156 files changed, 2664 insertions, 2187 deletions
diff --git a/drivers/Kconfig b/drivers/Kconfig
index 263e86ddc1a4..f39463418904 100644
--- a/drivers/Kconfig
+++ b/drivers/Kconfig
@@ -14,6 +14,10 @@ source "drivers/pnp/Kconfig"
 source "drivers/block/Kconfig"
+# misc before ide - BLK_DEV_SGIIOC4 depends on SGI_IOC4
+source "drivers/misc/Kconfig"
 source "drivers/ide/Kconfig"
 source "drivers/scsi/Kconfig"
@@ -52,8 +56,6 @@ source "drivers/w1/Kconfig"
 source "drivers/hwmon/Kconfig"
-source "drivers/misc/Kconfig"
 source "drivers/mfd/Kconfig"
 source "drivers/media/Kconfig"
diff --git a/drivers/acpi/asus_acpi.c b/drivers/acpi/asus_acpi.c
index e9ee4c52a5f6..c7ac9297a204 100644
--- a/drivers/acpi/asus_acpi.c
+++ b/drivers/acpi/asus_acpi.c
@@ -138,6 +138,7 @@ struct asus_hotk {
                S2x,            //S200 (J1 reported), Victor MP-XP7210
                W1N,            //W1000N
                W5A,            //W5A
+                W3V,            //W3030V
                xxN,            //M2400N, M3700N, M5200N, M6800N, S1300N, S5200N
                //(Centrino)
                END_MODEL
@@ -376,6 +377,17 @@ static struct model_data model_conf[END_MODEL] = {
         .display_get = "\\ADVG"},
        {
+         .name = "W3V",
+         .mt_mled = "MLED",
+         .mt_wled = "WLED",
+         .mt_lcd_switch = xxN_PREFIX "_Q10",
+         .lcd_status = "\\BKLT",
+         .brightness_set = "SPLV",
+         .brightness_get = "GPLV",
+         .display_set = "SDSP",
+         .display_get = "\\INFB"},
+       {
         .name = "xxN",
         .mt_mled = "MLED",
 /* WLED present, but not controlled by ACPI */
@@ -555,11 +567,11 @@ static int
 write_led(const char __user * buffer, unsigned long count,
          char *ledname, int ledmask, int invert)
 {
-        int value;
+        int rv, value;
        int led_out = 0;
-        count = parse_arg(buffer, count, &value);
+        rv = parse_arg(buffer, count, &value);
-        if (count > 0)
+        if (rv > 0)
                led_out = value ? 1 : 0;
        hotk->status =
@@ -572,7 +584,7 @@ write_led(const char __user * buffer, unsigned long count,
                printk(KERN_WARNING "Asus ACPI: LED (%s) write failed\n",
                       ledname);
-        return count;
+        return rv;
 }
 /*
@@ -607,20 +619,18 @@ static int
 proc_write_ledd(struct file *file, const char __user * buffer,
                unsigned long count, void *data)
 {
-        int value;
+        int rv, value;
-        count = parse_arg(buffer, count, &value);
+        rv = parse_arg(buffer, count, &value);
-        if (count > 0) {
+        if (rv > 0) {
                if (!write_acpi_int
                    (hotk->handle, hotk->methods->mt_ledd, value, NULL))
                        printk(KERN_WARNING
                               "Asus ACPI: LED display write failed\n");
                else
                        hotk->ledd_status = (u32) value;
-        } else if (count < 0)
+        }
-                printk(KERN_WARNING "Asus ACPI: Error reading user input\n");
+        return rv;
-        return count;
 }
 /*
@@ -761,12 +771,12 @@ static int
 proc_write_lcd(struct file *file, const char __user * buffer,
               unsigned long count, void *data)
 {
-        int value;
+        int rv, value;
-        count = parse_arg(buffer, count, &value);
+        rv = parse_arg(buffer, count, &value);
-        if (count > 0)
+        if (rv > 0)
                set_lcd_state(value);
-        return count;
+        return rv;
 }
 static int read_brightness(void)
@@ -830,18 +840,15 @@ static int
 proc_write_brn(struct file *file, const char __user * buffer,
               unsigned long count, void *data)
 {
-        int value;
+        int rv, value;
-        count = parse_arg(buffer, count, &value);
+        rv = parse_arg(buffer, count, &value);
-        if (count > 0) {
+        if (rv > 0) {
                value = (0 < value) ? ((15 < value) ? 15 : value) : 0;
                /* 0 <= value <= 15 */
                set_brightness(value);
-        } else if (count < 0) {
-                printk(KERN_WARNING "Asus ACPI: Error reading user input\n");
        }
+        return rv;
-        return count;
 }
 static void set_display(int value)
@@ -880,15 +887,12 @@ static int
 proc_write_disp(struct file *file, const char __user * buffer,
                unsigned long count, void *data)
 {
-        int value;
+        int rv, value;
-        count = parse_arg(buffer, count, &value);
+        rv = parse_arg(buffer, count, &value);
-        if (count > 0)
+        if (rv > 0)
                set_display(value);
-        else if (count < 0)
+        return rv;
-                printk(KERN_WARNING "Asus ACPI: Error reading user input\n");
-        return count;
 }
 typedef int (proc_readfunc) (char *page, char **start, off_t off, int count,
@@ -1097,6 +1101,8 @@ static int asus_model_match(char *model)
                return A4G;
        else if (strncmp(model, "W1N", 3) == 0)
                return W1N;
+        else if (strncmp(model, "W3V", 3) == 0)
+                return W3V;
        else if (strncmp(model, "W5A", 3) == 0)
                return W5A;
        else
@@ -1200,9 +1206,10 @@ static int asus_hotk_get_info(void)
                hotk->methods->mt_wled = NULL;
        /* L5D's WLED is not controlled by ACPI */
        else if (strncmp(string, "M2N", 3) == 0 ||
+                 strncmp(string, "W3V", 3) == 0 ||
                 strncmp(string, "S1N", 3) == 0)
                hotk->methods->mt_wled = "WLED";
-        /* M2N and S1N have a usable WLED */
+        /* M2N, S1N and W3V have a usable WLED */
        else if (asus_info) {
                if (strncmp(asus_info->oem_table_id, "L1", 2) == 0)
                        hotk->methods->mled_status = NULL;
diff --git a/drivers/acpi/battery.c b/drivers/acpi/battery.c
index 9810e2a55d0a..026e40755cdd 100644
--- a/drivers/acpi/battery.c
+++ b/drivers/acpi/battery.c
@@ -64,6 +64,7 @@ extern void *acpi_unlock_battery_dir(struct proc_dir_entry *acpi_battery_dir);
 static int acpi_battery_add(struct acpi_device *device);
 static int acpi_battery_remove(struct acpi_device *device, int type);
+static int acpi_battery_resume(struct acpi_device *device, int status);
 static struct acpi_driver acpi_battery_driver = {
        .name = ACPI_BATTERY_DRIVER_NAME,
@@ -71,6 +72,7 @@ static struct acpi_driver acpi_battery_driver = {
        .ids = ACPI_BATTERY_HID,
        .ops = {
                .add = acpi_battery_add,
+                .resume = acpi_battery_resume,
                .remove = acpi_battery_remove,
                },
 };
@@ -753,6 +755,18 @@ static int acpi_battery_remove(struct acpi_device *device, int type)
        return 0;
 }
+/* this is needed to learn about changes made in suspended state */
+static int acpi_battery_resume(struct acpi_device *device, int state)
+{
+        struct acpi_battery *battery;
+        if (!device)
+                return -EINVAL;
+        battery = device->driver_data;
+        return acpi_battery_check(battery);
+}
 static int __init acpi_battery_init(void)
 {
        int result;
diff --git a/drivers/acpi/ec.c b/drivers/acpi/ec.c
index e5d796362854..e6d4b084dca2 100644
--- a/drivers/acpi/ec.c
+++ b/drivers/acpi/ec.c
@@ -45,206 +45,143 @@ ACPI_MODULE_NAME("acpi_ec")
 #define ACPI_EC_DRIVER_NAME             "ACPI Embedded Controller Driver"
 #define ACPI_EC_DEVICE_NAME             "Embedded Controller"
 #define ACPI_EC_FILE_INFO               "info"
+/* EC status register */
 #define ACPI_EC_FLAG_OBF        0x01    /* Output buffer full */
 #define ACPI_EC_FLAG_IBF        0x02    /* Input buffer full */
 #define ACPI_EC_FLAG_BURST      0x10    /* burst mode */
 #define ACPI_EC_FLAG_SCI        0x20    /* EC-SCI occurred */
-#define ACPI_EC_EVENT_OBF       0x01    /* Output buffer full */
-#define ACPI_EC_EVENT_IBE       0x02    /* Input buffer empty */
+/* EC commands */
-#define ACPI_EC_DELAY           50      /* Wait 50ms max. during EC ops */
-#define ACPI_EC_UDELAY_GLK      1000    /* Wait 1ms max. to get global lock */
-#define ACPI_EC_UDELAY         100      /* Poll @ 100us increments */
-#define ACPI_EC_UDELAY_COUNT   1000     /* Wait 10ms max. during EC ops */
 #define ACPI_EC_COMMAND_READ    0x80
 #define ACPI_EC_COMMAND_WRITE   0x81
 #define ACPI_EC_BURST_ENABLE    0x82
 #define ACPI_EC_BURST_DISABLE   0x83
 #define ACPI_EC_COMMAND_QUERY   0x84
-#define EC_POLL                 0xFF
-#define EC_INTR                 0x00
+/* EC events */
+enum {
+        ACPI_EC_EVENT_OBF_1 = 1,        /* Output buffer full */
+        ACPI_EC_EVENT_IBF_0,            /* Input buffer empty */
+};
+#define ACPI_EC_DELAY           50      /* Wait 50ms max. during EC ops */
+#define ACPI_EC_UDELAY_GLK      1000    /* Wait 1ms max. to get global lock */
+#define ACPI_EC_UDELAY         100      /* Poll @ 100us increments */
+#define ACPI_EC_UDELAY_COUNT   1000     /* Wait 10ms max. during EC ops */
+enum {
+        EC_INTR = 1,    /* Output buffer full */
+        EC_POLL,        /* Input buffer empty */
+};
 static int acpi_ec_remove(struct acpi_device *device, int type);
 static int acpi_ec_start(struct acpi_device *device);
 static int acpi_ec_stop(struct acpi_device *device, int type);
-static int acpi_ec_intr_add(struct acpi_device *device);
+static int acpi_ec_add(struct acpi_device *device);
-static int acpi_ec_poll_add(struct acpi_device *device);
 static struct acpi_driver acpi_ec_driver = {
        .name = ACPI_EC_DRIVER_NAME,
        .class = ACPI_EC_CLASS,
        .ids = ACPI_EC_HID,
        .ops = {
-                .add = acpi_ec_intr_add,
+                .add = acpi_ec_add,
                .remove = acpi_ec_remove,
                .start = acpi_ec_start,
                .stop = acpi_ec_stop,
                },
 };
-union acpi_ec {
-        struct {
-                u32 mode;
-                acpi_handle handle;
-                unsigned long uid;
-                unsigned long gpe_bit;
-                struct acpi_generic_address status_addr;
-                struct acpi_generic_address command_addr;
-                struct acpi_generic_address data_addr;
-                unsigned long global_lock;
-        } common;
-        struct {
-                u32 mode;
-                acpi_handle handle;
-                unsigned long uid;
-                unsigned long gpe_bit;
-                struct acpi_generic_address status_addr;
-                struct acpi_generic_address command_addr;
-                struct acpi_generic_address data_addr;
-                unsigned long global_lock;
-                unsigned int expect_event;
-                atomic_t leaving_burst; /* 0 : No, 1 : Yes, 2: abort */
-                atomic_t pending_gpe;
-                struct semaphore sem;
-                wait_queue_head_t wait;
-        } intr;
-        struct {
-                u32 mode;
-                acpi_handle handle;
-                unsigned long uid;
-                unsigned long gpe_bit;
-                struct acpi_generic_address status_addr;
-                struct acpi_generic_address command_addr;
-                struct acpi_generic_address data_addr;
-                unsigned long global_lock;
-                struct semaphore sem;
-        } poll;
-};
-static int acpi_ec_poll_wait(union acpi_ec *ec, u8 event);
-static int acpi_ec_intr_wait(union acpi_ec *ec, unsigned int event);
-static int acpi_ec_poll_read(union acpi_ec *ec, u8 address, u32 * data);
-static int acpi_ec_intr_read(union acpi_ec *ec, u8 address, u32 * data);
-static int acpi_ec_poll_write(union acpi_ec *ec, u8 address, u8 data);
-static int acpi_ec_intr_write(union acpi_ec *ec, u8 address, u8 data);
-static int acpi_ec_poll_query(union acpi_ec *ec, u32 * data);
-static int acpi_ec_intr_query(union acpi_ec *ec, u32 * data);
-static void acpi_ec_gpe_poll_query(void *ec_cxt);
-static void acpi_ec_gpe_intr_query(void *ec_cxt);
-static u32 acpi_ec_gpe_poll_handler(void *data);
-static u32 acpi_ec_gpe_intr_handler(void *data);
-static acpi_status __init
-acpi_fake_ecdt_poll_callback(acpi_handle handle,
-                                u32 Level, void *context, void **retval);
-static acpi_status __init
-acpi_fake_ecdt_intr_callback(acpi_handle handle,
-                              u32 Level, void *context, void **retval);
-static int __init acpi_ec_poll_get_real_ecdt(void);
-static int __init acpi_ec_intr_get_real_ecdt(void);
 /* If we find an EC via the ECDT, we need to keep a ptr to its context */
-static union acpi_ec *ec_ecdt;
+struct acpi_ec {
+        acpi_handle handle;
+        unsigned long uid;
+        unsigned long gpe_bit;
+        unsigned long command_addr;
+        unsigned long data_addr;
+        unsigned long global_lock;
+        struct semaphore sem;
+        unsigned int expect_event;
+        atomic_t leaving_burst; /* 0 : No, 1 : Yes, 2: abort */
+        wait_queue_head_t wait;
+} *ec_ecdt;
 /* External interfaces use first EC only, so remember */
 static struct acpi_device *first_ec;
-static int acpi_ec_poll_mode = EC_INTR;
+static int acpi_ec_mode = EC_INTR;
 /* --------------------------------------------------------------------------
                             Transaction Management
   -------------------------------------------------------------------------- */
-static u32 acpi_ec_read_status(union acpi_ec *ec)
+static inline u8 acpi_ec_read_status(struct acpi_ec *ec)
 {
-        u32 status = 0;
+        return inb(ec->command_addr);
-        acpi_hw_low_level_read(8, &status, &ec->common.status_addr);
-        return status;
 }
-static int acpi_ec_wait(union acpi_ec *ec, u8 event)
+static inline u8 acpi_ec_read_data(struct acpi_ec *ec)
 {
-        if (acpi_ec_poll_mode)
+        return inb(ec->data_addr);
-                return acpi_ec_poll_wait(ec, event);
-        else
-                return acpi_ec_intr_wait(ec, event);
 }
-static int acpi_ec_poll_wait(union acpi_ec *ec, u8 event)
+static inline void acpi_ec_write_cmd(struct acpi_ec *ec, u8 command)
 {
-        u32 acpi_ec_status = 0;
+        outb(command, ec->command_addr);
-        u32 i = ACPI_EC_UDELAY_COUNT;
+}
-        if (!ec)
+static inline void acpi_ec_write_data(struct acpi_ec *ec, u8 data)
-                return -EINVAL;
+{
+        outb(data, ec->data_addr);
+}
-        /* Poll the EC status register waiting for the event to occur. */
+static int acpi_ec_check_status(u8 status, u8 event)
+{
        switch (event) {
-        case ACPI_EC_EVENT_OBF:
+        case ACPI_EC_EVENT_OBF_1:
-                do {
+                if (status & ACPI_EC_FLAG_OBF)
-                        acpi_hw_low_level_read(8, &acpi_ec_status,
+                        return 1;
-                                               &ec->common.status_addr);
-                        if (acpi_ec_status & ACPI_EC_FLAG_OBF)
-                                return 0;
-                        udelay(ACPI_EC_UDELAY);
-                } while (--i > 0);
                break;
-        case ACPI_EC_EVENT_IBE:
+        case ACPI_EC_EVENT_IBF_0:
-                do {
+                if (!(status & ACPI_EC_FLAG_IBF))
-                        acpi_hw_low_level_read(8, &acpi_ec_status,
+                        return 1;
-                                               &ec->common.status_addr);
-                        if (!(acpi_ec_status & ACPI_EC_FLAG_IBF))
-                                return 0;
-                        udelay(ACPI_EC_UDELAY);
-                } while (--i > 0);
                break;
        default:
-                return -EINVAL;
+                break;
        }
-        return -ETIME;
+        return 0;
 }
-static int acpi_ec_intr_wait(union acpi_ec *ec, unsigned int event)
-{
-        int result = 0;
-        ec->intr.expect_event = event;
+static int acpi_ec_wait(struct acpi_ec *ec, u8 event)
-        smp_mb();
+{
+        int i = (acpi_ec_mode == EC_POLL) ? ACPI_EC_UDELAY_COUNT : 0;
+        long time_left;
-        switch (event) {
+        ec->expect_event = event;
-        case ACPI_EC_EVENT_IBE:
+        if (acpi_ec_check_status(acpi_ec_read_status(ec), event)) {
-                if (~acpi_ec_read_status(ec) & ACPI_EC_FLAG_IBF) {
+                ec->expect_event = 0;
-                        ec->intr.expect_event = 0;
+                return 0;
-                        return 0;
-                }
-                break;
-        default:
-                break;
        }
-        result = wait_event_timeout(ec->intr.wait,
+        do {
-                                    !ec->intr.expect_event,
+                if (acpi_ec_mode == EC_POLL) {
+                        udelay(ACPI_EC_UDELAY);
+                } else {
+                        time_left = wait_event_timeout(ec->wait,
+                                    !ec->expect_event,
                                    msecs_to_jiffies(ACPI_EC_DELAY));
+                        if (time_left > 0) {
-        ec->intr.expect_event = 0;
+                                ec->expect_event = 0;
-        smp_mb();
+                                return 0;
+                        }
-        /*
+                }
-         * Verify that the event in question has actually happened by
+                if (acpi_ec_check_status(acpi_ec_read_status(ec), event)) {
-         * querying EC status. Do the check even if operation timed-out
+                        ec->expect_event = 0;
-         * to make sure that we did not miss interrupt.
-         */
-        switch (event) {
-        case ACPI_EC_EVENT_OBF:
-                if (acpi_ec_read_status(ec) & ACPI_EC_FLAG_OBF)
                        return 0;
-                break;
+                }
+        } while (--i > 0);
-        case ACPI_EC_EVENT_IBE:
+        ec->expect_event = 0;
-                if (~acpi_ec_read_status(ec) & ACPI_EC_FLAG_IBF)
-                        return 0;
-                break;
-        }
        return -ETIME;
 }
@@ -254,272 +191,150 @@ static int acpi_ec_intr_wait(union acpi_ec *ec, unsigned int event)
 * Note: samsung nv5000 doesn't work with ec burst mode.
 * http://bugzilla.kernel.org/show_bug.cgi?id=4980
 */
-int acpi_ec_enter_burst_mode(union acpi_ec *ec)
+int acpi_ec_enter_burst_mode(struct acpi_ec *ec)
 {
-        u32 tmp = 0;
+        u8 tmp = 0;
-        int status = 0;
+        u8 status = 0;
        status = acpi_ec_read_status(ec);
        if (status != -EINVAL && !(status & ACPI_EC_FLAG_BURST)) {
-                status = acpi_ec_wait(ec, ACPI_EC_EVENT_IBE);
+                status = acpi_ec_wait(ec, ACPI_EC_EVENT_IBF_0);
                if (status)
                        goto end;
-                acpi_hw_low_level_write(8, ACPI_EC_BURST_ENABLE,
+                acpi_ec_write_cmd(ec, ACPI_EC_BURST_ENABLE);
-                                        &ec->common.command_addr);
+                status = acpi_ec_wait(ec, ACPI_EC_EVENT_OBF_1);
-                status = acpi_ec_wait(ec, ACPI_EC_EVENT_OBF);
+                tmp = acpi_ec_read_data(ec);
-                acpi_hw_low_level_read(8, &tmp, &ec->common.data_addr);
                if (tmp != 0x90) {      /* Burst ACK byte */
                        return -EINVAL;
                }
        }
-        atomic_set(&ec->intr.leaving_burst, 0);
+        atomic_set(&ec->leaving_burst, 0);
        return 0;
-      end:
+  end:
-        ACPI_EXCEPTION ((AE_INFO, status, "EC wait, burst mode");
+        ACPI_EXCEPTION((AE_INFO, status, "EC wait, burst mode"));
        return -1;
 }
-int acpi_ec_leave_burst_mode(union acpi_ec *ec)
+int acpi_ec_leave_burst_mode(struct acpi_ec *ec)
 {
-        int status = 0;
+        u8 status = 0;
        status = acpi_ec_read_status(ec);
        if (status != -EINVAL && (status & ACPI_EC_FLAG_BURST)){
-                status = acpi_ec_wait(ec, ACPI_EC_FLAG_IBF);
+                status = acpi_ec_wait(ec, ACPI_EC_EVENT_IBF_0);
                if(status)
                        goto end;
-                acpi_hw_low_level_write(8, ACPI_EC_BURST_DISABLE, &ec->common.command_addr);
+                acpi_ec_write_cmd(ec, ACPI_EC_BURST_DISABLE);
-                acpi_ec_wait(ec, ACPI_EC_FLAG_IBF);
+                acpi_ec_wait(ec, ACPI_EC_EVENT_IBF_0);
-        } 
+        }
-        atomic_set(&ec->intr.leaving_burst, 1);
+        atomic_set(&ec->leaving_burst, 1);
        return 0;
-end:
+  end:
-        ACPI_EXCEPTION((AE_INFO, status, "EC leave burst mode");
+        ACPI_EXCEPTION((AE_INFO, status, "EC leave burst mode"));
        return -1;
 }
 #endif /* ACPI_FUTURE_USAGE */
-static int acpi_ec_read(union acpi_ec *ec, u8 address, u32 * data)
+static int acpi_ec_transaction_unlocked(struct acpi_ec *ec, u8 command,
-{
+                                        const u8 *wdata, unsigned wdata_len,
-        if (acpi_ec_poll_mode)
+                                        u8 *rdata, unsigned rdata_len)
-                return acpi_ec_poll_read(ec, address, data);
-        else
-                return acpi_ec_intr_read(ec, address, data);
-}
-static int acpi_ec_write(union acpi_ec *ec, u8 address, u8 data)
-{
-        if (acpi_ec_poll_mode)
-                return acpi_ec_poll_write(ec, address, data);
-        else
-                return acpi_ec_intr_write(ec, address, data);
-}
-static int acpi_ec_poll_read(union acpi_ec *ec, u8 address, u32 * data)
 {
-        acpi_status status = AE_OK;
+        int result;
-        int result = 0;
-        u32 glk = 0;
+        acpi_ec_write_cmd(ec, command);
-        if (!ec || !data)
+        for (; wdata_len > 0; wdata_len --) {
-                return -EINVAL;
+                result = acpi_ec_wait(ec, ACPI_EC_EVENT_IBF_0);
+                if (result)
-        *data = 0;
+                        return result;
+                acpi_ec_write_data(ec, *(wdata++));
-        if (ec->common.global_lock) {
-                status = acpi_acquire_global_lock(ACPI_EC_UDELAY_GLK, &glk);
-                if (ACPI_FAILURE(status))
-                        return -ENODEV;
        }
-        if (down_interruptible(&ec->poll.sem)) {
+        if (command == ACPI_EC_COMMAND_WRITE) {
-                result = -ERESTARTSYS;
+                result = acpi_ec_wait(ec, ACPI_EC_EVENT_IBF_0);
-                goto end_nosem;
+                if (result)
+                        return result;
        }
-        
-        acpi_hw_low_level_write(8, ACPI_EC_COMMAND_READ,
-                                &ec->common.command_addr);
-        result = acpi_ec_wait(ec, ACPI_EC_EVENT_IBE);
-        if (result)
-                goto end;
-        acpi_hw_low_level_write(8, address, &ec->common.data_addr);
-        result = acpi_ec_wait(ec, ACPI_EC_EVENT_OBF);
-        if (result)
-                goto end;
-        acpi_hw_low_level_read(8, data, &ec->common.data_addr);
-        ACPI_DEBUG_PRINT((ACPI_DB_INFO, "Read [%02x] from address [%02x]\n",
-                          *data, address));
-      end:
-        up(&ec->poll.sem);
-end_nosem:
-        if (ec->common.global_lock)
-                acpi_release_global_lock(glk);
-        return result;
-}
-static int acpi_ec_poll_write(union acpi_ec *ec, u8 address, u8 data)
-{
-        int result = 0;
-        acpi_status status = AE_OK;
-        u32 glk = 0;
+        for (; rdata_len > 0; rdata_len --) {
+                result = acpi_ec_wait(ec, ACPI_EC_EVENT_OBF_1);
+                if (result)
+                        return result;
-        if (!ec)
+                *(rdata++) = acpi_ec_read_data(ec);
-                return -EINVAL;
-        if (ec->common.global_lock) {
-                status = acpi_acquire_global_lock(ACPI_EC_UDELAY_GLK, &glk);
-                if (ACPI_FAILURE(status))
-                        return -ENODEV;
-        }
-        if (down_interruptible(&ec->poll.sem)) {
-                result = -ERESTARTSYS;
-                goto end_nosem;
        }
-        
-        acpi_hw_low_level_write(8, ACPI_EC_COMMAND_WRITE,
-                                &ec->common.command_addr);
-        result = acpi_ec_wait(ec, ACPI_EC_EVENT_IBE);
-        if (result)
-                goto end;
-        acpi_hw_low_level_write(8, address, &ec->common.data_addr);
-        result = acpi_ec_wait(ec, ACPI_EC_EVENT_IBE);
-        if (result)
-                goto end;
-        acpi_hw_low_level_write(8, data, &ec->common.data_addr);
-        result = acpi_ec_wait(ec, ACPI_EC_EVENT_IBE);
-        if (result)
-                goto end;
-        ACPI_DEBUG_PRINT((ACPI_DB_INFO, "Wrote [%02x] to address [%02x]\n",
+        return 0;
-                          data, address));
-      end:
-        up(&ec->poll.sem);
-end_nosem:
-        if (ec->common.global_lock)
-                acpi_release_global_lock(glk);
-        return result;
 }
-static int acpi_ec_intr_read(union acpi_ec *ec, u8 address, u32 * data)
+static int acpi_ec_transaction(struct acpi_ec *ec, u8 command,
+                                const u8 *wdata, unsigned wdata_len,
+                                u8 *rdata, unsigned rdata_len)
 {
-        int status = 0;
+        int status;
        u32 glk;
+        if (!ec || (wdata_len && !wdata) || (rdata_len && !rdata))
-        if (!ec || !data)
                return -EINVAL;
-        *data = 0;
+        if (rdata)
+                memset(rdata, 0, rdata_len);
-        if (ec->common.global_lock) {
+        if (ec->global_lock) {
                status = acpi_acquire_global_lock(ACPI_EC_UDELAY_GLK, &glk);
                if (ACPI_FAILURE(status))
                        return -ENODEV;
        }
+        down(&ec->sem);
-        WARN_ON(in_interrupt());
+        status = acpi_ec_wait(ec, ACPI_EC_EVENT_IBF_0);
-        down(&ec->intr.sem);
-        status = acpi_ec_wait(ec, ACPI_EC_EVENT_IBE);
        if (status) {
                printk(KERN_DEBUG PREFIX "read EC, IB not empty\n");
                goto end;
        }
-        acpi_hw_low_level_write(8, ACPI_EC_COMMAND_READ,
-                                &ec->common.command_addr);
-        status = acpi_ec_wait(ec, ACPI_EC_EVENT_IBE);
-        if (status) {
-                printk(KERN_DEBUG PREFIX "read EC, IB not empty\n");
-        }
-        acpi_hw_low_level_write(8, address, &ec->common.data_addr);
+        status = acpi_ec_transaction_unlocked(ec, command,
-        status = acpi_ec_wait(ec, ACPI_EC_EVENT_OBF);
+                                              wdata, wdata_len,
-        if (status) {
+                                              rdata, rdata_len);
-                printk(KERN_DEBUG PREFIX "read EC, OB not full\n");
-                goto end;
-        }
-        acpi_hw_low_level_read(8, data, &ec->common.data_addr);
-        ACPI_DEBUG_PRINT((ACPI_DB_INFO, "Read [%02x] from address [%02x]\n",
-                          *data, address));
-      end:
+end:
-        up(&ec->intr.sem);
+        up(&ec->sem);
-        if (ec->common.global_lock)
+        if (ec->global_lock)
                acpi_release_global_lock(glk);
        return status;
 }
-static int acpi_ec_intr_write(union acpi_ec *ec, u8 address, u8 data)
+static int acpi_ec_read(struct acpi_ec *ec, u8 address, u8 *data)
 {
-        int status = 0;
+        int result;
-        u32 glk;
+        u8 d;
-        if (!ec)
-                return -EINVAL;
-        if (ec->common.global_lock) {
-                status = acpi_acquire_global_lock(ACPI_EC_UDELAY_GLK, &glk);
-                if (ACPI_FAILURE(status))
-                        return -ENODEV;
-        }
-        WARN_ON(in_interrupt());
-        down(&ec->intr.sem);
-        status = acpi_ec_wait(ec, ACPI_EC_EVENT_IBE);
-        if (status) {
-                printk(KERN_DEBUG PREFIX "write EC, IB not empty\n");
-        }
-        acpi_hw_low_level_write(8, ACPI_EC_COMMAND_WRITE,
-                                &ec->common.command_addr);
-        status = acpi_ec_wait(ec, ACPI_EC_EVENT_IBE);
-        if (status) {
-                printk(KERN_DEBUG PREFIX "write EC, IB not empty\n");
-        }
-        acpi_hw_low_level_write(8, address, &ec->common.data_addr);
-        status = acpi_ec_wait(ec, ACPI_EC_EVENT_IBE);
-        if (status) {
-                printk(KERN_DEBUG PREFIX "write EC, IB not empty\n");
-        }
-        acpi_hw_low_level_write(8, data, &ec->common.data_addr);
-        ACPI_DEBUG_PRINT((ACPI_DB_INFO, "Wrote [%02x] to address [%02x]\n",
+        result = acpi_ec_transaction(ec, ACPI_EC_COMMAND_READ,
-                          data, address));
+                                     &address, 1, &d, 1);
+        *data = d;
-        up(&ec->intr.sem);
+        return result;
+}
-        if (ec->common.global_lock)
-                acpi_release_global_lock(glk);
-        return status;
+static int acpi_ec_write(struct acpi_ec *ec, u8 address, u8 data)
+{
+        u8 wdata[2] = { address, data };
+        return acpi_ec_transaction(ec, ACPI_EC_COMMAND_WRITE,
+                                   wdata, 2, NULL, 0);
 }
 /*
 * Externally callable EC access functions. For now, assume 1 EC only
 */
-int ec_read(u8 addr, u8 * val)
+int ec_read(u8 addr, u8 *val)
 {
-        union acpi_ec *ec;
+        struct acpi_ec *ec;
        int err;
-        u32 temp_data;
+        u8 temp_data;
        if (!first_ec)
                return -ENODEV;
@@ -539,7 +354,7 @@ EXPORT_SYMBOL(ec_read);
 int ec_write(u8 addr, u8 val)
 {
-        union acpi_ec *ec;
+        struct acpi_ec *ec;
        int err;
        if (!first_ec)
@@ -554,255 +369,106 @@ int ec_write(u8 addr, u8 val)
 EXPORT_SYMBOL(ec_write);
-static int acpi_ec_query(union acpi_ec *ec, u32 * data)
+extern int ec_transaction(u8 command,
-{
+                          const u8 *wdata, unsigned wdata_len,
-        if (acpi_ec_poll_mode)
+                          u8 *rdata, unsigned rdata_len)
-                return acpi_ec_poll_query(ec, data);
-        else
-                return acpi_ec_intr_query(ec, data);
-}
-static int acpi_ec_poll_query(union acpi_ec *ec, u32 * data)
 {
-        int result = 0;
+        struct acpi_ec *ec;
-        acpi_status status = AE_OK;
-        u32 glk = 0;
-        if (!ec || !data)
-                return -EINVAL;
-        *data = 0;
-        if (ec->common.global_lock) {
-                status = acpi_acquire_global_lock(ACPI_EC_UDELAY_GLK, &glk);
-                if (ACPI_FAILURE(status))
-                        return -ENODEV;
-        }
-        /*
+        if (!first_ec)
-         * Query the EC to find out which _Qxx method we need to evaluate.
+                return -ENODEV;
-         * Note that successful completion of the query causes the ACPI_EC_SCI
-         * bit to be cleared (and thus clearing the interrupt source).
-         */
-        if (down_interruptible(&ec->poll.sem)) {
-                result = -ERESTARTSYS;
-                goto end_nosem;
-        }
-        
-        acpi_hw_low_level_write(8, ACPI_EC_COMMAND_QUERY,
-                                &ec->common.command_addr);
-        result = acpi_ec_wait(ec, ACPI_EC_EVENT_OBF);
-        if (result)
-                goto end;
-        acpi_hw_low_level_read(8, data, &ec->common.data_addr);
-        if (!*data)
-                result = -ENODATA;
-      end:
+        ec = acpi_driver_data(first_ec);
-        up(&ec->poll.sem);
-end_nosem:
-        if (ec->common.global_lock)
-                acpi_release_global_lock(glk);
-        return result;
+        return acpi_ec_transaction(ec, command, wdata,
+                                   wdata_len, rdata, rdata_len);
 }
-static int acpi_ec_intr_query(union acpi_ec *ec, u32 * data)
-{
-        int status = 0;
-        u32 glk;
-        if (!ec || !data)
+EXPORT_SYMBOL(ec_transaction);
-                return -EINVAL;
-        *data = 0;
-        if (ec->common.global_lock) {
-                status = acpi_acquire_global_lock(ACPI_EC_UDELAY_GLK, &glk);
-                if (ACPI_FAILURE(status))
-                        return -ENODEV;
-        }
-        down(&ec->intr.sem);
+static int acpi_ec_query(struct acpi_ec *ec, u8 *data)
+{
+        int result;
+        u8 d;
-        status = acpi_ec_wait(ec, ACPI_EC_EVENT_IBE);
+        if (!ec || !data)
-        if (status) {
+                return -EINVAL;
-                printk(KERN_DEBUG PREFIX "query EC, IB not empty\n");
-                goto end;
-        }
-        /*
-         * Query the EC to find out which _Qxx method we need to evaluate.
-         * Note that successful completion of the query causes the ACPI_EC_SCI
-         * bit to be cleared (and thus clearing the interrupt source).
-         */
-        acpi_hw_low_level_write(8, ACPI_EC_COMMAND_QUERY,
-                                &ec->common.command_addr);
-        status = acpi_ec_wait(ec, ACPI_EC_EVENT_OBF);
-        if (status) {
-                printk(KERN_DEBUG PREFIX "query EC, OB not full\n");
-                goto end;
-        }
-        acpi_hw_low_level_read(8, data, &ec->common.data_addr);
+        /*
-        if (!*data)
+         * Query the EC to find out which _Qxx method we need to evaluate.
-                status = -ENODATA;
+         * Note that successful completion of the query causes the ACPI_EC_SCI
+         * bit to be cleared (and thus clearing the interrupt source).
+         */
-      end:
+        result = acpi_ec_transaction(ec, ACPI_EC_COMMAND_QUERY, NULL, 0, &d, 1);
-        up(&ec->intr.sem);
+        if (result)
+                return result;
-        if (ec->common.global_lock)
+        if (!d)
-                acpi_release_global_lock(glk);
+                return -ENODATA;
-        return status;
+        *data = d;
+        return 0;
 }
 /* --------------------------------------------------------------------------
                                Event Management
   -------------------------------------------------------------------------- */
-union acpi_ec_query_data {
+struct acpi_ec_query_data {
        acpi_handle handle;
        u8 data;
 };
 static void acpi_ec_gpe_query(void *ec_cxt)
 {
-        if (acpi_ec_poll_mode)
+        struct acpi_ec *ec = (struct acpi_ec *)ec_cxt;
-                acpi_ec_gpe_poll_query(ec_cxt);
+        u8 value = 0;
-        else
+        static char object_name[8];
-                acpi_ec_gpe_intr_query(ec_cxt);
-}
-static void acpi_ec_gpe_poll_query(void *ec_cxt)
-{
-        union acpi_ec *ec = (union acpi_ec *)ec_cxt;
-        u32 value = 0;
-        static char object_name[5] = { '_', 'Q', '0', '0', '\0' };
-        const char hex[] = { '0', '1', '2', '3', '4', '5', '6', '7',
-                '8', '9', 'A', 'B', 'C', 'D', 'E', 'F'
-        };
-        if (!ec_cxt)
+        if (!ec)
                goto end;
-        if (down_interruptible (&ec->poll.sem)) {
+        value = acpi_ec_read_status(ec);
-                return;
-        }
-        acpi_hw_low_level_read(8, &value, &ec->common.command_addr);
-        up(&ec->poll.sem);
-        /* TBD: Implement asynch events!
-         * NOTE: All we care about are EC-SCI's.  Other EC events are
-         * handled via polling (yuck!).  This is because some systems
-         * treat EC-SCIs as level (versus EDGE!) triggered, preventing
-         *  a purely interrupt-driven approach (grumble, grumble).
-         */
        if (!(value & ACPI_EC_FLAG_SCI))
                goto end;
        if (acpi_ec_query(ec, &value))
                goto end;
-        object_name[2] = hex[((value >> 4) & 0x0F)];
+        snprintf(object_name, 8, "_Q%2.2X", value);
-        object_name[3] = hex[(value & 0x0F)];
-        ACPI_DEBUG_PRINT((ACPI_DB_INFO, "Evaluating %s\n", object_name));
-        acpi_evaluate_object(ec->common.handle, object_name, NULL, NULL);
+        ACPI_DEBUG_PRINT((ACPI_DB_INFO, "Evaluating %s", object_name));
-      end:
+        acpi_evaluate_object(ec->handle, object_name, NULL, NULL);
-        acpi_enable_gpe(NULL, ec->common.gpe_bit, ACPI_NOT_ISR);
-}
-static void acpi_ec_gpe_intr_query(void *ec_cxt)
-{
-        union acpi_ec *ec = (union acpi_ec *)ec_cxt;
-        u32 value;
-        int result = -ENODATA;
-        static char object_name[5] = { '_', 'Q', '0', '0', '\0' };
-        const char hex[] = { '0', '1', '2', '3', '4', '5', '6', '7',
-                '8', '9', 'A', 'B', 'C', 'D', 'E', 'F'
-        };
-        if (acpi_ec_read_status(ec) & ACPI_EC_FLAG_SCI)
-                result = acpi_ec_query(ec, &value);
-        if (result)
-                goto end;
-        object_name[2] = hex[((value >> 4) & 0x0F)];
-        object_name[3] = hex[(value & 0x0F)];
-        ACPI_DEBUG_PRINT((ACPI_DB_INFO, "Evaluating %s\n", object_name));
-        acpi_evaluate_object(ec->common.handle, object_name, NULL, NULL);
      end:
-        atomic_dec(&ec->intr.pending_gpe);
+        acpi_enable_gpe(NULL, ec->gpe_bit, ACPI_NOT_ISR);
-        return;
 }
 static u32 acpi_ec_gpe_handler(void *data)
 {
-        if (acpi_ec_poll_mode)
-                return acpi_ec_gpe_poll_handler(data);
-        else
-                return acpi_ec_gpe_intr_handler(data);
-}
-static u32 acpi_ec_gpe_poll_handler(void *data)
-{
        acpi_status status = AE_OK;
-        union acpi_ec *ec = (union acpi_ec *)data;
+        u8 value;
+        struct acpi_ec *ec = (struct acpi_ec *)data;
-        if (!ec)
-                return ACPI_INTERRUPT_NOT_HANDLED;
-        acpi_disable_gpe(NULL, ec->common.gpe_bit, ACPI_ISR);
-        status = acpi_os_execute(OSL_EC_POLL_HANDLER, acpi_ec_gpe_query, ec);
-        if (status == AE_OK)
-                return ACPI_INTERRUPT_HANDLED;
-        else
-                return ACPI_INTERRUPT_NOT_HANDLED;
-}
-static u32 acpi_ec_gpe_intr_handler(void *data)
-{
-        acpi_status status = AE_OK;
-        u32 value;
-        union acpi_ec *ec = (union acpi_ec *)data;
-        if (!ec)
-                return ACPI_INTERRUPT_NOT_HANDLED;
-        acpi_clear_gpe(NULL, ec->common.gpe_bit, ACPI_ISR);
+        acpi_clear_gpe(NULL, ec->gpe_bit, ACPI_ISR);
        value = acpi_ec_read_status(ec);
-        switch (ec->intr.expect_event) {
+        if (acpi_ec_mode == EC_INTR) {
-        case ACPI_EC_EVENT_OBF:
+                if (acpi_ec_check_status(value, ec->expect_event)) {
-                if (!(value & ACPI_EC_FLAG_OBF))
+                        ec->expect_event = 0;
-                        break;
+                        wake_up(&ec->wait);
-                ec->intr.expect_event = 0;
+                }
-                wake_up(&ec->intr.wait);
-                break;
-        case ACPI_EC_EVENT_IBE:
-                if ((value & ACPI_EC_FLAG_IBF))
-                        break;
-                ec->intr.expect_event = 0;
-                wake_up(&ec->intr.wait);
-                break;
-        default:
-                break;
        }
        if (value & ACPI_EC_FLAG_SCI) {
-                atomic_add(1, &ec->intr.pending_gpe);
+                status = acpi_os_execute(OSL_EC_BURST_HANDLER, acpi_ec_gpe_query, ec);
-                status = acpi_os_execute(OSL_EC_BURST_HANDLER,
-                                                     acpi_ec_gpe_query, ec);
                return status == AE_OK ?
                    ACPI_INTERRUPT_HANDLED : ACPI_INTERRUPT_NOT_HANDLED;
        }
-        acpi_enable_gpe(NULL, ec->common.gpe_bit, ACPI_ISR);
+        acpi_enable_gpe(NULL, ec->gpe_bit, ACPI_ISR);
        return status == AE_OK ?
            ACPI_INTERRUPT_HANDLED : ACPI_INTERRUPT_NOT_HANDLED;
 }
@@ -833,7 +499,7 @@ acpi_ec_space_handler(u32 function,
                      void *handler_context, void *region_context)
 {
        int result = 0;
-        union acpi_ec *ec = NULL;
+        struct acpi_ec *ec = NULL;
        u64 temp = *value;
        acpi_integer f_v = 0;
        int i = 0;
@@ -843,18 +509,16 @@ acpi_ec_space_handler(u32 function,
                return AE_BAD_PARAMETER;
        if (bit_width != 8 && acpi_strict) {
-                printk(KERN_WARNING PREFIX
-                       "acpi_ec_space_handler: bit_width should be 8\n");
                return AE_BAD_PARAMETER;
        }
-        ec = (union acpi_ec *)handler_context;
+        ec = (struct acpi_ec *)handler_context;
      next_byte:
        switch (function) {
        case ACPI_READ:
                temp = 0;
-                result = acpi_ec_read(ec, (u8) address, (u32 *) & temp);
+                result = acpi_ec_read(ec, (u8) address, (u8 *) &temp);
                break;
        case ACPI_WRITE:
                result = acpi_ec_write(ec, (u8) address, (u8) temp);
@@ -905,20 +569,20 @@ static struct proc_dir_entry *acpi_ec_dir;
 static int acpi_ec_read_info(struct seq_file *seq, void *offset)
 {
-        union acpi_ec *ec = (union acpi_ec *)seq->private;
+        struct acpi_ec *ec = (struct acpi_ec *)seq->private;
        if (!ec)
                goto end;
        seq_printf(seq, "gpe bit:                 0x%02x\n",
-                   (u32) ec->common.gpe_bit);
+                   (u32) ec->gpe_bit);
        seq_printf(seq, "ports:                   0x%02x, 0x%02x\n",
-                   (u32) ec->common.status_addr.address,
+                   (u32) ec->command_addr,
-                   (u32) ec->common.data_addr.address);
+                   (u32) ec->data_addr);
        seq_printf(seq, "use global lock:         %s\n",
-                   ec->common.global_lock ? "yes" : "no");
+                   ec->global_lock ? "yes" : "no");
-        acpi_enable_gpe(NULL, ec->common.gpe_bit, ACPI_NOT_ISR);
+        acpi_enable_gpe(NULL, ec->gpe_bit, ACPI_NOT_ISR);
      end:
        return 0;
@@ -929,7 +593,7 @@ static int acpi_ec_info_open_fs(struct inode *inode, struct file *file)
        return single_open(file, acpi_ec_read_info, PDE(inode)->data);
 }
-static const struct file_operations acpi_ec_info_ops = {
+static struct file_operations acpi_ec_info_ops = {
        .open = acpi_ec_info_open_fs,
        .read = seq_read,
        .llseek = seq_lseek,
@@ -978,101 +642,35 @@ static int acpi_ec_remove_fs(struct acpi_device *device)
                               Driver Interface
   -------------------------------------------------------------------------- */
-static int acpi_ec_poll_add(struct acpi_device *device)
+static int acpi_ec_add(struct acpi_device *device)
 {
        int result = 0;
        acpi_status status = AE_OK;
-        union acpi_ec *ec = NULL;
+        struct acpi_ec *ec = NULL;
        if (!device)
                return -EINVAL;
-        ec = kmalloc(sizeof(union acpi_ec), GFP_KERNEL);
+        ec = kmalloc(sizeof(struct acpi_ec), GFP_KERNEL);
        if (!ec)
                return -ENOMEM;
-        memset(ec, 0, sizeof(union acpi_ec));
+        memset(ec, 0, sizeof(struct acpi_ec));
-        ec->common.handle = device->handle;
+        ec->handle = device->handle;
-        ec->common.uid = -1;
+        ec->uid = -1;
-        init_MUTEX(&ec->poll.sem);
+        init_MUTEX(&ec->sem);
-        strcpy(acpi_device_name(device), ACPI_EC_DEVICE_NAME);
+        if (acpi_ec_mode == EC_INTR) {
-        strcpy(acpi_device_class(device), ACPI_EC_CLASS);
+                atomic_set(&ec->leaving_burst, 1);
-        acpi_driver_data(device) = ec;
+                init_waitqueue_head(&ec->wait);
-        /* Use the global lock for all EC transactions? */
-        acpi_evaluate_integer(ec->common.handle, "_GLK", NULL,
-                              &ec->common.global_lock);
-        /* XXX we don't test uids, because on some boxes ecdt uid = 0, see:
-           http://bugzilla.kernel.org/show_bug.cgi?id=6111 */
-        if (ec_ecdt) {
-                acpi_remove_address_space_handler(ACPI_ROOT_OBJECT,
-                                                  ACPI_ADR_SPACE_EC,
-                                                  &acpi_ec_space_handler);
-                acpi_remove_gpe_handler(NULL, ec_ecdt->common.gpe_bit,
-                                        &acpi_ec_gpe_handler);
-                kfree(ec_ecdt);
        }
-        /* Get GPE bit assignment (EC events). */
-        /* TODO: Add support for _GPE returning a package */
-        status =
-            acpi_evaluate_integer(ec->common.handle, "_GPE", NULL,
-                                  &ec->common.gpe_bit);
-        if (ACPI_FAILURE(status)) {
-                ACPI_EXCEPTION((AE_INFO, status, "Obtaining GPE bit"));
-                result = -ENODEV;
-                goto end;
-        }
-        result = acpi_ec_add_fs(device);
-        if (result)
-                goto end;
-        printk(KERN_INFO PREFIX "%s [%s] (gpe %d) polling mode.\n",
-               acpi_device_name(device), acpi_device_bid(device),
-               (u32) ec->common.gpe_bit);
-        if (!first_ec)
-                first_ec = device;
-      end:
-        if (result)
-                kfree(ec);
-        return result;
-}
-static int acpi_ec_intr_add(struct acpi_device *device)
-{
-        int result = 0;
-        acpi_status status = AE_OK;
-        union acpi_ec *ec = NULL;
-        if (!device)
-                return -EINVAL;
-        ec = kmalloc(sizeof(union acpi_ec), GFP_KERNEL);
-        if (!ec)
-                return -ENOMEM;
-        memset(ec, 0, sizeof(union acpi_ec));
-        ec->common.handle = device->handle;
-        ec->common.uid = -1;
-        atomic_set(&ec->intr.pending_gpe, 0);
-        atomic_set(&ec->intr.leaving_burst, 1);
-        init_MUTEX(&ec->intr.sem);
-        init_waitqueue_head(&ec->intr.wait);
        strcpy(acpi_device_name(device), ACPI_EC_DEVICE_NAME);
        strcpy(acpi_device_class(device), ACPI_EC_CLASS);
        acpi_driver_data(device) = ec;
        /* Use the global lock for all EC transactions? */
-        acpi_evaluate_integer(ec->common.handle, "_GLK", NULL,
+        acpi_evaluate_integer(ec->handle, "_GLK", NULL,
-                              &ec->common.global_lock);
+                              &ec->global_lock);
        /* XXX we don't test uids, because on some boxes ecdt uid = 0, see:
           http://bugzilla.kernel.org/show_bug.cgi?id=6111 */
@@ -1081,7 +679,7 @@ static int acpi_ec_intr_add(struct acpi_device *device)
                                                  ACPI_ADR_SPACE_EC,
                                                  &acpi_ec_space_handler);
-                acpi_remove_gpe_handler(NULL, ec_ecdt->common.gpe_bit,
+                acpi_remove_gpe_handler(NULL, ec_ecdt->gpe_bit,
                                        &acpi_ec_gpe_handler);
                kfree(ec_ecdt);
@@ -1090,10 +688,10 @@ static int acpi_ec_intr_add(struct acpi_device *device)
        /* Get GPE bit assignment (EC events). */
        /* TODO: Add support for _GPE returning a package */
        status =
-            acpi_evaluate_integer(ec->common.handle, "_GPE", NULL,
+            acpi_evaluate_integer(ec->handle, "_GPE", NULL,
-                                  &ec->common.gpe_bit);
+                                  &ec->gpe_bit);
        if (ACPI_FAILURE(status)) {
-                printk(KERN_ERR PREFIX "Obtaining GPE bit assignment\n");
+                ACPI_EXCEPTION((AE_INFO, status, "Obtaining GPE bit assignment"));
                result = -ENODEV;
                goto end;
        }
@@ -1102,14 +700,14 @@ static int acpi_ec_intr_add(struct acpi_device *device)
        if (result)
                goto end;
-        printk(KERN_INFO PREFIX "%s [%s] (gpe %d) interrupt mode.\n",
+        ACPI_DEBUG_PRINT((ACPI_DB_INFO, "%s [%s] (gpe %d) interrupt mode.",
               acpi_device_name(device), acpi_device_bid(device),
-               (u32) ec->common.gpe_bit);
+               (u32) ec->gpe_bit));
        if (!first_ec)
                first_ec = device;
-      end:
+  end:
        if (result)
                kfree(ec);
@@ -1118,7 +716,7 @@ static int acpi_ec_intr_add(struct acpi_device *device)
 static int acpi_ec_remove(struct acpi_device *device, int type)
 {
-        union acpi_ec *ec = NULL;
+        struct acpi_ec *ec = NULL;
        if (!device)
@@ -1136,8 +734,7 @@ static int acpi_ec_remove(struct acpi_device *device, int type)
 static acpi_status
 acpi_ec_io_ports(struct acpi_resource *resource, void *context)
 {
-        union acpi_ec *ec = (union acpi_ec *)context;
+        struct acpi_ec *ec = (struct acpi_ec *)context;
-        struct acpi_generic_address *addr;
        if (resource->type != ACPI_RESOURCE_TYPE_IO) {
                return AE_OK;
@@ -1148,26 +745,21 @@ acpi_ec_io_ports(struct acpi_resource *resource, void *context)
         * the second address region returned is the status/command
         * port.
         */
-        if (ec->common.data_addr.register_bit_width == 0) {
+        if (ec->data_addr == 0) {
-                addr = &ec->common.data_addr;
+                ec->data_addr = resource->data.io.minimum;
-        } else if (ec->common.command_addr.register_bit_width == 0) {
+        } else if (ec->command_addr == 0) {
-                addr = &ec->common.command_addr;
+                ec->command_addr = resource->data.io.minimum;
        } else {
                return AE_CTRL_TERMINATE;
        }
-        addr->address_space_id = ACPI_ADR_SPACE_SYSTEM_IO;
-        addr->register_bit_width = 8;
-        addr->register_bit_offset = 0;
-        addr->address = resource->data.io.minimum;
        return AE_OK;
 }
 static int acpi_ec_start(struct acpi_device *device)
 {
        acpi_status status = AE_OK;
-        union acpi_ec *ec = NULL;
+        struct acpi_ec *ec = NULL;
        if (!device)
@@ -1181,39 +773,35 @@ static int acpi_ec_start(struct acpi_device *device)
        /*
         * Get I/O port addresses. Convert to GAS format.
         */
-        status = acpi_walk_resources(ec->common.handle, METHOD_NAME__CRS,
+        status = acpi_walk_resources(ec->handle, METHOD_NAME__CRS,
                                     acpi_ec_io_ports, ec);
-        if (ACPI_FAILURE(status)
+        if (ACPI_FAILURE(status) || ec->command_addr == 0) {
-            || ec->common.command_addr.register_bit_width == 0) {
+                ACPI_EXCEPTION((AE_INFO, status,
-                printk(KERN_ERR PREFIX "Error getting I/O port addresses\n");
+                                "Error getting I/O port addresses"));
                return -ENODEV;
        }
-        ec->common.status_addr = ec->common.command_addr;
+        ACPI_DEBUG_PRINT((ACPI_DB_INFO, "gpe=0x%02lx, ports=0x%2lx,0x%2lx",
+                          ec->gpe_bit, ec->command_addr, ec->data_addr));
-        ACPI_DEBUG_PRINT((ACPI_DB_INFO, "gpe=0x%02x, ports=0x%2x,0x%2x\n",
-                          (u32) ec->common.gpe_bit,
-                          (u32) ec->common.command_addr.address,
-                          (u32) ec->common.data_addr.address));
        /*
         * Install GPE handler
         */
-        status = acpi_install_gpe_handler(NULL, ec->common.gpe_bit,
+        status = acpi_install_gpe_handler(NULL, ec->gpe_bit,
                                          ACPI_GPE_EDGE_TRIGGERED,
                                          &acpi_ec_gpe_handler, ec);
        if (ACPI_FAILURE(status)) {
                return -ENODEV;
        }
-        acpi_set_gpe_type(NULL, ec->common.gpe_bit, ACPI_GPE_TYPE_RUNTIME);
+        acpi_set_gpe_type(NULL, ec->gpe_bit, ACPI_GPE_TYPE_RUNTIME);
-        acpi_enable_gpe(NULL, ec->common.gpe_bit, ACPI_NOT_ISR);
+        acpi_enable_gpe(NULL, ec->gpe_bit, ACPI_NOT_ISR);
-        status = acpi_install_address_space_handler(ec->common.handle,
+        status = acpi_install_address_space_handler(ec->handle,
                                                    ACPI_ADR_SPACE_EC,
                                                    &acpi_ec_space_handler,
                                                    &acpi_ec_space_setup, ec);
        if (ACPI_FAILURE(status)) {
-                acpi_remove_gpe_handler(NULL, ec->common.gpe_bit,
+                acpi_remove_gpe_handler(NULL, ec->gpe_bit,
                                        &acpi_ec_gpe_handler);
                return -ENODEV;
        }
@@ -1224,7 +812,7 @@ static int acpi_ec_start(struct acpi_device *device)
 static int acpi_ec_stop(struct acpi_device *device, int type)
 {
        acpi_status status = AE_OK;
-        union acpi_ec *ec = NULL;
+        struct acpi_ec *ec = NULL;
        if (!device)
@@ -1232,14 +820,14 @@ static int acpi_ec_stop(struct acpi_device *device, int type)
        ec = acpi_driver_data(device);
-        status = acpi_remove_address_space_handler(ec->common.handle,
+        status = acpi_remove_address_space_handler(ec->handle,
                                                   ACPI_ADR_SPACE_EC,
                                                   &acpi_ec_space_handler);
        if (ACPI_FAILURE(status))
                return -ENODEV;
        status =
-            acpi_remove_gpe_handler(NULL, ec->common.gpe_bit,
+            acpi_remove_gpe_handler(NULL, ec->gpe_bit,
                                    &acpi_ec_gpe_handler);
        if (ACPI_FAILURE(status))
                return -ENODEV;
@@ -1251,76 +839,30 @@ static acpi_status __init
 acpi_fake_ecdt_callback(acpi_handle handle,
                        u32 Level, void *context, void **retval)
 {
-        if (acpi_ec_poll_mode)
-                return acpi_fake_ecdt_poll_callback(handle,
-                                                       Level, context, retval);
-        else
-                return acpi_fake_ecdt_intr_callback(handle,
-                                                     Level, context, retval);
-}
-static acpi_status __init
-acpi_fake_ecdt_poll_callback(acpi_handle handle,
-                                u32 Level, void *context, void **retval)
-{
-        acpi_status status;
-        status = acpi_walk_resources(handle, METHOD_NAME__CRS,
-                                     acpi_ec_io_ports, ec_ecdt);
-        if (ACPI_FAILURE(status))
-                return status;
-        ec_ecdt->common.status_addr = ec_ecdt->common.command_addr;
-        ec_ecdt->common.uid = -1;
-        acpi_evaluate_integer(handle, "_UID", NULL, &ec_ecdt->common.uid);
-        status =
-            acpi_evaluate_integer(handle, "_GPE", NULL,
-                                  &ec_ecdt->common.gpe_bit);
-        if (ACPI_FAILURE(status))
-                return status;
-        init_MUTEX(&ec_ecdt->poll.sem);
-        ec_ecdt->common.global_lock = TRUE;
-        ec_ecdt->common.handle = handle;
-        printk(KERN_INFO PREFIX "GPE=0x%02x, ports=0x%2x, 0x%2x\n",
-               (u32) ec_ecdt->common.gpe_bit,
-               (u32) ec_ecdt->common.command_addr.address,
-               (u32) ec_ecdt->common.data_addr.address);
-        return AE_CTRL_TERMINATE;
-}
-static acpi_status __init
-acpi_fake_ecdt_intr_callback(acpi_handle handle,
-                              u32 Level, void *context, void **retval)
-{
        acpi_status status;
-        init_MUTEX(&ec_ecdt->intr.sem);
+        init_MUTEX(&ec_ecdt->sem);
-        init_waitqueue_head(&ec_ecdt->intr.wait);
+        if (acpi_ec_mode == EC_INTR) {
+                init_waitqueue_head(&ec_ecdt->wait);
+        }
        status = acpi_walk_resources(handle, METHOD_NAME__CRS,
                                     acpi_ec_io_ports, ec_ecdt);
        if (ACPI_FAILURE(status))
                return status;
-        ec_ecdt->common.status_addr = ec_ecdt->common.command_addr;
-        ec_ecdt->common.uid = -1;
+        ec_ecdt->uid = -1;
-        acpi_evaluate_integer(handle, "_UID", NULL, &ec_ecdt->common.uid);
+        acpi_evaluate_integer(handle, "_UID", NULL, &ec_ecdt->uid);
        status =
            acpi_evaluate_integer(handle, "_GPE", NULL,
-                                  &ec_ecdt->common.gpe_bit);
+                                  &ec_ecdt->gpe_bit);
        if (ACPI_FAILURE(status))
                return status;
-        ec_ecdt->common.global_lock = TRUE;
+        ec_ecdt->global_lock = TRUE;
-        ec_ecdt->common.handle = handle;
+        ec_ecdt->handle = handle;
-        printk(KERN_INFO PREFIX "GPE=0x%02x, ports=0x%2x, 0x%2x\n",
+        ACPI_DEBUG_PRINT((ACPI_DB_INFO, "GPE=0x%02lx, ports=0x%2lx, 0x%2lx",
-               (u32) ec_ecdt->common.gpe_bit,
+               ec_ecdt->gpe_bit, ec_ecdt->command_addr, ec_ecdt->data_addr));
-               (u32) ec_ecdt->common.command_addr.address,
-               (u32) ec_ecdt->common.data_addr.address);
        return AE_CTRL_TERMINATE;
 }
@@ -1340,14 +882,14 @@ static int __init acpi_ec_fake_ecdt(void)
        acpi_status status;
        int ret = 0;
-        printk(KERN_INFO PREFIX "Try to make an fake ECDT\n");
+        ACPI_DEBUG_PRINT((ACPI_DB_INFO, "Try to make an fake ECDT"));
-        ec_ecdt = kmalloc(sizeof(union acpi_ec), GFP_KERNEL);
+        ec_ecdt = kmalloc(sizeof(struct acpi_ec), GFP_KERNEL);
        if (!ec_ecdt) {
                ret = -ENOMEM;
                goto error;
        }
-        memset(ec_ecdt, 0, sizeof(union acpi_ec));
+        memset(ec_ecdt, 0, sizeof(struct acpi_ec));
        status = acpi_get_devices(ACPI_EC_HID,
                                  acpi_fake_ecdt_callback, NULL, NULL);
@@ -1355,24 +897,16 @@ static int __init acpi_ec_fake_ecdt(void)
                kfree(ec_ecdt);
                ec_ecdt = NULL;
                ret = -ENODEV;
+                ACPI_EXCEPTION((AE_INFO, status, "Can't make an fake ECDT"));
                goto error;
        }
        return 0;
-      error:
+  error:
-        printk(KERN_ERR PREFIX "Can't make an fake ECDT\n");
        return ret;
 }
 static int __init acpi_ec_get_real_ecdt(void)
 {
-        if (acpi_ec_poll_mode)
-                return acpi_ec_poll_get_real_ecdt();
-        else
-                return acpi_ec_intr_get_real_ecdt();
-}
-static int __init acpi_ec_poll_get_real_ecdt(void)
-{
        acpi_status status;
        struct acpi_table_ecdt *ecdt_ptr;
@@ -1382,80 +916,36 @@ static int __init acpi_ec_poll_get_real_ecdt(void)
        if (ACPI_FAILURE(status))
                return -ENODEV;
-        printk(KERN_INFO PREFIX "Found ECDT\n");
+        ACPI_DEBUG_PRINT((ACPI_DB_INFO, "Found ECDT"));
        /*
         * Generate a temporary ec context to use until the namespace is scanned
         */
-        ec_ecdt = kmalloc(sizeof(union acpi_ec), GFP_KERNEL);
+        ec_ecdt = kmalloc(sizeof(struct acpi_ec), GFP_KERNEL);
        if (!ec_ecdt)
                return -ENOMEM;
-        memset(ec_ecdt, 0, sizeof(union acpi_ec));
+        memset(ec_ecdt, 0, sizeof(struct acpi_ec));
-        ec_ecdt->common.command_addr = ecdt_ptr->ec_control;
-        ec_ecdt->common.status_addr = ecdt_ptr->ec_control;
-        ec_ecdt->common.data_addr = ecdt_ptr->ec_data;
-        ec_ecdt->common.gpe_bit = ecdt_ptr->gpe_bit;
-        init_MUTEX(&ec_ecdt->poll.sem);
-        /* use the GL just to be safe */
-        ec_ecdt->common.global_lock = TRUE;
-        ec_ecdt->common.uid = ecdt_ptr->uid;
-        status =
+        init_MUTEX(&ec_ecdt->sem);
-            acpi_get_handle(NULL, ecdt_ptr->ec_id, &ec_ecdt->common.handle);
+        if (acpi_ec_mode == EC_INTR) {
-        if (ACPI_FAILURE(status)) {
+                init_waitqueue_head(&ec_ecdt->wait);
-                goto error;
        }
+        ec_ecdt->command_addr = ecdt_ptr->ec_control.address;
-        return 0;
+        ec_ecdt->data_addr = ecdt_ptr->ec_data.address;
-      error:
+        ec_ecdt->gpe_bit = ecdt_ptr->gpe_bit;
-        printk(KERN_ERR PREFIX "Could not use ECDT\n");
-        kfree(ec_ecdt);
-        ec_ecdt = NULL;
-        return -ENODEV;
-}
-static int __init acpi_ec_intr_get_real_ecdt(void)
-{
-        acpi_status status;
-        struct acpi_table_ecdt *ecdt_ptr;
-        status = acpi_get_firmware_table("ECDT", 1, ACPI_LOGICAL_ADDRESSING,
-                                         (struct acpi_table_header **)
-                                         &ecdt_ptr);
-        if (ACPI_FAILURE(status))
-                return -ENODEV;
-        printk(KERN_INFO PREFIX "Found ECDT\n");
-        /*
-         * Generate a temporary ec context to use until the namespace is scanned
-         */
-        ec_ecdt = kmalloc(sizeof(union acpi_ec), GFP_KERNEL);
-        if (!ec_ecdt)
-                return -ENOMEM;
-        memset(ec_ecdt, 0, sizeof(union acpi_ec));
-        init_MUTEX(&ec_ecdt->intr.sem);
-        init_waitqueue_head(&ec_ecdt->intr.wait);
-        ec_ecdt->common.command_addr = ecdt_ptr->ec_control;
-        ec_ecdt->common.status_addr = ecdt_ptr->ec_control;
-        ec_ecdt->common.data_addr = ecdt_ptr->ec_data;
-        ec_ecdt->common.gpe_bit = ecdt_ptr->gpe_bit;
        /* use the GL just to be safe */
-        ec_ecdt->common.global_lock = TRUE;
+        ec_ecdt->global_lock = TRUE;
-        ec_ecdt->common.uid = ecdt_ptr->uid;
+        ec_ecdt->uid = ecdt_ptr->uid;
        status =
-            acpi_get_handle(NULL, ecdt_ptr->ec_id, &ec_ecdt->common.handle);
+            acpi_get_handle(NULL, ecdt_ptr->ec_id, &ec_ecdt->handle);
        if (ACPI_FAILURE(status)) {
                goto error;
        }
        return 0;
-      error:
+  error:
-        printk(KERN_ERR PREFIX "Could not use ECDT\n");
+        ACPI_EXCEPTION((AE_INFO, status, "Could not use ECDT"));
        kfree(ec_ecdt);
        ec_ecdt = NULL;
@@ -1480,14 +970,14 @@ int __init acpi_ec_ecdt_probe(void)
        /*
         * Install GPE handler
         */
-        status = acpi_install_gpe_handler(NULL, ec_ecdt->common.gpe_bit,
+        status = acpi_install_gpe_handler(NULL, ec_ecdt->gpe_bit,
                                          ACPI_GPE_EDGE_TRIGGERED,
                                          &acpi_ec_gpe_handler, ec_ecdt);
        if (ACPI_FAILURE(status)) {
                goto error;
        }
-        acpi_set_gpe_type(NULL, ec_ecdt->common.gpe_bit, ACPI_GPE_TYPE_RUNTIME);
+        acpi_set_gpe_type(NULL, ec_ecdt->gpe_bit, ACPI_GPE_TYPE_RUNTIME);
-        acpi_enable_gpe(NULL, ec_ecdt->common.gpe_bit, ACPI_NOT_ISR);
+        acpi_enable_gpe(NULL, ec_ecdt->gpe_bit, ACPI_NOT_ISR);
        status = acpi_install_address_space_handler(ACPI_ROOT_OBJECT,
                                                    ACPI_ADR_SPACE_EC,
@@ -1495,7 +985,7 @@ int __init acpi_ec_ecdt_probe(void)
                                                    &acpi_ec_space_setup,
                                                    ec_ecdt);
        if (ACPI_FAILURE(status)) {
-                acpi_remove_gpe_handler(NULL, ec_ecdt->common.gpe_bit,
+                acpi_remove_gpe_handler(NULL, ec_ecdt->gpe_bit,
                                        &acpi_ec_gpe_handler);
                goto error;
        }
@@ -1503,7 +993,7 @@ int __init acpi_ec_ecdt_probe(void)
        return 0;
      error:
-        printk(KERN_ERR PREFIX "Could not use ECDT\n");
+        ACPI_EXCEPTION((AE_INFO, status, "Could not use ECDT"));
        kfree(ec_ecdt);
        ec_ecdt = NULL;
@@ -1562,13 +1052,13 @@ static int __init acpi_ec_set_intr_mode(char *str)
                return 0;
        if (intr) {
-                acpi_ec_poll_mode = EC_INTR;
+                acpi_ec_mode = EC_INTR;
-                acpi_ec_driver.ops.add = acpi_ec_intr_add;
        } else {
-                acpi_ec_poll_mode = EC_POLL;
+                acpi_ec_mode = EC_POLL;
-                acpi_ec_driver.ops.add = acpi_ec_poll_add;
        }
-        printk(KERN_INFO PREFIX "EC %s mode.\n", intr ? "interrupt" : "polling");
+        acpi_ec_driver.ops.add = acpi_ec_add;
+        ACPI_DEBUG_PRINT((ACPI_DB_INFO, "EC %s mode.\n", intr ? "interrupt" : "polling"));
        return 1;
 }
diff --git a/drivers/acpi/events/evmisc.c b/drivers/acpi/events/evmisc.c
index 6eef4efddcf6..ee2a10bf9077 100644
--- a/drivers/acpi/events/evmisc.c
+++ b/drivers/acpi/events/evmisc.c
@@ -342,20 +342,8 @@ static u32 acpi_ev_global_lock_handler(void *context)
        if (acquired) {
                /* Got the lock, now wake all threads waiting for it */
                acpi_gbl_global_lock_acquired = TRUE;
+                acpi_ev_global_lock_thread(context);
-                /* Run the Global Lock thread which will signal all waiting threads */
-                status =
-                    acpi_os_execute(OSL_GLOBAL_LOCK_HANDLER,
-                                    acpi_ev_global_lock_thread, context);
-                if (ACPI_FAILURE(status)) {
-                        ACPI_EXCEPTION((AE_INFO, status,
-                                        "Could not queue Global Lock thread"));
-                        return (ACPI_INTERRUPT_NOT_HANDLED);
-                }
        }
        return (ACPI_INTERRUPT_HANDLED);
diff --git a/drivers/acpi/events/evrgnini.c b/drivers/acpi/events/evrgnini.c
index 5b3c7a85eb9a..203d1359190a 100644
--- a/drivers/acpi/events/evrgnini.c
+++ b/drivers/acpi/events/evrgnini.c
@@ -225,13 +225,12 @@ acpi_ev_pci_config_region_setup(acpi_handle handle,
                                if (!
                                    (ACPI_STRNCMP
                                     (object_hID.value, PCI_ROOT_HID_STRING,
-                                      sizeof(PCI_ROOT_HID_STRING))
+                                      sizeof(PCI_ROOT_HID_STRING)))
-                                     ||
+                                    ||
-                                     !(ACPI_STRNCMP
+                                    !(ACPI_STRNCMP
-                                       (object_hID.value,
+                                      (object_hID.value,
-                                        PCI_EXPRESS_ROOT_HID_STRING,
+                                       PCI_EXPRESS_ROOT_HID_STRING,
-                                        sizeof(PCI_EXPRESS_ROOT_HID_STRING)))))
+                                       sizeof(PCI_EXPRESS_ROOT_HID_STRING)))) {
-                                {
                                        /* Install a handler for this PCI root bridge */
diff --git a/drivers/acpi/ibm_acpi.c b/drivers/acpi/ibm_acpi.c
index 15fc12482ba0..003a9876c968 100644
--- a/drivers/acpi/ibm_acpi.c
+++ b/drivers/acpi/ibm_acpi.c
@@ -1702,13 +1702,11 @@ static struct ibm_struct ibms[] = {
         .name = "brightness",
         .read = brightness_read,
         .write = brightness_write,
-         .experimental = 1,
         },
        {
         .name = "volume",
         .read = volume_read,
         .write = volume_write,
-         .experimental = 1,
         },
        {
         .name = "fan",
diff --git a/drivers/acpi/motherboard.c b/drivers/acpi/motherboard.c
index ec6b7f9ede34..2e17ec75af03 100644
--- a/drivers/acpi/motherboard.c
+++ b/drivers/acpi/motherboard.c
@@ -48,6 +48,12 @@ ACPI_MODULE_NAME("acpi_motherboard")
 * the io ports if they really know they can use it, while
 * still preventing hotplug PCI devices from using it.
 */
+/*
+ * When CONFIG_PNP is enabled, pnp/system.c binds to PNP0C01
+ * and PNP0C02, redundant with acpi_reserve_io_ranges().
+ * But acpi_reserve_io_ranges() is necessary for !CONFIG_PNP.
+ */
 static acpi_status acpi_reserve_io_ranges(struct acpi_resource *res, void *data)
 {
        struct resource *requested_res = NULL;
diff --git a/drivers/acpi/osl.c b/drivers/acpi/osl.c
index 068fe4f100b0..c84286cbbe25 100644
--- a/drivers/acpi/osl.c
+++ b/drivers/acpi/osl.c
@@ -73,6 +73,7 @@ static unsigned int acpi_irq_irq;
 static acpi_osd_handler acpi_irq_handler;
 static void *acpi_irq_context;
 static struct workqueue_struct *kacpid_wq;
+static struct workqueue_struct *kacpi_notify_wq;
 acpi_status acpi_os_initialize(void)
 {
@@ -91,8 +92,9 @@ acpi_status acpi_os_initialize1(void)
                return AE_NULL_ENTRY;
        }
        kacpid_wq = create_singlethread_workqueue("kacpid");
+        kacpi_notify_wq = create_singlethread_workqueue("kacpi_notify");
        BUG_ON(!kacpid_wq);
+        BUG_ON(!kacpi_notify_wq);
        return AE_OK;
 }
@@ -104,6 +106,7 @@ acpi_status acpi_os_terminate(void)
        }
        destroy_workqueue(kacpid_wq);
+        destroy_workqueue(kacpi_notify_wq);
        return AE_OK;
 }
@@ -566,10 +569,7 @@ void acpi_os_derive_pci_id(acpi_handle rhandle,	/* upper bound  */
 static void acpi_os_execute_deferred(void *context)
 {
-        struct acpi_os_dpc *dpc = NULL;
+        struct acpi_os_dpc *dpc = (struct acpi_os_dpc *)context;
-        dpc = (struct acpi_os_dpc *)context;
        if (!dpc) {
                printk(KERN_ERR PREFIX "Invalid (NULL) context\n");
                return;
@@ -604,14 +604,12 @@ acpi_status acpi_os_execute(acpi_execute_type type,
        struct acpi_os_dpc *dpc;
        struct work_struct *task;
-        ACPI_FUNCTION_TRACE("os_queue_for_execution");
        ACPI_DEBUG_PRINT((ACPI_DB_EXEC,
                          "Scheduling function [%p(%p)] for deferred execution.\n",
                          function, context));
        if (!function)
-                return_ACPI_STATUS(AE_BAD_PARAMETER);
+                return AE_BAD_PARAMETER;
        /*
         * Allocate/initialize DPC structure.  Note that this memory will be
@@ -624,26 +622,20 @@ acpi_status acpi_os_execute(acpi_execute_type type,
         * from the same memory.
         */
-        dpc =
+        dpc = kmalloc(sizeof(struct acpi_os_dpc) +
-            kmalloc(sizeof(struct acpi_os_dpc) + sizeof(struct work_struct),
+                        sizeof(struct work_struct), GFP_ATOMIC);
-                    GFP_ATOMIC);
        if (!dpc)
-                return_ACPI_STATUS(AE_NO_MEMORY);
+                return AE_NO_MEMORY;
        dpc->function = function;
        dpc->context = context;
        task = (void *)(dpc + 1);
        INIT_WORK(task, acpi_os_execute_deferred, (void *)dpc);
+        if (!queue_work((type == OSL_NOTIFY_HANDLER)?
-        if (!queue_work(kacpid_wq, task)) {
+                        kacpi_notify_wq : kacpid_wq, task)) {
-                ACPI_DEBUG_PRINT((ACPI_DB_ERROR,
-                                  "Call to queue_work() failed.\n"));
-                kfree(dpc);
                status = AE_ERROR;
+                kfree(dpc);
        }
+        return status;
-        return_ACPI_STATUS(status);
 }
 EXPORT_SYMBOL(acpi_os_execute);
diff --git a/drivers/acpi/pci_link.c b/drivers/acpi/pci_link.c
index 7f3e7e77e794..d53bd9878ca2 100644
--- a/drivers/acpi/pci_link.c
+++ b/drivers/acpi/pci_link.c
@@ -307,7 +307,7 @@ static int acpi_pci_link_set(struct acpi_pci_link *link, int irq)
        if (!link || !irq)
                return -EINVAL;
-        resource = kmalloc(sizeof(*resource) + 1, GFP_ATOMIC);
+        resource = kmalloc(sizeof(*resource) + 1, irqs_disabled() ? GFP_ATOMIC: GFP_KERNEL);
        if (!resource)
                return -ENOMEM;
diff --git a/drivers/acpi/power.c b/drivers/acpi/power.c
index fec225d1b6b7..fe67a8af520e 100644
--- a/drivers/acpi/power.c
+++ b/drivers/acpi/power.c
@@ -216,10 +216,8 @@ static int acpi_power_off_device(acpi_handle handle)
 {
        int result = 0;
        acpi_status status = AE_OK;
-        struct acpi_device *device = NULL;
        struct acpi_power_resource *resource = NULL;
        result = acpi_power_get_context(handle, &resource);
        if (result)
                return result;
@@ -230,13 +228,13 @@ static int acpi_power_off_device(acpi_handle handle)
        if (resource->references) {
                ACPI_DEBUG_PRINT((ACPI_DB_INFO,
                                  "Resource [%s] is still in use, dereferencing\n",
-                                  device->pnp.bus_id));
+                                  resource->device->pnp.bus_id));
                return 0;
        }
        if (resource->state == ACPI_POWER_RESOURCE_STATE_OFF) {
                ACPI_DEBUG_PRINT((ACPI_DB_INFO, "Resource [%s] already off\n",
-                                  device->pnp.bus_id));
+                                  resource->device->pnp.bus_id));
                return 0;
        }
@@ -251,8 +249,7 @@ static int acpi_power_off_device(acpi_handle handle)
                return -ENOEXEC;
        /* Update the power resource's _device_ power state */
-        device = resource->device;
+        resource->device->power.state = ACPI_STATE_D3;
-        device->power.state = ACPI_STATE_D3;
        ACPI_DEBUG_PRINT((ACPI_DB_INFO, "Resource [%s] turned off\n",
                          resource->name));
diff --git a/drivers/acpi/processor_core.c b/drivers/acpi/processor_core.c
index b13d64415b7a..1908e0d20222 100644
--- a/drivers/acpi/processor_core.c
+++ b/drivers/acpi/processor_core.c
@@ -519,7 +519,7 @@ static int acpi_processor_get_info(struct acpi_processor *pr)
 static void *processor_device_array[NR_CPUS];
-static int acpi_processor_start(struct acpi_device *device)
+static int __cpuinit acpi_processor_start(struct acpi_device *device)
 {
        int result = 0;
        acpi_status status = AE_OK;
diff --git a/drivers/acpi/processor_idle.c b/drivers/acpi/processor_idle.c
index 0a395fca843b..e67144cf3c8b 100644
--- a/drivers/acpi/processor_idle.c
+++ b/drivers/acpi/processor_idle.c
@@ -219,6 +219,23 @@ static void acpi_safe_halt(void)
 static atomic_t c3_cpu_count;
+/* Common C-state entry for C2, C3, .. */
+static void acpi_cstate_enter(struct acpi_processor_cx *cstate)
+{
+        if (cstate->space_id == ACPI_CSTATE_FFH) {
+                /* Call into architectural FFH based C-state */
+                acpi_processor_ffh_cstate_enter(cstate);
+        } else {
+                int unused;
+                /* IO port based C-state */
+                inb(cstate->address);
+                /* Dummy wait op - must do something useless after P_LVL2 read
+                   because chipsets cannot guarantee that STPCLK# signal
+                   gets asserted in time to freeze execution properly. */
+                unused = inl(acpi_fadt.xpm_tmr_blk.address);
+        }
+}
 static void acpi_processor_idle(void)
 {
        struct acpi_processor *pr = NULL;
@@ -361,11 +378,7 @@ static void acpi_processor_idle(void)
                /* Get start time (ticks) */
                t1 = inl(acpi_fadt.xpm_tmr_blk.address);
                /* Invoke C2 */
-                inb(cx->address);
+                acpi_cstate_enter(cx);
-                /* Dummy wait op - must do something useless after P_LVL2 read
-                   because chipsets cannot guarantee that STPCLK# signal
-                   gets asserted in time to freeze execution properly. */
-                t2 = inl(acpi_fadt.xpm_tmr_blk.address);
                /* Get end time (ticks) */
                t2 = inl(acpi_fadt.xpm_tmr_blk.address);
@@ -401,9 +414,7 @@ static void acpi_processor_idle(void)
                /* Get start time (ticks) */
                t1 = inl(acpi_fadt.xpm_tmr_blk.address);
                /* Invoke C3 */
-                inb(cx->address);
+                acpi_cstate_enter(cx);
-                /* Dummy wait op (see above) */
-                t2 = inl(acpi_fadt.xpm_tmr_blk.address);
                /* Get end time (ticks) */
                t2 = inl(acpi_fadt.xpm_tmr_blk.address);
                if (pr->flags.bm_check) {
@@ -628,20 +639,16 @@ static int acpi_processor_get_power_info_fadt(struct acpi_processor *pr)
        return 0;
 }
-static int acpi_processor_get_power_info_default_c1(struct acpi_processor *pr)
+static int acpi_processor_get_power_info_default(struct acpi_processor *pr)
 {
+        if (!pr->power.states[ACPI_STATE_C1].valid) {
-        /* Zero initialize all the C-states info. */
+                /* set the first C-State to C1 */
-        memset(pr->power.states, 0, sizeof(pr->power.states));
+                /* all processors need to support C1 */
+                pr->power.states[ACPI_STATE_C1].type = ACPI_STATE_C1;
-        /* set the first C-State to C1 */
+                pr->power.states[ACPI_STATE_C1].valid = 1;
-        pr->power.states[ACPI_STATE_C1].type = ACPI_STATE_C1;
+        }
+        /* the C0 state only exists as a filler in our array */
-        /* the C0 state only exists as a filler in our array,
-         * and all processors need to support C1 */
        pr->power.states[ACPI_STATE_C0].valid = 1;
-        pr->power.states[ACPI_STATE_C1].valid = 1;
        return 0;
 }
@@ -658,12 +665,7 @@ static int acpi_processor_get_power_info_cst(struct acpi_processor *pr)
        if (nocst)
                return -ENODEV;
-        current_count = 1;
+        current_count = 0;
-        /* Zero initialize C2 onwards and prepare for fresh CST lookup */
-        for (i = 2; i < ACPI_PROCESSOR_MAX_POWER; i++)
-                memset(&(pr->power.states[i]), 0, 
-                                sizeof(struct acpi_processor_cx));
        status = acpi_evaluate_object(pr->handle, "_CST", NULL, &buffer);
        if (ACPI_FAILURE(status)) {
@@ -718,22 +720,39 @@ static int acpi_processor_get_power_info_cst(struct acpi_processor *pr)
                    (reg->space_id != ACPI_ADR_SPACE_FIXED_HARDWARE))
                        continue;
-                cx.address = (reg->space_id == ACPI_ADR_SPACE_FIXED_HARDWARE) ?
-                    0 : reg->address;
                /* There should be an easy way to extract an integer... */
                obj = (union acpi_object *)&(element->package.elements[1]);
                if (obj->type != ACPI_TYPE_INTEGER)
                        continue;
                cx.type = obj->integer.value;
+                /*
-                if ((cx.type != ACPI_STATE_C1) &&
+                 * Some buggy BIOSes won't list C1 in _CST -
-                    (reg->space_id != ACPI_ADR_SPACE_SYSTEM_IO))
+                 * Let acpi_processor_get_power_info_default() handle them later
-                        continue;
+                 */
+                if (i == 1 && cx.type != ACPI_STATE_C1)
-                if ((cx.type < ACPI_STATE_C2) || (cx.type > ACPI_STATE_C3))
+                        current_count++;
-                        continue;
+                cx.address = reg->address;
+                cx.index = current_count + 1;
+                cx.space_id = ACPI_CSTATE_SYSTEMIO;
+                if (reg->space_id == ACPI_ADR_SPACE_FIXED_HARDWARE) {
+                        if (acpi_processor_ffh_cstate_probe
+                                        (pr->id, &cx, reg) == 0) {
+                                cx.space_id = ACPI_CSTATE_FFH;
+                        } else if (cx.type != ACPI_STATE_C1) {
+                                /*
+                                 * C1 is a special case where FIXED_HARDWARE
+                                 * can be handled in non-MWAIT way as well.
+                                 * In that case, save this _CST entry info.
+                                 * That is, we retain space_id of SYSTEM_IO for
+                                 * halt based C1.
+                                 * Otherwise, ignore this info and continue.
+                                 */
+                                continue;
+                        }
+                }
                obj = (union acpi_object *)&(element->package.elements[2]);
                if (obj->type != ACPI_TYPE_INTEGER)
@@ -938,12 +957,18 @@ static int acpi_processor_get_power_info(struct acpi_processor *pr)
        /* NOTE: the idle thread may not be running while calling
         * this function */
-        /* Adding C1 state */
+        /* Zero initialize all the C-states info. */
-        acpi_processor_get_power_info_default_c1(pr);
+        memset(pr->power.states, 0, sizeof(pr->power.states));
        result = acpi_processor_get_power_info_cst(pr);
        if (result == -ENODEV)
                acpi_processor_get_power_info_fadt(pr);
+        if (result)
+                return result;
+        acpi_processor_get_power_info_default(pr);
        pr->power.count = acpi_processor_power_verify(pr);
        /*
@@ -1083,6 +1108,7 @@ static const struct file_operations acpi_processor_power_fops = {
        .release = single_release,
 };
+#ifdef CONFIG_SMP
 static void smp_callback(void *v)
 {
        /* we already woke the CPU up, nothing more to do */
@@ -1104,8 +1130,9 @@ static int acpi_processor_latency_notify(struct notifier_block *b,
 static struct notifier_block acpi_processor_latency_notifier = {
        .notifier_call = acpi_processor_latency_notify,
 };
+#endif
-int acpi_processor_power_init(struct acpi_processor *pr,
+int __cpuinit acpi_processor_power_init(struct acpi_processor *pr,
                              struct acpi_device *device)
 {
        acpi_status status = 0;
@@ -1121,7 +1148,9 @@ int acpi_processor_power_init(struct acpi_processor *pr,
                               "ACPI: processor limited to max C-state %d\n",
                               max_cstate);
                first_run++;
+#ifdef CONFIG_SMP
                register_latency_notifier(&acpi_processor_latency_notifier);
+#endif
        }
        if (!pr)
@@ -1193,7 +1222,9 @@ int acpi_processor_power_exit(struct acpi_processor *pr,
                 * copies of pm_idle before proceeding.
                 */
                cpu_idle_wait();
+#ifdef CONFIG_SMP
                unregister_latency_notifier(&acpi_processor_latency_notifier);
+#endif
        }
        return 0;
diff --git a/drivers/acpi/sbs.c b/drivers/acpi/sbs.c
index 62bef0b3b614..8908a975e575 100644
--- a/drivers/acpi/sbs.c
+++ b/drivers/acpi/sbs.c
@@ -98,11 +98,11 @@ static int update_info_mode = UPDATE_INFO_MODE;
 static int update_time = UPDATE_TIME;
 static int update_time2 = UPDATE_TIME2;
-module_param(capacity_mode, int, CAPACITY_UNIT);
+module_param(capacity_mode, int, 0);
-module_param(update_mode, int, UPDATE_MODE);
+module_param(update_mode, int, 0);
-module_param(update_info_mode, int, UPDATE_INFO_MODE);
+module_param(update_info_mode, int, 0);
-module_param(update_time, int, UPDATE_TIME);
+module_param(update_time, int, 0);
-module_param(update_time2, int, UPDATE_TIME2);
+module_param(update_time2, int, 0);
 static int acpi_sbs_add(struct acpi_device *device);
 static int acpi_sbs_remove(struct acpi_device *device, int type);
@@ -1685,10 +1685,16 @@ static int acpi_sbs_add(struct acpi_device *device)
 int acpi_sbs_remove(struct acpi_device *device, int type)
 {
-        struct acpi_sbs *sbs = (struct acpi_sbs *)acpi_driver_data(device);
+        struct acpi_sbs *sbs = NULL;
        int id;
-        if (!device || !sbs) {
+        if (!device) {
+                return -EINVAL;
+        }
+        sbs = (struct acpi_sbs *)acpi_driver_data(device);
+        if (!sbs) {
                return -EINVAL;
        }
diff --git a/drivers/acpi/tables/tbget.c b/drivers/acpi/tables/tbget.c
index 7856db759af0..11e2d4454e05 100644
--- a/drivers/acpi/tables/tbget.c
+++ b/drivers/acpi/tables/tbget.c
@@ -324,7 +324,7 @@ acpi_tb_get_this_table(struct acpi_pointer *address,
        if (header->length < sizeof(struct acpi_table_header)) {
                ACPI_ERROR((AE_INFO,
-                            "Table length (%X) is smaller than minimum (%X)",
+                            "Table length (%X) is smaller than minimum (%zX)",
                            header->length, sizeof(struct acpi_table_header)));
                return_ACPI_STATUS(AE_INVALID_TABLE_LENGTH);
diff --git a/drivers/acpi/tables/tbrsdt.c b/drivers/acpi/tables/tbrsdt.c
index 0ad3dbb9ebca..86a5fca9b739 100644
--- a/drivers/acpi/tables/tbrsdt.c
+++ b/drivers/acpi/tables/tbrsdt.c
@@ -187,7 +187,7 @@ acpi_status acpi_tb_validate_rsdt(struct acpi_table_header *table_ptr)
        if (table_ptr->length < sizeof(struct acpi_table_header)) {
                ACPI_ERROR((AE_INFO,
-                            "RSDT/XSDT length (%X) is smaller than minimum (%X)",
+                            "RSDT/XSDT length (%X) is smaller than minimum (%zX)",
                            table_ptr->length,
                            sizeof(struct acpi_table_header)));
diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c
index 77138a39eb04..83728a9457ad 100644
--- a/drivers/ata/libata-core.c
+++ b/drivers/ata/libata-core.c
@@ -870,7 +870,11 @@ static unsigned int ata_id_xfermask(const u16 *id)
                 * the PIO timing number for the maximum. Turn it into
                 * a mask.
                 */
-                pio_mask = (2 << (id[ATA_ID_OLD_PIO_MODES] & 0xFF)) - 1 ;
+                u8 mode = id[ATA_ID_OLD_PIO_MODES] & 0xFF;
+                if (mode < 5)   /* Valid PIO range */
+                        pio_mask = (2 << mode) - 1;
+                else
+                        pio_mask = 1;
                /* But wait.. there's more. Design your standards by
                 * committee and you too can get a free iordy field to
diff --git a/drivers/ata/libata-scsi.c b/drivers/ata/libata-scsi.c
index b0d0cc41f3e8..7af2a4ba4990 100644
--- a/drivers/ata/libata-scsi.c
+++ b/drivers/ata/libata-scsi.c
@@ -164,10 +164,10 @@ int ata_cmd_ioctl(struct scsi_device *scsidev, void __user *arg)
 {
        int rc = 0;
        u8 scsi_cmd[MAX_COMMAND_SIZE];
-        u8 args[4], *argbuf = NULL;
+        u8 args[4], *argbuf = NULL, *sensebuf = NULL;
        int argsize = 0;
-        struct scsi_sense_hdr sshdr;
        enum dma_data_direction data_dir;
+        int cmd_result;
        if (arg == NULL)
                return -EINVAL;
@@ -175,6 +175,10 @@ int ata_cmd_ioctl(struct scsi_device *scsidev, void __user *arg)
        if (copy_from_user(args, arg, sizeof(args)))
                return -EFAULT;
+        sensebuf = kzalloc(SCSI_SENSE_BUFFERSIZE, GFP_NOIO);
+        if (!sensebuf)
+                return -ENOMEM;
        memset(scsi_cmd, 0, sizeof(scsi_cmd));
        if (args[3]) {
@@ -191,7 +195,7 @@ int ata_cmd_ioctl(struct scsi_device *scsidev, void __user *arg)
                data_dir = DMA_FROM_DEVICE;
        } else {
                scsi_cmd[1]  = (3 << 1); /* Non-data */
-                /* scsi_cmd[2] is already 0 -- no off.line, cc, or data xfer */
+                scsi_cmd[2]  = 0x20;     /* cc but no off.line or data xfer */
                data_dir = DMA_NONE;
        }
@@ -210,18 +214,46 @@ int ata_cmd_ioctl(struct scsi_device *scsidev, void __user *arg)
        /* Good values for timeout and retries?  Values below
           from scsi_ioctl_send_command() for default case... */
-        if (scsi_execute_req(scsidev, scsi_cmd, data_dir, argbuf, argsize,
+        cmd_result = scsi_execute(scsidev, scsi_cmd, data_dir, argbuf, argsize,
-                             &sshdr, (10*HZ), 5)) {
+                                  sensebuf, (10*HZ), 5, 0);
+        if (driver_byte(cmd_result) == DRIVER_SENSE) {/* sense data available */
+                u8 *desc = sensebuf + 8;
+                cmd_result &= ~(0xFF<<24); /* DRIVER_SENSE is not an error */
+                /* If we set cc then ATA pass-through will cause a
+                 * check condition even if no error. Filter that. */
+                if (cmd_result & SAM_STAT_CHECK_CONDITION) {
+                        struct scsi_sense_hdr sshdr;
+                        scsi_normalize_sense(sensebuf, SCSI_SENSE_BUFFERSIZE,
+                                              &sshdr);
+                        if (sshdr.sense_key==0 &&
+                            sshdr.asc==0 && sshdr.ascq==0)
+                                cmd_result &= ~SAM_STAT_CHECK_CONDITION;
+                }
+                /* Send userspace a few ATA registers (same as drivers/ide) */
+                if (sensebuf[0] == 0x72 &&     /* format is "descriptor" */
+                    desc[0] == 0x09 ) {        /* code is "ATA Descriptor" */
+                        args[0] = desc[13];    /* status */
+                        args[1] = desc[3];     /* error */
+                        args[2] = desc[5];     /* sector count (0:7) */
+                        if (copy_to_user(arg, args, sizeof(args)))
+                                rc = -EFAULT;
+                }
+        }
+        if (cmd_result) {
                rc = -EIO;
                goto error;
        }
-        /* Need code to retrieve data from check condition? */
        if ((argbuf)
         && copy_to_user(arg + sizeof(args), argbuf, argsize))
                rc = -EFAULT;
 error:
+        kfree(sensebuf);
        kfree(argbuf);
        return rc;
 }
diff --git a/drivers/ata/pata_qdi.c b/drivers/ata/pata_qdi.c
index 7977f471d5e9..2c3cc0ccc606 100644
--- a/drivers/ata/pata_qdi.c
+++ b/drivers/ata/pata_qdi.c
@@ -141,7 +141,7 @@ static void qdi_data_xfer(struct ata_device *adev, unsigned char *buf, unsigned
                                memcpy(&pad, buf + buflen - slop, slop);
                                outl(le32_to_cpu(pad), ap->ioaddr.data_addr);
                        } else {
-                                pad = cpu_to_le16(inl(ap->ioaddr.data_addr));
+                                pad = cpu_to_le32(inl(ap->ioaddr.data_addr));
                                memcpy(buf + buflen - slop, &pad, slop);
                        }
                }
diff --git a/drivers/ata/sata_promise.c b/drivers/ata/sata_promise.c
index 8bcdfa64667c..72eda5160fad 100644
--- a/drivers/ata/sata_promise.c
+++ b/drivers/ata/sata_promise.c
@@ -260,6 +260,7 @@ static const struct pci_device_id pdc_ata_pci_tbl[] = {
 #if 0
        { PCI_VDEVICE(PROMISE, 0x3570), board_20771 },
 #endif
+        { PCI_VDEVICE(PROMISE, 0x3577), board_20771 },
        { }     /* terminate list */
 };
diff --git a/drivers/block/DAC960.h b/drivers/block/DAC960.h
index cec539e601fe..6148073532b2 100644
--- a/drivers/block/DAC960.h
+++ b/drivers/block/DAC960.h
@@ -4379,8 +4379,8 @@ static inline void DAC960_P_To_PD_TranslateEnquiry(void *Enquiry)
 static inline void DAC960_P_To_PD_TranslateDeviceState(void *DeviceState)
 {
  memcpy(DeviceState + 2, DeviceState + 3, 1);
-  memcpy(DeviceState + 4, DeviceState + 5, 2);
+  memmove(DeviceState + 4, DeviceState + 5, 2);
-  memcpy(DeviceState + 6, DeviceState + 8, 4);
+  memmove(DeviceState + 6, DeviceState + 8, 4);
 }
 static inline
diff --git a/drivers/block/amiflop.c b/drivers/block/amiflop.c
index 5d254b714509..5d6562171533 100644
--- a/drivers/block/amiflop.c
+++ b/drivers/block/amiflop.c
@@ -1709,10 +1709,13 @@ static struct kobject *floppy_find(dev_t dev, int *part, void *data)
        return get_disk(unit[drive].gendisk);
 }
-int __init amiga_floppy_init(void)
+static int __init amiga_floppy_init(void)
 {
        int i, ret;
+        if (!MACH_IS_AMIGA)
+                return -ENXIO;
        if (!AMIGAHW_PRESENT(AMI_FLOPPY))
                return -ENXIO;
@@ -1809,15 +1812,9 @@ out_blkdev:
        return ret;
 }
+module_init(amiga_floppy_init);
 #ifdef MODULE
-int init_module(void)
-{
-        if (!MACH_IS_AMIGA)
-                return -ENXIO;
-        return amiga_floppy_init();
-}
 #if 0 /* not safe to unload */
 void cleanup_module(void)
 {
diff --git a/drivers/block/rd.c b/drivers/block/rd.c
index a3f64bfe6b58..485aa87e9bcd 100644
--- a/drivers/block/rd.c
+++ b/drivers/block/rd.c
@@ -432,6 +432,12 @@ static int __init rd_init(void)
                rd_disks[i] = alloc_disk(1);
                if (!rd_disks[i])
                        goto out;
+                rd_queue[i] = blk_alloc_queue(GFP_KERNEL);
+                if (!rd_queue[i]) {
+                        put_disk(rd_disks[i]);
+                        goto out;
+                }
        }
        if (register_blkdev(RAMDISK_MAJOR, "ramdisk")) {
@@ -442,10 +448,6 @@ static int __init rd_init(void)
        for (i = 0; i < CONFIG_BLK_DEV_RAM_COUNT; i++) {
                struct gendisk *disk = rd_disks[i];
-                rd_queue[i] = blk_alloc_queue(GFP_KERNEL);
-                if (!rd_queue[i])
-                        goto out_queue;
                blk_queue_make_request(rd_queue[i], &rd_make_request);
                blk_queue_hardsect_size(rd_queue[i], rd_blocksize);
@@ -466,8 +468,6 @@ static int __init rd_init(void)
                CONFIG_BLK_DEV_RAM_COUNT, rd_size, rd_blocksize);
        return 0;
-out_queue:
-        unregister_blkdev(RAMDISK_MAJOR, "ramdisk");
 out:
        while (i--) {
                put_disk(rd_disks[i]);
diff --git a/drivers/block/xd.c b/drivers/block/xd.c
index 10cc38783bdf..0d97b7eb818a 100644
--- a/drivers/block/xd.c
+++ b/drivers/block/xd.c
@@ -48,9 +48,9 @@
 #include <linux/blkdev.h>
 #include <linux/blkpg.h>
 #include <linux/delay.h>
+#include <linux/io.h>
 #include <asm/system.h>
-#include <asm/io.h>
 #include <asm/uaccess.h>
 #include <asm/dma.h>
diff --git a/drivers/block/z2ram.c b/drivers/block/z2ram.c
index 82ddbdd7bd4b..7cc2685ca84a 100644
--- a/drivers/block/z2ram.c
+++ b/drivers/block/z2ram.c
@@ -329,7 +329,7 @@ static struct kobject *z2_find(dev_t dev, int *part, void *data)
 static struct request_queue *z2_queue;
-int __init 
+static int __init 
 z2_init(void)
 {
    int ret;
@@ -370,26 +370,7 @@ err:
    return ret;
 }
-#if defined(MODULE)
+static void __exit z2_exit(void)
-MODULE_LICENSE("GPL");
-int
-init_module( void )
-{
-    int error;
-    
-    error = z2_init();
-    if ( error == 0 )
-    {
-        printk( KERN_INFO DEVICE_NAME ": loaded as module\n" );
-    }
-    
-    return error;
-}
-void
-cleanup_module( void )
 {
    int i, j;
    blk_unregister_region(MKDEV(Z2RAM_MAJOR, 0), 256);
@@ -425,4 +406,7 @@ cleanup_module( void )
    return;
 } 
-#endif
+module_init(z2_init);
+module_exit(z2_exit);
+MODULE_LICENSE("GPL");
diff --git a/drivers/bluetooth/bcm203x.c b/drivers/bluetooth/bcm203x.c
index 67cdda43f229..516751754aa9 100644
--- a/drivers/bluetooth/bcm203x.c
+++ b/drivers/bluetooth/bcm203x.c
@@ -29,7 +29,6 @@
 #include <linux/slab.h>
 #include <linux/types.h>
 #include <linux/errno.h>
-#include <linux/timer.h>
 #include <linux/device.h>
 #include <linux/firmware.h>
@@ -43,7 +42,7 @@
 #define BT_DBG(D...)
 #endif
-#define VERSION "1.0"
+#define VERSION "1.1"
 static int ignore = 0;
@@ -72,7 +71,7 @@ struct bcm203x_data {
        unsigned long           state;
-        struct timer_list       timer;
+        struct work_struct      work;
        struct urb              *urb;
        unsigned char           *buffer;
@@ -105,7 +104,7 @@ static void bcm203x_complete(struct urb *urb)
                data->state = BCM203X_SELECT_MEMORY;
-                mod_timer(&data->timer, jiffies + (HZ / 10));
+                schedule_work(&data->work);
                break;
        case BCM203X_SELECT_MEMORY:
@@ -158,9 +157,9 @@ static void bcm203x_complete(struct urb *urb)
        }
 }
-static void bcm203x_timer(unsigned long user_data)
+static void bcm203x_work(void *user_data)
 {
-        struct bcm203x_data *data = (struct bcm203x_data *) user_data;
+        struct bcm203x_data *data = user_data;
        if (usb_submit_urb(data->urb, GFP_ATOMIC) < 0)
                BT_ERR("Can't submit URB");
@@ -247,13 +246,11 @@ static int bcm203x_probe(struct usb_interface *intf, const struct usb_device_id
        release_firmware(firmware);
-        init_timer(&data->timer);
+        INIT_WORK(&data->work, bcm203x_work, (void *) data);
-        data->timer.function = bcm203x_timer;
-        data->timer.data = (unsigned long) data;
        usb_set_intfdata(intf, data);
-        mod_timer(&data->timer, jiffies + HZ);
+        schedule_work(&data->work);
        return 0;
 }
diff --git a/drivers/char/Kconfig b/drivers/char/Kconfig
index 0e6f35fcc2eb..39a9f8cc6412 100644
--- a/drivers/char/Kconfig
+++ b/drivers/char/Kconfig
@@ -1046,7 +1046,7 @@ source "drivers/char/tpm/Kconfig"
 config TELCLOCK
        tristate "Telecom clock driver for MPBL0010 ATCA SBC"
-        depends on EXPERIMENTAL
+        depends on EXPERIMENTAL && X86
        default n
        help
          The telecom clock device is specific to the MPBL0010 ATCA computer and
diff --git a/drivers/char/epca.c b/drivers/char/epca.c
index c3f95583a120..706733c0b36a 100644
--- a/drivers/char/epca.c
+++ b/drivers/char/epca.c
@@ -1157,6 +1157,7 @@ static int __init pc_init(void)
        int crd;
        struct board_info *bd;
        unsigned char board_id = 0;
+        int err = -ENOMEM;
        int pci_boards_found, pci_count;
@@ -1164,13 +1165,11 @@ static int __init pc_init(void)
        pc_driver = alloc_tty_driver(MAX_ALLOC);
        if (!pc_driver)
-                return -ENOMEM;
+                goto out1;
        pc_info = alloc_tty_driver(MAX_ALLOC);
-        if (!pc_info) {
+        if (!pc_info)
-                put_tty_driver(pc_driver);
+                goto out2;
-                return -ENOMEM;
-        }
        /* -----------------------------------------------------------------------
                If epca_setup has not been ran by LILO set num_cards to defaults; copy
@@ -1370,11 +1369,17 @@ static int __init pc_init(void)
        } /* End for each card */
-        if (tty_register_driver(pc_driver))
+        err = tty_register_driver(pc_driver);
-                panic("Couldn't register Digi PC/ driver");
+        if (err) {
+                printk(KERN_ERR "Couldn't register Digi PC/ driver");
+                goto out3;
+        }
-        if (tty_register_driver(pc_info))
+        err = tty_register_driver(pc_info);
-                panic("Couldn't register Digi PC/ info ");
+        if (err) {
+                printk(KERN_ERR "Couldn't register Digi PC/ info ");
+                goto out4;
+        }
        /* -------------------------------------------------------------------
           Start up the poller to check for events on all enabled boards
@@ -1385,6 +1390,15 @@ static int __init pc_init(void)
        mod_timer(&epca_timer, jiffies + HZ/25);
        return 0;
+out4:
+        tty_unregister_driver(pc_driver);
+out3:
+        put_tty_driver(pc_info);
+out2:
+        put_tty_driver(pc_driver);
+out1:
+        return err;
 } /* End pc_init */
 /* ------------------ Begin post_fep_init  ---------------------- */
diff --git a/drivers/char/ip2/i2lib.c b/drivers/char/ip2/i2lib.c
index fc944d375be7..54d93f0345e8 100644
--- a/drivers/char/ip2/i2lib.c
+++ b/drivers/char/ip2/i2lib.c
@@ -1007,7 +1007,7 @@ i2InputAvailable(i2ChanStrPtr pCh)
 // applications that one cannot break out of.
 //******************************************************************************
 static int
-i2Output(i2ChanStrPtr pCh, const char *pSource, int count, int user )
+i2Output(i2ChanStrPtr pCh, const char *pSource, int count)
 {
        i2eBordStrPtr pB;
        unsigned char *pInsert;
@@ -1020,7 +1020,7 @@ i2Output(i2ChanStrPtr pCh, const char *pSource, int count, int user )
        int bailout = 10;
-        ip2trace (CHANN, ITRC_OUTPUT, ITRC_ENTER, 2, count, user );
+        ip2trace (CHANN, ITRC_OUTPUT, ITRC_ENTER, 2, count, 0 );
        // Ensure channel structure seems real
        if ( !i2Validate ( pCh ) ) 
@@ -1087,12 +1087,7 @@ i2Output(i2ChanStrPtr pCh, const char *pSource, int count, int user )
                        DATA_COUNT_OF(pInsert)  = amountToMove;
                        // Move the data
-                        if ( user ) {
+                        memcpy( (char*)(DATA_OF(pInsert)), pSource, amountToMove );
-                                rc = copy_from_user((char*)(DATA_OF(pInsert)), pSource,
-                                                amountToMove );
-                        } else {
-                                memcpy( (char*)(DATA_OF(pInsert)), pSource, amountToMove );
-                        }
                        // Adjust pointers and indices
                        pSource                                 += amountToMove;
                        pCh->Obuf_char_count    += amountToMove;
diff --git a/drivers/char/ip2/i2lib.h b/drivers/char/ip2/i2lib.h
index 952e113ccd8a..e559e9bac06d 100644
--- a/drivers/char/ip2/i2lib.h
+++ b/drivers/char/ip2/i2lib.h
@@ -332,7 +332,7 @@ static int  i2QueueCommands(int, i2ChanStrPtr, int, int, cmdSyntaxPtr,...);
 static int  i2GetStatus(i2ChanStrPtr, int);
 static int  i2Input(i2ChanStrPtr);
 static int  i2InputFlush(i2ChanStrPtr);
-static int  i2Output(i2ChanStrPtr, const char *, int, int);
+static int  i2Output(i2ChanStrPtr, const char *, int);
 static int  i2OutputFree(i2ChanStrPtr);
 static int  i2ServiceBoard(i2eBordStrPtr);
 static void i2DrainOutput(i2ChanStrPtr, int);
diff --git a/drivers/char/ip2/ip2main.c b/drivers/char/ip2/ip2main.c
index 858ba5432c99..a3f32d46d2f8 100644
--- a/drivers/char/ip2/ip2main.c
+++ b/drivers/char/ip2/ip2main.c
@@ -1704,7 +1704,7 @@ ip2_write( PTTY tty, const unsigned char *pData, int count)
        /* This is the actual move bit. Make sure it does what we need!!!!! */
        WRITE_LOCK_IRQSAVE(&pCh->Pbuf_spinlock,flags);
-        bytesSent = i2Output( pCh, pData, count, 0 );
+        bytesSent = i2Output( pCh, pData, count);
        WRITE_UNLOCK_IRQRESTORE(&pCh->Pbuf_spinlock,flags);
        ip2trace (CHANN, ITRC_WRITE, ITRC_RETURN, 1, bytesSent );
@@ -1764,7 +1764,7 @@ ip2_flush_chars( PTTY tty )
                //
                // We may need to restart i2Output if it does not fullfill this request
                //
-                strip = i2Output( pCh, pCh->Pbuf, pCh->Pbuf_stuff, 0 );
+                strip = i2Output( pCh, pCh->Pbuf, pCh->Pbuf_stuff);
                if ( strip != pCh->Pbuf_stuff ) {
                        memmove( pCh->Pbuf, &pCh->Pbuf[strip], pCh->Pbuf_stuff - strip );
                }
diff --git a/drivers/char/ipmi/ipmi_msghandler.c b/drivers/char/ipmi/ipmi_msghandler.c
index 2455e8d478ac..34a4fd13fa81 100644
--- a/drivers/char/ipmi/ipmi_msghandler.c
+++ b/drivers/char/ipmi/ipmi_msghandler.c
@@ -1928,13 +1928,8 @@ static ssize_t guid_show(struct device *dev, struct device_attribute *attr,
                        (long long) bmc->guid[8]);
 }
-static void
+static void remove_files(struct bmc_device *bmc)
-cleanup_bmc_device(struct kref *ref)
 {
-        struct bmc_device *bmc;
-        bmc = container_of(ref, struct bmc_device, refcount);
        device_remove_file(&bmc->dev->dev,
                           &bmc->device_id_attr);
        device_remove_file(&bmc->dev->dev,
@@ -1951,12 +1946,23 @@ cleanup_bmc_device(struct kref *ref)
                           &bmc->manufacturer_id_attr);
        device_remove_file(&bmc->dev->dev,
                           &bmc->product_id_attr);
        if (bmc->id.aux_firmware_revision_set)
                device_remove_file(&bmc->dev->dev,
                                   &bmc->aux_firmware_rev_attr);
        if (bmc->guid_set)
                device_remove_file(&bmc->dev->dev,
                                   &bmc->guid_attr);
+}
+static void
+cleanup_bmc_device(struct kref *ref)
+{
+        struct bmc_device *bmc;
+        bmc = container_of(ref, struct bmc_device, refcount);
+        remove_files(bmc);
        platform_device_unregister(bmc->dev);
        kfree(bmc);
 }
@@ -1977,6 +1983,79 @@ static void ipmi_bmc_unregister(ipmi_smi_t intf)
        mutex_unlock(&ipmidriver_mutex);
 }
+static int create_files(struct bmc_device *bmc)
+{
+        int err;
+        err = device_create_file(&bmc->dev->dev,
+                           &bmc->device_id_attr);
+        if (err) goto out;
+        err = device_create_file(&bmc->dev->dev,
+                           &bmc->provides_dev_sdrs_attr);
+        if (err) goto out_devid;
+        err = device_create_file(&bmc->dev->dev,
+                           &bmc->revision_attr);
+        if (err) goto out_sdrs;
+        err = device_create_file(&bmc->dev->dev,
+                           &bmc->firmware_rev_attr);
+        if (err) goto out_rev;
+        err = device_create_file(&bmc->dev->dev,
+                           &bmc->version_attr);
+        if (err) goto out_firm;
+        err = device_create_file(&bmc->dev->dev,
+                           &bmc->add_dev_support_attr);
+        if (err) goto out_version;
+        err = device_create_file(&bmc->dev->dev,
+                           &bmc->manufacturer_id_attr);
+        if (err) goto out_add_dev;
+        err = device_create_file(&bmc->dev->dev,
+                           &bmc->product_id_attr);
+        if (err) goto out_manu;
+        if (bmc->id.aux_firmware_revision_set) {
+                err = device_create_file(&bmc->dev->dev,
+                                   &bmc->aux_firmware_rev_attr);
+                if (err) goto out_prod_id;
+        }
+        if (bmc->guid_set) {
+                err = device_create_file(&bmc->dev->dev,
+                                   &bmc->guid_attr);
+                if (err) goto out_aux_firm;
+        }
+        return 0;
+out_aux_firm:
+        if (bmc->id.aux_firmware_revision_set)
+                device_remove_file(&bmc->dev->dev,
+                                   &bmc->aux_firmware_rev_attr);
+out_prod_id:
+        device_remove_file(&bmc->dev->dev,
+                           &bmc->product_id_attr);
+out_manu:
+        device_remove_file(&bmc->dev->dev,
+                           &bmc->manufacturer_id_attr);
+out_add_dev:
+        device_remove_file(&bmc->dev->dev,
+                           &bmc->add_dev_support_attr);
+out_version:
+        device_remove_file(&bmc->dev->dev,
+                           &bmc->version_attr);
+out_firm:
+        device_remove_file(&bmc->dev->dev,
+                           &bmc->firmware_rev_attr);
+out_rev:
+        device_remove_file(&bmc->dev->dev,
+                           &bmc->revision_attr);
+out_sdrs:
+        device_remove_file(&bmc->dev->dev,
+                           &bmc->provides_dev_sdrs_attr);
+out_devid:
+        device_remove_file(&bmc->dev->dev,
+                           &bmc->device_id_attr);
+out:
+        return err;
+}
 static int ipmi_bmc_register(ipmi_smi_t intf)
 {
        int               rv;
@@ -2051,7 +2130,6 @@ static int ipmi_bmc_register(ipmi_smi_t intf)
                bmc->provides_dev_sdrs_attr.attr.mode = S_IRUGO;
                bmc->provides_dev_sdrs_attr.show = provides_dev_sdrs_show;
                bmc->revision_attr.attr.name = "revision";
                bmc->revision_attr.attr.owner = THIS_MODULE;
                bmc->revision_attr.attr.mode = S_IRUGO;
@@ -2093,28 +2171,14 @@ static int ipmi_bmc_register(ipmi_smi_t intf)
                bmc->aux_firmware_rev_attr.attr.mode = S_IRUGO;
                bmc->aux_firmware_rev_attr.show = aux_firmware_rev_show;
-                device_create_file(&bmc->dev->dev,
+                rv = create_files(bmc);
-                                   &bmc->device_id_attr);
+                if (rv) {
-                device_create_file(&bmc->dev->dev,
+                        mutex_lock(&ipmidriver_mutex);
-                                   &bmc->provides_dev_sdrs_attr);
+                        platform_device_unregister(bmc->dev);
-                device_create_file(&bmc->dev->dev,
+                        mutex_unlock(&ipmidriver_mutex);
-                                   &bmc->revision_attr);
-                device_create_file(&bmc->dev->dev,
+                        return rv;
-                                   &bmc->firmware_rev_attr);
+                }
-                device_create_file(&bmc->dev->dev,
-                                   &bmc->version_attr);
-                device_create_file(&bmc->dev->dev,
-                                   &bmc->add_dev_support_attr);
-                device_create_file(&bmc->dev->dev,
-                                   &bmc->manufacturer_id_attr);
-                device_create_file(&bmc->dev->dev,
-                                   &bmc->product_id_attr);
-                if (bmc->id.aux_firmware_revision_set)
-                        device_create_file(&bmc->dev->dev,
-                                           &bmc->aux_firmware_rev_attr);
-                if (bmc->guid_set)
-                        device_create_file(&bmc->dev->dev,
-                                           &bmc->guid_attr);
                printk(KERN_INFO
                       "ipmi: Found new BMC (man_id: 0x%6.6x, "
diff --git a/drivers/char/mem.c b/drivers/char/mem.c
index 6511012cbdcd..55473371b7c6 100644
--- a/drivers/char/mem.c
+++ b/drivers/char/mem.c
@@ -26,6 +26,7 @@
 #include <linux/backing-dev.h>
 #include <linux/bootmem.h>
 #include <linux/pipe_fs_i.h>
+#include <linux/pfn.h>
 #include <asm/uaccess.h>
 #include <asm/io.h>
@@ -292,8 +293,8 @@ static int mmap_kmem(struct file * file, struct vm_area_struct * vma)
 {
        unsigned long pfn;
-        /* Turn a kernel-virtual address into a physical page frame */
+        /* Turn a pfn offset into an absolute pfn */
-        pfn = __pa((u64)vma->vm_pgoff << PAGE_SHIFT) >> PAGE_SHIFT;
+        pfn = PFN_DOWN(virt_to_phys((void *)PAGE_OFFSET)) + vma->vm_pgoff;
        /*
         * RED-PEN: on some architectures there is more mapped memory
diff --git a/drivers/char/rio/rioctrl.c b/drivers/char/rio/rioctrl.c
index 052e8120a471..7ce77619707c 100644
--- a/drivers/char/rio/rioctrl.c
+++ b/drivers/char/rio/rioctrl.c
@@ -662,7 +662,7 @@ int riocontrol(struct rio_info *p, dev_t dev, int cmd, unsigned long arg, int su
                        p->RIOError.Error = COPYIN_FAILED;
                        return -EFAULT;
                }
-                if (portStats.port >= RIO_PORTS) {
+                if (portStats.port < 0 || portStats.port >= RIO_PORTS) {
                        p->RIOError.Error = PORT_NUMBER_OUT_OF_RANGE;
                        return -ENXIO;
                }
@@ -702,7 +702,7 @@ int riocontrol(struct rio_info *p, dev_t dev, int cmd, unsigned long arg, int su
                        p->RIOError.Error = COPYIN_FAILED;
                        return -EFAULT;
                }
-                if (portStats.port >= RIO_PORTS) {
+                if (portStats.port < 0 || portStats.port >= RIO_PORTS) {
                        p->RIOError.Error = PORT_NUMBER_OUT_OF_RANGE;
                        return -ENXIO;
                }
diff --git a/drivers/char/serial167.c b/drivers/char/serial167.c
index 461bfe0234c9..3af7f0958c5d 100644
--- a/drivers/char/serial167.c
+++ b/drivers/char/serial167.c
@@ -839,7 +839,7 @@ shutdown(struct cyclades_port * info)
    local_irq_save(flags);
        if (info->xmit_buf){
            free_page((unsigned long) info->xmit_buf);
-            info->xmit_buf = 0;
+            info->xmit_buf = NULL;
        }
        base_addr[CyCAR] = (u_char)channel;
@@ -1354,7 +1354,7 @@ cy_unthrottle(struct tty_struct * tty)
 static int
 get_serial_info(struct cyclades_port * info,
-                           struct serial_struct * retinfo)
+                           struct serial_struct __user * retinfo)
 {
  struct serial_struct tmp;
@@ -1376,7 +1376,7 @@ get_serial_info(struct cyclades_port * info,
 static int
 set_serial_info(struct cyclades_port * info,
-                           struct serial_struct * new_info)
+                           struct serial_struct __user * new_info)
 {
  struct serial_struct new_serial;
  struct cyclades_port old_info;
@@ -1503,7 +1503,7 @@ send_break( struct cyclades_port * info, int duration)
 } /* send_break */
 static int
-get_mon_info(struct cyclades_port * info, struct cyclades_monitor * mon)
+get_mon_info(struct cyclades_port * info, struct cyclades_monitor __user * mon)
 {
   if (copy_to_user(mon, &info->mon, sizeof(struct cyclades_monitor)))
@@ -1516,7 +1516,7 @@ get_mon_info(struct cyclades_port * info, struct cyclades_monitor * mon)
 }
 static int
-set_threshold(struct cyclades_port * info, unsigned long *arg)
+set_threshold(struct cyclades_port * info, unsigned long __user *arg)
 {
   volatile unsigned char *base_addr = (u_char *)BASE_ADDR;
   unsigned long value;
@@ -1533,7 +1533,7 @@ set_threshold(struct cyclades_port * info, unsigned long *arg)
 }
 static int
-get_threshold(struct cyclades_port * info, unsigned long *value)
+get_threshold(struct cyclades_port * info, unsigned long __user *value)
 {
   volatile unsigned char *base_addr = (u_char *)BASE_ADDR;
   int channel;
@@ -1546,7 +1546,7 @@ get_threshold(struct cyclades_port * info, unsigned long *value)
 }
 static int
-set_default_threshold(struct cyclades_port * info, unsigned long *arg)
+set_default_threshold(struct cyclades_port * info, unsigned long __user *arg)
 {
   unsigned long value;
@@ -1558,13 +1558,13 @@ set_default_threshold(struct cyclades_port * info, unsigned long *arg)
 }
 static int
-get_default_threshold(struct cyclades_port * info, unsigned long *value)
+get_default_threshold(struct cyclades_port * info, unsigned long __user *value)
 {
   return put_user(info->default_threshold,value);
 }
 static int
-set_timeout(struct cyclades_port * info, unsigned long *arg)
+set_timeout(struct cyclades_port * info, unsigned long __user *arg)
 {
   volatile unsigned char *base_addr = (u_char *)BASE_ADDR;
   int channel;
@@ -1581,7 +1581,7 @@ set_timeout(struct cyclades_port * info, unsigned long *arg)
 }
 static int
-get_timeout(struct cyclades_port * info, unsigned long *value)
+get_timeout(struct cyclades_port * info, unsigned long __user *value)
 {
   volatile unsigned char *base_addr = (u_char *)BASE_ADDR;
   int channel;
@@ -1601,7 +1601,7 @@ set_default_timeout(struct cyclades_port * info, unsigned long value)
 }
 static int
-get_default_timeout(struct cyclades_port * info, unsigned long *value)
+get_default_timeout(struct cyclades_port * info, unsigned long __user *value)
 {
   return put_user(info->default_timeout,value);
 }
@@ -1613,6 +1613,7 @@ cy_ioctl(struct tty_struct *tty, struct file * file,
  unsigned long val;
  struct cyclades_port * info = (struct cyclades_port *)tty->driver_data;
  int ret_val = 0;
+  void __user *argp = (void __user *)arg;
 #ifdef SERIAL_DEBUG_OTHER
    printk("cy_ioctl %s, cmd = %x arg = %lx\n", tty->name, cmd, arg); /* */
@@ -1620,28 +1621,28 @@ cy_ioctl(struct tty_struct *tty, struct file * file,
    switch (cmd) {
        case CYGETMON:
-            ret_val = get_mon_info(info, (struct cyclades_monitor *)arg);
+            ret_val = get_mon_info(info, argp);
            break;
        case CYGETTHRESH:
-            ret_val = get_threshold(info, (unsigned long *)arg);
+            ret_val = get_threshold(info, argp);
            break;
        case CYSETTHRESH:
-            ret_val = set_threshold(info, (unsigned long *)arg);
+            ret_val = set_threshold(info, argp);
            break;
        case CYGETDEFTHRESH:
-            ret_val = get_default_threshold(info, (unsigned long *)arg);
+            ret_val = get_default_threshold(info, argp);
            break;
        case CYSETDEFTHRESH:
-            ret_val = set_default_threshold(info, (unsigned long *)arg);
+            ret_val = set_default_threshold(info, argp);
            break;
        case CYGETTIMEOUT:
-            ret_val = get_timeout(info, (unsigned long *)arg);
+            ret_val = get_timeout(info, argp);
            break;
        case CYSETTIMEOUT:
-            ret_val = set_timeout(info, (unsigned long *)arg);
+            ret_val = set_timeout(info, argp);
            break;
        case CYGETDEFTIMEOUT:
-            ret_val = get_default_timeout(info, (unsigned long *)arg);
+            ret_val = get_default_timeout(info, argp);
            break;
        case CYSETDEFTIMEOUT:
            ret_val = set_default_timeout(info, (unsigned long)arg);
@@ -1664,21 +1665,20 @@ cy_ioctl(struct tty_struct *tty, struct file * file,
 /* The following commands are incompletely implemented!!! */
        case TIOCGSOFTCAR:
-            ret_val = put_user(C_CLOCAL(tty) ? 1 : 0, (unsigned long *) arg);
+            ret_val = put_user(C_CLOCAL(tty) ? 1 : 0, (unsigned long __user *) argp);
            break;
        case TIOCSSOFTCAR:
-            ret_val = get_user(val, (unsigned long *) arg);
+            ret_val = get_user(val, (unsigned long __user *) argp);
            if (ret_val)
                    break;
            tty->termios->c_cflag =
                    ((tty->termios->c_cflag & ~CLOCAL) | (val ? CLOCAL : 0));
            break;
        case TIOCGSERIAL:
-            ret_val = get_serial_info(info, (struct serial_struct *) arg);
+            ret_val = get_serial_info(info, argp);
            break;
        case TIOCSSERIAL:
-            ret_val = set_serial_info(info,
+            ret_val = set_serial_info(info, argp);
-                                   (struct serial_struct *) arg);
            break;
        default:
            ret_val = -ENOIOCTLCMD;
@@ -1773,7 +1773,7 @@ cy_close(struct tty_struct * tty, struct file * filp)
        tty->driver->flush_buffer(tty);
    tty_ldisc_flush(tty);
    info->event = 0;
-    info->tty = 0;
+    info->tty = NULL;
    if (info->blocked_open) {
        if (info->close_delay) {
            msleep_interruptible(jiffies_to_msecs(info->close_delay));
@@ -2250,7 +2250,7 @@ scrn[1] = '\0';
                info->card = index;
                info->line = port_num;
                info->flags = STD_COM_FLAGS;
-                info->tty = 0;
+                info->tty = NULL;
                info->xmit_fifo_size = 12;
                info->cor1 = CyPARITY_NONE|Cy_8_BITS;
                info->cor2 = CyETC;
diff --git a/drivers/char/specialix.c b/drivers/char/specialix.c
index d0b88d0e87fd..7e1bd9562c2a 100644
--- a/drivers/char/specialix.c
+++ b/drivers/char/specialix.c
@@ -183,11 +183,6 @@ static int sx_poll = HZ;
 static struct tty_driver *specialix_driver;
-static unsigned long baud_table[] =  {
-        0, 50, 75, 110, 134, 150, 200, 300, 600, 1200, 1800, 2400, 4800,
-        9600, 19200, 38400, 57600, 115200, 0,
-};
 static struct specialix_board sx_board[SX_NBOARD] =  {
        { 0, SX_IOBASE1,  9, },
        { 0, SX_IOBASE2, 11, },
@@ -1090,9 +1085,9 @@ static void sx_change_speed(struct specialix_board *bp, struct specialix_port *p
        if (baud == 38400) {
                if ((port->flags & ASYNC_SPD_MASK) == ASYNC_SPD_HI)
-                        baud ++;
+                        baud = 57600;
                if ((port->flags & ASYNC_SPD_MASK) == ASYNC_SPD_VHI)
-                        baud += 2;
+                        baud = 115200;
        }
        if (!baud) {
@@ -1150,11 +1145,9 @@ static void sx_change_speed(struct specialix_board *bp, struct specialix_port *p
        sx_out(bp, CD186x_RBPRL, tmp & 0xff);
        sx_out(bp, CD186x_TBPRL, tmp & 0xff);
        spin_unlock_irqrestore(&bp->lock, flags);
-        if (port->custom_divisor) {
+        if (port->custom_divisor)
                baud = (SX_OSCFREQ + port->custom_divisor/2) / port->custom_divisor;
-                baud = ( baud + 5 ) / 10;
+        baud = (baud + 5) / 10;         /* Estimated CPS */
-        } else
-                baud = (baud_table[baud] + 5) / 10;   /* Estimated CPS */
        /* Two timer ticks seems enough to wakeup something like SLIP driver */
        tmp = ((baud + HZ/2) / HZ) * 2 - CD186x_NFIFO;
diff --git a/drivers/char/sx.c b/drivers/char/sx.c
index 5fec626598cd..cc10af08cb05 100644
--- a/drivers/char/sx.c
+++ b/drivers/char/sx.c
@@ -2602,7 +2602,7 @@ static void __exit sx_exit (void)
                }
        }
        if (misc_deregister(&sx_fw_device) < 0) {
-                printk (KERN_INFO "sx: couldn't deregister firmware loader devic\n");
+                printk (KERN_INFO "sx: couldn't deregister firmware loader device\n");
        }
        sx_dprintk (SX_DEBUG_CLEANUP, "Cleaning up drivers (%d)\n", sx_initialized);
        if (sx_initialized)
diff --git a/drivers/char/synclink.c b/drivers/char/synclink.c
index f2864cc64240..06784adcc35c 100644
--- a/drivers/char/synclink.c
+++ b/drivers/char/synclink.c
@@ -133,8 +133,8 @@ static MGSL_PARAMS default_params = {
 };
 #define SHARED_MEM_ADDRESS_SIZE 0x40000
-#define BUFFERLISTSIZE (PAGE_SIZE)
+#define BUFFERLISTSIZE 4096
-#define DMABUFFERSIZE (PAGE_SIZE)
+#define DMABUFFERSIZE 4096
 #define MAXRXFRAMES 7
 typedef struct _DMABUFFERENTRY
diff --git a/drivers/char/tpm/tpm.c b/drivers/char/tpm/tpm.c
index a082a2e34252..6ad2d3bb945c 100644
--- a/drivers/char/tpm/tpm.c
+++ b/drivers/char/tpm/tpm.c
@@ -1153,7 +1153,14 @@ struct tpm_chip *tpm_register_hardware(struct device *dev, const struct tpm_vend
        spin_unlock(&driver_lock);
-        sysfs_create_group(&dev->kobj, chip->vendor.attr_group);
+        if (sysfs_create_group(&dev->kobj, chip->vendor.attr_group)) {
+                list_del(&chip->list);
+                put_device(dev);
+                clear_bit(chip->dev_num, dev_mask);
+                kfree(chip);
+                kfree(devname);
+                return NULL;
+        }
        chip->bios_dir = tpm_bios_log_setup(devname);
diff --git a/drivers/char/tpm/tpm_atmel.c b/drivers/char/tpm/tpm_atmel.c
index ad8ffe49256f..1ab0896070be 100644
--- a/drivers/char/tpm/tpm_atmel.c
+++ b/drivers/char/tpm/tpm_atmel.c
@@ -184,7 +184,9 @@ static int __init init_atmel(void)
        unsigned long base;
        struct  tpm_chip *chip;
-        driver_register(&atml_drv);
+        rc = driver_register(&atml_drv);
+        if (rc)
+                return rc;
        if ((iobase = atmel_get_base_addr(&base, &region_size)) == NULL) {
                rc = -ENODEV;
@@ -195,10 +197,8 @@ static int __init init_atmel(void)
            (atmel_request_region
             (tpm_atmel.base, region_size, "tpm_atmel0") == NULL) ? 0 : 1;
+        pdev = platform_device_register_simple("tpm_atmel", -1, NULL, 0);
-        if (IS_ERR
+        if (IS_ERR(pdev)) {
-            (pdev =
-             platform_device_register_simple("tpm_atmel", -1, NULL, 0))) {
                rc = PTR_ERR(pdev);
                goto err_rel_reg;
        }
diff --git a/drivers/char/tpm/tpm_nsc.c b/drivers/char/tpm/tpm_nsc.c
index 26287aace87d..608f73071bef 100644
--- a/drivers/char/tpm/tpm_nsc.c
+++ b/drivers/char/tpm/tpm_nsc.c
@@ -284,7 +284,7 @@ static struct device_driver nsc_drv = {
 static int __init init_nsc(void)
 {
        int rc = 0;
-        int lo, hi;
+        int lo, hi, err;
        int nscAddrBase = TPM_ADDR;
        struct tpm_chip *chip;
        unsigned long base;
@@ -297,7 +297,9 @@ static int __init init_nsc(void)
                        return -ENODEV;
        }
-        driver_register(&nsc_drv);
+        err = driver_register(&nsc_drv);
+        if (err)
+                return err;
        hi = tpm_read_index(nscAddrBase, TPM_NSC_BASE0_HI);
        lo = tpm_read_index(nscAddrBase, TPM_NSC_BASE0_LO);
diff --git a/drivers/eisa/eisa-bus.c b/drivers/eisa/eisa-bus.c
index 3a365e159d89..d944647c82c2 100644
--- a/drivers/eisa/eisa-bus.c
+++ b/drivers/eisa/eisa-bus.c
@@ -226,14 +226,26 @@ static int __init eisa_init_device (struct eisa_root_device *root,
 static int __init eisa_register_device (struct eisa_device *edev)
 {
-        if (device_register (&edev->dev))
+        int rc = device_register (&edev->dev);
-                return -1;
+        if (rc)
+                return rc;
-        device_create_file (&edev->dev, &dev_attr_signature);
+        rc = device_create_file (&edev->dev, &dev_attr_signature);
-        device_create_file (&edev->dev, &dev_attr_enabled);
+        if (rc) goto err_devreg;
-        device_create_file (&edev->dev, &dev_attr_modalias);
+        rc = device_create_file (&edev->dev, &dev_attr_enabled);
+        if (rc) goto err_sig;
+        rc = device_create_file (&edev->dev, &dev_attr_modalias);
+        if (rc) goto err_enab;
        return 0;
+err_enab:
+        device_remove_file (&edev->dev, &dev_attr_enabled);
+err_sig:
+        device_remove_file (&edev->dev, &dev_attr_signature);
+err_devreg:
+        device_unregister(&edev->dev);
+        return rc;
 }
 static int __init eisa_request_resources (struct eisa_root_device *root,
diff --git a/drivers/firmware/dell_rbu.c b/drivers/firmware/dell_rbu.c
index fc17599c905e..08b161798443 100644
--- a/drivers/firmware/dell_rbu.c
+++ b/drivers/firmware/dell_rbu.c
@@ -249,7 +249,7 @@ static int packetize_data(void *data, size_t length)
                if ((rc = create_packet(temp, packet_length)))
                        return rc;
-                pr_debug("%p:%lu\n", temp, (end - temp));
+                pr_debug("%p:%td\n", temp, (end - temp));
                temp += packet_length;
        }
@@ -718,14 +718,27 @@ static int __init dcdrbu_init(void)
                return -EIO;
        }
-        sysfs_create_bin_file(&rbu_device->dev.kobj, &rbu_data_attr);
+        rc = sysfs_create_bin_file(&rbu_device->dev.kobj, &rbu_data_attr);
-        sysfs_create_bin_file(&rbu_device->dev.kobj, &rbu_image_type_attr);
+        if (rc)
-        sysfs_create_bin_file(&rbu_device->dev.kobj,
+                goto out_devreg;
+        rc = sysfs_create_bin_file(&rbu_device->dev.kobj, &rbu_image_type_attr);
+        if (rc)
+                goto out_data;
+        rc = sysfs_create_bin_file(&rbu_device->dev.kobj,
                &rbu_packet_size_attr);
+        if (rc)
+                goto out_imtype;
        rbu_data.entry_created = 0;
-        return rc;
+        return 0;
+out_imtype:
+        sysfs_remove_bin_file(&rbu_device->dev.kobj, &rbu_image_type_attr);
+out_data:
+        sysfs_remove_bin_file(&rbu_device->dev.kobj, &rbu_data_attr);
+out_devreg:
+        platform_device_unregister(rbu_device);
+        return rc;
 }
 static __exit void dcdrbu_exit(void)
diff --git a/drivers/firmware/efivars.c b/drivers/firmware/efivars.c
index 8ebce1c03ad7..5ab5e393b882 100644
--- a/drivers/firmware/efivars.c
+++ b/drivers/firmware/efivars.c
@@ -639,7 +639,12 @@ efivar_create_sysfs_entry(unsigned long variable_name_size,
        kobject_set_name(&new_efivar->kobj, "%s", short_name);
        kobj_set_kset_s(new_efivar, vars_subsys);
-        kobject_register(&new_efivar->kobj);
+        i = kobject_register(&new_efivar->kobj);
+        if (i) {
+                kfree(short_name);
+                kfree(new_efivar);
+                return 1;
+        }
        kfree(short_name);
        short_name = NULL;
diff --git a/drivers/ide/ide-cd.c b/drivers/ide/ide-cd.c
index 69bbb6206a00..bddfebdf91d8 100644
--- a/drivers/ide/ide-cd.c
+++ b/drivers/ide/ide-cd.c
@@ -597,7 +597,7 @@ static void cdrom_prepare_request(ide_drive_t *drive, struct request *rq)
        struct cdrom_info *cd = drive->driver_data;
        ide_init_drive_cmd(rq);
-        rq->cmd_type = REQ_TYPE_BLOCK_PC;
+        rq->cmd_type = REQ_TYPE_ATA_PC;
        rq->rq_disk = cd->disk;
 }
@@ -716,7 +716,7 @@ static int cdrom_decode_status(ide_drive_t *drive, int good_stat, int *stat_ret)
                ide_error(drive, "request sense failure", stat);
                return 1;
-        } else if (blk_pc_request(rq)) {
+        } else if (blk_pc_request(rq) || rq->cmd_type == REQ_TYPE_ATA_PC) {
                /* All other functions, except for READ. */
                unsigned long flags;
@@ -2023,7 +2023,8 @@ ide_do_rw_cdrom (ide_drive_t *drive, struct request *rq, sector_t block)
                }
                info->last_block = block;
                return action;
-        } else if (rq->cmd_type == REQ_TYPE_SENSE) {
+        } else if (rq->cmd_type == REQ_TYPE_SENSE ||
+                   rq->cmd_type == REQ_TYPE_ATA_PC) {
                return cdrom_do_packet_command(drive);
        } else if (blk_pc_request(rq)) {
                return cdrom_do_block_pc(drive, rq);
diff --git a/drivers/ide/ide-taskfile.c b/drivers/ide/ide-taskfile.c
index 1d0470c1f957..30175c7688e8 100644
--- a/drivers/ide/ide-taskfile.c
+++ b/drivers/ide/ide-taskfile.c
@@ -524,8 +524,8 @@ int ide_taskfile_ioctl (ide_drive_t *drive, unsigned int cmd, unsigned long arg)
        task_ioreg_t *hobsptr   = args.hobRegister;
        int err                 = 0;
        int tasksize            = sizeof(struct ide_task_request_s);
-        int taskin              = 0;
+        unsigned int taskin     = 0;
-        int taskout             = 0;
+        unsigned int taskout    = 0;
        u8 io_32bit             = drive->io_32bit;
        char __user *buf = (char __user *)arg;
@@ -538,8 +538,13 @@ int ide_taskfile_ioctl (ide_drive_t *drive, unsigned int cmd, unsigned long arg)
                return -EFAULT;
        }
-        taskout = (int) req_task->out_size;
+        taskout = req_task->out_size;
-        taskin  = (int) req_task->in_size;
+        taskin  = req_task->in_size;
+        
+        if (taskin > 65536 || taskout > 65536) {
+                err = -EINVAL;
+                goto abort;
+        }
        if (taskout) {
                int outtotal = tasksize;
diff --git a/drivers/ide/pci/generic.c b/drivers/ide/pci/generic.c
index 965c43659e35..5b77a5bcbf0c 100644
--- a/drivers/ide/pci/generic.c
+++ b/drivers/ide/pci/generic.c
@@ -237,10 +237,12 @@ static int __devinit generic_init_one(struct pci_dev *dev, const struct pci_devi
        if (dev->vendor == PCI_VENDOR_ID_JMICRON && PCI_FUNC(dev->devfn) != 1)
                goto out;
-        pci_read_config_word(dev, PCI_COMMAND, &command);
+        if (dev->vendor != PCI_VENDOR_ID_JMICRON) {
-        if (!(command & PCI_COMMAND_IO)) {
+                pci_read_config_word(dev, PCI_COMMAND, &command);
-                printk(KERN_INFO "Skipping disabled %s IDE controller.\n", d->name);
+                if (!(command & PCI_COMMAND_IO)) {
-                goto out;
+                        printk(KERN_INFO "Skipping disabled %s IDE controller.\n", d->name);
+                        goto out;
+                }
        }
        ret = ide_setup_pci_device(dev, d);
 out:
diff --git a/drivers/ide/pci/sgiioc4.c b/drivers/ide/pci/sgiioc4.c
index f3fe287fbd89..244f7eb7006d 100644
--- a/drivers/ide/pci/sgiioc4.c
+++ b/drivers/ide/pci/sgiioc4.c
@@ -774,7 +774,7 @@ ioc4_ide_exit(void)
        ioc4_unregister_submodule(&ioc4_ide_submodule);
 }
-module_init(ioc4_ide_init);
+late_initcall(ioc4_ide_init); /* Call only after IDE init is done */
 module_exit(ioc4_ide_exit);
 MODULE_AUTHOR("Aniket Malatpure/Jeremy Higdon");
diff --git a/drivers/input/misc/hp_sdc_rtc.c b/drivers/input/misc/hp_sdc_rtc.c
index 1be963961c15..ab4da79ee560 100644
--- a/drivers/input/misc/hp_sdc_rtc.c
+++ b/drivers/input/misc/hp_sdc_rtc.c
@@ -60,7 +60,7 @@ static struct fasync_struct *hp_sdc_rtc_async_queue;
 static DECLARE_WAIT_QUEUE_HEAD(hp_sdc_rtc_wait);
-static ssize_t hp_sdc_rtc_read(struct file *file, char *buf,
+static ssize_t hp_sdc_rtc_read(struct file *file, char __user *buf,
                               size_t count, loff_t *ppos);
 static int hp_sdc_rtc_ioctl(struct inode *inode, struct file *file,
@@ -385,14 +385,14 @@ static int hp_sdc_rtc_set_i8042timer (struct timeval *setto, uint8_t setcmd)
        return 0;
 }
-static ssize_t hp_sdc_rtc_read(struct file *file, char *buf,
+static ssize_t hp_sdc_rtc_read(struct file *file, char __user *buf,
                               size_t count, loff_t *ppos) {
        ssize_t retval;
        if (count < sizeof(unsigned long))
                return -EINVAL;
-        retval = put_user(68, (unsigned long *)buf);
+        retval = put_user(68, (unsigned long __user *)buf);
        return retval;
 }
@@ -696,7 +696,7 @@ static int __init hp_sdc_rtc_init(void)
        if ((ret = hp_sdc_request_timer_irq(&hp_sdc_rtc_isr)))
                return ret;
        misc_register(&hp_sdc_rtc_dev);
-        create_proc_read_entry ("driver/rtc", 0, 0, 
+        create_proc_read_entry ("driver/rtc", 0, NULL,
                                hp_sdc_rtc_read_proc, NULL);
        printk(KERN_INFO "HP i8042 SDC + MSM-58321 RTC support loaded "
diff --git a/drivers/input/misc/wistron_btns.c b/drivers/input/misc/wistron_btns.c
index 4639537336fc..7b9d1c1da41a 100644
--- a/drivers/input/misc/wistron_btns.c
+++ b/drivers/input/misc/wistron_btns.c
@@ -17,7 +17,7 @@
 * with this program; if not, write to the Free Software Foundation, Inc.,
 * 59 Temple Place Suite 330, Boston, MA 02111-1307, USA.
 */
-#include <asm/io.h>
+#include <linux/io.h>
 #include <linux/dmi.h>
 #include <linux/init.h>
 #include <linux/input.h>
diff --git a/drivers/input/serio/hil_mlc.c b/drivers/input/serio/hil_mlc.c
index bdfde046b741..49e11e2c1d5d 100644
--- a/drivers/input/serio/hil_mlc.c
+++ b/drivers/input/serio/hil_mlc.c
@@ -391,23 +391,23 @@ static int hilse_operate(hil_mlc *mlc, int repoll) {
 }
 #define FUNC(funct, funct_arg, zero_rc, neg_rc, pos_rc) \
-{ HILSE_FUNC,           { func: &funct }, funct_arg, zero_rc, neg_rc, pos_rc },
+{ HILSE_FUNC,           { .func = funct }, funct_arg, zero_rc, neg_rc, pos_rc },
 #define OUT(pack) \
-{ HILSE_OUT,            { packet: pack }, 0, HILSEN_NEXT, HILSEN_DOZE, 0 },
+{ HILSE_OUT,            { .packet = pack }, 0, HILSEN_NEXT, HILSEN_DOZE, 0 },
 #define CTS \
-{ HILSE_CTS,            { packet: 0    }, 0, HILSEN_NEXT | HILSEN_SCHED | HILSEN_BREAK, HILSEN_DOZE, 0 },
+{ HILSE_CTS,            { .packet = 0    }, 0, HILSEN_NEXT | HILSEN_SCHED | HILSEN_BREAK, HILSEN_DOZE, 0 },
 #define EXPECT(comp, to, got, got_wrong, timed_out) \
-{ HILSE_EXPECT,         { packet: comp }, to, got, got_wrong, timed_out },
+{ HILSE_EXPECT,         { .packet = comp }, to, got, got_wrong, timed_out },
 #define EXPECT_LAST(comp, to, got, got_wrong, timed_out) \
-{ HILSE_EXPECT_LAST,    { packet: comp }, to, got, got_wrong, timed_out },
+{ HILSE_EXPECT_LAST,    { .packet = comp }, to, got, got_wrong, timed_out },
 #define EXPECT_DISC(comp, to, got, got_wrong, timed_out) \
-{ HILSE_EXPECT_DISC,    { packet: comp }, to, got, got_wrong, timed_out },
+{ HILSE_EXPECT_DISC,    { .packet = comp }, to, got, got_wrong, timed_out },
 #define IN(to, got, got_error, timed_out) \
-{ HILSE_IN,             { packet: 0    }, to, got, got_error, timed_out },
+{ HILSE_IN,             { .packet = 0    }, to, got, got_error, timed_out },
 #define OUT_DISC(pack) \
-{ HILSE_OUT_DISC,       { packet: pack }, 0, 0, 0, 0 },
+{ HILSE_OUT_DISC,       { .packet = pack }, 0, 0, 0, 0 },
 #define OUT_LAST(pack) \
-{ HILSE_OUT_LAST,       { packet: pack }, 0, 0, 0, 0 },
+{ HILSE_OUT_LAST,       { .packet = pack }, 0, 0, 0, 0 },
 struct hilse_node hil_mlc_se[HILSEN_END] = {
diff --git a/drivers/input/serio/hp_sdc.c b/drivers/input/serio/hp_sdc.c
index ba7b920347e3..9907ad3bea23 100644
--- a/drivers/input/serio/hp_sdc.c
+++ b/drivers/input/serio/hp_sdc.c
@@ -310,7 +310,7 @@ static void hp_sdc_tasklet(unsigned long foo) {
                                 * in tasklet/bh context.
                                 */
                                if (curr->act.irqhook) 
-                                        curr->act.irqhook(0, 0, 0, 0);
+                                        curr->act.irqhook(0, NULL, 0, 0);
                        }
                        curr->actidx = curr->idx;
                        curr->idx++;
@@ -525,7 +525,7 @@ actdone:
                up(curr->act.semaphore);
        }
        else if (act & HP_SDC_ACT_CALLBACK) {
-                curr->act.irqhook(0,0,0,0);
+                curr->act.irqhook(0,NULL,0,0);
        }
        if (curr->idx >= curr->endidx) { /* This transaction is over. */
                if (act & HP_SDC_ACT_DEALLOC) kfree(curr);
diff --git a/drivers/isdn/capi/capidrv.c b/drivers/isdn/capi/capidrv.c
index d10c8b82e6aa..b6f9476c0501 100644
--- a/drivers/isdn/capi/capidrv.c
+++ b/drivers/isdn/capi/capidrv.c
@@ -1907,7 +1907,8 @@ static int if_readstat(u8 __user *buf, int len, int id, int channel)
        }
        for (p=buf, count=0; count < len; p++, count++) {
-                put_user(*card->q931_read++, p);
+                if (put_user(*card->q931_read++, p))
+                        return -EFAULT;
                if (card->q931_read > card->q931_end)
                        card->q931_read = card->q931_buf;
        }
diff --git a/drivers/isdn/hisax/config.c b/drivers/isdn/hisax/config.c
index e4823ab2b127..785b08554fca 100644
--- a/drivers/isdn/hisax/config.c
+++ b/drivers/isdn/hisax/config.c
@@ -631,7 +631,8 @@ static int HiSax_readstatus(u_char __user *buf, int len, int id, int channel)
                count = cs->status_end - cs->status_read + 1;
                if (count >= len)
                        count = len;
-                copy_to_user(p, cs->status_read, count);
+                if (copy_to_user(p, cs->status_read, count))
+                        return -EFAULT;
                cs->status_read += count;
                if (cs->status_read > cs->status_end)
                        cs->status_read = cs->status_buf;
@@ -642,7 +643,8 @@ static int HiSax_readstatus(u_char __user *buf, int len, int id, int channel)
                                cnt = HISAX_STATUS_BUFSIZE;
                        else
                                cnt = count;
-                        copy_to_user(p, cs->status_read, cnt);
+                        if (copy_to_user(p, cs->status_read, cnt))
+                                return -EFAULT;
                        p += cnt;
                        cs->status_read += cnt % HISAX_STATUS_BUFSIZE;
                        count -= cnt;
diff --git a/drivers/isdn/hysdn/boardergo.c b/drivers/isdn/hysdn/boardergo.c
index 160f22fa5941..8bbe33ae06db 100644
--- a/drivers/isdn/hysdn/boardergo.c
+++ b/drivers/isdn/hysdn/boardergo.c
@@ -45,11 +45,10 @@ ergo_interrupt(int intno, void *dev_id)
        if (!card->irq_enabled)
                return IRQ_NONE;                /* other device interrupting or irq switched off */
-        save_flags(flags);
+        spin_lock_irqsave(&card->hysdn_lock, flags); /* no further irqs allowed */
-        cli();                  /* no further irqs allowed */
        if (!(bytein(card->iobase + PCI9050_INTR_REG) & PCI9050_INTR_REG_STAT1)) {
-                restore_flags(flags);   /* restore old state */
+                spin_unlock_irqrestore(&card->hysdn_lock, flags);       /* restore old state */
                return IRQ_NONE;                /* no interrupt requested by E1 */
        }
        /* clear any pending ints on the board */
@@ -61,7 +60,7 @@ ergo_interrupt(int intno, void *dev_id)
        /* start kernel task immediately after leaving all interrupts */
        if (!card->hw_lock)
                schedule_work(&card->irq_queue);
-        restore_flags(flags);
+        spin_unlock_irqrestore(&card->hysdn_lock, flags);
        return IRQ_HANDLED;
 }                               /* ergo_interrupt */
@@ -83,10 +82,9 @@ ergo_irq_bh(hysdn_card * card)
        dpr = card->dpram;      /* point to DPRAM */
-        save_flags(flags);
+        spin_lock_irqsave(&card->hysdn_lock, flags);
-        cli();
        if (card->hw_lock) {
-                restore_flags(flags);   /* hardware currently unavailable */
+                spin_unlock_irqrestore(&card->hysdn_lock, flags);       /* hardware currently unavailable */
                return;
        }
        card->hw_lock = 1;      /* we now lock the hardware */
@@ -120,7 +118,7 @@ ergo_irq_bh(hysdn_card * card)
                        card->hw_lock = 0;      /* free hardware again */
        } while (again);        /* until nothing more to do */
-        restore_flags(flags);
+        spin_unlock_irqrestore(&card->hysdn_lock, flags);
 }                               /* ergo_irq_bh */
@@ -137,8 +135,7 @@ ergo_stopcard(hysdn_card * card)
 #ifdef CONFIG_HYSDN_CAPI
        hycapi_capi_stop(card);
 #endif /* CONFIG_HYSDN_CAPI */
-        save_flags(flags);
+        spin_lock_irqsave(&card->hysdn_lock, flags);
-        cli();
        val = bytein(card->iobase + PCI9050_INTR_REG);  /* get actual value */
        val &= ~(PCI9050_INTR_REG_ENPCI | PCI9050_INTR_REG_EN1);        /* mask irq */
        byteout(card->iobase + PCI9050_INTR_REG, val);
@@ -147,7 +144,7 @@ ergo_stopcard(hysdn_card * card)
        card->state = CARD_STATE_UNUSED;
        card->err_log_state = ERRLOG_STATE_OFF;         /* currently no log active */
-        restore_flags(flags);
+        spin_unlock_irqrestore(&card->hysdn_lock, flags);
 }                               /* ergo_stopcard */
 /**************************************************************************/
@@ -162,12 +159,11 @@ ergo_set_errlog_state(hysdn_card * card, int on)
                card->err_log_state = ERRLOG_STATE_OFF;         /* must be off */
                return;
        }
-        save_flags(flags);
+        spin_lock_irqsave(&card->hysdn_lock, flags);
-        cli();
        if (((card->err_log_state == ERRLOG_STATE_OFF) && !on) ||
            ((card->err_log_state == ERRLOG_STATE_ON) && on)) {
-                restore_flags(flags);
+                spin_unlock_irqrestore(&card->hysdn_lock, flags);
                return;         /* nothing to do */
        }
        if (on)
@@ -175,7 +171,7 @@ ergo_set_errlog_state(hysdn_card * card, int on)
        else
                card->err_log_state = ERRLOG_STATE_STOP;        /* request stop */
-        restore_flags(flags);
+        spin_unlock_irqrestore(&card->hysdn_lock, flags);
        schedule_work(&card->irq_queue);
 }                               /* ergo_set_errlog_state */
@@ -356,8 +352,7 @@ ergo_waitpofready(struct HYSDN_CARD *card)
                        if (card->debug_flags & LOG_POF_RECORD)
                                hysdn_addlog(card, "ERGO: pof boot success");
-                        save_flags(flags);
+                        spin_lock_irqsave(&card->hysdn_lock, flags);
-                        cli();
                        card->state = CARD_STATE_RUN;   /* now card is running */
                        /* enable the cards interrupt */
@@ -370,7 +365,7 @@ ergo_waitpofready(struct HYSDN_CARD *card)
                        dpr->ToHyInt = 1;
                        dpr->ToPcInt = 1;       /* interrupt to E1 for all cards */
-                        restore_flags(flags);
+                        spin_unlock_irqrestore(&card->hysdn_lock, flags);
                        if ((hynet_enable & (1 << card->myid)) 
                            && (i = hysdn_net_create(card))) 
                        {
@@ -448,6 +443,7 @@ ergo_inithardware(hysdn_card * card)
        card->waitpofready = ergo_waitpofready;
        card->set_errlog_state = ergo_set_errlog_state;
        INIT_WORK(&card->irq_queue, (void *) (void *) ergo_irq_bh, card);
+        card->hysdn_lock = SPIN_LOCK_UNLOCKED;
        return (0);
 }                               /* ergo_inithardware */
diff --git a/drivers/isdn/hysdn/hysdn_defs.h b/drivers/isdn/hysdn/hysdn_defs.h
index 461e831592dd..729df4089385 100644
--- a/drivers/isdn/hysdn/hysdn_defs.h
+++ b/drivers/isdn/hysdn/hysdn_defs.h
@@ -188,6 +188,8 @@ typedef struct HYSDN_CARD {
        /* init and deinit stopcard for booting, too */
        void (*stopcard) (struct HYSDN_CARD *);
        void (*releasehardware) (struct HYSDN_CARD *);
+        spinlock_t hysdn_lock;
 #ifdef CONFIG_HYSDN_CAPI
        struct hycapictrl_info {
                char cardname[32];
diff --git a/drivers/isdn/hysdn/hysdn_proclog.c b/drivers/isdn/hysdn/hysdn_proclog.c
index c4301e8338ef..fcd49920b220 100644
--- a/drivers/isdn/hysdn/hysdn_proclog.c
+++ b/drivers/isdn/hysdn/hysdn_proclog.c
@@ -116,8 +116,7 @@ put_log_buffer(hysdn_card * card, char *cp)
        strcpy(ib->log_start, cp);      /* set output string */
        ib->next = NULL;
        ib->proc_ctrl = pd;     /* point to own control structure */
-        save_flags(flags);
+        spin_lock_irqsave(&card->hysdn_lock, flags);
-        cli();
        ib->usage_cnt = pd->if_used;
        if (!pd->log_head)
                pd->log_head = ib;      /* new head */
@@ -125,7 +124,7 @@ put_log_buffer(hysdn_card * card, char *cp)
                pd->log_tail->next = ib;        /* follows existing messages */
        pd->log_tail = ib;      /* new tail */
        i = pd->del_lock++;     /* get lock state */
-        restore_flags(flags);
+        spin_unlock_irqrestore(&card->hysdn_lock, flags);
        /* delete old entrys */
        if (!i)
@@ -270,14 +269,13 @@ hysdn_log_open(struct inode *ino, struct file *filep)
        } else if ((filep->f_mode & (FMODE_READ | FMODE_WRITE)) == FMODE_READ) {
                /* read access -> log/debug read */
-                save_flags(flags);
+                spin_lock_irqsave(&card->hysdn_lock, flags);
-                cli();
                pd->if_used++;
                if (pd->log_head)
                        filep->private_data = &pd->log_tail->next;
                else
                        filep->private_data = &pd->log_head;
-                restore_flags(flags);
+                spin_unlock_irqrestore(&card->hysdn_lock, flags);
        } else {                /* simultaneous read/write access forbidden ! */
                unlock_kernel();
                return (-EPERM);        /* no permission this time */
@@ -301,7 +299,7 @@ hysdn_log_close(struct inode *ino, struct file *filep)
        hysdn_card *card;
        int retval = 0;
        unsigned long flags;
+        spinlock_t hysdn_lock = SPIN_LOCK_UNLOCKED;
        lock_kernel();
        if ((filep->f_mode & (FMODE_READ | FMODE_WRITE)) == FMODE_WRITE) {
@@ -311,8 +309,7 @@ hysdn_log_close(struct inode *ino, struct file *filep)
                /* read access -> log/debug read, mark one further file as closed */
                pd = NULL;
-                save_flags(flags);
+                spin_lock_irqsave(&hysdn_lock, flags);
-                cli();
                inf = *((struct log_data **) filep->private_data);      /* get first log entry */
                if (inf)
                        pd = (struct procdata *) inf->proc_ctrl;        /* still entries there */
@@ -335,7 +332,7 @@ hysdn_log_close(struct inode *ino, struct file *filep)
                        inf->usage_cnt--;       /* decrement usage count for buffers */
                        inf = inf->next;
                }
-                restore_flags(flags);
+                spin_unlock_irqrestore(&hysdn_lock, flags);
                if (pd)
                        if (pd->if_used <= 0)   /* delete buffers if last file closed */
diff --git a/drivers/isdn/hysdn/hysdn_sched.c b/drivers/isdn/hysdn/hysdn_sched.c
index 1c0d54ac12ab..1fadf0133e9b 100644
--- a/drivers/isdn/hysdn/hysdn_sched.c
+++ b/drivers/isdn/hysdn/hysdn_sched.c
@@ -155,8 +155,7 @@ hysdn_tx_cfgline(hysdn_card *card, unsigned char *line, unsigned short chan)
        if (card->debug_flags & LOG_SCHED_ASYN)
                hysdn_addlog(card, "async tx-cfg chan=%d len=%d", chan, strlen(line) + 1);
-        save_flags(flags);
+        spin_lock_irqsave(&card->hysdn_lock, flags);
-        cli();
        while (card->async_busy) {
                sti();
@@ -165,7 +164,7 @@ hysdn_tx_cfgline(hysdn_card *card, unsigned char *line, unsigned short chan)
                msleep_interruptible(20);               /* Timeout 20ms */
                if (!--cnt) {
-                        restore_flags(flags);
+                        spin_unlock_irqrestore(&card->hysdn_lock, flags);
                        return (-ERR_ASYNC_TIME);       /* timed out */
                }
                cli();
@@ -194,13 +193,13 @@ hysdn_tx_cfgline(hysdn_card *card, unsigned char *line, unsigned short chan)
                msleep_interruptible(20);               /* Timeout 20ms */
                if (!--cnt) {
-                        restore_flags(flags);
+                        spin_unlock_irqrestore(&card->hysdn_lock, flags);
                        return (-ERR_ASYNC_TIME);       /* timed out */
                }
                cli();
        }                       /* wait for buffer to become free again */
-        restore_flags(flags);
+        spin_unlock_irqrestore(&card->hysdn_lock, flags);
        if (card->debug_flags & LOG_SCHED_ASYN)
                hysdn_addlog(card, "async tx-cfg data send");
diff --git a/drivers/isdn/i4l/isdn_common.c b/drivers/isdn/i4l/isdn_common.c
index c3d79eef9e32..69aee2602aa6 100644
--- a/drivers/isdn/i4l/isdn_common.c
+++ b/drivers/isdn/i4l/isdn_common.c
@@ -1134,9 +1134,12 @@ isdn_read(struct file *file, char __user *buf, size_t count, loff_t * off)
                if (dev->drv[drvidx]->interface->readstat) {
                        if (count > dev->drv[drvidx]->stavail)
                                count = dev->drv[drvidx]->stavail;
-                        len = dev->drv[drvidx]->interface->
+                        len = dev->drv[drvidx]->interface->readstat(buf, count,
-                                readstat(buf, count, drvidx,
+                                                drvidx, isdn_minor2chan(minor));
-                                         isdn_minor2chan(minor));
+                        if (len < 0) {
+                                retval = len;
+                                goto out;
+                        }
                } else {
                        len = 0;
                }
diff --git a/drivers/isdn/icn/icn.c b/drivers/isdn/icn/icn.c
index 6649f8bc9951..730bbd07ebc7 100644
--- a/drivers/isdn/icn/icn.c
+++ b/drivers/isdn/icn/icn.c
@@ -1010,7 +1010,8 @@ icn_readstatus(u_char __user *buf, int len, icn_card * card)
        for (p = buf, count = 0; count < len; p++, count++) {
                if (card->msg_buf_read == card->msg_buf_write)
                        return count;
-                put_user(*card->msg_buf_read++, p);
+                if (put_user(*card->msg_buf_read++, p))
+                        return -EFAULT;
                if (card->msg_buf_read > card->msg_buf_end)
                        card->msg_buf_read = card->msg_buf;
        }
diff --git a/drivers/isdn/isdnloop/isdnloop.c b/drivers/isdn/isdnloop/isdnloop.c
index fabbd461603e..c3ae2edaf6fa 100644
--- a/drivers/isdn/isdnloop/isdnloop.c
+++ b/drivers/isdn/isdnloop/isdnloop.c
@@ -100,12 +100,11 @@ isdnloop_pollbchan(unsigned long data)
                isdnloop_bchan_send(card, 1);
        if (card->flags & (ISDNLOOP_FLAGS_B1ACTIVE | ISDNLOOP_FLAGS_B2ACTIVE)) {
                /* schedule b-channel polling again */
-                save_flags(flags);
+                spin_lock_irqsave(&card->isdnloop_lock, flags);
-                cli();
                card->rb_timer.expires = jiffies + ISDNLOOP_TIMER_BCREAD;
                add_timer(&card->rb_timer);
                card->flags |= ISDNLOOP_FLAGS_RBTIMER;
-                restore_flags(flags);
+                spin_unlock_irqrestore(&card->isdnloop_lock, flags);
        } else
                card->flags &= ~ISDNLOOP_FLAGS_RBTIMER;
 }
@@ -281,8 +280,7 @@ isdnloop_putmsg(isdnloop_card * card, unsigned char c)
 {
        ulong flags;
-        save_flags(flags);
+        spin_lock_irqsave(&card->isdnloop_lock, flags);
-        cli();
        *card->msg_buf_write++ = (c == 0xff) ? '\n' : c;
        if (card->msg_buf_write == card->msg_buf_read) {
                if (++card->msg_buf_read > card->msg_buf_end)
@@ -290,7 +288,7 @@ isdnloop_putmsg(isdnloop_card * card, unsigned char c)
        }
        if (card->msg_buf_write > card->msg_buf_end)
                card->msg_buf_write = card->msg_buf;
-        restore_flags(flags);
+        spin_unlock_irqrestore(&card->isdnloop_lock, flags);
 }
 /*
@@ -372,21 +370,19 @@ isdnloop_polldchan(unsigned long data)
                if (!(card->flags & ISDNLOOP_FLAGS_RBTIMER)) {
                        /* schedule b-channel polling */
                        card->flags |= ISDNLOOP_FLAGS_RBTIMER;
-                        save_flags(flags);
+                        spin_lock_irqsave(&card->isdnloop_lock, flags);
-                        cli();
                        del_timer(&card->rb_timer);
                        card->rb_timer.function = isdnloop_pollbchan;
                        card->rb_timer.data = (unsigned long) card;
                        card->rb_timer.expires = jiffies + ISDNLOOP_TIMER_BCREAD;
                        add_timer(&card->rb_timer);
-                        restore_flags(flags);
+                        spin_unlock_irqrestore(&card->isdnloop_lock, flags);
                }
        /* schedule again */
-        save_flags(flags);
+        spin_lock_irqsave(&card->isdnloop_lock, flags);
-        cli();
        card->st_timer.expires = jiffies + ISDNLOOP_TIMER_DCREAD;
        add_timer(&card->st_timer);
-        restore_flags(flags);
+        spin_unlock_irqrestore(&card->isdnloop_lock, flags);
 }
 /*
@@ -416,8 +412,7 @@ isdnloop_sendbuf(int channel, struct sk_buff *skb, isdnloop_card * card)
                        return 0;
                if (card->sndcount[channel] > ISDNLOOP_MAX_SQUEUE)
                        return 0;
-                save_flags(flags);
+                spin_lock_irqsave(&card->isdnloop_lock, flags);
-                cli();
                nskb = dev_alloc_skb(skb->len);
                if (nskb) {
                        memcpy(skb_put(nskb, len), skb->data, len);
@@ -426,7 +421,7 @@ isdnloop_sendbuf(int channel, struct sk_buff *skb, isdnloop_card * card)
                } else
                        len = 0;
                card->sndcount[channel] += len;
-                restore_flags(flags);
+                spin_unlock_irqrestore(&card->isdnloop_lock, flags);
        }
        return len;
 }
@@ -451,7 +446,8 @@ isdnloop_readstatus(u_char __user *buf, int len, isdnloop_card * card)
        for (p = buf, count = 0; count < len; p++, count++) {
                if (card->msg_buf_read == card->msg_buf_write)
                        return count;
-                put_user(*card->msg_buf_read++, p);
+                if (put_user(*card->msg_buf_read++, p))
+                        return -EFAULT;
                if (card->msg_buf_read > card->msg_buf_end)
                        card->msg_buf_read = card->msg_buf;
        }
@@ -576,8 +572,7 @@ isdnloop_atimeout(isdnloop_card * card, int ch)
        unsigned long flags;
        char buf[60];
-        save_flags(flags);
+        spin_lock_irqsave(&card->isdnloop_lock, flags);
-        cli();
        if (card->rcard) {
                isdnloop_fake(card->rcard[ch], "DDIS_I", card->rch[ch] + 1);
                card->rcard[ch]->rcard[card->rch[ch]] = NULL;
@@ -587,7 +582,7 @@ isdnloop_atimeout(isdnloop_card * card, int ch)
        /* No user responding */
        sprintf(buf, "CAU%s", isdnloop_unicause(card, 1, 3));
        isdnloop_fake(card, buf, ch + 1);
-        restore_flags(flags);
+        spin_unlock_irqrestore(&card->isdnloop_lock, flags);
 }
 /*
@@ -622,8 +617,7 @@ isdnloop_start_ctimer(isdnloop_card * card, int ch)
 {
        unsigned long flags;
-        save_flags(flags);
+        spin_lock_irqsave(&card->isdnloop_lock, flags);
-        cli();
        init_timer(&card->c_timer[ch]);
        card->c_timer[ch].expires = jiffies + ISDNLOOP_TIMER_ALERTWAIT;
        if (ch)
@@ -632,7 +626,7 @@ isdnloop_start_ctimer(isdnloop_card * card, int ch)
                card->c_timer[ch].function = isdnloop_atimeout0;
        card->c_timer[ch].data = (unsigned long) card;
        add_timer(&card->c_timer[ch]);
-        restore_flags(flags);
+        spin_unlock_irqrestore(&card->isdnloop_lock, flags);
 }
 /*
@@ -647,10 +641,9 @@ isdnloop_kill_ctimer(isdnloop_card * card, int ch)
 {
        unsigned long flags;
-        save_flags(flags);
+        spin_lock_irqsave(&card->isdnloop_lock, flags);
-        cli();
        del_timer(&card->c_timer[ch]);
-        restore_flags(flags);
+        spin_unlock_irqrestore(&card->isdnloop_lock, flags);
 }
 static u_char si2bit[] =
@@ -706,13 +699,12 @@ isdnloop_try_call(isdnloop_card * card, char *p, int lch, isdn_ctrl * cmd)
                                        }
                        }
                        if (num_match) {
-                                save_flags(flags);
+                                spin_lock_irqsave(&card->isdnloop_lock, flags);
-                                cli();
                                /* channel idle? */
                                if (!(cc->rcard[ch])) {
                                        /* Check SI */
                                        if (!(si2bit[cmd->parm.setup.si1] & cc->sil[ch])) {
-                                                restore_flags(flags);
+                                                spin_unlock_irqrestore(&card->isdnloop_lock, flags);
                                                return 3;
                                        }
                                        /* ch is idle, si and number matches */
@@ -720,10 +712,10 @@ isdnloop_try_call(isdnloop_card * card, char *p, int lch, isdn_ctrl * cmd)
                                        cc->rch[ch] = lch;
                                        card->rcard[lch] = cc;
                                        card->rch[lch] = ch;
-                                        restore_flags(flags);
+                                        spin_unlock_irqrestore(&card->isdnloop_lock, flags);
                                        return 0;
                                } else {
-                                        restore_flags(flags);
+                                        spin_unlock_irqrestore(&card->isdnloop_lock, flags);
                                        /* num matches, but busy */
                                        if (ch == 1)
                                                return 1;
@@ -1027,8 +1019,7 @@ isdnloop_stopcard(isdnloop_card * card)
        unsigned long flags;
        isdn_ctrl cmd;
-        save_flags(flags);
+        spin_lock_irqsave(&card->isdnloop_lock, flags);
-        cli();
        if (card->flags & ISDNLOOP_FLAGS_RUNNING) {
                card->flags &= ~ISDNLOOP_FLAGS_RUNNING;
                del_timer(&card->st_timer);
@@ -1039,7 +1030,7 @@ isdnloop_stopcard(isdnloop_card * card)
                cmd.driver = card->myid;
                card->interface.statcallb(&cmd);
        }
-        restore_flags(flags);
+        spin_unlock_irqrestore(&card->isdnloop_lock, flags);
 }
 /*
@@ -1078,18 +1069,17 @@ isdnloop_start(isdnloop_card * card, isdnloop_sdef * sdefp)
                return -EBUSY;
        if (copy_from_user((char *) &sdef, (char *) sdefp, sizeof(sdef)))
                return -EFAULT;
-        save_flags(flags);
+        spin_lock_irqsave(&card->isdnloop_lock, flags);
-        cli();
        switch (sdef.ptype) {
                case ISDN_PTYPE_EURO:
                        if (isdnloop_fake(card, "DRV1.23EC-Q.931-CAPI-CNS-BASIS-20.02.96",
                                          -1)) {
-                                restore_flags(flags);
+                                spin_unlock_irqrestore(&card->isdnloop_lock, flags);
                                return -ENOMEM;
                        }
                        card->sil[0] = card->sil[1] = 4;
                        if (isdnloop_fake(card, "TEI OK", 0)) {
-                                restore_flags(flags);
+                                spin_unlock_irqrestore(&card->isdnloop_lock, flags);
                                return -ENOMEM;
                        }
                        for (i = 0; i < 3; i++)
@@ -1098,12 +1088,12 @@ isdnloop_start(isdnloop_card * card, isdnloop_sdef * sdefp)
                case ISDN_PTYPE_1TR6:
                        if (isdnloop_fake(card, "DRV1.04TC-1TR6-CAPI-CNS-BASIS-29.11.95",
                                          -1)) {
-                                restore_flags(flags);
+                                spin_unlock_irqrestore(&card->isdnloop_lock, flags);
                                return -ENOMEM;
                        }
                        card->sil[0] = card->sil[1] = 4;
                        if (isdnloop_fake(card, "TEI OK", 0)) {
-                                restore_flags(flags);
+                                spin_unlock_irqrestore(&card->isdnloop_lock, flags);
                                return -ENOMEM;
                        }
                        strcpy(card->s0num[0], sdef.num[0]);
@@ -1111,7 +1101,7 @@ isdnloop_start(isdnloop_card * card, isdnloop_sdef * sdefp)
                        card->s0num[2][0] = '\0';
                        break;
                default:
-                        restore_flags(flags);
+                        spin_unlock_irqrestore(&card->isdnloop_lock, flags);
                        printk(KERN_WARNING "isdnloop: Illegal D-channel protocol %d\n",
                               sdef.ptype);
                        return -EINVAL;
@@ -1122,7 +1112,7 @@ isdnloop_start(isdnloop_card * card, isdnloop_sdef * sdefp)
        card->st_timer.data = (unsigned long) card;
        add_timer(&card->st_timer);
        card->flags |= ISDNLOOP_FLAGS_RUNNING;
-        restore_flags(flags);
+        spin_unlock_irqrestore(&card->isdnloop_lock, flags);
        return 0;
 }
@@ -1472,6 +1462,7 @@ isdnloop_initcard(char *id)
                skb_queue_head_init(&card->bqueue[i]);
        }
        skb_queue_head_init(&card->dqueue);
+        card->isdnloop_lock = SPIN_LOCK_UNLOCKED;
        card->next = cards;
        cards = card;
        if (!register_isdn(&card->interface)) {
diff --git a/drivers/isdn/isdnloop/isdnloop.h b/drivers/isdn/isdnloop/isdnloop.h
index d699fe53e1c3..0d458a86f529 100644
--- a/drivers/isdn/isdnloop/isdnloop.h
+++ b/drivers/isdn/isdnloop/isdnloop.h
@@ -94,6 +94,7 @@ typedef struct isdnloop_card {
        struct sk_buff_head
         bqueue[ISDNLOOP_BCH];  /* B-Channel queues                 */
        struct sk_buff_head dqueue;     /* D-Channel queue                  */
+        spinlock_t isdnloop_lock;
 } isdnloop_card;
 /*
diff --git a/drivers/isdn/pcbit/drv.c b/drivers/isdn/pcbit/drv.c
index 94f21486bb24..6ead5e1508b7 100644
--- a/drivers/isdn/pcbit/drv.c
+++ b/drivers/isdn/pcbit/drv.c
@@ -725,23 +725,27 @@ static int pcbit_stat(u_char __user *buf, int len, int driver, int channel)
        if (stat_st < stat_end)
        {
-                copy_to_user(buf, statbuf + stat_st, len);
+                if (copy_to_user(buf, statbuf + stat_st, len))
+                        return -EFAULT;
                stat_st += len;    
        }
        else
        {
                if (len > STATBUF_LEN - stat_st)
                {
-                        copy_to_user(buf, statbuf + stat_st, 
+                        if (copy_to_user(buf, statbuf + stat_st,
-                                       STATBUF_LEN - stat_st);
+                                       STATBUF_LEN - stat_st))
-                        copy_to_user(buf, statbuf, 
+                                return -EFAULT;
-                                       len - (STATBUF_LEN - stat_st));
+                        if (copy_to_user(buf, statbuf,
+                                       len - (STATBUF_LEN - stat_st)))
+                                return -EFAULT;
                        stat_st = len - (STATBUF_LEN - stat_st);
                }
                else
                {
-                        copy_to_user(buf, statbuf + stat_st, len);
+                        if (copy_to_user(buf, statbuf + stat_st, len))
+                                return -EFAULT;
                        stat_st += len;
                        
diff --git a/drivers/isdn/pcbit/layer2.c b/drivers/isdn/pcbit/layer2.c
index 13e7d219d1c7..937fd2120381 100644
--- a/drivers/isdn/pcbit/layer2.c
+++ b/drivers/isdn/pcbit/layer2.c
@@ -311,6 +311,7 @@ pcbit_deliver(void *data)
                dev->read_queue = frame->next;
                spin_unlock_irqrestore(&dev->lock, flags);
+                msg = 0;
                SET_MSG_CPU(msg, 0);
                SET_MSG_PROC(msg, 0);
                SET_MSG_CMD(msg, frame->skb->data[2]);
diff --git a/drivers/isdn/sc/init.c b/drivers/isdn/sc/init.c
index 222ca7c08baa..06c9872e8c6a 100644
--- a/drivers/isdn/sc/init.c
+++ b/drivers/isdn/sc/init.c
@@ -98,13 +98,14 @@ static int __init sc_init(void)
                         * Confirm the I/O Address with a test
                         */
                        if(io[b] == 0) {
-                                pr_debug("I/O Address 0x%x is in use.\n");
+                                pr_debug("I/O Address invalid.\n");
                                continue;
                        }
                        outb(0x18, io[b] + 0x400 * EXP_PAGE0);
                        if(inb(io[b] + 0x400 * EXP_PAGE0) != 0x18) {
-                                pr_debug("I/O Base 0x%x fails test\n");
+                                pr_debug("I/O Base 0x%x fails test\n",
+                                         io[b] + 0x400 * EXP_PAGE0);
                                continue;
                        }
                }
@@ -158,8 +159,8 @@ static int __init sc_init(void)
                        outb(0xFF, io[b] + RESET_OFFSET);
                        msleep_interruptible(10000);
                }
-                pr_debug("RAM Base for board %d is 0x%x, %s probe\n", b, ram[b],
+                pr_debug("RAM Base for board %d is 0x%lx, %s probe\n", b,
-                        ram[b] == 0 ? "will" : "won't");
+                        ram[b], ram[b] == 0 ? "will" : "won't");
                if(ram[b]) {
                        /*
@@ -168,7 +169,7 @@ static int __init sc_init(void)
                         * board model
                         */
                        if(request_region(ram[b], SRAM_PAGESIZE, "sc test")) {
-                                pr_debug("request_region for RAM base 0x%x succeeded\n", ram[b]);
+                                pr_debug("request_region for RAM base 0x%lx succeeded\n", ram[b]);
                                model = identify_board(ram[b], io[b]);
                                release_region(ram[b], SRAM_PAGESIZE);
                        }
@@ -204,7 +205,7 @@ static int __init sc_init(void)
                         * Nope, there was no place in RAM for the
                         * board, or it couldn't be identified
                         */
-                         pr_debug("Failed to find an adapter at 0x%x\n", ram[b]);
+                         pr_debug("Failed to find an adapter at 0x%lx\n", ram[b]);
                         continue;
                }
@@ -451,7 +452,7 @@ static int identify_board(unsigned long rambase, unsigned int iobase)
        HWConfig_pl hwci;
        int x;
-        pr_debug("Attempting to identify adapter @ 0x%x io 0x%x\n",
+        pr_debug("Attempting to identify adapter @ 0x%lx io 0x%x\n",
                rambase, iobase);
        /*
@@ -490,7 +491,7 @@ static int identify_board(unsigned long rambase, unsigned int iobase)
        outb(PRI_BASEPG_VAL, pgport);
        msleep_interruptible(1000);
        sig = readl(rambase + SIG_OFFSET);
-        pr_debug("Looking for a signature, got 0x%x\n", sig);
+        pr_debug("Looking for a signature, got 0x%lx\n", sig);
        if(sig == SIGNATURE)
                return PRI_BOARD;
@@ -500,7 +501,7 @@ static int identify_board(unsigned long rambase, unsigned int iobase)
        outb(BRI_BASEPG_VAL, pgport);
        msleep_interruptible(1000);
        sig = readl(rambase + SIG_OFFSET);
-        pr_debug("Looking for a signature, got 0x%x\n", sig);
+        pr_debug("Looking for a signature, got 0x%lx\n", sig);
        if(sig == SIGNATURE)
                return BRI_BOARD;
@@ -510,7 +511,7 @@ static int identify_board(unsigned long rambase, unsigned int iobase)
         * Try to spot a card
         */
        sig = readl(rambase + SIG_OFFSET);
-        pr_debug("Looking for a signature, got 0x%x\n", sig);
+        pr_debug("Looking for a signature, got 0x%lx\n", sig);
        if(sig != SIGNATURE)
                return -1;
@@ -540,7 +541,7 @@ static int identify_board(unsigned long rambase, unsigned int iobase)
        memcpy_fromio(&rcvmsg, &(dpm->rsp_queue[dpm->rsp_tail]), MSG_LEN);
        pr_debug("Got HWConfig response, status = 0x%x\n", rcvmsg.rsp_status);
        memcpy(&hwci, &(rcvmsg.msg_data.HWCresponse), sizeof(HWConfig_pl));
-        pr_debug("Hardware Config: Interface: %s, RAM Size: %d, Serial: %s\n"
+        pr_debug("Hardware Config: Interface: %s, RAM Size: %ld, Serial: %s\n"
                 "                 Part: %s, Rev: %s\n",
                 hwci.st_u_sense ? "S/T" : "U", hwci.ram_size,
                 hwci.serial_no, hwci.part_no, hwci.rev_no);
diff --git a/drivers/isdn/sc/packet.c b/drivers/isdn/sc/packet.c
index f50defc38ae5..1e04676b016b 100644
--- a/drivers/isdn/sc/packet.c
+++ b/drivers/isdn/sc/packet.c
@@ -44,7 +44,7 @@ int sndpkt(int devId, int channel, struct sk_buff *data)
                return -ENODEV;
        }
-        pr_debug("%s: sndpkt: frst = 0x%x nxt = %d  f = %d n = %d\n",
+        pr_debug("%s: sndpkt: frst = 0x%lx nxt = %d  f = %d n = %d\n",
                sc_adapter[card]->devicename,
                sc_adapter[card]->channel[channel].first_sendbuf,
                sc_adapter[card]->channel[channel].next_sendbuf,
@@ -66,7 +66,7 @@ int sndpkt(int devId, int channel, struct sk_buff *data)
        ReqLnkWrite.buff_offset = sc_adapter[card]->channel[channel].next_sendbuf *
                BUFFER_SIZE + sc_adapter[card]->channel[channel].first_sendbuf;
        ReqLnkWrite.msg_len = data->len; /* sk_buff size */
-        pr_debug("%s: writing %d bytes to buffer offset 0x%x\n",
+        pr_debug("%s: writing %d bytes to buffer offset 0x%lx\n",
                        sc_adapter[card]->devicename,
                        ReqLnkWrite.msg_len, ReqLnkWrite.buff_offset);
        memcpy_toshmem(card, (char *)ReqLnkWrite.buff_offset, data->data, ReqLnkWrite.msg_len);
@@ -74,7 +74,7 @@ int sndpkt(int devId, int channel, struct sk_buff *data)
        /*
         * sendmessage
         */
-        pr_debug("%s: sndpkt size=%d, buf_offset=0x%x buf_indx=%d\n",
+        pr_debug("%s: sndpkt size=%d, buf_offset=0x%lx buf_indx=%d\n",
                sc_adapter[card]->devicename,
                ReqLnkWrite.msg_len, ReqLnkWrite.buff_offset,
                sc_adapter[card]->channel[channel].next_sendbuf);
@@ -124,7 +124,7 @@ void rcvpkt(int card, RspMessage *rcvmsg)
                        return;
                }
                skb_put(skb, rcvmsg->msg_data.response.msg_len);
-                pr_debug("%s: getting data from offset: 0x%x\n",
+                pr_debug("%s: getting data from offset: 0x%lx\n",
                        sc_adapter[card]->devicename,
                        rcvmsg->msg_data.response.buff_offset);
                memcpy_fromshmem(card,
@@ -143,7 +143,7 @@ void rcvpkt(int card, RspMessage *rcvmsg)
 /*              memset_shmem(card, rcvmsg->msg_data.response.buff_offset, 0, BUFFER_SIZE); */
                newll.buff_offset = rcvmsg->msg_data.response.buff_offset;
                newll.msg_len = BUFFER_SIZE;
-                pr_debug("%s: recycled buffer at offset 0x%x size %d\n",
+                pr_debug("%s: recycled buffer at offset 0x%lx size %d\n",
                        sc_adapter[card]->devicename,
                        newll.buff_offset, newll.msg_len);
                sendmessage(card, CEPID, ceReqTypeLnk, ceReqClass1, ceReqLnkRead,
@@ -186,7 +186,7 @@ int setup_buffers(int card, int c)
        sc_adapter[card]->channel[c-1].num_sendbufs = nBuffers / 2;
        sc_adapter[card]->channel[c-1].free_sendbufs = nBuffers / 2;
        sc_adapter[card]->channel[c-1].next_sendbuf = 0;
-        pr_debug("%s: send buffer setup complete: first=0x%x n=%d f=%d, nxt=%d\n",
+        pr_debug("%s: send buffer setup complete: first=0x%lx n=%d f=%d, nxt=%d\n",
                                sc_adapter[card]->devicename,
                                sc_adapter[card]->channel[c-1].first_sendbuf,
                                sc_adapter[card]->channel[c-1].num_sendbufs,
@@ -203,7 +203,7 @@ int setup_buffers(int card, int c)
                        ((sc_adapter[card]->channel[c-1].first_sendbuf +
                        (nBuffers / 2) * buffer_size) + (buffer_size * i));
                RcvBuffOffset.msg_len = buffer_size;
-                pr_debug("%s: adding RcvBuffer #%d offset=0x%x sz=%d bufsz:%d\n",
+                pr_debug("%s: adding RcvBuffer #%d offset=0x%lx sz=%d bufsz:%d\n",
                                sc_adapter[card]->devicename,
                                i + 1, RcvBuffOffset.buff_offset, 
                                RcvBuffOffset.msg_len,buffer_size);
diff --git a/drivers/isdn/sc/shmem.c b/drivers/isdn/sc/shmem.c
index 24854826ca45..6f58862992db 100644
--- a/drivers/isdn/sc/shmem.c
+++ b/drivers/isdn/sc/shmem.c
@@ -61,7 +61,7 @@ void memcpy_toshmem(int card, void *dest, const void *src, size_t n)
        spin_unlock_irqrestore(&sc_adapter[card]->lock, flags);
        pr_debug("%s: set page to %#x\n",sc_adapter[card]->devicename,
                ((sc_adapter[card]->shmem_magic + ch * SRAM_PAGESIZE)>>14)|0x80);
-        pr_debug("%s: copying %d bytes from %#x to %#x\n",
+        pr_debug("%s: copying %d bytes from %#lx to %#lx\n",
                sc_adapter[card]->devicename, n,
                (unsigned long) src,
                sc_adapter[card]->rambase + ((unsigned long) dest %0x4000));
diff --git a/drivers/leds/led-class.c b/drivers/leds/led-class.c
index aecbbe2e89a9..3c1711210e38 100644
--- a/drivers/leds/led-class.c
+++ b/drivers/leds/led-class.c
@@ -91,6 +91,8 @@ EXPORT_SYMBOL_GPL(led_classdev_resume);
 */
 int led_classdev_register(struct device *parent, struct led_classdev *led_cdev)
 {
+        int rc;
        led_cdev->class_dev = class_device_create(leds_class, NULL, 0,
                                                parent, "%s", led_cdev->name);
        if (unlikely(IS_ERR(led_cdev->class_dev)))
@@ -99,8 +101,10 @@ int led_classdev_register(struct device *parent, struct led_classdev *led_cdev)
        class_set_devdata(led_cdev->class_dev, led_cdev);
        /* register the attributes */
-        class_device_create_file(led_cdev->class_dev,
+        rc = class_device_create_file(led_cdev->class_dev,
-                                &class_device_attr_brightness);
+                                      &class_device_attr_brightness);
+        if (rc)
+                goto err_out;
        /* add to the list of leds */
        write_lock(&leds_list_lock);
@@ -110,16 +114,28 @@ int led_classdev_register(struct device *parent, struct led_classdev *led_cdev)
 #ifdef CONFIG_LEDS_TRIGGERS
        rwlock_init(&led_cdev->trigger_lock);
-        led_trigger_set_default(led_cdev);
+        rc = class_device_create_file(led_cdev->class_dev,
+                                      &class_device_attr_trigger);
+        if (rc)
+                goto err_out_led_list;
-        class_device_create_file(led_cdev->class_dev,
+        led_trigger_set_default(led_cdev);
-                                &class_device_attr_trigger);
 #endif
        printk(KERN_INFO "Registered led device: %s\n",
                        led_cdev->class_dev->class_id);
        return 0;
+#ifdef CONFIG_LEDS_TRIGGERS
+err_out_led_list:
+        class_device_remove_file(led_cdev->class_dev,
+                                &class_device_attr_brightness);
+        list_del(&led_cdev->node);
+#endif
+err_out:
+        class_device_unregister(led_cdev->class_dev);
+        return rc;
 }
 EXPORT_SYMBOL_GPL(led_classdev_register);
diff --git a/drivers/leds/ledtrig-timer.c b/drivers/leds/ledtrig-timer.c
index 179c2876b541..29a8818a32ec 100644
--- a/drivers/leds/ledtrig-timer.c
+++ b/drivers/leds/ledtrig-timer.c
@@ -123,6 +123,7 @@ static CLASS_DEVICE_ATTR(delay_off, 0644, led_delay_off_show,
 static void timer_trig_activate(struct led_classdev *led_cdev)
 {
        struct timer_trig_data *timer_data;
+        int rc;
        timer_data = kzalloc(sizeof(struct timer_trig_data), GFP_KERNEL);
        if (!timer_data)
@@ -134,10 +135,21 @@ static void timer_trig_activate(struct led_classdev *led_cdev)
        timer_data->timer.function = led_timer_function;
        timer_data->timer.data = (unsigned long) led_cdev;
-        class_device_create_file(led_cdev->class_dev,
+        rc = class_device_create_file(led_cdev->class_dev,
                                &class_device_attr_delay_on);
-        class_device_create_file(led_cdev->class_dev,
+        if (rc) goto err_out;
+        rc = class_device_create_file(led_cdev->class_dev,
                                &class_device_attr_delay_off);
+        if (rc) goto err_out_delayon;
+        return;
+err_out_delayon:
+        class_device_remove_file(led_cdev->class_dev,
+                                &class_device_attr_delay_on);
+err_out:
+        led_cdev->trigger_data = NULL;
+        kfree(timer_data);
 }
 static void timer_trig_deactivate(struct led_classdev *led_cdev)
diff --git a/drivers/mca/mca-bus.c b/drivers/mca/mca-bus.c
index 09baa43b2599..da862e4632dd 100644
--- a/drivers/mca/mca-bus.c
+++ b/drivers/mca/mca-bus.c
@@ -100,6 +100,7 @@ static DEVICE_ATTR(pos, S_IRUGO, mca_show_pos, NULL);
 int __init mca_register_device(int bus, struct mca_device *mca_dev)
 {
        struct mca_bus *mca_bus = mca_root_busses[bus];
+        int rc;
        mca_dev->dev.parent = &mca_bus->dev;
        mca_dev->dev.bus = &mca_bus_type;
@@ -108,13 +109,23 @@ int __init mca_register_device(int bus, struct mca_device *mca_dev)
        mca_dev->dev.dma_mask = &mca_dev->dma_mask;
        mca_dev->dev.coherent_dma_mask = mca_dev->dma_mask;
-        if (device_register(&mca_dev->dev))
+        rc = device_register(&mca_dev->dev);
-                return 0;
+        if (rc)
+                goto err_out;
-        device_create_file(&mca_dev->dev, &dev_attr_id);
+        rc = device_create_file(&mca_dev->dev, &dev_attr_id);
-        device_create_file(&mca_dev->dev, &dev_attr_pos);
+        if (rc) goto err_out_devreg;
+        rc = device_create_file(&mca_dev->dev, &dev_attr_pos);
+        if (rc) goto err_out_id;
        return 1;
+err_out_id:
+        device_remove_file(&mca_dev->dev, &dev_attr_id);
+err_out_devreg:
+        device_unregister(&mca_dev->dev);
+err_out:
+        return 0;
 }
 /* */
@@ -130,13 +141,16 @@ struct mca_bus * __devinit mca_attach_bus(int bus)
                return NULL;
        }
-        mca_bus = kmalloc(sizeof(struct mca_bus), GFP_KERNEL);
+        mca_bus = kzalloc(sizeof(struct mca_bus), GFP_KERNEL);
        if (!mca_bus)
                return NULL;
-        memset(mca_bus, 0, sizeof(struct mca_bus));
        sprintf(mca_bus->dev.bus_id,"mca%d",bus);
        sprintf(mca_bus->name,"Host %s MCA Bridge", bus ? "Secondary" : "Primary");
-        device_register(&mca_bus->dev);
+        if (device_register(&mca_bus->dev)) {
+                kfree(mca_bus);
+                return NULL;
+        }
        mca_root_busses[bus] = mca_bus;
diff --git a/drivers/md/bitmap.c b/drivers/md/bitmap.c
index 8e67634e79a0..d47d38ac71b1 100644
--- a/drivers/md/bitmap.c
+++ b/drivers/md/bitmap.c
@@ -1413,7 +1413,7 @@ int bitmap_create(mddev_t *mddev)
        int err;
        sector_t start;
-        BUG_ON(sizeof(bitmap_super_t) != 256);
+        BUILD_BUG_ON(sizeof(bitmap_super_t) != 256);
        if (!file && !mddev->bitmap_offset) /* bitmap disabled, nothing to do */
                return 0;
diff --git a/drivers/md/md.c b/drivers/md/md.c
index 57fa64f93e5f..f7f19088f3be 100644
--- a/drivers/md/md.c
+++ b/drivers/md/md.c
@@ -4912,6 +4912,7 @@ static unsigned int mdstat_poll(struct file *filp, poll_table *wait)
 }
 static struct file_operations md_seq_fops = {
+        .owner          = THIS_MODULE,
        .open           = md_seq_open,
        .read           = seq_read,
        .llseek         = seq_lseek,
diff --git a/drivers/media/dvb/bt8xx/dvb-bt8xx.c b/drivers/media/dvb/bt8xx/dvb-bt8xx.c
index fb6c4cc8477d..14e69a736eda 100644
--- a/drivers/media/dvb/bt8xx/dvb-bt8xx.c
+++ b/drivers/media/dvb/bt8xx/dvb-bt8xx.c
@@ -665,6 +665,10 @@ static void frontend_init(struct dvb_bt8xx_card *card, u32 type)
        case BTTV_BOARD_TWINHAN_DST:
                /*      DST is not a frontend driver !!!                */
                state = (struct dst_state *) kmalloc(sizeof (struct dst_state), GFP_KERNEL);
+                if (!state) {
+                        printk("dvb_bt8xx: No memory\n");
+                        break;
+                }
                /*      Setup the Card                                  */
                state->config = &dst_config;
                state->i2c = card->i2c_adapter;
diff --git a/drivers/media/dvb/dvb-core/Kconfig b/drivers/media/dvb/dvb-core/Kconfig
index e46eae3b9be2..1990eda10c46 100644
--- a/drivers/media/dvb/dvb-core/Kconfig
+++ b/drivers/media/dvb/dvb-core/Kconfig
@@ -19,6 +19,6 @@ config DVB_CORE_ATTACH
          allow the card drivers to only load the frontend modules
          they require. This saves several KBytes of memory.
-          Note: You will need moudule-init-tools v3.2 or later for this feature.
+          Note: You will need module-init-tools v3.2 or later for this feature.
          If unsure say Y.
diff --git a/drivers/media/dvb/dvb-usb/dibusb-common.c b/drivers/media/dvb/dvb-usb/dibusb-common.c
index fd3a9902f98d..5143e426d283 100644
--- a/drivers/media/dvb/dvb-usb/dibusb-common.c
+++ b/drivers/media/dvb/dvb-usb/dibusb-common.c
@@ -169,7 +169,7 @@ EXPORT_SYMBOL(dibusb_read_eeprom_byte);
 // Config Adjacent channels  Perf -cal22
 static struct dibx000_agc_config dib3000p_mt2060_agc_config = {
        .band_caps = BAND_VHF | BAND_UHF,
-        .setup     = (0 << 15) | (0 << 14) | (1 << 13) | (1 << 12) | (29 << 0),
+        .setup     = (1 << 8) | (5 << 5) | (1 << 4) | (1 << 3) | (0 << 2) | (2 << 0),
        .agc1_max = 48497,
        .agc1_min = 23593,
@@ -196,10 +196,14 @@ static struct dib3000mc_config stk3000p_dib3000p_config = {
        .ln_adc_level = 0x1cc7,
        .output_mpeg2_in_188_bytes = 1,
+        .agc_command1 = 1,
+        .agc_command2 = 1,
 };
 static struct dibx000_agc_config dib3000p_panasonic_agc_config = {
-        .setup    = (0 << 15) | (0 << 14) | (1 << 13) | (1 << 12) | (29 << 0),
+        .band_caps = BAND_VHF | BAND_UHF,
+        .setup     = (1 << 8) | (5 << 5) | (1 << 4) | (1 << 3) | (0 << 2) | (2 << 0),
        .agc1_max = 56361,
        .agc1_min = 22282,
@@ -226,6 +230,9 @@ static struct dib3000mc_config mod3000p_dib3000p_config = {
        .ln_adc_level = 0x1cc7,
        .output_mpeg2_in_188_bytes = 1,
+        .agc_command1 = 1,
+        .agc_command2 = 1,
 };
 int dibusb_dib3000mc_frontend_attach(struct dvb_usb_adapter *adap)
diff --git a/drivers/media/dvb/dvb-usb/dibusb.h b/drivers/media/dvb/dvb-usb/dibusb.h
index 5153fb943da1..b60781032742 100644
--- a/drivers/media/dvb/dvb-usb/dibusb.h
+++ b/drivers/media/dvb/dvb-usb/dibusb.h
@@ -99,7 +99,9 @@
 struct dibusb_state {
        struct dib_fe_xfer_ops ops;
        int mt2060_present;
+};
+struct dibusb_device_state {
        /* for RC5 remote control */
        int old_toggle;
        int last_repeat_count;
diff --git a/drivers/media/dvb/dvb-usb/nova-t-usb2.c b/drivers/media/dvb/dvb-usb/nova-t-usb2.c
index a9219bf69b89..a58874c790b2 100644
--- a/drivers/media/dvb/dvb-usb/nova-t-usb2.c
+++ b/drivers/media/dvb/dvb-usb/nova-t-usb2.c
@@ -75,7 +75,7 @@ static int nova_t_rc_query(struct dvb_usb_device *d, u32 *event, int *state)
        u8 key[5],cmd[2] = { DIBUSB_REQ_POLL_REMOTE, 0x35 }, data,toggle,custom;
        u16 raw;
        int i;
-        struct dibusb_state *st = d->priv;
+        struct dibusb_device_state *st = d->priv;
        dvb_usb_generic_rw(d,cmd,2,key,5,0);
@@ -184,6 +184,7 @@ static struct dvb_usb_device_properties nova_t_properties = {
                        .size_of_priv     = sizeof(struct dibusb_state),
                }
        },
+        .size_of_priv     = sizeof(struct dibusb_device_state),
        .power_ctrl       = dibusb2_0_power_ctrl,
        .read_mac_address = nova_t_read_mac_address,
diff --git a/drivers/media/dvb/frontends/dib3000mc.c b/drivers/media/dvb/frontends/dib3000mc.c
index ccc813b525d6..3561a777568c 100644
--- a/drivers/media/dvb/frontends/dib3000mc.c
+++ b/drivers/media/dvb/frontends/dib3000mc.c
@@ -345,7 +345,7 @@ static int dib3000mc_init(struct dvb_frontend *demod)
        /* agc */
        dib3000mc_write_word(state, 36, state->cfg->max_time);
-        dib3000mc_write_word(state, 37, agc->setup);
+        dib3000mc_write_word(state, 37, (state->cfg->agc_command1 << 13) | (state->cfg->agc_command2 << 12) | (0x1d << 0));
        dib3000mc_write_word(state, 38, state->cfg->pwm3_value);
        dib3000mc_write_word(state, 39, state->cfg->ln_adc_level);
diff --git a/drivers/media/dvb/frontends/dib3000mc.h b/drivers/media/dvb/frontends/dib3000mc.h
index b198cd5b1843..0d6fdef77538 100644
--- a/drivers/media/dvb/frontends/dib3000mc.h
+++ b/drivers/media/dvb/frontends/dib3000mc.h
@@ -28,6 +28,9 @@ struct dib3000mc_config {
        u16 max_time;
        u16 ln_adc_level;
+        u8 agc_command1 :1;
+        u8 agc_command2 :1;
        u8 mobile_mode;
        u8 output_mpeg2_in_188_bytes;
diff --git a/drivers/media/dvb/frontends/tda10086.h b/drivers/media/dvb/frontends/tda10086.h
index e8061db11123..18457adee30b 100644
--- a/drivers/media/dvb/frontends/tda10086.h
+++ b/drivers/media/dvb/frontends/tda10086.h
@@ -35,7 +35,16 @@ struct tda10086_config
        u8 invert;
 };
+#if defined(CONFIG_DVB_TDA10086) || defined(CONFIG_DVB_TDA10086_MODULE)
 extern struct dvb_frontend* tda10086_attach(const struct tda10086_config* config,
                                            struct i2c_adapter* i2c);
+#else
+static inline struct dvb_frontend* tda10086_attach(const struct tda10086_config* config,
+                                                   struct i2c_adapter* i2c)
+{
+        printk(KERN_WARNING "%s: driver disabled by Kconfig\n", __FUNCTION__);
+        return NULL;
+}
+#endif // CONFIG_DVB_TDA10086
 #endif // TDA10086_H
diff --git a/drivers/media/dvb/frontends/tda826x.h b/drivers/media/dvb/frontends/tda826x.h
index 3307607632b0..83998c001196 100644
--- a/drivers/media/dvb/frontends/tda826x.h
+++ b/drivers/media/dvb/frontends/tda826x.h
@@ -35,6 +35,19 @@
 * @param has_loopthrough Set to 1 if the card has a loopthrough RF connector.
 * @return FE pointer on success, NULL on failure.
 */
-extern struct dvb_frontend *tda826x_attach(struct dvb_frontend *fe, int addr, struct i2c_adapter *i2c, int has_loopthrough);
+#if defined(CONFIG_DVB_TDA826X) || defined(CONFIG_DVB_TDA826X_MODULE)
+extern struct dvb_frontend* tda826x_attach(struct dvb_frontend *fe, int addr,
-#endif
+                                           struct i2c_adapter *i2c,
+                                           int has_loopthrough);
+#else
+static inline struct dvb_frontend* tda826x_attach(struct dvb_frontend *fe,
+                                                  int addr,
+                                                  struct i2c_adapter *i2c,
+                                                  int has_loopthrough)
+{
+        printk(KERN_WARNING "%s: driver disabled by Kconfig\n", __FUNCTION__);
+        return NULL;
+}
+#endif // CONFIG_DVB_TDA826X
+#endif // __DVB_TDA826X_H__
diff --git a/drivers/media/video/Kconfig b/drivers/media/video/Kconfig
index afb734df6e05..fbe5b6168cc2 100644
--- a/drivers/media/video/Kconfig
+++ b/drivers/media/video/Kconfig
@@ -677,6 +677,8 @@ config VIDEO_M32R_AR_M64278
 menu "V4L USB devices"
        depends on USB && VIDEO_DEV
+source "drivers/media/video/pvrusb2/Kconfig"
 source "drivers/media/video/em28xx/Kconfig"
 source "drivers/media/video/usbvideo/Kconfig"
diff --git a/drivers/media/video/cx25840/cx25840-vbi.c b/drivers/media/video/cx25840/cx25840-vbi.c
index 48014a254e15..f85f2084324f 100644
--- a/drivers/media/video/cx25840/cx25840-vbi.c
+++ b/drivers/media/video/cx25840/cx25840-vbi.c
@@ -235,6 +235,7 @@ int cx25840_vbi(struct i2c_client *client, unsigned int cmd, void *arg)
                        0, 0, V4L2_SLICED_VPS, 0, 0,    /* 9 */
                        0, 0, 0, 0
                };
+                int is_pal = !(cx25840_get_v4lstd(client) & V4L2_STD_525_60);
                int i;
                fmt = arg;
@@ -246,13 +247,25 @@ int cx25840_vbi(struct i2c_client *client, unsigned int cmd, void *arg)
                if ((cx25840_read(client, 0x404) & 0x10) == 0)
                        break;
-                for (i = 7; i <= 23; i++) {
+                if (is_pal) {
-                        u8 v = cx25840_read(client, 0x424 + i - 7);
+                        for (i = 7; i <= 23; i++) {
+                                u8 v = cx25840_read(client, 0x424 + i - 7);
+                                svbi->service_lines[0][i] = lcr2vbi[v >> 4];
+                                svbi->service_lines[1][i] = lcr2vbi[v & 0xf];
+                                svbi->service_set |=
+                                        svbi->service_lines[0][i] | svbi->service_lines[1][i];
+                        }
+                }
+                else {
+                        for (i = 10; i <= 21; i++) {
+                                u8 v = cx25840_read(client, 0x424 + i - 10);
-                        svbi->service_lines[0][i] = lcr2vbi[v >> 4];
+                                svbi->service_lines[0][i] = lcr2vbi[v >> 4];
-                        svbi->service_lines[1][i] = lcr2vbi[v & 0xf];
+                                svbi->service_lines[1][i] = lcr2vbi[v & 0xf];
-                        svbi->service_set |=
+                                svbi->service_set |=
-                                 svbi->service_lines[0][i] | svbi->service_lines[1][i];
+                                        svbi->service_lines[0][i] | svbi->service_lines[1][i];
+                        }
                }
                break;
        }
diff --git a/drivers/media/video/cx88/cx88-cards.c b/drivers/media/video/cx88/cx88-cards.c
index af71d4225c76..f764a57c56be 100644
--- a/drivers/media/video/cx88/cx88-cards.c
+++ b/drivers/media/video/cx88/cx88-cards.c
@@ -1230,6 +1230,7 @@ struct cx88_board cx88_boards[] = {
                        .vmux   = 2,
                        .gpio0  = 0x84bf,
                }},
+                .mpeg           = CX88_MPEG_DVB,
        },
        [CX88_BOARD_NORWOOD_MICRO] = {
                .name           = "Norwood Micro TV Tuner",
@@ -1590,6 +1591,18 @@ struct cx88_subid cx88_subids[] = {
                .subvendor = 0x0070,
                .subdevice = 0x9000,
                .card      = CX88_BOARD_HAUPPAUGE_DVB_T1,
+        },{
+                .subvendor = 0x0070,
+                .subdevice = 0x1400,
+                .card      = CX88_BOARD_HAUPPAUGE_HVR3000,
+        },{
+                .subvendor = 0x0070,
+                .subdevice = 0x1401,
+                .card      = CX88_BOARD_HAUPPAUGE_HVR3000,
+        },{
+                .subvendor = 0x0070,
+                .subdevice = 0x1402,
+                .card      = CX88_BOARD_HAUPPAUGE_HVR3000,
        },
 };
 const unsigned int cx88_idcount = ARRAY_SIZE(cx88_subids);
@@ -1633,7 +1646,15 @@ static void hauppauge_eeprom(struct cx88_core *core, u8 *eeprom_data)
        /* Make sure we support the board model */
        switch (tv.model)
        {
+        case 14009: /* WinTV-HVR3000 (Retail, IR, b/panel video, 3.5mm audio in) */
+        case 14019: /* WinTV-HVR3000 (Retail, IR Blaster, b/panel video, 3.5mm audio in) */
+        case 14029: /* WinTV-HVR3000 (Retail, IR, b/panel video, 3.5mm audio in - 880 bridge) */
+        case 14109: /* WinTV-HVR3000 (Retail, IR, b/panel video, 3.5mm audio in - low profile) */
+        case 14129: /* WinTV-HVR3000 (Retail, IR, b/panel video, 3.5mm audio in - 880 bridge - LP) */
+        case 14559: /* WinTV-HVR3000 (OEM, no IR, b/panel video, 3.5mm audio in) */
        case 14569: /* WinTV-HVR3000 (OEM, no IR, no back panel video) */
+        case 14659: /* WinTV-HVR3000 (OEM, no IR, b/panel video, RCA audio in - Low profile) */
+        case 14669: /* WinTV-HVR3000 (OEM, no IR, no b/panel video - Low profile) */
        case 28552: /* WinTV-PVR 'Roslyn' (No IR) */
        case 34519: /* WinTV-PCI-FM */
        case 90002: /* Nova-T-PCI (9002) */
diff --git a/drivers/media/video/cx88/cx88-dvb.c b/drivers/media/video/cx88/cx88-dvb.c
index bd0c8797f26d..0ef13e7efa2e 100644
--- a/drivers/media/video/cx88/cx88-dvb.c
+++ b/drivers/media/video/cx88/cx88-dvb.c
@@ -315,15 +315,22 @@ static struct cx22702_config hauppauge_novat_config = {
        .demod_address = 0x43,
        .output_mode   = CX22702_SERIAL_OUTPUT,
 };
 static struct cx22702_config hauppauge_hvr1100_config = {
        .demod_address = 0x63,
        .output_mode   = CX22702_SERIAL_OUTPUT,
 };
 static struct cx22702_config hauppauge_hvr1300_config = {
        .demod_address = 0x63,
        .output_mode   = CX22702_SERIAL_OUTPUT,
 };
+static struct cx22702_config hauppauge_hvr3000_config = {
+        .demod_address = 0x63,
+        .output_mode = CX22702_SERIAL_OUTPUT,
+};
 static int or51132_set_ts_param(struct dvb_frontend* fe,
                                int is_punctured)
 {
@@ -558,6 +565,16 @@ static int dvb_register(struct cx8802_dev *dev)
                                   &dvb_pll_fmd1216me);
                }
                break;
+        case CX88_BOARD_HAUPPAUGE_HVR3000:
+                dev->dvb.frontend = dvb_attach(cx22702_attach,
+                                               &hauppauge_hvr3000_config,
+                                               &dev->core->i2c_adap);
+                if (dev->dvb.frontend != NULL) {
+                        dvb_attach(dvb_pll_attach, dev->dvb.frontend, 0x61,
+                                   &dev->core->i2c_adap,
+                                   &dvb_pll_fmd1216me);
+                }
+                break;
        case CX88_BOARD_DVICO_FUSIONHDTV_DVB_T_PLUS:
                dev->dvb.frontend = dvb_attach(mt352_attach,
                                               &dvico_fusionhdtv,
diff --git a/drivers/media/video/cx88/cx88-input.c b/drivers/media/video/cx88/cx88-input.c
index 83ebf7a3c054..ee48995a4ab5 100644
--- a/drivers/media/video/cx88/cx88-input.c
+++ b/drivers/media/video/cx88/cx88-input.c
@@ -196,6 +196,7 @@ int cx88_ir_init(struct cx88_core *core, struct pci_dev *pci)
        case CX88_BOARD_HAUPPAUGE_NOVASPLUS_S1:
        case CX88_BOARD_HAUPPAUGE_HVR1100:
        case CX88_BOARD_HAUPPAUGE_HVR1300:
+        case CX88_BOARD_HAUPPAUGE_HVR3000:
                ir_codes = ir_codes_hauppauge_new;
                ir_type = IR_TYPE_RC5;
                ir->sampling = 1;
@@ -419,6 +420,7 @@ void cx88_ir_irq(struct cx88_core *core)
        case CX88_BOARD_HAUPPAUGE_NOVASPLUS_S1:
        case CX88_BOARD_HAUPPAUGE_HVR1100:
        case CX88_BOARD_HAUPPAUGE_HVR1300:
+        case CX88_BOARD_HAUPPAUGE_HVR3000:
                ircode = ir_decode_biphase(ir->samples, ir->scount, 5, 7);
                ir_dprintk("biphase decoded: %x\n", ircode);
                if ((ircode & 0xfffff000) != 0x3000)
diff --git a/drivers/media/video/et61x251/et61x251_core.c b/drivers/media/video/et61x251/et61x251_core.c
index bc544cc7ccb8..f786ab11d2cd 100644
--- a/drivers/media/video/et61x251/et61x251_core.c
+++ b/drivers/media/video/et61x251/et61x251_core.c
@@ -973,16 +973,32 @@ static CLASS_DEVICE_ATTR(i2c_val, S_IRUGO | S_IWUSR,
                         et61x251_show_i2c_val, et61x251_store_i2c_val);
-static void et61x251_create_sysfs(struct et61x251_device* cam)
+static int et61x251_create_sysfs(struct et61x251_device* cam)
 {
        struct video_device *v4ldev = cam->v4ldev;
+        int rc;
-        video_device_create_file(v4ldev, &class_device_attr_reg);
+        rc = video_device_create_file(v4ldev, &class_device_attr_reg);
-        video_device_create_file(v4ldev, &class_device_attr_val);
+        if (rc) goto err;
+        rc = video_device_create_file(v4ldev, &class_device_attr_val);
+        if (rc) goto err_reg;
        if (cam->sensor.sysfs_ops) {
-                video_device_create_file(v4ldev, &class_device_attr_i2c_reg);
+                rc = video_device_create_file(v4ldev, &class_device_attr_i2c_reg);
-                video_device_create_file(v4ldev, &class_device_attr_i2c_val);
+                if (rc) goto err_val;
+                rc = video_device_create_file(v4ldev, &class_device_attr_i2c_val);
+                if (rc) goto err_i2c_reg;
        }
+        return 0;
+err_i2c_reg:
+        video_device_remove_file(v4ldev, &class_device_attr_i2c_reg);
+err_val:
+        video_device_remove_file(v4ldev, &class_device_attr_val);
+err_reg:
+        video_device_remove_file(v4ldev, &class_device_attr_reg);
+err:
+        return rc;
 }
 #endif /* CONFIG_VIDEO_ADV_DEBUG */
@@ -2534,7 +2550,9 @@ et61x251_usb_probe(struct usb_interface* intf, const struct usb_device_id* id)
        dev_nr = (dev_nr < ET61X251_MAX_DEVICES-1) ? dev_nr+1 : 0;
 #ifdef CONFIG_VIDEO_ADV_DEBUG
-        et61x251_create_sysfs(cam);
+        err = et61x251_create_sysfs(cam);
+        if (err)
+                goto fail2;
        DBG(2, "Optional device control through 'sysfs' interface ready");
 #endif
@@ -2544,6 +2562,13 @@ et61x251_usb_probe(struct usb_interface* intf, const struct usb_device_id* id)
        return 0;
+#ifdef CONFIG_VIDEO_ADV_DEBUG
+fail2:
+        video_nr[dev_nr] = -1;
+        dev_nr = (dev_nr < ET61X251_MAX_DEVICES-1) ? dev_nr+1 : 0;
+        mutex_unlock(&cam->dev_mutex);
+        video_unregister_device(cam->v4ldev);
+#endif
 fail:
        if (cam) {
                kfree(cam->control_buffer);
diff --git a/drivers/media/video/ov511.c b/drivers/media/video/ov511.c
index ce4886f1528d..b4db2cbb5a84 100644
--- a/drivers/media/video/ov511.c
+++ b/drivers/media/video/ov511.c
@@ -5648,17 +5648,49 @@ static ssize_t show_exposure(struct class_device *cd, char *buf)
 }
 static CLASS_DEVICE_ATTR(exposure, S_IRUGO, show_exposure, NULL);
-static void ov_create_sysfs(struct video_device *vdev)
+static int ov_create_sysfs(struct video_device *vdev)
 {
-        video_device_create_file(vdev, &class_device_attr_custom_id);
+        int rc;
-        video_device_create_file(vdev, &class_device_attr_model);
-        video_device_create_file(vdev, &class_device_attr_bridge);
+        rc = video_device_create_file(vdev, &class_device_attr_custom_id);
-        video_device_create_file(vdev, &class_device_attr_sensor);
+        if (rc) goto err;
-        video_device_create_file(vdev, &class_device_attr_brightness);
+        rc = video_device_create_file(vdev, &class_device_attr_model);
-        video_device_create_file(vdev, &class_device_attr_saturation);
+        if (rc) goto err_id;
-        video_device_create_file(vdev, &class_device_attr_contrast);
+        rc = video_device_create_file(vdev, &class_device_attr_bridge);
-        video_device_create_file(vdev, &class_device_attr_hue);
+        if (rc) goto err_model;
-        video_device_create_file(vdev, &class_device_attr_exposure);
+        rc = video_device_create_file(vdev, &class_device_attr_sensor);
+        if (rc) goto err_bridge;
+        rc = video_device_create_file(vdev, &class_device_attr_brightness);
+        if (rc) goto err_sensor;
+        rc = video_device_create_file(vdev, &class_device_attr_saturation);
+        if (rc) goto err_bright;
+        rc = video_device_create_file(vdev, &class_device_attr_contrast);
+        if (rc) goto err_sat;
+        rc = video_device_create_file(vdev, &class_device_attr_hue);
+        if (rc) goto err_contrast;
+        rc = video_device_create_file(vdev, &class_device_attr_exposure);
+        if (rc) goto err_hue;
+        return 0;
+err_hue:
+        video_device_remove_file(vdev, &class_device_attr_hue);
+err_contrast:
+        video_device_remove_file(vdev, &class_device_attr_contrast);
+err_sat:
+        video_device_remove_file(vdev, &class_device_attr_saturation);
+err_bright:
+        video_device_remove_file(vdev, &class_device_attr_brightness);
+err_sensor:
+        video_device_remove_file(vdev, &class_device_attr_sensor);
+err_bridge:
+        video_device_remove_file(vdev, &class_device_attr_bridge);
+err_model:
+        video_device_remove_file(vdev, &class_device_attr_model);
+err_id:
+        video_device_remove_file(vdev, &class_device_attr_custom_id);
+err:
+        return rc;
 }
 /****************************************************************************
@@ -5817,7 +5849,11 @@ ov51x_probe(struct usb_interface *intf, const struct usb_device_id *id)
             ov->vdev->minor);
        usb_set_intfdata(intf, ov);
-        ov_create_sysfs(ov->vdev);
+        if (ov_create_sysfs(ov->vdev)) {
+                err("ov_create_sysfs failed");
+                goto error;
+        }
        return 0;
 error:
diff --git a/drivers/media/video/pwc/pwc-if.c b/drivers/media/video/pwc/pwc-if.c
index c77b85cf3d80..46c114830884 100644
--- a/drivers/media/video/pwc/pwc-if.c
+++ b/drivers/media/video/pwc/pwc-if.c
@@ -1024,12 +1024,25 @@ static ssize_t show_snapshot_button_status(struct class_device *class_dev, char
 static CLASS_DEVICE_ATTR(button, S_IRUGO | S_IWUSR, show_snapshot_button_status,
                         NULL);
-static void pwc_create_sysfs_files(struct video_device *vdev)
+static int pwc_create_sysfs_files(struct video_device *vdev)
 {
        struct pwc_device *pdev = video_get_drvdata(vdev);
-        if (pdev->features & FEATURE_MOTOR_PANTILT)
+        int rc;
-                video_device_create_file(vdev, &class_device_attr_pan_tilt);
-        video_device_create_file(vdev, &class_device_attr_button);
+        rc = video_device_create_file(vdev, &class_device_attr_button);
+        if (rc)
+                goto err;
+        if (pdev->features & FEATURE_MOTOR_PANTILT) {
+                rc = video_device_create_file(vdev,&class_device_attr_pan_tilt);
+                if (rc) goto err_button;
+        }
+        return 0;
+err_button:
+        video_device_remove_file(vdev, &class_device_attr_button);
+err:
+        return rc;
 }
 static void pwc_remove_sysfs_files(struct video_device *vdev)
@@ -1408,7 +1421,7 @@ static int usb_pwc_probe(struct usb_interface *intf, const struct usb_device_id
        struct usb_device *udev = interface_to_usbdev(intf);
        struct pwc_device *pdev = NULL;
        int vendor_id, product_id, type_id;
-        int i, hint;
+        int i, hint, rc;
        int features = 0;
        int video_nr = -1; /* default: use next available device */
        char serial_number[30], *name;
@@ -1709,9 +1722,8 @@ static int usb_pwc_probe(struct usb_interface *intf, const struct usb_device_id
        i = video_register_device(pdev->vdev, VFL_TYPE_GRABBER, video_nr);
        if (i < 0) {
                PWC_ERROR("Failed to register as video device (%d).\n", i);
-                video_device_release(pdev->vdev); /* Drip... drip... drip... */
+                rc = i;
-                kfree(pdev); /* Oops, no memory leaks please */
+                goto err;
-                return -EIO;
        }
        else {
                PWC_INFO("Registered as /dev/video%d.\n", pdev->vdev->minor & 0x3F);
@@ -1723,13 +1735,24 @@ static int usb_pwc_probe(struct usb_interface *intf, const struct usb_device_id
        PWC_DEBUG_PROBE("probe() function returning struct at 0x%p.\n", pdev);
        usb_set_intfdata (intf, pdev);
-        pwc_create_sysfs_files(pdev->vdev);
+        rc = pwc_create_sysfs_files(pdev->vdev);
+        if (rc)
+                goto err_unreg;
        /* Set the leds off */
        pwc_set_leds(pdev, 0, 0);
        pwc_camera_power(pdev, 0);
        return 0;
+err_unreg:
+        if (hint < MAX_DEV_HINTS)
+                device_hint[hint].pdev = NULL;
+        video_unregister_device(pdev->vdev);
+err:
+        video_device_release(pdev->vdev); /* Drip... drip... drip... */
+        kfree(pdev); /* Oops, no memory leaks please */
+        return rc;
 }
 /* The user janked out the cable... */
diff --git a/drivers/media/video/saa7115.c b/drivers/media/video/saa7115.c
index 974179d4d389..c5719f7bd1ac 100644
--- a/drivers/media/video/saa7115.c
+++ b/drivers/media/video/saa7115.c
@@ -960,6 +960,8 @@ static void saa711x_set_v4lstd(struct i2c_client *client, v4l2_std_id std)
                        reg |= 0x10;
                } else if (std == V4L2_STD_NTSC_M_JP) {
                        reg |= 0x40;
+                } else if (std == V4L2_STD_SECAM) {
+                        reg |= 0x50;
                }
                saa711x_write(client, R_0E_CHROMA_CNTL_1, reg);
        } else {
diff --git a/drivers/media/video/saa7134/saa7134-video.c b/drivers/media/video/saa7134/saa7134-video.c
index 203302f21827..830617ea81cc 100644
--- a/drivers/media/video/saa7134/saa7134-video.c
+++ b/drivers/media/video/saa7134/saa7134-video.c
@@ -2248,7 +2248,11 @@ static int radio_do_ioctl(struct inode *inode, struct file *file,
                t->type = V4L2_TUNER_RADIO;
                saa7134_i2c_call_clients(dev, VIDIOC_G_TUNER, t);
+                if (dev->input->amux == TV) {
+                        t->signal = 0xf800 - ((saa_readb(0x581) & 0x1f) << 11);
+                        t->rxsubchans = (saa_readb(0x529) & 0x08) ?
+                                        V4L2_TUNER_SUB_STEREO : V4L2_TUNER_SUB_MONO;
+                }
                return 0;
        }
        case VIDIOC_S_TUNER:
diff --git a/drivers/media/video/sn9c102/sn9c102_core.c b/drivers/media/video/sn9c102/sn9c102_core.c
index 3e0ff8a78468..a4702d3c2aca 100644
--- a/drivers/media/video/sn9c102/sn9c102_core.c
+++ b/drivers/media/video/sn9c102/sn9c102_core.c
@@ -1240,23 +1240,53 @@ static CLASS_DEVICE_ATTR(frame_header, S_IRUGO,
                         sn9c102_show_frame_header, NULL);
-static void sn9c102_create_sysfs(struct sn9c102_device* cam)
+static int sn9c102_create_sysfs(struct sn9c102_device* cam)
 {
        struct video_device *v4ldev = cam->v4ldev;
+        int rc;
+        rc = video_device_create_file(v4ldev, &class_device_attr_reg);
+        if (rc) goto err;
+        rc = video_device_create_file(v4ldev, &class_device_attr_val);
+        if (rc) goto err_reg;
+        rc = video_device_create_file(v4ldev, &class_device_attr_frame_header);
+        if (rc) goto err_val;
-        video_device_create_file(v4ldev, &class_device_attr_reg);
-        video_device_create_file(v4ldev, &class_device_attr_val);
-        video_device_create_file(v4ldev, &class_device_attr_frame_header);
-        if (cam->bridge == BRIDGE_SN9C101 || cam->bridge == BRIDGE_SN9C102)
-                video_device_create_file(v4ldev, &class_device_attr_green);
-        else if (cam->bridge == BRIDGE_SN9C103) {
-                video_device_create_file(v4ldev, &class_device_attr_blue);
-                video_device_create_file(v4ldev, &class_device_attr_red);
-        }
        if (cam->sensor.sysfs_ops) {
-                video_device_create_file(v4ldev, &class_device_attr_i2c_reg);
+                rc = video_device_create_file(v4ldev, &class_device_attr_i2c_reg);
-                video_device_create_file(v4ldev, &class_device_attr_i2c_val);
+                if (rc) goto err_frhead;
+                rc = video_device_create_file(v4ldev, &class_device_attr_i2c_val);
+                if (rc) goto err_i2c_reg;
+        }
+        if (cam->bridge == BRIDGE_SN9C101 || cam->bridge == BRIDGE_SN9C102) {
+                rc = video_device_create_file(v4ldev, &class_device_attr_green);
+                if (rc) goto err_i2c_val;
+        } else if (cam->bridge == BRIDGE_SN9C103) {
+                rc = video_device_create_file(v4ldev, &class_device_attr_blue);
+                if (rc) goto err_i2c_val;
+                rc = video_device_create_file(v4ldev, &class_device_attr_red);
+                if (rc) goto err_blue;
        }
+        return 0;
+err_blue:
+        video_device_remove_file(v4ldev, &class_device_attr_blue);
+err_i2c_val:
+        if (cam->sensor.sysfs_ops)
+                video_device_remove_file(v4ldev, &class_device_attr_i2c_val);
+err_i2c_reg:
+        if (cam->sensor.sysfs_ops)
+                video_device_remove_file(v4ldev, &class_device_attr_i2c_reg);
+err_frhead:
+        video_device_remove_file(v4ldev, &class_device_attr_frame_header);
+err_val:
+        video_device_remove_file(v4ldev, &class_device_attr_val);
+err_reg:
+        video_device_remove_file(v4ldev, &class_device_attr_reg);
+err:
+        return rc;
 }
 #endif /* CONFIG_VIDEO_ADV_DEBUG */
@@ -2809,10 +2839,7 @@ sn9c102_usb_probe(struct usb_interface* intf, const struct usb_device_id* id)
                DBG(1, "V4L2 device registration failed");
                if (err == -ENFILE && video_nr[dev_nr] == -1)
                        DBG(1, "Free /dev/videoX node not found");
-                video_nr[dev_nr] = -1;
+                goto fail2;
-                dev_nr = (dev_nr < SN9C102_MAX_DEVICES-1) ? dev_nr+1 : 0;
-                mutex_unlock(&cam->dev_mutex);
-                goto fail;
        }
        DBG(2, "V4L2 device registered as /dev/video%d", cam->v4ldev->minor);
@@ -2823,7 +2850,9 @@ sn9c102_usb_probe(struct usb_interface* intf, const struct usb_device_id* id)
        dev_nr = (dev_nr < SN9C102_MAX_DEVICES-1) ? dev_nr+1 : 0;
 #ifdef CONFIG_VIDEO_ADV_DEBUG
-        sn9c102_create_sysfs(cam);
+        err = sn9c102_create_sysfs(cam);
+        if (err)
+                goto fail3;
        DBG(2, "Optional device control through 'sysfs' interface ready");
 #endif
@@ -2833,6 +2862,14 @@ sn9c102_usb_probe(struct usb_interface* intf, const struct usb_device_id* id)
        return 0;
+#ifdef CONFIG_VIDEO_ADV_DEBUG
+fail3:
+        video_unregister_device(cam->v4ldev);
+#endif
+fail2:
+        video_nr[dev_nr] = -1;
+        dev_nr = (dev_nr < SN9C102_MAX_DEVICES-1) ? dev_nr+1 : 0;
+        mutex_unlock(&cam->dev_mutex);
 fail:
        if (cam) {
                kfree(cam->control_buffer);
diff --git a/drivers/media/video/stv680.c b/drivers/media/video/stv680.c
index 87e11300181d..6d1ef1e2e8ef 100644
--- a/drivers/media/video/stv680.c
+++ b/drivers/media/video/stv680.c
@@ -516,16 +516,45 @@ stv680_file(frames_read, framecount, "%d\n");
 stv680_file(packets_dropped, dropped, "%d\n");
 stv680_file(decoding_errors, error, "%d\n");
-static void stv680_create_sysfs_files(struct video_device *vdev)
+static int stv680_create_sysfs_files(struct video_device *vdev)
 {
-        video_device_create_file(vdev, &class_device_attr_model);
+        int rc;
-        video_device_create_file(vdev, &class_device_attr_in_use);
-        video_device_create_file(vdev, &class_device_attr_streaming);
+        rc = video_device_create_file(vdev, &class_device_attr_model);
-        video_device_create_file(vdev, &class_device_attr_palette);
+        if (rc) goto err;
-        video_device_create_file(vdev, &class_device_attr_frames_total);
+        rc = video_device_create_file(vdev, &class_device_attr_in_use);
-        video_device_create_file(vdev, &class_device_attr_frames_read);
+        if (rc) goto err_model;
-        video_device_create_file(vdev, &class_device_attr_packets_dropped);
+        rc = video_device_create_file(vdev, &class_device_attr_streaming);
-        video_device_create_file(vdev, &class_device_attr_decoding_errors);
+        if (rc) goto err_inuse;
+        rc = video_device_create_file(vdev, &class_device_attr_palette);
+        if (rc) goto err_stream;
+        rc = video_device_create_file(vdev, &class_device_attr_frames_total);
+        if (rc) goto err_pal;
+        rc = video_device_create_file(vdev, &class_device_attr_frames_read);
+        if (rc) goto err_framtot;
+        rc = video_device_create_file(vdev, &class_device_attr_packets_dropped);
+        if (rc) goto err_framread;
+        rc = video_device_create_file(vdev, &class_device_attr_decoding_errors);
+        if (rc) goto err_dropped;
+        return 0;
+err_dropped:
+        video_device_remove_file(vdev, &class_device_attr_packets_dropped);
+err_framread:
+        video_device_remove_file(vdev, &class_device_attr_frames_read);
+err_framtot:
+        video_device_remove_file(vdev, &class_device_attr_frames_total);
+err_pal:
+        video_device_remove_file(vdev, &class_device_attr_palette);
+err_stream:
+        video_device_remove_file(vdev, &class_device_attr_streaming);
+err_inuse:
+        video_device_remove_file(vdev, &class_device_attr_in_use);
+err_model:
+        video_device_remove_file(vdev, &class_device_attr_model);
+err:
+        return rc;
 }
 static void stv680_remove_sysfs_files(struct video_device *vdev)
@@ -1418,9 +1447,13 @@ static int stv680_probe (struct usb_interface *intf, const struct usb_device_id
        PDEBUG (0, "STV(i): registered new video device: video%d", stv680->vdev->minor);
        usb_set_intfdata (intf, stv680);
-        stv680_create_sysfs_files(stv680->vdev);
+        retval = stv680_create_sysfs_files(stv680->vdev);
+        if (retval)
+                goto error_unreg;
        return 0;
+error_unreg:
+        video_unregister_device(stv680->vdev);
 error_vdev:
        video_device_release(stv680->vdev);
 error:
diff --git a/drivers/media/video/tuner-types.c b/drivers/media/video/tuner-types.c
index 8fff642fad56..781682373b61 100644
--- a/drivers/media/video/tuner-types.c
+++ b/drivers/media/video/tuner-types.c
@@ -1046,7 +1046,6 @@ static struct tuner_params tuner_samsung_tcpn_2121p30a_params[] = {
                .type   = TUNER_PARAM_TYPE_NTSC,
                .ranges = tuner_samsung_tcpn_2121p30a_ntsc_ranges,
                .count  = ARRAY_SIZE(tuner_samsung_tcpn_2121p30a_ntsc_ranges),
-                .has_tda9887 = 1,
        },
 };
diff --git a/drivers/media/video/videodev.c b/drivers/media/video/videodev.c
index 479a0675cf60..d424a4129d69 100644
--- a/drivers/media/video/videodev.c
+++ b/drivers/media/video/videodev.c
@@ -17,10 +17,11 @@
 */
 #define dbgarg(cmd, fmt, arg...) \
-                if (vfd->debug & V4L2_DEBUG_IOCTL_ARG)                  \
+                if (vfd->debug & V4L2_DEBUG_IOCTL_ARG) {                \
                        printk (KERN_DEBUG "%s: ",  vfd->name);         \
                        v4l_printk_ioctl(cmd);                          \
-                        printk (KERN_DEBUG "%s: " fmt, vfd->name, ## arg);
+                        printk (KERN_DEBUG "%s: " fmt, vfd->name, ## arg); \
+                }
 #define dbgarg2(fmt, arg...) \
                if (vfd->debug & V4L2_DEBUG_IOCTL_ARG)                  \
@@ -1287,6 +1288,7 @@ static int __video_do_ioctl(struct inode *inode, struct file *file,
                        ret=vfd->vidioc_g_parm(file, fh, p);
                } else {
                        struct v4l2_standard s;
+                        int i;
                        if (!vfd->tvnormsize) {
                                printk (KERN_WARNING "%s: no TV norms defined!\n",
@@ -1297,8 +1299,14 @@ static int __video_do_ioctl(struct inode *inode, struct file *file,
                        if (p->type != V4L2_BUF_TYPE_VIDEO_CAPTURE)
                                return -EINVAL;
-                        v4l2_video_std_construct(&s, vfd->tvnorms[vfd->current_norm].id,
+                        for (i = 0; i < vfd->tvnormsize; i++)
-                                                 vfd->tvnorms[vfd->current_norm].name);
+                                if (vfd->tvnorms[i].id == vfd->current_norm)
+                                        break;
+                        if (i >= vfd->tvnormsize)
+                                return -EINVAL;
+                        v4l2_video_std_construct(&s, vfd->current_norm,
+                                                 vfd->tvnorms[i].name);
                        memset(p,0,sizeof(*p));
diff --git a/drivers/media/video/vivi.c b/drivers/media/video/vivi.c
index e7c01d560b64..3c8dc72dc8e9 100644
--- a/drivers/media/video/vivi.c
+++ b/drivers/media/video/vivi.c
@@ -272,7 +272,7 @@ static void gen_line(struct sg_to_addr to_addr[],int inipos,int pages,int wmax,
        /* Get first addr pointed to pixel position */
        oldpg=get_addr_pos(pos,pages,to_addr);
-        pg=pfn_to_page(to_addr[oldpg].sg->dma_address >> PAGE_SHIFT);
+        pg=pfn_to_page(sg_dma_address(to_addr[oldpg].sg) >> PAGE_SHIFT);
        basep = kmap_atomic(pg, KM_BOUNCE_READ)+to_addr[oldpg].sg->offset;
        /* We will just duplicate the second pixel at the packet */
@@ -287,7 +287,7 @@ static void gen_line(struct sg_to_addr to_addr[],int inipos,int pages,int wmax,
                for (color=0;color<4;color++) {
                        pgpos=get_addr_pos(pos,pages,to_addr);
                        if (pgpos!=oldpg) {
-                                pg=pfn_to_page(to_addr[pgpos].sg->dma_address >> PAGE_SHIFT);
+                                pg=pfn_to_page(sg_dma_address(to_addr[pgpos].sg) >> PAGE_SHIFT);
                                kunmap_atomic(basep, KM_BOUNCE_READ);
                                basep= kmap_atomic(pg, KM_BOUNCE_READ)+to_addr[pgpos].sg->offset;
                                oldpg=pgpos;
@@ -339,8 +339,8 @@ static void gen_line(struct sg_to_addr to_addr[],int inipos,int pages,int wmax,
                                for (color=0;color<4;color++) {
                                        pgpos=get_addr_pos(pos,pages,to_addr);
                                        if (pgpos!=oldpg) {
-                                                pg=pfn_to_page(to_addr[pgpos].
+                                                pg=pfn_to_page(sg_dma_address(
-                                                                sg->dma_address
+                                                                to_addr[pgpos].sg)
                                                                >> PAGE_SHIFT);
                                                kunmap_atomic(basep,
                                                                KM_BOUNCE_READ);
@@ -386,7 +386,7 @@ static void vivi_fillbuff(struct vivi_dev *dev,struct vivi_buffer *buf)
        struct timeval ts;
        /* Test if DMA mapping is ready */
-        if (!vb->dma.sglist[0].dma_address)
+        if (!sg_dma_address(&vb->dma.sglist[0]))
                return;
        prep_to_addr(to_addr,vb);
@@ -783,7 +783,7 @@ static int vivi_map_sg(void *dev, struct scatterlist *sg, int nents,
        for (i = 0; i < nents; i++ ) {
                BUG_ON(!sg[i].page);
-                sg[i].dma_address = page_to_phys(sg[i].page) + sg[i].offset;
+                sg_dma_address(&sg[i]) = page_to_phys(sg[i].page) + sg[i].offset;
        }
        return nents;
diff --git a/drivers/message/i2o/bus-osm.c b/drivers/message/i2o/bus-osm.c
index ac06f10c54ec..d96c687aee93 100644
--- a/drivers/message/i2o/bus-osm.c
+++ b/drivers/message/i2o/bus-osm.c
@@ -80,18 +80,26 @@ static DEVICE_ATTR(scan, S_IWUSR, NULL, i2o_bus_store_scan);
 *      @dev: device to verify if it is a I2O Bus Adapter device
 *
 *      Because we want all Bus Adapters always return 0.
+ *      Except when we fail.  Then we are sad.
 *
- *      Returns 0.
+ *      Returns 0, except when we fail to excel.
 */
 static int i2o_bus_probe(struct device *dev)
 {
        struct i2o_device *i2o_dev = to_i2o_device(get_device(dev));
+        int rc;
-        device_create_file(dev, &dev_attr_scan);
+        rc = device_create_file(dev, &dev_attr_scan);
+        if (rc)
+                goto err_out;
        osm_info("device added (TID: %03x)\n", i2o_dev->lct_data.tid);
        return 0;
+err_out:
+        put_device(dev);
+        return rc;
 };
 /**
diff --git a/drivers/message/i2o/exec-osm.c b/drivers/message/i2o/exec-osm.c
index 7bd4d85d0b42..91f95d172ca5 100644
--- a/drivers/message/i2o/exec-osm.c
+++ b/drivers/message/i2o/exec-osm.c
@@ -325,13 +325,24 @@ static DEVICE_ATTR(product_id, S_IRUGO, i2o_exec_show_product_id, NULL);
 static int i2o_exec_probe(struct device *dev)
 {
        struct i2o_device *i2o_dev = to_i2o_device(dev);
+        int rc;
-        i2o_event_register(i2o_dev, &i2o_exec_driver, 0, 0xffffffff);
+        rc = i2o_event_register(i2o_dev, &i2o_exec_driver, 0, 0xffffffff);
+        if (rc) goto err_out;
-        device_create_file(dev, &dev_attr_vendor_id);
+        rc = device_create_file(dev, &dev_attr_vendor_id);
-        device_create_file(dev, &dev_attr_product_id);
+        if (rc) goto err_evtreg;
+        rc = device_create_file(dev, &dev_attr_product_id);
+        if (rc) goto err_vid;
        return 0;
+err_vid:
+        device_remove_file(dev, &dev_attr_vendor_id);
+err_evtreg:
+        i2o_event_register(to_i2o_device(dev), &i2o_exec_driver, 0, 0);
+err_out:
+        return rc;
 };
 /**
diff --git a/drivers/misc/Kconfig b/drivers/misc/Kconfig
index 3df0e7a07c46..b6c045dc97b4 100644
--- a/drivers/misc/Kconfig
+++ b/drivers/misc/Kconfig
@@ -28,6 +28,17 @@ config IBM_ASM
          If unsure, say N.
+config SGI_IOC4
+        tristate "SGI IOC4 Base IO support"
+        ---help---
+          This option enables basic support for the IOC4 chip on certain
+          SGI IO controller cards (IO9, IO10, and PCI-RT).  This option
+          does not enable any specific functions on such a card, but provides
+          necessary infrastructure for other drivers to utilize.
+          If you have an SGI Altix with an IOC4-based card say Y.
+          Otherwise say N.
 config TIFM_CORE
        tristate "TI Flash Media interface support (EXPERIMENTAL)"
        depends on EXPERIMENTAL
@@ -57,4 +68,23 @@ config TIFM_7XX1
          To compile this driver as a module, choose M here: the module will
          be called tifm_7xx1.
+config MSI_LAPTOP
+        tristate "MSI Laptop Extras"
+        depends on X86
+        depends on ACPI_EC
+        depends on BACKLIGHT_CLASS_DEVICE
+        ---help---
+          This is a driver for laptops built by MSI (MICRO-STAR
+          INTERNATIONAL):
+          MSI MegaBook S270 (MS-1013)
+          Cytron/TCM/Medion/Tchibo MD96100/SAM2000
+          It adds support for Bluetooth, WLAN and LCD brightness control.
+          More information about this driver is available at
+          <http://0pointer.de/lennart/tchibo.html>.
+          If you have an MSI S270 laptop, say Y or M here.
 endmenu
diff --git a/drivers/misc/Makefile b/drivers/misc/Makefile
index d65ece76095a..c9e98ab021c5 100644
--- a/drivers/misc/Makefile
+++ b/drivers/misc/Makefile
@@ -5,6 +5,8 @@ obj- := misc.o	# Dummy rule to force built-in.o to be made
 obj-$(CONFIG_IBM_ASM)           += ibmasm/
 obj-$(CONFIG_HDPU_FEATURES)     += hdpuftrs/
+obj-$(CONFIG_MSI_LAPTOP)     += msi-laptop.o
 obj-$(CONFIG_LKDTM)             += lkdtm.o
 obj-$(CONFIG_TIFM_CORE)         += tifm_core.o
 obj-$(CONFIG_TIFM_7XX1)         += tifm_7xx1.o
+obj-$(CONFIG_SGI_IOC4)          += ioc4.o
diff --git a/drivers/sn/ioc4.c b/drivers/misc/ioc4.c
index 8562821e6498..1c3c14a3839c 100644
--- a/drivers/sn/ioc4.c
+++ b/drivers/misc/ioc4.c
@@ -3,7 +3,7 @@
 * License.  See the file "COPYING" in the main directory of this archive
 * for more details.
 *
- * Copyright (C) 2005 Silicon Graphics, Inc.  All Rights Reserved.
+ * Copyright (C) 2005-2006 Silicon Graphics, Inc.  All Rights Reserved.
 */
 /* This file contains the master driver module for use by SGI IOC4 subdrivers.
@@ -29,12 +29,9 @@
 #include <linux/module.h>
 #include <linux/pci.h>
 #include <linux/ioc4.h>
-#include <linux/mmtimer.h>
+#include <linux/ktime.h>
-#include <linux/rtc.h>
 #include <linux/mutex.h>
-#include <asm/sn/addrs.h>
+#include <linux/time.h>
-#include <asm/sn/clksupport.h>
-#include <asm/sn/shub_mmr.h>
 /***************
 * Definitions *
@@ -43,7 +40,7 @@
 /* Tweakable values */
 /* PCI bus speed detection/calibration */
-#define IOC4_CALIBRATE_COUNT 63 /* Calibration cycle period */
+#define IOC4_CALIBRATE_COUNT 63         /* Calibration cycle period */
 #define IOC4_CALIBRATE_CYCLES 256       /* Average over this many cycles */
 #define IOC4_CALIBRATE_DISCARD 2        /* Discard first few cycles */
 #define IOC4_CALIBRATE_LOW_MHZ 25       /* Lower bound on bus speed sanity */
@@ -143,11 +140,11 @@ ioc4_unregister_submodule(struct ioc4_submodule *is)
 static void
 ioc4_clock_calibrate(struct ioc4_driver_data *idd)
 {
-        extern unsigned long sn_rtc_cycles_per_second;
        union ioc4_int_out int_out;
        union ioc4_gpcr gpcr;
        unsigned int state, last_state = 1;
-        uint64_t start = 0, end, period;
+        struct timespec start_ts, end_ts;
+        uint64_t start, end, period;
        unsigned int count = 0;
        /* Enable output */
@@ -175,30 +172,28 @@ ioc4_clock_calibrate(struct ioc4_driver_data *idd)
                if (!last_state && state) {
                        count++;
                        if (count == IOC4_CALIBRATE_END) {
-                                end = rtc_time();
+                                ktime_get_ts(&end_ts);
                                break;
                        } else if (count == IOC4_CALIBRATE_DISCARD)
-                                start = rtc_time();
+                                ktime_get_ts(&start_ts);
                }
                last_state = state;
        } while (1);
        /* Calculation rearranged to preserve intermediate precision.
         * Logically:
-         * 1. "end - start" gives us number of RTC cycles over all the
+         * 1. "end - start" gives us the measurement period over all
-         *    square wave cycles measured.
+         *    the square wave cycles.
-         * 2. Divide by number of square wave cycles to get number of
+         * 2. Divide by number of square wave cycles to get the period
-         *    RTC cycles per square wave cycle.
+         *    of a square wave cycle.
         * 3. Divide by 2*(int_out.fields.count+1), which is the formula
         *    by which the IOC4 generates the square wave, to get the
-         *    number of RTC cycles per IOC4 INT_OUT count.
+         *    period of an IOC4 INT_OUT count.
-         * 4. Divide by sn_rtc_cycles_per_second to get seconds per
-         *    count.
-         * 5. Multiply by 1E9 to get nanoseconds per count.
         */
-        period = ((end - start) * 1000000000) /
+        end = end_ts.tv_sec * NSEC_PER_SEC + end_ts.tv_nsec;
-            (IOC4_CALIBRATE_CYCLES * 2 * (IOC4_CALIBRATE_COUNT + 1)
+        start = start_ts.tv_sec * NSEC_PER_SEC + start_ts.tv_nsec;
-             * sn_rtc_cycles_per_second);
+        period = (end - start) /
+                (IOC4_CALIBRATE_CYCLES * 2 * (IOC4_CALIBRATE_COUNT + 1));
        /* Bounds check the result. */
        if (period > IOC4_CALIBRATE_LOW_LIMIT ||
@@ -210,10 +205,12 @@ ioc4_clock_calibrate(struct ioc4_driver_data *idd)
                       IOC4_CALIBRATE_DEFAULT / IOC4_EXTINT_COUNT_DIVISOR);
                period = IOC4_CALIBRATE_DEFAULT;
        } else {
+                u64 ns = period;
+                do_div(ns, IOC4_EXTINT_COUNT_DIVISOR);
                printk(KERN_DEBUG
-                       "IOC4 %s: PCI clock is %ld ns.\n",
+                       "IOC4 %s: PCI clock is %lld ns.\n",
-                       pci_name(idd->idd_pdev),
+                       pci_name(idd->idd_pdev), ns);
-                       period / IOC4_EXTINT_COUNT_DIVISOR);
        }
        /* Remember results.  We store the extint clock period rather
diff --git a/drivers/misc/msi-laptop.c b/drivers/misc/msi-laptop.c
new file mode 100644
index 000000000000..fdb7153f4426
--- /dev/null
+++ b/drivers/misc/msi-laptop.c
@@ -0,0 +1,395 @@
+/*-*-linux-c-*-*/
+/*
+  Copyright (C) 2006 Lennart Poettering <mzxreary (at) 0pointer (dot) de>
+  This program is free software; you can redistribute it and/or modify
+  it under the terms of the GNU General Public License as published by
+  the Free Software Foundation; either version 2 of the License, or
+  (at your option) any later version.
+  This program is distributed in the hope that it will be useful, but
+  WITHOUT ANY WARRANTY; without even the implied warranty of
+  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+  General Public License for more details.
+  You should have received a copy of the GNU General Public License
+  along with this program; if not, write to the Free Software
+  Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
+  02110-1301, USA.
+ */
+/*
+ * msi-laptop.c - MSI S270 laptop support. This laptop is sold under
+ * various brands, including "Cytron/TCM/Medion/Tchibo MD96100".
+ *
+ * This driver exports a few files in /sys/devices/platform/msi-laptop-pf/:
+ *
+ *   lcd_level - Screen brightness: contains a single integer in the
+ *   range 0..8. (rw)
+ *
+ *   auto_brightness - Enable automatic brightness control: contains
+ *   either 0 or 1. If set to 1 the hardware adjusts the screen
+ *   brightness automatically when the power cord is
+ *   plugged/unplugged. (rw)
+ *
+ *   wlan - WLAN subsystem enabled: contains either 0 or 1. (ro)
+ *
+ *   bluetooth - Bluetooth subsystem enabled: contains either 0 or 1
+ *   Please note that this file is constantly 0 if no Bluetooth
+ *   hardware is available. (ro)
+ *
+ * In addition to these platform device attributes the driver
+ * registers itself in the Linux backlight control subsystem and is
+ * available to userspace under /sys/class/backlight/msi-laptop-bl/.
+ *
+ * This driver might work on other laptops produced by MSI. If you
+ * want to try it you can pass force=1 as argument to the module which
+ * will force it to load even when the DMI data doesn't identify the
+ * laptop as MSI S270. YMMV.
+ */
+#include <linux/module.h>
+#include <linux/kernel.h>
+#include <linux/init.h>
+#include <linux/acpi.h>
+#include <linux/dmi.h>
+#include <linux/backlight.h>
+#include <linux/platform_device.h>
+#include <linux/autoconf.h>
+#define MSI_DRIVER_VERSION "0.5"
+#define MSI_LCD_LEVEL_MAX 9
+#define MSI_EC_COMMAND_WIRELESS 0x10
+#define MSI_EC_COMMAND_LCD_LEVEL 0x11
+static int force;
+module_param(force, bool, 0);
+MODULE_PARM_DESC(force, "Force driver load, ignore DMI data");
+static int auto_brightness;
+module_param(auto_brightness, int, 0);
+MODULE_PARM_DESC(auto_brightness, "Enable automatic brightness control (0: disabled; 1: enabled; 2: don't touch)");
+/* Hardware access */
+static int set_lcd_level(int level)
+{
+        u8 buf[2];
+        if (level < 0 || level >= MSI_LCD_LEVEL_MAX)
+                return -EINVAL;
+        buf[0] = 0x80;
+        buf[1] = (u8) (level*31);
+        return ec_transaction(MSI_EC_COMMAND_LCD_LEVEL, buf, sizeof(buf), NULL, 0);
+}
+static int get_lcd_level(void)
+{
+        u8 wdata = 0, rdata;
+        int result;
+        result = ec_transaction(MSI_EC_COMMAND_LCD_LEVEL, &wdata, 1, &rdata, 1);
+        if (result < 0)
+                return result;
+        return (int) rdata / 31;
+}
+static int get_auto_brightness(void)
+{
+        u8 wdata = 4, rdata;
+        int result;
+        result = ec_transaction(MSI_EC_COMMAND_LCD_LEVEL, &wdata, 1, &rdata, 1);
+        if (result < 0)
+                return result;
+        return !!(rdata & 8);
+}
+static int set_auto_brightness(int enable)
+{
+        u8 wdata[2], rdata;
+        int result;
+        wdata[0] = 4;
+        result = ec_transaction(MSI_EC_COMMAND_LCD_LEVEL, wdata, 1, &rdata, 1);
+        if (result < 0)
+                return result;
+        wdata[0] = 0x84;
+        wdata[1] = (rdata & 0xF7) | (enable ? 8 : 0);
+        return ec_transaction(MSI_EC_COMMAND_LCD_LEVEL, wdata, 2, NULL, 0);
+}
+static int get_wireless_state(int *wlan, int *bluetooth)
+{
+        u8 wdata = 0, rdata;
+        int result;
+        result = ec_transaction(MSI_EC_COMMAND_WIRELESS, &wdata, 1, &rdata, 1);
+        if (result < 0)
+                return -1;
+        if (wlan)
+                *wlan = !!(rdata & 8);
+        if (bluetooth)
+                *bluetooth = !!(rdata & 128);
+        return 0;
+}
+/* Backlight device stuff */
+static int bl_get_brightness(struct backlight_device *b)
+{
+        return get_lcd_level();
+}
+static int bl_update_status(struct backlight_device *b)
+{
+        return set_lcd_level(b->props->brightness);
+}
+static struct backlight_properties msibl_props = {
+        .owner          = THIS_MODULE,
+        .get_brightness = bl_get_brightness,
+        .update_status  = bl_update_status,
+        .max_brightness = MSI_LCD_LEVEL_MAX-1,
+};
+static struct backlight_device *msibl_device;
+/* Platform device */
+static ssize_t show_wlan(struct device *dev,
+        struct device_attribute *attr, char *buf)
+{
+        int ret, enabled;
+        ret = get_wireless_state(&enabled, NULL);
+        if (ret < 0)
+                return ret;
+        return sprintf(buf, "%i\n", enabled);
+}
+static ssize_t show_bluetooth(struct device *dev,
+        struct device_attribute *attr, char *buf)
+{
+        int ret, enabled;
+        ret = get_wireless_state(NULL, &enabled);
+        if (ret < 0)
+                return ret;
+        return sprintf(buf, "%i\n", enabled);
+}
+static ssize_t show_lcd_level(struct device *dev,
+        struct device_attribute *attr, char *buf)
+{
+        int ret;
+        ret = get_lcd_level();
+        if (ret < 0)
+                return ret;
+        return sprintf(buf, "%i\n", ret);
+}
+static ssize_t store_lcd_level(struct device *dev,
+        struct device_attribute *attr, const char *buf, size_t count)
+{
+        int level, ret;
+        if (sscanf(buf, "%i", &level) != 1 || (level < 0 || level >= MSI_LCD_LEVEL_MAX))
+                return -EINVAL;
+        ret = set_lcd_level(level);
+        if (ret < 0)
+                return ret;
+        return count;
+}
+static ssize_t show_auto_brightness(struct device *dev,
+        struct device_attribute *attr, char *buf)
+{
+        int ret;
+        ret = get_auto_brightness();
+        if (ret < 0)
+                return ret;
+        return sprintf(buf, "%i\n", ret);
+}
+static ssize_t store_auto_brightness(struct device *dev,
+        struct device_attribute *attr, const char *buf, size_t count)
+{
+        int enable, ret;
+        if (sscanf(buf, "%i", &enable) != 1 || (enable != (enable & 1)))
+                return -EINVAL;
+        ret = set_auto_brightness(enable);
+        if (ret < 0)
+                return ret;
+        return count;
+}
+static DEVICE_ATTR(lcd_level, 0644, show_lcd_level, store_lcd_level);
+static DEVICE_ATTR(auto_brightness, 0644, show_auto_brightness, store_auto_brightness);
+static DEVICE_ATTR(bluetooth, 0444, show_bluetooth, NULL);
+static DEVICE_ATTR(wlan, 0444, show_wlan, NULL);
+static struct attribute *msipf_attributes[] = {
+        &dev_attr_lcd_level.attr,
+        &dev_attr_auto_brightness.attr,
+        &dev_attr_bluetooth.attr,
+        &dev_attr_wlan.attr,
+        NULL
+};
+static struct attribute_group msipf_attribute_group = {
+        .attrs = msipf_attributes
+};
+static struct platform_driver msipf_driver = {
+        .driver = {
+                .name = "msi-laptop-pf",
+                .owner = THIS_MODULE,
+        }
+};
+static struct platform_device *msipf_device;
+/* Initialization */
+static struct dmi_system_id __initdata msi_dmi_table[] = {
+        {
+                .ident = "MSI S270",
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "MICRO-STAR INT'L CO.,LTD"),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "MS-1013"),
+                }
+        },
+        {
+                .ident = "Medion MD96100",
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "NOTEBOOK"),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "SAM2000"),
+                }
+        },
+        { }
+};
+static int __init msi_init(void)
+{
+        int ret;
+        if (acpi_disabled)
+                return -ENODEV;
+        if (!force && !dmi_check_system(msi_dmi_table))
+                return -ENODEV;
+        if (auto_brightness < 0 || auto_brightness > 2)
+                return -EINVAL;
+        /* Register backlight stuff */
+        msibl_device = backlight_device_register("msi-laptop-bl", NULL, &msibl_props);
+        if (IS_ERR(msibl_device))
+                return PTR_ERR(msibl_device);
+        ret = platform_driver_register(&msipf_driver);
+        if (ret)
+                goto fail_backlight;
+        /* Register platform stuff */
+        msipf_device = platform_device_alloc("msi-laptop-pf", -1);
+        if (!msipf_device) {
+                ret = -ENOMEM;
+                goto fail_platform_driver;
+        }
+        ret = platform_device_add(msipf_device);
+        if (ret)
+                goto fail_platform_device1;
+        ret = sysfs_create_group(&msipf_device->dev.kobj, &msipf_attribute_group);
+        if (ret)
+                goto fail_platform_device2;
+        /* Disable automatic brightness control by default because
+         * this module was probably loaded to do brightness control in
+         * software. */
+        if (auto_brightness != 2)
+                set_auto_brightness(auto_brightness);
+        printk(KERN_INFO "msi-laptop: driver "MSI_DRIVER_VERSION" successfully loaded.\n");
+        return 0;
+fail_platform_device2:
+        platform_device_del(msipf_device);
+fail_platform_device1:
+        platform_device_put(msipf_device);
+fail_platform_driver:
+        platform_driver_unregister(&msipf_driver);
+fail_backlight:
+        backlight_device_unregister(msibl_device);
+        return ret;
+}
+static void __exit msi_cleanup(void)
+{
+        sysfs_remove_group(&msipf_device->dev.kobj, &msipf_attribute_group);
+        platform_device_unregister(msipf_device);
+        platform_driver_unregister(&msipf_driver);
+        backlight_device_unregister(msibl_device);
+        /* Enable automatic brightness control again */
+        if (auto_brightness != 2)
+                set_auto_brightness(1);
+        printk(KERN_INFO "msi-laptop: driver unloaded.\n");
+}
+module_init(msi_init);
+module_exit(msi_cleanup);
+MODULE_AUTHOR("Lennart Poettering");
+MODULE_DESCRIPTION("MSI Laptop Support");
+MODULE_VERSION(MSI_DRIVER_VERSION);
+MODULE_LICENSE("GPL");
diff --git a/drivers/net/b44.c b/drivers/net/b44.c
index b124eee4eb10..1ec217433b4c 100644
--- a/drivers/net/b44.c
+++ b/drivers/net/b44.c
@@ -1706,14 +1706,15 @@ static void __b44_set_rx_mode(struct net_device *dev)
                __b44_set_mac_addr(bp);
-                if (dev->flags & IFF_ALLMULTI)
+                if ((dev->flags & IFF_ALLMULTI) ||
+                    (dev->mc_count > B44_MCAST_TABLE_SIZE))
                        val |= RXCONFIG_ALLMULTI;
                else
                        i = __b44_load_mcast(bp, dev);
-                for (; i < 64; i++) {
+                for (; i < 64; i++)
                        __b44_cam_write(bp, zero, i);
-                }
                bw32(bp, B44_RXCONFIG, val);
                val = br32(bp, B44_CAM_CTRL);
                bw32(bp, B44_CAM_CTRL, val | CAM_CTRL_ENABLE);
@@ -2055,7 +2056,7 @@ static int b44_read_eeprom(struct b44 *bp, u8 *data)
        u16 *ptr = (u16 *) data;
        for (i = 0; i < 128; i += 2)
-                ptr[i / 2] = readw(bp->regs + 4096 + i);
+                ptr[i / 2] = cpu_to_le16(readw(bp->regs + 4096 + i));
        return 0;
 }
diff --git a/drivers/net/bonding/bond_alb.c b/drivers/net/bonding/bond_alb.c
index e83bc825f6af..32923162179e 100644
--- a/drivers/net/bonding/bond_alb.c
+++ b/drivers/net/bonding/bond_alb.c
@@ -1433,7 +1433,7 @@ void bond_alb_monitor(struct bonding *bond)
                 * write lock to protect from other code that also
                 * sets the promiscuity.
                 */
-                write_lock(&bond->curr_slave_lock);
+                write_lock_bh(&bond->curr_slave_lock);
                if (bond_info->primary_is_promisc &&
                    (++bond_info->rlb_promisc_timeout_counter >= RLB_PROMISC_TIMEOUT)) {
@@ -1448,7 +1448,7 @@ void bond_alb_monitor(struct bonding *bond)
                        bond_info->primary_is_promisc = 0;
                }
-                write_unlock(&bond->curr_slave_lock);
+                write_unlock_bh(&bond->curr_slave_lock);
                if (bond_info->rlb_rebalance) {
                        bond_info->rlb_rebalance = 0;
diff --git a/drivers/net/ehea/ehea.h b/drivers/net/ehea/ehea.h
index 23b451a8ae12..b40724fc6b74 100644
--- a/drivers/net/ehea/ehea.h
+++ b/drivers/net/ehea/ehea.h
@@ -39,7 +39,7 @@
 #include <asm/io.h>
 #define DRV_NAME        "ehea"
-#define DRV_VERSION     "EHEA_0028"
+#define DRV_VERSION     "EHEA_0034"
 #define EHEA_MSG_DEFAULT (NETIF_MSG_LINK | NETIF_MSG_TIMER \
        | NETIF_MSG_RX_ERR | NETIF_MSG_TX_ERR)
@@ -50,6 +50,7 @@
 #define EHEA_MAX_ENTRIES_SQ  32767
 #define EHEA_MIN_ENTRIES_QP  127
+#define EHEA_SMALL_QUEUES
 #define EHEA_NUM_TX_QP 1
 #ifdef EHEA_SMALL_QUEUES
@@ -59,11 +60,11 @@
 #define EHEA_DEF_ENTRIES_RQ2    1023
 #define EHEA_DEF_ENTRIES_RQ3    1023
 #else
-#define EHEA_MAX_CQE_COUNT     32000
+#define EHEA_MAX_CQE_COUNT      4080
-#define EHEA_DEF_ENTRIES_SQ    16000
+#define EHEA_DEF_ENTRIES_SQ     4080
-#define EHEA_DEF_ENTRIES_RQ1   32080
+#define EHEA_DEF_ENTRIES_RQ1    8160
-#define EHEA_DEF_ENTRIES_RQ2    4020
+#define EHEA_DEF_ENTRIES_RQ2    2040
-#define EHEA_DEF_ENTRIES_RQ3    4020
+#define EHEA_DEF_ENTRIES_RQ3    2040
 #endif
 #define EHEA_MAX_ENTRIES_EQ 20
diff --git a/drivers/net/ehea/ehea_main.c b/drivers/net/ehea/ehea_main.c
index c6b31775e26b..eb7d44de59ff 100644
--- a/drivers/net/ehea/ehea_main.c
+++ b/drivers/net/ehea/ehea_main.c
@@ -766,7 +766,7 @@ static void ehea_parse_eqe(struct ehea_adapter *adapter, u64 eqe)
                if (EHEA_BMASK_GET(NEQE_PORT_UP, eqe)) {
                        if (!netif_carrier_ok(port->netdev)) {
                                ret = ehea_sense_port_attr(
-                                        adapter->port[portnum]);
+                                        port);
                                if (ret) {
                                        ehea_error("failed resensing port "
                                                   "attributes");
@@ -818,7 +818,7 @@ static void ehea_parse_eqe(struct ehea_adapter *adapter, u64 eqe)
                netif_stop_queue(port->netdev);
                break;
        default:
-                ehea_error("unknown event code %x", ec);
+                ehea_error("unknown event code %x, eqe=0x%lX", ec, eqe);
                break;
        }
 }
@@ -1841,7 +1841,7 @@ static int ehea_start_xmit(struct sk_buff *skb, struct net_device *dev)
        if (netif_msg_tx_queued(port)) {
                ehea_info("post swqe on QP %d", pr->qp->init_attr.qp_nr);
-                ehea_dump(swqe, sizeof(*swqe), "swqe");
+                ehea_dump(swqe, 512, "swqe");
        }
        ehea_post_swqe(pr->qp, swqe);
diff --git a/drivers/net/ehea/ehea_phyp.c b/drivers/net/ehea/ehea_phyp.c
index 4a85aca4c7e9..0b51a8cea077 100644
--- a/drivers/net/ehea/ehea_phyp.c
+++ b/drivers/net/ehea/ehea_phyp.c
@@ -44,71 +44,99 @@ static inline u16 get_order_of_qentries(u16 queue_entries)
 #define H_ALL_RES_TYPE_MR        5
 #define H_ALL_RES_TYPE_MW        6
-static long ehea_hcall_9arg_9ret(unsigned long opcode,
+static long ehea_plpar_hcall_norets(unsigned long opcode,
-                                 unsigned long arg1, unsigned long arg2,
+                                    unsigned long arg1,
-                                 unsigned long arg3, unsigned long arg4,
+                                    unsigned long arg2,
-                                 unsigned long arg5, unsigned long arg6,
+                                    unsigned long arg3,
-                                 unsigned long arg7, unsigned long arg8,
+                                    unsigned long arg4,
-                                 unsigned long arg9, unsigned long *out1,
+                                    unsigned long arg5,
-                                 unsigned long *out2,unsigned long *out3,
+                                    unsigned long arg6,
-                                 unsigned long *out4,unsigned long *out5,
+                                    unsigned long arg7)
-                                 unsigned long *out6,unsigned long *out7,
-                                 unsigned long *out8,unsigned long *out9)
 {
-        long hret;
+        long ret;
        int i, sleep_msecs;
        for (i = 0; i < 5; i++) {
-                hret = plpar_hcall_9arg_9ret(opcode,arg1, arg2, arg3, arg4,
+                ret = plpar_hcall_norets(opcode, arg1, arg2, arg3, arg4,
-                                             arg5, arg6, arg7, arg8, arg9, out1,
+                                         arg5, arg6, arg7);
-                                             out2, out3, out4, out5, out6, out7,
-                                             out8, out9);
+                if (H_IS_LONG_BUSY(ret)) {
-                if (H_IS_LONG_BUSY(hret)) {
+                        sleep_msecs = get_longbusy_msecs(ret);
-                        sleep_msecs = get_longbusy_msecs(hret);
                        msleep_interruptible(sleep_msecs);
                        continue;
                }
-                if (hret < H_SUCCESS)
+                if (ret < H_SUCCESS)
-                        ehea_error("op=%lx hret=%lx "
+                        ehea_error("opcode=%lx ret=%lx"
-                                   "i1=%lx i2=%lx i3=%lx i4=%lx i5=%lx i6=%lx "
+                                   " arg1=%lx arg2=%lx arg3=%lx arg4=%lx"
-                                   "i7=%lx i8=%lx i9=%lx "
+                                   " arg5=%lx arg6=%lx arg7=%lx ",
-                                   "o1=%lx o2=%lx o3=%lx o4=%lx o5=%lx o6=%lx "
+                                   opcode, ret,
-                                   "o7=%lx o8=%lx o9=%lx",
+                                   arg1, arg2, arg3, arg4, arg5,
-                                   opcode, hret, arg1, arg2, arg3, arg4, arg5,
+                                   arg6, arg7);
-                                   arg6, arg7, arg8, arg9, *out1, *out2, *out3,
-                                   *out4, *out5, *out6, *out7, *out8, *out9);
+                return ret;
-                return hret;
        }
        return H_BUSY;
 }
-u64 ehea_h_query_ehea_qp(const u64 adapter_handle, const u8 qp_category,
+static long ehea_plpar_hcall9(unsigned long opcode,
-                         const u64 qp_handle, const u64 sel_mask, void *cb_addr)
+                              unsigned long *outs, /* array of 9 outputs */
+                              unsigned long arg1,
+                              unsigned long arg2,
+                              unsigned long arg3,
+                              unsigned long arg4,
+                              unsigned long arg5,
+                              unsigned long arg6,
+                              unsigned long arg7,
+                              unsigned long arg8,
+                              unsigned long arg9)
 {
-        u64 dummy;
+        long ret;
+        int i, sleep_msecs;
-        if ((((u64)cb_addr) & (PAGE_SIZE - 1)) != 0) {
+        for (i = 0; i < 5; i++) {
-                ehea_error("not on pageboundary");
+                ret = plpar_hcall9(opcode, outs,
-                return H_PARAMETER;
+                                   arg1, arg2, arg3, arg4, arg5,
+                                   arg6, arg7, arg8, arg9);
+                if (H_IS_LONG_BUSY(ret)) {
+                        sleep_msecs = get_longbusy_msecs(ret);
+                        msleep_interruptible(sleep_msecs);
+                        continue;
+                }
+                if (ret < H_SUCCESS)
+                        ehea_error("opcode=%lx ret=%lx"
+                                   " arg1=%lx arg2=%lx arg3=%lx arg4=%lx"
+                                   " arg5=%lx arg6=%lx arg7=%lx arg8=%lx"
+                                   " arg9=%lx"
+                                   " out1=%lx out2=%lx out3=%lx out4=%lx"
+                                   " out5=%lx out6=%lx out7=%lx out8=%lx"
+                                   " out9=%lx",
+                                   opcode, ret,
+                                   arg1, arg2, arg3, arg4, arg5,
+                                   arg6, arg7, arg8, arg9,
+                                   outs[0], outs[1], outs[2], outs[3],
+                                   outs[4], outs[5], outs[6], outs[7],
+                                   outs[8]);
+                return ret;
        }
-        return ehea_hcall_9arg_9ret(H_QUERY_HEA_QP,
+        return H_BUSY;
-                                    adapter_handle,             /* R4 */
+}
-                                    qp_category,                /* R5 */
-                                    qp_handle,                  /* R6 */
+u64 ehea_h_query_ehea_qp(const u64 adapter_handle, const u8 qp_category,
-                                    sel_mask,                   /* R7 */
+                         const u64 qp_handle, const u64 sel_mask, void *cb_addr)
-                                    virt_to_abs(cb_addr),       /* R8 */
+{
-                                    0, 0, 0, 0,                 /* R9-R12 */
+        return ehea_plpar_hcall_norets(H_QUERY_HEA_QP,
-                                    &dummy,                     /* R4 */
+                                       adapter_handle,          /* R4 */
-                                    &dummy,                     /* R5 */
+                                       qp_category,             /* R5 */
-                                    &dummy,                     /* R6 */
+                                       qp_handle,               /* R6 */
-                                    &dummy,                     /* R7 */
+                                       sel_mask,                /* R7 */
-                                    &dummy,                     /* R8 */
+                                       virt_to_abs(cb_addr),    /* R8 */
-                                    &dummy,                     /* R9 */
+                                       0, 0);
-                                    &dummy,                     /* R10 */
-                                    &dummy,                     /* R11 */
-                                    &dummy);                    /* R12 */
 }
 /* input param R5 */
@@ -180,6 +208,7 @@ u64 ehea_h_alloc_resource_qp(const u64 adapter_handle,
                             u64 *qp_handle, struct h_epas *h_epas)
 {
        u64 hret;
+        u64 outs[PLPAR_HCALL9_BUFSIZE];
        u64 allocate_controls =
            EHEA_BMASK_SET(H_ALL_RES_QP_EQPO, init_attr->low_lat_rq1 ? 1 : 0)
@@ -219,45 +248,29 @@ u64 ehea_h_alloc_resource_qp(const u64 adapter_handle,
            EHEA_BMASK_SET(H_ALL_RES_QP_TH_RQ2, init_attr->rq2_threshold)
            | EHEA_BMASK_SET(H_ALL_RES_QP_TH_RQ3, init_attr->rq3_threshold);
-        u64 r5_out = 0;
+        hret = ehea_plpar_hcall9(H_ALLOC_HEA_RESOURCE,
-        u64 r6_out = 0;
+                                 outs,
-        u64 r7_out = 0;
+                                 adapter_handle,                /* R4 */
-        u64 r8_out = 0;
+                                 allocate_controls,             /* R5 */
-        u64 r9_out = 0;
+                                 init_attr->send_cq_handle,     /* R6 */
-        u64 g_la_user_out = 0;
+                                 init_attr->recv_cq_handle,     /* R7 */
-        u64 r11_out = 0;
+                                 init_attr->aff_eq_handle,      /* R8 */
-        u64 r12_out = 0;
+                                 r9_reg,                        /* R9 */
+                                 max_r10_reg,                   /* R10 */
-        hret = ehea_hcall_9arg_9ret(H_ALLOC_HEA_RESOURCE,
+                                 r11_in,                        /* R11 */
-                                    adapter_handle,             /* R4 */
+                                 threshold);                    /* R12 */
-                                    allocate_controls,          /* R5 */
-                                    init_attr->send_cq_handle,  /* R6 */
+        *qp_handle = outs[0];
-                                    init_attr->recv_cq_handle,  /* R7 */
+        init_attr->qp_nr = (u32)outs[1];
-                                    init_attr->aff_eq_handle,   /* R8 */
-                                    r9_reg,                     /* R9 */
-                                    max_r10_reg,                /* R10 */
-                                    r11_in,                     /* R11 */
-                                    threshold,                  /* R12 */
-                                    qp_handle,                  /* R4 */
-                                    &r5_out,                    /* R5 */
-                                    &r6_out,                    /* R6 */
-                                    &r7_out,                    /* R7 */
-                                    &r8_out,                    /* R8 */
-                                    &r9_out,                    /* R9 */
-                                    &g_la_user_out,             /* R10 */
-                                    &r11_out,                   /* R11 */
-                                    &r12_out);                  /* R12 */
-        init_attr->qp_nr = (u32)r5_out;
        init_attr->act_nr_send_wqes =
-            (u16)EHEA_BMASK_GET(H_ALL_RES_QP_ACT_SWQE, r6_out);
+            (u16)EHEA_BMASK_GET(H_ALL_RES_QP_ACT_SWQE, outs[2]);
        init_attr->act_nr_rwqes_rq1 =
-            (u16)EHEA_BMASK_GET(H_ALL_RES_QP_ACT_R1WQE, r6_out);
+            (u16)EHEA_BMASK_GET(H_ALL_RES_QP_ACT_R1WQE, outs[2]);
        init_attr->act_nr_rwqes_rq2 =
-            (u16)EHEA_BMASK_GET(H_ALL_RES_QP_ACT_R2WQE, r6_out);
+            (u16)EHEA_BMASK_GET(H_ALL_RES_QP_ACT_R2WQE, outs[2]);
        init_attr->act_nr_rwqes_rq3 =
-            (u16)EHEA_BMASK_GET(H_ALL_RES_QP_ACT_R3WQE, r6_out);
+            (u16)EHEA_BMASK_GET(H_ALL_RES_QP_ACT_R3WQE, outs[2]);
        init_attr->act_wqe_size_enc_sq = init_attr->wqe_size_enc_sq;
        init_attr->act_wqe_size_enc_rq1 = init_attr->wqe_size_enc_rq1;
@@ -265,25 +278,25 @@ u64 ehea_h_alloc_resource_qp(const u64 adapter_handle,
        init_attr->act_wqe_size_enc_rq3 = init_attr->wqe_size_enc_rq3;
        init_attr->nr_sq_pages =
-            (u32)EHEA_BMASK_GET(H_ALL_RES_QP_SIZE_SQ, r8_out);
+            (u32)EHEA_BMASK_GET(H_ALL_RES_QP_SIZE_SQ, outs[4]);
        init_attr->nr_rq1_pages =
-            (u32)EHEA_BMASK_GET(H_ALL_RES_QP_SIZE_RQ1, r8_out);
+            (u32)EHEA_BMASK_GET(H_ALL_RES_QP_SIZE_RQ1, outs[4]);
        init_attr->nr_rq2_pages =
-            (u32)EHEA_BMASK_GET(H_ALL_RES_QP_SIZE_RQ2, r9_out);
+            (u32)EHEA_BMASK_GET(H_ALL_RES_QP_SIZE_RQ2, outs[5]);
        init_attr->nr_rq3_pages =
-            (u32)EHEA_BMASK_GET(H_ALL_RES_QP_SIZE_RQ3, r9_out);
+            (u32)EHEA_BMASK_GET(H_ALL_RES_QP_SIZE_RQ3, outs[5]);
        init_attr->liobn_sq =
-            (u32)EHEA_BMASK_GET(H_ALL_RES_QP_LIOBN_SQ, r11_out);
+            (u32)EHEA_BMASK_GET(H_ALL_RES_QP_LIOBN_SQ, outs[7]);
        init_attr->liobn_rq1 =
-            (u32)EHEA_BMASK_GET(H_ALL_RES_QP_LIOBN_RQ1, r11_out);
+            (u32)EHEA_BMASK_GET(H_ALL_RES_QP_LIOBN_RQ1, outs[7]);
        init_attr->liobn_rq2 =
-            (u32)EHEA_BMASK_GET(H_ALL_RES_QP_LIOBN_RQ2, r12_out);
+            (u32)EHEA_BMASK_GET(H_ALL_RES_QP_LIOBN_RQ2, outs[8]);
        init_attr->liobn_rq3 =
-            (u32)EHEA_BMASK_GET(H_ALL_RES_QP_LIOBN_RQ3, r12_out);
+            (u32)EHEA_BMASK_GET(H_ALL_RES_QP_LIOBN_RQ3, outs[8]);
        if (!hret)
-                hcp_epas_ctor(h_epas, g_la_user_out, g_la_user_out);
+                hcp_epas_ctor(h_epas, outs[6], outs[6]);
        return hret;
 }
@@ -292,31 +305,24 @@ u64 ehea_h_alloc_resource_cq(const u64 adapter_handle,
                             struct ehea_cq_attr *cq_attr,
                             u64 *cq_handle, struct h_epas *epas)
 {
-        u64 hret, dummy, act_nr_of_cqes_out, act_pages_out;
+        u64 hret;
-        u64 g_la_privileged_out, g_la_user_out;
+        u64 outs[PLPAR_HCALL9_BUFSIZE];
-        hret = ehea_hcall_9arg_9ret(H_ALLOC_HEA_RESOURCE,
+        hret = ehea_plpar_hcall9(H_ALLOC_HEA_RESOURCE,
-                                    adapter_handle,             /* R4 */
+                                 outs,
-                                    H_ALL_RES_TYPE_CQ,          /* R5 */
+                                 adapter_handle,                /* R4 */
-                                    cq_attr->eq_handle,         /* R6 */
+                                 H_ALL_RES_TYPE_CQ,             /* R5 */
-                                    cq_attr->cq_token,          /* R7 */
+                                 cq_attr->eq_handle,            /* R6 */
-                                    cq_attr->max_nr_of_cqes,    /* R8 */
+                                 cq_attr->cq_token,             /* R7 */
-                                    0, 0, 0, 0,                 /* R9-R12 */
+                                 cq_attr->max_nr_of_cqes,       /* R8 */
-                                    cq_handle,                  /* R4 */
+                                 0, 0, 0, 0);                   /* R9-R12 */
-                                    &dummy,                     /* R5 */
-                                    &dummy,                     /* R6 */
+        *cq_handle = outs[0];
-                                    &act_nr_of_cqes_out,        /* R7 */
+        cq_attr->act_nr_of_cqes = outs[3];
-                                    &act_pages_out,             /* R8 */
+        cq_attr->nr_pages = outs[4];
-                                    &g_la_privileged_out,       /* R9 */
-                                    &g_la_user_out,             /* R10 */
-                                    &dummy,                     /* R11 */
-                                    &dummy);                    /* R12 */
-        cq_attr->act_nr_of_cqes = act_nr_of_cqes_out;
-        cq_attr->nr_pages = act_pages_out;
        if (!hret)
-                hcp_epas_ctor(epas, g_la_privileged_out, g_la_user_out);
+                hcp_epas_ctor(epas, outs[5], outs[6]);
        return hret;
 }
@@ -361,9 +367,8 @@ u64 ehea_h_alloc_resource_cq(const u64 adapter_handle,
 u64 ehea_h_alloc_resource_eq(const u64 adapter_handle,
                             struct ehea_eq_attr *eq_attr, u64 *eq_handle)
 {
-        u64 hret, dummy, eq_liobn, allocate_controls;
+        u64 hret, allocate_controls;
-        u64 ist1_out, ist2_out, ist3_out, ist4_out;
+        u64 outs[PLPAR_HCALL9_BUFSIZE];
-        u64 act_nr_of_eqes_out, act_pages_out;
        /* resource type */
        allocate_controls =
@@ -372,27 +377,20 @@ u64 ehea_h_alloc_resource_eq(const u64 adapter_handle,
            | EHEA_BMASK_SET(H_ALL_RES_EQ_INH_EQE_GEN, !eq_attr->eqe_gen)
            | EHEA_BMASK_SET(H_ALL_RES_EQ_NON_NEQ_ISN, 1);
-        hret = ehea_hcall_9arg_9ret(H_ALLOC_HEA_RESOURCE,
+        hret = ehea_plpar_hcall9(H_ALLOC_HEA_RESOURCE,
-                                    adapter_handle,             /* R4 */
+                                 outs,
-                                    allocate_controls,          /* R5 */
+                                 adapter_handle,                /* R4 */
-                                    eq_attr->max_nr_of_eqes,    /* R6 */
+                                 allocate_controls,             /* R5 */
-                                    0, 0, 0, 0, 0, 0,           /* R7-R10 */
+                                 eq_attr->max_nr_of_eqes,       /* R6 */
-                                    eq_handle,                  /* R4 */
+                                 0, 0, 0, 0, 0, 0);             /* R7-R10 */
-                                    &dummy,                     /* R5 */
-                                    &eq_liobn,                  /* R6 */
+        *eq_handle = outs[0];
-                                    &act_nr_of_eqes_out,        /* R7 */
+        eq_attr->act_nr_of_eqes = outs[3];
-                                    &act_pages_out,             /* R8 */
+        eq_attr->nr_pages = outs[4];
-                                    &ist1_out,                  /* R9 */
+        eq_attr->ist1 = outs[5];
-                                    &ist2_out,                  /* R10 */
+        eq_attr->ist2 = outs[6];
-                                    &ist3_out,                  /* R11 */
+        eq_attr->ist3 = outs[7];
-                                    &ist4_out);                 /* R12 */
+        eq_attr->ist4 = outs[8];
-        eq_attr->act_nr_of_eqes = act_nr_of_eqes_out;
-        eq_attr->nr_pages = act_pages_out;
-        eq_attr->ist1 = ist1_out;
-        eq_attr->ist2 = ist2_out;
-        eq_attr->ist3 = ist3_out;
-        eq_attr->ist4 = ist4_out;
        return hret;
 }
@@ -402,31 +400,22 @@ u64 ehea_h_modify_ehea_qp(const u64 adapter_handle, const u8 cat,
                          void *cb_addr, u64 *inv_attr_id, u64 *proc_mask,
                          u16 *out_swr, u16 *out_rwr)
 {
-        u64 hret, dummy, act_out_swr, act_out_rwr;
+        u64 hret;
+        u64 outs[PLPAR_HCALL9_BUFSIZE];
-        if ((((u64)cb_addr) & (PAGE_SIZE - 1)) != 0) {
-                ehea_error("not on page boundary");
+        hret = ehea_plpar_hcall9(H_MODIFY_HEA_QP,
-                return H_PARAMETER;
+                                 outs,
-        }
+                                 adapter_handle,                /* R4 */
+                                 (u64) cat,                     /* R5 */
-        hret = ehea_hcall_9arg_9ret(H_MODIFY_HEA_QP,
+                                 qp_handle,                     /* R6 */
-                                    adapter_handle,             /* R4 */
+                                 sel_mask,                      /* R7 */
-                                    (u64) cat,                  /* R5 */
+                                 virt_to_abs(cb_addr),          /* R8 */
-                                    qp_handle,                  /* R6 */
+                                 0, 0, 0, 0);                   /* R9-R12 */
-                                    sel_mask,                   /* R7 */
-                                    virt_to_abs(cb_addr),       /* R8 */
+        *inv_attr_id = outs[0];
-                                    0, 0, 0, 0,                 /* R9-R12 */
+        *out_swr = outs[3];
-                                    inv_attr_id,                /* R4 */
+        *out_rwr = outs[4];
-                                    &dummy,                     /* R5 */
+        *proc_mask = outs[5];
-                                    &dummy,                     /* R6 */
-                                    &act_out_swr,               /* R7 */
-                                    &act_out_rwr,               /* R8 */
-                                    proc_mask,                  /* R9 */
-                                    &dummy,                     /* R10 */
-                                    &dummy,                     /* R11 */
-                                    &dummy);                    /* R12 */
-        *out_swr = act_out_swr;
-        *out_rwr = act_out_rwr;
        return hret;
 }
@@ -435,122 +424,81 @@ u64 ehea_h_register_rpage(const u64 adapter_handle, const u8 pagesize,
                          const u8 queue_type, const u64 resource_handle,
                          const u64 log_pageaddr, u64 count)
 {
-        u64 dummy, reg_control;
+        u64  reg_control;
        reg_control = EHEA_BMASK_SET(H_REG_RPAGE_PAGE_SIZE, pagesize)
                    | EHEA_BMASK_SET(H_REG_RPAGE_QT, queue_type);
-        return ehea_hcall_9arg_9ret(H_REGISTER_HEA_RPAGES,
+        return ehea_plpar_hcall_norets(H_REGISTER_HEA_RPAGES,
-                                    adapter_handle,             /* R4 */
+                                       adapter_handle,          /* R4 */
-                                    reg_control,                /* R5 */
+                                       reg_control,             /* R5 */
-                                    resource_handle,            /* R6 */
+                                       resource_handle,         /* R6 */
-                                    log_pageaddr,               /* R7 */
+                                       log_pageaddr,            /* R7 */
-                                    count,                      /* R8 */
+                                       count,                   /* R8 */
-                                    0, 0, 0, 0,                 /* R9-R12 */
+                                       0, 0);                   /* R9-R10 */
-                                    &dummy,                     /* R4 */
-                                    &dummy,                     /* R5 */
-                                    &dummy,                     /* R6 */
-                                    &dummy,                     /* R7 */
-                                    &dummy,                     /* R8 */
-                                    &dummy,                     /* R9 */
-                                    &dummy,                     /* R10 */
-                                    &dummy,                     /* R11 */
-                                    &dummy);                    /* R12 */
 }
 u64 ehea_h_register_smr(const u64 adapter_handle, const u64 orig_mr_handle,
                        const u64 vaddr_in, const u32 access_ctrl, const u32 pd,
                        struct ehea_mr *mr)
 {
-        u64 hret, dummy, lkey_out;
+        u64 hret;
+        u64 outs[PLPAR_HCALL9_BUFSIZE];
-        hret = ehea_hcall_9arg_9ret(H_REGISTER_SMR,
-                                    adapter_handle       ,          /* R4 */
+        hret = ehea_plpar_hcall9(H_REGISTER_SMR,
-                                    orig_mr_handle,                 /* R5 */
+                                 outs,
-                                    vaddr_in,                       /* R6 */
+                                 adapter_handle       ,          /* R4 */
-                                    (((u64)access_ctrl) << 32ULL),  /* R7 */
+                                 orig_mr_handle,                 /* R5 */
-                                    pd,                             /* R8 */
+                                 vaddr_in,                       /* R6 */
-                                    0, 0, 0, 0,                     /* R9-R12 */
+                                 (((u64)access_ctrl) << 32ULL),  /* R7 */
-                                    &mr->handle,                    /* R4 */
+                                 pd,                             /* R8 */
-                                    &dummy,                         /* R5 */
+                                 0, 0, 0, 0);                    /* R9-R12 */
-                                    &lkey_out,                      /* R6 */
-                                    &dummy,                         /* R7 */
+        mr->handle = outs[0];
-                                    &dummy,                         /* R8 */
+        mr->lkey = (u32)outs[2];
-                                    &dummy,                         /* R9 */
-                                    &dummy,                         /* R10 */
-                                    &dummy,                         /* R11 */
-                                    &dummy);                        /* R12 */
-        mr->lkey = (u32)lkey_out;
        return hret;
 }
 u64 ehea_h_disable_and_get_hea(const u64 adapter_handle, const u64 qp_handle)
 {
-        u64 hret, dummy, ladr_next_sq_wqe_out;
+        u64 outs[PLPAR_HCALL9_BUFSIZE];
-        u64 ladr_next_rq1_wqe_out, ladr_next_rq2_wqe_out, ladr_next_rq3_wqe_out;
+        return ehea_plpar_hcall9(H_DISABLE_AND_GET_HEA,
-        hret = ehea_hcall_9arg_9ret(H_DISABLE_AND_GET_HEA,
+                                 outs,
-                                    adapter_handle,             /* R4 */
+                                 adapter_handle,                /* R4 */
-                                    H_DISABLE_GET_EHEA_WQE_P,   /* R5 */
+                                 H_DISABLE_GET_EHEA_WQE_P,      /* R5 */
-                                    qp_handle,                  /* R6 */
+                                 qp_handle,                     /* R6 */
-                                    0, 0, 0, 0, 0, 0,           /* R7-R12 */
+                                 0, 0, 0, 0, 0, 0);             /* R7-R12 */
-                                    &ladr_next_sq_wqe_out,      /* R4 */
-                                    &ladr_next_rq1_wqe_out,     /* R5 */
-                                    &ladr_next_rq2_wqe_out,     /* R6 */
-                                    &ladr_next_rq3_wqe_out,     /* R7 */
-                                    &dummy,                     /* R8 */
-                                    &dummy,                     /* R9 */
-                                    &dummy,                     /* R10 */
-                                    &dummy,                     /* R11 */
-                                    &dummy);                    /* R12 */
-        return hret;
 }
 u64 ehea_h_free_resource(const u64 adapter_handle, const u64 res_handle)
 {
-        u64 dummy;
+        return ehea_plpar_hcall_norets(H_FREE_RESOURCE,
+                                       adapter_handle,     /* R4 */
-        return ehea_hcall_9arg_9ret(H_FREE_RESOURCE,
+                                       res_handle,         /* R5 */
-                                    adapter_handle,        /* R4 */
+                                       0, 0, 0, 0, 0);     /* R6-R10 */
-                                    res_handle,            /* R5 */
-                                    0, 0, 0, 0, 0, 0, 0,   /* R6-R12 */
-                                    &dummy,                /* R4 */
-                                    &dummy,                /* R5 */
-                                    &dummy,                /* R6 */
-                                    &dummy,                /* R7 */
-                                    &dummy,                /* R8 */
-                                    &dummy,                /* R9 */
-                                    &dummy,                /* R10 */
-                                    &dummy,                /* R11 */
-                                    &dummy);               /* R12 */
 }
 u64 ehea_h_alloc_resource_mr(const u64 adapter_handle, const u64 vaddr,
                             const u64 length, const u32 access_ctrl,
                             const u32 pd, u64 *mr_handle, u32 *lkey)
 {
-        u64 hret, dummy, lkey_out;
+        u64 hret;
+        u64 outs[PLPAR_HCALL9_BUFSIZE];
-        hret = ehea_hcall_9arg_9ret(H_ALLOC_HEA_RESOURCE,
-                                    adapter_handle,                /* R4 */
+        hret = ehea_plpar_hcall9(H_ALLOC_HEA_RESOURCE,
-                                    5,                             /* R5 */
+                                 outs,
-                                    vaddr,                         /* R6 */
+                                 adapter_handle,                   /* R4 */
-                                    length,                        /* R7 */
+                                 5,                                /* R5 */
-                                    (((u64) access_ctrl) << 32ULL),/* R8 */
+                                 vaddr,                            /* R6 */
-                                    pd,                            /* R9 */
+                                 length,                           /* R7 */
-                                    0, 0, 0,                       /* R10-R12 */
+                                 (((u64) access_ctrl) << 32ULL),   /* R8 */
-                                    mr_handle,                     /* R4 */
+                                 pd,                               /* R9 */
-                                    &dummy,                        /* R5 */
+                                 0, 0, 0);                         /* R10-R12 */
-                                    &lkey_out,                     /* R6 */
-                                    &dummy,                        /* R7 */
+        *mr_handle = outs[0];
-                                    &dummy,                        /* R8 */
+        *lkey = (u32)outs[2];
-                                    &dummy,                        /* R9 */
-                                    &dummy,                        /* R10 */
-                                    &dummy,                        /* R11 */
-                                    &dummy);                       /* R12 */
-        *lkey = (u32) lkey_out;
        return hret;
 }
@@ -570,23 +518,14 @@ u64 ehea_h_register_rpage_mr(const u64 adapter_handle, const u64 mr_handle,
 u64 ehea_h_query_ehea(const u64 adapter_handle, void *cb_addr)
 {
-        u64 hret, dummy, cb_logaddr;
+        u64 hret, cb_logaddr;
        cb_logaddr = virt_to_abs(cb_addr);
-        hret = ehea_hcall_9arg_9ret(H_QUERY_HEA,
+        hret = ehea_plpar_hcall_norets(H_QUERY_HEA,
-                                    adapter_handle,             /* R4 */
+                                       adapter_handle,          /* R4 */
-                                    cb_logaddr,                 /* R5 */
+                                       cb_logaddr,              /* R5 */
-                                    0, 0, 0, 0, 0, 0, 0,        /* R6-R12 */
+                                       0, 0, 0, 0, 0);          /* R6-R10 */
-                                    &dummy,                     /* R4 */
-                                    &dummy,                     /* R5 */
-                                    &dummy,                     /* R6 */
-                                    &dummy,                     /* R7 */
-                                    &dummy,                     /* R8 */
-                                    &dummy,                     /* R9 */
-                                    &dummy,                     /* R10 */
-                                    &dummy,                     /* R11 */
-                                    &dummy);                    /* R12 */
 #ifdef DEBUG
        ehea_dmp(cb_addr, sizeof(struct hcp_query_ehea), "hcp_query_ehea");
 #endif
@@ -597,36 +536,28 @@ u64 ehea_h_query_ehea_port(const u64 adapter_handle, const u16 port_num,
                           const u8 cb_cat, const u64 select_mask,
                           void *cb_addr)
 {
-        u64 port_info, dummy;
+        u64 port_info;
        u64 cb_logaddr = virt_to_abs(cb_addr);
        u64 arr_index = 0;
        port_info = EHEA_BMASK_SET(H_MEHEAPORT_CAT, cb_cat)
                  | EHEA_BMASK_SET(H_MEHEAPORT_PN, port_num);
-        return ehea_hcall_9arg_9ret(H_QUERY_HEA_PORT,
+        return ehea_plpar_hcall_norets(H_QUERY_HEA_PORT,
-                                    adapter_handle,             /* R4 */
+                                       adapter_handle,          /* R4 */
-                                    port_info,                  /* R5 */
+                                       port_info,               /* R5 */
-                                    select_mask,                /* R6 */
+                                       select_mask,             /* R6 */
-                                    arr_index,                  /* R7 */
+                                       arr_index,               /* R7 */
-                                    cb_logaddr,                 /* R8 */
+                                       cb_logaddr,              /* R8 */
-                                    0, 0, 0, 0,                 /* R9-R12 */
+                                       0, 0);                   /* R9-R10 */
-                                    &dummy,                     /* R4 */
-                                    &dummy,                     /* R5 */
-                                    &dummy,                     /* R6 */
-                                    &dummy,                     /* R7 */
-                                    &dummy,                     /* R8 */
-                                    &dummy,                     /* R9 */
-                                    &dummy,                     /* R10 */
-                                    &dummy,                     /* R11 */
-                                    &dummy);                    /* R12 */
 }
 u64 ehea_h_modify_ehea_port(const u64 adapter_handle, const u16 port_num,
                            const u8 cb_cat, const u64 select_mask,
                            void *cb_addr)
 {
-        u64 port_info, dummy, inv_attr_ident, proc_mask;
+        u64 outs[PLPAR_HCALL9_BUFSIZE];
+        u64 port_info;
        u64 arr_index = 0;
        u64 cb_logaddr = virt_to_abs(cb_addr);
@@ -635,29 +566,21 @@ u64 ehea_h_modify_ehea_port(const u64 adapter_handle, const u16 port_num,
 #ifdef DEBUG
        ehea_dump(cb_addr, sizeof(struct hcp_ehea_port_cb0), "Before HCALL");
 #endif
-        return ehea_hcall_9arg_9ret(H_MODIFY_HEA_PORT,
+        return ehea_plpar_hcall9(H_MODIFY_HEA_PORT,
-                                    adapter_handle,             /* R4 */
+                                 outs,
-                                    port_info,                  /* R5 */
+                                 adapter_handle,                /* R4 */
-                                    select_mask,                /* R6 */
+                                 port_info,                     /* R5 */
-                                    arr_index,                  /* R7 */
+                                 select_mask,                   /* R6 */
-                                    cb_logaddr,                 /* R8 */
+                                 arr_index,                     /* R7 */
-                                    0, 0, 0, 0,                 /* R9-R12 */
+                                 cb_logaddr,                    /* R8 */
-                                    &inv_attr_ident,            /* R4 */
+                                 0, 0, 0, 0);                   /* R9-R12 */
-                                    &proc_mask,                 /* R5 */
-                                    &dummy,                     /* R6 */
-                                    &dummy,                     /* R7 */
-                                    &dummy,                     /* R8 */
-                                    &dummy,                     /* R9 */
-                                    &dummy,                     /* R10 */
-                                    &dummy,                     /* R11 */
-                                    &dummy);                    /* R12 */
 }
 u64 ehea_h_reg_dereg_bcmc(const u64 adapter_handle, const u16 port_num,
                          const u8 reg_type, const u64 mc_mac_addr,
                          const u16 vlan_id, const u32 hcall_id)
 {
-        u64 r5_port_num, r6_reg_type, r7_mc_mac_addr, r8_vlan_id, dummy;
+        u64 r5_port_num, r6_reg_type, r7_mc_mac_addr, r8_vlan_id;
        u64 mac_addr = mc_mac_addr >> 16;
        r5_port_num = EHEA_BMASK_SET(H_REGBCMC_PN, port_num);
@@ -665,41 +588,21 @@ u64 ehea_h_reg_dereg_bcmc(const u64 adapter_handle, const u16 port_num,
        r7_mc_mac_addr = EHEA_BMASK_SET(H_REGBCMC_MACADDR, mac_addr);
        r8_vlan_id = EHEA_BMASK_SET(H_REGBCMC_VLANID, vlan_id);
-        return ehea_hcall_9arg_9ret(hcall_id,
+        return ehea_plpar_hcall_norets(hcall_id,
-                                    adapter_handle,             /* R4 */
+                                       adapter_handle,          /* R4 */
-                                    r5_port_num,                /* R5 */
+                                       r5_port_num,             /* R5 */
-                                    r6_reg_type,                /* R6 */
+                                       r6_reg_type,             /* R6 */
-                                    r7_mc_mac_addr,             /* R7 */
+                                       r7_mc_mac_addr,          /* R7 */
-                                    r8_vlan_id,                 /* R8 */
+                                       r8_vlan_id,              /* R8 */
-                                    0, 0, 0, 0,                 /* R9-R12 */
+                                       0, 0);                   /* R9-R12 */
-                                    &dummy,                     /* R4 */
-                                    &dummy,                     /* R5 */
-                                    &dummy,                     /* R6 */
-                                    &dummy,                     /* R7 */
-                                    &dummy,                     /* R8 */
-                                    &dummy,                     /* R9 */
-                                    &dummy,                     /* R10 */
-                                    &dummy,                     /* R11 */
-                                    &dummy);                    /* R12 */
 }
 u64 ehea_h_reset_events(const u64 adapter_handle, const u64 neq_handle,
                        const u64 event_mask)
 {
-        u64 dummy;
+        return ehea_plpar_hcall_norets(H_RESET_EVENTS,
+                                       adapter_handle,          /* R4 */
-        return ehea_hcall_9arg_9ret(H_RESET_EVENTS,
+                                       neq_handle,              /* R5 */
-                                    adapter_handle,             /* R4 */
+                                       event_mask,              /* R6 */
-                                    neq_handle,                 /* R5 */
+                                       0, 0, 0, 0);             /* R7-R12 */
-                                    event_mask,                 /* R6 */
-                                    0, 0, 0, 0, 0, 0,           /* R7-R12 */
-                                    &dummy,                     /* R4 */
-                                    &dummy,                     /* R5 */
-                                    &dummy,                     /* R6 */
-                                    &dummy,                     /* R7 */
-                                    &dummy,                     /* R8 */
-                                    &dummy,                     /* R9 */
-                                    &dummy,                     /* R10 */
-                                    &dummy,                     /* R11 */
-                                    &dummy);                    /* R12 */
 }
diff --git a/drivers/net/eth16i.c b/drivers/net/eth16i.c
index 8cc3c331aca8..b7b8bc2a6307 100644
--- a/drivers/net/eth16i.c
+++ b/drivers/net/eth16i.c
@@ -162,9 +162,9 @@ static char *version =
 #include <linux/skbuff.h>
 #include <linux/bitops.h>
 #include <linux/jiffies.h>
+#include <linux/io.h>
 #include <asm/system.h>
-#include <asm/io.h>
 #include <asm/dma.h>
diff --git a/drivers/net/forcedeth.c b/drivers/net/forcedeth.c
index 99b7a411db28..c5ed635bce36 100644
--- a/drivers/net/forcedeth.c
+++ b/drivers/net/forcedeth.c
@@ -2497,6 +2497,7 @@ static irqreturn_t nv_nic_irq_tx(int foo, void *data)
        u8 __iomem *base = get_hwbase(dev);
        u32 events;
        int i;
+        unsigned long flags;
        dprintk(KERN_DEBUG "%s: nv_nic_irq_tx\n", dev->name);
@@ -2508,16 +2509,16 @@ static irqreturn_t nv_nic_irq_tx(int foo, void *data)
                if (!(events & np->irqmask))
                        break;
-                spin_lock_irq(&np->lock);
+                spin_lock_irqsave(&np->lock, flags);
                nv_tx_done(dev);
-                spin_unlock_irq(&np->lock);
+                spin_unlock_irqrestore(&np->lock, flags);
                if (events & (NVREG_IRQ_TX_ERR)) {
                        dprintk(KERN_DEBUG "%s: received irq with events 0x%x. Probably TX fail.\n",
                                                dev->name, events);
                }
                if (i > max_interrupt_work) {
-                        spin_lock_irq(&np->lock);
+                        spin_lock_irqsave(&np->lock, flags);
                        /* disable interrupts on the nic */
                        writel(NVREG_IRQ_TX_ALL, base + NvRegIrqMask);
                        pci_push(base);
@@ -2527,7 +2528,7 @@ static irqreturn_t nv_nic_irq_tx(int foo, void *data)
                                mod_timer(&np->nic_poll, jiffies + POLL_WAIT);
                        }
                        printk(KERN_DEBUG "%s: too many iterations (%d) in nv_nic_irq_tx.\n", dev->name, i);
-                        spin_unlock_irq(&np->lock);
+                        spin_unlock_irqrestore(&np->lock, flags);
                        break;
                }
@@ -2601,6 +2602,7 @@ static irqreturn_t nv_nic_irq_rx(int foo, void *data)
        u8 __iomem *base = get_hwbase(dev);
        u32 events;
        int i;
+        unsigned long flags;
        dprintk(KERN_DEBUG "%s: nv_nic_irq_rx\n", dev->name);
@@ -2614,14 +2616,14 @@ static irqreturn_t nv_nic_irq_rx(int foo, void *data)
                nv_rx_process(dev, dev->weight);
                if (nv_alloc_rx(dev)) {
-                        spin_lock_irq(&np->lock);
+                        spin_lock_irqsave(&np->lock, flags);
                        if (!np->in_shutdown)
                                mod_timer(&np->oom_kick, jiffies + OOM_REFILL);
-                        spin_unlock_irq(&np->lock);
+                        spin_unlock_irqrestore(&np->lock, flags);
                }
                if (i > max_interrupt_work) {
-                        spin_lock_irq(&np->lock);
+                        spin_lock_irqsave(&np->lock, flags);
                        /* disable interrupts on the nic */
                        writel(NVREG_IRQ_RX_ALL, base + NvRegIrqMask);
                        pci_push(base);
@@ -2631,7 +2633,7 @@ static irqreturn_t nv_nic_irq_rx(int foo, void *data)
                                mod_timer(&np->nic_poll, jiffies + POLL_WAIT);
                        }
                        printk(KERN_DEBUG "%s: too many iterations (%d) in nv_nic_irq_rx.\n", dev->name, i);
-                        spin_unlock_irq(&np->lock);
+                        spin_unlock_irqrestore(&np->lock, flags);
                        break;
                }
        }
@@ -2648,6 +2650,7 @@ static irqreturn_t nv_nic_irq_other(int foo, void *data)
        u8 __iomem *base = get_hwbase(dev);
        u32 events;
        int i;
+        unsigned long flags;
        dprintk(KERN_DEBUG "%s: nv_nic_irq_other\n", dev->name);
@@ -2660,14 +2663,14 @@ static irqreturn_t nv_nic_irq_other(int foo, void *data)
                        break;
                if (events & NVREG_IRQ_LINK) {
-                        spin_lock_irq(&np->lock);
+                        spin_lock_irqsave(&np->lock, flags);
                        nv_link_irq(dev);
-                        spin_unlock_irq(&np->lock);
+                        spin_unlock_irqrestore(&np->lock, flags);
                }
                if (np->need_linktimer && time_after(jiffies, np->link_timeout)) {
-                        spin_lock_irq(&np->lock);
+                        spin_lock_irqsave(&np->lock, flags);
                        nv_linkchange(dev);
-                        spin_unlock_irq(&np->lock);
+                        spin_unlock_irqrestore(&np->lock, flags);
                        np->link_timeout = jiffies + LINK_TIMEOUT;
                }
                if (events & (NVREG_IRQ_UNKNOWN)) {
@@ -2675,7 +2678,7 @@ static irqreturn_t nv_nic_irq_other(int foo, void *data)
                                                dev->name, events);
                }
                if (i > max_interrupt_work) {
-                        spin_lock_irq(&np->lock);
+                        spin_lock_irqsave(&np->lock, flags);
                        /* disable interrupts on the nic */
                        writel(NVREG_IRQ_OTHER, base + NvRegIrqMask);
                        pci_push(base);
@@ -2685,7 +2688,7 @@ static irqreturn_t nv_nic_irq_other(int foo, void *data)
                                mod_timer(&np->nic_poll, jiffies + POLL_WAIT);
                        }
                        printk(KERN_DEBUG "%s: too many iterations (%d) in nv_nic_irq_other.\n", dev->name, i);
-                        spin_unlock_irq(&np->lock);
+                        spin_unlock_irqrestore(&np->lock, flags);
                        break;
                }
diff --git a/drivers/net/ibmveth.c b/drivers/net/ibmveth.c
index 4bac3cd8f235..2802db23d3cb 100644
--- a/drivers/net/ibmveth.c
+++ b/drivers/net/ibmveth.c
@@ -213,6 +213,7 @@ static void ibmveth_replenish_buffer_pool(struct ibmveth_adapter *adapter, struc
                }
                free_index = pool->consumer_index++ % pool->size;
+                pool->consumer_index = free_index;
                index = pool->free_map[free_index];
                ibmveth_assert(index != IBM_VETH_INVALID_MAP);
@@ -238,7 +239,10 @@ static void ibmveth_replenish_buffer_pool(struct ibmveth_adapter *adapter, struc
                if(lpar_rc != H_SUCCESS) {
                        pool->free_map[free_index] = index;
                        pool->skbuff[index] = NULL;
-                        pool->consumer_index--;
+                        if (pool->consumer_index == 0)
+                                pool->consumer_index = pool->size - 1;
+                        else
+                                pool->consumer_index--;
                        dma_unmap_single(&adapter->vdev->dev,
                                        pool->dma_addr[index], pool->buff_size,
                                        DMA_FROM_DEVICE);
@@ -326,6 +330,7 @@ static void ibmveth_remove_buffer_from_pool(struct ibmveth_adapter *adapter, u64
                         DMA_FROM_DEVICE);
        free_index = adapter->rx_buff_pool[pool].producer_index++ % adapter->rx_buff_pool[pool].size;
+        adapter->rx_buff_pool[pool].producer_index = free_index;
        adapter->rx_buff_pool[pool].free_map[free_index] = index;
        mb();
@@ -437,6 +442,31 @@ static void ibmveth_cleanup(struct ibmveth_adapter *adapter)
                                                 &adapter->rx_buff_pool[i]);
 }
+static int ibmveth_register_logical_lan(struct ibmveth_adapter *adapter,
+        union ibmveth_buf_desc rxq_desc, u64 mac_address)
+{
+        int rc, try_again = 1;
+        /* After a kexec the adapter will still be open, so our attempt to
+        * open it will fail. So if we get a failure we free the adapter and
+        * try again, but only once. */
+retry:
+        rc = h_register_logical_lan(adapter->vdev->unit_address,
+                                    adapter->buffer_list_dma, rxq_desc.desc,
+                                    adapter->filter_list_dma, mac_address);
+        if (rc != H_SUCCESS && try_again) {
+                do {
+                        rc = h_free_logical_lan(adapter->vdev->unit_address);
+                } while (H_IS_LONG_BUSY(rc) || (rc == H_BUSY));
+                try_again = 0;
+                goto retry;
+        }
+        return rc;
+}
 static int ibmveth_open(struct net_device *netdev)
 {
        struct ibmveth_adapter *adapter = netdev->priv;
@@ -502,12 +532,9 @@ static int ibmveth_open(struct net_device *netdev)
        ibmveth_debug_printk("filter list @ 0x%p\n", adapter->filter_list_addr);
        ibmveth_debug_printk("receive q   @ 0x%p\n", adapter->rx_queue.queue_addr);
+        h_vio_signal(adapter->vdev->unit_address, VIO_IRQ_DISABLE);
-        lpar_rc = h_register_logical_lan(adapter->vdev->unit_address,
+        lpar_rc = ibmveth_register_logical_lan(adapter, rxq_desc, mac_address);
-                                         adapter->buffer_list_dma,
-                                         rxq_desc.desc,
-                                         adapter->filter_list_dma,
-                                         mac_address);
        if(lpar_rc != H_SUCCESS) {
                ibmveth_error_printk("h_register_logical_lan failed with %ld\n", lpar_rc);
@@ -905,6 +932,14 @@ static int ibmveth_change_mtu(struct net_device *dev, int new_mtu)
        return -EINVAL;
 }
+#ifdef CONFIG_NET_POLL_CONTROLLER
+static void ibmveth_poll_controller(struct net_device *dev)
+{
+        ibmveth_replenish_task(dev->priv);
+        ibmveth_interrupt(dev->irq, dev);
+}
+#endif
 static int __devinit ibmveth_probe(struct vio_dev *dev, const struct vio_device_id *id)
 {
        int rc, i;
@@ -977,6 +1012,9 @@ static int __devinit ibmveth_probe(struct vio_dev *dev, const struct vio_device_
        netdev->ethtool_ops           = &netdev_ethtool_ops;
        netdev->change_mtu         = ibmveth_change_mtu;
        SET_NETDEV_DEV(netdev, &dev->dev);
+#ifdef CONFIG_NET_POLL_CONTROLLER
+        netdev->poll_controller = ibmveth_poll_controller;
+#endif
        netdev->features |= NETIF_F_LLTX;
        spin_lock_init(&adapter->stats_lock);
@@ -1132,7 +1170,9 @@ static void ibmveth_proc_register_adapter(struct ibmveth_adapter *adapter)
 {
        struct proc_dir_entry *entry;
        if (ibmveth_proc_dir) {
-                entry = create_proc_entry(adapter->netdev->name, S_IFREG, ibmveth_proc_dir);
+                char u_addr[10];
+                sprintf(u_addr, "%x", adapter->vdev->unit_address);
+                entry = create_proc_entry(u_addr, S_IFREG, ibmveth_proc_dir);
                if (!entry) {
                        ibmveth_error_printk("Cannot create adapter proc entry");
                } else {
@@ -1147,7 +1187,9 @@ static void ibmveth_proc_register_adapter(struct ibmveth_adapter *adapter)
 static void ibmveth_proc_unregister_adapter(struct ibmveth_adapter *adapter)
 {
        if (ibmveth_proc_dir) {
-                remove_proc_entry(adapter->netdev->name, ibmveth_proc_dir);
+                char u_addr[10];
+                sprintf(u_addr, "%x", adapter->vdev->unit_address);
+                remove_proc_entry(u_addr, ibmveth_proc_dir);
        }
 }
diff --git a/drivers/net/mv643xx_eth.c b/drivers/net/mv643xx_eth.c
index 2ffa3a59e704..9997081c6dae 100644
--- a/drivers/net/mv643xx_eth.c
+++ b/drivers/net/mv643xx_eth.c
@@ -2155,7 +2155,7 @@ static void eth_update_mib_counters(struct mv643xx_private *mp)
        for (offset = ETH_MIB_BAD_OCTETS_RECEIVED;
                        offset <= ETH_MIB_FRAMES_1024_TO_MAX_OCTETS;
                        offset += 4)
-                *(u32 *)((char *)p + offset) = read_mib(mp, offset);
+                *(u32 *)((char *)p + offset) += read_mib(mp, offset);
        p->good_octets_sent += read_mib(mp, ETH_MIB_GOOD_OCTETS_SENT_LOW);
        p->good_octets_sent +=
@@ -2164,7 +2164,7 @@ static void eth_update_mib_counters(struct mv643xx_private *mp)
        for (offset = ETH_MIB_GOOD_FRAMES_SENT;
                        offset <= ETH_MIB_LATE_COLLISION;
                        offset += 4)
-                *(u32 *)((char *)p + offset) = read_mib(mp, offset);
+                *(u32 *)((char *)p + offset) += read_mib(mp, offset);
 }
 /*
diff --git a/drivers/net/skge.c b/drivers/net/skge.c
index a4a58e4e93a1..e7e414928f89 100644
--- a/drivers/net/skge.c
+++ b/drivers/net/skge.c
@@ -43,7 +43,7 @@
 #include "skge.h"
 #define DRV_NAME                "skge"
-#define DRV_VERSION             "1.8"
+#define DRV_VERSION             "1.9"
 #define PFX                     DRV_NAME " "
 #define DEFAULT_TX_RING_SIZE    128
@@ -197,8 +197,8 @@ static u32 skge_supported_modes(const struct skge_hw *hw)
                else if (hw->chip_id == CHIP_ID_YUKON)
                        supported &= ~SUPPORTED_1000baseT_Half;
        } else
-                supported = SUPPORTED_1000baseT_Full | SUPPORTED_FIBRE
+                supported = SUPPORTED_1000baseT_Full | SUPPORTED_1000baseT_Half
-                        | SUPPORTED_Autoneg;
+                        | SUPPORTED_FIBRE | SUPPORTED_Autoneg;
        return supported;
 }
@@ -487,31 +487,37 @@ static void skge_get_pauseparam(struct net_device *dev,
 {
        struct skge_port *skge = netdev_priv(dev);
-        ecmd->tx_pause = (skge->flow_control == FLOW_MODE_LOC_SEND)
+        ecmd->rx_pause = (skge->flow_control == FLOW_MODE_SYMMETRIC)
-                || (skge->flow_control == FLOW_MODE_SYMMETRIC);
+                || (skge->flow_control == FLOW_MODE_SYM_OR_REM);
-        ecmd->rx_pause = (skge->flow_control == FLOW_MODE_REM_SEND)
+        ecmd->tx_pause = ecmd->rx_pause || (skge->flow_control == FLOW_MODE_LOC_SEND);
-                || (skge->flow_control == FLOW_MODE_SYMMETRIC);
-        ecmd->autoneg = skge->autoneg;
+        ecmd->autoneg = ecmd->rx_pause || ecmd->tx_pause;
 }
 static int skge_set_pauseparam(struct net_device *dev,
                               struct ethtool_pauseparam *ecmd)
 {
        struct skge_port *skge = netdev_priv(dev);
+        struct ethtool_pauseparam old;
-        skge->autoneg = ecmd->autoneg;
+        skge_get_pauseparam(dev, &old);
-        if (ecmd->rx_pause && ecmd->tx_pause)
-                skge->flow_control = FLOW_MODE_SYMMETRIC;
+        if (ecmd->autoneg != old.autoneg)
-        else if (ecmd->rx_pause && !ecmd->tx_pause)
+                skge->flow_control = ecmd->autoneg ? FLOW_MODE_NONE : FLOW_MODE_SYMMETRIC;
-                skge->flow_control = FLOW_MODE_REM_SEND;
+        else {
-        else if (!ecmd->rx_pause && ecmd->tx_pause)
+                if (ecmd->rx_pause && ecmd->tx_pause)
-                skge->flow_control = FLOW_MODE_LOC_SEND;
+                        skge->flow_control = FLOW_MODE_SYMMETRIC;
-        else
+                else if (ecmd->rx_pause && !ecmd->tx_pause)
-                skge->flow_control = FLOW_MODE_NONE;
+                        skge->flow_control = FLOW_MODE_SYM_OR_REM;
+                else if (!ecmd->rx_pause && ecmd->tx_pause)
+                        skge->flow_control = FLOW_MODE_LOC_SEND;
+                else
+                        skge->flow_control = FLOW_MODE_NONE;
+        }
        if (netif_running(dev))
                skge_phy_reset(skge);
        return 0;
 }
@@ -854,6 +860,23 @@ static int skge_rx_fill(struct net_device *dev)
        return 0;
 }
+static const char *skge_pause(enum pause_status status)
+{
+        switch(status) {
+        case FLOW_STAT_NONE:
+                return "none";
+        case FLOW_STAT_REM_SEND:
+                return "rx only";
+        case FLOW_STAT_LOC_SEND:
+                return "tx_only";
+        case FLOW_STAT_SYMMETRIC:               /* Both station may send PAUSE */
+                return "both";
+        default:
+                return "indeterminated";
+        }
+}
 static void skge_link_up(struct skge_port *skge)
 {
        skge_write8(skge->hw, SK_REG(skge->port, LNK_LED_REG),
@@ -862,16 +885,13 @@ static void skge_link_up(struct skge_port *skge)
        netif_carrier_on(skge->netdev);
        netif_wake_queue(skge->netdev);
-        if (netif_msg_link(skge))
+        if (netif_msg_link(skge)) {
                printk(KERN_INFO PFX
                       "%s: Link is up at %d Mbps, %s duplex, flow control %s\n",
                       skge->netdev->name, skge->speed,
                       skge->duplex == DUPLEX_FULL ? "full" : "half",
-                       (skge->flow_control == FLOW_MODE_NONE) ? "none" :
+                       skge_pause(skge->flow_status));
-                       (skge->flow_control == FLOW_MODE_LOC_SEND) ? "tx only" :
+        }
-                       (skge->flow_control == FLOW_MODE_REM_SEND) ? "rx only" :
-                       (skge->flow_control == FLOW_MODE_SYMMETRIC) ? "tx and rx" :
-                       "unknown");
 }
 static void skge_link_down(struct skge_port *skge)
@@ -884,6 +904,29 @@ static void skge_link_down(struct skge_port *skge)
                printk(KERN_INFO PFX "%s: Link is down.\n", skge->netdev->name);
 }
+static void xm_link_down(struct skge_hw *hw, int port)
+{
+        struct net_device *dev = hw->dev[port];
+        struct skge_port *skge = netdev_priv(dev);
+        u16 cmd, msk;
+        if (hw->phy_type == SK_PHY_XMAC) {
+                msk = xm_read16(hw, port, XM_IMSK);
+                msk |= XM_IS_INP_ASS | XM_IS_LIPA_RC | XM_IS_RX_PAGE | XM_IS_AND;
+                xm_write16(hw, port, XM_IMSK, msk);
+        }
+        cmd = xm_read16(hw, port, XM_MMU_CMD);
+        cmd &= ~(XM_MMU_ENA_RX | XM_MMU_ENA_TX);
+        xm_write16(hw, port, XM_MMU_CMD, cmd);
+        /* dummy read to ensure writing */
+        (void) xm_read16(hw, port, XM_MMU_CMD);
+        if (netif_carrier_ok(dev))
+                skge_link_down(skge);
+}
 static int __xm_phy_read(struct skge_hw *hw, int port, u16 reg, u16 *val)
 {
        int i;
@@ -992,7 +1035,15 @@ static const u16 phy_pause_map[] = {
        [FLOW_MODE_NONE] =      0,
        [FLOW_MODE_LOC_SEND] =  PHY_AN_PAUSE_ASYM,
        [FLOW_MODE_SYMMETRIC] = PHY_AN_PAUSE_CAP,
-        [FLOW_MODE_REM_SEND]  = PHY_AN_PAUSE_CAP | PHY_AN_PAUSE_ASYM,
+        [FLOW_MODE_SYM_OR_REM]  = PHY_AN_PAUSE_CAP | PHY_AN_PAUSE_ASYM,
+};
+/* special defines for FIBER (88E1011S only) */
+static const u16 fiber_pause_map[] = {
+        [FLOW_MODE_NONE]        = PHY_X_P_NO_PAUSE,
+        [FLOW_MODE_LOC_SEND]    = PHY_X_P_ASYM_MD,
+        [FLOW_MODE_SYMMETRIC]   = PHY_X_P_SYM_MD,
+        [FLOW_MODE_SYM_OR_REM]  = PHY_X_P_BOTH_MD,
 };
@@ -1008,14 +1059,7 @@ static void bcom_check_link(struct skge_hw *hw, int port)
        status = xm_phy_read(hw, port, PHY_BCOM_STAT);
        if ((status & PHY_ST_LSYNC) == 0) {
-                u16 cmd = xm_read16(hw, port, XM_MMU_CMD);
+                xm_link_down(hw, port);
-                cmd &= ~(XM_MMU_ENA_RX | XM_MMU_ENA_TX);
-                xm_write16(hw, port, XM_MMU_CMD, cmd);
-                /* dummy read to ensure writing */
-                (void) xm_read16(hw, port, XM_MMU_CMD);
-                if (netif_carrier_ok(dev))
-                        skge_link_down(skge);
                return;
        }
@@ -1048,20 +1092,19 @@ static void bcom_check_link(struct skge_hw *hw, int port)
                        return;
                }
                /* We are using IEEE 802.3z/D5.0 Table 37-4 */
                switch (aux & PHY_B_AS_PAUSE_MSK) {
                case PHY_B_AS_PAUSE_MSK:
-                        skge->flow_control = FLOW_MODE_SYMMETRIC;
+                        skge->flow_status = FLOW_STAT_SYMMETRIC;
                        break;
                case PHY_B_AS_PRR:
-                        skge->flow_control = FLOW_MODE_REM_SEND;
+                        skge->flow_status = FLOW_STAT_REM_SEND;
                        break;
                case PHY_B_AS_PRT:
-                        skge->flow_control = FLOW_MODE_LOC_SEND;
+                        skge->flow_status = FLOW_STAT_LOC_SEND;
                        break;
                default:
-                        skge->flow_control = FLOW_MODE_NONE;
+                        skge->flow_status = FLOW_STAT_NONE;
                }
                skge->speed = SPEED_1000;
        }
@@ -1191,17 +1234,7 @@ static void xm_phy_init(struct skge_port *skge)
                if (skge->advertising & ADVERTISED_1000baseT_Full)
                        ctrl |= PHY_X_AN_FD;
-                switch(skge->flow_control) {
+                ctrl |= fiber_pause_map[skge->flow_control];
-                case FLOW_MODE_NONE:
-                        ctrl |= PHY_X_P_NO_PAUSE;
-                        break;
-                case FLOW_MODE_LOC_SEND:
-                        ctrl |= PHY_X_P_ASYM_MD;
-                        break;
-                case FLOW_MODE_SYMMETRIC:
-                        ctrl |= PHY_X_P_BOTH_MD;
-                        break;
-                }
                xm_phy_write(hw, port, PHY_XMAC_AUNE_ADV, ctrl);
@@ -1235,14 +1268,7 @@ static void xm_check_link(struct net_device *dev)
        status = xm_phy_read(hw, port, PHY_XMAC_STAT);
        if ((status & PHY_ST_LSYNC) == 0) {
-                u16 cmd = xm_read16(hw, port, XM_MMU_CMD);
+                xm_link_down(hw, port);
-                cmd &= ~(XM_MMU_ENA_RX | XM_MMU_ENA_TX);
-                xm_write16(hw, port, XM_MMU_CMD, cmd);
-                /* dummy read to ensure writing */
-                (void) xm_read16(hw, port, XM_MMU_CMD);
-                if (netif_carrier_ok(dev))
-                        skge_link_down(skge);
                return;
        }
@@ -1276,15 +1302,20 @@ static void xm_check_link(struct net_device *dev)
                }
                /* We are using IEEE 802.3z/D5.0 Table 37-4 */
-                if (lpa & PHY_X_P_SYM_MD)
+                if ((skge->flow_control == FLOW_MODE_SYMMETRIC ||
-                        skge->flow_control = FLOW_MODE_SYMMETRIC;
+                     skge->flow_control == FLOW_MODE_SYM_OR_REM) &&
-                else if ((lpa & PHY_X_RS_PAUSE) == PHY_X_P_ASYM_MD)
+                    (lpa & PHY_X_P_SYM_MD))
-                        skge->flow_control = FLOW_MODE_REM_SEND;
+                        skge->flow_status = FLOW_STAT_SYMMETRIC;
-                else if ((lpa & PHY_X_RS_PAUSE) == PHY_X_P_BOTH_MD)
+                else if (skge->flow_control == FLOW_MODE_SYM_OR_REM &&
-                        skge->flow_control = FLOW_MODE_LOC_SEND;
+                         (lpa & PHY_X_RS_PAUSE) == PHY_X_P_ASYM_MD)
+                        /* Enable PAUSE receive, disable PAUSE transmit */
+                        skge->flow_status  = FLOW_STAT_REM_SEND;
+                else if (skge->flow_control == FLOW_MODE_LOC_SEND &&
+                         (lpa & PHY_X_RS_PAUSE) == PHY_X_P_BOTH_MD)
+                        /* Disable PAUSE receive, enable PAUSE transmit */
+                        skge->flow_status = FLOW_STAT_LOC_SEND;
                else
-                        skge->flow_control = FLOW_MODE_NONE;
+                        skge->flow_status = FLOW_STAT_NONE;
                skge->speed = SPEED_1000;
        }
@@ -1568,6 +1599,10 @@ static void genesis_mac_intr(struct skge_hw *hw, int port)
                printk(KERN_DEBUG PFX "%s: mac interrupt status 0x%x\n",
                       skge->netdev->name, status);
+        if (hw->phy_type == SK_PHY_XMAC &&
+            (status & (XM_IS_INP_ASS | XM_IS_LIPA_RC)))
+                xm_link_down(hw, port);
        if (status & XM_IS_TXF_UR) {
                xm_write32(hw, port, XM_MODE, XM_MD_FTF);
                ++skge->net_stats.tx_fifo_errors;
@@ -1582,7 +1617,7 @@ static void genesis_link_up(struct skge_port *skge)
 {
        struct skge_hw *hw = skge->hw;
        int port = skge->port;
-        u16 cmd;
+        u16 cmd, msk;
        u32 mode;
        cmd = xm_read16(hw, port, XM_MMU_CMD);
@@ -1591,8 +1626,8 @@ static void genesis_link_up(struct skge_port *skge)
         * enabling pause frame reception is required for 1000BT
         * because the XMAC is not reset if the link is going down
         */
-        if (skge->flow_control == FLOW_MODE_NONE ||
+        if (skge->flow_status == FLOW_STAT_NONE ||
-            skge->flow_control == FLOW_MODE_LOC_SEND)
+            skge->flow_status == FLOW_STAT_LOC_SEND)
                /* Disable Pause Frame Reception */
                cmd |= XM_MMU_IGN_PF;
        else
@@ -1602,8 +1637,8 @@ static void genesis_link_up(struct skge_port *skge)
        xm_write16(hw, port, XM_MMU_CMD, cmd);
        mode = xm_read32(hw, port, XM_MODE);
-        if (skge->flow_control == FLOW_MODE_SYMMETRIC ||
+        if (skge->flow_status== FLOW_STAT_SYMMETRIC ||
-            skge->flow_control == FLOW_MODE_LOC_SEND) {
+            skge->flow_status == FLOW_STAT_LOC_SEND) {
                /*
                 * Configure Pause Frame Generation
                 * Use internal and external Pause Frame Generation.
@@ -1631,7 +1666,11 @@ static void genesis_link_up(struct skge_port *skge)
        }
        xm_write32(hw, port, XM_MODE, mode);
-        xm_write16(hw, port, XM_IMSK, XM_DEF_MSK);
+        msk = XM_DEF_MSK;
+        if (hw->phy_type != SK_PHY_XMAC)
+                msk |= XM_IS_INP_ASS;   /* disable GP0 interrupt bit */
+        xm_write16(hw, port, XM_IMSK, msk);
        xm_read16(hw, port, XM_ISRC);
        /* get MMU Command Reg. */
@@ -1779,11 +1818,17 @@ static void yukon_init(struct skge_hw *hw, int port)
                                adv |= PHY_M_AN_10_FD;
                        if (skge->advertising & ADVERTISED_10baseT_Half)
                                adv |= PHY_M_AN_10_HD;
-                } else  /* special defines for FIBER (88E1011S only) */
-                        adv |= PHY_M_AN_1000X_AHD | PHY_M_AN_1000X_AFD;
-                /* Set Flow-control capabilities */
+                        /* Set Flow-control capabilities */
-                adv |= phy_pause_map[skge->flow_control];
+                        adv |= phy_pause_map[skge->flow_control];
+                } else {
+                        if (skge->advertising & ADVERTISED_1000baseT_Full)
+                                adv |= PHY_M_AN_1000X_AFD;
+                        if (skge->advertising & ADVERTISED_1000baseT_Half)
+                                adv |= PHY_M_AN_1000X_AHD;
+                        adv |= fiber_pause_map[skge->flow_control];
+                }
                /* Restart Auto-negotiation */
                ctrl |= PHY_CT_ANE | PHY_CT_RE_CFG;
@@ -1917,6 +1962,11 @@ static void yukon_mac_init(struct skge_hw *hw, int port)
        case FLOW_MODE_LOC_SEND:
                /* disable Rx flow-control */
                reg |= GM_GPCR_FC_RX_DIS | GM_GPCR_AU_FCT_DIS;
+                break;
+        case FLOW_MODE_SYMMETRIC:
+        case FLOW_MODE_SYM_OR_REM:
+                /* enable Tx & Rx flow-control */
+                break;
        }
        gma_write16(hw, port, GM_GP_CTRL, reg);
@@ -2111,13 +2161,11 @@ static void yukon_link_down(struct skge_port *skge)
        ctrl &= ~(GM_GPCR_RX_ENA | GM_GPCR_TX_ENA);
        gma_write16(hw, port, GM_GP_CTRL, ctrl);
-        if (skge->flow_control == FLOW_MODE_REM_SEND) {
+        if (skge->flow_status == FLOW_STAT_REM_SEND) {
+                ctrl = gm_phy_read(hw, port, PHY_MARV_AUNE_ADV);
+                ctrl |= PHY_M_AN_ASP;
                /* restore Asymmetric Pause bit */
-                gm_phy_write(hw, port, PHY_MARV_AUNE_ADV,
+                gm_phy_write(hw, port, PHY_MARV_AUNE_ADV, ctrl);
-                                  gm_phy_read(hw, port,
-                                                   PHY_MARV_AUNE_ADV)
-                                  | PHY_M_AN_ASP);
        }
        yukon_reset(hw, port);
@@ -2164,19 +2212,19 @@ static void yukon_phy_intr(struct skge_port *skge)
                /* We are using IEEE 802.3z/D5.0 Table 37-4 */
                switch (phystat & PHY_M_PS_PAUSE_MSK) {
                case PHY_M_PS_PAUSE_MSK:
-                        skge->flow_control = FLOW_MODE_SYMMETRIC;
+                        skge->flow_status = FLOW_STAT_SYMMETRIC;
                        break;
                case PHY_M_PS_RX_P_EN:
-                        skge->flow_control = FLOW_MODE_REM_SEND;
+                        skge->flow_status = FLOW_STAT_REM_SEND;
                        break;
                case PHY_M_PS_TX_P_EN:
-                        skge->flow_control = FLOW_MODE_LOC_SEND;
+                        skge->flow_status = FLOW_STAT_LOC_SEND;
                        break;
                default:
-                        skge->flow_control = FLOW_MODE_NONE;
+                        skge->flow_status = FLOW_STAT_NONE;
                }
-                if (skge->flow_control == FLOW_MODE_NONE ||
+                if (skge->flow_status == FLOW_STAT_NONE ||
                    (skge->speed < SPEED_1000 && skge->duplex == DUPLEX_HALF))
                        skge_write8(hw, SK_REG(port, GMAC_CTRL), GMC_PAUSE_OFF);
                else
@@ -3399,7 +3447,7 @@ static struct net_device *skge_devinit(struct skge_hw *hw, int port,
        /* Auto speed and flow control */
        skge->autoneg = AUTONEG_ENABLE;
-        skge->flow_control = FLOW_MODE_SYMMETRIC;
+        skge->flow_control = FLOW_MODE_SYM_OR_REM;
        skge->duplex = -1;
        skge->speed = -1;
        skge->advertising = skge_supported_modes(hw);
diff --git a/drivers/net/skge.h b/drivers/net/skge.h
index d0b47d46cf9d..537c0aaa1db8 100644
--- a/drivers/net/skge.h
+++ b/drivers/net/skge.h
@@ -2195,7 +2195,8 @@ enum {
        XM_IS_RX_COMP   = 1<<0, /* Bit  0:      Frame Rx Complete */
 };
-#define XM_DEF_MSK      (~(XM_IS_RXC_OV | XM_IS_TXC_OV | XM_IS_RXF_OV | XM_IS_TXF_UR))
+#define XM_DEF_MSK      (~(XM_IS_INP_ASS | XM_IS_LIPA_RC | \
+                           XM_IS_RXF_OV | XM_IS_TXF_UR))
 /*      XM_HW_CFG       16 bit r/w      Hardware Config Register */
@@ -2426,13 +2427,24 @@ struct skge_hw {
        struct mutex         phy_mutex;
 };
-enum {
+enum pause_control {
-        FLOW_MODE_NONE          = 0, /* No Flow-Control */
+        FLOW_MODE_NONE          = 1, /* No Flow-Control */
-        FLOW_MODE_LOC_SEND      = 1, /* Local station sends PAUSE */
+        FLOW_MODE_LOC_SEND      = 2, /* Local station sends PAUSE */
-        FLOW_MODE_REM_SEND      = 2, /* Symmetric or just remote */
        FLOW_MODE_SYMMETRIC     = 3, /* Both stations may send PAUSE */
+        FLOW_MODE_SYM_OR_REM    = 4, /* Both stations may send PAUSE or
+                                      * just the remote station may send PAUSE
+                                      */
+};
+enum pause_status {
+        FLOW_STAT_INDETERMINATED=0,     /* indeterminated */
+        FLOW_STAT_NONE,                 /* No Flow Control */
+        FLOW_STAT_REM_SEND,             /* Remote Station sends PAUSE */
+        FLOW_STAT_LOC_SEND,             /* Local station sends PAUSE */
+        FLOW_STAT_SYMMETRIC,            /* Both station may send PAUSE */
 };
 struct skge_port {
        u32                  msg_enable;
        struct skge_hw       *hw;
@@ -2445,9 +2457,10 @@ struct skge_port {
        struct net_device_stats net_stats;
        struct work_struct   link_thread;
+        enum pause_control   flow_control;
+        enum pause_status    flow_status;
        u8                   rx_csum;
        u8                   blink_on;
-        u8                   flow_control;
        u8                   wol;
        u8                   autoneg;   /* AUTONEG_ENABLE, AUTONEG_DISABLE */
        u8                   duplex;    /* DUPLEX_HALF, DUPLEX_FULL */
diff --git a/drivers/net/sky2.c b/drivers/net/sky2.c
index 459c845d6648..c10e7f5faa5f 100644
--- a/drivers/net/sky2.c
+++ b/drivers/net/sky2.c
@@ -683,7 +683,7 @@ static void sky2_mac_init(struct sky2_hw *hw, unsigned port)
        sky2_write16(hw, SK_REG(port, TX_GMF_CTRL_T), GMF_OPER_ON);
        if (hw->chip_id == CHIP_ID_YUKON_EC_U) {
-                sky2_write8(hw, SK_REG(port, RX_GMF_LP_THR), 768/8);
+                sky2_write8(hw, SK_REG(port, RX_GMF_LP_THR), 512/8);
                sky2_write8(hw, SK_REG(port, RX_GMF_UP_THR), 1024/8);
                if (hw->dev[port]->mtu > ETH_DATA_LEN) {
                        /* set Tx GMAC FIFO Almost Empty Threshold */
@@ -1907,7 +1907,7 @@ static struct sk_buff *receive_copy(struct sky2_port *sky2,
                pci_dma_sync_single_for_device(sky2->hw->pdev, re->data_addr,
                                               length, PCI_DMA_FROMDEVICE);
                re->skb->ip_summed = CHECKSUM_NONE;
-                __skb_put(skb, length);
+                skb_put(skb, length);
        }
        return skb;
 }
@@ -1970,7 +1970,7 @@ static struct sk_buff *receive_new(struct sky2_port *sky2,
        if (skb_shinfo(skb)->nr_frags)
                skb_put_frags(skb, hdr_space, length);
        else
-                skb_put(skb, hdr_space);
+                skb_put(skb, length);
        return skb;
 }
@@ -2220,8 +2220,7 @@ static void sky2_hw_intr(struct sky2_hw *hw)
                /* PCI-Express uncorrectable Error occurred */
                u32 pex_err;
-                pex_err = sky2_pci_read32(hw,
+                pex_err = sky2_pci_read32(hw, PEX_UNC_ERR_STAT);
-                                          hw->err_cap + PCI_ERR_UNCOR_STATUS);
                if (net_ratelimit())
                        printk(KERN_ERR PFX "%s: pci express error (0x%x)\n",
@@ -2229,20 +2228,15 @@ static void sky2_hw_intr(struct sky2_hw *hw)
                /* clear the interrupt */
                sky2_write32(hw, B2_TST_CTRL1, TST_CFG_WRITE_ON);
-                sky2_pci_write32(hw,
+                sky2_pci_write32(hw, PEX_UNC_ERR_STAT,
-                                 hw->err_cap + PCI_ERR_UNCOR_STATUS,
+                                       0xffffffffUL);
-                                 0xffffffffUL);
                sky2_write32(hw, B2_TST_CTRL1, TST_CFG_WRITE_OFF);
+                if (pex_err & PEX_FATAL_ERRORS) {
-                /* In case of fatal error mask off to keep from getting stuck */
-                if (pex_err & (PCI_ERR_UNC_POISON_TLP | PCI_ERR_UNC_FCP
-                               | PCI_ERR_UNC_DLP)) {
                        u32 hwmsk = sky2_read32(hw, B0_HWE_IMSK);
                        hwmsk &= ~Y2_IS_PCI_EXP;
                        sky2_write32(hw, B0_HWE_IMSK, hwmsk);
                }
        }
        if (status & Y2_HWE_L1_MASK)
@@ -2423,7 +2417,6 @@ static int sky2_reset(struct sky2_hw *hw)
        u16 status;
        u8 t8;
        int i;
-        u32 msk;
        sky2_write8(hw, B0_CTST, CS_RST_CLR);
@@ -2464,13 +2457,9 @@ static int sky2_reset(struct sky2_hw *hw)
        sky2_write8(hw, B0_CTST, CS_MRST_CLR);
        /* clear any PEX errors */
-        if (pci_find_capability(hw->pdev, PCI_CAP_ID_EXP)) {
+        if (pci_find_capability(hw->pdev, PCI_CAP_ID_EXP))
-                hw->err_cap = pci_find_ext_capability(hw->pdev, PCI_EXT_CAP_ID_ERR);
+                sky2_pci_write32(hw, PEX_UNC_ERR_STAT, 0xffffffffUL);
-                if (hw->err_cap)
-                        sky2_pci_write32(hw,
-                                         hw->err_cap + PCI_ERR_UNCOR_STATUS,
-                                         0xffffffffUL);
-        }
        hw->pmd_type = sky2_read8(hw, B2_PMD_TYP);
        hw->ports = 1;
@@ -2527,10 +2516,7 @@ static int sky2_reset(struct sky2_hw *hw)
                sky2_write8(hw, RAM_BUFFER(i, B3_RI_RTO_XS2), SK_RI_TO_53);
        }
-        msk = Y2_HWE_ALL_MASK;
+        sky2_write32(hw, B0_HWE_IMSK, Y2_HWE_ALL_MASK);
-        if (!hw->err_cap)
-                msk &= ~Y2_IS_PCI_EXP;
-        sky2_write32(hw, B0_HWE_IMSK, msk);
        for (i = 0; i < hw->ports; i++)
                sky2_gmac_reset(hw, i);
diff --git a/drivers/net/sky2.h b/drivers/net/sky2.h
index f66109a96d95..43d2accf60e1 100644
--- a/drivers/net/sky2.h
+++ b/drivers/net/sky2.h
@@ -6,15 +6,24 @@
 #define ETH_JUMBO_MTU           9000    /* Maximum MTU supported */
-/* PCI device specific config registers */
+/* PCI config registers */
 enum {
        PCI_DEV_REG1    = 0x40,
        PCI_DEV_REG2    = 0x44,
+        PCI_DEV_STATUS  = 0x7c,
        PCI_DEV_REG3    = 0x80,
        PCI_DEV_REG4    = 0x84,
        PCI_DEV_REG5    = 0x88,
 };
+enum {
+        PEX_DEV_CAP     = 0xe4,
+        PEX_DEV_CTRL    = 0xe8,
+        PEX_DEV_STA     = 0xea,
+        PEX_LNK_STAT    = 0xf2,
+        PEX_UNC_ERR_STAT= 0x104,
+};
 /* Yukon-2 */
 enum pci_dev_reg_1 {
        PCI_Y2_PIG_ENA   = 1<<31, /* Enable Plug-in-Go (YUKON-2) */
@@ -63,6 +72,39 @@ enum pci_dev_reg_4 {
                               PCI_STATUS_REC_MASTER_ABORT | \
                               PCI_STATUS_REC_TARGET_ABORT | \
                               PCI_STATUS_PARITY)
+enum pex_dev_ctrl {
+        PEX_DC_MAX_RRS_MSK      = 7<<12, /* Bit 14..12: Max. Read Request Size */
+        PEX_DC_EN_NO_SNOOP      = 1<<11,/* Enable No Snoop */
+        PEX_DC_EN_AUX_POW       = 1<<10,/* Enable AUX Power */
+        PEX_DC_EN_PHANTOM       = 1<<9, /* Enable Phantom Functions */
+        PEX_DC_EN_EXT_TAG       = 1<<8, /* Enable Extended Tag Field */
+        PEX_DC_MAX_PLS_MSK      = 7<<5, /* Bit  7.. 5:  Max. Payload Size Mask */
+        PEX_DC_EN_REL_ORD       = 1<<4, /* Enable Relaxed Ordering */
+        PEX_DC_EN_UNS_RQ_RP     = 1<<3, /* Enable Unsupported Request Reporting */
+        PEX_DC_EN_FAT_ER_RP     = 1<<2, /* Enable Fatal Error Reporting */
+        PEX_DC_EN_NFA_ER_RP     = 1<<1, /* Enable Non-Fatal Error Reporting */
+        PEX_DC_EN_COR_ER_RP     = 1<<0, /* Enable Correctable Error Reporting */
+};
+#define  PEX_DC_MAX_RD_RQ_SIZE(x) (((x)<<12) & PEX_DC_MAX_RRS_MSK)
+/* PEX_UNC_ERR_STAT      PEX Uncorrectable Errors Status Register (Yukon-2) */
+enum pex_err {
+        PEX_UNSUP_REQ   = 1<<20, /* Unsupported Request Error */
+        PEX_MALFOR_TLP  = 1<<18, /* Malformed TLP */
+        PEX_UNEXP_COMP  = 1<<16, /* Unexpected Completion */
+        PEX_COMP_TO     = 1<<14, /* Completion Timeout */
+        PEX_FLOW_CTRL_P = 1<<13, /* Flow Control Protocol Error */
+        PEX_POIS_TLP    = 1<<12, /* Poisoned TLP */
+        PEX_DATA_LINK_P = 1<<4, /* Data Link Protocol Error */
+        PEX_FATAL_ERRORS= (PEX_MALFOR_TLP | PEX_FLOW_CTRL_P | PEX_DATA_LINK_P),
+};
 enum csr_regs {
        B0_RAP          = 0x0000,
        B0_CTST         = 0x0004,
@@ -1836,7 +1878,6 @@ struct sky2_hw {
        struct net_device    *dev[2];
        int                  pm_cap;
-        int                  err_cap;
        u8                   chip_id;
        u8                   chip_rev;
        u8                   pmd_type;
diff --git a/drivers/net/smc91x.h b/drivers/net/smc91x.h
index 636dbfcdf8cb..0c9f1e7dab2e 100644
--- a/drivers/net/smc91x.h
+++ b/drivers/net/smc91x.h
@@ -398,6 +398,24 @@ static inline void LPD7_SMC_outsw (unsigned char* a, int r,
 #define SMC_IRQ_FLAGS           (0)
+#elif   defined(CONFIG_ARCH_VERSATILE)
+#define SMC_CAN_USE_8BIT        1
+#define SMC_CAN_USE_16BIT       1
+#define SMC_CAN_USE_32BIT       1
+#define SMC_NOWAIT              1
+#define SMC_inb(a, r)           readb((a) + (r))
+#define SMC_inw(a, r)           readw((a) + (r))
+#define SMC_inl(a, r)           readl((a) + (r))
+#define SMC_outb(v, a, r)       writeb(v, (a) + (r))
+#define SMC_outw(v, a, r)       writew(v, (a) + (r))
+#define SMC_outl(v, a, r)       writel(v, (a) + (r))
+#define SMC_insl(a, r, p, l)    readsl((a) + (r), p, l)
+#define SMC_outsl(a, r, p, l)   writesl((a) + (r), p, l)
+#define SMC_IRQ_FLAGS           (0)
 #else
 #define SMC_CAN_USE_8BIT        1
diff --git a/drivers/net/spider_net.c b/drivers/net/spider_net.c
index 46a009085f7c..418138dd6c68 100644
--- a/drivers/net/spider_net.c
+++ b/drivers/net/spider_net.c
@@ -55,12 +55,13 @@ MODULE_AUTHOR("Utz Bacher <utz.bacher@de.ibm.com> and Jens Osterkamp " \
              "<Jens.Osterkamp@de.ibm.com>");
 MODULE_DESCRIPTION("Spider Southbridge Gigabit Ethernet driver");
 MODULE_LICENSE("GPL");
+MODULE_VERSION(VERSION);
 static int rx_descriptors = SPIDER_NET_RX_DESCRIPTORS_DEFAULT;
 static int tx_descriptors = SPIDER_NET_TX_DESCRIPTORS_DEFAULT;
-module_param(rx_descriptors, int, 0644);
+module_param(rx_descriptors, int, 0444);
-module_param(tx_descriptors, int, 0644);
+module_param(tx_descriptors, int, 0444);
 MODULE_PARM_DESC(rx_descriptors, "number of descriptors used " \
                 "in rx chains");
@@ -300,7 +301,7 @@ static int
 spider_net_init_chain(struct spider_net_card *card,
                       struct spider_net_descr_chain *chain,
                       struct spider_net_descr *start_descr,
-                       int direction, int no)
+                       int no)
 {
        int i;
        struct spider_net_descr *descr;
@@ -315,7 +316,7 @@ spider_net_init_chain(struct spider_net_card *card,
                buf = pci_map_single(card->pdev, descr,
                                     SPIDER_NET_DESCR_SIZE,
-                                     direction);
+                                     PCI_DMA_BIDIRECTIONAL);
                if (pci_dma_mapping_error(buf))
                        goto iommu_error;
@@ -329,11 +330,6 @@ spider_net_init_chain(struct spider_net_card *card,
        (descr-1)->next = start_descr;
        start_descr->prev = descr-1;
-        descr = start_descr;
-        if (direction == PCI_DMA_FROMDEVICE)
-                for (i=0; i < no; i++, descr++)
-                        descr->next_descr_addr = descr->next->bus_addr;
        spin_lock_init(&chain->lock);
        chain->head = start_descr;
        chain->tail = start_descr;
@@ -346,7 +342,7 @@ iommu_error:
                if (descr->bus_addr)
                        pci_unmap_single(card->pdev, descr->bus_addr,
                                         SPIDER_NET_DESCR_SIZE,
-                                         direction);
+                                         PCI_DMA_BIDIRECTIONAL);
        return -ENOMEM;
 }
@@ -362,15 +358,15 @@ spider_net_free_rx_chain_contents(struct spider_net_card *card)
        struct spider_net_descr *descr;
        descr = card->rx_chain.head;
-        while (descr->next != card->rx_chain.head) {
+        do {
                if (descr->skb) {
                        dev_kfree_skb(descr->skb);
                        pci_unmap_single(card->pdev, descr->buf_addr,
                                         SPIDER_NET_MAX_FRAME,
-                                         PCI_DMA_FROMDEVICE);
+                                         PCI_DMA_BIDIRECTIONAL);
                }
                descr = descr->next;
-        }
+        } while (descr != card->rx_chain.head);
 }
 /**
@@ -645,26 +641,41 @@ static int
 spider_net_prepare_tx_descr(struct spider_net_card *card,
                            struct sk_buff *skb)
 {
-        struct spider_net_descr *descr = card->tx_chain.head;
+        struct spider_net_descr *descr;
        dma_addr_t buf;
+        unsigned long flags;
+        int length;
-        buf = pci_map_single(card->pdev, skb->data, skb->len, PCI_DMA_TODEVICE);
+        length = skb->len;
+        if (length < ETH_ZLEN) {
+                if (skb_pad(skb, ETH_ZLEN-length))
+                        return 0;
+                length = ETH_ZLEN;
+        }
+        buf = pci_map_single(card->pdev, skb->data, length, PCI_DMA_TODEVICE);
        if (pci_dma_mapping_error(buf)) {
                if (netif_msg_tx_err(card) && net_ratelimit())
                        pr_err("could not iommu-map packet (%p, %i). "
-                                  "Dropping packet\n", skb->data, skb->len);
+                                  "Dropping packet\n", skb->data, length);
                card->spider_stats.tx_iommu_map_error++;
                return -ENOMEM;
        }
+        spin_lock_irqsave(&card->tx_chain.lock, flags);
+        descr = card->tx_chain.head;
+        card->tx_chain.head = descr->next;
        descr->buf_addr = buf;
-        descr->buf_size = skb->len;
+        descr->buf_size = length;
        descr->next_descr_addr = 0;
        descr->skb = skb;
        descr->data_status = 0;
        descr->dmac_cmd_status =
                        SPIDER_NET_DESCR_CARDOWNED | SPIDER_NET_DMAC_NOCS;
+        spin_unlock_irqrestore(&card->tx_chain.lock, flags);
        if (skb->protocol == htons(ETH_P_IP))
                switch (skb->nh.iph->protocol) {
                case IPPROTO_TCP:
@@ -675,32 +686,51 @@ spider_net_prepare_tx_descr(struct spider_net_card *card,
                        break;
                }
+        /* Chain the bus address, so that the DMA engine finds this descr. */
        descr->prev->next_descr_addr = descr->bus_addr;
+        card->netdev->trans_start = jiffies; /* set netdev watchdog timer */
        return 0;
 }
-/**
+static int
- * spider_net_release_tx_descr - processes a used tx descriptor
+spider_net_set_low_watermark(struct spider_net_card *card)
- * @card: card structure
- * @descr: descriptor to release
- *
- * releases a used tx descriptor (unmapping, freeing of skb)
- */
-static inline void
-spider_net_release_tx_descr(struct spider_net_card *card)
 {
+        unsigned long flags;
+        int status;
+        int cnt=0;
+        int i;
        struct spider_net_descr *descr = card->tx_chain.tail;
-        struct sk_buff *skb;
-        card->tx_chain.tail = card->tx_chain.tail->next;
+        /* Measure the length of the queue. Measurement does not
-        descr->dmac_cmd_status |= SPIDER_NET_DESCR_NOT_IN_USE;
+         * need to be precise -- does not need a lock. */
+        while (descr != card->tx_chain.head) {
+                status = descr->dmac_cmd_status & SPIDER_NET_DESCR_NOT_IN_USE;
+                if (status == SPIDER_NET_DESCR_NOT_IN_USE)
+                        break;
+                descr = descr->next;
+                cnt++;
+        }
-        /* unmap the skb */
+        /* If TX queue is short, don't even bother with interrupts */
-        skb = descr->skb;
+        if (cnt < card->num_tx_desc/4)
-        pci_unmap_single(card->pdev, descr->buf_addr, skb->len,
+                return cnt;
-                        PCI_DMA_TODEVICE);
-        dev_kfree_skb_any(skb);
+        /* Set low-watermark 3/4th's of the way into the queue. */
+        descr = card->tx_chain.tail;
+        cnt = (cnt*3)/4;
+        for (i=0;i<cnt; i++)
+                descr = descr->next;
+        /* Set the new watermark, clear the old watermark */
+        spin_lock_irqsave(&card->tx_chain.lock, flags);
+        descr->dmac_cmd_status |= SPIDER_NET_DESCR_TXDESFLG;
+        if (card->low_watermark && card->low_watermark != descr)
+                card->low_watermark->dmac_cmd_status =
+                     card->low_watermark->dmac_cmd_status & ~SPIDER_NET_DESCR_TXDESFLG;
+        card->low_watermark = descr;
+        spin_unlock_irqrestore(&card->tx_chain.lock, flags);
+        return cnt;
 }
 /**
@@ -719,21 +749,29 @@ static int
 spider_net_release_tx_chain(struct spider_net_card *card, int brutal)
 {
        struct spider_net_descr_chain *chain = &card->tx_chain;
+        struct spider_net_descr *descr;
+        struct sk_buff *skb;
+        u32 buf_addr;
+        unsigned long flags;
        int status;
-        spider_net_read_reg(card, SPIDER_NET_GDTDMACCNTR);
        while (chain->tail != chain->head) {
-                status = spider_net_get_descr_status(chain->tail);
+                spin_lock_irqsave(&chain->lock, flags);
+                descr = chain->tail;
+                status = spider_net_get_descr_status(descr);
                switch (status) {
                case SPIDER_NET_DESCR_COMPLETE:
                        card->netdev_stats.tx_packets++;
-                        card->netdev_stats.tx_bytes += chain->tail->skb->len;
+                        card->netdev_stats.tx_bytes += descr->skb->len;
                        break;
                case SPIDER_NET_DESCR_CARDOWNED:
-                        if (!brutal)
+                        if (!brutal) {
+                                spin_unlock_irqrestore(&chain->lock, flags);
                                return 1;
+                        }
                        /* fallthrough, if we release the descriptors
                         * brutally (then we don't care about
                         * SPIDER_NET_DESCR_CARDOWNED) */
@@ -750,11 +788,25 @@ spider_net_release_tx_chain(struct spider_net_card *card, int brutal)
                default:
                        card->netdev_stats.tx_dropped++;
-                        return 1;
+                        if (!brutal) {
+                                spin_unlock_irqrestore(&chain->lock, flags);
+                                return 1;
+                        }
                }
-                spider_net_release_tx_descr(card);
-        }
+                chain->tail = descr->next;
+                descr->dmac_cmd_status |= SPIDER_NET_DESCR_NOT_IN_USE;
+                skb = descr->skb;
+                buf_addr = descr->buf_addr;
+                spin_unlock_irqrestore(&chain->lock, flags);
+                /* unmap the skb */
+                if (skb) {
+                        int len = skb->len < ETH_ZLEN ? ETH_ZLEN : skb->len;
+                        pci_unmap_single(card->pdev, buf_addr, len, PCI_DMA_TODEVICE);
+                        dev_kfree_skb(skb);
+                }
+        }
        return 0;
 }
@@ -763,8 +815,12 @@ spider_net_release_tx_chain(struct spider_net_card *card, int brutal)
 * @card: card structure
 * @descr: descriptor address to enable TX processing at
 *
- * spider_net_kick_tx_dma writes the current tx chain head as start address
+ * This routine will start the transmit DMA running if
- * of the tx descriptor chain and enables the transmission DMA engine
+ * it is not already running. This routine ned only be
+ * called when queueing a new packet to an empty tx queue.
+ * Writes the current tx chain head as start address
+ * of the tx descriptor chain and enables the transmission
+ * DMA engine.
 */
 static inline void
 spider_net_kick_tx_dma(struct spider_net_card *card)
@@ -804,65 +860,43 @@ out:
 static int
 spider_net_xmit(struct sk_buff *skb, struct net_device *netdev)
 {
+        int cnt;
        struct spider_net_card *card = netdev_priv(netdev);
        struct spider_net_descr_chain *chain = &card->tx_chain;
-        struct spider_net_descr *descr = chain->head;
-        unsigned long flags;
-        int result;
-        spin_lock_irqsave(&chain->lock, flags);
        spider_net_release_tx_chain(card, 0);
-        if (chain->head->next == chain->tail->prev) {
+        if ((chain->head->next == chain->tail->prev) ||
-                card->netdev_stats.tx_dropped++;
+           (spider_net_prepare_tx_descr(card, skb) != 0)) {
-                result = NETDEV_TX_LOCKED;
-                goto out;
-        }
-        if (spider_net_get_descr_status(descr) != SPIDER_NET_DESCR_NOT_IN_USE) {
                card->netdev_stats.tx_dropped++;
-                result = NETDEV_TX_LOCKED;
+                netif_stop_queue(netdev);
-                goto out;
+                return NETDEV_TX_BUSY;
        }
-        if (spider_net_prepare_tx_descr(card, skb) != 0) {
+        cnt = spider_net_set_low_watermark(card);
-                card->netdev_stats.tx_dropped++;
+        if (cnt < 5)
-                result = NETDEV_TX_BUSY;
+                spider_net_kick_tx_dma(card);
-                goto out;
+        return NETDEV_TX_OK;
-        }
-        result = NETDEV_TX_OK;
-        spider_net_kick_tx_dma(card);
-        card->tx_chain.head = card->tx_chain.head->next;
-out:
-        spin_unlock_irqrestore(&chain->lock, flags);
-        netif_wake_queue(netdev);
-        return result;
 }
 /**
 * spider_net_cleanup_tx_ring - cleans up the TX ring
 * @card: card structure
 *
- * spider_net_cleanup_tx_ring is called by the tx_timer (as we don't use
+ * spider_net_cleanup_tx_ring is called by either the tx_timer
- * interrupts to cleanup our TX ring) and returns sent packets to the stack
+ * or from the NAPI polling routine.
- * by freeing them
+ * This routine releases resources associted with transmitted
+ * packets, including updating the queue tail pointer.
 */
 static void
 spider_net_cleanup_tx_ring(struct spider_net_card *card)
 {
-        unsigned long flags;
-        spin_lock_irqsave(&card->tx_chain.lock, flags);
        if ((spider_net_release_tx_chain(card, 0) != 0) &&
-            (card->netdev->flags & IFF_UP))
+            (card->netdev->flags & IFF_UP)) {
                spider_net_kick_tx_dma(card);
+                netif_wake_queue(card->netdev);
-        spin_unlock_irqrestore(&card->tx_chain.lock, flags);
+        }
 }
 /**
@@ -1053,6 +1087,7 @@ spider_net_poll(struct net_device *netdev, int *budget)
        int packets_to_do, packets_done = 0;
        int no_more_packets = 0;
+        spider_net_cleanup_tx_ring(card);
        packets_to_do = min(*budget, netdev->quota);
        while (packets_to_do) {
@@ -1243,12 +1278,15 @@ spider_net_handle_error_irq(struct spider_net_card *card, u32 status_reg)
        case SPIDER_NET_PHYINT:
        case SPIDER_NET_GMAC2INT:
        case SPIDER_NET_GMAC1INT:
-        case SPIDER_NET_GIPSINT:
        case SPIDER_NET_GFIFOINT:
        case SPIDER_NET_DMACINT:
        case SPIDER_NET_GSYSINT:
                break; */
+        case SPIDER_NET_GIPSINT:
+                show_error = 0;
+                break;
        case SPIDER_NET_GPWOPCMPINT:
                /* PHY write operation completed */
                show_error = 0;
@@ -1307,9 +1345,10 @@ spider_net_handle_error_irq(struct spider_net_card *card, u32 status_reg)
        case SPIDER_NET_GDTDCEINT:
                /* chain end. If a descriptor should be sent, kick off
                 * tx dma
-                if (card->tx_chain.tail == card->tx_chain.head)
+                if (card->tx_chain.tail != card->tx_chain.head)
                        spider_net_kick_tx_dma(card);
-                show_error = 0; */
+                */
+                show_error = 0;
                break;
        /* case SPIDER_NET_G1TMCNTINT: not used. print a message */
@@ -1354,7 +1393,7 @@ spider_net_handle_error_irq(struct spider_net_card *card, u32 status_reg)
                if (netif_msg_intr(card))
                        pr_err("got descriptor chain end interrupt, "
                               "restarting DMAC %c.\n",
-                               'D'+i-SPIDER_NET_GDDDCEINT);
+                               'D'-(i-SPIDER_NET_GDDDCEINT)/3);
                spider_net_refill_rx_chain(card);
                spider_net_enable_rxdmac(card);
                show_error = 0;
@@ -1423,8 +1462,9 @@ spider_net_handle_error_irq(struct spider_net_card *card, u32 status_reg)
        }
        if ((show_error) && (netif_msg_intr(card)))
-                pr_err("Got error interrupt, GHIINT0STS = 0x%08x, "
+                pr_err("Got error interrupt on %s, GHIINT0STS = 0x%08x, "
                       "GHIINT1STS = 0x%08x, GHIINT2STS = 0x%08x\n",
+                       card->netdev->name,
                       status_reg, error_reg1, error_reg2);
        /* clear interrupt sources */
@@ -1460,6 +1500,8 @@ spider_net_interrupt(int irq, void *ptr)
                spider_net_rx_irq_off(card);
                netif_rx_schedule(netdev);
        }
+        if (status_reg & SPIDER_NET_TXINT)
+                netif_rx_schedule(netdev);
        if (status_reg & SPIDER_NET_ERRINT )
                spider_net_handle_error_irq(card, status_reg);
@@ -1599,7 +1641,7 @@ spider_net_enable_card(struct spider_net_card *card)
                             SPIDER_NET_INT2_MASK_VALUE);
        spider_net_write_reg(card, SPIDER_NET_GDTDMACCNTR,
-                             SPIDER_NET_GDTDCEIDIS);
+                             SPIDER_NET_GDTBSTA | SPIDER_NET_GDTDCEIDIS);
 }
 /**
@@ -1615,17 +1657,26 @@ int
 spider_net_open(struct net_device *netdev)
 {
        struct spider_net_card *card = netdev_priv(netdev);
-        int result;
+        struct spider_net_descr *descr;
+        int i, result;
        result = -ENOMEM;
        if (spider_net_init_chain(card, &card->tx_chain, card->descr,
-                        PCI_DMA_TODEVICE, card->tx_desc))
+                                  card->num_tx_desc))
                goto alloc_tx_failed;
+        card->low_watermark = NULL;
+        /* rx_chain is after tx_chain, so offset is descr + tx_count */
        if (spider_net_init_chain(card, &card->rx_chain,
-                        card->descr + card->rx_desc,
+                                  card->descr + card->num_tx_desc,
-                        PCI_DMA_FROMDEVICE, card->rx_desc))
+                                  card->num_rx_desc))
                goto alloc_rx_failed;
+        descr = card->rx_chain.head;
+        for (i=0; i < card->num_rx_desc; i++, descr++)
+                descr->next_descr_addr = descr->next->bus_addr;
        /* allocate rx skbs */
        if (spider_net_alloc_rx_skbs(card))
                goto alloc_skbs_failed;
@@ -1878,10 +1929,7 @@ spider_net_stop(struct net_device *netdev)
        spider_net_disable_rxdmac(card);
        /* release chains */
-        if (spin_trylock(&card->tx_chain.lock)) {
+        spider_net_release_tx_chain(card, 1);
-                spider_net_release_tx_chain(card, 1);
-                spin_unlock(&card->tx_chain.lock);
-        }
        spider_net_free_chain(card, &card->tx_chain);
        spider_net_free_chain(card, &card->rx_chain);
@@ -2012,8 +2060,8 @@ spider_net_setup_netdev(struct spider_net_card *card)
        card->options.rx_csum = SPIDER_NET_RX_CSUM_DEFAULT;
-        card->tx_desc = tx_descriptors;
+        card->num_tx_desc = tx_descriptors;
-        card->rx_desc = rx_descriptors;
+        card->num_rx_desc = rx_descriptors;
        spider_net_setup_netdev_ops(netdev);
@@ -2252,6 +2300,8 @@ static struct pci_driver spider_net_driver = {
 */
 static int __init spider_net_init(void)
 {
+        printk(KERN_INFO "Spidernet version %s.\n", VERSION);
        if (rx_descriptors < SPIDER_NET_RX_DESCRIPTORS_MIN) {
                rx_descriptors = SPIDER_NET_RX_DESCRIPTORS_MIN;
                pr_info("adjusting rx descriptors to %i.\n", rx_descriptors);
diff --git a/drivers/net/spider_net.h b/drivers/net/spider_net.h
index a59deda2f95e..b3b46119b424 100644
--- a/drivers/net/spider_net.h
+++ b/drivers/net/spider_net.h
@@ -24,6 +24,8 @@
 #ifndef _SPIDER_NET_H
 #define _SPIDER_NET_H
+#define VERSION "1.1 A"
 #include "sungem_phy.h"
 extern int spider_net_stop(struct net_device *netdev);
@@ -47,7 +49,7 @@ extern char spider_net_driver_name[];
 #define SPIDER_NET_TX_DESCRIPTORS_MIN           16
 #define SPIDER_NET_TX_DESCRIPTORS_MAX           512
-#define SPIDER_NET_TX_TIMER                     20
+#define SPIDER_NET_TX_TIMER                     (HZ/5)
 #define SPIDER_NET_RX_CSUM_DEFAULT              1
@@ -189,7 +191,9 @@ extern char spider_net_driver_name[];
 #define SPIDER_NET_MACMODE_VALUE        0x00000001
 #define SPIDER_NET_BURSTLMT_VALUE       0x00000200 /* about 16 us */
-/* 1(0)                                 enable r/tx dma
+/* DMAC control register GDMACCNTR
+ *
+ * 1(0)                         enable r/tx dma
 *  0000000                             fixed to 0
 *
 *         000000                       fixed to 0
@@ -198,6 +202,7 @@ extern char spider_net_driver_name[];
 *
 *                 000000               fixed to 0
 *                       00             burst alignment: 128 bytes
+ *                       11             burst alignment: 1024 bytes
 *
 *                         00000        fixed to 0
 *                              0       descr writeback size 32 bytes
@@ -208,10 +213,13 @@ extern char spider_net_driver_name[];
 #define SPIDER_NET_DMA_RX_VALUE         0x80000000
 #define SPIDER_NET_DMA_RX_FEND_VALUE    0x00030003
 /* to set TX_DMA_EN */
-#define SPIDER_NET_TX_DMA_EN            0x80000000
+#define SPIDER_NET_TX_DMA_EN           0x80000000
-#define SPIDER_NET_GDTDCEIDIS           0x00000002
+#define SPIDER_NET_GDTBSTA             0x00000300
-#define SPIDER_NET_DMA_TX_VALUE         SPIDER_NET_TX_DMA_EN | \
+#define SPIDER_NET_GDTDCEIDIS          0x00000002
-                                        SPIDER_NET_GDTDCEIDIS
+#define SPIDER_NET_DMA_TX_VALUE        SPIDER_NET_TX_DMA_EN | \
+                                       SPIDER_NET_GDTBSTA | \
+                                       SPIDER_NET_GDTDCEIDIS
 #define SPIDER_NET_DMA_TX_FEND_VALUE    0x00030003
 /* SPIDER_NET_UA_DESCR_VALUE is OR'ed with the unicast address */
@@ -320,13 +328,10 @@ enum spider_net_int2_status {
        SPIDER_NET_GRISPDNGINT
 };
-#define SPIDER_NET_TXINT        ( (1 << SPIDER_NET_GTTEDINT) | \
+#define SPIDER_NET_TXINT        ( (1 << SPIDER_NET_GDTFDCINT) )
-                                  (1 << SPIDER_NET_GDTDCEINT) | \
-                                  (1 << SPIDER_NET_GDTFDCINT) )
-/* we rely on flagged descriptor interrupts*/
+/* We rely on flagged descriptor interrupts */
-#define SPIDER_NET_RXINT        ( (1 << SPIDER_NET_GDAFDCINT) | \
+#define SPIDER_NET_RXINT        ( (1 << SPIDER_NET_GDAFDCINT) )
-                                  (1 << SPIDER_NET_GRMFLLINT) )
 #define SPIDER_NET_ERRINT       ( 0xffffffff & \
                                  (~SPIDER_NET_TXINT) & \
@@ -349,6 +354,7 @@ enum spider_net_int2_status {
 #define SPIDER_NET_DESCR_FORCE_END              0x50000000 /* used in rx and tx */
 #define SPIDER_NET_DESCR_CARDOWNED              0xA0000000 /* used in rx and tx */
 #define SPIDER_NET_DESCR_NOT_IN_USE             0xF0000000
+#define SPIDER_NET_DESCR_TXDESFLG               0x00800000
 struct spider_net_descr {
        /* as defined by the hardware */
@@ -433,6 +439,7 @@ struct spider_net_card {
        struct spider_net_descr_chain tx_chain;
        struct spider_net_descr_chain rx_chain;
+        struct spider_net_descr *low_watermark;
        struct net_device_stats netdev_stats;
@@ -448,8 +455,8 @@ struct spider_net_card {
        /* for ethtool */
        int msg_enable;
-        int rx_desc;
+        int num_rx_desc;
-        int tx_desc;
+        int num_tx_desc;
        struct spider_net_extra_stats spider_stats;
        struct spider_net_descr descr[0];
diff --git a/drivers/net/spider_net_ethtool.c b/drivers/net/spider_net_ethtool.c
index 589e43658dee..91b995102915 100644
--- a/drivers/net/spider_net_ethtool.c
+++ b/drivers/net/spider_net_ethtool.c
@@ -76,7 +76,7 @@ spider_net_ethtool_get_drvinfo(struct net_device *netdev,
        /* clear and fill out info */
        memset(drvinfo, 0, sizeof(struct ethtool_drvinfo));
        strncpy(drvinfo->driver, spider_net_driver_name, 32);
-        strncpy(drvinfo->version, "0.1", 32);
+        strncpy(drvinfo->version, VERSION, 32);
        strcpy(drvinfo->fw_version, "no information");
        strncpy(drvinfo->bus_info, pci_name(card->pdev), 32);
 }
@@ -158,9 +158,9 @@ spider_net_ethtool_get_ringparam(struct net_device *netdev,
        struct spider_net_card *card = netdev->priv;
        ering->tx_max_pending = SPIDER_NET_TX_DESCRIPTORS_MAX;
-        ering->tx_pending = card->tx_desc;
+        ering->tx_pending = card->num_tx_desc;
        ering->rx_max_pending = SPIDER_NET_RX_DESCRIPTORS_MAX;
-        ering->rx_pending = card->rx_desc;
+        ering->rx_pending = card->num_rx_desc;
 }
 static int spider_net_get_stats_count(struct net_device *netdev)
diff --git a/drivers/net/sun3_82586.c b/drivers/net/sun3_82586.c
index d1d1885b0295..a3220a96524f 100644
--- a/drivers/net/sun3_82586.c
+++ b/drivers/net/sun3_82586.c
@@ -330,7 +330,7 @@ out2:
 out1:
        free_netdev(dev);
 out:
-        iounmap((void *)ioaddr);
+        iounmap((void __iomem *)ioaddr);
        return ERR_PTR(err);
 }
diff --git a/drivers/net/sun3lance.c b/drivers/net/sun3lance.c
index 91c76544e4dd..b865db363ba0 100644
--- a/drivers/net/sun3lance.c
+++ b/drivers/net/sun3lance.c
@@ -286,7 +286,7 @@ struct net_device * __init sun3lance_probe(int unit)
 out1:
 #ifdef CONFIG_SUN3
-        iounmap((void *)dev->base_addr);
+        iounmap((void __iomem *)dev->base_addr);
 #endif
 out:
        free_netdev(dev);
@@ -326,7 +326,7 @@ static int __init lance_probe( struct net_device *dev)
                ioaddr_probe[1] = tmp2;
 #ifdef CONFIG_SUN3
-                iounmap((void *)ioaddr);
+                iounmap((void __iomem *)ioaddr);
 #endif
                return 0;
        }
@@ -956,7 +956,7 @@ void cleanup_module(void)
 {
        unregister_netdev(sun3lance_dev);
 #ifdef CONFIG_SUN3
-        iounmap((void *)sun3lance_dev->base_addr);
+        iounmap((void __iomem *)sun3lance_dev->base_addr);
 #endif
        free_netdev(sun3lance_dev);
 }
diff --git a/drivers/net/tulip/de2104x.c b/drivers/net/tulip/de2104x.c
index 2cfd9634895a..f6b3a94e97bf 100644
--- a/drivers/net/tulip/de2104x.c
+++ b/drivers/net/tulip/de2104x.c
@@ -1730,7 +1730,7 @@ static void __init de21040_get_media_info(struct de_private *de)
 }
 /* Note: this routine returns extra data bits for size detection. */
-static unsigned __init tulip_read_eeprom(void __iomem *regs, int location, int addr_len)
+static unsigned __devinit tulip_read_eeprom(void __iomem *regs, int location, int addr_len)
 {
        int i;
        unsigned retval = 0;
@@ -1926,7 +1926,7 @@ bad_srom:
        goto fill_defaults;
 }
-static int __init de_init_one (struct pci_dev *pdev,
+static int __devinit de_init_one (struct pci_dev *pdev,
                                  const struct pci_device_id *ent)
 {
        struct net_device *dev;
@@ -2082,7 +2082,7 @@ err_out_free:
        return rc;
 }
-static void __exit de_remove_one (struct pci_dev *pdev)
+static void __devexit de_remove_one (struct pci_dev *pdev)
 {
        struct net_device *dev = pci_get_drvdata(pdev);
        struct de_private *de = dev->priv;
@@ -2164,7 +2164,7 @@ static struct pci_driver de_driver = {
        .name           = DRV_NAME,
        .id_table       = de_pci_tbl,
        .probe          = de_init_one,
-        .remove         = __exit_p(de_remove_one),
+        .remove         = __devexit_p(de_remove_one),
 #ifdef CONFIG_PM
        .suspend        = de_suspend,
        .resume         = de_resume,
diff --git a/drivers/pci/Kconfig b/drivers/pci/Kconfig
index 30294127a0aa..ecc50db8585a 100644
--- a/drivers/pci/Kconfig
+++ b/drivers/pci/Kconfig
@@ -55,7 +55,7 @@ config PCI_DEBUG
 config HT_IRQ
        bool "Interrupts on hypertransport devices"
        default y
-        depends on X86_LOCAL_APIC && X86_IO_APIC
+        depends on PCI && X86_LOCAL_APIC && X86_IO_APIC
        help
           This allows native hypertransport devices to use interrupts.
diff --git a/drivers/rtc/rtc-max6902.c b/drivers/rtc/rtc-max6902.c
index 0b20dfacbf59..d94170728075 100644
--- a/drivers/rtc/rtc-max6902.c
+++ b/drivers/rtc/rtc-max6902.c
@@ -136,7 +136,7 @@ static int max6902_get_datetime(struct device *dev, struct rtc_time *dt)
        dt->tm_min      = BCD2BIN(chip->buf[2]);
        dt->tm_hour     = BCD2BIN(chip->buf[3]);
        dt->tm_mday     = BCD2BIN(chip->buf[4]);
-        dt->tm_mon      = BCD2BIN(chip->buf[5] - 1);
+        dt->tm_mon      = BCD2BIN(chip->buf[5]) - 1;
        dt->tm_wday     = BCD2BIN(chip->buf[6]);
        dt->tm_year = BCD2BIN(chip->buf[7]);
diff --git a/drivers/rtc/rtc-sh.c b/drivers/rtc/rtc-sh.c
index 8b6efcc05058..143302a8e79c 100644
--- a/drivers/rtc/rtc-sh.c
+++ b/drivers/rtc/rtc-sh.c
@@ -160,7 +160,7 @@ static int sh_rtc_open(struct device *dev)
        tmp |= RCR1_CIE;
        writeb(tmp, rtc->regbase + RCR1);
-        ret = request_irq(rtc->periodic_irq, sh_rtc_periodic, SA_INTERRUPT,
+        ret = request_irq(rtc->periodic_irq, sh_rtc_periodic, IRQF_DISABLED,
                          "sh-rtc period", dev);
        if (unlikely(ret)) {
                dev_err(dev, "request period IRQ failed with %d, IRQ %d\n",
@@ -168,7 +168,7 @@ static int sh_rtc_open(struct device *dev)
                return ret;
        }
-        ret = request_irq(rtc->carry_irq, sh_rtc_interrupt, SA_INTERRUPT,
+        ret = request_irq(rtc->carry_irq, sh_rtc_interrupt, IRQF_DISABLED,
                          "sh-rtc carry", dev);
        if (unlikely(ret)) {
                dev_err(dev, "request carry IRQ failed with %d, IRQ %d\n",
@@ -177,7 +177,7 @@ static int sh_rtc_open(struct device *dev)
                goto err_bad_carry;
        }
-        ret = request_irq(rtc->alarm_irq, sh_rtc_interrupt, SA_INTERRUPT,
+        ret = request_irq(rtc->alarm_irq, sh_rtc_interrupt, IRQF_DISABLED,
                          "sh-rtc alarm", dev);
        if (unlikely(ret)) {
                dev_err(dev, "request alarm IRQ failed with %d, IRQ %d\n",
diff --git a/drivers/rtc/rtc-v3020.c b/drivers/rtc/rtc-v3020.c
index 09b714f1cdc3..3b58d3d5d38a 100644
--- a/drivers/rtc/rtc-v3020.c
+++ b/drivers/rtc/rtc-v3020.c
@@ -195,9 +195,9 @@ static int rtc_probe(struct platform_device *pdev)
         * are all disabled */
        v3020_set_reg(chip, V3020_STATUS_0, 0x0);
-        dev_info(&pdev->dev, "Chip available at physical address 0x%p,"
+        dev_info(&pdev->dev, "Chip available at physical address 0x%llx,"
                "data connected to D%d\n",
-                (void*)pdev->resource[0].start,
+                (unsigned long long)pdev->resource[0].start,
                chip->leftshift);
        platform_set_drvdata(pdev, chip);
diff --git a/drivers/s390/char/monwriter.c b/drivers/s390/char/monwriter.c
index 4362ff260244..abd02ed501cb 100644
--- a/drivers/s390/char/monwriter.c
+++ b/drivers/s390/char/monwriter.c
@@ -110,7 +110,7 @@ static int monwrite_new_hdr(struct mon_private *monpriv)
                monbuf = kzalloc(sizeof(struct mon_buf), GFP_KERNEL);
                if (!monbuf)
                        return -ENOMEM;
-                monbuf->data = kzalloc(monbuf->hdr.datalen,
+                monbuf->data = kzalloc(monhdr->datalen,
                                       GFP_KERNEL | GFP_DMA);
                if (!monbuf->data) {
                        kfree(monbuf);
diff --git a/drivers/s390/cio/chsc.c b/drivers/s390/cio/chsc.c
index 07c7f19339d2..2d78f0f4a40f 100644
--- a/drivers/s390/cio/chsc.c
+++ b/drivers/s390/cio/chsc.c
@@ -370,7 +370,7 @@ __s390_process_res_acc(struct subchannel_id schid, void *data)
        struct res_acc_data *res_data;
        struct subchannel *sch;
-        res_data = (struct res_acc_data *)data;
+        res_data = data;
        sch = get_subchannel_by_schid(schid);
        if (!sch)
                /* Check if a subchannel is newly available. */
@@ -444,7 +444,7 @@ __get_chpid_from_lir(void *data)
                u32 isinfo[28];
        } *lir;
-        lir = (struct lir*) data;
+        lir = data;
        if (!(lir->iq&0x80))
                /* NULL link incident record */
                return -EINVAL;
@@ -628,7 +628,7 @@ __chp_add(struct subchannel_id schid, void *data)
        struct channel_path *chp;
        struct subchannel *sch;
-        chp = (struct channel_path *)data;
+        chp = data;
        sch = get_subchannel_by_schid(schid);
        if (!sch)
                /* Check if the subchannel is now available. */
@@ -707,8 +707,7 @@ chp_process_crw(int chpid, int on)
        return chp_add(chpid);
 }
-static inline int
+static inline int check_for_io_on_path(struct subchannel *sch, int index)
-__check_for_io_and_kill(struct subchannel *sch, int index)
 {
        int cc;
@@ -718,10 +717,8 @@ __check_for_io_and_kill(struct subchannel *sch, int index)
        cc = stsch(sch->schid, &sch->schib);
        if (cc)
                return 0;
-        if (sch->schib.scsw.actl && sch->schib.pmcw.lpum == (0x80 >> index)) {
+        if (sch->schib.scsw.actl && sch->schib.pmcw.lpum == (0x80 >> index))
-                device_set_waiting(sch);
                return 1;
-        }
        return 0;
 }
@@ -750,12 +747,10 @@ __s390_subchannel_vary_chpid(struct subchannel *sch, __u8 chpid, int on)
                } else {
                        sch->opm &= ~(0x80 >> chp);
                        sch->lpm &= ~(0x80 >> chp);
-                        /*
+                        if (check_for_io_on_path(sch, chp))
-                         * Give running I/O a grace period in which it
+                                /* Path verification is done after killing. */
-                         * can successfully terminate, even using the
+                                device_kill_io(sch);
-                         * just varied off path. Then kill it.
+                        else if (!sch->lpm) {
-                         */
-                        if (!__check_for_io_and_kill(sch, chp) && !sch->lpm) {
                                if (css_enqueue_subchannel_slow(sch->schid)) {
                                        css_clear_subchannel_slow_list();
                                        need_rescan = 1;
diff --git a/drivers/s390/cio/cio.c b/drivers/s390/cio/cio.c
index f18b1623cad7..8936e460a807 100644
--- a/drivers/s390/cio/cio.c
+++ b/drivers/s390/cio/cio.c
@@ -609,8 +609,8 @@ do_IRQ (struct pt_regs *regs)
        struct irb *irb;
        struct pt_regs *old_regs;
-        irq_enter ();
        old_regs = set_irq_regs(regs);
+        irq_enter();
        asm volatile ("mc 0,0");
        if (S390_lowcore.int_clock >= S390_lowcore.jiffy_timer)
                /**
@@ -655,8 +655,8 @@ do_IRQ (struct pt_regs *regs)
                 * out of the sie which costs more cycles than it saves.
                 */
        } while (!MACHINE_IS_VM && tpi (NULL) != 0);
+        irq_exit();
        set_irq_regs(old_regs);
-        irq_exit ();
 }
 #ifdef CONFIG_CCW_CONSOLE
diff --git a/drivers/s390/cio/css.c b/drivers/s390/cio/css.c
index 7086a74e9871..a2dee5bf5a17 100644
--- a/drivers/s390/cio/css.c
+++ b/drivers/s390/cio/css.c
@@ -177,7 +177,7 @@ get_subchannel_by_schid(struct subchannel_id schid)
        struct device *dev;
        dev = bus_find_device(&css_bus_type, NULL,
-                              (void *)&schid, check_subchannel);
+                              &schid, check_subchannel);
        return dev ? to_subchannel(dev) : NULL;
 }
diff --git a/drivers/s390/cio/css.h b/drivers/s390/cio/css.h
index 8aabb4adeb5f..4c2ff8336288 100644
--- a/drivers/s390/cio/css.h
+++ b/drivers/s390/cio/css.h
@@ -76,9 +76,8 @@ struct ccw_device_private {
        int state;              /* device state */
        atomic_t onoff;
        unsigned long registered;
-        __u16 devno;            /* device number */
+        struct ccw_dev_id dev_id;       /* device id */
-        __u16 sch_no;           /* subchannel number */
+        struct subchannel_id schid;     /* subchannel number */
-        __u8 ssid;              /* subchannel set id */
        __u8 imask;             /* lpm mask for SNID/SID/SPGID */
        int iretry;             /* retry counter SNID/SID/SPGID */
        struct {
@@ -171,7 +170,7 @@ void device_trigger_reprobe(struct subchannel *);
 /* Helper functions for vary on/off. */
 int device_is_online(struct subchannel *);
-void device_set_waiting(struct subchannel *);
+void device_kill_io(struct subchannel *);
 /* Machine check helper function. */
 void device_kill_pending_timer(struct subchannel *);
diff --git a/drivers/s390/cio/device.c b/drivers/s390/cio/device.c
index 688945662c15..94bdd4d8a4c9 100644
--- a/drivers/s390/cio/device.c
+++ b/drivers/s390/cio/device.c
@@ -552,21 +552,19 @@ ccw_device_register(struct ccw_device *cdev)
 }
 struct match_data {
-        unsigned int devno;
+        struct ccw_dev_id dev_id;
-        unsigned int ssid;
        struct ccw_device * sibling;
 };
 static int
 match_devno(struct device * dev, void * data)
 {
-        struct match_data * d = (struct match_data *)data;
+        struct match_data * d = data;
        struct ccw_device * cdev;
        cdev = to_ccwdev(dev);
        if ((cdev->private->state == DEV_STATE_DISCONNECTED) &&
-            (cdev->private->devno == d->devno) &&
+            ccw_dev_id_is_equal(&cdev->private->dev_id, &d->dev_id) &&
-            (cdev->private->ssid == d->ssid) &&
            (cdev != d->sibling)) {
                cdev->private->state = DEV_STATE_NOT_OPER;
                return 1;
@@ -574,15 +572,13 @@ match_devno(struct device * dev, void * data)
        return 0;
 }
-static struct ccw_device *
+static struct ccw_device * get_disc_ccwdev_by_dev_id(struct ccw_dev_id *dev_id,
-get_disc_ccwdev_by_devno(unsigned int devno, unsigned int ssid,
+                                                     struct ccw_device *sibling)
-                         struct ccw_device *sibling)
 {
        struct device *dev;
        struct match_data data;
-        data.devno = devno;
+        data.dev_id = *dev_id;
-        data.ssid = ssid;
        data.sibling = sibling;
        dev = bus_find_device(&ccw_bus_type, NULL, &data, match_devno);
@@ -595,7 +591,7 @@ ccw_device_add_changed(void *data)
        struct ccw_device *cdev;
-        cdev = (struct ccw_device *)data;
+        cdev = data;
        if (device_add(&cdev->dev)) {
                put_device(&cdev->dev);
                return;
@@ -616,9 +612,9 @@ ccw_device_do_unreg_rereg(void *data)
        struct subchannel *sch;
        int need_rename;
-        cdev = (struct ccw_device *)data;
+        cdev = data;
        sch = to_subchannel(cdev->dev.parent);
-        if (cdev->private->devno != sch->schib.pmcw.dev) {
+        if (cdev->private->dev_id.devno != sch->schib.pmcw.dev) {
                /*
                 * The device number has changed. This is usually only when
                 * a device has been detached under VM and then re-appeared
@@ -633,10 +629,12 @@ ccw_device_do_unreg_rereg(void *data)
                 *        get possibly sick...
                 */
                struct ccw_device *other_cdev;
+                struct ccw_dev_id dev_id;
                need_rename = 1;
-                other_cdev = get_disc_ccwdev_by_devno(sch->schib.pmcw.dev,
+                dev_id.devno = sch->schib.pmcw.dev;
-                                                      sch->schid.ssid, cdev);
+                dev_id.ssid = sch->schid.ssid;
+                other_cdev = get_disc_ccwdev_by_dev_id(&dev_id, cdev);
                if (other_cdev) {
                        struct subchannel *other_sch;
@@ -652,7 +650,7 @@ ccw_device_do_unreg_rereg(void *data)
                }
                /* Update ssd info here. */
                css_get_ssd_info(sch);
-                cdev->private->devno = sch->schib.pmcw.dev;
+                cdev->private->dev_id.devno = sch->schib.pmcw.dev;
        } else
                need_rename = 0;
        device_remove_files(&cdev->dev);
@@ -662,7 +660,7 @@ ccw_device_do_unreg_rereg(void *data)
                snprintf (cdev->dev.bus_id, BUS_ID_SIZE, "0.%x.%04x",
                          sch->schid.ssid, sch->schib.pmcw.dev);
        PREPARE_WORK(&cdev->private->kick_work,
-                     ccw_device_add_changed, (void *)cdev);
+                     ccw_device_add_changed, cdev);
        queue_work(ccw_device_work, &cdev->private->kick_work);
 }
@@ -687,7 +685,7 @@ io_subchannel_register(void *data)
        int ret;
        unsigned long flags;
-        cdev = (struct ccw_device *) data;
+        cdev = data;
        sch = to_subchannel(cdev->dev.parent);
        if (klist_node_attached(&cdev->dev.knode_parent)) {
@@ -759,7 +757,7 @@ io_subchannel_recog_done(struct ccw_device *cdev)
                        break;
                sch = to_subchannel(cdev->dev.parent);
                PREPARE_WORK(&cdev->private->kick_work,
-                             ccw_device_call_sch_unregister, (void *) cdev);
+                             ccw_device_call_sch_unregister, cdev);
                queue_work(slow_path_wq, &cdev->private->kick_work);
                if (atomic_dec_and_test(&ccw_device_init_count))
                        wake_up(&ccw_device_init_wq);
@@ -774,7 +772,7 @@ io_subchannel_recog_done(struct ccw_device *cdev)
                if (!get_device(&cdev->dev))
                        break;
                PREPARE_WORK(&cdev->private->kick_work,
-                             io_subchannel_register, (void *) cdev);
+                             io_subchannel_register, cdev);
                queue_work(slow_path_wq, &cdev->private->kick_work);
                break;
        }
@@ -792,9 +790,9 @@ io_subchannel_recog(struct ccw_device *cdev, struct subchannel *sch)
        /* Init private data. */
        priv = cdev->private;
-        priv->devno = sch->schib.pmcw.dev;
+        priv->dev_id.devno = sch->schib.pmcw.dev;
-        priv->ssid = sch->schid.ssid;
+        priv->dev_id.ssid = sch->schid.ssid;
-        priv->sch_no = sch->schid.sch_no;
+        priv->schid = sch->schid;
        priv->state = DEV_STATE_NOT_OPER;
        INIT_LIST_HEAD(&priv->cmb_list);
        init_waitqueue_head(&priv->wait_q);
@@ -912,7 +910,7 @@ io_subchannel_remove (struct subchannel *sch)
         */
        if (get_device(&cdev->dev)) {
                PREPARE_WORK(&cdev->private->kick_work,
-                             ccw_device_unregister, (void *) cdev);
+                             ccw_device_unregister, cdev);
                queue_work(ccw_device_work, &cdev->private->kick_work);
        }
        return 0;
@@ -1055,7 +1053,7 @@ __ccwdev_check_busid(struct device *dev, void *id)
 {
        char *bus_id;
-        bus_id = (char *)id;
+        bus_id = id;
        return (strncmp(bus_id, dev->bus_id, BUS_ID_SIZE) == 0);
 }
diff --git a/drivers/s390/cio/device.h b/drivers/s390/cio/device.h
index 00be9a5b4acd..c6140cc97a80 100644
--- a/drivers/s390/cio/device.h
+++ b/drivers/s390/cio/device.h
@@ -21,7 +21,6 @@ enum dev_state {
        /* states to wait for i/o completion before doing something */
        DEV_STATE_CLEAR_VERIFY,
        DEV_STATE_TIMEOUT_KILL,
-        DEV_STATE_WAIT4IO,
        DEV_STATE_QUIESCE,
        /* special states for devices gone not operational */
        DEV_STATE_DISCONNECTED,
diff --git a/drivers/s390/cio/device_fsm.c b/drivers/s390/cio/device_fsm.c
index b67620208f36..fcaf28d7b4eb 100644
--- a/drivers/s390/cio/device_fsm.c
+++ b/drivers/s390/cio/device_fsm.c
@@ -59,18 +59,6 @@ device_set_disconnected(struct subchannel *sch)
        cdev->private->state = DEV_STATE_DISCONNECTED;
 }
-void
-device_set_waiting(struct subchannel *sch)
-{
-        struct ccw_device *cdev;
-        if (!sch->dev.driver_data)
-                return;
-        cdev = sch->dev.driver_data;
-        ccw_device_set_timeout(cdev, 10*HZ);
-        cdev->private->state = DEV_STATE_WAIT4IO;
-}
 /*
 * Timeout function. It just triggers a DEV_EVENT_TIMEOUT.
 */
@@ -183,9 +171,9 @@ ccw_device_handle_oper(struct ccw_device *cdev)
            cdev->id.cu_model != cdev->private->senseid.cu_model ||
            cdev->id.dev_type != cdev->private->senseid.dev_type ||
            cdev->id.dev_model != cdev->private->senseid.dev_model ||
-            cdev->private->devno != sch->schib.pmcw.dev) {
+            cdev->private->dev_id.devno != sch->schib.pmcw.dev) {
                PREPARE_WORK(&cdev->private->kick_work,
-                             ccw_device_do_unreg_rereg, (void *)cdev);
+                             ccw_device_do_unreg_rereg, cdev);
                queue_work(ccw_device_work, &cdev->private->kick_work);
                return 0;
        }
@@ -255,7 +243,7 @@ ccw_device_recog_done(struct ccw_device *cdev, int state)
        case DEV_STATE_NOT_OPER:
                CIO_DEBUG(KERN_WARNING, 2,
                          "SenseID : unknown device %04x on subchannel "
-                          "0.%x.%04x\n", cdev->private->devno,
+                          "0.%x.%04x\n", cdev->private->dev_id.devno,
                          sch->schid.ssid, sch->schid.sch_no);
                break;
        case DEV_STATE_OFFLINE:
@@ -282,14 +270,15 @@ ccw_device_recog_done(struct ccw_device *cdev, int state)
                CIO_DEBUG(KERN_INFO, 2, "SenseID : device 0.%x.%04x reports: "
                          "CU  Type/Mod = %04X/%02X, Dev Type/Mod = "
                          "%04X/%02X\n",
-                          cdev->private->ssid, cdev->private->devno,
+                          cdev->private->dev_id.ssid,
+                          cdev->private->dev_id.devno,
                          cdev->id.cu_type, cdev->id.cu_model,
                          cdev->id.dev_type, cdev->id.dev_model);
                break;
        case DEV_STATE_BOXED:
                CIO_DEBUG(KERN_WARNING, 2,
                          "SenseID : boxed device %04x on subchannel "
-                          "0.%x.%04x\n", cdev->private->devno,
+                          "0.%x.%04x\n", cdev->private->dev_id.devno,
                          sch->schid.ssid, sch->schid.sch_no);
                break;
        }
@@ -325,13 +314,13 @@ ccw_device_oper_notify(void *data)
        struct subchannel *sch;
        int ret;
-        cdev = (struct ccw_device *)data;
+        cdev = data;
        sch = to_subchannel(cdev->dev.parent);
        ret = (sch->driver && sch->driver->notify) ?
                sch->driver->notify(&sch->dev, CIO_OPER) : 0;
        if (!ret)
                /* Driver doesn't want device back. */
-                ccw_device_do_unreg_rereg((void *)cdev);
+                ccw_device_do_unreg_rereg(cdev);
        else {
                /* Reenable channel measurements, if needed. */
                cmf_reenable(cdev);
@@ -363,12 +352,12 @@ ccw_device_done(struct ccw_device *cdev, int state)
        if (state == DEV_STATE_BOXED)
                CIO_DEBUG(KERN_WARNING, 2,
                          "Boxed device %04x on subchannel %04x\n",
-                          cdev->private->devno, sch->schid.sch_no);
+                          cdev->private->dev_id.devno, sch->schid.sch_no);
        if (cdev->private->flags.donotify) {
                cdev->private->flags.donotify = 0;
                PREPARE_WORK(&cdev->private->kick_work, ccw_device_oper_notify,
-                             (void *)cdev);
+                             cdev);
                queue_work(ccw_device_notify_work, &cdev->private->kick_work);
        }
        wake_up(&cdev->private->wait_q);
@@ -412,7 +401,8 @@ static void __ccw_device_get_common_pgid(struct ccw_device *cdev)
                /* PGID mismatch, can't pathgroup. */
                CIO_MSG_EVENT(0, "SNID - pgid mismatch for device "
                              "0.%x.%04x, can't pathgroup\n",
-                              cdev->private->ssid, cdev->private->devno);
+                              cdev->private->dev_id.ssid,
+                              cdev->private->dev_id.devno);
                cdev->private->options.pgroup = 0;
                return;
        }
@@ -523,7 +513,7 @@ ccw_device_nopath_notify(void *data)
        struct subchannel *sch;
        int ret;
-        cdev = (struct ccw_device *)data;
+        cdev = data;
        sch = to_subchannel(cdev->dev.parent);
        /* Extra sanity. */
        if (sch->lpm)
@@ -537,7 +527,7 @@ ccw_device_nopath_notify(void *data)
                        if (get_device(&cdev->dev)) {
                                PREPARE_WORK(&cdev->private->kick_work,
                                             ccw_device_call_sch_unregister,
-                                             (void *)cdev);
+                                             cdev);
                                queue_work(ccw_device_work,
                                           &cdev->private->kick_work);
                        } else
@@ -592,7 +582,7 @@ ccw_device_verify_done(struct ccw_device *cdev, int err)
                break;
        default:
                PREPARE_WORK(&cdev->private->kick_work,
-                             ccw_device_nopath_notify, (void *)cdev);
+                             ccw_device_nopath_notify, cdev);
                queue_work(ccw_device_notify_work, &cdev->private->kick_work);
                ccw_device_done(cdev, DEV_STATE_NOT_OPER);
                break;
@@ -723,7 +713,7 @@ ccw_device_offline_notoper(struct ccw_device *cdev, enum dev_event dev_event)
        sch = to_subchannel(cdev->dev.parent);
        if (get_device(&cdev->dev)) {
                PREPARE_WORK(&cdev->private->kick_work,
-                             ccw_device_call_sch_unregister, (void *)cdev);
+                             ccw_device_call_sch_unregister, cdev);
                queue_work(ccw_device_work, &cdev->private->kick_work);
        }
        wake_up(&cdev->private->wait_q);
@@ -754,7 +744,7 @@ ccw_device_online_notoper(struct ccw_device *cdev, enum dev_event dev_event)
        }
        if (get_device(&cdev->dev)) {
                PREPARE_WORK(&cdev->private->kick_work,
-                             ccw_device_call_sch_unregister, (void *)cdev);
+                             ccw_device_call_sch_unregister, cdev);
                queue_work(ccw_device_work, &cdev->private->kick_work);
        }
        wake_up(&cdev->private->wait_q);
@@ -859,7 +849,7 @@ ccw_device_online_timeout(struct ccw_device *cdev, enum dev_event dev_event)
                sch = to_subchannel(cdev->dev.parent);
                if (!sch->lpm) {
                        PREPARE_WORK(&cdev->private->kick_work,
-                                     ccw_device_nopath_notify, (void *)cdev);
+                                     ccw_device_nopath_notify, cdev);
                        queue_work(ccw_device_notify_work,
                                   &cdev->private->kick_work);
                } else
@@ -885,7 +875,8 @@ ccw_device_w4sense(struct ccw_device *cdev, enum dev_event dev_event)
                        /* Basic sense hasn't started. Try again. */
                        ccw_device_do_sense(cdev, irb);
                else {
-                        printk("Huh? %s(%s): unsolicited interrupt...\n",
+                        printk(KERN_INFO "Huh? %s(%s): unsolicited "
+                               "interrupt...\n",
                               __FUNCTION__, cdev->dev.bus_id);
                        if (cdev->handler)
                                cdev->handler (cdev, 0, irb);
@@ -944,10 +935,10 @@ ccw_device_killing_irq(struct ccw_device *cdev, enum dev_event dev_event)
        cdev->private->state = DEV_STATE_ONLINE;
        if (cdev->handler)
                cdev->handler(cdev, cdev->private->intparm,
-                              ERR_PTR(-ETIMEDOUT));
+                              ERR_PTR(-EIO));
        if (!sch->lpm) {
                PREPARE_WORK(&cdev->private->kick_work,
-                             ccw_device_nopath_notify, (void *)cdev);
+                             ccw_device_nopath_notify, cdev);
                queue_work(ccw_device_notify_work, &cdev->private->kick_work);
        } else if (cdev->private->flags.doverify)
                /* Start delayed path verification. */
@@ -970,7 +961,7 @@ ccw_device_killing_timeout(struct ccw_device *cdev, enum dev_event dev_event)
                sch = to_subchannel(cdev->dev.parent);
                if (!sch->lpm) {
                        PREPARE_WORK(&cdev->private->kick_work,
-                                     ccw_device_nopath_notify, (void *)cdev);
+                                     ccw_device_nopath_notify, cdev);
                        queue_work(ccw_device_notify_work,
                                   &cdev->private->kick_work);
                } else
@@ -981,51 +972,15 @@ ccw_device_killing_timeout(struct ccw_device *cdev, enum dev_event dev_event)
        cdev->private->state = DEV_STATE_ONLINE;
        if (cdev->handler)
                cdev->handler(cdev, cdev->private->intparm,
-                              ERR_PTR(-ETIMEDOUT));
+                              ERR_PTR(-EIO));
-}
-static void
-ccw_device_wait4io_irq(struct ccw_device *cdev, enum dev_event dev_event)
-{
-        struct irb *irb;
-        struct subchannel *sch;
-        irb = (struct irb *) __LC_IRB;
-        /*
-         * Accumulate status and find out if a basic sense is needed.
-         * This is fine since we have already adapted the lpm.
-         */
-        ccw_device_accumulate_irb(cdev, irb);
-        if (cdev->private->flags.dosense) {
-                if (ccw_device_do_sense(cdev, irb) == 0) {
-                        cdev->private->state = DEV_STATE_W4SENSE;
-                }
-                return;
-        }
-        /* Iff device is idle, reset timeout. */
-        sch = to_subchannel(cdev->dev.parent);
-        if (!stsch(sch->schid, &sch->schib))
-                if (sch->schib.scsw.actl == 0)
-                        ccw_device_set_timeout(cdev, 0);
-        /* Call the handler. */
-        ccw_device_call_handler(cdev);
-        if (!sch->lpm) {
-                PREPARE_WORK(&cdev->private->kick_work,
-                             ccw_device_nopath_notify, (void *)cdev);
-                queue_work(ccw_device_notify_work, &cdev->private->kick_work);
-        } else if (cdev->private->flags.doverify)
-                ccw_device_online_verify(cdev, 0);
 }
-static void
+void device_kill_io(struct subchannel *sch)
-ccw_device_wait4io_timeout(struct ccw_device *cdev, enum dev_event dev_event)
 {
        int ret;
-        struct subchannel *sch;
+        struct ccw_device *cdev;
-        sch = to_subchannel(cdev->dev.parent);
+        cdev = sch->dev.driver_data;
-        ccw_device_set_timeout(cdev, 0);
        ret = ccw_device_cancel_halt_clear(cdev);
        if (ret == -EBUSY) {
                ccw_device_set_timeout(cdev, 3*HZ);
@@ -1035,7 +990,7 @@ ccw_device_wait4io_timeout(struct ccw_device *cdev, enum dev_event dev_event)
        if (ret == -ENODEV) {
                if (!sch->lpm) {
                        PREPARE_WORK(&cdev->private->kick_work,
-                                     ccw_device_nopath_notify, (void *)cdev);
+                                     ccw_device_nopath_notify, cdev);
                        queue_work(ccw_device_notify_work,
                                   &cdev->private->kick_work);
                } else
@@ -1044,12 +999,12 @@ ccw_device_wait4io_timeout(struct ccw_device *cdev, enum dev_event dev_event)
        }
        if (cdev->handler)
                cdev->handler(cdev, cdev->private->intparm,
-                              ERR_PTR(-ETIMEDOUT));
+                              ERR_PTR(-EIO));
        if (!sch->lpm) {
                PREPARE_WORK(&cdev->private->kick_work,
-                             ccw_device_nopath_notify, (void *)cdev);
+                             ccw_device_nopath_notify, cdev);
                queue_work(ccw_device_notify_work, &cdev->private->kick_work);
-        } else if (cdev->private->flags.doverify)
+        } else
                /* Start delayed path verification. */
                ccw_device_online_verify(cdev, 0);
 }
@@ -1286,12 +1241,6 @@ fsm_func_t *dev_jumptable[NR_DEV_STATES][NR_DEV_EVENTS] = {
                [DEV_EVENT_TIMEOUT]     = ccw_device_killing_timeout,
                [DEV_EVENT_VERIFY]      = ccw_device_nop, //FIXME
        },
-        [DEV_STATE_WAIT4IO] = {
-                [DEV_EVENT_NOTOPER]     = ccw_device_online_notoper,
-                [DEV_EVENT_INTERRUPT]   = ccw_device_wait4io_irq,
-                [DEV_EVENT_TIMEOUT]     = ccw_device_wait4io_timeout,
-                [DEV_EVENT_VERIFY]      = ccw_device_delay_verify,
-        },
        [DEV_STATE_QUIESCE] = {
                [DEV_EVENT_NOTOPER]     = ccw_device_quiesce_done,
                [DEV_EVENT_INTERRUPT]   = ccw_device_quiesce_done,
diff --git a/drivers/s390/cio/device_id.c b/drivers/s390/cio/device_id.c
index 1398367b5f68..a74785b9e4eb 100644
--- a/drivers/s390/cio/device_id.c
+++ b/drivers/s390/cio/device_id.c
@@ -251,7 +251,7 @@ ccw_device_check_sense_id(struct ccw_device *cdev)
                 */
                CIO_MSG_EVENT(2, "SenseID : device %04x on Subchannel "
                              "0.%x.%04x reports cmd reject\n",
-                              cdev->private->devno, sch->schid.ssid,
+                              cdev->private->dev_id.devno, sch->schid.ssid,
                              sch->schid.sch_no);
                return -EOPNOTSUPP;
        }
@@ -259,7 +259,8 @@ ccw_device_check_sense_id(struct ccw_device *cdev)
                CIO_MSG_EVENT(2, "SenseID : UC on dev 0.%x.%04x, "
                              "lpum %02X, cnt %02d, sns :"
                              " %02X%02X%02X%02X %02X%02X%02X%02X ...\n",
-                              cdev->private->ssid, cdev->private->devno,
+                              cdev->private->dev_id.ssid,
+                              cdev->private->dev_id.devno,
                              irb->esw.esw0.sublog.lpum,
                              irb->esw.esw0.erw.scnt,
                              irb->ecw[0], irb->ecw[1],
@@ -274,14 +275,15 @@ ccw_device_check_sense_id(struct ccw_device *cdev)
                        CIO_MSG_EVENT(2, "SenseID : path %02X for device %04x "
                                      "on subchannel 0.%x.%04x is "
                                      "'not operational'\n", sch->orb.lpm,
-                                      cdev->private->devno, sch->schid.ssid,
+                                      cdev->private->dev_id.devno,
-                                      sch->schid.sch_no);
+                                      sch->schid.ssid, sch->schid.sch_no);
                return -EACCES;
        }
        /* Hmm, whatever happened, try again. */
        CIO_MSG_EVENT(2, "SenseID : start_IO() for device %04x on "
                      "subchannel 0.%x.%04x returns status %02X%02X\n",
-                      cdev->private->devno, sch->schid.ssid, sch->schid.sch_no,
+                      cdev->private->dev_id.devno, sch->schid.ssid,
+                      sch->schid.sch_no,
                      irb->scsw.dstat, irb->scsw.cstat);
        return -EAGAIN;
 }
@@ -330,7 +332,7 @@ ccw_device_sense_id_irq(struct ccw_device *cdev, enum dev_event dev_event)
                /* fall through. */
        default:                /* Sense ID failed. Try asking VM. */
                if (MACHINE_IS_VM) {
-                        VM_virtual_device_info (cdev->private->devno,
+                        VM_virtual_device_info (cdev->private->dev_id.devno,
                                                &cdev->private->senseid);
                        if (cdev->private->senseid.cu_type != 0xFFFF) {
                                /* Got the device information from VM. */
diff --git a/drivers/s390/cio/device_ops.c b/drivers/s390/cio/device_ops.c
index 84b9b18eabc2..b39c1fa48acd 100644
--- a/drivers/s390/cio/device_ops.c
+++ b/drivers/s390/cio/device_ops.c
@@ -50,7 +50,6 @@ ccw_device_clear(struct ccw_device *cdev, unsigned long intparm)
        if (cdev->private->state == DEV_STATE_NOT_OPER)
                return -ENODEV;
        if (cdev->private->state != DEV_STATE_ONLINE &&
-            cdev->private->state != DEV_STATE_WAIT4IO &&
            cdev->private->state != DEV_STATE_W4SENSE)
                return -EINVAL;
        sch = to_subchannel(cdev->dev.parent);
@@ -155,7 +154,6 @@ ccw_device_halt(struct ccw_device *cdev, unsigned long intparm)
        if (cdev->private->state == DEV_STATE_NOT_OPER)
                return -ENODEV;
        if (cdev->private->state != DEV_STATE_ONLINE &&
-            cdev->private->state != DEV_STATE_WAIT4IO &&
            cdev->private->state != DEV_STATE_W4SENSE)
                return -EINVAL;
        sch = to_subchannel(cdev->dev.parent);
@@ -592,13 +590,13 @@ ccw_device_get_chp_desc(struct ccw_device *cdev, int chp_no)
 int
 _ccw_device_get_subchannel_number(struct ccw_device *cdev)
 {
-        return cdev->private->sch_no;
+        return cdev->private->schid.sch_no;
 }
 int
 _ccw_device_get_device_number(struct ccw_device *cdev)
 {
-        return cdev->private->devno;
+        return cdev->private->dev_id.devno;
 }
diff --git a/drivers/s390/cio/device_pgid.c b/drivers/s390/cio/device_pgid.c
index 84917b39de45..2975ce888c19 100644
--- a/drivers/s390/cio/device_pgid.c
+++ b/drivers/s390/cio/device_pgid.c
@@ -79,7 +79,8 @@ __ccw_device_sense_pgid_start(struct ccw_device *cdev)
                        CIO_MSG_EVENT(2, "SNID - Device %04x on Subchannel "
                                      "0.%x.%04x, lpm %02X, became 'not "
                                      "operational'\n",
-                                      cdev->private->devno, sch->schid.ssid,
+                                      cdev->private->dev_id.devno,
+                                      sch->schid.ssid,
                                      sch->schid.sch_no, cdev->private->imask);
                }
@@ -135,7 +136,8 @@ __ccw_device_check_sense_pgid(struct ccw_device *cdev)
                CIO_MSG_EVENT(2, "SNID - device 0.%x.%04x, unit check, "
                              "lpum %02X, cnt %02d, sns : "
                              "%02X%02X%02X%02X %02X%02X%02X%02X ...\n",
-                              cdev->private->ssid, cdev->private->devno,
+                              cdev->private->dev_id.ssid,
+                              cdev->private->dev_id.devno,
                              irb->esw.esw0.sublog.lpum,
                              irb->esw.esw0.erw.scnt,
                              irb->ecw[0], irb->ecw[1],
@@ -147,7 +149,7 @@ __ccw_device_check_sense_pgid(struct ccw_device *cdev)
        if (irb->scsw.cc == 3) {
                CIO_MSG_EVENT(2, "SNID - Device %04x on Subchannel 0.%x.%04x,"
                              " lpm %02X, became 'not operational'\n",
-                              cdev->private->devno, sch->schid.ssid,
+                              cdev->private->dev_id.devno, sch->schid.ssid,
                              sch->schid.sch_no, sch->orb.lpm);
                return -EACCES;
        }
@@ -155,7 +157,7 @@ __ccw_device_check_sense_pgid(struct ccw_device *cdev)
        if (cdev->private->pgid[i].inf.ps.state2 == SNID_STATE2_RESVD_ELSE) {
                CIO_MSG_EVENT(2, "SNID - Device %04x on Subchannel 0.%x.%04x "
                              "is reserved by someone else\n",
-                              cdev->private->devno, sch->schid.ssid,
+                              cdev->private->dev_id.devno, sch->schid.ssid,
                              sch->schid.sch_no);
                return -EUSERS;
        }
@@ -261,7 +263,7 @@ __ccw_device_do_pgid(struct ccw_device *cdev, __u8 func)
        /* PGID command failed on this path. */
        CIO_MSG_EVENT(2, "SPID - Device %04x on Subchannel "
                      "0.%x.%04x, lpm %02X, became 'not operational'\n",
-                      cdev->private->devno, sch->schid.ssid,
+                      cdev->private->dev_id.devno, sch->schid.ssid,
                      sch->schid.sch_no, cdev->private->imask);
        return ret;
 }
@@ -301,7 +303,7 @@ static int __ccw_device_do_nop(struct ccw_device *cdev)
        /* nop command failed on this path. */
        CIO_MSG_EVENT(2, "NOP - Device %04x on Subchannel "
                      "0.%x.%04x, lpm %02X, became 'not operational'\n",
-                      cdev->private->devno, sch->schid.ssid,
+                      cdev->private->dev_id.devno, sch->schid.ssid,
                      sch->schid.sch_no, cdev->private->imask);
        return ret;
 }
@@ -328,8 +330,9 @@ __ccw_device_check_pgid(struct ccw_device *cdev)
                CIO_MSG_EVENT(2, "SPID - device 0.%x.%04x, unit check, "
                              "cnt %02d, "
                              "sns : %02X%02X%02X%02X %02X%02X%02X%02X ...\n",
-                              cdev->private->ssid,
+                              cdev->private->dev_id.ssid,
-                              cdev->private->devno, irb->esw.esw0.erw.scnt,
+                              cdev->private->dev_id.devno,
+                              irb->esw.esw0.erw.scnt,
                              irb->ecw[0], irb->ecw[1],
                              irb->ecw[2], irb->ecw[3],
                              irb->ecw[4], irb->ecw[5],
@@ -339,7 +342,7 @@ __ccw_device_check_pgid(struct ccw_device *cdev)
        if (irb->scsw.cc == 3) {
                CIO_MSG_EVENT(2, "SPID - Device %04x on Subchannel 0.%x.%04x,"
                              " lpm %02X, became 'not operational'\n",
-                              cdev->private->devno, sch->schid.ssid,
+                              cdev->private->dev_id.devno, sch->schid.ssid,
                              sch->schid.sch_no, cdev->private->imask);
                return -EACCES;
        }
@@ -362,7 +365,7 @@ static int __ccw_device_check_nop(struct ccw_device *cdev)
        if (irb->scsw.cc == 3) {
                CIO_MSG_EVENT(2, "NOP - Device %04x on Subchannel 0.%x.%04x,"
                              " lpm %02X, became 'not operational'\n",
-                              cdev->private->devno, sch->schid.ssid,
+                              cdev->private->dev_id.devno, sch->schid.ssid,
                              sch->schid.sch_no, cdev->private->imask);
                return -EACCES;
        }
diff --git a/drivers/s390/cio/device_status.c b/drivers/s390/cio/device_status.c
index caf148d5caad..3f7cbce4cd87 100644
--- a/drivers/s390/cio/device_status.c
+++ b/drivers/s390/cio/device_status.c
@@ -32,19 +32,18 @@ ccw_device_msg_control_check(struct ccw_device *cdev, struct irb *irb)
                                 SCHN_STAT_CHN_CTRL_CHK |
                                 SCHN_STAT_INTF_CTRL_CHK)))
                return;
-                
        CIO_MSG_EVENT(0, "Channel-Check or Interface-Control-Check "
                      "received"
                      " ... device %04x on subchannel 0.%x.%04x, dev_stat "
                      ": %02X sch_stat : %02X\n",
-                      cdev->private->devno, cdev->private->ssid,
+                      cdev->private->dev_id.devno, cdev->private->schid.ssid,
-                      cdev->private->sch_no,
+                      cdev->private->schid.sch_no,
                      irb->scsw.dstat, irb->scsw.cstat);
        if (irb->scsw.cc != 3) {
                char dbf_text[15];
-                sprintf(dbf_text, "chk%x", cdev->private->sch_no);
+                sprintf(dbf_text, "chk%x", cdev->private->schid.sch_no);
                CIO_TRACE_EVENT(0, dbf_text);
                CIO_HEX_EVENT(0, irb, sizeof (struct irb));
        }
diff --git a/drivers/s390/cio/qdio.c b/drivers/s390/cio/qdio.c
index cde822d8b5c8..0648ce5bb684 100644
--- a/drivers/s390/cio/qdio.c
+++ b/drivers/s390/cio/qdio.c
@@ -1741,7 +1741,7 @@ qdio_fill_qs(struct qdio_irq *irq_ptr, struct ccw_device *cdev,
        void *ptr;
        int available;
-        sprintf(dbf_text,"qfqs%4x",cdev->private->sch_no);
+        sprintf(dbf_text,"qfqs%4x",cdev->private->schid.sch_no);
        QDIO_DBF_TEXT0(0,setup,dbf_text);
        for (i=0;i<no_input_qs;i++) {
                q=irq_ptr->input_qs[i];
@@ -2924,7 +2924,7 @@ qdio_establish_handle_irq(struct ccw_device *cdev, int cstat, int dstat)
        irq_ptr = cdev->private->qdio_data;
-        sprintf(dbf_text,"qehi%4x",cdev->private->sch_no);
+        sprintf(dbf_text,"qehi%4x",cdev->private->schid.sch_no);
        QDIO_DBF_TEXT0(0,setup,dbf_text);
        QDIO_DBF_TEXT0(0,trace,dbf_text);
@@ -2943,7 +2943,7 @@ qdio_initialize(struct qdio_initialize *init_data)
        int rc;
        char dbf_text[15];
-        sprintf(dbf_text,"qini%4x",init_data->cdev->private->sch_no);
+        sprintf(dbf_text,"qini%4x",init_data->cdev->private->schid.sch_no);
        QDIO_DBF_TEXT0(0,setup,dbf_text);
        QDIO_DBF_TEXT0(0,trace,dbf_text);
@@ -2964,7 +2964,7 @@ qdio_allocate(struct qdio_initialize *init_data)
        struct qdio_irq *irq_ptr;
        char dbf_text[15];
-        sprintf(dbf_text,"qalc%4x",init_data->cdev->private->sch_no);
+        sprintf(dbf_text,"qalc%4x",init_data->cdev->private->schid.sch_no);
        QDIO_DBF_TEXT0(0,setup,dbf_text);
        QDIO_DBF_TEXT0(0,trace,dbf_text);
        if ( (init_data->no_input_qs>QDIO_MAX_QUEUES_PER_IRQ) ||
@@ -3187,7 +3187,7 @@ qdio_establish(struct qdio_initialize *init_data)
                tiqdio_set_delay_target(irq_ptr,TIQDIO_DELAY_TARGET);
        }
-        sprintf(dbf_text,"qest%4x",cdev->private->sch_no);
+        sprintf(dbf_text,"qest%4x",cdev->private->schid.sch_no);
        QDIO_DBF_TEXT0(0,setup,dbf_text);
        QDIO_DBF_TEXT0(0,trace,dbf_text);
diff --git a/drivers/sbus/char/bbc_envctrl.c b/drivers/sbus/char/bbc_envctrl.c
index d27e4f6d7045..0d3660c28f7d 100644
--- a/drivers/sbus/char/bbc_envctrl.c
+++ b/drivers/sbus/char/bbc_envctrl.c
@@ -4,10 +4,8 @@
 * Copyright (C) 2001 David S. Miller (davem@redhat.com)
 */
-#include <linux/kernel.h>
 #include <linux/kthread.h>
-#include <linux/sched.h>
+#include <linux/syscalls.h>
-#include <linux/slab.h>
 #include <linux/delay.h>
 #include <asm/oplib.h>
 #include <asm/ebus.h>
diff --git a/drivers/sbus/char/envctrl.c b/drivers/sbus/char/envctrl.c
index 728a133d0fc5..6b6a855f3795 100644
--- a/drivers/sbus/char/envctrl.c
+++ b/drivers/sbus/char/envctrl.c
@@ -20,16 +20,12 @@
 */
 #include <linux/module.h>
-#include <linux/sched.h>
+#include <linux/init.h>
 #include <linux/kthread.h>
-#include <linux/errno.h>
 #include <linux/delay.h>
 #include <linux/ioport.h>
-#include <linux/init.h>
 #include <linux/miscdevice.h>
-#include <linux/mm.h>
+#include <linux/syscalls.h>
-#include <linux/slab.h>
-#include <linux/kernel.h>
 #include <asm/ebus.h>
 #include <asm/uaccess.h>
diff --git a/drivers/scsi/aha152x.c b/drivers/scsi/aha152x.c
index a0d1cee0be77..306f46b85a55 100644
--- a/drivers/scsi/aha152x.c
+++ b/drivers/scsi/aha152x.c
@@ -238,7 +238,7 @@
 #include <linux/module.h>
 #include <linux/sched.h>
 #include <asm/irq.h>
-#include <asm/io.h>
+#include <linux/io.h>
 #include <linux/blkdev.h>
 #include <asm/system.h>
 #include <linux/errno.h>
diff --git a/drivers/scsi/dtc.c b/drivers/scsi/dtc.c
index 0d5713dfa204..54756722dd5f 100644
--- a/drivers/scsi/dtc.c
+++ b/drivers/scsi/dtc.c
@@ -82,7 +82,7 @@
 #include <linux/string.h>
 #include <linux/init.h>
 #include <linux/interrupt.h>
-#include <asm/io.h>
+#include <linux/io.h>
 #include "scsi.h"
 #include <scsi/scsi_host.h>
 #include "dtc.h"
diff --git a/drivers/scsi/fdomain.c b/drivers/scsi/fdomain.c
index 41b05fc45380..72794a7b6dcc 100644
--- a/drivers/scsi/fdomain.c
+++ b/drivers/scsi/fdomain.c
@@ -278,9 +278,9 @@
 #include <linux/pci.h>
 #include <linux/stat.h>
 #include <linux/delay.h>
+#include <linux/io.h>
 #include <scsi/scsicam.h>
-#include <asm/io.h>
 #include <asm/system.h>
 #include <scsi/scsi.h>
diff --git a/drivers/scsi/megaraid/megaraid_mbox.c b/drivers/scsi/megaraid/megaraid_mbox.c
index c0edb662d863..7bac86dda88f 100644
--- a/drivers/scsi/megaraid/megaraid_mbox.c
+++ b/drivers/scsi/megaraid/megaraid_mbox.c
@@ -884,7 +884,7 @@ megaraid_init_mbox(adapter_t *adapter)
        if (((magic64 == HBA_SIGNATURE_64_BIT) &&
                ((adapter->pdev->subsystem_device !=
-                PCI_SUBSYS_ID_MEGARAID_SATA_150_6) ||
+                PCI_SUBSYS_ID_MEGARAID_SATA_150_6) &&
                (adapter->pdev->subsystem_device !=
                PCI_SUBSYS_ID_MEGARAID_SATA_150_4))) ||
                (adapter->pdev->vendor == PCI_VENDOR_ID_LSI_LOGIC &&
diff --git a/drivers/scsi/seagate.c b/drivers/scsi/seagate.c
index 8ff1f2866f7b..5ffec2721b28 100644
--- a/drivers/scsi/seagate.c
+++ b/drivers/scsi/seagate.c
@@ -97,8 +97,8 @@
 #include <linux/blkdev.h>
 #include <linux/stat.h>
 #include <linux/delay.h>
+#include <linux/io.h>
-#include <asm/io.h>
 #include <asm/system.h>
 #include <asm/uaccess.h>
diff --git a/drivers/scsi/t128.c b/drivers/scsi/t128.c
index 2df6747cb76f..0b7a70f61e0d 100644
--- a/drivers/scsi/t128.c
+++ b/drivers/scsi/t128.c
@@ -109,7 +109,7 @@
 #include <asm/system.h>
 #include <linux/signal.h>
 #include <linux/sched.h>
-#include <asm/io.h>
+#include <linux/io.h>
 #include <linux/blkdev.h>
 #include <linux/interrupt.h>
 #include <linux/stat.h>
diff --git a/drivers/scsi/wd7000.c b/drivers/scsi/wd7000.c
index 331e1cf159b0..30be76514c43 100644
--- a/drivers/scsi/wd7000.c
+++ b/drivers/scsi/wd7000.c
@@ -178,10 +178,10 @@
 #include <linux/blkdev.h>
 #include <linux/init.h>
 #include <linux/stat.h>
+#include <linux/io.h>
 #include <asm/system.h>
 #include <asm/dma.h>
-#include <asm/io.h>
 #include <scsi/scsi.h>
 #include <scsi/scsi_cmnd.h>
diff --git a/drivers/serial/ioc4_serial.c b/drivers/serial/ioc4_serial.c
index 98ce88d80207..ff4fa25f9fd1 100644
--- a/drivers/serial/ioc4_serial.c
+++ b/drivers/serial/ioc4_serial.c
@@ -2935,7 +2935,7 @@ static void __devexit ioc4_serial_exit(void)
        uart_unregister_driver(&ioc4_uart_rs422);
 }
-module_init(ioc4_serial_init);
+late_initcall(ioc4_serial_init); /* Call only after tty init is done */
 module_exit(ioc4_serial_exit);
 MODULE_AUTHOR("Pat Gefre - Silicon Graphics Inc. (SGI) <pfg@sgi.com>");
diff --git a/drivers/serial/sh-sci.c b/drivers/serial/sh-sci.c
index 266aa325569e..cfcc3caf49d8 100644
--- a/drivers/serial/sh-sci.c
+++ b/drivers/serial/sh-sci.c
@@ -808,7 +808,7 @@ static int sci_request_irq(struct sci_port *port)
                }
                if (request_irq(port->irqs[0], sci_mpxed_interrupt,
-                                SA_INTERRUPT, "sci", port)) {
+                                IRQF_DISABLED, "sci", port)) {
                        printk(KERN_ERR "sci: Cannot allocate irq.\n");
                        return -ENODEV;
                }
@@ -817,7 +817,7 @@ static int sci_request_irq(struct sci_port *port)
                        if (!port->irqs[i])
                                continue;
                        if (request_irq(port->irqs[i], handlers[i],
-                                        SA_INTERRUPT, desc[i], port)) {
+                                        IRQF_DISABLED, desc[i], port)) {
                                printk(KERN_ERR "sci: Cannot allocate irq.\n");
                                return -ENODEV;
                        }
diff --git a/drivers/serial/sunzilog.c b/drivers/serial/sunzilog.c
index 73dd2eedaaad..b2cc703b2b9e 100644
--- a/drivers/serial/sunzilog.c
+++ b/drivers/serial/sunzilog.c
@@ -1182,7 +1182,7 @@ static int __init sunzilog_console_setup(struct console *con, char *options)
        return 0;
 }
-static struct console sunzilog_console = {
+static struct console sunzilog_console_ops = {
        .name   =       "ttyS",
        .write  =       sunzilog_console_write,
        .device =       uart_console_device,
@@ -1208,10 +1208,10 @@ static inline struct console *SUNZILOG_CONSOLE(void)
        if (i == NUM_CHANNELS)
                return NULL;
-        sunzilog_console.index = i;
+        sunzilog_console_ops.index = i;
        sunzilog_port_table[i].flags |= SUNZILOG_FLAG_IS_CONS;
-        return &sunzilog_console;
+        return &sunzilog_console_ops;
 }
 #else
diff --git a/drivers/sn/Kconfig b/drivers/sn/Kconfig
index a34731625877..c66ba9ad833d 100644
--- a/drivers/sn/Kconfig
+++ b/drivers/sn/Kconfig
@@ -5,19 +5,6 @@
 menu "SN Devices"
        depends on SGI_SN
-config SGI_IOC4
-        tristate "SGI IOC4 Base IO support"
-        depends on MMTIMER
-        default m
-        ---help---
-        This option enables basic support for the SGI IOC4-based Base IO
-        controller card.  This option does not enable any specific
-        functions on such a card, but provides necessary infrastructure
-        for other drivers to utilize.
-        If you have an SGI Altix with an IOC4-based
-        I/O controller say Y.  Otherwise say N.
 config SGI_IOC3
        tristate "SGI IOC3 Base IO support"
        default m
diff --git a/drivers/sn/Makefile b/drivers/sn/Makefile
index 2cda011597c0..693db8bb8d9c 100644
--- a/drivers/sn/Makefile
+++ b/drivers/sn/Makefile
@@ -3,5 +3,4 @@
 #
 #
-obj-$(CONFIG_SGI_IOC4) += ioc4.o
 obj-$(CONFIG_SGI_IOC3) += ioc3.o
diff --git a/drivers/video/Kconfig b/drivers/video/Kconfig
index daaa486159cf..7a43020fa583 100644
--- a/drivers/video/Kconfig
+++ b/drivers/video/Kconfig
@@ -701,7 +701,6 @@ config FB_NVIDIA
        depends on FB && PCI
        select I2C_ALGOBIT if FB_NVIDIA_I2C
        select I2C if FB_NVIDIA_I2C
-        select FB_DDC if FB_NVIDIA_I2C
        select FB_MODE_HELPERS
        select FB_CFB_FILLRECT
        select FB_CFB_COPYAREA
diff --git a/drivers/video/nvidia/nv_i2c.c b/drivers/video/nvidia/nv_i2c.c
index e48de3c9fd13..19eef3a09023 100644
--- a/drivers/video/nvidia/nv_i2c.c
+++ b/drivers/video/nvidia/nv_i2c.c
@@ -160,12 +160,51 @@ void nvidia_delete_i2c_busses(struct nvidia_par *par)
 }
+static u8 *nvidia_do_probe_i2c_edid(struct nvidia_i2c_chan *chan)
+{
+        u8 start = 0x0;
+        struct i2c_msg msgs[] = {
+                {
+                 .addr = 0x50,
+                 .len = 1,
+                 .buf = &start,
+                 }, {
+                     .addr = 0x50,
+                     .flags = I2C_M_RD,
+                     .len = EDID_LENGTH,
+                     },
+        };
+        u8 *buf;
+        if (!chan->par)
+                return NULL;
+        buf = kmalloc(EDID_LENGTH, GFP_KERNEL);
+        if (!buf) {
+                dev_warn(&chan->par->pci_dev->dev, "Out of memory!\n");
+                return NULL;
+        }
+        msgs[1].buf = buf;
+        if (i2c_transfer(&chan->adapter, msgs, 2) == 2)
+                return buf;
+        dev_dbg(&chan->par->pci_dev->dev, "Unable to read EDID block.\n");
+        kfree(buf);
+        return NULL;
+}
 int nvidia_probe_i2c_connector(struct fb_info *info, int conn, u8 **out_edid)
 {
        struct nvidia_par *par = info->par;
-        u8 *edid;
+        u8 *edid = NULL;
+        int i;
-        edid = fb_ddc_read(&par->chan[conn - 1].adapter);
+        for (i = 0; i < 3; i++) {
+                /* Do the real work */
+                edid = nvidia_do_probe_i2c_edid(&par->chan[conn - 1]);
+                if (edid)
+                        break;
+        }
        if (!edid && conn == 1) {
                /* try to get from firmware */
diff --git a/drivers/w1/Kconfig b/drivers/w1/Kconfig
index 27c9d05d03ef..c287a9ae4fdd 100644
--- a/drivers/w1/Kconfig
+++ b/drivers/w1/Kconfig
@@ -2,7 +2,6 @@ menu "Dallas's 1-wire bus"
 config W1
        tristate "Dallas's 1-wire support"
-        depends on CONNECTOR
        ---help---
          Dallas' 1-wire bus is useful to connect slow 1-pin devices
          such as iButtons and thermal sensors.