49 files changed, 2063 insertions, 356 deletions
diff --git a/drivers/char/Kconfig b/drivers/char/Kconfig
index 402296670d3a..78d928f9d9f1 100644
--- a/drivers/char/Kconfig
+++ b/drivers/char/Kconfig
@@ -291,7 +291,7 @@ config SX
 config RIO
        tristate "Specialix RIO system support"
-        depends on SERIAL_NONSTANDARD && !64BIT
+        depends on SERIAL_NONSTANDARD
        help
          This is a driver for the Specialix RIO, a smart serial card which
          drives an outboard box that can support up to 128 ports.  Product
diff --git a/drivers/char/rio/host.h b/drivers/char/rio/host.h
index 3ec73d1a279a..179cdbea712b 100644
--- a/drivers/char/rio/host.h
+++ b/drivers/char/rio/host.h
@@ -33,12 +33,6 @@
 #ifndef __rio_host_h__
 #define __rio_host_h__
-#ifdef SCCS_LABELS
-#ifndef lint
-static char *_host_h_sccs_ = "@(#)host.h        1.2";
-#endif
-#endif
 /*
 ** the host structure - one per host card in the system.
 */
@@ -77,9 +71,6 @@ struct Host {
 #define RC_STARTUP            1
 #define RC_RUNNING            2
 #define RC_STUFFED            3
-#define RC_SOMETHING          4
-#define RC_SOMETHING_NEW      5
-#define RC_SOMETHING_ELSE     6
 #define RC_READY              7
 #define RUN_STATE             7
 /*
diff --git a/drivers/char/rio/rioboot.c b/drivers/char/rio/rioboot.c
index acda9326c2ef..290143addd34 100644
--- a/drivers/char/rio/rioboot.c
+++ b/drivers/char/rio/rioboot.c
@@ -34,6 +34,7 @@
 #include <linux/slab.h>
 #include <linux/termios.h>
 #include <linux/serial.h>
+#include <linux/vmalloc.h>
 #include <asm/semaphore.h>
 #include <linux/generic_serial.h>
 #include <linux/errno.h>
diff --git a/drivers/char/rio/rioctrl.c b/drivers/char/rio/rioctrl.c
index d31aba62bb7f..75b2557c37ec 100644
--- a/drivers/char/rio/rioctrl.c
+++ b/drivers/char/rio/rioctrl.c
@@ -1394,14 +1394,17 @@ int RIOPreemptiveCmd(struct rio_info *p, struct Port *PortP, u8 Cmd)
                return RIO_FAIL;
        }
-        if (((int) ((char) PortP->InUse) == -1) || !(CmdBlkP = RIOGetCmdBlk())) {
+        if ((PortP->InUse == (typeof(PortP->InUse))-1) ||
-                rio_dprintk(RIO_DEBUG_CTRL, "Cannot allocate command block for command %d on port %d\n", Cmd, PortP->PortNum);
+                        !(CmdBlkP = RIOGetCmdBlk())) {
+                rio_dprintk(RIO_DEBUG_CTRL, "Cannot allocate command block "
+                        "for command %d on port %d\n", Cmd, PortP->PortNum);
                return RIO_FAIL;
        }
-        rio_dprintk(RIO_DEBUG_CTRL, "Command blk %p - InUse now %d\n", CmdBlkP, PortP->InUse);
+        rio_dprintk(RIO_DEBUG_CTRL, "Command blk %p - InUse now %d\n",
+                        CmdBlkP, PortP->InUse);
-        PktCmdP = (struct PktCmd_M *) &CmdBlkP->Packet.data[0];
+        PktCmdP = (struct PktCmd_M *)&CmdBlkP->Packet.data[0];
        CmdBlkP->Packet.src_unit = 0;
        if (PortP->SecondBlock)
@@ -1425,38 +1428,46 @@ int RIOPreemptiveCmd(struct rio_info *p, struct Port *PortP, u8 Cmd)
        switch (Cmd) {
        case MEMDUMP:
-                rio_dprintk(RIO_DEBUG_CTRL, "Queue MEMDUMP command blk %p (addr 0x%x)\n", CmdBlkP, (int) SubCmd.Addr);
+                rio_dprintk(RIO_DEBUG_CTRL, "Queue MEMDUMP command blk %p "
+                                "(addr 0x%x)\n", CmdBlkP, (int) SubCmd.Addr);
                PktCmdP->SubCommand = MEMDUMP;
                PktCmdP->SubAddr = SubCmd.Addr;
                break;
        case FCLOSE:
-                rio_dprintk(RIO_DEBUG_CTRL, "Queue FCLOSE command blk %p\n", CmdBlkP);
+                rio_dprintk(RIO_DEBUG_CTRL, "Queue FCLOSE command blk %p\n",
+                                CmdBlkP);
                break;
        case READ_REGISTER:
-                rio_dprintk(RIO_DEBUG_CTRL, "Queue READ_REGISTER (0x%x) command blk %p\n", (int) SubCmd.Addr, CmdBlkP);
+                rio_dprintk(RIO_DEBUG_CTRL, "Queue READ_REGISTER (0x%x) "
+                                "command blk %p\n", (int) SubCmd.Addr, CmdBlkP);
                PktCmdP->SubCommand = READ_REGISTER;
                PktCmdP->SubAddr = SubCmd.Addr;
                break;
        case RESUME:
-                rio_dprintk(RIO_DEBUG_CTRL, "Queue RESUME command blk %p\n", CmdBlkP);
+                rio_dprintk(RIO_DEBUG_CTRL, "Queue RESUME command blk %p\n",
+                                CmdBlkP);
                break;
        case RFLUSH:
-                rio_dprintk(RIO_DEBUG_CTRL, "Queue RFLUSH command blk %p\n", CmdBlkP);
+                rio_dprintk(RIO_DEBUG_CTRL, "Queue RFLUSH command blk %p\n",
+                                CmdBlkP);
                CmdBlkP->PostFuncP = RIORFlushEnable;
                break;
        case SUSPEND:
-                rio_dprintk(RIO_DEBUG_CTRL, "Queue SUSPEND command blk %p\n", CmdBlkP);
+                rio_dprintk(RIO_DEBUG_CTRL, "Queue SUSPEND command blk %p\n",
+                                CmdBlkP);
                break;
        case MGET:
-                rio_dprintk(RIO_DEBUG_CTRL, "Queue MGET command blk %p\n", CmdBlkP);
+                rio_dprintk(RIO_DEBUG_CTRL, "Queue MGET command blk %p\n",
+                                CmdBlkP);
                break;
        case MSET:
        case MBIC:
        case MBIS:
                CmdBlkP->Packet.data[4] = (char) PortP->ModemLines;
-                rio_dprintk(RIO_DEBUG_CTRL, "Queue MSET/MBIC/MBIS command blk %p\n", CmdBlkP);
+                rio_dprintk(RIO_DEBUG_CTRL, "Queue MSET/MBIC/MBIS command "
+                                "blk %p\n", CmdBlkP);
                break;
        case WFLUSH:
@@ -1465,12 +1476,14 @@ int RIOPreemptiveCmd(struct rio_info *p, struct Port *PortP, u8 Cmd)
                 ** allowed then we should not bother sending any more to the
                 ** RTA.
                 */
-                if ((int) ((char) PortP->WflushFlag) == (int) -1) {
+                if (PortP->WflushFlag == (typeof(PortP->WflushFlag))-1) {
-                        rio_dprintk(RIO_DEBUG_CTRL, "Trashed WFLUSH, WflushFlag about to wrap!");
+                        rio_dprintk(RIO_DEBUG_CTRL, "Trashed WFLUSH, "
+                                        "WflushFlag about to wrap!");
                        RIOFreeCmdBlk(CmdBlkP);
                        return (RIO_FAIL);
                } else {
-                        rio_dprintk(RIO_DEBUG_CTRL, "Queue WFLUSH command blk %p\n", CmdBlkP);
+                        rio_dprintk(RIO_DEBUG_CTRL, "Queue WFLUSH command "
+                                        "blk %p\n", CmdBlkP);
                        CmdBlkP->PostFuncP = RIOWFlushMark;
                }
                break;
diff --git a/drivers/char/rio/rioioctl.h b/drivers/char/rio/rioioctl.h
index 14b83fae75c8..e8af5b30519e 100644
--- a/drivers/char/rio/rioioctl.h
+++ b/drivers/char/rio/rioioctl.h
@@ -33,10 +33,6 @@
 #ifndef __rioioctl_h__
 #define __rioioctl_h__
-#ifdef SCCS_LABELS
-static char *_rioioctl_h_sccs_ = "@(#)rioioctl.h        1.2";
-#endif
 /*
 ** RIO device driver - user ioctls and associated structures.
 */
@@ -44,55 +40,13 @@ static char *_rioioctl_h_sccs_ = "@(#)rioioctl.h	1.2";
 struct portStats {
        int port;
        int gather;
-        ulong txchars;
+        unsigned long txchars;
-        ulong rxchars;
+        unsigned long rxchars;
-        ulong opens;
+        unsigned long opens;
-        ulong closes;
+        unsigned long closes;
-        ulong ioctls;
+        unsigned long ioctls;
 };
-#define rIOC    ('r'<<8)
-#define TCRIOSTATE      (rIOC | 1)
-#define TCRIOXPON       (rIOC | 2)
-#define TCRIOXPOFF      (rIOC | 3)
-#define TCRIOXPCPS      (rIOC | 4)
-#define TCRIOXPRINT     (rIOC | 5)
-#define TCRIOIXANYON    (rIOC | 6)
-#define TCRIOIXANYOFF   (rIOC | 7)
-#define TCRIOIXONON     (rIOC | 8)
-#define TCRIOIXONOFF    (rIOC | 9)
-#define TCRIOMBIS       (rIOC | 10)
-#define TCRIOMBIC       (rIOC | 11)
-#define TCRIOTRIAD      (rIOC | 12)
-#define TCRIOTSTATE     (rIOC | 13)
-/*
-** 15.10.1998 ARG - ESIL 0761 part fix
-** Add RIO ioctls for manipulating RTS and CTS flow control, (as LynxOS
-** appears to not support hardware flow control).
-*/
-#define TCRIOCTSFLOWEN  (rIOC | 14)     /* enable CTS flow control */
-#define TCRIOCTSFLOWDIS (rIOC | 15)     /* disable CTS flow control */
-#define TCRIORTSFLOWEN  (rIOC | 16)     /* enable RTS flow control */
-#define TCRIORTSFLOWDIS (rIOC | 17)     /* disable RTS flow control */
-/*
-** 09.12.1998 ARG - ESIL 0776 part fix
-** Definition for 'RIOC' also appears in daemon.h, so we'd better do a
-** #ifndef here first.
-** 'RIO_QUICK_CHECK' also #define'd here as this ioctl is now
-** allowed to be used by customers.
-**
-** 05.02.1999 ARG -
-** This is what I've decied to do with ioctls etc., which are intended to be
-** invoked from users applications :
-** Anything that needs to be defined here will be removed from daemon.h, that
-** way it won't end up having to be defined/maintained in two places. The only
-** consequence of this is that this file should now be #include'd by daemon.h
-**
-** 'stats' ioctls now #define'd here as they are to be used by customers.
-*/
 #define RIOC    ('R'<<8)|('i'<<16)|('o'<<24)
 #define RIO_QUICK_CHECK         (RIOC | 105)
diff --git a/drivers/char/tpm/Kconfig b/drivers/char/tpm/Kconfig
index 1efde3b27619..fe00c7dfb649 100644
--- a/drivers/char/tpm/Kconfig
+++ b/drivers/char/tpm/Kconfig
@@ -22,7 +22,7 @@ config TCG_TPM
 config TCG_TIS
        tristate "TPM Interface Specification 1.2 Interface"
-        depends on TCG_TPM
+        depends on TCG_TPM && PNPACPI
        ---help---
          If you have a TPM security chip that is compliant with the
          TCG TIS 1.2 TPM specification say Yes and it will be accessible
diff --git a/drivers/char/tpm/tpm.h b/drivers/char/tpm/tpm.h
index 54a4c804e25f..050ced247f68 100644
--- a/drivers/char/tpm/tpm.h
+++ b/drivers/char/tpm/tpm.h
@@ -140,7 +140,7 @@ extern int tpm_pm_resume(struct device *);
 extern struct dentry ** tpm_bios_log_setup(char *);
 extern void tpm_bios_log_teardown(struct dentry **);
 #else
-static inline struct dentry* tpm_bios_log_setup(char *name)
+static inline struct dentry ** tpm_bios_log_setup(char *name)
 {
        return NULL;
 }
diff --git a/drivers/char/tpm/tpm_tis.c b/drivers/char/tpm/tpm_tis.c
index b9cae9a238bb..f621168f38ae 100644
--- a/drivers/char/tpm/tpm_tis.c
+++ b/drivers/char/tpm/tpm_tis.c
@@ -55,7 +55,7 @@ enum tis_int_flags {
 };
 enum tis_defaults {
-        TIS_MEM_BASE = 0xFED4000,
+        TIS_MEM_BASE = 0xFED40000,
        TIS_MEM_LEN = 0x5000,
        TIS_SHORT_TIMEOUT = 750,        /* ms */
        TIS_LONG_TIMEOUT = 2000,        /* 2 sec */
diff --git a/drivers/char/watchdog/i8xx_tco.c b/drivers/char/watchdog/i8xx_tco.c
index a13395e2c372..fa2ba9ebe42a 100644
--- a/drivers/char/watchdog/i8xx_tco.c
+++ b/drivers/char/watchdog/i8xx_tco.c
@@ -33,11 +33,6 @@
 *      82801E   (C-ICH)  : document number 273599-001, 273645-002,
 *      82801EB  (ICH5)   : document number 252516-001, 252517-003,
 *      82801ER  (ICH5R)  : document number 252516-001, 252517-003,
- *      82801FB  (ICH6)   : document number 301473-002, 301474-007,
- *      82801FR  (ICH6R)  : document number 301473-002, 301474-007,
- *      82801FBM (ICH6-M) : document number 301473-002, 301474-007,
- *      82801FW  (ICH6W)  : document number 301473-001, 301474-007,
- *      82801FRW (ICH6RW) : document number 301473-001, 301474-007
 *
 *  20000710 Nils Faerber
 *      Initial Version 0.01
@@ -66,6 +61,10 @@
 *  20050807 Wim Van Sebroeck <wim@iguana.be>
 *      0.08 Make sure that the watchdog is only "armed" when started.
 *           (Kernel Bug 4251)
+ *  20060416 Wim Van Sebroeck <wim@iguana.be>
+ *      0.09 Remove support for the ICH6, ICH6R, ICH6-M, ICH6W and ICH6RW and
+ *           ICH7 chipsets. (See Kernel Bug 6031 - other code will support these
+ *           chipsets)
 */
 /*
@@ -90,7 +89,7 @@
 #include "i8xx_tco.h"
 /* Module and version information */
-#define TCO_VERSION "0.08"
+#define TCO_VERSION "0.09"
 #define TCO_MODULE_NAME "i8xx TCO timer"
 #define TCO_DRIVER_NAME   TCO_MODULE_NAME ", v" TCO_VERSION
 #define PFX TCO_MODULE_NAME ": "
@@ -391,11 +390,6 @@ static struct pci_device_id i8xx_tco_pci_tbl[] = {
        { PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_82801DB_12,  PCI_ANY_ID, PCI_ANY_ID, },
        { PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_82801E_0,    PCI_ANY_ID, PCI_ANY_ID, },
        { PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_82801EB_0,   PCI_ANY_ID, PCI_ANY_ID, },
-        { PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_ICH6_0,      PCI_ANY_ID, PCI_ANY_ID, },
-        { PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_ICH6_1,      PCI_ANY_ID, PCI_ANY_ID, },
-        { PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_ICH6_2,      PCI_ANY_ID, PCI_ANY_ID, },
-        { PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_ICH7_0,      PCI_ANY_ID, PCI_ANY_ID, },
-        { PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_ICH7_1,      PCI_ANY_ID, PCI_ANY_ID, },
        { PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_ESB_1,       PCI_ANY_ID, PCI_ANY_ID, },
        { 0, },                 /* End of list */
 };
diff --git a/drivers/char/watchdog/s3c2410_wdt.c b/drivers/char/watchdog/s3c2410_wdt.c
index 9dc54736e4eb..1ea04e9b2b0b 100644
--- a/drivers/char/watchdog/s3c2410_wdt.c
+++ b/drivers/char/watchdog/s3c2410_wdt.c
@@ -423,6 +423,12 @@ static int s3c2410wdt_probe(struct platform_device *pdev)
        if (tmr_atboot && started == 0) {
                printk(KERN_INFO PFX "Starting Watchdog Timer\n");
                s3c2410wdt_start();
+        } else if (!tmr_atboot) {
+                /* if we're not enabling the watchdog, then ensure it is
+                 * disabled if it has been left running from the bootloader
+                 * or other source */
+                s3c2410wdt_stop();
        }
        return 0;
diff --git a/drivers/char/watchdog/sc1200wdt.c b/drivers/char/watchdog/sc1200wdt.c
index 515ce7572049..20b88f9b7be2 100644
--- a/drivers/char/watchdog/sc1200wdt.c
+++ b/drivers/char/watchdog/sc1200wdt.c
@@ -377,7 +377,7 @@ static int __init sc1200wdt_init(void)
 {
        int ret;
-        printk(banner);
+        printk("%s\n", banner);
        spin_lock_init(&sc1200wdt_lock);
        sema_init(&open_sem, 1);
diff --git a/drivers/ide/legacy/ide-cs.c b/drivers/ide/legacy/ide-cs.c
index 4961f1e764a7..602797a44208 100644
--- a/drivers/ide/legacy/ide-cs.c
+++ b/drivers/ide/legacy/ide-cs.c
@@ -392,6 +392,7 @@ static struct pcmcia_device_id ide_ids[] = {
        PCMCIA_DEVICE_PROD_ID12("FREECOM", "PCCARD-IDE", 0x5714cbf7, 0x48e0ab8e),
        PCMCIA_DEVICE_PROD_ID12("HITACHI", "FLASH", 0xf4f43949, 0x9eb86aae),
        PCMCIA_DEVICE_PROD_ID12("HITACHI", "microdrive", 0xf4f43949, 0xa6d76178),
+        PCMCIA_DEVICE_PROD_ID12("IBM", "microdrive", 0xb569a6e5, 0xa6d76178),
        PCMCIA_DEVICE_PROD_ID12("IBM", "IBM17JSSFP20", 0xb569a6e5, 0xf2508753),
        PCMCIA_DEVICE_PROD_ID12("IO DATA", "CBIDE2      ", 0x547e66dc, 0x8671043b),
        PCMCIA_DEVICE_PROD_ID12("IO DATA", "PCIDE", 0x547e66dc, 0x5c5ab149),
diff --git a/drivers/ieee1394/ohci1394.c b/drivers/ieee1394/ohci1394.c
index 19222878aae9..11f13778f139 100644
--- a/drivers/ieee1394/ohci1394.c
+++ b/drivers/ieee1394/ohci1394.c
@@ -553,7 +553,7 @@ static void ohci_initialize(struct ti_ohci *ohci)
         * register content.
         * To actually enable physical responses is the job of our interrupt
         * handler which programs the physical request filter. */
-        reg_write(ohci, OHCI1394_PhyUpperBound, 0xffff0000);
+        reg_write(ohci, OHCI1394_PhyUpperBound, 0x01000000);
        DBGMSG("physUpperBoundOffset=%08x",
               reg_read(ohci, OHCI1394_PhyUpperBound));
diff --git a/drivers/ieee1394/sbp2.c b/drivers/ieee1394/sbp2.c
index f4206604db03..8a23fb54c693 100644
--- a/drivers/ieee1394/sbp2.c
+++ b/drivers/ieee1394/sbp2.c
@@ -42,6 +42,7 @@
 #include <linux/kernel.h>
 #include <linux/list.h>
 #include <linux/string.h>
+#include <linux/stringify.h>
 #include <linux/slab.h>
 #include <linux/interrupt.h>
 #include <linux/fs.h>
@@ -117,7 +118,8 @@ MODULE_PARM_DESC(serialize_io, "Serialize I/O coming from scsi drivers (default
 */
 static int max_sectors = SBP2_MAX_SECTORS;
 module_param(max_sectors, int, 0444);
-MODULE_PARM_DESC(max_sectors, "Change max sectors per I/O supported (default = 255)");
+MODULE_PARM_DESC(max_sectors, "Change max sectors per I/O supported (default = "
+                 __stringify(SBP2_MAX_SECTORS) ")");
 /*
 * Exclusive login to sbp2 device? In most cases, the sbp2 driver should
@@ -135,18 +137,45 @@ module_param(exclusive_login, int, 0644);
 MODULE_PARM_DESC(exclusive_login, "Exclusive login to sbp2 device (default = 1)");
 /*
- * SCSI inquiry hack for really badly behaved sbp2 devices. Turn this on
+ * If any of the following workarounds is required for your device to work,
- * if your sbp2 device is not properly handling the SCSI inquiry command.
+ * please submit the kernel messages logged by sbp2 to the linux1394-devel
- * This hack makes the inquiry look more like a typical MS Windows inquiry
+ * mailing list.
- * by enforcing 36 byte inquiry and avoiding access to mode_sense page 8.
 *
- * If force_inquiry_hack=1 is required for your device to work,
+ * - 128kB max transfer
- * please submit the logged sbp2_firmware_revision value of this device to
+ *   Limit transfer size. Necessary for some old bridges.
- * the linux1394-devel mailing list.
+ *
+ * - 36 byte inquiry
+ *   When scsi_mod probes the device, let the inquiry command look like that
+ *   from MS Windows.
+ *
+ * - skip mode page 8
+ *   Suppress sending of mode_sense for mode page 8 if the device pretends to
+ *   support the SCSI Primary Block commands instead of Reduced Block Commands.
+ *
+ * - fix capacity
+ *   Tell sd_mod to correct the last sector number reported by read_capacity.
+ *   Avoids access beyond actual disk limits on devices with an off-by-one bug.
+ *   Don't use this with devices which don't have this bug.
+ *
+ * - override internal blacklist
+ *   Instead of adding to the built-in blacklist, use only the workarounds
+ *   specified in the module load parameter.
+ *   Useful if a blacklist entry interfered with a non-broken device.
 */
+static int sbp2_default_workarounds;
+module_param_named(workarounds, sbp2_default_workarounds, int, 0644);
+MODULE_PARM_DESC(workarounds, "Work around device bugs (default = 0"
+        ", 128kB max transfer = " __stringify(SBP2_WORKAROUND_128K_MAX_TRANS)
+        ", 36 byte inquiry = "    __stringify(SBP2_WORKAROUND_INQUIRY_36)
+        ", skip mode page 8 = "   __stringify(SBP2_WORKAROUND_MODE_SENSE_8)
+        ", fix capacity = "       __stringify(SBP2_WORKAROUND_FIX_CAPACITY)
+        ", override internal blacklist = " __stringify(SBP2_WORKAROUND_OVERRIDE)
+        ", or a combination)");
+/* legacy parameter */
 static int force_inquiry_hack;
 module_param(force_inquiry_hack, int, 0644);
-MODULE_PARM_DESC(force_inquiry_hack, "Force SCSI inquiry hack (default = 0)");
+MODULE_PARM_DESC(force_inquiry_hack, "Deprecated, use 'workarounds'");
 /*
 * Export information about protocols/devices supported by this driver.
@@ -266,14 +295,55 @@ static struct hpsb_protocol_driver sbp2_driver = {
 };
 /*
- * List of device firmwares that require the inquiry hack.
+ * List of devices with known bugs.
- * Yields a few false positives but did not break other devices so far.
+ *
+ * The firmware_revision field, masked with 0xffff00, is the best indicator
+ * for the type of bridge chip of a device.  It yields a few false positives
+ * but this did not break correctly behaving devices so far.
 */
-static u32 sbp2_broken_inquiry_list[] = {
+static const struct {
-        0x00002800,     /* Stefan Richter <stefanr@s5r6.in-berlin.de> */
+        u32 firmware_revision;
-                        /* DViCO Momobay CX-1 */
+        u32 model_id;
-        0x00000200      /* Andreas Plesch <plesch@fas.harvard.edu> */
+        unsigned workarounds;
-                        /* QPS Fire DVDBurner */
+} sbp2_workarounds_table[] = {
+        /* TSB42AA9 */ {
+                .firmware_revision      = 0x002800,
+                .workarounds            = SBP2_WORKAROUND_INQUIRY_36 |
+                                          SBP2_WORKAROUND_MODE_SENSE_8,
+        },
+        /* Initio bridges, actually only needed for some older ones */ {
+                .firmware_revision      = 0x000200,
+                .workarounds            = SBP2_WORKAROUND_INQUIRY_36,
+        },
+        /* Symbios bridge */ {
+                .firmware_revision      = 0xa0b800,
+                .workarounds            = SBP2_WORKAROUND_128K_MAX_TRANS,
+        },
+        /*
+         * Note about the following Apple iPod blacklist entries:
+         *
+         * There are iPods (2nd gen, 3rd gen) with model_id==0.  Since our
+         * matching logic treats 0 as a wildcard, we cannot match this ID
+         * without rewriting the matching routine.  Fortunately these iPods
+         * do not feature the read_capacity bug according to one report.
+         * Read_capacity behaviour as well as model_id could change due to
+         * Apple-supplied firmware updates though.
+         */
+        /* iPod 4th generation */ {
+                .firmware_revision      = 0x0a2700,
+                .model_id               = 0x000021,
+                .workarounds            = SBP2_WORKAROUND_FIX_CAPACITY,
+        },
+        /* iPod mini */ {
+                .firmware_revision      = 0x0a2700,
+                .model_id               = 0x000023,
+                .workarounds            = SBP2_WORKAROUND_FIX_CAPACITY,
+        },
+        /* iPod Photo */ {
+                .firmware_revision      = 0x0a2700,
+                .model_id               = 0x00007e,
+                .workarounds            = SBP2_WORKAROUND_FIX_CAPACITY,
+        }
 };
 /**************************************
@@ -765,11 +835,16 @@ static struct scsi_id_instance_data *sbp2_alloc_device(struct unit_directory *ud
        /* Register the status FIFO address range. We could use the same FIFO
         * for targets at different nodes. However we need different FIFOs per
-         * target in order to support multi-unit devices. */
+         * target in order to support multi-unit devices.
+         * The FIFO is located out of the local host controller's physical range
+         * but, if possible, within the posted write area. Status writes will
+         * then be performed as unified transactions. This slightly reduces
+         * bandwidth usage, and some Prolific based devices seem to require it.
+         */
        scsi_id->status_fifo_addr = hpsb_allocate_and_register_addrspace(
                        &sbp2_highlevel, ud->ne->host, &sbp2_ops,
                        sizeof(struct sbp2_status_block), sizeof(quadlet_t),
-                        ~0ULL, ~0ULL);
+                        0x010000000000ULL, CSR1212_ALL_SPACE_END);
        if (!scsi_id->status_fifo_addr) {
                SBP2_ERR("failed to allocate status FIFO address range");
                goto failed_alloc;
@@ -1450,7 +1525,8 @@ static void sbp2_parse_unit_directory(struct scsi_id_instance_data *scsi_id,
        struct csr1212_dentry *dentry;
        u64 management_agent_addr;
        u32 command_set_spec_id, command_set, unit_characteristics,
-            firmware_revision, workarounds;
+            firmware_revision;
+        unsigned workarounds;
        int i;
        SBP2_DEBUG_ENTER();
@@ -1506,12 +1582,8 @@ static void sbp2_parse_unit_directory(struct scsi_id_instance_data *scsi_id,
                case SBP2_FIRMWARE_REVISION_KEY:
                        /* Firmware revision */
                        firmware_revision = kv->value.immediate;
-                        if (force_inquiry_hack)
+                        SBP2_DEBUG("sbp2_firmware_revision = %x",
-                                SBP2_INFO("sbp2_firmware_revision = %x",
+                                   (unsigned int)firmware_revision);
-                                          (unsigned int)firmware_revision);
-                        else
-                                SBP2_DEBUG("sbp2_firmware_revision = %x",
-                                           (unsigned int)firmware_revision);
                        break;
                default:
@@ -1519,41 +1591,44 @@ static void sbp2_parse_unit_directory(struct scsi_id_instance_data *scsi_id,
                }
        }
-        /* This is the start of our broken device checking. We try to hack
+        workarounds = sbp2_default_workarounds;
-         * around oddities and known defects.  */
+        if (force_inquiry_hack) {
-        workarounds = 0x0;
+                SBP2_WARN("force_inquiry_hack is deprecated. "
+                          "Use parameter 'workarounds' instead.");
+                workarounds |= SBP2_WORKAROUND_INQUIRY_36;
+        }
-        /* If the vendor id is 0xa0b8 (Symbios vendor id), then we have a
+        if (!(workarounds & SBP2_WORKAROUND_OVERRIDE))
-         * bridge with 128KB max transfer size limitation. For sanity, we
+                for (i = 0; i < ARRAY_SIZE(sbp2_workarounds_table); i++) {
-         * only voice this when the current max_sectors setting
+                        if (sbp2_workarounds_table[i].firmware_revision &&
-         * exceeds the 128k limit. By default, that is not the case.
+                            sbp2_workarounds_table[i].firmware_revision !=
-         *
+                            (firmware_revision & 0xffff00))
-         * It would be really nice if we could detect this before the scsi
+                                continue;
-         * host gets initialized. That way we can down-force the
+                        if (sbp2_workarounds_table[i].model_id &&
-         * max_sectors to account for it. That is not currently
+                            sbp2_workarounds_table[i].model_id != ud->model_id)
-         * possible.  */
+                                continue;
-        if ((firmware_revision & 0xffff00) ==
+                        workarounds |= sbp2_workarounds_table[i].workarounds;
-                        SBP2_128KB_BROKEN_FIRMWARE &&
+                        break;
-                        (max_sectors * 512) > (128*1024)) {
-                SBP2_WARN("Node " NODE_BUS_FMT ": Bridge only supports 128KB max transfer size.",
-                                NODE_BUS_ARGS(ud->ne->host, ud->ne->nodeid));
-                SBP2_WARN("WARNING: Current max_sectors setting is larger than 128KB (%d sectors)!",
-                                max_sectors);
-                workarounds |= SBP2_BREAKAGE_128K_MAX_TRANSFER;
-        }
-        /* Check for a blacklisted set of devices that require us to force
-         * a 36 byte host inquiry. This can be overriden as a module param
-         * (to force all hosts).  */
-        for (i = 0; i < ARRAY_SIZE(sbp2_broken_inquiry_list); i++) {
-                if ((firmware_revision & 0xffff00) ==
-                                sbp2_broken_inquiry_list[i]) {
-                        SBP2_WARN("Node " NODE_BUS_FMT ": Using 36byte inquiry workaround",
-                                        NODE_BUS_ARGS(ud->ne->host, ud->ne->nodeid));
-                        workarounds |= SBP2_BREAKAGE_INQUIRY_HACK;
-                        break; /* No need to continue. */
                }
-        }
+        if (workarounds)
+                SBP2_INFO("Workarounds for node " NODE_BUS_FMT ": 0x%x "
+                          "(firmware_revision 0x%06x, vendor_id 0x%06x,"
+                          " model_id 0x%06x)",
+                          NODE_BUS_ARGS(ud->ne->host, ud->ne->nodeid),
+                          workarounds, firmware_revision,
+                          ud->vendor_id ? ud->vendor_id : ud->ne->vendor_id,
+                          ud->model_id);
+        /* We would need one SCSI host template for each target to adjust
+         * max_sectors on the fly, therefore warn only. */
+        if (workarounds & SBP2_WORKAROUND_128K_MAX_TRANS &&
+            (max_sectors * 512) > (128 * 1024))
+                SBP2_WARN("Node " NODE_BUS_FMT ": Bridge only supports 128KB "
+                          "max transfer size. WARNING: Current max_sectors "
+                          "setting is larger than 128KB (%d sectors)",
+                          NODE_BUS_ARGS(ud->ne->host, ud->ne->nodeid),
+                          max_sectors);
        /* If this is a logical unit directory entry, process the parent
         * to get the values. */
@@ -2447,19 +2522,25 @@ static int sbp2scsi_slave_alloc(struct scsi_device *sdev)
        scsi_id->sdev = sdev;
-        if (force_inquiry_hack ||
+        if (scsi_id->workarounds & SBP2_WORKAROUND_INQUIRY_36)
-            scsi_id->workarounds & SBP2_BREAKAGE_INQUIRY_HACK) {
                sdev->inquiry_len = 36;
-                sdev->skip_ms_page_8 = 1;
-        }
        return 0;
 }
 static int sbp2scsi_slave_configure(struct scsi_device *sdev)
 {
+        struct scsi_id_instance_data *scsi_id =
+                (struct scsi_id_instance_data *)sdev->host->hostdata[0];
        blk_queue_dma_alignment(sdev->request_queue, (512 - 1));
        sdev->use_10_for_rw = 1;
        sdev->use_10_for_ms = 1;
+        if (sdev->type == TYPE_DISK &&
+            scsi_id->workarounds & SBP2_WORKAROUND_MODE_SENSE_8)
+                sdev->skip_ms_page_8 = 1;
+        if (scsi_id->workarounds & SBP2_WORKAROUND_FIX_CAPACITY)
+                sdev->fix_capacity = 1;
        return 0;
 }
@@ -2603,7 +2684,9 @@ static int sbp2_module_init(void)
                scsi_driver_template.cmd_per_lun = 1;
        }
-        /* Set max sectors (module load option). Default is 255 sectors. */
+        if (sbp2_default_workarounds & SBP2_WORKAROUND_128K_MAX_TRANS &&
+            (max_sectors * 512) > (128 * 1024))
+                max_sectors = 128 * 1024 / 512;
        scsi_driver_template.max_sectors = max_sectors;
        /* Register our high level driver with 1394 stack */
diff --git a/drivers/ieee1394/sbp2.h b/drivers/ieee1394/sbp2.h
index e2d357a9ea3a..f4ccc9d0fba4 100644
--- a/drivers/ieee1394/sbp2.h
+++ b/drivers/ieee1394/sbp2.h
@@ -227,11 +227,6 @@ struct sbp2_status_block {
 #define SBP2_SW_VERSION_ENTRY                                   0x00010483
 /*
- * Other misc defines
- */
-#define SBP2_128KB_BROKEN_FIRMWARE                              0xa0b800
-/*
 * SCSI specific stuff
 */
@@ -239,6 +234,13 @@ struct sbp2_status_block {
 #define SBP2_MAX_SECTORS                255     /* Max sectors supported */
 #define SBP2_MAX_CMDS                   8       /* This should be safe */
+/* Flags for detected oddities and brokeness */
+#define SBP2_WORKAROUND_128K_MAX_TRANS  0x1
+#define SBP2_WORKAROUND_INQUIRY_36      0x2
+#define SBP2_WORKAROUND_MODE_SENSE_8    0x4
+#define SBP2_WORKAROUND_FIX_CAPACITY    0x8
+#define SBP2_WORKAROUND_OVERRIDE        0x100
 /* This is the two dma types we use for cmd_dma below */
 enum cmd_dma_types {
        CMD_DMA_NONE,
@@ -268,10 +270,6 @@ struct sbp2_command_info {
 };
-/* A list of flags for detected oddities and brokeness. */
-#define SBP2_BREAKAGE_128K_MAX_TRANSFER         0x1
-#define SBP2_BREAKAGE_INQUIRY_HACK              0x2
 struct sbp2scsi_host_info;
 /*
@@ -345,7 +343,7 @@ struct scsi_id_instance_data {
        struct Scsi_Host *scsi_host;
        /* Device specific workarounds/brokeness */
-        u32 workarounds;
+        unsigned workarounds;
 };
 /* Sbp2 host data structure (one per IEEE1394 host) */
diff --git a/drivers/infiniband/core/uverbs_mem.c b/drivers/infiniband/core/uverbs_mem.c
index 36a32c315668..efe147dbeb42 100644
--- a/drivers/infiniband/core/uverbs_mem.c
+++ b/drivers/infiniband/core/uverbs_mem.c
@@ -211,8 +211,10 @@ void ib_umem_release_on_close(struct ib_device *dev, struct ib_umem *umem)
         */
        work = kmalloc(sizeof *work, GFP_KERNEL);
-        if (!work)
+        if (!work) {
+                mmput(mm);
                return;
+        }
        INIT_WORK(&work->work, ib_umem_account, work);
        work->mm   = mm;
diff --git a/drivers/infiniband/hw/mthca/mthca_cmd.c b/drivers/infiniband/hw/mthca/mthca_cmd.c
index 1985b5dfa481..798e13e14faf 100644
--- a/drivers/infiniband/hw/mthca/mthca_cmd.c
+++ b/drivers/infiniband/hw/mthca/mthca_cmd.c
@@ -182,7 +182,7 @@ struct mthca_cmd_context {
        u8                status;
 };
-static int fw_cmd_doorbell = 1;
+static int fw_cmd_doorbell = 0;
 module_param(fw_cmd_doorbell, int, 0644);
 MODULE_PARM_DESC(fw_cmd_doorbell, "post FW commands through doorbell page if nonzero "
                 "(and supported by FW)");
diff --git a/drivers/infiniband/hw/mthca/mthca_qp.c b/drivers/infiniband/hw/mthca/mthca_qp.c
index 19765f6f8d58..07c13be07a4a 100644
--- a/drivers/infiniband/hw/mthca/mthca_qp.c
+++ b/drivers/infiniband/hw/mthca/mthca_qp.c
@@ -1727,23 +1727,7 @@ int mthca_tavor_post_receive(struct ib_qp *ibqp, struct ib_recv_wr *wr,
        ind = qp->rq.next_ind;
-        for (nreq = 0; wr; ++nreq, wr = wr->next) {
+        for (nreq = 0; wr; wr = wr->next) {
-                if (unlikely(nreq == MTHCA_TAVOR_MAX_WQES_PER_RECV_DB)) {
-                        nreq = 0;
-                        doorbell[0] = cpu_to_be32((qp->rq.next_ind << qp->rq.wqe_shift) | size0);
-                        doorbell[1] = cpu_to_be32(qp->qpn << 8);
-                        wmb();
-                        mthca_write64(doorbell,
-                                      dev->kar + MTHCA_RECEIVE_DOORBELL,
-                                      MTHCA_GET_DOORBELL_LOCK(&dev->doorbell_lock));
-                        qp->rq.head += MTHCA_TAVOR_MAX_WQES_PER_RECV_DB;
-                        size0 = 0;
-                }
                if (mthca_wq_overflow(&qp->rq, nreq, qp->ibqp.recv_cq)) {
                        mthca_err(dev, "RQ %06x full (%u head, %u tail,"
                                        " %d max, %d nreq)\n", qp->qpn,
@@ -1797,6 +1781,23 @@ int mthca_tavor_post_receive(struct ib_qp *ibqp, struct ib_recv_wr *wr,
                ++ind;
                if (unlikely(ind >= qp->rq.max))
                        ind -= qp->rq.max;
+                ++nreq;
+                if (unlikely(nreq == MTHCA_TAVOR_MAX_WQES_PER_RECV_DB)) {
+                        nreq = 0;
+                        doorbell[0] = cpu_to_be32((qp->rq.next_ind << qp->rq.wqe_shift) | size0);
+                        doorbell[1] = cpu_to_be32(qp->qpn << 8);
+                        wmb();
+                        mthca_write64(doorbell,
+                                      dev->kar + MTHCA_RECEIVE_DOORBELL,
+                                      MTHCA_GET_DOORBELL_LOCK(&dev->doorbell_lock));
+                        qp->rq.head += MTHCA_TAVOR_MAX_WQES_PER_RECV_DB;
+                        size0 = 0;
+                }
        }
 out:
diff --git a/drivers/infiniband/ulp/srp/ib_srp.c b/drivers/infiniband/ulp/srp/ib_srp.c
index c32ce4348e1b..9cbdffa08dc2 100644
--- a/drivers/infiniband/ulp/srp/ib_srp.c
+++ b/drivers/infiniband/ulp/srp/ib_srp.c
@@ -340,7 +340,10 @@ static void srp_disconnect_target(struct srp_target_port *target)
        /* XXX should send SRP_I_LOGOUT request */
        init_completion(&target->done);
-        ib_send_cm_dreq(target->cm_id, NULL, 0);
+        if (ib_send_cm_dreq(target->cm_id, NULL, 0)) {
+                printk(KERN_DEBUG PFX "Sending CM DREQ failed\n");
+                return;
+        }
        wait_for_completion(&target->done);
 }
@@ -351,7 +354,6 @@ static void srp_remove_work(void *target_ptr)
        spin_lock_irq(target->scsi_host->host_lock);
        if (target->state != SRP_TARGET_DEAD) {
                spin_unlock_irq(target->scsi_host->host_lock);
-                scsi_host_put(target->scsi_host);
                return;
        }
        target->state = SRP_TARGET_REMOVED;
@@ -365,8 +367,6 @@ static void srp_remove_work(void *target_ptr)
        ib_destroy_cm_id(target->cm_id);
        srp_free_target_ib(target);
        scsi_host_put(target->scsi_host);
-        /* And another put to really free the target port... */
-        scsi_host_put(target->scsi_host);
 }
 static int srp_connect_target(struct srp_target_port *target)
@@ -1241,7 +1241,7 @@ static int srp_reset_device(struct scsi_cmnd *scmnd)
        list_for_each_entry_safe(req, tmp, &target->req_queue, list)
                if (req->scmnd->device == scmnd->device) {
                        req->scmnd->result = DID_RESET << 16;
-                        scmnd->scsi_done(scmnd);
+                        req->scmnd->scsi_done(req->scmnd);
                        srp_remove_req(target, req);
                }
diff --git a/drivers/isdn/capi/capi.c b/drivers/isdn/capi/capi.c
index 9b493f0becc4..173c899a1fb4 100644
--- a/drivers/isdn/capi/capi.c
+++ b/drivers/isdn/capi/capi.c
@@ -1499,7 +1499,6 @@ static int __init capi_init(void)
                printk(KERN_ERR "capi20: unable to get major %d\n", capi_major);
                return major_ret;
        }
-        capi_major = major_ret;
        capi_class = class_create(THIS_MODULE, "capi");
        if (IS_ERR(capi_class)) {
                unregister_chrdev(capi_major, "capi20");
diff --git a/drivers/isdn/gigaset/usb-gigaset.c b/drivers/isdn/gigaset/usb-gigaset.c
index bfb73fd5077e..d86ab68114b0 100644
--- a/drivers/isdn/gigaset/usb-gigaset.c
+++ b/drivers/isdn/gigaset/usb-gigaset.c
@@ -710,8 +710,8 @@ static int gigaset_probe(struct usb_interface *interface,
        retval = -ENODEV; //FIXME
        /* See if the device offered us matches what we can accept */
-        if ((le16_to_cpu(udev->descriptor.idVendor  != USB_M105_VENDOR_ID)) ||
+        if ((le16_to_cpu(udev->descriptor.idVendor)  != USB_M105_VENDOR_ID) ||
-            (le16_to_cpu(udev->descriptor.idProduct != USB_M105_PRODUCT_ID)))
+            (le16_to_cpu(udev->descriptor.idProduct) != USB_M105_PRODUCT_ID))
                return -ENODEV;
        /* this starts to become ascii art... */
diff --git a/drivers/leds/Kconfig b/drivers/leds/Kconfig
index 3f5b64794542..626506234b76 100644
--- a/drivers/leds/Kconfig
+++ b/drivers/leds/Kconfig
@@ -4,8 +4,11 @@ menu "LED devices"
 config NEW_LEDS
        bool "LED Support"
        help
-          Say Y to enable Linux LED support.  This is not related to standard
+          Say Y to enable Linux LED support.  This allows control of supported
-          keyboard LEDs which are controlled via the input system.
+          LEDs from both userspace and optionally, by kernel events (triggers).
+          This is not related to standard keyboard LEDs which are controlled
+          via the input system.
 config LEDS_CLASS
        tristate "LED Class Support"
diff --git a/drivers/leds/led-class.c b/drivers/leds/led-class.c
index b0b5d05fadd6..c75d0ef1609c 100644
--- a/drivers/leds/led-class.c
+++ b/drivers/leds/led-class.c
@@ -19,6 +19,7 @@
 #include <linux/sysdev.h>
 #include <linux/timer.h>
 #include <linux/err.h>
+#include <linux/ctype.h>
 #include <linux/leds.h>
 #include "leds.h"
@@ -43,9 +44,13 @@ static ssize_t led_brightness_store(struct class_device *dev,
        ssize_t ret = -EINVAL;
        char *after;
        unsigned long state = simple_strtoul(buf, &after, 10);
+        size_t count = after - buf;
-        if (after - buf > 0) {
+        if (*after && isspace(*after))
-                ret = after - buf;
+                count++;
+        if (count == size) {
+                ret = count;
                led_set_brightness(led_cdev, state);
        }
diff --git a/drivers/leds/ledtrig-timer.c b/drivers/leds/ledtrig-timer.c
index f484b5d6dbf8..fbf141ef46ec 100644
--- a/drivers/leds/ledtrig-timer.c
+++ b/drivers/leds/ledtrig-timer.c
@@ -20,6 +20,7 @@
 #include <linux/device.h>
 #include <linux/sysdev.h>
 #include <linux/timer.h>
+#include <linux/ctype.h>
 #include <linux/leds.h>
 #include "leds.h"
@@ -69,11 +70,15 @@ static ssize_t led_delay_on_store(struct class_device *dev, const char *buf,
        int ret = -EINVAL;
        char *after;
        unsigned long state = simple_strtoul(buf, &after, 10);
+        size_t count = after - buf;
-        if (after - buf > 0) {
+        if (*after && isspace(*after))
+                count++;
+        if (count == size) {
                timer_data->delay_on = state;
                mod_timer(&timer_data->timer, jiffies + 1);
-                ret = after - buf;
+                ret = count;
        }
        return ret;
@@ -97,11 +102,15 @@ static ssize_t led_delay_off_store(struct class_device *dev, const char *buf,
        int ret = -EINVAL;
        char *after;
        unsigned long state = simple_strtoul(buf, &after, 10);
+        size_t count = after - buf;
+        if (*after && isspace(*after))
+                count++;
-        if (after - buf > 0) {
+        if (count == size) {
                timer_data->delay_off = state;
                mod_timer(&timer_data->timer, jiffies + 1);
-                ret = after - buf;
+                ret = count;
        }
        return ret;
diff --git a/drivers/mmc/au1xmmc.c b/drivers/mmc/au1xmmc.c
index 914d62b24064..5dc4bee7abeb 100644
--- a/drivers/mmc/au1xmmc.c
+++ b/drivers/mmc/au1xmmc.c
@@ -310,7 +310,7 @@ static void au1xmmc_data_complete(struct au1xmmc_host *host, u32 status)
                }
                else
                        data->bytes_xfered =
-                                (data->blocks * (1 << data->blksz_bits)) -
+                                (data->blocks * data->blksz) -
                                host->pio.len;
        }
@@ -575,7 +575,7 @@ static int
 au1xmmc_prepare_data(struct au1xmmc_host *host, struct mmc_data *data)
 {
-        int datalen = data->blocks * (1 << data->blksz_bits);
+        int datalen = data->blocks * data->blksz;
        if (dma != 0)
                host->flags |= HOST_F_DMA;
@@ -596,7 +596,7 @@ au1xmmc_prepare_data(struct au1xmmc_host *host, struct mmc_data *data)
        if (host->dma.len == 0)
                return MMC_ERR_TIMEOUT;
-        au_writel((1 << data->blksz_bits) - 1, HOST_BLKSIZE(host));
+        au_writel(data->blksz - 1, HOST_BLKSIZE(host));
        if (host->flags & HOST_F_DMA) {
                int i;
diff --git a/drivers/mmc/imxmmc.c b/drivers/mmc/imxmmc.c
index 79358e223f57..a4eb1d0e7a71 100644
--- a/drivers/mmc/imxmmc.c
+++ b/drivers/mmc/imxmmc.c
@@ -218,8 +218,10 @@ static int imxmci_busy_wait_for_status(struct imxmci_host *host,
        if(!loops)
                return 0;
-        dev_info(mmc_dev(host->mmc), "busy wait for %d usec in %s, STATUS = 0x%x (0x%x)\n",
+        /* The busy-wait is expected there for clock <8MHz due to SDHC hardware flaws */
-                loops, where, *pstat, stat_mask);
+        if(!(stat_mask & STATUS_END_CMD_RESP) || (host->mmc->ios.clock>=8000000))
+                dev_info(mmc_dev(host->mmc), "busy wait for %d usec in %s, STATUS = 0x%x (0x%x)\n",
+                        loops, where, *pstat, stat_mask);
        return loops;
 }
@@ -333,6 +335,9 @@ static void imxmci_start_cmd(struct imxmci_host *host, struct mmc_command *cmd,
        WARN_ON(host->cmd != NULL);
        host->cmd = cmd;
+        /* Ensure, that clock are stopped else command programming and start fails */
+        imxmci_stop_clock(host);
        if (cmd->flags & MMC_RSP_BUSY)
                cmdat |= CMD_DAT_CONT_BUSY;
@@ -553,7 +558,7 @@ static int imxmci_cpu_driven_data(struct imxmci_host *host, unsigned int *pstat)
        int trans_done = 0;
        unsigned int stat = *pstat;
-        if(host->actual_bus_width == MMC_BUS_WIDTH_4)
+        if(host->actual_bus_width != MMC_BUS_WIDTH_4)
                burst_len = 16;
        else
                burst_len = 64;
@@ -591,8 +596,7 @@ static int imxmci_cpu_driven_data(struct imxmci_host *host, unsigned int *pstat)
                        stat = MMC_STATUS;
                        /* Flush extra bytes from FIFO */
-                        while(flush_len >= 2){
+                        while(flush_len && !(stat & STATUS_DATA_TRANS_DONE)){
-                                flush_len -= 2;
                                i = MMC_BUFFER_ACCESS;
                                stat = MMC_STATUS;
                                stat &= ~STATUS_CRC_READ_ERR; /* Stupid but required there */
@@ -746,10 +750,6 @@ static void imxmci_tasklet_fnc(unsigned long data)
                        data_dir_mask = STATUS_DATA_TRANS_DONE;
                }
-                imxmci_busy_wait_for_status(host, &stat,
-                                data_dir_mask,
-                                50, "imxmci_tasklet_fnc data");
                if(stat & data_dir_mask) {
                        clear_bit(IMXMCI_PEND_DMA_END_b, &host->pending_events);
                        imxmci_data_done(host, stat);
@@ -865,7 +865,11 @@ static void imxmci_set_ios(struct mmc_host *mmc, struct mmc_ios *ios)
                imxmci_stop_clock(host);
                MMC_CLK_RATE = (prescaler<<3) | clk;
-                imxmci_start_clock(host);
+                /*
+                 * Under my understanding, clock should not be started there, because it would
+                 * initiate SDHC sequencer and send last or random command into card
+                 */
+                /*imxmci_start_clock(host);*/
                dev_dbg(mmc_dev(host->mmc), "MMC_CLK_RATE: 0x%08x\n", MMC_CLK_RATE);
        } else {
diff --git a/drivers/mmc/mmc.c b/drivers/mmc/mmc.c
index 1ca2c8b9c9b5..6201f3086a02 100644
--- a/drivers/mmc/mmc.c
+++ b/drivers/mmc/mmc.c
@@ -951,6 +951,7 @@ static void mmc_read_scrs(struct mmc_host *host)
                data.timeout_ns = card->csd.tacc_ns * 10;
                data.timeout_clks = card->csd.tacc_clks * 10;
                data.blksz_bits = 3;
+                data.blksz = 1 << 3;
                data.blocks = 1;
                data.flags = MMC_DATA_READ;
                data.sg = &sg;
diff --git a/drivers/mmc/mmc_block.c b/drivers/mmc/mmc_block.c
index 06bd1f4cb9b1..e39cc05c64c2 100644
--- a/drivers/mmc/mmc_block.c
+++ b/drivers/mmc/mmc_block.c
@@ -175,6 +175,7 @@ static int mmc_blk_issue_rq(struct mmc_queue *mq, struct request *req)
                brq.data.timeout_ns = card->csd.tacc_ns * 10;
                brq.data.timeout_clks = card->csd.tacc_clks * 10;
                brq.data.blksz_bits = md->block_bits;
+                brq.data.blksz = 1 << md->block_bits;
                brq.data.blocks = req->nr_sectors >> (md->block_bits - 9);
                brq.stop.opcode = MMC_STOP_TRANSMISSION;
                brq.stop.arg = 0;
diff --git a/drivers/mmc/pxamci.c b/drivers/mmc/pxamci.c
index f97b472085cb..b49368fd96b8 100644
--- a/drivers/mmc/pxamci.c
+++ b/drivers/mmc/pxamci.c
@@ -119,7 +119,7 @@ static void pxamci_setup_data(struct pxamci_host *host, struct mmc_data *data)
                nob = 0xffff;
        writel(nob, host->base + MMC_NOB);
-        writel(1 << data->blksz_bits, host->base + MMC_BLKLEN);
+        writel(data->blksz, host->base + MMC_BLKLEN);
        clks = (unsigned long long)data->timeout_ns * CLOCKRATE;
        do_div(clks, 1000000000UL);
@@ -283,7 +283,7 @@ static int pxamci_data_done(struct pxamci_host *host, unsigned int stat)
         * data blocks as being in error.
         */
        if (data->error == MMC_ERR_NONE)
-                data->bytes_xfered = data->blocks << data->blksz_bits;
+                data->bytes_xfered = data->blocks * data->blksz;
        else
                data->bytes_xfered = 0;
diff --git a/drivers/mmc/wbsd.c b/drivers/mmc/wbsd.c
index 39b3d97f891e..8167332d4013 100644
--- a/drivers/mmc/wbsd.c
+++ b/drivers/mmc/wbsd.c
@@ -662,14 +662,14 @@ static void wbsd_prepare_data(struct wbsd_host *host, struct mmc_data *data)
        unsigned long dmaflags;
        DBGF("blksz %04x blks %04x flags %08x\n",
-                1 << data->blksz_bits, data->blocks, data->flags);
+                data->blksz, data->blocks, data->flags);
        DBGF("tsac %d ms nsac %d clk\n",
                data->timeout_ns / 1000000, data->timeout_clks);
        /*
         * Calculate size.
         */
-        host->size = data->blocks << data->blksz_bits;
+        host->size = data->blocks * data->blksz;
        /*
         * Check timeout values for overflow.
@@ -696,12 +696,12 @@ static void wbsd_prepare_data(struct wbsd_host *host, struct mmc_data *data)
         * Two bytes are needed for each data line.
         */
        if (host->bus_width == MMC_BUS_WIDTH_1) {
-                blksize = (1 << data->blksz_bits) + 2;
+                blksize = data->blksz + 2;
                wbsd_write_index(host, WBSD_IDX_PBSMSB, (blksize >> 4) & 0xF0);
                wbsd_write_index(host, WBSD_IDX_PBSLSB, blksize & 0xFF);
        } else if (host->bus_width == MMC_BUS_WIDTH_4) {
-                blksize = (1 << data->blksz_bits) + 2 * 4;
+                blksize = data->blksz + 2 * 4;
                wbsd_write_index(host, WBSD_IDX_PBSMSB,
                        ((blksize >> 4) & 0xF0) | WBSD_DATA_WIDTH);
diff --git a/drivers/net/b44.c b/drivers/net/b44.c
index 3d306681919e..d8233e0b7899 100644
--- a/drivers/net/b44.c
+++ b/drivers/net/b44.c
@@ -650,9 +650,11 @@ static int b44_alloc_rx_skb(struct b44 *bp, int src_idx, u32 dest_idx_unmasked)
        /* Hardware bug work-around, the chip is unable to do PCI DMA
           to/from anything above 1GB :-( */
-        if (mapping + RX_PKT_BUF_SZ > B44_DMA_MASK) {
+        if (dma_mapping_error(mapping) ||
+                mapping + RX_PKT_BUF_SZ > B44_DMA_MASK) {
                /* Sigh... */
-                pci_unmap_single(bp->pdev, mapping, RX_PKT_BUF_SZ,PCI_DMA_FROMDEVICE);
+                if (!dma_mapping_error(mapping))
+                        pci_unmap_single(bp->pdev, mapping, RX_PKT_BUF_SZ,PCI_DMA_FROMDEVICE);
                dev_kfree_skb_any(skb);
                skb = __dev_alloc_skb(RX_PKT_BUF_SZ,GFP_DMA);
                if (skb == NULL)
@@ -660,8 +662,10 @@ static int b44_alloc_rx_skb(struct b44 *bp, int src_idx, u32 dest_idx_unmasked)
                mapping = pci_map_single(bp->pdev, skb->data,
                                         RX_PKT_BUF_SZ,
                                         PCI_DMA_FROMDEVICE);
-                if (mapping + RX_PKT_BUF_SZ > B44_DMA_MASK) {
+                if (dma_mapping_error(mapping) ||
-                        pci_unmap_single(bp->pdev, mapping, RX_PKT_BUF_SZ,PCI_DMA_FROMDEVICE);
+                        mapping + RX_PKT_BUF_SZ > B44_DMA_MASK) {
+                        if (!dma_mapping_error(mapping))
+                                pci_unmap_single(bp->pdev, mapping, RX_PKT_BUF_SZ,PCI_DMA_FROMDEVICE);
                        dev_kfree_skb_any(skb);
                        return -ENOMEM;
                }
@@ -967,9 +971,10 @@ static int b44_start_xmit(struct sk_buff *skb, struct net_device *dev)
        }
        mapping = pci_map_single(bp->pdev, skb->data, len, PCI_DMA_TODEVICE);
-        if (mapping + len > B44_DMA_MASK) {
+        if (dma_mapping_error(mapping) || mapping + len > B44_DMA_MASK) {
                /* Chip can't handle DMA to/from >1GB, use bounce buffer */
-                pci_unmap_single(bp->pdev, mapping, len, PCI_DMA_TODEVICE);
+                if (!dma_mapping_error(mapping))
+                        pci_unmap_single(bp->pdev, mapping, len, PCI_DMA_TODEVICE);
                bounce_skb = __dev_alloc_skb(TX_PKT_BUF_SZ,
                                             GFP_ATOMIC|GFP_DMA);
@@ -978,8 +983,9 @@ static int b44_start_xmit(struct sk_buff *skb, struct net_device *dev)
                mapping = pci_map_single(bp->pdev, bounce_skb->data,
                                         len, PCI_DMA_TODEVICE);
-                if (mapping + len > B44_DMA_MASK) {
+                if (dma_mapping_error(mapping) || mapping + len > B44_DMA_MASK) {
-                        pci_unmap_single(bp->pdev, mapping,
+                        if (!dma_mapping_error(mapping))
+                                pci_unmap_single(bp->pdev, mapping,
                                         len, PCI_DMA_TODEVICE);
                        dev_kfree_skb_any(bounce_skb);
                        goto err_out;
@@ -1203,7 +1209,8 @@ static int b44_alloc_consistent(struct b44 *bp)
                                             DMA_TABLE_BYTES,
                                             DMA_BIDIRECTIONAL);
-                if (rx_ring_dma + size > B44_DMA_MASK) {
+                if (dma_mapping_error(rx_ring_dma) ||
+                        rx_ring_dma + size > B44_DMA_MASK) {
                        kfree(rx_ring);
                        goto out_err;
                }
@@ -1229,7 +1236,8 @@ static int b44_alloc_consistent(struct b44 *bp)
                                             DMA_TABLE_BYTES,
                                             DMA_TO_DEVICE);
-                if (tx_ring_dma + size > B44_DMA_MASK) {
+                if (dma_mapping_error(tx_ring_dma) ||
+                        tx_ring_dma + size > B44_DMA_MASK) {
                        kfree(tx_ring);
                        goto out_err;
                }
diff --git a/drivers/net/dl2k.c b/drivers/net/dl2k.c
index 1ddefd281213..038447fb5c5e 100644
--- a/drivers/net/dl2k.c
+++ b/drivers/net/dl2k.c
@@ -53,6 +53,7 @@
 #define DRV_VERSION     "v1.17b"
 #define DRV_RELDATE     "2006/03/10"
 #include "dl2k.h"
+#include <linux/dma-mapping.h>
 static char version[] __devinitdata =
      KERN_INFO DRV_NAME " " DRV_VERSION " " DRV_RELDATE "\n";  
diff --git a/drivers/net/ixp2000/enp2611.c b/drivers/net/ixp2000/enp2611.c
index 6f7dce8eba51..b67f586d7392 100644
--- a/drivers/net/ixp2000/enp2611.c
+++ b/drivers/net/ixp2000/enp2611.c
@@ -149,6 +149,8 @@ static void enp2611_check_link_status(unsigned long __dummy)
                int status;
                dev = nds[i];
+                if (dev == NULL)
+                        continue;
                status = pm3386_is_link_up(i);
                if (status && !netif_carrier_ok(dev)) {
@@ -191,6 +193,7 @@ static void enp2611_set_port_admin_status(int port, int up)
 static int __init enp2611_init_module(void)
 { 
+        int ports;
        int i;
        if (!machine_is_enp2611())
@@ -199,7 +202,8 @@ static int __init enp2611_init_module(void)
        caleb_reset();
        pm3386_reset();
-        for (i = 0; i < 3; i++) {
+        ports = pm3386_port_count();
+        for (i = 0; i < ports; i++) {
                nds[i] = ixpdev_alloc(i, sizeof(struct enp2611_ixpdev_priv));
                if (nds[i] == NULL) {
                        while (--i >= 0)
@@ -215,9 +219,10 @@ static int __init enp2611_init_module(void)
        ixp2400_msf_init(&enp2611_msf_parameters);
-        if (ixpdev_init(3, nds, enp2611_set_port_admin_status)) {
+        if (ixpdev_init(ports, nds, enp2611_set_port_admin_status)) {
-                for (i = 0; i < 3; i++)
+                for (i = 0; i < ports; i++)
-                        free_netdev(nds[i]);
+                        if (nds[i])
+                                free_netdev(nds[i]);
                return -EINVAL;
        }
diff --git a/drivers/net/ixp2000/pm3386.c b/drivers/net/ixp2000/pm3386.c
index 5c7ab7564053..5224651c9aac 100644
--- a/drivers/net/ixp2000/pm3386.c
+++ b/drivers/net/ixp2000/pm3386.c
@@ -86,40 +86,53 @@ static void pm3386_port_reg_write(int port, int _reg, int spacing, u16 value)
        pm3386_reg_write(port >> 1, reg, value);
 }
+int pm3386_secondary_present(void)
+{
+        return pm3386_reg_read(1, 0) == 0x3386;
+}
 void pm3386_reset(void)
 {
        u8 mac[3][6];
+        int secondary;
+        secondary = pm3386_secondary_present();
        /* Save programmed MAC addresses.  */
        pm3386_get_mac(0, mac[0]);
        pm3386_get_mac(1, mac[1]);
-        pm3386_get_mac(2, mac[2]);
+        if (secondary)
+                pm3386_get_mac(2, mac[2]);
        /* Assert analog and digital reset.  */
        pm3386_reg_write(0, 0x002, 0x0060);
-        pm3386_reg_write(1, 0x002, 0x0060);
+        if (secondary)
+                pm3386_reg_write(1, 0x002, 0x0060);
        mdelay(1);
        /* Deassert analog reset.  */
        pm3386_reg_write(0, 0x002, 0x0062);
-        pm3386_reg_write(1, 0x002, 0x0062);
+        if (secondary)
+                pm3386_reg_write(1, 0x002, 0x0062);
        mdelay(10);
        /* Deassert digital reset.  */
        pm3386_reg_write(0, 0x002, 0x0063);
-        pm3386_reg_write(1, 0x002, 0x0063);
+        if (secondary)
+                pm3386_reg_write(1, 0x002, 0x0063);
        mdelay(10);
        /* Restore programmed MAC addresses.  */
        pm3386_set_mac(0, mac[0]);
        pm3386_set_mac(1, mac[1]);
-        pm3386_set_mac(2, mac[2]);
+        if (secondary)
+                pm3386_set_mac(2, mac[2]);
        /* Disable carrier on all ports.  */
        pm3386_set_carrier(0, 0);
        pm3386_set_carrier(1, 0);
-        pm3386_set_carrier(2, 0);
+        if (secondary)
+                pm3386_set_carrier(2, 0);
 }
 static u16 swaph(u16 x)
@@ -127,6 +140,11 @@ static u16 swaph(u16 x)
        return ((x << 8) | (x >> 8)) & 0xffff;
 }
+int pm3386_port_count(void)
+{
+        return 2 + pm3386_secondary_present();
+}
 void pm3386_init_port(int port)
 {
        int pm = port >> 1;
diff --git a/drivers/net/ixp2000/pm3386.h b/drivers/net/ixp2000/pm3386.h
index fe92bb056ac4..cc4183dca911 100644
--- a/drivers/net/ixp2000/pm3386.h
+++ b/drivers/net/ixp2000/pm3386.h
@@ -13,6 +13,7 @@
 #define __PM3386_H
 void pm3386_reset(void);
+int pm3386_port_count(void);
 void pm3386_init_port(int port);
 void pm3386_get_mac(int port, u8 *mac);
 void pm3386_set_mac(int port, u8 *mac);
diff --git a/drivers/net/sky2.c b/drivers/net/sky2.c
index ffd267fab21d..62be6d99d05c 100644
--- a/drivers/net/sky2.c
+++ b/drivers/net/sky2.c
@@ -1020,8 +1020,19 @@ static int sky2_up(struct net_device *dev)
        struct sky2_hw *hw = sky2->hw;
        unsigned port = sky2->port;
        u32 ramsize, rxspace, imask;
-        int err = -ENOMEM;
+        int err;
+        struct net_device *otherdev = hw->dev[sky2->port^1];
+        /* Block bringing up both ports at the same time on a dual port card.
+         * There is an unfixed bug where receiver gets confused and picks up
+         * packets out of order. Until this is fixed, prevent data corruption.
+         */
+        if (otherdev && netif_running(otherdev)) {
+                printk(KERN_INFO PFX "dual port support is disabled.\n");
+                return -EBUSY;
+        }
+        err = -ENOMEM;
        if (netif_msg_ifup(sky2))
                printk(KERN_INFO PFX "%s: enabling interface\n", dev->name);
diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c
index 19e2b174d33c..d378478612fb 100644
--- a/drivers/pci/quirks.c
+++ b/drivers/pci/quirks.c
@@ -634,6 +634,9 @@ DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_VIA,	PCI_DEVICE_ID_VIA_82C686_4,	quirk_vi
 * non-x86 architectures (yes Via exists on PPC among other places),
 * we must mask the PCI_INTERRUPT_LINE value versus 0xf to get
 * interrupts delivered properly.
+ *
+ * Some of the on-chip devices are actually '586 devices' so they are
+ * listed here.
 */
 static void quirk_via_irq(struct pci_dev *dev)
 {
@@ -648,6 +651,10 @@ static void quirk_via_irq(struct pci_dev *dev)
                pci_write_config_byte(dev, PCI_INTERRUPT_LINE, new_irq);
        }
 }
+DECLARE_PCI_FIXUP_ENABLE(PCI_VENDOR_ID_VIA, PCI_DEVICE_ID_VIA_82C586_0, quirk_via_irq);
+DECLARE_PCI_FIXUP_ENABLE(PCI_VENDOR_ID_VIA, PCI_DEVICE_ID_VIA_82C586_1, quirk_via_irq);
+DECLARE_PCI_FIXUP_ENABLE(PCI_VENDOR_ID_VIA, PCI_DEVICE_ID_VIA_82C586_2, quirk_via_irq);
+DECLARE_PCI_FIXUP_ENABLE(PCI_VENDOR_ID_VIA, PCI_DEVICE_ID_VIA_82C586_3, quirk_via_irq);
 DECLARE_PCI_FIXUP_ENABLE(PCI_VENDOR_ID_VIA, PCI_DEVICE_ID_VIA_82C686, quirk_via_irq);
 DECLARE_PCI_FIXUP_ENABLE(PCI_VENDOR_ID_VIA, PCI_DEVICE_ID_VIA_82C686_4, quirk_via_irq);
 DECLARE_PCI_FIXUP_ENABLE(PCI_VENDOR_ID_VIA, PCI_DEVICE_ID_VIA_82C686_5, quirk_via_irq);
@@ -895,6 +902,7 @@ static void __init k8t_sound_hostbridge(struct pci_dev *dev)
 }
 DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_VIA, PCI_DEVICE_ID_VIA_8237, k8t_sound_hostbridge);
+#ifndef CONFIG_ACPI_SLEEP
 /*
 * On ASUS P4B boards, the SMBus PCI Device within the ICH2/4 southbridge
 * is not activated. The myth is that Asus said that they do not want the
@@ -906,8 +914,12 @@ DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_VIA, PCI_DEVICE_ID_VIA_8237, k8t_sound_ho
 * bridge. Unfortunately, this device has no subvendor/subdevice ID. So it 
 * becomes necessary to do this tweak in two steps -- I've chosen the Host
 * bridge as trigger.
+ *
+ * Actually, leaving it unhidden and not redoing the quirk over suspend2ram
+ * will cause thermal management to break down, and causing machine to
+ * overheat.
 */
-static int __initdata asus_hides_smbus = 0;
+static int __initdata asus_hides_smbus;
 static void __init asus_hides_smbus_hostbridge(struct pci_dev *dev)
 {
@@ -1050,6 +1062,8 @@ static void __init asus_hides_smbus_lpc_ich6(struct pci_dev *dev)
 }
 DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL,   PCI_DEVICE_ID_INTEL_ICH6_1,     asus_hides_smbus_lpc_ich6 );
+#endif
 /*
 * SiS 96x south bridge: BIOS typically hides SMBus device...
 */
diff --git a/drivers/pcmcia/pcmcia_ioctl.c b/drivers/pcmcia/pcmcia_ioctl.c
index c53db7ceda5e..738b1ef595a3 100644
--- a/drivers/pcmcia/pcmcia_ioctl.c
+++ b/drivers/pcmcia/pcmcia_ioctl.c
@@ -426,7 +426,7 @@ static int ds_open(struct inode *inode, struct file *file)
    if (!warning_printed) {
            printk(KERN_INFO "pcmcia: Detected deprecated PCMCIA ioctl "
-                        "usage.\n");
+                        "usage from process: %s.\n", current->comm);
            printk(KERN_INFO "pcmcia: This interface will soon be removed from "
                        "the kernel; please expect breakage unless you upgrade "
                        "to new tools.\n");
@@ -601,8 +601,12 @@ static int ds_ioctl(struct inode * inode, struct file * file,
            ret = CS_BAD_ARGS;
        else {
            struct pcmcia_device *p_dev = get_pcmcia_device(s, buf->config.Function);
-            ret = pccard_get_configuration_info(s, p_dev, &buf->config);
+            if (p_dev == NULL)
-            pcmcia_put_dev(p_dev);
+                    ret = CS_BAD_ARGS;
+            else {
+                    ret = pccard_get_configuration_info(s, p_dev, &buf->config);
+                    pcmcia_put_dev(p_dev);
+            }
        }
        break;
    case DS_GET_FIRST_TUPLE:
@@ -632,8 +636,12 @@ static int ds_ioctl(struct inode * inode, struct file * file,
                    ret = CS_BAD_ARGS;
            else {
                    struct pcmcia_device *p_dev = get_pcmcia_device(s, buf->status.Function);
-                    ret = pccard_get_status(s, p_dev, &buf->status);
+                    if (p_dev == NULL)
-                    pcmcia_put_dev(p_dev);
+                            ret = CS_BAD_ARGS;
+                    else {
+                            ret = pccard_get_status(s, p_dev, &buf->status);
+                            pcmcia_put_dev(p_dev);
+                    }
            }
            break;
    case DS_VALIDATE_CIS:
@@ -665,9 +673,10 @@ static int ds_ioctl(struct inode * inode, struct file * file,
        if (!(buf->conf_reg.Function &&
             (buf->conf_reg.Function >= s->functions))) {
                struct pcmcia_device *p_dev = get_pcmcia_device(s, buf->conf_reg.Function);
-                if (p_dev)
+                if (p_dev) {
                        ret = pcmcia_access_configuration_register(p_dev, &buf->conf_reg);
-                pcmcia_put_dev(p_dev);
+                        pcmcia_put_dev(p_dev);
+                }
        }
        break;
    case DS_GET_FIRST_REGION:
diff --git a/drivers/s390/net/lcs.c b/drivers/s390/net/lcs.c
index 5d6b7a57b02f..e65da921a827 100644
--- a/drivers/s390/net/lcs.c
+++ b/drivers/s390/net/lcs.c
@@ -1348,7 +1348,7 @@ lcs_irq(struct ccw_device *cdev, unsigned long intparm, struct irb *irb)
                index = (struct ccw1 *) __va((addr_t) irb->scsw.cpa) 
                        - channel->ccws;
                if ((irb->scsw.actl & SCSW_ACTL_SUSPENDED) ||
-                    (irb->scsw.cstat | SCHN_STAT_PCI))
+                    (irb->scsw.cstat & SCHN_STAT_PCI))
                        /* Bloody io subsystem tells us lies about cpa... */
                        index = (index - 1) & (LCS_NUM_BUFFS - 1);
                while (channel->io_idx != index) {
diff --git a/drivers/scsi/libata-core.c b/drivers/scsi/libata-core.c
index 9051b6821c1c..00881226f8dd 100644
--- a/drivers/scsi/libata-core.c
+++ b/drivers/scsi/libata-core.c
@@ -875,6 +875,9 @@ static unsigned int ata_id_xfermask(const u16 *id)
 /**
 *      ata_port_queue_task - Queue port_task
 *      @ap: The ata_port to queue port_task for
+ *      @fn: workqueue function to be scheduled
+ *      @data: data value to pass to workqueue function
+ *      @delay: delay time for workqueue function
 *
 *      Schedule @fn(@data) for execution after @delay jiffies using
 *      port_task.  There is one port_task per port and it's the
@@ -3091,8 +3094,8 @@ static unsigned int ata_dev_set_xfermode(struct ata_device *dev)
 /**
 *      ata_dev_init_params - Issue INIT DEV PARAMS command
 *      @dev: Device to which command will be sent
- *      @heads: Number of heads
+ *      @heads: Number of heads (taskfile parameter)
- *      @sectors: Number of sectors
+ *      @sectors: Number of sectors (taskfile parameter)
 *
 *      LOCKING:
 *      Kernel thread context (may sleep)
@@ -5007,6 +5010,7 @@ int ata_device_resume(struct ata_device *dev)
 /**
 *      ata_device_suspend - prepare a device for suspend
 *      @dev: the device to suspend
+ *      @state: target power management state
 *
 *      Flush the cache on the drive, if appropriate, then issue a
 *      standbynow command.
diff --git a/drivers/scsi/sata_mv.c b/drivers/scsi/sata_mv.c
index e6d141dd0385..bfe817fc7520 100644
--- a/drivers/scsi/sata_mv.c
+++ b/drivers/scsi/sata_mv.c
@@ -37,7 +37,7 @@
 #include <asm/io.h>
 #define DRV_NAME        "sata_mv"
-#define DRV_VERSION     "0.6"
+#define DRV_VERSION     "0.7"
 enum {
        /* BAR's are enumerated in terms of pci_resource_start() terms */
@@ -50,6 +50,12 @@ enum {
        MV_PCI_REG_BASE         = 0,
        MV_IRQ_COAL_REG_BASE    = 0x18000,      /* 6xxx part only */
+        MV_IRQ_COAL_CAUSE               = (MV_IRQ_COAL_REG_BASE + 0x08),
+        MV_IRQ_COAL_CAUSE_LO            = (MV_IRQ_COAL_REG_BASE + 0x88),
+        MV_IRQ_COAL_CAUSE_HI            = (MV_IRQ_COAL_REG_BASE + 0x8c),
+        MV_IRQ_COAL_THRESHOLD           = (MV_IRQ_COAL_REG_BASE + 0xcc),
+        MV_IRQ_COAL_TIME_THRESHOLD      = (MV_IRQ_COAL_REG_BASE + 0xd0),
        MV_SATAHC0_REG_BASE     = 0x20000,
        MV_FLASH_CTL            = 0x1046c,
        MV_GPIO_PORT_CTL        = 0x104f0,
@@ -302,9 +308,6 @@ struct mv_port_priv {
        dma_addr_t              crpb_dma;
        struct mv_sg            *sg_tbl;
        dma_addr_t              sg_tbl_dma;
-        unsigned                req_producer;           /* cp of req_in_ptr */
-        unsigned                rsp_consumer;           /* cp of rsp_out_ptr */
        u32                     pp_flags;
 };
@@ -937,8 +940,6 @@ static int mv_port_start(struct ata_port *ap)
        writelfl(pp->crpb_dma & EDMA_RSP_Q_BASE_LO_MASK,
                 port_mmio + EDMA_RSP_Q_OUT_PTR_OFS);
-        pp->req_producer = pp->rsp_consumer = 0;
        /* Don't turn on EDMA here...do it before DMA commands only.  Else
         * we'll be unable to send non-data, PIO, etc due to restricted access
         * to shadow regs.
@@ -1022,16 +1023,16 @@ static void mv_fill_sg(struct ata_queued_cmd *qc)
        }
 }
-static inline unsigned mv_inc_q_index(unsigned *index)
+static inline unsigned mv_inc_q_index(unsigned index)
 {
-        *index = (*index + 1) & MV_MAX_Q_DEPTH_MASK;
+        return (index + 1) & MV_MAX_Q_DEPTH_MASK;
-        return *index;
 }
 static inline void mv_crqb_pack_cmd(u16 *cmdw, u8 data, u8 addr, unsigned last)
 {
-        *cmdw = data | (addr << CRQB_CMD_ADDR_SHIFT) | CRQB_CMD_CS |
+        u16 tmp = data | (addr << CRQB_CMD_ADDR_SHIFT) | CRQB_CMD_CS |
                (last ? CRQB_CMD_LAST : 0);
+        *cmdw = cpu_to_le16(tmp);
 }
 /**
@@ -1053,15 +1054,11 @@ static void mv_qc_prep(struct ata_queued_cmd *qc)
        u16 *cw;
        struct ata_taskfile *tf;
        u16 flags = 0;
+        unsigned in_index;
        if (ATA_PROT_DMA != qc->tf.protocol)
                return;
-        /* the req producer index should be the same as we remember it */
-        WARN_ON(((readl(mv_ap_base(qc->ap) + EDMA_REQ_Q_IN_PTR_OFS) >>
-                  EDMA_REQ_Q_PTR_SHIFT) & MV_MAX_Q_DEPTH_MASK) !=
-                pp->req_producer);
        /* Fill in command request block
         */
        if (!(qc->tf.flags & ATA_TFLAG_WRITE))
@@ -1069,13 +1066,17 @@ static void mv_qc_prep(struct ata_queued_cmd *qc)
        WARN_ON(MV_MAX_Q_DEPTH <= qc->tag);
        flags |= qc->tag << CRQB_TAG_SHIFT;
-        pp->crqb[pp->req_producer].sg_addr =
+        /* get current queue index from hardware */
+        in_index = (readl(mv_ap_base(ap) + EDMA_REQ_Q_IN_PTR_OFS)
+                        >> EDMA_REQ_Q_PTR_SHIFT) & MV_MAX_Q_DEPTH_MASK;
+        pp->crqb[in_index].sg_addr =
                cpu_to_le32(pp->sg_tbl_dma & 0xffffffff);
-        pp->crqb[pp->req_producer].sg_addr_hi =
+        pp->crqb[in_index].sg_addr_hi =
                cpu_to_le32((pp->sg_tbl_dma >> 16) >> 16);
-        pp->crqb[pp->req_producer].ctrl_flags = cpu_to_le16(flags);
+        pp->crqb[in_index].ctrl_flags = cpu_to_le16(flags);
-        cw = &pp->crqb[pp->req_producer].ata_cmd[0];
+        cw = &pp->crqb[in_index].ata_cmd[0];
        tf = &qc->tf;
        /* Sadly, the CRQB cannot accomodate all registers--there are
@@ -1144,16 +1145,12 @@ static void mv_qc_prep_iie(struct ata_queued_cmd *qc)
        struct mv_port_priv *pp = ap->private_data;
        struct mv_crqb_iie *crqb;
        struct ata_taskfile *tf;
+        unsigned in_index;
        u32 flags = 0;
        if (ATA_PROT_DMA != qc->tf.protocol)
                return;
-        /* the req producer index should be the same as we remember it */
-        WARN_ON(((readl(mv_ap_base(qc->ap) + EDMA_REQ_Q_IN_PTR_OFS) >>
-                  EDMA_REQ_Q_PTR_SHIFT) & MV_MAX_Q_DEPTH_MASK) !=
-                pp->req_producer);
        /* Fill in Gen IIE command request block
         */
        if (!(qc->tf.flags & ATA_TFLAG_WRITE))
@@ -1162,7 +1159,11 @@ static void mv_qc_prep_iie(struct ata_queued_cmd *qc)
        WARN_ON(MV_MAX_Q_DEPTH <= qc->tag);
        flags |= qc->tag << CRQB_TAG_SHIFT;
-        crqb = (struct mv_crqb_iie *) &pp->crqb[pp->req_producer];
+        /* get current queue index from hardware */
+        in_index = (readl(mv_ap_base(ap) + EDMA_REQ_Q_IN_PTR_OFS)
+                        >> EDMA_REQ_Q_PTR_SHIFT) & MV_MAX_Q_DEPTH_MASK;
+        crqb = (struct mv_crqb_iie *) &pp->crqb[in_index];
        crqb->addr = cpu_to_le32(pp->sg_tbl_dma & 0xffffffff);
        crqb->addr_hi = cpu_to_le32((pp->sg_tbl_dma >> 16) >> 16);
        crqb->flags = cpu_to_le32(flags);
@@ -1210,6 +1211,7 @@ static unsigned int mv_qc_issue(struct ata_queued_cmd *qc)
 {
        void __iomem *port_mmio = mv_ap_base(qc->ap);
        struct mv_port_priv *pp = qc->ap->private_data;
+        unsigned in_index;
        u32 in_ptr;
        if (ATA_PROT_DMA != qc->tf.protocol) {
@@ -1221,23 +1223,20 @@ static unsigned int mv_qc_issue(struct ata_queued_cmd *qc)
                return ata_qc_issue_prot(qc);
        }
-        in_ptr = readl(port_mmio + EDMA_REQ_Q_IN_PTR_OFS);
+        in_ptr   = readl(port_mmio + EDMA_REQ_Q_IN_PTR_OFS);
+        in_index = (in_ptr >> EDMA_REQ_Q_PTR_SHIFT) & MV_MAX_Q_DEPTH_MASK;
-        /* the req producer index should be the same as we remember it */
-        WARN_ON(((in_ptr >> EDMA_REQ_Q_PTR_SHIFT) & MV_MAX_Q_DEPTH_MASK) !=
-                pp->req_producer);
        /* until we do queuing, the queue should be empty at this point */
-        WARN_ON(((in_ptr >> EDMA_REQ_Q_PTR_SHIFT) & MV_MAX_Q_DEPTH_MASK) !=
+        WARN_ON(in_index != ((readl(port_mmio + EDMA_REQ_Q_OUT_PTR_OFS)
-                ((readl(port_mmio + EDMA_REQ_Q_OUT_PTR_OFS) >>
+                >> EDMA_REQ_Q_PTR_SHIFT) & MV_MAX_Q_DEPTH_MASK));
-                  EDMA_REQ_Q_PTR_SHIFT) & MV_MAX_Q_DEPTH_MASK));
-        mv_inc_q_index(&pp->req_producer);      /* now incr producer index */
+        in_index = mv_inc_q_index(in_index);    /* now incr producer index */
        mv_start_dma(port_mmio, pp);
        /* and write the request in pointer to kick the EDMA to life */
        in_ptr &= EDMA_REQ_Q_BASE_LO_MASK;
-        in_ptr |= pp->req_producer << EDMA_REQ_Q_PTR_SHIFT;
+        in_ptr |= in_index << EDMA_REQ_Q_PTR_SHIFT;
        writelfl(in_ptr, port_mmio + EDMA_REQ_Q_IN_PTR_OFS);
        return 0;
@@ -1260,28 +1259,26 @@ static u8 mv_get_crpb_status(struct ata_port *ap)
 {
        void __iomem *port_mmio = mv_ap_base(ap);
        struct mv_port_priv *pp = ap->private_data;
+        unsigned out_index;
        u32 out_ptr;
        u8 ata_status;
-        out_ptr = readl(port_mmio + EDMA_RSP_Q_OUT_PTR_OFS);
+        out_ptr   = readl(port_mmio + EDMA_RSP_Q_OUT_PTR_OFS);
+        out_index = (out_ptr >> EDMA_RSP_Q_PTR_SHIFT) & MV_MAX_Q_DEPTH_MASK;
-        /* the response consumer index should be the same as we remember it */
+        ata_status = le16_to_cpu(pp->crpb[out_index].flags)
-        WARN_ON(((out_ptr >> EDMA_RSP_Q_PTR_SHIFT) & MV_MAX_Q_DEPTH_MASK) !=
+                                        >> CRPB_FLAG_STATUS_SHIFT;
-                pp->rsp_consumer);
-        ata_status = pp->crpb[pp->rsp_consumer].flags >> CRPB_FLAG_STATUS_SHIFT;
        /* increment our consumer index... */
-        pp->rsp_consumer = mv_inc_q_index(&pp->rsp_consumer);
+        out_index = mv_inc_q_index(out_index);
        /* and, until we do NCQ, there should only be 1 CRPB waiting */
-        WARN_ON(((readl(port_mmio + EDMA_RSP_Q_IN_PTR_OFS) >>
+        WARN_ON(out_index != ((readl(port_mmio + EDMA_RSP_Q_IN_PTR_OFS)
-                  EDMA_RSP_Q_PTR_SHIFT) & MV_MAX_Q_DEPTH_MASK) !=
+                >> EDMA_RSP_Q_PTR_SHIFT) & MV_MAX_Q_DEPTH_MASK));
-                pp->rsp_consumer);
        /* write out our inc'd consumer index so EDMA knows we're caught up */
        out_ptr &= EDMA_RSP_Q_BASE_LO_MASK;
-        out_ptr |= pp->rsp_consumer << EDMA_RSP_Q_PTR_SHIFT;
+        out_ptr |= out_index << EDMA_RSP_Q_PTR_SHIFT;
        writelfl(out_ptr, port_mmio + EDMA_RSP_Q_OUT_PTR_OFS);
        /* Return ATA status register for completed CRPB */
@@ -1291,6 +1288,7 @@ static u8 mv_get_crpb_status(struct ata_port *ap)
 /**
 *      mv_err_intr - Handle error interrupts on the port
 *      @ap: ATA channel to manipulate
+ *      @reset_allowed: bool: 0 == don't trigger from reset here
 *
 *      In most cases, just clear the interrupt and move on.  However,
 *      some cases require an eDMA reset, which is done right before
@@ -1301,7 +1299,7 @@ static u8 mv_get_crpb_status(struct ata_port *ap)
 *      LOCKING:
 *      Inherited from caller.
 */
-static void mv_err_intr(struct ata_port *ap)
+static void mv_err_intr(struct ata_port *ap, int reset_allowed)
 {
        void __iomem *port_mmio = mv_ap_base(ap);
        u32 edma_err_cause, serr = 0;
@@ -1323,9 +1321,8 @@ static void mv_err_intr(struct ata_port *ap)
        writelfl(0, port_mmio + EDMA_ERR_IRQ_CAUSE_OFS);
        /* check for fatal here and recover if needed */
-        if (EDMA_ERR_FATAL & edma_err_cause) {
+        if (reset_allowed && (EDMA_ERR_FATAL & edma_err_cause))
                mv_stop_and_reset(ap);
-        }
 }
 /**
@@ -1374,12 +1371,12 @@ static void mv_host_intr(struct ata_host_set *host_set, u32 relevant,
                struct ata_port *ap = host_set->ports[port];
                struct mv_port_priv *pp = ap->private_data;
-                hard_port = port & MV_PORT_MASK;        /* range 0-3 */
+                hard_port = mv_hardport_from_port(port); /* range 0..3 */
                handled = 0;    /* ensure ata_status is set if handled++ */
                /* Note that DEV_IRQ might happen spuriously during EDMA,
-                 * and should be ignored in such cases.  We could mask it,
+                 * and should be ignored in such cases.
-                 * but it's pretty rare and may not be worth the overhead.
+                 * The cause of this is still under investigation.
                 */ 
                if (pp->pp_flags & MV_PP_FLAG_EDMA_EN) {
                        /* EDMA: check for response queue interrupt */
@@ -1393,6 +1390,11 @@ static void mv_host_intr(struct ata_host_set *host_set, u32 relevant,
                                ata_status = readb((void __iomem *)
                                           ap->ioaddr.status_addr);
                                handled = 1;
+                                /* ignore spurious intr if drive still BUSY */
+                                if (ata_status & ATA_BUSY) {
+                                        ata_status = 0;
+                                        handled = 0;
+                                }
                        }
                }
@@ -1406,7 +1408,7 @@ static void mv_host_intr(struct ata_host_set *host_set, u32 relevant,
                        shift++;        /* skip bit 8 in the HC Main IRQ reg */
                }
                if ((PORT0_ERR << shift) & relevant) {
-                        mv_err_intr(ap);
+                        mv_err_intr(ap, 1);
                        err_mask |= AC_ERR_OTHER;
                        handled = 1;
                }
@@ -1448,6 +1450,7 @@ static irqreturn_t mv_interrupt(int irq, void *dev_instance,
        struct ata_host_set *host_set = dev_instance;
        unsigned int hc, handled = 0, n_hcs;
        void __iomem *mmio = host_set->mmio_base;
+        struct mv_host_priv *hpriv;
        u32 irq_stat;
        irq_stat = readl(mmio + HC_MAIN_IRQ_CAUSE_OFS);
@@ -1469,6 +1472,17 @@ static irqreturn_t mv_interrupt(int irq, void *dev_instance,
                        handled++;
                }
        }
+        hpriv = host_set->private_data;
+        if (IS_60XX(hpriv)) {
+                /* deal with the interrupt coalescing bits */
+                if (irq_stat & (TRAN_LO_DONE | TRAN_HI_DONE | PORTS_0_7_COAL_DONE)) {
+                        writelfl(0, mmio + MV_IRQ_COAL_CAUSE_LO);
+                        writelfl(0, mmio + MV_IRQ_COAL_CAUSE_HI);
+                        writelfl(0, mmio + MV_IRQ_COAL_CAUSE);
+                }
+        }
        if (PCI_ERR & irq_stat) {
                printk(KERN_ERR DRV_NAME ": PCI ERROR; PCI IRQ cause=0x%08x\n",
                       readl(mmio + PCI_IRQ_CAUSE_OFS));
@@ -1867,7 +1881,8 @@ static void mv_channel_reset(struct mv_host_priv *hpriv, void __iomem *mmio,
        if (IS_60XX(hpriv)) {
                u32 ifctl = readl(port_mmio + SATA_INTERFACE_CTL);
-                ifctl |= (1 << 12) | (1 << 7);
+                ifctl |= (1 << 7);              /* enable gen2i speed */
+                ifctl = (ifctl & 0xfff) | 0x9b1000; /* from chip spec */
                writelfl(ifctl, port_mmio + SATA_INTERFACE_CTL);
        }
@@ -2033,11 +2048,14 @@ static void mv_eng_timeout(struct ata_port *ap)
               ap->host_set->mmio_base, ap, qc, qc->scsicmd,
               &qc->scsicmd->cmnd);
-        mv_err_intr(ap);
+        mv_err_intr(ap, 0);
        mv_stop_and_reset(ap);
-        qc->err_mask |= AC_ERR_TIMEOUT;
+        WARN_ON(!(qc->flags & ATA_QCFLAG_ACTIVE));
-        ata_eh_qc_complete(qc);
+        if (qc->flags & ATA_QCFLAG_ACTIVE) {
+                qc->err_mask |= AC_ERR_TIMEOUT;
+                ata_eh_qc_complete(qc);
+        }
 }
 /**
@@ -2231,7 +2249,8 @@ static int mv_init_host(struct pci_dev *pdev, struct ata_probe_ent *probe_ent,
                        void __iomem *port_mmio = mv_port_base(mmio, port);
                        u32 ifctl = readl(port_mmio + SATA_INTERFACE_CTL);
-                        ifctl |= (1 << 12);
+                        ifctl |= (1 << 7);              /* enable gen2i speed */
+                        ifctl = (ifctl & 0xfff) | 0x9b1000; /* from chip spec */
                        writelfl(ifctl, port_mmio + SATA_INTERFACE_CTL);
                }
@@ -2332,6 +2351,7 @@ static int mv_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
        if (rc) {
                return rc;
        }
+        pci_set_master(pdev);
        rc = pci_request_regions(pdev, DRV_NAME);
        if (rc) {
diff --git a/drivers/serial/serial_core.c b/drivers/serial/serial_core.c
index aeb8153ccf24..17839e753e4c 100644
--- a/drivers/serial/serial_core.c
+++ b/drivers/serial/serial_core.c
@@ -1907,9 +1907,12 @@ uart_set_options(struct uart_port *port, struct console *co,
 static void uart_change_pm(struct uart_state *state, int pm_state)
 {
        struct uart_port *port = state->port;
-        if (port->ops->pm)
-                port->ops->pm(port, pm_state, state->pm_state);
+        if (state->pm_state != pm_state) {
-        state->pm_state = pm_state;
+                if (port->ops->pm)
+                        port->ops->pm(port, pm_state, state->pm_state);
+                state->pm_state = pm_state;
+        }
 }
 int uart_suspend_port(struct uart_driver *drv, struct uart_port *port)
diff --git a/drivers/spi/Kconfig b/drivers/spi/Kconfig
index 7a75faeb0526..9ce1d01469b1 100644
--- a/drivers/spi/Kconfig
+++ b/drivers/spi/Kconfig
@@ -75,6 +75,14 @@ config SPI_BUTTERFLY
          inexpensive battery powered microcontroller evaluation board.
          This same cable can be used to flash new firmware.
+config SPI_PXA2XX
+        tristate "PXA2xx SSP SPI master"
+        depends on SPI_MASTER && ARCH_PXA && EXPERIMENTAL
+        help
+          This enables using a PXA2xx SSP port as a SPI master controller.
+          The driver can be configured to use any SSP port and additional
+          documentation can be found a Documentation/spi/pxa2xx.
 #
 # Add new SPI master controllers in alphabetical order above this line
 #
diff --git a/drivers/spi/Makefile b/drivers/spi/Makefile
index c2c87e845abf..1bca5f95de25 100644
--- a/drivers/spi/Makefile
+++ b/drivers/spi/Makefile
@@ -13,6 +13,7 @@ obj-$(CONFIG_SPI_MASTER)		+= spi.o
 # SPI master controller drivers (bus)
 obj-$(CONFIG_SPI_BITBANG)               += spi_bitbang.o
 obj-$(CONFIG_SPI_BUTTERFLY)             += spi_butterfly.o
+obj-$(CONFIG_SPI_PXA2XX)                += pxa2xx_spi.o
 #       ... add above this line ...
 # SPI protocol drivers (device/link on bus)
diff --git a/drivers/spi/pxa2xx_spi.c b/drivers/spi/pxa2xx_spi.c
new file mode 100644
index 000000000000..596bf820b70c
--- /dev/null
+++ b/drivers/spi/pxa2xx_spi.c
@@ -0,0 +1,1467 @@
+/*
+ * Copyright (C) 2005 Stephen Street / StreetFire Sound Labs
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
+ */
+#include <linux/init.h>
+#include <linux/module.h>
+#include <linux/device.h>
+#include <linux/ioport.h>
+#include <linux/errno.h>
+#include <linux/interrupt.h>
+#include <linux/platform_device.h>
+#include <linux/dma-mapping.h>
+#include <linux/spi/spi.h>
+#include <linux/workqueue.h>
+#include <linux/errno.h>
+#include <linux/delay.h>
+#include <asm/io.h>
+#include <asm/irq.h>
+#include <asm/hardware.h>
+#include <asm/delay.h>
+#include <asm/dma.h>
+#include <asm/arch/hardware.h>
+#include <asm/arch/pxa-regs.h>
+#include <asm/arch/pxa2xx_spi.h>
+MODULE_AUTHOR("Stephen Street");
+MODULE_DESCRIPTION("PXA2xx SSP SPI Contoller");
+MODULE_LICENSE("GPL");
+#define MAX_BUSES 3
+#define DMA_INT_MASK (DCSR_ENDINTR | DCSR_STARTINTR | DCSR_BUSERR)
+#define RESET_DMA_CHANNEL (DCSR_NODESC | DMA_INT_MASK)
+#define IS_DMA_ALIGNED(x) (((u32)(x)&0x07)==0)
+#define DEFINE_SSP_REG(reg, off) \
+static inline u32 read_##reg(void *p) { return __raw_readl(p + (off)); } \
+static inline void write_##reg(u32 v, void *p) { __raw_writel(v, p + (off)); }
+DEFINE_SSP_REG(SSCR0, 0x00)
+DEFINE_SSP_REG(SSCR1, 0x04)
+DEFINE_SSP_REG(SSSR, 0x08)
+DEFINE_SSP_REG(SSITR, 0x0c)
+DEFINE_SSP_REG(SSDR, 0x10)
+DEFINE_SSP_REG(SSTO, 0x28)
+DEFINE_SSP_REG(SSPSP, 0x2c)
+#define START_STATE ((void*)0)
+#define RUNNING_STATE ((void*)1)
+#define DONE_STATE ((void*)2)
+#define ERROR_STATE ((void*)-1)
+#define QUEUE_RUNNING 0
+#define QUEUE_STOPPED 1
+struct driver_data {
+        /* Driver model hookup */
+        struct platform_device *pdev;
+        /* SPI framework hookup */
+        enum pxa_ssp_type ssp_type;
+        struct spi_master *master;
+        /* PXA hookup */
+        struct pxa2xx_spi_master *master_info;
+        /* DMA setup stuff */
+        int rx_channel;
+        int tx_channel;
+        u32 *null_dma_buf;
+        /* SSP register addresses */
+        void *ioaddr;
+        u32 ssdr_physical;
+        /* SSP masks*/
+        u32 dma_cr1;
+        u32 int_cr1;
+        u32 clear_sr;
+        u32 mask_sr;
+        /* Driver message queue */
+        struct workqueue_struct *workqueue;
+        struct work_struct pump_messages;
+        spinlock_t lock;
+        struct list_head queue;
+        int busy;
+        int run;
+        /* Message Transfer pump */
+        struct tasklet_struct pump_transfers;
+        /* Current message transfer state info */
+        struct spi_message* cur_msg;
+        struct spi_transfer* cur_transfer;
+        struct chip_data *cur_chip;
+        size_t len;
+        void *tx;
+        void *tx_end;
+        void *rx;
+        void *rx_end;
+        int dma_mapped;
+        dma_addr_t rx_dma;
+        dma_addr_t tx_dma;
+        size_t rx_map_len;
+        size_t tx_map_len;
+        u8 n_bytes;
+        u32 dma_width;
+        int cs_change;
+        void (*write)(struct driver_data *drv_data);
+        void (*read)(struct driver_data *drv_data);
+        irqreturn_t (*transfer_handler)(struct driver_data *drv_data);
+        void (*cs_control)(u32 command);
+};
+struct chip_data {
+        u32 cr0;
+        u32 cr1;
+        u32 to;
+        u32 psp;
+        u32 timeout;
+        u8 n_bytes;
+        u32 dma_width;
+        u32 dma_burst_size;
+        u32 threshold;
+        u32 dma_threshold;
+        u8 enable_dma;
+        u8 bits_per_word;
+        u32 speed_hz;
+        void (*write)(struct driver_data *drv_data);
+        void (*read)(struct driver_data *drv_data);
+        void (*cs_control)(u32 command);
+};
+static void pump_messages(void *data);
+static int flush(struct driver_data *drv_data)
+{
+        unsigned long limit = loops_per_jiffy << 1;
+        void *reg = drv_data->ioaddr;
+        do {
+                while (read_SSSR(reg) & SSSR_RNE) {
+                        read_SSDR(reg);
+                }
+        } while ((read_SSSR(reg) & SSSR_BSY) && limit--);
+        write_SSSR(SSSR_ROR, reg);
+        return limit;
+}
+static void restore_state(struct driver_data *drv_data)
+{
+        void *reg = drv_data->ioaddr;
+        /* Clear status and disable clock */
+        write_SSSR(drv_data->clear_sr, reg);
+        write_SSCR0(drv_data->cur_chip->cr0 & ~SSCR0_SSE, reg);
+        /* Load the registers */
+        write_SSCR1(drv_data->cur_chip->cr1, reg);
+        write_SSCR0(drv_data->cur_chip->cr0, reg);
+        if (drv_data->ssp_type != PXA25x_SSP) {
+                write_SSTO(0, reg);
+                write_SSPSP(drv_data->cur_chip->psp, reg);
+        }
+}
+static void null_cs_control(u32 command)
+{
+}
+static void null_writer(struct driver_data *drv_data)
+{
+        void *reg = drv_data->ioaddr;
+        u8 n_bytes = drv_data->n_bytes;
+        while ((read_SSSR(reg) & SSSR_TNF)
+                        && (drv_data->tx < drv_data->tx_end)) {
+                write_SSDR(0, reg);
+                drv_data->tx += n_bytes;
+        }
+}
+static void null_reader(struct driver_data *drv_data)
+{
+        void *reg = drv_data->ioaddr;
+        u8 n_bytes = drv_data->n_bytes;
+        while ((read_SSSR(reg) & SSSR_RNE)
+                        && (drv_data->rx < drv_data->rx_end)) {
+                read_SSDR(reg);
+                drv_data->rx += n_bytes;
+        }
+}
+static void u8_writer(struct driver_data *drv_data)
+{
+        void *reg = drv_data->ioaddr;
+        while ((read_SSSR(reg) & SSSR_TNF)
+                        && (drv_data->tx < drv_data->tx_end)) {
+                write_SSDR(*(u8 *)(drv_data->tx), reg);
+                ++drv_data->tx;
+        }
+}
+static void u8_reader(struct driver_data *drv_data)
+{
+        void *reg = drv_data->ioaddr;
+        while ((read_SSSR(reg) & SSSR_RNE)
+                        && (drv_data->rx < drv_data->rx_end)) {
+                *(u8 *)(drv_data->rx) = read_SSDR(reg);
+                ++drv_data->rx;
+        }
+}
+static void u16_writer(struct driver_data *drv_data)
+{
+        void *reg = drv_data->ioaddr;
+        while ((read_SSSR(reg) & SSSR_TNF)
+                        && (drv_data->tx < drv_data->tx_end)) {
+                write_SSDR(*(u16 *)(drv_data->tx), reg);
+                drv_data->tx += 2;
+        }
+}
+static void u16_reader(struct driver_data *drv_data)
+{
+        void *reg = drv_data->ioaddr;
+        while ((read_SSSR(reg) & SSSR_RNE)
+                        && (drv_data->rx < drv_data->rx_end)) {
+                *(u16 *)(drv_data->rx) = read_SSDR(reg);
+                drv_data->rx += 2;
+        }
+}
+static void u32_writer(struct driver_data *drv_data)
+{
+        void *reg = drv_data->ioaddr;
+        while ((read_SSSR(reg) & SSSR_TNF)
+                        && (drv_data->tx < drv_data->tx_end)) {
+                write_SSDR(*(u32 *)(drv_data->tx), reg);
+                drv_data->tx += 4;
+        }
+}
+static void u32_reader(struct driver_data *drv_data)
+{
+        void *reg = drv_data->ioaddr;
+        while ((read_SSSR(reg) & SSSR_RNE)
+                        && (drv_data->rx < drv_data->rx_end)) {
+                *(u32 *)(drv_data->rx) = read_SSDR(reg);
+                drv_data->rx += 4;
+        }
+}
+static void *next_transfer(struct driver_data *drv_data)
+{
+        struct spi_message *msg = drv_data->cur_msg;
+        struct spi_transfer *trans = drv_data->cur_transfer;
+        /* Move to next transfer */
+        if (trans->transfer_list.next != &msg->transfers) {
+                drv_data->cur_transfer =
+                        list_entry(trans->transfer_list.next,
+                                        struct spi_transfer,
+                                        transfer_list);
+                return RUNNING_STATE;
+        } else
+                return DONE_STATE;
+}
+static int map_dma_buffers(struct driver_data *drv_data)
+{
+        struct spi_message *msg = drv_data->cur_msg;
+        struct device *dev = &msg->spi->dev;
+        if (!drv_data->cur_chip->enable_dma)
+                return 0;
+        if (msg->is_dma_mapped)
+                return  drv_data->rx_dma && drv_data->tx_dma;
+        if (!IS_DMA_ALIGNED(drv_data->rx) || !IS_DMA_ALIGNED(drv_data->tx))
+                return 0;
+        /* Modify setup if rx buffer is null */
+        if (drv_data->rx == NULL) {
+                *drv_data->null_dma_buf = 0;
+                drv_data->rx = drv_data->null_dma_buf;
+                drv_data->rx_map_len = 4;
+        } else
+                drv_data->rx_map_len = drv_data->len;
+        /* Modify setup if tx buffer is null */
+        if (drv_data->tx == NULL) {
+                *drv_data->null_dma_buf = 0;
+                drv_data->tx = drv_data->null_dma_buf;
+                drv_data->tx_map_len = 4;
+        } else
+                drv_data->tx_map_len = drv_data->len;
+        /* Stream map the rx buffer */
+        drv_data->rx_dma = dma_map_single(dev, drv_data->rx,
+                                                drv_data->rx_map_len,
+                                                DMA_FROM_DEVICE);
+        if (dma_mapping_error(drv_data->rx_dma))
+                return 0;
+        /* Stream map the tx buffer */
+        drv_data->tx_dma = dma_map_single(dev, drv_data->tx,
+                                                drv_data->tx_map_len,
+                                                DMA_TO_DEVICE);
+        if (dma_mapping_error(drv_data->tx_dma)) {
+                dma_unmap_single(dev, drv_data->rx_dma,
+                                        drv_data->rx_map_len, DMA_FROM_DEVICE);
+                return 0;
+        }
+        return 1;
+}
+static void unmap_dma_buffers(struct driver_data *drv_data)
+{
+        struct device *dev;
+        if (!drv_data->dma_mapped)
+                return;
+        if (!drv_data->cur_msg->is_dma_mapped) {
+                dev = &drv_data->cur_msg->spi->dev;
+                dma_unmap_single(dev, drv_data->rx_dma,
+                                        drv_data->rx_map_len, DMA_FROM_DEVICE);
+                dma_unmap_single(dev, drv_data->tx_dma,
+                                        drv_data->tx_map_len, DMA_TO_DEVICE);
+        }
+        drv_data->dma_mapped = 0;
+}
+/* caller already set message->status; dma and pio irqs are blocked */
+static void giveback(struct spi_message *message, struct driver_data *drv_data)
+{
+        struct spi_transfer* last_transfer;
+        last_transfer = list_entry(message->transfers.prev,
+                                        struct spi_transfer,
+                                        transfer_list);
+        if (!last_transfer->cs_change)
+                drv_data->cs_control(PXA2XX_CS_DEASSERT);
+        message->state = NULL;
+        if (message->complete)
+                message->complete(message->context);
+        drv_data->cur_msg = NULL;
+        drv_data->cur_transfer = NULL;
+        drv_data->cur_chip = NULL;
+        queue_work(drv_data->workqueue, &drv_data->pump_messages);
+}
+static int wait_ssp_rx_stall(void *ioaddr)
+{
+        unsigned long limit = loops_per_jiffy << 1;
+        while ((read_SSSR(ioaddr) & SSSR_BSY) && limit--)
+                cpu_relax();
+        return limit;
+}
+static int wait_dma_channel_stop(int channel)
+{
+        unsigned long limit = loops_per_jiffy << 1;
+        while (!(DCSR(channel) & DCSR_STOPSTATE) && limit--)
+                cpu_relax();
+        return limit;
+}
+static void dma_handler(int channel, void *data, struct pt_regs *regs)
+{
+        struct driver_data *drv_data = data;
+        struct spi_message *msg = drv_data->cur_msg;
+        void *reg = drv_data->ioaddr;
+        u32 irq_status = DCSR(channel) & DMA_INT_MASK;
+        u32 trailing_sssr = 0;
+        if (irq_status & DCSR_BUSERR) {
+                /* Disable interrupts, clear status and reset DMA */
+                if (drv_data->ssp_type != PXA25x_SSP)
+                        write_SSTO(0, reg);
+                write_SSSR(drv_data->clear_sr, reg);
+                write_SSCR1(read_SSCR1(reg) & ~drv_data->dma_cr1, reg);
+                DCSR(drv_data->rx_channel) = RESET_DMA_CHANNEL;
+                DCSR(drv_data->tx_channel) = RESET_DMA_CHANNEL;
+                if (flush(drv_data) == 0)
+                        dev_err(&drv_data->pdev->dev,
+                                        "dma_handler: flush fail\n");
+                unmap_dma_buffers(drv_data);
+                if (channel == drv_data->tx_channel)
+                        dev_err(&drv_data->pdev->dev,
+                                "dma_handler: bad bus address on "
+                                "tx channel %d, source %x target = %x\n",
+                                channel, DSADR(channel), DTADR(channel));
+                else
+                        dev_err(&drv_data->pdev->dev,
+                                "dma_handler: bad bus address on "
+                                "rx channel %d, source %x target = %x\n",
+                                channel, DSADR(channel), DTADR(channel));
+                msg->state = ERROR_STATE;
+                tasklet_schedule(&drv_data->pump_transfers);
+        }
+        /* PXA255x_SSP has no timeout interrupt, wait for tailing bytes */
+        if ((drv_data->ssp_type == PXA25x_SSP)
+                && (channel == drv_data->tx_channel)
+                && (irq_status & DCSR_ENDINTR)) {
+                /* Wait for rx to stall */
+                if (wait_ssp_rx_stall(drv_data->ioaddr) == 0)
+                        dev_err(&drv_data->pdev->dev,
+                                "dma_handler: ssp rx stall failed\n");
+                /* Clear and disable interrupts on SSP and DMA channels*/
+                write_SSSR(drv_data->clear_sr, reg);
+                write_SSCR1(read_SSCR1(reg) & ~drv_data->dma_cr1, reg);
+                DCSR(drv_data->tx_channel) = RESET_DMA_CHANNEL;
+                DCSR(drv_data->rx_channel) = RESET_DMA_CHANNEL;
+                if (wait_dma_channel_stop(drv_data->rx_channel) == 0)
+                        dev_err(&drv_data->pdev->dev,
+                                "dma_handler: dma rx channel stop failed\n");
+                unmap_dma_buffers(drv_data);
+                /* Read trailing bytes */
+                /* Calculate number of trailing bytes, read them */
+                trailing_sssr = read_SSSR(reg);
+                if ((trailing_sssr & 0xf008) != 0xf000) {
+                        drv_data->rx = drv_data->rx_end -
+                                        (((trailing_sssr >> 12) & 0x0f) + 1);
+                        drv_data->read(drv_data);
+                }
+                msg->actual_length += drv_data->len;
+                /* Release chip select if requested, transfer delays are
+                 * handled in pump_transfers */
+                if (drv_data->cs_change)
+                        drv_data->cs_control(PXA2XX_CS_DEASSERT);
+                /* Move to next transfer */
+                msg->state = next_transfer(drv_data);
+                /* Schedule transfer tasklet */
+                tasklet_schedule(&drv_data->pump_transfers);
+        }
+}
+static irqreturn_t dma_transfer(struct driver_data *drv_data)
+{
+        u32 irq_status;
+        u32 trailing_sssr = 0;
+        struct spi_message *msg = drv_data->cur_msg;
+        void *reg = drv_data->ioaddr;
+        irq_status = read_SSSR(reg) & drv_data->mask_sr;
+        if (irq_status & SSSR_ROR) {
+                /* Clear and disable interrupts on SSP and DMA channels*/
+                if (drv_data->ssp_type != PXA25x_SSP)
+                        write_SSTO(0, reg);
+                write_SSSR(drv_data->clear_sr, reg);
+                write_SSCR1(read_SSCR1(reg) & ~drv_data->dma_cr1, reg);
+                DCSR(drv_data->tx_channel) = RESET_DMA_CHANNEL;
+                DCSR(drv_data->rx_channel) = RESET_DMA_CHANNEL;
+                unmap_dma_buffers(drv_data);
+                if (flush(drv_data) == 0)
+                        dev_err(&drv_data->pdev->dev,
+                                        "dma_transfer: flush fail\n");
+                dev_warn(&drv_data->pdev->dev, "dma_transfer: fifo overun\n");
+                drv_data->cur_msg->state = ERROR_STATE;
+                tasklet_schedule(&drv_data->pump_transfers);
+                return IRQ_HANDLED;
+        }
+        /* Check for false positive timeout */
+        if ((irq_status & SSSR_TINT) && DCSR(drv_data->tx_channel) & DCSR_RUN) {
+                write_SSSR(SSSR_TINT, reg);
+                return IRQ_HANDLED;
+        }
+        if (irq_status & SSSR_TINT || drv_data->rx == drv_data->rx_end) {
+                /* Clear and disable interrupts on SSP and DMA channels*/
+                if (drv_data->ssp_type != PXA25x_SSP)
+                        write_SSTO(0, reg);
+                write_SSSR(drv_data->clear_sr, reg);
+                write_SSCR1(read_SSCR1(reg) & ~drv_data->dma_cr1, reg);
+                DCSR(drv_data->tx_channel) = RESET_DMA_CHANNEL;
+                DCSR(drv_data->rx_channel) = RESET_DMA_CHANNEL;
+                if (wait_dma_channel_stop(drv_data->rx_channel) == 0)
+                        dev_err(&drv_data->pdev->dev,
+                                "dma_transfer: dma rx channel stop failed\n");
+                if (wait_ssp_rx_stall(drv_data->ioaddr) == 0)
+                        dev_err(&drv_data->pdev->dev,
+                                "dma_transfer: ssp rx stall failed\n");
+                unmap_dma_buffers(drv_data);
+                /* Calculate number of trailing bytes, read them */
+                trailing_sssr = read_SSSR(reg);
+                if ((trailing_sssr & 0xf008) != 0xf000) {
+                        drv_data->rx = drv_data->rx_end -
+                                        (((trailing_sssr >> 12) & 0x0f) + 1);
+                        drv_data->read(drv_data);
+                }
+                msg->actual_length += drv_data->len;
+                /* Release chip select if requested, transfer delays are
+                 * handled in pump_transfers */
+                if (drv_data->cs_change)
+                        drv_data->cs_control(PXA2XX_CS_DEASSERT);
+                /* Move to next transfer */
+                msg->state = next_transfer(drv_data);
+                /* Schedule transfer tasklet */
+                tasklet_schedule(&drv_data->pump_transfers);
+                return IRQ_HANDLED;
+        }
+        /* Opps problem detected */
+        return IRQ_NONE;
+}
+static irqreturn_t interrupt_transfer(struct driver_data *drv_data)
+{
+        u32 irq_status;
+        struct spi_message *msg = drv_data->cur_msg;
+        void *reg = drv_data->ioaddr;
+        irqreturn_t handled = IRQ_NONE;
+        unsigned long limit = loops_per_jiffy << 1;
+        while ((irq_status = (read_SSSR(reg) & drv_data->mask_sr))) {
+                if (irq_status & SSSR_ROR) {
+                        /* Clear and disable interrupts */
+                        if (drv_data->ssp_type != PXA25x_SSP)
+                                write_SSTO(0, reg);
+                        write_SSSR(drv_data->clear_sr, reg);
+                        write_SSCR1(read_SSCR1(reg) & ~drv_data->int_cr1, reg);
+                        if (flush(drv_data) == 0)
+                                dev_err(&drv_data->pdev->dev,
+                                        "interrupt_transfer: flush fail\n");
+                        dev_warn(&drv_data->pdev->dev,
+                                        "interrupt_transfer: fifo overun\n");
+                        msg->state = ERROR_STATE;
+                        tasklet_schedule(&drv_data->pump_transfers);
+                        return IRQ_HANDLED;
+                }
+                /* Look for false positive timeout */
+                if ((irq_status & SSSR_TINT)
+                                && (drv_data->rx < drv_data->rx_end))
+                        write_SSSR(SSSR_TINT, reg);
+                /* Pump data */
+                drv_data->read(drv_data);
+                drv_data->write(drv_data);
+                if (drv_data->tx == drv_data->tx_end) {
+                        /* Disable tx interrupt */
+                        write_SSCR1(read_SSCR1(reg) & ~SSCR1_TIE, reg);
+                        /* PXA25x_SSP has no timeout, read trailing bytes */
+                        if (drv_data->ssp_type == PXA25x_SSP) {
+                                while ((read_SSSR(reg) & SSSR_BSY) && limit--)
+                                        drv_data->read(drv_data);
+                                if (limit == 0)
+                                        dev_err(&drv_data->pdev->dev,
+                                                "interrupt_transfer: "
+                                                "trailing byte read failed\n");
+                        }
+                }
+                if ((irq_status & SSSR_TINT)
+                                || (drv_data->rx == drv_data->rx_end)) {
+                        /* Clear timeout */
+                        if (drv_data->ssp_type != PXA25x_SSP)
+                                write_SSTO(0, reg);
+                        write_SSSR(drv_data->clear_sr, reg);
+                        write_SSCR1(read_SSCR1(reg) & ~drv_data->int_cr1, reg);
+                        /* Update total byte transfered */
+                        msg->actual_length += drv_data->len;
+                        /* Release chip select if requested, transfer delays are
+                         * handled in pump_transfers */
+                        if (drv_data->cs_change)
+                                drv_data->cs_control(PXA2XX_CS_DEASSERT);
+                        /* Move to next transfer */
+                        msg->state = next_transfer(drv_data);
+                        /* Schedule transfer tasklet */
+                        tasklet_schedule(&drv_data->pump_transfers);
+                        return IRQ_HANDLED;
+                }
+                /* We did something */
+                handled = IRQ_HANDLED;
+        }
+        return handled;
+}
+static irqreturn_t ssp_int(int irq, void *dev_id, struct pt_regs *regs)
+{
+        struct driver_data *drv_data = (struct driver_data *)dev_id;
+        if (!drv_data->cur_msg) {
+                dev_err(&drv_data->pdev->dev, "bad message state "
+                                "in interrupt handler\n");
+                /* Never fail */
+                return IRQ_HANDLED;
+        }
+        return drv_data->transfer_handler(drv_data);
+}
+static void pump_transfers(unsigned long data)
+{
+        struct driver_data *drv_data = (struct driver_data *)data;
+        struct spi_message *message = NULL;
+        struct spi_transfer *transfer = NULL;
+        struct spi_transfer *previous = NULL;
+        struct chip_data *chip = NULL;
+        void *reg = drv_data->ioaddr;
+        u32 clk_div = 0;
+        u8 bits = 0;
+        u32 speed = 0;
+        u32 cr0;
+        /* Get current state information */
+        message = drv_data->cur_msg;
+        transfer = drv_data->cur_transfer;
+        chip = drv_data->cur_chip;
+        /* Handle for abort */
+        if (message->state == ERROR_STATE) {
+                message->status = -EIO;
+                giveback(message, drv_data);
+                return;
+        }
+        /* Handle end of message */
+        if (message->state == DONE_STATE) {
+                message->status = 0;
+                giveback(message, drv_data);
+                return;
+        }
+        /* Delay if requested at end of transfer*/
+        if (message->state == RUNNING_STATE) {
+                previous = list_entry(transfer->transfer_list.prev,
+                                        struct spi_transfer,
+                                        transfer_list);
+                if (previous->delay_usecs)
+                        udelay(previous->delay_usecs);
+        }
+        /* Setup the transfer state based on the type of transfer */
+        if (flush(drv_data) == 0) {
+                dev_err(&drv_data->pdev->dev, "pump_transfers: flush failed\n");
+                message->status = -EIO;
+                giveback(message, drv_data);
+                return;
+        }
+        drv_data->n_bytes = chip->n_bytes;
+        drv_data->dma_width = chip->dma_width;
+        drv_data->cs_control = chip->cs_control;
+        drv_data->tx = (void *)transfer->tx_buf;
+        drv_data->tx_end = drv_data->tx + transfer->len;
+        drv_data->rx = transfer->rx_buf;
+        drv_data->rx_end = drv_data->rx + transfer->len;
+        drv_data->rx_dma = transfer->rx_dma;
+        drv_data->tx_dma = transfer->tx_dma;
+        drv_data->len = transfer->len;
+        drv_data->write = drv_data->tx ? chip->write : null_writer;
+        drv_data->read = drv_data->rx ? chip->read : null_reader;
+        drv_data->cs_change = transfer->cs_change;
+        /* Change speed and bit per word on a per transfer */
+        if (transfer->speed_hz || transfer->bits_per_word) {
+                /* Disable clock */
+                write_SSCR0(chip->cr0 & ~SSCR0_SSE, reg);
+                cr0 = chip->cr0;
+                bits = chip->bits_per_word;
+                speed = chip->speed_hz;
+                if (transfer->speed_hz)
+                        speed = transfer->speed_hz;
+                if (transfer->bits_per_word)
+                        bits = transfer->bits_per_word;
+                if (reg == SSP1_VIRT)
+                        clk_div = SSP1_SerClkDiv(speed);
+                else if (reg == SSP2_VIRT)
+                        clk_div = SSP2_SerClkDiv(speed);
+                else if (reg == SSP3_VIRT)
+                        clk_div = SSP3_SerClkDiv(speed);
+                if (bits <= 8) {
+                        drv_data->n_bytes = 1;
+                        drv_data->dma_width = DCMD_WIDTH1;
+                        drv_data->read = drv_data->read != null_reader ?
+                                                u8_reader : null_reader;
+                        drv_data->write = drv_data->write != null_writer ?
+                                                u8_writer : null_writer;
+                } else if (bits <= 16) {
+                        drv_data->n_bytes = 2;
+                        drv_data->dma_width = DCMD_WIDTH2;
+                        drv_data->read = drv_data->read != null_reader ?
+                                                u16_reader : null_reader;
+                        drv_data->write = drv_data->write != null_writer ?
+                                                u16_writer : null_writer;
+                } else if (bits <= 32) {
+                        drv_data->n_bytes = 4;
+                        drv_data->dma_width = DCMD_WIDTH4;
+                        drv_data->read = drv_data->read != null_reader ?
+                                                u32_reader : null_reader;
+                        drv_data->write = drv_data->write != null_writer ?
+                                                u32_writer : null_writer;
+                }
+                cr0 = clk_div
+                        | SSCR0_Motorola
+                        | SSCR0_DataSize(bits & 0x0f)
+                        | SSCR0_SSE
+                        | (bits > 16 ? SSCR0_EDSS : 0);
+                /* Start it back up */
+                write_SSCR0(cr0, reg);
+        }
+        message->state = RUNNING_STATE;
+        /* Try to map dma buffer and do a dma transfer if successful */
+        if ((drv_data->dma_mapped = map_dma_buffers(drv_data))) {
+                /* Ensure we have the correct interrupt handler */
+                drv_data->transfer_handler = dma_transfer;
+                /* Setup rx DMA Channel */
+                DCSR(drv_data->rx_channel) = RESET_DMA_CHANNEL;
+                DSADR(drv_data->rx_channel) = drv_data->ssdr_physical;
+                DTADR(drv_data->rx_channel) = drv_data->rx_dma;
+                if (drv_data->rx == drv_data->null_dma_buf)
+                        /* No target address increment */
+                        DCMD(drv_data->rx_channel) = DCMD_FLOWSRC
+                                                        | drv_data->dma_width
+                                                        | chip->dma_burst_size
+                                                        | drv_data->len;
+                else
+                        DCMD(drv_data->rx_channel) = DCMD_INCTRGADDR
+                                                        | DCMD_FLOWSRC
+                                                        | drv_data->dma_width
+                                                        | chip->dma_burst_size
+                                                        | drv_data->len;
+                /* Setup tx DMA Channel */
+                DCSR(drv_data->tx_channel) = RESET_DMA_CHANNEL;
+                DSADR(drv_data->tx_channel) = drv_data->tx_dma;
+                DTADR(drv_data->tx_channel) = drv_data->ssdr_physical;
+                if (drv_data->tx == drv_data->null_dma_buf)
+                        /* No source address increment */
+                        DCMD(drv_data->tx_channel) = DCMD_FLOWTRG
+                                                        | drv_data->dma_width
+                                                        | chip->dma_burst_size
+                                                        | drv_data->len;
+                else
+                        DCMD(drv_data->tx_channel) = DCMD_INCSRCADDR
+                                                        | DCMD_FLOWTRG
+                                                        | drv_data->dma_width
+                                                        | chip->dma_burst_size
+                                                        | drv_data->len;
+                /* Enable dma end irqs on SSP to detect end of transfer */
+                if (drv_data->ssp_type == PXA25x_SSP)
+                        DCMD(drv_data->tx_channel) |= DCMD_ENDIRQEN;
+                /* Fix me, need to handle cs polarity */
+                drv_data->cs_control(PXA2XX_CS_ASSERT);
+                /* Go baby, go */
+                write_SSSR(drv_data->clear_sr, reg);
+                DCSR(drv_data->rx_channel) |= DCSR_RUN;
+                DCSR(drv_data->tx_channel) |= DCSR_RUN;
+                if (drv_data->ssp_type != PXA25x_SSP)
+                        write_SSTO(chip->timeout, reg);
+                write_SSCR1(chip->cr1
+                                | chip->dma_threshold
+                                | drv_data->dma_cr1,
+                                reg);
+        } else {
+                /* Ensure we have the correct interrupt handler */
+                drv_data->transfer_handler = interrupt_transfer;
+                /* Fix me, need to handle cs polarity */
+                drv_data->cs_control(PXA2XX_CS_ASSERT);
+                /* Go baby, go */
+                write_SSSR(drv_data->clear_sr, reg);
+                if (drv_data->ssp_type != PXA25x_SSP)
+                        write_SSTO(chip->timeout, reg);
+                write_SSCR1(chip->cr1
+                                | chip->threshold
+                                | drv_data->int_cr1,
+                                reg);
+        }
+}
+static void pump_messages(void *data)
+{
+        struct driver_data *drv_data = data;
+        unsigned long flags;
+        /* Lock queue and check for queue work */
+        spin_lock_irqsave(&drv_data->lock, flags);
+        if (list_empty(&drv_data->queue) || drv_data->run == QUEUE_STOPPED) {
+                drv_data->busy = 0;
+                spin_unlock_irqrestore(&drv_data->lock, flags);
+                return;
+        }
+        /* Make sure we are not already running a message */
+        if (drv_data->cur_msg) {
+                spin_unlock_irqrestore(&drv_data->lock, flags);
+                return;
+        }
+        /* Extract head of queue */
+        drv_data->cur_msg = list_entry(drv_data->queue.next,
+                                        struct spi_message, queue);
+        list_del_init(&drv_data->cur_msg->queue);
+        drv_data->busy = 1;
+        spin_unlock_irqrestore(&drv_data->lock, flags);
+        /* Initial message state*/
+        drv_data->cur_msg->state = START_STATE;
+        drv_data->cur_transfer = list_entry(drv_data->cur_msg->transfers.next,
+                                                struct spi_transfer,
+                                                transfer_list);
+        /* Setup the SSP using the per chip configuration */
+        drv_data->cur_chip = spi_get_ctldata(drv_data->cur_msg->spi);
+        restore_state(drv_data);
+        /* Mark as busy and launch transfers */
+        tasklet_schedule(&drv_data->pump_transfers);
+}
+static int transfer(struct spi_device *spi, struct spi_message *msg)
+{
+        struct driver_data *drv_data = spi_master_get_devdata(spi->master);
+        unsigned long flags;
+        spin_lock_irqsave(&drv_data->lock, flags);
+        if (drv_data->run == QUEUE_STOPPED) {
+                spin_unlock_irqrestore(&drv_data->lock, flags);
+                return -ESHUTDOWN;
+        }
+        msg->actual_length = 0;
+        msg->status = -EINPROGRESS;
+        msg->state = START_STATE;
+        list_add_tail(&msg->queue, &drv_data->queue);
+        if (drv_data->run == QUEUE_RUNNING && !drv_data->busy)
+                queue_work(drv_data->workqueue, &drv_data->pump_messages);
+        spin_unlock_irqrestore(&drv_data->lock, flags);
+        return 0;
+}
+static int setup(struct spi_device *spi)
+{
+        struct pxa2xx_spi_chip *chip_info = NULL;
+        struct chip_data *chip;
+        struct driver_data *drv_data = spi_master_get_devdata(spi->master);
+        unsigned int clk_div;
+        if (!spi->bits_per_word)
+                spi->bits_per_word = 8;
+        if (drv_data->ssp_type != PXA25x_SSP
+                        && (spi->bits_per_word < 4 || spi->bits_per_word > 32))
+                return -EINVAL;
+        else if (spi->bits_per_word < 4 || spi->bits_per_word > 16)
+                return -EINVAL;
+        /* Only alloc (or use chip_info) on first setup */
+        chip = spi_get_ctldata(spi);
+        if (chip == NULL) {
+                chip = kzalloc(sizeof(struct chip_data), GFP_KERNEL);
+                if (!chip)
+                        return -ENOMEM;
+                chip->cs_control = null_cs_control;
+                chip->enable_dma = 0;
+                chip->timeout = 5;
+                chip->threshold = SSCR1_RxTresh(1) | SSCR1_TxTresh(1);
+                chip->dma_burst_size = drv_data->master_info->enable_dma ?
+                                        DCMD_BURST8 : 0;
+                chip_info = spi->controller_data;
+        }
+        /* chip_info isn't always needed */
+        if (chip_info) {
+                if (chip_info->cs_control)
+                        chip->cs_control = chip_info->cs_control;
+                chip->timeout = (chip_info->timeout_microsecs * 10000) / 2712;
+                chip->threshold = SSCR1_RxTresh(chip_info->rx_threshold)
+                                        | SSCR1_TxTresh(chip_info->tx_threshold);
+                chip->enable_dma = chip_info->dma_burst_size != 0
+                                        && drv_data->master_info->enable_dma;
+                chip->dma_threshold = 0;
+                if (chip->enable_dma) {
+                        if (chip_info->dma_burst_size <= 8) {
+                                chip->dma_threshold = SSCR1_RxTresh(8)
+                                                        | SSCR1_TxTresh(8);
+                                chip->dma_burst_size = DCMD_BURST8;
+                        } else if (chip_info->dma_burst_size <= 16) {
+                                chip->dma_threshold = SSCR1_RxTresh(16)
+                                                        | SSCR1_TxTresh(16);
+                                chip->dma_burst_size = DCMD_BURST16;
+                        } else {
+                                chip->dma_threshold = SSCR1_RxTresh(32)
+                                                        | SSCR1_TxTresh(32);
+                                chip->dma_burst_size = DCMD_BURST32;
+                        }
+                }
+                if (chip_info->enable_loopback)
+                        chip->cr1 = SSCR1_LBM;
+        }
+        if (drv_data->ioaddr == SSP1_VIRT)
+                clk_div = SSP1_SerClkDiv(spi->max_speed_hz);
+        else if (drv_data->ioaddr == SSP2_VIRT)
+                clk_div = SSP2_SerClkDiv(spi->max_speed_hz);
+        else if (drv_data->ioaddr == SSP3_VIRT)
+                clk_div = SSP3_SerClkDiv(spi->max_speed_hz);
+        else
+                return -ENODEV;
+        chip->speed_hz = spi->max_speed_hz;
+        chip->cr0 = clk_div
+                        | SSCR0_Motorola
+                        | SSCR0_DataSize(spi->bits_per_word & 0x0f)
+                        | SSCR0_SSE
+                        | (spi->bits_per_word > 16 ? SSCR0_EDSS : 0);
+        chip->cr1 |= (((spi->mode & SPI_CPHA) != 0) << 4)
+                        | (((spi->mode & SPI_CPOL) != 0) << 3);
+        /* NOTE:  PXA25x_SSP _could_ use external clocking ... */
+        if (drv_data->ssp_type != PXA25x_SSP)
+                dev_dbg(&spi->dev, "%d bits/word, %d Hz, mode %d\n",
+                                spi->bits_per_word,
+                                (CLOCK_SPEED_HZ)
+                                        / (1 + ((chip->cr0 & SSCR0_SCR) >> 8)),
+                                spi->mode & 0x3);
+        else
+                dev_dbg(&spi->dev, "%d bits/word, %d Hz, mode %d\n",
+                                spi->bits_per_word,
+                                (CLOCK_SPEED_HZ/2)
+                                        / (1 + ((chip->cr0 & SSCR0_SCR) >> 8)),
+                                spi->mode & 0x3);
+        if (spi->bits_per_word <= 8) {
+                chip->n_bytes = 1;
+                chip->dma_width = DCMD_WIDTH1;
+                chip->read = u8_reader;
+                chip->write = u8_writer;
+        } else if (spi->bits_per_word <= 16) {
+                chip->n_bytes = 2;
+                chip->dma_width = DCMD_WIDTH2;
+                chip->read = u16_reader;
+                chip->write = u16_writer;
+        } else if (spi->bits_per_word <= 32) {
+                chip->cr0 |= SSCR0_EDSS;
+                chip->n_bytes = 4;
+                chip->dma_width = DCMD_WIDTH4;
+                chip->read = u32_reader;
+                chip->write = u32_writer;
+        } else {
+                dev_err(&spi->dev, "invalid wordsize\n");
+                kfree(chip);
+                return -ENODEV;
+        }
+        chip->bits_per_word = spi->bits_per_word;
+        spi_set_ctldata(spi, chip);
+        return 0;
+}
+static void cleanup(const struct spi_device *spi)
+{
+        struct chip_data *chip = spi_get_ctldata((struct spi_device *)spi);
+        kfree(chip);
+}
+static int init_queue(struct driver_data *drv_data)
+{
+        INIT_LIST_HEAD(&drv_data->queue);
+        spin_lock_init(&drv_data->lock);
+        drv_data->run = QUEUE_STOPPED;
+        drv_data->busy = 0;
+        tasklet_init(&drv_data->pump_transfers,
+                        pump_transfers, (unsigned long)drv_data);
+        INIT_WORK(&drv_data->pump_messages, pump_messages, drv_data);
+        drv_data->workqueue = create_singlethread_workqueue(
+                                        drv_data->master->cdev.dev->bus_id);
+        if (drv_data->workqueue == NULL)
+                return -EBUSY;
+        return 0;
+}
+static int start_queue(struct driver_data *drv_data)
+{
+        unsigned long flags;
+        spin_lock_irqsave(&drv_data->lock, flags);
+        if (drv_data->run == QUEUE_RUNNING || drv_data->busy) {
+                spin_unlock_irqrestore(&drv_data->lock, flags);
+                return -EBUSY;
+        }
+        drv_data->run = QUEUE_RUNNING;
+        drv_data->cur_msg = NULL;
+        drv_data->cur_transfer = NULL;
+        drv_data->cur_chip = NULL;
+        spin_unlock_irqrestore(&drv_data->lock, flags);
+        queue_work(drv_data->workqueue, &drv_data->pump_messages);
+        return 0;
+}
+static int stop_queue(struct driver_data *drv_data)
+{
+        unsigned long flags;
+        unsigned limit = 500;
+        int status = 0;
+        spin_lock_irqsave(&drv_data->lock, flags);
+        /* This is a bit lame, but is optimized for the common execution path.
+         * A wait_queue on the drv_data->busy could be used, but then the common
+         * execution path (pump_messages) would be required to call wake_up or
+         * friends on every SPI message. Do this instead */
+        drv_data->run = QUEUE_STOPPED;
+        while (!list_empty(&drv_data->queue) && drv_data->busy && limit--) {
+                spin_unlock_irqrestore(&drv_data->lock, flags);
+                msleep(10);
+                spin_lock_irqsave(&drv_data->lock, flags);
+        }
+        if (!list_empty(&drv_data->queue) || drv_data->busy)
+                status = -EBUSY;
+        spin_unlock_irqrestore(&drv_data->lock, flags);
+        return status;
+}
+static int destroy_queue(struct driver_data *drv_data)
+{
+        int status;
+        status = stop_queue(drv_data);
+        if (status != 0)
+                return status;
+        destroy_workqueue(drv_data->workqueue);
+        return 0;
+}
+static int pxa2xx_spi_probe(struct platform_device *pdev)
+{
+        struct device *dev = &pdev->dev;
+        struct pxa2xx_spi_master *platform_info;
+        struct spi_master *master;
+        struct driver_data *drv_data = 0;
+        struct resource *memory_resource;
+        int irq;
+        int status = 0;
+        platform_info = dev->platform_data;
+        if (platform_info->ssp_type == SSP_UNDEFINED) {
+                dev_err(&pdev->dev, "undefined SSP\n");
+                return -ENODEV;
+        }
+        /* Allocate master with space for drv_data and null dma buffer */
+        master = spi_alloc_master(dev, sizeof(struct driver_data) + 16);
+        if (!master) {
+                dev_err(&pdev->dev, "can not alloc spi_master\n");
+                return -ENOMEM;
+        }
+        drv_data = spi_master_get_devdata(master);
+        drv_data->master = master;
+        drv_data->master_info = platform_info;
+        drv_data->pdev = pdev;
+        master->bus_num = pdev->id;
+        master->num_chipselect = platform_info->num_chipselect;
+        master->cleanup = cleanup;
+        master->setup = setup;
+        master->transfer = transfer;
+        drv_data->ssp_type = platform_info->ssp_type;
+        drv_data->null_dma_buf = (u32 *)ALIGN((u32)(drv_data +
+                                                sizeof(struct driver_data)), 8);
+        /* Setup register addresses */
+        memory_resource = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+        if (!memory_resource) {
+                dev_err(&pdev->dev, "memory resources not defined\n");
+                status = -ENODEV;
+                goto out_error_master_alloc;
+        }
+        drv_data->ioaddr = (void *)io_p2v(memory_resource->start);
+        drv_data->ssdr_physical = memory_resource->start + 0x00000010;
+        if (platform_info->ssp_type == PXA25x_SSP) {
+                drv_data->int_cr1 = SSCR1_TIE | SSCR1_RIE;
+                drv_data->dma_cr1 = 0;
+                drv_data->clear_sr = SSSR_ROR;
+                drv_data->mask_sr = SSSR_RFS | SSSR_TFS | SSSR_ROR;
+        } else {
+                drv_data->int_cr1 = SSCR1_TIE | SSCR1_RIE | SSCR1_TINTE;
+                drv_data->dma_cr1 = SSCR1_TSRE | SSCR1_RSRE | SSCR1_TINTE;
+                drv_data->clear_sr = SSSR_ROR | SSSR_TINT;
+                drv_data->mask_sr = SSSR_TINT | SSSR_RFS | SSSR_TFS | SSSR_ROR;
+        }
+        /* Attach to IRQ */
+        irq = platform_get_irq(pdev, 0);
+        if (irq < 0) {
+                dev_err(&pdev->dev, "irq resource not defined\n");
+                status = -ENODEV;
+                goto out_error_master_alloc;
+        }
+        status = request_irq(irq, ssp_int, SA_INTERRUPT, dev->bus_id, drv_data);
+        if (status < 0) {
+                dev_err(&pdev->dev, "can not get IRQ\n");
+                goto out_error_master_alloc;
+        }
+        /* Setup DMA if requested */
+        drv_data->tx_channel = -1;
+        drv_data->rx_channel = -1;
+        if (platform_info->enable_dma) {
+                /* Get two DMA channels (rx and tx) */
+                drv_data->rx_channel = pxa_request_dma("pxa2xx_spi_ssp_rx",
+                                                        DMA_PRIO_HIGH,
+                                                        dma_handler,
+                                                        drv_data);
+                if (drv_data->rx_channel < 0) {
+                        dev_err(dev, "problem (%d) requesting rx channel\n",
+                                drv_data->rx_channel);
+                        status = -ENODEV;
+                        goto out_error_irq_alloc;
+                }
+                drv_data->tx_channel = pxa_request_dma("pxa2xx_spi_ssp_tx",
+                                                        DMA_PRIO_MEDIUM,
+                                                        dma_handler,
+                                                        drv_data);
+                if (drv_data->tx_channel < 0) {
+                        dev_err(dev, "problem (%d) requesting tx channel\n",
+                                drv_data->tx_channel);
+                        status = -ENODEV;
+                        goto out_error_dma_alloc;
+                }
+                if (drv_data->ioaddr == SSP1_VIRT) {
+                                DRCMRRXSSDR = DRCMR_MAPVLD
+                                                | drv_data->rx_channel;
+                                DRCMRTXSSDR = DRCMR_MAPVLD
+                                                | drv_data->tx_channel;
+                } else if (drv_data->ioaddr == SSP2_VIRT) {
+                                DRCMRRXSS2DR = DRCMR_MAPVLD
+                                                | drv_data->rx_channel;
+                                DRCMRTXSS2DR = DRCMR_MAPVLD
+                                                | drv_data->tx_channel;
+                } else if (drv_data->ioaddr == SSP3_VIRT) {
+                                DRCMRRXSS3DR = DRCMR_MAPVLD
+                                                | drv_data->rx_channel;
+                                DRCMRTXSS3DR = DRCMR_MAPVLD
+                                                | drv_data->tx_channel;
+                } else {
+                        dev_err(dev, "bad SSP type\n");
+                        goto out_error_dma_alloc;
+                }
+        }
+        /* Enable SOC clock */
+        pxa_set_cken(platform_info->clock_enable, 1);
+        /* Load default SSP configuration */
+        write_SSCR0(0, drv_data->ioaddr);
+        write_SSCR1(SSCR1_RxTresh(4) | SSCR1_TxTresh(12), drv_data->ioaddr);
+        write_SSCR0(SSCR0_SerClkDiv(2)
+                        | SSCR0_Motorola
+                        | SSCR0_DataSize(8),
+                        drv_data->ioaddr);
+        if (drv_data->ssp_type != PXA25x_SSP)
+                write_SSTO(0, drv_data->ioaddr);
+        write_SSPSP(0, drv_data->ioaddr);
+        /* Initial and start queue */
+        status = init_queue(drv_data);
+        if (status != 0) {
+                dev_err(&pdev->dev, "problem initializing queue\n");
+                goto out_error_clock_enabled;
+        }
+        status = start_queue(drv_data);
+        if (status != 0) {
+                dev_err(&pdev->dev, "problem starting queue\n");
+                goto out_error_clock_enabled;
+        }
+        /* Register with the SPI framework */
+        platform_set_drvdata(pdev, drv_data);
+        status = spi_register_master(master);
+        if (status != 0) {
+                dev_err(&pdev->dev, "problem registering spi master\n");
+                goto out_error_queue_alloc;
+        }
+        return status;
+out_error_queue_alloc:
+        destroy_queue(drv_data);
+out_error_clock_enabled:
+        pxa_set_cken(platform_info->clock_enable, 0);
+out_error_dma_alloc:
+        if (drv_data->tx_channel != -1)
+                pxa_free_dma(drv_data->tx_channel);
+        if (drv_data->rx_channel != -1)
+                pxa_free_dma(drv_data->rx_channel);
+out_error_irq_alloc:
+        free_irq(irq, drv_data);
+out_error_master_alloc:
+        spi_master_put(master);
+        return status;
+}
+static int pxa2xx_spi_remove(struct platform_device *pdev)
+{
+        struct driver_data *drv_data = platform_get_drvdata(pdev);
+        int irq;
+        int status = 0;
+        if (!drv_data)
+                return 0;
+        /* Remove the queue */
+        status = destroy_queue(drv_data);
+        if (status != 0)
+                return status;
+        /* Disable the SSP at the peripheral and SOC level */
+        write_SSCR0(0, drv_data->ioaddr);
+        pxa_set_cken(drv_data->master_info->clock_enable, 0);
+        /* Release DMA */
+        if (drv_data->master_info->enable_dma) {
+                if (drv_data->ioaddr == SSP1_VIRT) {
+                        DRCMRRXSSDR = 0;
+                        DRCMRTXSSDR = 0;
+                } else if (drv_data->ioaddr == SSP2_VIRT) {
+                        DRCMRRXSS2DR = 0;
+                        DRCMRTXSS2DR = 0;
+                } else if (drv_data->ioaddr == SSP3_VIRT) {
+                        DRCMRRXSS3DR = 0;
+                        DRCMRTXSS3DR = 0;
+                }
+                pxa_free_dma(drv_data->tx_channel);
+                pxa_free_dma(drv_data->rx_channel);
+        }
+        /* Release IRQ */
+        irq = platform_get_irq(pdev, 0);
+        if (irq >= 0)
+                free_irq(irq, drv_data);
+        /* Disconnect from the SPI framework */
+        spi_unregister_master(drv_data->master);
+        /* Prevent double remove */
+        platform_set_drvdata(pdev, NULL);
+        return 0;
+}
+static void pxa2xx_spi_shutdown(struct platform_device *pdev)
+{
+        int status = 0;
+        if ((status = pxa2xx_spi_remove(pdev)) != 0)
+                dev_err(&pdev->dev, "shutdown failed with %d\n", status);
+}
+#ifdef CONFIG_PM
+static int suspend_devices(struct device *dev, void *pm_message)
+{
+        pm_message_t *state = pm_message;
+        if (dev->power.power_state.event != state->event) {
+                dev_warn(dev, "pm state does not match request\n");
+                return -1;
+        }
+        return 0;
+}
+static int pxa2xx_spi_suspend(struct platform_device *pdev, pm_message_t state)
+{
+        struct driver_data *drv_data = platform_get_drvdata(pdev);
+        int status = 0;
+        /* Check all childern for current power state */
+        if (device_for_each_child(&pdev->dev, &state, suspend_devices) != 0) {
+                dev_warn(&pdev->dev, "suspend aborted\n");
+                return -1;
+        }
+        status = stop_queue(drv_data);
+        if (status != 0)
+                return status;
+        write_SSCR0(0, drv_data->ioaddr);
+        pxa_set_cken(drv_data->master_info->clock_enable, 0);
+        return 0;
+}
+static int pxa2xx_spi_resume(struct platform_device *pdev)
+{
+        struct driver_data *drv_data = platform_get_drvdata(pdev);
+        int status = 0;
+        /* Enable the SSP clock */
+        pxa_set_cken(drv_data->master_info->clock_enable, 1);
+        /* Start the queue running */
+        status = start_queue(drv_data);
+        if (status != 0) {
+                dev_err(&pdev->dev, "problem starting queue (%d)\n", status);
+                return status;
+        }
+        return 0;
+}
+#else
+#define pxa2xx_spi_suspend NULL
+#define pxa2xx_spi_resume NULL
+#endif /* CONFIG_PM */
+static struct platform_driver driver = {
+        .driver = {
+                .name = "pxa2xx-spi",
+                .bus = &platform_bus_type,
+                .owner = THIS_MODULE,
+        },
+        .probe = pxa2xx_spi_probe,
+        .remove = __devexit_p(pxa2xx_spi_remove),
+        .shutdown = pxa2xx_spi_shutdown,
+        .suspend = pxa2xx_spi_suspend,
+        .resume = pxa2xx_spi_resume,
+};
+static int __init pxa2xx_spi_init(void)
+{
+        platform_driver_register(&driver);
+        return 0;
+}
+module_init(pxa2xx_spi_init);
+static void __exit pxa2xx_spi_exit(void)
+{
+        platform_driver_unregister(&driver);
+}
+module_exit(pxa2xx_spi_exit);
diff --git a/drivers/spi/spi.c b/drivers/spi/spi.c
index 94f5e8ed83a7..7a3f733051e9 100644
--- a/drivers/spi/spi.c
+++ b/drivers/spi/spi.c
@@ -395,7 +395,7 @@ EXPORT_SYMBOL_GPL(spi_alloc_master);
 int __init_or_module
 spi_register_master(struct spi_master *master)
 {
-        static atomic_t         dyn_bus_id = ATOMIC_INIT(0);
+        static atomic_t         dyn_bus_id = ATOMIC_INIT((1<<16) - 1);
        struct device           *dev = master->cdev.dev;
        int                     status = -ENODEV;
        int                     dynamic = 0;
@@ -404,7 +404,7 @@ spi_register_master(struct spi_master *master)
                return -ENODEV;
        /* convention:  dynamically assigned bus IDs count down from the max */
-        if (master->bus_num == 0) {
+        if (master->bus_num < 0) {
                master->bus_num = atomic_dec_return(&dyn_bus_id);
                dynamic = 1;
        }
@@ -522,7 +522,8 @@ int spi_sync(struct spi_device *spi, struct spi_message *message)
 }
 EXPORT_SYMBOL_GPL(spi_sync);
-#define SPI_BUFSIZ      (SMP_CACHE_BYTES)
+/* portable code must never pass more than 32 bytes */
+#define SPI_BUFSIZ      max(32,SMP_CACHE_BYTES)
 static u8       *buf;
diff --git a/drivers/spi/spi_bitbang.c b/drivers/spi/spi_bitbang.c
index f037e5593269..dd2f950b21a7 100644
--- a/drivers/spi/spi_bitbang.c
+++ b/drivers/spi/spi_bitbang.c
@@ -138,6 +138,45 @@ static unsigned bitbang_txrx_32(
        return t->len - count;
 }
+int spi_bitbang_setup_transfer(struct spi_device *spi, struct spi_transfer *t)
+{
+        struct spi_bitbang_cs   *cs = spi->controller_state;
+        u8                      bits_per_word;
+        u32                     hz;
+        if (t) {
+                bits_per_word = t->bits_per_word;
+                hz = t->speed_hz;
+        } else {
+                bits_per_word = 0;
+                hz = 0;
+        }
+        /* spi_transfer level calls that work per-word */
+        if (!bits_per_word)
+                bits_per_word = spi->bits_per_word;
+        if (bits_per_word <= 8)
+                cs->txrx_bufs = bitbang_txrx_8;
+        else if (bits_per_word <= 16)
+                cs->txrx_bufs = bitbang_txrx_16;
+        else if (bits_per_word <= 32)
+                cs->txrx_bufs = bitbang_txrx_32;
+        else
+                return -EINVAL;
+        /* nsecs = (clock period)/2 */
+        if (!hz)
+                hz = spi->max_speed_hz;
+        if (hz) {
+                cs->nsecs = (1000000000/2) / hz;
+                if (cs->nsecs > (MAX_UDELAY_MS * 1000 * 1000))
+                        return -EINVAL;
+        }
+        return 0;
+}
+EXPORT_SYMBOL_GPL(spi_bitbang_setup_transfer);
 /**
 * spi_bitbang_setup - default setup for per-word I/O loops
 */
@@ -145,8 +184,16 @@ int spi_bitbang_setup(struct spi_device *spi)
 {
        struct spi_bitbang_cs   *cs = spi->controller_state;
        struct spi_bitbang      *bitbang;
+        int                     retval;
-        if (!spi->max_speed_hz)
+        bitbang = spi_master_get_devdata(spi->master);
+        /* REVISIT: some systems will want to support devices using lsb-first
+         * bit encodings on the wire.  In pure software that would be trivial,
+         * just bitbang_txrx_le_cphaX() routines shifting the other way, and
+         * some hardware controllers also have this support.
+         */
+        if ((spi->mode & SPI_LSB_FIRST) != 0)
                return -EINVAL;
        if (!cs) {
@@ -155,32 +202,20 @@ int spi_bitbang_setup(struct spi_device *spi)
                        return -ENOMEM;
                spi->controller_state = cs;
        }
-        bitbang = spi_master_get_devdata(spi->master);
        if (!spi->bits_per_word)
                spi->bits_per_word = 8;
-        /* spi_transfer level calls that work per-word */
-        if (spi->bits_per_word <= 8)
-                cs->txrx_bufs = bitbang_txrx_8;
-        else if (spi->bits_per_word <= 16)
-                cs->txrx_bufs = bitbang_txrx_16;
-        else if (spi->bits_per_word <= 32)
-                cs->txrx_bufs = bitbang_txrx_32;
-        else
-                return -EINVAL;
        /* per-word shift register access, in hardware or bitbanging */
        cs->txrx_word = bitbang->txrx_word[spi->mode & (SPI_CPOL|SPI_CPHA)];
        if (!cs->txrx_word)
                return -EINVAL;
-        /* nsecs = (clock period)/2 */
+        retval = spi_bitbang_setup_transfer(spi, NULL);
-        cs->nsecs = (1000000000/2) / (spi->max_speed_hz);
+        if (retval < 0)
-        if (cs->nsecs > MAX_UDELAY_MS * 1000)
+                return retval;
-                return -EINVAL;
-        dev_dbg(&spi->dev, "%s, mode %d, %u bits/w, %u nsec\n",
+        dev_dbg(&spi->dev, "%s, mode %d, %u bits/w, %u nsec/bit\n",
                        __FUNCTION__, spi->mode & (SPI_CPOL | SPI_CPHA),
                        spi->bits_per_word, 2 * cs->nsecs);
@@ -246,6 +281,8 @@ static void bitbang_work(void *_bitbang)
                unsigned                tmp;
                unsigned                cs_change;
                int                     status;
+                int                     (*setup_transfer)(struct spi_device *,
+                                                struct spi_transfer *);
                m = container_of(bitbang->queue.next, struct spi_message,
                                queue);
@@ -262,6 +299,7 @@ static void bitbang_work(void *_bitbang)
                tmp = 0;
                cs_change = 1;
                status = 0;
+                setup_transfer = NULL;
                list_for_each_entry (t, &m->transfers, transfer_list) {
                        if (bitbang->shutdown) {
@@ -269,6 +307,20 @@ static void bitbang_work(void *_bitbang)
                                break;
                        }
+                        /* override or restore speed and wordsize */
+                        if (t->speed_hz || t->bits_per_word) {
+                                setup_transfer = bitbang->setup_transfer;
+                                if (!setup_transfer) {
+                                        status = -ENOPROTOOPT;
+                                        break;
+                                }
+                        }
+                        if (setup_transfer) {
+                                status = setup_transfer(spi, t);
+                                if (status < 0)
+                                        break;
+                        }
                        /* set up default clock polarity, and activate chip;
                         * this implicitly updates clock and spi modes as
                         * previously recorded for this device via setup().
@@ -325,6 +377,10 @@ static void bitbang_work(void *_bitbang)
                m->status = status;
                m->complete(m->context);
+                /* restore speed and wordsize */
+                if (setup_transfer)
+                        setup_transfer(spi, NULL);
                /* normally deactivate chipselect ... unless no error and
                 * cs_change has hinted that the next message will probably
                 * be for this chip too.
@@ -348,6 +404,7 @@ int spi_bitbang_transfer(struct spi_device *spi, struct spi_message *m)
 {
        struct spi_bitbang      *bitbang;
        unsigned long           flags;
+        int                     status = 0;
        m->actual_length = 0;
        m->status = -EINPROGRESS;
@@ -357,11 +414,15 @@ int spi_bitbang_transfer(struct spi_device *spi, struct spi_message *m)
                return -ESHUTDOWN;
        spin_lock_irqsave(&bitbang->lock, flags);
-        list_add_tail(&m->queue, &bitbang->queue);
+        if (!spi->max_speed_hz)
-        queue_work(bitbang->workqueue, &bitbang->work);
+                status = -ENETDOWN;
+        else {
+                list_add_tail(&m->queue, &bitbang->queue);
+                queue_work(bitbang->workqueue, &bitbang->work);
+        }
        spin_unlock_irqrestore(&bitbang->lock, flags);
-        return 0;
+        return status;
 }
 EXPORT_SYMBOL_GPL(spi_bitbang_transfer);
@@ -406,6 +467,9 @@ int spi_bitbang_start(struct spi_bitbang *bitbang)
                bitbang->use_dma = 0;
                bitbang->txrx_bufs = spi_bitbang_bufs;
                if (!bitbang->master->setup) {
+                        if (!bitbang->setup_transfer)
+                                bitbang->setup_transfer =
+                                         spi_bitbang_setup_transfer;
                        bitbang->master->setup = spi_bitbang_setup;
                        bitbang->master->cleanup = spi_bitbang_cleanup;
                }
diff --git a/drivers/video/backlight/backlight.c b/drivers/video/backlight/backlight.c
index 334b1db1bd7c..27597c576eff 100644
--- a/drivers/video/backlight/backlight.c
+++ b/drivers/video/backlight/backlight.c
@@ -29,12 +29,15 @@ static ssize_t backlight_show_power(struct class_device *cdev, char *buf)
 static ssize_t backlight_store_power(struct class_device *cdev, const char *buf, size_t count)
 {
-        int rc = -ENXIO, power;
+        int rc = -ENXIO;
        char *endp;
        struct backlight_device *bd = to_backlight_device(cdev);
+        int power = simple_strtoul(buf, &endp, 0);
+        size_t size = endp - buf;
-        power = simple_strtoul(buf, &endp, 0);
+        if (*endp && isspace(*endp))
-        if (*endp && !isspace(*endp))
+                size++;
+        if (size != count)
                return -EINVAL;
        down(&bd->sem);
@@ -65,12 +68,15 @@ static ssize_t backlight_show_brightness(struct class_device *cdev, char *buf)
 static ssize_t backlight_store_brightness(struct class_device *cdev, const char *buf, size_t count)
 {
-        int rc = -ENXIO, brightness;
+        int rc = -ENXIO;
        char *endp;
        struct backlight_device *bd = to_backlight_device(cdev);
+        int brightness = simple_strtoul(buf, &endp, 0);
+        size_t size = endp - buf;
-        brightness = simple_strtoul(buf, &endp, 0);
+        if (*endp && isspace(*endp))
-        if (*endp && !isspace(*endp))
+                size++;
+        if (size != count)
                return -EINVAL;
        down(&bd->sem);
diff --git a/drivers/video/backlight/lcd.c b/drivers/video/backlight/lcd.c
index 86908a60c630..bc8ab005a3fb 100644
--- a/drivers/video/backlight/lcd.c
+++ b/drivers/video/backlight/lcd.c
@@ -31,12 +31,15 @@ static ssize_t lcd_show_power(struct class_device *cdev, char *buf)
 static ssize_t lcd_store_power(struct class_device *cdev, const char *buf, size_t count)
 {
-        int rc, power;
+        int rc = -ENXIO;
        char *endp;
        struct lcd_device *ld = to_lcd_device(cdev);
+        int power = simple_strtoul(buf, &endp, 0);
+        size_t size = endp - buf;
-        power = simple_strtoul(buf, &endp, 0);
+        if (*endp && isspace(*endp))
-        if (*endp && !isspace(*endp))
+                size++;
+        if (size != count)
                return -EINVAL;
        down(&ld->sem);
@@ -44,8 +47,7 @@ static ssize_t lcd_store_power(struct class_device *cdev, const char *buf, size_
                pr_debug("lcd: set power to %d\n", power);
                ld->props->set_power(ld, power);
                rc = count;
-        } else
+        }
-                rc = -ENXIO;
        up(&ld->sem);
        return rc;
@@ -53,14 +55,12 @@ static ssize_t lcd_store_power(struct class_device *cdev, const char *buf, size_
 static ssize_t lcd_show_contrast(struct class_device *cdev, char *buf)
 {
-        int rc;
+        int rc = -ENXIO;
        struct lcd_device *ld = to_lcd_device(cdev);
        down(&ld->sem);
        if (likely(ld->props && ld->props->get_contrast))
                rc = sprintf(buf, "%d\n", ld->props->get_contrast(ld));
-        else
-                rc = -ENXIO;
        up(&ld->sem);
        return rc;
@@ -68,12 +68,15 @@ static ssize_t lcd_show_contrast(struct class_device *cdev, char *buf)
 static ssize_t lcd_store_contrast(struct class_device *cdev, const char *buf, size_t count)
 {
-        int rc, contrast;
+        int rc = -ENXIO;
        char *endp;
        struct lcd_device *ld = to_lcd_device(cdev);
+        int contrast = simple_strtoul(buf, &endp, 0);
+        size_t size = endp - buf;
-        contrast = simple_strtoul(buf, &endp, 0);
+        if (*endp && isspace(*endp))
-        if (*endp && !isspace(*endp))
+                size++;
+        if (size != count)
                return -EINVAL;
        down(&ld->sem);
@@ -81,8 +84,7 @@ static ssize_t lcd_store_contrast(struct class_device *cdev, const char *buf, si
                pr_debug("lcd: set contrast to %d\n", contrast);
                ld->props->set_contrast(ld, contrast);
                rc = count;
-        } else
+        }
-                rc = -ENXIO;
        up(&ld->sem);
        return rc;
@@ -90,14 +92,12 @@ static ssize_t lcd_store_contrast(struct class_device *cdev, const char *buf, si
 static ssize_t lcd_show_max_contrast(struct class_device *cdev, char *buf)
 {
-        int rc;
+        int rc = -ENXIO;
        struct lcd_device *ld = to_lcd_device(cdev);
        down(&ld->sem);
        if (likely(ld->props))
                rc = sprintf(buf, "%d\n", ld->props->max_contrast);
-        else
-                rc = -ENXIO;
        up(&ld->sem);
        return rc;