181 files changed, 4686 insertions, 3840 deletions

diff --git a/drivers/Kconfig b/drivers/Kconfig
index 5c91d6afb117..aeb5ab2391e4 100644
--- a/drivers/Kconfig
+++ b/drivers/Kconfig
@@ -68,8 +68,6 @@ source "drivers/leds/Kconfig"
 
 source "drivers/infiniband/Kconfig"
 
-source "drivers/sn/Kconfig"
-
 source "drivers/edac/Kconfig"
 
 source "drivers/rtc/Kconfig"
diff --git a/drivers/base/class.c b/drivers/base/class.c
index 0e71dff327cd..b1ea4df85c7d 100644
--- a/drivers/base/class.c
+++ b/drivers/base/class.c
@@ -456,6 +456,35 @@ static void class_device_remove_attrs(struct class_device * cd)
         }
 }
 
+static int class_device_add_groups(struct class_device * cd)
+{
+        int i;
+        int error = 0;
+
+        if (cd->groups) {
+                for (i = 0; cd->groups[i]; i++) {
+                        error = sysfs_create_group(&cd->kobj, cd->groups[i]);
+                        if (error) {
+                                while (--i >= 0)
+                                        sysfs_remove_group(&cd->kobj, cd->groups[i]);
+                                goto out;
+                        }
+                }
+        }
+out:
+        return error;
+}
+
+static void class_device_remove_groups(struct class_device * cd)
+{
+        int i;
+        if (cd->groups) {
+                for (i = 0; cd->groups[i]; i++) {
+                        sysfs_remove_group(&cd->kobj, cd->groups[i]);
+                }
+        }
+}
+
 static ssize_t show_dev(struct class_device *class_dev, char *buf)
 {
         return print_dev_t(buf, class_dev->devt);
@@ -559,6 +588,8 @@ int class_device_add(struct class_device *class_dev)
                                   class_name);
         }
 
+        class_device_add_groups(class_dev);
+
         kobject_uevent(&class_dev->kobj, KOBJ_ADD);
 
         /* notify any interfaces this device is now here */
@@ -672,6 +703,7 @@ void class_device_del(struct class_device *class_dev)
         if (class_dev->devt_attr)
                 class_device_remove_file(class_dev, class_dev->devt_attr);
         class_device_remove_attrs(class_dev);
+        class_device_remove_groups(class_dev);
 
         kobject_uevent(&class_dev->kobj, KOBJ_REMOVE);
         kobject_del(&class_dev->kobj);
diff --git a/drivers/base/topology.c b/drivers/base/topology.c
index 915810f6237e..8c52421cbc54 100644
--- a/drivers/base/topology.c
+++ b/drivers/base/topology.c
@@ -107,7 +107,7 @@ static int __cpuinit topology_remove_dev(struct sys_device * sys_dev)
         return 0;
 }
 
-static int __cpuinit topology_cpu_callback(struct notifier_block *nfb,
+static int topology_cpu_callback(struct notifier_block *nfb,
                 unsigned long action, void *hcpu)
 {
         unsigned int cpu = (unsigned long)hcpu;
diff --git a/drivers/block/floppy.c b/drivers/block/floppy.c
index bedb689b051f..dff1e67b1dd4 100644
--- a/drivers/block/floppy.c
+++ b/drivers/block/floppy.c
@@ -4301,7 +4301,7 @@ static int __init floppy_init(void)
         }
 
         use_virtual_dma = can_use_virtual_dma & 1;
-#if defined(CONFIG_PPC64)
+#if defined(CONFIG_PPC_MERGE)
         if (check_legacy_ioport(FDC1)) {
                 del_timer(&fd_timeout);
                 err = -ENODEV;
diff --git a/drivers/char/cs5535_gpio.c b/drivers/char/cs5535_gpio.c
index 5d72f50de1ac..46d66037b917 100644
--- a/drivers/char/cs5535_gpio.c
+++ b/drivers/char/cs5535_gpio.c
@@ -241,9 +241,10 @@ static int __init cs5535_gpio_init(void)
 static void __exit cs5535_gpio_cleanup(void)
 {
         dev_t dev_id = MKDEV(major, 0);
+
+        cdev_del(&cs5535_gpio_cdev);
         unregister_chrdev_region(dev_id, CS5535_GPIO_COUNT);
-        if (gpio_base != 0)
-                release_region(gpio_base, CS5535_GPIO_SIZE);
+        release_region(gpio_base, CS5535_GPIO_SIZE);
 }
 
 module_init(cs5535_gpio_init);
diff --git a/drivers/char/drm/drmP.h b/drivers/char/drm/drmP.h
index e1aadae00623..cb76e5ca9a23 100644
--- a/drivers/char/drm/drmP.h
+++ b/drivers/char/drm/drmP.h
@@ -889,7 +889,6 @@ extern int drm_lock_free(drm_device_t * dev,
                                 /* Buffer management support (drm_bufs.h) */
 extern int drm_addbufs_agp(drm_device_t * dev, drm_buf_desc_t * request);
 extern int drm_addbufs_pci(drm_device_t * dev, drm_buf_desc_t * request);
-extern int drm_addbufs_fb(drm_device_t *dev, drm_buf_desc_t *request);
 extern int drm_addmap(drm_device_t * dev, unsigned int offset,
                       unsigned int size, drm_map_type_t type,
                       drm_map_flags_t flags, drm_local_map_t ** map_ptr);
diff --git a/drivers/char/drm/drm_agpsupport.c b/drivers/char/drm/drm_agpsupport.c
index fabc930c67a2..40bfd9b01e39 100644
--- a/drivers/char/drm/drm_agpsupport.c
+++ b/drivers/char/drm/drm_agpsupport.c
@@ -503,8 +503,6 @@ int drm_agp_bind_memory(DRM_AGP_MEM * handle, off_t start)
         return agp_bind_memory(handle, start);
 }
 
-EXPORT_SYMBOL(drm_agp_bind_memory);
-
 /** Calls agp_unbind_memory() */
 int drm_agp_unbind_memory(DRM_AGP_MEM * handle)
 {
diff --git a/drivers/char/drm/drm_bufs.c b/drivers/char/drm/drm_bufs.c
index 8a9cf12e6183..006b06d29727 100644
--- a/drivers/char/drm/drm_bufs.c
+++ b/drivers/char/drm/drm_bufs.c
@@ -386,7 +386,6 @@ int drm_rmmap_locked(drm_device_t *dev, drm_local_map_t *map)
 
         return 0;
 }
-EXPORT_SYMBOL(drm_rmmap_locked);
 
 int drm_rmmap(drm_device_t *dev, drm_local_map_t *map)
 {
@@ -398,7 +397,6 @@ int drm_rmmap(drm_device_t *dev, drm_local_map_t *map)
 
         return ret;
 }
-EXPORT_SYMBOL(drm_rmmap);
 
 /* The rmmap ioctl appears to be unnecessary.  All mappings are torn down on
  * the last close of the device, and this is necessary for cleanup when things
@@ -1053,7 +1051,7 @@ static int drm_addbufs_sg(drm_device_t * dev, drm_buf_desc_t * request)
         return 0;
 }
 
-int drm_addbufs_fb(drm_device_t * dev, drm_buf_desc_t * request)
+static int drm_addbufs_fb(drm_device_t * dev, drm_buf_desc_t * request)
 {
         drm_device_dma_t *dma = dev->dma;
         drm_buf_entry_t *entry;
@@ -1212,7 +1210,6 @@ int drm_addbufs_fb(drm_device_t * dev, drm_buf_desc_t * request)
         atomic_dec(&dev->buf_alloc);
         return 0;
 }
-EXPORT_SYMBOL(drm_addbufs_fb);
 
 
 /**
diff --git a/drivers/char/drm/drm_stub.c b/drivers/char/drm/drm_stub.c
index 68073e14fdec..9a842a36bb27 100644
--- a/drivers/char/drm/drm_stub.c
+++ b/drivers/char/drm/drm_stub.c
@@ -229,8 +229,6 @@ int drm_get_dev(struct pci_dev *pdev, const struct pci_device_id *ent,
         return ret;
 }
 
-EXPORT_SYMBOL(drm_get_dev);
-
 /**
  * Put a device minor number.
  *
diff --git a/drivers/char/drm/r300_cmdbuf.c b/drivers/char/drm/r300_cmdbuf.c
index b108c7f913b2..26bdf2ca59d7 100644
--- a/drivers/char/drm/r300_cmdbuf.c
+++ b/drivers/char/drm/r300_cmdbuf.c
@@ -723,7 +723,7 @@ static int r300_scratch(drm_radeon_private_t *dev_priv,
         
         dev_priv->scratch_ages[header.scratch.reg]++;
         
-        ref_age_base = *(u32 **)cmdbuf->buf;
+        ref_age_base =  (u32 *)(unsigned long)*((uint64_t *)cmdbuf->buf);
         
         cmdbuf->buf += sizeof(u64);
         cmdbuf->bufsz -= sizeof(u64);
diff --git a/drivers/char/genrtc.c b/drivers/char/genrtc.c
index d3a2bc36129b..588fca542a98 100644
--- a/drivers/char/genrtc.c
+++ b/drivers/char/genrtc.c
@@ -200,13 +200,13 @@ static ssize_t gen_rtc_read(struct file *file, char __user *buf,
         /* first test allows optimizer to nuke this case for 32-bit machines */
         if (sizeof (int) != sizeof (long) && count == sizeof (unsigned int)) {
                 unsigned int uidata = data;
-                retval = put_user(uidata, (unsigned long __user *)buf);
+                retval = put_user(uidata, (unsigned int __user *)buf) ?:
+                        sizeof(unsigned int);
         }
         else {
-                retval = put_user(data, (unsigned long __user *)buf);
+                retval = put_user(data, (unsigned long __user *)buf) ?:
+                        sizeof(unsigned long);
         }
-        if (!retval)
-                retval = sizeof(unsigned long);
  out:
         current->state = TASK_RUNNING;
         remove_wait_queue(&gen_rtc_wait, &wait);
diff --git a/drivers/char/keyboard.c b/drivers/char/keyboard.c
index 935670a3cd98..5755b7e5f187 100644
--- a/drivers/char/keyboard.c
+++ b/drivers/char/keyboard.c
@@ -860,9 +860,32 @@ static void k_slock(struct vc_data *vc, unsigned char value, char up_flag, struc
 }
 
 /* by default, 300ms interval for combination release */
-static long brl_timeout = 300;
-MODULE_PARM_DESC(brl_timeout, "Braille keys release delay in ms (0 for combination on first release, < 0 for dead characters)");
-module_param(brl_timeout, long, 0644);
+static unsigned brl_timeout = 300;
+MODULE_PARM_DESC(brl_timeout, "Braille keys release delay in ms (0 for commit on first key release)");
+module_param(brl_timeout, uint, 0644);
+
+static unsigned brl_nbchords = 1;
+MODULE_PARM_DESC(brl_nbchords, "Number of chords that produce a braille pattern (0 for dead chords)");
+module_param(brl_nbchords, uint, 0644);
+
+static void k_brlcommit(struct vc_data *vc, unsigned int pattern, char up_flag, struct pt_regs *regs)
+{
+        static unsigned long chords;
+        static unsigned committed;
+
+        if (!brl_nbchords)
+                k_deadunicode(vc, BRL_UC_ROW | pattern, up_flag, regs);
+        else {
+                committed |= pattern;
+                chords++;
+                if (chords == brl_nbchords) {
+                        k_unicode(vc, BRL_UC_ROW | committed, up_flag, regs);
+                        chords = 0;
+                        committed = 0;
+                }
+        }
+}
+
 static void k_brl(struct vc_data *vc, unsigned char value, char up_flag, struct pt_regs *regs)
 {
         static unsigned pressed,committing;
@@ -882,11 +905,6 @@ static void k_brl(struct vc_data *vc, unsigned char value, char up_flag, struct
         if (value > 8)
                 return;
 
-        if (brl_timeout < 0) {
-                k_deadunicode(vc, BRL_UC_ROW | (1 << (value - 1)), up_flag, regs);
-                return;
-        }
-
         if (up_flag) {
                 if (brl_timeout) {
                         if (!committing ||
@@ -897,13 +915,13 @@ static void k_brl(struct vc_data *vc, unsigned char value, char up_flag, struct
                         pressed &= ~(1 << (value - 1));
                         if (!pressed) {
                                 if (committing) {
-                                        k_unicode(vc, BRL_UC_ROW | committing, 0, regs);
+                                        k_brlcommit(vc, committing, 0, regs);
                                         committing = 0;
                                 }
                         }
                 } else {
                         if (committing) {
-                                k_unicode(vc, BRL_UC_ROW | committing, 0, regs);
+                                k_brlcommit(vc, committing, 0, regs);
                                 committing = 0;
                         }
                         pressed &= ~(1 << (value - 1));
diff --git a/drivers/char/mem.c b/drivers/char/mem.c
index 66719f9d294c..1fa9fa157c12 100644
--- a/drivers/char/mem.c
+++ b/drivers/char/mem.c
@@ -27,6 +27,7 @@
 #include <linux/crash_dump.h>
 #include <linux/backing-dev.h>
 #include <linux/bootmem.h>
+#include <linux/pipe_fs_i.h>
 
 #include <asm/uaccess.h>
 #include <asm/io.h>
@@ -578,6 +579,18 @@ static ssize_t write_null(struct file * file, const char __user * buf,
         return count;
 }
 
+static int pipe_to_null(struct pipe_inode_info *info, struct pipe_buffer *buf,
+                        struct splice_desc *sd)
+{
+        return sd->len;
+}
+
+static ssize_t splice_write_null(struct pipe_inode_info *pipe,struct file *out,
+                                 loff_t *ppos, size_t len, unsigned int flags)
+{
+        return splice_from_pipe(pipe, out, ppos, len, flags, pipe_to_null);
+}
+
 #ifdef CONFIG_MMU
 /*
  * For fun, we are using the MMU for this.
@@ -785,6 +798,7 @@ static struct file_operations null_fops = {
         .llseek         = null_lseek,
         .read           = read_null,
         .write          = write_null,
+        .splice_write   = splice_write_null,
 };
 
 #if defined(CONFIG_ISA) || !defined(__mc68000__)
diff --git a/drivers/char/mwave/mwavedd.c b/drivers/char/mwave/mwavedd.c
index 8666171e187b..d3ba2f860ef0 100644
--- a/drivers/char/mwave/mwavedd.c
+++ b/drivers/char/mwave/mwavedd.c
@@ -271,7 +271,7 @@ static int mwave_ioctl(struct inode *inode, struct file *file,
                                 ipcnum,
                                 pDrvData->IPCs[ipcnum].usIntCount);
         
-                        if (ipcnum > ARRAY_SIZE(pDrvData->IPCs)) {
+                        if (ipcnum >= ARRAY_SIZE(pDrvData->IPCs)) {
                                 PRINTK_ERROR(KERN_ERR_MWAVE
                                                 "mwavedd::mwave_ioctl:"
                                                 " IOCTL_MW_REGISTER_IPC:"
diff --git a/drivers/char/pcmcia/cm4000_cs.c b/drivers/char/pcmcia/cm4000_cs.c
index 02114a0bd0d9..128b2632512d 100644
--- a/drivers/char/pcmcia/cm4000_cs.c
+++ b/drivers/char/pcmcia/cm4000_cs.c
@@ -1981,10 +1981,6 @@ static int __init cmm_init(void)
         if (!cmm_class)
                 return -1;
 
-        rc = pcmcia_register_driver(&cm4000_driver);
-        if (rc < 0)
-                return rc;
-
         major = register_chrdev(0, DEVICE_NAME, &cm4000_fops);
         if (major < 0) {
                 printk(KERN_WARNING MODULE_NAME
@@ -1992,6 +1988,12 @@ static int __init cmm_init(void)
                 return -1;
         }
 
+        rc = pcmcia_register_driver(&cm4000_driver);
+        if (rc < 0) {
+                unregister_chrdev(major, DEVICE_NAME);
+                return rc;
+        }
+
         return 0;
 }
 
diff --git a/drivers/char/pcmcia/cm4040_cs.c b/drivers/char/pcmcia/cm4040_cs.c
index 29efa64580a8..47a8465bf95b 100644
--- a/drivers/char/pcmcia/cm4040_cs.c
+++ b/drivers/char/pcmcia/cm4040_cs.c
@@ -724,16 +724,19 @@ static int __init cm4040_init(void)
         if (!cmx_class)
                 return -1;
 
-        rc = pcmcia_register_driver(&reader_driver);
-        if (rc < 0)
-                return rc;
-
         major = register_chrdev(0, DEVICE_NAME, &reader_fops);
         if (major < 0) {
                 printk(KERN_WARNING MODULE_NAME
                         ": could not get major number\n");
                 return -1;
         }
+
+        rc = pcmcia_register_driver(&reader_driver);
+        if (rc < 0) {
+                unregister_chrdev(major, DEVICE_NAME);
+                return rc;
+        }
+
         return 0;
 }
 
diff --git a/drivers/char/snsc.c b/drivers/char/snsc.c
index b543821d8cb4..56c8243cdb73 100644
--- a/drivers/char/snsc.c
+++ b/drivers/char/snsc.c
@@ -390,7 +390,8 @@ scdrv_init(void)
                         format_module_id(devnamep, geo_module(geoid),
                                          MODULE_FORMAT_BRIEF);
                         devnamep = devname + strlen(devname);
-                        sprintf(devnamep, "#%d", geo_slab(geoid));
+                        sprintf(devnamep, "^%d#%d", geo_slot(geoid),
+                                geo_slab(geoid));
 
                         /* allocate sysctl device data */
                         scd = kzalloc(sizeof (struct sysctl_data_s),
diff --git a/drivers/char/sonypi.c b/drivers/char/sonypi.c
index f8dd8527c6aa..a90f5d97df35 100644
--- a/drivers/char/sonypi.c
+++ b/drivers/char/sonypi.c
@@ -1341,6 +1341,9 @@ static int __devinit sonypi_probe(struct platform_device *dev)
         else if ((pcidev = pci_get_device(PCI_VENDOR_ID_INTEL,
                                           PCI_DEVICE_ID_INTEL_ICH6_1, NULL)))
                 sonypi_device.model = SONYPI_DEVICE_MODEL_TYPE3;
+        else if ((pcidev = pci_get_device(PCI_VENDOR_ID_INTEL,
+                                          PCI_DEVICE_ID_INTEL_ICH7_1, NULL)))
+                sonypi_device.model = SONYPI_DEVICE_MODEL_TYPE3;
         else
                 sonypi_device.model = SONYPI_DEVICE_MODEL_TYPE2;
 
diff --git a/drivers/char/tipar.c b/drivers/char/tipar.c
index eb2eb3e12d6a..079db5a935a1 100644
--- a/drivers/char/tipar.c
+++ b/drivers/char/tipar.c
@@ -515,7 +515,7 @@ tipar_init_module(void)
                 err = PTR_ERR(tipar_class);
                 goto out_chrdev;
         }
-        if (parport_register_driver(&tipar_driver) || tp_count == 0) {
+        if (parport_register_driver(&tipar_driver)) {
                 printk(KERN_ERR "tipar: unable to register with parport\n");
                 err = -EIO;
                 goto out_class;
diff --git a/drivers/char/tpm/Kconfig b/drivers/char/tpm/Kconfig
index a6873bf89ffa..1efde3b27619 100644
--- a/drivers/char/tpm/Kconfig
+++ b/drivers/char/tpm/Kconfig
@@ -20,9 +20,18 @@ config TCG_TPM
           Note: For more TPM drivers enable CONFIG_PNP, CONFIG_ACPI
           and CONFIG_PNPACPI.
 
+config TCG_TIS
+        tristate "TPM Interface Specification 1.2 Interface"
+        depends on TCG_TPM
+        ---help---
+          If you have a TPM security chip that is compliant with the
+          TCG TIS 1.2 TPM specification say Yes and it will be accessible
+          from within Linux.  To compile this driver as a module, choose
+          M here; the module will be called tpm_tis.
+
 config TCG_NSC
         tristate "National Semiconductor TPM Interface"
-        depends on TCG_TPM
+        depends on TCG_TPM && PNPACPI
         ---help---
           If you have a TPM security chip from National Semicondutor 
           say Yes and it will be accessible from within Linux.  To 
diff --git a/drivers/char/tpm/Makefile b/drivers/char/tpm/Makefile
index ba4582d160fd..ea3a1e02a824 100644
--- a/drivers/char/tpm/Makefile
+++ b/drivers/char/tpm/Makefile
@@ -5,6 +5,7 @@ obj-$(CONFIG_TCG_TPM) += tpm.o
 ifdef CONFIG_ACPI
         obj-$(CONFIG_TCG_TPM) += tpm_bios.o
 endif
+obj-$(CONFIG_TCG_TIS) += tpm_tis.o
 obj-$(CONFIG_TCG_NSC) += tpm_nsc.o
 obj-$(CONFIG_TCG_ATMEL) += tpm_atmel.o
 obj-$(CONFIG_TCG_INFINEON) += tpm_infineon.o
diff --git a/drivers/char/tpm/tpm.c b/drivers/char/tpm/tpm.c
index 5a3870477ef1..6889e7db3aff 100644
--- a/drivers/char/tpm/tpm.c
+++ b/drivers/char/tpm/tpm.c
@@ -32,12 +32,291 @@ enum tpm_const {
         TPM_MINOR = 224,        /* officially assigned */
         TPM_BUFSIZE = 2048,
         TPM_NUM_DEVICES = 256,
-        TPM_NUM_MASK_ENTRIES = TPM_NUM_DEVICES / (8 * sizeof(int))
 };
 
+enum tpm_duration {
+        TPM_SHORT = 0,
+        TPM_MEDIUM = 1,
+        TPM_LONG = 2,
+        TPM_UNDEFINED,
+};
+
+#define TPM_MAX_ORDINAL 243
+#define TPM_MAX_PROTECTED_ORDINAL 12
+#define TPM_PROTECTED_ORDINAL_MASK 0xFF
+
 static LIST_HEAD(tpm_chip_list);
 static DEFINE_SPINLOCK(driver_lock);
-static int dev_mask[TPM_NUM_MASK_ENTRIES];
+static DECLARE_BITMAP(dev_mask, TPM_NUM_DEVICES);
+
+/*
+ * Array with one entry per ordinal defining the maximum amount
+ * of time the chip could take to return the result.  The ordinal
+ * designation of short, medium or long is defined in a table in
+ * TCG Specification TPM Main Part 2 TPM Structures Section 17. The
+ * values of the SHORT, MEDIUM, and LONG durations are retrieved
+ * from the chip during initialization with a call to tpm_get_timeouts.
+ */
+static const u8 tpm_protected_ordinal_duration[TPM_MAX_PROTECTED_ORDINAL] = {
+        TPM_UNDEFINED,          /* 0 */
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,          /* 5 */
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_SHORT,              /* 10 */
+        TPM_SHORT,
+};
+
+static const u8 tpm_ordinal_duration[TPM_MAX_ORDINAL] = {
+        TPM_UNDEFINED,          /* 0 */
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,          /* 5 */
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_SHORT,              /* 10 */
+        TPM_SHORT,
+        TPM_MEDIUM,
+        TPM_LONG,
+        TPM_LONG,
+        TPM_MEDIUM,             /* 15 */
+        TPM_SHORT,
+        TPM_SHORT,
+        TPM_MEDIUM,
+        TPM_LONG,
+        TPM_SHORT,              /* 20 */
+        TPM_SHORT,
+        TPM_MEDIUM,
+        TPM_MEDIUM,
+        TPM_MEDIUM,
+        TPM_SHORT,              /* 25 */
+        TPM_SHORT,
+        TPM_MEDIUM,
+        TPM_SHORT,
+        TPM_SHORT,
+        TPM_MEDIUM,             /* 30 */
+        TPM_LONG,
+        TPM_MEDIUM,
+        TPM_SHORT,
+        TPM_SHORT,
+        TPM_SHORT,              /* 35 */
+        TPM_MEDIUM,
+        TPM_MEDIUM,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_MEDIUM,             /* 40 */
+        TPM_LONG,
+        TPM_MEDIUM,
+        TPM_SHORT,
+        TPM_SHORT,
+        TPM_SHORT,              /* 45 */
+        TPM_SHORT,
+        TPM_SHORT,
+        TPM_SHORT,
+        TPM_LONG,
+        TPM_MEDIUM,             /* 50 */
+        TPM_MEDIUM,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,          /* 55 */
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_MEDIUM,             /* 60 */
+        TPM_MEDIUM,
+        TPM_MEDIUM,
+        TPM_SHORT,
+        TPM_SHORT,
+        TPM_MEDIUM,             /* 65 */
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_SHORT,              /* 70 */
+        TPM_SHORT,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,          /* 75 */
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_LONG,               /* 80 */
+        TPM_UNDEFINED,
+        TPM_MEDIUM,
+        TPM_LONG,
+        TPM_SHORT,
+        TPM_UNDEFINED,          /* 85 */
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_SHORT,              /* 90 */
+        TPM_SHORT,
+        TPM_SHORT,
+        TPM_SHORT,
+        TPM_SHORT,
+        TPM_UNDEFINED,          /* 95 */
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_MEDIUM,             /* 100 */
+        TPM_SHORT,
+        TPM_SHORT,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,          /* 105 */
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_SHORT,              /* 110 */
+        TPM_SHORT,
+        TPM_SHORT,
+        TPM_SHORT,
+        TPM_SHORT,
+        TPM_SHORT,              /* 115 */
+        TPM_SHORT,
+        TPM_SHORT,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_LONG,               /* 120 */
+        TPM_LONG,
+        TPM_MEDIUM,
+        TPM_UNDEFINED,
+        TPM_SHORT,
+        TPM_SHORT,              /* 125 */
+        TPM_SHORT,
+        TPM_LONG,
+        TPM_SHORT,
+        TPM_SHORT,
+        TPM_SHORT,              /* 130 */
+        TPM_MEDIUM,
+        TPM_UNDEFINED,
+        TPM_SHORT,
+        TPM_MEDIUM,
+        TPM_UNDEFINED,          /* 135 */
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_SHORT,              /* 140 */
+        TPM_SHORT,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,          /* 145 */
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_SHORT,              /* 150 */
+        TPM_MEDIUM,
+        TPM_MEDIUM,
+        TPM_SHORT,
+        TPM_SHORT,
+        TPM_UNDEFINED,          /* 155 */
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_SHORT,              /* 160 */
+        TPM_SHORT,
+        TPM_SHORT,
+        TPM_SHORT,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,          /* 165 */
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_LONG,               /* 170 */
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,          /* 175 */
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_MEDIUM,             /* 180 */
+        TPM_SHORT,
+        TPM_MEDIUM,
+        TPM_MEDIUM,
+        TPM_MEDIUM,
+        TPM_MEDIUM,             /* 185 */
+        TPM_SHORT,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,          /* 190 */
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,          /* 195 */
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_SHORT,              /* 200 */
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_SHORT,
+        TPM_SHORT,              /* 205 */
+        TPM_SHORT,
+        TPM_SHORT,
+        TPM_SHORT,
+        TPM_SHORT,
+        TPM_MEDIUM,             /* 210 */
+        TPM_UNDEFINED,
+        TPM_MEDIUM,
+        TPM_MEDIUM,
+        TPM_MEDIUM,
+        TPM_UNDEFINED,          /* 215 */
+        TPM_MEDIUM,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_SHORT,
+        TPM_SHORT,              /* 220 */
+        TPM_SHORT,
+        TPM_SHORT,
+        TPM_SHORT,
+        TPM_SHORT,
+        TPM_UNDEFINED,          /* 225 */
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_SHORT,              /* 230 */
+        TPM_LONG,
+        TPM_MEDIUM,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,          /* 235 */
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_UNDEFINED,
+        TPM_SHORT,              /* 240 */
+        TPM_UNDEFINED,
+        TPM_MEDIUM,
+};
 
 static void user_reader_timeout(unsigned long ptr)
 {
@@ -46,7 +325,7 @@ static void user_reader_timeout(unsigned long ptr)
         schedule_work(&chip->work);
 }
 
-static void timeout_work(void * ptr)
+static void timeout_work(void *ptr)
 {
         struct tpm_chip *chip = ptr;
 
@@ -57,17 +336,43 @@ static void timeout_work(void * ptr)
 }
 
 /*
+ * Returns max number of jiffies to wait
+ */
+unsigned long tpm_calc_ordinal_duration(struct tpm_chip *chip,
+                                           u32 ordinal)
+{
+        int duration_idx = TPM_UNDEFINED;
+        int duration = 0;
+
+        if (ordinal < TPM_MAX_ORDINAL)
+                duration_idx = tpm_ordinal_duration[ordinal];
+        else if ((ordinal & TPM_PROTECTED_ORDINAL_MASK) <
+                 TPM_MAX_PROTECTED_ORDINAL)
+                duration_idx =
+                    tpm_protected_ordinal_duration[ordinal &
+                                                   TPM_PROTECTED_ORDINAL_MASK];
+
+        if (duration_idx != TPM_UNDEFINED)
+                duration = chip->vendor.duration[duration_idx];
+        if (duration <= 0)
+                return 2 * 60 * HZ;
+        else
+                return duration;
+}
+EXPORT_SYMBOL_GPL(tpm_calc_ordinal_duration);
+
+/*
  * Internal kernel interface to transmit TPM commands
  */
 static ssize_t tpm_transmit(struct tpm_chip *chip, const char *buf,
                             size_t bufsiz)
 {
         ssize_t rc;
-        u32 count;
+        u32 count, ordinal;
         unsigned long stop;
 
         count = be32_to_cpu(*((__be32 *) (buf + 2)));
-
+        ordinal = be32_to_cpu(*((__be32 *) (buf + 6)));
         if (count == 0)
                 return -ENODATA;
         if (count > bufsiz) {
@@ -78,21 +383,23 @@ static ssize_t tpm_transmit(struct tpm_chip *chip, const char *buf,
 
         down(&chip->tpm_mutex);
 
-        if ((rc = chip->vendor->send(chip, (u8 *) buf, count)) < 0) {
+        if ((rc = chip->vendor.send(chip, (u8 *) buf, count)) < 0) {
                 dev_err(chip->dev,
                         "tpm_transmit: tpm_send: error %zd\n", rc);
                 goto out;
         }
 
-        stop = jiffies + 2 * 60 * HZ;
+        if (chip->vendor.irq)
+                goto out_recv;
+
+        stop = jiffies + tpm_calc_ordinal_duration(chip, ordinal);
         do {
-                u8 status = chip->vendor->status(chip);
-                if ((status & chip->vendor->req_complete_mask) ==
-                    chip->vendor->req_complete_val) {
+                u8 status = chip->vendor.status(chip);
+                if ((status & chip->vendor.req_complete_mask) ==
+                    chip->vendor.req_complete_val)
                         goto out_recv;
-                }
 
-                if ((status == chip->vendor->req_canceled)) {
+                if ((status == chip->vendor.req_canceled)) {
                         dev_err(chip->dev, "Operation Canceled\n");
                         rc = -ECANCELED;
                         goto out;
@@ -102,14 +409,13 @@ static ssize_t tpm_transmit(struct tpm_chip *chip, const char *buf,
                 rmb();
         } while (time_before(jiffies, stop));
 
-
-        chip->vendor->cancel(chip);
+        chip->vendor.cancel(chip);
         dev_err(chip->dev, "Operation Timed out\n");
         rc = -ETIME;
         goto out;
 
 out_recv:
-        rc = chip->vendor->recv(chip, (u8 *) buf, bufsiz);
+        rc = chip->vendor.recv(chip, (u8 *) buf, bufsiz);
         if (rc < 0)
                 dev_err(chip->dev,
                         "tpm_transmit: tpm_recv: error %zd\n", rc);
@@ -119,17 +425,247 @@ out:
 }
 
 #define TPM_DIGEST_SIZE 20
-#define CAP_PCR_RESULT_SIZE 18
-static const u8 cap_pcr[] = {
+#define TPM_ERROR_SIZE 10
+#define TPM_RET_CODE_IDX 6
+#define TPM_GET_CAP_RET_SIZE_IDX 10
+#define TPM_GET_CAP_RET_UINT32_1_IDX 14
+#define TPM_GET_CAP_RET_UINT32_2_IDX 18
+#define TPM_GET_CAP_RET_UINT32_3_IDX 22
+#define TPM_GET_CAP_RET_UINT32_4_IDX 26
+#define TPM_GET_CAP_PERM_DISABLE_IDX 16
+#define TPM_GET_CAP_PERM_INACTIVE_IDX 18
+#define TPM_GET_CAP_RET_BOOL_1_IDX 14
+#define TPM_GET_CAP_TEMP_INACTIVE_IDX 16
+
+#define TPM_CAP_IDX 13
+#define TPM_CAP_SUBCAP_IDX 21
+
+enum tpm_capabilities {
+        TPM_CAP_FLAG = 4,
+        TPM_CAP_PROP = 5,
+};
+
+enum tpm_sub_capabilities {
+        TPM_CAP_PROP_PCR = 0x1,
+        TPM_CAP_PROP_MANUFACTURER = 0x3,
+        TPM_CAP_FLAG_PERM = 0x8,
+        TPM_CAP_FLAG_VOL = 0x9,
+        TPM_CAP_PROP_OWNER = 0x11,
+        TPM_CAP_PROP_TIS_TIMEOUT = 0x15,
+        TPM_CAP_PROP_TIS_DURATION = 0x20,
+};
+
+/*
+ * This is a semi generic GetCapability command for use
+ * with the capability type TPM_CAP_PROP or TPM_CAP_FLAG
+ * and their associated sub_capabilities.
+ */
+
+static const u8 tpm_cap[] = {
         0, 193,                 /* TPM_TAG_RQU_COMMAND */
         0, 0, 0, 22,            /* length */
         0, 0, 0, 101,           /* TPM_ORD_GetCapability */
-        0, 0, 0, 5,
-        0, 0, 0, 4,
-        0, 0, 1, 1
+        0, 0, 0, 0,             /* TPM_CAP_<TYPE> */
+        0, 0, 0, 4,             /* TPM_CAP_SUB_<TYPE> size */
+        0, 0, 1, 0              /* TPM_CAP_SUB_<TYPE> */
 };
 
-#define READ_PCR_RESULT_SIZE 30
+static ssize_t transmit_cmd(struct tpm_chip *chip, u8 *data, int len,
+                            char *desc)
+{
+        int err;
+
+        len = tpm_transmit(chip, data, len);
+        if (len <  0)
+                return len;
+        if (len == TPM_ERROR_SIZE) {
+                err = be32_to_cpu(*((__be32 *) (data + TPM_RET_CODE_IDX)));
+                dev_dbg(chip->dev, "A TPM error (%d) occurred %s\n", err, desc);
+                return err;
+        }
+        return 0;
+}
+
+void tpm_gen_interrupt(struct tpm_chip *chip)
+{
+        u8 data[max_t(int, ARRAY_SIZE(tpm_cap), 30)];
+        ssize_t rc;
+
+        memcpy(data, tpm_cap, sizeof(tpm_cap));
+        data[TPM_CAP_IDX] = TPM_CAP_PROP;
+        data[TPM_CAP_SUBCAP_IDX] = TPM_CAP_PROP_TIS_TIMEOUT;
+
+        rc = transmit_cmd(chip, data, sizeof(data),
+                        "attempting to determine the timeouts");
+}
+EXPORT_SYMBOL_GPL(tpm_gen_interrupt);
+
+void tpm_get_timeouts(struct tpm_chip *chip)
+{
+        u8 data[max_t(int, ARRAY_SIZE(tpm_cap), 30)];
+        ssize_t rc;
+        u32 timeout;
+
+        memcpy(data, tpm_cap, sizeof(tpm_cap));
+        data[TPM_CAP_IDX] = TPM_CAP_PROP;
+        data[TPM_CAP_SUBCAP_IDX] = TPM_CAP_PROP_TIS_TIMEOUT;
+
+        rc = transmit_cmd(chip, data, sizeof(data),
+                        "attempting to determine the timeouts");
+        if (rc)
+                goto duration;
+
+        if (be32_to_cpu(*((__be32 *) (data + TPM_GET_CAP_RET_SIZE_IDX)))
+            != 4 * sizeof(u32))
+                goto duration;
+
+        /* Don't overwrite default if value is 0 */
+        timeout =
+            be32_to_cpu(*((__be32 *) (data + TPM_GET_CAP_RET_UINT32_1_IDX)));
+        if (timeout)
+                chip->vendor.timeout_a = msecs_to_jiffies(timeout);
+        timeout =
+            be32_to_cpu(*((__be32 *) (data + TPM_GET_CAP_RET_UINT32_2_IDX)));
+        if (timeout)
+                chip->vendor.timeout_b = msecs_to_jiffies(timeout);
+        timeout =
+            be32_to_cpu(*((__be32 *) (data + TPM_GET_CAP_RET_UINT32_3_IDX)));
+        if (timeout)
+                chip->vendor.timeout_c = msecs_to_jiffies(timeout);
+        timeout =
+            be32_to_cpu(*((__be32 *) (data + TPM_GET_CAP_RET_UINT32_4_IDX)));
+        if (timeout)
+                chip->vendor.timeout_d = msecs_to_jiffies(timeout);
+
+duration:
+        memcpy(data, tpm_cap, sizeof(tpm_cap));
+        data[TPM_CAP_IDX] = TPM_CAP_PROP;
+        data[TPM_CAP_SUBCAP_IDX] = TPM_CAP_PROP_TIS_DURATION;
+
+        rc = transmit_cmd(chip, data, sizeof(data),
+                        "attempting to determine the durations");
+        if (rc)
+                return;
+
+        if (be32_to_cpu(*((__be32 *) (data + TPM_GET_CAP_RET_SIZE_IDX)))
+            != 3 * sizeof(u32))
+                return;
+
+        chip->vendor.duration[TPM_SHORT] =
+            msecs_to_jiffies(be32_to_cpu
+                             (*((__be32 *) (data +
+                                            TPM_GET_CAP_RET_UINT32_1_IDX))));
+        chip->vendor.duration[TPM_MEDIUM] =
+            msecs_to_jiffies(be32_to_cpu
+                             (*((__be32 *) (data +
+                                            TPM_GET_CAP_RET_UINT32_2_IDX))));
+        chip->vendor.duration[TPM_LONG] =
+            msecs_to_jiffies(be32_to_cpu
+                             (*((__be32 *) (data +
+                                            TPM_GET_CAP_RET_UINT32_3_IDX))));
+}
+EXPORT_SYMBOL_GPL(tpm_get_timeouts);
+
+void tpm_continue_selftest(struct tpm_chip *chip)
+{
+        u8 data[] = {
+                0, 193,                 /* TPM_TAG_RQU_COMMAND */
+                0, 0, 0, 10,            /* length */
+                0, 0, 0, 83,            /* TPM_ORD_GetCapability */
+        };
+
+        tpm_transmit(chip, data, sizeof(data));
+}
+EXPORT_SYMBOL_GPL(tpm_continue_selftest);
+
+ssize_t tpm_show_enabled(struct device * dev, struct device_attribute * attr,
+                        char *buf)
+{
+        u8 data[max_t(int, ARRAY_SIZE(tpm_cap), 35)];
+        ssize_t rc;
+
+        struct tpm_chip *chip = dev_get_drvdata(dev);
+        if (chip == NULL)
+                return -ENODEV;
+
+        memcpy(data, tpm_cap, sizeof(tpm_cap));
+        data[TPM_CAP_IDX] = TPM_CAP_FLAG;
+        data[TPM_CAP_SUBCAP_IDX] = TPM_CAP_FLAG_PERM;
+
+        rc = transmit_cmd(chip, data, sizeof(data),
+                        "attemtping to determine the permanent state");
+        if (rc)
+                return 0;
+        return sprintf(buf, "%d\n", !data[TPM_GET_CAP_PERM_DISABLE_IDX]);
+}
+EXPORT_SYMBOL_GPL(tpm_show_enabled);
+
+ssize_t tpm_show_active(struct device * dev, struct device_attribute * attr,
+                        char *buf)
+{
+        u8 data[max_t(int, ARRAY_SIZE(tpm_cap), 35)];
+        ssize_t rc;
+
+        struct tpm_chip *chip = dev_get_drvdata(dev);
+        if (chip == NULL)
+                return -ENODEV;
+
+        memcpy(data, tpm_cap, sizeof(tpm_cap));
+        data[TPM_CAP_IDX] = TPM_CAP_FLAG;
+        data[TPM_CAP_SUBCAP_IDX] = TPM_CAP_FLAG_PERM;
+
+        rc = transmit_cmd(chip, data, sizeof(data),
+                        "attemtping to determine the permanent state");
+        if (rc)
+                return 0;
+        return sprintf(buf, "%d\n", !data[TPM_GET_CAP_PERM_INACTIVE_IDX]);
+}
+EXPORT_SYMBOL_GPL(tpm_show_active);
+
+ssize_t tpm_show_owned(struct device * dev, struct device_attribute * attr,
+                        char *buf)
+{
+        u8 data[sizeof(tpm_cap)];
+        ssize_t rc;
+
+        struct tpm_chip *chip = dev_get_drvdata(dev);
+        if (chip == NULL)
+                return -ENODEV;
+
+        memcpy(data, tpm_cap, sizeof(tpm_cap));
+        data[TPM_CAP_IDX] = TPM_CAP_PROP;
+        data[TPM_CAP_SUBCAP_IDX] = TPM_CAP_PROP_OWNER;
+
+        rc = transmit_cmd(chip, data, sizeof(data),
+                        "attempting to determine the owner state");
+        if (rc)
+                return 0;
+        return sprintf(buf, "%d\n", data[TPM_GET_CAP_RET_BOOL_1_IDX]);
+}
+EXPORT_SYMBOL_GPL(tpm_show_owned);
+
+ssize_t tpm_show_temp_deactivated(struct device * dev,
+                                struct device_attribute * attr, char *buf)
+{
+        u8 data[sizeof(tpm_cap)];
+        ssize_t rc;
+
+        struct tpm_chip *chip = dev_get_drvdata(dev);
+        if (chip == NULL)
+                return -ENODEV;
+
+        memcpy(data, tpm_cap, sizeof(tpm_cap));
+        data[TPM_CAP_IDX] = TPM_CAP_FLAG;
+        data[TPM_CAP_SUBCAP_IDX] = TPM_CAP_FLAG_VOL;
+
+        rc = transmit_cmd(chip, data, sizeof(data),
+                        "attempting to determine the temporary state");
+        if (rc)
+                return 0;
+        return sprintf(buf, "%d\n", data[TPM_GET_CAP_TEMP_INACTIVE_IDX]);
+}
+EXPORT_SYMBOL_GPL(tpm_show_temp_deactivated);
+
 static const u8 pcrread[] = {
         0, 193,                 /* TPM_TAG_RQU_COMMAND */
         0, 0, 0, 14,            /* length */
@@ -140,8 +676,8 @@ static const u8 pcrread[] = {
 ssize_t tpm_show_pcrs(struct device *dev, struct device_attribute *attr,
                       char *buf)
 {
-        u8 data[READ_PCR_RESULT_SIZE];
-        ssize_t len;
+        u8 data[max_t(int, max(ARRAY_SIZE(tpm_cap), ARRAY_SIZE(pcrread)), 30)];
+        ssize_t rc;
         int i, j, num_pcrs;
         __be32 index;
         char *str = buf;
@@ -150,29 +686,24 @@ ssize_t tpm_show_pcrs(struct device *dev, struct device_attribute *attr,
         if (chip == NULL)
                 return -ENODEV;
 
-        memcpy(data, cap_pcr, sizeof(cap_pcr));
-        if ((len = tpm_transmit(chip, data, sizeof(data)))
-            < CAP_PCR_RESULT_SIZE) {
-                dev_dbg(chip->dev, "A TPM error (%d) occurred "
-                                "attempting to determine the number of PCRS\n",
-                        be32_to_cpu(*((__be32 *) (data + 6))));
+        memcpy(data, tpm_cap, sizeof(tpm_cap));
+        data[TPM_CAP_IDX] = TPM_CAP_PROP;
+        data[TPM_CAP_SUBCAP_IDX] = TPM_CAP_PROP_PCR;
+
+        rc = transmit_cmd(chip, data, sizeof(data),
+                        "attempting to determine the number of PCRS");
+        if (rc)
                 return 0;
-        }
 
         num_pcrs = be32_to_cpu(*((__be32 *) (data + 14)));
-
         for (i = 0; i < num_pcrs; i++) {
                 memcpy(data, pcrread, sizeof(pcrread));
                 index = cpu_to_be32(i);
                 memcpy(data + 10, &index, 4);
-                if ((len = tpm_transmit(chip, data, sizeof(data)))
-                    < READ_PCR_RESULT_SIZE){
-                        dev_dbg(chip->dev, "A TPM error (%d) occurred"
-                                " attempting to read PCR %d of %d\n",
-                                be32_to_cpu(*((__be32 *) (data + 6))),
-                                i, num_pcrs);
+                rc = transmit_cmd(chip, data, sizeof(data),
+                                "attempting to read a PCR");
+                if (rc)
                         goto out;
-                }
                 str += sprintf(str, "PCR-%02d: ", i);
                 for (j = 0; j < TPM_DIGEST_SIZE; j++)
                         str += sprintf(str, "%02X ", *(data + 10 + j));
@@ -194,7 +725,7 @@ ssize_t tpm_show_pubek(struct device *dev, struct device_attribute *attr,
                        char *buf)
 {
         u8 *data;
-        ssize_t len;
+        ssize_t err;
         int i, rc;
         char *str = buf;
 
@@ -208,14 +739,10 @@ ssize_t tpm_show_pubek(struct device *dev, struct device_attribute *attr,
 
         memcpy(data, readpubek, sizeof(readpubek));
 
-        if ((len = tpm_transmit(chip, data, READ_PUBEK_RESULT_SIZE)) <
-            READ_PUBEK_RESULT_SIZE) {
-                dev_dbg(chip->dev, "A TPM error (%d) occurred "
-                                "attempting to read the PUBEK\n",
-                            be32_to_cpu(*((__be32 *) (data + 6))));
-                rc = 0;
+        err = transmit_cmd(chip, data, READ_PUBEK_RESULT_SIZE,
+                        "attempting to read the PUBEK");
+        if (err)
                 goto out;
-        }
 
         /* 
            ignore header 10 bytes
@@ -245,67 +772,110 @@ ssize_t tpm_show_pubek(struct device *dev, struct device_attribute *attr,
                 if ((i + 1) % 16 == 0)
                         str += sprintf(str, "\n");
         }
-        rc = str - buf;
 out:
+        rc = str - buf;
         kfree(data);
         return rc;
 }
 EXPORT_SYMBOL_GPL(tpm_show_pubek);
 
-#define CAP_VER_RESULT_SIZE 18
+#define CAP_VERSION_1_1 6
+#define CAP_VERSION_1_2 0x1A
+#define CAP_VERSION_IDX 13
 static const u8 cap_version[] = {
         0, 193,                 /* TPM_TAG_RQU_COMMAND */
         0, 0, 0, 18,            /* length */
         0, 0, 0, 101,           /* TPM_ORD_GetCapability */
-        0, 0, 0, 6,
+        0, 0, 0, 0,
         0, 0, 0, 0
 };
 
-#define CAP_MANUFACTURER_RESULT_SIZE 18
-static const u8 cap_manufacturer[] = {
-        0, 193,                 /* TPM_TAG_RQU_COMMAND */
-        0, 0, 0, 22,            /* length */
-        0, 0, 0, 101,           /* TPM_ORD_GetCapability */
-        0, 0, 0, 5,
-        0, 0, 0, 4,
-        0, 0, 1, 3
-};
-
 ssize_t tpm_show_caps(struct device *dev, struct device_attribute *attr,
                       char *buf)
 {
-        u8 data[sizeof(cap_manufacturer)];
-        ssize_t len;
+        u8 data[max_t(int, max(ARRAY_SIZE(tpm_cap), ARRAY_SIZE(cap_version)), 30)];
+        ssize_t rc;
         char *str = buf;
 
         struct tpm_chip *chip = dev_get_drvdata(dev);
         if (chip == NULL)
                 return -ENODEV;
 
-        memcpy(data, cap_manufacturer, sizeof(cap_manufacturer));
+        memcpy(data, tpm_cap, sizeof(tpm_cap));
+        data[TPM_CAP_IDX] = TPM_CAP_PROP;
+        data[TPM_CAP_SUBCAP_IDX] = TPM_CAP_PROP_MANUFACTURER;
 
-        if ((len = tpm_transmit(chip, data, sizeof(data))) <
-            CAP_MANUFACTURER_RESULT_SIZE)
-                return len;
+        rc = transmit_cmd(chip, data, sizeof(data),
+                        "attempting to determine the manufacturer");
+        if (rc)
+                return 0;
 
         str += sprintf(str, "Manufacturer: 0x%x\n",
-                       be32_to_cpu(*((__be32 *) (data + 14))));
+                       be32_to_cpu(*((__be32 *) (data + TPM_GET_CAP_RET_UINT32_1_IDX))));
 
         memcpy(data, cap_version, sizeof(cap_version));
+        data[CAP_VERSION_IDX] = CAP_VERSION_1_1;
+        rc = transmit_cmd(chip, data, sizeof(data),
+                        "attempting to determine the 1.1 version");
+        if (rc)
+                goto out;
 
-        if ((len = tpm_transmit(chip, data, sizeof(data))) <
-            CAP_VER_RESULT_SIZE)
-                return len;
-
-        str +=
-            sprintf(str, "TCG version: %d.%d\nFirmware version: %d.%d\n",
-                    (int) data[14], (int) data[15], (int) data[16],
-                    (int) data[17]);
+        str += sprintf(str,
+                       "TCG version: %d.%d\nFirmware version: %d.%d\n",
+                       (int) data[14], (int) data[15], (int) data[16],
+                       (int) data[17]);
 
+out:
         return str - buf;
 }
 EXPORT_SYMBOL_GPL(tpm_show_caps);
 
+ssize_t tpm_show_caps_1_2(struct device * dev,
+                          struct device_attribute * attr, char *buf)
+{
+        u8 data[max_t(int, max(ARRAY_SIZE(tpm_cap), ARRAY_SIZE(cap_version)), 30)];
+        ssize_t len;
+        char *str = buf;
+
+        struct tpm_chip *chip = dev_get_drvdata(dev);
+        if (chip == NULL)
+                return -ENODEV;
+
+        memcpy(data, tpm_cap, sizeof(tpm_cap));
+        data[TPM_CAP_IDX] = TPM_CAP_PROP;
+        data[TPM_CAP_SUBCAP_IDX] = TPM_CAP_PROP_MANUFACTURER;
+
+        if ((len = tpm_transmit(chip, data, sizeof(data))) <=
+            TPM_ERROR_SIZE) {
+                dev_dbg(chip->dev, "A TPM error (%d) occurred "
+                        "attempting to determine the manufacturer\n",
+                        be32_to_cpu(*((__be32 *) (data + TPM_RET_CODE_IDX))));
+                return 0;
+        }
+
+        str += sprintf(str, "Manufacturer: 0x%x\n",
+                       be32_to_cpu(*((__be32 *) (data + TPM_GET_CAP_RET_UINT32_1_IDX))));
+
+        memcpy(data, cap_version, sizeof(cap_version));
+        data[CAP_VERSION_IDX] = CAP_VERSION_1_2;
+
+        if ((len = tpm_transmit(chip, data, sizeof(data))) <=
+            TPM_ERROR_SIZE) {
+                dev_err(chip->dev, "A TPM error (%d) occurred "
+                        "attempting to determine the 1.2 version\n",
+                        be32_to_cpu(*((__be32 *) (data + TPM_RET_CODE_IDX))));
+                goto out;
+        }
+        str += sprintf(str,
+                       "TCG version: %d.%d\nFirmware version: %d.%d\n",
+                       (int) data[16], (int) data[17], (int) data[18],
+                       (int) data[19]);
+
+out:
+        return str - buf;
+}
+EXPORT_SYMBOL_GPL(tpm_show_caps_1_2);
+
 ssize_t tpm_store_cancel(struct device *dev, struct device_attribute *attr,
                         const char *buf, size_t count)
 {
@@ -313,7 +883,7 @@ ssize_t tpm_store_cancel(struct device *dev, struct device_attribute *attr,
         if (chip == NULL)
                 return 0;
 
-        chip->vendor->cancel(chip);
+        chip->vendor.cancel(chip);
         return count;
 }
 EXPORT_SYMBOL_GPL(tpm_store_cancel);
@@ -329,7 +899,7 @@ int tpm_open(struct inode *inode, struct file *file)
         spin_lock(&driver_lock);
 
         list_for_each_entry(pos, &tpm_chip_list, list) {
-                if (pos->vendor->miscdev.minor == minor) {
+                if (pos->vendor.miscdev.minor == minor) {
                         chip = pos;
                         break;
                 }
@@ -387,7 +957,7 @@ int tpm_release(struct inode *inode, struct file *file)
 EXPORT_SYMBOL_GPL(tpm_release);
 
 ssize_t tpm_write(struct file *file, const char __user *buf,
-                  size_t size, loff_t * off)
+                  size_t size, loff_t *off)
 {
         struct tpm_chip *chip = file->private_data;
         int in_size = size, out_size;
@@ -419,11 +989,10 @@ ssize_t tpm_write(struct file *file, const char __user *buf,
 
         return in_size;
 }
-
 EXPORT_SYMBOL_GPL(tpm_write);
 
-ssize_t tpm_read(struct file * file, char __user *buf,
-                 size_t size, loff_t * off)
+ssize_t tpm_read(struct file *file, char __user *buf,
+                 size_t size, loff_t *off)
 {
         struct tpm_chip *chip = file->private_data;
         int ret_size;
@@ -462,14 +1031,13 @@ void tpm_remove_hardware(struct device *dev)
         spin_unlock(&driver_lock);
 
         dev_set_drvdata(dev, NULL);
-        misc_deregister(&chip->vendor->miscdev);
-        kfree(chip->vendor->miscdev.name);
+        misc_deregister(&chip->vendor.miscdev);
+        kfree(chip->vendor.miscdev.name);
 
-        sysfs_remove_group(&dev->kobj, chip->vendor->attr_group);
+        sysfs_remove_group(&dev->kobj, chip->vendor.attr_group);
         tpm_bios_log_teardown(chip->bios_dir);
 
-        dev_mask[chip->dev_num / TPM_NUM_MASK_ENTRIES ] &=
-                ~(1 << (chip->dev_num % TPM_NUM_MASK_ENTRIES));
+        clear_bit(chip->dev_num, dev_mask);
 
         kfree(chip);
 
@@ -520,18 +1088,18 @@ EXPORT_SYMBOL_GPL(tpm_pm_resume);
  * upon errant exit from this function specific probe function should call
  * pci_disable_device
  */
-int tpm_register_hardware(struct device *dev, struct tpm_vendor_specific *entry)
+struct tpm_chip *tpm_register_hardware(struct device *dev, const struct tpm_vendor_specific
+                                       *entry)
 {
 #define DEVNAME_SIZE 7
 
         char *devname;
         struct tpm_chip *chip;
-        int i, j;
 
         /* Driver specific per-device data */
         chip = kzalloc(sizeof(*chip), GFP_KERNEL);
         if (chip == NULL)
-                return -ENOMEM;
+                return NULL;
 
         init_MUTEX(&chip->buffer_mutex);
         init_MUTEX(&chip->tpm_mutex);
@@ -543,45 +1111,37 @@ int tpm_register_hardware(struct device *dev, struct tpm_vendor_specific *entry)
         chip->user_read_timer.function = user_reader_timeout;
         chip->user_read_timer.data = (unsigned long) chip;
 
-        chip->vendor = entry;
-
-        chip->dev_num = -1;
+        memcpy(&chip->vendor, entry, sizeof(struct tpm_vendor_specific));
 
-        for (i = 0; i < TPM_NUM_MASK_ENTRIES; i++)
-                for (j = 0; j < 8 * sizeof(int); j++)
-                        if ((dev_mask[i] & (1 << j)) == 0) {
-                                chip->dev_num =
-                                    i * TPM_NUM_MASK_ENTRIES + j;
-                                dev_mask[i] |= 1 << j;
-                                goto dev_num_search_complete;
-                        }
+        chip->dev_num = find_first_zero_bit(dev_mask, TPM_NUM_DEVICES);
 
-dev_num_search_complete:
-        if (chip->dev_num < 0) {
+        if (chip->dev_num >= TPM_NUM_DEVICES) {
                 dev_err(dev, "No available tpm device numbers\n");
                 kfree(chip);
-                return -ENODEV;
+                return NULL;
         } else if (chip->dev_num == 0)
-                chip->vendor->miscdev.minor = TPM_MINOR;
+                chip->vendor.miscdev.minor = TPM_MINOR;
         else
-                chip->vendor->miscdev.minor = MISC_DYNAMIC_MINOR;
+                chip->vendor.miscdev.minor = MISC_DYNAMIC_MINOR;
+
+        set_bit(chip->dev_num, dev_mask);
 
         devname = kmalloc(DEVNAME_SIZE, GFP_KERNEL);
         scnprintf(devname, DEVNAME_SIZE, "%s%d", "tpm", chip->dev_num);
-        chip->vendor->miscdev.name = devname;
+        chip->vendor.miscdev.name = devname;
 
-        chip->vendor->miscdev.dev = dev;
+        chip->vendor.miscdev.dev = dev;
         chip->dev = get_device(dev);
 
-        if (misc_register(&chip->vendor->miscdev)) {
+        if (misc_register(&chip->vendor.miscdev)) {
                 dev_err(chip->dev,
                         "unable to misc_register %s, minor %d\n",
-                        chip->vendor->miscdev.name,
-                        chip->vendor->miscdev.minor);
+                        chip->vendor.miscdev.name,
+                        chip->vendor.miscdev.minor);
                 put_device(dev);
+                clear_bit(chip->dev_num, dev_mask);
                 kfree(chip);
-                dev_mask[i] &= !(1 << j);
-                return -ENODEV;
+                return NULL;
         }
 
         spin_lock(&driver_lock);
@@ -592,11 +1152,11 @@ dev_num_search_complete:
 
         spin_unlock(&driver_lock);
 
-        sysfs_create_group(&dev->kobj, chip->vendor->attr_group);
+        sysfs_create_group(&dev->kobj, chip->vendor.attr_group);
 
         chip->bios_dir = tpm_bios_log_setup(devname);
 
-        return 0;
+        return chip;
 }
 EXPORT_SYMBOL_GPL(tpm_register_hardware);
 
diff --git a/drivers/char/tpm/tpm.h b/drivers/char/tpm/tpm.h
index dec0224b4478..54a4c804e25f 100644
--- a/drivers/char/tpm/tpm.h
+++ b/drivers/char/tpm/tpm.h
@@ -42,18 +42,30 @@ extern ssize_t tpm_show_pcrs(struct device *, struct device_attribute *attr,
                                 char *);
 extern ssize_t tpm_show_caps(struct device *, struct device_attribute *attr,
                                 char *);
+extern ssize_t tpm_show_caps_1_2(struct device *, struct device_attribute *attr,
+                                char *);
 extern ssize_t tpm_store_cancel(struct device *, struct device_attribute *attr,
                                 const char *, size_t);
+extern ssize_t tpm_show_enabled(struct device *, struct device_attribute *attr,
+                                char *);
+extern ssize_t tpm_show_active(struct device *, struct device_attribute *attr,
+                                char *);
+extern ssize_t tpm_show_owned(struct device *, struct device_attribute *attr,
+                                char *);
+extern ssize_t tpm_show_temp_deactivated(struct device *,
+                                         struct device_attribute *attr, char *);
 
 struct tpm_chip;
 
 struct tpm_vendor_specific {
-        u8 req_complete_mask;
-        u8 req_complete_val;
-        u8 req_canceled;
+        const u8 req_complete_mask;
+        const u8 req_complete_val;
+        const u8 req_canceled;
         void __iomem *iobase;           /* ioremapped address */
         unsigned long base;             /* TPM base address */
 
+        int irq;
+
         int region_size;
         int have_region;
 
@@ -63,6 +75,13 @@ struct tpm_vendor_specific {
         u8 (*status) (struct tpm_chip *);
         struct miscdevice miscdev;
         struct attribute_group *attr_group;
+        struct list_head list;
+        int locality;
+        unsigned long timeout_a, timeout_b, timeout_c, timeout_d; /* jiffies */
+        unsigned long duration[3]; /* jiffies */
+
+        wait_queue_head_t read_queue;
+        wait_queue_head_t int_queue;
 };
 
 struct tpm_chip {
@@ -81,13 +100,15 @@ struct tpm_chip {
         struct work_struct work;
         struct semaphore tpm_mutex;     /* tpm is processing */
 
-        struct tpm_vendor_specific *vendor;
+        struct tpm_vendor_specific vendor;
 
         struct dentry **bios_dir;
 
         struct list_head list;
 };
 
+#define to_tpm_chip(n) container_of(n, struct tpm_chip, vendor)
+
 static inline int tpm_read_index(int base, int index)
 {
         outb(index, base);
@@ -100,8 +121,12 @@ static inline void tpm_write_index(int base, int index, int value)
         outb(value & 0xFF, base+1);
 }
 
-extern int tpm_register_hardware(struct device *,
-                                 struct tpm_vendor_specific *);
+extern void tpm_get_timeouts(struct tpm_chip *);
+extern void tpm_gen_interrupt(struct tpm_chip *);
+extern void tpm_continue_selftest(struct tpm_chip *);
+extern unsigned long tpm_calc_ordinal_duration(struct tpm_chip *, u32);
+extern struct tpm_chip* tpm_register_hardware(struct device *,
+                                 const struct tpm_vendor_specific *);
 extern int tpm_open(struct inode *, struct file *);
 extern int tpm_release(struct inode *, struct file *);
 extern ssize_t tpm_write(struct file *, const char __user *, size_t,
diff --git a/drivers/char/tpm/tpm_atmel.c b/drivers/char/tpm/tpm_atmel.c
index ff3654964fe3..58a258cec153 100644
--- a/drivers/char/tpm/tpm_atmel.c
+++ b/drivers/char/tpm/tpm_atmel.c
@@ -47,12 +47,12 @@ static int tpm_atml_recv(struct tpm_chip *chip, u8 *buf, size_t count)
                 return -EIO;
 
         for (i = 0; i < 6; i++) {
-                status = ioread8(chip->vendor->iobase + 1);
+                status = ioread8(chip->vendor.iobase + 1);
                 if ((status & ATML_STATUS_DATA_AVAIL) == 0) {
                         dev_err(chip->dev, "error reading header\n");
                         return -EIO;
                 }
-                *buf++ = ioread8(chip->vendor->iobase);
+                *buf++ = ioread8(chip->vendor.iobase);
         }
 
         /* size of the data received */
@@ -63,7 +63,7 @@ static int tpm_atml_recv(struct tpm_chip *chip, u8 *buf, size_t count)
                 dev_err(chip->dev,
                         "Recv size(%d) less than available space\n", size);
                 for (; i < size; i++) { /* clear the waiting data anyway */
-                        status = ioread8(chip->vendor->iobase + 1);
+                        status = ioread8(chip->vendor.iobase + 1);
                         if ((status & ATML_STATUS_DATA_AVAIL) == 0) {
                                 dev_err(chip->dev, "error reading data\n");
                                 return -EIO;
@@ -74,16 +74,16 @@ static int tpm_atml_recv(struct tpm_chip *chip, u8 *buf, size_t count)
 
         /* read all the data available */
         for (; i < size; i++) {
-                status = ioread8(chip->vendor->iobase + 1);
+                status = ioread8(chip->vendor.iobase + 1);
                 if ((status & ATML_STATUS_DATA_AVAIL) == 0) {
                         dev_err(chip->dev, "error reading data\n");
                         return -EIO;
                 }
-                *buf++ = ioread8(chip->vendor->iobase);
+                *buf++ = ioread8(chip->vendor.iobase);
         }
 
         /* make sure data available is gone */
-        status = ioread8(chip->vendor->iobase + 1);
+        status = ioread8(chip->vendor.iobase + 1);
 
         if (status & ATML_STATUS_DATA_AVAIL) {
                 dev_err(chip->dev, "data available is stuck\n");
@@ -100,7 +100,7 @@ static int tpm_atml_send(struct tpm_chip *chip, u8 *buf, size_t count)
         dev_dbg(chip->dev, "tpm_atml_send:\n");
         for (i = 0; i < count; i++) {
                 dev_dbg(chip->dev, "%d 0x%x(%d)\n",  i, buf[i], buf[i]);
-                iowrite8(buf[i], chip->vendor->iobase);
+                iowrite8(buf[i], chip->vendor.iobase);
         }
 
         return count;
@@ -108,12 +108,12 @@ static int tpm_atml_send(struct tpm_chip *chip, u8 *buf, size_t count)
 
 static void tpm_atml_cancel(struct tpm_chip *chip)
 {
-        iowrite8(ATML_STATUS_ABORT, chip->vendor->iobase + 1);
+        iowrite8(ATML_STATUS_ABORT, chip->vendor.iobase + 1);
 }
 
 static u8 tpm_atml_status(struct tpm_chip *chip)
 {
-        return ioread8(chip->vendor->iobase + 1);
+        return ioread8(chip->vendor.iobase + 1);
 }
 
 static struct file_operations atmel_ops = {
@@ -140,7 +140,7 @@ static struct attribute* atmel_attrs[] = {
 
 static struct attribute_group atmel_attr_grp = { .attrs = atmel_attrs };
 
-static struct tpm_vendor_specific tpm_atmel = {
+static const struct tpm_vendor_specific tpm_atmel = {
         .recv = tpm_atml_recv,
         .send = tpm_atml_send,
         .cancel = tpm_atml_cancel,
@@ -159,10 +159,10 @@ static void atml_plat_remove(void)
         struct tpm_chip *chip = dev_get_drvdata(&pdev->dev);
 
         if (chip) {
-                if (chip->vendor->have_region)
-                        atmel_release_region(chip->vendor->base,
-                                             chip->vendor->region_size);
-                atmel_put_base_addr(chip->vendor);
+                if (chip->vendor.have_region)
+                        atmel_release_region(chip->vendor.base,
+                                             chip->vendor.region_size);
+                atmel_put_base_addr(chip->vendor.iobase);
                 tpm_remove_hardware(chip->dev);
                 platform_device_unregister(pdev);
         }
@@ -179,18 +179,22 @@ static struct device_driver atml_drv = {
 static int __init init_atmel(void)
 {
         int rc = 0;
+        void __iomem *iobase = NULL;
+        int have_region, region_size;
+        unsigned long base;
+        struct  tpm_chip *chip;
 
         driver_register(&atml_drv);
 
-        if ((tpm_atmel.iobase = atmel_get_base_addr(&tpm_atmel)) == NULL) {
+        if ((iobase = atmel_get_base_addr(&base, &region_size)) == NULL) {
                 rc = -ENODEV;
                 goto err_unreg_drv;
         }
 
-        tpm_atmel.have_region =
+        have_region =
             (atmel_request_region
-             (tpm_atmel.base, tpm_atmel.region_size,
-              "tpm_atmel0") == NULL) ? 0 : 1;
+             (tpm_atmel.base, region_size, "tpm_atmel0") == NULL) ? 0 : 1;
+
 
         if (IS_ERR
             (pdev =
@@ -199,17 +203,25 @@ static int __init init_atmel(void)
                 goto err_rel_reg;
         }
 
-        if ((rc = tpm_register_hardware(&pdev->dev, &tpm_atmel)) < 0)
+        if (!(chip = tpm_register_hardware(&pdev->dev, &tpm_atmel))) {
+                rc = -ENODEV;
                 goto err_unreg_dev;
+        }
+
+        chip->vendor.iobase = iobase;
+        chip->vendor.base = base;
+        chip->vendor.have_region = have_region;
+        chip->vendor.region_size = region_size;
+
         return 0;
 
 err_unreg_dev:
         platform_device_unregister(pdev);
 err_rel_reg:
-        atmel_put_base_addr(&tpm_atmel);
-        if (tpm_atmel.have_region)
-                atmel_release_region(tpm_atmel.base,
-                                     tpm_atmel.region_size);
+        atmel_put_base_addr(iobase);
+        if (have_region)
+                atmel_release_region(base,
+                                     region_size);
 err_unreg_drv:
         driver_unregister(&atml_drv);
         return rc;
diff --git a/drivers/char/tpm/tpm_atmel.h b/drivers/char/tpm/tpm_atmel.h
index d3478aaadd77..2e68eeb8a2cd 100644
--- a/drivers/char/tpm/tpm_atmel.h
+++ b/drivers/char/tpm/tpm_atmel.h
@@ -28,13 +28,12 @@
 #define atmel_request_region request_mem_region
 #define atmel_release_region release_mem_region
 
-static inline void atmel_put_base_addr(struct tpm_vendor_specific
-                                         *vendor)
+static inline void atmel_put_base_addr(void __iomem *iobase)
 {
-        iounmap(vendor->iobase);
+        iounmap(iobase);
 }
 
-static void __iomem * atmel_get_base_addr(struct tpm_vendor_specific *vendor)
+static void __iomem * atmel_get_base_addr(unsigned long *base, int *region_size)
 {
         struct device_node *dn;
         unsigned long address, size;
@@ -71,9 +70,9 @@ static void __iomem * atmel_get_base_addr(struct tpm_vendor_specific *vendor)
         else
                 size = reg[naddrc];
 
-        vendor->base = address;
-        vendor->region_size = size;
-        return ioremap(vendor->base, vendor->region_size);
+        *base = address;
+        *region_size = size;
+        return ioremap(*base, *region_size);
 }
 #else
 #define atmel_getb(chip, offset) inb(chip->vendor->base + offset)
@@ -106,14 +105,12 @@ static int atmel_verify_tpm11(void)
         return 0;
 }
 
-static inline void atmel_put_base_addr(struct tpm_vendor_specific
-                                         *vendor)
+static inline void atmel_put_base_addr(void __iomem *iobase)
 {
 }
 
 /* Determine where to talk to device */
-static void __iomem * atmel_get_base_addr(struct tpm_vendor_specific
-                                         *vendor)
+static void __iomem * atmel_get_base_addr(unsigned long *base, int *region_size)
 {
         int lo, hi;
 
@@ -123,9 +120,9 @@ static void __iomem * atmel_get_base_addr(struct tpm_vendor_specific
         lo = tpm_read_index(TPM_ADDR, TPM_ATMEL_BASE_ADDR_LO);
         hi = tpm_read_index(TPM_ADDR, TPM_ATMEL_BASE_ADDR_HI);
 
-        vendor->base = (hi << 8) | lo;
-        vendor->region_size = 2;
+        *base = (hi << 8) | lo;
+        *region_size = 2;
 
-        return ioport_map(vendor->base, vendor->region_size);
+        return ioport_map(*base, *region_size);
 }
 #endif
diff --git a/drivers/char/tpm/tpm_bios.c b/drivers/char/tpm/tpm_bios.c
index 537aa45d8c67..e45f0d3d12de 100644
--- a/drivers/char/tpm/tpm_bios.c
+++ b/drivers/char/tpm/tpm_bios.c
@@ -29,6 +29,11 @@
 #define MAX_TEXT_EVENT          1000    /* Max event string length */
 #define ACPI_TCPA_SIG           "TCPA"  /* 0x41504354 /'TCPA' */
 
+enum bios_platform_class {
+        BIOS_CLIENT = 0x00,
+        BIOS_SERVER = 0x01,
+};
+
 struct tpm_bios_log {
         void *bios_event_log;
         void *bios_event_log_end;
@@ -36,9 +41,18 @@ struct tpm_bios_log {
 
 struct acpi_tcpa {
         struct acpi_table_header hdr;
-        u16 reserved;
-        u32 log_max_len __attribute__ ((packed));
-        u32 log_start_addr __attribute__ ((packed));
+        u16 platform_class;
+        union {
+                struct client_hdr {
+                        u32 log_max_len __attribute__ ((packed));
+                        u64 log_start_addr __attribute__ ((packed));
+                } client;
+                struct server_hdr {
+                        u16 reserved;
+                        u64 log_max_len __attribute__ ((packed));
+                        u64 log_start_addr __attribute__ ((packed));
+                } server;
+        };
 };
 
 struct tcpa_event {
@@ -120,6 +134,7 @@ static const char* tcpa_pc_event_id_strings[] = {
         "S-CRTM Version",
         "S-CRTM Contents",
         "S-CRTM POST Contents",
+        "POST Contents",
 };
 
 /* returns pointer to start of pos. entry of tcg log */
@@ -306,6 +321,7 @@ static int tpm_binary_bios_measurements_show(struct seq_file *m, void *v)
         /* 5th: delimiter */
         seq_putc(m, '\0');
 
+        kfree(eventname);
         return 0;
 }
 
@@ -353,6 +369,7 @@ static int tpm_ascii_bios_measurements_show(struct seq_file *m, void *v)
         /* 4th: eventname <= max + \'0' delimiter */
         seq_printf(m, " %s\n", eventname);
 
+        kfree(eventname);
         return 0;
 }
 
@@ -376,6 +393,7 @@ static int read_log(struct tpm_bios_log *log)
         struct acpi_tcpa *buff;
         acpi_status status;
         struct acpi_table_header *virt;
+        u64 len, start;
 
         if (log->bios_event_log != NULL) {
                 printk(KERN_ERR
@@ -396,27 +414,37 @@ static int read_log(struct tpm_bios_log *log)
                 return -EIO;
         }
 
-        if (buff->log_max_len == 0) {
+        switch(buff->platform_class) {
+        case BIOS_SERVER:
+                len = buff->server.log_max_len;
+                start = buff->server.log_start_addr;
+                break;
+        case BIOS_CLIENT:
+        default:
+                len = buff->client.log_max_len;
+                start = buff->client.log_start_addr;
+                break;
+        }
+        if (!len) {
                 printk(KERN_ERR "%s: ERROR - TCPA log area empty\n", __func__);
                 return -EIO;
         }
 
         /* malloc EventLog space */
-        log->bios_event_log = kmalloc(buff->log_max_len, GFP_KERNEL);
+        log->bios_event_log = kmalloc(len, GFP_KERNEL);
         if (!log->bios_event_log) {
-                printk
-                    ("%s: ERROR - Not enough  Memory for BIOS measurements\n",
-                     __func__);
+                printk("%s: ERROR - Not enough  Memory for BIOS measurements\n",
+                        __func__);
                 return -ENOMEM;
         }
 
-        log->bios_event_log_end = log->bios_event_log + buff->log_max_len;
+        log->bios_event_log_end = log->bios_event_log + len;
 
-        acpi_os_map_memory(buff->log_start_addr, buff->log_max_len, (void *) &virt);
+        acpi_os_map_memory(start, len, (void *) &virt);
 
-        memcpy(log->bios_event_log, virt, buff->log_max_len);
+        memcpy(log->bios_event_log, virt, len);
 
-        acpi_os_unmap_memory(virt, buff->log_max_len);
+        acpi_os_unmap_memory(virt, len);
         return 0;
 }
 
diff --git a/drivers/char/tpm/tpm_infineon.c b/drivers/char/tpm/tpm_infineon.c
index 24095f6ee6da..adfff21beb21 100644
--- a/drivers/char/tpm/tpm_infineon.c
+++ b/drivers/char/tpm/tpm_infineon.c
@@ -15,6 +15,7 @@
  * License.
  */
 
+#include <linux/init.h>
 #include <linux/pnp.h>
 #include "tpm.h"
 
@@ -104,7 +105,7 @@ static int empty_fifo(struct tpm_chip *chip, int clear_wrfifo)
 
         if (clear_wrfifo) {
                 for (i = 0; i < 4096; i++) {
-                        status = inb(chip->vendor->base + WRFIFO);
+                        status = inb(chip->vendor.base + WRFIFO);
                         if (status == 0xff) {
                                 if (check == 5)
                                         break;
@@ -124,8 +125,8 @@ static int empty_fifo(struct tpm_chip *chip, int clear_wrfifo)
          */
         i = 0;
         do {
-                status = inb(chip->vendor->base + RDFIFO);
-                status = inb(chip->vendor->base + STAT);
+                status = inb(chip->vendor.base + RDFIFO);
+                status = inb(chip->vendor.base + STAT);
                 i++;
                 if (i == TPM_MAX_TRIES)
                         return -EIO;
@@ -138,7 +139,7 @@ static int wait(struct tpm_chip *chip, int wait_for_bit)
         int status;
         int i;
         for (i = 0; i < TPM_MAX_TRIES; i++) {
-                status = inb(chip->vendor->base + STAT);
+                status = inb(chip->vendor.base + STAT);
                 /* check the status-register if wait_for_bit is set */
                 if (status & 1 << wait_for_bit)
                         break;
@@ -157,7 +158,7 @@ static int wait(struct tpm_chip *chip, int wait_for_bit)
 static void wait_and_send(struct tpm_chip *chip, u8 sendbyte)
 {
         wait(chip, STAT_XFE);
-        outb(sendbyte, chip->vendor->base + WRFIFO);
+        outb(sendbyte, chip->vendor.base + WRFIFO);
 }
 
     /* Note: WTX means Waiting-Time-Extension. Whenever the TPM needs more
@@ -204,7 +205,7 @@ recv_begin:
                 ret = wait(chip, STAT_RDA);
                 if (ret)
                         return -EIO;
-                buf[i] = inb(chip->vendor->base + RDFIFO);
+                buf[i] = inb(chip->vendor.base + RDFIFO);
         }
 
         if (buf[0] != TPM_VL_VER) {
@@ -219,7 +220,7 @@ recv_begin:
 
                 for (i = 0; i < size; i++) {
                         wait(chip, STAT_RDA);
-                        buf[i] = inb(chip->vendor->base + RDFIFO);
+                        buf[i] = inb(chip->vendor.base + RDFIFO);
                 }
 
                 if ((size == 0x6D00) && (buf[1] == 0x80)) {
@@ -268,7 +269,7 @@ static int tpm_inf_send(struct tpm_chip *chip, u8 * buf, size_t count)
         u8 count_high, count_low, count_4, count_3, count_2, count_1;
 
         /* Disabling Reset, LP and IRQC */
-        outb(RESET_LP_IRQC_DISABLE, chip->vendor->base + CMD);
+        outb(RESET_LP_IRQC_DISABLE, chip->vendor.base + CMD);
 
         ret = empty_fifo(chip, 1);
         if (ret) {
@@ -319,7 +320,7 @@ static void tpm_inf_cancel(struct tpm_chip *chip)
 
 static u8 tpm_inf_status(struct tpm_chip *chip)
 {
-        return inb(chip->vendor->base + STAT);
+        return inb(chip->vendor.base + STAT);
 }
 
 static DEVICE_ATTR(pubek, S_IRUGO, tpm_show_pubek, NULL);
@@ -346,7 +347,7 @@ static struct file_operations inf_ops = {
         .release = tpm_release,
 };
 
-static struct tpm_vendor_specific tpm_inf = {
+static const struct tpm_vendor_specific tpm_inf = {
         .recv = tpm_inf_recv,
         .send = tpm_inf_send,
         .cancel = tpm_inf_cancel,
@@ -375,6 +376,7 @@ static int __devinit tpm_inf_pnp_probe(struct pnp_dev *dev,
         int version[2];
         int productid[2];
         char chipname[20];
+        struct tpm_chip *chip;
 
         /* read IO-ports through PnP */
         if (pnp_port_valid(dev, 0) && pnp_port_valid(dev, 1) &&
@@ -395,14 +397,13 @@ static int __devinit tpm_inf_pnp_probe(struct pnp_dev *dev,
                         goto err_last;
                 }
                 /* publish my base address and request region */
-                tpm_inf.base = TPM_INF_BASE;
                 if (request_region
-                    (tpm_inf.base, TPM_INF_PORT_LEN, "tpm_infineon0") == NULL) {
+                    (TPM_INF_BASE, TPM_INF_PORT_LEN, "tpm_infineon0") == NULL) {
                         rc = -EINVAL;
                         goto err_last;
                 }
-                if (request_region(TPM_INF_ADDR, TPM_INF_ADDR_LEN,
-                                "tpm_infineon0") == NULL) {
+                if (request_region
+                    (TPM_INF_ADDR, TPM_INF_ADDR_LEN, "tpm_infineon0") == NULL) {
                         rc = -EINVAL;
                         goto err_last;
                 }
@@ -442,9 +443,9 @@ static int __devinit tpm_inf_pnp_probe(struct pnp_dev *dev,
 
                 /* configure TPM with IO-ports */
                 outb(IOLIMH, TPM_INF_ADDR);
-                outb(((tpm_inf.base >> 8) & 0xff), TPM_INF_DATA);
+                outb(((TPM_INF_BASE >> 8) & 0xff), TPM_INF_DATA);
                 outb(IOLIML, TPM_INF_ADDR);
-                outb((tpm_inf.base & 0xff), TPM_INF_DATA);
+                outb((TPM_INF_BASE & 0xff), TPM_INF_DATA);
 
                 /* control if IO-ports are set correctly */
                 outb(IOLIMH, TPM_INF_ADDR);
@@ -452,10 +453,10 @@ static int __devinit tpm_inf_pnp_probe(struct pnp_dev *dev,
                 outb(IOLIML, TPM_INF_ADDR);
                 iol = inb(TPM_INF_DATA);
 
-                if ((ioh << 8 | iol) != tpm_inf.base) {
+                if ((ioh << 8 | iol) != TPM_INF_BASE) {
                         dev_err(&dev->dev,
-                                "Could not set IO-ports to 0x%lx\n",
-                                tpm_inf.base);
+                                "Could not set IO-ports to 0x%x\n",
+                                TPM_INF_BASE);
                         rc = -EIO;
                         goto err_release_region;
                 }
@@ -466,15 +467,15 @@ static int __devinit tpm_inf_pnp_probe(struct pnp_dev *dev,
                 outb(DISABLE_REGISTER_PAIR, TPM_INF_ADDR);
 
                 /* disable RESET, LP and IRQC */
-                outb(RESET_LP_IRQC_DISABLE, tpm_inf.base + CMD);
+                outb(RESET_LP_IRQC_DISABLE, TPM_INF_BASE + CMD);
 
                 /* Finally, we're done, print some infos */
                 dev_info(&dev->dev, "TPM found: "
                          "config base 0x%x, "
                          "io base 0x%x, "
-                         "chip version %02x%02x, "
-                         "vendor id %x%x (Infineon), "
-                         "product id %02x%02x"
+                         "chip version 0x%02x%02x, "
+                         "vendor id 0x%x%x (Infineon), "
+                         "product id 0x%02x%02x"
                          "%s\n",
                          TPM_INF_ADDR,
                          TPM_INF_BASE,
@@ -482,11 +483,10 @@ static int __devinit tpm_inf_pnp_probe(struct pnp_dev *dev,
                          vendorid[0], vendorid[1],
                          productid[0], productid[1], chipname);
 
-                rc = tpm_register_hardware(&dev->dev, &tpm_inf);
-                if (rc < 0) {
-                        rc = -ENODEV;
+                if (!(chip = tpm_register_hardware(&dev->dev, &tpm_inf))) {
                         goto err_release_region;
                 }
+                chip->vendor.base = TPM_INF_BASE;
                 return 0;
         } else {
                 rc = -ENODEV;
@@ -494,7 +494,7 @@ static int __devinit tpm_inf_pnp_probe(struct pnp_dev *dev,
         }
 
 err_release_region:
-        release_region(tpm_inf.base, TPM_INF_PORT_LEN);
+        release_region(TPM_INF_BASE, TPM_INF_PORT_LEN);
         release_region(TPM_INF_ADDR, TPM_INF_ADDR_LEN);
 
 err_last:
@@ -506,7 +506,8 @@ static __devexit void tpm_inf_pnp_remove(struct pnp_dev *dev)
         struct tpm_chip *chip = pnp_get_drvdata(dev);
 
         if (chip) {
-                release_region(chip->vendor->base, TPM_INF_PORT_LEN);
+                release_region(TPM_INF_BASE, TPM_INF_PORT_LEN);
+                release_region(TPM_INF_ADDR, TPM_INF_ADDR_LEN);
                 tpm_remove_hardware(chip->dev);
         }
 }
@@ -520,7 +521,7 @@ static struct pnp_driver tpm_inf_pnp = {
         },
         .id_table = tpm_pnp_tbl,
         .probe = tpm_inf_pnp_probe,
-        .remove = tpm_inf_pnp_remove,
+        .remove = __devexit_p(tpm_inf_pnp_remove),
 };
 
 static int __init init_inf(void)
@@ -538,5 +539,5 @@ module_exit(cleanup_inf);
 
 MODULE_AUTHOR("Marcel Selhorst <selhorst@crypto.rub.de>");
 MODULE_DESCRIPTION("Driver for Infineon TPM SLD 9630 TT 1.1 / SLB 9635 TT 1.2");
-MODULE_VERSION("1.7");
+MODULE_VERSION("1.8");
 MODULE_LICENSE("GPL");
diff --git a/drivers/char/tpm/tpm_nsc.c b/drivers/char/tpm/tpm_nsc.c
index 680a8e331887..4c8bc06c7d95 100644
--- a/drivers/char/tpm/tpm_nsc.c
+++ b/drivers/char/tpm/tpm_nsc.c
@@ -71,7 +71,7 @@ static int wait_for_stat(struct tpm_chip *chip, u8 mask, u8 val, u8 * data)
         unsigned long stop;
 
         /* status immediately available check */
-        *data = inb(chip->vendor->base + NSC_STATUS);
+        *data = inb(chip->vendor.base + NSC_STATUS);
         if ((*data & mask) == val)
                 return 0;
 
@@ -79,7 +79,7 @@ static int wait_for_stat(struct tpm_chip *chip, u8 mask, u8 val, u8 * data)
         stop = jiffies + 10 * HZ;
         do {
                 msleep(TPM_TIMEOUT);
-                *data = inb(chip->vendor->base + 1);
+                *data = inb(chip->vendor.base + 1);
                 if ((*data & mask) == val)
                         return 0;
         }
@@ -94,9 +94,9 @@ static int nsc_wait_for_ready(struct tpm_chip *chip)
         unsigned long stop;
 
         /* status immediately available check */
-        status = inb(chip->vendor->base + NSC_STATUS);
+        status = inb(chip->vendor.base + NSC_STATUS);
         if (status & NSC_STATUS_OBF)
-                status = inb(chip->vendor->base + NSC_DATA);
+                status = inb(chip->vendor.base + NSC_DATA);
         if (status & NSC_STATUS_RDY)
                 return 0;
 
@@ -104,9 +104,9 @@ static int nsc_wait_for_ready(struct tpm_chip *chip)
         stop = jiffies + 100;
         do {
                 msleep(TPM_TIMEOUT);
-                status = inb(chip->vendor->base + NSC_STATUS);
+                status = inb(chip->vendor.base + NSC_STATUS);
                 if (status & NSC_STATUS_OBF)
-                        status = inb(chip->vendor->base + NSC_DATA);
+                        status = inb(chip->vendor.base + NSC_DATA);
                 if (status & NSC_STATUS_RDY)
                         return 0;
         }
@@ -132,7 +132,7 @@ static int tpm_nsc_recv(struct tpm_chip *chip, u8 * buf, size_t count)
                 return -EIO;
         }
         if ((data =
-             inb(chip->vendor->base + NSC_DATA)) != NSC_COMMAND_NORMAL) {
+             inb(chip->vendor.base + NSC_DATA)) != NSC_COMMAND_NORMAL) {
                 dev_err(chip->dev, "not in normal mode (0x%x)\n",
                         data);
                 return -EIO;
@@ -148,7 +148,7 @@ static int tpm_nsc_recv(struct tpm_chip *chip, u8 * buf, size_t count)
                 }
                 if (data & NSC_STATUS_F0)
                         break;
-                *p = inb(chip->vendor->base + NSC_DATA);
+                *p = inb(chip->vendor.base + NSC_DATA);
         }
 
         if ((data & NSC_STATUS_F0) == 0 &&
@@ -156,7 +156,7 @@ static int tpm_nsc_recv(struct tpm_chip *chip, u8 * buf, size_t count)
                 dev_err(chip->dev, "F0 not set\n");
                 return -EIO;
         }
-        if ((data = inb(chip->vendor->base + NSC_DATA)) != NSC_COMMAND_EOC) {
+        if ((data = inb(chip->vendor.base + NSC_DATA)) != NSC_COMMAND_EOC) {
                 dev_err(chip->dev,
                         "expected end of command(0x%x)\n", data);
                 return -EIO;
@@ -182,7 +182,7 @@ static int tpm_nsc_send(struct tpm_chip *chip, u8 * buf, size_t count)
          * fix it. Not sure why this is needed, we followed the flow
          * chart in the manual to the letter.
          */
-        outb(NSC_COMMAND_CANCEL, chip->vendor->base + NSC_COMMAND);
+        outb(NSC_COMMAND_CANCEL, chip->vendor.base + NSC_COMMAND);
 
         if (nsc_wait_for_ready(chip) != 0)
                 return -EIO;
@@ -192,7 +192,7 @@ static int tpm_nsc_send(struct tpm_chip *chip, u8 * buf, size_t count)
                 return -EIO;
         }
 
-        outb(NSC_COMMAND_NORMAL, chip->vendor->base + NSC_COMMAND);
+        outb(NSC_COMMAND_NORMAL, chip->vendor.base + NSC_COMMAND);
         if (wait_for_stat(chip, NSC_STATUS_IBR, NSC_STATUS_IBR, &data) < 0) {
                 dev_err(chip->dev, "IBR timeout\n");
                 return -EIO;
@@ -204,26 +204,26 @@ static int tpm_nsc_send(struct tpm_chip *chip, u8 * buf, size_t count)
                                 "IBF timeout (while writing data)\n");
                         return -EIO;
                 }
-                outb(buf[i], chip->vendor->base + NSC_DATA);
+                outb(buf[i], chip->vendor.base + NSC_DATA);
         }
 
         if (wait_for_stat(chip, NSC_STATUS_IBF, 0, &data) < 0) {
                 dev_err(chip->dev, "IBF timeout\n");
                 return -EIO;
         }
-        outb(NSC_COMMAND_EOC, chip->vendor->base + NSC_COMMAND);
+        outb(NSC_COMMAND_EOC, chip->vendor.base + NSC_COMMAND);
 
         return count;
 }
 
 static void tpm_nsc_cancel(struct tpm_chip *chip)
 {
-        outb(NSC_COMMAND_CANCEL, chip->vendor->base + NSC_COMMAND);
+        outb(NSC_COMMAND_CANCEL, chip->vendor.base + NSC_COMMAND);
 }
 
 static u8 tpm_nsc_status(struct tpm_chip *chip)
 {
-        return inb(chip->vendor->base + NSC_STATUS);
+        return inb(chip->vendor.base + NSC_STATUS);
 }
 
 static struct file_operations nsc_ops = {
@@ -250,7 +250,7 @@ static struct attribute * nsc_attrs[] = {
 
 static struct attribute_group nsc_attr_grp = { .attrs = nsc_attrs };
 
-static struct tpm_vendor_specific tpm_nsc = {
+static const struct tpm_vendor_specific tpm_nsc = {
         .recv = tpm_nsc_recv,
         .send = tpm_nsc_send,
         .cancel = tpm_nsc_cancel,
@@ -268,7 +268,7 @@ static void __devexit tpm_nsc_remove(struct device *dev)
 {
         struct tpm_chip *chip = dev_get_drvdata(dev);
         if ( chip ) {
-                release_region(chip->vendor->base, 2);
+                release_region(chip->vendor.base, 2);
                 tpm_remove_hardware(chip->dev);
         }
 }
@@ -286,7 +286,8 @@ static int __init init_nsc(void)
         int rc = 0;
         int lo, hi;
         int nscAddrBase = TPM_ADDR;
-
+        struct tpm_chip *chip;
+        unsigned long base;
 
         /* verify that it is a National part (SID) */
         if (tpm_read_index(TPM_ADDR, NSC_SID_INDEX) != 0xEF) {
@@ -300,7 +301,7 @@ static int __init init_nsc(void)
 
         hi = tpm_read_index(nscAddrBase, TPM_NSC_BASE0_HI);
         lo = tpm_read_index(nscAddrBase, TPM_NSC_BASE0_LO);
-        tpm_nsc.base = (hi<<8) | lo;
+        base = (hi<<8) | lo;
 
         /* enable the DPM module */
         tpm_write_index(nscAddrBase, NSC_LDC_INDEX, 0x01);
@@ -320,13 +321,15 @@ static int __init init_nsc(void)
         if ((rc = platform_device_register(pdev)) < 0)
                 goto err_free_dev;
 
-        if (request_region(tpm_nsc.base, 2, "tpm_nsc0") == NULL ) {
+        if (request_region(base, 2, "tpm_nsc0") == NULL ) {
                 rc = -EBUSY;
                 goto err_unreg_dev;
         }
 
-        if ((rc = tpm_register_hardware(&pdev->dev, &tpm_nsc)) < 0)
+        if (!(chip = tpm_register_hardware(&pdev->dev, &tpm_nsc))) {
+                rc = -ENODEV;
                 goto err_rel_reg;
+        }
 
         dev_dbg(&pdev->dev, "NSC TPM detected\n");
         dev_dbg(&pdev->dev,
@@ -361,10 +364,12 @@ static int __init init_nsc(void)
                  "NSC TPM revision %d\n",
                  tpm_read_index(nscAddrBase, 0x27) & 0x1F);
 
+        chip->vendor.base = base;
+
         return 0;
 
 err_rel_reg:
-        release_region(tpm_nsc.base, 2);
+        release_region(base, 2);
 err_unreg_dev:
         platform_device_unregister(pdev);
 err_free_dev:
diff --git a/drivers/char/tpm/tpm_tis.c b/drivers/char/tpm/tpm_tis.c
new file mode 100644
index 000000000000..b9cae9a238bb
--- /dev/null
+++ b/drivers/char/tpm/tpm_tis.c
@@ -0,0 +1,669 @@
+/*
+ * Copyright (C) 2005, 2006 IBM Corporation
+ *
+ * Authors:
+ * Leendert van Doorn <leendert@watson.ibm.com>
+ * Kylene Hall <kjhall@us.ibm.com>
+ *
+ * Device driver for TCG/TCPA TPM (trusted platform module).
+ * Specifications at www.trustedcomputinggroup.org
+ *
+ * This device driver implements the TPM interface as defined in
+ * the TCG TPM Interface Spec version 1.2, revision 1.0.
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License as
+ * published by the Free Software Foundation, version 2 of the
+ * License.
+ */
+#include <linux/init.h>
+#include <linux/module.h>
+#include <linux/moduleparam.h>
+#include <linux/pnp.h>
+#include <linux/interrupt.h>
+#include <linux/wait.h>
+#include "tpm.h"
+
+#define TPM_HEADER_SIZE 10
+
+enum tis_access {
+        TPM_ACCESS_VALID = 0x80,
+        TPM_ACCESS_ACTIVE_LOCALITY = 0x20,
+        TPM_ACCESS_REQUEST_PENDING = 0x04,
+        TPM_ACCESS_REQUEST_USE = 0x02,
+};
+
+enum tis_status {
+        TPM_STS_VALID = 0x80,
+        TPM_STS_COMMAND_READY = 0x40,
+        TPM_STS_GO = 0x20,
+        TPM_STS_DATA_AVAIL = 0x10,
+        TPM_STS_DATA_EXPECT = 0x08,
+};
+
+enum tis_int_flags {
+        TPM_GLOBAL_INT_ENABLE = 0x80000000,
+        TPM_INTF_BURST_COUNT_STATIC = 0x100,
+        TPM_INTF_CMD_READY_INT = 0x080,
+        TPM_INTF_INT_EDGE_FALLING = 0x040,
+        TPM_INTF_INT_EDGE_RISING = 0x020,
+        TPM_INTF_INT_LEVEL_LOW = 0x010,
+        TPM_INTF_INT_LEVEL_HIGH = 0x008,
+        TPM_INTF_LOCALITY_CHANGE_INT = 0x004,
+        TPM_INTF_STS_VALID_INT = 0x002,
+        TPM_INTF_DATA_AVAIL_INT = 0x001,
+};
+
+enum tis_defaults {
+        TIS_MEM_BASE = 0xFED4000,
+        TIS_MEM_LEN = 0x5000,
+        TIS_SHORT_TIMEOUT = 750,        /* ms */
+        TIS_LONG_TIMEOUT = 2000,        /* 2 sec */
+};
+
+#define TPM_ACCESS(l)                   (0x0000 | ((l) << 12))
+#define TPM_INT_ENABLE(l)               (0x0008 | ((l) << 12))
+#define TPM_INT_VECTOR(l)               (0x000C | ((l) << 12))
+#define TPM_INT_STATUS(l)               (0x0010 | ((l) << 12))
+#define TPM_INTF_CAPS(l)                (0x0014 | ((l) << 12))
+#define TPM_STS(l)                      (0x0018 | ((l) << 12))
+#define TPM_DATA_FIFO(l)                (0x0024 | ((l) << 12))
+
+#define TPM_DID_VID(l)                  (0x0F00 | ((l) << 12))
+#define TPM_RID(l)                      (0x0F04 | ((l) << 12))
+
+static LIST_HEAD(tis_chips);
+static DEFINE_SPINLOCK(tis_lock);
+
+static int check_locality(struct tpm_chip *chip, int l)
+{
+        if ((ioread8(chip->vendor.iobase + TPM_ACCESS(l)) &
+             (TPM_ACCESS_ACTIVE_LOCALITY | TPM_ACCESS_VALID)) ==
+            (TPM_ACCESS_ACTIVE_LOCALITY | TPM_ACCESS_VALID))
+                return chip->vendor.locality = l;
+
+        return -1;
+}
+
+static void release_locality(struct tpm_chip *chip, int l, int force)
+{
+        if (force || (ioread8(chip->vendor.iobase + TPM_ACCESS(l)) &
+                      (TPM_ACCESS_REQUEST_PENDING | TPM_ACCESS_VALID)) ==
+            (TPM_ACCESS_REQUEST_PENDING | TPM_ACCESS_VALID))
+                iowrite8(TPM_ACCESS_ACTIVE_LOCALITY,
+                         chip->vendor.iobase + TPM_ACCESS(l));
+}
+
+static int request_locality(struct tpm_chip *chip, int l)
+{
+        unsigned long stop;
+        long rc;
+
+        if (check_locality(chip, l) >= 0)
+                return l;
+
+        iowrite8(TPM_ACCESS_REQUEST_USE,
+                 chip->vendor.iobase + TPM_ACCESS(l));
+
+        if (chip->vendor.irq) {
+                rc = wait_event_interruptible_timeout(chip->vendor.int_queue,
+                                                      (check_locality
+                                                       (chip, l) >= 0),
+                                                      chip->vendor.timeout_a);
+                if (rc > 0)
+                        return l;
+
+        } else {
+                /* wait for burstcount */
+                stop = jiffies + chip->vendor.timeout_a;
+                do {
+                        if (check_locality(chip, l) >= 0)
+                                return l;
+                        msleep(TPM_TIMEOUT);
+                }
+                while (time_before(jiffies, stop));
+        }
+        return -1;
+}
+
+static u8 tpm_tis_status(struct tpm_chip *chip)
+{
+        return ioread8(chip->vendor.iobase +
+                       TPM_STS(chip->vendor.locality));
+}
+
+static void tpm_tis_ready(struct tpm_chip *chip)
+{
+        /* this causes the current command to be aborted */
+        iowrite8(TPM_STS_COMMAND_READY,
+                 chip->vendor.iobase + TPM_STS(chip->vendor.locality));
+}
+
+static int get_burstcount(struct tpm_chip *chip)
+{
+        unsigned long stop;
+        int burstcnt;
+
+        /* wait for burstcount */
+        /* which timeout value, spec has 2 answers (c & d) */
+        stop = jiffies + chip->vendor.timeout_d;
+        do {
+                burstcnt = ioread8(chip->vendor.iobase +
+                                   TPM_STS(chip->vendor.locality) + 1);
+                burstcnt += ioread8(chip->vendor.iobase +
+                                    TPM_STS(chip->vendor.locality) +
+                                    2) << 8;
+                if (burstcnt)
+                        return burstcnt;
+                msleep(TPM_TIMEOUT);
+        } while (time_before(jiffies, stop));
+        return -EBUSY;
+}
+
+static int wait_for_stat(struct tpm_chip *chip, u8 mask, unsigned long timeout,
+                         wait_queue_head_t *queue)
+{
+        unsigned long stop;
+        long rc;
+        u8 status;
+
+        /* check current status */
+        status = tpm_tis_status(chip);
+        if ((status & mask) == mask)
+                return 0;
+
+        if (chip->vendor.irq) {
+                rc = wait_event_interruptible_timeout(*queue,
+                                                      ((tpm_tis_status
+                                                        (chip) & mask) ==
+                                                       mask), timeout);
+                if (rc > 0)
+                        return 0;
+        } else {
+                stop = jiffies + timeout;
+                do {
+                        msleep(TPM_TIMEOUT);
+                        status = tpm_tis_status(chip);
+                        if ((status & mask) == mask)
+                                return 0;
+                } while (time_before(jiffies, stop));
+        }
+        return -ETIME;
+}
+
+static int recv_data(struct tpm_chip *chip, u8 *buf, size_t count)
+{
+        int size = 0, burstcnt;
+        while (size < count &&
+               wait_for_stat(chip,
+                             TPM_STS_DATA_AVAIL | TPM_STS_VALID,
+                             chip->vendor.timeout_c,
+                             &chip->vendor.read_queue)
+               == 0) {
+                burstcnt = get_burstcount(chip);
+                for (; burstcnt > 0 && size < count; burstcnt--)
+                        buf[size++] = ioread8(chip->vendor.iobase +
+                                              TPM_DATA_FIFO(chip->vendor.
+                                                            locality));
+        }
+        return size;
+}
+
+static int tpm_tis_recv(struct tpm_chip *chip, u8 *buf, size_t count)
+{
+        int size = 0;
+        int expected, status;
+
+        if (count < TPM_HEADER_SIZE) {
+                size = -EIO;
+                goto out;
+        }
+
+        /* read first 10 bytes, including tag, paramsize, and result */
+        if ((size =
+             recv_data(chip, buf, TPM_HEADER_SIZE)) < TPM_HEADER_SIZE) {
+                dev_err(chip->dev, "Unable to read header\n");
+                goto out;
+        }
+
+        expected = be32_to_cpu(*(__be32 *) (buf + 2));
+        if (expected > count) {
+                size = -EIO;
+                goto out;
+        }
+
+        if ((size +=
+             recv_data(chip, &buf[TPM_HEADER_SIZE],
+                       expected - TPM_HEADER_SIZE)) < expected) {
+                dev_err(chip->dev, "Unable to read remainder of result\n");
+                size = -ETIME;
+                goto out;
+        }
+
+        wait_for_stat(chip, TPM_STS_VALID, chip->vendor.timeout_c,
+                      &chip->vendor.int_queue);
+        status = tpm_tis_status(chip);
+        if (status & TPM_STS_DATA_AVAIL) {      /* retry? */
+                dev_err(chip->dev, "Error left over data\n");
+                size = -EIO;
+                goto out;
+        }
+
+out:
+        tpm_tis_ready(chip);
+        release_locality(chip, chip->vendor.locality, 0);
+        return size;
+}
+
+/*
+ * If interrupts are used (signaled by an irq set in the vendor structure)
+ * tpm.c can skip polling for the data to be available as the interrupt is
+ * waited for here
+ */
+static int tpm_tis_send(struct tpm_chip *chip, u8 *buf, size_t len)
+{
+        int rc, status, burstcnt;
+        size_t count = 0;
+        u32 ordinal;
+
+        if (request_locality(chip, 0) < 0)
+                return -EBUSY;
+
+        status = tpm_tis_status(chip);
+        if ((status & TPM_STS_COMMAND_READY) == 0) {
+                tpm_tis_ready(chip);
+                if (wait_for_stat
+                    (chip, TPM_STS_COMMAND_READY, chip->vendor.timeout_b,
+                     &chip->vendor.int_queue) < 0) {
+                        rc = -ETIME;
+                        goto out_err;
+                }
+        }
+
+        while (count < len - 1) {
+                burstcnt = get_burstcount(chip);
+                for (; burstcnt > 0 && count < len - 1; burstcnt--) {
+                        iowrite8(buf[count], chip->vendor.iobase +
+                                 TPM_DATA_FIFO(chip->vendor.locality));
+                        count++;
+                }
+
+                wait_for_stat(chip, TPM_STS_VALID, chip->vendor.timeout_c,
+                              &chip->vendor.int_queue);
+                status = tpm_tis_status(chip);
+                if ((status & TPM_STS_DATA_EXPECT) == 0) {
+                        rc = -EIO;
+                        goto out_err;
+                }
+        }
+
+        /* write last byte */
+        iowrite8(buf[count],
+                 chip->vendor.iobase +
+                 TPM_DATA_FIFO(chip->vendor.locality));
+        wait_for_stat(chip, TPM_STS_VALID, chip->vendor.timeout_c,
+                      &chip->vendor.int_queue);
+        status = tpm_tis_status(chip);
+        if ((status & TPM_STS_DATA_EXPECT) != 0) {
+                rc = -EIO;
+                goto out_err;
+        }
+
+        /* go and do it */
+        iowrite8(TPM_STS_GO,
+                 chip->vendor.iobase + TPM_STS(chip->vendor.locality));
+
+        if (chip->vendor.irq) {
+                ordinal = be32_to_cpu(*((__be32 *) (buf + 6)));
+                if (wait_for_stat
+                    (chip, TPM_STS_DATA_AVAIL | TPM_STS_VALID,
+                     tpm_calc_ordinal_duration(chip, ordinal),
+                     &chip->vendor.read_queue) < 0) {
+                        rc = -ETIME;
+                        goto out_err;
+                }
+        }
+        return len;
+out_err:
+        tpm_tis_ready(chip);
+        release_locality(chip, chip->vendor.locality, 0);
+        return rc;
+}
+
+static struct file_operations tis_ops = {
+        .owner = THIS_MODULE,
+        .llseek = no_llseek,
+        .open = tpm_open,
+        .read = tpm_read,
+        .write = tpm_write,
+        .release = tpm_release,
+};
+
+static DEVICE_ATTR(pubek, S_IRUGO, tpm_show_pubek, NULL);
+static DEVICE_ATTR(pcrs, S_IRUGO, tpm_show_pcrs, NULL);
+static DEVICE_ATTR(enabled, S_IRUGO, tpm_show_enabled, NULL);
+static DEVICE_ATTR(active, S_IRUGO, tpm_show_active, NULL);
+static DEVICE_ATTR(owned, S_IRUGO, tpm_show_owned, NULL);
+static DEVICE_ATTR(temp_deactivated, S_IRUGO, tpm_show_temp_deactivated,
+                   NULL);
+static DEVICE_ATTR(caps, S_IRUGO, tpm_show_caps_1_2, NULL);
+static DEVICE_ATTR(cancel, S_IWUSR | S_IWGRP, NULL, tpm_store_cancel);
+
+static struct attribute *tis_attrs[] = {
+        &dev_attr_pubek.attr,
+        &dev_attr_pcrs.attr,
+        &dev_attr_enabled.attr,
+        &dev_attr_active.attr,
+        &dev_attr_owned.attr,
+        &dev_attr_temp_deactivated.attr,
+        &dev_attr_caps.attr,
+        &dev_attr_cancel.attr, NULL,
+};
+
+static struct attribute_group tis_attr_grp = {
+        .attrs = tis_attrs
+};
+
+static struct tpm_vendor_specific tpm_tis = {
+        .status = tpm_tis_status,
+        .recv = tpm_tis_recv,
+        .send = tpm_tis_send,
+        .cancel = tpm_tis_ready,
+        .req_complete_mask = TPM_STS_DATA_AVAIL | TPM_STS_VALID,
+        .req_complete_val = TPM_STS_DATA_AVAIL | TPM_STS_VALID,
+        .req_canceled = TPM_STS_COMMAND_READY,
+        .attr_group = &tis_attr_grp,
+        .miscdev = {
+                    .fops = &tis_ops,},
+};
+
+static irqreturn_t tis_int_probe(int irq, void *dev_id, struct pt_regs *regs)
+{
+        struct tpm_chip *chip = (struct tpm_chip *) dev_id;
+        u32 interrupt;
+
+        interrupt = ioread32(chip->vendor.iobase +
+                             TPM_INT_STATUS(chip->vendor.locality));
+
+        if (interrupt == 0)
+                return IRQ_NONE;
+
+        chip->vendor.irq = irq;
+
+        /* Clear interrupts handled with TPM_EOI */
+        iowrite32(interrupt,
+                  chip->vendor.iobase +
+                  TPM_INT_STATUS(chip->vendor.locality));
+        return IRQ_HANDLED;
+}
+
+static irqreturn_t tis_int_handler(int irq, void *dev_id, struct pt_regs *regs)
+{
+        struct tpm_chip *chip = (struct tpm_chip *) dev_id;
+        u32 interrupt;
+        int i;
+
+        interrupt = ioread32(chip->vendor.iobase +
+                             TPM_INT_STATUS(chip->vendor.locality));
+
+        if (interrupt == 0)
+                return IRQ_NONE;
+
+        if (interrupt & TPM_INTF_DATA_AVAIL_INT)
+                wake_up_interruptible(&chip->vendor.read_queue);
+        if (interrupt & TPM_INTF_LOCALITY_CHANGE_INT)
+                for (i = 0; i < 5; i++)
+                        if (check_locality(chip, i) >= 0)
+                                break;
+        if (interrupt &
+            (TPM_INTF_LOCALITY_CHANGE_INT | TPM_INTF_STS_VALID_INT |
+             TPM_INTF_CMD_READY_INT))
+                wake_up_interruptible(&chip->vendor.int_queue);
+
+        /* Clear interrupts handled with TPM_EOI */
+        iowrite32(interrupt,
+                  chip->vendor.iobase +
+                  TPM_INT_STATUS(chip->vendor.locality));
+        return IRQ_HANDLED;
+}
+
+static int interrupts = 1;
+module_param(interrupts, bool, 0444);
+MODULE_PARM_DESC(interrupts, "Enable interrupts");
+
+static int __devinit tpm_tis_pnp_init(struct pnp_dev *pnp_dev,
+                                      const struct pnp_device_id *pnp_id)
+{
+        u32 vendor, intfcaps, intmask;
+        int rc, i;
+        unsigned long start, len;
+        struct tpm_chip *chip;
+
+        start = pnp_mem_start(pnp_dev, 0);
+        len = pnp_mem_len(pnp_dev, 0);
+
+        if (!start)
+                start = TIS_MEM_BASE;
+        if (!len)
+                len = TIS_MEM_LEN;
+
+        if (!(chip = tpm_register_hardware(&pnp_dev->dev, &tpm_tis)))
+                return -ENODEV;
+
+        chip->vendor.iobase = ioremap(start, len);
+        if (!chip->vendor.iobase) {
+                rc = -EIO;
+                goto out_err;
+        }
+
+        vendor = ioread32(chip->vendor.iobase + TPM_DID_VID(0));
+        if ((vendor & 0xFFFF) == 0xFFFF) {
+                rc = -ENODEV;
+                goto out_err;
+        }
+
+        /* Default timeouts */
+        chip->vendor.timeout_a = msecs_to_jiffies(TIS_SHORT_TIMEOUT);
+        chip->vendor.timeout_b = msecs_to_jiffies(TIS_LONG_TIMEOUT);
+        chip->vendor.timeout_c = msecs_to_jiffies(TIS_SHORT_TIMEOUT);
+        chip->vendor.timeout_d = msecs_to_jiffies(TIS_SHORT_TIMEOUT);
+
+        dev_info(&pnp_dev->dev,
+                 "1.2 TPM (device-id 0x%X, rev-id %d)\n",
+                 vendor >> 16, ioread8(chip->vendor.iobase + TPM_RID(0)));
+
+        /* Figure out the capabilities */
+        intfcaps =
+            ioread32(chip->vendor.iobase +
+                     TPM_INTF_CAPS(chip->vendor.locality));
+        dev_dbg(&pnp_dev->dev, "TPM interface capabilities (0x%x):\n",
+                intfcaps);
+        if (intfcaps & TPM_INTF_BURST_COUNT_STATIC)
+                dev_dbg(&pnp_dev->dev, "\tBurst Count Static\n");
+        if (intfcaps & TPM_INTF_CMD_READY_INT)
+                dev_dbg(&pnp_dev->dev, "\tCommand Ready Int Support\n");
+        if (intfcaps & TPM_INTF_INT_EDGE_FALLING)
+                dev_dbg(&pnp_dev->dev, "\tInterrupt Edge Falling\n");
+        if (intfcaps & TPM_INTF_INT_EDGE_RISING)
+                dev_dbg(&pnp_dev->dev, "\tInterrupt Edge Rising\n");
+        if (intfcaps & TPM_INTF_INT_LEVEL_LOW)
+                dev_dbg(&pnp_dev->dev, "\tInterrupt Level Low\n");
+        if (intfcaps & TPM_INTF_INT_LEVEL_HIGH)
+                dev_dbg(&pnp_dev->dev, "\tInterrupt Level High\n");
+        if (intfcaps & TPM_INTF_LOCALITY_CHANGE_INT)
+                dev_dbg(&pnp_dev->dev, "\tLocality Change Int Support\n");
+        if (intfcaps & TPM_INTF_STS_VALID_INT)
+                dev_dbg(&pnp_dev->dev, "\tSts Valid Int Support\n");
+        if (intfcaps & TPM_INTF_DATA_AVAIL_INT)
+                dev_dbg(&pnp_dev->dev, "\tData Avail Int Support\n");
+
+        if (request_locality(chip, 0) != 0) {
+                rc = -ENODEV;
+                goto out_err;
+        }
+
+        /* INTERRUPT Setup */
+        init_waitqueue_head(&chip->vendor.read_queue);
+        init_waitqueue_head(&chip->vendor.int_queue);
+
+        intmask =
+            ioread32(chip->vendor.iobase +
+                     TPM_INT_ENABLE(chip->vendor.locality));
+
+        intmask |= TPM_INTF_CMD_READY_INT
+            | TPM_INTF_LOCALITY_CHANGE_INT | TPM_INTF_DATA_AVAIL_INT
+            | TPM_INTF_STS_VALID_INT;
+
+        iowrite32(intmask,
+                  chip->vendor.iobase +
+                  TPM_INT_ENABLE(chip->vendor.locality));
+        if (interrupts) {
+                chip->vendor.irq =
+                    ioread8(chip->vendor.iobase +
+                            TPM_INT_VECTOR(chip->vendor.locality));
+
+                for (i = 3; i < 16 && chip->vendor.irq == 0; i++) {
+                        iowrite8(i, chip->vendor.iobase +
+                                    TPM_INT_VECTOR(chip->vendor.locality));
+                        if (request_irq
+                            (i, tis_int_probe, SA_SHIRQ,
+                             chip->vendor.miscdev.name, chip) != 0) {
+                                dev_info(chip->dev,
+                                         "Unable to request irq: %d for probe\n",
+                                         i);
+                                continue;
+                        }
+
+                        /* Clear all existing */
+                        iowrite32(ioread32
+                                  (chip->vendor.iobase +
+                                   TPM_INT_STATUS(chip->vendor.locality)),
+                                  chip->vendor.iobase +
+                                  TPM_INT_STATUS(chip->vendor.locality));
+
+                        /* Turn on */
+                        iowrite32(intmask | TPM_GLOBAL_INT_ENABLE,
+                                  chip->vendor.iobase +
+                                  TPM_INT_ENABLE(chip->vendor.locality));
+
+                        /* Generate Interrupts */
+                        tpm_gen_interrupt(chip);
+
+                        /* Turn off */
+                        iowrite32(intmask,
+                                  chip->vendor.iobase +
+                                  TPM_INT_ENABLE(chip->vendor.locality));
+                        free_irq(i, chip);
+                }
+        }
+        if (chip->vendor.irq) {
+                iowrite8(chip->vendor.irq,
+                         chip->vendor.iobase +
+                         TPM_INT_VECTOR(chip->vendor.locality));
+                if (request_irq
+                    (chip->vendor.irq, tis_int_handler, SA_SHIRQ,
+                     chip->vendor.miscdev.name, chip) != 0) {
+                        dev_info(chip->dev,
+                                 "Unable to request irq: %d for use\n",
+                                 chip->vendor.irq);
+                        chip->vendor.irq = 0;
+                } else {
+                        /* Clear all existing */
+                        iowrite32(ioread32
+                                  (chip->vendor.iobase +
+                                   TPM_INT_STATUS(chip->vendor.locality)),
+                                  chip->vendor.iobase +
+                                  TPM_INT_STATUS(chip->vendor.locality));
+
+                        /* Turn on */
+                        iowrite32(intmask | TPM_GLOBAL_INT_ENABLE,
+                                  chip->vendor.iobase +
+                                  TPM_INT_ENABLE(chip->vendor.locality));
+                }
+        }
+
+        INIT_LIST_HEAD(&chip->vendor.list);
+        spin_lock(&tis_lock);
+        list_add(&chip->vendor.list, &tis_chips);
+        spin_unlock(&tis_lock);
+
+        tpm_get_timeouts(chip);
+        tpm_continue_selftest(chip);
+
+        return 0;
+out_err:
+        if (chip->vendor.iobase)
+                iounmap(chip->vendor.iobase);
+        tpm_remove_hardware(chip->dev);
+        return rc;
+}
+
+static int tpm_tis_pnp_suspend(struct pnp_dev *dev, pm_message_t msg)
+{
+        return tpm_pm_suspend(&dev->dev, msg);
+}
+
+static int tpm_tis_pnp_resume(struct pnp_dev *dev)
+{
+        return tpm_pm_resume(&dev->dev);
+}
+
+static struct pnp_device_id tpm_pnp_tbl[] __devinitdata = {
+        {"PNP0C31", 0},         /* TPM */
+        {"ATM1200", 0},         /* Atmel */
+        {"IFX0102", 0},         /* Infineon */
+        {"BCM0101", 0},         /* Broadcom */
+        {"NSC1200", 0},         /* National */
+        /* Add new here */
+        {"", 0},                /* User Specified */
+        {"", 0}                 /* Terminator */
+};
+
+static struct pnp_driver tis_pnp_driver = {
+        .name = "tpm_tis",
+        .id_table = tpm_pnp_tbl,
+        .probe = tpm_tis_pnp_init,
+        .suspend = tpm_tis_pnp_suspend,
+        .resume = tpm_tis_pnp_resume,
+};
+
+#define TIS_HID_USR_IDX sizeof(tpm_pnp_tbl)/sizeof(struct pnp_device_id) -2
+module_param_string(hid, tpm_pnp_tbl[TIS_HID_USR_IDX].id,
+                    sizeof(tpm_pnp_tbl[TIS_HID_USR_IDX].id), 0444);
+MODULE_PARM_DESC(hid, "Set additional specific HID for this driver to probe");
+
+static int __init init_tis(void)
+{
+        return pnp_register_driver(&tis_pnp_driver);
+}
+
+static void __exit cleanup_tis(void)
+{
+        struct tpm_vendor_specific *i, *j;
+        struct tpm_chip *chip;
+        spin_lock(&tis_lock);
+        list_for_each_entry_safe(i, j, &tis_chips, list) {
+                chip = to_tpm_chip(i);
+                iowrite32(~TPM_GLOBAL_INT_ENABLE &
+                          ioread32(chip->vendor.iobase +
+                                   TPM_INT_ENABLE(chip->vendor.
+                                                  locality)),
+                          chip->vendor.iobase +
+                          TPM_INT_ENABLE(chip->vendor.locality));
+                release_locality(chip, chip->vendor.locality, 1);
+                if (chip->vendor.irq)
+                        free_irq(chip->vendor.irq, chip);
+                iounmap(i->iobase);
+                list_del(&i->list);
+                tpm_remove_hardware(chip->dev);
+        }
+        spin_unlock(&tis_lock);
+        pnp_unregister_driver(&tis_pnp_driver);
+}
+
+module_init(init_tis);
+module_exit(cleanup_tis);
+MODULE_AUTHOR("Leendert van Doorn (leendert@watson.ibm.com)");
+MODULE_DESCRIPTION("TPM Driver");
+MODULE_VERSION("2.0");
+MODULE_LICENSE("GPL");
diff --git a/drivers/cpufreq/cpufreq.c b/drivers/cpufreq/cpufreq.c
index 9759d05b1972..29b2fa5534ae 100644
--- a/drivers/cpufreq/cpufreq.c
+++ b/drivers/cpufreq/cpufreq.c
@@ -1497,7 +1497,7 @@ int cpufreq_update_policy(unsigned int cpu)
 }
 EXPORT_SYMBOL(cpufreq_update_policy);
 
-static int __cpuinit cpufreq_cpu_callback(struct notifier_block *nfb,
+static int cpufreq_cpu_callback(struct notifier_block *nfb,
                                         unsigned long action, void *hcpu)
 {
         unsigned int cpu = (unsigned long)hcpu;
diff --git a/drivers/cpufreq/cpufreq_ondemand.c b/drivers/cpufreq/cpufreq_ondemand.c
index 956d121cb161..3e6ffcaa5af4 100644
--- a/drivers/cpufreq/cpufreq_ondemand.c
+++ b/drivers/cpufreq/cpufreq_ondemand.c
@@ -74,6 +74,8 @@ static unsigned int dbs_enable;	/* number of CPUs using this policy */
 static DEFINE_MUTEX (dbs_mutex);
 static DECLARE_WORK     (dbs_work, do_dbs_timer, NULL);
 
+static struct workqueue_struct *dbs_workq;
+
 struct dbs_tuners {
         unsigned int sampling_rate;
         unsigned int sampling_down_factor;
@@ -364,23 +366,29 @@ static void do_dbs_timer(void *data)
         mutex_lock(&dbs_mutex);
         for_each_online_cpu(i)
                 dbs_check_cpu(i);
-        schedule_delayed_work(&dbs_work,
-                        usecs_to_jiffies(dbs_tuners_ins.sampling_rate));
+        queue_delayed_work(dbs_workq, &dbs_work,
+                           usecs_to_jiffies(dbs_tuners_ins.sampling_rate));
         mutex_unlock(&dbs_mutex);
 }
 
 static inline void dbs_timer_init(void)
 {
         INIT_WORK(&dbs_work, do_dbs_timer, NULL);
-        schedule_delayed_work(&dbs_work,
-                        usecs_to_jiffies(dbs_tuners_ins.sampling_rate));
+        if (!dbs_workq)
+                dbs_workq = create_singlethread_workqueue("ondemand");
+        if (!dbs_workq) {
+                printk(KERN_ERR "ondemand: Cannot initialize kernel thread\n");
+                return;
+        }
+        queue_delayed_work(dbs_workq, &dbs_work,
+                           usecs_to_jiffies(dbs_tuners_ins.sampling_rate));
         return;
 }
 
 static inline void dbs_timer_exit(void)
 {
-        cancel_delayed_work(&dbs_work);
-        return;
+        if (dbs_workq)
+                cancel_rearming_delayed_workqueue(dbs_workq, &dbs_work);
 }
 
 static int cpufreq_governor_dbs(struct cpufreq_policy *policy,
@@ -489,8 +497,12 @@ static int __init cpufreq_gov_dbs_init(void)
 
 static void __exit cpufreq_gov_dbs_exit(void)
 {
-        /* Make sure that the scheduled work is indeed not running */
-        flush_scheduled_work();
+        /* Make sure that the scheduled work is indeed not running.
+           Assumes the timer has been cancelled first. */
+        if (dbs_workq) {
+                flush_workqueue(dbs_workq);
+                destroy_workqueue(dbs_workq);
+        }
 
         cpufreq_unregister_governor(&cpufreq_gov_dbs);
 }
diff --git a/drivers/edac/e752x_edac.c b/drivers/edac/e752x_edac.c
index 66572c5323ad..fce31936e6d7 100644
--- a/drivers/edac/e752x_edac.c
+++ b/drivers/edac/e752x_edac.c
@@ -25,6 +25,8 @@
 #include <linux/slab.h>
 #include "edac_mc.h"
 
+static int force_function_unhide;
+
 #define e752x_printk(level, fmt, arg...) \
         edac_printk(level, "e752x", fmt, ##arg)
 
@@ -782,8 +784,16 @@ static int e752x_probe1(struct pci_dev *pdev, int dev_idx)
         debugf0("%s(): mci\n", __func__);
         debugf0("Starting Probe1\n");
 
-        /* enable device 0 function 1 */
+        /* check to see if device 0 function 1 is enabled; if it isn't, we
+         * assume the BIOS has reserved it for a reason and is expecting
+         * exclusive access, we take care not to violate that assumption and
+         * fail the probe. */
         pci_read_config_byte(pdev, E752X_DEVPRES1, &stat8);
+        if (!force_function_unhide && !(stat8 & (1 << 5))) {
+                printk(KERN_INFO "Contact your BIOS vendor to see if the "
+                        "E752x error registers can be safely un-hidden\n");
+                goto fail;
+        }
         stat8 |= (1 << 5);
         pci_write_config_byte(pdev, E752X_DEVPRES1, stat8);
 
@@ -1063,3 +1073,8 @@ module_exit(e752x_exit);
 MODULE_LICENSE("GPL");
 MODULE_AUTHOR("Linux Networx (http://lnxi.com) Tom Zimmerman\n");
 MODULE_DESCRIPTION("MC support for Intel e752x memory controllers");
+
+module_param(force_function_unhide, int, 0444);
+MODULE_PARM_DESC(force_function_unhide, "if BIOS sets Dev0:Fun1 up as hidden:"
+" 1=force unhide and hope BIOS doesn't fight driver for Dev0:Fun1 access");
+
diff --git a/drivers/i2c/busses/i2c-i801.c b/drivers/i2c/busses/i2c-i801.c
index 8e0f3158215f..dfca74933625 100644
--- a/drivers/i2c/busses/i2c-i801.c
+++ b/drivers/i2c/busses/i2c-i801.c
@@ -478,6 +478,11 @@ static s32 i801_access(struct i2c_adapter * adap, u16 addr,
                 ret = i801_transaction();
         }
 
+        /* Some BIOSes don't like it when PEC is enabled at reboot or resume
+           time, so we forcibly disable it after every transaction. */
+        if (hwpec)
+                outb_p(0, SMBAUXCTL);
+
         if(block)
                 return ret;
         if(ret)
diff --git a/drivers/infiniband/core/sysfs.c b/drivers/infiniband/core/sysfs.c
index 15121cb5a1f6..21f9282c1b25 100644
--- a/drivers/infiniband/core/sysfs.c
+++ b/drivers/infiniband/core/sysfs.c
@@ -336,7 +336,7 @@ static ssize_t show_pma_counter(struct ib_port *p, struct port_attribute *attr,
         switch (width) {
         case 4:
                 ret = sprintf(buf, "%u\n", (out_mad->data[40 + offset / 8] >>
-                                            (offset % 4)) & 0xf);
+                                            (4 - (offset % 8))) & 0xf);
                 break;
         case 8:
                 ret = sprintf(buf, "%u\n", out_mad->data[40 + offset / 8]);
diff --git a/drivers/infiniband/hw/ipath/ipath_debug.h b/drivers/infiniband/hw/ipath/ipath_debug.h
index 593e28969c69..46762387f5f8 100644
--- a/drivers/infiniband/hw/ipath/ipath_debug.h
+++ b/drivers/infiniband/hw/ipath/ipath_debug.h
@@ -60,11 +60,11 @@
 #define __IPATH_KERNEL_SEND 0x2000      /* use kernel mode send */
 #define __IPATH_EPKTDBG     0x4000      /* print ethernet packet data */
 #define __IPATH_SMADBG      0x8000      /* sma packet debug */
-#define __IPATH_IPATHDBG    0x10000     /* Ethernet (IPATH) general debug on */
-#define __IPATH_IPATHWARN   0x20000     /* Ethernet (IPATH) warnings on */
-#define __IPATH_IPATHERR    0x40000     /* Ethernet (IPATH) errors on */
-#define __IPATH_IPATHPD     0x80000     /* Ethernet (IPATH) packet dump on */
-#define __IPATH_IPATHTABLE  0x100000    /* Ethernet (IPATH) table dump on */
+#define __IPATH_IPATHDBG    0x10000     /* Ethernet (IPATH) gen debug */
+#define __IPATH_IPATHWARN   0x20000     /* Ethernet (IPATH) warnings */
+#define __IPATH_IPATHERR    0x40000     /* Ethernet (IPATH) errors */
+#define __IPATH_IPATHPD     0x80000     /* Ethernet (IPATH) packet dump */
+#define __IPATH_IPATHTABLE  0x100000    /* Ethernet (IPATH) table dump */
 
 #else                           /* _IPATH_DEBUGGING */
 
@@ -79,11 +79,12 @@
 #define __IPATH_TRSAMPLE  0x0   /* generate trace buffer sample entries */
 #define __IPATH_VERBDBG   0x0   /* very verbose debug */
 #define __IPATH_PKTDBG    0x0   /* print packet data */
-#define __IPATH_PROCDBG   0x0   /* print process startup (init)/exit messages */
+#define __IPATH_PROCDBG   0x0   /* process startup (init)/exit messages */
 /* print mmap/nopage stuff, not using VDBG any more */
 #define __IPATH_MMDBG     0x0
 #define __IPATH_EPKTDBG   0x0   /* print ethernet packet data */
-#define __IPATH_SMADBG    0x0   /* print process startup (init)/exit messages */#define __IPATH_IPATHDBG  0x0   /* Ethernet (IPATH) table dump on */
+#define __IPATH_SMADBG    0x0   /* process startup (init)/exit messages */
+#define __IPATH_IPATHDBG  0x0   /* Ethernet (IPATH) table dump on */
 #define __IPATH_IPATHWARN 0x0   /* Ethernet (IPATH) warnings on   */
 #define __IPATH_IPATHERR  0x0   /* Ethernet (IPATH) errors on   */
 #define __IPATH_IPATHPD   0x0   /* Ethernet (IPATH) packet dump on   */
diff --git a/drivers/infiniband/hw/ipath/ipath_diag.c b/drivers/infiniband/hw/ipath/ipath_diag.c
index 7d3fb6996b41..28ddceb260e8 100644
--- a/drivers/infiniband/hw/ipath/ipath_diag.c
+++ b/drivers/infiniband/hw/ipath/ipath_diag.c
@@ -277,13 +277,14 @@ static int ipath_diag_open(struct inode *in, struct file *fp)
 
 bail:
         spin_unlock_irqrestore(&ipath_devs_lock, flags);
-        mutex_unlock(&ipath_mutex);
 
         /* Only expose a way to reset the device if we
            make it into diag mode. */
         if (ret == 0)
                 ipath_expose_reset(&dd->pcidev->dev);
 
+        mutex_unlock(&ipath_mutex);
+
         return ret;
 }
 
diff --git a/drivers/infiniband/hw/ipath/ipath_driver.c b/drivers/infiniband/hw/ipath/ipath_driver.c
index e7617c3982ea..398add4d4cb1 100644
--- a/drivers/infiniband/hw/ipath/ipath_driver.c
+++ b/drivers/infiniband/hw/ipath/ipath_driver.c
@@ -418,9 +418,19 @@ static int __devinit ipath_init_one(struct pci_dev *pdev,
 
         ret = pci_set_dma_mask(pdev, DMA_64BIT_MASK);
         if (ret) {
-                dev_info(&pdev->dev, "pci_set_dma_mask unit %u "
-                         "fails: %d\n", dd->ipath_unit, ret);
-                goto bail_regions;
+                /*
+                 * if the 64 bit setup fails, try 32 bit.  Some systems
+                 * do not setup 64 bit maps on systems with 2GB or less
+                 * memory installed.
+                 */
+                ret = pci_set_dma_mask(pdev, DMA_32BIT_MASK);
+                if (ret) {
+                        dev_info(&pdev->dev, "pci_set_dma_mask unit %u "
+                                 "fails: %d\n", dd->ipath_unit, ret);
+                        goto bail_regions;
+                }
+                else
+                        ipath_dbg("No 64bit DMA mask, used 32 bit mask\n");
         }
 
         pci_set_master(pdev);
@@ -1949,7 +1959,7 @@ int ipath_reset_device(int unit)
         }
 
         if (dd->ipath_pd)
-                for (i = 1; i < dd->ipath_portcnt; i++) {
+                for (i = 1; i < dd->ipath_cfgports; i++) {
                         if (dd->ipath_pd[i] && dd->ipath_pd[i]->port_cnt) {
                                 ipath_dbg("unit %u port %d is in use "
                                           "(PID %u cmd %s), can't reset\n",
diff --git a/drivers/infiniband/hw/ipath/ipath_init_chip.c b/drivers/infiniband/hw/ipath/ipath_init_chip.c
index 2823ff9c0c62..16f640e1c16e 100644
--- a/drivers/infiniband/hw/ipath/ipath_init_chip.c
+++ b/drivers/infiniband/hw/ipath/ipath_init_chip.c
@@ -53,13 +53,19 @@ MODULE_PARM_DESC(cfgports, "Set max number of ports to use");
 
 /*
  * Number of buffers reserved for driver (layered drivers and SMA
- * send).  Reserved at end of buffer list.
+ * send).  Reserved at end of buffer list.   Initialized based on
+ * number of PIO buffers if not set via module interface.
+ * The problem with this is that it's global, but we'll use different
+ * numbers for different chip types.  So the default value is not
+ * very useful.  I've redefined it for the 1.3 release so that it's
+ * zero unless set by the user to something else, in which case we
+ * try to respect it.
  */
-static ushort ipath_kpiobufs = 32;
+static ushort ipath_kpiobufs;
 
 static int ipath_set_kpiobufs(const char *val, struct kernel_param *kp);
 
-module_param_call(kpiobufs, ipath_set_kpiobufs, param_get_uint,
+module_param_call(kpiobufs, ipath_set_kpiobufs, param_get_ushort,
                   &ipath_kpiobufs, S_IWUSR | S_IRUGO);
 MODULE_PARM_DESC(kpiobufs, "Set number of PIO buffers for driver");
 
@@ -531,8 +537,11 @@ static int init_housekeeping(struct ipath_devdata *dd,
          * Don't clear ipath_flags as 8bit mode was set before
          * entering this func. However, we do set the linkstate to
          * unknown, so we can watch for a transition.
+         * PRESENT is set because we want register reads to work,
+         * and the kernel infrastructure saw it in config space;
+         * We clear it if we have failures.
          */
-        dd->ipath_flags |= IPATH_LINKUNK;
+        dd->ipath_flags |= IPATH_LINKUNK | IPATH_PRESENT;
         dd->ipath_flags &= ~(IPATH_LINKACTIVE | IPATH_LINKARMED |
                              IPATH_LINKDOWN | IPATH_LINKINIT);
 
@@ -560,6 +569,7 @@ static int init_housekeeping(struct ipath_devdata *dd,
             || (dd->ipath_uregbase & 0xffffffff) == 0xffffffff) {
                 ipath_dev_err(dd, "Register read failures from chip, "
                               "giving up initialization\n");
+                dd->ipath_flags &= ~IPATH_PRESENT;
                 ret = -ENODEV;
                 goto done;
         }
@@ -682,16 +692,14 @@ int ipath_init_chip(struct ipath_devdata *dd, int reinit)
          */
         dd->ipath_pioavregs = ALIGN(val, sizeof(u64) * BITS_PER_BYTE / 2)
                 / (sizeof(u64) * BITS_PER_BYTE / 2);
-        if (!ipath_kpiobufs)    /* have to have at least 1, for SMA */
-                kpiobufs = ipath_kpiobufs = 1;
-        else if ((dd->ipath_piobcnt2k + dd->ipath_piobcnt4k) <
-                 (dd->ipath_cfgports * IPATH_MIN_USER_PORT_BUFCNT)) {
-                dev_info(&dd->pcidev->dev, "Too few PIO buffers (%u) "
-                         "for %u ports to have %u each!\n",
-                         dd->ipath_piobcnt2k + dd->ipath_piobcnt4k,
-                         dd->ipath_cfgports, IPATH_MIN_USER_PORT_BUFCNT);
-                kpiobufs = 1;   /* reserve just the minimum for SMA/ether */
-        } else
+        if (ipath_kpiobufs == 0) {
+                /* not set by user, or set explictly to default  */
+                if ((dd->ipath_piobcnt2k + dd->ipath_piobcnt4k) > 128)
+                        kpiobufs = 32;
+                else
+                        kpiobufs = 16;
+        }
+        else
                 kpiobufs = ipath_kpiobufs;
 
         if (kpiobufs >
diff --git a/drivers/infiniband/hw/ipath/ipath_intr.c b/drivers/infiniband/hw/ipath/ipath_intr.c
index 0bcb428041f3..3e72a1fe3d73 100644
--- a/drivers/infiniband/hw/ipath/ipath_intr.c
+++ b/drivers/infiniband/hw/ipath/ipath_intr.c
@@ -665,14 +665,14 @@ static void handle_layer_pioavail(struct ipath_devdata *dd)
 
         ret = __ipath_layer_intr(dd, IPATH_LAYER_INT_SEND_CONTINUE);
         if (ret > 0)
-                goto clear;
+                goto set;
 
         ret = __ipath_verbs_piobufavail(dd);
         if (ret > 0)
-                goto clear;
+                goto set;
 
         return;
-clear:
+set:
         set_bit(IPATH_S_PIOINTBUFAVAIL, &dd->ipath_sendctrl);
         ipath_write_kreg(dd, dd->ipath_kregs->kr_sendctrl,
                          dd->ipath_sendctrl);
@@ -719,11 +719,24 @@ static void handle_rcv(struct ipath_devdata *dd, u32 istat)
 irqreturn_t ipath_intr(int irq, void *data, struct pt_regs *regs)
 {
         struct ipath_devdata *dd = data;
-        u32 istat = ipath_read_kreg32(dd, dd->ipath_kregs->kr_intstatus);
+        u32 istat;
         ipath_err_t estat = 0;
         static unsigned unexpected = 0;
         irqreturn_t ret;
 
+        if(!(dd->ipath_flags & IPATH_PRESENT)) {
+                /* this is mostly so we don't try to touch the chip while
+                 * it is being reset */
+                /*
+                 * This return value is perhaps odd, but we do not want the
+                 * interrupt core code to remove our interrupt handler
+                 * because we don't appear to be handling an interrupt
+                 * during a chip reset.
+                 */
+                return IRQ_HANDLED;
+        }
+
+        istat = ipath_read_kreg32(dd, dd->ipath_kregs->kr_intstatus);
         if (unlikely(!istat)) {
                 ipath_stats.sps_nullintr++;
                 ret = IRQ_NONE; /* not our interrupt, or already handled */
diff --git a/drivers/infiniband/hw/ipath/ipath_kernel.h b/drivers/infiniband/hw/ipath/ipath_kernel.h
index 0ce5f19c9d62..e6507f8115bc 100644
--- a/drivers/infiniband/hw/ipath/ipath_kernel.h
+++ b/drivers/infiniband/hw/ipath/ipath_kernel.h
@@ -731,7 +731,7 @@ u64 ipath_read_kreg64_port(const struct ipath_devdata *, ipath_kreg,
 static inline u32 ipath_read_ureg32(const struct ipath_devdata *dd,
                                     ipath_ureg regno, int port)
 {
-        if (!dd->ipath_kregbase)
+        if (!dd->ipath_kregbase || !(dd->ipath_flags & IPATH_PRESENT))
                 return 0;
 
         return readl(regno + (u64 __iomem *)
@@ -762,7 +762,7 @@ static inline void ipath_write_ureg(const struct ipath_devdata *dd,
 static inline u32 ipath_read_kreg32(const struct ipath_devdata *dd,
                                     ipath_kreg regno)
 {
-        if (!dd->ipath_kregbase)
+        if (!dd->ipath_kregbase || !(dd->ipath_flags & IPATH_PRESENT))
                 return -1;
         return readl((u32 __iomem *) & dd->ipath_kregbase[regno]);
 }
@@ -770,7 +770,7 @@ static inline u32 ipath_read_kreg32(const struct ipath_devdata *dd,
 static inline u64 ipath_read_kreg64(const struct ipath_devdata *dd,
                                     ipath_kreg regno)
 {
-        if (!dd->ipath_kregbase)
+        if (!dd->ipath_kregbase || !(dd->ipath_flags & IPATH_PRESENT))
                 return -1;
 
         return readq(&dd->ipath_kregbase[regno]);
@@ -786,7 +786,7 @@ static inline void ipath_write_kreg(const struct ipath_devdata *dd,
 static inline u64 ipath_read_creg(const struct ipath_devdata *dd,
                                   ipath_sreg regno)
 {
-        if (!dd->ipath_kregbase)
+        if (!dd->ipath_kregbase || !(dd->ipath_flags & IPATH_PRESENT))
                 return 0;
 
         return readq(regno + (u64 __iomem *)
@@ -797,7 +797,7 @@ static inline u64 ipath_read_creg(const struct ipath_devdata *dd,
 static inline u32 ipath_read_creg32(const struct ipath_devdata *dd,
                                          ipath_sreg regno)
 {
-        if (!dd->ipath_kregbase)
+        if (!dd->ipath_kregbase || !(dd->ipath_flags & IPATH_PRESENT))
                 return 0;
         return readl(regno + (u64 __iomem *)
                      (dd->ipath_cregbase +
diff --git a/drivers/infiniband/hw/ipath/ipath_layer.c b/drivers/infiniband/hw/ipath/ipath_layer.c
index 69ed1100701a..9cb5258ffed9 100644
--- a/drivers/infiniband/hw/ipath/ipath_layer.c
+++ b/drivers/infiniband/hw/ipath/ipath_layer.c
@@ -46,13 +46,15 @@
 /* Acquire before ipath_devs_lock. */
 static DEFINE_MUTEX(ipath_layer_mutex);
 
+static int ipath_verbs_registered;
+
 u16 ipath_layer_rcv_opcode;
+
 static int (*layer_intr)(void *, u32);
 static int (*layer_rcv)(void *, void *, struct sk_buff *);
 static int (*layer_rcv_lid)(void *, void *);
 static int (*verbs_piobufavail)(void *);
 static void (*verbs_rcv)(void *, void *, void *, u32);
-static int ipath_verbs_registered;
 
 static void *(*layer_add_one)(int, struct ipath_devdata *);
 static void (*layer_remove_one)(void *);
@@ -586,6 +588,8 @@ void ipath_verbs_unregister(void)
         verbs_rcv = NULL;
         verbs_timer_cb = NULL;
 
+        ipath_verbs_registered = 0;
+
         mutex_unlock(&ipath_layer_mutex);
 }
 
diff --git a/drivers/infiniband/hw/ipath/ipath_pe800.c b/drivers/infiniband/hw/ipath/ipath_pe800.c
index e1dc4f757062..6318067ab5ec 100644
--- a/drivers/infiniband/hw/ipath/ipath_pe800.c
+++ b/drivers/infiniband/hw/ipath/ipath_pe800.c
@@ -972,6 +972,8 @@ static int ipath_setup_pe_reset(struct ipath_devdata *dd)
         /* Use ERROR so it shows up in logs, etc. */
         ipath_dev_err(dd, "Resetting PE-800 unit %u\n",
                       dd->ipath_unit);
+        /* keep chip from being accessed in a few places */
+        dd->ipath_flags &= ~(IPATH_INITTED|IPATH_PRESENT);
         val = dd->ipath_control | INFINIPATH_C_RESET;
         ipath_write_kreg(dd, dd->ipath_kregs->kr_control, val);
         mb();
@@ -997,6 +999,8 @@ static int ipath_setup_pe_reset(struct ipath_devdata *dd)
                 if ((r = pci_enable_device(dd->pcidev)))
                         ipath_dev_err(dd, "pci_enable_device failed after "
                                       "reset: %d\n", r);
+                /* whether it worked or not, mark as present, again */
+                dd->ipath_flags |= IPATH_PRESENT;
                 val = ipath_read_kreg64(dd, dd->ipath_kregs->kr_revision);
                 if (val == dd->ipath_revision) {
                         ipath_cdbg(VERBOSE, "Got matching revision "
diff --git a/drivers/infiniband/hw/ipath/ipath_registers.h b/drivers/infiniband/hw/ipath/ipath_registers.h
index 1e59750c5f63..402126eb79c9 100644
--- a/drivers/infiniband/hw/ipath/ipath_registers.h
+++ b/drivers/infiniband/hw/ipath/ipath_registers.h
@@ -34,8 +34,9 @@
 #define _IPATH_REGISTERS_H
 
 /*
- * This file should only be included by kernel source, and by the diags.
- * It defines the registers, and their contents, for the InfiniPath HT-400 chip
+ * This file should only be included by kernel source, and by the diags.  It
+ * defines the registers, and their contents, for the InfiniPath HT-400
+ * chip.
  */
 
 /*
@@ -156,8 +157,10 @@
 #define INFINIPATH_IBCC_FLOWCTRLWATERMARK_SHIFT 8
 #define INFINIPATH_IBCC_LINKINITCMD_MASK 0x3ULL
 #define INFINIPATH_IBCC_LINKINITCMD_DISABLE 1
-#define INFINIPATH_IBCC_LINKINITCMD_POLL 2      /* cycle through TS1/TS2 till OK */
-#define INFINIPATH_IBCC_LINKINITCMD_SLEEP 3     /* wait for TS1, then go on */
+/* cycle through TS1/TS2 till OK */
+#define INFINIPATH_IBCC_LINKINITCMD_POLL 2
+/* wait for TS1, then go on */
+#define INFINIPATH_IBCC_LINKINITCMD_SLEEP 3
 #define INFINIPATH_IBCC_LINKINITCMD_SHIFT 16
 #define INFINIPATH_IBCC_LINKCMD_MASK 0x3ULL
 #define INFINIPATH_IBCC_LINKCMD_INIT 1  /* move to 0x11 */
@@ -182,7 +185,8 @@
 #define INFINIPATH_IBCS_LINKSTATE_SHIFT 4
 #define INFINIPATH_IBCS_TXREADY       0x40000000
 #define INFINIPATH_IBCS_TXCREDITOK    0x80000000
-/* link training states (shift by INFINIPATH_IBCS_LINKTRAININGSTATE_SHIFT) */
+/* link training states (shift by
+   INFINIPATH_IBCS_LINKTRAININGSTATE_SHIFT) */
 #define INFINIPATH_IBCS_LT_STATE_DISABLED       0x00
 #define INFINIPATH_IBCS_LT_STATE_LINKUP         0x01
 #define INFINIPATH_IBCS_LT_STATE_POLLACTIVE     0x02
@@ -267,10 +271,12 @@
 /* kr_serdesconfig0 bits */
 #define INFINIPATH_SERDC0_RESET_MASK  0xfULL    /* overal reset bits */
 #define INFINIPATH_SERDC0_RESET_PLL   0x10000000ULL     /* pll reset */
-#define INFINIPATH_SERDC0_TXIDLE      0xF000ULL /* tx idle enables (per lane) */
-#define INFINIPATH_SERDC0_RXDETECT_EN 0xF0000ULL        /* rx detect enables (per lane) */
-#define INFINIPATH_SERDC0_L1PWR_DN       0xF0ULL        /* L1 Power down; use with RXDETECT,
-                                                           Otherwise not used on IB side */
+/* tx idle enables (per lane) */
+#define INFINIPATH_SERDC0_TXIDLE      0xF000ULL
+/* rx detect enables (per lane) */
+#define INFINIPATH_SERDC0_RXDETECT_EN 0xF0000ULL
+/* L1 Power down; use with RXDETECT, Otherwise not used on IB side */
+#define INFINIPATH_SERDC0_L1PWR_DN       0xF0ULL
 
 /* kr_xgxsconfig bits */
 #define INFINIPATH_XGXS_RESET          0x7ULL
@@ -390,12 +396,13 @@ struct ipath_kregs {
         ipath_kreg kr_txintmemsize;
         ipath_kreg kr_xgxsconfig;
         ipath_kreg kr_ibpllcfg;
-        /* use these two (and the following N ports) only with ipath_k*_kreg64_port();
-         * not *kreg64() */
+        /* use these two (and the following N ports) only with
+         * ipath_k*_kreg64_port(); not *kreg64() */
         ipath_kreg kr_rcvhdraddr;
         ipath_kreg kr_rcvhdrtailaddr;
 
-        /* remaining registers are not present on all types of infinipath chips  */
+        /* remaining registers are not present on all types of infinipath
+           chips  */
         ipath_kreg kr_rcvpktledcnt;
         ipath_kreg kr_pcierbuftestreg0;
         ipath_kreg kr_pcierbuftestreg1;
diff --git a/drivers/infiniband/hw/ipath/ipath_ruc.c b/drivers/infiniband/hw/ipath/ipath_ruc.c
index f232e77b78ee..eb81424b3c5b 100644
--- a/drivers/infiniband/hw/ipath/ipath_ruc.c
+++ b/drivers/infiniband/hw/ipath/ipath_ruc.c
@@ -531,19 +531,12 @@ int ipath_post_rc_send(struct ipath_qp *qp, struct ib_send_wr *wr)
         }
         wqe->wr.num_sge = j;
         qp->s_head = next;
-        /*
-         * Wake up the send tasklet if the QP is not waiting
-         * for an RNR timeout.
-         */
-        next = qp->s_rnr_timeout;
         spin_unlock_irqrestore(&qp->s_lock, flags);
 
-        if (next == 0) {
-                if (qp->ibqp.qp_type == IB_QPT_UC)
-                        ipath_do_uc_send((unsigned long) qp);
-                else
-                        ipath_do_rc_send((unsigned long) qp);
-        }
+        if (qp->ibqp.qp_type == IB_QPT_UC)
+                ipath_do_uc_send((unsigned long) qp);
+        else
+                ipath_do_rc_send((unsigned long) qp);
 
         ret = 0;
 
diff --git a/drivers/infiniband/hw/ipath/ipath_sysfs.c b/drivers/infiniband/hw/ipath/ipath_sysfs.c
index 32acd8048b49..f323791cc495 100644
--- a/drivers/infiniband/hw/ipath/ipath_sysfs.c
+++ b/drivers/infiniband/hw/ipath/ipath_sysfs.c
@@ -711,10 +711,22 @@ static struct attribute_group dev_attr_group = {
  * enters diag mode.  A device reset is quite likely to crash the
  * machine entirely, so we don't want to normally make it
  * available.
+ *
+ * Called with ipath_mutex held.
  */
 int ipath_expose_reset(struct device *dev)
 {
-        return device_create_file(dev, &dev_attr_reset);
+        static int exposed;
+        int ret;
+
+        if (!exposed) {
+                ret = device_create_file(dev, &dev_attr_reset);
+                exposed = 1;
+        }
+        else
+                ret = 0;
+
+        return ret;
 }
 
 int ipath_driver_create_group(struct device_driver *drv)
diff --git a/drivers/infiniband/hw/ipath/ipath_ud.c b/drivers/infiniband/hw/ipath/ipath_ud.c
index 01cfb30ee160..e606daf83210 100644
--- a/drivers/infiniband/hw/ipath/ipath_ud.c
+++ b/drivers/infiniband/hw/ipath/ipath_ud.c
@@ -46,8 +46,10 @@
  * This is called from ipath_post_ud_send() to forward a WQE addressed
  * to the same HCA.
  */
-static void ipath_ud_loopback(struct ipath_qp *sqp, struct ipath_sge_state *ss,
-                              u32 length, struct ib_send_wr *wr, struct ib_wc *wc)
+static void ipath_ud_loopback(struct ipath_qp *sqp,
+                              struct ipath_sge_state *ss,
+                              u32 length, struct ib_send_wr *wr,
+                              struct ib_wc *wc)
 {
         struct ipath_ibdev *dev = to_idev(sqp->ibqp.device);
         struct ipath_qp *qp;
diff --git a/drivers/infiniband/hw/ipath/ipath_verbs.c b/drivers/infiniband/hw/ipath/ipath_verbs.c
index 8d2558a01f35..cb9e387c301f 100644
--- a/drivers/infiniband/hw/ipath/ipath_verbs.c
+++ b/drivers/infiniband/hw/ipath/ipath_verbs.c
@@ -449,7 +449,6 @@ static void ipath_ib_timer(void *arg)
 {
         struct ipath_ibdev *dev = (struct ipath_ibdev *) arg;
         struct ipath_qp *resend = NULL;
-        struct ipath_qp *rnr = NULL;
         struct list_head *last;
         struct ipath_qp *qp;
         unsigned long flags;
@@ -465,32 +464,18 @@ static void ipath_ib_timer(void *arg)
         last = &dev->pending[dev->pending_index];
         while (!list_empty(last)) {
                 qp = list_entry(last->next, struct ipath_qp, timerwait);
-                if (last->next == LIST_POISON1 ||
-                    last->next != &qp->timerwait ||
-                    qp->timerwait.prev != last) {
-                        INIT_LIST_HEAD(last);
-                } else {
-                        list_del(&qp->timerwait);
-                        qp->timerwait.prev = (struct list_head *) resend;
-                        resend = qp;
-                        atomic_inc(&qp->refcount);
-                }
+                list_del(&qp->timerwait);
+                qp->timer_next = resend;
+                resend = qp;
+                atomic_inc(&qp->refcount);
         }
         last = &dev->rnrwait;
         if (!list_empty(last)) {
                 qp = list_entry(last->next, struct ipath_qp, timerwait);
                 if (--qp->s_rnr_timeout == 0) {
                         do {
-                                if (last->next == LIST_POISON1 ||
-                                    last->next != &qp->timerwait ||
-                                    qp->timerwait.prev != last) {
-                                        INIT_LIST_HEAD(last);
-                                        break;
-                                }
                                 list_del(&qp->timerwait);
-                                qp->timerwait.prev =
-                                        (struct list_head *) rnr;
-                                rnr = qp;
+                                tasklet_hi_schedule(&qp->s_task);
                                 if (list_empty(last))
                                         break;
                                 qp = list_entry(last->next, struct ipath_qp,
@@ -530,8 +515,7 @@ static void ipath_ib_timer(void *arg)
         spin_unlock_irqrestore(&dev->pending_lock, flags);
 
         /* XXX What if timer fires again while this is running? */
-        for (qp = resend; qp != NULL;
-             qp = (struct ipath_qp *) qp->timerwait.prev) {
+        for (qp = resend; qp != NULL; qp = qp->timer_next) {
                 struct ib_wc wc;
 
                 spin_lock_irqsave(&qp->s_lock, flags);
@@ -545,9 +529,6 @@ static void ipath_ib_timer(void *arg)
                 if (atomic_dec_and_test(&qp->refcount))
                         wake_up(&qp->wait);
         }
-        for (qp = rnr; qp != NULL;
-             qp = (struct ipath_qp *) qp->timerwait.prev)
-                tasklet_hi_schedule(&qp->s_task);
 }
 
 /**
@@ -556,9 +537,9 @@ static void ipath_ib_timer(void *arg)
  *
  * This is called from ipath_intr() at interrupt level when a PIO buffer is
  * available after ipath_verbs_send() returned an error that no buffers were
- * available.  Return 0 if we consumed all the PIO buffers and we still have
+ * available.  Return 1 if we consumed all the PIO buffers and we still have
  * QPs waiting for buffers (for now, just do a tasklet_hi_schedule and
- * return one).
+ * return zero).
  */
 static int ipath_ib_piobufavail(void *arg)
 {
@@ -579,7 +560,7 @@ static int ipath_ib_piobufavail(void *arg)
         spin_unlock_irqrestore(&dev->pending_lock, flags);
 
 bail:
-        return 1;
+        return 0;
 }
 
 static int ipath_query_device(struct ib_device *ibdev,
@@ -1159,7 +1140,7 @@ static ssize_t show_stats(struct class_device *cdev, char *buf)
 
         len = sprintf(buf,
                       "RC resends  %d\n"
-                      "RC QACKs    %d\n"
+                      "RC no QACK  %d\n"
                       "RC ACKs     %d\n"
                       "RC SEQ NAKs %d\n"
                       "RC RDMA seq %d\n"
diff --git a/drivers/infiniband/hw/ipath/ipath_verbs.h b/drivers/infiniband/hw/ipath/ipath_verbs.h
index fcafbc7c9e71..4f8d59300e9b 100644
--- a/drivers/infiniband/hw/ipath/ipath_verbs.h
+++ b/drivers/infiniband/hw/ipath/ipath_verbs.h
@@ -282,7 +282,8 @@ struct ipath_srq {
  */
 struct ipath_qp {
         struct ib_qp ibqp;
-        struct ipath_qp *next;  /* link list for QPN hash table */
+        struct ipath_qp *next;          /* link list for QPN hash table */
+        struct ipath_qp *timer_next;    /* link list for ipath_ib_timer() */
         struct list_head piowait;       /* link for wait PIO buf */
         struct list_head timerwait;     /* link for waiting for timeouts */
         struct ib_ah_attr remote_ah_attr;
diff --git a/drivers/infiniband/hw/ipath/ips_common.h b/drivers/infiniband/hw/ipath/ips_common.h
index 410a764dfcef..ab7cbbbfd03a 100644
--- a/drivers/infiniband/hw/ipath/ips_common.h
+++ b/drivers/infiniband/hw/ipath/ips_common.h
@@ -95,7 +95,7 @@ struct ether_header {
         __u8 seq_num;
         __le32 len;
         /* MUST be of word size due to PIO write requirements */
-        __u32 csum;
+        __le32 csum;
         __le16 csum_offset;
         __le16 flags;
         __u16 first_2_bytes;
diff --git a/drivers/infiniband/hw/mthca/mthca_cq.c b/drivers/infiniband/hw/mthca/mthca_cq.c
index 312cf90731ea..205854e9c662 100644
--- a/drivers/infiniband/hw/mthca/mthca_cq.c
+++ b/drivers/infiniband/hw/mthca/mthca_cq.c
@@ -238,9 +238,9 @@ void mthca_cq_event(struct mthca_dev *dev, u32 cqn,
         spin_lock(&dev->cq_table.lock);
 
         cq = mthca_array_get(&dev->cq_table.cq, cqn & (dev->limits.num_cqs - 1));
-
         if (cq)
-                atomic_inc(&cq->refcount);
+                ++cq->refcount;
+
         spin_unlock(&dev->cq_table.lock);
 
         if (!cq) {
@@ -254,8 +254,10 @@ void mthca_cq_event(struct mthca_dev *dev, u32 cqn,
         if (cq->ibcq.event_handler)
                 cq->ibcq.event_handler(&event, cq->ibcq.cq_context);
 
-        if (atomic_dec_and_test(&cq->refcount))
+        spin_lock(&dev->cq_table.lock);
+        if (!--cq->refcount)
                 wake_up(&cq->wait);
+        spin_unlock(&dev->cq_table.lock);
 }
 
 static inline int is_recv_cqe(struct mthca_cqe *cqe)
@@ -267,23 +269,13 @@ static inline int is_recv_cqe(struct mthca_cqe *cqe)
                 return !(cqe->is_send & 0x80);
 }
 
-void mthca_cq_clean(struct mthca_dev *dev, u32 cqn, u32 qpn,
+void mthca_cq_clean(struct mthca_dev *dev, struct mthca_cq *cq, u32 qpn,
                     struct mthca_srq *srq)
 {
-        struct mthca_cq *cq;
         struct mthca_cqe *cqe;
         u32 prod_index;
         int nfreed = 0;
 
-        spin_lock_irq(&dev->cq_table.lock);
-        cq = mthca_array_get(&dev->cq_table.cq, cqn & (dev->limits.num_cqs - 1));
-        if (cq)
-                atomic_inc(&cq->refcount);
-        spin_unlock_irq(&dev->cq_table.lock);
-
-        if (!cq)
-                return;
-
         spin_lock_irq(&cq->lock);
 
         /*
@@ -301,7 +293,7 @@ void mthca_cq_clean(struct mthca_dev *dev, u32 cqn, u32 qpn,
 
         if (0)
                 mthca_dbg(dev, "Cleaning QPN %06x from CQN %06x; ci %d, pi %d\n",
-                          qpn, cqn, cq->cons_index, prod_index);
+                          qpn, cq->cqn, cq->cons_index, prod_index);
 
         /*
          * Now sweep backwards through the CQ, removing CQ entries
@@ -325,8 +317,6 @@ void mthca_cq_clean(struct mthca_dev *dev, u32 cqn, u32 qpn,
         }
 
         spin_unlock_irq(&cq->lock);
-        if (atomic_dec_and_test(&cq->refcount))
-                wake_up(&cq->wait);
 }
 
 void mthca_cq_resize_copy_cqes(struct mthca_cq *cq)
@@ -821,7 +811,7 @@ int mthca_init_cq(struct mthca_dev *dev, int nent,
         }
 
         spin_lock_init(&cq->lock);
-        atomic_set(&cq->refcount, 1);
+        cq->refcount = 1;
         init_waitqueue_head(&cq->wait);
 
         memset(cq_context, 0, sizeof *cq_context);
@@ -896,6 +886,17 @@ err_out:
         return err;
 }
 
+static inline int get_cq_refcount(struct mthca_dev *dev, struct mthca_cq *cq)
+{
+        int c;
+
+        spin_lock_irq(&dev->cq_table.lock);
+        c = cq->refcount;
+        spin_unlock_irq(&dev->cq_table.lock);
+
+        return c;
+}
+
 void mthca_free_cq(struct mthca_dev *dev,
                    struct mthca_cq *cq)
 {
@@ -929,6 +930,7 @@ void mthca_free_cq(struct mthca_dev *dev,
         spin_lock_irq(&dev->cq_table.lock);
         mthca_array_clear(&dev->cq_table.cq,
                           cq->cqn & (dev->limits.num_cqs - 1));
+        --cq->refcount;
         spin_unlock_irq(&dev->cq_table.lock);
 
         if (dev->mthca_flags & MTHCA_FLAG_MSI_X)
@@ -936,8 +938,7 @@ void mthca_free_cq(struct mthca_dev *dev,
         else
                 synchronize_irq(dev->pdev->irq);
 
-        atomic_dec(&cq->refcount);
-        wait_event(cq->wait, !atomic_read(&cq->refcount));
+        wait_event(cq->wait, !get_cq_refcount(dev, cq));
 
         if (cq->is_kernel) {
                 mthca_free_cq_buf(dev, &cq->buf, cq->ibcq.cqe);
diff --git a/drivers/infiniband/hw/mthca/mthca_dev.h b/drivers/infiniband/hw/mthca/mthca_dev.h
index 4c1dcb4c1822..f8160b8de090 100644
--- a/drivers/infiniband/hw/mthca/mthca_dev.h
+++ b/drivers/infiniband/hw/mthca/mthca_dev.h
@@ -496,7 +496,7 @@ void mthca_free_cq(struct mthca_dev *dev,
 void mthca_cq_completion(struct mthca_dev *dev, u32 cqn);
 void mthca_cq_event(struct mthca_dev *dev, u32 cqn,
                     enum ib_event_type event_type);
-void mthca_cq_clean(struct mthca_dev *dev, u32 cqn, u32 qpn,
+void mthca_cq_clean(struct mthca_dev *dev, struct mthca_cq *cq, u32 qpn,
                     struct mthca_srq *srq);
 void mthca_cq_resize_copy_cqes(struct mthca_cq *cq);
 int mthca_alloc_cq_buf(struct mthca_dev *dev, struct mthca_cq_buf *buf, int nent);
diff --git a/drivers/infiniband/hw/mthca/mthca_mr.c b/drivers/infiniband/hw/mthca/mthca_mr.c
index 25e1c1db9a40..a486dec1707e 100644
--- a/drivers/infiniband/hw/mthca/mthca_mr.c
+++ b/drivers/infiniband/hw/mthca/mthca_mr.c
@@ -761,6 +761,7 @@ void mthca_arbel_fmr_unmap(struct mthca_dev *dev, struct mthca_fmr *fmr)
 
 int __devinit mthca_init_mr_table(struct mthca_dev *dev)
 {
+        unsigned long addr;
         int err, i;
 
         err = mthca_alloc_init(&dev->mr_table.mpt_alloc,
@@ -796,9 +797,12 @@ int __devinit mthca_init_mr_table(struct mthca_dev *dev)
                         goto err_fmr_mpt;
                 }
 
+                addr = pci_resource_start(dev->pdev, 4) +
+                        ((pci_resource_len(dev->pdev, 4) - 1) &
+                         dev->mr_table.mpt_base);
+
                 dev->mr_table.tavor_fmr.mpt_base =
-                        ioremap(dev->mr_table.mpt_base,
-                                (1 << i) * sizeof (struct mthca_mpt_entry));
+                        ioremap(addr, (1 << i) * sizeof(struct mthca_mpt_entry));
 
                 if (!dev->mr_table.tavor_fmr.mpt_base) {
                         mthca_warn(dev, "MPT ioremap for FMR failed.\n");
@@ -806,9 +810,12 @@ int __devinit mthca_init_mr_table(struct mthca_dev *dev)
                         goto err_fmr_mpt;
                 }
 
+                addr = pci_resource_start(dev->pdev, 4) +
+                        ((pci_resource_len(dev->pdev, 4) - 1) &
+                         dev->mr_table.mtt_base);
+
                 dev->mr_table.tavor_fmr.mtt_base =
-                        ioremap(dev->mr_table.mtt_base,
-                                (1 << i) * MTHCA_MTT_SEG_SIZE);
+                        ioremap(addr, (1 << i) * MTHCA_MTT_SEG_SIZE);
                 if (!dev->mr_table.tavor_fmr.mtt_base) {
                         mthca_warn(dev, "MTT ioremap for FMR failed.\n");
                         err = -ENOMEM;
diff --git a/drivers/infiniband/hw/mthca/mthca_provider.c b/drivers/infiniband/hw/mthca/mthca_provider.c
index 565a24b1756f..a2eae8a30167 100644
--- a/drivers/infiniband/hw/mthca/mthca_provider.c
+++ b/drivers/infiniband/hw/mthca/mthca_provider.c
@@ -306,7 +306,7 @@ static int mthca_query_gid(struct ib_device *ibdev, u8 port,
                 goto out;
         }
 
-        memcpy(gid->raw + 8, out_mad->data + (index % 8) * 16, 8);
+        memcpy(gid->raw + 8, out_mad->data + (index % 8) * 8, 8);
 
  out:
         kfree(in_mad);
diff --git a/drivers/infiniband/hw/mthca/mthca_provider.h b/drivers/infiniband/hw/mthca/mthca_provider.h
index 6676a786d690..179a8f610d0f 100644
--- a/drivers/infiniband/hw/mthca/mthca_provider.h
+++ b/drivers/infiniband/hw/mthca/mthca_provider.h
@@ -139,11 +139,12 @@ struct mthca_ah {
  * a qp may be locked, with the send cq locked first.  No other
  * nesting should be done.
  *
- * Each struct mthca_cq/qp also has an atomic_t ref count.  The
- * pointer from the cq/qp_table to the struct counts as one reference.
- * This reference also is good for access through the consumer API, so
- * modifying the CQ/QP etc doesn't need to take another reference.
- * Access because of a completion being polled does need a reference.
+ * Each struct mthca_cq/qp also has an ref count, protected by the
+ * corresponding table lock.  The pointer from the cq/qp_table to the
+ * struct counts as one reference.  This reference also is good for
+ * access through the consumer API, so modifying the CQ/QP etc doesn't
+ * need to take another reference.  Access to a QP because of a
+ * completion being polled does not need a reference either.
  *
  * Finally, each struct mthca_cq/qp has a wait_queue_head_t for the
  * destroy function to sleep on.
@@ -159,8 +160,9 @@ struct mthca_ah {
  * - decrement ref count; if zero, wake up waiters
  *
  * To destroy a CQ/QP, we can do the following:
- * - lock cq/qp_table, remove pointer, unlock cq/qp_table lock
- * - decrement ref count
+ * - lock cq/qp_table
+ * - remove pointer and decrement ref count
+ * - unlock cq/qp_table lock
  * - wait_event until ref count is zero
  *
  * It is the consumer's responsibilty to make sure that no QP
@@ -197,7 +199,7 @@ struct mthca_cq_resize {
 struct mthca_cq {
         struct ib_cq            ibcq;
         spinlock_t              lock;
-        atomic_t                refcount;
+        int                     refcount;
         int                     cqn;
         u32                     cons_index;
         struct mthca_cq_buf     buf;
@@ -217,7 +219,7 @@ struct mthca_cq {
 struct mthca_srq {
         struct ib_srq           ibsrq;
         spinlock_t              lock;
-        atomic_t                refcount;
+        int                     refcount;
         int                     srqn;
         int                     max;
         int                     max_gs;
@@ -254,7 +256,7 @@ struct mthca_wq {
 
 struct mthca_qp {
         struct ib_qp           ibqp;
-        atomic_t               refcount;
+        int                    refcount;
         u32                    qpn;
         int                    is_direct;
         u8                     port; /* for SQP and memfree use only */
diff --git a/drivers/infiniband/hw/mthca/mthca_qp.c b/drivers/infiniband/hw/mthca/mthca_qp.c
index f37b0e367323..19765f6f8d58 100644
--- a/drivers/infiniband/hw/mthca/mthca_qp.c
+++ b/drivers/infiniband/hw/mthca/mthca_qp.c
@@ -240,7 +240,7 @@ void mthca_qp_event(struct mthca_dev *dev, u32 qpn,
         spin_lock(&dev->qp_table.lock);
         qp = mthca_array_get(&dev->qp_table.qp, qpn & (dev->limits.num_qps - 1));
         if (qp)
-                atomic_inc(&qp->refcount);
+                ++qp->refcount;
         spin_unlock(&dev->qp_table.lock);
 
         if (!qp) {
@@ -257,8 +257,10 @@ void mthca_qp_event(struct mthca_dev *dev, u32 qpn,
         if (qp->ibqp.event_handler)
                 qp->ibqp.event_handler(&event, qp->ibqp.qp_context);
 
-        if (atomic_dec_and_test(&qp->refcount))
+        spin_lock(&dev->qp_table.lock);
+        if (!--qp->refcount)
                 wake_up(&qp->wait);
+        spin_unlock(&dev->qp_table.lock);
 }
 
 static int to_mthca_state(enum ib_qp_state ib_state)
@@ -833,10 +835,10 @@ int mthca_modify_qp(struct ib_qp *ibqp, struct ib_qp_attr *attr, int attr_mask)
          * entries and reinitialize the QP.
          */
         if (new_state == IB_QPS_RESET && !qp->ibqp.uobject) {
-                mthca_cq_clean(dev, to_mcq(qp->ibqp.send_cq)->cqn, qp->qpn,
+                mthca_cq_clean(dev, to_mcq(qp->ibqp.send_cq), qp->qpn,
                                qp->ibqp.srq ? to_msrq(qp->ibqp.srq) : NULL);
                 if (qp->ibqp.send_cq != qp->ibqp.recv_cq)
-                        mthca_cq_clean(dev, to_mcq(qp->ibqp.recv_cq)->cqn, qp->qpn,
+                        mthca_cq_clean(dev, to_mcq(qp->ibqp.recv_cq), qp->qpn,
                                        qp->ibqp.srq ? to_msrq(qp->ibqp.srq) : NULL);
 
                 mthca_wq_init(&qp->sq);
@@ -1096,7 +1098,7 @@ static int mthca_alloc_qp_common(struct mthca_dev *dev,
         int ret;
         int i;
 
-        atomic_set(&qp->refcount, 1);
+        qp->refcount = 1;
         init_waitqueue_head(&qp->wait);
         qp->state        = IB_QPS_RESET;
         qp->atomic_rd_en = 0;
@@ -1318,6 +1320,17 @@ int mthca_alloc_sqp(struct mthca_dev *dev,
         return err;
 }
 
+static inline int get_qp_refcount(struct mthca_dev *dev, struct mthca_qp *qp)
+{
+        int c;
+
+        spin_lock_irq(&dev->qp_table.lock);
+        c = qp->refcount;
+        spin_unlock_irq(&dev->qp_table.lock);
+
+        return c;
+}
+
 void mthca_free_qp(struct mthca_dev *dev,
                    struct mthca_qp *qp)
 {
@@ -1339,14 +1352,14 @@ void mthca_free_qp(struct mthca_dev *dev,
         spin_lock(&dev->qp_table.lock);
         mthca_array_clear(&dev->qp_table.qp,
                           qp->qpn & (dev->limits.num_qps - 1));
+        --qp->refcount;
         spin_unlock(&dev->qp_table.lock);
 
         if (send_cq != recv_cq)
                 spin_unlock(&recv_cq->lock);
         spin_unlock_irq(&send_cq->lock);
 
-        atomic_dec(&qp->refcount);
-        wait_event(qp->wait, !atomic_read(&qp->refcount));
+        wait_event(qp->wait, !get_qp_refcount(dev, qp));
 
         if (qp->state != IB_QPS_RESET)
                 mthca_MODIFY_QP(dev, qp->state, IB_QPS_RESET, qp->qpn, 0,
@@ -1358,10 +1371,10 @@ void mthca_free_qp(struct mthca_dev *dev,
          * unref the mem-free tables and free the QPN in our table.
          */
         if (!qp->ibqp.uobject) {
-                mthca_cq_clean(dev, to_mcq(qp->ibqp.send_cq)->cqn, qp->qpn,
+                mthca_cq_clean(dev, to_mcq(qp->ibqp.send_cq), qp->qpn,
                                qp->ibqp.srq ? to_msrq(qp->ibqp.srq) : NULL);
                 if (qp->ibqp.send_cq != qp->ibqp.recv_cq)
-                        mthca_cq_clean(dev, to_mcq(qp->ibqp.recv_cq)->cqn, qp->qpn,
+                        mthca_cq_clean(dev, to_mcq(qp->ibqp.recv_cq), qp->qpn,
                                        qp->ibqp.srq ? to_msrq(qp->ibqp.srq) : NULL);
 
                 mthca_free_memfree(dev, qp);
diff --git a/drivers/infiniband/hw/mthca/mthca_srq.c b/drivers/infiniband/hw/mthca/mthca_srq.c
index adcaf85355ae..1ea433291fa7 100644
--- a/drivers/infiniband/hw/mthca/mthca_srq.c
+++ b/drivers/infiniband/hw/mthca/mthca_srq.c
@@ -241,7 +241,7 @@ int mthca_alloc_srq(struct mthca_dev *dev, struct mthca_pd *pd,
                 goto err_out_mailbox;
 
         spin_lock_init(&srq->lock);
-        atomic_set(&srq->refcount, 1);
+        srq->refcount = 1;
         init_waitqueue_head(&srq->wait);
 
         if (mthca_is_memfree(dev))
@@ -308,6 +308,17 @@ err_out:
         return err;
 }
 
+static inline int get_srq_refcount(struct mthca_dev *dev, struct mthca_srq *srq)
+{
+        int c;
+
+        spin_lock_irq(&dev->srq_table.lock);
+        c = srq->refcount;
+        spin_unlock_irq(&dev->srq_table.lock);
+
+        return c;
+}
+
 void mthca_free_srq(struct mthca_dev *dev, struct mthca_srq *srq)
 {
         struct mthca_mailbox *mailbox;
@@ -329,10 +340,10 @@ void mthca_free_srq(struct mthca_dev *dev, struct mthca_srq *srq)
         spin_lock_irq(&dev->srq_table.lock);
         mthca_array_clear(&dev->srq_table.srq,
                           srq->srqn & (dev->limits.num_srqs - 1));
+        --srq->refcount;
         spin_unlock_irq(&dev->srq_table.lock);
 
-        atomic_dec(&srq->refcount);
-        wait_event(srq->wait, !atomic_read(&srq->refcount));
+        wait_event(srq->wait, !get_srq_refcount(dev, srq));
 
         if (!srq->ibsrq.uobject) {
                 mthca_free_srq_buf(dev, srq);
@@ -414,7 +425,7 @@ void mthca_srq_event(struct mthca_dev *dev, u32 srqn,
         spin_lock(&dev->srq_table.lock);
         srq = mthca_array_get(&dev->srq_table.srq, srqn & (dev->limits.num_srqs - 1));
         if (srq)
-                atomic_inc(&srq->refcount);
+                ++srq->refcount;
         spin_unlock(&dev->srq_table.lock);
 
         if (!srq) {
@@ -431,8 +442,10 @@ void mthca_srq_event(struct mthca_dev *dev, u32 srqn,
         srq->ibsrq.event_handler(&event, srq->ibsrq.srq_context);
 
 out:
-        if (atomic_dec_and_test(&srq->refcount))
+        spin_lock(&dev->srq_table.lock);
+        if (!--srq->refcount)
                 wake_up(&srq->wait);
+        spin_unlock(&dev->srq_table.lock);
 }
 
 /*
diff --git a/drivers/infiniband/ulp/ipoib/ipoib_vlan.c b/drivers/infiniband/ulp/ipoib/ipoib_vlan.c
index 4ca175553f9f..f887780e8093 100644
--- a/drivers/infiniband/ulp/ipoib/ipoib_vlan.c
+++ b/drivers/infiniband/ulp/ipoib/ipoib_vlan.c
@@ -158,10 +158,8 @@ int ipoib_vlan_delete(struct net_device *pdev, unsigned short pkey)
                 if (priv->pkey == pkey) {
                         unregister_netdev(priv->dev);
                         ipoib_dev_cleanup(priv->dev);
-
                         list_del(&priv->list);
-
-                        kfree(priv);
+                        free_netdev(priv->dev);
 
                         ret = 0;
                         break;
diff --git a/drivers/infiniband/ulp/srp/ib_srp.c b/drivers/infiniband/ulp/srp/ib_srp.c
index 5bb55742ada6..c32ce4348e1b 100644
--- a/drivers/infiniband/ulp/srp/ib_srp.c
+++ b/drivers/infiniband/ulp/srp/ib_srp.c
@@ -409,6 +409,34 @@ static int srp_connect_target(struct srp_target_port *target)
         }
 }
 
+static void srp_unmap_data(struct scsi_cmnd *scmnd,
+                           struct srp_target_port *target,
+                           struct srp_request *req)
+{
+        struct scatterlist *scat;
+        int nents;
+
+        if (!scmnd->request_buffer ||
+            (scmnd->sc_data_direction != DMA_TO_DEVICE &&
+             scmnd->sc_data_direction != DMA_FROM_DEVICE))
+                return;
+
+        /*
+         * This handling of non-SG commands can be killed when the
+         * SCSI midlayer no longer generates non-SG commands.
+         */
+        if (likely(scmnd->use_sg)) {
+                nents = scmnd->use_sg;
+                scat  = scmnd->request_buffer;
+        } else {
+                nents = 1;
+                scat  = &req->fake_sg;
+        }
+
+        dma_unmap_sg(target->srp_host->dev->dma_device, scat, nents,
+                     scmnd->sc_data_direction);
+}
+
 static int srp_reconnect_target(struct srp_target_port *target)
 {
         struct ib_cm_id *new_cm_id;
@@ -455,16 +483,16 @@ static int srp_reconnect_target(struct srp_target_port *target)
         list_for_each_entry(req, &target->req_queue, list) {
                 req->scmnd->result = DID_RESET << 16;
                 req->scmnd->scsi_done(req->scmnd);
+                srp_unmap_data(req->scmnd, target, req);
         }
 
         target->rx_head  = 0;
         target->tx_head  = 0;
         target->tx_tail  = 0;
-        target->req_head = 0;
-        for (i = 0; i < SRP_SQ_SIZE - 1; ++i)
-                target->req_ring[i].next = i + 1;
-        target->req_ring[SRP_SQ_SIZE - 1].next = -1;
+        INIT_LIST_HEAD(&target->free_reqs);
         INIT_LIST_HEAD(&target->req_queue);
+        for (i = 0; i < SRP_SQ_SIZE; ++i)
+                list_add_tail(&target->req_ring[i].list, &target->free_reqs);
 
         ret = srp_connect_target(target);
         if (ret)
@@ -589,40 +617,10 @@ static int srp_map_data(struct scsi_cmnd *scmnd, struct srp_target_port *target,
         return len;
 }
 
-static void srp_unmap_data(struct scsi_cmnd *scmnd,
-                           struct srp_target_port *target,
-                           struct srp_request *req)
-{
-        struct scatterlist *scat;
-        int nents;
-
-        if (!scmnd->request_buffer ||
-            (scmnd->sc_data_direction != DMA_TO_DEVICE &&
-             scmnd->sc_data_direction != DMA_FROM_DEVICE))
-                return;
-
-        /*
-         * This handling of non-SG commands can be killed when the
-         * SCSI midlayer no longer generates non-SG commands.
-         */
-        if (likely(scmnd->use_sg)) {
-                nents = scmnd->use_sg;
-                scat  = scmnd->request_buffer;
-        } else {
-                nents = 1;
-                scat  = &req->fake_sg;
-        }
-
-        dma_unmap_sg(target->srp_host->dev->dma_device, scat, nents,
-                     scmnd->sc_data_direction);
-}
-
-static void srp_remove_req(struct srp_target_port *target, struct srp_request *req,
-                           int index)
+static void srp_remove_req(struct srp_target_port *target, struct srp_request *req)
 {
-        list_del(&req->list);
-        req->next = target->req_head;
-        target->req_head = index;
+        srp_unmap_data(req->scmnd, target, req);
+        list_move_tail(&req->list, &target->free_reqs);
 }
 
 static void srp_process_rsp(struct srp_target_port *target, struct srp_rsp *rsp)
@@ -647,7 +645,7 @@ static void srp_process_rsp(struct srp_target_port *target, struct srp_rsp *rsp)
                         req->tsk_status = rsp->data[3];
                 complete(&req->done);
         } else {
-                scmnd         = req->scmnd;
+                scmnd = req->scmnd;
                 if (!scmnd)
                         printk(KERN_ERR "Null scmnd for RSP w/tag %016llx\n",
                                (unsigned long long) rsp->tag);
@@ -665,14 +663,11 @@ static void srp_process_rsp(struct srp_target_port *target, struct srp_rsp *rsp)
                 else if (rsp->flags & (SRP_RSP_FLAG_DIOVER | SRP_RSP_FLAG_DIUNDER))
                         scmnd->resid = be32_to_cpu(rsp->data_in_res_cnt);
 
-                srp_unmap_data(scmnd, target, req);
-
                 if (!req->tsk_mgmt) {
-                        req->scmnd = NULL;
                         scmnd->host_scribble = (void *) -1L;
                         scmnd->scsi_done(scmnd);
 
-                        srp_remove_req(target, req, rsp->tag & ~SRP_TAG_TSK_MGMT);
+                        srp_remove_req(target, req);
                 } else
                         req->cmd_done = 1;
         }
@@ -859,7 +854,6 @@ static int srp_queuecommand(struct scsi_cmnd *scmnd,
         struct srp_request *req;
         struct srp_iu *iu;
         struct srp_cmd *cmd;
-        long req_index;
         int len;
 
         if (target->state == SRP_TARGET_CONNECTING)
@@ -879,22 +873,20 @@ static int srp_queuecommand(struct scsi_cmnd *scmnd,
         dma_sync_single_for_cpu(target->srp_host->dev->dma_device, iu->dma,
                                 SRP_MAX_IU_LEN, DMA_TO_DEVICE);
 
-        req_index = target->req_head;
+        req = list_entry(target->free_reqs.next, struct srp_request, list);
 
         scmnd->scsi_done     = done;
         scmnd->result        = 0;
-        scmnd->host_scribble = (void *) req_index;
+        scmnd->host_scribble = (void *) (long) req->index;
 
         cmd = iu->buf;
         memset(cmd, 0, sizeof *cmd);
 
         cmd->opcode = SRP_CMD;
         cmd->lun    = cpu_to_be64((u64) scmnd->device->lun << 48);
-        cmd->tag    = req_index;
+        cmd->tag    = req->index;
         memcpy(cmd->cdb, scmnd->cmnd, scmnd->cmd_len);
 
-        req = &target->req_ring[req_index];
-
         req->scmnd    = scmnd;
         req->cmd      = iu;
         req->cmd_done = 0;
@@ -919,8 +911,7 @@ static int srp_queuecommand(struct scsi_cmnd *scmnd,
                 goto err_unmap;
         }
 
-        target->req_head = req->next;
-        list_add_tail(&req->list, &target->req_queue);
+        list_move_tail(&req->list, &target->req_queue);
 
         return 0;
 
@@ -1143,30 +1134,20 @@ static int srp_cm_handler(struct ib_cm_id *cm_id, struct ib_cm_event *event)
         return 0;
 }
 
-static int srp_send_tsk_mgmt(struct scsi_cmnd *scmnd, u8 func)
+static int srp_send_tsk_mgmt(struct srp_target_port *target,
+                             struct srp_request *req, u8 func)
 {
-        struct srp_target_port *target = host_to_target(scmnd->device->host);
-        struct srp_request *req;
         struct srp_iu *iu;
         struct srp_tsk_mgmt *tsk_mgmt;
-        int req_index;
-        int ret = FAILED;
 
         spin_lock_irq(target->scsi_host->host_lock);
 
         if (target->state == SRP_TARGET_DEAD ||
             target->state == SRP_TARGET_REMOVED) {
-                scmnd->result = DID_BAD_TARGET << 16;
+                req->scmnd->result = DID_BAD_TARGET << 16;
                 goto out;
         }
 
-        if (scmnd->host_scribble == (void *) -1L)
-                goto out;
-
-        req_index = (long) scmnd->host_scribble;
-        printk(KERN_ERR "Abort for req_index %d\n", req_index);
-
-        req = &target->req_ring[req_index];
         init_completion(&req->done);
 
         iu = __srp_get_tx_iu(target);
@@ -1177,10 +1158,10 @@ static int srp_send_tsk_mgmt(struct scsi_cmnd *scmnd, u8 func)
         memset(tsk_mgmt, 0, sizeof *tsk_mgmt);
 
         tsk_mgmt->opcode        = SRP_TSK_MGMT;
-        tsk_mgmt->lun           = cpu_to_be64((u64) scmnd->device->lun << 48);
-        tsk_mgmt->tag           = req_index | SRP_TAG_TSK_MGMT;
+        tsk_mgmt->lun           = cpu_to_be64((u64) req->scmnd->device->lun << 48);
+        tsk_mgmt->tag           = req->index | SRP_TAG_TSK_MGMT;
         tsk_mgmt->tsk_mgmt_func = func;
-        tsk_mgmt->task_tag      = req_index;
+        tsk_mgmt->task_tag      = req->index;
 
         if (__srp_post_send(target, iu, sizeof *tsk_mgmt))
                 goto out;
@@ -1188,37 +1169,85 @@ static int srp_send_tsk_mgmt(struct scsi_cmnd *scmnd, u8 func)
         req->tsk_mgmt = iu;
 
         spin_unlock_irq(target->scsi_host->host_lock);
+
         if (!wait_for_completion_timeout(&req->done,
                                          msecs_to_jiffies(SRP_ABORT_TIMEOUT_MS)))
-                return FAILED;
-        spin_lock_irq(target->scsi_host->host_lock);
+                return -1;
 
-        if (req->cmd_done) {
-                srp_remove_req(target, req, req_index);
-                scmnd->scsi_done(scmnd);
-        } else if (!req->tsk_status) {
-                srp_remove_req(target, req, req_index);
-                scmnd->result = DID_ABORT << 16;
-                ret = SUCCESS;
-        }
+        return 0;
 
 out:
         spin_unlock_irq(target->scsi_host->host_lock);
-        return ret;
+        return -1;
+}
+
+static int srp_find_req(struct srp_target_port *target,
+                        struct scsi_cmnd *scmnd,
+                        struct srp_request **req)
+{
+        if (scmnd->host_scribble == (void *) -1L)
+                return -1;
+
+        *req = &target->req_ring[(long) scmnd->host_scribble];
+
+        return 0;
 }
 
 static int srp_abort(struct scsi_cmnd *scmnd)
 {
+        struct srp_target_port *target = host_to_target(scmnd->device->host);
+        struct srp_request *req;
+        int ret = SUCCESS;
+
         printk(KERN_ERR "SRP abort called\n");
 
-        return srp_send_tsk_mgmt(scmnd, SRP_TSK_ABORT_TASK);
+        if (srp_find_req(target, scmnd, &req))
+                return FAILED;
+        if (srp_send_tsk_mgmt(target, req, SRP_TSK_ABORT_TASK))
+                return FAILED;
+
+        spin_lock_irq(target->scsi_host->host_lock);
+
+        if (req->cmd_done) {
+                srp_remove_req(target, req);
+                scmnd->scsi_done(scmnd);
+        } else if (!req->tsk_status) {
+                srp_remove_req(target, req);
+                scmnd->result = DID_ABORT << 16;
+        } else
+                ret = FAILED;
+
+        spin_unlock_irq(target->scsi_host->host_lock);
+
+        return ret;
 }
 
 static int srp_reset_device(struct scsi_cmnd *scmnd)
 {
+        struct srp_target_port *target = host_to_target(scmnd->device->host);
+        struct srp_request *req, *tmp;
+
         printk(KERN_ERR "SRP reset_device called\n");
 
-        return srp_send_tsk_mgmt(scmnd, SRP_TSK_LUN_RESET);
+        if (srp_find_req(target, scmnd, &req))
+                return FAILED;
+        if (srp_send_tsk_mgmt(target, req, SRP_TSK_LUN_RESET))
+                return FAILED;
+        if (req->tsk_status)
+                return FAILED;
+
+        spin_lock_irq(target->scsi_host->host_lock);
+
+        list_for_each_entry_safe(req, tmp, &target->req_queue, list)
+                if (req->scmnd->device == scmnd->device) {
+                        req->scmnd->result = DID_RESET << 16;
+                        scmnd->scsi_done(scmnd);
+                        srp_remove_req(target, req);
+                }
+
+        spin_unlock_irq(target->scsi_host->host_lock);
+
+        return SUCCESS;
 }
 
 static int srp_reset_host(struct scsi_cmnd *scmnd)
@@ -1518,10 +1547,12 @@ static ssize_t srp_create_target(struct class_device *class_dev,
 
         INIT_WORK(&target->work, srp_reconnect_work, target);
 
-        for (i = 0; i < SRP_SQ_SIZE - 1; ++i)
-                target->req_ring[i].next = i + 1;
-        target->req_ring[SRP_SQ_SIZE - 1].next = -1;
+        INIT_LIST_HEAD(&target->free_reqs);
         INIT_LIST_HEAD(&target->req_queue);
+        for (i = 0; i < SRP_SQ_SIZE; ++i) {
+                target->req_ring[i].index = i;
+                list_add_tail(&target->req_ring[i].list, &target->free_reqs);
+        }
 
         ret = srp_parse_options(buf, target);
         if (ret)
diff --git a/drivers/infiniband/ulp/srp/ib_srp.h b/drivers/infiniband/ulp/srp/ib_srp.h
index bd7f7c3115de..c5cd43aae860 100644
--- a/drivers/infiniband/ulp/srp/ib_srp.h
+++ b/drivers/infiniband/ulp/srp/ib_srp.h
@@ -101,7 +101,7 @@ struct srp_request {
          */
         struct scatterlist      fake_sg;
         struct completion       done;
-        short                   next;
+        short                   index;
         u8                      cmd_done;
         u8                      tsk_status;
 };
@@ -133,7 +133,7 @@ struct srp_target_port {
         unsigned                tx_tail;
         struct srp_iu          *tx_ring[SRP_SQ_SIZE + 1];
 
-        int                     req_head;
+        struct list_head        free_reqs;
         struct list_head        req_queue;
         struct srp_request      req_ring[SRP_SQ_SIZE];
 
diff --git a/drivers/input/evdev.c b/drivers/input/evdev.c
index a34e3d91d9ed..ba325f16d077 100644
--- a/drivers/input/evdev.c
+++ b/drivers/input/evdev.c
@@ -403,6 +403,27 @@ static long evdev_ioctl_handler(struct file *file, unsigned int cmd,
                 case EVIOCGID:
                         if (copy_to_user(p, &dev->id, sizeof(struct input_id)))
                                 return -EFAULT;
+                        return 0;
+
+                case EVIOCGREP:
+                        if (!test_bit(EV_REP, dev->evbit))
+                                return -ENOSYS;
+                        if (put_user(dev->rep[REP_DELAY], ip))
+                                return -EFAULT;
+                        if (put_user(dev->rep[REP_PERIOD], ip + 1))
+                                return -EFAULT;
+                        return 0;
+
+                case EVIOCSREP:
+                        if (!test_bit(EV_REP, dev->evbit))
+                                return -ENOSYS;
+                        if (get_user(u, ip))
+                                return -EFAULT;
+                        if (get_user(v, ip + 1))
+                                return -EFAULT;
+
+                        input_event(dev, EV_REP, REP_DELAY, u);
+                        input_event(dev, EV_REP, REP_PERIOD, v);
 
                         return 0;
 
diff --git a/drivers/input/input.c b/drivers/input/input.c
index a935abeffffc..3038c268917d 100644
--- a/drivers/input/input.c
+++ b/drivers/input/input.c
@@ -155,6 +155,9 @@ void input_event(struct input_dev *dev, unsigned int type, unsigned int code, in
                         if (code > SND_MAX || !test_bit(code, dev->sndbit))
                                 return;
 
+                        if (!!test_bit(code, dev->snd) != !!value)
+                                change_bit(code, dev->snd);
+
                         if (dev->event) dev->event(dev, type, code, value);
 
                         break;
@@ -286,19 +289,19 @@ static struct input_device_id *input_match_device(struct input_device_id *id, st
         for (; id->flags || id->driver_info; id++) {
 
                 if (id->flags & INPUT_DEVICE_ID_MATCH_BUS)
-                        if (id->id.bustype != dev->id.bustype)
+                        if (id->bustype != dev->id.bustype)
                                 continue;
 
                 if (id->flags & INPUT_DEVICE_ID_MATCH_VENDOR)
-                        if (id->id.vendor != dev->id.vendor)
+                        if (id->vendor != dev->id.vendor)
                                 continue;
 
                 if (id->flags & INPUT_DEVICE_ID_MATCH_PRODUCT)
-                        if (id->id.product != dev->id.product)
+                        if (id->product != dev->id.product)
                                 continue;
 
                 if (id->flags & INPUT_DEVICE_ID_MATCH_VERSION)
-                        if (id->id.version != dev->id.version)
+                        if (id->version != dev->id.version)
                                 continue;
 
                 MATCH_BIT(evbit,  EV_MAX);
diff --git a/drivers/input/keyboard/hil_kbd.c b/drivers/input/keyboard/hil_kbd.c
index 1dca3cf42a54..2e4abdc26367 100644
--- a/drivers/input/keyboard/hil_kbd.c
+++ b/drivers/input/keyboard/hil_kbd.c
@@ -350,11 +350,11 @@ static int hil_kbd_connect(struct serio *serio, struct serio_driver *drv)
         return 0;
  bail2:
         serio_close(serio);
+        serio_set_drvdata(serio, NULL);
  bail1:
         input_free_device(kbd->dev);
  bail0:
         kfree(kbd);
-        serio_set_drvdata(serio, NULL);
         return -EIO;
 }
 
diff --git a/drivers/input/keyboard/spitzkbd.c b/drivers/input/keyboard/spitzkbd.c
index bc61cf8cfc65..1d238a9d52d6 100644
--- a/drivers/input/keyboard/spitzkbd.c
+++ b/drivers/input/keyboard/spitzkbd.c
@@ -53,8 +53,8 @@ static unsigned char spitzkbd_keycode[NR_SCANCODES] = {
         KEY_LEFTCTRL, KEY_1, KEY_3, KEY_5, KEY_6, KEY_7, KEY_9, KEY_0, KEY_BACKSPACE, SPITZ_KEY_EXOK, SPITZ_KEY_EXCANCEL, 0, 0, 0, 0, 0,  /* 1-16 */
         0, KEY_2, KEY_4, KEY_R, KEY_Y, KEY_8, KEY_I, KEY_O, KEY_P, SPITZ_KEY_EXJOGDOWN, SPITZ_KEY_EXJOGUP, 0, 0, 0, 0, 0, /* 17-32 */
         KEY_TAB, KEY_Q, KEY_E, KEY_T, KEY_G, KEY_U, KEY_J, KEY_K, 0, 0, 0, 0, 0, 0, 0, 0,                                 /* 33-48 */
-        SPITZ_KEY_CALENDER, KEY_W, KEY_S, KEY_F, KEY_V, KEY_H, KEY_M, KEY_L, 0, KEY_RIGHTSHIFT, 0, 0, 0, 0, 0, 0,         /* 49-64 */
-        SPITZ_KEY_ADDRESS, KEY_A, KEY_D, KEY_C, KEY_B, KEY_N, KEY_DOT, 0, KEY_ENTER, KEY_LEFTSHIFT, 0, 0, 0, 0, 0, 0,     /* 65-80 */
+        SPITZ_KEY_ADDRESS, KEY_W, KEY_S, KEY_F, KEY_V, KEY_H, KEY_M, KEY_L, 0, KEY_RIGHTSHIFT, 0, 0, 0, 0, 0, 0,         /* 49-64 */
+        SPITZ_KEY_CALENDER, KEY_A, KEY_D, KEY_C, KEY_B, KEY_N, KEY_DOT, 0, KEY_ENTER, KEY_LEFTSHIFT, 0, 0, 0, 0, 0, 0,    /* 65-80 */
         SPITZ_KEY_MAIL, KEY_Z, KEY_X, KEY_MINUS, KEY_SPACE, KEY_COMMA, 0, KEY_UP, 0, 0, SPITZ_KEY_FN, 0, 0, 0, 0, 0,      /* 81-96 */
         KEY_SYSRQ, SPITZ_KEY_JAP1, SPITZ_KEY_JAP2, SPITZ_KEY_CANCEL, SPITZ_KEY_OK, SPITZ_KEY_MENU, KEY_LEFT, KEY_DOWN, KEY_RIGHT, 0, 0, 0, 0, 0, 0, 0  /* 97-112 */
 };
diff --git a/drivers/input/misc/wistron_btns.c b/drivers/input/misc/wistron_btns.c
index 4b415d9b0123..36cd2e07fce8 100644
--- a/drivers/input/misc/wistron_btns.c
+++ b/drivers/input/misc/wistron_btns.c
@@ -273,6 +273,18 @@ static struct key_entry keymap_fs_amilo_pro_v2000[] = {
         { KE_END,  0 }
 };
 
+static struct key_entry keymap_fujitsu_n3510[] = {
+        { KE_KEY, 0x11, KEY_PROG1 },
+        { KE_KEY, 0x12, KEY_PROG2 },
+        { KE_KEY, 0x36, KEY_WWW },
+        { KE_KEY, 0x31, KEY_MAIL },
+        { KE_KEY, 0x71, KEY_STOPCD },
+        { KE_KEY, 0x72, KEY_PLAYPAUSE },
+        { KE_KEY, 0x74, KEY_REWIND },
+        { KE_KEY, 0x78, KEY_FORWARD },
+        { KE_END, 0 }
+};
+
 static struct key_entry keymap_wistron_ms2141[] = {
         { KE_KEY,  0x11, KEY_PROG1 },
         { KE_KEY,  0x12, KEY_PROG2 },
@@ -323,6 +335,24 @@ static struct dmi_system_id dmi_ids[] = {
         },
         {
                 .callback = dmi_matched,
+                .ident = "Fujitsu-Siemens Amilo M7400",
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "FUJITSU SIEMENS"),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "AMILO M        "),
+                },
+                .driver_data = keymap_fs_amilo_pro_v2000
+        },
+        {
+                .callback = dmi_matched,
+                .ident = "Fujitsu N3510",
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "FUJITSU"),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "N3510"),
+                },
+                .driver_data = keymap_fujitsu_n3510
+        },
+        {
+                .callback = dmi_matched,
                 .ident = "Acer Aspire 1500",
                 .matches = {
                         DMI_MATCH(DMI_SYS_VENDOR, "Acer"),
diff --git a/drivers/input/mouse/psmouse-base.c b/drivers/input/mouse/psmouse-base.c
index 32d70ed8f41d..136321a2cfdb 100644
--- a/drivers/input/mouse/psmouse-base.c
+++ b/drivers/input/mouse/psmouse-base.c
@@ -302,8 +302,10 @@ static irqreturn_t psmouse_interrupt(struct serio *serio,
  * Check if this is a new device announcement (0xAA 0x00)
  */
         if (unlikely(psmouse->packet[0] == PSMOUSE_RET_BAT && psmouse->pktcnt <= 2)) {
-                if (psmouse->pktcnt == 1)
+                if (psmouse->pktcnt == 1) {
+                        psmouse->last = jiffies;
                         goto out;
+                }
 
                 if (psmouse->packet[1] == PSMOUSE_RET_ID) {
                         __psmouse_set_state(psmouse, PSMOUSE_IGNORE);
diff --git a/drivers/input/serio/i8042-io.h b/drivers/input/serio/i8042-io.h
index 9a9221644250..cc21914fbc72 100644
--- a/drivers/input/serio/i8042-io.h
+++ b/drivers/input/serio/i8042-io.h
@@ -67,14 +67,14 @@ static inline int i8042_platform_init(void)
  * On some platforms touching the i8042 data register region can do really
  * bad things. Because of this the region is always reserved on such boxes.
  */
-#if !defined(__sh__) && !defined(__alpha__) && !defined(__mips__) && !defined(CONFIG_PPC64)
+#if !defined(__sh__) && !defined(__alpha__) && !defined(__mips__) && !defined(CONFIG_PPC_MERGE)
         if (!request_region(I8042_DATA_REG, 16, "i8042"))
                 return -EBUSY;
 #endif
 
         i8042_reset = 1;
 
-#if defined(CONFIG_PPC64)
+#if defined(CONFIG_PPC_MERGE)
         if (check_legacy_ioport(I8042_DATA_REG))
                 return -EBUSY;
         if (!request_region(I8042_DATA_REG, 16, "i8042"))
diff --git a/drivers/input/touchscreen/ads7846.c b/drivers/input/touchscreen/ads7846.c
index 46d1fec2cfd8..1494175ac6fe 100644
--- a/drivers/input/touchscreen/ads7846.c
+++ b/drivers/input/touchscreen/ads7846.c
@@ -2,6 +2,8 @@
  * ADS7846 based touchscreen and sensor driver
  *
  * Copyright (c) 2005 David Brownell
+ * Copyright (c) 2006 Nokia Corporation
+ * Various changes: Imre Deak <imre.deak@nokia.com>
  *
  * Using code from:
  *  - corgi_ts.c
@@ -34,17 +36,25 @@
 
 
 /*
- * This code has been lightly tested on an ads7846.
+ * This code has been tested on an ads7846 / N770 device.
  * Support for ads7843 and ads7845 has only been stubbed in.
  *
- * Not yet done:  investigate the values reported.  Are x/y/pressure
- * event values sane enough for X11?  How accurate are the temperature
- * and voltage readings?  (System-specific calibration should support
+ * Not yet done:  How accurate are the temperature and voltage
+ * readings? (System-specific calibration should support
  * accuracy of 0.3 degrees C; otherwise it's 2.0 degrees.)
  *
+ * IRQ handling needs a workaround because of a shortcoming in handling
+ * edge triggered IRQs on some platforms like the OMAP1/2. These
+ * platforms don't handle the ARM lazy IRQ disabling properly, thus we
+ * have to maintain our own SW IRQ disabled status. This should be
+ * removed as soon as the affected platform's IRQ handling is fixed.
+ *
  * app note sbaa036 talks in more detail about accurate sampling...
  * that ought to help in situations like LCDs inducing noise (which
  * can also be helped by using synch signals) and more generally.
+ * This driver tries to utilize the measures described in the app
+ * note. The strength of filtering can be set in the board-* specific
+ * files.
  */
 
 #define TS_POLL_PERIOD  msecs_to_jiffies(10)
@@ -61,6 +71,7 @@ struct ts_event {
         __be16 x;
         __be16 y;
         __be16 z1, z2;
+        int    ignore;
 };
 
 struct ads7846 {
@@ -71,12 +82,23 @@ struct ads7846 {
         u16                     model;
         u16                     vref_delay_usecs;
         u16                     x_plate_ohms;
+        u16                     pressure_max;
 
-        u8                      read_x, read_y, read_z1, read_z2;
+        u8                      read_x, read_y, read_z1, read_z2, pwrdown;
+        u16                     dummy;          /* for the pwrdown read */
         struct ts_event         tc;
 
-        struct spi_transfer     xfer[8];
-        struct spi_message      msg;
+        struct spi_transfer     xfer[10];
+        struct spi_message      msg[5];
+        struct spi_message      *last_msg;
+        int                     msg_idx;
+        int                     read_cnt;
+        int                     read_rep;
+        int                     last_read;
+
+        u16                     debounce_max;
+        u16                     debounce_tol;
+        u16                     debounce_rep;
 
         spinlock_t              lock;
         struct timer_list       timer;          /* P: lock */
@@ -84,6 +106,9 @@ struct ads7846 {
         unsigned                pending:1;      /* P: lock */
 // FIXME remove "irq_disabled"
         unsigned                irq_disabled:1; /* P: lock */
+        unsigned                disabled:1;
+
+        int                     (*get_pendown_state)(void);
 };
 
 /* leave chip selected when we're done, for quicker re-select? */
@@ -125,7 +150,9 @@ struct ads7846 {
 #define READ_Y  (READ_12BIT_DFR(y)  | ADS_PD10_ADC_ON)
 #define READ_Z1 (READ_12BIT_DFR(z1) | ADS_PD10_ADC_ON)
 #define READ_Z2 (READ_12BIT_DFR(z2) | ADS_PD10_ADC_ON)
-#define READ_X  (READ_12BIT_DFR(x)  | ADS_PD10_PDOWN)   /* LAST */
+
+#define READ_X  (READ_12BIT_DFR(x)  | ADS_PD10_ADC_ON)
+#define PWRDOWN (READ_12BIT_DFR(y)  | ADS_PD10_PDOWN)   /* LAST */
 
 /* single-ended samples need to first power up reference voltage;
  * we leave both ADC and VREF powered
@@ -152,6 +179,15 @@ struct ser_req {
         struct spi_transfer     xfer[6];
 };
 
+static void ads7846_enable(struct ads7846 *ts);
+static void ads7846_disable(struct ads7846 *ts);
+
+static int device_suspended(struct device *dev)
+{
+        struct ads7846 *ts = dev_get_drvdata(dev);
+        return dev->power.power_state.event != PM_EVENT_ON || ts->disabled;
+}
+
 static int ads7846_read12_ser(struct device *dev, unsigned command)
 {
         struct spi_device       *spi = to_spi_device(dev);
@@ -164,7 +200,7 @@ static int ads7846_read12_ser(struct device *dev, unsigned command)
         if (!req)
                 return -ENOMEM;
 
-        INIT_LIST_HEAD(&req->msg.transfers);
+        spi_message_init(&req->msg);
 
         /* activate reference, so it has time to settle; */
         req->ref_on = REF_ON;
@@ -204,8 +240,10 @@ static int ads7846_read12_ser(struct device *dev, unsigned command)
         for (i = 0; i < 6; i++)
                 spi_message_add_tail(&req->xfer[i], &req->msg);
 
+        ts->irq_disabled = 1;
         disable_irq(spi->irq);
         status = spi_sync(spi, &req->msg);
+        ts->irq_disabled = 0;
         enable_irq(spi->irq);
 
         if (req->msg.status)
@@ -233,6 +271,52 @@ SHOW(temp1)
 SHOW(vaux)
 SHOW(vbatt)
 
+static int is_pen_down(struct device *dev)
+{
+        struct ads7846          *ts = dev_get_drvdata(dev);
+
+        return ts->pendown;
+}
+
+static ssize_t ads7846_pen_down_show(struct device *dev,
+                                     struct device_attribute *attr, char *buf)
+{
+        return sprintf(buf, "%u\n", is_pen_down(dev));
+}
+
+static DEVICE_ATTR(pen_down, S_IRUGO, ads7846_pen_down_show, NULL);
+
+static ssize_t ads7846_disable_show(struct device *dev,
+                                     struct device_attribute *attr, char *buf)
+{
+        struct ads7846  *ts = dev_get_drvdata(dev);
+
+        return sprintf(buf, "%u\n", ts->disabled);
+}
+
+static ssize_t ads7846_disable_store(struct device *dev,
+                                     struct device_attribute *attr,
+                                     const char *buf, size_t count)
+{
+        struct ads7846 *ts = dev_get_drvdata(dev);
+        char *endp;
+        int i;
+
+        i = simple_strtoul(buf, &endp, 10);
+        spin_lock_irq(&ts->lock);
+
+        if (i)
+                ads7846_disable(ts);
+        else
+                ads7846_enable(ts);
+
+        spin_unlock_irq(&ts->lock);
+
+        return count;
+}
+
+static DEVICE_ATTR(disable, 0664, ads7846_disable_show, ads7846_disable_store);
+
 /*--------------------------------------------------------------------------*/
 
 /*
@@ -264,7 +348,7 @@ static void ads7846_rx(void *ads)
         if (x == MAX_12BIT)
                 x = 0;
 
-        if (x && z1 && ts->spi->dev.power.power_state.event == PM_EVENT_ON) {
+        if (likely(x && z1 && !device_suspended(&ts->spi->dev))) {
                 /* compute touch pressure resistance using equation #2 */
                 Rt = z2;
                 Rt -= z1;
@@ -275,6 +359,14 @@ static void ads7846_rx(void *ads)
         } else
                 Rt = 0;
 
+        /* Sample found inconsistent by debouncing or pressure is beyond
+        * the maximum. Don't report it to user space, repeat at least
+        * once more the measurement */
+        if (ts->tc.ignore || Rt > ts->pressure_max) {
+                mod_timer(&ts->timer, jiffies + TS_POLL_PERIOD);
+                return;
+        }
+
         /* NOTE:  "pendown" is inferred from pressure; we don't rely on
          * being able to check nPENIRQ status, or "friendly" trigger modes
          * (both-edges is much better than just-falling or low-level).
@@ -296,11 +388,13 @@ static void ads7846_rx(void *ads)
         if (Rt) {
                 input_report_abs(input_dev, ABS_X, x);
                 input_report_abs(input_dev, ABS_Y, y);
-                input_report_abs(input_dev, ABS_PRESSURE, Rt);
                 sync = 1;
         }
-        if (sync)
+
+        if (sync) {
+                input_report_abs(input_dev, ABS_PRESSURE, Rt);
                 input_sync(input_dev);
+        }
 
 #ifdef  VERBOSE
         if (Rt || ts->pendown)
@@ -308,80 +402,138 @@ static void ads7846_rx(void *ads)
                         x, y, Rt, Rt ? "" : " UP");
 #endif
 
-        /* don't retrigger while we're suspended */
         spin_lock_irqsave(&ts->lock, flags);
 
         ts->pendown = (Rt != 0);
-        ts->pending = 0;
+        mod_timer(&ts->timer, jiffies + TS_POLL_PERIOD);
 
-        if (ts->spi->dev.power.power_state.event == PM_EVENT_ON) {
-                if (ts->pendown)
-                        mod_timer(&ts->timer, jiffies + TS_POLL_PERIOD);
-                else if (ts->irq_disabled) {
-                        ts->irq_disabled = 0;
-                        enable_irq(ts->spi->irq);
+        spin_unlock_irqrestore(&ts->lock, flags);
+}
+
+static void ads7846_debounce(void *ads)
+{
+        struct ads7846          *ts = ads;
+        struct spi_message      *m;
+        struct spi_transfer     *t;
+        int                     val;
+        int                     status;
+
+        m = &ts->msg[ts->msg_idx];
+        t = list_entry(m->transfers.prev, struct spi_transfer, transfer_list);
+        val = (*(u16 *)t->rx_buf) >> 3;
+        if (!ts->read_cnt || (abs(ts->last_read - val) > ts->debounce_tol)) {
+                /* Repeat it, if this was the first read or the read
+                 * wasn't consistent enough. */
+                if (ts->read_cnt < ts->debounce_max) {
+                        ts->last_read = val;
+                        ts->read_cnt++;
+                } else {
+                        /* Maximum number of debouncing reached and still
+                         * not enough number of consistent readings. Abort
+                         * the whole sample, repeat it in the next sampling
+                         * period.
+                         */
+                        ts->tc.ignore = 1;
+                        ts->read_cnt = 0;
+                        /* Last message will contain ads7846_rx() as the
+                         * completion function.
+                         */
+                        m = ts->last_msg;
                 }
+                /* Start over collecting consistent readings. */
+                ts->read_rep = 0;
+        } else {
+                if (++ts->read_rep > ts->debounce_rep) {
+                        /* Got a good reading for this coordinate,
+                         * go for the next one. */
+                        ts->tc.ignore = 0;
+                        ts->msg_idx++;
+                        ts->read_cnt = 0;
+                        ts->read_rep = 0;
+                        m++;
+                } else
+                        /* Read more values that are consistent. */
+                        ts->read_cnt++;
         }
-
-        spin_unlock_irqrestore(&ts->lock, flags);
+        status = spi_async(ts->spi, m);
+        if (status)
+                dev_err(&ts->spi->dev, "spi_async --> %d\n",
+                                status);
 }
 
 static void ads7846_timer(unsigned long handle)
 {
         struct ads7846  *ts = (void *)handle;
         int             status = 0;
-        unsigned long   flags;
+
+        spin_lock_irq(&ts->lock);
+
+        if (unlikely(ts->msg_idx && !ts->pendown)) {
+                /* measurment cycle ended */
+                if (!device_suspended(&ts->spi->dev)) {
+                        ts->irq_disabled = 0;
+                        enable_irq(ts->spi->irq);
+                }
+                ts->pending = 0;
+                ts->msg_idx = 0;
+        } else {
+                /* pen is still down, continue with the measurement */
+                ts->msg_idx = 0;
+                status = spi_async(ts->spi, &ts->msg[0]);
+                if (status)
+                        dev_err(&ts->spi->dev, "spi_async --> %d\n", status);
+        }
+
+        spin_unlock_irq(&ts->lock);
+}
+
+static irqreturn_t ads7846_irq(int irq, void *handle, struct pt_regs *regs)
+{
+        struct ads7846 *ts = handle;
+        unsigned long flags;
 
         spin_lock_irqsave(&ts->lock, flags);
-        if (!ts->pending) {
-                ts->pending = 1;
+        if (likely(ts->get_pendown_state())) {
                 if (!ts->irq_disabled) {
+                        /* REVISIT irq logic for many ARM chips has cloned a
+                         * bug wherein disabling an irq in its handler won't
+                         * work;(it's disabled lazily, and too late to work.
+                         * until all their irq logic is fixed, we must shadow
+                         * that state here.
+                         */
                         ts->irq_disabled = 1;
                         disable_irq(ts->spi->irq);
+                        ts->pending = 1;
+                        mod_timer(&ts->timer, jiffies);
                 }
-                status = spi_async(ts->spi, &ts->msg);
-                if (status)
-                        dev_err(&ts->spi->dev, "spi_async --> %d\n",
-                                        status);
         }
         spin_unlock_irqrestore(&ts->lock, flags);
-}
 
-static irqreturn_t ads7846_irq(int irq, void *handle, struct pt_regs *regs)
-{
-        ads7846_timer((unsigned long) handle);
         return IRQ_HANDLED;
 }
 
 /*--------------------------------------------------------------------------*/
 
-static int
-ads7846_suspend(struct spi_device *spi, pm_message_t message)
+/* Must be called with ts->lock held */
+static void ads7846_disable(struct ads7846 *ts)
 {
-        struct ads7846 *ts = dev_get_drvdata(&spi->dev);
-        unsigned long   flags;
+        if (ts->disabled)
+                return;
 
-        spin_lock_irqsave(&ts->lock, flags);
-
-        spi->dev.power.power_state = message;
+        ts->disabled = 1;
 
         /* are we waiting for IRQ, or polling? */
-        if (!ts->pendown) {
-                if (!ts->irq_disabled) {
-                        ts->irq_disabled = 1;
-                        disable_irq(ts->spi->irq);
-                }
+        if (!ts->pending) {
+                ts->irq_disabled = 1;
+                disable_irq(ts->spi->irq);
         } else {
-                /* polling; force a final SPI completion;
-                 * that will clean things up neatly
+                /* the timer will run at least once more, and
+                 * leave everything in a clean state, IRQ disabled
                  */
-                if (!ts->pending)
-                        mod_timer(&ts->timer, jiffies);
-
-                while (ts->pendown || ts->pending) {
-                        spin_unlock_irqrestore(&ts->lock, flags);
-                        udelay(10);
-                        spin_lock_irqsave(&ts->lock, flags);
+                while (ts->pending) {
+                        spin_unlock_irq(&ts->lock);
+                        msleep(1);
+                        spin_lock_irq(&ts->lock);
                 }
         }
 
@@ -389,17 +541,45 @@ ads7846_suspend(struct spi_device *spi, pm_message_t message)
          * leave it that way after every request
          */
 
-        spin_unlock_irqrestore(&ts->lock, flags);
+}
+
+/* Must be called with ts->lock held */
+static void ads7846_enable(struct ads7846 *ts)
+{
+        if (!ts->disabled)
+                return;
+
+        ts->disabled = 0;
+        ts->irq_disabled = 0;
+        enable_irq(ts->spi->irq);
+}
+
+static int ads7846_suspend(struct spi_device *spi, pm_message_t message)
+{
+        struct ads7846 *ts = dev_get_drvdata(&spi->dev);
+
+        spin_lock_irq(&ts->lock);
+
+        spi->dev.power.power_state = message;
+        ads7846_disable(ts);
+
+        spin_unlock_irq(&ts->lock);
+
         return 0;
+
 }
 
 static int ads7846_resume(struct spi_device *spi)
 {
         struct ads7846 *ts = dev_get_drvdata(&spi->dev);
 
-        ts->irq_disabled = 0;
-        enable_irq(ts->spi->irq);
+        spin_lock_irq(&ts->lock);
+
         spi->dev.power.power_state = PMSG_ON;
+        ads7846_enable(ts);
+
+        spin_unlock_irq(&ts->lock);
+
         return 0;
 }
 
@@ -408,6 +588,7 @@ static int __devinit ads7846_probe(struct spi_device *spi)
         struct ads7846                  *ts;
         struct input_dev                *input_dev;
         struct ads7846_platform_data    *pdata = spi->dev.platform_data;
+        struct spi_message              *m;
         struct spi_transfer             *x;
         int                             err;
 
@@ -428,6 +609,11 @@ static int __devinit ads7846_probe(struct spi_device *spi)
                 return -EINVAL;
         }
 
+        if (pdata->get_pendown_state == NULL) {
+                dev_dbg(&spi->dev, "no get_pendown_state function?\n");
+                return -EINVAL;
+        }
+
         /* We'd set the wordsize to 12 bits ... except that some controllers
          * will then treat the 8 bit command words as 12 bits (and drop the
          * four MSBs of the 12 bit result).  Result: inputs must be shifted
@@ -451,9 +637,21 @@ static int __devinit ads7846_probe(struct spi_device *spi)
         ts->timer.data = (unsigned long) ts;
         ts->timer.function = ads7846_timer;
 
+        spin_lock_init(&ts->lock);
+
         ts->model = pdata->model ? : 7846;
         ts->vref_delay_usecs = pdata->vref_delay_usecs ? : 100;
         ts->x_plate_ohms = pdata->x_plate_ohms ? : 400;
+        ts->pressure_max = pdata->pressure_max ? : ~0;
+        if (pdata->debounce_max) {
+                ts->debounce_max = pdata->debounce_max;
+                ts->debounce_tol = pdata->debounce_tol;
+                ts->debounce_rep = pdata->debounce_rep;
+                if (ts->debounce_rep > ts->debounce_max + 1)
+                        ts->debounce_rep = ts->debounce_max - 1;
+        } else
+                ts->debounce_tol = ~0;
+        ts->get_pendown_state = pdata->get_pendown_state;
 
         snprintf(ts->phys, sizeof(ts->phys), "%s/input0", spi->dev.bus_id);
 
@@ -477,60 +675,100 @@ static int __devinit ads7846_probe(struct spi_device *spi)
         /* set up the transfers to read touchscreen state; this assumes we
          * use formula #2 for pressure, not #3.
          */
-        INIT_LIST_HEAD(&ts->msg.transfers);
+        m = &ts->msg[0];
         x = ts->xfer;
 
+        spi_message_init(m);
+
         /* y- still on; turn on only y+ (and ADC) */
         ts->read_y = READ_Y;
         x->tx_buf = &ts->read_y;
         x->len = 1;
-        spi_message_add_tail(x, &ts->msg);
+        spi_message_add_tail(x, m);
 
         x++;
         x->rx_buf = &ts->tc.y;
         x->len = 2;
-        spi_message_add_tail(x, &ts->msg);
+        spi_message_add_tail(x, m);
+
+        m->complete = ads7846_debounce;
+        m->context = ts;
+
+        m++;
+        spi_message_init(m);
+
+        /* turn y- off, x+ on, then leave in lowpower */
+        x++;
+        ts->read_x = READ_X;
+        x->tx_buf = &ts->read_x;
+        x->len = 1;
+        spi_message_add_tail(x, m);
+
+        x++;
+        x->rx_buf = &ts->tc.x;
+        x->len = 2;
+        spi_message_add_tail(x, m);
+
+        m->complete = ads7846_debounce;
+        m->context = ts;
 
         /* turn y+ off, x- on; we'll use formula #2 */
         if (ts->model == 7846) {
+                m++;
+                spi_message_init(m);
+
                 x++;
                 ts->read_z1 = READ_Z1;
                 x->tx_buf = &ts->read_z1;
                 x->len = 1;
-                spi_message_add_tail(x, &ts->msg);
+                spi_message_add_tail(x, m);
 
                 x++;
                 x->rx_buf = &ts->tc.z1;
                 x->len = 2;
-                spi_message_add_tail(x, &ts->msg);
+                spi_message_add_tail(x, m);
+
+                m->complete = ads7846_debounce;
+                m->context = ts;
+
+                m++;
+                spi_message_init(m);
 
                 x++;
                 ts->read_z2 = READ_Z2;
                 x->tx_buf = &ts->read_z2;
                 x->len = 1;
-                spi_message_add_tail(x, &ts->msg);
+                spi_message_add_tail(x, m);
 
                 x++;
                 x->rx_buf = &ts->tc.z2;
                 x->len = 2;
-                spi_message_add_tail(x, &ts->msg);
+                spi_message_add_tail(x, m);
+
+                m->complete = ads7846_debounce;
+                m->context = ts;
         }
 
-        /* turn y- off, x+ on, then leave in lowpower */
+        /* power down */
+        m++;
+        spi_message_init(m);
+
         x++;
-        ts->read_x = READ_X;
-        x->tx_buf = &ts->read_x;
+        ts->pwrdown = PWRDOWN;
+        x->tx_buf = &ts->pwrdown;
         x->len = 1;
-        spi_message_add_tail(x, &ts->msg);
+        spi_message_add_tail(x, m);
 
         x++;
-        x->rx_buf = &ts->tc.x;
+        x->rx_buf = &ts->dummy;
         x->len = 2;
         CS_CHANGE(*x);
-        spi_message_add_tail(x, &ts->msg);
+        spi_message_add_tail(x, m);
 
-        ts->msg.complete = ads7846_rx;
-        ts->msg.context = ts;
+        m->complete = ads7846_rx;
+        m->context = ts;
+
+        ts->last_msg = m;
 
         if (request_irq(spi->irq, ads7846_irq,
                         SA_SAMPLE_RANDOM | SA_TRIGGER_FALLING,
@@ -559,13 +797,27 @@ static int __devinit ads7846_probe(struct spi_device *spi)
                 device_create_file(&spi->dev, &dev_attr_vbatt);
         device_create_file(&spi->dev, &dev_attr_vaux);
 
+        device_create_file(&spi->dev, &dev_attr_pen_down);
+
+        device_create_file(&spi->dev, &dev_attr_disable);
+
         err = input_register_device(input_dev);
         if (err)
-                goto err_free_irq;
+                goto err_remove_attr;
 
         return 0;
 
- err_free_irq:
+ err_remove_attr:
+        device_remove_file(&spi->dev, &dev_attr_disable);
+        device_remove_file(&spi->dev, &dev_attr_pen_down);
+        if (ts->model == 7846) {
+                device_remove_file(&spi->dev, &dev_attr_temp1);
+                device_remove_file(&spi->dev, &dev_attr_temp0);
+        }
+        if (ts->model != 7845)
+                device_remove_file(&spi->dev, &dev_attr_vbatt);
+        device_remove_file(&spi->dev, &dev_attr_vaux);
+
         free_irq(spi->irq, ts);
  err_free_mem:
         input_free_device(input_dev);
@@ -577,20 +829,24 @@ static int __devexit ads7846_remove(struct spi_device *spi)
 {
         struct ads7846          *ts = dev_get_drvdata(&spi->dev);
 
+        input_unregister_device(ts->input);
+
         ads7846_suspend(spi, PMSG_SUSPEND);
-        free_irq(ts->spi->irq, ts);
-        if (ts->irq_disabled)
-                enable_irq(ts->spi->irq);
 
+        device_remove_file(&spi->dev, &dev_attr_disable);
+        device_remove_file(&spi->dev, &dev_attr_pen_down);
         if (ts->model == 7846) {
-                device_remove_file(&spi->dev, &dev_attr_temp0);
                 device_remove_file(&spi->dev, &dev_attr_temp1);
+                device_remove_file(&spi->dev, &dev_attr_temp0);
         }
         if (ts->model != 7845)
                 device_remove_file(&spi->dev, &dev_attr_vbatt);
         device_remove_file(&spi->dev, &dev_attr_vaux);
 
-        input_unregister_device(ts->input);
+        free_irq(ts->spi->irq, ts);
+        /* suspend left the IRQ disabled */
+        enable_irq(ts->spi->irq);
+
         kfree(ts);
 
         dev_dbg(&spi->dev, "unregistered touchscreen\n");
diff --git a/drivers/input/touchscreen/corgi_ts.c b/drivers/input/touchscreen/corgi_ts.c
index 1042987856f7..5013703db0e6 100644
--- a/drivers/input/touchscreen/corgi_ts.c
+++ b/drivers/input/touchscreen/corgi_ts.c
@@ -17,7 +17,7 @@
 #include <linux/interrupt.h>
 #include <linux/module.h>
 #include <linux/slab.h>
-#include <asm/irq.h>
+//#include <asm/irq.h>
 
 #include <asm/arch/sharpsl.h>
 #include <asm/arch/hardware.h>
diff --git a/drivers/isdn/gigaset/bas-gigaset.c b/drivers/isdn/gigaset/bas-gigaset.c
index f86ed6af3aa2..eb41aba3ddef 100644
--- a/drivers/isdn/gigaset/bas-gigaset.c
+++ b/drivers/isdn/gigaset/bas-gigaset.c
@@ -5,8 +5,6 @@
  *                       Tilman Schmidt <tilman@imap.cc>,
  *                       Stefan Eilers.
  *
- * Based on usb-gigaset.c.
- *
  * =====================================================================
  *      This program is free software; you can redistribute it and/or
  *      modify it under the terms of the GNU General Public License as
@@ -46,19 +44,20 @@ MODULE_PARM_DESC(cidmode, "Call-ID mode");
 #define GIGASET_DEVFSNAME  "gig/bas/"
 #define GIGASET_DEVNAME    "ttyGB"
 
-#define IF_WRITEBUF 256 //FIXME
+/* length limit according to Siemens 3070usb-protokoll.doc ch. 2.1 */
+#define IF_WRITEBUF 264
 
 /* Values for the Gigaset 307x */
 #define USB_GIGA_VENDOR_ID      0x0681
-#define USB_GIGA_PRODUCT_ID     0x0001
-#define USB_4175_PRODUCT_ID     0x0002
+#define USB_3070_PRODUCT_ID     0x0001
+#define USB_3075_PRODUCT_ID     0x0002
 #define USB_SX303_PRODUCT_ID    0x0021
 #define USB_SX353_PRODUCT_ID    0x0022
 
 /* table of devices that work with this driver */
 static struct usb_device_id gigaset_table [] = {
-        { USB_DEVICE(USB_GIGA_VENDOR_ID, USB_GIGA_PRODUCT_ID) },
-        { USB_DEVICE(USB_GIGA_VENDOR_ID, USB_4175_PRODUCT_ID) },
+        { USB_DEVICE(USB_GIGA_VENDOR_ID, USB_3070_PRODUCT_ID) },
+        { USB_DEVICE(USB_GIGA_VENDOR_ID, USB_3075_PRODUCT_ID) },
         { USB_DEVICE(USB_GIGA_VENDOR_ID, USB_SX303_PRODUCT_ID) },
         { USB_DEVICE(USB_GIGA_VENDOR_ID, USB_SX353_PRODUCT_ID) },
         { } /* Terminating entry */
@@ -77,6 +76,10 @@ static int gigaset_probe(struct usb_interface *interface,
 /* Function will be called if the device is unplugged */
 static void gigaset_disconnect(struct usb_interface *interface);
 
+static void read_ctrl_callback(struct urb *, struct pt_regs *);
+static void stopurbs(struct bas_bc_state *);
+static int atwrite_submit(struct cardstate *, unsigned char *, int);
+static int start_cbsend(struct cardstate *);
 
 /*==============================================================================*/
 
@@ -111,12 +114,14 @@ struct bas_cardstate {
 };
 
 /* status of direct USB connection to 307x base (bits in basstate) */
-#define BS_ATOPEN       0x001
-#define BS_B1OPEN       0x002
-#define BS_B2OPEN       0x004
-#define BS_ATREADY      0x008
-#define BS_INIT         0x010
-#define BS_ATTIMER      0x020
+#define BS_ATOPEN       0x001   /* AT channel open */
+#define BS_B1OPEN       0x002   /* B channel 1 open */
+#define BS_B2OPEN       0x004   /* B channel 2 open */
+#define BS_ATREADY      0x008   /* base ready for AT command */
+#define BS_INIT         0x010   /* base has signalled INIT_OK */
+#define BS_ATTIMER      0x020   /* waiting for HD_READY_SEND_ATDATA */
+#define BS_ATRDPEND     0x040   /* urb_cmd_in in use */
+#define BS_ATWRPEND     0x080   /* urb_cmd_out in use */
 
 
 static struct gigaset_driver *driver = NULL;
@@ -130,6 +135,47 @@ static struct usb_driver gigaset_usb_driver = {
         .id_table =     gigaset_table,
 };
 
+/* get message text for usb_submit_urb return code
+ */
+static char *get_usb_rcmsg(int rc)
+{
+        static char unkmsg[28];
+
+        switch (rc) {
+        case 0:
+                return "success";
+        case -ENOMEM:
+                return "out of memory";
+        case -ENODEV:
+                return "device not present";
+        case -ENOENT:
+                return "endpoint not present";
+        case -ENXIO:
+                return "URB type not supported";
+        case -EINVAL:
+                return "invalid argument";
+        case -EAGAIN:
+                return "start frame too early or too much scheduled";
+        case -EFBIG:
+                return "too many isochronous frames requested";
+        case -EPIPE:
+                return "endpoint stalled";
+        case -EMSGSIZE:
+                return "invalid packet size";
+        case -ENOSPC:
+                return "would overcommit USB bandwidth";
+        case -ESHUTDOWN:
+                return "device shut down";
+        case -EPERM:
+                return "reject flag set";
+        case -EHOSTUNREACH:
+                return "device suspended";
+        default:
+                snprintf(unkmsg, sizeof(unkmsg), "unknown error %d", rc);
+                return unkmsg;
+        }
+}
+
 /* get message text for USB status code
  */
 static char *get_usb_statmsg(int status)
@@ -140,43 +186,37 @@ static char *get_usb_statmsg(int status)
         case 0:
                 return "success";
         case -ENOENT:
-                return "canceled";
-        case -ECONNRESET:
-                return "canceled (async)";
+                return "unlinked (sync)";
         case -EINPROGRESS:
                 return "pending";
         case -EPROTO:
-                return "bit stuffing or unknown USB error";
+                return "bit stuffing error, timeout, or unknown USB error";
         case -EILSEQ:
-                return "Illegal byte sequence (CRC mismatch)";
-        case -EPIPE:
-                return "babble detect or endpoint stalled";
-        case -ENOSR:
-                return "buffer error";
+                return "CRC mismatch, timeout, or unknown USB error";
         case -ETIMEDOUT:
                 return "timed out";
-        case -ENODEV:
-                return "device not present";
+        case -EPIPE:
+                return "endpoint stalled";
+        case -ECOMM:
+                return "IN buffer overrun";
+        case -ENOSR:
+                return "OUT buffer underrun";
+        case -EOVERFLOW:
+                return "too much data";
         case -EREMOTEIO:
                 return "short packet detected";
+        case -ENODEV:
+                return "device removed";
         case -EXDEV:
                 return "partial isochronous transfer";
         case -EINVAL:
                 return "invalid argument";
-        case -ENXIO:
-                return "URB already queued";
-        case -EAGAIN:
-                return "isochronous start frame too early or too much scheduled";
-        case -EFBIG:
-                return "too many isochronous frames requested";
-        case -EMSGSIZE:
-                return "endpoint message size zero";
+        case -ECONNRESET:
+                return "unlinked (async)";
         case -ESHUTDOWN:
-                return "endpoint shutdown";
-        case -EBUSY:
-                return "another request pending";
+                return "device shut down";
         default:
-                snprintf(unkmsg, sizeof(unkmsg), "unknown error %d", status);
+                snprintf(unkmsg, sizeof(unkmsg), "unknown status %d", status);
                 return unkmsg;
         }
 }
@@ -277,18 +317,17 @@ static inline void error_hangup(struct bc_state *bcs)
         gig_dbg(DEBUG_ANY, "%s: scheduling HUP for channel %d",
                 __func__, bcs->channel);
 
-        if (!gigaset_add_event(cs, &bcs->at_state, EV_HUP, NULL, 0, NULL)) {
-                //FIXME what should we do?
-                return;
-        }
+        if (!gigaset_add_event(cs, &bcs->at_state, EV_HUP, NULL, 0, NULL))
+                dev_err(cs->dev, "event queue full\n");
 
         gigaset_schedule_event(cs);
 }
 
 /* error_reset
  * reset Gigaset device because of an unrecoverable error
- * This function may be called from any context and takes care of scheduling
- * the necessary actions for execution outside of interrupt context.
+ * This function may be called from any context, and should take care of
+ * scheduling the necessary actions for execution outside of interrupt context.
+ * Right now, it just generates a kernel message calling for help.
  * argument:
  *      controller state structure
  */
@@ -364,36 +403,38 @@ static void cmd_in_timeout(unsigned long data)
 {
         struct cardstate *cs = (struct cardstate *) data;
         struct bas_cardstate *ucs = cs->hw.bas;
-        unsigned long flags;
 
-        spin_lock_irqsave(&cs->lock, flags);
-        if (unlikely(!cs->connected)) {
-                gig_dbg(DEBUG_USBREQ, "%s: disconnected", __func__);
-                spin_unlock_irqrestore(&cs->lock, flags);
-                return;
-        }
         if (!ucs->rcvbuf_size) {
                 gig_dbg(DEBUG_USBREQ, "%s: no receive in progress", __func__);
-                spin_unlock_irqrestore(&cs->lock, flags);
                 return;
         }
-        spin_unlock_irqrestore(&cs->lock, flags);
 
         dev_err(cs->dev, "timeout reading AT response\n");
         error_reset(cs);        //FIXME retry?
 }
 
+/* set/clear bits in base connection state, return previous state
+ */
+inline static int update_basstate(struct bas_cardstate *ucs,
+                                  int set, int clear)
+{
+        unsigned long flags;
+        int state;
 
-static void read_ctrl_callback(struct urb *urb, struct pt_regs *regs);
+        spin_lock_irqsave(&ucs->lock, flags);
+        state = atomic_read(&ucs->basstate);
+        atomic_set(&ucs->basstate, (state & ~clear) | set);
+        spin_unlock_irqrestore(&ucs->lock, flags);
+        return state;
+}
 
 /* atread_submit
- * submit an HD_READ_ATMESSAGE command URB
+ * submit an HD_READ_ATMESSAGE command URB and optionally start a timeout
  * parameters:
  *      cs      controller state structure
  *      timeout timeout in 1/10 sec., 0: none
  * return value:
  *      0 on success
- *      -EINVAL if a NULL pointer is encountered somewhere
  *      -EBUSY if another request is pending
  *      any URB submission error code
  */
@@ -405,7 +446,7 @@ static int atread_submit(struct cardstate *cs, int timeout)
         gig_dbg(DEBUG_USBREQ, "-------> HD_READ_ATMESSAGE (%d)",
                 ucs->rcvbuf_size);
 
-        if (ucs->urb_cmd_in->status == -EINPROGRESS) {
+        if (update_basstate(ucs, BS_ATRDPEND, 0) & BS_ATRDPEND) {
                 dev_err(cs->dev,
                         "could not submit HD_READ_ATMESSAGE: URB busy\n");
                 return -EBUSY;
@@ -423,6 +464,7 @@ static int atread_submit(struct cardstate *cs, int timeout)
                              read_ctrl_callback, cs->inbuf);
 
         if ((ret = usb_submit_urb(ucs->urb_cmd_in, SLAB_ATOMIC)) != 0) {
+                update_basstate(ucs, 0, BS_ATRDPEND);
                 dev_err(cs->dev, "could not submit HD_READ_ATMESSAGE: %s\n",
                         get_usb_statmsg(ret));
                 return ret;
@@ -438,26 +480,6 @@ static int atread_submit(struct cardstate *cs, int timeout)
         return 0;
 }
 
-static void stopurbs(struct bas_bc_state *);
-static int start_cbsend(struct cardstate *);
-
-/* set/clear bits in base connection state
- */
-inline static void update_basstate(struct bas_cardstate *ucs,
-                                   int set, int clear)
-{
-        unsigned long flags;
-        int state;
-
-        spin_lock_irqsave(&ucs->lock, flags);
-        state = atomic_read(&ucs->basstate);
-        state &= ~clear;
-        state |= set;
-        atomic_set(&ucs->basstate, state);
-        spin_unlock_irqrestore(&ucs->lock, flags);
-}
-
-
 /* read_int_callback
  * USB completion handler for interrupt pipe input
  * called by the USB subsystem in interrupt context
@@ -471,20 +493,25 @@ static void read_int_callback(struct urb *urb, struct pt_regs *regs)
         struct bas_cardstate *ucs = cs->hw.bas;
         struct bc_state *bcs;
         unsigned long flags;
-        int status;
+        int rc;
         unsigned l;
         int channel;
 
         switch (urb->status) {
         case 0:                 /* success */
                 break;
-        case -ENOENT:                   /* canceled */
-        case -ECONNRESET:               /* canceled (async) */
+        case -ENOENT:                   /* cancelled */
+        case -ECONNRESET:               /* cancelled (async) */
         case -EINPROGRESS:              /* pending */
                 /* ignore silently */
                 gig_dbg(DEBUG_USBREQ, "%s: %s",
                         __func__, get_usb_statmsg(urb->status));
                 return;
+        case -ENODEV:                   /* device removed */
+        case -ESHUTDOWN:                /* device shut down */
+                //FIXME use this as disconnect indicator?
+                gig_dbg(DEBUG_USBREQ, "%s: device disconnected", __func__);
+                return;
         default:                /* severe trouble */
                 dev_warn(cs->dev, "interrupt read: %s\n",
                          get_usb_statmsg(urb->status));
@@ -492,6 +519,13 @@ static void read_int_callback(struct urb *urb, struct pt_regs *regs)
                 goto resubmit;
         }
 
+        /* drop incomplete packets even if the missing bytes wouldn't matter */
+        if (unlikely(urb->actual_length < 3)) {
+                dev_warn(cs->dev, "incomplete interrupt packet (%d bytes)\n",
+                         urb->actual_length);
+                goto resubmit;
+        }
+
         l = (unsigned) ucs->int_in_buf[1] +
             (((unsigned) ucs->int_in_buf[2]) << 8);
 
@@ -558,25 +592,28 @@ static void read_int_callback(struct urb *urb, struct pt_regs *regs)
                 }
                 spin_lock_irqsave(&cs->lock, flags);
                 if (ucs->rcvbuf_size) {
-                        spin_unlock_irqrestore(&cs->lock, flags);
+                        /* throw away previous buffer - we have no queue */
                         dev_err(cs->dev,
-                                "receive AT data overrun, %d bytes lost\n", l);
-                        error_reset(cs);        //FIXME reschedule
-                        break;
+                                "receive AT data overrun, %d bytes lost\n",
+                                ucs->rcvbuf_size);
+                        kfree(ucs->rcvbuf);
+                        ucs->rcvbuf_size = 0;
                 }
                 if ((ucs->rcvbuf = kmalloc(l, GFP_ATOMIC)) == NULL) {
                         spin_unlock_irqrestore(&cs->lock, flags);
-                        dev_err(cs->dev, "out of memory, %d bytes lost\n", l);
-                        error_reset(cs);        //FIXME reschedule
+                        dev_err(cs->dev, "out of memory receiving AT data\n");
+                        error_reset(cs);
                         break;
                 }
                 ucs->rcvbuf_size = l;
                 ucs->retry_cmd_in = 0;
-                if ((status = atread_submit(cs, BAS_TIMEOUT)) < 0) {
+                if ((rc = atread_submit(cs, BAS_TIMEOUT)) < 0) {
                         kfree(ucs->rcvbuf);
                         ucs->rcvbuf = NULL;
                         ucs->rcvbuf_size = 0;
-                        error_reset(cs);        //FIXME reschedule
+                        if (rc != -ENODEV)
+                                //FIXME corrective action?
+                                error_reset(cs);
                 }
                 spin_unlock_irqrestore(&cs->lock, flags);
                 break;
@@ -598,12 +635,10 @@ static void read_int_callback(struct urb *urb, struct pt_regs *regs)
         check_pending(ucs);
 
 resubmit:
-        spin_lock_irqsave(&cs->lock, flags);
-        status = cs->connected ? usb_submit_urb(urb, SLAB_ATOMIC) : -ENODEV;
-        spin_unlock_irqrestore(&cs->lock, flags);
-        if (unlikely(status)) {
+        rc = usb_submit_urb(urb, SLAB_ATOMIC);
+        if (unlikely(rc != 0 && rc != -ENODEV)) {
                 dev_err(cs->dev, "could not resubmit interrupt URB: %s\n",
-                        get_usb_statmsg(status));
+                        get_usb_rcmsg(rc));
                 error_reset(cs);
         }
 }
@@ -622,18 +657,12 @@ static void read_ctrl_callback(struct urb *urb, struct pt_regs *regs)
         struct bas_cardstate *ucs = cs->hw.bas;
         int have_data = 0;
         unsigned numbytes;
-        unsigned long flags;
+        int rc;
 
-        spin_lock_irqsave(&cs->lock, flags);
-        if (unlikely(!cs->connected)) {
-                warn("%s: disconnected", __func__);
-                spin_unlock_irqrestore(&cs->lock, flags);
-                return;
-        }
+        update_basstate(ucs, 0, BS_ATRDPEND);
 
         if (!ucs->rcvbuf_size) {
                 dev_warn(cs->dev, "%s: no receive in progress\n", __func__);
-                spin_unlock_irqrestore(&cs->lock, flags);
                 return;
         }
 
@@ -666,9 +695,11 @@ static void read_ctrl_callback(struct urb *urb, struct pt_regs *regs)
                 }
                 break;
 
-        case -ENOENT:                   /* canceled */
-        case -ECONNRESET:               /* canceled (async) */
+        case -ENOENT:                   /* cancelled */
+        case -ECONNRESET:               /* cancelled (async) */
         case -EINPROGRESS:              /* pending */
+        case -ENODEV:                   /* device removed */
+        case -ESHUTDOWN:                /* device shut down */
                 /* no action necessary */
                 gig_dbg(DEBUG_USBREQ, "%s: %s",
                         __func__, get_usb_statmsg(urb->status));
@@ -681,11 +712,11 @@ static void read_ctrl_callback(struct urb *urb, struct pt_regs *regs)
                 if (ucs->retry_cmd_in++ < BAS_RETRY) {
                         dev_notice(cs->dev, "control read: retry %d\n",
                                    ucs->retry_cmd_in);
-                        if (atread_submit(cs, BAS_TIMEOUT) >= 0) {
-                                /* resubmitted - bypass regular exit block */
-                                spin_unlock_irqrestore(&cs->lock, flags);
+                        rc = atread_submit(cs, BAS_TIMEOUT);
+                        if (rc >= 0 || rc == -ENODEV)
+                                /* resubmitted or disconnected */
+                                /* - bypass regular exit block */
                                 return;
-                        }
                 } else {
                         dev_err(cs->dev,
                                 "control read: giving up after %d tries\n",
@@ -697,7 +728,6 @@ static void read_ctrl_callback(struct urb *urb, struct pt_regs *regs)
         kfree(ucs->rcvbuf);
         ucs->rcvbuf = NULL;
         ucs->rcvbuf_size = 0;
-        spin_unlock_irqrestore(&cs->lock, flags);
         if (have_data) {
                 gig_dbg(DEBUG_INTR, "%s-->BH", __func__);
                 gigaset_schedule_event(cs);
@@ -719,8 +749,11 @@ static void read_iso_callback(struct urb *urb, struct pt_regs *regs)
         int i, rc;
 
         /* status codes not worth bothering the tasklet with */
-        if (unlikely(urb->status == -ENOENT || urb->status == -ECONNRESET ||
-                     urb->status == -EINPROGRESS)) {
+        if (unlikely(urb->status == -ENOENT ||
+                     urb->status == -ECONNRESET ||
+                     urb->status == -EINPROGRESS ||
+                     urb->status == -ENODEV ||
+                     urb->status == -ESHUTDOWN)) {
                 gig_dbg(DEBUG_ISO, "%s: %s",
                         __func__, get_usb_statmsg(urb->status));
                 return;
@@ -740,9 +773,9 @@ static void read_iso_callback(struct urb *urb, struct pt_regs *regs)
                 for (i = 0; i < BAS_NUMFRAMES; i++) {
                         ubc->isoinlost += urb->iso_frame_desc[i].actual_length;
                         if (unlikely(urb->iso_frame_desc[i].status != 0 &&
-                                     urb->iso_frame_desc[i].status != -EINPROGRESS)) {
+                                     urb->iso_frame_desc[i].status !=
+                                                                -EINPROGRESS))
                                 ubc->loststatus = urb->iso_frame_desc[i].status;
-                        }
                         urb->iso_frame_desc[i].status = 0;
                         urb->iso_frame_desc[i].actual_length = 0;
                 }
@@ -754,10 +787,10 @@ static void read_iso_callback(struct urb *urb, struct pt_regs *regs)
                         gig_dbg(DEBUG_ISO, "%s: isoc read overrun/resubmit",
                                 __func__);
                         rc = usb_submit_urb(urb, SLAB_ATOMIC);
-                        if (unlikely(rc != 0)) {
+                        if (unlikely(rc != 0 && rc != -ENODEV)) {
                                 dev_err(bcs->cs->dev,
                                         "could not resubmit isochronous read "
-                                        "URB: %s\n", get_usb_statmsg(rc));
+                                        "URB: %s\n", get_usb_rcmsg(rc));
                                 dump_urb(DEBUG_ISO, "isoc read", urb);
                                 error_hangup(bcs);
                         }
@@ -780,8 +813,11 @@ static void write_iso_callback(struct urb *urb, struct pt_regs *regs)
         unsigned long flags;
 
         /* status codes not worth bothering the tasklet with */
-        if (unlikely(urb->status == -ENOENT || urb->status == -ECONNRESET ||
-                     urb->status == -EINPROGRESS)) {
+        if (unlikely(urb->status == -ENOENT ||
+                     urb->status == -ECONNRESET ||
+                     urb->status == -EINPROGRESS ||
+                     urb->status == -ENODEV ||
+                     urb->status == -ESHUTDOWN)) {
                 gig_dbg(DEBUG_ISO, "%s: %s",
                         __func__, get_usb_statmsg(urb->status));
                 return;
@@ -822,7 +858,6 @@ static int starturbs(struct bc_state *bcs)
         for (k = 0; k < BAS_INURBS; k++) {
                 urb = ubc->isoinurbs[k];
                 if (!urb) {
-                        dev_err(bcs->cs->dev, "isoinurbs[%d]==NULL\n", k);
                         rc = -EFAULT;
                         goto error;
                 }
@@ -844,12 +879,8 @@ static int starturbs(struct bc_state *bcs)
                 }
 
                 dump_urb(DEBUG_ISO, "Initial isoc read", urb);
-                if ((rc = usb_submit_urb(urb, SLAB_ATOMIC)) != 0) {
-                        dev_err(bcs->cs->dev,
-                               "could not submit isochronous read URB %d: %s\n",
-                                k, get_usb_statmsg(rc));
+                if ((rc = usb_submit_urb(urb, SLAB_ATOMIC)) != 0)
                         goto error;
-                }
         }
 
         /* initialize L2 transmission */
@@ -859,7 +890,6 @@ static int starturbs(struct bc_state *bcs)
         for (k = 0; k < BAS_OUTURBS; ++k) {
                 urb = ubc->isoouturbs[k].urb;
                 if (!urb) {
-                        dev_err(bcs->cs->dev, "isoouturbs[%d].urb==NULL\n", k);
                         rc = -EFAULT;
                         goto error;
                 }
@@ -885,12 +915,8 @@ static int starturbs(struct bc_state *bcs)
         for (k = 0; k < 2; ++k) {
                 dump_urb(DEBUG_ISO, "Initial isoc write", urb);
                 rc = usb_submit_urb(ubc->isoouturbs[k].urb, SLAB_ATOMIC);
-                if (rc != 0) {
-                        dev_err(bcs->cs->dev,
-                              "could not submit isochronous write URB %d: %s\n",
-                                k, get_usb_statmsg(rc));
+                if (rc != 0)
                         goto error;
-                }
         }
         dump_urb(DEBUG_ISO, "Initial isoc write (free)", urb);
         ubc->isooutfree = &ubc->isoouturbs[2];
@@ -916,15 +942,15 @@ static void stopurbs(struct bas_bc_state *ubc)
         for (k = 0; k < BAS_INURBS; ++k) {
                 rc = usb_unlink_urb(ubc->isoinurbs[k]);
                 gig_dbg(DEBUG_ISO,
-                        "%s: isoc input URB %d unlinked, result = %d",
-                        __func__, k, rc);
+                        "%s: isoc input URB %d unlinked, result = %s",
+                        __func__, k, get_usb_rcmsg(rc));
         }
 
         for (k = 0; k < BAS_OUTURBS; ++k) {
                 rc = usb_unlink_urb(ubc->isoouturbs[k].urb);
                 gig_dbg(DEBUG_ISO,
-                        "%s: isoc output URB %d unlinked, result = %d",
-                        __func__, k, rc);
+                        "%s: isoc output URB %d unlinked, result = %s",
+                        __func__, k, get_usb_rcmsg(rc));
         }
 }
 
@@ -934,7 +960,7 @@ static void stopurbs(struct bas_bc_state *ubc)
 /* submit_iso_write_urb
  * fill and submit the next isochronous write URB
  * parameters:
- *      bcs     B channel state structure
+ *      ucx     context structure containing URB
  * return value:
  *      number of frames submitted in URB
  *      0 if URB not submitted because no data available (isooutbuf busy)
@@ -946,7 +972,6 @@ static int submit_iso_write_urb(struct isow_urbctx_t *ucx)
         struct bas_bc_state *ubc = ucx->bcs->hw.bas;
         struct usb_iso_packet_descriptor *ifd;
         int corrbytes, nframe, rc;
-        unsigned long flags;
 
         /* urb->dev is clobbered by USB subsystem */
         urb->dev = ucx->bcs->cs->hw.bas->udev;
@@ -992,20 +1017,22 @@ static int submit_iso_write_urb(struct isow_urbctx_t *ucx)
                 ifd->status = 0;
                 ifd->actual_length = 0;
         }
-        if ((urb->number_of_packets = nframe) > 0) {
-                spin_lock_irqsave(&ucx->bcs->cs->lock, flags);
-                rc = ucx->bcs->cs->connected ? usb_submit_urb(urb, SLAB_ATOMIC) : -ENODEV;
-                spin_unlock_irqrestore(&ucx->bcs->cs->lock, flags);
+        if (unlikely(nframe == 0))
+                return 0;       /* no data to send */
+        urb->number_of_packets = nframe;
 
-                if (rc) {
+        rc = usb_submit_urb(urb, SLAB_ATOMIC);
+        if (unlikely(rc)) {
+                if (rc == -ENODEV)
+                        /* device removed - give up silently */
+                        gig_dbg(DEBUG_ISO, "%s: disconnected", __func__);
+                else
                         dev_err(ucx->bcs->cs->dev,
                                 "could not submit isochronous write URB: %s\n",
-                                get_usb_statmsg(rc));
-                        dump_urb(DEBUG_ISO, "isoc write", urb);
-                        return rc;
-                }
-                ++ubc->numsub;
+                                get_usb_rcmsg(rc));
+                return rc;
         }
+        ++ubc->numsub;
         return nframe;
 }
 
@@ -1028,6 +1055,7 @@ static void write_iso_tasklet(unsigned long data)
         int i;
         struct sk_buff *skb;
         int len;
+        int rc;
 
         /* loop while completed URBs arrive in time */
         for (;;) {
@@ -1057,7 +1085,8 @@ static void write_iso_tasklet(unsigned long data)
                 ubc->isooutfree = NULL;
                 spin_unlock_irqrestore(&ubc->isooutlock, flags);
                 if (next) {
-                        if (submit_iso_write_urb(next) <= 0) {
+                        rc = submit_iso_write_urb(next);
+                        if (unlikely(rc <= 0 && rc != -ENODEV)) {
                                 /* could not submit URB, put it back */
                                 spin_lock_irqsave(&ubc->isooutlock, flags);
                                 if (ubc->isooutfree == NULL) {
@@ -1077,17 +1106,18 @@ static void write_iso_tasklet(unsigned long data)
                 /* process completed URB */
                 urb = done->urb;
                 switch (urb->status) {
+                case -EXDEV:                    /* partial completion */
+                        gig_dbg(DEBUG_ISO, "%s: URB partially completed",
+                                __func__);
+                        /* fall through - what's the difference anyway? */
                 case 0:                         /* normal completion */
-                        break;
-                case -EXDEV:                    /* inspect individual frames */
-                        /* assumptions (for lack of documentation):
-                         * - actual_length bytes of the frame in error are
+                        /* inspect individual frames
+                         * assumptions (for lack of documentation):
+                         * - actual_length bytes of first frame in error are
                          *   successfully sent
                          * - all following frames are not sent at all
                          */
-                        gig_dbg(DEBUG_ISO, "%s: URB partially completed",
-                                __func__);
-                        offset = done->limit;   /* just in case */
+                        offset = done->limit;   /* default (no error) */
                         for (i = 0; i < BAS_NUMFRAMES; i++) {
                                 ifd = &urb->iso_frame_desc[i];
                                 if (ifd->status ||
@@ -1122,7 +1152,7 @@ static void write_iso_tasklet(unsigned long data)
                         }
 #endif
                         break;
-                case -EPIPE:            //FIXME is this the code for "underrun"?
+                case -EPIPE:                    /* stall - probably underrun */
                         dev_err(cs->dev, "isochronous write stalled\n");
                         error_hangup(bcs);
                         break;
@@ -1142,7 +1172,8 @@ static void write_iso_tasklet(unsigned long data)
                 spin_unlock_irqrestore(&ubc->isooutlock, flags);
                 if (next) {
                         /* only one URB still active - resubmit one */
-                        if (submit_iso_write_urb(next) <= 0) {
+                        rc = submit_iso_write_urb(next);
+                        if (unlikely(rc <= 0 && rc != -ENODEV)) {
                                 /* couldn't submit */
                                 error_hangup(bcs);
                         }
@@ -1222,10 +1253,9 @@ static void read_iso_tasklet(unsigned long data)
                         break;
                 case -ENOENT:
                 case -ECONNRESET:
-                        gig_dbg(DEBUG_ISO, "%s: URB canceled", __func__);
-                        continue;               /* -> skip */
-                case -EINPROGRESS:              /* huh? */
-                        gig_dbg(DEBUG_ISO, "%s: URB still pending", __func__);
+                case -EINPROGRESS:
+                        gig_dbg(DEBUG_ISO, "%s: %s",
+                                __func__, get_usb_statmsg(urb->status));
                         continue;               /* -> skip */
                 case -EPIPE:
                         dev_err(cs->dev, "isochronous read stalled\n");
@@ -1290,13 +1320,11 @@ static void read_iso_tasklet(unsigned long data)
                 urb->dev = bcs->cs->hw.bas->udev;
                 urb->transfer_flags = URB_ISO_ASAP;
                 urb->number_of_packets = BAS_NUMFRAMES;
-                spin_lock_irqsave(&cs->lock, flags);
-                rc = cs->connected ? usb_submit_urb(urb, SLAB_ATOMIC) : -ENODEV;
-                spin_unlock_irqrestore(&cs->lock, flags);
-                if (rc) {
+                rc = usb_submit_urb(urb, SLAB_ATOMIC);
+                if (unlikely(rc != 0 && rc != -ENODEV)) {
                         dev_err(cs->dev,
                                 "could not resubmit isochronous read URB: %s\n",
-                                get_usb_statmsg(rc));
+                                get_usb_rcmsg(rc));
                         dump_urb(DEBUG_ISO, "resubmit iso read", urb);
                         error_hangup(bcs);
                 }
@@ -1397,7 +1425,6 @@ static void write_ctrl_callback(struct urb *urb, struct pt_regs *regs)
  *      timeout timeout in seconds (0: no timeout)
  * return value:
  *      0 on success
- *      -EINVAL if a NULL pointer is encountered somewhere
  *      -EBUSY if another request is pending
  *      any URB submission error code
  */
@@ -1418,12 +1445,6 @@ static int req_submit(struct bc_state *bcs, int req, int val, int timeout)
                         req, ucs->pending);
                 return -EBUSY;
         }
-        if (ucs->urb_ctrl->status == -EINPROGRESS) {
-                spin_unlock_irqrestore(&ucs->lock, flags);
-                dev_err(bcs->cs->dev,
-                        "could not submit request 0x%02x: URB busy\n", req);
-                return -EBUSY;
-        }
 
         ucs->dr_ctrl.bRequestType = OUT_VENDOR_REQ;
         ucs->dr_ctrl.bRequest = req;
@@ -1465,22 +1486,36 @@ static int req_submit(struct bc_state *bcs, int req, int val, int timeout)
 static int gigaset_init_bchannel(struct bc_state *bcs)
 {
         int req, ret;
+        unsigned long flags;
+
+        spin_lock_irqsave(&bcs->cs->lock, flags);
+        if (unlikely(!bcs->cs->connected)) {
+                gig_dbg(DEBUG_USBREQ, "%s: not connected", __func__);
+                spin_unlock_irqrestore(&bcs->cs->lock, flags);
+                return -ENODEV;
+        }
 
         if ((ret = starturbs(bcs)) < 0) {
                 dev_err(bcs->cs->dev,
-                        "could not start isochronous I/O for channel %d\n",
-                        bcs->channel + 1);
-                error_hangup(bcs);
+                        "could not start isochronous I/O for channel B%d: %s\n",
+                        bcs->channel + 1,
+                        ret == -EFAULT ? "null URB" : get_usb_rcmsg(ret));
+                if (ret != -ENODEV)
+                        error_hangup(bcs);
+                spin_unlock_irqrestore(&bcs->cs->lock, flags);
                 return ret;
         }
 
         req = bcs->channel ? HD_OPEN_B2CHANNEL : HD_OPEN_B1CHANNEL;
         if ((ret = req_submit(bcs, req, 0, BAS_TIMEOUT)) < 0) {
-                dev_err(bcs->cs->dev, "could not open channel %d: %s\n",
-                        bcs->channel + 1, get_usb_statmsg(ret));
+                dev_err(bcs->cs->dev, "could not open channel B%d\n",
+                        bcs->channel + 1);
                 stopurbs(bcs->hw.bas);
-                error_hangup(bcs);
+                if (ret != -ENODEV)
+                        error_hangup(bcs);
         }
+
+        spin_unlock_irqrestore(&bcs->cs->lock, flags);
         return ret;
 }
 
@@ -1497,19 +1532,30 @@ static int gigaset_init_bchannel(struct bc_state *bcs)
 static int gigaset_close_bchannel(struct bc_state *bcs)
 {
         int req, ret;
+        unsigned long flags;
+
+        spin_lock_irqsave(&bcs->cs->lock, flags);
+        if (unlikely(!bcs->cs->connected)) {
+                spin_unlock_irqrestore(&bcs->cs->lock, flags);
+                gig_dbg(DEBUG_USBREQ, "%s: not connected", __func__);
+                return -ENODEV;
+        }
 
         if (!(atomic_read(&bcs->cs->hw.bas->basstate) &
               (bcs->channel ? BS_B2OPEN : BS_B1OPEN))) {
                 /* channel not running: just signal common.c */
+                spin_unlock_irqrestore(&bcs->cs->lock, flags);
                 gigaset_bchannel_down(bcs);
                 return 0;
         }
 
+        /* channel running: tell device to close it */
         req = bcs->channel ? HD_CLOSE_B2CHANNEL : HD_CLOSE_B1CHANNEL;
         if ((ret = req_submit(bcs, req, 0, BAS_TIMEOUT)) < 0)
-                dev_err(bcs->cs->dev,
-                        "could not submit HD_CLOSE_BxCHANNEL request: %s\n",
-                        get_usb_statmsg(ret));
+                dev_err(bcs->cs->dev, "closing channel B%d failed\n",
+                        bcs->channel + 1);
+
+        spin_unlock_irqrestore(&bcs->cs->lock, flags);
         return ret;
 }
 
@@ -1545,8 +1591,6 @@ static void complete_cb(struct cardstate *cs)
         kfree(cb);
 }
 
-static int atwrite_submit(struct cardstate *cs, unsigned char *buf, int len);
-
 /* write_command_callback
  * USB completion handler for AT command transmission
  * called by the USB subsystem in interrupt context
@@ -1560,13 +1604,17 @@ static void write_command_callback(struct urb *urb, struct pt_regs *regs)
         struct bas_cardstate *ucs = cs->hw.bas;
         unsigned long flags;
 
+        update_basstate(ucs, 0, BS_ATWRPEND);
+
         /* check status */
         switch (urb->status) {
         case 0:                                 /* normal completion */
                 break;
-        case -ENOENT:                   /* canceled */
-        case -ECONNRESET:               /* canceled (async) */
+        case -ENOENT:                   /* cancelled */
+        case -ECONNRESET:               /* cancelled (async) */
         case -EINPROGRESS:              /* pending */
+        case -ENODEV:                   /* device removed */
+        case -ESHUTDOWN:                /* device shut down */
                 /* ignore silently */
                 gig_dbg(DEBUG_USBREQ, "%s: %s",
                         __func__, get_usb_statmsg(urb->status));
@@ -1627,19 +1675,17 @@ static void atrdy_timeout(unsigned long data)
  *      len     length of command to send
  * return value:
  *      0 on success
- *      -EFAULT if a NULL pointer is encountered somewhere
  *      -EBUSY if another request is pending
  *      any URB submission error code
  */
 static int atwrite_submit(struct cardstate *cs, unsigned char *buf, int len)
 {
         struct bas_cardstate *ucs = cs->hw.bas;
-        unsigned long flags;
-        int ret;
+        int rc;
 
         gig_dbg(DEBUG_USBREQ, "-------> HD_WRITE_ATMESSAGE (%d)", len);
 
-        if (ucs->urb_cmd_out->status == -EINPROGRESS) {
+        if (update_basstate(ucs, BS_ATWRPEND, 0) & BS_ATWRPEND) {
                 dev_err(cs->dev,
                         "could not submit HD_WRITE_ATMESSAGE: URB busy\n");
                 return -EBUSY;
@@ -1654,29 +1700,22 @@ static int atwrite_submit(struct cardstate *cs, unsigned char *buf, int len)
                              usb_sndctrlpipe(ucs->udev, 0),
                              (unsigned char*) &ucs->dr_cmd_out, buf, len,
                              write_command_callback, cs);
-
-        spin_lock_irqsave(&cs->lock, flags);
-        ret = cs->connected ? usb_submit_urb(ucs->urb_cmd_out, SLAB_ATOMIC) : -ENODEV;
-        spin_unlock_irqrestore(&cs->lock, flags);
-
-        if (ret) {
+        rc = usb_submit_urb(ucs->urb_cmd_out, SLAB_ATOMIC);
+        if (unlikely(rc)) {
+                update_basstate(ucs, 0, BS_ATWRPEND);
                 dev_err(cs->dev, "could not submit HD_WRITE_ATMESSAGE: %s\n",
-                        get_usb_statmsg(ret));
-                return ret;
+                        get_usb_rcmsg(rc));
+                return rc;
         }
 
-        /* submitted successfully */
-        update_basstate(ucs, 0, BS_ATREADY);
-
-        /* start timeout if necessary */
-        if (!(atomic_read(&ucs->basstate) & BS_ATTIMER)) {
+        /* submitted successfully, start timeout if necessary */
+        if (!(update_basstate(ucs, BS_ATTIMER, BS_ATREADY) & BS_ATTIMER)) {
                 gig_dbg(DEBUG_OUTPUT, "setting ATREADY timeout of %d/10 secs",
                         ATRDY_TIMEOUT);
                 ucs->timer_atrdy.expires = jiffies + ATRDY_TIMEOUT * HZ / 10;
                 ucs->timer_atrdy.data = (unsigned long) cs;
                 ucs->timer_atrdy.function = atrdy_timeout;
                 add_timer(&ucs->timer_atrdy);
-                update_basstate(ucs, BS_ATTIMER, 0);
         }
         return 0;
 }
@@ -1702,7 +1741,6 @@ static int start_cbsend(struct cardstate *cs)
                 gig_dbg(DEBUG_TRANSCMD|DEBUG_LOCKCMD, "AT channel not open");
                 rc = req_submit(cs->bcs, HD_OPEN_ATCHANNEL, 0, BAS_TIMEOUT);
                 if (rc < 0) {
-                        dev_err(cs->dev, "could not open AT channel\n");
                         /* flush command queue */
                         spin_lock_irqsave(&cs->cmdlock, flags);
                         while (cs->cmdbuf != NULL)
@@ -1786,8 +1824,14 @@ static int gigaset_write_cmd(struct cardstate *cs,
         cs->lastcmdbuf = cb;
         spin_unlock_irqrestore(&cs->cmdlock, flags);
 
+        spin_lock_irqsave(&cs->lock, flags);
+        if (unlikely(!cs->connected)) {
+                spin_unlock_irqrestore(&cs->lock, flags);
+                gig_dbg(DEBUG_USBREQ, "%s: not connected", __func__);
+                return -ENODEV;
+        }
         status = start_cbsend(cs);
-
+        spin_unlock_irqrestore(&cs->lock, flags);
         return status < 0 ? status : len;
 }
 
@@ -1849,12 +1893,32 @@ static int gigaset_brkchars(struct cardstate *cs, const unsigned char buf[6])
  */
 static int gigaset_freebcshw(struct bc_state *bcs)
 {
-        if (!bcs->hw.bas)
+        struct bas_bc_state *ubc = bcs->hw.bas;
+        int i;
+
+        if (!ubc)
                 return 0;
 
-        if (bcs->hw.bas->isooutbuf)
-                kfree(bcs->hw.bas->isooutbuf);
-        kfree(bcs->hw.bas);
+        /* kill URBs and tasklets before freeing - better safe than sorry */
+        atomic_set(&ubc->running, 0);
+        for (i = 0; i < BAS_OUTURBS; ++i)
+                if (ubc->isoouturbs[i].urb) {
+                        gig_dbg(DEBUG_INIT, "%s: killing iso out URB %d",
+                                __func__, i);
+                        usb_kill_urb(ubc->isoouturbs[i].urb);
+                        usb_free_urb(ubc->isoouturbs[i].urb);
+                }
+        for (i = 0; i < BAS_INURBS; ++i)
+                if (ubc->isoinurbs[i]) {
+                        gig_dbg(DEBUG_INIT, "%s: killing iso in URB %d",
+                                __func__, i);
+                        usb_kill_urb(ubc->isoinurbs[i]);
+                        usb_free_urb(ubc->isoinurbs[i]);
+                }
+        tasklet_kill(&ubc->sent_tasklet);
+        tasklet_kill(&ubc->rcvd_tasklet);
+        kfree(ubc->isooutbuf);
+        kfree(ubc);
         bcs->hw.bas = NULL;
         return 1;
 }
@@ -1931,13 +1995,9 @@ static void gigaset_reinitbcshw(struct bc_state *bcs)
 
 static void gigaset_freecshw(struct cardstate *cs)
 {
-        struct bas_cardstate *ucs = cs->hw.bas;
-
-        del_timer(&ucs->timer_ctrl);
-        del_timer(&ucs->timer_atrdy);
-        del_timer(&ucs->timer_cmd_in);
-
+        /* timers, URBs and rcvbuf are disposed of in disconnect */
         kfree(cs->hw.bas);
+        cs->hw.bas = NULL;
 }
 
 static int gigaset_initcshw(struct cardstate *cs)
@@ -2041,23 +2101,13 @@ static int gigaset_probe(struct usb_interface *interface,
         struct bas_bc_state *ubc;
         struct usb_endpoint_descriptor *endpoint;
         int i, j;
-        int ret;
+        int rc;
 
         gig_dbg(DEBUG_ANY,
                 "%s: Check if device matches .. (Vendor: 0x%x, Product: 0x%x)",
                 __func__, le16_to_cpu(udev->descriptor.idVendor),
                 le16_to_cpu(udev->descriptor.idProduct));
 
-        /* See if the device offered us matches what we can accept */
-        if ((le16_to_cpu(udev->descriptor.idVendor)  != USB_GIGA_VENDOR_ID) ||
-            (le16_to_cpu(udev->descriptor.idProduct) != USB_GIGA_PRODUCT_ID &&
-             le16_to_cpu(udev->descriptor.idProduct) != USB_4175_PRODUCT_ID &&
-             le16_to_cpu(udev->descriptor.idProduct) != USB_SX303_PRODUCT_ID &&
-             le16_to_cpu(udev->descriptor.idProduct) != USB_SX353_PRODUCT_ID)) {
-                gig_dbg(DEBUG_ANY, "%s: unmatched ID - exiting", __func__);
-                return -ENODEV;
-        }
-
         /* set required alternate setting */
         hostif = interface->cur_altsetting;
         if (hostif->desc.bAlternateSetting != 3) {
@@ -2105,45 +2155,22 @@ static int gigaset_probe(struct usb_interface *interface,
          * - three for the different uses of the default control pipe
          * - three for each isochronous pipe
          */
-        ucs->urb_int_in = usb_alloc_urb(0, SLAB_KERNEL);
-        if (!ucs->urb_int_in) {
-                dev_err(cs->dev, "no free urbs available\n");
-                goto error;
-        }
-        ucs->urb_cmd_in = usb_alloc_urb(0, SLAB_KERNEL);
-        if (!ucs->urb_cmd_in) {
-                dev_err(cs->dev, "no free urbs available\n");
-                goto error;
-        }
-        ucs->urb_cmd_out = usb_alloc_urb(0, SLAB_KERNEL);
-        if (!ucs->urb_cmd_out) {
-                dev_err(cs->dev, "no free urbs available\n");
-                goto error;
-        }
-        ucs->urb_ctrl = usb_alloc_urb(0, SLAB_KERNEL);
-        if (!ucs->urb_ctrl) {
-                dev_err(cs->dev, "no free urbs available\n");
-                goto error;
-        }
+        if (!(ucs->urb_int_in = usb_alloc_urb(0, SLAB_KERNEL)) ||
+            !(ucs->urb_cmd_in = usb_alloc_urb(0, SLAB_KERNEL)) ||
+            !(ucs->urb_cmd_out = usb_alloc_urb(0, SLAB_KERNEL)) ||
+            !(ucs->urb_ctrl = usb_alloc_urb(0, SLAB_KERNEL)))
+                goto allocerr;
 
         for (j = 0; j < 2; ++j) {
                 ubc = cs->bcs[j].hw.bas;
-                for (i = 0; i < BAS_OUTURBS; ++i) {
-                        ubc->isoouturbs[i].urb =
-                                usb_alloc_urb(BAS_NUMFRAMES, SLAB_KERNEL);
-                        if (!ubc->isoouturbs[i].urb) {
-                                dev_err(cs->dev, "no free urbs available\n");
-                                goto error;
-                        }
-                }
-                for (i = 0; i < BAS_INURBS; ++i) {
-                        ubc->isoinurbs[i] =
-                                usb_alloc_urb(BAS_NUMFRAMES, SLAB_KERNEL);
-                        if (!ubc->isoinurbs[i]) {
-                                dev_err(cs->dev, "no free urbs available\n");
-                                goto error;
-                        }
-                }
+                for (i = 0; i < BAS_OUTURBS; ++i)
+                        if (!(ubc->isoouturbs[i].urb =
+                              usb_alloc_urb(BAS_NUMFRAMES, SLAB_KERNEL)))
+                                goto allocerr;
+                for (i = 0; i < BAS_INURBS; ++i)
+                        if (!(ubc->isoinurbs[i] =
+                              usb_alloc_urb(BAS_NUMFRAMES, SLAB_KERNEL)))
+                                goto allocerr;
         }
 
         ucs->rcvbuf = NULL;
@@ -2156,15 +2183,14 @@ static int gigaset_probe(struct usb_interface *interface,
                                         (endpoint->bEndpointAddress) & 0x0f),
                          ucs->int_in_buf, 3, read_int_callback, cs,
                          endpoint->bInterval);
-        ret = usb_submit_urb(ucs->urb_int_in, SLAB_KERNEL);
-        if (ret) {
+        if ((rc = usb_submit_urb(ucs->urb_int_in, SLAB_KERNEL)) != 0) {
                 dev_err(cs->dev, "could not submit interrupt URB: %s\n",
-                        get_usb_statmsg(ret));
+                        get_usb_rcmsg(rc));
                 goto error;
         }
 
         /* tell the device that the driver is ready */
-        if ((ret = req_submit(cs->bcs, HD_DEVICE_INIT_ACK, 0, 0)) != 0)
+        if ((rc = req_submit(cs->bcs, HD_DEVICE_INIT_ACK, 0, 0)) != 0)
                 goto error;
 
         /* tell common part that the device is ready */
@@ -2179,6 +2205,8 @@ static int gigaset_probe(struct usb_interface *interface,
 
         return 0;
 
+allocerr:
+        dev_err(cs->dev, "could not allocate URBs\n");
 error:
         freeurbs(cs);
         usb_set_intfdata(interface, NULL);
@@ -2193,19 +2221,34 @@ static void gigaset_disconnect(struct usb_interface *interface)
 {
         struct cardstate *cs;
         struct bas_cardstate *ucs;
+        int j;
 
         cs = usb_get_intfdata(interface);
 
         ucs = cs->hw.bas;
 
         dev_info(cs->dev, "disconnecting Gigaset base\n");
+
+        /* mark base as not ready, all channels disconnected */
+        atomic_set(&ucs->basstate, 0);
+
+        /* tell LL all channels are down */
+        //FIXME shouldn't gigaset_stop() do this?
+        for (j = 0; j < 2; ++j)
+                gigaset_bchannel_down(cs->bcs + j);
+
+        /* stop driver (common part) */
         gigaset_stop(cs);
+
+        /* stop timers and URBs, free ressources */
+        del_timer_sync(&ucs->timer_ctrl);
+        del_timer_sync(&ucs->timer_atrdy);
+        del_timer_sync(&ucs->timer_cmd_in);
         freeurbs(cs);
         usb_set_intfdata(interface, NULL);
         kfree(ucs->rcvbuf);
         ucs->rcvbuf = NULL;
         ucs->rcvbuf_size = 0;
-        atomic_set(&ucs->basstate, 0);
         usb_put_dev(ucs->udev);
         ucs->interface = NULL;
         ucs->udev = NULL;
@@ -2277,6 +2320,8 @@ error:	if (cardstate)
  */
 static void __exit bas_gigaset_exit(void)
 {
+        struct bas_cardstate *ucs = cardstate->hw.bas;
+
         gigaset_blockdriver(driver); /* => probe will fail
                                       * => no gigaset_start any more
                                       */
@@ -2284,14 +2329,26 @@ static void __exit bas_gigaset_exit(void)
         gigaset_shutdown(cardstate);
         /* from now on, no isdn callback should be possible */
 
-        if (atomic_read(&cardstate->hw.bas->basstate) & BS_ATOPEN) {
-                gig_dbg(DEBUG_ANY, "closing AT channel");
-                if (req_submit(cardstate->bcs,
-                               HD_CLOSE_ATCHANNEL, 0, BAS_TIMEOUT) >= 0) {
-                        /* successfully submitted */
-                        //FIXME wait for completion?
-                }
+        /* close all still open channels */
+        if (atomic_read(&ucs->basstate) & BS_B1OPEN) {
+                gig_dbg(DEBUG_INIT, "closing B1 channel");
+                usb_control_msg(ucs->udev, usb_sndctrlpipe(ucs->udev, 0),
+                                HD_CLOSE_B1CHANNEL, OUT_VENDOR_REQ, 0, 0,
+                                NULL, 0, BAS_TIMEOUT);
+        }
+        if (atomic_read(&ucs->basstate) & BS_B2OPEN) {
+                gig_dbg(DEBUG_INIT, "closing B2 channel");
+                usb_control_msg(ucs->udev, usb_sndctrlpipe(ucs->udev, 0),
+                                HD_CLOSE_B2CHANNEL, OUT_VENDOR_REQ, 0, 0,
+                                NULL, 0, BAS_TIMEOUT);
+        }
+        if (atomic_read(&ucs->basstate) & BS_ATOPEN) {
+                gig_dbg(DEBUG_INIT, "closing AT channel");
+                usb_control_msg(ucs->udev, usb_sndctrlpipe(ucs->udev, 0),
+                                HD_CLOSE_ATCHANNEL, OUT_VENDOR_REQ, 0, 0,
+                                NULL, 0, BAS_TIMEOUT);
         }
+        atomic_set(&ucs->basstate, 0);
 
         /* deregister this driver with the USB subsystem */
         usb_deregister(&gigaset_usb_driver);
diff --git a/drivers/isdn/gigaset/common.c b/drivers/isdn/gigaset/common.c
index 749b3da1236e..e55767b2ccd3 100644
--- a/drivers/isdn/gigaset/common.c
+++ b/drivers/isdn/gigaset/common.c
@@ -781,8 +781,7 @@ error:	if (cs)
 }
 EXPORT_SYMBOL_GPL(gigaset_initcs);
 
-/* ReInitialize the b-channel structure */
-/* e.g. called on hangup, disconnect */
+/* ReInitialize the b-channel structure on hangup */
 void gigaset_bcs_reinit(struct bc_state *bcs)
 {
         struct sk_buff *skb;
diff --git a/drivers/isdn/gigaset/ev-layer.c b/drivers/isdn/gigaset/ev-layer.c
index 1ba3424a286b..18e05c09b71c 100644
--- a/drivers/isdn/gigaset/ev-layer.c
+++ b/drivers/isdn/gigaset/ev-layer.c
@@ -373,6 +373,9 @@ struct reply_t gigaset_tab_cid_m10x[] = /* for M10x */
 
         {EV_TIMEOUT,  750,750, -1,                  0, 0, {ACT_CONNTIMEOUT}},
 
+        /* B channel closed (general case) */
+        {EV_BC_CLOSED, -1, -1, -1,                 -1,-1, {ACT_NOTIFY_BC_DOWN}}, //FIXME
+
         /* misc. */
         {EV_PROTO_L2,  -1, -1, -1,                 -1,-1, {ACT_PROTO_L2}}, //FIXME
 
diff --git a/drivers/isdn/gigaset/gigaset.h b/drivers/isdn/gigaset/gigaset.h
index 9d21ba8757b0..22b9693f7c0a 100644
--- a/drivers/isdn/gigaset/gigaset.h
+++ b/drivers/isdn/gigaset/gigaset.h
@@ -75,7 +75,7 @@ extern int gigaset_debuglevel;	/* "needs" cast to (enum debuglevel) */
  * e.g. 'insmod usb_gigaset.o debug=0x2c' will set DEBUG_OPEN, DEBUG_CMD and
  * DEBUG_INTR.
  */
-enum debuglevel { /* up to 24 bits (atomic_t) */
+enum debuglevel {
         DEBUG_REG         = 0x0002, /* serial port I/O register operations */
         DEBUG_OPEN        = 0x0004, /* open/close serial port */
         DEBUG_INTR        = 0x0008, /* interrupt processing */
@@ -141,7 +141,7 @@ enum debuglevel { /* up to 24 bits (atomic_t) */
                         printk(KERN_DEBUG KBUILD_MODNAME ": " format "\n", \
                                ## arg); \
         } while (0)
-#define DEBUG_DEFAULT (DEBUG_INIT | DEBUG_TRANSCMD | DEBUG_CMD | DEBUG_USBREQ)
+#define DEBUG_DEFAULT (DEBUG_TRANSCMD | DEBUG_CMD | DEBUG_USBREQ)
 
 #else
 
@@ -627,8 +627,7 @@ struct gigaset_ops {
         /* Called by gigaset_freecs() for freeing bcs->hw.xxx */
         int (*freebcshw)(struct bc_state *bcs);
 
-        /* Called by gigaset_stop() or gigaset_bchannel_down() for resetting
-           bcs->hw.xxx */
+        /* Called by gigaset_bchannel_down() for resetting bcs->hw.xxx */
         void (*reinitbcshw)(struct bc_state *bcs);
 
         /* Called by gigaset_initcs() for setting up cs->hw.xxx */
diff --git a/drivers/isdn/gigaset/i4l.c b/drivers/isdn/gigaset/i4l.c
index 0815dbfb8291..1654fa413575 100644
--- a/drivers/isdn/gigaset/i4l.c
+++ b/drivers/isdn/gigaset/i4l.c
@@ -73,7 +73,7 @@ static int writebuf_from_LL(int driverID, int channel, int ack,
                 len, skblen, (unsigned) skb->head[0], (unsigned) skb->head[1]);
 
         /* pass to device-specific module */
-        return cs->ops->send_skb(bcs, skb); //FIXME cs->ops->send_skb() must handle !cs->connected correctly
+        return cs->ops->send_skb(bcs, skb);
 }
 
 void gigaset_skb_sent(struct bc_state *bcs, struct sk_buff *skb)
diff --git a/drivers/isdn/gigaset/isocdata.c b/drivers/isdn/gigaset/isocdata.c
index 45f017ed6e8c..8667daaa1a82 100644
--- a/drivers/isdn/gigaset/isocdata.c
+++ b/drivers/isdn/gigaset/isocdata.c
@@ -992,14 +992,18 @@ int gigaset_isoc_send_skb(struct bc_state *bcs, struct sk_buff *skb)
         int len = skb->len;
         unsigned long flags;
 
+        spin_lock_irqsave(&bcs->cs->lock, flags);
+        if (!bcs->cs->connected) {
+                spin_unlock_irqrestore(&bcs->cs->lock, flags);
+                return -ENODEV;
+        }
+
         skb_queue_tail(&bcs->squeue, skb);
         gig_dbg(DEBUG_ISO, "%s: skb queued, qlen=%d",
                 __func__, skb_queue_len(&bcs->squeue));
 
         /* tasklet submits URB if necessary */
-        spin_lock_irqsave(&bcs->cs->lock, flags);
-        if (bcs->cs->connected)
-                tasklet_schedule(&bcs->hw.bas->sent_tasklet);
+        tasklet_schedule(&bcs->hw.bas->sent_tasklet);
         spin_unlock_irqrestore(&bcs->cs->lock, flags);
 
         return len;     /* ok so far */
diff --git a/drivers/macintosh/therm_adt746x.c b/drivers/macintosh/therm_adt746x.c
index 5ebfd1d138da..5282fec17075 100644
--- a/drivers/macintosh/therm_adt746x.c
+++ b/drivers/macintosh/therm_adt746x.c
@@ -627,8 +627,8 @@ thermostat_init(void)
         if(therm_type == ADT7460)
                 device_create_file(&of_dev->dev, &dev_attr_sensor2_fan_speed);
 
-#ifndef CONFIG_I2C_KEYWEST
-        request_module("i2c-keywest");
+#ifndef CONFIG_I2C_POWERMAC
+        request_module("i2c-powermac");
 #endif
 
         return i2c_add_driver(&thermostat_driver);
diff --git a/drivers/md/md.c b/drivers/md/md.c
index 434ca39d19c1..d7316b829a62 100644
--- a/drivers/md/md.c
+++ b/drivers/md/md.c
@@ -279,11 +279,6 @@ static inline int mddev_lock(mddev_t * mddev)
         return mutex_lock_interruptible(&mddev->reconfig_mutex);
 }
 
-static inline void mddev_lock_uninterruptible(mddev_t * mddev)
-{
-        mutex_lock(&mddev->reconfig_mutex);
-}
-
 static inline int mddev_trylock(mddev_t * mddev)
 {
         return mutex_trylock(&mddev->reconfig_mutex);
@@ -2458,9 +2453,11 @@ md_attr_show(struct kobject *kobj, struct attribute *attr, char *page)
 
         if (!entry->show)
                 return -EIO;
-        mddev_lock(mddev);
-        rv = entry->show(mddev, page);
-        mddev_unlock(mddev);
+        rv = mddev_lock(mddev);
+        if (!rv) {
+                rv = entry->show(mddev, page);
+                mddev_unlock(mddev);
+        }
         return rv;
 }
 
@@ -2474,9 +2471,11 @@ md_attr_store(struct kobject *kobj, struct attribute *attr,
 
         if (!entry->store)
                 return -EIO;
-        mddev_lock(mddev);
-        rv = entry->store(mddev, page, length);
-        mddev_unlock(mddev);
+        rv = mddev_lock(mddev);
+        if (!rv) {
+                rv = entry->store(mddev, page, length);
+                mddev_unlock(mddev);
+        }
         return rv;
 }
 
@@ -4341,8 +4340,9 @@ static int md_seq_show(struct seq_file *seq, void *v)
                 return 0;
         }
 
-        if (mddev_lock(mddev)!=0) 
+        if (mddev_lock(mddev) < 0)
                 return -EINTR;
+
         if (mddev->pers || mddev->raid_disks || !list_empty(&mddev->disks)) {
                 seq_printf(seq, "%s : %sactive", mdname(mddev),
                                                 mddev->pers ? "" : "in");
diff --git a/drivers/md/raid1.c b/drivers/md/raid1.c
index 6081941de1b3..4070eff6f0f8 100644
--- a/drivers/md/raid1.c
+++ b/drivers/md/raid1.c
@@ -315,10 +315,11 @@ static int raid1_end_write_request(struct bio *bio, unsigned int bytes_done, int
                 if (r1_bio->bios[mirror] == bio)
                         break;
 
-        if (error == -ENOTSUPP && test_bit(R1BIO_Barrier, &r1_bio->state)) {
+        if (error == -EOPNOTSUPP && test_bit(R1BIO_Barrier, &r1_bio->state)) {
                 set_bit(BarriersNotsupp, &conf->mirrors[mirror].rdev->flags);
                 set_bit(R1BIO_BarrierRetry, &r1_bio->state);
                 r1_bio->mddev->barriers_work = 0;
+                /* Don't rdev_dec_pending in this branch - keep it for the retry */
         } else {
                 /*
                  * this branch is our 'one mirror IO has finished' event handler:
@@ -365,6 +366,7 @@ static int raid1_end_write_request(struct bio *bio, unsigned int bytes_done, int
                                 }
                         }
                 }
+                rdev_dec_pending(conf->mirrors[mirror].rdev, conf->mddev);
         }
         /*
          *
@@ -374,11 +376,9 @@ static int raid1_end_write_request(struct bio *bio, unsigned int bytes_done, int
         if (atomic_dec_and_test(&r1_bio->remaining)) {
                 if (test_bit(R1BIO_BarrierRetry, &r1_bio->state)) {
                         reschedule_retry(r1_bio);
-                        /* Don't dec_pending yet, we want to hold
-                         * the reference over the retry
-                         */
                         goto out;
                 }
+                /* it really is the end of this request */
                 if (test_bit(R1BIO_BehindIO, &r1_bio->state)) {
                         /* free extra copy of the data pages */
                         int i = bio->bi_vcnt;
@@ -393,8 +393,6 @@ static int raid1_end_write_request(struct bio *bio, unsigned int bytes_done, int
                 md_write_end(r1_bio->mddev);
                 raid_end_bio_io(r1_bio);
         }
-
-        rdev_dec_pending(conf->mirrors[mirror].rdev, conf->mddev);
  out:
         if (to_put)
                 bio_put(to_put);
@@ -753,18 +751,24 @@ static int make_request(request_queue_t *q, struct bio * bio)
         const int rw = bio_data_dir(bio);
         int do_barriers;
 
-        if (unlikely(!mddev->barriers_work && bio_barrier(bio))) {
-                bio_endio(bio, bio->bi_size, -EOPNOTSUPP);
-                return 0;
-        }
-
         /*
          * Register the new request and wait if the reconstruction
          * thread has put up a bar for new requests.
          * Continue immediately if no resync is active currently.
+         * We test barriers_work *after* md_write_start as md_write_start
+         * may cause the first superblock write, and that will check out
+         * if barriers work.
          */
+
         md_write_start(mddev, bio); /* wait on superblock update early */
 
+        if (unlikely(!mddev->barriers_work && bio_barrier(bio))) {
+                if (rw == WRITE)
+                        md_write_end(mddev);
+                bio_endio(bio, bio->bi_size, -EOPNOTSUPP);
+                return 0;
+        }
+
         wait_barrier(conf);
 
         disk_stat_inc(mddev->gendisk, ios[rw]);
@@ -1404,10 +1408,11 @@ static void raid1d(mddev_t *mddev)
                         unplug = 1;
                 } else if (test_bit(R1BIO_BarrierRetry, &r1_bio->state)) {
                         /* some requests in the r1bio were BIO_RW_BARRIER
-                         * requests which failed with -ENOTSUPP.  Hohumm..
+                         * requests which failed with -EOPNOTSUPP.  Hohumm..
                          * Better resubmit without the barrier.
                          * We know which devices to resubmit for, because
                          * all others have had their bios[] entry cleared.
+                         * We already have a nr_pending reference on these rdevs.
                          */
                         int i;
                         clear_bit(R1BIO_BarrierRetry, &r1_bio->state);
diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c
index 617012bc107a..1440935414e6 100644
--- a/drivers/md/raid10.c
+++ b/drivers/md/raid10.c
@@ -1407,43 +1407,54 @@ static void raid10d(mddev_t *mddev)
                                 if (s > (PAGE_SIZE>>9))
                                         s = PAGE_SIZE >> 9;
 
+                                rcu_read_lock();
                                 do {
                                         int d = r10_bio->devs[sl].devnum;
-                                        rdev = conf->mirrors[d].rdev;
+                                        rdev = rcu_dereference(conf->mirrors[d].rdev);
                                         if (rdev &&
-                                            test_bit(In_sync, &rdev->flags) &&
-                                            sync_page_io(rdev->bdev,
-                                                         r10_bio->devs[sl].addr +
-                                                         sect + rdev->data_offset,
-                                                         s<<9,
-                                                         conf->tmppage, READ))
-                                                success = 1;
-                                        else {
-                                                sl++;
-                                                if (sl == conf->copies)
-                                                        sl = 0;
+                                            test_bit(In_sync, &rdev->flags)) {
+                                                atomic_inc(&rdev->nr_pending);
+                                                rcu_read_unlock();
+                                                success = sync_page_io(rdev->bdev,
+                                                                       r10_bio->devs[sl].addr +
+                                                                       sect + rdev->data_offset,
+                                                                       s<<9,
+                                                                       conf->tmppage, READ);
+                                                rdev_dec_pending(rdev, mddev);
+                                                rcu_read_lock();
+                                                if (success)
+                                                        break;
                                         }
+                                        sl++;
+                                        if (sl == conf->copies)
+                                                sl = 0;
                                 } while (!success && sl != r10_bio->read_slot);
+                                rcu_read_unlock();
 
                                 if (success) {
                                         int start = sl;
                                         /* write it back and re-read */
+                                        rcu_read_lock();
                                         while (sl != r10_bio->read_slot) {
                                                 int d;
                                                 if (sl==0)
                                                         sl = conf->copies;
                                                 sl--;
                                                 d = r10_bio->devs[sl].devnum;
-                                                rdev = conf->mirrors[d].rdev;
-                                                atomic_add(s, &rdev->corrected_errors);
+                                                rdev = rcu_dereference(conf->mirrors[d].rdev);
                                                 if (rdev &&
                                                     test_bit(In_sync, &rdev->flags)) {
+                                                        atomic_inc(&rdev->nr_pending);
+                                                        rcu_read_unlock();
+                                                        atomic_add(s, &rdev->corrected_errors);
                                                         if (sync_page_io(rdev->bdev,
                                                                          r10_bio->devs[sl].addr +
                                                                          sect + rdev->data_offset,
                                                                          s<<9, conf->tmppage, WRITE) == 0)
                                                                 /* Well, this device is dead */
                                                                 md_error(mddev, rdev);
+                                                        rdev_dec_pending(rdev, mddev);
+                                                        rcu_read_lock();
                                                 }
                                         }
                                         sl = start;
@@ -1453,17 +1464,22 @@ static void raid10d(mddev_t *mddev)
                                                         sl = conf->copies;
                                                 sl--;
                                                 d = r10_bio->devs[sl].devnum;
-                                                rdev = conf->mirrors[d].rdev;
+                                                rdev = rcu_dereference(conf->mirrors[d].rdev);
                                                 if (rdev &&
                                                     test_bit(In_sync, &rdev->flags)) {
+                                                        atomic_inc(&rdev->nr_pending);
+                                                        rcu_read_unlock();
                                                         if (sync_page_io(rdev->bdev,
                                                                          r10_bio->devs[sl].addr +
                                                                          sect + rdev->data_offset,
                                                                          s<<9, conf->tmppage, READ) == 0)
                                                                 /* Well, this device is dead */
                                                                 md_error(mddev, rdev);
+                                                        rdev_dec_pending(rdev, mddev);
+                                                        rcu_read_lock();
                                                 }
                                         }
+                                        rcu_read_unlock();
                                 } else {
                                         /* Cannot read from anywhere -- bye bye array */
                                         md_error(mddev, conf->mirrors[r10_bio->devs[r10_bio->read_slot].devnum].rdev);
diff --git a/drivers/media/video/cx88/cx88-alsa.c b/drivers/media/video/cx88/cx88-alsa.c
index f9d87b86492c..320b3d9384ba 100644
--- a/drivers/media/video/cx88/cx88-alsa.c
+++ b/drivers/media/video/cx88/cx88-alsa.c
@@ -616,7 +616,7 @@ static struct snd_kcontrol_new snd_cx88_capture_volume = {
  * Only boards with eeprom and byte 1 at eeprom=1 have it
  */
 
-static struct pci_device_id cx88_audio_pci_tbl[] = {
+static struct pci_device_id cx88_audio_pci_tbl[] __devinitdata = {
         {0x14f1,0x8801,PCI_ANY_ID,PCI_ANY_ID,0,0,0},
         {0x14f1,0x8811,PCI_ANY_ID,PCI_ANY_ID,0,0,0},
         {0, }
diff --git a/drivers/mmc/at91_mci.c b/drivers/mmc/at91_mci.c
index 6061c2d101a0..88f0eef9cf33 100644
--- a/drivers/mmc/at91_mci.c
+++ b/drivers/mmc/at91_mci.c
@@ -621,9 +621,6 @@ static void at91_mci_set_ios(struct mmc_host *mmc, struct mmc_ios *ios)
         struct at91mci_host *host = mmc_priv(mmc);
         unsigned long at91_master_clock = clk_get_rate(mci_clk);
 
-        DBG("Clock %uHz, busmode %u, powermode %u, Vdd %u\n",
-                ios->clock, ios->bus_mode, ios->power_mode, ios->vdd);
-
         if (host)
                 host->bus_mode = ios->bus_mode;
         else
diff --git a/drivers/mmc/au1xmmc.c b/drivers/mmc/au1xmmc.c
index c0326bbc5f28..914d62b24064 100644
--- a/drivers/mmc/au1xmmc.c
+++ b/drivers/mmc/au1xmmc.c
@@ -720,10 +720,6 @@ static void au1xmmc_set_ios(struct mmc_host* mmc, struct mmc_ios* ios)
 {
         struct au1xmmc_host *host = mmc_priv(mmc);
 
-        DBG("set_ios (power=%u, clock=%uHz, vdd=%u, mode=%u)\n",
-              host->id, ios->power_mode, ios->clock, ios->vdd,
-              ios->bus_mode);
-
         if (ios->power_mode == MMC_POWER_OFF)
                 au1xmmc_set_power(host, 0);
         else if (ios->power_mode == MMC_POWER_ON) {
diff --git a/drivers/mmc/imxmmc.c b/drivers/mmc/imxmmc.c
index ffb7f55d3467..79358e223f57 100644
--- a/drivers/mmc/imxmmc.c
+++ b/drivers/mmc/imxmmc.c
@@ -102,6 +102,7 @@ struct imxmci_host {
 #define IMXMCI_PEND_CPU_DATA_b  5
 #define IMXMCI_PEND_CARD_XCHG_b 6
 #define IMXMCI_PEND_SET_INIT_b  7
+#define IMXMCI_PEND_STARTED_b   8
 
 #define IMXMCI_PEND_IRQ_m       (1 << IMXMCI_PEND_IRQ_b)
 #define IMXMCI_PEND_DMA_END_m   (1 << IMXMCI_PEND_DMA_END_b)
@@ -111,6 +112,7 @@ struct imxmci_host {
 #define IMXMCI_PEND_CPU_DATA_m  (1 << IMXMCI_PEND_CPU_DATA_b)
 #define IMXMCI_PEND_CARD_XCHG_m (1 << IMXMCI_PEND_CARD_XCHG_b)
 #define IMXMCI_PEND_SET_INIT_m  (1 << IMXMCI_PEND_SET_INIT_b)
+#define IMXMCI_PEND_STARTED_m   (1 << IMXMCI_PEND_STARTED_b)
 
 static void imxmci_stop_clock(struct imxmci_host *host)
 {
@@ -131,23 +133,52 @@ static void imxmci_stop_clock(struct imxmci_host *host)
         dev_dbg(mmc_dev(host->mmc), "imxmci_stop_clock blocked, no luck\n");
 }
 
-static void imxmci_start_clock(struct imxmci_host *host)
+static int imxmci_start_clock(struct imxmci_host *host)
 {
-        int i = 0;
+        unsigned int trials = 0;
+        unsigned int delay_limit = 128;
+        unsigned long flags;
+
         MMC_STR_STP_CLK &= ~STR_STP_CLK_STOP_CLK;
-        while(i < 0x1000) {
-                if(!(i & 0x7f))
-                        MMC_STR_STP_CLK |= STR_STP_CLK_START_CLK;
 
-                if(MMC_STATUS & STATUS_CARD_BUS_CLK_RUN) {
-                        /* Check twice before cut */
+        clear_bit(IMXMCI_PEND_STARTED_b, &host->pending_events);
+
+        /*
+         * Command start of the clock, this usually succeeds in less
+         * then 6 delay loops, but during card detection (low clockrate)
+         * it takes up to 5000 delay loops and sometimes fails for the first time
+         */
+        MMC_STR_STP_CLK |= STR_STP_CLK_START_CLK;
+
+        do {
+                unsigned int delay = delay_limit;
+
+                while(delay--){
                         if(MMC_STATUS & STATUS_CARD_BUS_CLK_RUN)
-                                return;
+                                /* Check twice before cut */
+                                if(MMC_STATUS & STATUS_CARD_BUS_CLK_RUN)
+                                        return 0;
+
+                        if(test_bit(IMXMCI_PEND_STARTED_b, &host->pending_events))
+                                return 0;
                 }
 
-                i++;
-        }
-        dev_dbg(mmc_dev(host->mmc), "imxmci_start_clock blocked, no luck\n");
+                local_irq_save(flags);
+                /*
+                 * Ensure, that request is not doubled under all possible circumstances.
+                 * It is possible, that cock running state is missed, because some other
+                 * IRQ or schedule delays this function execution and the clocks has
+                 * been already stopped by other means (response processing, SDHC HW)
+                 */
+                if(!test_bit(IMXMCI_PEND_STARTED_b, &host->pending_events))
+                        MMC_STR_STP_CLK |= STR_STP_CLK_START_CLK;
+                local_irq_restore(flags);
+
+        } while(++trials<256);
+
+        dev_err(mmc_dev(host->mmc), "imxmci_start_clock blocked, no luck\n");
+
+        return -1;
 }
 
 static void imxmci_softreset(void)
@@ -498,7 +529,7 @@ static int imxmci_data_done(struct imxmci_host *host, unsigned int stat)
 
         data_error = imxmci_finish_data(host, stat);
 
-        if (host->req->stop && (data_error == MMC_ERR_NONE)) {
+        if (host->req->stop) {
                 imxmci_stop_clock(host);
                 imxmci_start_cmd(host, host->req->stop, 0);
         } else {
@@ -622,6 +653,7 @@ static irqreturn_t imxmci_irq(int irq, void *devid, struct pt_regs *regs)
         atomic_set(&host->stuck_timeout, 0);
         host->status_reg = stat;
         set_bit(IMXMCI_PEND_IRQ_b, &host->pending_events);
+        set_bit(IMXMCI_PEND_STARTED_b, &host->pending_events);
         tasklet_schedule(&host->tasklet);
 
         return IRQ_RETVAL(handled);;
@@ -775,10 +807,6 @@ static void imxmci_set_ios(struct mmc_host *mmc, struct mmc_ios *ios)
         struct imxmci_host *host = mmc_priv(mmc);
         int prescaler;
 
-        dev_dbg(mmc_dev(host->mmc), "clock %u power %u vdd %u width %u\n",
-                ios->clock, ios->power_mode, ios->vdd,
-                (ios->bus_width==MMC_BUS_WIDTH_4)?4:1);
-
         if( ios->bus_width==MMC_BUS_WIDTH_4 ) {
                 host->actual_bus_width = MMC_BUS_WIDTH_4;
                 imx_gpio_mode(PB11_PF_SD_DAT3);
diff --git a/drivers/mmc/mmc.c b/drivers/mmc/mmc.c
index da6ddd910fc5..1ca2c8b9c9b5 100644
--- a/drivers/mmc/mmc.c
+++ b/drivers/mmc/mmc.c
@@ -59,21 +59,23 @@ static const unsigned int tacc_mant[] = {
 
 
 /**
- *      mmc_request_done - finish processing an MMC command
- *      @host: MMC host which completed command
- *      @mrq: MMC request which completed
+ *      mmc_request_done - finish processing an MMC request
+ *      @host: MMC host which completed request
+ *      @mrq: MMC request which request
  *
  *      MMC drivers should call this function when they have completed
- *      their processing of a command.  This should be called before the
- *      data part of the command has completed.
+ *      their processing of a request.
  */
 void mmc_request_done(struct mmc_host *host, struct mmc_request *mrq)
 {
         struct mmc_command *cmd = mrq->cmd;
-        int err = mrq->cmd->error;
-        pr_debug("MMC: req done (%02x): %d: %08x %08x %08x %08x\n",
-                 cmd->opcode, err, cmd->resp[0], cmd->resp[1],
-                 cmd->resp[2], cmd->resp[3]);
+        int err = cmd->error;
+
+        pr_debug("%s: req done (CMD%u): %d/%d/%d: %08x %08x %08x %08x\n",
+                 mmc_hostname(host), cmd->opcode, err,
+                 mrq->data ? mrq->data->error : 0,
+                 mrq->stop ? mrq->stop->error : 0,
+                 cmd->resp[0], cmd->resp[1], cmd->resp[2], cmd->resp[3]);
 
         if (err && cmd->retries) {
                 cmd->retries--;
@@ -97,8 +99,9 @@ EXPORT_SYMBOL(mmc_request_done);
 void
 mmc_start_request(struct mmc_host *host, struct mmc_request *mrq)
 {
-        pr_debug("MMC: starting cmd %02x arg %08x flags %08x\n",
-                 mrq->cmd->opcode, mrq->cmd->arg, mrq->cmd->flags);
+        pr_debug("%s: starting CMD%u arg %08x flags %08x\n",
+                 mmc_hostname(host), mrq->cmd->opcode,
+                 mrq->cmd->arg, mrq->cmd->flags);
 
         WARN_ON(host->card_busy == NULL);
 
@@ -312,6 +315,18 @@ void mmc_release_host(struct mmc_host *host)
 
 EXPORT_SYMBOL(mmc_release_host);
 
+static inline void mmc_set_ios(struct mmc_host *host)
+{
+        struct mmc_ios *ios = &host->ios;
+
+        pr_debug("%s: clock %uHz busmode %u powermode %u cs %u Vdd %u width %u\n",
+                 mmc_hostname(host), ios->clock, ios->bus_mode,
+                 ios->power_mode, ios->chip_select, ios->vdd,
+                 ios->bus_width);
+        
+        host->ops->set_ios(host, ios);
+}
+
 static int mmc_select_card(struct mmc_host *host, struct mmc_card *card)
 {
         int err;
@@ -364,7 +379,7 @@ static int mmc_select_card(struct mmc_host *host, struct mmc_card *card)
                 }
         }
 
-        host->ops->set_ios(host, &host->ios);
+        mmc_set_ios(host);
 
         return MMC_ERR_NONE;
 }
@@ -415,7 +430,7 @@ static u32 mmc_select_voltage(struct mmc_host *host, u32 ocr)
                 ocr = 3 << bit;
 
                 host->ios.vdd = bit;
-                host->ops->set_ios(host, &host->ios);
+                mmc_set_ios(host);
         } else {
                 ocr = 0;
         }
@@ -549,6 +564,7 @@ static void mmc_decode_csd(struct mmc_card *card)
                 csd->read_partial = UNSTUFF_BITS(resp, 79, 1);
                 csd->write_misalign = UNSTUFF_BITS(resp, 78, 1);
                 csd->read_misalign = UNSTUFF_BITS(resp, 77, 1);
+                csd->r2w_factor = UNSTUFF_BITS(resp, 26, 3);
                 csd->write_blkbits = UNSTUFF_BITS(resp, 22, 4);
                 csd->write_partial = UNSTUFF_BITS(resp, 21, 1);
         } else {
@@ -583,6 +599,7 @@ static void mmc_decode_csd(struct mmc_card *card)
                 csd->read_partial = UNSTUFF_BITS(resp, 79, 1);
                 csd->write_misalign = UNSTUFF_BITS(resp, 78, 1);
                 csd->read_misalign = UNSTUFF_BITS(resp, 77, 1);
+                csd->r2w_factor = UNSTUFF_BITS(resp, 26, 3);
                 csd->write_blkbits = UNSTUFF_BITS(resp, 22, 4);
                 csd->write_partial = UNSTUFF_BITS(resp, 21, 1);
         }
@@ -666,7 +683,7 @@ static void mmc_idle_cards(struct mmc_host *host)
         struct mmc_command cmd;
 
         host->ios.chip_select = MMC_CS_HIGH;
-        host->ops->set_ios(host, &host->ios);
+        mmc_set_ios(host);
 
         mmc_delay(1);
 
@@ -679,7 +696,7 @@ static void mmc_idle_cards(struct mmc_host *host)
         mmc_delay(1);
 
         host->ios.chip_select = MMC_CS_DONTCARE;
-        host->ops->set_ios(host, &host->ios);
+        mmc_set_ios(host);
 
         mmc_delay(1);
 }
@@ -704,13 +721,13 @@ static void mmc_power_up(struct mmc_host *host)
         host->ios.chip_select = MMC_CS_DONTCARE;
         host->ios.power_mode = MMC_POWER_UP;
         host->ios.bus_width = MMC_BUS_WIDTH_1;
-        host->ops->set_ios(host, &host->ios);
+        mmc_set_ios(host);
 
         mmc_delay(1);
 
         host->ios.clock = host->f_min;
         host->ios.power_mode = MMC_POWER_ON;
-        host->ops->set_ios(host, &host->ios);
+        mmc_set_ios(host);
 
         mmc_delay(2);
 }
@@ -723,7 +740,7 @@ static void mmc_power_off(struct mmc_host *host)
         host->ios.chip_select = MMC_CS_DONTCARE;
         host->ios.power_mode = MMC_POWER_OFF;
         host->ios.bus_width = MMC_BUS_WIDTH_1;
-        host->ops->set_ios(host, &host->ios);
+        mmc_set_ios(host);
 }
 
 static int mmc_send_op_cond(struct mmc_host *host, u32 ocr, u32 *rocr)
@@ -971,7 +988,8 @@ static unsigned int mmc_calculate_clock(struct mmc_host *host)
                 if (!mmc_card_dead(card) && max_dtr > card->csd.max_dtr)
                         max_dtr = card->csd.max_dtr;
 
-        pr_debug("MMC: selected %d.%03dMHz transfer rate\n",
+        pr_debug("%s: selected %d.%03dMHz transfer rate\n",
+                 mmc_hostname(host),
                  max_dtr / 1000000, (max_dtr / 1000) % 1000);
 
         return max_dtr;
@@ -1046,7 +1064,7 @@ static void mmc_setup(struct mmc_host *host)
         } else {
                 host->ios.bus_mode = MMC_BUSMODE_OPENDRAIN;
                 host->ios.clock = host->f_min;
-                host->ops->set_ios(host, &host->ios);
+                mmc_set_ios(host);
 
                 /*
                  * We should remember the OCR mask from the existing
@@ -1082,7 +1100,7 @@ static void mmc_setup(struct mmc_host *host)
          * Ok, now switch to push-pull mode.
          */
         host->ios.bus_mode = MMC_BUSMODE_PUSHPULL;
-        host->ops->set_ios(host, &host->ios);
+        mmc_set_ios(host);
 
         mmc_read_csds(host);
 
@@ -1128,7 +1146,7 @@ static void mmc_rescan(void *data)
                  * attached cards and the host support.
                  */
                 host->ios.clock = mmc_calculate_clock(host);
-                host->ops->set_ios(host, &host->ios);
+                mmc_set_ios(host);
         }
 
         mmc_release_host(host);
diff --git a/drivers/mmc/mmc_block.c b/drivers/mmc/mmc_block.c
index 8eb2a2ede64b..06bd1f4cb9b1 100644
--- a/drivers/mmc/mmc_block.c
+++ b/drivers/mmc/mmc_block.c
@@ -187,6 +187,12 @@ static int mmc_blk_issue_rq(struct mmc_queue *mq, struct request *req)
                         brq.cmd.opcode = MMC_WRITE_BLOCK;
                         brq.data.flags |= MMC_DATA_WRITE;
                         brq.data.blocks = 1;
+
+                        /*
+                         * Scale up the timeout by the r2w factor
+                         */
+                        brq.data.timeout_ns <<= card->csd.r2w_factor;
+                        brq.data.timeout_clks <<= card->csd.r2w_factor;
                 }
 
                 if (brq.data.blocks > 1) {
diff --git a/drivers/mmc/mmci.c b/drivers/mmc/mmci.c
index df7e861e2fc7..da8e4d7339cc 100644
--- a/drivers/mmc/mmci.c
+++ b/drivers/mmc/mmci.c
@@ -402,9 +402,6 @@ static void mmci_set_ios(struct mmc_host *mmc, struct mmc_ios *ios)
         struct mmci_host *host = mmc_priv(mmc);
         u32 clk = 0, pwr = 0;
 
-        DBG(host, "clock %uHz busmode %u powermode %u Vdd %u\n",
-            ios->clock, ios->bus_mode, ios->power_mode, ios->vdd);
-
         if (ios->clock) {
                 if (ios->clock >= host->mclk) {
                         clk = MCI_CLK_BYPASS;
diff --git a/drivers/mmc/pxamci.c b/drivers/mmc/pxamci.c
index eb9a8826e9b5..f97b472085cb 100644
--- a/drivers/mmc/pxamci.c
+++ b/drivers/mmc/pxamci.c
@@ -65,11 +65,6 @@ struct pxamci_host {
         unsigned int            dma_dir;
 };
 
-static inline unsigned int ns_to_clocks(unsigned int ns)
-{
-        return (ns * (CLOCKRATE / 1000000) + 999) / 1000;
-}
-
 static void pxamci_stop_clock(struct pxamci_host *host)
 {
         if (readl(host->base + MMC_STAT) & STAT_CLK_EN) {
@@ -113,6 +108,7 @@ static void pxamci_disable_irq(struct pxamci_host *host, unsigned int mask)
 static void pxamci_setup_data(struct pxamci_host *host, struct mmc_data *data)
 {
         unsigned int nob = data->blocks;
+        unsigned long long clks;
         unsigned int timeout;
         u32 dcmd;
         int i;
@@ -125,7 +121,9 @@ static void pxamci_setup_data(struct pxamci_host *host, struct mmc_data *data)
         writel(nob, host->base + MMC_NOB);
         writel(1 << data->blksz_bits, host->base + MMC_BLKLEN);
 
-        timeout = ns_to_clocks(data->timeout_ns) + data->timeout_clks;
+        clks = (unsigned long long)data->timeout_ns * CLOCKRATE;
+        do_div(clks, 1000000000UL);
+        timeout = (unsigned int)clks + (data->timeout_clks << host->clkrt);
         writel((timeout + 255) / 256, host->base + MMC_RDTO);
 
         if (data->flags & MMC_DATA_READ) {
@@ -200,7 +198,6 @@ static void pxamci_start_cmd(struct pxamci_host *host, struct mmc_command *cmd,
 
 static void pxamci_finish_request(struct pxamci_host *host, struct mmc_request *mrq)
 {
-        pr_debug("PXAMCI: request done\n");
         host->mrq = NULL;
         host->cmd = NULL;
         host->data = NULL;
@@ -293,7 +290,7 @@ static int pxamci_data_done(struct pxamci_host *host, unsigned int stat)
         pxamci_disable_irq(host, DATA_TRAN_DONE);
 
         host->data = NULL;
-        if (host->mrq->stop && data->error == MMC_ERR_NONE) {
+        if (host->mrq->stop) {
                 pxamci_stop_clock(host);
                 pxamci_start_cmd(host, host->mrq->stop, 0);
         } else {
@@ -311,12 +308,10 @@ static irqreturn_t pxamci_irq(int irq, void *devid, struct pt_regs *regs)
 
         ireg = readl(host->base + MMC_I_REG);
 
-        pr_debug("PXAMCI: irq %08x\n", ireg);
-
         if (ireg) {
                 unsigned stat = readl(host->base + MMC_STAT);
 
-                pr_debug("PXAMCI: stat %08x\n", stat);
+                pr_debug("PXAMCI: irq %08x stat %08x\n", ireg, stat);
 
                 if (ireg & END_CMD_RES)
                         handled |= pxamci_cmd_done(host, stat);
@@ -370,10 +365,6 @@ static void pxamci_set_ios(struct mmc_host *mmc, struct mmc_ios *ios)
 {
         struct pxamci_host *host = mmc_priv(mmc);
 
-        pr_debug("pxamci_set_ios: clock %u power %u vdd %u.%02u\n",
-                 ios->clock, ios->power_mode, ios->vdd / 100,
-                 ios->vdd % 100);
-
         if (ios->clock) {
                 unsigned int clk = CLOCKRATE / ios->clock;
                 if (CLOCKRATE / clk > ios->clock)
@@ -399,7 +390,7 @@ static void pxamci_set_ios(struct mmc_host *mmc, struct mmc_ios *ios)
                         host->cmdat |= CMDAT_INIT;
         }
 
-        pr_debug("pxamci_set_ios: clkrt = %x cmdat = %x\n",
+        pr_debug("PXAMCI: clkrt = %x cmdat = %x\n",
                  host->clkrt, host->cmdat);
 }
 
diff --git a/drivers/mmc/sdhci.c b/drivers/mmc/sdhci.c
index bdbfca050029..b0053280ff2d 100644
--- a/drivers/mmc/sdhci.c
+++ b/drivers/mmc/sdhci.c
@@ -570,10 +570,6 @@ static void sdhci_set_ios(struct mmc_host *mmc, struct mmc_ios *ios)
 
         spin_lock_irqsave(&host->lock, flags);
 
-        DBG("clock %uHz busmode %u powermode %u cs %u Vdd %u width %u\n",
-             ios->clock, ios->bus_mode, ios->power_mode, ios->chip_select,
-             ios->vdd, ios->bus_width);
-
         /*
          * Reset the chip on each power off.
          * Should clear out any weird states.
diff --git a/drivers/mmc/wbsd.c b/drivers/mmc/wbsd.c
index 511f7b0b31d2..39b3d97f891e 100644
--- a/drivers/mmc/wbsd.c
+++ b/drivers/mmc/wbsd.c
@@ -931,10 +931,6 @@ static void wbsd_set_ios(struct mmc_host *mmc, struct mmc_ios *ios)
         struct wbsd_host *host = mmc_priv(mmc);
         u8 clk, setup, pwr;
 
-        DBGF("clock %uHz busmode %u powermode %u cs %u Vdd %u width %u\n",
-                ios->clock, ios->bus_mode, ios->power_mode, ios->chip_select,
-                ios->vdd, ios->bus_width);
-
         spin_lock_bh(&host->lock);
 
         /*
diff --git a/drivers/net/au1000_eth.c b/drivers/net/au1000_eth.c
index 1363083b4d83..14dbad14afb6 100644
--- a/drivers/net/au1000_eth.c
+++ b/drivers/net/au1000_eth.c
@@ -52,6 +52,7 @@
 #include <linux/mii.h>
 #include <linux/skbuff.h>
 #include <linux/delay.h>
+#include <linux/crc32.h>
 #include <asm/mipsregs.h>
 #include <asm/irq.h>
 #include <asm/io.h>
@@ -2070,23 +2071,6 @@ static void au1000_tx_timeout(struct net_device *dev)
         netif_wake_queue(dev);
 }
 
-
-static unsigned const ethernet_polynomial = 0x04c11db7U;
-static inline u32 ether_crc(int length, unsigned char *data)
-{
-    int crc = -1;
-
-    while(--length >= 0) {
-                unsigned char current_octet = *data++;
-                int bit;
-                for (bit = 0; bit < 8; bit++, current_octet >>= 1)
-                        crc = (crc << 1) ^
-                                ((crc < 0) ^ (current_octet & 1) ? 
-                                 ethernet_polynomial : 0);
-    }
-    return crc;
-}
-
 static void set_rx_mode(struct net_device *dev)
 {
         struct au1000_private *aup = (struct au1000_private *) dev->priv;
diff --git a/drivers/net/dl2k.c b/drivers/net/dl2k.c
index 1f3627470c95..1ddefd281213 100644
--- a/drivers/net/dl2k.c
+++ b/drivers/net/dl2k.c
@@ -765,7 +765,7 @@ rio_free_tx (struct net_device *dev, int irq)
                         break;
                 skb = np->tx_skbuff[entry];
                 pci_unmap_single (np->pdev,
-                                  np->tx_ring[entry].fraginfo & 0xffffffffffff,
+                                  np->tx_ring[entry].fraginfo & DMA_48BIT_MASK,
                                   skb->len, PCI_DMA_TODEVICE);
                 if (irq)
                         dev_kfree_skb_irq (skb);
@@ -893,7 +893,7 @@ receive_packet (struct net_device *dev)
                         /* Small skbuffs for short packets */
                         if (pkt_len > copy_thresh) {
                                 pci_unmap_single (np->pdev,
-                                                  desc->fraginfo & 0xffffffffffff,
+                                                  desc->fraginfo & DMA_48BIT_MASK,
                                                   np->rx_buf_sz,
                                                   PCI_DMA_FROMDEVICE);
                                 skb_put (skb = np->rx_skbuff[entry], pkt_len);
@@ -901,7 +901,7 @@ receive_packet (struct net_device *dev)
                         } else if ((skb = dev_alloc_skb (pkt_len + 2)) != NULL) {
                                 pci_dma_sync_single_for_cpu(np->pdev,
                                                             desc->fraginfo & 
-                                                                0xffffffffffff,
+                                                                DMA_48BIT_MASK,
                                                             np->rx_buf_sz,
                                                             PCI_DMA_FROMDEVICE);
                                 skb->dev = dev;
@@ -913,7 +913,7 @@ receive_packet (struct net_device *dev)
                                 skb_put (skb, pkt_len);
                                 pci_dma_sync_single_for_device(np->pdev,
                                                                desc->fraginfo &
-                                                                 0xffffffffffff,
+                                                                 DMA_48BIT_MASK,
                                                                np->rx_buf_sz,
                                                                PCI_DMA_FROMDEVICE);
                         }
@@ -1800,7 +1800,7 @@ rio_close (struct net_device *dev)
                 skb = np->rx_skbuff[i];
                 if (skb) {
                         pci_unmap_single(np->pdev, 
-                                         np->rx_ring[i].fraginfo & 0xffffffffffff,
+                                         np->rx_ring[i].fraginfo & DMA_48BIT_MASK,
                                          skb->len, PCI_DMA_FROMDEVICE);
                         dev_kfree_skb (skb);
                         np->rx_skbuff[i] = NULL;
@@ -1810,7 +1810,7 @@ rio_close (struct net_device *dev)
                 skb = np->tx_skbuff[i];
                 if (skb) {
                         pci_unmap_single(np->pdev, 
-                                         np->tx_ring[i].fraginfo & 0xffffffffffff,
+                                         np->tx_ring[i].fraginfo & DMA_48BIT_MASK,
                                          skb->len, PCI_DMA_TODEVICE);
                         dev_kfree_skb (skb);
                         np->tx_skbuff[i] = NULL;
diff --git a/drivers/net/e1000/e1000_main.c b/drivers/net/e1000/e1000_main.c
index add8dc4aa7b0..c99e87838f92 100644
--- a/drivers/net/e1000/e1000_main.c
+++ b/drivers/net/e1000/e1000_main.c
@@ -3768,6 +3768,7 @@ e1000_clean_rx_irq_ps(struct e1000_adapter *adapter,
                         ps_page->ps_page[j] = NULL;
                         skb->len += length;
                         skb->data_len += length;
+                        skb->truesize += length;
                 }
 
 copydone:
diff --git a/drivers/net/forcedeth.c b/drivers/net/forcedeth.c
index 7627a75f4f7c..f7235c9bc421 100644
--- a/drivers/net/forcedeth.c
+++ b/drivers/net/forcedeth.c
@@ -105,6 +105,8 @@
  *      0.50: 20 Jan 2006: Add 8021pq tagging support.
  *      0.51: 20 Jan 2006: Add 64bit consistent memory allocation for rings.
  *      0.52: 20 Jan 2006: Add MSI/MSIX support.
+ *      0.53: 19 Mar 2006: Fix init from low power mode and add hw reset.
+ *      0.54: 21 Mar 2006: Fix spin locks for multi irqs and cleanup.
  *
  * Known bugs:
  * We suspect that on some hardware no TX done interrupts are generated.
@@ -116,7 +118,7 @@
  * DEV_NEED_TIMERIRQ will not harm you on sane hardware, only generating a few
  * superfluous timer interrupts from the nic.
  */
-#define FORCEDETH_VERSION               "0.52"
+#define FORCEDETH_VERSION               "0.54"
 #define DRV_NAME                        "forcedeth"
 
 #include <linux/module.h>
@@ -160,6 +162,7 @@
 #define DEV_HAS_VLAN            0x0020  /* device supports vlan tagging and striping */
 #define DEV_HAS_MSI             0x0040  /* device supports MSI */
 #define DEV_HAS_MSI_X           0x0080  /* device supports MSI-X */
+#define DEV_HAS_POWER_CNTRL     0x0100  /* device supports power savings */
 
 enum {
         NvRegIrqStatus = 0x000,
@@ -203,6 +206,8 @@ enum {
 #define NVREG_MISC1_HD          0x02
 #define NVREG_MISC1_FORCE       0x3b0f3c
 
+        NvRegMacReset = 0x3c,
+#define NVREG_MAC_RESET_ASSERT  0x0F3
         NvRegTransmitterControl = 0x084,
 #define NVREG_XMITCTL_START     0x01
         NvRegTransmitterStatus = 0x088,
@@ -326,6 +331,10 @@ enum {
         NvRegMSIXMap0 = 0x3e0,
         NvRegMSIXMap1 = 0x3e4,
         NvRegMSIXIrqStatus = 0x3f0,
+
+        NvRegPowerState2 = 0x600,
+#define NVREG_POWERSTATE2_POWERUP_MASK          0x0F11
+#define NVREG_POWERSTATE2_POWERUP_REV_A3        0x0001
 };
 
 /* Big endian: should work, but is untested */
@@ -414,7 +423,8 @@ typedef union _ring_type {
 #define NV_RX3_VLAN_TAG_MASK    (0x0000FFFF)
 
 /* Miscelaneous hardware related defines: */
-#define NV_PCI_REGSZ            0x270
+#define NV_PCI_REGSZ_VER1       0x270
+#define NV_PCI_REGSZ_VER2       0x604
 
 /* various timeout delays: all in usec */
 #define NV_TXRX_RESET_DELAY     4
@@ -431,6 +441,7 @@ typedef union _ring_type {
 #define NV_MIIBUSY_DELAY        50
 #define NV_MIIPHY_DELAY 10
 #define NV_MIIPHY_DELAYMAX      10000
+#define NV_MAC_RESET_DELAY      64
 
 #define NV_WAKEUPPATTERNS       5
 #define NV_WAKEUPMASKENTRIES    4
@@ -552,6 +563,8 @@ struct fe_priv {
         u32 desc_ver;
         u32 txrxctl_bits;
         u32 vlanctl_bits;
+        u32 driver_data;
+        u32 register_size;
 
         void __iomem *base;
 
@@ -698,6 +711,72 @@ static void setup_hw_rings(struct net_device *dev, int rxtx_flags)
         }
 }
 
+static int using_multi_irqs(struct net_device *dev)
+{
+        struct fe_priv *np = get_nvpriv(dev);
+
+        if (!(np->msi_flags & NV_MSI_X_ENABLED) ||
+            ((np->msi_flags & NV_MSI_X_ENABLED) &&
+             ((np->msi_flags & NV_MSI_X_VECTORS_MASK) == 0x1)))
+                return 0;
+        else
+                return 1;
+}
+
+static void nv_enable_irq(struct net_device *dev)
+{
+        struct fe_priv *np = get_nvpriv(dev);
+
+        if (!using_multi_irqs(dev)) {
+                if (np->msi_flags & NV_MSI_X_ENABLED)
+                        enable_irq(np->msi_x_entry[NV_MSI_X_VECTOR_ALL].vector);
+                else
+                        enable_irq(dev->irq);
+        } else {
+                enable_irq(np->msi_x_entry[NV_MSI_X_VECTOR_RX].vector);
+                enable_irq(np->msi_x_entry[NV_MSI_X_VECTOR_TX].vector);
+                enable_irq(np->msi_x_entry[NV_MSI_X_VECTOR_OTHER].vector);
+        }
+}
+
+static void nv_disable_irq(struct net_device *dev)
+{
+        struct fe_priv *np = get_nvpriv(dev);
+
+        if (!using_multi_irqs(dev)) {
+                if (np->msi_flags & NV_MSI_X_ENABLED)
+                        disable_irq(np->msi_x_entry[NV_MSI_X_VECTOR_ALL].vector);
+                else
+                        disable_irq(dev->irq);
+        } else {
+                disable_irq(np->msi_x_entry[NV_MSI_X_VECTOR_RX].vector);
+                disable_irq(np->msi_x_entry[NV_MSI_X_VECTOR_TX].vector);
+                disable_irq(np->msi_x_entry[NV_MSI_X_VECTOR_OTHER].vector);
+        }
+}
+
+/* In MSIX mode, a write to irqmask behaves as XOR */
+static void nv_enable_hw_interrupts(struct net_device *dev, u32 mask)
+{
+        u8 __iomem *base = get_hwbase(dev);
+
+        writel(mask, base + NvRegIrqMask);
+}
+
+static void nv_disable_hw_interrupts(struct net_device *dev, u32 mask)
+{
+        struct fe_priv *np = get_nvpriv(dev);
+        u8 __iomem *base = get_hwbase(dev);
+
+        if (np->msi_flags & NV_MSI_X_ENABLED) {
+                writel(mask, base + NvRegIrqMask);
+        } else {
+                if (np->msi_flags & NV_MSI_ENABLED)
+                        writel(0, base + NvRegMSIIrqMask);
+                writel(0, base + NvRegIrqMask);
+        }
+}
+
 #define MII_READ        (-1)
 /* mii_rw: read/write a register on the PHY.
  *
@@ -919,6 +998,24 @@ static void nv_txrx_reset(struct net_device *dev)
         pci_push(base);
 }
 
+static void nv_mac_reset(struct net_device *dev)
+{
+        struct fe_priv *np = netdev_priv(dev);
+        u8 __iomem *base = get_hwbase(dev);
+
+        dprintk(KERN_DEBUG "%s: nv_mac_reset\n", dev->name);
+        writel(NVREG_TXRXCTL_BIT2 | NVREG_TXRXCTL_RESET | np->txrxctl_bits, base + NvRegTxRxControl);
+        pci_push(base);
+        writel(NVREG_MAC_RESET_ASSERT, base + NvRegMacReset);
+        pci_push(base);
+        udelay(NV_MAC_RESET_DELAY);
+        writel(0, base + NvRegMacReset);
+        pci_push(base);
+        udelay(NV_MAC_RESET_DELAY);
+        writel(NVREG_TXRXCTL_BIT2 | np->txrxctl_bits, base + NvRegTxRxControl);
+        pci_push(base);
+}
+
 /*
  * nv_get_stats: dev->get_stats function
  * Get latest stats value from the nic.
@@ -989,24 +1086,25 @@ static void nv_do_rx_refill(unsigned long data)
         struct net_device *dev = (struct net_device *) data;
         struct fe_priv *np = netdev_priv(dev);
 
-
-        if (!(np->msi_flags & NV_MSI_X_ENABLED) ||
-            ((np->msi_flags & NV_MSI_X_ENABLED) && 
-             ((np->msi_flags & NV_MSI_X_VECTORS_MASK) == 0x1))) {
-                disable_irq(dev->irq);
+        if (!using_multi_irqs(dev)) {
+                if (np->msi_flags & NV_MSI_X_ENABLED)
+                        disable_irq(np->msi_x_entry[NV_MSI_X_VECTOR_ALL].vector);
+                else
+                        disable_irq(dev->irq);
         } else {
                 disable_irq(np->msi_x_entry[NV_MSI_X_VECTOR_RX].vector);
         }
         if (nv_alloc_rx(dev)) {
-                spin_lock(&np->lock);
+                spin_lock_irq(&np->lock);
                 if (!np->in_shutdown)
                         mod_timer(&np->oom_kick, jiffies + OOM_REFILL);
-                spin_unlock(&np->lock);
+                spin_unlock_irq(&np->lock);
         }
-        if (!(np->msi_flags & NV_MSI_X_ENABLED) ||
-            ((np->msi_flags & NV_MSI_X_ENABLED) && 
-             ((np->msi_flags & NV_MSI_X_VECTORS_MASK) == 0x1))) {
-                enable_irq(dev->irq);
+        if (!using_multi_irqs(dev)) {
+                if (np->msi_flags & NV_MSI_X_ENABLED)
+                        enable_irq(np->msi_x_entry[NV_MSI_X_VECTOR_ALL].vector);
+                else
+                        enable_irq(dev->irq);
         } else {
                 enable_irq(np->msi_x_entry[NV_MSI_X_VECTOR_RX].vector);
         }
@@ -1331,7 +1429,7 @@ static void nv_tx_timeout(struct net_device *dev)
                                 dev->name, (unsigned long)np->ring_addr,
                                 np->next_tx, np->nic_tx);
                 printk(KERN_INFO "%s: Dumping tx registers\n", dev->name);
-                for (i=0;i<0x400;i+= 32) {
+                for (i=0;i<=np->register_size;i+= 32) {
                         printk(KERN_INFO "%3x: %08x %08x %08x %08x %08x %08x %08x %08x\n",
                                         i,
                                         readl(base + i + 0), readl(base + i + 4),
@@ -1638,15 +1736,7 @@ static int nv_change_mtu(struct net_device *dev, int new_mtu)
                  * guessed, there is probably a simpler approach.
                  * Changing the MTU is a rare event, it shouldn't matter.
                  */
-                if (!(np->msi_flags & NV_MSI_X_ENABLED) ||
-                    ((np->msi_flags & NV_MSI_X_ENABLED) && 
-                     ((np->msi_flags & NV_MSI_X_VECTORS_MASK) == 0x1))) {
-                        disable_irq(dev->irq);
-                } else {
-                        disable_irq(np->msi_x_entry[NV_MSI_X_VECTOR_RX].vector);
-                        disable_irq(np->msi_x_entry[NV_MSI_X_VECTOR_TX].vector);
-                        disable_irq(np->msi_x_entry[NV_MSI_X_VECTOR_OTHER].vector);
-                }
+                nv_disable_irq(dev);
                 spin_lock_bh(&dev->xmit_lock);
                 spin_lock(&np->lock);
                 /* stop engines */
@@ -1679,15 +1769,7 @@ static int nv_change_mtu(struct net_device *dev, int new_mtu)
                 nv_start_tx(dev);
                 spin_unlock(&np->lock);
                 spin_unlock_bh(&dev->xmit_lock);
-                if (!(np->msi_flags & NV_MSI_X_ENABLED) ||
-                    ((np->msi_flags & NV_MSI_X_ENABLED) && 
-                     ((np->msi_flags & NV_MSI_X_VECTORS_MASK) == 0x1))) {
-                        enable_irq(dev->irq);
-                } else {
-                        enable_irq(np->msi_x_entry[NV_MSI_X_VECTOR_RX].vector);
-                        enable_irq(np->msi_x_entry[NV_MSI_X_VECTOR_TX].vector);
-                        enable_irq(np->msi_x_entry[NV_MSI_X_VECTOR_OTHER].vector);
-                }
+                nv_enable_irq(dev);
         }
         return 0;
 }
@@ -2078,16 +2160,16 @@ static irqreturn_t nv_nic_irq_tx(int foo, void *data, struct pt_regs *regs)
                 if (!(events & np->irqmask))
                         break;
 
-                spin_lock(&np->lock);
+                spin_lock_irq(&np->lock);
                 nv_tx_done(dev);
-                spin_unlock(&np->lock);
+                spin_unlock_irq(&np->lock);
                 
                 if (events & (NVREG_IRQ_TX_ERR)) {
                         dprintk(KERN_DEBUG "%s: received irq with events 0x%x. Probably TX fail.\n",
                                                 dev->name, events);
                 }
                 if (i > max_interrupt_work) {
-                        spin_lock(&np->lock);
+                        spin_lock_irq(&np->lock);
                         /* disable interrupts on the nic */
                         writel(NVREG_IRQ_TX_ALL, base + NvRegIrqMask);
                         pci_push(base);
@@ -2097,7 +2179,7 @@ static irqreturn_t nv_nic_irq_tx(int foo, void *data, struct pt_regs *regs)
                                 mod_timer(&np->nic_poll, jiffies + POLL_WAIT);
                         }
                         printk(KERN_DEBUG "%s: too many iterations (%d) in nv_nic_irq_tx.\n", dev->name, i);
-                        spin_unlock(&np->lock);
+                        spin_unlock_irq(&np->lock);
                         break;
                 }
 
@@ -2127,14 +2209,14 @@ static irqreturn_t nv_nic_irq_rx(int foo, void *data, struct pt_regs *regs)
                 
                 nv_rx_process(dev);
                 if (nv_alloc_rx(dev)) {
-                        spin_lock(&np->lock);
+                        spin_lock_irq(&np->lock);
                         if (!np->in_shutdown)
                                 mod_timer(&np->oom_kick, jiffies + OOM_REFILL);
-                        spin_unlock(&np->lock);
+                        spin_unlock_irq(&np->lock);
                 }
                 
                 if (i > max_interrupt_work) {
-                        spin_lock(&np->lock);
+                        spin_lock_irq(&np->lock);
                         /* disable interrupts on the nic */
                         writel(NVREG_IRQ_RX_ALL, base + NvRegIrqMask);
                         pci_push(base);
@@ -2144,7 +2226,7 @@ static irqreturn_t nv_nic_irq_rx(int foo, void *data, struct pt_regs *regs)
                                 mod_timer(&np->nic_poll, jiffies + POLL_WAIT);
                         }
                         printk(KERN_DEBUG "%s: too many iterations (%d) in nv_nic_irq_rx.\n", dev->name, i);
-                        spin_unlock(&np->lock);
+                        spin_unlock_irq(&np->lock);
                         break;
                 }
 
@@ -2173,14 +2255,14 @@ static irqreturn_t nv_nic_irq_other(int foo, void *data, struct pt_regs *regs)
                         break;
                 
                 if (events & NVREG_IRQ_LINK) {
-                        spin_lock(&np->lock);
+                        spin_lock_irq(&np->lock);
                         nv_link_irq(dev);
-                        spin_unlock(&np->lock);
+                        spin_unlock_irq(&np->lock);
                 }
                 if (np->need_linktimer && time_after(jiffies, np->link_timeout)) {
-                        spin_lock(&np->lock);
+                        spin_lock_irq(&np->lock);
                         nv_linkchange(dev);
-                        spin_unlock(&np->lock);
+                        spin_unlock_irq(&np->lock);
                         np->link_timeout = jiffies + LINK_TIMEOUT;
                 }
                 if (events & (NVREG_IRQ_UNKNOWN)) {
@@ -2188,7 +2270,7 @@ static irqreturn_t nv_nic_irq_other(int foo, void *data, struct pt_regs *regs)
                                                 dev->name, events);
                 }
                 if (i > max_interrupt_work) {
-                        spin_lock(&np->lock);
+                        spin_lock_irq(&np->lock);
                         /* disable interrupts on the nic */
                         writel(NVREG_IRQ_OTHER, base + NvRegIrqMask);
                         pci_push(base);
@@ -2198,7 +2280,7 @@ static irqreturn_t nv_nic_irq_other(int foo, void *data, struct pt_regs *regs)
                                 mod_timer(&np->nic_poll, jiffies + POLL_WAIT);
                         }
                         printk(KERN_DEBUG "%s: too many iterations (%d) in nv_nic_irq_other.\n", dev->name, i);
-                        spin_unlock(&np->lock);
+                        spin_unlock_irq(&np->lock);
                         break;
                 }
 
@@ -2221,10 +2303,11 @@ static void nv_do_nic_poll(unsigned long data)
          * nv_nic_irq because that may decide to do otherwise
          */
 
-        if (!(np->msi_flags & NV_MSI_X_ENABLED) ||
-            ((np->msi_flags & NV_MSI_X_ENABLED) && 
-             ((np->msi_flags & NV_MSI_X_VECTORS_MASK) == 0x1))) {
-                disable_irq(dev->irq);
+        if (!using_multi_irqs(dev)) {
+                if (np->msi_flags & NV_MSI_X_ENABLED)
+                        disable_irq(np->msi_x_entry[NV_MSI_X_VECTOR_ALL].vector);
+                else
+                        disable_irq(dev->irq);
                 mask = np->irqmask;
         } else {
                 if (np->nic_poll_irq & NVREG_IRQ_RX_ALL) {
@@ -2247,11 +2330,12 @@ static void nv_do_nic_poll(unsigned long data)
         writel(mask, base + NvRegIrqMask);
         pci_push(base);
 
-        if (!(np->msi_flags & NV_MSI_X_ENABLED) || 
-            ((np->msi_flags & NV_MSI_X_ENABLED) && 
-             ((np->msi_flags & NV_MSI_X_VECTORS_MASK) == 0x1))) {
+        if (!using_multi_irqs(dev)) {
                 nv_nic_irq((int) 0, (void *) data, (struct pt_regs *) NULL);
-                enable_irq(dev->irq);
+                if (np->msi_flags & NV_MSI_X_ENABLED)
+                        enable_irq(np->msi_x_entry[NV_MSI_X_VECTOR_ALL].vector);
+                else
+                        enable_irq(dev->irq);
         } else {
                 if (np->nic_poll_irq & NVREG_IRQ_RX_ALL) {
                         nv_nic_irq_rx((int) 0, (void *) data, (struct pt_regs *) NULL);
@@ -2488,11 +2572,11 @@ static int nv_set_settings(struct net_device *dev, struct ethtool_cmd *ecmd)
 }
 
 #define FORCEDETH_REGS_VER      1
-#define FORCEDETH_REGS_SIZE     0x400 /* 256 32-bit registers */
 
 static int nv_get_regs_len(struct net_device *dev)
 {
-        return FORCEDETH_REGS_SIZE;
+        struct fe_priv *np = netdev_priv(dev);
+        return np->register_size;
 }
 
 static void nv_get_regs(struct net_device *dev, struct ethtool_regs *regs, void *buf)
@@ -2504,7 +2588,7 @@ static void nv_get_regs(struct net_device *dev, struct ethtool_regs *regs, void
 
         regs->version = FORCEDETH_REGS_VER;
         spin_lock_irq(&np->lock);
-        for (i=0;i<FORCEDETH_REGS_SIZE/sizeof(u32);i++)
+        for (i = 0;i <= np->register_size/sizeof(u32); i++)
                 rbuf[i] = readl(base + i*sizeof(u32));
         spin_unlock_irq(&np->lock);
 }
@@ -2598,6 +2682,113 @@ static void set_msix_vector_map(struct net_device *dev, u32 vector, u32 irqmask)
         writel(readl(base + NvRegMSIXMap1) | msixmap, base + NvRegMSIXMap1);
 }
 
+static int nv_request_irq(struct net_device *dev)
+{
+        struct fe_priv *np = get_nvpriv(dev);
+        u8 __iomem *base = get_hwbase(dev);
+        int ret = 1;
+        int i;
+
+        if (np->msi_flags & NV_MSI_X_CAPABLE) {
+                for (i = 0; i < (np->msi_flags & NV_MSI_X_VECTORS_MASK); i++) {
+                        np->msi_x_entry[i].entry = i;
+                }
+                if ((ret = pci_enable_msix(np->pci_dev, np->msi_x_entry, (np->msi_flags & NV_MSI_X_VECTORS_MASK))) == 0) {
+                        np->msi_flags |= NV_MSI_X_ENABLED;
+                        if (optimization_mode == NV_OPTIMIZATION_MODE_THROUGHPUT) {
+                                /* Request irq for rx handling */
+                                if (request_irq(np->msi_x_entry[NV_MSI_X_VECTOR_RX].vector, &nv_nic_irq_rx, SA_SHIRQ, dev->name, dev) != 0) {
+                                        printk(KERN_INFO "forcedeth: request_irq failed for rx %d\n", ret);
+                                        pci_disable_msix(np->pci_dev);
+                                        np->msi_flags &= ~NV_MSI_X_ENABLED;
+                                        goto out_err;
+                                }
+                                /* Request irq for tx handling */
+                                if (request_irq(np->msi_x_entry[NV_MSI_X_VECTOR_TX].vector, &nv_nic_irq_tx, SA_SHIRQ, dev->name, dev) != 0) {
+                                        printk(KERN_INFO "forcedeth: request_irq failed for tx %d\n", ret);
+                                        pci_disable_msix(np->pci_dev);
+                                        np->msi_flags &= ~NV_MSI_X_ENABLED;
+                                        goto out_free_rx;
+                                }
+                                /* Request irq for link and timer handling */
+                                if (request_irq(np->msi_x_entry[NV_MSI_X_VECTOR_OTHER].vector, &nv_nic_irq_other, SA_SHIRQ, dev->name, dev) != 0) {
+                                        printk(KERN_INFO "forcedeth: request_irq failed for link %d\n", ret);
+                                        pci_disable_msix(np->pci_dev);
+                                        np->msi_flags &= ~NV_MSI_X_ENABLED;
+                                        goto out_free_tx;
+                                }
+                                /* map interrupts to their respective vector */
+                                writel(0, base + NvRegMSIXMap0);
+                                writel(0, base + NvRegMSIXMap1);
+                                set_msix_vector_map(dev, NV_MSI_X_VECTOR_RX, NVREG_IRQ_RX_ALL);
+                                set_msix_vector_map(dev, NV_MSI_X_VECTOR_TX, NVREG_IRQ_TX_ALL);
+                                set_msix_vector_map(dev, NV_MSI_X_VECTOR_OTHER, NVREG_IRQ_OTHER);
+                        } else {
+                                /* Request irq for all interrupts */
+                                if (request_irq(np->msi_x_entry[NV_MSI_X_VECTOR_ALL].vector, &nv_nic_irq, SA_SHIRQ, dev->name, dev) != 0) {
+                                        printk(KERN_INFO "forcedeth: request_irq failed %d\n", ret);
+                                        pci_disable_msix(np->pci_dev);
+                                        np->msi_flags &= ~NV_MSI_X_ENABLED;
+                                        goto out_err;
+                                }
+
+                                /* map interrupts to vector 0 */
+                                writel(0, base + NvRegMSIXMap0);
+                                writel(0, base + NvRegMSIXMap1);
+                        }
+                }
+        }
+        if (ret != 0 && np->msi_flags & NV_MSI_CAPABLE) {
+                if ((ret = pci_enable_msi(np->pci_dev)) == 0) {
+                        np->msi_flags |= NV_MSI_ENABLED;
+                        if (request_irq(np->pci_dev->irq, &nv_nic_irq, SA_SHIRQ, dev->name, dev) != 0) {
+                                printk(KERN_INFO "forcedeth: request_irq failed %d\n", ret);
+                                pci_disable_msi(np->pci_dev);
+                                np->msi_flags &= ~NV_MSI_ENABLED;
+                                goto out_err;
+                        }
+
+                        /* map interrupts to vector 0 */
+                        writel(0, base + NvRegMSIMap0);
+                        writel(0, base + NvRegMSIMap1);
+                        /* enable msi vector 0 */
+                        writel(NVREG_MSI_VECTOR_0_ENABLED, base + NvRegMSIIrqMask);
+                }
+        }
+        if (ret != 0) {
+                if (request_irq(np->pci_dev->irq, &nv_nic_irq, SA_SHIRQ, dev->name, dev) != 0)
+                        goto out_err;
+        }
+
+        return 0;
+out_free_tx:
+        free_irq(np->msi_x_entry[NV_MSI_X_VECTOR_TX].vector, dev);
+out_free_rx:
+        free_irq(np->msi_x_entry[NV_MSI_X_VECTOR_RX].vector, dev);
+out_err:
+        return 1;
+}
+
+static void nv_free_irq(struct net_device *dev)
+{
+        struct fe_priv *np = get_nvpriv(dev);
+        int i;
+
+        if (np->msi_flags & NV_MSI_X_ENABLED) {
+                for (i = 0; i < (np->msi_flags & NV_MSI_X_VECTORS_MASK); i++) {
+                        free_irq(np->msi_x_entry[i].vector, dev);
+                }
+                pci_disable_msix(np->pci_dev);
+                np->msi_flags &= ~NV_MSI_X_ENABLED;
+        } else {
+                free_irq(np->pci_dev->irq, dev);
+                if (np->msi_flags & NV_MSI_ENABLED) {
+                        pci_disable_msi(np->pci_dev);
+                        np->msi_flags &= ~NV_MSI_ENABLED;
+                }
+        }
+}
+
 static int nv_open(struct net_device *dev)
 {
         struct fe_priv *np = netdev_priv(dev);
@@ -2608,6 +2799,8 @@ static int nv_open(struct net_device *dev)
         dprintk(KERN_DEBUG "nv_open: begin\n");
 
         /* 1) erase previous misconfiguration */
+        if (np->driver_data & DEV_HAS_POWER_CNTRL)
+                nv_mac_reset(dev);
         /* 4.1-1: stop adapter: ignored, 4.3 seems to be overkill */
         writel(NVREG_MCASTADDRA_FORCE, base + NvRegMulticastAddrA);
         writel(0, base + NvRegMulticastAddrB);
@@ -2688,12 +2881,16 @@ static int nv_open(struct net_device *dev)
         udelay(10);
         writel(readl(base + NvRegPowerState) | NVREG_POWERSTATE_VALID, base + NvRegPowerState);
 
-        writel(0, base + NvRegIrqMask);
+        nv_disable_hw_interrupts(dev, np->irqmask);
         pci_push(base);
         writel(NVREG_MIISTAT_MASK2, base + NvRegMIIStatus);
         writel(NVREG_IRQSTAT_MASK, base + NvRegIrqStatus);
         pci_push(base);
 
+        if (nv_request_irq(dev)) {
+                goto out_drain;
+        }
+
         if (np->msi_flags & NV_MSI_X_CAPABLE) {
                 for (i = 0; i < (np->msi_flags & NV_MSI_X_VECTORS_MASK); i++) {
                         np->msi_x_entry[i].entry = i;
@@ -2767,7 +2964,7 @@ static int nv_open(struct net_device *dev)
         }
 
         /* ask for interrupts */
-        writel(np->irqmask, base + NvRegIrqMask);
+        nv_enable_hw_interrupts(dev, np->irqmask);
 
         spin_lock_irq(&np->lock);
         writel(NVREG_MCASTADDRA_FORCE, base + NvRegMulticastAddrA);
@@ -2811,7 +3008,6 @@ static int nv_close(struct net_device *dev)
 {
         struct fe_priv *np = netdev_priv(dev);
         u8 __iomem *base;
-        int i;
 
         spin_lock_irq(&np->lock);
         np->in_shutdown = 1;
@@ -2829,31 +3025,13 @@ static int nv_close(struct net_device *dev)
 
         /* disable interrupts on the nic or we will lock up */
         base = get_hwbase(dev);
-        if (np->msi_flags & NV_MSI_X_ENABLED) {
-                writel(np->irqmask, base + NvRegIrqMask);
-        } else {
-                if (np->msi_flags & NV_MSI_ENABLED)
-                        writel(0, base + NvRegMSIIrqMask);
-                writel(0, base + NvRegIrqMask);
-        }
+        nv_disable_hw_interrupts(dev, np->irqmask);
         pci_push(base);
         dprintk(KERN_INFO "%s: Irqmask is zero again\n", dev->name);
 
         spin_unlock_irq(&np->lock);
 
-        if (np->msi_flags & NV_MSI_X_ENABLED) {
-                for (i = 0; i < (np->msi_flags & NV_MSI_X_VECTORS_MASK); i++) {
-                        free_irq(np->msi_x_entry[i].vector, dev);
-                }
-                pci_disable_msix(np->pci_dev);
-                np->msi_flags &= ~NV_MSI_X_ENABLED;
-        } else {
-                free_irq(np->pci_dev->irq, dev);
-                if (np->msi_flags & NV_MSI_ENABLED) {
-                        pci_disable_msi(np->pci_dev);
-                        np->msi_flags &= ~NV_MSI_ENABLED;
-                }
-        }
+        nv_free_irq(dev);
 
         drain_ring(dev);
 
@@ -2878,6 +3056,7 @@ static int __devinit nv_probe(struct pci_dev *pci_dev, const struct pci_device_i
         unsigned long addr;
         u8 __iomem *base;
         int err, i;
+        u32 powerstate;
 
         dev = alloc_etherdev(sizeof(struct fe_priv));
         err = -ENOMEM;
@@ -2910,6 +3089,11 @@ static int __devinit nv_probe(struct pci_dev *pci_dev, const struct pci_device_i
         if (err < 0)
                 goto out_disable;
 
+        if (id->driver_data & (DEV_HAS_VLAN|DEV_HAS_MSI_X|DEV_HAS_POWER_CNTRL))
+                np->register_size = NV_PCI_REGSZ_VER2;
+        else
+                np->register_size = NV_PCI_REGSZ_VER1;
+
         err = -EINVAL;
         addr = 0;
         for (i = 0; i < DEVICE_COUNT_RESOURCE; i++) {
@@ -2918,7 +3102,7 @@ static int __devinit nv_probe(struct pci_dev *pci_dev, const struct pci_device_i
                                 pci_resource_len(pci_dev, i),
                                 pci_resource_flags(pci_dev, i));
                 if (pci_resource_flags(pci_dev, i) & IORESOURCE_MEM &&
-                                pci_resource_len(pci_dev, i) >= NV_PCI_REGSZ) {
+                                pci_resource_len(pci_dev, i) >= np->register_size) {
                         addr = pci_resource_start(pci_dev, i);
                         break;
                 }
@@ -2929,24 +3113,25 @@ static int __devinit nv_probe(struct pci_dev *pci_dev, const struct pci_device_i
                 goto out_relreg;
         }
 
+        /* copy of driver data */
+        np->driver_data = id->driver_data;
+
         /* handle different descriptor versions */
         if (id->driver_data & DEV_HAS_HIGH_DMA) {
                 /* packet format 3: supports 40-bit addressing */
                 np->desc_ver = DESC_VER_3;
+                np->txrxctl_bits = NVREG_TXRXCTL_DESC_3;
                 if (pci_set_dma_mask(pci_dev, DMA_39BIT_MASK)) {
                         printk(KERN_INFO "forcedeth: 64-bit DMA failed, using 32-bit addressing for device %s.\n",
                                         pci_name(pci_dev));
                 } else {
-                        if (pci_set_consistent_dma_mask(pci_dev, 0x0000007fffffffffULL)) {
-                                printk(KERN_INFO "forcedeth: 64-bit DMA (consistent) failed for device %s.\n",
-                                        pci_name(pci_dev));
-                                goto out_relreg;
-                        } else {
-                                dev->features |= NETIF_F_HIGHDMA;
-                                printk(KERN_INFO "forcedeth: using HIGHDMA\n");
-                        }
+                        dev->features |= NETIF_F_HIGHDMA;
+                        printk(KERN_INFO "forcedeth: using HIGHDMA\n");
+                }
+                if (pci_set_consistent_dma_mask(pci_dev, 0x0000007fffffffffULL)) {
+                        printk(KERN_INFO "forcedeth: 64-bit DMA (consistent) failed for device %s.\n",
+                               pci_name(pci_dev));
                 }
-                np->txrxctl_bits = NVREG_TXRXCTL_DESC_3;
         } else if (id->driver_data & DEV_HAS_LARGEDESC) {
                 /* packet format 2: supports jumbo frames */
                 np->desc_ver = DESC_VER_2;
@@ -2986,7 +3171,7 @@ static int __devinit nv_probe(struct pci_dev *pci_dev, const struct pci_device_i
         }
 
         err = -ENOMEM;
-        np->base = ioremap(addr, NV_PCI_REGSZ);
+        np->base = ioremap(addr, np->register_size);
         if (!np->base)
                 goto out_relreg;
         dev->base_addr = (unsigned long)np->base;
@@ -3062,6 +3247,20 @@ static int __devinit nv_probe(struct pci_dev *pci_dev, const struct pci_device_i
         writel(0, base + NvRegWakeUpFlags);
         np->wolenabled = 0;
 
+        if (id->driver_data & DEV_HAS_POWER_CNTRL) {
+                u8 revision_id;
+                pci_read_config_byte(pci_dev, PCI_REVISION_ID, &revision_id);
+
+                /* take phy and nic out of low power mode */
+                powerstate = readl(base + NvRegPowerState2);
+                powerstate &= ~NVREG_POWERSTATE2_POWERUP_MASK;
+                if ((id->device == PCI_DEVICE_ID_NVIDIA_NVENET_12 ||
+                     id->device == PCI_DEVICE_ID_NVIDIA_NVENET_13) &&
+                    revision_id >= 0xA3)
+                        powerstate |= NVREG_POWERSTATE2_POWERUP_REV_A3;
+                writel(powerstate, base + NvRegPowerState2);
+        }
+
         if (np->desc_ver == DESC_VER_1) {
                 np->tx_flags = NV_TX_VALID;
         } else {
@@ -3223,19 +3422,19 @@ static struct pci_device_id pci_tbl[] = {
         },
         {       /* MCP51 Ethernet Controller */
                 PCI_DEVICE(PCI_VENDOR_ID_NVIDIA, PCI_DEVICE_ID_NVIDIA_NVENET_12),
-                .driver_data = DEV_NEED_TIMERIRQ|DEV_NEED_LINKTIMER|DEV_HAS_HIGH_DMA,
+                .driver_data = DEV_NEED_TIMERIRQ|DEV_NEED_LINKTIMER|DEV_HAS_HIGH_DMA|DEV_HAS_POWER_CNTRL,
         },
         {       /* MCP51 Ethernet Controller */
                 PCI_DEVICE(PCI_VENDOR_ID_NVIDIA, PCI_DEVICE_ID_NVIDIA_NVENET_13),
-                .driver_data = DEV_NEED_TIMERIRQ|DEV_NEED_LINKTIMER|DEV_HAS_HIGH_DMA,
+                .driver_data = DEV_NEED_TIMERIRQ|DEV_NEED_LINKTIMER|DEV_HAS_HIGH_DMA|DEV_HAS_POWER_CNTRL,
         },
         {       /* MCP55 Ethernet Controller */
                 PCI_DEVICE(PCI_VENDOR_ID_NVIDIA, PCI_DEVICE_ID_NVIDIA_NVENET_14),
-                .driver_data = DEV_NEED_TIMERIRQ|DEV_NEED_LINKTIMER|DEV_HAS_LARGEDESC|DEV_HAS_CHECKSUM|DEV_HAS_HIGH_DMA|DEV_HAS_VLAN|DEV_HAS_MSI|DEV_HAS_MSI_X,
+                .driver_data = DEV_NEED_TIMERIRQ|DEV_NEED_LINKTIMER|DEV_HAS_LARGEDESC|DEV_HAS_CHECKSUM|DEV_HAS_HIGH_DMA|DEV_HAS_VLAN|DEV_HAS_MSI|DEV_HAS_MSI_X|DEV_HAS_POWER_CNTRL,
         },
         {       /* MCP55 Ethernet Controller */
                 PCI_DEVICE(PCI_VENDOR_ID_NVIDIA, PCI_DEVICE_ID_NVIDIA_NVENET_15),
-                .driver_data = DEV_NEED_TIMERIRQ|DEV_NEED_LINKTIMER|DEV_HAS_LARGEDESC|DEV_HAS_CHECKSUM|DEV_HAS_HIGH_DMA|DEV_HAS_VLAN|DEV_HAS_MSI|DEV_HAS_MSI_X,
+                .driver_data = DEV_NEED_TIMERIRQ|DEV_NEED_LINKTIMER|DEV_HAS_LARGEDESC|DEV_HAS_CHECKSUM|DEV_HAS_HIGH_DMA|DEV_HAS_VLAN|DEV_HAS_MSI|DEV_HAS_MSI_X|DEV_HAS_POWER_CNTRL,
         },
         {0,},
 };
diff --git a/drivers/net/gianfar.c b/drivers/net/gianfar.c
index 771e25d8c417..218d31764c52 100644
--- a/drivers/net/gianfar.c
+++ b/drivers/net/gianfar.c
@@ -210,7 +210,8 @@ static int gfar_probe(struct platform_device *pdev)
                 goto regs_fail;
         }
 
-        spin_lock_init(&priv->lock);
+        spin_lock_init(&priv->txlock);
+        spin_lock_init(&priv->rxlock);
 
         platform_set_drvdata(pdev, dev);
 
@@ -515,11 +516,13 @@ void stop_gfar(struct net_device *dev)
         phy_stop(priv->phydev);
 
         /* Lock it down */
-        spin_lock_irqsave(&priv->lock, flags);
+        spin_lock_irqsave(&priv->txlock, flags);
+        spin_lock(&priv->rxlock);
 
         gfar_halt(dev);
 
-        spin_unlock_irqrestore(&priv->lock, flags);
+        spin_unlock(&priv->rxlock);
+        spin_unlock_irqrestore(&priv->txlock, flags);
 
         /* Free the IRQs */
         if (priv->einfo->device_flags & FSL_GIANFAR_DEV_HAS_MULTI_INTR) {
@@ -605,14 +608,15 @@ void gfar_start(struct net_device *dev)
         tempval |= DMACTRL_INIT_SETTINGS;
         gfar_write(&priv->regs->dmactrl, tempval);
 
-        /* Clear THLT, so that the DMA starts polling now */
-        gfar_write(&regs->tstat, TSTAT_CLEAR_THALT);
-
         /* Make sure we aren't stopped */
         tempval = gfar_read(&priv->regs->dmactrl);
         tempval &= ~(DMACTRL_GRS | DMACTRL_GTS);
         gfar_write(&priv->regs->dmactrl, tempval);
 
+        /* Clear THLT/RHLT, so that the DMA starts polling now */
+        gfar_write(&regs->tstat, TSTAT_CLEAR_THALT);
+        gfar_write(&regs->rstat, RSTAT_CLEAR_RHALT);
+
         /* Unmask the interrupts we look for */
         gfar_write(&regs->imask, IMASK_DEFAULT);
 }
@@ -928,12 +932,13 @@ static int gfar_start_xmit(struct sk_buff *skb, struct net_device *dev)
         struct txfcb *fcb = NULL;
         struct txbd8 *txbdp;
         u16 status;
+        unsigned long flags;
 
         /* Update transmit stats */
         priv->stats.tx_bytes += skb->len;
 
         /* Lock priv now */
-        spin_lock_irq(&priv->lock);
+        spin_lock_irqsave(&priv->txlock, flags);
 
         /* Point at the first free tx descriptor */
         txbdp = priv->cur_tx;
@@ -1004,7 +1009,7 @@ static int gfar_start_xmit(struct sk_buff *skb, struct net_device *dev)
         gfar_write(&priv->regs->tstat, TSTAT_CLEAR_THALT);
 
         /* Unlock priv */
-        spin_unlock_irq(&priv->lock);
+        spin_unlock_irqrestore(&priv->txlock, flags);
 
         return 0;
 }
@@ -1049,7 +1054,7 @@ static void gfar_vlan_rx_register(struct net_device *dev,
         unsigned long flags;
         u32 tempval;
 
-        spin_lock_irqsave(&priv->lock, flags);
+        spin_lock_irqsave(&priv->rxlock, flags);
 
         priv->vlgrp = grp;
 
@@ -1076,7 +1081,7 @@ static void gfar_vlan_rx_register(struct net_device *dev,
                 gfar_write(&priv->regs->rctrl, tempval);
         }
 
-        spin_unlock_irqrestore(&priv->lock, flags);
+        spin_unlock_irqrestore(&priv->rxlock, flags);
 }
 
 
@@ -1085,12 +1090,12 @@ static void gfar_vlan_rx_kill_vid(struct net_device *dev, uint16_t vid)
         struct gfar_private *priv = netdev_priv(dev);
         unsigned long flags;
 
-        spin_lock_irqsave(&priv->lock, flags);
+        spin_lock_irqsave(&priv->rxlock, flags);
 
         if (priv->vlgrp)
                 priv->vlgrp->vlan_devices[vid] = NULL;
 
-        spin_unlock_irqrestore(&priv->lock, flags);
+        spin_unlock_irqrestore(&priv->rxlock, flags);
 }
 
 
@@ -1179,7 +1184,7 @@ static irqreturn_t gfar_transmit(int irq, void *dev_id, struct pt_regs *regs)
         gfar_write(&priv->regs->ievent, IEVENT_TX_MASK);
 
         /* Lock priv */
-        spin_lock(&priv->lock);
+        spin_lock(&priv->txlock);
         bdp = priv->dirty_tx;
         while ((bdp->status & TXBD_READY) == 0) {
                 /* If dirty_tx and cur_tx are the same, then either the */
@@ -1224,7 +1229,7 @@ static irqreturn_t gfar_transmit(int irq, void *dev_id, struct pt_regs *regs)
         else
                 gfar_write(&priv->regs->txic, 0);
 
-        spin_unlock(&priv->lock);
+        spin_unlock(&priv->txlock);
 
         return IRQ_HANDLED;
 }
@@ -1305,9 +1310,10 @@ irqreturn_t gfar_receive(int irq, void *dev_id, struct pt_regs *regs)
 {
         struct net_device *dev = (struct net_device *) dev_id;
         struct gfar_private *priv = netdev_priv(dev);
-
 #ifdef CONFIG_GFAR_NAPI
         u32 tempval;
+#else
+        unsigned long flags;
 #endif
 
         /* Clear IEVENT, so rx interrupt isn't called again
@@ -1330,7 +1336,7 @@ irqreturn_t gfar_receive(int irq, void *dev_id, struct pt_regs *regs)
         }
 #else
 
-        spin_lock(&priv->lock);
+        spin_lock_irqsave(&priv->rxlock, flags);
         gfar_clean_rx_ring(dev, priv->rx_ring_size);
 
         /* If we are coalescing interrupts, update the timer */
@@ -1341,7 +1347,7 @@ irqreturn_t gfar_receive(int irq, void *dev_id, struct pt_regs *regs)
         else
                 gfar_write(&priv->regs->rxic, 0);
 
-        spin_unlock(&priv->lock);
+        spin_unlock_irqrestore(&priv->rxlock, flags);
 #endif
 
         return IRQ_HANDLED;
@@ -1490,13 +1496,6 @@ int gfar_clean_rx_ring(struct net_device *dev, int rx_work_limit)
         /* Update the current rxbd pointer to be the next one */
         priv->cur_rx = bdp;
 
-        /* If no packets have arrived since the
-         * last one we processed, clear the IEVENT RX and
-         * BSY bits so that another interrupt won't be
-         * generated when we set IMASK */
-        if (bdp->status & RXBD_EMPTY)
-                gfar_write(&priv->regs->ievent, IEVENT_RX_MASK);
-
         return howmany;
 }
 
@@ -1516,7 +1515,7 @@ static int gfar_poll(struct net_device *dev, int *budget)
         rx_work_limit -= howmany;
         *budget -= howmany;
 
-        if (rx_work_limit >= 0) {
+        if (rx_work_limit > 0) {
                 netif_rx_complete(dev);
 
                 /* Clear the halt bit in RSTAT */
@@ -1533,7 +1532,8 @@ static int gfar_poll(struct net_device *dev, int *budget)
                         gfar_write(&priv->regs->rxic, 0);
         }
 
-        return (rx_work_limit < 0) ? 1 : 0;
+        /* Return 1 if there's more work to do */
+        return (rx_work_limit > 0) ? 0 : 1;
 }
 #endif
 
@@ -1629,7 +1629,7 @@ static void adjust_link(struct net_device *dev)
         struct phy_device *phydev = priv->phydev;
         int new_state = 0;
 
-        spin_lock_irqsave(&priv->lock, flags);
+        spin_lock_irqsave(&priv->txlock, flags);
         if (phydev->link) {
                 u32 tempval = gfar_read(&regs->maccfg2);
                 u32 ecntrl = gfar_read(&regs->ecntrl);
@@ -1694,7 +1694,7 @@ static void adjust_link(struct net_device *dev)
         if (new_state && netif_msg_link(priv))
                 phy_print_status(phydev);
 
-        spin_unlock_irqrestore(&priv->lock, flags);
+        spin_unlock_irqrestore(&priv->txlock, flags);
 }
 
 /* Update the hash table based on the current list of multicast
diff --git a/drivers/net/gianfar.h b/drivers/net/gianfar.h
index d37d5401be6e..127c98cf3336 100644
--- a/drivers/net/gianfar.h
+++ b/drivers/net/gianfar.h
@@ -656,43 +656,62 @@ struct gfar {
  * the buffer descriptor determines the actual condition.
  */
 struct gfar_private {
-        /* pointers to arrays of skbuffs for tx and rx */
+        /* Fields controlled by TX lock */
+        spinlock_t txlock;
+
+        /* Pointer to the array of skbuffs */
         struct sk_buff ** tx_skbuff;
-        struct sk_buff ** rx_skbuff;
 
-        /* indices pointing to the next free sbk in skb arrays */
+        /* next free skb in the array */
         u16 skb_curtx;
-        u16 skb_currx;
 
-        /* index of the first skb which hasn't been transmitted
-         * yet. */
+        /* First skb in line to be transmitted */
         u16 skb_dirtytx;
 
         /* Configuration info for the coalescing features */
         unsigned char txcoalescing;
         unsigned short txcount;
         unsigned short txtime;
+
+        /* Buffer descriptor pointers */
+        struct txbd8 *tx_bd_base;       /* First tx buffer descriptor */
+        struct txbd8 *cur_tx;           /* Next free ring entry */
+        struct txbd8 *dirty_tx;         /* First buffer in line
+                                           to be transmitted */
+        unsigned int tx_ring_size;
+
+        /* RX Locked fields */
+        spinlock_t rxlock;
+
+        /* skb array and index */
+        struct sk_buff ** rx_skbuff;
+        u16 skb_currx;
+
+        /* RX Coalescing values */
         unsigned char rxcoalescing;
         unsigned short rxcount;
         unsigned short rxtime;
 
-        /* GFAR addresses */
-        struct rxbd8 *rx_bd_base;       /* Base addresses of Rx and Tx Buffers */
-        struct txbd8 *tx_bd_base;
+        struct rxbd8 *rx_bd_base;       /* First Rx buffers */
         struct rxbd8 *cur_rx;           /* Next free rx ring entry */
-        struct txbd8 *cur_tx;           /* Next free ring entry */
-        struct txbd8 *dirty_tx;         /* The Ring entry to be freed. */
-        struct gfar __iomem *regs;      /* Pointer to the GFAR memory mapped Registers */
-        u32 __iomem *hash_regs[16];
-        int hash_width;
-        struct net_device_stats stats; /* linux network statistics */
-        struct gfar_extra_stats extra_stats;
-        spinlock_t lock;
+
+        /* RX parameters */
+        unsigned int rx_ring_size;
         unsigned int rx_buffer_size;
         unsigned int rx_stash_size;
         unsigned int rx_stash_index;
-        unsigned int tx_ring_size;
-        unsigned int rx_ring_size;
+
+        struct vlan_group *vlgrp;
+
+        /* Unprotected fields */
+        /* Pointer to the GFAR memory mapped Registers */
+        struct gfar __iomem *regs;
+
+        /* Hash registers and their width */
+        u32 __iomem *hash_regs[16];
+        int hash_width;
+
+        /* global parameters */
         unsigned int fifo_threshold;
         unsigned int fifo_starve;
         unsigned int fifo_starve_off;
@@ -702,13 +721,15 @@ struct gfar_private {
                 extended_hash:1,
                 bd_stash_en:1;
         unsigned short padding;
-        struct vlan_group *vlgrp;
-        /* Info structure initialized by board setup code */
+
         unsigned int interruptTransmit;
         unsigned int interruptReceive;
         unsigned int interruptError;
+
+        /* info structure initialized by platform code */
         struct gianfar_platform_data *einfo;
 
+        /* PHY stuff */
         struct phy_device *phydev;
         struct mii_bus *mii_bus;
         int oldspeed;
@@ -716,6 +737,10 @@ struct gfar_private {
         int oldlink;
 
         uint32_t msg_enable;
+
+        /* Network Statistics */
+        struct net_device_stats stats;
+        struct gfar_extra_stats extra_stats;
 };
 
 static inline u32 gfar_read(volatile unsigned __iomem *addr)
diff --git a/drivers/net/gianfar_ethtool.c b/drivers/net/gianfar_ethtool.c
index 5de7b2e259dc..d69698c695ef 100644
--- a/drivers/net/gianfar_ethtool.c
+++ b/drivers/net/gianfar_ethtool.c
@@ -455,10 +455,14 @@ static int gfar_sringparam(struct net_device *dev, struct ethtool_ringparam *rva
 
                 /* Halt TX and RX, and process the frames which
                  * have already been received */
-                spin_lock_irqsave(&priv->lock, flags);
+                spin_lock_irqsave(&priv->txlock, flags);
+                spin_lock(&priv->rxlock);
+
                 gfar_halt(dev);
                 gfar_clean_rx_ring(dev, priv->rx_ring_size);
-                spin_unlock_irqrestore(&priv->lock, flags);
+
+                spin_unlock(&priv->rxlock);
+                spin_unlock_irqrestore(&priv->txlock, flags);
 
                 /* Now we take down the rings to rebuild them */
                 stop_gfar(dev);
@@ -488,10 +492,14 @@ static int gfar_set_rx_csum(struct net_device *dev, uint32_t data)
 
                 /* Halt TX and RX, and process the frames which
                  * have already been received */
-                spin_lock_irqsave(&priv->lock, flags);
+                spin_lock_irqsave(&priv->txlock, flags);
+                spin_lock(&priv->rxlock);
+
                 gfar_halt(dev);
                 gfar_clean_rx_ring(dev, priv->rx_ring_size);
-                spin_unlock_irqrestore(&priv->lock, flags);
+
+                spin_unlock(&priv->rxlock);
+                spin_unlock_irqrestore(&priv->txlock, flags);
 
                 /* Now we take down the rings to rebuild them */
                 stop_gfar(dev);
@@ -523,7 +531,7 @@ static int gfar_set_tx_csum(struct net_device *dev, uint32_t data)
         if (!(priv->einfo->device_flags & FSL_GIANFAR_DEV_HAS_CSUM))
                 return -EOPNOTSUPP;
 
-        spin_lock_irqsave(&priv->lock, flags);
+        spin_lock_irqsave(&priv->txlock, flags);
         gfar_halt(dev);
 
         if (data)
@@ -532,7 +540,7 @@ static int gfar_set_tx_csum(struct net_device *dev, uint32_t data)
                 dev->features &= ~NETIF_F_IP_CSUM;
 
         gfar_start(dev);
-        spin_unlock_irqrestore(&priv->lock, flags);
+        spin_unlock_irqrestore(&priv->txlock, flags);
 
         return 0;
 }
diff --git a/drivers/net/gianfar_sysfs.c b/drivers/net/gianfar_sysfs.c
index 51ef181b1368..a6d5c43199cb 100644
--- a/drivers/net/gianfar_sysfs.c
+++ b/drivers/net/gianfar_sysfs.c
@@ -82,7 +82,7 @@ static ssize_t gfar_set_bd_stash(struct class_device *cdev,
         else
                 return count;
 
-        spin_lock_irqsave(&priv->lock, flags);
+        spin_lock_irqsave(&priv->rxlock, flags);
 
         /* Set the new stashing value */
         priv->bd_stash_en = new_setting;
@@ -96,7 +96,7 @@ static ssize_t gfar_set_bd_stash(struct class_device *cdev,
 
         gfar_write(&priv->regs->attr, temp);
 
-        spin_unlock_irqrestore(&priv->lock, flags);
+        spin_unlock_irqrestore(&priv->rxlock, flags);
 
         return count;
 }
@@ -118,7 +118,7 @@ static ssize_t gfar_set_rx_stash_size(struct class_device *cdev,
         u32 temp;
         unsigned long flags;
 
-        spin_lock_irqsave(&priv->lock, flags);
+        spin_lock_irqsave(&priv->rxlock, flags);
         if (length > priv->rx_buffer_size)
                 return count;
 
@@ -142,7 +142,7 @@ static ssize_t gfar_set_rx_stash_size(struct class_device *cdev,
 
         gfar_write(&priv->regs->attr, temp);
 
-        spin_unlock_irqrestore(&priv->lock, flags);
+        spin_unlock_irqrestore(&priv->rxlock, flags);
 
         return count;
 }
@@ -166,7 +166,7 @@ static ssize_t gfar_set_rx_stash_index(struct class_device *cdev,
         u32 temp;
         unsigned long flags;
 
-        spin_lock_irqsave(&priv->lock, flags);
+        spin_lock_irqsave(&priv->rxlock, flags);
         if (index > priv->rx_stash_size)
                 return count;
 
@@ -180,7 +180,7 @@ static ssize_t gfar_set_rx_stash_index(struct class_device *cdev,
         temp |= ATTRELI_EI(index);
         gfar_write(&priv->regs->attreli, flags);
 
-        spin_unlock_irqrestore(&priv->lock, flags);
+        spin_unlock_irqrestore(&priv->rxlock, flags);
 
         return count;
 }
@@ -205,7 +205,7 @@ static ssize_t gfar_set_fifo_threshold(struct class_device *cdev,
         if (length > GFAR_MAX_FIFO_THRESHOLD)
                 return count;
 
-        spin_lock_irqsave(&priv->lock, flags);
+        spin_lock_irqsave(&priv->txlock, flags);
 
         priv->fifo_threshold = length;
 
@@ -214,7 +214,7 @@ static ssize_t gfar_set_fifo_threshold(struct class_device *cdev,
         temp |= length;
         gfar_write(&priv->regs->fifo_tx_thr, temp);
 
-        spin_unlock_irqrestore(&priv->lock, flags);
+        spin_unlock_irqrestore(&priv->txlock, flags);
 
         return count;
 }
@@ -240,7 +240,7 @@ static ssize_t gfar_set_fifo_starve(struct class_device *cdev,
         if (num > GFAR_MAX_FIFO_STARVE)
                 return count;
 
-        spin_lock_irqsave(&priv->lock, flags);
+        spin_lock_irqsave(&priv->txlock, flags);
 
         priv->fifo_starve = num;
 
@@ -249,7 +249,7 @@ static ssize_t gfar_set_fifo_starve(struct class_device *cdev,
         temp |= num;
         gfar_write(&priv->regs->fifo_tx_starve, temp);
 
-        spin_unlock_irqrestore(&priv->lock, flags);
+        spin_unlock_irqrestore(&priv->txlock, flags);
 
         return count;
 }
@@ -274,7 +274,7 @@ static ssize_t gfar_set_fifo_starve_off(struct class_device *cdev,
         if (num > GFAR_MAX_FIFO_STARVE_OFF)
                 return count;
 
-        spin_lock_irqsave(&priv->lock, flags);
+        spin_lock_irqsave(&priv->txlock, flags);
 
         priv->fifo_starve_off = num;
 
@@ -283,7 +283,7 @@ static ssize_t gfar_set_fifo_starve_off(struct class_device *cdev,
         temp |= num;
         gfar_write(&priv->regs->fifo_tx_starve_shutoff, temp);
 
-        spin_unlock_irqrestore(&priv->lock, flags);
+        spin_unlock_irqrestore(&priv->txlock, flags);
 
         return count;
 }
diff --git a/drivers/net/hamradio/dmascc.c b/drivers/net/hamradio/dmascc.c
index 79a8fbcf5f93..0d5fccc984bb 100644
--- a/drivers/net/hamradio/dmascc.c
+++ b/drivers/net/hamradio/dmascc.c
@@ -582,7 +582,6 @@ static int __init setup_adapter(int card_base, int type, int n)
                 INIT_WORK(&priv->rx_work, rx_bh, priv);
                 dev->priv = priv;
                 sprintf(dev->name, "dmascc%i", 2 * n + i);
-                SET_MODULE_OWNER(dev);
                 dev->base_addr = card_base;
                 dev->irq = irq;
                 dev->open = scc_open;
diff --git a/drivers/net/hamradio/scc.c b/drivers/net/hamradio/scc.c
index 6ace0e914fd1..5927784df3f9 100644
--- a/drivers/net/hamradio/scc.c
+++ b/drivers/net/hamradio/scc.c
@@ -1550,7 +1550,6 @@ static unsigned char ax25_nocall[AX25_ADDR_LEN] =
 
 static void scc_net_setup(struct net_device *dev)
 {
-        SET_MODULE_OWNER(dev);
         dev->tx_queue_len    = 16;      /* should be enough... */
 
         dev->open            = scc_net_open;
diff --git a/drivers/net/hamradio/yam.c b/drivers/net/hamradio/yam.c
index fe22479eb202..b49884048caa 100644
--- a/drivers/net/hamradio/yam.c
+++ b/drivers/net/hamradio/yam.c
@@ -1098,7 +1098,6 @@ static void yam_setup(struct net_device *dev)
 
         dev->base_addr = yp->iobase;
         dev->irq = yp->irq;
-        SET_MODULE_OWNER(dev);
 
         dev->open = yam_open;
         dev->stop = yam_close;
diff --git a/drivers/net/irda/irda-usb.c b/drivers/net/irda/irda-usb.c
index 96bdb73c2283..cd87593e4e8a 100644
--- a/drivers/net/irda/irda-usb.c
+++ b/drivers/net/irda/irda-usb.c
@@ -1778,7 +1778,7 @@ static int irda_usb_probe(struct usb_interface *intf,
 
         if (self->needspatch) {
                 ret = usb_control_msg (self->usbdev, usb_sndctrlpipe (self->usbdev, 0),
-                                       0x02, 0x40, 0, 0, 0, 0, msecs_to_jiffies(500));
+                                       0x02, 0x40, 0, 0, NULL, 0, 500);
                 if (ret < 0) {
                         IRDA_DEBUG (0, "usb_control_msg failed %d\n", ret);
                         goto err_out_3;
diff --git a/drivers/net/mv643xx_eth.c b/drivers/net/mv643xx_eth.c
index ea62a3e7d586..411f4d809c47 100644
--- a/drivers/net/mv643xx_eth.c
+++ b/drivers/net/mv643xx_eth.c
@@ -1419,6 +1419,8 @@ static int mv643xx_eth_probe(struct platform_device *pdev)
         mv643xx_eth_update_pscr(dev, &cmd);
         mv643xx_set_settings(dev, &cmd);
 
+        SET_MODULE_OWNER(dev);
+        SET_NETDEV_DEV(dev, &pdev->dev);
         err = register_netdev(dev);
         if (err)
                 goto out;
diff --git a/drivers/net/ne.c b/drivers/net/ne.c
index 08b218c5bfbc..b32765215f75 100644
--- a/drivers/net/ne.c
+++ b/drivers/net/ne.c
@@ -139,8 +139,9 @@ bad_clone_list[] __initdata = {
 
 #if defined(CONFIG_PLAT_MAPPI)
 #  define DCR_VAL 0x4b
-#elif defined(CONFIG_PLAT_OAKS32R)
-#  define DCR_VAL 0x48
+#elif defined(CONFIG_PLAT_OAKS32R)  || \
+   defined(CONFIG_TOSHIBA_RBTX4927) || defined(CONFIG_TOSHIBA_RBTX4938)
+#  define DCR_VAL 0x48          /* 8-bit mode */
 #else
 #  define DCR_VAL 0x49
 #endif
@@ -226,7 +227,7 @@ struct net_device * __init ne_probe(int unit)
         netdev_boot_setup_check(dev);
 
 #ifdef CONFIG_TOSHIBA_RBTX4938
-        dev->base_addr = 0x07f20280;
+        dev->base_addr = RBTX4938_RTL_8019_BASE;
         dev->irq = RBTX4938_RTL_8019_IRQ;
 #endif
         err = do_ne_probe(dev);
@@ -396,10 +397,22 @@ static int __init ne_probe1(struct net_device *dev, int ioaddr)
                 /* We must set the 8390 for word mode. */
                 outb_p(DCR_VAL, ioaddr + EN0_DCFG);
                 start_page = NESM_START_PG;
-                stop_page = NESM_STOP_PG;
+
+                /*
+                 * Realtek RTL8019AS datasheet says that the PSTOP register
+                 * shouldn't exceed 0x60 in 8-bit mode.
+                 * This chip can be identified by reading the signature from
+                 * the  remote byte count registers (otherwise write-only)...
+                 */
+                if ((DCR_VAL & 0x01) == 0 &&            /* 8-bit mode */
+                    inb(ioaddr + EN0_RCNTLO) == 0x50 &&
+                    inb(ioaddr + EN0_RCNTHI) == 0x70)
+                        stop_page = 0x60;
+                else
+                        stop_page = NESM_STOP_PG;
         } else {
                 start_page = NE1SM_START_PG;
-                stop_page = NE1SM_STOP_PG;
+                stop_page  = NE1SM_STOP_PG;
         }
 
 #if  defined(CONFIG_PLAT_MAPPI) || defined(CONFIG_PLAT_OAKS32R)
@@ -509,15 +522,9 @@ static int __init ne_probe1(struct net_device *dev, int ioaddr)
         ei_status.name = name;
         ei_status.tx_start_page = start_page;
         ei_status.stop_page = stop_page;
-#if defined(CONFIG_TOSHIBA_RBTX4927) || defined(CONFIG_TOSHIBA_RBTX4938)
-        wordlength = 1;
-#endif
 
-#ifdef CONFIG_PLAT_OAKS32R
-        ei_status.word16 = 0;
-#else
-        ei_status.word16 = (wordlength == 2);
-#endif
+        /* Use 16-bit mode only if this wasn't overridden by DCR_VAL */
+        ei_status.word16 = (wordlength == 2 && (DCR_VAL & 0x01));
 
         ei_status.rx_start_page = start_page + TX_PAGES;
 #ifdef PACKETBUF_MEMSIZE
diff --git a/drivers/net/pcmcia/pcnet_cs.c b/drivers/net/pcmcia/pcnet_cs.c
index 506e777c5f06..d090df413049 100644
--- a/drivers/net/pcmcia/pcnet_cs.c
+++ b/drivers/net/pcmcia/pcnet_cs.c
@@ -1639,6 +1639,7 @@ static struct pcmcia_device_id pcnet_ids[] = {
         PCMCIA_DEVICE_PROD_ID12("CONTEC", "C-NET(PC)C-10L", 0x21cab552, 0xf6f90722),
         PCMCIA_DEVICE_PROD_ID12("corega", "FEther PCC-TXF", 0x0a21501a, 0xa51564a2),
         PCMCIA_DEVICE_PROD_ID12("corega K.K.", "corega EtherII PCC-T", 0x5261440f, 0xfa9d85bd),
+        PCMCIA_DEVICE_PROD_ID12("corega K.K.", "corega EtherII PCC-TD", 0x5261440f, 0xc49bd73d),
         PCMCIA_DEVICE_PROD_ID12("Corega K.K.", "corega EtherII PCC-TD", 0xd4fdcbd8, 0xc49bd73d),
         PCMCIA_DEVICE_PROD_ID12("corega K.K.", "corega Ether PCC-T", 0x5261440f, 0x6705fcaa),
         PCMCIA_DEVICE_PROD_ID12("corega K.K.", "corega FastEther PCC-TX", 0x5261440f, 0x485e85d9),
diff --git a/drivers/net/phy/mdio_bus.c b/drivers/net/phy/mdio_bus.c
index 459443b572ce..1b236bdf6b92 100644
--- a/drivers/net/phy/mdio_bus.c
+++ b/drivers/net/phy/mdio_bus.c
@@ -60,8 +60,10 @@ int mdiobus_register(struct mii_bus *bus)
         for (i = 0; i < PHY_MAX_ADDR; i++) {
                 struct phy_device *phydev;
 
-                if (bus->phy_mask & (1 << i))
+                if (bus->phy_mask & (1 << i)) {
+                        bus->phy_map[i] = NULL;
                         continue;
+                }
 
                 phydev = get_phy_device(bus, i);
 
diff --git a/drivers/net/sis900.c b/drivers/net/sis900.c
index b82191d2bee1..f5a3bf4d959a 100644
--- a/drivers/net/sis900.c
+++ b/drivers/net/sis900.c
@@ -127,6 +127,7 @@ static const struct mii_chip_info {
 } mii_chip_table[] = {
         { "SiS 900 Internal MII PHY",           0x001d, 0x8000, LAN },
         { "SiS 7014 Physical Layer Solution",   0x0016, 0xf830, LAN },
+        { "SiS 900 on Foxconn 661 7MI",         0x0143, 0xBC70, LAN },
         { "Altimata AC101LF PHY",               0x0022, 0x5520, LAN },
         { "ADM 7001 LAN PHY",                   0x002e, 0xcc60, LAN },
         { "AMD 79C901 10BASE-T PHY",            0x0000, 0x6B70, LAN },
diff --git a/drivers/net/sky2.c b/drivers/net/sky2.c
index 67b0eab16589..ffd267fab21d 100644
--- a/drivers/net/sky2.c
+++ b/drivers/net/sky2.c
@@ -51,7 +51,7 @@
 #include "sky2.h"
 
 #define DRV_NAME                "sky2"
-#define DRV_VERSION             "1.1"
+#define DRV_VERSION             "1.3"
 #define PFX                     DRV_NAME " "
 
 /*
@@ -79,6 +79,8 @@
 #define NAPI_WEIGHT             64
 #define PHY_RETRIES             1000
 
+#define RING_NEXT(x,s)  (((x)+1) & ((s)-1))
+
 static const u32 default_msg =
     NETIF_MSG_DRV | NETIF_MSG_PROBE | NETIF_MSG_LINK
     | NETIF_MSG_TIMER | NETIF_MSG_TX_ERR | NETIF_MSG_RX_ERR
@@ -96,6 +98,10 @@ static int disable_msi = 0;
 module_param(disable_msi, int, 0);
 MODULE_PARM_DESC(disable_msi, "Disable Message Signaled Interrupt (MSI)");
 
+static int idle_timeout = 100;
+module_param(idle_timeout, int, 0);
+MODULE_PARM_DESC(idle_timeout, "Idle timeout workaround for lost interrupts (ms)");
+
 static const struct pci_device_id sky2_id_table[] = {
         { PCI_DEVICE(PCI_VENDOR_ID_SYSKONNECT, 0x9000) },
         { PCI_DEVICE(PCI_VENDOR_ID_SYSKONNECT, 0x9E00) },
@@ -122,6 +128,7 @@ MODULE_DEVICE_TABLE(pci, sky2_id_table);
 /* Avoid conditionals by using array */
 static const unsigned txqaddr[] = { Q_XA1, Q_XA2 };
 static const unsigned rxqaddr[] = { Q_R1, Q_R2 };
+static const u32 portirq_msk[] = { Y2_IS_PORT_1, Y2_IS_PORT_2 };
 
 /* This driver supports yukon2 chipset only */
 static const char *yukon2_name[] = {
@@ -298,7 +305,8 @@ static void sky2_phy_init(struct sky2_hw *hw, unsigned port)
         struct sky2_port *sky2 = netdev_priv(hw->dev[port]);
         u16 ctrl, ct1000, adv, pg, ledctrl, ledover;
 
-        if (sky2->autoneg == AUTONEG_ENABLE && hw->chip_id != CHIP_ID_YUKON_XL) {
+        if (sky2->autoneg == AUTONEG_ENABLE &&
+            (hw->chip_id != CHIP_ID_YUKON_XL || hw->chip_id == CHIP_ID_YUKON_EC_U)) {
                 u16 ectrl = gm_phy_read(hw, port, PHY_MARV_EXT_CTRL);
 
                 ectrl &= ~(PHY_M_EC_M_DSC_MSK | PHY_M_EC_S_DSC_MSK |
@@ -326,7 +334,7 @@ static void sky2_phy_init(struct sky2_hw *hw, unsigned port)
                         ctrl |= PHY_M_PC_MDI_XMODE(PHY_M_PC_ENA_AUTO);
 
                         if (sky2->autoneg == AUTONEG_ENABLE &&
-                            hw->chip_id == CHIP_ID_YUKON_XL) {
+                            (hw->chip_id == CHIP_ID_YUKON_XL || hw->chip_id == CHIP_ID_YUKON_EC_U)) {
                                 ctrl &= ~PHY_M_PC_DSC_MSK;
                                 ctrl |= PHY_M_PC_DSC(2) | PHY_M_PC_DOWN_S_ENA;
                         }
@@ -442,10 +450,11 @@ static void sky2_phy_init(struct sky2_hw *hw, unsigned port)
                 gm_phy_write(hw, port, PHY_MARV_EXT_ADR, 3);
 
                 /* set LED Function Control register */
-                gm_phy_write(hw, port, PHY_MARV_PHY_CTRL, (PHY_M_LEDC_LOS_CTRL(1) |     /* LINK/ACT */
-                                                           PHY_M_LEDC_INIT_CTRL(7) |    /* 10 Mbps */
-                                                           PHY_M_LEDC_STA1_CTRL(7) |    /* 100 Mbps */
-                                                           PHY_M_LEDC_STA0_CTRL(7)));   /* 1000 Mbps */
+                gm_phy_write(hw, port, PHY_MARV_PHY_CTRL,
+                             (PHY_M_LEDC_LOS_CTRL(1) |  /* LINK/ACT */
+                              PHY_M_LEDC_INIT_CTRL(7) | /* 10 Mbps */
+                              PHY_M_LEDC_STA1_CTRL(7) | /* 100 Mbps */
+                              PHY_M_LEDC_STA0_CTRL(7)));        /* 1000 Mbps */
 
                 /* set Polarity Control register */
                 gm_phy_write(hw, port, PHY_MARV_PHY_STAT,
@@ -459,6 +468,25 @@ static void sky2_phy_init(struct sky2_hw *hw, unsigned port)
                 /* restore page register */
                 gm_phy_write(hw, port, PHY_MARV_EXT_ADR, pg);
                 break;
+        case CHIP_ID_YUKON_EC_U:
+                pg = gm_phy_read(hw, port, PHY_MARV_EXT_ADR);
+
+                /* select page 3 to access LED control register */
+                gm_phy_write(hw, port, PHY_MARV_EXT_ADR, 3);
+
+                /* set LED Function Control register */
+                gm_phy_write(hw, port, PHY_MARV_PHY_CTRL,
+                             (PHY_M_LEDC_LOS_CTRL(1) |  /* LINK/ACT */
+                              PHY_M_LEDC_INIT_CTRL(8) | /* 10 Mbps */
+                              PHY_M_LEDC_STA1_CTRL(7) | /* 100 Mbps */
+                              PHY_M_LEDC_STA0_CTRL(7)));/* 1000 Mbps */
+
+                /* set Blink Rate in LED Timer Control Register */
+                gm_phy_write(hw, port, PHY_MARV_INT_MASK,
+                             ledctrl | PHY_M_LED_BLINK_RT(BLINK_84MS));
+                /* restore page register */
+                gm_phy_write(hw, port, PHY_MARV_EXT_ADR, pg);
+                break;
 
         default:
                 /* set Tx LED (LED_TX) to blink mode on Rx OR Tx activity */
@@ -467,19 +495,21 @@ static void sky2_phy_init(struct sky2_hw *hw, unsigned port)
                 ledover |= PHY_M_LED_MO_RX(MO_LED_OFF);
         }
 
-        if (hw->chip_id == CHIP_ID_YUKON_EC_U && hw->chip_rev >= 2) {
+        if (hw->chip_id == CHIP_ID_YUKON_EC_U && hw->chip_rev == CHIP_REV_YU_EC_A1) {
                 /* apply fixes in PHY AFE */
-                gm_phy_write(hw, port, 22, 255);
+                pg = gm_phy_read(hw, port, PHY_MARV_EXT_ADR);
+                gm_phy_write(hw, port, PHY_MARV_EXT_ADR, 255);
+
                 /* increase differential signal amplitude in 10BASE-T */
-                gm_phy_write(hw, port, 24, 0xaa99);
-                gm_phy_write(hw, port, 23, 0x2011);
+                gm_phy_write(hw, port, 0x18, 0xaa99);
+                gm_phy_write(hw, port, 0x17, 0x2011);
 
                 /* fix for IEEE A/B Symmetry failure in 1000BASE-T */
-                gm_phy_write(hw, port, 24, 0xa204);
-                gm_phy_write(hw, port, 23, 0x2002);
+                gm_phy_write(hw, port, 0x18, 0xa204);
+                gm_phy_write(hw, port, 0x17, 0x2002);
 
                 /* set page register to 0 */
-                gm_phy_write(hw, port, 22, 0);
+                gm_phy_write(hw, port, PHY_MARV_EXT_ADR, pg);
         } else {
                 gm_phy_write(hw, port, PHY_MARV_LED_CTRL, ledctrl);
 
@@ -553,6 +583,11 @@ static void sky2_mac_init(struct sky2_hw *hw, unsigned port)
 
                 if (sky2->duplex == DUPLEX_FULL)
                         reg |= GM_GPCR_DUP_FULL;
+
+                /* turn off pause in 10/100mbps half duplex */
+                else if (sky2->speed != SPEED_1000 &&
+                         hw->chip_id != CHIP_ID_YUKON_EC_U)
+                        sky2->tx_pause = sky2->rx_pause = 0;
         } else
                 reg = GM_GPCR_SPEED_1000 | GM_GPCR_SPEED_100 | GM_GPCR_DUP_FULL;
 
@@ -719,7 +754,7 @@ static inline struct sky2_tx_le *get_tx_le(struct sky2_port *sky2)
 {
         struct sky2_tx_le *le = sky2->tx_le + sky2->tx_prod;
 
-        sky2->tx_prod = (sky2->tx_prod + 1) % TX_RING_SIZE;
+        sky2->tx_prod = RING_NEXT(sky2->tx_prod, TX_RING_SIZE);
         return le;
 }
 
@@ -735,7 +770,7 @@ static inline void sky2_put_idx(struct sky2_hw *hw, unsigned q, u16 idx)
 static inline struct sky2_rx_le *sky2_next_rx(struct sky2_port *sky2)
 {
         struct sky2_rx_le *le = sky2->rx_le + sky2->rx_put;
-        sky2->rx_put = (sky2->rx_put + 1) % RX_LE_SIZE;
+        sky2->rx_put = RING_NEXT(sky2->rx_put, RX_LE_SIZE);
         return le;
 }
 
@@ -925,8 +960,7 @@ static inline struct sk_buff *sky2_alloc_skb(unsigned int size, gfp_t gfp_mask)
         skb = alloc_skb(size + RX_SKB_ALIGN, gfp_mask);
         if (likely(skb)) {
                 unsigned long p = (unsigned long) skb->data;
-                skb_reserve(skb,
-                        ((p + RX_SKB_ALIGN - 1) & ~(RX_SKB_ALIGN - 1)) - p);
+                skb_reserve(skb, ALIGN(p, RX_SKB_ALIGN) - p);
         }
 
         return skb;
@@ -1051,7 +1085,7 @@ static int sky2_up(struct net_device *dev)
 
         /* Enable interrupts from phy/mac for port */
         imask = sky2_read32(hw, B0_IMSK);
-        imask |= (port == 0) ? Y2_IS_PORT_1 : Y2_IS_PORT_2;
+        imask |= portirq_msk[port];
         sky2_write32(hw, B0_IMSK, imask);
 
         return 0;
@@ -1079,7 +1113,7 @@ err_out:
 /* Modular subtraction in ring */
 static inline int tx_dist(unsigned tail, unsigned head)
 {
-        return (head - tail) % TX_RING_SIZE;
+        return (head - tail) & (TX_RING_SIZE - 1);
 }
 
 /* Number of list elements available for next tx */
@@ -1256,7 +1290,7 @@ static int sky2_xmit_frame(struct sk_buff *skb, struct net_device *dev)
                 le->opcode = OP_BUFFER | HW_OWNER;
 
                 fre = sky2->tx_ring
-                    + ((re - sky2->tx_ring) + i + 1) % TX_RING_SIZE;
+                    + RING_NEXT((re - sky2->tx_ring) + i, TX_RING_SIZE);
                 pci_unmap_addr_set(fre, mapaddr, mapping);
         }
 
@@ -1316,7 +1350,7 @@ static void sky2_tx_complete(struct sky2_port *sky2, u16 done)
 
                 for (i = 0; i < skb_shinfo(skb)->nr_frags; i++) {
                         struct tx_ring_info *fre;
-                        fre = sky2->tx_ring + (put + i + 1) % TX_RING_SIZE;
+                        fre = sky2->tx_ring + RING_NEXT(put + i, TX_RING_SIZE);
                         pci_unmap_page(pdev, pci_unmap_addr(fre, mapaddr),
                                        skb_shinfo(skb)->frags[i].size,
                                        PCI_DMA_TODEVICE);
@@ -1402,7 +1436,7 @@ static int sky2_down(struct net_device *dev)
 
         /* Disable port IRQ */
         imask = sky2_read32(hw, B0_IMSK);
-        imask &= ~(sky2->port == 0) ? Y2_IS_PORT_1 : Y2_IS_PORT_2;
+        imask &= ~portirq_msk[port];
         sky2_write32(hw, B0_IMSK, imask);
 
         /* turn off LED's */
@@ -1499,17 +1533,26 @@ static void sky2_link_up(struct sky2_port *sky2)
         sky2_write8(hw, SK_REG(port, LNK_LED_REG),
                     LINKLED_ON | LINKLED_BLINK_OFF | LINKLED_LINKSYNC_OFF);
 
-        if (hw->chip_id == CHIP_ID_YUKON_XL) {
+        if (hw->chip_id == CHIP_ID_YUKON_XL || hw->chip_id == CHIP_ID_YUKON_EC_U) {
                 u16 pg = gm_phy_read(hw, port, PHY_MARV_EXT_ADR);
+                u16 led = PHY_M_LEDC_LOS_CTRL(1);       /* link active */
+
+                switch(sky2->speed) {
+                case SPEED_10:
+                        led |= PHY_M_LEDC_INIT_CTRL(7);
+                        break;
+
+                case SPEED_100:
+                        led |= PHY_M_LEDC_STA1_CTRL(7);
+                        break;
+
+                case SPEED_1000:
+                        led |= PHY_M_LEDC_STA0_CTRL(7);
+                        break;
+                }
 
                 gm_phy_write(hw, port, PHY_MARV_EXT_ADR, 3);
-                gm_phy_write(hw, port, PHY_MARV_PHY_CTRL, PHY_M_LEDC_LOS_CTRL(1) |      /* LINK/ACT */
-                             PHY_M_LEDC_INIT_CTRL(sky2->speed ==
-                                                  SPEED_10 ? 7 : 0) |
-                             PHY_M_LEDC_STA1_CTRL(sky2->speed ==
-                                                  SPEED_100 ? 7 : 0) |
-                             PHY_M_LEDC_STA0_CTRL(sky2->speed ==
-                                                  SPEED_1000 ? 7 : 0));
+                gm_phy_write(hw, port, PHY_MARV_PHY_CTRL, led);
                 gm_phy_write(hw, port, PHY_MARV_EXT_ADR, pg);
         }
 
@@ -1584,7 +1627,7 @@ static int sky2_autoneg_done(struct sky2_port *sky2, u16 aux)
         sky2->speed = sky2_phy_speed(hw, aux);
 
         /* Pause bits are offset (9..8) */
-        if (hw->chip_id == CHIP_ID_YUKON_XL)
+        if (hw->chip_id == CHIP_ID_YUKON_XL || hw->chip_id == CHIP_ID_YUKON_EC_U)
                 aux >>= 6;
 
         sky2->rx_pause = (aux & PHY_M_PS_RX_P_EN) != 0;
@@ -1686,13 +1729,12 @@ static void sky2_tx_timeout(struct net_device *dev)
 }
 
 
-#define roundup(x, y)   ((((x)+((y)-1))/(y))*(y))
 /* Want receive buffer size to be multiple of 64 bits
  * and incl room for vlan and truncation
  */
 static inline unsigned sky2_buf_size(int mtu)
 {
-        return roundup(mtu + ETH_HLEN + VLAN_HLEN, 8) + 8;
+        return ALIGN(mtu + ETH_HLEN + VLAN_HLEN, 8) + 8;
 }
 
 static int sky2_change_mtu(struct net_device *dev, int new_mtu)
@@ -1861,35 +1903,28 @@ static inline void sky2_tx_done(struct net_device *dev, u16 last)
 static int sky2_status_intr(struct sky2_hw *hw, int to_do)
 {
         int work_done = 0;
+        u16 hwidx = sky2_read16(hw, STAT_PUT_IDX);
 
         rmb();
 
-        for(;;) {
+        while (hw->st_idx != hwidx) {
                 struct sky2_status_le *le  = hw->st_le + hw->st_idx;
                 struct net_device *dev;
                 struct sky2_port *sky2;
                 struct sk_buff *skb;
                 u32 status;
                 u16 length;
-                u8  link, opcode;
 
-                opcode = le->opcode;
-                if (!opcode)
-                        break;
-                opcode &= ~HW_OWNER;
+                hw->st_idx = RING_NEXT(hw->st_idx, STATUS_RING_SIZE);
 
-                hw->st_idx = (hw->st_idx + 1) % STATUS_RING_SIZE;
-                le->opcode = 0;
-
-                link = le->link;
-                BUG_ON(link >= 2);
-                dev = hw->dev[link];
+                BUG_ON(le->link >= 2);
+                dev = hw->dev[le->link];
 
                 sky2 = netdev_priv(dev);
                 length = le->length;
                 status = le->status;
 
-                switch (opcode) {
+                switch (le->opcode & ~HW_OWNER) {
                 case OP_RXSTAT:
                         skb = sky2_receive(sky2, length, status);
                         if (!skb)
@@ -1929,7 +1964,8 @@ static int sky2_status_intr(struct sky2_hw *hw, int to_do)
 
                 case OP_TXINDEXLE:
                         /* TX index reports status for both ports */
-                        sky2_tx_done(hw->dev[0], status & 0xffff);
+                        BUILD_BUG_ON(TX_RING_SIZE > 0x1000);
+                        sky2_tx_done(hw->dev[0], status & 0xfff);
                         if (hw->dev[1])
                                 sky2_tx_done(hw->dev[1],
                                      ((status >> 24) & 0xff)
@@ -1939,8 +1975,8 @@ static int sky2_status_intr(struct sky2_hw *hw, int to_do)
                 default:
                         if (net_ratelimit())
                                 printk(KERN_WARNING PFX
-                                       "unknown status opcode 0x%x\n", opcode);
-                        break;
+                                       "unknown status opcode 0x%x\n", le->opcode);
+                        goto exit_loop;
                 }
         }
 
@@ -2086,6 +2122,21 @@ static void sky2_descriptor_error(struct sky2_hw *hw, unsigned port,
         }
 }
 
+/* If idle then force a fake soft NAPI poll once a second
+ * to work around cases where sharing an edge triggered interrupt.
+ */
+static void sky2_idle(unsigned long arg)
+{
+        struct sky2_hw *hw = (struct sky2_hw *) arg;
+        struct net_device *dev = hw->dev[0];
+
+        if (__netif_rx_schedule_prep(dev))
+                __netif_rx_schedule(dev);
+
+        mod_timer(&hw->idle_timer, jiffies + msecs_to_jiffies(idle_timeout));
+}
+
+
 static int sky2_poll(struct net_device *dev0, int *budget)
 {
         struct sky2_hw *hw = ((struct sky2_port *) netdev_priv(dev0))->hw;
@@ -2093,45 +2144,42 @@ static int sky2_poll(struct net_device *dev0, int *budget)
         int work_done = 0;
         u32 status = sky2_read32(hw, B0_Y2_SP_EISR);
 
-        if (unlikely(status & ~Y2_IS_STAT_BMU)) {
-                if (status & Y2_IS_HW_ERR)
-                        sky2_hw_intr(hw);
+        if (status & Y2_IS_HW_ERR)
+                sky2_hw_intr(hw);
 
-                if (status & Y2_IS_IRQ_PHY1)
-                        sky2_phy_intr(hw, 0);
+        if (status & Y2_IS_IRQ_PHY1)
+                sky2_phy_intr(hw, 0);
 
-                if (status & Y2_IS_IRQ_PHY2)
-                        sky2_phy_intr(hw, 1);
+        if (status & Y2_IS_IRQ_PHY2)
+                sky2_phy_intr(hw, 1);
 
-                if (status & Y2_IS_IRQ_MAC1)
-                        sky2_mac_intr(hw, 0);
+        if (status & Y2_IS_IRQ_MAC1)
+                sky2_mac_intr(hw, 0);
 
-                if (status & Y2_IS_IRQ_MAC2)
-                        sky2_mac_intr(hw, 1);
+        if (status & Y2_IS_IRQ_MAC2)
+                sky2_mac_intr(hw, 1);
 
-                if (status & Y2_IS_CHK_RX1)
-                        sky2_descriptor_error(hw, 0, "receive", Y2_IS_CHK_RX1);
+        if (status & Y2_IS_CHK_RX1)
+                sky2_descriptor_error(hw, 0, "receive", Y2_IS_CHK_RX1);
 
-                if (status & Y2_IS_CHK_RX2)
-                        sky2_descriptor_error(hw, 1, "receive", Y2_IS_CHK_RX2);
+        if (status & Y2_IS_CHK_RX2)
+                sky2_descriptor_error(hw, 1, "receive", Y2_IS_CHK_RX2);
 
-                if (status & Y2_IS_CHK_TXA1)
-                        sky2_descriptor_error(hw, 0, "transmit", Y2_IS_CHK_TXA1);
+        if (status & Y2_IS_CHK_TXA1)
+                sky2_descriptor_error(hw, 0, "transmit", Y2_IS_CHK_TXA1);
 
-                if (status & Y2_IS_CHK_TXA2)
-                        sky2_descriptor_error(hw, 1, "transmit", Y2_IS_CHK_TXA2);
-        }
+        if (status & Y2_IS_CHK_TXA2)
+                sky2_descriptor_error(hw, 1, "transmit", Y2_IS_CHK_TXA2);
 
-        if (status & Y2_IS_STAT_BMU) {
-                work_done = sky2_status_intr(hw, work_limit);
-                *budget -= work_done;
-                dev0->quota -= work_done;
+        if (status & Y2_IS_STAT_BMU)
+                sky2_write32(hw, STAT_CTRL, SC_STAT_CLR_IRQ);
 
-                if (work_done >= work_limit)
-                        return 1;
+        work_done = sky2_status_intr(hw, work_limit);
+        *budget -= work_done;
+        dev0->quota -= work_done;
 
-                sky2_write32(hw, STAT_CTRL, SC_STAT_CLR_IRQ);
-        }
+        if (work_done >= work_limit)
+                return 1;
 
         netif_rx_complete(dev0);
 
@@ -2153,8 +2201,6 @@ static irqreturn_t sky2_intr(int irq, void *dev_id, struct pt_regs *regs)
         prefetch(&hw->st_le[hw->st_idx]);
         if (likely(__netif_rx_schedule_prep(dev0)))
                 __netif_rx_schedule(dev0);
-        else
-                printk(KERN_DEBUG PFX "irq race detected\n");
 
         return IRQ_HANDLED;
 }
@@ -2193,7 +2239,7 @@ static inline u32 sky2_clk2us(const struct sky2_hw *hw, u32 clk)
 }
 
 
-static int sky2_reset(struct sky2_hw *hw)
+static int __devinit sky2_reset(struct sky2_hw *hw)
 {
         u16 status;
         u8 t8, pmd_type;
@@ -2218,13 +2264,6 @@ static int sky2_reset(struct sky2_hw *hw)
                 return -EOPNOTSUPP;
         }
 
-        /* This chip is new and not tested yet */
-        if (hw->chip_id == CHIP_ID_YUKON_EC_U) {
-                pr_info(PFX "%s: is a version of Yukon 2 chipset that has not been tested yet.\n",
-                        pci_name(hw->pdev));
-                pr_info("Please report success/failure to maintainer <shemminger@osdl.org>\n");
-        }
-
         /* disable ASF */
         if (hw->chip_id <= CHIP_ID_YUKON_EC) {
                 sky2_write8(hw, B28_Y2_ASF_STAT_CMD, Y2_ASF_RESET);
@@ -3276,6 +3315,11 @@ static int __devinit sky2_probe(struct pci_dev *pdev,
 
         sky2_write32(hw, B0_IMSK, Y2_IS_BASE);
 
+        setup_timer(&hw->idle_timer, sky2_idle, (unsigned long) hw);
+        if (idle_timeout > 0)
+                mod_timer(&hw->idle_timer,
+                          jiffies + msecs_to_jiffies(idle_timeout));
+
         pci_set_drvdata(pdev, hw);
 
         return 0;
@@ -3311,13 +3355,17 @@ static void __devexit sky2_remove(struct pci_dev *pdev)
         if (!hw)
                 return;
 
+        del_timer_sync(&hw->idle_timer);
+
+        sky2_write32(hw, B0_IMSK, 0);
+        synchronize_irq(hw->pdev->irq);
+
         dev0 = hw->dev[0];
         dev1 = hw->dev[1];
         if (dev1)
                 unregister_netdev(dev1);
         unregister_netdev(dev0);
 
-        sky2_write32(hw, B0_IMSK, 0);
         sky2_set_power_state(hw, PCI_D3hot);
         sky2_write16(hw, B0_Y2LED, LED_STAT_OFF);
         sky2_write8(hw, B0_CTST, CS_RST_SET);
diff --git a/drivers/net/sky2.h b/drivers/net/sky2.h
index 89dd18cd12f0..8012994c9b93 100644
--- a/drivers/net/sky2.h
+++ b/drivers/net/sky2.h
@@ -378,6 +378,9 @@ enum {
         CHIP_REV_YU_EC_A1    = 0,  /* Chip Rev. for Yukon-EC A1/A0 */
         CHIP_REV_YU_EC_A2    = 1,  /* Chip Rev. for Yukon-EC A2 */
         CHIP_REV_YU_EC_A3    = 2,  /* Chip Rev. for Yukon-EC A3 */
+
+        CHIP_REV_YU_EC_U_A0  = 0,
+        CHIP_REV_YU_EC_U_A1  = 1,
 };
 
 /*      B2_Y2_CLK_GATE   8 bit  Clock Gating (Yukon-2 only) */
@@ -1880,6 +1883,8 @@ struct sky2_hw {
         struct sky2_status_le *st_le;
         u32                  st_idx;
         dma_addr_t           st_dma;
+
+        struct timer_list    idle_timer;
         int                  msi_detected;
         wait_queue_head_t    msi_wait;
 };
diff --git a/drivers/net/spider_net.c b/drivers/net/spider_net.c
index 43f5e86fc559..394339d5e87c 100644
--- a/drivers/net/spider_net.c
+++ b/drivers/net/spider_net.c
@@ -1652,6 +1652,8 @@ spider_net_enable_card(struct spider_net_card *card)
                 { SPIDER_NET_GFTRESTRT, SPIDER_NET_RESTART_VALUE },
 
                 { SPIDER_NET_GMRWOLCTRL, 0 },
+                { SPIDER_NET_GTESTMD, 0x10000000 },
+                { SPIDER_NET_GTTQMSK, 0x00400040 },
                 { SPIDER_NET_GTESTMD, 0 },
 
                 { SPIDER_NET_GMACINTEN, 0 },
@@ -1792,15 +1794,7 @@ spider_net_setup_phy(struct spider_net_card *card)
         if (phy->def->ops->setup_forced)
                 phy->def->ops->setup_forced(phy, SPEED_1000, DUPLEX_FULL);
 
-        /* the following two writes could be moved to sungem_phy.c */
-        /* enable fiber mode */
-        spider_net_write_phy(card->netdev, 1, MII_NCONFIG, 0x9020);
-        /* LEDs active in both modes, autosense prio = fiber */
-        spider_net_write_phy(card->netdev, 1, MII_NCONFIG, 0x945f);
-
-        /* switch off fibre autoneg */
-        spider_net_write_phy(card->netdev, 1, MII_NCONFIG, 0xfc01);
-        spider_net_write_phy(card->netdev, 1, 0x0b, 0x0004);
+        phy->def->ops->enable_fiber(phy);
 
         phy->def->ops->read_link(phy);
         pr_info("Found %s with %i Mbps, %s-duplex.\n", phy->def->name,
diff --git a/drivers/net/spider_net.h b/drivers/net/spider_net.h
index 5922b529a048..3b8d951cf73c 100644
--- a/drivers/net/spider_net.h
+++ b/drivers/net/spider_net.h
@@ -120,6 +120,8 @@ extern char spider_net_driver_name[];
 #define SPIDER_NET_GMRUAFILnR           0x00000500
 #define SPIDER_NET_GMRUA0FIL15R         0x00000578
 
+#define SPIDER_NET_GTTQMSK              0x00000934
+
 /* RX DMA controller registers, all 0x00000a.. are for DMA controller A,
  * 0x00000b.. for DMA controller B, etc. */
 #define SPIDER_NET_GDADCHA              0x00000a00
diff --git a/drivers/net/sungem_phy.c b/drivers/net/sungem_phy.c
index cb0aba95d4e3..b2ddd5e79303 100644
--- a/drivers/net/sungem_phy.c
+++ b/drivers/net/sungem_phy.c
@@ -275,7 +275,7 @@ static int bcm5411_init(struct mii_phy* phy)
         return 0;
 }
 
-static int bcm5411_suspend(struct mii_phy* phy)
+static int generic_suspend(struct mii_phy* phy)
 {
         phy_write(phy, MII_BMCR, BMCR_PDOWN);
 
@@ -329,6 +329,30 @@ static int bcm5421_init(struct mii_phy* phy)
         return 0;
 }
 
+static int bcm5421_enable_fiber(struct mii_phy* phy)
+{
+        /* enable fiber mode */
+        phy_write(phy, MII_NCONFIG, 0x9020);
+        /* LEDs active in both modes, autosense prio = fiber */
+        phy_write(phy, MII_NCONFIG, 0x945f);
+
+        /* switch off fibre autoneg */
+        phy_write(phy, MII_NCONFIG, 0xfc01);
+        phy_write(phy, 0x0b, 0x0004);
+
+        return 0;
+}
+
+static int bcm5461_enable_fiber(struct mii_phy* phy)
+{
+        phy_write(phy, MII_NCONFIG, 0xfc0c);
+        phy_write(phy, MII_BMCR, 0x4140);
+        phy_write(phy, MII_NCONFIG, 0xfc0b);
+        phy_write(phy, MII_BMCR, 0x0140);
+
+        return 0;
+}
+
 static int bcm54xx_setup_aneg(struct mii_phy *phy, u32 advertise)
 {
         u16 ctl, adv;
@@ -738,7 +762,7 @@ static struct mii_phy_def bcm5401_phy_def = {
 /* Broadcom BCM 5411 */
 static struct mii_phy_ops bcm5411_phy_ops = {
         .init           = bcm5411_init,
-        .suspend        = bcm5411_suspend,
+        .suspend        = generic_suspend,
         .setup_aneg     = bcm54xx_setup_aneg,
         .setup_forced   = bcm54xx_setup_forced,
         .poll_link      = genmii_poll_link,
@@ -757,11 +781,12 @@ static struct mii_phy_def bcm5411_phy_def = {
 /* Broadcom BCM 5421 */
 static struct mii_phy_ops bcm5421_phy_ops = {
         .init           = bcm5421_init,
-        .suspend        = bcm5411_suspend,
+        .suspend        = generic_suspend,
         .setup_aneg     = bcm54xx_setup_aneg,
         .setup_forced   = bcm54xx_setup_forced,
         .poll_link      = genmii_poll_link,
         .read_link      = bcm54xx_read_link,
+        .enable_fiber   = bcm5421_enable_fiber,
 };
 
 static struct mii_phy_def bcm5421_phy_def = {
@@ -776,7 +801,7 @@ static struct mii_phy_def bcm5421_phy_def = {
 /* Broadcom BCM 5421 built-in K2 */
 static struct mii_phy_ops bcm5421k2_phy_ops = {
         .init           = bcm5421_init,
-        .suspend        = bcm5411_suspend,
+        .suspend        = generic_suspend,
         .setup_aneg     = bcm54xx_setup_aneg,
         .setup_forced   = bcm54xx_setup_forced,
         .poll_link      = genmii_poll_link,
@@ -792,10 +817,29 @@ static struct mii_phy_def bcm5421k2_phy_def = {
         .ops            = &bcm5421k2_phy_ops
 };
 
+static struct mii_phy_ops bcm5461_phy_ops = {
+        .init           = bcm5421_init,
+        .suspend        = generic_suspend,
+        .setup_aneg     = bcm54xx_setup_aneg,
+        .setup_forced   = bcm54xx_setup_forced,
+        .poll_link      = genmii_poll_link,
+        .read_link      = bcm54xx_read_link,
+        .enable_fiber   = bcm5461_enable_fiber,
+};
+
+static struct mii_phy_def bcm5461_phy_def = {
+        .phy_id         = 0x002060c0,
+        .phy_id_mask    = 0xfffffff0,
+        .name           = "BCM5461",
+        .features       = MII_GBIT_FEATURES,
+        .magic_aneg     = 1,
+        .ops            = &bcm5461_phy_ops
+};
+
 /* Broadcom BCM 5462 built-in Vesta */
 static struct mii_phy_ops bcm5462V_phy_ops = {
         .init           = bcm5421_init,
-        .suspend        = bcm5411_suspend,
+        .suspend        = generic_suspend,
         .setup_aneg     = bcm54xx_setup_aneg,
         .setup_forced   = bcm54xx_setup_forced,
         .poll_link      = genmii_poll_link,
@@ -816,6 +860,7 @@ static struct mii_phy_def bcm5462V_phy_def = {
  * would be useful here) --BenH.
  */
 static struct mii_phy_ops marvell_phy_ops = {
+        .suspend        = generic_suspend,
         .setup_aneg     = marvell_setup_aneg,
         .setup_forced   = marvell_setup_forced,
         .poll_link      = genmii_poll_link,
@@ -856,6 +901,7 @@ static struct mii_phy_def* mii_phy_table[] = {
         &bcm5411_phy_def,
         &bcm5421_phy_def,
         &bcm5421k2_phy_def,
+        &bcm5461_phy_def,
         &bcm5462V_phy_def,
         &marvell_phy_def,
         &genmii_phy_def,
diff --git a/drivers/net/sungem_phy.h b/drivers/net/sungem_phy.h
index 430544496c52..69e125197fcf 100644
--- a/drivers/net/sungem_phy.h
+++ b/drivers/net/sungem_phy.h
@@ -12,6 +12,7 @@ struct mii_phy_ops
         int             (*setup_forced)(struct mii_phy *phy, int speed, int fd);
         int             (*poll_link)(struct mii_phy *phy);
         int             (*read_link)(struct mii_phy *phy);
+        int             (*enable_fiber)(struct mii_phy *phy);
 };
 
 /* Structure used to statically define an mii/gii based PHY */
diff --git a/drivers/net/tg3.c b/drivers/net/tg3.c
index 73e271e59c6a..beeb612be98f 100644
--- a/drivers/net/tg3.c
+++ b/drivers/net/tg3.c
@@ -69,8 +69,8 @@
 
 #define DRV_MODULE_NAME         "tg3"
 #define PFX DRV_MODULE_NAME     ": "
-#define DRV_MODULE_VERSION      "3.56"
-#define DRV_MODULE_RELDATE      "Apr 1, 2006"
+#define DRV_MODULE_VERSION      "3.57"
+#define DRV_MODULE_RELDATE      "Apr 28, 2006"
 
 #define TG3_DEF_MAC_MODE        0
 #define TG3_DEF_RX_MODE         0
@@ -974,6 +974,8 @@ static int tg3_phy_reset_5703_4_5(struct tg3 *tp)
         return err;
 }
 
+static void tg3_link_report(struct tg3 *);
+
 /* This will reset the tigon3 PHY if there is no valid
  * link unless the FORCE argument is non-zero.
  */
@@ -987,6 +989,11 @@ static int tg3_phy_reset(struct tg3 *tp)
         if (err != 0)
                 return -EBUSY;
 
+        if (netif_running(tp->dev) && netif_carrier_ok(tp->dev)) {
+                netif_carrier_off(tp->dev);
+                tg3_link_report(tp);
+        }
+
         if (GET_ASIC_REV(tp->pci_chip_rev_id) == ASIC_REV_5703 ||
             GET_ASIC_REV(tp->pci_chip_rev_id) == ASIC_REV_5704 ||
             GET_ASIC_REV(tp->pci_chip_rev_id) == ASIC_REV_5705) {
@@ -1023,6 +1030,12 @@ out:
                 tg3_writephy(tp, MII_TG3_DSP_RW_PORT, 0x14e2);
                 tg3_writephy(tp, MII_TG3_AUX_CTRL, 0x0400);
         }
+        else if (tp->tg3_flags2 & TG3_FLG2_PHY_JITTER_BUG) {
+                tg3_writephy(tp, MII_TG3_AUX_CTRL, 0x0c00);
+                tg3_writephy(tp, MII_TG3_DSP_ADDRESS, 0x000a);
+                tg3_writephy(tp, MII_TG3_DSP_RW_PORT, 0x010b);
+                tg3_writephy(tp, MII_TG3_AUX_CTRL, 0x0400);
+        }
         /* Set Extended packet length bit (bit 14) on all chips that */
         /* support jumbo frames */
         if ((tp->phy_id & PHY_ID_MASK) == PHY_ID_BCM5401) {
@@ -3531,7 +3544,7 @@ static irqreturn_t tg3_test_isr(int irq, void *dev_id,
         return IRQ_RETVAL(0);
 }
 
-static int tg3_init_hw(struct tg3 *);
+static int tg3_init_hw(struct tg3 *, int);
 static int tg3_halt(struct tg3 *, int, int);
 
 #ifdef CONFIG_NET_POLL_CONTROLLER
@@ -3567,7 +3580,7 @@ static void tg3_reset_task(void *_data)
         tp->tg3_flags2 &= ~TG3_FLG2_RESTART_TIMER;
 
         tg3_halt(tp, RESET_KIND_SHUTDOWN, 0);
-        tg3_init_hw(tp);
+        tg3_init_hw(tp, 1);
 
         tg3_netif_start(tp);
 
@@ -4042,7 +4055,7 @@ static int tg3_change_mtu(struct net_device *dev, int new_mtu)
 
         tg3_set_mtu(dev, tp, new_mtu);
 
-        tg3_init_hw(tp);
+        tg3_init_hw(tp, 0);
 
         tg3_netif_start(tp);
 
@@ -5719,9 +5732,23 @@ static int tg3_set_mac_addr(struct net_device *dev, void *p)
         if (!netif_running(dev))
                 return 0;
 
-        spin_lock_bh(&tp->lock);
-        __tg3_set_mac_addr(tp);
-        spin_unlock_bh(&tp->lock);
+        if (tp->tg3_flags & TG3_FLAG_ENABLE_ASF) {
+                /* Reset chip so that ASF can re-init any MAC addresses it
+                 * needs.
+                 */
+                tg3_netif_stop(tp);
+                tg3_full_lock(tp, 1);
+
+                tg3_halt(tp, RESET_KIND_SHUTDOWN, 1);
+                tg3_init_hw(tp, 0);
+
+                tg3_netif_start(tp);
+                tg3_full_unlock(tp);
+        } else {
+                spin_lock_bh(&tp->lock);
+                __tg3_set_mac_addr(tp);
+                spin_unlock_bh(&tp->lock);
+        }
 
         return 0;
 }
@@ -5771,7 +5798,7 @@ static void __tg3_set_coalesce(struct tg3 *tp, struct ethtool_coalesce *ec)
 }
 
 /* tp->lock is held. */
-static int tg3_reset_hw(struct tg3 *tp)
+static int tg3_reset_hw(struct tg3 *tp, int reset_phy)
 {
         u32 val, rdmac_mode;
         int i, err, limit;
@@ -5786,7 +5813,7 @@ static int tg3_reset_hw(struct tg3 *tp)
                 tg3_abort_hw(tp, 1);
         }
 
-        if (tp->tg3_flags2 & TG3_FLG2_MII_SERDES)
+        if ((tp->tg3_flags2 & TG3_FLG2_MII_SERDES) && reset_phy)
                 tg3_phy_reset(tp);
 
         err = tg3_chip_reset(tp);
@@ -6327,7 +6354,7 @@ static int tg3_reset_hw(struct tg3 *tp)
                 tw32(GRC_LOCAL_CTRL, tp->grc_local_ctrl);
         }
 
-        err = tg3_setup_phy(tp, 1);
+        err = tg3_setup_phy(tp, reset_phy);
         if (err)
                 return err;
 
@@ -6400,7 +6427,7 @@ static int tg3_reset_hw(struct tg3 *tp)
 /* Called at device open time to get the chip ready for
  * packet processing.  Invoked with tp->lock held.
  */
-static int tg3_init_hw(struct tg3 *tp)
+static int tg3_init_hw(struct tg3 *tp, int reset_phy)
 {
         int err;
 
@@ -6413,7 +6440,7 @@ static int tg3_init_hw(struct tg3 *tp)
 
         tw32(TG3PCI_MEM_WIN_BASE_ADDR, 0);
 
-        err = tg3_reset_hw(tp);
+        err = tg3_reset_hw(tp, reset_phy);
 
 out:
         return err;
@@ -6683,7 +6710,7 @@ static int tg3_test_msi(struct tg3 *tp)
         tg3_full_lock(tp, 1);
 
         tg3_halt(tp, RESET_KIND_SHUTDOWN, 1);
-        err = tg3_init_hw(tp);
+        err = tg3_init_hw(tp, 1);
 
         tg3_full_unlock(tp);
 
@@ -6748,7 +6775,7 @@ static int tg3_open(struct net_device *dev)
 
         tg3_full_lock(tp, 0);
 
-        err = tg3_init_hw(tp);
+        err = tg3_init_hw(tp, 1);
         if (err) {
                 tg3_halt(tp, RESET_KIND_SHUTDOWN, 1);
                 tg3_free_rings(tp);
@@ -7839,7 +7866,7 @@ static int tg3_set_ringparam(struct net_device *dev, struct ethtool_ringparam *e
 
         if (netif_running(dev)) {
                 tg3_halt(tp, RESET_KIND_SHUTDOWN, 1);
-                tg3_init_hw(tp);
+                tg3_init_hw(tp, 1);
                 tg3_netif_start(tp);
         }
 
@@ -7884,7 +7911,7 @@ static int tg3_set_pauseparam(struct net_device *dev, struct ethtool_pauseparam
 
         if (netif_running(dev)) {
                 tg3_halt(tp, RESET_KIND_SHUTDOWN, 1);
-                tg3_init_hw(tp);
+                tg3_init_hw(tp, 1);
                 tg3_netif_start(tp);
         }
 
@@ -8522,7 +8549,7 @@ static int tg3_test_loopback(struct tg3 *tp)
         if (!netif_running(tp->dev))
                 return TG3_LOOPBACK_FAILED;
 
-        tg3_reset_hw(tp);
+        tg3_reset_hw(tp, 1);
 
         if (tg3_run_loopback(tp, TG3_MAC_LOOPBACK))
                 err |= TG3_MAC_LOOPBACK_FAILED;
@@ -8596,7 +8623,7 @@ static void tg3_self_test(struct net_device *dev, struct ethtool_test *etest,
                 tg3_halt(tp, RESET_KIND_SHUTDOWN, 1);
                 if (netif_running(dev)) {
                         tp->tg3_flags |= TG3_FLAG_INIT_COMPLETE;
-                        tg3_init_hw(tp);
+                        tg3_init_hw(tp, 1);
                         tg3_netif_start(tp);
                 }
 
@@ -9377,7 +9404,7 @@ static int tg3_nvram_write_block_buffered(struct tg3 *tp, u32 offset, u32 len,
 
                 if ((page_off == 0) || (i == 0))
                         nvram_cmd |= NVRAM_CMD_FIRST;
-                else if (page_off == (tp->nvram_pagesize - 4))
+                if (page_off == (tp->nvram_pagesize - 4))
                         nvram_cmd |= NVRAM_CMD_LAST;
 
                 if (i == (len - 4))
@@ -10353,10 +10380,13 @@ static int __devinit tg3_get_invariants(struct tg3 *tp)
         if (tp->pci_chip_rev_id == CHIPREV_ID_5704_A0)
                 tp->tg3_flags2 |= TG3_FLG2_PHY_5704_A0_BUG;
 
-        if ((tp->tg3_flags2 & TG3_FLG2_5705_PLUS) &&
-            (GET_ASIC_REV(tp->pci_chip_rev_id) != ASIC_REV_5755) &&
-            (GET_ASIC_REV(tp->pci_chip_rev_id) != ASIC_REV_5787))
-                tp->tg3_flags2 |= TG3_FLG2_PHY_BER_BUG;
+        if (tp->tg3_flags2 & TG3_FLG2_5705_PLUS) {
+                if (GET_ASIC_REV(tp->pci_chip_rev_id) == ASIC_REV_5755 ||
+                    GET_ASIC_REV(tp->pci_chip_rev_id) == ASIC_REV_5787)
+                        tp->tg3_flags2 |= TG3_FLG2_PHY_JITTER_BUG;
+                else
+                        tp->tg3_flags2 |= TG3_FLG2_PHY_BER_BUG;
+        }
 
         tp->coalesce_mode = 0;
         if (GET_CHIP_REV(tp->pci_chip_rev_id) != CHIPREV_5700_AX &&
@@ -11569,7 +11599,7 @@ static int tg3_suspend(struct pci_dev *pdev, pm_message_t state)
                 tg3_full_lock(tp, 0);
 
                 tp->tg3_flags |= TG3_FLAG_INIT_COMPLETE;
-                tg3_init_hw(tp);
+                tg3_init_hw(tp, 1);
 
                 tp->timer.expires = jiffies + tp->timer_offset;
                 add_timer(&tp->timer);
@@ -11603,7 +11633,7 @@ static int tg3_resume(struct pci_dev *pdev)
         tg3_full_lock(tp, 0);
 
         tp->tg3_flags |= TG3_FLAG_INIT_COMPLETE;
-        tg3_init_hw(tp);
+        tg3_init_hw(tp, 1);
 
         tp->timer.expires = jiffies + tp->timer_offset;
         add_timer(&tp->timer);
diff --git a/drivers/net/tg3.h b/drivers/net/tg3.h
index 8c8b987d1250..0e29b885d449 100644
--- a/drivers/net/tg3.h
+++ b/drivers/net/tg3.h
@@ -2215,6 +2215,7 @@ struct tg3 {
 #define TG3_FLG2_HW_TSO_2               0x08000000
 #define TG3_FLG2_HW_TSO                 (TG3_FLG2_HW_TSO_1 | TG3_FLG2_HW_TSO_2)
 #define TG3_FLG2_1SHOT_MSI              0x10000000
+#define TG3_FLG2_PHY_JITTER_BUG         0x20000000
 
         u32                             split_mode_max_reqs;
 #define SPLIT_MODE_5704_MAX_REQ         3
diff --git a/drivers/net/via-rhine.c b/drivers/net/via-rhine.c
index 6a23964c1317..a6dc53b4250d 100644
--- a/drivers/net/via-rhine.c
+++ b/drivers/net/via-rhine.c
@@ -129,6 +129,7 @@
         - Massive clean-up
         - Rewrite PHY, media handling (remove options, full_duplex, backoff)
         - Fix Tx engine race for good
+        - Craig Brind: Zero padded aligned buffers for short packets.
 
 */
 
@@ -1326,7 +1327,12 @@ static int rhine_start_tx(struct sk_buff *skb, struct net_device *dev)
                         rp->stats.tx_dropped++;
                         return 0;
                 }
+
+                /* Padding is not copied and so must be redone. */
                 skb_copy_and_csum_dev(skb, rp->tx_buf[entry]);
+                if (skb->len < ETH_ZLEN)
+                        memset(rp->tx_buf[entry] + skb->len, 0,
+                               ETH_ZLEN - skb->len);
                 rp->tx_skbuff_dma[entry] = 0;
                 rp->tx_ring[entry].addr = cpu_to_le32(rp->tx_bufs_dma +
                                                       (rp->tx_buf[entry] -
diff --git a/drivers/net/wireless/Kconfig b/drivers/net/wireless/Kconfig
index bad09ebdb50b..e0874cbfefea 100644
--- a/drivers/net/wireless/Kconfig
+++ b/drivers/net/wireless/Kconfig
@@ -6,7 +6,7 @@ menu "Wireless LAN (non-hamradio)"
         depends on NETDEVICES
 
 config NET_RADIO
-        bool "Wireless LAN drivers (non-hamradio)"
+        bool "Wireless LAN drivers (non-hamradio) & Wireless Extensions"
         select WIRELESS_EXT
         ---help---
           Support for wireless LANs and everything having to do with radio,
diff --git a/drivers/net/wireless/airo.c b/drivers/net/wireless/airo.c
index 108d9fed8f07..00764ddd74d8 100644
--- a/drivers/net/wireless/airo.c
+++ b/drivers/net/wireless/airo.c
@@ -3139,6 +3139,7 @@ static irqreturn_t airo_interrupt ( int irq, void* dev_id, struct pt_regs *regs)
                 }
                 if ( status & EV_LINK ) {
                         union iwreq_data        wrqu;
+                        int scan_forceloss = 0;
                         /* The link status has changed, if you want to put a
                            monitor hook in, do it here.  (Remember that
                            interrupts are still disabled!)
@@ -3157,7 +3158,8 @@ static irqreturn_t airo_interrupt ( int irq, void* dev_id, struct pt_regs *regs)
                           code) */
 #define AUTHFAIL 0x0300 /* Authentication failure (low byte is reason
                            code) */
-#define ASSOCIATED 0x0400 /* Assocatied */
+#define ASSOCIATED 0x0400 /* Associated */
+#define REASSOCIATED 0x0600 /* Reassociated?  Only on firmware >= 5.30.17 */
 #define RC_RESERVED 0 /* Reserved return code */
 #define RC_NOREASON 1 /* Unspecified reason */
 #define RC_AUTHINV 2 /* Previous authentication invalid */
@@ -3174,44 +3176,30 @@ static irqreturn_t airo_interrupt ( int irq, void* dev_id, struct pt_regs *regs)
                           leaving BSS */
 #define RC_NOAUTH 9 /* Station requesting (Re)Association is not
                        Authenticated with the responding station */
-                        if (newStatus != ASSOCIATED) {
-                                if (auto_wep && !apriv->expires) {
-                                        apriv->expires = RUN_AT(3*HZ);
-                                        wake_up_interruptible(&apriv->thr_wait);
-                                }
-                        } else {
-                                struct task_struct *task = apriv->task;
+                        if (newStatus == FORCELOSS && apriv->scan_timeout > 0)
+                                scan_forceloss = 1;
+                        if(newStatus == ASSOCIATED || newStatus == REASSOCIATED) {
                                 if (auto_wep)
                                         apriv->expires = 0;
-                                if (task)
-                                        wake_up_process (task);
+                                if (apriv->task)
+                                        wake_up_process (apriv->task);
                                 set_bit(FLAG_UPDATE_UNI, &apriv->flags);
                                 set_bit(FLAG_UPDATE_MULTI, &apriv->flags);
-                        }
-                        /* Question : is ASSOCIATED the only status
-                         * that is valid ? We want to catch handover
-                         * and reassociations as valid status
-                         * Jean II */
-                        if(newStatus == ASSOCIATED) {
-#if 0
-                                /* FIXME: Grabbing scan results here
-                                 * seems to be too early???  Just wait for
-                                 * timeout instead. */
-                                if (apriv->scan_timeout > 0) {
-                                        set_bit(JOB_SCAN_RESULTS, &apriv->flags);
-                                        wake_up_interruptible(&apriv->thr_wait);
-                                }
-#endif
+
                                 if (down_trylock(&apriv->sem) != 0) {
                                         set_bit(JOB_EVENT, &apriv->flags);
                                         wake_up_interruptible(&apriv->thr_wait);
                                 } else
                                         airo_send_event(dev);
-                        } else {
-                                memset(wrqu.ap_addr.sa_data, '\0', ETH_ALEN);
-                                wrqu.ap_addr.sa_family = ARPHRD_ETHER;
+                        } else if (!scan_forceloss) {
+                                if (auto_wep && !apriv->expires) {
+                                        apriv->expires = RUN_AT(3*HZ);
+                                        wake_up_interruptible(&apriv->thr_wait);
+                                }
 
                                 /* Send event to user space */
+                                memset(wrqu.ap_addr.sa_data, '\0', ETH_ALEN);
+                                wrqu.ap_addr.sa_family = ARPHRD_ETHER;
                                 wireless_send_event(dev, SIOCGIWAP, &wrqu,NULL);
                         }
                 }
@@ -7136,10 +7124,10 @@ static int airo_set_scan(struct net_device *dev,
                 goto out;
 
         /* Initiate a scan command */
+        ai->scan_timeout = RUN_AT(3*HZ);
         memset(&cmd, 0, sizeof(cmd));
         cmd.cmd=CMD_LISTBSS;
         issuecommand(ai, &cmd, &rsp);
-        ai->scan_timeout = RUN_AT(3*HZ);
         wake = 1;
 
 out:
diff --git a/drivers/net/wireless/atmel.c b/drivers/net/wireless/atmel.c
index 87afa6878f26..8606c88886fc 100644
--- a/drivers/net/wireless/atmel.c
+++ b/drivers/net/wireless/atmel.c
@@ -3463,6 +3463,7 @@ static void atmel_command_irq(struct atmel_private *priv)
         u8 status = atmel_rmem8(priv, atmel_co(priv, CMD_BLOCK_STATUS_OFFSET));
         u8 command = atmel_rmem8(priv, atmel_co(priv, CMD_BLOCK_COMMAND_OFFSET));
         int fast_scan;
+        union iwreq_data wrqu;
 
         if (status == CMD_STATUS_IDLE ||
             status == CMD_STATUS_IN_PROGRESS)
@@ -3487,6 +3488,7 @@ static void atmel_command_irq(struct atmel_private *priv)
                         atmel_scan(priv, 1);
                 } else {
                         int bss_index = retrieve_bss(priv);
+                        int notify_scan_complete = 1;
                         if (bss_index != -1) {
                                 atmel_join_bss(priv, bss_index);
                         } else if (priv->operating_mode == IW_MODE_ADHOC &&
@@ -3495,8 +3497,14 @@ static void atmel_command_irq(struct atmel_private *priv)
                         } else {
                                 priv->fast_scan = !fast_scan;
                                 atmel_scan(priv, 1);
+                                notify_scan_complete = 0;
                         }
                         priv->site_survey_state = SITE_SURVEY_COMPLETED;
+                        if (notify_scan_complete) {
+                                wrqu.data.length = 0;
+                                wrqu.data.flags = 0;
+                                wireless_send_event(priv->dev, SIOCGIWSCAN, &wrqu, NULL);
+                        }
                 }
                 break;
 
@@ -3509,6 +3517,9 @@ static void atmel_command_irq(struct atmel_private *priv)
                 priv->site_survey_state = SITE_SURVEY_COMPLETED;
                 if (priv->station_is_associated) {
                         atmel_enter_state(priv, STATION_STATE_READY);
+                        wrqu.data.length = 0;
+                        wrqu.data.flags = 0;
+                        wireless_send_event(priv->dev, SIOCGIWSCAN, &wrqu, NULL);
                 } else {
                         atmel_scan(priv, 1);
                 }
diff --git a/drivers/net/wireless/bcm43xx/Kconfig b/drivers/net/wireless/bcm43xx/Kconfig
index 418465600a77..25ea4748f0b9 100644
--- a/drivers/net/wireless/bcm43xx/Kconfig
+++ b/drivers/net/wireless/bcm43xx/Kconfig
@@ -17,8 +17,11 @@ config BCM43XX_DEBUG
 
 config BCM43XX_DMA
         bool
+        depends on BCM43XX
+
 config BCM43XX_PIO
         bool
+        depends on BCM43XX
 
 choice
         prompt "BCM43xx data transfer mode"
diff --git a/drivers/net/wireless/bcm43xx/bcm43xx.h b/drivers/net/wireless/bcm43xx/bcm43xx.h
index dcadd295de4f..2e83083935e1 100644
--- a/drivers/net/wireless/bcm43xx/bcm43xx.h
+++ b/drivers/net/wireless/bcm43xx/bcm43xx.h
@@ -15,7 +15,6 @@
 
 #include "bcm43xx_debugfs.h"
 #include "bcm43xx_leds.h"
-#include "bcm43xx_sysfs.h"
 
 
 #define PFX                             KBUILD_MODNAME ": "
@@ -638,8 +637,6 @@ struct bcm43xx_key {
 };
 
 struct bcm43xx_private {
-        struct bcm43xx_sysfs sysfs;
-
         struct ieee80211_device *ieee;
         struct ieee80211softmac_device *softmac;
 
@@ -772,6 +769,20 @@ struct bcm43xx_private * bcm43xx_priv(struct net_device *dev)
         return ieee80211softmac_priv(dev);
 }
 
+struct device;
+
+static inline
+struct bcm43xx_private * dev_to_bcm(struct device *dev)
+{
+        struct net_device *net_dev;
+        struct bcm43xx_private *bcm;
+
+        net_dev = dev_get_drvdata(dev);
+        bcm = bcm43xx_priv(net_dev);
+
+        return bcm;
+}
+
 
 /* Helper function, which returns a boolean.
  * TRUE, if PIO is used; FALSE, if DMA is used.
diff --git a/drivers/net/wireless/bcm43xx/bcm43xx_debugfs.c b/drivers/net/wireless/bcm43xx/bcm43xx_debugfs.c
index d2c3401e9b70..35a4fcb6d923 100644
--- a/drivers/net/wireless/bcm43xx/bcm43xx_debugfs.c
+++ b/drivers/net/wireless/bcm43xx/bcm43xx_debugfs.c
@@ -452,12 +452,12 @@ void bcm43xx_printk_dump(const char *data,
         size_t i;
         char c;
 
-        printk(KERN_INFO PFX "Data dump (%s, %u bytes):",
+        printk(KERN_INFO PFX "Data dump (%s, %zd bytes):",
                description, size);
         for (i = 0; i < size; i++) {
                 c = data[i];
                 if (i % 8 == 0)
-                        printk("\n" KERN_INFO PFX "0x%08x:  0x%02x, ", i, c & 0xff);
+                        printk("\n" KERN_INFO PFX "0x%08zx:  0x%02x, ", i, c & 0xff);
                 else
                         printk("0x%02x, ", c & 0xff);
         }
@@ -472,12 +472,12 @@ void bcm43xx_printk_bitdump(const unsigned char *data,
         int j;
         const unsigned char *d;
 
-        printk(KERN_INFO PFX "*** Bitdump (%s, %u bytes, %s) ***",
+        printk(KERN_INFO PFX "*** Bitdump (%s, %zd bytes, %s) ***",
                description, bytes, msb_to_lsb ? "MSB to LSB" : "LSB to MSB");
         for (i = 0; i < bytes; i++) {
                 d = data + i;
                 if (i % 8 == 0)
-                        printk("\n" KERN_INFO PFX "0x%08x:  ", i);
+                        printk("\n" KERN_INFO PFX "0x%08zx:  ", i);
                 if (msb_to_lsb) {
                         for (j = 7; j >= 0; j--) {
                                 if (*d & (1 << j))
diff --git a/drivers/net/wireless/bcm43xx/bcm43xx_dma.c b/drivers/net/wireless/bcm43xx/bcm43xx_dma.c
index c3681b8f09b4..bbecba02e697 100644
--- a/drivers/net/wireless/bcm43xx/bcm43xx_dma.c
+++ b/drivers/net/wireless/bcm43xx/bcm43xx_dma.c
@@ -196,8 +196,9 @@ static int alloc_ringmemory(struct bcm43xx_dmaring *ring)
         }
         if (ring->dmabase + BCM43xx_DMA_RINGMEMSIZE > BCM43xx_DMA_BUSADDRMAX) {
                 printk(KERN_ERR PFX ">>>FATAL ERROR<<<  DMA RINGMEMORY >1G "
-                                    "(0x%08x, len: %lu)\n",
-                       ring->dmabase, BCM43xx_DMA_RINGMEMSIZE);
+                                    "(0x%llx, len: %lu)\n",
+                                (unsigned long long)ring->dmabase,
+                                BCM43xx_DMA_RINGMEMSIZE);
                 dma_free_coherent(dev, BCM43xx_DMA_RINGMEMSIZE,
                                   ring->vbase, ring->dmabase);
                 return -ENOMEM;
@@ -307,8 +308,8 @@ static int setup_rx_descbuffer(struct bcm43xx_dmaring *ring,
                 unmap_descbuffer(ring, dmaaddr, ring->rx_buffersize, 0);
                 dev_kfree_skb_any(skb);
                 printk(KERN_ERR PFX ">>>FATAL ERROR<<<  DMA RX SKB >1G "
-                                    "(0x%08x, len: %u)\n",
-                       dmaaddr, ring->rx_buffersize);
+                                    "(0x%llx, len: %u)\n",
+                        (unsigned long long)dmaaddr, ring->rx_buffersize);
                 return -ENOMEM;
         }
         meta->skb = skb;
@@ -729,8 +730,8 @@ static int dma_tx_fragment(struct bcm43xx_dmaring *ring,
         if (unlikely(meta->dmaaddr + skb->len > BCM43xx_DMA_BUSADDRMAX)) {
                 return_slot(ring, slot);
                 printk(KERN_ERR PFX ">>>FATAL ERROR<<<  DMA TX SKB >1G "
-                                    "(0x%08x, len: %u)\n",
-                       meta->dmaaddr, skb->len);
+                                    "(0x%llx, len: %u)\n",
+                        (unsigned long long)meta->dmaaddr, skb->len);
                 return -ENOMEM;
         }
 
diff --git a/drivers/net/wireless/bcm43xx/bcm43xx_dma.h b/drivers/net/wireless/bcm43xx/bcm43xx_dma.h
index 2d520e4b0276..b7d77638ba8c 100644
--- a/drivers/net/wireless/bcm43xx/bcm43xx_dma.h
+++ b/drivers/net/wireless/bcm43xx/bcm43xx_dma.h
@@ -213,6 +213,14 @@ static inline
 void bcm43xx_dma_rx(struct bcm43xx_dmaring *ring)
 {
 }
+static inline
+void bcm43xx_dma_tx_suspend(struct bcm43xx_dmaring *ring)
+{
+}
+static inline
+void bcm43xx_dma_tx_resume(struct bcm43xx_dmaring *ring)
+{
+}
 
 #endif /* CONFIG_BCM43XX_DMA */
 #endif /* BCM43xx_DMA_H_ */
diff --git a/drivers/net/wireless/bcm43xx/bcm43xx_main.c b/drivers/net/wireless/bcm43xx/bcm43xx_main.c
index c37371fc9e01..e2982a83ae42 100644
--- a/drivers/net/wireless/bcm43xx/bcm43xx_main.c
+++ b/drivers/net/wireless/bcm43xx/bcm43xx_main.c
@@ -52,6 +52,7 @@
 #include "bcm43xx_wx.h"
 #include "bcm43xx_ethtool.h"
 #include "bcm43xx_xmit.h"
+#include "bcm43xx_sysfs.h"
 
 
 MODULE_DESCRIPTION("Broadcom BCM43xx wireless driver");
@@ -938,9 +939,9 @@ static int bcm43xx_sprom_extract(struct bcm43xx_private *bcm)
         return 0;
 }
 
-static void bcm43xx_geo_init(struct bcm43xx_private *bcm)
+static int bcm43xx_geo_init(struct bcm43xx_private *bcm)
 {
-        struct ieee80211_geo geo;
+        struct ieee80211_geo *geo;
         struct ieee80211_channel *chan;
         int have_a = 0, have_bg = 0;
         int i;
@@ -948,7 +949,10 @@ static void bcm43xx_geo_init(struct bcm43xx_private *bcm)
         struct bcm43xx_phyinfo *phy;
         const char *iso_country;
 
-        memset(&geo, 0, sizeof(geo));
+        geo = kzalloc(sizeof(*geo), GFP_KERNEL);
+        if (!geo)
+                return -ENOMEM;
+
         for (i = 0; i < bcm->nr_80211_available; i++) {
                 phy = &(bcm->core_80211_ext[i].phy);
                 switch (phy->type) {
@@ -966,31 +970,36 @@ static void bcm43xx_geo_init(struct bcm43xx_private *bcm)
         iso_country = bcm43xx_locale_iso(bcm->sprom.locale);
 
         if (have_a) {
-                for (i = 0, channel = 0; channel < 201; channel++) {
-                        chan = &geo.a[i++];
+                for (i = 0, channel = IEEE80211_52GHZ_MIN_CHANNEL;
+                      channel <= IEEE80211_52GHZ_MAX_CHANNEL; channel++) {
+                        chan = &geo->a[i++];
                         chan->freq = bcm43xx_channel_to_freq_a(channel);
                         chan->channel = channel;
                 }
-                geo.a_channels = i;
+                geo->a_channels = i;
         }
         if (have_bg) {
-                for (i = 0, channel = 1; channel < 15; channel++) {
-                        chan = &geo.bg[i++];
+                for (i = 0, channel = IEEE80211_24GHZ_MIN_CHANNEL;
+                      channel <= IEEE80211_24GHZ_MAX_CHANNEL; channel++) {
+                        chan = &geo->bg[i++];
                         chan->freq = bcm43xx_channel_to_freq_bg(channel);
                         chan->channel = channel;
                 }
-                geo.bg_channels = i;
+                geo->bg_channels = i;
         }
-        memcpy(geo.name, iso_country, 2);
+        memcpy(geo->name, iso_country, 2);
         if (0 /*TODO: Outdoor use only */)
-                geo.name[2] = 'O';
+                geo->name[2] = 'O';
         else if (0 /*TODO: Indoor use only */)
-                geo.name[2] = 'I';
+                geo->name[2] = 'I';
         else
-                geo.name[2] = ' ';
-        geo.name[3] = '\0';
+                geo->name[2] = ' ';
+        geo->name[3] = '\0';
+
+        ieee80211_set_geo(bcm->ieee, geo);
+        kfree(geo);
 
-        ieee80211_set_geo(bcm->ieee, &geo);
+        return 0;
 }
 
 /* DummyTransmission function, as documented on 
@@ -3478,16 +3487,17 @@ static int bcm43xx_attach_board(struct bcm43xx_private *bcm)
                         goto err_80211_unwind;
                 bcm43xx_wireless_core_disable(bcm);
         }
+        err = bcm43xx_geo_init(bcm);
+        if (err)
+                goto err_80211_unwind;
         bcm43xx_pctl_set_crystal(bcm, 0);
 
         /* Set the MAC address in the networking subsystem */
-        if (bcm43xx_current_phy(bcm)->type == BCM43xx_PHYTYPE_A)
+        if (is_valid_ether_addr(bcm->sprom.et1macaddr))
                 memcpy(bcm->net_dev->dev_addr, bcm->sprom.et1macaddr, 6);
         else
                 memcpy(bcm->net_dev->dev_addr, bcm->sprom.il0macaddr, 6);
 
-        bcm43xx_geo_init(bcm);
-
         snprintf(bcm->nick, IW_ESSID_MAX_SIZE,
                  "Broadcom %04X", bcm->chip_id);
 
@@ -3522,6 +3532,7 @@ static inline int bcm43xx_tx(struct bcm43xx_private *bcm,
                 err = bcm43xx_pio_tx(bcm, txb);
         else
                 err = bcm43xx_dma_tx(bcm, txb);
+        bcm->net_dev->trans_start = jiffies;
 
         return err;
 }
diff --git a/drivers/net/wireless/bcm43xx/bcm43xx_main.h b/drivers/net/wireless/bcm43xx/bcm43xx_main.h
index eca79a38594a..30a202b258b5 100644
--- a/drivers/net/wireless/bcm43xx/bcm43xx_main.h
+++ b/drivers/net/wireless/bcm43xx/bcm43xx_main.h
@@ -118,12 +118,14 @@ int bcm43xx_channel_to_freq(struct bcm43xx_private *bcm,
 static inline
 int bcm43xx_is_valid_channel_a(u8 channel)
 {
-        return (channel <= 200);
+        return (channel >= IEEE80211_52GHZ_MIN_CHANNEL
+               && channel <= IEEE80211_52GHZ_MAX_CHANNEL);
 }
 static inline
 int bcm43xx_is_valid_channel_bg(u8 channel)
 {
-        return (channel >= 1 && channel <= 14);
+        return (channel >= IEEE80211_24GHZ_MIN_CHANNEL
+               && channel <= IEEE80211_24GHZ_MAX_CHANNEL);
 }
 static inline
 int bcm43xx_is_valid_channel(struct bcm43xx_private *bcm,
diff --git a/drivers/net/wireless/bcm43xx/bcm43xx_phy.c b/drivers/net/wireless/bcm43xx/bcm43xx_phy.c
index 0a66f43ca0c0..b0abac515530 100644
--- a/drivers/net/wireless/bcm43xx/bcm43xx_phy.c
+++ b/drivers/net/wireless/bcm43xx/bcm43xx_phy.c
@@ -1287,7 +1287,7 @@ static void bcm43xx_phy_initg(struct bcm43xx_private *bcm)
         if (radio->revision == 8)
                 bcm43xx_phy_write(bcm, 0x0805, 0x3230);
         bcm43xx_phy_init_pctl(bcm);
-        if (bcm->chip_id == 0x4306 && bcm->chip_package != 2) {
+        if (bcm->chip_id == 0x4306 && bcm->chip_package == 2) {
                 bcm43xx_phy_write(bcm, 0x0429,
                                   bcm43xx_phy_read(bcm, 0x0429) & 0xBFFF);
                 bcm43xx_phy_write(bcm, 0x04C3,
@@ -2151,6 +2151,7 @@ int bcm43xx_phy_init_tssi2dbm_table(struct bcm43xx_private *bcm)
                                 phy->tssi2dbm = NULL;
                                 printk(KERN_ERR PFX "Could not generate "
                                                     "tssi2dBm table\n");
+                                kfree(dyn_tssi2dbm);
                                 return -ENODEV;
                         }
                 phy->tssi2dbm = dyn_tssi2dbm;
diff --git a/drivers/net/wireless/bcm43xx/bcm43xx_pio.c b/drivers/net/wireless/bcm43xx/bcm43xx_pio.c
index c59ddd40680d..0aa1bd269a25 100644
--- a/drivers/net/wireless/bcm43xx/bcm43xx_pio.c
+++ b/drivers/net/wireless/bcm43xx/bcm43xx_pio.c
@@ -27,6 +27,7 @@
 #include "bcm43xx_pio.h"
 #include "bcm43xx_main.h"
 #include "bcm43xx_xmit.h"
+#include "bcm43xx_power.h"
 
 #include <linux/delay.h>
 
@@ -44,10 +45,10 @@ static void tx_octet(struct bcm43xx_pioqueue *queue,
                 bcm43xx_pio_write(queue, BCM43xx_PIO_TXDATA,
                                   octet);
                 bcm43xx_pio_write(queue, BCM43xx_PIO_TXCTL,
-                                  BCM43xx_PIO_TXCTL_WRITEHI);
+                                  BCM43xx_PIO_TXCTL_WRITELO);
         } else {
                 bcm43xx_pio_write(queue, BCM43xx_PIO_TXCTL,
-                                  BCM43xx_PIO_TXCTL_WRITEHI);
+                                  BCM43xx_PIO_TXCTL_WRITELO);
                 bcm43xx_pio_write(queue, BCM43xx_PIO_TXDATA,
                                   octet);
         }
@@ -103,7 +104,7 @@ static void tx_complete(struct bcm43xx_pioqueue *queue,
                 bcm43xx_pio_write(queue, BCM43xx_PIO_TXDATA,
                                   skb->data[skb->len - 1]);
                 bcm43xx_pio_write(queue, BCM43xx_PIO_TXCTL,
-                                  BCM43xx_PIO_TXCTL_WRITEHI |
+                                  BCM43xx_PIO_TXCTL_WRITELO |
                                   BCM43xx_PIO_TXCTL_COMPLETE);
         } else {
                 bcm43xx_pio_write(queue, BCM43xx_PIO_TXCTL,
@@ -112,9 +113,10 @@ static void tx_complete(struct bcm43xx_pioqueue *queue,
 }
 
 static u16 generate_cookie(struct bcm43xx_pioqueue *queue,
-                           int packetindex)
+                           struct bcm43xx_pio_txpacket *packet)
 {
         u16 cookie = 0x0000;
+        int packetindex;
 
         /* We use the upper 4 bits for the PIO
          * controller ID and the lower 12 bits
@@ -135,6 +137,7 @@ static u16 generate_cookie(struct bcm43xx_pioqueue *queue,
         default:
                 assert(0);
         }
+        packetindex = pio_txpacket_getindex(packet);
         assert(((u16)packetindex & 0xF000) == 0x0000);
         cookie |= (u16)packetindex;
 
@@ -184,7 +187,7 @@ static void pio_tx_write_fragment(struct bcm43xx_pioqueue *queue,
         bcm43xx_generate_txhdr(queue->bcm,
                                &txhdr, skb->data, skb->len,
                                (packet->xmitted_frags == 0),
-                               generate_cookie(queue, pio_txpacket_getindex(packet)));
+                               generate_cookie(queue, packet));
 
         tx_start(queue);
         octets = skb->len + sizeof(txhdr);
@@ -241,7 +244,7 @@ static int pio_tx_packet(struct bcm43xx_pio_txpacket *packet)
                 queue->tx_devq_packets++;
                 queue->tx_devq_used += octets;
 
-                assert(packet->xmitted_frags <= packet->txb->nr_frags);
+                assert(packet->xmitted_frags < packet->txb->nr_frags);
                 packet->xmitted_frags++;
                 packet->xmitted_octets += octets;
         }
@@ -257,8 +260,14 @@ static void tx_tasklet(unsigned long d)
         unsigned long flags;
         struct bcm43xx_pio_txpacket *packet, *tmp_packet;
         int err;
+        u16 txctl;
 
         bcm43xx_lock_mmio(bcm, flags);
+
+        txctl = bcm43xx_pio_read(queue, BCM43xx_PIO_TXCTL);
+        if (txctl & BCM43xx_PIO_TXCTL_SUSPEND)
+                goto out_unlock;
+
         list_for_each_entry_safe(packet, tmp_packet, &queue->txqueue, list) {
                 assert(packet->xmitted_frags < packet->txb->nr_frags);
                 if (packet->xmitted_frags == 0) {
@@ -288,6 +297,7 @@ static void tx_tasklet(unsigned long d)
         next_packet:
                 continue;
         }
+out_unlock:
         bcm43xx_unlock_mmio(bcm, flags);
 }
 
@@ -330,12 +340,19 @@ struct bcm43xx_pioqueue * bcm43xx_setup_pioqueue(struct bcm43xx_private *bcm,
                      (unsigned long)queue);
 
         value = bcm43xx_read32(bcm, BCM43xx_MMIO_STATUS_BITFIELD);
-        value |= BCM43xx_SBF_XFER_REG_BYTESWAP;
+        value &= ~BCM43xx_SBF_XFER_REG_BYTESWAP;
         bcm43xx_write32(bcm, BCM43xx_MMIO_STATUS_BITFIELD, value);
 
         qsize = bcm43xx_read16(bcm, queue->mmio_base + BCM43xx_PIO_TXQBUFSIZE);
+        if (qsize == 0) {
+                printk(KERN_ERR PFX "ERROR: This card does not support PIO "
+                                    "operation mode. Please use DMA mode "
+                                    "(module parameter pio=0).\n");
+                goto err_freequeue;
+        }
         if (qsize <= BCM43xx_PIO_TXQADJUST) {
-                printk(KERN_ERR PFX "PIO tx device-queue too small (%u)\n", qsize);
+                printk(KERN_ERR PFX "PIO tx device-queue too small (%u)\n",
+                       qsize);
                 goto err_freequeue;
         }
         qsize -= BCM43xx_PIO_TXQADJUST;
@@ -444,15 +461,10 @@ int bcm43xx_pio_tx(struct bcm43xx_private *bcm,
 {
         struct bcm43xx_pioqueue *queue = bcm43xx_current_pio(bcm)->queue1;
         struct bcm43xx_pio_txpacket *packet;
-        u16 tmp;
 
         assert(!queue->tx_suspended);
         assert(!list_empty(&queue->txfree));
 
-        tmp = bcm43xx_pio_read(queue, BCM43xx_PIO_TXCTL);
-        if (tmp & BCM43xx_PIO_TXCTL_SUSPEND)
-                return -EBUSY;
-
         packet = list_entry(queue->txfree.next, struct bcm43xx_pio_txpacket, list);
         packet->txb = txb;
         packet->xmitted_frags = 0;
@@ -462,7 +474,7 @@ int bcm43xx_pio_tx(struct bcm43xx_private *bcm,
         assert(queue->nr_txfree < BCM43xx_PIO_MAXTXPACKETS);
 
         /* Suspend TX, if we are out of packets in the "free" queue. */
-        if (unlikely(list_empty(&queue->txfree))) {
+        if (list_empty(&queue->txfree)) {
                 netif_stop_queue(queue->bcm->net_dev);
                 queue->tx_suspended = 1;
         }
@@ -480,15 +492,15 @@ void bcm43xx_pio_handle_xmitstatus(struct bcm43xx_private *bcm,
 
         queue = parse_cookie(bcm, status->cookie, &packet);
         assert(queue);
-//TODO
-if (!queue)
-return;
+
         free_txpacket(packet, 1);
-        if (unlikely(queue->tx_suspended)) {
+        if (queue->tx_suspended) {
                 queue->tx_suspended = 0;
                 netif_wake_queue(queue->bcm->net_dev);
         }
-        /* If there are packets on the txqueue, poke the tasklet. */
+        /* If there are packets on the txqueue, poke the tasklet
+         * to transmit them.
+         */
         if (!list_empty(&queue->txqueue))
                 tasklet_schedule(&queue->txtask);
 }
@@ -519,12 +531,9 @@ void bcm43xx_pio_rx(struct bcm43xx_pioqueue *queue)
         int i, preamble_readwords;
         struct sk_buff *skb;
 
-return;
         tmp = bcm43xx_pio_read(queue, BCM43xx_PIO_RXCTL);
-        if (!(tmp & BCM43xx_PIO_RXCTL_DATAAVAILABLE)) {
-                dprintkl(KERN_ERR PFX "PIO RX: No data available\n");//TODO: remove this printk.
+        if (!(tmp & BCM43xx_PIO_RXCTL_DATAAVAILABLE))
                 return;
-        }
         bcm43xx_pio_write(queue, BCM43xx_PIO_RXCTL,
                           BCM43xx_PIO_RXCTL_DATAAVAILABLE);
 
@@ -538,8 +547,7 @@ return;
         return;
 data_ready:
 
-//FIXME: endianess in this function.
-        len = le16_to_cpu(bcm43xx_pio_read(queue, BCM43xx_PIO_RXDATA));
+        len = bcm43xx_pio_read(queue, BCM43xx_PIO_RXDATA);
         if (unlikely(len > 0x700)) {
                 pio_rx_error(queue, 0, "len > 0x700");
                 return;
@@ -555,7 +563,7 @@ data_ready:
                 preamble_readwords = 18 / sizeof(u16);
         for (i = 0; i < preamble_readwords; i++) {
                 tmp = bcm43xx_pio_read(queue, BCM43xx_PIO_RXDATA);
-                preamble[i + 1] = cpu_to_be16(tmp);//FIXME?
+                preamble[i + 1] = cpu_to_le16(tmp);
         }
         rxhdr = (struct bcm43xx_rxhdr *)preamble;
         rxflags2 = le16_to_cpu(rxhdr->flags2);
@@ -591,16 +599,40 @@ data_ready:
         }
         skb_put(skb, len);
         for (i = 0; i < len - 1; i += 2) {
-                tmp = cpu_to_be16(bcm43xx_pio_read(queue, BCM43xx_PIO_RXDATA));
-                *((u16 *)(skb->data + i)) = tmp;
+                tmp = bcm43xx_pio_read(queue, BCM43xx_PIO_RXDATA);
+                *((u16 *)(skb->data + i)) = cpu_to_le16(tmp);
         }
         if (len % 2) {
                 tmp = bcm43xx_pio_read(queue, BCM43xx_PIO_RXDATA);
                 skb->data[len - 1] = (tmp & 0x00FF);
+/* The specs say the following is required, but
+ * it is wrong and corrupts the PLCP. If we don't do
+ * this, the PLCP seems to be correct. So ifdef it out for now.
+ */
+#if 0
                 if (rxflags2 & BCM43xx_RXHDR_FLAGS2_TYPE2FRAME)
-                        skb->data[0x20] = (tmp & 0xFF00) >> 8;
+                        skb->data[2] = (tmp & 0xFF00) >> 8;
                 else
-                        skb->data[0x1E] = (tmp & 0xFF00) >> 8;
+                        skb->data[0] = (tmp & 0xFF00) >> 8;
+#endif
         }
+        skb_trim(skb, len - IEEE80211_FCS_LEN);
         bcm43xx_rx(queue->bcm, skb, rxhdr);
 }
+
+void bcm43xx_pio_tx_suspend(struct bcm43xx_pioqueue *queue)
+{
+        bcm43xx_power_saving_ctl_bits(queue->bcm, -1, 1);
+        bcm43xx_pio_write(queue, BCM43xx_PIO_TXCTL,
+                          bcm43xx_pio_read(queue, BCM43xx_PIO_TXCTL)
+                          | BCM43xx_PIO_TXCTL_SUSPEND);
+}
+
+void bcm43xx_pio_tx_resume(struct bcm43xx_pioqueue *queue)
+{
+        bcm43xx_pio_write(queue, BCM43xx_PIO_TXCTL,
+                          bcm43xx_pio_read(queue, BCM43xx_PIO_TXCTL)
+                          & ~BCM43xx_PIO_TXCTL_SUSPEND);
+        bcm43xx_power_saving_ctl_bits(queue->bcm, -1, -1);
+        tasklet_schedule(&queue->txtask);
+}
diff --git a/drivers/net/wireless/bcm43xx/bcm43xx_pio.h b/drivers/net/wireless/bcm43xx/bcm43xx_pio.h
index 970627bc1769..dfc78209e3a3 100644
--- a/drivers/net/wireless/bcm43xx/bcm43xx_pio.h
+++ b/drivers/net/wireless/bcm43xx/bcm43xx_pio.h
@@ -14,8 +14,8 @@
 #define BCM43xx_PIO_RXCTL               0x08
 #define BCM43xx_PIO_RXDATA              0x0A
 
-#define BCM43xx_PIO_TXCTL_WRITEHI       (1 << 0)
-#define BCM43xx_PIO_TXCTL_WRITELO       (1 << 1)
+#define BCM43xx_PIO_TXCTL_WRITELO       (1 << 0)
+#define BCM43xx_PIO_TXCTL_WRITEHI       (1 << 1)
 #define BCM43xx_PIO_TXCTL_COMPLETE      (1 << 2)
 #define BCM43xx_PIO_TXCTL_INIT          (1 << 3)
 #define BCM43xx_PIO_TXCTL_SUSPEND       (1 << 7)
@@ -95,6 +95,7 @@ void bcm43xx_pio_write(struct bcm43xx_pioqueue *queue,
                        u16 offset, u16 value)
 {
         bcm43xx_write16(queue->bcm, queue->mmio_base + offset, value);
+        mmiowb();
 }
 
 
@@ -107,6 +108,9 @@ void bcm43xx_pio_handle_xmitstatus(struct bcm43xx_private *bcm,
                                    struct bcm43xx_xmitstatus *status);
 void bcm43xx_pio_rx(struct bcm43xx_pioqueue *queue);
 
+void bcm43xx_pio_tx_suspend(struct bcm43xx_pioqueue *queue);
+void bcm43xx_pio_tx_resume(struct bcm43xx_pioqueue *queue);
+
 #else /* CONFIG_BCM43XX_PIO */
 
 static inline
@@ -133,6 +137,14 @@ static inline
 void bcm43xx_pio_rx(struct bcm43xx_pioqueue *queue)
 {
 }
+static inline
+void bcm43xx_pio_tx_suspend(struct bcm43xx_pioqueue *queue)
+{
+}
+static inline
+void bcm43xx_pio_tx_resume(struct bcm43xx_pioqueue *queue)
+{
+}
 
 #endif /* CONFIG_BCM43XX_PIO */
 #endif /* BCM43xx_PIO_H_ */
diff --git a/drivers/net/wireless/bcm43xx/bcm43xx_power.c b/drivers/net/wireless/bcm43xx/bcm43xx_power.c
index 3c92b62807c5..6569da3a7a39 100644
--- a/drivers/net/wireless/bcm43xx/bcm43xx_power.c
+++ b/drivers/net/wireless/bcm43xx/bcm43xx_power.c
@@ -35,77 +35,101 @@
 #include "bcm43xx_main.h"
 
 
+/* Get the Slow Clock Source */
+static int bcm43xx_pctl_get_slowclksrc(struct bcm43xx_private *bcm)
+{
+        u32 tmp;
+        int err;
+
+        assert(bcm->current_core == &bcm->core_chipcommon);
+        if (bcm->current_core->rev < 6) {
+                if (bcm->bustype == BCM43xx_BUSTYPE_PCMCIA ||
+                    bcm->bustype == BCM43xx_BUSTYPE_SB)
+                        return BCM43xx_PCTL_CLKSRC_XTALOS;
+                if (bcm->bustype == BCM43xx_BUSTYPE_PCI) {
+                        err = bcm43xx_pci_read_config32(bcm, BCM43xx_PCTL_OUT, &tmp);
+                        assert(!err);
+                        if (tmp & 0x10)
+                                return BCM43xx_PCTL_CLKSRC_PCI;
+                        return BCM43xx_PCTL_CLKSRC_XTALOS;
+                }
+        }
+        if (bcm->current_core->rev < 10) {
+                tmp = bcm43xx_read32(bcm, BCM43xx_CHIPCOMMON_SLOWCLKCTL);
+                tmp &= 0x7;
+                if (tmp == 0)
+                        return BCM43xx_PCTL_CLKSRC_LOPWROS;
+                if (tmp == 1)
+                        return BCM43xx_PCTL_CLKSRC_XTALOS;
+                if (tmp == 2)
+                        return BCM43xx_PCTL_CLKSRC_PCI;
+        }
+
+        return BCM43xx_PCTL_CLKSRC_XTALOS;
+}
+
 /* Get max/min slowclock frequency
  * as described in http://bcm-specs.sipsolutions.net/PowerControl
  */
 static int bcm43xx_pctl_clockfreqlimit(struct bcm43xx_private *bcm,
                                        int get_max)
 {
-        int limit = 0;
+        int limit;
+        int clocksrc;
         int divisor;
-        int selection;
-        int err;
         u32 tmp;
-        struct bcm43xx_coreinfo *old_core;
 
-        if (!(bcm->chipcommon_capabilities & BCM43xx_CAPABILITIES_PCTL))
-                goto out;
-        old_core = bcm->current_core;
-        err = bcm43xx_switch_core(bcm, &bcm->core_chipcommon);
-        if (err)
-                goto out;
+        assert(bcm->chipcommon_capabilities & BCM43xx_CAPABILITIES_PCTL);
+        assert(bcm->current_core == &bcm->core_chipcommon);
 
+        clocksrc = bcm43xx_pctl_get_slowclksrc(bcm);
         if (bcm->current_core->rev < 6) {
-                if ((bcm->bustype == BCM43xx_BUSTYPE_PCMCIA) ||
-                        (bcm->bustype == BCM43xx_BUSTYPE_SB)) {
-                        selection = 1;
+                switch (clocksrc) {
+                case BCM43xx_PCTL_CLKSRC_PCI:
+                        divisor = 64;
+                        break;
+                case BCM43xx_PCTL_CLKSRC_XTALOS:
                         divisor = 32;
-                } else {
-                        err = bcm43xx_pci_read_config32(bcm, BCM43xx_PCTL_OUT, &tmp);
-                        if (err) {
-                                printk(KERN_ERR PFX "clockfreqlimit pcicfg read failure\n");
-                                goto out_switchback;
-                        }
-                        if (tmp & 0x10) {
-                                /* PCI */
-                                selection = 2;
-                                divisor = 64;
-                        } else {
-                                /* XTAL */
-                                selection = 1;
-                                divisor = 32;
-                        }
+                        break;
+                default:
+                        assert(0);
+                        divisor = 1;
                 }
         } else if (bcm->current_core->rev < 10) {
-                selection = (tmp & 0x07);
-                if (selection) {
+                switch (clocksrc) {
+                case BCM43xx_PCTL_CLKSRC_LOPWROS:
+                        divisor = 1;
+                        break;
+                case BCM43xx_PCTL_CLKSRC_XTALOS:
+                case BCM43xx_PCTL_CLKSRC_PCI:
                         tmp = bcm43xx_read32(bcm, BCM43xx_CHIPCOMMON_SLOWCLKCTL);
-                        divisor = 4 * (1 + ((tmp & 0xFFFF0000) >> 16));
-                } else
+                        divisor = ((tmp & 0xFFFF0000) >> 16) + 1;
+                        divisor *= 4;
+                        break;
+                default:
+                        assert(0);
                         divisor = 1;
+                }
         } else {
                 tmp = bcm43xx_read32(bcm, BCM43xx_CHIPCOMMON_SYSCLKCTL);
-                divisor = 4 * (1 + ((tmp & 0xFFFF0000) >> 16));
-                selection = 1;
+                divisor = ((tmp & 0xFFFF0000) >> 16) + 1;
+                divisor *= 4;
         }
-        
-        switch (selection) {
-        case 0:
-                /* LPO */
+
+        switch (clocksrc) {
+        case BCM43xx_PCTL_CLKSRC_LOPWROS:
                 if (get_max)
                         limit = 43000;
                 else
                         limit = 25000;
                 break;
-        case 1:
-                /* XTAL */
+        case BCM43xx_PCTL_CLKSRC_XTALOS:
                 if (get_max)
                         limit = 20200000;
                 else
                         limit = 19800000;
                 break;
-        case 2:
-                /* PCI */
+        case BCM43xx_PCTL_CLKSRC_PCI:
                 if (get_max)
                         limit = 34000000;
                 else
@@ -113,17 +137,14 @@ static int bcm43xx_pctl_clockfreqlimit(struct bcm43xx_private *bcm,
                 break;
         default:
                 assert(0);
+                limit = 0;
         }
         limit /= divisor;
 
-out_switchback:
-        err = bcm43xx_switch_core(bcm, old_core);
-        assert(err == 0);
-
-out:
         return limit;
 }
 
+
 /* init power control
  * as described in http://bcm-specs.sipsolutions.net/PowerControl
  */
diff --git a/drivers/net/wireless/bcm43xx/bcm43xx_power.h b/drivers/net/wireless/bcm43xx/bcm43xx_power.h
index 5f63640810bd..c966ab3a5a8c 100644
--- a/drivers/net/wireless/bcm43xx/bcm43xx_power.h
+++ b/drivers/net/wireless/bcm43xx/bcm43xx_power.h
@@ -33,6 +33,15 @@
 
 #include <linux/types.h>
 
+/* Clock sources */
+enum {
+        /* PCI clock */
+        BCM43xx_PCTL_CLKSRC_PCI,
+        /* Crystal slow clock oscillator */
+        BCM43xx_PCTL_CLKSRC_XTALOS,
+        /* Low power oscillator */
+        BCM43xx_PCTL_CLKSRC_LOPWROS,
+};
 
 struct bcm43xx_private;
 
diff --git a/drivers/net/wireless/bcm43xx/bcm43xx_sysfs.c b/drivers/net/wireless/bcm43xx/bcm43xx_sysfs.c
index c44d890b949b..b438f48e891d 100644
--- a/drivers/net/wireless/bcm43xx/bcm43xx_sysfs.c
+++ b/drivers/net/wireless/bcm43xx/bcm43xx_sysfs.c
@@ -71,14 +71,46 @@ static int get_boolean(const char *buf, size_t count)
         return -EINVAL;
 }
 
+static int sprom2hex(const u16 *sprom, char *buf, size_t buf_len)
+{
+        int i, pos = 0;
+
+        for (i = 0; i < BCM43xx_SPROM_SIZE; i++) {
+                pos += snprintf(buf + pos, buf_len - pos - 1,
+                                "%04X", swab16(sprom[i]) & 0xFFFF);
+        }
+        pos += snprintf(buf + pos, buf_len - pos - 1, "\n");
+
+        return pos + 1;
+}
+
+static int hex2sprom(u16 *sprom, const char *dump, size_t len)
+{
+        char tmp[5] = { 0 };
+        int cnt = 0;
+        unsigned long parsed;
+
+        if (len < BCM43xx_SPROM_SIZE * sizeof(u16) * 2)
+                return -EINVAL;
+
+        while (cnt < BCM43xx_SPROM_SIZE) {
+                memcpy(tmp, dump, 4);
+                dump += 4;
+                parsed = simple_strtoul(tmp, NULL, 16);
+                sprom[cnt++] = swab16((u16)parsed);
+        }
+
+        return 0;
+}
+
 static ssize_t bcm43xx_attr_sprom_show(struct device *dev,
                                        struct device_attribute *attr,
                                        char *buf)
 {
-        struct bcm43xx_private *bcm = devattr_to_bcm(attr, attr_sprom);
+        struct bcm43xx_private *bcm = dev_to_bcm(dev);
         u16 *sprom;
         unsigned long flags;
-        int i, err;
+        int err;
 
         if (!capable(CAP_NET_ADMIN))
                 return -EPERM;
@@ -91,55 +123,53 @@ static ssize_t bcm43xx_attr_sprom_show(struct device *dev,
         bcm43xx_lock_mmio(bcm, flags);
         assert(bcm->initialized);
         err = bcm43xx_sprom_read(bcm, sprom);
-        if (!err) {
-                for (i = 0; i < BCM43xx_SPROM_SIZE; i++) {
-                        buf[i * 2] = sprom[i] & 0x00FF;
-                        buf[i * 2 + 1] = (sprom[i] & 0xFF00) >> 8;
-                }
-        }
+        if (!err)
+                err = sprom2hex(sprom, buf, PAGE_SIZE);
         bcm43xx_unlock_mmio(bcm, flags);
         kfree(sprom);
 
-        return err ? err : BCM43xx_SPROM_SIZE * sizeof(u16);
+        return err;
 }
 
 static ssize_t bcm43xx_attr_sprom_store(struct device *dev,
                                         struct device_attribute *attr,
                                         const char *buf, size_t count)
 {
-        struct bcm43xx_private *bcm = devattr_to_bcm(attr, attr_sprom);
+        struct bcm43xx_private *bcm = dev_to_bcm(dev);
         u16 *sprom;
         unsigned long flags;
-        int i, err;
+        int err;
 
         if (!capable(CAP_NET_ADMIN))
                 return -EPERM;
 
-        if (count != BCM43xx_SPROM_SIZE * sizeof(u16))
-                return -EINVAL;
         sprom = kmalloc(BCM43xx_SPROM_SIZE * sizeof(*sprom),
                         GFP_KERNEL);
         if (!sprom)
                 return -ENOMEM;
-        for (i = 0; i < BCM43xx_SPROM_SIZE; i++) {
-                sprom[i] = buf[i * 2] & 0xFF;
-                sprom[i] |= ((u16)(buf[i * 2 + 1] & 0xFF)) << 8;
-        }
+        err = hex2sprom(sprom, buf, count);
+        if (err)
+                goto out_kfree;
         bcm43xx_lock_mmio(bcm, flags);
         assert(bcm->initialized);
         err = bcm43xx_sprom_write(bcm, sprom);
         bcm43xx_unlock_mmio(bcm, flags);
+out_kfree:
         kfree(sprom);
 
         return err ? err : count;
 
 }
 
+static DEVICE_ATTR(sprom, 0600,
+                   bcm43xx_attr_sprom_show,
+                   bcm43xx_attr_sprom_store);
+
 static ssize_t bcm43xx_attr_interfmode_show(struct device *dev,
                                             struct device_attribute *attr,
                                             char *buf)
 {
-        struct bcm43xx_private *bcm = devattr_to_bcm(attr, attr_interfmode);
+        struct bcm43xx_private *bcm = dev_to_bcm(dev);
         unsigned long flags;
         int err;
         ssize_t count = 0;
@@ -175,7 +205,7 @@ static ssize_t bcm43xx_attr_interfmode_store(struct device *dev,
                                              struct device_attribute *attr,
                                              const char *buf, size_t count)
 {
-        struct bcm43xx_private *bcm = devattr_to_bcm(attr, attr_interfmode);
+        struct bcm43xx_private *bcm = dev_to_bcm(dev);
         unsigned long flags;
         int err;
         int mode;
@@ -215,11 +245,15 @@ static ssize_t bcm43xx_attr_interfmode_store(struct device *dev,
         return err ? err : count;
 }
 
+static DEVICE_ATTR(interference, 0644,
+                   bcm43xx_attr_interfmode_show,
+                   bcm43xx_attr_interfmode_store);
+
 static ssize_t bcm43xx_attr_preamble_show(struct device *dev,
                                           struct device_attribute *attr,
                                           char *buf)
 {
-        struct bcm43xx_private *bcm = devattr_to_bcm(attr, attr_preamble);
+        struct bcm43xx_private *bcm = dev_to_bcm(dev);
         unsigned long flags;
         int err;
         ssize_t count;
@@ -245,7 +279,7 @@ static ssize_t bcm43xx_attr_preamble_store(struct device *dev,
                                            struct device_attribute *attr,
                                            const char *buf, size_t count)
 {
-        struct bcm43xx_private *bcm = devattr_to_bcm(attr, attr_preamble);
+        struct bcm43xx_private *bcm = dev_to_bcm(dev);
         unsigned long flags;
         int err;
         int value;
@@ -267,56 +301,41 @@ static ssize_t bcm43xx_attr_preamble_store(struct device *dev,
         return err ? err : count;
 }
 
+static DEVICE_ATTR(shortpreamble, 0644,
+                   bcm43xx_attr_preamble_show,
+                   bcm43xx_attr_preamble_store);
+
 int bcm43xx_sysfs_register(struct bcm43xx_private *bcm)
 {
         struct device *dev = &bcm->pci_dev->dev;
-        struct bcm43xx_sysfs *sysfs = &bcm->sysfs;
         int err;
 
         assert(bcm->initialized);
 
-        sysfs->attr_sprom.attr.name = "sprom";
-        sysfs->attr_sprom.attr.owner = THIS_MODULE;
-        sysfs->attr_sprom.attr.mode = 0600;
-        sysfs->attr_sprom.show = bcm43xx_attr_sprom_show;
-        sysfs->attr_sprom.store = bcm43xx_attr_sprom_store;
-        err = device_create_file(dev, &sysfs->attr_sprom);
+        err = device_create_file(dev, &dev_attr_sprom);
         if (err)
                 goto out;
-
-        sysfs->attr_interfmode.attr.name = "interference";
-        sysfs->attr_interfmode.attr.owner = THIS_MODULE;
-        sysfs->attr_interfmode.attr.mode = 0600;
-        sysfs->attr_interfmode.show = bcm43xx_attr_interfmode_show;
-        sysfs->attr_interfmode.store = bcm43xx_attr_interfmode_store;
-        err = device_create_file(dev, &sysfs->attr_interfmode);
+        err = device_create_file(dev, &dev_attr_interference);
         if (err)
                 goto err_remove_sprom;
-
-        sysfs->attr_preamble.attr.name = "shortpreamble";
-        sysfs->attr_preamble.attr.owner = THIS_MODULE;
-        sysfs->attr_preamble.attr.mode = 0600;
-        sysfs->attr_preamble.show = bcm43xx_attr_preamble_show;
-        sysfs->attr_preamble.store = bcm43xx_attr_preamble_store;
-        err = device_create_file(dev, &sysfs->attr_preamble);
+        err = device_create_file(dev, &dev_attr_shortpreamble);
         if (err)
                 goto err_remove_interfmode;
 
 out:
         return err;
 err_remove_interfmode:
-        device_remove_file(dev, &sysfs->attr_interfmode);
+        device_remove_file(dev, &dev_attr_interference);
 err_remove_sprom:
-        device_remove_file(dev, &sysfs->attr_sprom);
+        device_remove_file(dev, &dev_attr_sprom);
         goto out;
 }
 
 void bcm43xx_sysfs_unregister(struct bcm43xx_private *bcm)
 {
         struct device *dev = &bcm->pci_dev->dev;
-        struct bcm43xx_sysfs *sysfs = &bcm->sysfs;
 
-        device_remove_file(dev, &sysfs->attr_preamble);
-        device_remove_file(dev, &sysfs->attr_interfmode);
-        device_remove_file(dev, &sysfs->attr_sprom);
+        device_remove_file(dev, &dev_attr_shortpreamble);
+        device_remove_file(dev, &dev_attr_interference);
+        device_remove_file(dev, &dev_attr_sprom);
 }
diff --git a/drivers/net/wireless/bcm43xx/bcm43xx_sysfs.h b/drivers/net/wireless/bcm43xx/bcm43xx_sysfs.h
index 57f14514e3e0..cc701df71e2a 100644
--- a/drivers/net/wireless/bcm43xx/bcm43xx_sysfs.h
+++ b/drivers/net/wireless/bcm43xx/bcm43xx_sysfs.h
@@ -1,22 +1,6 @@
 #ifndef BCM43xx_SYSFS_H_
 #define BCM43xx_SYSFS_H_
 
-#include <linux/device.h>
-
-
-struct bcm43xx_sysfs {
-        struct device_attribute attr_sprom;
-        struct device_attribute attr_interfmode;
-        struct device_attribute attr_preamble;
-};
-
-#define devattr_to_bcm(attr, attr_name) ({                              \
-        struct bcm43xx_sysfs *__s; struct bcm43xx_private *__p;         \
-        __s = container_of((attr), struct bcm43xx_sysfs, attr_name);    \
-        __p = container_of(__s, struct bcm43xx_private, sysfs);         \
-        __p;                                                            \
-                                        })
-
 struct bcm43xx_private;
 
 int bcm43xx_sysfs_register(struct bcm43xx_private *bcm);
diff --git a/drivers/net/wireless/bcm43xx/bcm43xx_wx.c b/drivers/net/wireless/bcm43xx/bcm43xx_wx.c
index 3daee828ef4b..b45063974ae9 100644
--- a/drivers/net/wireless/bcm43xx/bcm43xx_wx.c
+++ b/drivers/net/wireless/bcm43xx/bcm43xx_wx.c
@@ -182,8 +182,11 @@ static int bcm43xx_wx_set_mode(struct net_device *net_dev,
                 mode = BCM43xx_INITIAL_IWMODE;
 
         bcm43xx_lock_mmio(bcm, flags);
-        if (bcm->ieee->iw_mode != mode)
-                bcm43xx_set_iwmode(bcm, mode);
+        if (bcm->initialized) {
+                if (bcm->ieee->iw_mode != mode)
+                        bcm43xx_set_iwmode(bcm, mode);
+        } else
+                bcm->ieee->iw_mode = mode;
         bcm43xx_unlock_mmio(bcm, flags);
 
         return 0;
@@ -962,22 +965,22 @@ static const struct iw_priv_args bcm43xx_priv_wx_args[] = {
         {
                 .cmd            = PRIV_WX_SET_SHORTPREAMBLE,
                 .set_args       = IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 1,
-                .name           = "set_shortpreambl",
+                .name           = "set_shortpreamb",
         },
         {
                 .cmd            = PRIV_WX_GET_SHORTPREAMBLE,
                 .get_args       = IW_PRIV_TYPE_CHAR | IW_PRIV_SIZE_FIXED | MAX_WX_STRING,
-                .name           = "get_shortpreambl",
+                .name           = "get_shortpreamb",
         },
         {
                 .cmd            = PRIV_WX_SET_SWENCRYPTION,
                 .set_args       = IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 1,
-                .name           = "set_swencryption",
+                .name           = "set_swencrypt",
         },
         {
                 .cmd            = PRIV_WX_GET_SWENCRYPTION,
                 .get_args       = IW_PRIV_TYPE_CHAR | IW_PRIV_SIZE_FIXED | MAX_WX_STRING,
-                .name           = "get_swencryption",
+                .name           = "get_swencrypt",
         },
         {
                 .cmd            = PRIV_WX_SPROM_WRITE,
diff --git a/drivers/net/wireless/hostap/hostap_ioctl.c b/drivers/net/wireless/hostap/hostap_ioctl.c
index 8b37e824dfcb..8399de581893 100644
--- a/drivers/net/wireless/hostap/hostap_ioctl.c
+++ b/drivers/net/wireless/hostap/hostap_ioctl.c
@@ -1860,7 +1860,7 @@ static char * __prism2_translate_scan(local_info_t *local,
         memset(&iwe, 0, sizeof(iwe));
         iwe.cmd = SIOCGIWFREQ;
         if (scan) {
-                chan = scan->chid;
+                chan = le16_to_cpu(scan->chid);
         } else if (bss) {
                 chan = bss->chan;
         } else {
@@ -1868,7 +1868,7 @@ static char * __prism2_translate_scan(local_info_t *local,
         }
 
         if (chan > 0) {
-                iwe.u.freq.m = freq_list[le16_to_cpu(chan - 1)] * 100000;
+                iwe.u.freq.m = freq_list[chan - 1] * 100000;
                 iwe.u.freq.e = 1;
                 current_ev = iwe_stream_add_event(current_ev, end_buf, &iwe,
                                                   IW_EV_FREQ_LEN);
diff --git a/drivers/net/wireless/orinoco.c b/drivers/net/wireless/orinoco.c
index 8dfdfbd5966c..06523e2a8471 100644
--- a/drivers/net/wireless/orinoco.c
+++ b/drivers/net/wireless/orinoco.c
@@ -390,7 +390,7 @@ static struct iw_statistics *orinoco_get_wireless_stats(struct net_device *dev)
                 }
         } else {
                 struct {
-                        __le16 qual, signal, noise;
+                        __le16 qual, signal, noise, unused;
                 } __attribute__ ((packed)) cq;
 
                 err = HERMES_READ_RECORD(hw, USER_BAP,
diff --git a/drivers/parisc/pdc_stable.c b/drivers/parisc/pdc_stable.c
index 4e53be9c03ab..bbeabe3fc4c6 100644
--- a/drivers/parisc/pdc_stable.c
+++ b/drivers/parisc/pdc_stable.c
@@ -535,7 +535,7 @@ pdcs_auto_read(struct subsystem *entry, char *buf, int knob)
 {
         char *out = buf;
         struct pdcspath_entry *pathentry;
-        
+
         if (!entry || !buf)
                 return -EINVAL;
 
diff --git a/drivers/parisc/sba_iommu.c b/drivers/parisc/sba_iommu.c
index 42b32ff2fca6..278f325021ee 100644
--- a/drivers/parisc/sba_iommu.c
+++ b/drivers/parisc/sba_iommu.c
@@ -178,6 +178,11 @@ extern struct proc_dir_entry * proc_mckinley_root;
 #define ROPE6_CTL       0x230
 #define ROPE7_CTL       0x238
 
+#define IOC_ROPE0_CFG   0x500   /* pluto only */
+#define   IOC_ROPE_AO     0x10  /* Allow "Relaxed Ordering" */
+
+
+
 #define HF_ENABLE       0x40
 
 
@@ -1759,19 +1764,33 @@ printk("sba_hw_init(): mem_boot 0x%x 0x%x 0x%x 0x%x\n", PAGE0->mem_boot.hpa,
 
         sba_dev->num_ioc = num_ioc;
         for (i = 0; i < num_ioc; i++) {
-                /*
-                ** Make sure the box crashes if we get any errors on a rope.
-                */
-                WRITE_REG(HF_ENABLE, sba_dev->ioc[i].ioc_hpa + ROPE0_CTL);
-                WRITE_REG(HF_ENABLE, sba_dev->ioc[i].ioc_hpa + ROPE1_CTL);
-                WRITE_REG(HF_ENABLE, sba_dev->ioc[i].ioc_hpa + ROPE2_CTL);
-                WRITE_REG(HF_ENABLE, sba_dev->ioc[i].ioc_hpa + ROPE3_CTL);
-                WRITE_REG(HF_ENABLE, sba_dev->ioc[i].ioc_hpa + ROPE4_CTL);
-                WRITE_REG(HF_ENABLE, sba_dev->ioc[i].ioc_hpa + ROPE5_CTL);
-                WRITE_REG(HF_ENABLE, sba_dev->ioc[i].ioc_hpa + ROPE6_CTL);
-                WRITE_REG(HF_ENABLE, sba_dev->ioc[i].ioc_hpa + ROPE7_CTL);
-
-                /* flush out the writes */
+                unsigned long ioc_hpa = sba_dev->ioc[i].ioc_hpa;
+                unsigned int j;
+
+                for (j=0; j < sizeof(u64) * ROPES_PER_IOC; j+=sizeof(u64)) {
+
+                        /*
+                         * Clear ROPE(N)_CONFIG AO bit.
+                         * Disables "NT Ordering" (~= !"Relaxed Ordering")
+                         * Overrides bit 1 in DMA Hint Sets.
+                         * Improves netperf UDP_STREAM by ~10% for bcm5701.
+                         */
+                        if (IS_PLUTO(sba_dev->iodc)) {
+                                unsigned long rope_cfg, cfg_val;
+
+                                rope_cfg = ioc_hpa + IOC_ROPE0_CFG + j;
+                                cfg_val = READ_REG(rope_cfg);
+                                cfg_val &= ~IOC_ROPE_AO;
+                                WRITE_REG(cfg_val, rope_cfg);
+                        }
+
+                        /*
+                        ** Make sure the box crashes on rope errors.
+                        */
+                        WRITE_REG(HF_ENABLE, ioc_hpa + ROPE0_CTL + j);
+                }
+
+                /* flush out the last writes */
                 READ_REG(sba_dev->ioc[i].ioc_hpa + ROPE7_CTL);
 
                 DBG_INIT("      ioc[%d] ROPE_CFG 0x%Lx  ROPE_DBG 0x%Lx\n",
diff --git a/drivers/parisc/superio.c b/drivers/parisc/superio.c
index 719b863bc20e..828eb45062de 100644
--- a/drivers/parisc/superio.c
+++ b/drivers/parisc/superio.c
@@ -155,7 +155,7 @@ superio_init(struct pci_dev *pcidev)
         struct pci_dev *pdev = sio->lio_pdev;
         u16 word;
 
-        if (sio->suckyio_irq_enabled)                                       
+        if (sio->suckyio_irq_enabled)
                 return;
 
         BUG_ON(!pdev);
@@ -194,7 +194,7 @@ superio_init(struct pci_dev *pcidev)
         request_region (sio->acpi_base, 0x1f, "acpi");
 
         /* Enable the legacy I/O function */
-        pci_read_config_word (pdev, PCI_COMMAND, &word);
+        pci_read_config_word (pdev, PCI_COMMAND, &word);
         word |= PCI_COMMAND_SERR | PCI_COMMAND_PARITY | PCI_COMMAND_IO;
         pci_write_config_word (pdev, PCI_COMMAND, word);
 
diff --git a/drivers/pci/msi.c b/drivers/pci/msi.c
index 2087a397ef16..9855c4c920b8 100644
--- a/drivers/pci/msi.c
+++ b/drivers/pci/msi.c
@@ -793,8 +793,10 @@ static int msix_capability_init(struct pci_dev *dev,
                 if (!entry)
                         break;
                 vector = get_msi_vector(dev);
-                if (vector < 0)
+                if (vector < 0) {
+                        kmem_cache_free(msi_cachep, entry);
                         break;
+                }
 
                 j = entries[i].entry;
                 entries[i].vector = vector;
diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c
index 827550d25c9e..19e2b174d33c 100644
--- a/drivers/pci/quirks.c
+++ b/drivers/pci/quirks.c
@@ -642,13 +642,15 @@ static void quirk_via_irq(struct pci_dev *dev)
         new_irq = dev->irq & 0xf;
         pci_read_config_byte(dev, PCI_INTERRUPT_LINE, &irq);
         if (new_irq != irq) {
-                printk(KERN_INFO "PCI: Via IRQ fixup for %s, from %d to %d\n",
+                printk(KERN_INFO "PCI: VIA IRQ fixup for %s, from %d to %d\n",
                         pci_name(dev), irq, new_irq);
                 udelay(15);     /* unknown if delay really needed */
                 pci_write_config_byte(dev, PCI_INTERRUPT_LINE, new_irq);
         }
 }
-DECLARE_PCI_FIXUP_ENABLE(PCI_VENDOR_ID_VIA, PCI_ANY_ID, quirk_via_irq);
+DECLARE_PCI_FIXUP_ENABLE(PCI_VENDOR_ID_VIA, PCI_DEVICE_ID_VIA_82C686, quirk_via_irq);
+DECLARE_PCI_FIXUP_ENABLE(PCI_VENDOR_ID_VIA, PCI_DEVICE_ID_VIA_82C686_4, quirk_via_irq);
+DECLARE_PCI_FIXUP_ENABLE(PCI_VENDOR_ID_VIA, PCI_DEVICE_ID_VIA_82C686_5, quirk_via_irq);
 
 /*
  * VIA VT82C598 has its device ID settable and many BIOSes
@@ -865,6 +867,35 @@ static void __init quirk_eisa_bridge(struct pci_dev *dev)
 DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL,   PCI_DEVICE_ID_INTEL_82375,      quirk_eisa_bridge );
 
 /*
+ * On the MSI-K8T-Neo2Fir Board, the internal Soundcard is disabled
+ * when a PCI-Soundcard is added. The BIOS only gives Options
+ * "Disabled" and "AUTO". This Quirk Sets the corresponding
+ * Register-Value to enable the Soundcard.
+ */
+static void __init k8t_sound_hostbridge(struct pci_dev *dev)
+{
+        unsigned char val;
+
+        printk(KERN_INFO "PCI: Quirk-MSI-K8T Soundcard On\n");
+        pci_read_config_byte(dev, 0x50, &val);
+        if (val == 0x88 || val == 0xc8) {
+                pci_write_config_byte(dev, 0x50, val & (~0x40));
+
+                /* Verify the Change for Status output */
+                pci_read_config_byte(dev, 0x50, &val);
+                if (val & 0x40)
+                        printk(KERN_INFO "PCI: MSI-K8T soundcard still off\n");
+                else
+                        printk(KERN_INFO "PCI: MSI-K8T soundcard on\n");
+        } else {
+                printk(KERN_INFO "PCI: Unexpected Value in PCI-Register: "
+                                        "no Change!\n");
+        }
+
+}
+DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_VIA, PCI_DEVICE_ID_VIA_8237, k8t_sound_hostbridge);
+
+/*
  * On ASUS P4B boards, the SMBus PCI Device within the ICH2/4 southbridge
  * is not activated. The myth is that Asus said that they do not want the
  * users to be irritated by just another PCI Device in the Win98 device
diff --git a/drivers/pcmcia/Kconfig b/drivers/pcmcia/Kconfig
index cba6c9eef28e..61cb4b29f55c 100644
--- a/drivers/pcmcia/Kconfig
+++ b/drivers/pcmcia/Kconfig
@@ -250,7 +250,7 @@ config M32R_CFC_NUM
 
 config PCMCIA_VRC4171
         tristate "NEC VRC4171 Card Controllers support"
-        depends on VRC4171 && PCMCIA
+        depends on CPU_VR41XX && ISA && PCMCIA
 
 config PCMCIA_VRC4173
         tristate "NEC VRC4173 CARDU support"
diff --git a/drivers/pcmcia/ds.c b/drivers/pcmcia/ds.c
index ae10d1eed65e..48d3b3d30c21 100644
--- a/drivers/pcmcia/ds.c
+++ b/drivers/pcmcia/ds.c
@@ -236,11 +236,11 @@ static void pcmcia_check_driver(struct pcmcia_driver *p_drv)
 /**
  * pcmcia_load_firmware - load CIS from userspace if device-provided is broken
  * @dev - the pcmcia device which needs a CIS override
- * @filename - requested filename in /lib/firmware/cis/
+ * @filename - requested filename in /lib/firmware/
  *
  * This uses the in-kernel firmware loading mechanism to use a "fake CIS" if
  * the one provided by the card is broken. The firmware files reside in
- * /lib/firmware/cis/ in userspace.
+ * /lib/firmware/ in userspace.
  */
 static int pcmcia_load_firmware(struct pcmcia_device *dev, char * filename)
 {
@@ -298,9 +298,6 @@ static inline int pcmcia_load_firmware(struct pcmcia_device *dev, char * filenam
  *
  * Registers a PCMCIA driver with the PCMCIA bus core.
  */
-static int pcmcia_device_probe(struct device *dev);
-static int pcmcia_device_remove(struct device * dev);
-
 int pcmcia_register_driver(struct pcmcia_driver *driver)
 {
         if (!driver)
@@ -400,7 +397,7 @@ static int pcmcia_device_probe(struct device * dev)
          * call which will then check whether there are two
          * pseudo devices, and if not, add the second one.
          */
-        did = (struct pcmcia_device_id *) p_dev->dev.driver_data;
+        did = p_dev->dev.driver_data;
         if (did && (did->match_flags & PCMCIA_DEV_ID_MATCH_DEVICE_NO) &&
             (p_dev->socket->device_count == 1) && (p_dev->device_no == 0))
                 pcmcia_add_pseudo_device(p_dev->socket);
@@ -448,7 +445,6 @@ static void pcmcia_card_remove(struct pcmcia_socket *s, struct pcmcia_device *le
         return;
 }
 
-
 static int pcmcia_device_remove(struct device * dev)
 {
         struct pcmcia_device *p_dev;
@@ -463,7 +459,7 @@ static int pcmcia_device_remove(struct device * dev)
          * pseudo multi-function card, we need to unbind
          * all devices
          */
-        did = (struct pcmcia_device_id *) p_dev->dev.driver_data;
+        did = p_dev->dev.driver_data;
         if (did && (did->match_flags & PCMCIA_DEV_ID_MATCH_DEVICE_NO) &&
             (p_dev->socket->device_count != 0) &&
             (p_dev->device_no == 0))
@@ -476,6 +472,8 @@ static int pcmcia_device_remove(struct device * dev)
         if (p_drv->remove)
                 p_drv->remove(p_dev);
 
+        p_dev->dev_node = NULL;
+
         /* check for proper unloading */
         if (p_dev->_irq || p_dev->_io || p_dev->_locked)
                 printk(KERN_INFO "pcmcia: driver %s did not release config properly\n",
@@ -628,7 +626,7 @@ struct pcmcia_device * pcmcia_device_add(struct pcmcia_socket *s, unsigned int f
                 }
 
         /* Add to the list in pcmcia_bus_socket */
-        list_add_tail(&p_dev->socket_device_list, &s->devices_list);
+        list_add(&p_dev->socket_device_list, &s->devices_list);
 
         spin_unlock_irqrestore(&pcmcia_dev_list_lock, flags);
 
diff --git a/drivers/pcmcia/i82365.c b/drivers/pcmcia/i82365.c
index bd0308e89815..a2f05f485156 100644
--- a/drivers/pcmcia/i82365.c
+++ b/drivers/pcmcia/i82365.c
@@ -509,7 +509,8 @@ static irqreturn_t i365_count_irq(int irq, void *dev, struct pt_regs *regs)
 static u_int __init test_irq(u_short sock, int irq)
 {
     debug(2, "  testing ISA irq %d\n", irq);
-    if (request_irq(irq, i365_count_irq, 0, "scan", i365_count_irq) != 0)
+    if (request_irq(irq, i365_count_irq, SA_PROBEIRQ, "scan",
+                        i365_count_irq) != 0)
         return 1;
     irq_hits = 0; irq_sock = sock;
     msleep(10);
@@ -561,7 +562,7 @@ static u_int __init isa_scan(u_short sock, u_int mask0)
     } else {
         /* Fallback: just find interrupts that aren't in use */
         for (i = 0; i < 16; i++)
-            if ((mask0 & (1 << i)) && (_check_irq(i, 0) == 0))
+            if ((mask0 & (1 << i)) && (_check_irq(i, SA_PROBEIRQ) == 0))
                 mask1 |= (1 << i);
         printk("default");
         /* If scan failed, default to polled status */
@@ -725,7 +726,7 @@ static void __init add_pcic(int ns, int type)
         u_int cs_mask = mask & ((cs_irq) ? (1<<cs_irq) : ~(1<<12));
         for (cs_irq = 15; cs_irq > 0; cs_irq--)
             if ((cs_mask & (1 << cs_irq)) &&
-                (_check_irq(cs_irq, 0) == 0))
+                (_check_irq(cs_irq, SA_PROBEIRQ) == 0))
                 break;
         if (cs_irq) {
             grab_irq = 1;
diff --git a/drivers/pcmcia/pcmcia_resource.c b/drivers/pcmcia/pcmcia_resource.c
index 45063b4e5b78..3131bb0a0095 100644
--- a/drivers/pcmcia/pcmcia_resource.c
+++ b/drivers/pcmcia/pcmcia_resource.c
@@ -88,7 +88,6 @@ static int alloc_io_space(struct pcmcia_socket *s, u_int attr, ioaddr_t *base,
         }
         if ((s->features & SS_CAP_STATIC_MAP) && s->io_offset) {
                 *base = s->io_offset | (*base & 0x0fff);
-                s->io[0].res->flags = (s->io[0].res->flags & ~IORESOURCE_BITS) | (attr & IORESOURCE_BITS);
                 return 0;
         }
         /* Check for an already-allocated window that must conflict with
@@ -209,7 +208,6 @@ int pccard_get_configuration_info(struct pcmcia_socket *s,
         if (!(s->state & SOCKET_PRESENT))
                 return CS_NO_CARD;
 
-        config->Function = p_dev->func;
 
 #ifdef CONFIG_CARDBUS
         if (s->state & SOCKET_CARDBUS) {
@@ -223,14 +221,22 @@ int pccard_get_configuration_info(struct pcmcia_socket *s,
                         config->AssignedIRQ = s->irq.AssignedIRQ;
                         if (config->AssignedIRQ)
                                 config->Attributes |= CONF_ENABLE_IRQ;
-                        config->BasePort1 = s->io[0].res->start;
-                        config->NumPorts1 = s->io[0].res->end - config->BasePort1 + 1;
+                        if (s->io[0].res) {
+                                config->BasePort1 = s->io[0].res->start;
+                                config->NumPorts1 = s->io[0].res->end - config->BasePort1 + 1;
+                        }
                 }
                 return CS_SUCCESS;
         }
 #endif
 
-        c = (p_dev) ? p_dev->function_config : NULL;
+        if (p_dev) {
+                c = p_dev->function_config;
+                config->Function = p_dev->func;
+        } else {
+                c = NULL;
+                config->Function = 0;
+        }
 
         if ((c == NULL) || !(c->state & CONFIG_LOCKED)) {
                 config->Attributes = 0;
@@ -947,7 +953,5 @@ void pcmcia_disable_device(struct pcmcia_device *p_dev) {
         pcmcia_release_irq(p_dev, &p_dev->irq);
         if (&p_dev->win)
                 pcmcia_release_window(p_dev->win);
-
-        p_dev->dev_node = NULL;
 }
 EXPORT_SYMBOL(pcmcia_disable_device);
diff --git a/drivers/rtc/rtc-dev.c b/drivers/rtc/rtc-dev.c
index b1e3e6179e56..6c9ad92747fd 100644
--- a/drivers/rtc/rtc-dev.c
+++ b/drivers/rtc/rtc-dev.c
@@ -58,7 +58,7 @@ rtc_dev_read(struct file *file, char __user *buf, size_t count, loff_t *ppos)
         unsigned long data;
         ssize_t ret;
 
-        if (count < sizeof(unsigned long))
+        if (count != sizeof(unsigned int) && count < sizeof(unsigned long))
                 return -EINVAL;
 
         add_wait_queue(&rtc->irq_queue, &wait);
@@ -90,11 +90,16 @@ rtc_dev_read(struct file *file, char __user *buf, size_t count, loff_t *ppos)
         if (ret == 0) {
                 /* Check for any data updates */
                 if (rtc->ops->read_callback)
-                        data = rtc->ops->read_callback(rtc->class_dev.dev, data);
-
-                ret = put_user(data, (unsigned long __user *)buf);
-                if (ret == 0)
-                        ret = sizeof(unsigned long);
+                        data = rtc->ops->read_callback(rtc->class_dev.dev,
+                                                       data);
+
+                if (sizeof(int) != sizeof(long) &&
+                    count == sizeof(unsigned int))
+                        ret = put_user(data, (unsigned int __user *)buf) ?:
+                                sizeof(unsigned int);
+                else
+                        ret = put_user(data, (unsigned long __user *)buf) ?:
+                                sizeof(unsigned long);
         }
         return ret;
 }
diff --git a/drivers/rtc/rtc-sa1100.c b/drivers/rtc/rtc-sa1100.c
index a23ec54989f6..2bc8aad47219 100644
--- a/drivers/rtc/rtc-sa1100.c
+++ b/drivers/rtc/rtc-sa1100.c
@@ -178,9 +178,9 @@ static int sa1100_rtc_open(struct device *dev)
         return 0;
 
  fail_pi:
-        free_irq(IRQ_RTCAlrm, NULL);
+        free_irq(IRQ_RTCAlrm, dev);
  fail_ai:
-        free_irq(IRQ_RTC1Hz, NULL);
+        free_irq(IRQ_RTC1Hz, dev);
  fail_ui:
         return ret;
 }
@@ -295,7 +295,7 @@ static int sa1100_rtc_set_alarm(struct device *dev, struct rtc_wkalrm *alrm)
 
 static int sa1100_rtc_proc(struct device *dev, struct seq_file *seq)
 {
-        seq_printf(seq, "trim/divider\t: 0x%08x\n", RTTR);
+        seq_printf(seq, "trim/divider\t: 0x%08lx\n", RTTR);
         seq_printf(seq, "alarm_IRQ\t: %s\n",
                         (RTSR & RTSR_ALE) ? "yes" : "no" );
         seq_printf(seq, "update_IRQ\t: %s\n",
diff --git a/drivers/s390/block/dasd.c b/drivers/s390/block/dasd.c
index a3bfebcf31ef..cfb1fff3787c 100644
--- a/drivers/s390/block/dasd.c
+++ b/drivers/s390/block/dasd.c
@@ -315,6 +315,11 @@ dasd_increase_state(struct dasd_device *device)
                 rc = dasd_state_basic_to_ready(device);
 
         if (!rc &&
+            device->state == DASD_STATE_UNFMT &&
+            device->target > DASD_STATE_UNFMT)
+                rc = -EPERM;
+
+        if (!rc &&
             device->state == DASD_STATE_READY &&
             device->target >= DASD_STATE_ONLINE)
                 rc = dasd_state_ready_to_online(device);
diff --git a/drivers/s390/block/dasd_devmap.c b/drivers/s390/block/dasd_devmap.c
index c1c6f1381150..216bc4fba199 100644
--- a/drivers/s390/block/dasd_devmap.c
+++ b/drivers/s390/block/dasd_devmap.c
@@ -45,6 +45,7 @@ struct dasd_devmap {
         unsigned int devindex;
         unsigned short features;
         struct dasd_device *device;
+        struct dasd_uid uid;
 };
 
 /*
@@ -716,6 +717,68 @@ dasd_discipline_show(struct device *dev, struct device_attribute *attr, char *bu
 
 static DEVICE_ATTR(discipline, 0444, dasd_discipline_show, NULL);
 
+static ssize_t
+dasd_alias_show(struct device *dev, struct device_attribute *attr, char *buf)
+{
+        struct dasd_devmap *devmap;
+        int alias;
+
+        devmap = dasd_find_busid(dev->bus_id);
+        spin_lock(&dasd_devmap_lock);
+        if (!IS_ERR(devmap))
+                alias = devmap->uid.alias;
+        else
+                alias = 0;
+        spin_unlock(&dasd_devmap_lock);
+
+        return sprintf(buf, alias ? "1\n" : "0\n");
+}
+
+static DEVICE_ATTR(alias, 0444, dasd_alias_show, NULL);
+
+static ssize_t
+dasd_vendor_show(struct device *dev, struct device_attribute *attr, char *buf)
+{
+        struct dasd_devmap *devmap;
+        char *vendor;
+
+        devmap = dasd_find_busid(dev->bus_id);
+        spin_lock(&dasd_devmap_lock);
+        if (!IS_ERR(devmap) && strlen(devmap->uid.vendor) > 0)
+                vendor = devmap->uid.vendor;
+        else
+                vendor = "";
+        spin_unlock(&dasd_devmap_lock);
+
+        return snprintf(buf, PAGE_SIZE, "%s\n", vendor);
+}
+
+static DEVICE_ATTR(vendor, 0444, dasd_vendor_show, NULL);
+
+#define UID_STRLEN ( /* vendor */ 3 + 1 + /* serial    */ 14 + 1 +\
+                     /* SSID   */ 4 + 1 + /* unit addr */ 2 + 1)
+
+static ssize_t
+dasd_uid_show(struct device *dev, struct device_attribute *attr, char *buf)
+{
+        struct dasd_devmap *devmap;
+        char uid[UID_STRLEN];
+
+        devmap = dasd_find_busid(dev->bus_id);
+        spin_lock(&dasd_devmap_lock);
+        if (!IS_ERR(devmap) && strlen(devmap->uid.vendor) > 0)
+                snprintf(uid, sizeof(uid), "%s.%s.%04x.%02x",
+                         devmap->uid.vendor, devmap->uid.serial,
+                         devmap->uid.ssid, devmap->uid.unit_addr);
+        else
+                uid[0] = 0;
+        spin_unlock(&dasd_devmap_lock);
+
+        return snprintf(buf, PAGE_SIZE, "%s\n", uid);
+}
+
+static DEVICE_ATTR(uid, 0444, dasd_uid_show, NULL);
+
 /*
  * extended error-reporting
  */
@@ -759,6 +822,9 @@ static DEVICE_ATTR(eer_enabled, 0644, dasd_eer_show, dasd_eer_store);
 static struct attribute * dasd_attrs[] = {
         &dev_attr_readonly.attr,
         &dev_attr_discipline.attr,
+        &dev_attr_alias.attr,
+        &dev_attr_vendor.attr,
+        &dev_attr_uid.attr,
         &dev_attr_use_diag.attr,
         &dev_attr_eer_enabled.attr,
         NULL,
@@ -768,6 +834,42 @@ static struct attribute_group dasd_attr_group = {
         .attrs = dasd_attrs,
 };
 
+
+/*
+ * Return copy of the device unique identifier.
+ */
+int
+dasd_get_uid(struct ccw_device *cdev, struct dasd_uid *uid)
+{
+        struct dasd_devmap *devmap;
+
+        devmap = dasd_find_busid(cdev->dev.bus_id);
+        if (IS_ERR(devmap))
+                return PTR_ERR(devmap);
+        spin_lock(&dasd_devmap_lock);
+        *uid = devmap->uid;
+        spin_unlock(&dasd_devmap_lock);
+        return 0;
+}
+
+/*
+ * Register the given device unique identifier into devmap struct.
+ */
+int
+dasd_set_uid(struct ccw_device *cdev, struct dasd_uid *uid)
+{
+        struct dasd_devmap *devmap;
+
+        devmap = dasd_find_busid(cdev->dev.bus_id);
+        if (IS_ERR(devmap))
+                return PTR_ERR(devmap);
+        spin_lock(&dasd_devmap_lock);
+        devmap->uid = *uid;
+        spin_unlock(&dasd_devmap_lock);
+        return 0;
+}
+EXPORT_SYMBOL(dasd_set_uid);
+
 /*
  * Return value of the specified feature.
  */
diff --git a/drivers/s390/block/dasd_eckd.c b/drivers/s390/block/dasd_eckd.c
index ee09ef33d08d..7d5a6cee4bd8 100644
--- a/drivers/s390/block/dasd_eckd.c
+++ b/drivers/s390/block/dasd_eckd.c
@@ -446,6 +446,39 @@ dasd_eckd_cdl_reclen(int recid)
         return LABEL_SIZE;
 }
 
+/*
+ * Generate device unique id that specifies the physical device.
+ */
+static int
+dasd_eckd_generate_uid(struct dasd_device *device, struct dasd_uid *uid)
+{
+        struct dasd_eckd_private *private;
+        struct dasd_eckd_confdata *confdata;
+
+        private = (struct dasd_eckd_private *) device->private;
+        if (!private)
+                return -ENODEV;
+        confdata = &private->conf_data;
+        if (!confdata)
+                return -ENODEV;
+
+        memset(uid, 0, sizeof(struct dasd_uid));
+        strncpy(uid->vendor, confdata->ned1.HDA_manufacturer,
+                sizeof(uid->vendor) - 1);
+        EBCASC(uid->vendor, sizeof(uid->vendor) - 1);
+        strncpy(uid->serial, confdata->ned1.HDA_location,
+                sizeof(uid->serial) - 1);
+        EBCASC(uid->serial, sizeof(uid->serial) - 1);
+        uid->ssid = confdata->neq.subsystemID;
+        if (confdata->ned2.sneq.flags == 0x40) {
+                uid->alias = 1;
+                uid->unit_addr = confdata->ned2.sneq.base_unit_addr;
+        } else
+                uid->unit_addr = confdata->ned1.unit_addr;
+
+        return 0;
+}
+
 static int
 dasd_eckd_read_conf(struct dasd_device *device)
 {
@@ -507,11 +540,15 @@ dasd_eckd_read_conf(struct dasd_device *device)
         return 0;
 }
 
-
+/*
+ * Check device characteristics.
+ * If the device is accessible using ECKD discipline, the device is enabled.
+ */
 static int
 dasd_eckd_check_characteristics(struct dasd_device *device)
 {
         struct dasd_eckd_private *private;
+        struct dasd_uid uid;
         void *rdc_data;
         int rc;
 
@@ -536,6 +573,7 @@ dasd_eckd_check_characteristics(struct dasd_device *device)
 
         /* Read Device Characteristics */
         rdc_data = (void *) &(private->rdc_data);
+        memset(rdc_data, 0, sizeof(rdc_data));
         rc = read_dev_chars(device->cdev, &rdc_data, 64);
         if (rc) {
                 DEV_MESSAGE(KERN_WARNING, device,
@@ -556,8 +594,17 @@ dasd_eckd_check_characteristics(struct dasd_device *device)
 
         /* Read Configuration Data */
         rc = dasd_eckd_read_conf (device);
-        return rc;
+        if (rc)
+                return rc;
+
+        /* Generate device unique id and register in devmap */
+        rc = dasd_eckd_generate_uid(device, &uid);
+        if (rc)
+                return rc;
 
+        rc = dasd_set_uid(device->cdev, &uid);
+
+        return rc;
 }
 
 static struct dasd_ccw_req *
diff --git a/drivers/s390/block/dasd_eckd.h b/drivers/s390/block/dasd_eckd.h
index ad8524bb7bb3..d5734e976e1c 100644
--- a/drivers/s390/block/dasd_eckd.h
+++ b/drivers/s390/block/dasd_eckd.h
@@ -228,26 +228,36 @@ struct dasd_eckd_confdata {
                 unsigned char HDA_manufacturer[3];
                 unsigned char HDA_location[2];
                 unsigned char HDA_seqno[12];
-                __u16 ID;
+                __u8 ID;
+                __u8 unit_addr;
         } __attribute__ ((packed)) ned1;
-        struct {
+        union {
                 struct {
-                        unsigned char identifier:2;
-                        unsigned char token_id:1;
-                        unsigned char sno_valid:1;
-                        unsigned char subst_sno:1;
-                        unsigned char recNED:1;
-                        unsigned char emuNED:1;
-                        unsigned char reserved:1;
-                } __attribute__ ((packed)) flags;
-                __u8 descriptor;
-                __u8 reserved[2];
-                unsigned char dev_type[6];
-                unsigned char dev_model[3];
-                unsigned char DASD_manufacturer[3];
-                unsigned char DASD_location[2];
-                unsigned char DASD_seqno[12];
-                __u16 ID;
+                        struct {
+                                unsigned char identifier:2;
+                                unsigned char token_id:1;
+                                unsigned char sno_valid:1;
+                                unsigned char subst_sno:1;
+                                unsigned char recNED:1;
+                                unsigned char emuNED:1;
+                                unsigned char reserved:1;
+                        } __attribute__ ((packed)) flags;
+                        __u8 descriptor;
+                        __u8 reserved[2];
+                        unsigned char dev_type[6];
+                        unsigned char dev_model[3];
+                        unsigned char DASD_manufacturer[3];
+                        unsigned char DASD_location[2];
+                        unsigned char DASD_seqno[12];
+                        __u16 ID;
+                } __attribute__ ((packed)) ned;
+                struct {
+                        unsigned char flags;            /* byte  0    */
+                        unsigned char res2[7];          /* byte  1- 7 */
+                        unsigned char sua_flags;        /* byte  8    */
+                        __u8 base_unit_addr;            /* byte  9    */
+                        unsigned char res3[22];         /* byte 10-31 */
+                } __attribute__ ((packed)) sneq;
         } __attribute__ ((packed)) ned2;
         struct {
                 struct {
diff --git a/drivers/s390/block/dasd_int.h b/drivers/s390/block/dasd_int.h
index 4293ba827523..d4b13e300a76 100644
--- a/drivers/s390/block/dasd_int.h
+++ b/drivers/s390/block/dasd_int.h
@@ -268,6 +268,16 @@ struct dasd_discipline {
 
 extern struct dasd_discipline *dasd_diag_discipline_pointer;
 
+/*
+ * Unique identifier for dasd device.
+ */
+struct dasd_uid {
+        __u8 alias;
+        char vendor[4];
+        char serial[15];
+        __u16 ssid;
+        __u8 unit_addr;
+};
 
 /*
  * Notification numbers for extended error reporting notifications:
@@ -516,6 +526,8 @@ void dasd_devmap_exit(void);
 struct dasd_device *dasd_create_device(struct ccw_device *);
 void dasd_delete_device(struct dasd_device *);
 
+int dasd_get_uid(struct ccw_device *, struct dasd_uid *);
+int dasd_set_uid(struct ccw_device *, struct dasd_uid *);
 int dasd_get_feature(struct ccw_device *, int);
 int dasd_set_feature(struct ccw_device *, int, int);
 
diff --git a/drivers/s390/char/tape_3590.c b/drivers/s390/char/tape_3590.c
index c3915f60a3aa..d71ef1adea59 100644
--- a/drivers/s390/char/tape_3590.c
+++ b/drivers/s390/char/tape_3590.c
@@ -230,14 +230,16 @@ tape_3590_read_attmsg(struct tape_device *device)
  * These functions are used to schedule follow-up actions from within an
  * interrupt context (like unsolicited interrupts).
  */
+struct work_handler_data {
+        struct tape_device *device;
+        enum tape_op        op;
+        struct work_struct  work;
+};
+
 static void
 tape_3590_work_handler(void *data)
 {
-        struct {
-                struct tape_device *device;
-                enum tape_op op;
-                struct work_struct work;
-        } *p = data;
+        struct work_handler_data *p = data;
 
         switch (p->op) {
         case TO_MSEN:
@@ -257,11 +259,7 @@ tape_3590_work_handler(void *data)
 static int
 tape_3590_schedule_work(struct tape_device *device, enum tape_op op)
 {
-        struct {
-                struct tape_device *device;
-                enum tape_op op;
-                struct work_struct work;
-        } *p;
+        struct work_handler_data *p;
 
         if ((p = kzalloc(sizeof(*p), GFP_ATOMIC)) == NULL)
                 return -ENOMEM;
@@ -316,7 +314,7 @@ tape_3590_bread(struct tape_device *device, struct request *req)
 
         rq_for_each_bio(bio, req) {
                 bio_for_each_segment(bv, bio, i) {
-                        dst = kmap(bv->bv_page) + bv->bv_offset;
+                        dst = page_address(bv->bv_page) + bv->bv_offset;
                         for (off = 0; off < bv->bv_len;
                              off += TAPEBLOCK_HSEC_SIZE) {
                                 ccw->flags = CCW_FLAG_CC;
@@ -1168,6 +1166,7 @@ tape_3590_setup_device(struct tape_device *device)
 static void
 tape_3590_cleanup_device(struct tape_device *device)
 {
+        flush_scheduled_work();
         tape_std_unassign(device);
 
         kfree(device->discdata);
@@ -1234,6 +1233,7 @@ static struct tape_discipline tape_discipline_3590 = {
 
 static struct ccw_device_id tape_3590_ids[] = {
         {CCW_DEVICE_DEVTYPE(0x3590, 0, 0x3590, 0), .driver_info = tape_3590},
+        {CCW_DEVICE_DEVTYPE(0x3592, 0, 0x3592, 0), .driver_info = tape_3592},
         { /* end of list */ }
 };
 
diff --git a/drivers/s390/char/tape_std.h b/drivers/s390/char/tape_std.h
index 2d311798edf4..1fc952359341 100644
--- a/drivers/s390/char/tape_std.h
+++ b/drivers/s390/char/tape_std.h
@@ -153,6 +153,7 @@ enum s390_tape_type {
         tape_3480,
         tape_3490,
         tape_3590,
+        tape_3592,
 };
 
 #endif // _TAPE_STD_H
diff --git a/drivers/s390/cio/chsc.c b/drivers/s390/cio/chsc.c
index 6412b2c3edd3..72187e54dcac 100644
--- a/drivers/s390/cio/chsc.c
+++ b/drivers/s390/cio/chsc.c
@@ -242,28 +242,10 @@ s390_subchannel_remove_chpid(struct device *dev, void *data)
         if (sch->vpm == mask)
                 goto out_unreg;
 
-        if ((sch->schib.scsw.actl & (SCSW_ACTL_CLEAR_PEND |
-                                     SCSW_ACTL_HALT_PEND |
-                                     SCSW_ACTL_START_PEND |
-                                     SCSW_ACTL_RESUME_PEND)) &&
-            (sch->schib.pmcw.lpum == mask)) {
-                int cc = cio_cancel(sch);
-                
-                if (cc == -ENODEV)
-                        goto out_unreg;
-
-                if (cc == -EINVAL) {
-                        cc = cio_clear(sch);
-                        if (cc == -ENODEV)
-                                goto out_unreg;
-                        /* Call handler. */
-                        if (sch->driver && sch->driver->termination)
-                                sch->driver->termination(&sch->dev);
-                        goto out_unlock;
-                }
-        } else if ((sch->schib.scsw.actl & SCSW_ACTL_DEVACT) &&
-                   (sch->schib.scsw.actl & SCSW_ACTL_SCHACT) &&
-                   (sch->schib.pmcw.lpum == mask)) {
+        if ((sch->schib.scsw.actl & SCSW_ACTL_DEVACT) &&
+            (sch->schib.scsw.actl & SCSW_ACTL_SCHACT) &&
+            (sch->schib.pmcw.lpum == mask) &&
+            (sch->vpm == 0)) {
                 int cc;
 
                 cc = cio_clear(sch);
@@ -653,13 +635,13 @@ __chp_add(struct subchannel_id schid, void *data)
                 if (sch->schib.pmcw.chpid[i] == chp->id) {
                         if (stsch(sch->schid, &sch->schib) != 0) {
                                 /* Endgame. */
-                                spin_unlock(&sch->lock);
+                                spin_unlock_irq(&sch->lock);
                                 return -ENXIO;
                         }
                         break;
                 }
         if (i==8) {
-                spin_unlock(&sch->lock);
+                spin_unlock_irq(&sch->lock);
                 return 0;
         }
         sch->lpm = ((sch->schib.pmcw.pim &
diff --git a/drivers/s390/cio/qdio.c b/drivers/s390/cio/qdio.c
index 814f9258ce00..96f519281d92 100644
--- a/drivers/s390/cio/qdio.c
+++ b/drivers/s390/cio/qdio.c
@@ -38,6 +38,7 @@
 #include <linux/kernel.h>
 #include <linux/proc_fs.h>
 #include <linux/timer.h>
+#include <linux/mempool.h>
 
 #include <asm/ccwdev.h>
 #include <asm/io.h>
@@ -80,6 +81,8 @@ static int indicator_used[INDICATORS_PER_CACHELINE];
 static __u32 * volatile indicators;
 static __u32 volatile spare_indicator;
 static atomic_t spare_indicator_usecount;
+#define QDIO_MEMPOOL_SCSSC_ELEMENTS 2
+static mempool_t *qdio_mempool_scssc;
 
 static debug_info_t *qdio_dbf_setup;
 static debug_info_t *qdio_dbf_sbal;
@@ -1637,7 +1640,7 @@ next:
 
         }
         kfree(irq_ptr->qdr);
-        kfree(irq_ptr);
+        free_page((unsigned long) irq_ptr);
 }
 
 static void
@@ -2304,7 +2307,7 @@ qdio_get_ssqd_information(struct qdio_irq *irq_ptr)
 
         QDIO_DBF_TEXT0(0,setup,"getssqd");
         qdioac = 0;
-        ssqd_area = (void *)get_zeroed_page(GFP_KERNEL | GFP_DMA);
+        ssqd_area = mempool_alloc(qdio_mempool_scssc, GFP_ATOMIC);
         if (!ssqd_area) {
                 QDIO_PRINT_WARN("Could not get memory for chsc. Using all " \
                                 "SIGAs for sch x%x.\n", irq_ptr->schid.sch_no);
@@ -2364,7 +2367,7 @@ qdio_get_ssqd_information(struct qdio_irq *irq_ptr)
 out:
         qdio_check_subchannel_qebsm(irq_ptr, qdioac,
                                     ssqd_area->sch_token);
-        free_page ((unsigned long) ssqd_area);
+        mempool_free(ssqd_area, qdio_mempool_scssc);
         irq_ptr->qdioac = qdioac;
 }
 
@@ -2458,7 +2461,7 @@ tiqdio_set_subchannel_ind(struct qdio_irq *irq_ptr, int reset_to_zero)
                         virt_to_phys((volatile void *)irq_ptr->dev_st_chg_ind);
         }
 
-        scssc_area = (void *)get_zeroed_page(GFP_KERNEL | GFP_DMA);
+        scssc_area = mempool_alloc(qdio_mempool_scssc, GFP_ATOMIC);
         if (!scssc_area) {
                 QDIO_PRINT_WARN("No memory for setting indicators on " \
                                 "subchannel 0.%x.%x.\n",
@@ -2514,7 +2517,7 @@ tiqdio_set_subchannel_ind(struct qdio_irq *irq_ptr, int reset_to_zero)
         QDIO_DBF_HEX2(0,setup,&real_addr_dev_st_chg_ind,sizeof(unsigned long));
         result = 0;
 out:
-        free_page ((unsigned long) scssc_area);
+        mempool_free(scssc_area, qdio_mempool_scssc);
         return result;
 
 }
@@ -2543,7 +2546,7 @@ tiqdio_set_delay_target(struct qdio_irq *irq_ptr, unsigned long delay_target)
         if (!irq_ptr->is_thinint_irq)
                 return -ENODEV;
 
-        scsscf_area = (void *)get_zeroed_page(GFP_KERNEL | GFP_DMA);
+        scsscf_area = mempool_alloc(qdio_mempool_scssc, GFP_ATOMIC);
         if (!scsscf_area) {
                 QDIO_PRINT_WARN("No memory for setting delay target on " \
                                 "subchannel 0.%x.%x.\n",
@@ -2581,7 +2584,7 @@ tiqdio_set_delay_target(struct qdio_irq *irq_ptr, unsigned long delay_target)
         QDIO_DBF_HEX2(0,trace,&delay_target,sizeof(unsigned long));
         result = 0; /* not critical */
 out:
-        free_page ((unsigned long) scsscf_area);
+        mempool_free(scsscf_area, qdio_mempool_scssc);
         return result;
 }
 
@@ -2980,7 +2983,7 @@ qdio_allocate(struct qdio_initialize *init_data)
         qdio_allocate_do_dbf(init_data);
 
         /* create irq */
-        irq_ptr = kzalloc(sizeof(struct qdio_irq), GFP_KERNEL | GFP_DMA);
+        irq_ptr = (void *) get_zeroed_page(GFP_KERNEL | GFP_DMA);
 
         QDIO_DBF_TEXT0(0,setup,"irq_ptr:");
         QDIO_DBF_HEX0(0,setup,&irq_ptr,sizeof(void*));
@@ -2995,7 +2998,7 @@ qdio_allocate(struct qdio_initialize *init_data)
         /* QDR must be in DMA area since CCW data address is only 32 bit */
         irq_ptr->qdr=kmalloc(sizeof(struct qdr), GFP_KERNEL | GFP_DMA);
         if (!(irq_ptr->qdr)) {
-                kfree(irq_ptr);
+                free_page((unsigned long) irq_ptr);
                 QDIO_PRINT_ERR("kmalloc of irq_ptr->qdr failed!\n");
                 return -ENOMEM;
         }
@@ -3780,6 +3783,16 @@ oom:
         return -ENOMEM;
 }
 
+static void *qdio_mempool_alloc(gfp_t gfp_mask, void *size)
+{
+        return (void *) get_zeroed_page(gfp_mask|GFP_DMA);
+}
+
+static void qdio_mempool_free(void *element, void *size)
+{
+        free_page((unsigned long) element);
+}
+
 static int __init
 init_QDIO(void)
 {
@@ -3809,6 +3822,10 @@ init_QDIO(void)
 
         qdio_add_procfs_entry();
 
+        qdio_mempool_scssc = mempool_create(QDIO_MEMPOOL_SCSSC_ELEMENTS,
+                                            qdio_mempool_alloc,
+                                            qdio_mempool_free, NULL);
+
         if (tiqdio_check_chsc_availability())
                 QDIO_PRINT_ERR("Not all CHSCs supported. Continuing.\n");
 
@@ -3824,6 +3841,7 @@ cleanup_QDIO(void)
         qdio_remove_procfs_entry();
         qdio_release_qdio_memory();
         qdio_unregister_dbf_views();
+        mempool_destroy(qdio_mempool_scssc);
 
         printk("qdio: %s: module removed\n",version);
 }
diff --git a/drivers/s390/net/qeth_main.c b/drivers/s390/net/qeth_main.c
index b3c6e7907790..cb14642d97aa 100644
--- a/drivers/s390/net/qeth_main.c
+++ b/drivers/s390/net/qeth_main.c
@@ -8014,7 +8014,6 @@ static int (*qeth_old_arp_constructor) (struct neighbour *);
 
 static struct neigh_ops arp_direct_ops_template = {
         .family = AF_INET,
-        .destructor = NULL,
         .solicit = NULL,
         .error_report = NULL,
         .output = dev_queue_xmit,
diff --git a/drivers/s390/s390mach.c b/drivers/s390/s390mach.c
index 3bf466603512..f99e55308b32 100644
--- a/drivers/s390/s390mach.c
+++ b/drivers/s390/s390mach.c
@@ -13,6 +13,7 @@
 #include <linux/sched.h>
 #include <linux/errno.h>
 #include <linux/workqueue.h>
+#include <linux/time.h>
 
 #include <asm/lowcore.h>
 
@@ -362,12 +363,19 @@ s390_revalidate_registers(struct mci *mci)
         return kill_task;
 }
 
+#define MAX_IPD_COUNT   29
+#define MAX_IPD_TIME    (5 * 60 * USEC_PER_SEC) /* 5 minutes */
+
 /*
  * machine check handler.
  */
 void
 s390_do_machine_check(struct pt_regs *regs)
 {
+        static DEFINE_SPINLOCK(ipd_lock);
+        static unsigned long long last_ipd;
+        static int ipd_count;
+        unsigned long long tmp;
         struct mci *mci;
         struct mcck_struct *mcck;
         int umode;
@@ -404,11 +412,27 @@ s390_do_machine_check(struct pt_regs *regs)
                                 s390_handle_damage("processing backup machine "
                                                    "check with damage.");
                         }
-                        if (!umode)
-                                s390_handle_damage("processing backup machine "
-                                                   "check in kernel mode.");
-                        mcck->kill_task = 1;
-                        mcck->mcck_code = *(unsigned long long *) mci;
+
+                        /*
+                         * Nullifying exigent condition, therefore we might
+                         * retry this instruction.
+                         */
+
+                        spin_lock(&ipd_lock);
+
+                        tmp = get_clock();
+
+                        if (((tmp - last_ipd) >> 12) < MAX_IPD_TIME)
+                                ipd_count++;
+                        else
+                                ipd_count = 1;
+
+                        last_ipd = tmp;
+
+                        if (ipd_count == MAX_IPD_COUNT)
+                                s390_handle_damage("too many ipd retries.");
+
+                        spin_unlock(&ipd_lock);
                 }
                 else {
                         /* Processing damage -> stopping machine */
diff --git a/drivers/scsi/Kconfig b/drivers/scsi/Kconfig
index 3e7302692dbe..a480a3742d47 100644
--- a/drivers/scsi/Kconfig
+++ b/drivers/scsi/Kconfig
@@ -446,7 +446,9 @@ config SCSI_DPT_I2O
 
 config SCSI_ADVANSYS
         tristate "AdvanSys SCSI support"
-        depends on (ISA || EISA || PCI) && SCSI && BROKEN
+        depends on SCSI
+        depends on ISA || EISA || PCI
+        depends on BROKEN || X86_32
         help
           This is a driver for all SCSI host adapters manufactured by
           AdvanSys. It is documented in the kernel source in
diff --git a/drivers/scsi/advansys.c b/drivers/scsi/advansys.c
index 28b93057b607..2a419634b256 100644
--- a/drivers/scsi/advansys.c
+++ b/drivers/scsi/advansys.c
@@ -2051,7 +2051,7 @@ STATIC ASC_DCNT  AscGetMaxDmaCount(ushort);
 #define ADV_VADDR_TO_U32   virt_to_bus
 #define ADV_U32_TO_VADDR   bus_to_virt
 
-#define AdvPortAddr  ulong              /* Virtual memory address size */
+#define AdvPortAddr  void __iomem *     /* Virtual memory address size */
 
 /*
  * Define Adv Library required memory access macros.
diff --git a/drivers/serial/cpm_uart/cpm_uart.h b/drivers/serial/cpm_uart/cpm_uart.h
index 73c8a088c160..3b35cb779539 100644
--- a/drivers/serial/cpm_uart/cpm_uart.h
+++ b/drivers/serial/cpm_uart/cpm_uart.h
@@ -5,11 +5,20 @@
  *
  *  Copyright (C) 2004 Freescale Semiconductor, Inc.
  *
+ *  2006 (c) MontaVista Software, Inc.
+ *      Vitaly Bordug <vbordug@ru.mvista.com>
+ *
+ * This file is licensed under the terms of the GNU General Public License
+ * version 2. This program is licensed "as is" without any warranty of any
+ * kind, whether express or implied.
+ *
  */
 #ifndef CPM_UART_H
 #define CPM_UART_H
 
 #include <linux/config.h>
+#include <linux/platform_device.h>
+#include <linux/fs_uart_pd.h>
 
 #if defined(CONFIG_CPM2)
 #include "cpm_uart_cpm2.h"
@@ -26,14 +35,14 @@
 #define FLAG_SMC        0x00000002
 #define FLAG_CONSOLE    0x00000001
 
-#define UART_SMC1       0
-#define UART_SMC2       1
-#define UART_SCC1       2
-#define UART_SCC2       3
-#define UART_SCC3       4
-#define UART_SCC4       5
+#define UART_SMC1       fsid_smc1_uart
+#define UART_SMC2       fsid_smc2_uart
+#define UART_SCC1       fsid_scc1_uart
+#define UART_SCC2       fsid_scc2_uart
+#define UART_SCC3       fsid_scc3_uart
+#define UART_SCC4       fsid_scc4_uart
 
-#define UART_NR 6
+#define UART_NR         fs_uart_nr
 
 #define RX_NUM_FIFO     4
 #define RX_BUF_SIZE     32
@@ -64,6 +73,7 @@ struct uart_cpm_port {
         uint                     dp_addr;
         void                    *mem_addr;
         dma_addr_t               dma_addr;
+        u32                     mem_size;
         /* helpers */
         int                      baud;
         int                      bits;
@@ -90,4 +100,38 @@ void scc2_lineif(struct uart_cpm_port *pinfo);
 void scc3_lineif(struct uart_cpm_port *pinfo);
 void scc4_lineif(struct uart_cpm_port *pinfo);
 
+/*
+   virtual to phys transtalion
+*/
+static inline unsigned long cpu2cpm_addr(void* addr, struct uart_cpm_port *pinfo)
+{
+        int offset;
+        u32 val = (u32)addr;
+        /* sane check */
+        if (likely((val >= (u32)pinfo->mem_addr)) &&
+                        (val<((u32)pinfo->mem_addr + pinfo->mem_size))) {
+                offset = val - (u32)pinfo->mem_addr;
+                return pinfo->dma_addr+offset;
+        }
+        /* something nasty happened */
+        BUG();
+        return 0;
+}
+
+static inline void *cpm2cpu_addr(unsigned long addr, struct uart_cpm_port *pinfo)
+{
+        int offset;
+        u32 val = addr;
+        /* sane check */
+        if (likely((val >= pinfo->dma_addr) &&
+                        (val<(pinfo->dma_addr + pinfo->mem_size)))) {
+                offset = val - (u32)pinfo->dma_addr;
+                return (void*)(pinfo->mem_addr+offset);
+        }
+        /* something nasty happened */
+        BUG();
+        return 0;
+}
+
+
 #endif /* CPM_UART_H */
diff --git a/drivers/serial/cpm_uart/cpm_uart_core.c b/drivers/serial/cpm_uart/cpm_uart_core.c
index b7bf4c698a47..969f94900431 100644
--- a/drivers/serial/cpm_uart/cpm_uart_core.c
+++ b/drivers/serial/cpm_uart/cpm_uart_core.c
@@ -12,7 +12,8 @@
  *
  *  Copyright (C) 2004 Freescale Semiconductor, Inc.
  *            (C) 2004 Intracom, S.A.
- *            (C) 2005 MontaVista Software, Inc. by Vitaly Bordug <vbordug@ru.mvista.com>
+ *            (C) 2005-2006 MontaVista Software, Inc.
+ *              Vitaly Bordug <vbordug@ru.mvista.com>
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by
@@ -41,6 +42,7 @@
 #include <linux/device.h>
 #include <linux/bootmem.h>
 #include <linux/dma-mapping.h>
+#include <linux/fs_uart_pd.h>
 
 #include <asm/io.h>
 #include <asm/irq.h>
@@ -60,7 +62,7 @@
 /* Track which ports are configured as uarts */
 int cpm_uart_port_map[UART_NR];
 /* How many ports did we config as uarts */
-int cpm_uart_nr;
+int cpm_uart_nr = 0;
 
 /**************************************************************/
 
@@ -71,18 +73,51 @@ static void cpm_uart_initbd(struct uart_cpm_port *pinfo);
 
 /**************************************************************/
 
-static inline unsigned long cpu2cpm_addr(void *addr)
+
+/* Place-holder for board-specific stuff */
+struct platform_device* __attribute__ ((weak)) __init
+early_uart_get_pdev(int index)
+{
+        return NULL;
+}
+
+
+static void cpm_uart_count(void)
 {
-        if ((unsigned long)addr >= CPM_ADDR)
-                return (unsigned long)addr;
-        return virt_to_bus(addr);
+        cpm_uart_nr = 0;
+#ifdef CONFIG_SERIAL_CPM_SMC1
+        cpm_uart_port_map[cpm_uart_nr++] = UART_SMC1;
+#endif
+#ifdef CONFIG_SERIAL_CPM_SMC2
+        cpm_uart_port_map[cpm_uart_nr++] = UART_SMC2;
+#endif
+#ifdef CONFIG_SERIAL_CPM_SCC1
+        cpm_uart_port_map[cpm_uart_nr++] = UART_SCC1;
+#endif
+#ifdef CONFIG_SERIAL_CPM_SCC2
+        cpm_uart_port_map[cpm_uart_nr++] = UART_SCC2;
+#endif
+#ifdef CONFIG_SERIAL_CPM_SCC3
+        cpm_uart_port_map[cpm_uart_nr++] = UART_SCC3;
+#endif
+#ifdef CONFIG_SERIAL_CPM_SCC4
+        cpm_uart_port_map[cpm_uart_nr++] = UART_SCC4;
+#endif
 }
 
-static inline void *cpm2cpu_addr(unsigned long addr)
+/* Get UART number by its id */
+static int cpm_uart_id2nr(int id)
 {
-        if (addr >= CPM_ADDR)
-                return (void *)addr;
-        return bus_to_virt(addr);
+        int i;
+        if (id < UART_NR) {
+                for (i=0; i<UART_NR; i++) {
+                        if (cpm_uart_port_map[i] == id)
+                                return i;
+                }
+        }
+
+        /* not found or invalid argument */
+        return -1;
 }
 
 /*
@@ -258,7 +293,7 @@ static void cpm_uart_int_rx(struct uart_port *port, struct pt_regs *regs)
                 }
 
                 /* get pointer */
-                cp = cpm2cpu_addr(bdp->cbd_bufaddr);
+                cp = cpm2cpu_addr(bdp->cbd_bufaddr, pinfo);
 
                 /* loop through the buffer */
                 while (i-- > 0) {
@@ -438,7 +473,11 @@ static void cpm_uart_shutdown(struct uart_port *port)
                 }
 
                 /* Shut them really down and reinit buffer descriptors */
-                cpm_line_cr_cmd(line, CPM_CR_STOP_TX);
+                if (IS_SMC(pinfo))
+                        cpm_line_cr_cmd(line, CPM_CR_STOP_TX);
+                else
+                        cpm_line_cr_cmd(line, CPM_CR_GRA_STOP_TX);
+
                 cpm_uart_initbd(pinfo);
         }
 }
@@ -601,7 +640,7 @@ static int cpm_uart_tx_pump(struct uart_port *port)
                 /* Pick next descriptor and fill from buffer */
                 bdp = pinfo->tx_cur;
 
-                p = cpm2cpu_addr(bdp->cbd_bufaddr);
+                p = cpm2cpu_addr(bdp->cbd_bufaddr, pinfo);
 
                 *p++ = port->x_char;
                 bdp->cbd_datlen = 1;
@@ -628,7 +667,7 @@ static int cpm_uart_tx_pump(struct uart_port *port)
 
         while (!(bdp->cbd_sc & BD_SC_READY) && (xmit->tail != xmit->head)) {
                 count = 0;
-                p = cpm2cpu_addr(bdp->cbd_bufaddr);
+                p = cpm2cpu_addr(bdp->cbd_bufaddr, pinfo);
                 while (count < pinfo->tx_fifosize) {
                         *p++ = xmit->buf[xmit->tail];
                         xmit->tail = (xmit->tail + 1) & (UART_XMIT_SIZE - 1);
@@ -677,12 +716,12 @@ static void cpm_uart_initbd(struct uart_cpm_port *pinfo)
         mem_addr = pinfo->mem_addr;
         bdp = pinfo->rx_cur = pinfo->rx_bd_base;
         for (i = 0; i < (pinfo->rx_nrfifos - 1); i++, bdp++) {
-                bdp->cbd_bufaddr = cpu2cpm_addr(mem_addr);
+                bdp->cbd_bufaddr = cpu2cpm_addr(mem_addr, pinfo);
                 bdp->cbd_sc = BD_SC_EMPTY | BD_SC_INTRPT;
                 mem_addr += pinfo->rx_fifosize;
         }
 
-        bdp->cbd_bufaddr = cpu2cpm_addr(mem_addr);
+        bdp->cbd_bufaddr = cpu2cpm_addr(mem_addr, pinfo);
         bdp->cbd_sc = BD_SC_WRAP | BD_SC_EMPTY | BD_SC_INTRPT;
 
         /* Set the physical address of the host memory
@@ -692,12 +731,12 @@ static void cpm_uart_initbd(struct uart_cpm_port *pinfo)
         mem_addr = pinfo->mem_addr + L1_CACHE_ALIGN(pinfo->rx_nrfifos * pinfo->rx_fifosize);
         bdp = pinfo->tx_cur = pinfo->tx_bd_base;
         for (i = 0; i < (pinfo->tx_nrfifos - 1); i++, bdp++) {
-                bdp->cbd_bufaddr = cpu2cpm_addr(mem_addr);
+                bdp->cbd_bufaddr = cpu2cpm_addr(mem_addr, pinfo);
                 bdp->cbd_sc = BD_SC_INTRPT;
                 mem_addr += pinfo->tx_fifosize;
         }
 
-        bdp->cbd_bufaddr = cpu2cpm_addr(mem_addr);
+        bdp->cbd_bufaddr = cpu2cpm_addr(mem_addr, pinfo);
         bdp->cbd_sc = BD_SC_WRAP | BD_SC_INTRPT;
 }
 
@@ -829,14 +868,6 @@ static int cpm_uart_request_port(struct uart_port *port)
         if (pinfo->flags & FLAG_CONSOLE)
                 return 0;
 
-        /*
-         * Setup any port IO, connect any baud rate generators,
-         * etc.  This is expected to be handled by board
-         * dependant code
-         */
-        if (pinfo->set_lineif)
-                pinfo->set_lineif(pinfo);
-
         if (IS_SMC(pinfo)) {
                 pinfo->smcp->smc_smcm &= ~(SMCM_RX | SMCM_TX);
                 pinfo->smcp->smc_smcmr &= ~(SMCMR_REN | SMCMR_TEN);
@@ -988,6 +1019,58 @@ struct uart_cpm_port cpm_uart_ports[UART_NR] = {
         },
 };
 
+int cpm_uart_drv_get_platform_data(struct platform_device *pdev, int is_con)
+{
+        struct resource *r;
+        struct fs_uart_platform_info *pdata = pdev->dev.platform_data;
+        int idx = pdata->fs_no; /* It is UART_SMCx or UART_SCCx index */
+        struct uart_cpm_port *pinfo;
+        int line;
+        u32 mem, pram;
+
+        line = cpm_uart_id2nr(idx);
+        if(line < 0) {
+                printk(KERN_ERR"%s(): port %d is not registered", __FUNCTION__, idx);
+                return -1;
+        }
+
+        pinfo = (struct uart_cpm_port *) &cpm_uart_ports[idx];
+
+        pinfo->brg = pdata->brg;
+
+        if (!is_con) {
+                pinfo->port.line = line;
+                pinfo->port.flags = UPF_BOOT_AUTOCONF;
+        }
+
+        if (!(r = platform_get_resource_byname(pdev, IORESOURCE_MEM, "regs")))
+                return -EINVAL;
+        mem = r->start;
+
+        if (!(r = platform_get_resource_byname(pdev, IORESOURCE_MEM, "pram")))
+                return -EINVAL;
+        pram = r->start;
+
+        if(idx > fsid_smc2_uart) {
+                pinfo->sccp = (scc_t *)mem;
+                pinfo->sccup = (scc_uart_t *)pram;
+        } else {
+                pinfo->smcp = (smc_t *)mem;
+                pinfo->smcup = (smc_uart_t *)pram;
+        }
+        pinfo->tx_nrfifos = pdata->tx_num_fifo;
+        pinfo->tx_fifosize = pdata->tx_buf_size;
+
+        pinfo->rx_nrfifos = pdata->rx_num_fifo;
+        pinfo->rx_fifosize = pdata->rx_buf_size;
+
+        pinfo->port.uartclk = pdata->uart_clk;
+        pinfo->port.mapbase = (unsigned long)mem;
+        pinfo->port.irq = platform_get_irq(pdev, 0);
+
+        return 0;
+}
+
 #ifdef CONFIG_SERIAL_CPM_CONSOLE
 /*
  *      Print a string to the serial port trying not to disturb
@@ -1027,7 +1110,7 @@ static void cpm_uart_console_write(struct console *co, const char *s,
                  * If the buffer address is in the CPM DPRAM, don't
                  * convert it.
                  */
-                cp = cpm2cpu_addr(bdp->cbd_bufaddr);
+                cp = cpm2cpu_addr(bdp->cbd_bufaddr, pinfo);
 
                 *cp = *s;
 
@@ -1044,7 +1127,7 @@ static void cpm_uart_console_write(struct console *co, const char *s,
                         while ((bdp->cbd_sc & BD_SC_READY) != 0)
                                 ;
 
-                        cp = cpm2cpu_addr(bdp->cbd_bufaddr);
+                        cp = cpm2cpu_addr(bdp->cbd_bufaddr, pinfo);
 
                         *cp = 13;
                         bdp->cbd_datlen = 1;
@@ -1067,9 +1150,7 @@ static void cpm_uart_console_write(struct console *co, const char *s,
         pinfo->tx_cur = (volatile cbd_t *) bdp;
 }
 
-/*
- * Setup console. Be careful is called early !
- */
+
 static int __init cpm_uart_console_setup(struct console *co, char *options)
 {
         struct uart_port *port;
@@ -1080,9 +1161,27 @@ static int __init cpm_uart_console_setup(struct console *co, char *options)
         int flow = 'n';
         int ret;
 
+        struct fs_uart_platform_info *pdata;
+        struct platform_device* pdev = early_uart_get_pdev(co->index);
+
         port =
             (struct uart_port *)&cpm_uart_ports[cpm_uart_port_map[co->index]];
         pinfo = (struct uart_cpm_port *)port;
+        if (!pdev) {
+                pr_info("cpm_uart: console: compat mode\n");
+                /* compatibility - will be cleaned up */
+                cpm_uart_init_portdesc();
+
+                if (pinfo->set_lineif)
+                        pinfo->set_lineif(pinfo);
+        } else {
+                pdata = pdev->dev.platform_data;
+                if (pdata)
+                        if (pdata->init_ioports)
+                                pdata->init_ioports();
+
+                cpm_uart_drv_get_platform_data(pdev, 1);
+        }
 
         pinfo->flags |= FLAG_CONSOLE;
 
@@ -1097,14 +1196,6 @@ static int __init cpm_uart_console_setup(struct console *co, char *options)
                         baud = 9600;
         }
 
-        /*
-         * Setup any port IO, connect any baud rate generators,
-         * etc.  This is expected to be handled by board
-         * dependant code
-         */
-        if (pinfo->set_lineif)
-                pinfo->set_lineif(pinfo);
-
         if (IS_SMC(pinfo)) {
                 pinfo->smcp->smc_smcm &= ~(SMCM_RX | SMCM_TX);
                 pinfo->smcp->smc_smcmr &= ~(SMCMR_REN | SMCMR_TEN);
@@ -1143,11 +1234,8 @@ static struct console cpm_scc_uart_console = {
 
 int __init cpm_uart_console_init(void)
 {
-        int ret = cpm_uart_init_portdesc();
-
-        if (!ret)
-                register_console(&cpm_scc_uart_console);
-        return ret;
+        register_console(&cpm_scc_uart_console);
+        return 0;
 }
 
 console_initcall(cpm_uart_console_init);
@@ -1165,44 +1253,129 @@ static struct uart_driver cpm_reg = {
         .minor          = SERIAL_CPM_MINOR,
         .cons           = CPM_UART_CONSOLE,
 };
-
-static int __init cpm_uart_init(void)
+static int cpm_uart_drv_probe(struct device *dev)
 {
-        int ret, i;
-
-        printk(KERN_INFO "Serial: CPM driver $Revision: 0.01 $\n");
+        struct platform_device  *pdev = to_platform_device(dev);
+        struct fs_uart_platform_info *pdata;
+        int ret = -ENODEV;
 
-#ifndef CONFIG_SERIAL_CPM_CONSOLE
-        ret = cpm_uart_init_portdesc();
-        if (ret)
+        if(!pdev) {
+                printk(KERN_ERR"CPM UART: platform data missing!\n");
                 return ret;
-#endif
+        }
 
-        cpm_reg.nr = cpm_uart_nr;
-        ret = uart_register_driver(&cpm_reg);
+        pdata = pdev->dev.platform_data;
+        pr_debug("cpm_uart_drv_probe: Adding CPM UART %d\n", cpm_uart_id2nr(pdata->fs_no));
 
-        if (ret)
+        if ((ret = cpm_uart_drv_get_platform_data(pdev, 0)))
                 return ret;
 
-        for (i = 0; i < cpm_uart_nr; i++) {
-                int con = cpm_uart_port_map[i];
-                cpm_uart_ports[con].port.line = i;
-                cpm_uart_ports[con].port.flags = UPF_BOOT_AUTOCONF;
-                uart_add_one_port(&cpm_reg, &cpm_uart_ports[con].port);
-        }
+        if (pdata->init_ioports)
+                pdata->init_ioports();
 
-        return ret;
+        ret = uart_add_one_port(&cpm_reg, &cpm_uart_ports[pdata->fs_no].port);
+
+        return ret;
 }
 
-static void __exit cpm_uart_exit(void)
+static int cpm_uart_drv_remove(struct device *dev)
 {
+        struct platform_device  *pdev = to_platform_device(dev);
+        struct fs_uart_platform_info *pdata = pdev->dev.platform_data;
+
+        pr_debug("cpm_uart_drv_remove: Removing CPM UART %d\n",
+                        cpm_uart_id2nr(pdata->fs_no));
+
+        uart_remove_one_port(&cpm_reg, &cpm_uart_ports[pdata->fs_no].port);
+        return 0;
+}
+
+static struct device_driver cpm_smc_uart_driver = {
+        .name   = "fsl-cpm-smc:uart",
+        .bus    = &platform_bus_type,
+        .probe  = cpm_uart_drv_probe,
+        .remove = cpm_uart_drv_remove,
+};
+
+static struct device_driver cpm_scc_uart_driver = {
+        .name   = "fsl-cpm-scc:uart",
+        .bus    = &platform_bus_type,
+        .probe  = cpm_uart_drv_probe,
+        .remove = cpm_uart_drv_remove,
+};
+
+/*
+   This is supposed to match uart devices on platform bus,
+   */
+static int match_is_uart (struct device* dev, void* data)
+{
+        struct platform_device* pdev = container_of(dev, struct platform_device, dev);
+        int ret = 0;
+        /* this was setfunc as uart */
+        if(strstr(pdev->name,":uart")) {
+                ret = 1;
+        }
+        return ret;
+}
+
+
+static int cpm_uart_init(void) {
+
+        int ret;
         int i;
+        struct device *dev;
+        printk(KERN_INFO "Serial: CPM driver $Revision: 0.02 $\n");
+
+        /* lookup the bus for uart devices */
+        dev = bus_find_device(&platform_bus_type, NULL, 0, match_is_uart);
+
+        /* There are devices on the bus - all should be OK  */
+        if (dev) {
+                cpm_uart_count();
+                cpm_reg.nr = cpm_uart_nr;
+
+                if (!(ret = uart_register_driver(&cpm_reg))) {
+                        if ((ret = driver_register(&cpm_smc_uart_driver))) {
+                                uart_unregister_driver(&cpm_reg);
+                                return ret;
+                        }
+                        if ((ret = driver_register(&cpm_scc_uart_driver))) {
+                                driver_unregister(&cpm_scc_uart_driver);
+                                uart_unregister_driver(&cpm_reg);
+                        }
+                }
+        } else {
+        /* No capable platform devices found - falling back to legacy mode */
+                pr_info("cpm_uart: WARNING: no UART devices found on platform bus!\n");
+                pr_info(
+                "cpm_uart: the driver will guess configuration, but this mode is no longer supported.\n");
+#ifndef CONFIG_SERIAL_CPM_CONSOLE
+                ret = cpm_uart_init_portdesc();
+                if (ret)
+                        return ret;
+#endif
+
+                cpm_reg.nr = cpm_uart_nr;
+                ret = uart_register_driver(&cpm_reg);
+
+                if (ret)
+                        return ret;
+
+                for (i = 0; i < cpm_uart_nr; i++) {
+                        int con = cpm_uart_port_map[i];
+                        cpm_uart_ports[con].port.line = i;
+                        cpm_uart_ports[con].port.flags = UPF_BOOT_AUTOCONF;
+                        uart_add_one_port(&cpm_reg, &cpm_uart_ports[con].port);
+                }
 
-        for (i = 0; i < cpm_uart_nr; i++) {
-                int con = cpm_uart_port_map[i];
-                uart_remove_one_port(&cpm_reg, &cpm_uart_ports[con].port);
         }
+        return ret;
+}
 
+static void __exit cpm_uart_exit(void)
+{
+        driver_unregister(&cpm_scc_uart_driver);
+        driver_unregister(&cpm_smc_uart_driver);
         uart_unregister_driver(&cpm_reg);
 }
 
diff --git a/drivers/serial/cpm_uart/cpm_uart_cpm1.c b/drivers/serial/cpm_uart/cpm_uart_cpm1.c
index d789ee55cbb7..17406a05ce1f 100644
--- a/drivers/serial/cpm_uart/cpm_uart_cpm1.c
+++ b/drivers/serial/cpm_uart/cpm_uart_cpm1.c
@@ -8,6 +8,8 @@
  *
  *  Copyright (C) 2004 Freescale Semiconductor, Inc.
  *            (C) 2004 Intracom, S.A.
+ *            (C) 2006 MontaVista Software, Inc.
+ *              Vitaly Bordug <vbordug@ru.mvista.com>
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by
@@ -81,58 +83,11 @@ void cpm_line_cr_cmd(int line, int cmd)
 
 void smc1_lineif(struct uart_cpm_port *pinfo)
 {
-        volatile cpm8xx_t *cp = cpmp;
-
-        (void)cp;       /* fix warning */
-#if defined (CONFIG_MPC885ADS)
-        /* Enable SMC1 transceivers */
-        {
-                cp->cp_pepar |= 0x000000c0;
-                cp->cp_pedir &= ~0x000000c0;
-                cp->cp_peso &= ~0x00000040;
-                cp->cp_peso |= 0x00000080;
-        }
-#elif defined (CONFIG_MPC86XADS)
-        unsigned int iobits = 0x000000c0;
-
-        if (!pinfo->is_portb) {
-                cp->cp_pbpar |= iobits;
-                cp->cp_pbdir &= ~iobits;
-                cp->cp_pbodr &= ~iobits;
-        } else {
-                ((immap_t *)IMAP_ADDR)->im_ioport.iop_papar |= iobits;
-                ((immap_t *)IMAP_ADDR)->im_ioport.iop_padir &= ~iobits;
-                ((immap_t *)IMAP_ADDR)->im_ioport.iop_paodr &= ~iobits;
-        }
-#endif
         pinfo->brg = 1;
 }
 
 void smc2_lineif(struct uart_cpm_port *pinfo)
 {
-        volatile cpm8xx_t *cp = cpmp;
-
-        (void)cp;       /* fix warning */
-#if defined (CONFIG_MPC885ADS)
-        cp->cp_pepar |= 0x00000c00;
-        cp->cp_pedir &= ~0x00000c00;
-        cp->cp_peso &= ~0x00000400;
-        cp->cp_peso |= 0x00000800;
-#elif defined (CONFIG_MPC86XADS)
-        unsigned int iobits = 0x00000c00;
-
-        if (!pinfo->is_portb) {
-                cp->cp_pbpar |= iobits;
-                cp->cp_pbdir &= ~iobits;
-                cp->cp_pbodr &= ~iobits;
-        } else {
-                ((immap_t *)IMAP_ADDR)->im_ioport.iop_papar |= iobits;
-                ((immap_t *)IMAP_ADDR)->im_ioport.iop_padir &= ~iobits;
-                ((immap_t *)IMAP_ADDR)->im_ioport.iop_paodr &= ~iobits;
-        }
-
-#endif
-
         pinfo->brg = 2;
 }
 
@@ -191,7 +146,7 @@ int cpm_uart_allocbuf(struct uart_cpm_port *pinfo, unsigned int is_con)
                 /* was hostalloc but changed cause it blows away the */
                 /* large tlb mapping when pinning the kernel area    */
                 mem_addr = (u8 *) cpm_dpram_addr(cpm_dpalloc(memsz, 8));
-                dma_addr = 0;
+                dma_addr = (u32)mem_addr;
         } else
                 mem_addr = dma_alloc_coherent(NULL, memsz, &dma_addr,
                                               GFP_KERNEL);
@@ -204,8 +159,9 @@ int cpm_uart_allocbuf(struct uart_cpm_port *pinfo, unsigned int is_con)
         }
 
         pinfo->dp_addr = dp_offset;
-        pinfo->mem_addr = mem_addr;
-        pinfo->dma_addr = dma_addr;
+        pinfo->mem_addr = mem_addr;             /*  virtual address*/
+        pinfo->dma_addr = dma_addr;             /*  physical address*/
+        pinfo->mem_size = memsz;
 
         pinfo->rx_buf = mem_addr;
         pinfo->tx_buf = pinfo->rx_buf + L1_CACHE_ALIGN(pinfo->rx_nrfifos
diff --git a/drivers/serial/cpm_uart/cpm_uart_cpm2.c b/drivers/serial/cpm_uart/cpm_uart_cpm2.c
index fd9e53ed3feb..4b2de08f46d0 100644
--- a/drivers/serial/cpm_uart/cpm_uart_cpm2.c
+++ b/drivers/serial/cpm_uart/cpm_uart_cpm2.c
@@ -8,6 +8,8 @@
  * 
  *  Copyright (C) 2004 Freescale Semiconductor, Inc.
  *            (C) 2004 Intracom, S.A.
+ *            (C) 2006 MontaVista Software, Inc.
+ *              Vitaly Bordug <vbordug@ru.mvista.com>
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by
@@ -142,14 +144,6 @@ void scc2_lineif(struct uart_cpm_port *pinfo)
          * be supported in a sane fashion.
          */
 #ifndef CONFIG_STX_GP3
-#ifdef CONFIG_MPC8560_ADS
-        volatile iop_cpm2_t *io = &cpm2_immr->im_ioport;
-        io->iop_ppard |= 0x00000018;
-        io->iop_psord &= ~0x00000008;   /* Rx */
-        io->iop_psord &= ~0x00000010;   /* Tx */
-        io->iop_pdird &= ~0x00000008;   /* Rx */
-        io->iop_pdird |= 0x00000010;    /* Tx */
-#else
         volatile iop_cpm2_t *io = &cpm2_immr->im_ioport;
         io->iop_pparb |= 0x008b0000;
         io->iop_pdirb |= 0x00880000;
@@ -157,7 +151,6 @@ void scc2_lineif(struct uart_cpm_port *pinfo)
         io->iop_pdirb &= ~0x00030000;
         io->iop_psorb &= ~0x00030000;
 #endif
-#endif
         cpm2_immr->im_cpmux.cmx_scr &= 0xff00ffff;
         cpm2_immr->im_cpmux.cmx_scr |= 0x00090000;
         pinfo->brg = 2;
@@ -218,8 +211,10 @@ int cpm_uart_allocbuf(struct uart_cpm_port *pinfo, unsigned int is_con)
 
         memsz = L1_CACHE_ALIGN(pinfo->rx_nrfifos * pinfo->rx_fifosize) +
             L1_CACHE_ALIGN(pinfo->tx_nrfifos * pinfo->tx_fifosize);
-        if (is_con)
+        if (is_con) {
                 mem_addr = alloc_bootmem(memsz);
+                dma_addr = mem_addr;
+        }
         else
                 mem_addr = dma_alloc_coherent(NULL, memsz, &dma_addr,
                                               GFP_KERNEL);
@@ -234,6 +229,7 @@ int cpm_uart_allocbuf(struct uart_cpm_port *pinfo, unsigned int is_con)
         pinfo->dp_addr = dp_offset;
         pinfo->mem_addr = mem_addr;
         pinfo->dma_addr = dma_addr;
+        pinfo->mem_size = memsz;
 
         pinfo->rx_buf = mem_addr;
         pinfo->tx_buf = pinfo->rx_buf + L1_CACHE_ALIGN(pinfo->rx_nrfifos
diff --git a/drivers/serial/imx.c b/drivers/serial/imx.c
index c3b7a6673e9c..d202eb4f3848 100644
--- a/drivers/serial/imx.c
+++ b/drivers/serial/imx.c
@@ -45,6 +45,7 @@
 #include <asm/io.h>
 #include <asm/irq.h>
 #include <asm/hardware.h>
+#include <asm/arch/imx-uart.h>
 
 /* We've been assigned a range on the "Low-density serial ports" major */
 #define SERIAL_IMX_MAJOR        204
@@ -73,7 +74,8 @@ struct imx_port {
         struct uart_port        port;
         struct timer_list       timer;
         unsigned int            old_status;
-        int txirq,rxirq,rtsirq;
+        int                     txirq,rxirq,rtsirq;
+        int                     have_rtscts:1;
 };
 
 /*
@@ -491,8 +493,12 @@ imx_set_termios(struct uart_port *port, struct termios *termios,
                 ucr2 = UCR2_SRST | UCR2_IRTS;
 
         if (termios->c_cflag & CRTSCTS) {
-                ucr2 &= ~UCR2_IRTS;
-                ucr2 |= UCR2_CTSC;
+                if( sport->have_rtscts ) {
+                        ucr2 &= ~UCR2_IRTS;
+                        ucr2 |= UCR2_CTSC;
+                } else {
+                        termios->c_cflag &= ~CRTSCTS;
+                }
         }
 
         if (termios->c_cflag & CSTOPB)
@@ -719,27 +725,6 @@ static void __init imx_init_ports(void)
                 imx_ports[i].timer.function = imx_timeout;
                 imx_ports[i].timer.data     = (unsigned long)&imx_ports[i];
         }
-
-        imx_gpio_mode(PC9_PF_UART1_CTS);
-        imx_gpio_mode(PC10_PF_UART1_RTS);
-        imx_gpio_mode(PC11_PF_UART1_TXD);
-        imx_gpio_mode(PC12_PF_UART1_RXD);
-        imx_gpio_mode(PB28_PF_UART2_CTS);
-        imx_gpio_mode(PB29_PF_UART2_RTS);
-
-        imx_gpio_mode(PB30_PF_UART2_TXD);
-        imx_gpio_mode(PB31_PF_UART2_RXD);
-
-#if 0 /* We don't need these, on the mx1 the _modem_ side of the uart
-       * is implemented.
-       */
-        imx_gpio_mode(PD7_AF_UART2_DTR);
-        imx_gpio_mode(PD8_AF_UART2_DCD);
-        imx_gpio_mode(PD9_AF_UART2_RI);
-        imx_gpio_mode(PD10_AF_UART2_DSR);
-#endif
-
-
 }
 
 #ifdef CONFIG_SERIAL_IMX_CONSOLE
@@ -932,7 +917,14 @@ static int serial_imx_resume(struct platform_device *dev)
 
 static int serial_imx_probe(struct platform_device *dev)
 {
+        struct imxuart_platform_data *pdata;
+
         imx_ports[dev->id].port.dev = &dev->dev;
+
+        pdata = (struct imxuart_platform_data *)dev->dev.platform_data;
+        if(pdata && (pdata->flags & IMXUART_HAVE_RTSCTS))
+                imx_ports[dev->id].have_rtscts = 1;
+
         uart_add_one_port(&imx_reg, &imx_ports[dev->id].port);
         platform_set_drvdata(dev, &imx_ports[dev->id]);
         return 0;
diff --git a/drivers/sn/ioc3.c b/drivers/sn/ioc3.c
index 0b49ff78efc1..501316b198e5 100644
--- a/drivers/sn/ioc3.c
+++ b/drivers/sn/ioc3.c
@@ -678,7 +678,7 @@ static int ioc3_probe(struct pci_dev *pdev, const struct pci_device_id *pci_id)
         /* Track PCI-device specific data */
         pci_set_drvdata(pdev, idd);
         down_write(&ioc3_devices_rwsem);
-        list_add(&idd->list, &ioc3_devices);
+        list_add_tail(&idd->list, &ioc3_devices);
         idd->id = ioc3_counter++;
         up_write(&ioc3_devices_rwsem);
 
diff --git a/drivers/sn/ioc4.c b/drivers/sn/ioc4.c
index 67140a5804f5..cdeff909403e 100644
--- a/drivers/sn/ioc4.c
+++ b/drivers/sn/ioc4.c
@@ -310,7 +310,7 @@ ioc4_probe(struct pci_dev *pdev, const struct pci_device_id *pci_id)
         pci_set_drvdata(idd->idd_pdev, idd);
 
         mutex_lock(&ioc4_mutex);
-        list_add(&idd->idd_list, &ioc4_devices);
+        list_add_tail(&idd->idd_list, &ioc4_devices);
 
         /* Add this IOC4 to all submodules */
         list_for_each_entry(is, &ioc4_submodules, is_list) {
diff --git a/drivers/usb/gadget/inode.c b/drivers/usb/gadget/inode.c
index 42b457030b03..0eb010a3f5bc 100644
--- a/drivers/usb/gadget/inode.c
+++ b/drivers/usb/gadget/inode.c
@@ -1614,6 +1614,7 @@ static int activate_ep_files (struct dev_data *dev)
                                 data, &ep_config_operations,
                                 &data->dentry);
                 if (!data->inode) {
+                        usb_ep_free_request(ep, data->req);
                         kfree (data);
                         goto enomem;
                 }
diff --git a/drivers/usb/gadget/net2280.c b/drivers/usb/gadget/net2280.c
index 6a4b93ad1082..0b9293493957 100644
--- a/drivers/usb/gadget/net2280.c
+++ b/drivers/usb/gadget/net2280.c
@@ -2166,7 +2166,7 @@ static void handle_ep_small (struct net2280_ep *ep)
                                         ep->stopped = 1;
                                         set_halt (ep);
                                         mode = 2;
-                                } else if (!req && ep->stopped)
+                                } else if (!req && !ep->stopped)
                                         write_fifo (ep, NULL);
                         }
                 } else {
@@ -2280,9 +2280,7 @@ static void handle_ep_small (struct net2280_ep *ep)
                 /* if we wrote it all, we're usually done */
                 if (req->req.actual == req->req.length) {
                         if (ep->num == 0) {
-                                /* wait for control status */
-                                if (mode != 2)
-                                        req = NULL;
+                                /* send zlps until the status stage */
                         } else if (!req->req.zero || len != ep->ep.maxpacket)
                                 mode = 2;
                 }
@@ -2744,6 +2742,10 @@ static irqreturn_t net2280_irq (int irq, void *_dev, struct pt_regs * r)
 {
         struct net2280          *dev = _dev;
 
+        /* shared interrupt, not ours */
+        if (!(readl(&dev->regs->irqstat0) & (1 << INTA_ASSERTED)))
+                return IRQ_NONE;
+
         spin_lock (&dev->lock);
 
         /* handle disconnect, dma, and more */
@@ -2831,13 +2833,13 @@ static int net2280_probe (struct pci_dev *pdev, const struct pci_device_id *id)
         }
 
         /* alloc, and start init */
-        dev = kmalloc (sizeof *dev, SLAB_KERNEL);
+        dev = kzalloc (sizeof *dev, SLAB_KERNEL);
         if (dev == NULL){
                 retval = -ENOMEM;
                 goto done;
         }
 
-        memset (dev, 0, sizeof *dev);
+        pci_set_drvdata (pdev, dev);
         spin_lock_init (&dev->lock);
         dev->pdev = pdev;
         dev->gadget.ops = &net2280_ops;
@@ -2950,7 +2952,6 @@ static int net2280_probe (struct pci_dev *pdev, const struct pci_device_id *id)
         dev->chiprev = get_idx_reg (dev->regs, REG_CHIPREV) & 0xffff;
 
         /* done */
-        pci_set_drvdata (pdev, dev);
         INFO (dev, "%s\n", driver_desc);
         INFO (dev, "irq %s, pci mem %p, chip rev %04x\n",
                         bufp, base, dev->chiprev);
diff --git a/drivers/usb/host/ehci-pci.c b/drivers/usb/host/ehci-pci.c
index 1e03f1a5a5fd..a1bd2bea6deb 100644
--- a/drivers/usb/host/ehci-pci.c
+++ b/drivers/usb/host/ehci-pci.c
@@ -350,7 +350,7 @@ static const struct hc_driver ehci_pci_hc_driver = {
 /* PCI driver selection metadata; PCI hotplugging uses this */
 static const struct pci_device_id pci_ids [] = { {
         /* handle any USB 2.0 EHCI controller */
-        PCI_DEVICE_CLASS(((PCI_CLASS_SERIAL_USB << 8) | 0x20), ~0),
+        PCI_DEVICE_CLASS(PCI_CLASS_SERIAL_USB_EHCI, ~0),
         .driver_data =  (unsigned long) &ehci_pci_hc_driver,
         },
         { /* end: all zeroes */ }
diff --git a/drivers/usb/host/ohci-pci.c b/drivers/usb/host/ohci-pci.c
index 1bfe96f4d045..b268537e389e 100644
--- a/drivers/usb/host/ohci-pci.c
+++ b/drivers/usb/host/ohci-pci.c
@@ -206,7 +206,7 @@ static const struct hc_driver ohci_pci_hc_driver = {
 
 static const struct pci_device_id pci_ids [] = { {
         /* handle any USB OHCI controller */
-        PCI_DEVICE_CLASS((PCI_CLASS_SERIAL_USB << 8) | 0x10, ~0),
+        PCI_DEVICE_CLASS(PCI_CLASS_SERIAL_USB_OHCI, ~0),
         .driver_data =  (unsigned long) &ohci_pci_hc_driver,
         }, { /* end: all zeroes */ }
 };
diff --git a/drivers/usb/host/uhci-hcd.c b/drivers/usb/host/uhci-hcd.c
index c0c4db78b590..d225e11f4055 100644
--- a/drivers/usb/host/uhci-hcd.c
+++ b/drivers/usb/host/uhci-hcd.c
@@ -858,7 +858,7 @@ static const struct hc_driver uhci_driver = {
 
 static const struct pci_device_id uhci_pci_ids[] = { {
         /* handle any USB UHCI controller */
-        PCI_DEVICE_CLASS(((PCI_CLASS_SERIAL_USB << 8) | 0x00), ~0),
+        PCI_DEVICE_CLASS(PCI_CLASS_SERIAL_USB_UHCI, ~0),
         .driver_data =  (unsigned long) &uhci_driver,
         }, { /* end: all zeroes */ }
 };
diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c
index f5851db67f5b..82151207d814 100644
--- a/drivers/usb/serial/ftdi_sio.c
+++ b/drivers/usb/serial/ftdi_sio.c
@@ -308,6 +308,7 @@ static struct ftdi_sio_quirk ftdi_HE_TIRA1_quirk = {
 
 static struct usb_device_id id_table_combined [] = {
         { USB_DEVICE(FTDI_VID, FTDI_IRTRANS_PID) },
+        { USB_DEVICE(FTDI_VID, FTDI_IPLUS_PID) },
         { USB_DEVICE(FTDI_VID, FTDI_SIO_PID) },
         { USB_DEVICE(FTDI_VID, FTDI_8U232AM_PID) },
         { USB_DEVICE(FTDI_VID, FTDI_8U232AM_ALT_PID) },
@@ -493,6 +494,8 @@ static struct usb_device_id id_table_combined [] = {
         { USB_DEVICE(FTDI_VID, FTDI_WESTREX_MODEL_777_PID) },
         { USB_DEVICE(FTDI_VID, FTDI_WESTREX_MODEL_8900F_PID) },
         { USB_DEVICE(FTDI_VID, FTDI_PCDJ_DAC2_PID) },
+        { USB_DEVICE(FTDI_VID, FTDI_RRCIRKITS_LOCOBUFFER_PID) },
+        { USB_DEVICE(FTDI_VID, FTDI_ASK_RDR400_PID) },
         { USB_DEVICE(ICOM_ID1_VID, ICOM_ID1_PID) },
         { USB_DEVICE(PAPOUCH_VID, PAPOUCH_TMU_PID) },
         { },                                    /* Optional parameter entry */
diff --git a/drivers/usb/serial/ftdi_sio.h b/drivers/usb/serial/ftdi_sio.h
index 2155f0e4a378..2c55a5ea9c99 100644
--- a/drivers/usb/serial/ftdi_sio.h
+++ b/drivers/usb/serial/ftdi_sio.h
@@ -39,6 +39,9 @@
 /* www.thoughttechnology.com/ TT-USB provide with procomp use ftdi_sio */
 #define FTDI_TTUSB_PID 0xFF20 /* Product Id */
 
+/* iPlus device */
+#define FTDI_IPLUS_PID 0xD070 /* Product Id */
+
 /* www.crystalfontz.com devices - thanx for providing free devices for evaluation ! */
 /* they use the ftdi chipset for the USB interface and the vendor id is the same */
 #define FTDI_XF_632_PID 0xFC08  /* 632: 16x2 Character Display */
@@ -153,6 +156,11 @@
 #define ICOM_ID1_PID            0x0004
 
 /*
+ * ASK.fr devices
+ */
+#define FTDI_ASK_RDR400_PID     0xC991  /* ASK RDR 400 series card reader */
+
+/*
  * DSS-20 Sync Station for Sony Ericsson P800
  */
  
@@ -400,6 +408,11 @@
 #define FTDI_WESTREX_MODEL_8900F_PID    0xDC01  /* Model 8900F */
 
 /*
+ * RR-CirKits LocoBuffer USB (http://www.rr-cirkits.com)
+ */
+#define FTDI_RRCIRKITS_LOCOBUFFER_PID   0xc7d0  /* LocoBuffer USB */
+
+/*
  * Eclo (http://www.eclo.pt/) product IDs.
  * PID 0xEA90 submitted by Martin Grill.
  */
diff --git a/drivers/usb/serial/pl2303.c b/drivers/usb/serial/pl2303.c
index ccf746b27d4e..c96714bb1cb8 100644
--- a/drivers/usb/serial/pl2303.c
+++ b/drivers/usb/serial/pl2303.c
@@ -61,6 +61,7 @@ static struct usb_device_id id_table [] = {
         { USB_DEVICE(ELCOM_VENDOR_ID, ELCOM_PRODUCT_ID) },
         { USB_DEVICE(ELCOM_VENDOR_ID, ELCOM_PRODUCT_ID_UCSGT) },
         { USB_DEVICE(ITEGNO_VENDOR_ID, ITEGNO_PRODUCT_ID) },
+        { USB_DEVICE(ITEGNO_VENDOR_ID, ITEGNO_PRODUCT_ID_2080) },
         { USB_DEVICE(MA620_VENDOR_ID, MA620_PRODUCT_ID) },
         { USB_DEVICE(RATOC_VENDOR_ID, RATOC_PRODUCT_ID) },
         { USB_DEVICE(TRIPP_VENDOR_ID, TRIPP_PRODUCT_ID) },
diff --git a/drivers/usb/serial/pl2303.h b/drivers/usb/serial/pl2303.h
index 09f379b19e98..7f29e81d3e35 100644
--- a/drivers/usb/serial/pl2303.h
+++ b/drivers/usb/serial/pl2303.h
@@ -26,6 +26,7 @@
 
 #define ITEGNO_VENDOR_ID        0x0eba
 #define ITEGNO_PRODUCT_ID       0x1080
+#define ITEGNO_PRODUCT_ID_2080  0x2080
 
 #define MA620_VENDOR_ID         0x0df7
 #define MA620_PRODUCT_ID        0x0620
diff --git a/drivers/usb/serial/whiteheat.c b/drivers/usb/serial/whiteheat.c
index 557411c6e7c7..f806553cd9a4 100644
--- a/drivers/usb/serial/whiteheat.c
+++ b/drivers/usb/serial/whiteheat.c
@@ -508,6 +508,7 @@ no_firmware:
         err("%s: Unable to retrieve firmware version, try replugging\n", serial->type->description);
         err("%s: If the firmware is not running (status led not blinking)\n", serial->type->description);
         err("%s: please contact support@connecttech.com\n", serial->type->description);
+        kfree(result);
         return -ENODEV;
 
 no_command_private:
diff --git a/drivers/usb/storage/unusual_devs.h b/drivers/usb/storage/unusual_devs.h
index c4a9dcff5f2b..aec5ea8682d5 100644
--- a/drivers/usb/storage/unusual_devs.h
+++ b/drivers/usb/storage/unusual_devs.h
@@ -411,7 +411,7 @@ UNUSUAL_DEV(  0x050d, 0x0115, 0x0133, 0x0133,
 UNUSUAL_DEV(  0x0525, 0xa140, 0x0100, 0x0100,
                 "Iomega",
                 "USB Clik! 40",
-                US_SC_8070, US_PR_BULK, NULL,
+                US_SC_8070, US_PR_DEVICE, NULL,
                 US_FL_FIX_INQUIRY ),
 
 /* Yakumo Mega Image 37
@@ -773,6 +773,13 @@ UNUSUAL_DEV(  0x069b, 0x3004, 0x0001, 0x0001,
                 US_SC_DEVICE, US_PR_DEVICE, NULL,
                 US_FL_FIX_CAPACITY ),
 
+/* Reported by Olivier Blondeau <zeitoun@gmail.com> */
+UNUSUAL_DEV(  0x0727, 0x0306, 0x0100, 0x0100,
+                "ATMEL",
+                "SND1 Storage",
+                US_SC_DEVICE, US_PR_DEVICE, NULL,
+                US_FL_IGNORE_RESIDUE),
+
 /* Submitted by Roman Hodek <roman@hodek.net> */
 UNUSUAL_DEV(  0x0781, 0x0001, 0x0200, 0x0200,
                 "Sandisk",
diff --git a/drivers/video/Kconfig b/drivers/video/Kconfig
index 9060e7137441..4587087d777a 100644
--- a/drivers/video/Kconfig
+++ b/drivers/video/Kconfig
@@ -400,6 +400,8 @@ config FB_ASILIANT
         select FB_CFB_FILLRECT
         select FB_CFB_COPYAREA
         select FB_CFB_IMAGEBLIT
+        help
+          This is the frame buffer device driver for the Asiliant 69030 chipset
 
 config FB_IMSTT
         bool "IMS Twin Turbo display support"
diff --git a/drivers/video/au1200fb.c b/drivers/video/au1200fb.c
index b367de30b98c..600d3e0e08b7 100644
--- a/drivers/video/au1200fb.c
+++ b/drivers/video/au1200fb.c
@@ -1920,1925 +1920,3 @@ module_exit(au1200fb_cleanup);
 
 MODULE_DESCRIPTION(DRIVER_DESC);
 MODULE_LICENSE("GPL");
-/*
- * BRIEF MODULE DESCRIPTION
- *      Au1200 LCD Driver.
- *
- * Copyright 2004-2005 AMD
- * Author: AMD
- *
- * Based on:
- * linux/drivers/video/skeletonfb.c -- Skeleton for a frame buffer device
- *  Created 28 Dec 1997 by Geert Uytterhoeven
- *
- *  This program is free software; you can redistribute  it and/or modify it
- *  under  the terms of  the GNU General  Public License as published by the
- *  Free Software Foundation;  either version 2 of the  License, or (at your
- *  option) any later version.
- *
- *  THIS  SOFTWARE  IS PROVIDED   ``AS  IS'' AND   ANY  EXPRESS OR IMPLIED
- *  WARRANTIES,   INCLUDING, BUT NOT  LIMITED  TO, THE IMPLIED WARRANTIES OF
- *  MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.  IN
- *  NO  EVENT  SHALL   THE AUTHOR  BE    LIABLE FOR ANY   DIRECT, INDIRECT,
- *  INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
- *  NOT LIMITED   TO, PROCUREMENT OF  SUBSTITUTE GOODS  OR SERVICES; LOSS OF
- *  USE, DATA,  OR PROFITS; OR  BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
- *  ANY THEORY OF LIABILITY, WHETHER IN  CONTRACT, STRICT LIABILITY, OR TORT
- *  (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
- *  THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- *
- *  You should have received a copy of the  GNU General Public License along
- *  with this program; if not, write  to the Free Software Foundation, Inc.,
- *  675 Mass Ave, Cambridge, MA 02139, USA.
- */
-
-#include <linux/module.h>
-#include <linux/platform_device.h>
-#include <linux/kernel.h>
-#include <linux/errno.h>
-#include <linux/string.h>
-#include <linux/mm.h>
-#include <linux/fb.h>
-#include <linux/init.h>
-#include <linux/interrupt.h>
-#include <linux/ctype.h>
-#include <linux/dma-mapping.h>
-
-#include <asm/mach-au1x00/au1000.h>
-#include "au1200fb.h"
-
-#ifdef CONFIG_PM
-#include <asm/mach-au1x00/au1xxx_pm.h>
-#endif
-
-#ifndef CONFIG_FB_AU1200_DEVS
-#define CONFIG_FB_AU1200_DEVS 4
-#endif
-
-#define DRIVER_NAME "au1200fb"
-#define DRIVER_DESC "LCD controller driver for AU1200 processors"
-
-#define DEBUG 1
-
-#define print_err(f, arg...) printk(KERN_ERR DRIVER_NAME ": " f "\n", ## arg)
-#define print_warn(f, arg...) printk(KERN_WARNING DRIVER_NAME ": " f "\n", ## arg)
-#define print_info(f, arg...) printk(KERN_INFO DRIVER_NAME ": " f "\n", ## arg)
-
-#if DEBUG
-#define print_dbg(f, arg...) printk(KERN_DEBUG __FILE__ ": " f "\n", ## arg)
-#else
-#define print_dbg(f, arg...) do {} while (0)
-#endif
-
-
-#define AU1200_LCD_FB_IOCTL 0x46FF
-
-#define AU1200_LCD_SET_SCREEN 1
-#define AU1200_LCD_GET_SCREEN 2
-#define AU1200_LCD_SET_WINDOW 3
-#define AU1200_LCD_GET_WINDOW 4
-#define AU1200_LCD_SET_PANEL  5
-#define AU1200_LCD_GET_PANEL  6
-
-#define SCREEN_SIZE                 (1<< 1)
-#define SCREEN_BACKCOLOR    (1<< 2)
-#define SCREEN_BRIGHTNESS   (1<< 3)
-#define SCREEN_COLORKEY     (1<< 4)
-#define SCREEN_MASK         (1<< 5)
-
-struct au1200_lcd_global_regs_t {
-        unsigned int flags;
-        unsigned int xsize;
-        unsigned int ysize;
-        unsigned int backcolor;
-        unsigned int brightness;
-        unsigned int colorkey;
-        unsigned int mask;
-        unsigned int panel_choice;
-        char panel_desc[80];
-
-};
-
-#define WIN_POSITION            (1<< 0)
-#define WIN_ALPHA_COLOR         (1<< 1)
-#define WIN_ALPHA_MODE          (1<< 2)
-#define WIN_PRIORITY            (1<< 3)
-#define WIN_CHANNEL             (1<< 4)
-#define WIN_BUFFER_FORMAT       (1<< 5)
-#define WIN_COLOR_ORDER         (1<< 6)
-#define WIN_PIXEL_ORDER         (1<< 7)
-#define WIN_SIZE                (1<< 8)
-#define WIN_COLORKEY_MODE       (1<< 9)
-#define WIN_DOUBLE_BUFFER_MODE  (1<< 10)
-#define WIN_RAM_ARRAY_MODE      (1<< 11)
-#define WIN_BUFFER_SCALE        (1<< 12)
-#define WIN_ENABLE                  (1<< 13)
-
-struct au1200_lcd_window_regs_t {
-        unsigned int flags;
-        unsigned int xpos;
-        unsigned int ypos;
-        unsigned int alpha_color;
-        unsigned int alpha_mode;
-        unsigned int priority;
-        unsigned int channel;
-        unsigned int buffer_format;
-        unsigned int color_order;
-        unsigned int pixel_order;
-        unsigned int xsize;
-        unsigned int ysize;
-        unsigned int colorkey_mode;
-        unsigned int double_buffer_mode;
-        unsigned int ram_array_mode;
-        unsigned int xscale;
-        unsigned int yscale;
-        unsigned int enable;
-};
-
-
-struct au1200_lcd_iodata_t {
-        unsigned int subcmd;
-        struct au1200_lcd_global_regs_t global;
-        struct au1200_lcd_window_regs_t window;
-};
-
-#if defined(__BIG_ENDIAN)
-#define LCD_CONTROL_DEFAULT_PO LCD_CONTROL_PO_11
-#else
-#define LCD_CONTROL_DEFAULT_PO LCD_CONTROL_PO_00
-#endif
-#define LCD_CONTROL_DEFAULT_SBPPF LCD_CONTROL_SBPPF_565
-
-/* Private, per-framebuffer management information (independent of the panel itself) */
-struct au1200fb_device {
-        struct fb_info fb_info;                 /* FB driver info record */
-
-        int                                     plane;
-        unsigned char*          fb_mem;         /* FrameBuffer memory map */
-        unsigned int            fb_len;
-        dma_addr_t              fb_phys;
-};
-
-static struct au1200fb_device _au1200fb_devices[CONFIG_FB_AU1200_DEVS];
-/********************************************************************/
-
-/* LCD controller restrictions */
-#define AU1200_LCD_MAX_XRES     1280
-#define AU1200_LCD_MAX_YRES     1024
-#define AU1200_LCD_MAX_BPP      32
-#define AU1200_LCD_MAX_CLK      96000000 /* fixme: this needs to go away ? */
-#define AU1200_LCD_NBR_PALETTE_ENTRIES 256
-
-/* Default number of visible screen buffer to allocate */
-#define AU1200FB_NBR_VIDEO_BUFFERS 1
-
-/********************************************************************/
-
-static struct au1200_lcd *lcd = (struct au1200_lcd *) AU1200_LCD_ADDR;
-static int window_index = 2; /* default is zero */
-static int panel_index = 2; /* default is zero */
-static struct window_settings *win;
-static struct panel_settings *panel;
-static int noblanking = 1;
-static int nohwcursor = 0;
-
-struct window_settings {
-        unsigned char name[64];
-        uint32 mode_backcolor;
-        uint32 mode_colorkey;
-        uint32 mode_colorkeymsk;
-        struct {
-                int xres;
-                int yres;
-                int xpos;
-                int ypos;
-                uint32 mode_winctrl1; /* winctrl1[FRM,CCO,PO,PIPE] */
-                uint32 mode_winenable;
-        } w[4];
-};
-
-#if defined(__BIG_ENDIAN)
-#define LCD_WINCTRL1_PO_16BPP LCD_WINCTRL1_PO_00
-#else
-#define LCD_WINCTRL1_PO_16BPP LCD_WINCTRL1_PO_01
-#endif
-
-extern int board_au1200fb_panel_init (void);
-extern int board_au1200fb_panel_shutdown (void);
-
-#ifdef CONFIG_PM
-int au1200fb_pm_callback(au1xxx_power_dev_t *dev,
-                au1xxx_request_t request, void *data);
-au1xxx_power_dev_t *LCD_pm_dev;
-#endif
-
-/*
- * Default window configurations
- */
-static struct window_settings windows[] = {
-        { /* Index 0 */
-                "0-FS gfx, 1-video, 2-ovly gfx, 3-ovly gfx",
-                /* mode_backcolor       */ 0x006600ff,
-                /* mode_colorkey,msk*/ 0, 0,
-                {
-                        {
-                        /* xres, yres, xpos, ypos */ 0, 0, 0, 0,
-                        /* mode_winctrl1 */ LCD_WINCTRL1_FRM_16BPP565 |
-                                LCD_WINCTRL1_PO_16BPP,
-                        /* mode_winenable*/ LCD_WINENABLE_WEN0,
-                        },
-                        {
-                        /* xres, yres, xpos, ypos */ 100, 100, 100, 100,
-                        /* mode_winctrl1 */ LCD_WINCTRL1_FRM_16BPP565 |
-                                LCD_WINCTRL1_PO_16BPP |
-                                LCD_WINCTRL1_PIPE,
-                        /* mode_winenable*/ LCD_WINENABLE_WEN1,
-                        },
-                        {
-                        /* xres, yres, xpos, ypos */ 0, 0, 0, 0,
-                        /* mode_winctrl1 */ LCD_WINCTRL1_FRM_16BPP565 |
-                                LCD_WINCTRL1_PO_16BPP,
-                        /* mode_winenable*/ 0,
-                        },
-                        {
-                        /* xres, yres, xpos, ypos */ 0, 0, 0, 0,
-                        /* mode_winctrl1 */ LCD_WINCTRL1_FRM_16BPP565 |
-                                LCD_WINCTRL1_PO_16BPP |
-                                LCD_WINCTRL1_PIPE,
-                        /* mode_winenable*/ 0,
-                        },
-                },
-        },
-
-        { /* Index 1 */
-                "0-FS gfx, 1-video, 2-ovly gfx, 3-ovly gfx",
-                /* mode_backcolor       */ 0x006600ff,
-                /* mode_colorkey,msk*/ 0, 0,
-                {
-                        {
-                        /* xres, yres, xpos, ypos */ 320, 240, 5, 5,
-                        /* mode_winctrl1 */ LCD_WINCTRL1_FRM_24BPP |
-                                LCD_WINCTRL1_PO_00,
-                        /* mode_winenable*/ LCD_WINENABLE_WEN0,
-                        },
-                        {
-                        /* xres, yres, xpos, ypos */ 0, 0, 0, 0,
-                        /* mode_winctrl1 */ LCD_WINCTRL1_FRM_16BPP565
-                                | LCD_WINCTRL1_PO_16BPP,
-                        /* mode_winenable*/ 0,
-                        },
-                        {
-                        /* xres, yres, xpos, ypos */ 100, 100, 0, 0,
-                        /* mode_winctrl1 */ LCD_WINCTRL1_FRM_16BPP565 |
-                                LCD_WINCTRL1_PO_16BPP |
-                                LCD_WINCTRL1_PIPE,
-                        /* mode_winenable*/ 0/*LCD_WINENABLE_WEN2*/,
-                        },
-                        {
-                        /* xres, yres, xpos, ypos */ 200, 25, 0, 0,
-                        /* mode_winctrl1 */ LCD_WINCTRL1_FRM_16BPP565 |
-                                LCD_WINCTRL1_PO_16BPP |
-                                LCD_WINCTRL1_PIPE,
-                        /* mode_winenable*/ 0,
-                        },
-                },
-        },
-        { /* Index 2 */
-                "0-FS gfx, 1-video, 2-ovly gfx, 3-ovly gfx",
-                /* mode_backcolor       */ 0x006600ff,
-                /* mode_colorkey,msk*/ 0, 0,
-                {
-                        {
-                        /* xres, yres, xpos, ypos */ 0, 0, 0, 0,
-                        /* mode_winctrl1 */ LCD_WINCTRL1_FRM_16BPP565 |
-                                LCD_WINCTRL1_PO_16BPP,
-                        /* mode_winenable*/ LCD_WINENABLE_WEN0,
-                        },
-                        {
-                        /* xres, yres, xpos, ypos */ 0, 0, 0, 0,
-                        /* mode_winctrl1 */ LCD_WINCTRL1_FRM_16BPP565 |
-                                LCD_WINCTRL1_PO_16BPP,
-                        /* mode_winenable*/ 0,
-                        },
-                        {
-                        /* xres, yres, xpos, ypos */ 0, 0, 0, 0,
-                        /* mode_winctrl1 */ LCD_WINCTRL1_FRM_32BPP |
-                                LCD_WINCTRL1_PO_00|LCD_WINCTRL1_PIPE,
-                        /* mode_winenable*/ 0/*LCD_WINENABLE_WEN2*/,
-                        },
-                        {
-                        /* xres, yres, xpos, ypos */ 0, 0, 0, 0,
-                        /* mode_winctrl1 */ LCD_WINCTRL1_FRM_16BPP565 |
-                                LCD_WINCTRL1_PO_16BPP |
-                                LCD_WINCTRL1_PIPE,
-                        /* mode_winenable*/ 0,
-                        },
-                },
-        },
-        /* Need VGA 640 @ 24bpp, @ 32bpp */
-        /* Need VGA 800 @ 24bpp, @ 32bpp */
-        /* Need VGA 1024 @ 24bpp, @ 32bpp */
-};
-
-/*
- * Controller configurations for various panels.
- */
-
-struct panel_settings
-{
-        const char name[25];            /* Full name <vendor>_<model> */
-
-        struct  fb_monspecs monspecs;   /* FB monitor specs */
-
-        /* panel timings */
-        uint32 mode_screen;
-        uint32 mode_horztiming;
-        uint32 mode_verttiming;
-        uint32 mode_clkcontrol;
-        uint32 mode_pwmdiv;
-        uint32 mode_pwmhi;
-        uint32 mode_outmask;
-        uint32 mode_fifoctrl;
-        uint32 mode_toyclksrc;
-        uint32 mode_backlight;
-        uint32 mode_auxpll;
-        int (*device_init)(void);
-        int (*device_shutdown)(void);
-#define Xres min_xres
-#define Yres min_yres
-        u32     min_xres;               /* Minimum horizontal resolution */
-        u32     max_xres;               /* Maximum horizontal resolution */
-        u32     min_yres;               /* Minimum vertical resolution */
-        u32     max_yres;               /* Maximum vertical resolution */
-};
-
-/********************************************************************/
-/* fixme: Maybe a modedb for the CRT ? otherwise panels should be as-is */
-
-/* List of panels known to work with the AU1200 LCD controller.
- * To add a new panel, enter the same specifications as the
- * Generic_TFT one, and MAKE SURE that it doesn't conflicts
- * with the controller restrictions. Restrictions are:
- *
- * STN color panels: max_bpp <= 12
- * STN mono panels: max_bpp <= 4
- * TFT panels: max_bpp <= 16
- * max_xres <= 800
- * max_yres <= 600
- */
-static struct panel_settings known_lcd_panels[] =
-{
-        [0] = { /* QVGA 320x240 H:33.3kHz V:110Hz */
-                .name = "QVGA_320x240",
-                .monspecs = {
-                        .modedb = NULL,
-                        .modedb_len = 0,
-                        .hfmin = 30000,
-                        .hfmax = 70000,
-                        .vfmin = 60,
-                        .vfmax = 60,
-                        .dclkmin = 6000000,
-                        .dclkmax = 28000000,
-                        .input = FB_DISP_RGB,
-                },
-                .mode_screen            = LCD_SCREEN_SX_N(320) |
-                        LCD_SCREEN_SY_N(240),
-                .mode_horztiming        = 0x00c4623b,
-                .mode_verttiming        = 0x00502814,
-                .mode_clkcontrol        = 0x00020002, /* /4=24Mhz */
-                .mode_pwmdiv            = 0x00000000,
-                .mode_pwmhi             = 0x00000000,
-                .mode_outmask   = 0x00FFFFFF,
-                .mode_fifoctrl  = 0x2f2f2f2f,
-                .mode_toyclksrc = 0x00000004, /* AUXPLL directly */
-                .mode_backlight = 0x00000000,
-                .mode_auxpll            = 8, /* 96MHz AUXPLL */
-                .device_init            = NULL,
-                .device_shutdown        = NULL,
-                320, 320,
-                240, 240,
-        },
-
-        [1] = { /* VGA 640x480 H:30.3kHz V:58Hz */
-                .name = "VGA_640x480",
-                .monspecs = {
-                        .modedb = NULL,
-                        .modedb_len = 0,
-                        .hfmin = 30000,
-                        .hfmax = 70000,
-                        .vfmin = 60,
-                        .vfmax = 60,
-                        .dclkmin = 6000000,
-                        .dclkmax = 28000000,
-                        .input = FB_DISP_RGB,
-                },
-                .mode_screen            = 0x13f9df80,
-                .mode_horztiming        = 0x003c5859,
-                .mode_verttiming        = 0x00741201,
-                .mode_clkcontrol        = 0x00020001, /* /4=24Mhz */
-                .mode_pwmdiv            = 0x00000000,
-                .mode_pwmhi             = 0x00000000,
-                .mode_outmask   = 0x00FFFFFF,
-                .mode_fifoctrl  = 0x2f2f2f2f,
-                .mode_toyclksrc = 0x00000004, /* AUXPLL directly */
-                .mode_backlight = 0x00000000,
-                .mode_auxpll            = 8, /* 96MHz AUXPLL */
-                .device_init            = NULL,
-                .device_shutdown        = NULL,
-                640, 480,
-                640, 480,
-        },
-
-        [2] = { /* SVGA 800x600 H:46.1kHz V:69Hz */
-                .name = "SVGA_800x600",
-                .monspecs = {
-                        .modedb = NULL,
-                        .modedb_len = 0,
-                        .hfmin = 30000,
-                        .hfmax = 70000,
-                        .vfmin = 60,
-                        .vfmax = 60,
-                        .dclkmin = 6000000,
-                        .dclkmax = 28000000,
-                        .input = FB_DISP_RGB,
-                },
-                .mode_screen            = 0x18fa5780,
-                .mode_horztiming        = 0x00dc7e77,
-                .mode_verttiming        = 0x00584805,
-                .mode_clkcontrol        = 0x00020000, /* /2=48Mhz */
-                .mode_pwmdiv            = 0x00000000,
-                .mode_pwmhi             = 0x00000000,
-                .mode_outmask   = 0x00FFFFFF,
-                .mode_fifoctrl  = 0x2f2f2f2f,
-                .mode_toyclksrc = 0x00000004, /* AUXPLL directly */
-                .mode_backlight = 0x00000000,
-                .mode_auxpll            = 8, /* 96MHz AUXPLL */
-                .device_init            = NULL,
-                .device_shutdown        = NULL,
-                800, 800,
-                600, 600,
-        },
-
-        [3] = { /* XVGA 1024x768 H:56.2kHz V:70Hz */
-                .name = "XVGA_1024x768",
-                .monspecs = {
-                        .modedb = NULL,
-                        .modedb_len = 0,
-                        .hfmin = 30000,
-                        .hfmax = 70000,
-                        .vfmin = 60,
-                        .vfmax = 60,
-                        .dclkmin = 6000000,
-                        .dclkmax = 28000000,
-                        .input = FB_DISP_RGB,
-                },
-                .mode_screen            = 0x1ffaff80,
-                .mode_horztiming        = 0x007d0e57,
-                .mode_verttiming        = 0x00740a01,
-                .mode_clkcontrol        = 0x000A0000, /* /1 */
-                .mode_pwmdiv            = 0x00000000,
-                .mode_pwmhi             = 0x00000000,
-                .mode_outmask   = 0x00FFFFFF,
-                .mode_fifoctrl  = 0x2f2f2f2f,
-                .mode_toyclksrc = 0x00000004, /* AUXPLL directly */
-                .mode_backlight = 0x00000000,
-                .mode_auxpll            = 6, /* 72MHz AUXPLL */
-                .device_init            = NULL,
-                .device_shutdown        = NULL,
-                1024, 1024,
-                768, 768,
-        },
-
-        [4] = { /* XVGA XVGA 1280x1024 H:68.5kHz V:65Hz */
-                .name = "XVGA_1280x1024",
-                .monspecs = {
-                        .modedb = NULL,
-                        .modedb_len = 0,
-                        .hfmin = 30000,
-                        .hfmax = 70000,
-                        .vfmin = 60,
-                        .vfmax = 60,
-                        .dclkmin = 6000000,
-                        .dclkmax = 28000000,
-                        .input = FB_DISP_RGB,
-                },
-                .mode_screen            = 0x27fbff80,
-                .mode_horztiming        = 0x00cdb2c7,
-                .mode_verttiming        = 0x00600002,
-                .mode_clkcontrol        = 0x000A0000, /* /1 */
-                .mode_pwmdiv            = 0x00000000,
-                .mode_pwmhi             = 0x00000000,
-                .mode_outmask   = 0x00FFFFFF,
-                .mode_fifoctrl  = 0x2f2f2f2f,
-                .mode_toyclksrc = 0x00000004, /* AUXPLL directly */
-                .mode_backlight = 0x00000000,
-                .mode_auxpll            = 10, /* 120MHz AUXPLL */
-                .device_init            = NULL,
-                .device_shutdown        = NULL,
-                1280, 1280,
-                1024, 1024,
-        },
-
-        [5] = { /* Samsung 1024x768 TFT */
-                .name = "Samsung_1024x768_TFT",
-                .monspecs = {
-                        .modedb = NULL,
-                        .modedb_len = 0,
-                        .hfmin = 30000,
-                        .hfmax = 70000,
-                        .vfmin = 60,
-                        .vfmax = 60,
-                        .dclkmin = 6000000,
-                        .dclkmax = 28000000,
-                        .input = FB_DISP_RGB,
-                },
-                .mode_screen            = 0x1ffaff80,
-                .mode_horztiming        = 0x018cc677,
-                .mode_verttiming        = 0x00241217,
-                .mode_clkcontrol        = 0x00000000, /* SCB 0x1 /4=24Mhz */
-                .mode_pwmdiv            = 0x8000063f, /* SCB 0x0 */
-                .mode_pwmhi             = 0x03400000, /* SCB 0x0 */
-                .mode_outmask   = 0x00FFFFFF,
-                .mode_fifoctrl  = 0x2f2f2f2f,
-                .mode_toyclksrc = 0x00000004, /* AUXPLL directly */
-                .mode_backlight = 0x00000000,
-                .mode_auxpll            = 8, /* 96MHz AUXPLL */
-                .device_init            = board_au1200fb_panel_init,
-                .device_shutdown        = board_au1200fb_panel_shutdown,
-                1024, 1024,
-                768, 768,
-        },
-
-        [6] = { /* Toshiba 640x480 TFT */
-                .name = "Toshiba_640x480_TFT",
-                .monspecs = {
-                        .modedb = NULL,
-                        .modedb_len = 0,
-                        .hfmin = 30000,
-                        .hfmax = 70000,
-                        .vfmin = 60,
-                        .vfmax = 60,
-                        .dclkmin = 6000000,
-                        .dclkmax = 28000000,
-                        .input = FB_DISP_RGB,
-                },
-                .mode_screen            = LCD_SCREEN_SX_N(640) |
-                        LCD_SCREEN_SY_N(480),
-                .mode_horztiming        = LCD_HORZTIMING_HPW_N(96) |
-                        LCD_HORZTIMING_HND1_N(13) | LCD_HORZTIMING_HND2_N(51),
-                .mode_verttiming        = LCD_VERTTIMING_VPW_N(2) |
-                        LCD_VERTTIMING_VND1_N(11) | LCD_VERTTIMING_VND2_N(32),
-                .mode_clkcontrol        = 0x00000000, /* /4=24Mhz */
-                .mode_pwmdiv            = 0x8000063f,
-                .mode_pwmhi             = 0x03400000,
-                .mode_outmask   = 0x00fcfcfc,
-                .mode_fifoctrl  = 0x2f2f2f2f,
-                .mode_toyclksrc = 0x00000004, /* AUXPLL directly */
-                .mode_backlight = 0x00000000,
-                .mode_auxpll            = 8, /* 96MHz AUXPLL */
-                .device_init            = board_au1200fb_panel_init,
-                .device_shutdown        = board_au1200fb_panel_shutdown,
-                640, 480,
-                640, 480,
-        },
-
-        [7] = { /* Sharp 320x240 TFT */
-                .name = "Sharp_320x240_TFT",
-                .monspecs = {
-                        .modedb = NULL,
-                        .modedb_len = 0,
-                        .hfmin = 12500,
-                        .hfmax = 20000,
-                        .vfmin = 38,
-                        .vfmax = 81,
-                        .dclkmin = 4500000,
-                        .dclkmax = 6800000,
-                        .input = FB_DISP_RGB,
-                },
-                .mode_screen            = LCD_SCREEN_SX_N(320) |
-                        LCD_SCREEN_SY_N(240),
-                .mode_horztiming        = LCD_HORZTIMING_HPW_N(60) |
-                        LCD_HORZTIMING_HND1_N(13) | LCD_HORZTIMING_HND2_N(2),
-                .mode_verttiming        = LCD_VERTTIMING_VPW_N(2) |
-                        LCD_VERTTIMING_VND1_N(2) | LCD_VERTTIMING_VND2_N(5),
-                .mode_clkcontrol        = LCD_CLKCONTROL_PCD_N(7), /*16=6Mhz*/
-                .mode_pwmdiv            = 0x8000063f,
-                .mode_pwmhi             = 0x03400000,
-                .mode_outmask   = 0x00fcfcfc,
-                .mode_fifoctrl  = 0x2f2f2f2f,
-                .mode_toyclksrc = 0x00000004, /* AUXPLL directly */
-                .mode_backlight = 0x00000000,
-                .mode_auxpll            = 8, /* 96MHz AUXPLL */
-                .device_init            = board_au1200fb_panel_init,
-                .device_shutdown        = board_au1200fb_panel_shutdown,
-                320, 320,
-                240, 240,
-        },
-
-        [8] = { /* Toppoly TD070WGCB2 7" 856x480 TFT */
-                .name = "Toppoly_TD070WGCB2",
-                .monspecs = {
-                        .modedb = NULL,
-                        .modedb_len = 0,
-                        .hfmin = 30000,
-                        .hfmax = 70000,
-                        .vfmin = 60,
-                        .vfmax = 60,
-                        .dclkmin = 6000000,
-                        .dclkmax = 28000000,
-                        .input = FB_DISP_RGB,
-                },
-                .mode_screen            = LCD_SCREEN_SX_N(856) |
-                        LCD_SCREEN_SY_N(480),
-                .mode_horztiming        = LCD_HORZTIMING_HND2_N(43) |
-                        LCD_HORZTIMING_HND1_N(43) | LCD_HORZTIMING_HPW_N(114),
-                .mode_verttiming        = LCD_VERTTIMING_VND2_N(20) |
-                        LCD_VERTTIMING_VND1_N(21) | LCD_VERTTIMING_VPW_N(4),
-                .mode_clkcontrol        = 0x00020001, /* /4=24Mhz */
-                .mode_pwmdiv            = 0x8000063f,
-                .mode_pwmhi             = 0x03400000,
-                .mode_outmask   = 0x00fcfcfc,
-                .mode_fifoctrl  = 0x2f2f2f2f,
-                .mode_toyclksrc = 0x00000004, /* AUXPLL directly */
-                .mode_backlight = 0x00000000,
-                .mode_auxpll            = 8, /* 96MHz AUXPLL */
-                .device_init            = board_au1200fb_panel_init,
-                .device_shutdown        = board_au1200fb_panel_shutdown,
-                856, 856,
-                480, 480,
-        },
-};
-
-#define NUM_PANELS (ARRAY_SIZE(known_lcd_panels))
-
-/********************************************************************/
-
-#ifdef CONFIG_PM
-static int set_brightness(unsigned int brightness)
-{
-        unsigned int hi1, divider;
-
-        /* limit brightness pwm duty to >= 30/1600 */
-        if (brightness < 30) {
-                brightness = 30;
-        }
-        divider = (lcd->pwmdiv & 0x3FFFF) + 1;
-        hi1 = (lcd->pwmhi >> 16) + 1;
-        hi1 = (((brightness & 0xFF) + 1) * divider >> 8);
-        lcd->pwmhi &= 0xFFFF;
-        lcd->pwmhi |= (hi1 << 16);
-
-        return brightness;
-}
-#endif /* CONFIG_PM */
-
-static int winbpp (unsigned int winctrl1)
-{
-        int bits = 0;
-
-        /* how many bits are needed for each pixel format */
-        switch (winctrl1 & LCD_WINCTRL1_FRM) {
-        case LCD_WINCTRL1_FRM_1BPP:
-                bits = 1;
-                break;
-        case LCD_WINCTRL1_FRM_2BPP:
-                bits = 2;
-                break;
-        case LCD_WINCTRL1_FRM_4BPP:
-                bits = 4;
-                break;
-        case LCD_WINCTRL1_FRM_8BPP:
-                bits = 8;
-                break;
-        case LCD_WINCTRL1_FRM_12BPP:
-        case LCD_WINCTRL1_FRM_16BPP655:
-        case LCD_WINCTRL1_FRM_16BPP565:
-        case LCD_WINCTRL1_FRM_16BPP556:
-        case LCD_WINCTRL1_FRM_16BPPI1555:
-        case LCD_WINCTRL1_FRM_16BPPI5551:
-        case LCD_WINCTRL1_FRM_16BPPA1555:
-        case LCD_WINCTRL1_FRM_16BPPA5551:
-                bits = 16;
-                break;
-        case LCD_WINCTRL1_FRM_24BPP:
-        case LCD_WINCTRL1_FRM_32BPP:
-                bits = 32;
-                break;
-        }
-
-        return bits;
-}
-
-static int fbinfo2index (struct fb_info *fb_info)
-{
-        int i;
-
-        for (i = 0; i < CONFIG_FB_AU1200_DEVS; ++i) {
-                if (fb_info == (struct fb_info *)(&_au1200fb_devices[i].fb_info))
-                        return i;
-        }
-        printk("au1200fb: ERROR: fbinfo2index failed!\n");
-        return -1;
-}
-
-static int au1200_setlocation (struct au1200fb_device *fbdev, int plane,
-        int xpos, int ypos)
-{
-        uint32 winctrl0, winctrl1, winenable, fb_offset = 0;
-        int xsz, ysz;
-
-        /* FIX!!! NOT CHECKING FOR COMPLETE OFFSCREEN YET */
-
-        winctrl0 = lcd->window[plane].winctrl0;
-        winctrl1 = lcd->window[plane].winctrl1;
-        winctrl0 &= (LCD_WINCTRL0_A | LCD_WINCTRL0_AEN);
-        winctrl1 &= ~(LCD_WINCTRL1_SZX | LCD_WINCTRL1_SZY);
-
-        /* Check for off-screen adjustments */
-        xsz = win->w[plane].xres;
-        ysz = win->w[plane].yres;
-        if ((xpos + win->w[plane].xres) > panel->Xres) {
-                /* Off-screen to the right */
-                xsz = panel->Xres - xpos; /* off by 1 ??? */
-                /*printk("off screen right\n");*/
-        }
-
-        if ((ypos + win->w[plane].yres) > panel->Yres) {
-                /* Off-screen to the bottom */
-                ysz = panel->Yres - ypos; /* off by 1 ??? */
-                /*printk("off screen bottom\n");*/
-        }
-
-        if (xpos < 0) {
-                /* Off-screen to the left */
-                xsz = win->w[plane].xres + xpos;
-                fb_offset += (((0 - xpos) * winbpp(lcd->window[plane].winctrl1))/8);
-                xpos = 0;
-                /*printk("off screen left\n");*/
-        }
-
-        if (ypos < 0) {
-                /* Off-screen to the top */
-                ysz = win->w[plane].yres + ypos;
-                /* fixme: fb_offset += ((0-ypos)*fb_pars[plane].line_length); */
-                ypos = 0;
-                /*printk("off screen top\n");*/
-        }
-
-        /* record settings */
-        win->w[plane].xpos = xpos;
-        win->w[plane].ypos = ypos;
-
-        xsz -= 1;
-        ysz -= 1;
-        winctrl0 |= (xpos << 21);
-        winctrl0 |= (ypos << 10);
-        winctrl1 |= (xsz << 11);
-        winctrl1 |= (ysz << 0);
-
-        /* Disable the window while making changes, then restore WINEN */
-        winenable = lcd->winenable & (1 << plane);
-        au_sync();
-        lcd->winenable &= ~(1 << plane);
-        lcd->window[plane].winctrl0 = winctrl0;
-        lcd->window[plane].winctrl1 = winctrl1;
-        lcd->window[plane].winbuf0 =
-        lcd->window[plane].winbuf1 = fbdev->fb_phys;
-        lcd->window[plane].winbufctrl = 0; /* select winbuf0 */
-        lcd->winenable |= winenable;
-        au_sync();
-
-        return 0;
-}
-
-static void au1200_setpanel (struct panel_settings *newpanel)
-{
-        /*
-         * Perform global setup/init of LCD controller
-         */
-        uint32 winenable;
-
-        /* Make sure all windows disabled */
-        winenable = lcd->winenable;
-        lcd->winenable = 0;
-        au_sync();
-        /*
-         * Ensure everything is disabled before reconfiguring
-         */
-        if (lcd->screen & LCD_SCREEN_SEN) {
-                /* Wait for vertical sync period */
-                lcd->intstatus = LCD_INT_SS;
-                while ((lcd->intstatus & LCD_INT_SS) == 0) {
-                        au_sync();
-                }
-
-                lcd->screen &= ~LCD_SCREEN_SEN; /*disable the controller*/
-
-                do {
-                        lcd->intstatus = lcd->intstatus; /*clear interrupts*/
-                        au_sync();
-                /*wait for controller to shut down*/
-                } while ((lcd->intstatus & LCD_INT_SD) == 0);
-
-                /* Call shutdown of current panel (if up) */
-                /* this must occur last, because if an external clock is driving
-                    the controller, the clock cannot be turned off before first
-                        shutting down the controller.
-                 */
-                if (panel->device_shutdown != NULL)
-                        panel->device_shutdown();
-        }
-
-        /* Newpanel == NULL indicates a shutdown operation only */
-        if (newpanel == NULL)
-                return;
-
-        panel = newpanel;
-
-        printk("Panel(%s), %dx%d\n", panel->name, panel->Xres, panel->Yres);
-
-        /*
-         * Setup clocking if internal LCD clock source (assumes sys_auxpll valid)
-         */
-        if (!(panel->mode_clkcontrol & LCD_CLKCONTROL_EXT))
-        {
-                uint32 sys_clksrc;
-                au_writel(panel->mode_auxpll, SYS_AUXPLL);
-                sys_clksrc = au_readl(SYS_CLKSRC) & ~0x0000001f;
-                sys_clksrc |= panel->mode_toyclksrc;
-                au_writel(sys_clksrc, SYS_CLKSRC);
-        }
-
-        /*
-         * Configure panel timings
-         */
-        lcd->screen = panel->mode_screen;
-        lcd->horztiming = panel->mode_horztiming;
-        lcd->verttiming = panel->mode_verttiming;
-        lcd->clkcontrol = panel->mode_clkcontrol;
-        lcd->pwmdiv = panel->mode_pwmdiv;
-        lcd->pwmhi = panel->mode_pwmhi;
-        lcd->outmask = panel->mode_outmask;
-        lcd->fifoctrl = panel->mode_fifoctrl;
-        au_sync();
-
-        /* fixme: Check window settings to make sure still valid
-         * for new geometry */
-#if 0
-        au1200_setlocation(fbdev, 0, win->w[0].xpos, win->w[0].ypos);
-        au1200_setlocation(fbdev, 1, win->w[1].xpos, win->w[1].ypos);
-        au1200_setlocation(fbdev, 2, win->w[2].xpos, win->w[2].ypos);
-        au1200_setlocation(fbdev, 3, win->w[3].xpos, win->w[3].ypos);
-#endif
-        lcd->winenable = winenable;
-
-        /*
-         * Re-enable screen now that it is configured
-         */
-        lcd->screen |= LCD_SCREEN_SEN;
-        au_sync();
-
-        /* Call init of panel */
-        if (panel->device_init != NULL) panel->device_init();
-
-        /* FIX!!!! not appropriate on panel change!!! Global setup/init */
-        lcd->intenable = 0;
-        lcd->intstatus = ~0;
-        lcd->backcolor = win->mode_backcolor;
-
-        /* Setup Color Key - FIX!!! */
-        lcd->colorkey = win->mode_colorkey;
-        lcd->colorkeymsk = win->mode_colorkeymsk;
-
-        /* Setup HWCursor - FIX!!! Need to support this eventually */
-        lcd->hwc.cursorctrl = 0;
-        lcd->hwc.cursorpos = 0;
-        lcd->hwc.cursorcolor0 = 0;
-        lcd->hwc.cursorcolor1 = 0;
-        lcd->hwc.cursorcolor2 = 0;
-        lcd->hwc.cursorcolor3 = 0;
-
-
-#if 0
-#define D(X) printk("%25s: %08X\n", #X, X)
-        D(lcd->screen);
-        D(lcd->horztiming);
-        D(lcd->verttiming);
-        D(lcd->clkcontrol);
-        D(lcd->pwmdiv);
-        D(lcd->pwmhi);
-        D(lcd->outmask);
-        D(lcd->fifoctrl);
-        D(lcd->window[0].winctrl0);
-        D(lcd->window[0].winctrl1);
-        D(lcd->window[0].winctrl2);
-        D(lcd->window[0].winbuf0);
-        D(lcd->window[0].winbuf1);
-        D(lcd->window[0].winbufctrl);
-        D(lcd->window[1].winctrl0);
-        D(lcd->window[1].winctrl1);
-        D(lcd->window[1].winctrl2);
-        D(lcd->window[1].winbuf0);
-        D(lcd->window[1].winbuf1);
-        D(lcd->window[1].winbufctrl);
-        D(lcd->window[2].winctrl0);
-        D(lcd->window[2].winctrl1);
-        D(lcd->window[2].winctrl2);
-        D(lcd->window[2].winbuf0);
-        D(lcd->window[2].winbuf1);
-        D(lcd->window[2].winbufctrl);
-        D(lcd->window[3].winctrl0);
-        D(lcd->window[3].winctrl1);
-        D(lcd->window[3].winctrl2);
-        D(lcd->window[3].winbuf0);
-        D(lcd->window[3].winbuf1);
-        D(lcd->window[3].winbufctrl);
-        D(lcd->winenable);
-        D(lcd->intenable);
-        D(lcd->intstatus);
-        D(lcd->backcolor);
-        D(lcd->winenable);
-        D(lcd->colorkey);
-    D(lcd->colorkeymsk);
-        D(lcd->hwc.cursorctrl);
-        D(lcd->hwc.cursorpos);
-        D(lcd->hwc.cursorcolor0);
-        D(lcd->hwc.cursorcolor1);
-        D(lcd->hwc.cursorcolor2);
-        D(lcd->hwc.cursorcolor3);
-#endif
-}
-
-static void au1200_setmode(struct au1200fb_device *fbdev)
-{
-        int plane = fbdev->plane;
-        /* Window/plane setup */
-        lcd->window[plane].winctrl1 = ( 0
-                | LCD_WINCTRL1_PRI_N(plane)
-                | win->w[plane].mode_winctrl1 /* FRM,CCO,PO,PIPE */
-                ) ;
-
-        au1200_setlocation(fbdev, plane, win->w[plane].xpos, win->w[plane].ypos);
-
-        lcd->window[plane].winctrl2 = ( 0
-                | LCD_WINCTRL2_CKMODE_00
-                | LCD_WINCTRL2_DBM
-                | LCD_WINCTRL2_BX_N( fbdev->fb_info.fix.line_length)
-                | LCD_WINCTRL2_SCX_1
-                | LCD_WINCTRL2_SCY_1
-                ) ;
-        lcd->winenable |= win->w[plane].mode_winenable;
-        au_sync();
-}
-
-
-/* Inline helpers */
-
-/*#define panel_is_dual(panel)  ((panel->mode_screen & LCD_SCREEN_PT) == LCD_SCREEN_PT_010)*/
-/*#define panel_is_active(panel)((panel->mode_screen & LCD_SCREEN_PT) == LCD_SCREEN_PT_010)*/
-
-#define panel_is_color(panel) ((panel->mode_screen & LCD_SCREEN_PT) <= LCD_SCREEN_PT_CDSTN)
-
-/* Bitfields format supported by the controller. */
-static struct fb_bitfield rgb_bitfields[][4] = {
-        /*     Red,        Green,        Blue,       Transp   */
-        [LCD_WINCTRL1_FRM_16BPP655 >> 25] =
-                { { 10, 6, 0 }, { 5, 5, 0 }, { 0, 5, 0 }, { 0, 0, 0 } },
-
-        [LCD_WINCTRL1_FRM_16BPP565 >> 25] =
-                { { 11, 5, 0 }, { 5, 6, 0 }, { 0, 5, 0 }, { 0, 0, 0 } },
-
-        [LCD_WINCTRL1_FRM_16BPP556 >> 25] =
-                { { 11, 5, 0 }, { 6, 5, 0 }, { 0, 6, 0 }, { 0, 0, 0 } },
-
-        [LCD_WINCTRL1_FRM_16BPPI1555 >> 25] =
-                { { 10, 5, 0 }, { 5, 5, 0 }, { 0, 5, 0 }, { 0, 0, 0 } },
-
-        [LCD_WINCTRL1_FRM_16BPPI5551 >> 25] =
-                { { 11, 5, 0 }, { 6, 5, 0 }, { 1, 5, 0 }, { 0, 0, 0 } },
-
-        [LCD_WINCTRL1_FRM_16BPPA1555 >> 25] =
-                { { 10, 5, 0 }, { 5, 5, 0 }, { 0, 5, 0 }, { 15, 1, 0 } },
-
-        [LCD_WINCTRL1_FRM_16BPPA5551 >> 25] =
-                { { 11, 5, 0 }, { 6, 5, 0 }, { 1, 5, 0 }, { 0, 1, 0 } },
-
-        [LCD_WINCTRL1_FRM_24BPP >> 25] =
-                { { 16, 8, 0 }, { 8, 8, 0 }, { 0, 8, 0 }, { 0, 0, 0 } },
-
-        [LCD_WINCTRL1_FRM_32BPP >> 25] =
-                { { 16, 8, 0 }, { 8, 8, 0 }, { 0, 8, 0 }, { 24, 0, 0 } },
-};
-
-/*-------------------------------------------------------------------------*/
-
-/* Helpers */
-
-static void au1200fb_update_fbinfo(struct fb_info *fbi)
-{
-        /* FIX!!!! This also needs to take the window pixel format into account!!! */
-
-        /* Update var-dependent FB info */
-        if (panel_is_color(panel)) {
-                if (fbi->var.bits_per_pixel <= 8) {
-                        /* palettized */
-                        fbi->fix.visual = FB_VISUAL_PSEUDOCOLOR;
-                        fbi->fix.line_length = fbi->var.xres_virtual /
-                                (8/fbi->var.bits_per_pixel);
-                } else {
-                        /* non-palettized */
-                        fbi->fix.visual = FB_VISUAL_TRUECOLOR;
-                        fbi->fix.line_length = fbi->var.xres_virtual * (fbi->var.bits_per_pixel / 8);
-                }
-        } else {
-                /* mono FIX!!! mono 8 and 4 bits */
-                fbi->fix.visual = FB_VISUAL_MONO10;
-                fbi->fix.line_length = fbi->var.xres_virtual / 8;
-        }
-
-        fbi->screen_size = fbi->fix.line_length * fbi->var.yres_virtual;
-        print_dbg("line length: %d\n", fbi->fix.line_length);
-        print_dbg("bits_per_pixel: %d\n", fbi->var.bits_per_pixel);
-}
-
-/*-------------------------------------------------------------------------*/
-
-/* AU1200 framebuffer driver */
-
-/* fb_check_var
- * Validate var settings with hardware restrictions and modify it if necessary
- */
-static int au1200fb_fb_check_var(struct fb_var_screeninfo *var,
-        struct fb_info *fbi)
-{
-        struct au1200fb_device *fbdev = (struct au1200fb_device *)fbi;
-        u32 pixclock;
-        int screen_size, plane;
-
-        plane = fbdev->plane;
-
-        /* Make sure that the mode respect all LCD controller and
-         * panel restrictions. */
-        var->xres = win->w[plane].xres;
-        var->yres = win->w[plane].yres;
-
-        /* No need for virtual resolution support */
-        var->xres_virtual = var->xres;
-        var->yres_virtual = var->yres;
-
-        var->bits_per_pixel = winbpp(win->w[plane].mode_winctrl1);
-
-        screen_size = var->xres_virtual * var->yres_virtual;
-        if (var->bits_per_pixel > 8) screen_size *= (var->bits_per_pixel / 8);
-        else screen_size /= (8/var->bits_per_pixel);
-
-        if (fbdev->fb_len < screen_size)
-                return -EINVAL; /* Virtual screen is to big, abort */
-
-        /* FIX!!!! what are the implicaitons of ignoring this for windows ??? */
-        /* The max LCD clock is fixed to 48MHz (value of AUX_CLK). The pixel
-         * clock can only be obtain by dividing this value by an even integer.
-         * Fallback to a slower pixel clock if necessary. */
-        pixclock = max((u32)(PICOS2KHZ(var->pixclock) * 1000), fbi->monspecs.dclkmin);
-        pixclock = min(pixclock, min(fbi->monspecs.dclkmax, (u32)AU1200_LCD_MAX_CLK/2));
-
-        if (AU1200_LCD_MAX_CLK % pixclock) {
-                int diff = AU1200_LCD_MAX_CLK % pixclock;
-                pixclock -= diff;
-        }
-
-        var->pixclock = KHZ2PICOS(pixclock/1000);
-#if 0
-        if (!panel_is_active(panel)) {
-                int pcd = AU1200_LCD_MAX_CLK / (pixclock * 2) - 1;
-
-                if (!panel_is_color(panel)
-                        && (panel->control_base & LCD_CONTROL_MPI) && (pcd < 3)) {
-                        /* STN 8bit mono panel support is up to 6MHz pixclock */
-                        var->pixclock = KHZ2PICOS(6000);
-                } else if (!pcd) {
-                        /* Other STN panel support is up to 12MHz  */
-                        var->pixclock = KHZ2PICOS(12000);
-                }
-        }
-#endif
-        /* Set bitfield accordingly */
-        switch (var->bits_per_pixel) {
-                case 16:
-                {
-                        /* 16bpp True color.
-                         * These must be set to MATCH WINCTRL[FORM] */
-                        int idx;
-                        idx = (win->w[0].mode_winctrl1 & LCD_WINCTRL1_FRM) >> 25;
-                        var->red    = rgb_bitfields[idx][0];
-                        var->green  = rgb_bitfields[idx][1];
-                        var->blue   = rgb_bitfields[idx][2];
-                        var->transp = rgb_bitfields[idx][3];
-                        break;
-                }
-
-                case 32:
-                {
-                        /* 32bpp True color.
-                         * These must be set to MATCH WINCTRL[FORM] */
-                        int idx;
-                        idx = (win->w[0].mode_winctrl1 & LCD_WINCTRL1_FRM) >> 25;
-                        var->red    = rgb_bitfields[idx][0];
-                        var->green  = rgb_bitfields[idx][1];
-                        var->blue   = rgb_bitfields[idx][2];
-                        var->transp = rgb_bitfields[idx][3];
-                        break;
-                }
-                default:
-                        print_dbg("Unsupported depth %dbpp", var->bits_per_pixel);
-                        return -EINVAL;
-        }
-
-        return 0;
-}
-
-/* fb_set_par
- * Set hardware with var settings. This will enable the controller with a
- * specific mode, normally validated with the fb_check_var method
- */
-static int au1200fb_fb_set_par(struct fb_info *fbi)
-{
-        struct au1200fb_device *fbdev = (struct au1200fb_device *)fbi;
-
-        au1200fb_update_fbinfo(fbi);
-        au1200_setmode(fbdev);
-
-        return 0;
-}
-
-/* fb_setcolreg
- * Set color in LCD palette.
- */
-static int au1200fb_fb_setcolreg(unsigned regno, unsigned red, unsigned green,
-        unsigned blue, unsigned transp, struct fb_info *fbi)
-{
-        volatile u32 *palette = lcd->palette;
-        u32 value;
-
-        if (regno > (AU1200_LCD_NBR_PALETTE_ENTRIES - 1))
-                return -EINVAL;
-
-        if (fbi->var.grayscale) {
-                /* Convert color to grayscale */
-                red = green = blue =
-                        (19595 * red + 38470 * green + 7471 * blue) >> 16;
-        }
-
-        if (fbi->fix.visual == FB_VISUAL_TRUECOLOR) {
-                /* Place color in the pseudopalette */
-                if (regno > 16)
-                        return -EINVAL;
-
-                palette = (u32*) fbi->pseudo_palette;
-
-                red   >>= (16 - fbi->var.red.length);
-                green >>= (16 - fbi->var.green.length);
-                blue  >>= (16 - fbi->var.blue.length);
-
-                value = (red   << fbi->var.red.offset)  |
-                        (green << fbi->var.green.offset)|
-                        (blue  << fbi->var.blue.offset);
-                value &= 0xFFFF;
-
-        } else if (1 /*FIX!!! panel_is_active(fbdev->panel)*/) {
-                /* COLOR TFT PALLETTIZED (use RGB 565) */
-                value = (red & 0xF800)|((green >> 5) &
-                                0x07E0)|((blue >> 11) & 0x001F);
-                value &= 0xFFFF;
-
-        } else if (0 /*panel_is_color(fbdev->panel)*/) {
-                /* COLOR STN MODE */
-                value = 0x1234;
-                value &= 0xFFF;
-        } else {
-                /* MONOCHROME MODE */
-                value = (green >> 12) & 0x000F;
-                value &= 0xF;
-        }
-
-        palette[regno] = value;
-
-        return 0;
-}
-
-/* fb_blank
- * Blank the screen. Depending on the mode, the screen will be
- * activated with the backlight color, or desactivated
- */
-static int au1200fb_fb_blank(int blank_mode, struct fb_info *fbi)
-{
-        /* Short-circuit screen blanking */
-        if (noblanking)
-                return 0;
-
-        switch (blank_mode) {
-
-        case FB_BLANK_UNBLANK:
-        case FB_BLANK_NORMAL:
-                /* printk("turn on panel\n"); */
-                au1200_setpanel(panel);
-                break;
-        case FB_BLANK_VSYNC_SUSPEND:
-        case FB_BLANK_HSYNC_SUSPEND:
-        case FB_BLANK_POWERDOWN:
-                /* printk("turn off panel\n"); */
-                au1200_setpanel(NULL);
-                break;
-        default:
-                break;
-
-        }
-
-        /* FB_BLANK_NORMAL is a soft blank */
-        return (blank_mode == FB_BLANK_NORMAL) ? -EINVAL : 0;
-}
-
-/* fb_mmap
- * Map video memory in user space. We don't use the generic fb_mmap
- * method mainly to allow the use of the TLB streaming flag (CCA=6)
- */
-static int au1200fb_fb_mmap(struct fb_info *info, struct vm_area_struct *vma)
-
-{
-        unsigned int len;
-        unsigned long start=0, off;
-        struct au1200fb_device *fbdev = (struct au1200fb_device *) info;
-
-#ifdef CONFIG_PM
-        au1xxx_pm_access(LCD_pm_dev);
-#endif
-
-        if (vma->vm_pgoff > (~0UL >> PAGE_SHIFT)) {
-                return -EINVAL;
-        }
-
-        start = fbdev->fb_phys & PAGE_MASK;
-        len = PAGE_ALIGN((start & ~PAGE_MASK) + fbdev->fb_len);
-
-        off = vma->vm_pgoff << PAGE_SHIFT;
-
-        if ((vma->vm_end - vma->vm_start + off) > len) {
-                return -EINVAL;
-        }
-
-        off += start;
-        vma->vm_pgoff = off >> PAGE_SHIFT;
-
-        vma->vm_page_prot = pgprot_noncached(vma->vm_page_prot);
-        pgprot_val(vma->vm_page_prot) |= _CACHE_MASK; /* CCA=7 */
-
-        vma->vm_flags |= VM_IO;
-
-        return io_remap_pfn_range(vma, vma->vm_start, off >> PAGE_SHIFT,
-                                  vma->vm_end - vma->vm_start,
-                                  vma->vm_page_prot);
-
-        return 0;
-}
-
-static void set_global(u_int cmd, struct au1200_lcd_global_regs_t *pdata)
-{
-
-        unsigned int hi1, divider;
-
-        /* SCREEN_SIZE: user cannot reset size, must switch panel choice */
-
-        if (pdata->flags & SCREEN_BACKCOLOR)
-                lcd->backcolor = pdata->backcolor;
-
-        if (pdata->flags & SCREEN_BRIGHTNESS) {
-
-                // limit brightness pwm duty to >= 30/1600
-                if (pdata->brightness < 30) {
-                        pdata->brightness = 30;
-                }
-                divider = (lcd->pwmdiv & 0x3FFFF) + 1;
-                hi1 = (lcd->pwmhi >> 16) + 1;
-                hi1 = (((pdata->brightness & 0xFF)+1) * divider >> 8);
-                lcd->pwmhi &= 0xFFFF;
-                lcd->pwmhi |= (hi1 << 16);
-        }
-
-        if (pdata->flags & SCREEN_COLORKEY)
-                lcd->colorkey = pdata->colorkey;
-
-        if (pdata->flags & SCREEN_MASK)
-                lcd->colorkeymsk = pdata->mask;
-        au_sync();
-}
-
-static void get_global(u_int cmd, struct au1200_lcd_global_regs_t *pdata)
-{
-        unsigned int hi1, divider;
-
-        pdata->xsize = ((lcd->screen & LCD_SCREEN_SX) >> 19) + 1;
-        pdata->ysize = ((lcd->screen & LCD_SCREEN_SY) >> 8) + 1;
-
-        pdata->backcolor = lcd->backcolor;
-        pdata->colorkey = lcd->colorkey;
-        pdata->mask = lcd->colorkeymsk;
-
-        // brightness
-        hi1 = (lcd->pwmhi >> 16) + 1;
-        divider = (lcd->pwmdiv & 0x3FFFF) + 1;
-        pdata->brightness = ((hi1 << 8) / divider) - 1;
-        au_sync();
-}
-
-static void set_window(unsigned int plane,
-        struct au1200_lcd_window_regs_t *pdata)
-{
-        unsigned int val, bpp;
-
-        /* Window control register 0 */
-        if (pdata->flags & WIN_POSITION) {
-                val = lcd->window[plane].winctrl0 & ~(LCD_WINCTRL0_OX |
-                                LCD_WINCTRL0_OY);
-                val |= ((pdata->xpos << 21) & LCD_WINCTRL0_OX);
-                val |= ((pdata->ypos << 10) & LCD_WINCTRL0_OY);
-                lcd->window[plane].winctrl0 = val;
-        }
-        if (pdata->flags & WIN_ALPHA_COLOR) {
-                val = lcd->window[plane].winctrl0 & ~(LCD_WINCTRL0_A);
-                val |= ((pdata->alpha_color << 2) & LCD_WINCTRL0_A);
-                lcd->window[plane].winctrl0 = val;
-        }
-        if (pdata->flags & WIN_ALPHA_MODE) {
-                val = lcd->window[plane].winctrl0 & ~(LCD_WINCTRL0_AEN);
-                val |= ((pdata->alpha_mode << 1) & LCD_WINCTRL0_AEN);
-                lcd->window[plane].winctrl0 = val;
-        }
-
-        /* Window control register 1 */
-        if (pdata->flags & WIN_PRIORITY) {
-                val = lcd->window[plane].winctrl1 & ~(LCD_WINCTRL1_PRI);
-                val |= ((pdata->priority << 30) & LCD_WINCTRL1_PRI);
-                lcd->window[plane].winctrl1 = val;
-        }
-        if (pdata->flags & WIN_CHANNEL) {
-                val = lcd->window[plane].winctrl1 & ~(LCD_WINCTRL1_PIPE);
-                val |= ((pdata->channel << 29) & LCD_WINCTRL1_PIPE);
-                lcd->window[plane].winctrl1 = val;
-        }
-        if (pdata->flags & WIN_BUFFER_FORMAT) {
-                val = lcd->window[plane].winctrl1 & ~(LCD_WINCTRL1_FRM);
-                val |= ((pdata->buffer_format << 25) & LCD_WINCTRL1_FRM);
-                lcd->window[plane].winctrl1 = val;
-        }
-        if (pdata->flags & WIN_COLOR_ORDER) {
-                val = lcd->window[plane].winctrl1 & ~(LCD_WINCTRL1_CCO);
-                val |= ((pdata->color_order << 24) & LCD_WINCTRL1_CCO);
-                lcd->window[plane].winctrl1 = val;
-        }
-        if (pdata->flags & WIN_PIXEL_ORDER) {
-                val = lcd->window[plane].winctrl1 & ~(LCD_WINCTRL1_PO);
-                val |= ((pdata->pixel_order << 22) & LCD_WINCTRL1_PO);
-                lcd->window[plane].winctrl1 = val;
-        }
-        if (pdata->flags & WIN_SIZE) {
-                val = lcd->window[plane].winctrl1 & ~(LCD_WINCTRL1_SZX |
-                                LCD_WINCTRL1_SZY);
-                val |= (((pdata->xsize << 11) - 1) & LCD_WINCTRL1_SZX);
-                val |= (((pdata->ysize) - 1) & LCD_WINCTRL1_SZY);
-                lcd->window[plane].winctrl1 = val;
-                /* program buffer line width */
-                bpp = winbpp(val) / 8;
-                val = lcd->window[plane].winctrl2 & ~(LCD_WINCTRL2_BX);
-                val |= (((pdata->xsize * bpp) << 8) & LCD_WINCTRL2_BX);
-                lcd->window[plane].winctrl2 = val;
-        }
-
-        /* Window control register 2 */
-        if (pdata->flags & WIN_COLORKEY_MODE) {
-                val = lcd->window[plane].winctrl2 & ~(LCD_WINCTRL2_CKMODE);
-                val |= ((pdata->colorkey_mode << 24) & LCD_WINCTRL2_CKMODE);
-                lcd->window[plane].winctrl2 = val;
-        }
-        if (pdata->flags & WIN_DOUBLE_BUFFER_MODE) {
-                val = lcd->window[plane].winctrl2 & ~(LCD_WINCTRL2_DBM);
-                val |= ((pdata->double_buffer_mode << 23) & LCD_WINCTRL2_DBM);
-                lcd->window[plane].winctrl2 = val;
-        }
-        if (pdata->flags & WIN_RAM_ARRAY_MODE) {
-                val = lcd->window[plane].winctrl2 & ~(LCD_WINCTRL2_RAM);
-                val |= ((pdata->ram_array_mode << 21) & LCD_WINCTRL2_RAM);
-                lcd->window[plane].winctrl2 = val;
-        }
-
-        /* Buffer line width programmed with WIN_SIZE */
-
-        if (pdata->flags & WIN_BUFFER_SCALE) {
-                val = lcd->window[plane].winctrl2 & ~(LCD_WINCTRL2_SCX |
-                                LCD_WINCTRL2_SCY);
-                val |= ((pdata->xsize << 11) & LCD_WINCTRL2_SCX);
-                val |= ((pdata->ysize) & LCD_WINCTRL2_SCY);
-                lcd->window[plane].winctrl2 = val;
-        }
-
-        if (pdata->flags & WIN_ENABLE) {
-                val = lcd->winenable;
-                val &= ~(1<<plane);
-                val |= (pdata->enable & 1) << plane;
-                lcd->winenable = val;
-        }
-        au_sync();
-}
-
-static void get_window(unsigned int plane,
-        struct au1200_lcd_window_regs_t *pdata)
-{
-        /* Window control register 0 */
-        pdata->xpos = (lcd->window[plane].winctrl0 & LCD_WINCTRL0_OX) >> 21;
-        pdata->ypos = (lcd->window[plane].winctrl0 & LCD_WINCTRL0_OY) >> 10;
-        pdata->alpha_color = (lcd->window[plane].winctrl0 & LCD_WINCTRL0_A) >> 2;
-        pdata->alpha_mode = (lcd->window[plane].winctrl0 & LCD_WINCTRL0_AEN) >> 1;
-
-        /* Window control register 1 */
-        pdata->priority = (lcd->window[plane].winctrl1& LCD_WINCTRL1_PRI) >> 30;
-        pdata->channel = (lcd->window[plane].winctrl1 & LCD_WINCTRL1_PIPE) >> 29;
-        pdata->buffer_format = (lcd->window[plane].winctrl1 & LCD_WINCTRL1_FRM) >> 25;
-        pdata->color_order = (lcd->window[plane].winctrl1 & LCD_WINCTRL1_CCO) >> 24;
-        pdata->pixel_order = (lcd->window[plane].winctrl1 & LCD_WINCTRL1_PO) >> 22;
-        pdata->xsize = ((lcd->window[plane].winctrl1 & LCD_WINCTRL1_SZX) >> 11) + 1;
-        pdata->ysize = (lcd->window[plane].winctrl1 & LCD_WINCTRL1_SZY) + 1;
-
-        /* Window control register 2 */
-        pdata->colorkey_mode = (lcd->window[plane].winctrl2 & LCD_WINCTRL2_CKMODE) >> 24;
-        pdata->double_buffer_mode = (lcd->window[plane].winctrl2 & LCD_WINCTRL2_DBM) >> 23;
-        pdata->ram_array_mode = (lcd->window[plane].winctrl2 & LCD_WINCTRL2_RAM) >> 21;
-
-        pdata->enable = (lcd->winenable >> plane) & 1;
-        au_sync();
-}
-
-static int au1200fb_ioctl(struct fb_info *info, unsigned int cmd,
-                          unsigned long arg)
-{
-        int plane;
-        int val;
-
-#ifdef CONFIG_PM
-        au1xxx_pm_access(LCD_pm_dev);
-#endif
-
-        plane = fbinfo2index(info);
-        print_dbg("au1200fb: ioctl %d on plane %d\n", cmd, plane);
-
-        if (cmd == AU1200_LCD_FB_IOCTL) {
-                struct au1200_lcd_iodata_t iodata;
-
-                if (copy_from_user(&iodata, (void __user *) arg, sizeof(iodata)))
-                        return -EFAULT;
-
-                print_dbg("FB IOCTL called\n");
-
-                switch (iodata.subcmd) {
-                case AU1200_LCD_SET_SCREEN:
-                        print_dbg("AU1200_LCD_SET_SCREEN\n");
-                        set_global(cmd, &iodata.global);
-                        break;
-
-                case AU1200_LCD_GET_SCREEN:
-                        print_dbg("AU1200_LCD_GET_SCREEN\n");
-                        get_global(cmd, &iodata.global);
-                        break;
-
-                case AU1200_LCD_SET_WINDOW:
-                        print_dbg("AU1200_LCD_SET_WINDOW\n");
-                        set_window(plane, &iodata.window);
-                        break;
-
-                case AU1200_LCD_GET_WINDOW:
-                        print_dbg("AU1200_LCD_GET_WINDOW\n");
-                        get_window(plane, &iodata.window);
-                        break;
-
-                case AU1200_LCD_SET_PANEL:
-                        print_dbg("AU1200_LCD_SET_PANEL\n");
-                        if ((iodata.global.panel_choice >= 0) &&
-                                        (iodata.global.panel_choice <
-                                         NUM_PANELS))
-                        {
-                                struct panel_settings *newpanel;
-                                panel_index = iodata.global.panel_choice;
-                                newpanel = &known_lcd_panels[panel_index];
-                                au1200_setpanel(newpanel);
-                        }
-                        break;
-
-                case AU1200_LCD_GET_PANEL:
-                        print_dbg("AU1200_LCD_GET_PANEL\n");
-                        iodata.global.panel_choice = panel_index;
-                        break;
-
-                default:
-                        return -EINVAL;
-                }
-
-                val = copy_to_user((void __user *) arg, &iodata, sizeof(iodata));
-                if (val) {
-                        print_dbg("error: could not copy %d bytes\n", val);
-                        return -EFAULT;
-                }
-        }
-
-        return 0;
-}
-
-
-static struct fb_ops au1200fb_fb_ops = {
-        .owner          = THIS_MODULE,
-        .fb_check_var   = au1200fb_fb_check_var,
-        .fb_set_par     = au1200fb_fb_set_par,
-        .fb_setcolreg   = au1200fb_fb_setcolreg,
-        .fb_blank       = au1200fb_fb_blank,
-        .fb_fillrect    = cfb_fillrect,
-        .fb_copyarea    = cfb_copyarea,
-        .fb_imageblit   = cfb_imageblit,
-        .fb_sync        = NULL,
-        .fb_ioctl       = au1200fb_ioctl,
-        .fb_mmap        = au1200fb_fb_mmap,
-};
-
-/*-------------------------------------------------------------------------*/
-
-static irqreturn_t au1200fb_handle_irq(int irq, void* dev_id, struct pt_regs *regs)
-{
-        /* Nothing to do for now, just clear any pending interrupt */
-        lcd->intstatus = lcd->intstatus;
-        au_sync();
-
-        return IRQ_HANDLED;
-}
-
-/*-------------------------------------------------------------------------*/
-
-/* AU1200 LCD device probe helpers */
-
-static int au1200fb_init_fbinfo(struct au1200fb_device *fbdev)
-{
-        struct fb_info *fbi = &fbdev->fb_info;
-        int bpp;
-
-        memset(fbi, 0, sizeof(struct fb_info));
-        fbi->fbops = &au1200fb_fb_ops;
-
-        bpp = winbpp(win->w[fbdev->plane].mode_winctrl1);
-
-        /* Copy monitor specs from panel data */
-        /* fixme: we're setting up LCD controller windows, so these dont give a
-        damn as to what the monitor specs are (the panel itself does, but that
-        isnt done here...so maybe need a generic catchall monitor setting??? */
-        memcpy(&fbi->monspecs, &panel->monspecs, sizeof(struct fb_monspecs));
-
-        /* We first try the user mode passed in argument. If that failed,
-         * or if no one has been specified, we default to the first mode of the
-         * panel list. Note that after this call, var data will be set */
-        if (!fb_find_mode(&fbi->var,
-                          fbi,
-                          NULL, /* drv_info.opt_mode, */
-                          fbi->monspecs.modedb,
-                          fbi->monspecs.modedb_len,
-                          fbi->monspecs.modedb,
-                          bpp)) {
-
-                print_err("Cannot find valid mode for panel %s", panel->name);
-                return -EFAULT;
-        }
-
-        fbi->pseudo_palette = kmalloc(sizeof(u32) * 16, GFP_KERNEL);
-        if (!fbi->pseudo_palette) {
-                return -ENOMEM;
-        }
-        memset(fbi->pseudo_palette, 0, sizeof(u32) * 16);
-
-        if (fb_alloc_cmap(&fbi->cmap, AU1200_LCD_NBR_PALETTE_ENTRIES, 0) < 0) {
-                print_err("Fail to allocate colormap (%d entries)",
-                           AU1200_LCD_NBR_PALETTE_ENTRIES);
-                kfree(fbi->pseudo_palette);
-                return -EFAULT;
-        }
-
-        strncpy(fbi->fix.id, "AU1200", sizeof(fbi->fix.id));
-        fbi->fix.smem_start = fbdev->fb_phys;
-        fbi->fix.smem_len = fbdev->fb_len;
-        fbi->fix.type = FB_TYPE_PACKED_PIXELS;
-        fbi->fix.xpanstep = 0;
-        fbi->fix.ypanstep = 0;
-        fbi->fix.mmio_start = 0;
-        fbi->fix.mmio_len = 0;
-        fbi->fix.accel = FB_ACCEL_NONE;
-
-        fbi->screen_base = (char __iomem *) fbdev->fb_mem;
-
-        au1200fb_update_fbinfo(fbi);
-
-        return 0;
-}
-
-/*-------------------------------------------------------------------------*/
-
-/* AU1200 LCD controller device driver */
-
-static int au1200fb_drv_probe(struct device *dev)
-{
-        struct au1200fb_device *fbdev;
-        unsigned long page;
-        int bpp, plane, ret;
-
-        if (!dev)
-                return -EINVAL;
-
-        for (plane = 0; plane < CONFIG_FB_AU1200_DEVS; ++plane) {
-                bpp = winbpp(win->w[plane].mode_winctrl1);
-                if (win->w[plane].xres == 0)
-                        win->w[plane].xres = panel->Xres;
-                if (win->w[plane].yres == 0)
-                        win->w[plane].yres = panel->Yres;
-
-                fbdev = &_au1200fb_devices[plane];
-                memset(fbdev, 0, sizeof(struct au1200fb_device));
-                fbdev->plane = plane;
-
-                /* Allocate the framebuffer to the maximum screen size */
-                fbdev->fb_len = (win->w[plane].xres * win->w[plane].yres * bpp) / 8;
-
-                fbdev->fb_mem = dma_alloc_noncoherent(dev,
-                                PAGE_ALIGN(fbdev->fb_len),
-                                &fbdev->fb_phys, GFP_KERNEL);
-                if (!fbdev->fb_mem) {
-                        print_err("fail to allocate frambuffer (size: %dK))",
-                                  fbdev->fb_len / 1024);
-                        return -ENOMEM;
-                }
-
-                /*
-                 * Set page reserved so that mmap will work. This is necessary
-                 * since we'll be remapping normal memory.
-                 */
-                for (page = (unsigned long)fbdev->fb_phys;
-                     page < PAGE_ALIGN((unsigned long)fbdev->fb_phys +
-                             fbdev->fb_len);
-                     page += PAGE_SIZE) {
-                        SetPageReserved(pfn_to_page(page >> PAGE_SHIFT)); /* LCD DMA is NOT coherent on Au1200 */
-                }
-                print_dbg("Framebuffer memory map at %p", fbdev->fb_mem);
-                print_dbg("phys=0x%08x, size=%dK", fbdev->fb_phys, fbdev->fb_len / 1024);
-
-                /* Init FB data */
-                if ((ret = au1200fb_init_fbinfo(fbdev)) < 0)
-                        goto failed;
-
-                /* Register new framebuffer */
-                if ((ret = register_framebuffer(&fbdev->fb_info)) < 0) {
-                        print_err("cannot register new framebuffer");
-                        goto failed;
-                }
-
-                au1200fb_fb_set_par(&fbdev->fb_info);
-
-#if !defined(CONFIG_FRAMEBUFFER_CONSOLE) && defined(CONFIG_LOGO)
-                if (plane == 0)
-                        if (fb_prepare_logo(&fbdev->fb_info, FB_ROTATE_UR)) {
-                                /* Start display and show logo on boot */
-                                fb_set_cmap(&fbdev->fb_info.cmap,
-                                                &fbdev->fb_info);
-
-                                fb_show_logo(&fbdev->fb_info, FB_ROTATE_UR);
-                        }
-#endif
-        }
-
-        /* Now hook interrupt too */
-        if ((ret = request_irq(AU1200_LCD_INT, au1200fb_handle_irq,
-                          SA_INTERRUPT | SA_SHIRQ, "lcd", (void *)dev)) < 0) {
-                print_err("fail to request interrupt line %d (err: %d)",
-                          AU1200_LCD_INT, ret);
-                goto failed;
-        }
-
-        return 0;
-
-failed:
-        /* NOTE: This only does the current plane/window that failed; others are still active */
-        if (fbdev->fb_mem)
-                dma_free_noncoherent(dev, PAGE_ALIGN(fbdev->fb_len),
-                                fbdev->fb_mem, fbdev->fb_phys);
-        if (fbdev->fb_info.cmap.len != 0)
-                fb_dealloc_cmap(&fbdev->fb_info.cmap);
-        if (fbdev->fb_info.pseudo_palette)
-                kfree(fbdev->fb_info.pseudo_palette);
-        if (plane == 0)
-                free_irq(AU1200_LCD_INT, (void*)dev);
-        return ret;
-}
-
-static int au1200fb_drv_remove(struct device *dev)
-{
-        struct au1200fb_device *fbdev;
-        int plane;
-
-        if (!dev)
-                return -ENODEV;
-
-        /* Turn off the panel */
-        au1200_setpanel(NULL);
-
-        for (plane = 0; plane < CONFIG_FB_AU1200_DEVS; ++plane)
-        {
-                fbdev = &_au1200fb_devices[plane];
-
-                /* Clean up all probe data */
-                unregister_framebuffer(&fbdev->fb_info);
-                if (fbdev->fb_mem)
-                        dma_free_noncoherent(dev, PAGE_ALIGN(fbdev->fb_len),
-                                        fbdev->fb_mem, fbdev->fb_phys);
-                if (fbdev->fb_info.cmap.len != 0)
-                        fb_dealloc_cmap(&fbdev->fb_info.cmap);
-                if (fbdev->fb_info.pseudo_palette)
-                        kfree(fbdev->fb_info.pseudo_palette);
-        }
-
-        free_irq(AU1200_LCD_INT, (void *)dev);
-
-        return 0;
-}
-
-#ifdef CONFIG_PM
-static int au1200fb_drv_suspend(struct device *dev, u32 state, u32 level)
-{
-        /* TODO */
-        return 0;
-}
-
-static int au1200fb_drv_resume(struct device *dev, u32 level)
-{
-        /* TODO */
-        return 0;
-}
-#endif /* CONFIG_PM */
-
-static struct device_driver au1200fb_driver = {
-        .name           = "au1200-lcd",
-        .bus            = &platform_bus_type,
-        .probe          = au1200fb_drv_probe,
-        .remove         = au1200fb_drv_remove,
-#ifdef CONFIG_PM
-        .suspend        = au1200fb_drv_suspend,
-        .resume         = au1200fb_drv_resume,
-#endif
-};
-
-/*-------------------------------------------------------------------------*/
-
-/* Kernel driver */
-
-static void au1200fb_setup(void)
-{
-        char* options = NULL;
-        char* this_opt;
-        int num_panels = ARRAY_SIZE(known_lcd_panels);
-        int panel_idx = -1;
-
-        fb_get_options(DRIVER_NAME, &options);
-
-        if (options) {
-                while ((this_opt = strsep(&options,",")) != NULL) {
-                        /* Panel option - can be panel name,
-                         * "bs" for board-switch, or number/index */
-                        if (!strncmp(this_opt, "panel:", 6)) {
-                                int i;
-                                long int li;
-                                char *endptr;
-                                this_opt += 6;
-                                /* First check for index, which allows
-                                 * to short circuit this mess */
-                                li = simple_strtol(this_opt, &endptr, 0);
-                                if (*endptr == '\0') {
-                                        panel_idx = (int)li;
-                                }
-                                else if (strcmp(this_opt, "bs") == 0) {
-                                        extern int board_au1200fb_panel(void);
-                                        panel_idx = board_au1200fb_panel();
-                                }
-
-                                else
-                                for (i = 0; i < num_panels; i++) {
-                                        if (!strcmp(this_opt, known_lcd_panels[i].name)) {
-                                                panel_idx = i;
-                                                break;
-                                        }
-                                }
-
-                                if ((panel_idx < 0) || (panel_idx >= num_panels)) {
-                                                print_warn("Panel %s not supported!", this_opt);
-                                }
-                                else
-                                        panel_index = panel_idx;
-                        }
-
-                        else if (strncmp(this_opt, "nohwcursor", 10) == 0) {
-                                nohwcursor = 1;
-                        }
-
-                        /* Unsupported option */
-                        else {
-                                print_warn("Unsupported option \"%s\"", this_opt);
-                        }
-                }
-        }
-}
-
-#ifdef CONFIG_PM
-static int au1200fb_pm_callback(au1xxx_power_dev_t *dev,
-                au1xxx_request_t request, void *data) {
-        int retval = -1;
-        unsigned int d = 0;
-        unsigned int brightness = 0;
-
-        if (request == AU1XXX_PM_SLEEP) {
-                board_au1200fb_panel_shutdown();
-        }
-        else if (request == AU1XXX_PM_WAKEUP) {
-                if(dev->prev_state == SLEEP_STATE)
-                {
-                        int plane;
-                        au1200_setpanel(panel);
-                        for (plane = 0; plane < CONFIG_FB_AU1200_DEVS; ++plane)         {
-                                struct au1200fb_device *fbdev;
-                                fbdev = &_au1200fb_devices[plane];
-                                au1200fb_fb_set_par(&fbdev->fb_info);
-                        }
-                }
-
-                d = *((unsigned int*)data);
-                if(d <=10) brightness = 26;
-                else if(d<=20) brightness = 51;
-                else if(d<=30) brightness = 77;
-                else if(d<=40) brightness = 102;
-                else if(d<=50) brightness = 128;
-                else if(d<=60) brightness = 153;
-                else if(d<=70) brightness = 179;
-                else if(d<=80) brightness = 204;
-                else if(d<=90) brightness = 230;
-                else brightness = 255;
-                set_brightness(brightness);
-        } else if (request == AU1XXX_PM_GETSTATUS) {
-                return dev->cur_state;
-        } else if (request == AU1XXX_PM_ACCESS) {
-                if (dev->cur_state != SLEEP_STATE)
-                        return retval;
-                else {
-                        au1200_setpanel(panel);
-                }
-        } else if (request == AU1XXX_PM_IDLE) {
-        } else if (request == AU1XXX_PM_CLEANUP) {
-        }
-
-        return retval;
-}
-#endif
-
-static int __init au1200fb_init(void)
-{
-        print_info("" DRIVER_DESC "");
-
-        /* Setup driver with options */
-        au1200fb_setup();
-
-        /* Point to the panel selected */
-        panel = &known_lcd_panels[panel_index];
-        win = &windows[window_index];
-
-        printk(DRIVER_NAME ": Panel %d %s\n", panel_index, panel->name);
-        printk(DRIVER_NAME ": Win %d %s\n", window_index, win->name);
-
-        /* Kickstart the panel, the framebuffers/windows come soon enough */
-        au1200_setpanel(panel);
-
-        #ifdef CONFIG_PM
-        LCD_pm_dev = new_au1xxx_power_device("LCD", &au1200fb_pm_callback, NULL);
-        if ( LCD_pm_dev == NULL)
-                printk(KERN_INFO "Unable to create a power management device entry for the au1200fb.\n");
-        else
-                printk(KERN_INFO "Power management device entry for the au1200fb loaded.\n");
-        #endif
-
-        return driver_register(&au1200fb_driver);
-}
-
-static void __exit au1200fb_cleanup(void)
-{
-        driver_unregister(&au1200fb_driver);
-}
-
-module_init(au1200fb_init);
-module_exit(au1200fb_cleanup);
-
-MODULE_DESCRIPTION(DRIVER_DESC);
-MODULE_LICENSE("GPL");
diff --git a/drivers/video/fbsysfs.c b/drivers/video/fbsysfs.c
index b72b05250a9d..34e07399756b 100644
--- a/drivers/video/fbsysfs.c
+++ b/drivers/video/fbsysfs.c
@@ -305,94 +305,6 @@ static ssize_t show_stride(struct class_device *class_device, char *buf)
         return snprintf(buf, PAGE_SIZE, "%d\n", fb_info->fix.line_length);
 }
 
-/* Format for cmap is "%02x%c%4x%4x%4x\n" */
-/* %02x entry %c transp %4x red %4x blue %4x green \n */
-/* 256 rows at 16 chars equals 4096, the normal page size */
-/* the code will automatically adjust for different page sizes */
-static ssize_t store_cmap(struct class_device *class_device, const char *buf,
-                          size_t count)
-{
-        struct fb_info *fb_info = class_get_devdata(class_device);
-        int rc, i, start, length, transp = 0;
-
-        if ((count > PAGE_SIZE) || ((count % 16) != 0))
-                return -EINVAL;
-
-        if (!fb_info->fbops->fb_setcolreg && !fb_info->fbops->fb_setcmap)
-                return -EINVAL;
-
-        sscanf(buf, "%02x", &start);
-        length = count / 16;
-
-        for (i = 0; i < length; i++)
-                if (buf[i * 16 + 2] != ' ')
-                        transp = 1;
-
-        /* If we can batch, do it */
-        if (fb_info->fbops->fb_setcmap && length > 1) {
-                struct fb_cmap umap;
-
-                memset(&umap, 0, sizeof(umap));
-                if ((rc = fb_alloc_cmap(&umap, length, transp)))
-                        return rc;
-
-                umap.start = start;
-                for (i = 0; i < length; i++) {
-                        sscanf(&buf[i * 16 +  3], "%4hx", &umap.red[i]);
-                        sscanf(&buf[i * 16 +  7], "%4hx", &umap.blue[i]);
-                        sscanf(&buf[i * 16 + 11], "%4hx", &umap.green[i]);
-                        if (transp)
-                                umap.transp[i] = (buf[i * 16 +  2] != ' ');
-                }
-                rc = fb_info->fbops->fb_setcmap(&umap, fb_info);
-                fb_copy_cmap(&umap, &fb_info->cmap);
-                fb_dealloc_cmap(&umap);
-
-                return rc ?: count;
-        }
-        for (i = 0; i < length; i++) {
-                u16 red, blue, green, tsp;
-
-                sscanf(&buf[i * 16 +  3], "%4hx", &red);
-                sscanf(&buf[i * 16 +  7], "%4hx", &blue);
-                sscanf(&buf[i * 16 + 11], "%4hx", &green);
-                tsp = (buf[i * 16 +  2] != ' ');
-                if ((rc = fb_info->fbops->fb_setcolreg(start++,
-                                      red, green, blue, tsp, fb_info)))
-                        return rc;
-
-                fb_info->cmap.red[i] = red;
-                fb_info->cmap.blue[i] = blue;
-                fb_info->cmap.green[i] = green;
-                if (transp)
-                        fb_info->cmap.transp[i] = tsp;
-        }
-        return count;
-}
-
-static ssize_t show_cmap(struct class_device *class_device, char *buf)
-{
-        struct fb_info *fb_info = class_get_devdata(class_device);
-        unsigned int i;
-
-        if (!fb_info->cmap.red || !fb_info->cmap.blue ||
-           !fb_info->cmap.green)
-                return -EINVAL;
-
-        if (fb_info->cmap.len > PAGE_SIZE / 16)
-                return -EINVAL;
-
-        /* don't mess with the format, the buffer is PAGE_SIZE */
-        /* 256 entries at 16 chars per line equals 4096 = PAGE_SIZE */
-        for (i = 0; i < fb_info->cmap.len; i++) {
-                snprintf(&buf[ i * 16], PAGE_SIZE - i * 16, "%02x%c%4x%4x%4x\n", i + fb_info->cmap.start,
-                        ((fb_info->cmap.transp && fb_info->cmap.transp[i]) ? '*' : ' '),
-                        fb_info->cmap.red[i], fb_info->cmap.blue[i],
-                        fb_info->cmap.green[i]);
-        }
-        return 16 * fb_info->cmap.len;
-}
-
 static ssize_t store_blank(struct class_device *class_device, const char * buf,
                            size_t count)
 {
@@ -502,10 +414,12 @@ static ssize_t show_fbstate(struct class_device *class_device, char *buf)
         return snprintf(buf, PAGE_SIZE, "%d\n", fb_info->state);
 }
 
+/* When cmap is added back in it should be a binary attribute
+ * not a text one. Consideration should also be given to converting
+ * fbdev to use configfs instead of sysfs */
 static struct class_device_attribute class_device_attrs[] = {
         __ATTR(bits_per_pixel, S_IRUGO|S_IWUSR, show_bpp, store_bpp),
         __ATTR(blank, S_IRUGO|S_IWUSR, show_blank, store_blank),
-        __ATTR(color_map, S_IRUGO|S_IWUSR, show_cmap, store_cmap),
         __ATTR(console, S_IRUGO|S_IWUSR, show_console, store_console),
         __ATTR(cursor, S_IRUGO|S_IWUSR, show_cursor, store_cursor),
         __ATTR(mode, S_IRUGO|S_IWUSR, show_mode, store_mode),
diff --git a/drivers/video/logo/Makefile b/drivers/video/logo/Makefile
index 4ef5cd19609d..b985dfad6c63 100644
--- a/drivers/video/logo/Makefile
+++ b/drivers/video/logo/Makefile
@@ -34,7 +34,7 @@ extra-y += $(call logo-cfiles,_clut224,ppm)
 extra-y += $(call logo-cfiles,_gray256,pgm)
 
 # Create commands like "pnmtologo -t mono -n logo_mac_mono -o ..."
-quiet_cmd_logo = LOGO   $@
+quiet_cmd_logo = LOGO    $@
         cmd_logo = scripts/pnmtologo \
                         -t $(patsubst $*_%,%,$(notdir $(basename $<))) \
                         -n $(notdir $(basename $<)) -o $@ $<
diff --git a/drivers/video/pm2fb.c b/drivers/video/pm2fb.c
index 5fe197943deb..4e963930b50a 100644
--- a/drivers/video/pm2fb.c
+++ b/drivers/video/pm2fb.c
@@ -73,8 +73,8 @@ static char *mode __devinitdata = NULL;
  * these flags allow the user to specify that requests for +ve sync
  * should be silently turned in -ve sync.
  */
-static int lowhsync __devinitdata = 0;
-static int lowvsync __devinitdata = 0;
+static int lowhsync;
+static int lowvsync;
 
 /*
  * The hardware state of the graphics card that isn't part of the