arg)
                         return -EINVAL;
                 }
 
-                DEB_EE(("VIDIOC_S_FREQUENCY: freq:0x%08x.\n",f->frequency));
-
-                mxb->cur_freq = f->frequency;
+                mxb->cur_freq = *f;
+                DEB_EE(("VIDIOC_S_FREQUENCY: freq:0x%08x.\n", mxb->cur_freq.frequency));
 
                 /* tune in desired frequency */                 
-                mxb->tuner->driver->command(mxb->tuner, VIDIOCSFREQ, &mxb->cur_freq);
-
-                /* check if pll of tuner & saa7111a is locked */
-//              mxb->tuner->driver->command(mxb->tuner,TUNER_IS_LOCKED, &t_locked);
-                mxb->saa7111a->driver->command(mxb->saa7111a,DECODER_GET_STATUS, &v_byte);
-
-                /* not locked -- anything to do here ? */
-                if( 0 == t_locked || 0 == (v_byte & DECODER_STATUS_GOOD)) {
-                }
+                mxb->tuner->driver->command(mxb->tuner, VIDIOC_S_FREQUENCY, &mxb->cur_freq);
 
                 /* hack: changing the frequency should invalidate the vbi-counter (=> alevt) */
                 spin_lock(&dev->slock);
diff --git a/drivers/media/video/saa7134/Makefile b/drivers/media/video/saa7134/Makefile
index e577a06b136b..b778ffd94e65 100644
--- a/drivers/media/video/saa7134/Makefile
+++ b/drivers/media/video/saa7134/Makefile
@@ -9,3 +9,9 @@ obj-$(CONFIG_VIDEO_SAA7134_DVB) += saa7134-dvb.o
 EXTRA_CFLAGS += -I$(src)/..
 EXTRA_CFLAGS += -I$(srctree)/drivers/media/dvb/dvb-core
 EXTRA_CFLAGS += -I$(srctree)/drivers/media/dvb/frontends
+ifneq ($(CONFIG_DVB_MT352),n)
+ EXTRA_CFLAGS += -DHAVE_MT352=1
+endif
+ifneq ($(CONFIG_DVB_TDA1004X),n)
+ EXTRA_CFLAGS += -DHAVE_TDA1004X=1
+endif
diff --git a/drivers/media/video/saa7134/saa7134-dvb.c b/drivers/media/video/saa7134/saa7134-dvb.c
index 334bc1850092..8be6a90358c8 100644
--- a/drivers/media/video/saa7134/saa7134-dvb.c
+++ b/drivers/media/video/saa7134/saa7134-dvb.c
@@ -1,5 +1,5 @@
 /*
- * $Id: saa7134-dvb.c,v 1.18 2005/07/04 16:05:50 mkrufky Exp $
+ * $Id: saa7134-dvb.c,v 1.23 2005/07/24 22:12:47 mkrufky Exp $
  *
  * (c) 2004 Gerd Knorr <kraxel@bytesex.org> [SuSE Labs]
  *
@@ -29,18 +29,17 @@
 #include <linux/delay.h>
 #include <linux/kthread.h>
 #include <linux/suspend.h>
+#include <linux/config.h>
 
-#define CONFIG_DVB_MT352 1
-#define CONFIG_DVB_TDA1004X 1
 
 #include "saa7134-reg.h"
 #include "saa7134.h"
 
-#if CONFIG_DVB_MT352
+#ifdef HAVE_MT352
 # include "mt352.h"
 # include "mt352_priv.h" /* FIXME */
 #endif
-#if CONFIG_DVB_TDA1004X
+#ifdef HAVE_TDA1004X
 # include "tda1004x.h"
 #endif
 
@@ -54,7 +53,7 @@ MODULE_PARM_DESC(antenna_pwr,"enable antenna power (Pinnacle 300i)");
 
 /* ------------------------------------------------------------------ */
 
-#if CONFIG_DVB_MT352
+#ifdef HAVE_MT352
 static int pinnacle_antenna_pwr(struct saa7134_dev *dev, int on)
 {
         u32 ok;
@@ -153,7 +152,7 @@ static struct mt352_config pinnacle_300i = {
 
 /* ------------------------------------------------------------------ */
 
-#if CONFIG_DVB_TDA1004X
+#ifdef HAVE_TDA1004X
 static int philips_tu1216_pll_init(struct dvb_frontend *fe)
 {
         struct saa7134_dev *dev = fe->dvb->priv;
@@ -385,7 +384,7 @@ static int philips_fmd1216_pll_set(struct dvb_frontend *fe, struct dvb_frontend_
         return 0;
 }
 
-
+#ifdef HAVE_TDA1004X
 static struct tda1004x_config medion_cardbus = {
         .demod_address = 0x08,
         .invert        = 1,
@@ -398,6 +397,7 @@ static struct tda1004x_config medion_cardbus = {
         .pll_sleep         = philips_fmd1216_analog,
         .request_firmware = NULL,
 };
+#endif
 
 /* ------------------------------------------------------------------ */
 
@@ -547,14 +547,14 @@ static int dvb_init(struct saa7134_dev *dev)
                             dev);
 
         switch (dev->board) {
-#if CONFIG_DVB_MT352
+#ifdef HAVE_MT352
         case SAA7134_BOARD_PINNACLE_300I_DVBT_PAL:
                 printk("%s: pinnacle 300i dvb setup\n",dev->name);
                 dev->dvb.frontend = mt352_attach(&pinnacle_300i,
                                                  &dev->i2c_adap);
                 break;
 #endif
-#if CONFIG_DVB_TDA1004X
+#ifdef HAVE_TDA1004X
         case SAA7134_BOARD_MD7134:
                 dev->dvb.frontend = tda10046_attach(&medion_cardbus,
                                                     &dev->i2c_adap);
diff --git a/drivers/media/video/tvaudio.c b/drivers/media/video/tvaudio.c
index d8b78f1d686b..f42a1efa8fcf 100644
--- a/drivers/media/video/tvaudio.c
+++ b/drivers/media/video/tvaudio.c
@@ -285,6 +285,7 @@ static int chip_thread(void *data)
                         schedule();
                 }
                 remove_wait_queue(&chip->wq, &wait);
+                try_to_freeze();
                 if (chip->done || signal_pending(current))
                         break;
                 dprintk("%s: thread wakeup\n", i2c_clientname(&chip->c));
diff --git a/drivers/media/video/tveeprom.c b/drivers/media/video/tveeprom.c
index e8d9440977cb..62b03ef091e0 100644
--- a/drivers/media/video/tveeprom.c
+++ b/drivers/media/video/tveeprom.c
@@ -445,6 +445,7 @@ int tveeprom_read(struct i2c_client *c, unsigned char *eedata, int len)
 }
 EXPORT_SYMBOL(tveeprom_read);
 
+#if 0
 int tveeprom_dump(unsigned char *eedata, int len)
 {
         int i;
@@ -460,6 +461,7 @@ int tveeprom_dump(unsigned char *eedata, int len)
         return 0;
 }
 EXPORT_SYMBOL(tveeprom_dump);
+#endif  /*  0  */
 
 /* ----------------------------------------------------------------------- */
 /* needed for ivtv.sf.net at the moment.  Should go away in the long       */
@@ -477,7 +479,7 @@ static unsigned short normal_i2c[] = {
 
 I2C_CLIENT_INSMOD;
 
-struct i2c_driver i2c_driver_tveeprom;
+static struct i2c_driver i2c_driver_tveeprom;
 
 static int
 tveeprom_command(struct i2c_client *client,
@@ -549,7 +551,7 @@ tveeprom_detach_client (struct i2c_client *client)
         return 0;
 }
 
-struct i2c_driver i2c_driver_tveeprom = {
+static struct i2c_driver i2c_driver_tveeprom = {
         .owner          = THIS_MODULE,
         .name           = "tveeprom",
         .id             = I2C_DRIVERID_TVEEPROM,
diff --git a/drivers/mmc/wbsd.c b/drivers/mmc/wbsd.c
index 0c41d4b41a65..8b487ed1069c 100644
--- a/drivers/mmc/wbsd.c
+++ b/drivers/mmc/wbsd.c
@@ -1053,7 +1053,7 @@ static void wbsd_detect_card(unsigned long data)
  * Tasklets
  */
 
-inline static struct mmc_data* wbsd_get_data(struct wbsd_host* host)
+static inline struct mmc_data* wbsd_get_data(struct wbsd_host* host)
 {
         WARN_ON(!host->mrq);
         if (!host->mrq)
diff --git a/drivers/mtd/devices/docecc.c b/drivers/mtd/devices/docecc.c
index 933877ff4d88..9a087c1fb0b7 100644
--- a/drivers/mtd/devices/docecc.c
+++ b/drivers/mtd/devices/docecc.c
@@ -40,6 +40,7 @@
 #include <linux/mtd/mtd.h>
 #include <linux/mtd/doc2000.h>
 
+#define DEBUG 0
 /* need to undef it (from asm/termbits.h) */
 #undef B0
 
diff --git a/drivers/net/3c505.c b/drivers/net/3c505.c
index ad17f17e8e7a..111601ca4ca3 100644
--- a/drivers/net/3c505.c
+++ b/drivers/net/3c505.c
@@ -272,7 +272,7 @@ static inline void set_hsf(struct net_device *dev, int hsf)
 
 static int start_receive(struct net_device *, pcb_struct *);
 
-inline static void adapter_reset(struct net_device *dev)
+static inline void adapter_reset(struct net_device *dev)
 {
         unsigned long timeout;
         elp_device *adapter = dev->priv;
diff --git a/drivers/net/8139too.c b/drivers/net/8139too.c
index 5a4a08a7c951..4c2cf7bbd252 100644
--- a/drivers/net/8139too.c
+++ b/drivers/net/8139too.c
@@ -126,14 +126,14 @@
 #define USE_IO_OPS 1
 #endif
 
-/* define to 1 to enable copious debugging info */
-#undef RTL8139_DEBUG
+/* define to 1, 2 or 3 to enable copious debugging info */
+#define RTL8139_DEBUG 0
 
 /* define to 1 to disable lightweight runtime debugging checks */
 #undef RTL8139_NDEBUG
 
 
-#ifdef RTL8139_DEBUG
+#if RTL8139_DEBUG
 /* note: prints function name for you */
 #  define DPRINTK(fmt, args...) printk(KERN_DEBUG "%s: " fmt, __FUNCTION__ , ## args)
 #else
diff --git a/drivers/net/amd8111e.c b/drivers/net/amd8111e.c
index 8618012df06a..d9ba8be72af8 100755
--- a/drivers/net/amd8111e.c
+++ b/drivers/net/amd8111e.c
@@ -1290,7 +1290,7 @@ static irqreturn_t amd8111e_interrupt(int irq, void *dev_id, struct pt_regs *reg
         writel(intr0, mmio + INT0);
 
         /* Check if Receive Interrupt has occurred. */
-#if CONFIG_AMD8111E_NAPI
+#ifdef CONFIG_AMD8111E_NAPI
         if(intr0 & RINT0){
                 if(netif_rx_schedule_prep(dev)){
                         /* Disable receive interupts */
diff --git a/drivers/net/ne.c b/drivers/net/ne.c
index 6c57096aa2e1..d209a1556b2e 100644
--- a/drivers/net/ne.c
+++ b/drivers/net/ne.c
@@ -129,9 +129,9 @@ bad_clone_list[] __initdata = {
 #define NESM_START_PG   0x40    /* First page of TX buffer */
 #define NESM_STOP_PG    0x80    /* Last page +1 of RX ring */
 
-#ifdef CONFIG_PLAT_MAPPI
+#if defined(CONFIG_PLAT_MAPPI)
 #  define DCR_VAL 0x4b
-#elif CONFIG_PLAT_OAKS32R
+#elif defined(CONFIG_PLAT_OAKS32R)
 #  define DCR_VAL 0x48
 #else
 #  define DCR_VAL 0x49
diff --git a/drivers/net/plip.c b/drivers/net/plip.c
index 21537ee3a6a7..1bd22cd40c75 100644
--- a/drivers/net/plip.c
+++ b/drivers/net/plip.c
@@ -160,7 +160,7 @@ static struct net_device_stats *plip_get_stats(struct net_device *dev);
 static int plip_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd);
 static int plip_preempt(void *handle);
 static void plip_wakeup(void *handle);
-
+
 enum plip_connection_state {
         PLIP_CN_NONE=0,
         PLIP_CN_RECEIVE,
@@ -231,8 +231,8 @@ struct net_local {
         atomic_t kill_timer;
         struct semaphore killed_timer_sem;
 };
-
-inline static void enable_parport_interrupts (struct net_device *dev)
+
+static inline void enable_parport_interrupts (struct net_device *dev)
 {
         if (dev->irq != -1)
         {
@@ -242,7 +242,7 @@ inline static void enable_parport_interrupts (struct net_device *dev)
         }
 }
 
-inline static void disable_parport_interrupts (struct net_device *dev)
+static inline void disable_parport_interrupts (struct net_device *dev)
 {
         if (dev->irq != -1)
         {
@@ -252,7 +252,7 @@ inline static void disable_parport_interrupts (struct net_device *dev)
         }
 }
 
-inline static void write_data (struct net_device *dev, unsigned char data)
+static inline void write_data (struct net_device *dev, unsigned char data)
 {
         struct parport *port =
            ((struct net_local *)dev->priv)->pardev->port;
@@ -260,14 +260,14 @@ inline static void write_data (struct net_device *dev, unsigned char data)
         port->ops->write_data (port, data);
 }
 
-inline static unsigned char read_status (struct net_device *dev)
+static inline unsigned char read_status (struct net_device *dev)
 {
         struct parport *port =
            ((struct net_local *)dev->priv)->pardev->port;
 
         return port->ops->read_status (port);
 }
-
+
 /* Entry point of PLIP driver.
    Probe the hardware, and register/initialize the driver.
 
@@ -316,7 +316,7 @@ plip_init_netdev(struct net_device *dev)
 
         spin_lock_init(&nl->lock);
 }
-
+
 /* Bottom half handler for the delayed request.
    This routine is kicked by do_timer().
    Request `plip_bh' to be invoked. */
@@ -471,7 +471,7 @@ plip_bh_timeout_error(struct net_device *dev, struct net_local *nl,
 
         return TIMEOUT;
 }
-
+
 static int
 plip_none(struct net_device *dev, struct net_local *nl,
           struct plip_local *snd, struct plip_local *rcv)
@@ -481,7 +481,7 @@ plip_none(struct net_device *dev, struct net_local *nl,
 
 /* PLIP_RECEIVE --- receive a byte(two nibbles)
    Returns OK on success, TIMEOUT on timeout */
-inline static int
+static inline int
 plip_receive(unsigned short nibble_timeout, struct net_device *dev,
              enum plip_nibble_state *ns_p, unsigned char *data_p)
 {
@@ -582,7 +582,6 @@ static __be16 plip_type_trans(struct sk_buff *skb, struct net_device *dev)
         return htons(ETH_P_802_2);
 }
 
-
 /* PLIP_RECEIVE_PACKET --- receive a packet */
 static int
 plip_receive_packet(struct net_device *dev, struct net_local *nl,
@@ -702,7 +701,7 @@ plip_receive_packet(struct net_device *dev, struct net_local *nl,
 
 /* PLIP_SEND --- send a byte (two nibbles)
    Returns OK on success, TIMEOUT when timeout    */
-inline static int
+static inline int
 plip_send(unsigned short nibble_timeout, struct net_device *dev,
           enum plip_nibble_state *ns_p, unsigned char data)
 {
@@ -902,7 +901,7 @@ plip_error(struct net_device *dev, struct net_local *nl,
 
         return OK;
 }
-
+
 /* Handle the parallel port interrupts. */
 static void
 plip_interrupt(int irq, void *dev_id, struct pt_regs * regs)
@@ -957,7 +956,7 @@ plip_interrupt(int irq, void *dev_id, struct pt_regs * regs)
 
         spin_unlock_irq(&nl->lock);
 }
-
+
 static int
 plip_tx_packet(struct sk_buff *skb, struct net_device *dev)
 {
@@ -1238,7 +1237,7 @@ plip_ioctl(struct net_device *dev, struct ifreq *rq, int cmd)
         }
         return 0;
 }
-
+
 static int parport[PLIP_MAX] = { [0 ... PLIP_MAX-1] = -1 };
 static int timid;
 
diff --git a/drivers/net/via-velocity.h b/drivers/net/via-velocity.h
index 1b70b7c97580..d9a774b91ddc 100644
--- a/drivers/net/via-velocity.h
+++ b/drivers/net/via-velocity.h
@@ -1414,7 +1414,7 @@ static inline void mac_get_cam(struct mac_regs __iomem * regs, int idx, u8 *addr
  *      the rest of the logic from the result of sleep/wakeup
  */
 
-inline static void mac_wol_reset(struct mac_regs __iomem * regs)
+static inline void mac_wol_reset(struct mac_regs __iomem * regs)
 {
 
         /* Turn off SWPTAG right after leaving power mode */
@@ -1811,7 +1811,7 @@ struct velocity_info {
  *      CHECK ME: locking
  */
 
-inline static int velocity_get_ip(struct velocity_info *vptr)
+static inline int velocity_get_ip(struct velocity_info *vptr)
 {
         struct in_device *in_dev = (struct in_device *) vptr->dev->ip_ptr;
         struct in_ifaddr *ifa;
diff --git a/drivers/net/wireless/airo.c b/drivers/net/wireless/airo.c
index 47f3c5d0203d..df20adcd0730 100644
--- a/drivers/net/wireless/airo.c
+++ b/drivers/net/wireless/airo.c
@@ -5013,7 +5013,7 @@ static void proc_SSID_on_close( struct inode *inode, struct file *file ) {
         enable_MAC(ai, &rsp, 1);
 }
 
-inline static u8 hexVal(char c) {
+static inline u8 hexVal(char c) {
         if (c>='0' && c<='9') return c -= '0';
         if (c>='a' && c<='f') return c -= 'a'-10;
         if (c>='A' && c<='F') return c -= 'A'-10;
diff --git a/drivers/oprofile/cpu_buffer.c b/drivers/oprofile/cpu_buffer.c
index e9b1772a3a28..026f671ea558 100644
--- a/drivers/oprofile/cpu_buffer.c
+++ b/drivers/oprofile/cpu_buffer.c
@@ -42,8 +42,7 @@ void free_cpu_buffers(void)
                 vfree(cpu_buffer[i].buffer);
         }
 }
- 
- 
+
 int alloc_cpu_buffers(void)
 {
         int i;
@@ -74,7 +73,6 @@ fail:
         free_cpu_buffers();
         return -ENOMEM;
 }
- 
 
 void start_cpu_work(void)
 {
@@ -93,7 +91,6 @@ void start_cpu_work(void)
         }
 }
 
-
 void end_cpu_work(void)
 {
         int i;
@@ -109,7 +106,6 @@ void end_cpu_work(void)
         flush_scheduled_work();
 }
 
-
 /* Resets the cpu buffer to a sane state. */
 void cpu_buffer_reset(struct oprofile_cpu_buffer * cpu_buf)
 {
@@ -121,7 +117,6 @@ void cpu_buffer_reset(struct oprofile_cpu_buffer * cpu_buf)
         cpu_buf->last_task = NULL;
 }
 
-
 /* compute number of available slots in cpu_buffer queue */
 static unsigned long nr_available_slots(struct oprofile_cpu_buffer const * b)
 {
@@ -134,7 +129,6 @@ static unsigned long nr_available_slots(struct oprofile_cpu_buffer const * b)
         return tail + (b->buffer_size - head) - 1;
 }
 
-
 static void increment_head(struct oprofile_cpu_buffer * b)
 {
         unsigned long new_head = b->head_pos + 1;
@@ -149,10 +143,7 @@ static void increment_head(struct oprofile_cpu_buffer * b)
                 b->head_pos = 0;
 }
 
-
-
-
-inline static void
+static inline void
 add_sample(struct oprofile_cpu_buffer * cpu_buf,
            unsigned long pc, unsigned long event)
 {
@@ -162,14 +153,12 @@ add_sample(struct oprofile_cpu_buffer * cpu_buf,
         increment_head(cpu_buf);
 }
 
-
-inline static void
+static inline void
 add_code(struct oprofile_cpu_buffer * buffer, unsigned long value)
 {
         add_sample(buffer, ESCAPE_CODE, value);
 }
 
-
 /* This must be safe from any context. It's safe writing here
  * because of the head/tail separation of the writer and reader
  * of the CPU buffer.
@@ -223,13 +212,11 @@ static int oprofile_begin_trace(struct oprofile_cpu_buffer * cpu_buf)
         return 1;
 }
 
-
 static void oprofile_end_trace(struct oprofile_cpu_buffer * cpu_buf)
 {
         cpu_buf->tracing = 0;
 }
 
-
 void oprofile_add_sample(struct pt_regs * const regs, unsigned long event)
 {
         struct oprofile_cpu_buffer * cpu_buf = &cpu_buffer[smp_processor_id()];
@@ -251,14 +238,12 @@ void oprofile_add_sample(struct pt_regs * const regs, unsigned long event)
         oprofile_end_trace(cpu_buf);
 }
 
-
 void oprofile_add_pc(unsigned long pc, int is_kernel, unsigned long event)
 {
         struct oprofile_cpu_buffer * cpu_buf = &cpu_buffer[smp_processor_id()];
         log_sample(cpu_buf, pc, is_kernel, event);
 }
 
-
 void oprofile_add_trace(unsigned long pc)
 {
         struct oprofile_cpu_buffer * cpu_buf = &cpu_buffer[smp_processor_id()];
@@ -283,8 +268,6 @@ void oprofile_add_trace(unsigned long pc)
         add_sample(cpu_buf, pc, 0);
 }
 
-
-
 /*
  * This serves to avoid cpu buffer overflow, and makes sure
  * the task mortuary progresses
diff --git a/drivers/pnp/pnpbios/rsparser.c b/drivers/pnp/pnpbios/rsparser.c
index 9001b6f0204d..e305bb132c24 100644
--- a/drivers/pnp/pnpbios/rsparser.c
+++ b/drivers/pnp/pnpbios/rsparser.c
@@ -11,7 +11,7 @@
 #ifdef CONFIG_PCI
 #include <linux/pci.h>
 #else
-inline void pcibios_penalize_isa_irq(int irq) {}
+inline void pcibios_penalize_isa_irq(int irq, int active) {}
 #endif /* CONFIG_PCI */
 
 #include "pnpbios.h"
diff --git a/drivers/s390/block/dasd.c b/drivers/s390/block/dasd.c
index 6527ff6f4706..d5f53980749b 100644
--- a/drivers/s390/block/dasd.c
+++ b/drivers/s390/block/dasd.c
@@ -7,7 +7,7 @@
  * Bugreports.to..: <Linux390@de.ibm.com>
  * (C) IBM Corporation, IBM Deutschland Entwicklung GmbH, 1999-2001
  *
- * $Revision: 1.164 $
+ * $Revision: 1.165 $
  */
 
 #include <linux/config.h>
@@ -1740,6 +1740,10 @@ dasd_exit(void)
         dasd_proc_exit();
 #endif
         dasd_ioctl_exit();
+        if (dasd_page_cache != NULL) {
+                kmem_cache_destroy(dasd_page_cache);
+                dasd_page_cache = NULL;
+        }
         dasd_gendisk_exit();
         dasd_devmap_exit();
         devfs_remove("dasd");
diff --git a/drivers/s390/block/dasd_fba.c b/drivers/s390/block/dasd_fba.c
index 7963ae343eef..28cb4613b7f5 100644
--- a/drivers/s390/block/dasd_fba.c
+++ b/drivers/s390/block/dasd_fba.c
@@ -4,7 +4,7 @@
  * Bugreports.to..: <Linux390@de.ibm.com>
  * (C) IBM Corporation, IBM Deutschland Entwicklung GmbH, 1999,2000
  *
- * $Revision: 1.39 $
+ * $Revision: 1.40 $
  */
 
 #include <linux/config.h>
@@ -354,6 +354,8 @@ dasd_fba_build_cp(struct dasd_device * device, struct request *req)
         }
         cqr->device = device;
         cqr->expires = 5 * 60 * HZ;     /* 5 minutes */
+        cqr->retries = 32;
+        cqr->buildclk = get_clock();
         cqr->status = DASD_CQR_FILLED;
         return cqr;
 }
diff --git a/drivers/s390/char/tape.h b/drivers/s390/char/tape.h
index d04e6c2c3cc1..01d865d93791 100644
--- a/drivers/s390/char/tape.h
+++ b/drivers/s390/char/tape.h
@@ -3,10 +3,11 @@
  *    tape device driver for 3480/3490E/3590 tapes.
  *
  *  S390 and zSeries version
- *    Copyright (C) 2001,2002 IBM Deutschland Entwicklung GmbH, IBM Corporation
+ *    Copyright (C) 2001,2005 IBM Deutschland Entwicklung GmbH, IBM Corporation
  *    Author(s): Carsten Otte <cotte@de.ibm.com>
  *               Tuan Ngo-Anh <ngoanh@de.ibm.com>
  *               Martin Schwidefsky <schwidefsky@de.ibm.com>
+ *               Stefan Bader <shbader@de.ibm.com>
  */
 
 #ifndef _TAPE_H
@@ -111,6 +112,7 @@ enum tape_request_status {
         TAPE_REQUEST_QUEUED,    /* request is queued to be processed */
         TAPE_REQUEST_IN_IO,     /* request is currently in IO */
         TAPE_REQUEST_DONE,      /* request is completed. */
+        TAPE_REQUEST_CANCEL,    /* request should be canceled. */
 };
 
 /* Tape CCW request */
@@ -237,6 +239,9 @@ struct tape_device {
         /* Block dev frontend data */
         struct tape_blk_data            blk_data;
 #endif
+
+        /* Function to start or stop the next request later. */
+        struct work_struct              tape_dnr;
 };
 
 /* Externals from tape_core.c */
diff --git a/drivers/s390/char/tape_core.c b/drivers/s390/char/tape_core.c
index 0597aa0e27ee..6c52e8307dc5 100644
--- a/drivers/s390/char/tape_core.c
+++ b/drivers/s390/char/tape_core.c
@@ -3,11 +3,12 @@
  *    basic function of the tape device driver
  *
  *  S390 and zSeries version
- *    Copyright (C) 2001,2002 IBM Deutschland Entwicklung GmbH, IBM Corporation
+ *    Copyright (C) 2001,2005 IBM Deutschland Entwicklung GmbH, IBM Corporation
  *    Author(s): Carsten Otte <cotte@de.ibm.com>
  *               Michael Holzheu <holzheu@de.ibm.com>
  *               Tuan Ngo-Anh <ngoanh@de.ibm.com>
  *               Martin Schwidefsky <schwidefsky@de.ibm.com>
+ *               Stefan Bader <shbader@de.ibm.com>
  */
 
 #include <linux/config.h>
@@ -28,7 +29,7 @@
 #define PRINTK_HEADER "TAPE_CORE: "
 
 static void __tape_do_irq (struct ccw_device *, unsigned long, struct irb *);
-static void __tape_remove_request(struct tape_device *, struct tape_request *);
+static void tape_delayed_next_request(void * data);
 
 /*
  * One list to contain all tape devices of all disciplines, so
@@ -257,7 +258,7 @@ tape_med_state_set(struct tape_device *device, enum tape_medium_state newstate)
  * Stop running ccw. Has to be called with the device lock held.
  */
 static inline int
-__tape_halt_io(struct tape_device *device, struct tape_request *request)
+__tape_cancel_io(struct tape_device *device, struct tape_request *request)
 {
         int retries;
         int rc;
@@ -270,20 +271,23 @@ __tape_halt_io(struct tape_device *device, struct tape_request *request)
         for (retries = 0; retries < 5; retries++) {
                 rc = ccw_device_clear(device->cdev, (long) request);
 
-                if (rc == 0) {                     /* Termination successful */
-                        request->rc     = -EIO;
-                        request->status = TAPE_REQUEST_DONE;
-                        return 0;
+                switch (rc) {
+                        case 0:
+                                request->status = TAPE_REQUEST_DONE;
+                                return 0;
+                        case -EBUSY:
+                                request->status = TAPE_REQUEST_CANCEL;
+                                schedule_work(&device->tape_dnr);
+                                return 0;
+                        case -ENODEV:
+                                DBF_EXCEPTION(2, "device gone, retry\n");
+                                break;
+                        case -EIO:
+                                DBF_EXCEPTION(2, "I/O error, retry\n");
+                                break;
+                        default:
+                                BUG();
                 }
-
-                if (rc == -ENODEV)
-                        DBF_EXCEPTION(2, "device gone, retry\n");
-                else if (rc == -EIO)
-                        DBF_EXCEPTION(2, "I/O error, retry\n");
-                else if (rc == -EBUSY)
-                        DBF_EXCEPTION(2, "device busy, retry late\n");
-                else
-                        BUG();
         }
 
         return rc;
@@ -473,6 +477,7 @@ tape_alloc_device(void)
         *device->modeset_byte = 0;
         device->first_minor = -1;
         atomic_set(&device->ref_count, 1);
+        INIT_WORK(&device->tape_dnr, tape_delayed_next_request, device);
 
         return device;
 }
@@ -708,54 +713,119 @@ tape_free_request (struct tape_request * request)
         kfree(request);
 }
 
+static inline int
+__tape_start_io(struct tape_device *device, struct tape_request *request)
+{
+        int rc;
+
+#ifdef CONFIG_S390_TAPE_BLOCK
+        if (request->op == TO_BLOCK)
+                device->discipline->check_locate(device, request);
+#endif
+        rc = ccw_device_start(
+                device->cdev,
+                request->cpaddr,
+                (unsigned long) request,
+                0x00,
+                request->options
+        );
+        if (rc == 0) {
+                request->status = TAPE_REQUEST_IN_IO;
+        } else if (rc == -EBUSY) {
+                /* The common I/O subsystem is currently busy. Retry later. */
+                request->status = TAPE_REQUEST_QUEUED;
+                schedule_work(&device->tape_dnr);
+                rc = 0;
+        } else {
+                /* Start failed. Remove request and indicate failure. */
+                DBF_EVENT(1, "tape: start request failed with RC = %i\n", rc);
+        }
+        return rc;
+}
+
 static inline void
-__tape_do_io_list(struct tape_device *device)
+__tape_start_next_request(struct tape_device *device)
 {
         struct list_head *l, *n;
         struct tape_request *request;
         int rc;
 
-        DBF_LH(6, "__tape_do_io_list(%p)\n", device);
+        DBF_LH(6, "__tape_start_next_request(%p)\n", device);
         /*
          * Try to start each request on request queue until one is
          * started successful.
          */
         list_for_each_safe(l, n, &device->req_queue) {
                 request = list_entry(l, struct tape_request, list);
-#ifdef CONFIG_S390_TAPE_BLOCK
-                if (request->op == TO_BLOCK)
-                        device->discipline->check_locate(device, request);
-#endif
-                rc = ccw_device_start(device->cdev, request->cpaddr,
-                                      (unsigned long) request, 0x00,
-                                      request->options);
-                if (rc == 0) {
-                        request->status = TAPE_REQUEST_IN_IO;
-                        break;
+
+                /*
+                 * Avoid race condition if bottom-half was triggered more than
+                 * once.
+                 */
+                if (request->status == TAPE_REQUEST_IN_IO)
+                        return;
+
+                /*
+                 * We wanted to cancel the request but the common I/O layer
+                 * was busy at that time. This can only happen if this
+                 * function is called by delayed_next_request.
+                 * Otherwise we start the next request on the queue.
+                 */
+                if (request->status == TAPE_REQUEST_CANCEL) {
+                        rc = __tape_cancel_io(device, request);
+                } else {
+                        rc = __tape_start_io(device, request);
                 }
-                /* Start failed. Remove request and indicate failure. */
-                DBF_EVENT(1, "tape: DOIO failed with er = %i\n", rc);
+                if (rc == 0)
+                        return;
 
-                /* Set ending status and do callback. */
+                /* Set ending status. */
                 request->rc = rc;
                 request->status = TAPE_REQUEST_DONE;
-                __tape_remove_request(device, request);
+
+                /* Remove from request queue. */
+                list_del(&request->list);
+
+                /* Do callback. */
+                if (request->callback != NULL)
+                        request->callback(request, request->callback_data);
         }
 }
 
 static void
-__tape_remove_request(struct tape_device *device, struct tape_request *request)
+tape_delayed_next_request(void *data)
 {
-        /* Remove from request queue. */
-        list_del(&request->list);
+        struct tape_device *    device;
 
-        /* Do callback. */
-        if (request->callback != NULL)
-                request->callback(request, request->callback_data);
+        device = (struct tape_device *) data;
+        DBF_LH(6, "tape_delayed_next_request(%p)\n", device);
+        spin_lock_irq(get_ccwdev_lock(device->cdev));
+        __tape_start_next_request(device);
+        spin_unlock_irq(get_ccwdev_lock(device->cdev));
+}
+
+static inline void
+__tape_end_request(
+        struct tape_device *    device,
+        struct tape_request *   request,
+        int                     rc)
+{
+        DBF_LH(6, "__tape_end_request(%p, %p, %i)\n", device, request, rc);
+        if (request) {
+                request->rc = rc;
+                request->status = TAPE_REQUEST_DONE;
+
+                /* Remove from request queue. */
+                list_del(&request->list);
+
+                /* Do callback. */
+                if (request->callback != NULL)
+                        request->callback(request, request->callback_data);
+        }
 
         /* Start next request. */
         if (!list_empty(&device->req_queue))
-                __tape_do_io_list(device);
+                __tape_start_next_request(device);
 }
 
 /*
@@ -812,7 +882,7 @@ tape_dump_sense_dbf(struct tape_device *device, struct tape_request *request,
  * the device lock held.
  */
 static inline int
-__tape_do_io(struct tape_device *device, struct tape_request *request)
+__tape_start_request(struct tape_device *device, struct tape_request *request)
 {
         int rc;
 
@@ -837,24 +907,16 @@ __tape_do_io(struct tape_device *device, struct tape_request *request)
 
         if (list_empty(&device->req_queue)) {
                 /* No other requests are on the queue. Start this one. */
-#ifdef CONFIG_S390_TAPE_BLOCK
-                if (request->op == TO_BLOCK)
-                        device->discipline->check_locate(device, request);
-#endif
-                rc = ccw_device_start(device->cdev, request->cpaddr,
-                                      (unsigned long) request, 0x00,
-                                      request->options);
-                if (rc) {
-                        DBF_EVENT(1, "tape: DOIO failed with rc = %i\n", rc);
+                rc = __tape_start_io(device, request);
+                if (rc)
                         return rc;
-                }
+
                 DBF_LH(5, "Request %p added for execution.\n", request);
                 list_add(&request->list, &device->req_queue);
-                request->status = TAPE_REQUEST_IN_IO;
         } else {
                 DBF_LH(5, "Request %p add to queue.\n", request);
-                list_add_tail(&request->list, &device->req_queue);
                 request->status = TAPE_REQUEST_QUEUED;
+                list_add_tail(&request->list, &device->req_queue);
         }
         return 0;
 }
@@ -872,7 +934,7 @@ tape_do_io_async(struct tape_device *device, struct tape_request *request)
 
         spin_lock_irq(get_ccwdev_lock(device->cdev));
         /* Add request to request queue and try to start it. */
-        rc = __tape_do_io(device, request);
+        rc = __tape_start_request(device, request);
         spin_unlock_irq(get_ccwdev_lock(device->cdev));
         return rc;
 }
@@ -901,7 +963,7 @@ tape_do_io(struct tape_device *device, struct tape_request *request)
         request->callback = __tape_wake_up;
         request->callback_data = &wq;
         /* Add request to request queue and try to start it. */
-        rc = __tape_do_io(device, request);
+        rc = __tape_start_request(device, request);
         spin_unlock_irq(get_ccwdev_lock(device->cdev));
         if (rc)
                 return rc;
@@ -935,7 +997,7 @@ tape_do_io_interruptible(struct tape_device *device,
         /* Setup callback */
         request->callback = __tape_wake_up_interruptible;
         request->callback_data = &wq;
-        rc = __tape_do_io(device, request);
+        rc = __tape_start_request(device, request);
         spin_unlock_irq(get_ccwdev_lock(device->cdev));
         if (rc)
                 return rc;
@@ -944,36 +1006,27 @@ tape_do_io_interruptible(struct tape_device *device,
         if (rc != -ERESTARTSYS)
                 /* Request finished normally. */
                 return request->rc;
+
         /* Interrupted by a signal. We have to stop the current request. */
         spin_lock_irq(get_ccwdev_lock(device->cdev));
-        rc = __tape_halt_io(device, request);
+        rc = __tape_cancel_io(device, request);
+        spin_unlock_irq(get_ccwdev_lock(device->cdev));
         if (rc == 0) {
+                /* Wait for the interrupt that acknowledges the halt. */
+                do {
+                        rc = wait_event_interruptible(
+                                wq,
+                                (request->callback == NULL)
+                        );
+                } while (rc != -ERESTARTSYS);
+
                 DBF_EVENT(3, "IO stopped on %08x\n", device->cdev_id);
                 rc = -ERESTARTSYS;
         }
-        spin_unlock_irq(get_ccwdev_lock(device->cdev));
         return rc;
 }
 
 /*
- * Handle requests that return an i/o error in the irb.
- */
-static inline void
-tape_handle_killed_request(
-        struct tape_device *device,
-        struct tape_request *request)
-{
-        if(request != NULL) {
-                /* Set ending status. FIXME: Should the request be retried? */
-                request->rc = -EIO;
-                request->status = TAPE_REQUEST_DONE;
-                __tape_remove_request(device, request);
-        } else {
-                __tape_do_io_list(device);
-        }
-}
-
-/*
  * Tape interrupt routine, called from the ccw_device layer
  */
 static void
@@ -981,7 +1034,6 @@ __tape_do_irq (struct ccw_device *cdev, unsigned long intparm, struct irb *irb)
 {
         struct tape_device *device;
         struct tape_request *request;
-        int final;
         int rc;
 
         device = (struct tape_device *) cdev->dev.driver_data;
@@ -996,12 +1048,13 @@ __tape_do_irq (struct ccw_device *cdev, unsigned long intparm, struct irb *irb)
 
         /* On special conditions irb is an error pointer */
         if (IS_ERR(irb)) {
+                /* FIXME: What to do with the request? */
                 switch (PTR_ERR(irb)) {
                         case -ETIMEDOUT:
                                 PRINT_WARN("(%s): Request timed out\n",
                                         cdev->dev.bus_id);
                         case -EIO:
-                                tape_handle_killed_request(device, request);
+                                __tape_end_request(device, request, -EIO);
                                 break;
                         default:
                                 PRINT_ERR("(%s): Unexpected i/o error %li\n",
@@ -1011,6 +1064,21 @@ __tape_do_irq (struct ccw_device *cdev, unsigned long intparm, struct irb *irb)
                 return;
         }
 
+        /*
+         * If the condition code is not zero and the start function bit is
+         * still set, this is an deferred error and the last start I/O did
+         * not succeed. Restart the request now.
+         */
+        if (irb->scsw.cc != 0 && (irb->scsw.fctl & SCSW_FCTL_START_FUNC)) {
+                PRINT_WARN("(%s): deferred cc=%i. restaring\n",
+                        cdev->dev.bus_id,
+                        irb->scsw.cc);
+                rc = __tape_start_io(device, request);
+                if (rc)
+                        __tape_end_request(device, request, rc);
+                return;
+        }
+
         /* May be an unsolicited irq */
         if(request != NULL)
                 request->rescnt = irb->scsw.count;
@@ -1042,7 +1110,7 @@ __tape_do_irq (struct ccw_device *cdev, unsigned long intparm, struct irb *irb)
          * To detect these request the state will be set to TAPE_REQUEST_DONE.
          */
         if(request != NULL && request->status == TAPE_REQUEST_DONE) {
-                __tape_remove_request(device, request);
+                __tape_end_request(device, request, -EIO);
                 return;
         }
 
@@ -1054,51 +1122,34 @@ __tape_do_irq (struct ccw_device *cdev, unsigned long intparm, struct irb *irb)
          * rc == TAPE_IO_RETRY: request finished but needs another go.
          * rc == TAPE_IO_STOP: request needs to get terminated.
          */
-        final = 0;
         switch (rc) {
-        case TAPE_IO_SUCCESS:
-                /* Upon normal completion the device _is_ online */
-                device->tape_generic_status |= GMT_ONLINE(~0);
-                final = 1;
-                break;
-        case TAPE_IO_PENDING:
-                break;
-        case TAPE_IO_RETRY:
-#ifdef CONFIG_S390_TAPE_BLOCK
-                if (request->op == TO_BLOCK)
-                        device->discipline->check_locate(device, request);
-#endif
-                rc = ccw_device_start(cdev, request->cpaddr,
-                                      (unsigned long) request, 0x00,
-                                      request->options);
-                if (rc) {
-                        DBF_EVENT(1, "tape: DOIO failed with er = %i\n", rc);
-                        final = 1;
-                }
-                break;
-        case TAPE_IO_STOP:
-                __tape_halt_io(device, request);
-                break;
-        default:
-                if (rc > 0) {
-                        DBF_EVENT(6, "xunknownrc\n");
-                        PRINT_ERR("Invalid return code from discipline "
-                                  "interrupt function.\n");
-                        rc = -EIO;
-                }
-                final = 1;
-                break;
-        }
-        if (final) {
-                /* May be an unsolicited irq */
-                if(request != NULL) {
-                        /* Set ending status. */
-                        request->rc = rc;
-                        request->status = TAPE_REQUEST_DONE;
-                        __tape_remove_request(device, request);
-                } else {
-                        __tape_do_io_list(device);
-                }
+                case TAPE_IO_SUCCESS:
+                        /* Upon normal completion the device _is_ online */
+                        device->tape_generic_status |= GMT_ONLINE(~0);
+                        __tape_end_request(device, request, rc);
+                        break;
+                case TAPE_IO_PENDING:
+                        break;
+                case TAPE_IO_RETRY:
+                        rc = __tape_start_io(device, request);
+                        if (rc)
+                                __tape_end_request(device, request, rc);
+                        break;
+                case TAPE_IO_STOP:
+                        rc = __tape_cancel_io(device, request);
+                        if (rc)
+                                __tape_end_request(device, request, rc);
+                        break;
+                default:
+                        if (rc > 0) {
+                                DBF_EVENT(6, "xunknownrc\n");
+                                PRINT_ERR("Invalid return code from discipline "
+                                        "interrupt function.\n");
+                                __tape_end_request(device, request, -EIO);
+                        } else {
+                                __tape_end_request(device, request, rc);
+                        }
+                        break;
         }
 }
 
@@ -1191,7 +1242,7 @@ tape_init (void)
 #ifdef DBF_LIKE_HELL
         debug_set_level(TAPE_DBF_AREA, 6);
 #endif
-        DBF_EVENT(3, "tape init: ($Revision: 1.51 $)\n");
+        DBF_EVENT(3, "tape init: ($Revision: 1.54 $)\n");
         tape_proc_init();
         tapechar_init ();
         tapeblock_init ();
@@ -1216,7 +1267,7 @@ tape_exit(void)
 MODULE_AUTHOR("(C) 2001 IBM Deutschland Entwicklung GmbH by Carsten Otte and "
               "Michael Holzheu (cotte@de.ibm.com,holzheu@de.ibm.com)");
 MODULE_DESCRIPTION("Linux on zSeries channel attached "
-                   "tape device driver ($Revision: 1.51 $)");
+                   "tape device driver ($Revision: 1.54 $)");
 MODULE_LICENSE("GPL");
 
 module_init(tape_init);
diff --git a/drivers/s390/char/vmcp.c b/drivers/s390/char/vmcp.c
index 7f11a608a633..8990d8076e7d 100644
--- a/drivers/s390/char/vmcp.c
+++ b/drivers/s390/char/vmcp.c
@@ -115,9 +115,9 @@ vmcp_write(struct file *file, const char __user * buff, size_t count,
                 return -ENOMEM;
         }
         debug_text_event(vmcp_debug, 1, cmd);
-        session->resp_size = cpcmd(cmd, session->response,
-                                   session->bufsize,
-                                   &session->resp_code);
+        session->resp_size = __cpcmd(cmd, session->response,
+                                     session->bufsize,
+                                     &session->resp_code);
         up(&session->mutex);
         kfree(cmd);
         *ppos = 0;              /* reset the file pointer after a command */
diff --git a/drivers/s390/char/vmwatchdog.c b/drivers/s390/char/vmwatchdog.c
index 22cf4fec8da9..5473c23fcb52 100644
--- a/drivers/s390/char/vmwatchdog.c
+++ b/drivers/s390/char/vmwatchdog.c
@@ -23,11 +23,7 @@
 static char vmwdt_cmd[MAX_CMDLEN] = "IPL";
 static int vmwdt_conceal;
 
-#ifdef CONFIG_WATCHDOG_NOWAYOUT
-static int vmwdt_nowayout = 1;
-#else
-static int vmwdt_nowayout = 0;
-#endif
+static int vmwdt_nowayout = WATCHDOG_NOWAYOUT;
 
 MODULE_LICENSE("GPL");
 MODULE_AUTHOR("Arnd Bergmann <arndb@de.ibm.com>");
diff --git a/drivers/s390/cio/chsc.c b/drivers/s390/cio/chsc.c
index b86f94ecd874..fa3c23b80e3a 100644
--- a/drivers/s390/cio/chsc.c
+++ b/drivers/s390/cio/chsc.c
@@ -1,7 +1,7 @@
 /*
  *  drivers/s390/cio/chsc.c
  *   S/390 common I/O routines -- channel subsystem call
- *   $Revision: 1.119 $
+ *   $Revision: 1.120 $
  *
  *    Copyright (C) 1999-2002 IBM Deutschland Entwicklung GmbH,
  *                            IBM Corporation
@@ -412,11 +412,7 @@ s390_process_res_acc (u8 chpid, __u16 fla, u32 fla_mask)
                 if (chp_mask == 0) {
 
                         spin_unlock_irq(&sch->lock);
-
-                        if (fla_mask != 0)
-                                break;
-                        else
-                                continue;
+                        continue;
                 }
                 old_lpm = sch->lpm;
                 sch->lpm = ((sch->schib.pmcw.pim &
@@ -430,7 +426,7 @@ s390_process_res_acc (u8 chpid, __u16 fla, u32 fla_mask)
 
                 spin_unlock_irq(&sch->lock);
                 put_device(&sch->dev);
-                if (fla_mask != 0)
+                if (fla_mask == 0xffff)
                         break;
         }
         return rc;
diff --git a/drivers/s390/cio/device_status.c b/drivers/s390/cio/device_status.c
index 4ab2e0d95009..12a24d4331a2 100644
--- a/drivers/s390/cio/device_status.c
+++ b/drivers/s390/cio/device_status.c
@@ -39,15 +39,14 @@ ccw_device_msg_control_check(struct ccw_device *cdev, struct irb *irb)
                       " ... device %04X on subchannel %04X, dev_stat "
                       ": %02X sch_stat : %02X\n",
                       cdev->private->devno, cdev->private->irq,
-                      cdev->private->irb.scsw.dstat,
-                      cdev->private->irb.scsw.cstat);
+                      irb->scsw.dstat, irb->scsw.cstat);
 
         if (irb->scsw.cc != 3) {
                 char dbf_text[15];
 
                 sprintf(dbf_text, "chk%x", cdev->private->irq);
                 CIO_TRACE_EVENT(0, dbf_text);
-                CIO_HEX_EVENT(0, &cdev->private->irb, sizeof (struct irb));
+                CIO_HEX_EVENT(0, irb, sizeof (struct irb));
         }
 }
 
diff --git a/drivers/s390/cio/qdio.c b/drivers/s390/cio/qdio.c
index 82194c4eadfb..d36258d6665f 100644
--- a/drivers/s390/cio/qdio.c
+++ b/drivers/s390/cio/qdio.c
@@ -432,7 +432,7 @@ tiqdio_clear_global_summary(void)
 
 /************************* OUTBOUND ROUTINES *******************************/
 
-inline static int
+static inline int
 qdio_get_outbound_buffer_frontier(struct qdio_q *q)
 {
         int f,f_mod_no;
@@ -510,7 +510,7 @@ out:
 }
 
 /* all buffers are processed */
-inline static int
+static inline int
 qdio_is_outbound_q_done(struct qdio_q *q)
 {
         int no_used;
@@ -532,7 +532,7 @@ qdio_is_outbound_q_done(struct qdio_q *q)
         return (no_used==0);
 }
 
-inline static int
+static inline int
 qdio_has_outbound_q_moved(struct qdio_q *q)
 {
         int i;
@@ -552,7 +552,7 @@ qdio_has_outbound_q_moved(struct qdio_q *q)
         }
 }
 
-inline static void
+static inline void
 qdio_kick_outbound_q(struct qdio_q *q)
 {
         int result;
@@ -641,7 +641,7 @@ qdio_kick_outbound_q(struct qdio_q *q)
                 }
 }
 
-inline static void
+static inline void
 qdio_kick_outbound_handler(struct qdio_q *q)
 {
         int start, end, real_end, count;
@@ -740,7 +740,7 @@ qdio_outbound_processing(struct qdio_q *q)
 /************************* INBOUND ROUTINES *******************************/
 
 
-inline static int
+static inline int
 qdio_get_inbound_buffer_frontier(struct qdio_q *q)
 {
         int f,f_mod_no;
@@ -865,7 +865,7 @@ out:
         return q->first_to_check;
 }
 
-inline static int
+static inline int
 qdio_has_inbound_q_moved(struct qdio_q *q)
 {
         int i;
@@ -898,7 +898,7 @@ qdio_has_inbound_q_moved(struct qdio_q *q)
 }
 
 /* means, no more buffers to be filled */
-inline static int
+static inline int
 tiqdio_is_inbound_q_done(struct qdio_q *q)
 {
         int no_used;
@@ -951,7 +951,7 @@ tiqdio_is_inbound_q_done(struct qdio_q *q)
         return 0;
 }
 
-inline static int
+static inline int
 qdio_is_inbound_q_done(struct qdio_q *q)
 {
         int no_used;
@@ -1010,7 +1010,7 @@ qdio_is_inbound_q_done(struct qdio_q *q)
         }
 }
 
-inline static void
+static inline void
 qdio_kick_inbound_handler(struct qdio_q *q)
 {
         int count, start, end, real_end, i;
diff --git a/drivers/s390/net/qeth.h b/drivers/s390/net/qeth.h
index 008e0a5d2eb3..3a0285669adf 100644
--- a/drivers/s390/net/qeth.h
+++ b/drivers/s390/net/qeth.h
@@ -824,7 +824,7 @@ extern struct list_head qeth_notify_list;
 
 #define QETH_CARD_IFNAME(card) (((card)->dev)? (card)->dev->name : "")
 
-inline static __u8
+static inline __u8
 qeth_get_ipa_adp_type(enum qeth_link_types link_type)
 {
         switch (link_type) {
@@ -835,7 +835,7 @@ qeth_get_ipa_adp_type(enum qeth_link_types link_type)
         }
 }
 
-inline static int
+static inline int
 qeth_realloc_headroom(struct qeth_card *card, struct sk_buff **skb, int size)
 {
         struct sk_buff *new_skb = NULL;
@@ -852,6 +852,7 @@ qeth_realloc_headroom(struct qeth_card *card, struct sk_buff **skb, int size)
         }
         return 0;
 }
+
 static inline struct sk_buff *
 qeth_pskb_unshare(struct sk_buff *skb, int pri)
 {
@@ -863,8 +864,7 @@ qeth_pskb_unshare(struct sk_buff *skb, int pri)
         return nskb;
 }
 
-
-inline static void *
+static inline void *
 qeth_push_skb(struct qeth_card *card, struct sk_buff **skb, int size)
 {
         void *hdr;
@@ -887,7 +887,7 @@ qeth_push_skb(struct qeth_card *card, struct sk_buff **skb, int size)
 }
 
 
-inline static int
+static inline int
 qeth_get_hlen(__u8 link_type)
 {
 #ifdef CONFIG_QETH_IPV6
@@ -911,7 +911,7 @@ qeth_get_hlen(__u8 link_type)
 #endif /* CONFIG_QETH_IPV6 */
 }
 
-inline static unsigned short
+static inline unsigned short
 qeth_get_netdev_flags(struct qeth_card *card)
 {
         if (card->options.layer2)
@@ -929,7 +929,7 @@ qeth_get_netdev_flags(struct qeth_card *card)
         }
 }
 
-inline static int
+static inline int
 qeth_get_initial_mtu_for_card(struct qeth_card * card)
 {
         switch (card->info.type) {
@@ -950,7 +950,7 @@ qeth_get_initial_mtu_for_card(struct qeth_card * card)
         }
 }
 
-inline static int
+static inline int
 qeth_get_max_mtu_for_card(int cardtype)
 {
         switch (cardtype) {
@@ -965,7 +965,7 @@ qeth_get_max_mtu_for_card(int cardtype)
         }
 }
 
-inline static int
+static inline int
 qeth_get_mtu_out_of_mpc(int cardtype)
 {
         switch (cardtype) {
@@ -976,7 +976,7 @@ qeth_get_mtu_out_of_mpc(int cardtype)
         }
 }
 
-inline static int
+static inline int
 qeth_get_mtu_outof_framesize(int framesize)
 {
         switch (framesize) {
@@ -993,7 +993,7 @@ qeth_get_mtu_outof_framesize(int framesize)
         }
 }
 
-inline static int
+static inline int
 qeth_mtu_is_valid(struct qeth_card * card, int mtu)
 {
         switch (card->info.type) {
@@ -1008,7 +1008,7 @@ qeth_mtu_is_valid(struct qeth_card * card, int mtu)
         }
 }
 
-inline static int
+static inline int
 qeth_get_arphdr_type(int cardtype, int linktype)
 {
         switch (cardtype) {
@@ -1027,7 +1027,7 @@ qeth_get_arphdr_type(int cardtype, int linktype)
 }
 
 #ifdef CONFIG_QETH_PERF_STATS
-inline static int
+static inline int
 qeth_get_micros(void)
 {
         return (int) (get_clock() >> 12);
diff --git a/drivers/scsi/NCR53c406a.c b/drivers/scsi/NCR53c406a.c
index b2002ba6e2aa..79ae73b23680 100644
--- a/drivers/scsi/NCR53c406a.c
+++ b/drivers/scsi/NCR53c406a.c
@@ -182,13 +182,13 @@ static int irq_probe(void);
 static void *bios_base;
 #endif
 
-#if PORT_BASE
+#ifdef PORT_BASE
 static int port_base = PORT_BASE;
 #else
 static int port_base;
 #endif
 
-#if IRQ_LEV
+#ifdef IRQ_LEV
 static int irq_level = IRQ_LEV;
 #else
 static int irq_level = -1;      /* 0 is 'no irq', so use -1 for 'uninitialized' */
diff --git a/drivers/scsi/aic7xxx/aic79xx_osm.c b/drivers/scsi/aic7xxx/aic79xx_osm.c
index 6466a184a141..329cb2331339 100644
--- a/drivers/scsi/aic7xxx/aic79xx_osm.c
+++ b/drivers/scsi/aic7xxx/aic79xx_osm.c
@@ -1505,7 +1505,7 @@ ahd_linux_dev_reset(Scsi_Cmnd *cmd)
         memset(recovery_cmd, 0, sizeof(struct scsi_cmnd));
         recovery_cmd->device = cmd->device;
         recovery_cmd->scsi_done = ahd_linux_dev_reset_complete;
-#if AHD_DEBUG
+#ifdef AHD_DEBUG
         if ((ahd_debug & AHD_SHOW_RECOVERY) != 0)
                 printf("%s:%d:%d:%d: Device reset called for cmd %p\n",
                        ahd_name(ahd), cmd->device->channel, cmd->device->id,
diff --git a/drivers/scsi/aic7xxx/aic79xx_pci.c b/drivers/scsi/aic7xxx/aic79xx_pci.c
index 4c3bb7bb8420..703f6e44889d 100644
--- a/drivers/scsi/aic7xxx/aic79xx_pci.c
+++ b/drivers/scsi/aic7xxx/aic79xx_pci.c
@@ -582,7 +582,7 @@ ahd_check_extport(struct ahd_softc *ahd)
                 }
         }
 
-#if AHD_DEBUG
+#ifdef AHD_DEBUG
         if (have_seeprom != 0
          && (ahd_debug & AHD_DUMP_SEEPROM) != 0) {
                 uint16_t *sc_data;
diff --git a/drivers/scsi/dc395x.c b/drivers/scsi/dc395x.c
index ae13c002f60d..929170dcd3cb 100644
--- a/drivers/scsi/dc395x.c
+++ b/drivers/scsi/dc395x.c
@@ -744,7 +744,7 @@ static void free_tag(struct DeviceCtlBlk *dcb, struct ScsiReqBlk *srb)
 
 
 /* Find cmd in SRB list */
-inline static struct ScsiReqBlk *find_cmd(struct scsi_cmnd *cmd, 
+static inline struct ScsiReqBlk *find_cmd(struct scsi_cmnd *cmd,
                 struct list_head *head)
 {
         struct ScsiReqBlk *i;
diff --git a/drivers/scsi/dpt/dptsig.h b/drivers/scsi/dpt/dptsig.h
index 95a4cce6c892..4bf447792129 100644
--- a/drivers/scsi/dpt/dptsig.h
+++ b/drivers/scsi/dpt/dptsig.h
@@ -76,7 +76,7 @@ typedef unsigned long sigLONG;
 #endif  /* aix */
 #endif
 /* For the Macintosh */
-#if STRUCTALIGNMENTSUPPORTED
+#ifdef STRUCTALIGNMENTSUPPORTED
 #pragma options align=mac68k
 #endif
 
@@ -332,7 +332,7 @@ typedef struct dpt_sig {
 #endif  /* aix */
 #endif
 /* For the Macintosh */
-#if STRUCTALIGNMENTSUPPORTED
+#ifdef STRUCTALIGNMENTSUPPORTED
 #pragma options align=reset
 #endif
 
diff --git a/drivers/scsi/dtc.c b/drivers/scsi/dtc.c
index ab9de39bb50b..897743b23342 100644
--- a/drivers/scsi/dtc.c
+++ b/drivers/scsi/dtc.c
@@ -92,10 +92,6 @@
 
 #define DTC_PUBLIC_RELEASE 2
 
-/*#define DTCDEBUG 0x1*/
-#define DTCDEBUG_INIT   0x1
-#define DTCDEBUG_TRANSFER 0x2
-
 /*
  * The DTC3180 & 3280 boards are memory mapped.
  * 
diff --git a/drivers/scsi/dtc.h b/drivers/scsi/dtc.h
index ed73629eb2f9..277cd015ee4e 100644
--- a/drivers/scsi/dtc.h
+++ b/drivers/scsi/dtc.h
@@ -28,6 +28,10 @@
 #ifndef DTC3280_H
 #define DTC3280_H
 
+#define DTCDEBUG 0
+#define DTCDEBUG_INIT   0x1
+#define DTCDEBUG_TRANSFER 0x2
+
 static int dtc_abort(Scsi_Cmnd *);
 static int dtc_biosparam(struct scsi_device *, struct block_device *,
                          sector_t, int*);
diff --git a/drivers/scsi/fdomain.c b/drivers/scsi/fdomain.c
index aecf32dd0bde..3b2a5bf5c43e 100644
--- a/drivers/scsi/fdomain.c
+++ b/drivers/scsi/fdomain.c
@@ -570,7 +570,7 @@ static void do_pause(unsigned amount)	/* Pause for amount*10 milliseconds */
         mdelay(10*amount);
 }
 
-inline static void fdomain_make_bus_idle( void )
+static inline void fdomain_make_bus_idle( void )
 {
    outb(0, port_base + SCSI_Cntl);
    outb(0, port_base + SCSI_Mode_Cntl);
diff --git a/drivers/scsi/initio.c b/drivers/scsi/initio.c
index 2094d4811d61..ea6f3c0e05d9 100644
--- a/drivers/scsi/initio.c
+++ b/drivers/scsi/initio.c
@@ -716,7 +716,7 @@ static int init_tulip(HCS * pCurHcb, SCB * scbp, int tul_num_scb,
         pCurHcb->HCS_SCSI_ID = i91unvramp->NVM_SCSIInfo[0].NVM_ChSCSIID;
         pCurHcb->HCS_IdMask = ~(1 << pCurHcb->HCS_SCSI_ID);
 
-#if CHK_PARITY
+#ifdef CHK_PARITY
         /* Enable parity error response */
         TUL_WR(pCurHcb->HCS_Base + TUL_PCMD, TUL_RD(pCurHcb->HCS_Base, TUL_PCMD) | 0x40);
 #endif
diff --git a/drivers/scsi/lpfc/lpfc_compat.h b/drivers/scsi/lpfc/lpfc_compat.h
index 275ba34b3c9d..a11f1ae7b98e 100644
--- a/drivers/scsi/lpfc/lpfc_compat.h
+++ b/drivers/scsi/lpfc/lpfc_compat.h
@@ -30,8 +30,9 @@ memcpy_toio() and memcpy_fromio() can be used.
 However on a big-endian host, copy 4 bytes at a time,
 using writel() and readl().
  *******************************************************************/
+#include <asm/byteorder.h>
 
-#if __BIG_ENDIAN
+#ifdef __BIG_ENDIAN
 
 static inline void
 lpfc_memcpy_to_slim(void __iomem *dest, void *src, unsigned int bytes)
diff --git a/drivers/scsi/lpfc/lpfc_scsi.h b/drivers/scsi/lpfc/lpfc_scsi.h
index d8fd2010ef41..0fd9ba14e1b5 100644
--- a/drivers/scsi/lpfc/lpfc_scsi.h
+++ b/drivers/scsi/lpfc/lpfc_scsi.h
@@ -18,6 +18,8 @@
  * included with this package.                                     *
  *******************************************************************/
 
+#include <asm/byteorder.h>
+
 struct lpfc_hba;
 
 #define list_remove_head(list, entry, type, member)             \
@@ -81,7 +83,7 @@ struct fcp_cmnd {
         /* # of bits to shift lun id to end up in right
          * payload word, little endian = 8, big = 16.
          */
-#if __BIG_ENDIAN
+#ifdef __BIG_ENDIAN
 #define FC_LUN_SHIFT         16
 #define FC_ADDR_MODE_SHIFT   24
 #else   /*  __LITTLE_ENDIAN */
diff --git a/drivers/scsi/pas16.c b/drivers/scsi/pas16.c
index 363e0ebd4a39..72bc947e45b6 100644
--- a/drivers/scsi/pas16.c
+++ b/drivers/scsi/pas16.c
@@ -2,6 +2,7 @@
 #define PSEUDO_DMA
 #define FOO
 #define UNSAFE  /* Not unsafe for PAS16 -- use it */
+#define PDEBUG 0
 
 /*
  * This driver adapted from Drew Eckhardt's Trantor T128 driver
diff --git a/drivers/scsi/scsi_scan.c b/drivers/scsi/scsi_scan.c
index ad3a5b142468..2d3c4ac475f2 100644
--- a/drivers/scsi/scsi_scan.c
+++ b/drivers/scsi/scsi_scan.c
@@ -756,7 +756,8 @@ static int scsi_add_lun(struct scsi_device *sdev, char *inq_result, int *bflags)
          * register it and tell the rest of the kernel
          * about it.
          */
-        scsi_sysfs_add_sdev(sdev);
+        if (scsi_sysfs_add_sdev(sdev) != 0)
+                return SCSI_SCAN_NO_RESPONSE;
 
         return SCSI_SCAN_LUN_PRESENT;
 }
diff --git a/drivers/scsi/sym53c8xx_2/sym_hipd.h b/drivers/scsi/sym53c8xx_2/sym_hipd.h
index c55c7a57afa0..3131a6bf7ab7 100644
--- a/drivers/scsi/sym53c8xx_2/sym_hipd.h
+++ b/drivers/scsi/sym53c8xx_2/sym_hipd.h
@@ -151,6 +151,16 @@
  */
 #define SYM_CONF_MIN_ASYNC (40)
 
+
+/*
+ * MEMORY ALLOCATOR.
+ */
+
+#define SYM_MEM_WARN    1       /* Warn on failed operations */
+
+#define SYM_MEM_PAGE_ORDER 0    /* 1 PAGE  maximum */
+#define SYM_MEM_CLUSTER_SHIFT   (PAGE_SHIFT+SYM_MEM_PAGE_ORDER)
+#define SYM_MEM_FREE_UNUSED     /* Free unused pages immediately */
 /*
  *  Shortest memory chunk is (1<<SYM_MEM_SHIFT), currently 16.
  *  Actual allocations happen as SYM_MEM_CLUSTER_SIZE sized.
@@ -1192,12 +1202,6 @@ static inline void sym_setup_data_pointers(struct sym_hcb *np,
  *  MEMORY ALLOCATOR.
  */
 
-#define SYM_MEM_PAGE_ORDER 0    /* 1 PAGE  maximum */
-#define SYM_MEM_CLUSTER_SHIFT   (PAGE_SHIFT+SYM_MEM_PAGE_ORDER)
-#define SYM_MEM_FREE_UNUSED     /* Free unused pages immediately */
-
-#define SYM_MEM_WARN    1       /* Warn on failed operations */
-
 #define sym_get_mem_cluster()   \
         (void *) __get_free_pages(GFP_ATOMIC, SYM_MEM_PAGE_ORDER)
 #define sym_free_mem_cluster(p) \
diff --git a/drivers/scsi/sym53c8xx_2/sym_nvram.c b/drivers/scsi/sym53c8xx_2/sym_nvram.c
index cd9140e158cf..994b7566bcac 100644
--- a/drivers/scsi/sym53c8xx_2/sym_nvram.c
+++ b/drivers/scsi/sym53c8xx_2/sym_nvram.c
@@ -367,7 +367,7 @@ static void S24C16_read_byte(struct sym_device *np, u_char *read_data, u_char ac
         S24C16_write_ack(np, ack_data, gpreg, gpcntl);
 }
 
-#if SYM_CONF_NVRAM_WRITE_SUPPORT
+#ifdef SYM_CONF_NVRAM_WRITE_SUPPORT
 /*
  *  Write 'len' bytes starting at 'offset'.
  */
diff --git a/drivers/scsi/t128.h b/drivers/scsi/t128.h
index 9ad1d68827a7..596f3a32a1c6 100644
--- a/drivers/scsi/t128.h
+++ b/drivers/scsi/t128.h
@@ -43,6 +43,7 @@
 
 #define T128_PUBLIC_RELEASE 3
 
+#define TDEBUG          0
 #define TDEBUG_INIT     0x1
 #define TDEBUG_TRANSFER 0x2
 
diff --git a/drivers/serial/8250_pci.c b/drivers/serial/8250_pci.c
index 356f5556759a..07f05e9d0955 100644
--- a/drivers/serial/8250_pci.c
+++ b/drivers/serial/8250_pci.c
@@ -1029,6 +1029,8 @@ enum pci_board_num_t {
         pbn_b0_2_921600,
         pbn_b0_4_921600,
 
+        pbn_b0_2_1130000,
+
         pbn_b0_4_1152000,
 
         pbn_b0_bt_1_115200,
@@ -1163,6 +1165,14 @@ static struct pci_board pci_boards[] __devinitdata = {
                 .base_baud      = 921600,
                 .uart_offset    = 8,
         },
+
+        [pbn_b0_2_1130000] = {
+                .flags          = FL_BASE0,
+                .num_ports      = 2,
+                .base_baud      = 1130000,
+                .uart_offset    = 8,
+        },
+
         [pbn_b0_4_1152000] = {
                 .flags          = FL_BASE0,
                 .num_ports      = 4,
@@ -1988,6 +1998,16 @@ static struct pci_device_id serial_pci_tbl[] = {
         {       PCI_VENDOR_ID_OXSEMI, PCI_DEVICE_ID_OXSEMI_16PCI954,
                 PCI_SUBVENDOR_ID_SIIG, PCI_SUBDEVICE_ID_SIIG_QUARTET_SERIAL, 0, 0,
                 pbn_b0_4_1152000 },
+
+                /*
+                 * The below card is a little controversial since it is the
+                 * subject of a PCI vendor/device ID clash.  (See
+                 * www.ussg.iu.edu/hypermail/linux/kernel/0303.1/0516.html).
+                 * For now just used the hex ID 0x950a.
+                 */
+        {       PCI_VENDOR_ID_OXSEMI, 0x950a,
+                PCI_ANY_ID, PCI_ANY_ID, 0, 0,
+                pbn_b0_2_1130000 },
         {       PCI_VENDOR_ID_OXSEMI, PCI_DEVICE_ID_OXSEMI_16PCI954,
                 PCI_ANY_ID, PCI_ANY_ID, 0, 0,
                 pbn_b0_4_115200 },
diff --git a/drivers/serial/cpm_uart/cpm_uart_cpm1.c b/drivers/serial/cpm_uart/cpm_uart_cpm1.c
index 7911912f50c7..8efbd6d1d6a4 100644
--- a/drivers/serial/cpm_uart/cpm_uart_cpm1.c
+++ b/drivers/serial/cpm_uart/cpm_uart_cpm1.c
@@ -185,7 +185,7 @@ int cpm_uart_allocbuf(struct uart_cpm_port *pinfo, unsigned int is_con)
         memsz = L1_CACHE_ALIGN(pinfo->rx_nrfifos * pinfo->rx_fifosize) +
             L1_CACHE_ALIGN(pinfo->tx_nrfifos * pinfo->tx_fifosize);
         if (is_con) {
-                mem_addr = (u8 *) m8xx_cpm_hostalloc(memsz);
+                mem_addr = (u8 *) cpm_dpram_addr(cpm_dpalloc(memsz, 8));
                 dma_addr = 0;
         } else
                 mem_addr = dma_alloc_coherent(NULL, memsz, &dma_addr,
diff --git a/drivers/serial/jsm/jsm.h b/drivers/serial/jsm/jsm.h
index 5bf3c45521f4..18753193f59b 100644
--- a/drivers/serial/jsm/jsm.h
+++ b/drivers/serial/jsm/jsm.h
@@ -89,7 +89,7 @@ enum {
 #define WRITEBUFLEN     ((4096) + 4)
 #define MYFLIPLEN       N_TTY_BUF_SIZE
 
-#define JSM_VERSION     "jsm: 1.1-1-INKERNEL"
+#define JSM_VERSION     "jsm: 1.2-1-INKERNEL"
 #define JSM_PARTNUM     "40002438_A-INKERNEL"
 
 struct jsm_board;
diff --git a/drivers/serial/jsm/jsm_driver.c b/drivers/serial/jsm/jsm_driver.c
index cc5d21300ed3..7e56c7824194 100644
--- a/drivers/serial/jsm/jsm_driver.c
+++ b/drivers/serial/jsm/jsm_driver.c
@@ -22,6 +22,7 @@
  * Scott H Kilau <Scott_Kilau@digi.com>
  * Wendy Xiong   <wendyx@us.ltcfwd.linux.ibm.com>
  *
+ *
  ***********************************************************************/
 #include <linux/moduleparam.h>
 #include <linux/pci.h>
@@ -42,7 +43,7 @@ struct uart_driver jsm_uart_driver = {
         .owner          = THIS_MODULE,
         .driver_name    = JSM_DRIVER_NAME,
         .dev_name       = "ttyn",
-        .major          = 253,
+        .major          = 0,
         .minor          = JSM_MINOR_START,
         .nr             = NR_PORTS,
 };
diff --git a/drivers/serial/jsm/jsm_neo.c b/drivers/serial/jsm/jsm_neo.c
index 3a11a69feb44..6f22b42d9337 100644
--- a/drivers/serial/jsm/jsm_neo.c
+++ b/drivers/serial/jsm/jsm_neo.c
@@ -48,8 +48,9 @@ static inline void neo_pci_posting_flush(struct jsm_board *bd)
 
 static void neo_set_cts_flow_control(struct jsm_channel *ch)
 {
-        u8 ier = readb(&ch->ch_neo_uart->ier);
-        u8 efr = readb(&ch->ch_neo_uart->efr);
+        u8 ier, efr;
+        ier = readb(&ch->ch_neo_uart->ier);
+        efr = readb(&ch->ch_neo_uart->efr);
 
         jsm_printk(PARAM, INFO, &ch->ch_bd->pci_dev, "Setting CTSFLOW\n");
 
@@ -78,8 +79,9 @@ static void neo_set_cts_flow_control(struct jsm_channel *ch)
 
 static void neo_set_rts_flow_control(struct jsm_channel *ch)
 {
-        u8 ier = readb(&ch->ch_neo_uart->ier);
-        u8 efr = readb(&ch->ch_neo_uart->efr);
+        u8 ier, efr;
+        ier = readb(&ch->ch_neo_uart->ier);
+        efr = readb(&ch->ch_neo_uart->efr);
 
         jsm_printk(PARAM, INFO, &ch->ch_bd->pci_dev, "Setting RTSFLOW\n");
 
@@ -117,8 +119,9 @@ static void neo_set_rts_flow_control(struct jsm_channel *ch)
 
 static void neo_set_ixon_flow_control(struct jsm_channel *ch)
 {
-        u8 ier = readb(&ch->ch_neo_uart->ier);
-        u8 efr = readb(&ch->ch_neo_uart->efr);
+        u8 ier, efr;
+        ier = readb(&ch->ch_neo_uart->ier);
+        efr = readb(&ch->ch_neo_uart->efr);
 
         jsm_printk(PARAM, INFO, &ch->ch_bd->pci_dev, "Setting IXON FLOW\n");
 
@@ -153,8 +156,9 @@ static void neo_set_ixon_flow_control(struct jsm_channel *ch)
 
 static void neo_set_ixoff_flow_control(struct jsm_channel *ch)
 {
-        u8 ier = readb(&ch->ch_neo_uart->ier);
-        u8 efr = readb(&ch->ch_neo_uart->efr);
+        u8 ier, efr;
+        ier = readb(&ch->ch_neo_uart->ier);
+        efr = readb(&ch->ch_neo_uart->efr);
 
         jsm_printk(PARAM, INFO, &ch->ch_bd->pci_dev, "Setting IXOFF FLOW\n");
 
@@ -190,8 +194,9 @@ static void neo_set_ixoff_flow_control(struct jsm_channel *ch)
 
 static void neo_set_no_input_flow_control(struct jsm_channel *ch)
 {
-        u8 ier = readb(&ch->ch_neo_uart->ier);
-        u8 efr = readb(&ch->ch_neo_uart->efr);
+        u8 ier, efr;
+        ier = readb(&ch->ch_neo_uart->ier);
+        efr = readb(&ch->ch_neo_uart->efr);
 
         jsm_printk(PARAM, INFO, &ch->ch_bd->pci_dev, "Unsetting Input FLOW\n");
 
@@ -228,8 +233,9 @@ static void neo_set_no_input_flow_control(struct jsm_channel *ch)
 
 static void neo_set_no_output_flow_control(struct jsm_channel *ch)
 {
-        u8 ier = readb(&ch->ch_neo_uart->ier);
-        u8 efr = readb(&ch->ch_neo_uart->efr);
+        u8 ier, efr;
+        ier = readb(&ch->ch_neo_uart->ier);
+        efr = readb(&ch->ch_neo_uart->efr);
 
         jsm_printk(PARAM, INFO, &ch->ch_bd->pci_dev, "Unsetting Output FLOW\n");
 
diff --git a/drivers/usb/image/microtek.c b/drivers/usb/image/microtek.c
index 7d21a4f5c425..c84e1486054f 100644
--- a/drivers/usb/image/microtek.c
+++ b/drivers/usb/image/microtek.c
@@ -361,8 +361,7 @@ int mts_scsi_queuecommand (Scsi_Cmnd *srb, mts_scsi_cmnd_callback callback );
 static void mts_transfer_cleanup( struct urb *transfer );
 static void mts_do_sg(struct urb * transfer, struct pt_regs *regs);
 
-
-inline static
+static inline
 void mts_int_submit_urb (struct urb* transfer,
                         int pipe,
                         void* data,
diff --git a/drivers/video/Kconfig b/drivers/video/Kconfig
index 04d3120f7236..cde0ed097af6 100644
--- a/drivers/video/Kconfig
+++ b/drivers/video/Kconfig
@@ -1399,8 +1399,8 @@ config FB_TX3912
           Say Y here to enable kernel support for the on-board framebuffer.
 
 config FB_G364
-        bool
-        depends on MIPS_MAGNUM_4000 || OLIVETTI_M700
+        bool "G364 frame buffer support"
+        depends on (FB = y) && (MIPS_MAGNUM_4000 || OLIVETTI_M700)
         select FB_CFB_FILLRECT
         select FB_CFB_COPYAREA
         select FB_CFB_IMAGEBLIT
diff --git a/drivers/video/aty/radeon_base.c b/drivers/video/aty/radeon_base.c
index 47a6b12bc968..e7e8b52014c3 100644
--- a/drivers/video/aty/radeon_base.c
+++ b/drivers/video/aty/radeon_base.c
@@ -2521,6 +2521,11 @@ static void __devexit radeonfb_pci_unregister (struct pci_dev *pdev)
  
         radeonfb_pm_exit(rinfo);
 
+        if (rinfo->mon1_EDID)
+                sysfs_remove_bin_file(&rinfo->pdev->dev.kobj, &edid1_attr);
+        if (rinfo->mon2_EDID)
+                sysfs_remove_bin_file(&rinfo->pdev->dev.kobj, &edid2_attr);
+
 #if 0
         /* restore original state
          * 
diff --git a/drivers/video/console/fbcon.c b/drivers/video/console/fbcon.c
index 9dd0fbccf994..35c88bd7ba5e 100644
--- a/drivers/video/console/fbcon.c
+++ b/drivers/video/console/fbcon.c
@@ -275,7 +275,8 @@ static void fb_flashcursor(void *private)
 
         if (!vc || !CON_IS_VISIBLE(vc) ||
             fbcon_is_inactive(vc, info) ||
-            registered_fb[con2fb_map[vc->vc_num]] != info)
+            registered_fb[con2fb_map[vc->vc_num]] != info ||
+            vc_cons[ops->currcon].d->vc_deccm != 1)
                 return;
         acquire_console_sem();
         p = &fb_display[vc->vc_num];
diff --git a/drivers/video/fbcmap.c b/drivers/video/fbcmap.c
index 4e5ce8f7d65e..c32a2a50bfa2 100644
--- a/drivers/video/fbcmap.c
+++ b/drivers/video/fbcmap.c
@@ -212,7 +212,7 @@ int fb_cmap_to_user(struct fb_cmap *from, struct fb_cmap_user *to)
 
 int fb_set_cmap(struct fb_cmap *cmap, struct fb_info *info)
 {
-        int i, start;
+        int i, start, rc = 0;
         u16 *red, *green, *blue, *transp;
         u_int hred, hgreen, hblue, htransp = 0xffff;
 
@@ -225,75 +225,51 @@ int fb_set_cmap(struct fb_cmap *cmap, struct fb_info *info)
         if (start < 0 || (!info->fbops->fb_setcolreg &&
                           !info->fbops->fb_setcmap))
                 return -EINVAL;
-        if (info->fbops->fb_setcmap)
-                return info->fbops->fb_setcmap(cmap, info);
-        for (i = 0; i < cmap->len; i++) {
-                hred = *red++;
-                hgreen = *green++;
-                hblue = *blue++;
-                if (transp)
-                        htransp = *transp++;
-                if (info->fbops->fb_setcolreg(start++,
-                                              hred, hgreen, hblue, htransp,
-                                              info))
-                        break;
+        if (info->fbops->fb_setcmap) {
+                rc = info->fbops->fb_setcmap(cmap, info);
+        } else {
+                for (i = 0; i < cmap->len; i++) {
+                        hred = *red++;
+                        hgreen = *green++;
+                        hblue = *blue++;
+                        if (transp)
+                                htransp = *transp++;
+                        if (info->fbops->fb_setcolreg(start++,
+                                                      hred, hgreen, hblue,
+                                                      htransp, info))
+                                break;
+                }
         }
-        return 0;
+        if (rc == 0)
+                fb_copy_cmap(cmap, &info->cmap);
+
+        return rc;
 }
 
 int fb_set_user_cmap(struct fb_cmap_user *cmap, struct fb_info *info)
 {
-        int i, start;
-        u16 __user *red, *green, *blue, *transp;
-        u_int hred, hgreen, hblue, htransp = 0xffff;
-
-        red = cmap->red;
-        green = cmap->green;
-        blue = cmap->blue;
-        transp = cmap->transp;
-        start = cmap->start;
+        int rc, size = cmap->len * sizeof(u16);
+        struct fb_cmap umap;
 
-        if (start < 0 || (!info->fbops->fb_setcolreg &&
-                          !info->fbops->fb_setcmap))
+        if (cmap->start < 0 || (!info->fbops->fb_setcolreg &&
+                                !info->fbops->fb_setcmap))
                 return -EINVAL;
 
-        /* If we can batch, do it */
-        if (info->fbops->fb_setcmap && cmap->len > 1) {
-                struct fb_cmap umap;
-                int size = cmap->len * sizeof(u16);
-                int rc;
-
-                memset(&umap, 0, sizeof(struct fb_cmap));
-                rc = fb_alloc_cmap(&umap, cmap->len, transp != NULL);
-                if (rc)
-                        return rc;
-                if (copy_from_user(umap.red, red, size) ||
-                    copy_from_user(umap.green, green, size) ||
-                    copy_from_user(umap.blue, blue, size) ||
-                    (transp && copy_from_user(umap.transp, transp, size))) {
-                        rc = -EFAULT;
-                }
-                umap.start = start;
-                if (rc == 0)
-                        rc = info->fbops->fb_setcmap(&umap, info);
-                fb_dealloc_cmap(&umap);
+        memset(&umap, 0, sizeof(struct fb_cmap));
+        rc = fb_alloc_cmap(&umap, cmap->len, cmap->transp != NULL);
+        if (rc)
                 return rc;
+        if (copy_from_user(umap.red, cmap->red, size) ||
+            copy_from_user(umap.green, cmap->green, size) ||
+            copy_from_user(umap.blue, cmap->blue, size) ||
+            (cmap->transp && copy_from_user(umap.transp, cmap->transp, size))) {
+                fb_dealloc_cmap(&umap);
+                return -EFAULT;
         }
-
-        for (i = 0; i < cmap->len; i++, red++, blue++, green++) {
-                if (get_user(hred, red) ||
-                    get_user(hgreen, green) ||
-                    get_user(hblue, blue) ||
-                    (transp && get_user(htransp, transp)))
-                        return -EFAULT;
-                if (info->fbops->fb_setcolreg(start++,
-                                              hred, hgreen, hblue, htransp,
-                                              info))
-                        return 0;
-                if (transp)
-                        transp++;
-        }
-        return 0;
+        umap.start = cmap->start;
+        rc = fb_set_cmap(&umap, info);
+        fb_dealloc_cmap(&umap);
+        return rc;
 }
 
 /**
diff --git a/drivers/video/fbmem.c b/drivers/video/fbmem.c
index 2222de6ad844..40784a944d05 100644
--- a/drivers/video/fbmem.c
+++ b/drivers/video/fbmem.c
@@ -1164,6 +1164,7 @@ static void __exit
 fbmem_exit(void)
 {
         class_destroy(fb_class);
+        unregister_chrdev(FB_MAJOR, "fb");
 }
 
 module_exit(fbmem_exit);
diff --git a/drivers/video/fbmon.c b/drivers/video/fbmon.c
index 6cd1976548d4..c2718bb94949 100644
--- a/drivers/video/fbmon.c
+++ b/drivers/video/fbmon.c
@@ -1241,6 +1241,8 @@ int fb_validate_mode(const struct fb_var_screeninfo *var, struct fb_info *info)
                 vtotal *= 2;
 
         hfreq = pixclock/htotal;
+        hfreq = (hfreq + 500) / 1000 * 1000;
+
         vfreq = hfreq/vtotal;
 
         return (vfreq < vfmin || vfreq > vfmax || 
diff --git a/drivers/video/fbsysfs.c b/drivers/video/fbsysfs.c
index ddc9443254d9..63b505cce4ec 100644
--- a/drivers/video/fbsysfs.c
+++ b/drivers/video/fbsysfs.c
@@ -242,10 +242,68 @@ static ssize_t show_virtual(struct class_device *class_device, char *buf)
                         fb_info->var.yres_virtual);
 }
 
-static ssize_t store_cmap(struct class_device *class_device, const char * buf,
+/* Format for cmap is "%02x%c%4x%4x%4x\n" */
+/* %02x entry %c transp %4x red %4x blue %4x green \n */
+/* 255 rows at 16 chars equals 4096 */
+/* PAGE_SIZE can be 4096 or larger */
+static ssize_t store_cmap(struct class_device *class_device, const char *buf,
                           size_t count)
 {
-//      struct fb_info *fb_info = (struct fb_info *)class_get_devdata(class_device);
+        struct fb_info *fb_info = (struct fb_info *)class_get_devdata(class_device);
+        int rc, i, start, length, transp = 0;
+
+        if ((count > 4096) || ((count % 16) != 0) || (PAGE_SIZE < 4096))
+                return -EINVAL;
+
+        if (!fb_info->fbops->fb_setcolreg && !fb_info->fbops->fb_setcmap)
+                return -EINVAL;
+
+        sscanf(buf, "%02x", &start);
+        length = count / 16;
+
+        for (i = 0; i < length; i++)
+                if (buf[i * 16 + 2] != ' ')
+                        transp = 1;
+
+        /* If we can batch, do it */
+        if (fb_info->fbops->fb_setcmap && length > 1) {
+                struct fb_cmap umap;
+
+                memset(&umap, 0, sizeof(umap));
+                if ((rc = fb_alloc_cmap(&umap, length, transp)))
+                        return rc;
+
+                umap.start = start;
+                for (i = 0; i < length; i++) {
+                        sscanf(&buf[i * 16 +  3], "%4hx", &umap.red[i]);
+                        sscanf(&buf[i * 16 +  7], "%4hx", &umap.blue[i]);
+                        sscanf(&buf[i * 16 + 11], "%4hx", &umap.green[i]);
+                        if (transp)
+                                umap.transp[i] = (buf[i * 16 +  2] != ' ');
+                }
+                rc = fb_info->fbops->fb_setcmap(&umap, fb_info);
+                fb_copy_cmap(&umap, &fb_info->cmap);
+                fb_dealloc_cmap(&umap);
+
+                return rc;
+        }
+        for (i = 0; i < length; i++) {
+                u16 red, blue, green, tsp;
+
+                sscanf(&buf[i * 16 +  3], "%4hx", &red);
+                sscanf(&buf[i * 16 +  7], "%4hx", &blue);
+                sscanf(&buf[i * 16 + 11], "%4hx", &green);
+                tsp = (buf[i * 16 +  2] != ' ');
+                if ((rc = fb_info->fbops->fb_setcolreg(start++,
+                                      red, green, blue, tsp, fb_info)))
+                        return rc;
+
+                fb_info->cmap.red[i] = red;
+                fb_info->cmap.blue[i] = blue;
+                fb_info->cmap.green[i] = green;
+                if (transp)
+                        fb_info->cmap.transp[i] = tsp;
+        }
         return 0;
 }
 
@@ -253,20 +311,24 @@ static ssize_t show_cmap(struct class_device *class_device, char *buf)
 {
         struct fb_info *fb_info =
                 (struct fb_info *)class_get_devdata(class_device);
-        unsigned int offset = 0, i;
+        unsigned int i;
 
         if (!fb_info->cmap.red || !fb_info->cmap.blue ||
-            !fb_info->cmap.green || !fb_info->cmap.transp)
+           !fb_info->cmap.green)
+                return -EINVAL;
+
+        if (PAGE_SIZE < 4096)
                 return -EINVAL;
 
+        /* don't mess with the format, the buffer is PAGE_SIZE */
+        /* 255 entries at 16 chars per line equals 4096 = PAGE_SIZE */
         for (i = 0; i < fb_info->cmap.len; i++) {
-                offset += snprintf(buf, PAGE_SIZE - offset,
-                                   "%d,%d,%d,%d,%d\n", i + fb_info->cmap.start,
-                                   fb_info->cmap.red[i], fb_info->cmap.blue[i],
-                                   fb_info->cmap.green[i],
-                                   fb_info->cmap.transp[i]);
+                sprintf(&buf[ i * 16], "%02x%c%4x%4x%4x\n", i + fb_info->cmap.start,
+                        ((fb_info->cmap.transp && fb_info->cmap.transp[i]) ? '*' : ' '),
+                        fb_info->cmap.red[i], fb_info->cmap.blue[i],
+                        fb_info->cmap.green[i]);
         }
-        return offset;
+        return 4096;
 }
 
 static ssize_t store_blank(struct class_device *class_device, const char * buf,
diff --git a/drivers/video/pm2fb.c b/drivers/video/pm2fb.c
index 5dceddedf507..42c17efa9fb0 100644
--- a/drivers/video/pm2fb.c
+++ b/drivers/video/pm2fb.c
@@ -138,27 +138,27 @@ static struct fb_var_screeninfo pm2fb_var __devinitdata = {
  * Utility functions
  */
 
-inline static u32 RD32(unsigned char __iomem *base, s32 off)
+static inline u32 RD32(unsigned char __iomem *base, s32 off)
 {
         return fb_readl(base + off);
 }
 
-inline static void WR32(unsigned char __iomem *base, s32 off, u32 v)
+static inline void WR32(unsigned char __iomem *base, s32 off, u32 v)
 {
         fb_writel(v, base + off);
 }
 
-inline static u32 pm2_RD(struct pm2fb_par* p, s32 off)
+static inline u32 pm2_RD(struct pm2fb_par* p, s32 off)
 {
         return RD32(p->v_regs, off);
 }
 
-inline static void pm2_WR(struct pm2fb_par* p, s32 off, u32 v)
+static inline void pm2_WR(struct pm2fb_par* p, s32 off, u32 v)
 {
         WR32(p->v_regs, off, v);
 }
 
-inline static u32 pm2_RDAC_RD(struct pm2fb_par* p, s32 idx)
+static inline u32 pm2_RDAC_RD(struct pm2fb_par* p, s32 idx)
 {
         int index = PM2R_RD_INDEXED_DATA;
         switch (p->type) {
@@ -174,7 +174,7 @@ inline static u32 pm2_RDAC_RD(struct pm2fb_par* p, s32 idx)
         return pm2_RD(p, index);
 }
 
-inline static void pm2_RDAC_WR(struct pm2fb_par* p, s32 idx, u32 v)
+static inline void pm2_RDAC_WR(struct pm2fb_par* p, s32 idx, u32 v)
 {
         int index = PM2R_RD_INDEXED_DATA;
         switch (p->type) {
@@ -190,7 +190,7 @@ inline static void pm2_RDAC_WR(struct pm2fb_par* p, s32 idx, u32 v)
         pm2_WR(p, index, v);
 }
 
-inline static void pm2v_RDAC_WR(struct pm2fb_par* p, s32 idx, u32 v)
+static inline void pm2v_RDAC_WR(struct pm2fb_par* p, s32 idx, u32 v)
 {
         pm2_WR(p, PM2VR_RD_INDEX_LOW, idx & 0xff);
         mb();
@@ -200,7 +200,7 @@ inline static void pm2v_RDAC_WR(struct pm2fb_par* p, s32 idx, u32 v)
 #ifdef CONFIG_FB_PM2_FIFO_DISCONNECT
 #define WAIT_FIFO(p,a)
 #else
-inline static void WAIT_FIFO(struct pm2fb_par* p, u32 a)
+static inline void WAIT_FIFO(struct pm2fb_par* p, u32 a)
 {
         while( pm2_RD(p, PM2R_IN_FIFO_SPACE) < a );
         mb();
diff --git a/drivers/video/riva/fbdev.c b/drivers/video/riva/fbdev.c
index 6a9e183be41b..ae297e222681 100644
--- a/drivers/video/riva/fbdev.c
+++ b/drivers/video/riva/fbdev.c
@@ -1826,7 +1826,7 @@ static void __devinit riva_get_EDID(struct fb_info *info, struct pci_dev *pdev)
 #ifdef CONFIG_PPC_OF
         if (!riva_get_EDID_OF(info, pdev))
                 printk(PFX "could not retrieve EDID from OF\n");
-#elif CONFIG_FB_RIVA_I2C
+#elif defined(CONFIG_FB_RIVA_I2C)
         if (!riva_get_EDID_i2c(info))
                 printk(PFX "could not retrieve EDID from DDC/I2C\n");
 #endif