579 files changed, 15865 insertions, 1506 deletions

diff --git a/drivers/acorn/block/mfmhd.c b/drivers/acorn/block/mfmhd.c
index 7fde8f4daebf..689a4c3542ba 100644
--- a/drivers/acorn/block/mfmhd.c
+++ b/drivers/acorn/block/mfmhd.c
@@ -99,7 +99,6 @@
  */
 
 #include <linux/module.h>
-#include <linux/sched.h>
 #include <linux/fs.h>
 #include <linux/interrupt.h>
 #include <linux/kernel.h>
diff --git a/drivers/acorn/char/i2c.c b/drivers/acorn/char/i2c.c
index 157d8b73bb64..d276fd14d63a 100644
--- a/drivers/acorn/char/i2c.c
+++ b/drivers/acorn/char/i2c.c
@@ -14,7 +14,6 @@
  */
 #include <linux/capability.h>
 #include <linux/init.h>
-#include <linux/sched.h>
 #include <linux/time.h>
 #include <linux/miscdevice.h>
 #include <linux/rtc.h>
diff --git a/drivers/acpi/i2c_ec.c b/drivers/acpi/i2c_ec.c
index 8338be0990bc..76ec8b63e69f 100644
--- a/drivers/acpi/i2c_ec.c
+++ b/drivers/acpi/i2c_ec.c
@@ -14,7 +14,6 @@
 #include <linux/slab.h>
 #include <linux/kernel.h>
 #include <linux/stddef.h>
-#include <linux/sched.h>
 #include <linux/init.h>
 #include <linux/i2c.h>
 #include <linux/acpi.h>
@@ -340,6 +339,7 @@ static int acpi_ec_hc_add(struct acpi_device *device)
         smbus->adapter.owner = THIS_MODULE;
         smbus->adapter.algo = &acpi_ec_smbus_algorithm;
         smbus->adapter.algo_data = smbus;
+        smbus->adapter.dev.parent = &device->dev;
 
         if (i2c_add_adapter(&smbus->adapter)) {
                 ACPI_DEBUG_PRINT((ACPI_DB_WARN,
diff --git a/drivers/acpi/namespace/nsinit.c b/drivers/acpi/namespace/nsinit.c
index 326af8fc0ce7..33db2241044e 100644
--- a/drivers/acpi/namespace/nsinit.c
+++ b/drivers/acpi/namespace/nsinit.c
@@ -45,6 +45,7 @@
 #include <acpi/acnamesp.h>
 #include <acpi/acdispat.h>
 #include <acpi/acinterp.h>
+#include <linux/nmi.h>
 
 #define _COMPONENT          ACPI_NAMESPACE
 ACPI_MODULE_NAME("nsinit")
@@ -534,7 +535,15 @@ acpi_ns_init_one_device(acpi_handle obj_handle,
         info->parameter_type = ACPI_PARAM_ARGS;
         info->flags = ACPI_IGNORE_RETURN_VALUE;
 
+        /*
+         * Some hardware relies on this being executed as atomically
+         * as possible (without an NMI being received in the middle of
+         * this) - so disable NMIs and initialize the device:
+         */
+        acpi_nmi_disable();
         status = acpi_ns_evaluate(info);
+        acpi_nmi_enable();
+
         if (ACPI_SUCCESS(status)) {
                 walk_info->num_INI++;
 
diff --git a/drivers/acpi/processor_idle.c b/drivers/acpi/processor_idle.c
index 6c6751b1405b..8206fc1ecc58 100644
--- a/drivers/acpi/processor_idle.c
+++ b/drivers/acpi/processor_idle.c
@@ -39,6 +39,17 @@
 #include <linux/moduleparam.h>
 #include <linux/sched.h>        /* need_resched() */
 #include <linux/latency.h>
+#include <linux/clockchips.h>
+
+/*
+ * Include the apic definitions for x86 to have the APIC timer related defines
+ * available also for UP (on SMP it gets magically included via linux/smp.h).
+ * asm/acpi.h is not an option, as it would require more include magic. Also
+ * creating an empty asm-ia64/apic.h would just trade pest vs. cholera.
+ */
+#ifdef CONFIG_X86
+#include <asm/apic.h>
+#endif
 
 #include <asm/io.h>
 #include <asm/uaccess.h>
@@ -238,6 +249,81 @@ static void acpi_cstate_enter(struct acpi_processor_cx *cstate)
         }
 }
 
+#ifdef ARCH_APICTIMER_STOPS_ON_C3
+
+/*
+ * Some BIOS implementations switch to C3 in the published C2 state.
+ * This seems to be a common problem on AMD boxen, but other vendors
+ * are affected too. We pick the most conservative approach: we assume
+ * that the local APIC stops in both C2 and C3.
+ */
+static void acpi_timer_check_state(int state, struct acpi_processor *pr,
+                                   struct acpi_processor_cx *cx)
+{
+        struct acpi_processor_power *pwr = &pr->power;
+
+        /*
+         * Check, if one of the previous states already marked the lapic
+         * unstable
+         */
+        if (pwr->timer_broadcast_on_state < state)
+                return;
+
+        if (cx->type >= ACPI_STATE_C2)
+                pr->power.timer_broadcast_on_state = state;
+}
+
+static void acpi_propagate_timer_broadcast(struct acpi_processor *pr)
+{
+#ifdef CONFIG_GENERIC_CLOCKEVENTS
+        unsigned long reason;
+
+        reason = pr->power.timer_broadcast_on_state < INT_MAX ?
+                CLOCK_EVT_NOTIFY_BROADCAST_ON : CLOCK_EVT_NOTIFY_BROADCAST_OFF;
+
+        clockevents_notify(reason, &pr->id);
+#else
+        cpumask_t mask = cpumask_of_cpu(pr->id);
+
+        if (pr->power.timer_broadcast_on_state < INT_MAX)
+                on_each_cpu(switch_APIC_timer_to_ipi, &mask, 1, 1);
+        else
+                on_each_cpu(switch_ipi_to_APIC_timer, &mask, 1, 1);
+#endif
+}
+
+/* Power(C) State timer broadcast control */
+static void acpi_state_timer_broadcast(struct acpi_processor *pr,
+                                       struct acpi_processor_cx *cx,
+                                       int broadcast)
+{
+#ifdef CONFIG_GENERIC_CLOCKEVENTS
+
+        int state = cx - pr->power.states;
+
+        if (state >= pr->power.timer_broadcast_on_state) {
+                unsigned long reason;
+
+                reason = broadcast ?  CLOCK_EVT_NOTIFY_BROADCAST_ENTER :
+                        CLOCK_EVT_NOTIFY_BROADCAST_EXIT;
+                clockevents_notify(reason, &pr->id);
+        }
+#endif
+}
+
+#else
+
+static void acpi_timer_check_state(int state, struct acpi_processor *pr,
+                                   struct acpi_processor_cx *cstate) { }
+static void acpi_propagate_timer_broadcast(struct acpi_processor *pr) { }
+static void acpi_state_timer_broadcast(struct acpi_processor *pr,
+                                       struct acpi_processor_cx *cx,
+                                       int broadcast)
+{
+}
+
+#endif
+
 static void acpi_processor_idle(void)
 {
         struct acpi_processor *pr = NULL;
@@ -382,6 +468,7 @@ static void acpi_processor_idle(void)
                 /* Get start time (ticks) */
                 t1 = inl(acpi_gbl_FADT.xpm_timer_block.address);
                 /* Invoke C2 */
+                acpi_state_timer_broadcast(pr, cx, 1);
                 acpi_cstate_enter(cx);
                 /* Get end time (ticks) */
                 t2 = inl(acpi_gbl_FADT.xpm_timer_block.address);
@@ -396,6 +483,7 @@ static void acpi_processor_idle(void)
                 /* Compute time (ticks) that we were actually asleep */
                 sleep_ticks =
                     ticks_elapsed(t1, t2) - cx->latency_ticks - C2_OVERHEAD;
+                acpi_state_timer_broadcast(pr, cx, 0);
                 break;
 
         case ACPI_STATE_C3:
@@ -417,6 +505,7 @@ static void acpi_processor_idle(void)
                 /* Get start time (ticks) */
                 t1 = inl(acpi_gbl_FADT.xpm_timer_block.address);
                 /* Invoke C3 */
+                acpi_state_timer_broadcast(pr, cx, 1);
                 acpi_cstate_enter(cx);
                 /* Get end time (ticks) */
                 t2 = inl(acpi_gbl_FADT.xpm_timer_block.address);
@@ -436,6 +525,7 @@ static void acpi_processor_idle(void)
                 /* Compute time (ticks) that we were actually asleep */
                 sleep_ticks =
                     ticks_elapsed(t1, t2) - cx->latency_ticks - C3_OVERHEAD;
+                acpi_state_timer_broadcast(pr, cx, 0);
                 break;
 
         default:
@@ -904,11 +994,7 @@ static int acpi_processor_power_verify(struct acpi_processor *pr)
         unsigned int i;
         unsigned int working = 0;
 
-#ifdef ARCH_APICTIMER_STOPS_ON_C3
-        int timer_broadcast = 0;
-        cpumask_t mask = cpumask_of_cpu(pr->id);
-        on_each_cpu(switch_ipi_to_APIC_timer, &mask, 1, 1);
-#endif
+        pr->power.timer_broadcast_on_state = INT_MAX;
 
         for (i = 1; i < ACPI_PROCESSOR_MAX_POWER; i++) {
                 struct acpi_processor_cx *cx = &pr->power.states[i];
@@ -920,21 +1006,14 @@ static int acpi_processor_power_verify(struct acpi_processor *pr)
 
                 case ACPI_STATE_C2:
                         acpi_processor_power_verify_c2(cx);
-#ifdef ARCH_APICTIMER_STOPS_ON_C3
-                        /* Some AMD systems fake C3 as C2, but still
-                           have timer troubles */
-                        if (cx->valid && 
-                                boot_cpu_data.x86_vendor == X86_VENDOR_AMD)
-                                timer_broadcast++;
-#endif
+                        if (cx->valid)
+                                acpi_timer_check_state(i, pr, cx);
                         break;
 
                 case ACPI_STATE_C3:
                         acpi_processor_power_verify_c3(pr, cx);
-#ifdef ARCH_APICTIMER_STOPS_ON_C3
                         if (cx->valid)
-                                timer_broadcast++;
-#endif
+                                acpi_timer_check_state(i, pr, cx);
                         break;
                 }
 
@@ -942,10 +1021,7 @@ static int acpi_processor_power_verify(struct acpi_processor *pr)
                         working++;
         }
 
-#ifdef ARCH_APICTIMER_STOPS_ON_C3
-        if (timer_broadcast)
-                on_each_cpu(switch_APIC_timer_to_ipi, &mask, 1, 1);
-#endif
+        acpi_propagate_timer_broadcast(pr);
 
         return (working);
 }
diff --git a/drivers/acpi/sleep/poweroff.c b/drivers/acpi/sleep/poweroff.c
index 47fb4b394eec..d9801eff6489 100644
--- a/drivers/acpi/sleep/poweroff.c
+++ b/drivers/acpi/sleep/poweroff.c
@@ -12,7 +12,6 @@
 #include <linux/pm.h>
 #include <linux/init.h>
 #include <acpi/acpi_bus.h>
-#include <linux/sched.h>
 #include <linux/sysdev.h>
 #include <asm/io.h>
 #include "sleep.h"
diff --git a/drivers/acpi/tables.c b/drivers/acpi/tables.c
index ba4cb200314a..45bd17313c4a 100644
--- a/drivers/acpi/tables.c
+++ b/drivers/acpi/tables.c
@@ -25,7 +25,6 @@
 
 #include <linux/init.h>
 #include <linux/kernel.h>
-#include <linux/sched.h>
 #include <linux/smp.h>
 #include <linux/string.h>
 #include <linux/types.h>
diff --git a/drivers/acpi/thermal.c b/drivers/acpi/thermal.c
index f76d3168c2b2..986afd470a14 100644
--- a/drivers/acpi/thermal.c
+++ b/drivers/acpi/thermal.c
@@ -36,7 +36,8 @@
 #include <linux/init.h>
 #include <linux/types.h>
 #include <linux/proc_fs.h>
-#include <linux/sched.h>
+#include <linux/timer.h>
+#include <linux/jiffies.h>
 #include <linux/kmod.h>
 #include <linux/seq_file.h>
 #include <asm/uaccess.h>
diff --git a/drivers/ata/ahci.c b/drivers/ata/ahci.c
index 92cdb0c5171f..6a3543e06241 100644
--- a/drivers/ata/ahci.c
+++ b/drivers/ata/ahci.c
@@ -39,7 +39,6 @@
 #include <linux/blkdev.h>
 #include <linux/delay.h>
 #include <linux/interrupt.h>
-#include <linux/sched.h>
 #include <linux/dma-mapping.h>
 #include <linux/device.h>
 #include <scsi/scsi_host.h>
diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c
index 25d8d3f778a1..2cf8251728d2 100644
--- a/drivers/ata/libata-core.c
+++ b/drivers/ata/libata-core.c
@@ -1410,7 +1410,16 @@ int ata_dev_read_id(struct ata_device *dev, unsigned int *p_class,
         }
 
         tf.protocol = ATA_PROT_PIO;
-        tf.flags |= ATA_TFLAG_POLLING; /* for polling presence detection */
+
+        /* Some devices choke if TF registers contain garbage.  Make
+         * sure those are properly initialized.
+         */
+        tf.flags |= ATA_TFLAG_ISADDR | ATA_TFLAG_DEVICE;
+
+        /* Device presence detection is unreliable on some
+         * controllers.  Always poll IDENTIFY if available.
+         */
+        tf.flags |= ATA_TFLAG_POLLING;
 
         err_mask = ata_exec_internal(dev, &tf, NULL, DMA_FROM_DEVICE,
                                      id, sizeof(id[0]) * ATA_ID_WORDS);
diff --git a/drivers/ata/pata_legacy.c b/drivers/ata/pata_legacy.c
index 4223e10de6a0..98c1fee4b305 100644
--- a/drivers/ata/pata_legacy.c
+++ b/drivers/ata/pata_legacy.c
@@ -89,9 +89,10 @@ static int probe_all;			/* Set to check all ISA port ranges */
 static int ht6560a;                     /* HT 6560A on primary 1, secondary 2, both 3 */
 static int ht6560b;                     /* HT 6560A on primary 1, secondary 2, both 3 */
 static int opti82c611a;                 /* Opti82c611A on primary 1, secondary 2, both 3 */
-static int opti82c46x;          /* Opti 82c465MV present (pri/sec autodetect) */
+static int opti82c46x;                  /* Opti 82c465MV present (pri/sec autodetect) */
 static int autospeed;                   /* Chip present which snoops speed changes */
 static int pio_mask = 0x1F;             /* PIO range for autospeed devices */
+static int iordy_mask = 0xFFFFFFFF;     /* Use iordy if available */
 
 /**
  *      legacy_set_mode         -       mode setting
@@ -113,6 +114,7 @@ static int legacy_set_mode(struct ata_port *ap, struct ata_device **unused)
         for (i = 0; i < ATA_MAX_DEVICES; i++) {
                 struct ata_device *dev = &ap->device[i];
                 if (ata_dev_enabled(dev)) {
+                        ata_dev_printk(dev, KERN_INFO, "configured for PIO\n");
                         dev->pio_mode = XFER_PIO_0;
                         dev->xfer_mode = XFER_PIO_0;
                         dev->xfer_shift = ATA_SHIFT_PIO;
@@ -695,6 +697,7 @@ static __init int legacy_init_one(int port, unsigned long io, unsigned long ctrl
         void __iomem *io_addr, *ctrl_addr;
         int pio_modes = pio_mask;
         u32 mask = (1 << port);
+        u32 iordy = (iordy_mask & mask) ? 0: ATA_FLAG_NO_IORDY;
         int ret;
 
         pdev = platform_device_register_simple(DRV_NAME, nr_legacy_host, NULL, 0);
@@ -715,6 +718,7 @@ static __init int legacy_init_one(int port, unsigned long io, unsigned long ctrl
         if (ht6560a & mask) {
                 ops = &ht6560a_port_ops;
                 pio_modes = 0x07;
+                iordy = ATA_FLAG_NO_IORDY;
         }
         if (ht6560b & mask) {
                 ops = &ht6560b_port_ops;
@@ -750,6 +754,7 @@ static __init int legacy_init_one(int port, unsigned long io, unsigned long ctrl
                         printk(KERN_INFO "PDC20230-C/20630 VLB ATA controller detected.\n");
                                 pio_modes = 0x07;
                         ops = &pdc20230_port_ops;
+                        iordy = ATA_FLAG_NO_IORDY;
                         udelay(100);
                         inb(0x1F5);
                 } else {
@@ -767,6 +772,7 @@ static __init int legacy_init_one(int port, unsigned long io, unsigned long ctrl
         /* Chip does mode setting by command snooping */
         if (ops == &legacy_port_ops && (autospeed & mask))
                 ops = &simple_port_ops;
+
         memset(&ae, 0, sizeof(struct ata_probe_ent));
         INIT_LIST_HEAD(&ae.node);
         ae.dev = &pdev->dev;
@@ -776,7 +782,7 @@ static __init int legacy_init_one(int port, unsigned long io, unsigned long ctrl
         ae.pio_mask = pio_modes;
         ae.irq = irq;
         ae.irq_flags = 0;
-        ae.port_flags = ATA_FLAG_SLAVE_POSS|ATA_FLAG_SRST;
+        ae.port_flags = ATA_FLAG_SLAVE_POSS|ATA_FLAG_SRST|iordy;
         ae.port[0].cmd_addr = io_addr;
         ae.port[0].altstatus_addr = ctrl_addr;
         ae.port[0].ctl_addr = ctrl_addr;
@@ -945,6 +951,7 @@ module_param(ht6560b, int, 0);
 module_param(opti82c611a, int, 0);
 module_param(opti82c46x, int, 0);
 module_param(pio_mask, int, 0);
+module_param(iordy_mask, int, 0);
 
 module_init(legacy_init);
 module_exit(legacy_exit);
diff --git a/drivers/ata/pata_mpc52xx.c b/drivers/ata/pata_mpc52xx.c
index d7378df44970..29e1809e5ecf 100644
--- a/drivers/ata/pata_mpc52xx.c
+++ b/drivers/ata/pata_mpc52xx.c
@@ -484,10 +484,8 @@ mpc52xx_ata_resume(struct of_device *op)
 
 static struct of_device_id mpc52xx_ata_of_match[] = {
         {
-                .compatible = "mpc5200-ata",
-        },
-        {
-                .compatible = "mpc52xx-ata",
+                .type           = "ata",
+                .compatible     = "mpc5200-ata",
         },
         {},
 };
diff --git a/drivers/ata/pata_mpiix.c b/drivers/ata/pata_mpiix.c
index ca8c965179b1..f2e7115f7ab9 100644
--- a/drivers/ata/pata_mpiix.c
+++ b/drivers/ata/pata_mpiix.c
@@ -241,7 +241,7 @@ static int mpiix_init_one(struct pci_dev *dev, const struct pci_device_id *id)
         probe.port_ops = &mpiix_port_ops;
         probe.sht = &mpiix_sht;
         probe.pio_mask = 0x1F;
-        probe.irq_flags = SA_SHIRQ;
+        probe.irq_flags = IRQF_SHARED;
         probe.port_flags = ATA_FLAG_SLAVE_POSS | ATA_FLAG_SRST;
         probe.n_ports = 1;
 
diff --git a/drivers/ata/pata_pcmcia.c b/drivers/ata/pata_pcmcia.c
index acfc09f9abd9..36468ec6454c 100644
--- a/drivers/ata/pata_pcmcia.c
+++ b/drivers/ata/pata_pcmcia.c
@@ -264,7 +264,7 @@ next_entry:
         ae.n_ports = 1;
         ae.pio_mask = 1;                /* ISA so PIO 0 cycles */
         ae.irq = pdev->irq.AssignedIRQ;
-        ae.irq_flags = SA_SHIRQ;
+        ae.irq_flags = IRQF_SHARED;
         ae.port_flags = ATA_FLAG_SLAVE_POSS | ATA_FLAG_SRST;
         ae.port[0].cmd_addr = io_addr;
         ae.port[0].altstatus_addr = ctl_addr;
diff --git a/drivers/ata/pata_pdc2027x.c b/drivers/ata/pata_pdc2027x.c
index ffa7f47fbb20..61537873d28e 100644
--- a/drivers/ata/pata_pdc2027x.c
+++ b/drivers/ata/pata_pdc2027x.c
@@ -796,7 +796,7 @@ static int __devinit pdc2027x_init_one(struct pci_dev *pdev, const struct pci_de
         probe_ent->port_ops     = pdc2027x_port_info[board_idx].port_ops;
 
         probe_ent->irq = pdev->irq;
-        probe_ent->irq_flags = SA_SHIRQ;
+        probe_ent->irq_flags = IRQF_SHARED;
         probe_ent->iomap = pcim_iomap_table(pdev);
 
         mmio_base = probe_ent->iomap[PDC_MMIO_BAR];
diff --git a/drivers/ata/pata_qdi.c b/drivers/ata/pata_qdi.c
index 1b3b4ed8eb19..4362141976ad 100644
--- a/drivers/ata/pata_qdi.c
+++ b/drivers/ata/pata_qdi.c
@@ -264,16 +264,18 @@ static __init int qdi_init_one(unsigned long port, int type, unsigned long io, i
         if (type == 6580) {
                 ae.port_ops = &qdi6580_port_ops;
                 ae.pio_mask = 0x1F;
+                ae.port_flags = ATA_FLAG_SLAVE_POSS | ATA_FLAG_SRST;
         } else {
                 ae.port_ops = &qdi6500_port_ops;
                 ae.pio_mask = 0x07;     /* Actually PIO3 !IORDY is possible */
+                ae.port_flags = ATA_FLAG_SLAVE_POSS | ATA_FLAG_SRST |
+                                ATA_FLAG_NO_IORDY;
         }
 
         ae.sht = &qdi_sht;
         ae.n_ports = 1;
         ae.irq = irq;
         ae.irq_flags = 0;
-        ae.port_flags = ATA_FLAG_SLAVE_POSS | ATA_FLAG_SRST;
         ae.port[0].cmd_addr = io_addr;
         ae.port[0].altstatus_addr = ctl_addr;
         ae.port[0].ctl_addr = ctl_addr;
diff --git a/drivers/ata/pata_sl82c105.c b/drivers/ata/pata_sl82c105.c
index f2fa158d07ca..96e890fd645b 100644
--- a/drivers/ata/pata_sl82c105.c
+++ b/drivers/ata/pata_sl82c105.c
@@ -187,7 +187,9 @@ static void sl82c105_bmdma_start(struct ata_queued_cmd *qc)
 {
         struct ata_port *ap = qc->ap;
 
+        udelay(100);
         sl82c105_reset_engine(ap);
+        udelay(100);
 
         /* Set the clocks for DMA */
         sl82c105_configure_dmamode(ap, qc->dev);
@@ -216,6 +218,7 @@ static void sl82c105_bmdma_stop(struct ata_queued_cmd *qc)
 
         ata_bmdma_stop(qc);
         sl82c105_reset_engine(ap);
+        udelay(100);
 
         /* This will redo the initial setup of the DMA device to matching
            PIO timings */
diff --git a/drivers/ata/pdc_adma.c b/drivers/ata/pdc_adma.c
index b4ed8ce553e6..857ac23217ab 100644
--- a/drivers/ata/pdc_adma.c
+++ b/drivers/ata/pdc_adma.c
@@ -39,7 +39,6 @@
 #include <linux/blkdev.h>
 #include <linux/delay.h>
 #include <linux/interrupt.h>
-#include <linux/sched.h>
 #include <linux/device.h>
 #include <scsi/scsi_host.h>
 #include <linux/libata.h>
diff --git a/drivers/ata/sata_inic162x.c b/drivers/ata/sata_inic162x.c
index c5335f422801..31b636fac98e 100644
--- a/drivers/ata/sata_inic162x.c
+++ b/drivers/ata/sata_inic162x.c
@@ -710,7 +710,7 @@ static int inic_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
         probe_ent->n_ports              = NR_PORTS;
 
         probe_ent->irq = pdev->irq;
-        probe_ent->irq_flags = SA_SHIRQ;
+        probe_ent->irq_flags = IRQF_SHARED;
 
         probe_ent->iomap = iomap;
 
diff --git a/drivers/ata/sata_mv.c b/drivers/ata/sata_mv.c
index 769eca52442c..d689df52eae3 100644
--- a/drivers/ata/sata_mv.c
+++ b/drivers/ata/sata_mv.c
@@ -28,7 +28,6 @@
 #include <linux/blkdev.h>
 #include <linux/delay.h>
 #include <linux/interrupt.h>
-#include <linux/sched.h>
 #include <linux/dma-mapping.h>
 #include <linux/device.h>
 #include <scsi/scsi_host.h>
diff --git a/drivers/ata/sata_nv.c b/drivers/ata/sata_nv.c
index 095ef1b2cd0e..ab92f208dae2 100644
--- a/drivers/ata/sata_nv.c
+++ b/drivers/ata/sata_nv.c
@@ -827,7 +827,8 @@ static irqreturn_t nv_adma_interrupt(int irq, void *dev_instance)
                         /* freeze if hotplugged or controller error */
                         if (unlikely(status & (NV_ADMA_STAT_HOTPLUG |
                                                NV_ADMA_STAT_HOTUNPLUG |
-                                               NV_ADMA_STAT_TIMEOUT))) {
+                                               NV_ADMA_STAT_TIMEOUT |
+                                               NV_ADMA_STAT_SERROR))) {
                                 struct ata_eh_info *ehi = &ap->eh_info;
 
                                 ata_ehi_clear_desc(ehi);
@@ -841,6 +842,9 @@ static irqreturn_t nv_adma_interrupt(int irq, void *dev_instance)
                                 } else if (status & NV_ADMA_STAT_HOTUNPLUG) {
                                         ata_ehi_hotplugged(ehi);
                                         ata_ehi_push_desc(ehi, ": hot unplug");
+                                } else if (status & NV_ADMA_STAT_SERROR) {
+                                        /* let libata analyze SError and figure out the cause */
+                                        ata_ehi_push_desc(ehi, ": SError");
                                 }
                                 ata_port_freeze(ap);
                                 continue;
diff --git a/drivers/ata/sata_promise.c b/drivers/ata/sata_promise.c
index 3be4cc338d7b..cf9ed8c39301 100644
--- a/drivers/ata/sata_promise.c
+++ b/drivers/ata/sata_promise.c
@@ -37,7 +37,6 @@
 #include <linux/blkdev.h>
 #include <linux/delay.h>
 #include <linux/interrupt.h>
-#include <linux/sched.h>
 #include <linux/device.h>
 #include <scsi/scsi.h>
 #include <scsi/scsi_host.h>
@@ -120,9 +119,7 @@ static u32 pdc_sata_scr_read (struct ata_port *ap, unsigned int sc_reg);
 static void pdc_sata_scr_write (struct ata_port *ap, unsigned int sc_reg, u32 val);
 static int pdc_ata_init_one (struct pci_dev *pdev, const struct pci_device_id *ent);
 static irqreturn_t pdc_interrupt (int irq, void *dev_instance);
-static void pdc_eng_timeout(struct ata_port *ap);
 static int pdc_port_start(struct ata_port *ap);
-static void pdc_pata_phy_reset(struct ata_port *ap);
 static void pdc_qc_prep(struct ata_queued_cmd *qc);
 static void pdc_tf_load_mmio(struct ata_port *ap, const struct ata_taskfile *tf);
 static void pdc_exec_command_mmio(struct ata_port *ap, const struct ata_taskfile *tf);
@@ -216,12 +213,12 @@ static const struct ata_port_operations pdc_pata_ops = {
         .dev_select             = ata_std_dev_select,
         .check_atapi_dma        = pdc_check_atapi_dma,
 
-        .phy_reset              = pdc_pata_phy_reset,
-
         .qc_prep                = pdc_qc_prep,
         .qc_issue               = pdc_qc_issue_prot,
+        .freeze                 = pdc_freeze,
+        .thaw                   = pdc_thaw,
+        .error_handler          = pdc_error_handler,
         .data_xfer              = ata_data_xfer,
-        .eng_timeout            = pdc_eng_timeout,
         .irq_handler            = pdc_interrupt,
         .irq_clear              = pdc_irq_clear,
         .irq_on                 = ata_irq_on,
@@ -254,7 +251,7 @@ static const struct ata_port_info pdc_port_info[] = {
         /* board_20619 */
         {
                 .sht            = &pdc_ata_sht,
-                .flags          = PDC_COMMON_FLAGS | ATA_FLAG_SRST | ATA_FLAG_SLAVE_POSS,
+                .flags          = PDC_COMMON_FLAGS | ATA_FLAG_SLAVE_POSS,
                 .pio_mask       = 0x1f, /* pio0-4 */
                 .mwdma_mask     = 0x07, /* mwdma0-2 */
                 .udma_mask      = 0x7f, /* udma0-6 ; FIXME */
@@ -390,14 +387,6 @@ static void pdc_pata_cbl_detect(struct ata_port *ap)
                 ap->cbl = ATA_CBL_PATA80;
 }
 
-static void pdc_pata_phy_reset(struct ata_port *ap)
-{
-        pdc_pata_cbl_detect(ap);
-        pdc_reset_port(ap);
-        ata_port_probe(ap);
-        ata_bus_reset(ap);
-}
-
 static u32 pdc_sata_scr_read (struct ata_port *ap, unsigned int sc_reg)
 {
         if (sc_reg > SCR_CONTROL || ap->cbl != ATA_CBL_SATA)
@@ -565,6 +554,13 @@ static void pdc_thaw(struct ata_port *ap)
         readl(mmio + PDC_CTLSTAT); /* flush */
 }
 
+static int pdc_pre_reset(struct ata_port *ap)
+{
+        if (!sata_scr_valid(ap))
+                pdc_pata_cbl_detect(ap);
+        return ata_std_prereset(ap);
+}
+
 static void pdc_error_handler(struct ata_port *ap)
 {
         ata_reset_fn_t hardreset;
@@ -577,7 +573,7 @@ static void pdc_error_handler(struct ata_port *ap)
                 hardreset = sata_std_hardreset;
 
         /* perform recovery */
-        ata_do_eh(ap, ata_std_prereset, ata_std_softreset, hardreset,
+        ata_do_eh(ap, pdc_pre_reset, ata_std_softreset, hardreset,
                   ata_std_postreset);
 }
 
@@ -593,43 +589,6 @@ static void pdc_post_internal_cmd(struct ata_queued_cmd *qc)
                 pdc_reset_port(ap);
 }
 
-static void pdc_eng_timeout(struct ata_port *ap)
-{
-        struct ata_host *host = ap->host;
-        u8 drv_stat;
-        struct ata_queued_cmd *qc;
-        unsigned long flags;
-
-        DPRINTK("ENTER\n");
-
-        spin_lock_irqsave(&host->lock, flags);
-
-        qc = ata_qc_from_tag(ap, ap->active_tag);
-
-        switch (qc->tf.protocol) {
-        case ATA_PROT_DMA:
-        case ATA_PROT_NODATA:
-                ata_port_printk(ap, KERN_ERR, "command timeout\n");
-                drv_stat = ata_wait_idle(ap);
-                qc->err_mask |= __ac_err_mask(drv_stat);
-                break;
-
-        default:
-                drv_stat = ata_busy_wait(ap, ATA_BUSY | ATA_DRQ, 1000);
-
-                ata_port_printk(ap, KERN_ERR,
-                                "unknown timeout, cmd 0x%x stat 0x%x\n",
-                                qc->tf.command, drv_stat);
-
-                qc->err_mask |= ac_err_mask(drv_stat);
-                break;
-        }
-
-        spin_unlock_irqrestore(&host->lock, flags);
-        ata_eh_qc_complete(qc);
-        DPRINTK("EXIT\n");
-}
-
 static inline unsigned int pdc_host_intr( struct ata_port *ap,
                                           struct ata_queued_cmd *qc)
 {
diff --git a/drivers/ata/sata_qstor.c b/drivers/ata/sata_qstor.c
index bfa35ede6551..6097d8f2a0c0 100644
--- a/drivers/ata/sata_qstor.c
+++ b/drivers/ata/sata_qstor.c
@@ -34,7 +34,6 @@
 #include <linux/blkdev.h>
 #include <linux/delay.h>
 #include <linux/interrupt.h>
-#include <linux/sched.h>
 #include <linux/device.h>
 #include <scsi/scsi_host.h>
 #include <linux/libata.h>
diff --git a/drivers/ata/sata_sx4.c b/drivers/ata/sata_sx4.c
index 06e87a377382..0ebd77b080d6 100644
--- a/drivers/ata/sata_sx4.c
+++ b/drivers/ata/sata_sx4.c
@@ -37,7 +37,6 @@
 #include <linux/blkdev.h>
 #include <linux/delay.h>
 #include <linux/interrupt.h>
-#include <linux/sched.h>
 #include <linux/device.h>
 #include <scsi/scsi_host.h>
 #include <scsi/scsi_cmnd.h>
diff --git a/drivers/ata/sata_vsc.c b/drivers/ata/sata_vsc.c
index 3d9daf231115..2fd037bde090 100644
--- a/drivers/ata/sata_vsc.c
+++ b/drivers/ata/sata_vsc.c
@@ -346,6 +346,7 @@ static int __devinit vsc_sata_init_one (struct pci_dev *pdev, const struct pci_d
         struct ata_probe_ent *probe_ent;
         void __iomem *mmio_base;
         int rc;
+        u8 cls;
 
         if (!printed_version++)
                 dev_printk(KERN_DEBUG, &pdev->dev, "version " DRV_VERSION "\n");
@@ -383,9 +384,12 @@ static int __devinit vsc_sata_init_one (struct pci_dev *pdev, const struct pci_d
         INIT_LIST_HEAD(&probe_ent->node);
 
         /*
-         * Due to a bug in the chip, the default cache line size can't be used
+         * Due to a bug in the chip, the default cache line size can't be
+         * used (unless the default is non-zero).
          */
-        pci_write_config_byte(pdev, PCI_CACHE_LINE_SIZE, 0x80);
+        pci_read_config_byte(pdev, PCI_CACHE_LINE_SIZE, &cls);
+        if (cls == 0x00)
+                pci_write_config_byte(pdev, PCI_CACHE_LINE_SIZE, 0x80);
 
         if (pci_enable_msi(pdev) == 0)
                 pci_intx(pdev, 0);
diff --git a/drivers/atm/adummy.c b/drivers/atm/adummy.c
index ac2c10822be0..8d60c4eb54fe 100644
--- a/drivers/atm/adummy.c
+++ b/drivers/atm/adummy.c
@@ -13,7 +13,6 @@
 #include <linux/delay.h>
 #include <linux/init.h>
 #include <linux/mm.h>
-#include <linux/sched.h>
 #include <linux/timer.h>
 #include <linux/interrupt.h>
 #include <asm/io.h>
diff --git a/drivers/atm/fore200e.c b/drivers/atm/fore200e.c
index 4aeb3d062ff6..a7c0ed3107e3 100644
--- a/drivers/atm/fore200e.c
+++ b/drivers/atm/fore200e.c
@@ -29,7 +29,6 @@
 #include <linux/slab.h>
 #include <linux/init.h>
 #include <linux/capability.h>
-#include <linux/sched.h>
 #include <linux/interrupt.h>
 #include <linux/bitops.h>
 #include <linux/pci.h>
diff --git a/drivers/atm/idt77105.c b/drivers/atm/idt77105.c
index 325325afabec..0bd657f5dd2a 100644
--- a/drivers/atm/idt77105.c
+++ b/drivers/atm/idt77105.c
@@ -4,7 +4,6 @@
 
 
 #include <linux/module.h>
-#include <linux/sched.h>
 #include <linux/kernel.h>
 #include <linux/mm.h>
 #include <linux/errno.h>
diff --git a/drivers/atm/uPD98402.c b/drivers/atm/uPD98402.c
index 9504cce51bfb..fc8cb07c2477 100644
--- a/drivers/atm/uPD98402.c
+++ b/drivers/atm/uPD98402.c
@@ -4,7 +4,6 @@
  
 
 #include <linux/module.h>
-#include <linux/sched.h> /* for jiffies */
 #include <linux/mm.h>
 #include <linux/errno.h>
 #include <linux/atmdev.h>
diff --git a/drivers/atm/zatm.c b/drivers/atm/zatm.c
index 756d4f760da3..0d7091e2077f 100644
--- a/drivers/atm/zatm.c
+++ b/drivers/atm/zatm.c
@@ -4,7 +4,6 @@
 
 
 #include <linux/module.h>
-#include <linux/sched.h>
 #include <linux/kernel.h>
 #include <linux/mm.h>
 #include <linux/pci.h>
diff --git a/drivers/block/acsi.c b/drivers/block/acsi.c
index 706cdc6a69ec..e3d9152e231a 100644
--- a/drivers/block/acsi.c
+++ b/drivers/block/acsi.c
@@ -46,7 +46,6 @@
 #include <linux/module.h>
 #include <linux/errno.h>
 #include <linux/signal.h>
-#include <linux/sched.h>
 #include <linux/timer.h>
 #include <linux/fs.h>
 #include <linux/kernel.h>
diff --git a/drivers/block/paride/pd.c b/drivers/block/paride/pd.c
index 9d9bff23f426..99e2c8ce1cc4 100644
--- a/drivers/block/paride/pd.c
+++ b/drivers/block/paride/pd.c
@@ -153,7 +153,6 @@ enum {D_PRT, D_PRO, D_UNI, D_MOD, D_GEO, D_SBY, D_DLY, D_SLV};
 #include <linux/blkpg.h>
 #include <linux/kernel.h>
 #include <asm/uaccess.h>
-#include <linux/sched.h>
 #include <linux/workqueue.h>
 
 static DEFINE_SPINLOCK(pd_lock);
diff --git a/drivers/block/umem.c b/drivers/block/umem.c
index 30f16bd83650..dff3766f117f 100644
--- a/drivers/block/umem.c
+++ b/drivers/block/umem.c
@@ -35,7 +35,6 @@
  */
 
 //#define DEBUG /* uncomment if you want debugging info (pr_debug) */
-#include <linux/sched.h>
 #include <linux/fs.h>
 #include <linux/bio.h>
 #include <linux/kernel.h>
diff --git a/drivers/bluetooth/bfusb.c b/drivers/bluetooth/bfusb.c
index 31ade991aa91..27cceb6f5652 100644
--- a/drivers/bluetooth/bfusb.c
+++ b/drivers/bluetooth/bfusb.c
@@ -27,7 +27,6 @@
 #include <linux/init.h>
 #include <linux/slab.h>
 #include <linux/types.h>
-#include <linux/sched.h>
 #include <linux/errno.h>
 #include <linux/skbuff.h>
 
diff --git a/drivers/bluetooth/bt3c_cs.c b/drivers/bluetooth/bt3c_cs.c
index aae3abace586..34e5555cb917 100644
--- a/drivers/bluetooth/bt3c_cs.c
+++ b/drivers/bluetooth/bt3c_cs.c
@@ -27,7 +27,6 @@
 #include <linux/init.h>
 #include <linux/slab.h>
 #include <linux/types.h>
-#include <linux/sched.h>
 #include <linux/delay.h>
 #include <linux/errno.h>
 #include <linux/ptrace.h>
diff --git a/drivers/bluetooth/btuart_cs.c b/drivers/bluetooth/btuart_cs.c
index 92648ef2f5d0..c1bce75148fe 100644
--- a/drivers/bluetooth/btuart_cs.c
+++ b/drivers/bluetooth/btuart_cs.c
@@ -26,7 +26,6 @@
 #include <linux/init.h>
 #include <linux/slab.h>
 #include <linux/types.h>
-#include <linux/sched.h>
 #include <linux/delay.h>
 #include <linux/errno.h>
 #include <linux/ptrace.h>
diff --git a/drivers/bluetooth/dtl1_cs.c b/drivers/bluetooth/dtl1_cs.c
index 77b99eecbc49..459aa97937ab 100644
--- a/drivers/bluetooth/dtl1_cs.c
+++ b/drivers/bluetooth/dtl1_cs.c
@@ -26,7 +26,6 @@
 #include <linux/init.h>
 #include <linux/slab.h>
 #include <linux/types.h>
-#include <linux/sched.h>
 #include <linux/delay.h>
 #include <linux/errno.h>
 #include <linux/ptrace.h>
diff --git a/drivers/bluetooth/hci_bcsp.c b/drivers/bluetooth/hci_bcsp.c
index 5e2c31882003..d66064ccb31c 100644
--- a/drivers/bluetooth/hci_bcsp.c
+++ b/drivers/bluetooth/hci_bcsp.c
@@ -26,7 +26,6 @@
 
 #include <linux/kernel.h>
 #include <linux/init.h>
-#include <linux/sched.h>
 #include <linux/types.h>
 #include <linux/fcntl.h>
 #include <linux/interrupt.h>
diff --git a/drivers/bluetooth/hci_h4.c b/drivers/bluetooth/hci_h4.c
index ad62abbbb739..34f0afc42407 100644
--- a/drivers/bluetooth/hci_h4.c
+++ b/drivers/bluetooth/hci_h4.c
@@ -27,7 +27,6 @@
 
 #include <linux/kernel.h>
 #include <linux/init.h>
-#include <linux/sched.h>
 #include <linux/types.h>
 #include <linux/fcntl.h>
 #include <linux/interrupt.h>
diff --git a/drivers/bluetooth/hci_ldisc.c b/drivers/bluetooth/hci_ldisc.c
index 420b645c4c9f..0f4203b499af 100644
--- a/drivers/bluetooth/hci_ldisc.c
+++ b/drivers/bluetooth/hci_ldisc.c
@@ -27,7 +27,6 @@
 
 #include <linux/kernel.h>
 #include <linux/init.h>
-#include <linux/sched.h>
 #include <linux/types.h>
 #include <linux/fcntl.h>
 #include <linux/interrupt.h>
diff --git a/drivers/bluetooth/hci_usb.c b/drivers/bluetooth/hci_usb.c
index 6bdf593081d8..406af579ac3a 100644
--- a/drivers/bluetooth/hci_usb.c
+++ b/drivers/bluetooth/hci_usb.c
@@ -35,7 +35,6 @@
 
 #include <linux/kernel.h>
 #include <linux/init.h>
-#include <linux/sched.h>
 #include <linux/unistd.h>
 #include <linux/types.h>
 #include <linux/interrupt.h>
diff --git a/drivers/cdrom/aztcd.c b/drivers/cdrom/aztcd.c
index ec469497c10f..1f9fb7a96703 100644
--- a/drivers/cdrom/aztcd.c
+++ b/drivers/cdrom/aztcd.c
@@ -170,7 +170,6 @@
 
 #include <linux/module.h>
 #include <linux/errno.h>
-#include <linux/sched.h>
 #include <linux/mm.h>
 #include <linux/timer.h>
 #include <linux/fs.h>
diff --git a/drivers/cdrom/cdrom.c b/drivers/cdrom/cdrom.c
index 3105dddf59f1..b36f44d4d1bf 100644
--- a/drivers/cdrom/cdrom.c
+++ b/drivers/cdrom/cdrom.c
@@ -3553,9 +3553,7 @@ static void cdrom_sysctl_register(void)
         if (initialized == 1)
                 return;
 
-        cdrom_sysctl_header = register_sysctl_table(cdrom_root_table, 1);
-        if (cdrom_root_table->ctl_name && cdrom_root_table->child->de)
-                cdrom_root_table->child->de->owner = THIS_MODULE;
+        cdrom_sysctl_header = register_sysctl_table(cdrom_root_table);
 
         /* set the defaults */
         cdrom_sysctl_settings.autoclose = autoclose;
diff --git a/drivers/cdrom/cm206.c b/drivers/cdrom/cm206.c
index b6c61bbb20e1..230131163240 100644
--- a/drivers/cdrom/cm206.c
+++ b/drivers/cdrom/cm206.c
@@ -183,7 +183,6 @@ History:
 #include <linux/errno.h>        /* These include what we really need */
 #include <linux/delay.h>
 #include <linux/string.h>
-#include <linux/sched.h>
 #include <linux/interrupt.h>
 #include <linux/timer.h>
 #include <linux/cdrom.h>
diff --git a/drivers/cdrom/gscd.c b/drivers/cdrom/gscd.c
index fa7082489765..b3ab6e9b8df1 100644
--- a/drivers/cdrom/gscd.c
+++ b/drivers/cdrom/gscd.c
@@ -53,7 +53,6 @@
 #include <linux/slab.h>
 #include <linux/errno.h>
 #include <linux/signal.h>
-#include <linux/sched.h>
 #include <linux/timer.h>
 #include <linux/fs.h>
 #include <linux/mm.h>
diff --git a/drivers/cdrom/sjcd.c b/drivers/cdrom/sjcd.c
index bf5aef4e555b..5409fca5bbfc 100644
--- a/drivers/cdrom/sjcd.c
+++ b/drivers/cdrom/sjcd.c
@@ -60,7 +60,6 @@
 
 #include <linux/module.h>
 #include <linux/errno.h>
-#include <linux/sched.h>
 #include <linux/mm.h>
 #include <linux/timer.h>
 #include <linux/fs.h>
diff --git a/drivers/char/agp/Makefile b/drivers/char/agp/Makefile
index 3e581603d0a8..a0d04a23dacd 100644
--- a/drivers/char/agp/Makefile
+++ b/drivers/char/agp/Makefile
@@ -1,6 +1,7 @@
 agpgart-y := backend.o frontend.o generic.o isoch.o
 
 obj-$(CONFIG_AGP)               += agpgart.o
+obj-$(CONFIG_COMPAT)            += compat_ioctl.o
 obj-$(CONFIG_AGP_ALI)           += ali-agp.o
 obj-$(CONFIG_AGP_ATI)           += ati-agp.o
 obj-$(CONFIG_AGP_AMD)           += amd-k7-agp.o
diff --git a/drivers/char/agp/agp.h b/drivers/char/agp/agp.h
index 1d59e2a5b9aa..9bd68d9f0f59 100644
--- a/drivers/char/agp/agp.h
+++ b/drivers/char/agp/agp.h
@@ -114,6 +114,7 @@ struct agp_bridge_driver {
         void (*free_by_type)(struct agp_memory *);
         void *(*agp_alloc_page)(struct agp_bridge_data *);
         void (*agp_destroy_page)(void *);
+        int (*agp_type_to_mask_type) (struct agp_bridge_data *, int);
 };
 
 struct agp_bridge_data {
@@ -218,6 +219,7 @@ struct agp_bridge_data {
 #define I810_PTE_MAIN_UNCACHED  0x00000000
 #define I810_PTE_LOCAL          0x00000002
 #define I810_PTE_VALID          0x00000001
+#define I830_PTE_SYSTEM_CACHED  0x00000006
 #define I810_SMRAM_MISCC        0x70
 #define I810_GFX_MEM_WIN_SIZE   0x00010000
 #define I810_GFX_MEM_WIN_32M    0x00010000
@@ -270,8 +272,16 @@ void global_cache_flush(void);
 void get_agp_version(struct agp_bridge_data *bridge);
 unsigned long agp_generic_mask_memory(struct agp_bridge_data *bridge,
         unsigned long addr, int type);
+int agp_generic_type_to_mask_type(struct agp_bridge_data *bridge,
+                                  int type);
 struct agp_bridge_data *agp_generic_find_bridge(struct pci_dev *pdev);
 
+/* generic functions for user-populated AGP memory types */
+struct agp_memory *agp_generic_alloc_user(size_t page_count, int type);
+void agp_alloc_page_array(size_t size, struct agp_memory *mem);
+void agp_free_page_array(struct agp_memory *mem);
+
+
 /* generic routines for agp>=3 */
 int agp3_generic_fetch_size(void);
 void agp3_generic_tlbflush(struct agp_memory *mem);
@@ -288,6 +298,8 @@ extern struct aper_size_info_16 agp3_generic_sizes[];
 extern int agp_off;
 extern int agp_try_unsupported_boot;
 
+long compat_agp_ioctl(struct file *file, unsigned int cmd, unsigned long arg);
+
 /* Chipset independant registers (from AGP Spec) */
 #define AGP_APBASE      0x10
 
diff --git a/drivers/char/agp/ali-agp.c b/drivers/char/agp/ali-agp.c
index 5a31ec7c62fc..98177a93076f 100644
--- a/drivers/char/agp/ali-agp.c
+++ b/drivers/char/agp/ali-agp.c
@@ -214,6 +214,7 @@ static struct agp_bridge_driver ali_generic_bridge = {
         .free_by_type           = agp_generic_free_by_type,
         .agp_alloc_page         = agp_generic_alloc_page,
         .agp_destroy_page       = ali_destroy_page,
+        .agp_type_to_mask_type  = agp_generic_type_to_mask_type,
 };
 
 static struct agp_bridge_driver ali_m1541_bridge = {
@@ -237,6 +238,7 @@ static struct agp_bridge_driver ali_m1541_bridge = {
         .free_by_type           = agp_generic_free_by_type,
         .agp_alloc_page         = m1541_alloc_page,
         .agp_destroy_page       = m1541_destroy_page,
+        .agp_type_to_mask_type  = agp_generic_type_to_mask_type,
 };
 
 
diff --git a/drivers/char/agp/alpha-agp.c b/drivers/char/agp/alpha-agp.c
index b4e00a343da9..b0acf41c0db9 100644
--- a/drivers/char/agp/alpha-agp.c
+++ b/drivers/char/agp/alpha-agp.c
@@ -91,6 +91,9 @@ static int alpha_core_agp_insert_memory(struct agp_memory *mem, off_t pg_start,
         int num_entries, status;
         void *temp;
 
+        if (type >= AGP_USER_TYPES || mem->type >= AGP_USER_TYPES)
+                return -EINVAL;
+
         temp = agp_bridge->current_size;
         num_entries = A_SIZE_FIX(temp)->num_entries;
         if ((pg_start + mem->page_count) > num_entries)
@@ -142,6 +145,7 @@ struct agp_bridge_driver alpha_core_agp_driver = {
         .free_by_type           = agp_generic_free_by_type,
         .agp_alloc_page         = agp_generic_alloc_page,
         .agp_destroy_page       = agp_generic_destroy_page,
+        .agp_type_to_mask_type  = agp_generic_type_to_mask_type,
 };
 
 struct agp_bridge_data *alpha_bridge;
diff --git a/drivers/char/agp/amd-k7-agp.c b/drivers/char/agp/amd-k7-agp.c
index c85c8cadb6df..3d8d448bf394 100644
--- a/drivers/char/agp/amd-k7-agp.c
+++ b/drivers/char/agp/amd-k7-agp.c
@@ -381,6 +381,7 @@ static struct agp_bridge_driver amd_irongate_driver = {
         .free_by_type           = agp_generic_free_by_type,
         .agp_alloc_page         = agp_generic_alloc_page,
         .agp_destroy_page       = agp_generic_destroy_page,
+        .agp_type_to_mask_type  = agp_generic_type_to_mask_type,
 };
 
 static struct agp_device_ids amd_agp_device_ids[] __devinitdata =
diff --git a/drivers/char/agp/amd64-agp.c b/drivers/char/agp/amd64-agp.c
index 93d2209fee4c..636d984ed4a6 100644
--- a/drivers/char/agp/amd64-agp.c
+++ b/drivers/char/agp/amd64-agp.c
@@ -62,12 +62,18 @@ static int amd64_insert_memory(struct agp_memory *mem, off_t pg_start, int type)
 {
         int i, j, num_entries;
         long long tmp;
+        int mask_type;
+        struct agp_bridge_data *bridge = mem->bridge;
         u32 pte;
 
         num_entries = agp_num_entries();
 
-        if (type != 0 || mem->type != 0)
+        if (type != mem->type)
                 return -EINVAL;
+        mask_type = bridge->driver->agp_type_to_mask_type(bridge, type);
+        if (mask_type != 0)
+                return -EINVAL;
+
 
         /* Make sure we can fit the range in the gatt table. */
         /* FIXME: could wrap */
@@ -90,7 +96,7 @@ static int amd64_insert_memory(struct agp_memory *mem, off_t pg_start, int type)
 
         for (i = 0, j = pg_start; i < mem->page_count; i++, j++) {
                 tmp = agp_bridge->driver->mask_memory(agp_bridge,
-                        mem->memory[i], mem->type);
+                        mem->memory[i], mask_type);
 
                 BUG_ON(tmp & 0xffffff0000000ffcULL);
                 pte = (tmp & 0x000000ff00000000ULL) >> 28;
@@ -247,6 +253,7 @@ static struct agp_bridge_driver amd_8151_driver = {
         .free_by_type           = agp_generic_free_by_type,
         .agp_alloc_page         = agp_generic_alloc_page,
         .agp_destroy_page       = agp_generic_destroy_page,
+        .agp_type_to_mask_type  = agp_generic_type_to_mask_type,
 };
 
 /* Some basic sanity checks for the aperture. */
diff --git a/drivers/char/agp/ati-agp.c b/drivers/char/agp/ati-agp.c
index 9987dc2e0c3f..77c9ad68fba9 100644
--- a/drivers/char/agp/ati-agp.c
+++ b/drivers/char/agp/ati-agp.c
@@ -431,6 +431,7 @@ static struct agp_bridge_driver ati_generic_bridge = {
         .free_by_type           = agp_generic_free_by_type,
         .agp_alloc_page         = agp_generic_alloc_page,
         .agp_destroy_page       = agp_generic_destroy_page,
+        .agp_type_to_mask_type  = agp_generic_type_to_mask_type,
 };
 
 
diff --git a/drivers/char/agp/backend.c b/drivers/char/agp/backend.c
index d59e037ddd12..ebdd6dd66edb 100644
--- a/drivers/char/agp/backend.c
+++ b/drivers/char/agp/backend.c
@@ -43,7 +43,7 @@
  * fix some real stupidity. It's only by chance we can bump
  * past 0.99 at all due to some boolean logic error. */
 #define AGPGART_VERSION_MAJOR 0
-#define AGPGART_VERSION_MINOR 101
+#define AGPGART_VERSION_MINOR 102
 static const struct agp_version agp_current_version =
 {
         .major = AGPGART_VERSION_MAJOR,
diff --git a/drivers/char/agp/compat_ioctl.c b/drivers/char/agp/compat_ioctl.c
new file mode 100644
index 000000000000..fcb4b1bf0d4e
--- /dev/null
+++ b/drivers/char/agp/compat_ioctl.c
@@ -0,0 +1,282 @@
+/*
+ * AGPGART driver frontend compatibility ioctls
+ * Copyright (C) 2004 Silicon Graphics, Inc.
+ * Copyright (C) 2002-2003 Dave Jones
+ * Copyright (C) 1999 Jeff Hartmann
+ * Copyright (C) 1999 Precision Insight, Inc.
+ * Copyright (C) 1999 Xi Graphics, Inc.
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a
+ * copy of this software and associated documentation files (the "Software"),
+ * to deal in the Software without restriction, including without limitation
+ * the rights to use, copy, modify, merge, publish, distribute, sublicense,
+ * and/or sell copies of the Software, and to permit persons to whom the
+ * Software is furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included
+ * in all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
+ * OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.  IN NO EVENT SHALL
+ * JEFF HARTMANN, OR ANY OTHER CONTRIBUTORS BE LIABLE FOR ANY CLAIM,
+ * DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR
+ * OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE
+ * OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+ *
+ */
+
+#include <linux/kernel.h>
+#include <linux/pci.h>
+#include <linux/agpgart.h>
+#include <asm/uaccess.h>
+#include "agp.h"
+#include "compat_ioctl.h"
+
+static int compat_agpioc_info_wrap(struct agp_file_private *priv, void __user *arg)
+{
+        struct agp_info32 userinfo;
+        struct agp_kern_info kerninfo;
+
+        agp_copy_info(agp_bridge, &kerninfo);
+
+        userinfo.version.major = kerninfo.version.major;
+        userinfo.version.minor = kerninfo.version.minor;
+        userinfo.bridge_id = kerninfo.device->vendor |
+            (kerninfo.device->device << 16);
+        userinfo.agp_mode = kerninfo.mode;
+        userinfo.aper_base = (compat_long_t)kerninfo.aper_base;
+        userinfo.aper_size = kerninfo.aper_size;
+        userinfo.pg_total = userinfo.pg_system = kerninfo.max_memory;
+        userinfo.pg_used = kerninfo.current_memory;
+
+        if (copy_to_user(arg, &userinfo, sizeof(userinfo)))
+                return -EFAULT;
+
+        return 0;
+}
+
+static int compat_agpioc_reserve_wrap(struct agp_file_private *priv, void __user *arg)
+{
+        struct agp_region32 ureserve;
+        struct agp_region kreserve;
+        struct agp_client *client;
+        struct agp_file_private *client_priv;
+
+        DBG("");
+        if (copy_from_user(&ureserve, arg, sizeof(ureserve)))
+                return -EFAULT;
+
+        if ((unsigned) ureserve.seg_count >= ~0U/sizeof(struct agp_segment32))
+                return -EFAULT;
+
+        kreserve.pid = ureserve.pid;
+        kreserve.seg_count = ureserve.seg_count;
+
+        client = agp_find_client_by_pid(kreserve.pid);
+
+        if (kreserve.seg_count == 0) {
+                /* remove a client */
+                client_priv = agp_find_private(kreserve.pid);
+
+                if (client_priv != NULL) {
+                        set_bit(AGP_FF_IS_CLIENT, &client_priv->access_flags);
+                        set_bit(AGP_FF_IS_VALID, &client_priv->access_flags);
+                }
+                if (client == NULL) {
+                        /* client is already removed */
+                        return 0;
+                }
+                return agp_remove_client(kreserve.pid);
+        } else {
+                struct agp_segment32 *usegment;
+                struct agp_segment *ksegment;
+                int seg;
+
+                if (ureserve.seg_count >= 16384)
+                        return -EINVAL;
+
+                usegment = kmalloc(sizeof(*usegment) * ureserve.seg_count, GFP_KERNEL);
+                if (!usegment)
+                        return -ENOMEM;
+
+                ksegment = kmalloc(sizeof(*ksegment) * kreserve.seg_count, GFP_KERNEL);
+                if (!ksegment) {
+                        kfree(usegment);
+                        return -ENOMEM;
+                }
+
+                if (copy_from_user(usegment, (void __user *) ureserve.seg_list,
+                                   sizeof(*usegment) * ureserve.seg_count)) {
+                        kfree(usegment);
+                        kfree(ksegment);
+                        return -EFAULT;
+                }
+
+                for (seg = 0; seg < ureserve.seg_count; seg++) {
+                        ksegment[seg].pg_start = usegment[seg].pg_start;
+                        ksegment[seg].pg_count = usegment[seg].pg_count;
+                        ksegment[seg].prot = usegment[seg].prot;
+                }
+
+                kfree(usegment);
+                kreserve.seg_list = ksegment;
+
+                if (client == NULL) {
+                        /* Create the client and add the segment */
+                        client = agp_create_client(kreserve.pid);
+
+                        if (client == NULL) {
+                                kfree(ksegment);
+                                return -ENOMEM;
+                        }
+                        client_priv = agp_find_private(kreserve.pid);
+
+                        if (client_priv != NULL) {
+                                set_bit(AGP_FF_IS_CLIENT, &client_priv->access_flags);
+                                set_bit(AGP_FF_IS_VALID, &client_priv->access_flags);
+                        }
+                }
+                return agp_create_segment(client, &kreserve);
+        }
+        /* Will never really happen */
+        return -EINVAL;
+}
+
+static int compat_agpioc_allocate_wrap(struct agp_file_private *priv, void __user *arg)
+{
+        struct agp_memory *memory;
+        struct agp_allocate32 alloc;
+
+        DBG("");
+        if (copy_from_user(&alloc, arg, sizeof(alloc)))
+                return -EFAULT;
+
+        memory = agp_allocate_memory_wrap(alloc.pg_count, alloc.type);
+
+        if (memory == NULL)
+                return -ENOMEM;
+
+        alloc.key = memory->key;
+        alloc.physical = memory->physical;
+
+        if (copy_to_user(arg, &alloc, sizeof(alloc))) {
+                agp_free_memory_wrap(memory);
+                return -EFAULT;
+        }
+        return 0;
+}
+
+static int compat_agpioc_bind_wrap(struct agp_file_private *priv, void __user *arg)
+{
+        struct agp_bind32 bind_info;
+        struct agp_memory *memory;
+
+        DBG("");
+        if (copy_from_user(&bind_info, arg, sizeof(bind_info)))
+                return -EFAULT;
+
+        memory = agp_find_mem_by_key(bind_info.key);
+
+        if (memory == NULL)
+                return -EINVAL;
+
+        return agp_bind_memory(memory, bind_info.pg_start);
+}
+
+static int compat_agpioc_unbind_wrap(struct agp_file_private *priv, void __user *arg)
+{
+        struct agp_memory *memory;
+        struct agp_unbind32 unbind;
+
+        DBG("");
+        if (copy_from_user(&unbind, arg, sizeof(unbind)))
+                return -EFAULT;
+
+        memory = agp_find_mem_by_key(unbind.key);
+
+        if (memory == NULL)
+                return -EINVAL;
+
+        return agp_unbind_memory(memory);
+}
+
+long compat_agp_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
+{
+        struct agp_file_private *curr_priv = file->private_data;
+        int ret_val = -ENOTTY;
+
+        mutex_lock(&(agp_fe.agp_mutex));
+
+        if ((agp_fe.current_controller == NULL) &&
+            (cmd != AGPIOC_ACQUIRE32)) {
+                ret_val = -EINVAL;
+                goto ioctl_out;
+        }
+        if ((agp_fe.backend_acquired != TRUE) &&
+            (cmd != AGPIOC_ACQUIRE32)) {
+                ret_val = -EBUSY;
+                goto ioctl_out;
+        }
+        if (cmd != AGPIOC_ACQUIRE32) {
+                if (!(test_bit(AGP_FF_IS_CONTROLLER, &curr_priv->access_flags))) {
+                        ret_val = -EPERM;
+                        goto ioctl_out;
+                }
+                /* Use the original pid of the controller,
+                 * in case it's threaded */
+
+                if (agp_fe.current_controller->pid != curr_priv->my_pid) {
+                        ret_val = -EBUSY;
+                        goto ioctl_out;
+                }
+        }
+
+        switch (cmd) {
+        case AGPIOC_INFO32:
+                ret_val = compat_agpioc_info_wrap(curr_priv, (void __user *) arg);
+                break;
+
+        case AGPIOC_ACQUIRE32:
+                ret_val = agpioc_acquire_wrap(curr_priv);
+                break;
+
+        case AGPIOC_RELEASE32:
+                ret_val = agpioc_release_wrap(curr_priv);
+                break;
+
+        case AGPIOC_SETUP32:
+                ret_val = agpioc_setup_wrap(curr_priv, (void __user *) arg);
+                break;
+
+        case AGPIOC_RESERVE32:
+                ret_val = compat_agpioc_reserve_wrap(curr_priv, (void __user *) arg);
+                break;
+
+        case AGPIOC_PROTECT32:
+                ret_val = agpioc_protect_wrap(curr_priv);
+                break;
+
+        case AGPIOC_ALLOCATE32:
+                ret_val = compat_agpioc_allocate_wrap(curr_priv, (void __user *) arg);
+                break;
+
+        case AGPIOC_DEALLOCATE32:
+                ret_val = agpioc_deallocate_wrap(curr_priv, (int) arg);
+                break;
+
+        case AGPIOC_BIND32:
+                ret_val = compat_agpioc_bind_wrap(curr_priv, (void __user *) arg);
+                break;
+
+        case AGPIOC_UNBIND32:
+                ret_val = compat_agpioc_unbind_wrap(curr_priv, (void __user *) arg);
+                break;
+        }
+
+ioctl_out:
+        DBG("ioctl returns %d\n", ret_val);
+        mutex_unlock(&(agp_fe.agp_mutex));
+        return ret_val;
+}
+
diff --git a/drivers/char/agp/compat_ioctl.h b/drivers/char/agp/compat_ioctl.h
new file mode 100644
index 000000000000..71939d637236
--- /dev/null
+++ b/drivers/char/agp/compat_ioctl.h
@@ -0,0 +1,105 @@
+/*
+ * Copyright (C) 1999 Jeff Hartmann
+ * Copyright (C) 1999 Precision Insight, Inc.
+ * Copyright (C) 1999 Xi Graphics, Inc.
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a
+ * copy of this software and associated documentation files (the "Software"),
+ * to deal in the Software without restriction, including without limitation
+ * the rights to use, copy, modify, merge, publish, distribute, sublicense,
+ * and/or sell copies of the Software, and to permit persons to whom the
+ * Software is furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included
+ * in all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
+ * OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.  IN NO EVENT SHALL
+ * JEFF HARTMANN, OR ANY OTHER CONTRIBUTORS BE LIABLE FOR ANY CLAIM,
+ * DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR
+ * OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE
+ * OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+ *
+ */
+
+#ifndef _AGP_COMPAT_IOCTL_H
+#define _AGP_COMPAT_IOCTL_H
+
+#include <linux/compat.h>
+#include <linux/agpgart.h>
+
+#define AGPIOC_INFO32       _IOR (AGPIOC_BASE, 0, compat_uptr_t)
+#define AGPIOC_ACQUIRE32    _IO  (AGPIOC_BASE, 1)
+#define AGPIOC_RELEASE32    _IO  (AGPIOC_BASE, 2)
+#define AGPIOC_SETUP32      _IOW (AGPIOC_BASE, 3, compat_uptr_t)
+#define AGPIOC_RESERVE32    _IOW (AGPIOC_BASE, 4, compat_uptr_t)
+#define AGPIOC_PROTECT32    _IOW (AGPIOC_BASE, 5, compat_uptr_t)
+#define AGPIOC_ALLOCATE32   _IOWR(AGPIOC_BASE, 6, compat_uptr_t)
+#define AGPIOC_DEALLOCATE32 _IOW (AGPIOC_BASE, 7, compat_int_t)
+#define AGPIOC_BIND32       _IOW (AGPIOC_BASE, 8, compat_uptr_t)
+#define AGPIOC_UNBIND32     _IOW (AGPIOC_BASE, 9, compat_uptr_t)
+
+struct agp_info32 {
+        struct agp_version version;     /* version of the driver        */
+        u32 bridge_id;          /* bridge vendor/device         */
+        u32 agp_mode;           /* mode info of bridge          */
+        compat_long_t aper_base;        /* base of aperture             */
+        compat_size_t aper_size;        /* size of aperture             */
+        compat_size_t pg_total; /* max pages (swap + system)    */
+        compat_size_t pg_system;        /* max pages (system)           */
+        compat_size_t pg_used;          /* current pages used           */
+};
+
+/*
+ * The "prot" down below needs still a "sleep" flag somehow ...
+ */
+struct agp_segment32 {
+        compat_off_t pg_start;          /* starting page to populate    */
+        compat_size_t pg_count; /* number of pages              */
+        compat_int_t prot;              /* prot flags for mmap          */
+};
+
+struct agp_region32 {
+        compat_pid_t pid;               /* pid of process               */
+        compat_size_t seg_count;        /* number of segments           */
+        struct agp_segment32 *seg_list;
+};
+
+struct agp_allocate32 {
+        compat_int_t key;               /* tag of allocation            */
+        compat_size_t pg_count; /* number of pages              */
+        u32 type;               /* 0 == normal, other devspec   */
+        u32 physical;           /* device specific (some devices
+                                 * need a phys address of the
+                                 * actual page behind the gatt
+                                 * table)                        */
+};
+
+struct agp_bind32 {
+        compat_int_t key;               /* tag of allocation            */
+        compat_off_t pg_start;          /* starting page to populate    */
+};
+
+struct agp_unbind32 {
+        compat_int_t key;               /* tag of allocation            */
+        u32 priority;           /* priority for paging out      */
+};
+
+extern struct agp_front_data agp_fe;
+
+int agpioc_acquire_wrap(struct agp_file_private *priv);
+int agpioc_release_wrap(struct agp_file_private *priv);
+int agpioc_protect_wrap(struct agp_file_private *priv);
+int agpioc_setup_wrap(struct agp_file_private *priv, void __user *arg);
+int agpioc_deallocate_wrap(struct agp_file_private *priv, int arg);
+struct agp_file_private *agp_find_private(pid_t pid);
+struct agp_client *agp_create_client(pid_t id);
+int agp_remove_client(pid_t id);
+int agp_create_segment(struct agp_client *client, struct agp_region *region);
+void agp_free_memory_wrap(struct agp_memory *memory);
+struct agp_memory *agp_allocate_memory_wrap(size_t pg_count, u32 type);
+struct agp_memory *agp_find_mem_by_key(int key);
+struct agp_client *agp_find_client_by_pid(pid_t id);
+
+#endif /* _AGP_COMPAT_H */
diff --git a/drivers/char/agp/efficeon-agp.c b/drivers/char/agp/efficeon-agp.c
index 30f730ff81c1..658cb1a72d2c 100644
--- a/drivers/char/agp/efficeon-agp.c
+++ b/drivers/char/agp/efficeon-agp.c
@@ -335,6 +335,7 @@ static struct agp_bridge_driver efficeon_driver = {
         .free_by_type           = agp_generic_free_by_type,
         .agp_alloc_page         = agp_generic_alloc_page,
         .agp_destroy_page       = agp_generic_destroy_page,
+        .agp_type_to_mask_type  = agp_generic_type_to_mask_type,
 };
 
 static int __devinit agp_efficeon_probe(struct pci_dev *pdev,
diff --git a/drivers/char/agp/frontend.c b/drivers/char/agp/frontend.c
index 0f2ed2aa2d81..679d7f972439 100644
--- a/drivers/char/agp/frontend.c
+++ b/drivers/char/agp/frontend.c
@@ -41,9 +41,9 @@
 #include <asm/pgtable.h>
 #include "agp.h"
 
-static struct agp_front_data agp_fe;
+struct agp_front_data agp_fe;
 
-static struct agp_memory *agp_find_mem_by_key(int key)
+struct agp_memory *agp_find_mem_by_key(int key)
 {
         struct agp_memory *curr;
 
@@ -159,7 +159,7 @@ static pgprot_t agp_convert_mmap_flags(int prot)
         return vm_get_page_prot(prot_bits);
 }
 
-static int agp_create_segment(struct agp_client *client, struct agp_region *region)
+int agp_create_segment(struct agp_client *client, struct agp_region *region)
 {
         struct agp_segment_priv **ret_seg;
         struct agp_segment_priv *seg;
@@ -211,7 +211,7 @@ static void agp_insert_into_pool(struct agp_memory * temp)
 
 /* File private list routines */
 
-static struct agp_file_private *agp_find_private(pid_t pid)
+struct agp_file_private *agp_find_private(pid_t pid)
 {
         struct agp_file_private *curr;
 
@@ -266,13 +266,13 @@ static void agp_remove_file_private(struct agp_file_private * priv)
  * Wrappers for agp_free_memory & agp_allocate_memory
  * These make sure that internal lists are kept updated.
  */
-static void agp_free_memory_wrap(struct agp_memory *memory)
+void agp_free_memory_wrap(struct agp_memory *memory)
 {
         agp_remove_from_pool(memory);
         agp_free_memory(memory);
 }
 
-static struct agp_memory *agp_allocate_memory_wrap(size_t pg_count, u32 type)
+struct agp_memory *agp_allocate_memory_wrap(size_t pg_count, u32 type)
 {
         struct agp_memory *memory;
 
@@ -484,7 +484,7 @@ static struct agp_controller *agp_find_controller_for_client(pid_t id)
         return NULL;
 }
 
-static struct agp_client *agp_find_client_by_pid(pid_t id)
+struct agp_client *agp_find_client_by_pid(pid_t id)
 {
         struct agp_client *temp;
 
@@ -509,7 +509,7 @@ static void agp_insert_client(struct agp_client *client)
         agp_fe.current_controller->num_clients++;
 }
 
-static struct agp_client *agp_create_client(pid_t id)
+struct agp_client *agp_create_client(pid_t id)
 {
         struct agp_client *new_client;
 
@@ -522,7 +522,7 @@ static struct agp_client *agp_create_client(pid_t id)
         return new_client;
 }
 
-static int agp_remove_client(pid_t id)
+int agp_remove_client(pid_t id)
 {
         struct agp_client *client;
         struct agp_client *prev_client;
@@ -746,7 +746,7 @@ static int agpioc_info_wrap(struct agp_file_private *priv, void __user *arg)
         return 0;
 }
 
-static int agpioc_acquire_wrap(struct agp_file_private *priv)
+int agpioc_acquire_wrap(struct agp_file_private *priv)
 {
         struct agp_controller *controller;
 
@@ -789,14 +789,14 @@ static int agpioc_acquire_wrap(struct agp_file_private *priv)
         return 0;
 }
 
-static int agpioc_release_wrap(struct agp_file_private *priv)
+int agpioc_release_wrap(struct agp_file_private *priv)
 {
         DBG("");
         agp_controller_release_current(agp_fe.current_controller, priv);
         return 0;
 }
 
-static int agpioc_setup_wrap(struct agp_file_private *priv, void __user *arg)
+int agpioc_setup_wrap(struct agp_file_private *priv, void __user *arg)
 {
         struct agp_setup mode;
 
@@ -876,7 +876,7 @@ static int agpioc_reserve_wrap(struct agp_file_private *priv, void __user *arg)
         return -EINVAL;
 }
 
-static int agpioc_protect_wrap(struct agp_file_private *priv)
+int agpioc_protect_wrap(struct agp_file_private *priv)
 {
         DBG("");
         /* This function is not currently implemented */
@@ -892,6 +892,9 @@ static int agpioc_allocate_wrap(struct agp_file_private *priv, void __user *arg)
         if (copy_from_user(&alloc, arg, sizeof(struct agp_allocate)))
                 return -EFAULT;
 
+        if (alloc.type >= AGP_USER_TYPES)
+                return -EINVAL;
+
         memory = agp_allocate_memory_wrap(alloc.pg_count, alloc.type);
 
         if (memory == NULL)
@@ -907,7 +910,7 @@ static int agpioc_allocate_wrap(struct agp_file_private *priv, void __user *arg)
         return 0;
 }
 
-static int agpioc_deallocate_wrap(struct agp_file_private *priv, int arg)
+int agpioc_deallocate_wrap(struct agp_file_private *priv, int arg)
 {
         struct agp_memory *memory;
 
@@ -1043,6 +1046,9 @@ static const struct file_operations agp_fops =
         .read           = agp_read,
         .write          = agp_write,
         .ioctl          = agp_ioctl,
+#ifdef CONFIG_COMPAT
+        .compat_ioctl   = compat_agp_ioctl,
+#endif
         .mmap           = agp_mmap,
         .open           = agp_open,
         .release        = agp_release,
diff --git a/drivers/char/agp/generic.c b/drivers/char/agp/generic.c
index 3491d6f84bc6..7923337c3d26 100644
--- a/drivers/char/agp/generic.c
+++ b/drivers/char/agp/generic.c
@@ -101,6 +101,63 @@ static int agp_get_key(void)
         return -1;
 }
 
+/*
+ * Use kmalloc if possible for the page list. Otherwise fall back to
+ * vmalloc. This speeds things up and also saves memory for small AGP
+ * regions.
+ */
+
+void agp_alloc_page_array(size_t size, struct agp_memory *mem)
+{
+        mem->memory = NULL;
+        mem->vmalloc_flag = 0;
+
+        if (size <= 2*PAGE_SIZE)
+                mem->memory = kmalloc(size, GFP_KERNEL | __GFP_NORETRY);
+        if (mem->memory == NULL) {
+                mem->memory = vmalloc(size);
+                mem->vmalloc_flag = 1;
+        }
+}
+EXPORT_SYMBOL(agp_alloc_page_array);
+
+void agp_free_page_array(struct agp_memory *mem)
+{
+        if (mem->vmalloc_flag) {
+                vfree(mem->memory);
+        } else {
+                kfree(mem->memory);
+        }
+}
+EXPORT_SYMBOL(agp_free_page_array);
+
+
+static struct agp_memory *agp_create_user_memory(unsigned long num_agp_pages)
+{
+        struct agp_memory *new;
+        unsigned long alloc_size = num_agp_pages*sizeof(struct page *);
+
+        new = kzalloc(sizeof(struct agp_memory), GFP_KERNEL);
+        if (new == NULL)
+                return NULL;
+
+        new->key = agp_get_key();
+
+        if (new->key < 0) {
+                kfree(new);
+                return NULL;
+        }
+
+        agp_alloc_page_array(alloc_size, new);
+
+        if (new->memory == NULL) {
+                agp_free_key(new->key);
+                kfree(new);
+                return NULL;
+        }
+        new->num_scratch_pages = 0;
+        return new;
+}
 
 struct agp_memory *agp_create_memory(int scratch_pages)
 {
@@ -116,7 +173,8 @@ struct agp_memory *agp_create_memory(int scratch_pages)
                 kfree(new);
                 return NULL;
         }
-        new->memory = vmalloc(PAGE_SIZE * scratch_pages);
+
+        agp_alloc_page_array(PAGE_SIZE * scratch_pages, new);
 
         if (new->memory == NULL) {
                 agp_free_key(new->key);
@@ -124,6 +182,7 @@ struct agp_memory *agp_create_memory(int scratch_pages)
                 return NULL;
         }
         new->num_scratch_pages = scratch_pages;
+        new->type = AGP_NORMAL_MEMORY;
         return new;
 }
 EXPORT_SYMBOL(agp_create_memory);
@@ -146,6 +205,11 @@ void agp_free_memory(struct agp_memory *curr)
         if (curr->is_bound == TRUE)
                 agp_unbind_memory(curr);
 
+        if (curr->type >= AGP_USER_TYPES) {
+                agp_generic_free_by_type(curr);
+                return;
+        }
+
         if (curr->type != 0) {
                 curr->bridge->driver->free_by_type(curr);
                 return;
@@ -157,7 +221,7 @@ void agp_free_memory(struct agp_memory *curr)
                 flush_agp_mappings();
         }
         agp_free_key(curr->key);
-        vfree(curr->memory);
+        agp_free_page_array(curr);
         kfree(curr);
 }
 EXPORT_SYMBOL(agp_free_memory);
@@ -188,6 +252,13 @@ struct agp_memory *agp_allocate_memory(struct agp_bridge_data *bridge,
         if ((atomic_read(&bridge->current_memory_agp) + page_count) > bridge->max_memory_agp)
                 return NULL;
 
+        if (type >= AGP_USER_TYPES) {
+                new = agp_generic_alloc_user(page_count, type);
+                if (new)
+                        new->bridge = bridge;
+                return new;
+        }
+
         if (type != 0) {
                 new = bridge->driver->alloc_by_type(page_count, type);
                 if (new)
@@ -960,6 +1031,7 @@ int agp_generic_insert_memory(struct agp_memory * mem, off_t pg_start, int type)
         off_t j;
         void *temp;
         struct agp_bridge_data *bridge;
+        int mask_type;
 
         bridge = mem->bridge;
         if (!bridge)
@@ -995,7 +1067,11 @@ int agp_generic_insert_memory(struct agp_memory * mem, off_t pg_start, int type)
         num_entries -= agp_memory_reserved/PAGE_SIZE;
         if (num_entries < 0) num_entries = 0;
 
-        if (type != 0 || mem->type != 0) {
+        if (type != mem->type)
+                return -EINVAL;
+
+        mask_type = bridge->driver->agp_type_to_mask_type(bridge, type);
+        if (mask_type != 0) {
                 /* The generic routines know nothing of memory types */
                 return -EINVAL;
         }
@@ -1018,7 +1094,8 @@ int agp_generic_insert_memory(struct agp_memory * mem, off_t pg_start, int type)
         }
 
         for (i = 0, j = pg_start; i < mem->page_count; i++, j++) {
-                writel(bridge->driver->mask_memory(bridge, mem->memory[i], mem->type), bridge->gatt_table+j);
+                writel(bridge->driver->mask_memory(bridge, mem->memory[i], mask_type),
+                       bridge->gatt_table+j);
         }
         readl(bridge->gatt_table+j-1);  /* PCI Posting. */
 
@@ -1032,6 +1109,7 @@ int agp_generic_remove_memory(struct agp_memory *mem, off_t pg_start, int type)
 {
         size_t i;
         struct agp_bridge_data *bridge;
+        int mask_type;
 
         bridge = mem->bridge;
         if (!bridge)
@@ -1040,7 +1118,11 @@ int agp_generic_remove_memory(struct agp_memory *mem, off_t pg_start, int type)
         if (mem->page_count == 0)
                 return 0;
 
-        if (type != 0 || mem->type != 0) {
+        if (type != mem->type)
+                return -EINVAL;
+
+        mask_type = bridge->driver->agp_type_to_mask_type(bridge, type);
+        if (mask_type != 0) {
                 /* The generic routines know nothing of memory types */
                 return -EINVAL;
         }
@@ -1056,22 +1138,40 @@ int agp_generic_remove_memory(struct agp_memory *mem, off_t pg_start, int type)
 }
 EXPORT_SYMBOL(agp_generic_remove_memory);
 
-
 struct agp_memory *agp_generic_alloc_by_type(size_t page_count, int type)
 {
         return NULL;
 }
 EXPORT_SYMBOL(agp_generic_alloc_by_type);
 
-
 void agp_generic_free_by_type(struct agp_memory *curr)
 {
-        vfree(curr->memory);
+        agp_free_page_array(curr);
         agp_free_key(curr->key);
         kfree(curr);
 }
 EXPORT_SYMBOL(agp_generic_free_by_type);
 
+struct agp_memory *agp_generic_alloc_user(size_t page_count, int type)
+{
+        struct agp_memory *new;
+        int i;
+        int pages;
+
+        pages = (page_count + ENTRIES_PER_PAGE - 1) / ENTRIES_PER_PAGE;
+        new = agp_create_user_memory(page_count);
+        if (new == NULL)
+                return NULL;
+
+        for (i = 0; i < page_count; i++)
+                new->memory[i] = 0;
+        new->page_count = 0;
+        new->type = type;
+        new->num_scratch_pages = pages;
+
+        return new;
+}
+EXPORT_SYMBOL(agp_generic_alloc_user);
 
 /*
  * Basic Page Allocation Routines -
@@ -1165,6 +1265,15 @@ unsigned long agp_generic_mask_memory(struct agp_bridge_data *bridge,
 }
 EXPORT_SYMBOL(agp_generic_mask_memory);
 
+int agp_generic_type_to_mask_type(struct agp_bridge_data *bridge,
+                                  int type)
+{
+        if (type >= AGP_USER_TYPES)
+                return 0;
+        return type;
+}
+EXPORT_SYMBOL(agp_generic_type_to_mask_type);
+
 /*
  * These functions are implemented according to the AGPv3 spec,
  * which covers implementation details that had previously been
diff --git a/drivers/char/agp/hp-agp.c b/drivers/char/agp/hp-agp.c
index 907fb66ec4a9..847deabf7f9b 100644
--- a/drivers/char/agp/hp-agp.c
+++ b/drivers/char/agp/hp-agp.c
@@ -438,6 +438,7 @@ struct agp_bridge_driver hp_zx1_driver = {
         .free_by_type           = agp_generic_free_by_type,
         .agp_alloc_page         = agp_generic_alloc_page,
         .agp_destroy_page       = agp_generic_destroy_page,
+        .agp_type_to_mask_type  = agp_generic_type_to_mask_type,
         .cant_use_aperture      = 1,
 };
 
diff --git a/drivers/char/agp/i460-agp.c b/drivers/char/agp/i460-agp.c
index 91769443d8fe..3e7618653abd 100644
--- a/drivers/char/agp/i460-agp.c
+++ b/drivers/char/agp/i460-agp.c
@@ -293,6 +293,9 @@ static int i460_insert_memory_small_io_page (struct agp_memory *mem,
         pr_debug("i460_insert_memory_small_io_page(mem=%p, pg_start=%ld, type=%d, paddr0=0x%lx)\n",
                  mem, pg_start, type, mem->memory[0]);
 
+        if (type >= AGP_USER_TYPES || mem->type >= AGP_USER_TYPES)
+                return -EINVAL;
+
         io_pg_start = I460_IOPAGES_PER_KPAGE * pg_start;
 
         temp = agp_bridge->current_size;
@@ -396,6 +399,9 @@ static int i460_insert_memory_large_io_page (struct agp_memory *mem,
         struct lp_desc *start, *end, *lp;
         void *temp;
 
+        if (type >= AGP_USER_TYPES || mem->type >= AGP_USER_TYPES)
+                return -EINVAL;
+
         temp = agp_bridge->current_size;
         num_entries = A_SIZE_8(temp)->num_entries;
 
@@ -572,6 +578,7 @@ struct agp_bridge_driver intel_i460_driver = {
 #endif
         .alloc_by_type          = agp_generic_alloc_by_type,
         .free_by_type           = agp_generic_free_by_type,
+        .agp_type_to_mask_type  = agp_generic_type_to_mask_type,
         .cant_use_aperture      = 1,
 };
 
diff --git a/drivers/char/agp/intel-agp.c b/drivers/char/agp/intel-agp.c
index a3011de51f7c..06b0bb6d982f 100644
--- a/drivers/char/agp/intel-agp.c
+++ b/drivers/char/agp/intel-agp.c
@@ -5,6 +5,7 @@
 #include <linux/module.h>
 #include <linux/pci.h>
 #include <linux/init.h>
+#include <linux/kernel.h>
 #include <linux/pagemap.h>
 #include <linux/agp_backend.h>
 #include "agp.h"
@@ -24,6 +25,9 @@
                  agp_bridge->dev->device == PCI_DEVICE_ID_INTEL_82965G_HB)
 
 
+extern int agp_memory_reserved;
+
+
 /* Intel 815 register */
 #define INTEL_815_APCONT        0x51
 #define INTEL_815_ATTBASE_MASK  ~0x1FFFFFFF
@@ -68,12 +72,15 @@ static struct aper_size_info_fixed intel_i810_sizes[] =
 
 #define AGP_DCACHE_MEMORY       1
 #define AGP_PHYS_MEMORY         2
+#define INTEL_AGP_CACHED_MEMORY 3
 
 static struct gatt_mask intel_i810_masks[] =
 {
         {.mask = I810_PTE_VALID, .type = 0},
         {.mask = (I810_PTE_VALID | I810_PTE_LOCAL), .type = AGP_DCACHE_MEMORY},
-        {.mask = I810_PTE_VALID, .type = 0}
+        {.mask = I810_PTE_VALID, .type = 0},
+        {.mask = I810_PTE_VALID | I830_PTE_SYSTEM_CACHED,
+         .type = INTEL_AGP_CACHED_MEMORY}
 };
 
 static struct _intel_i810_private {
@@ -117,13 +124,15 @@ static int intel_i810_configure(void)
 
         current_size = A_SIZE_FIX(agp_bridge->current_size);
 
-        pci_read_config_dword(intel_i810_private.i810_dev, I810_MMADDR, &temp);
-        temp &= 0xfff80000;
-
-        intel_i810_private.registers = ioremap(temp, 128 * 4096);
         if (!intel_i810_private.registers) {
-                printk(KERN_ERR PFX "Unable to remap memory.\n");
-                return -ENOMEM;
+                pci_read_config_dword(intel_i810_private.i810_dev, I810_MMADDR, &temp);
+                temp &= 0xfff80000;
+
+                intel_i810_private.registers = ioremap(temp, 128 * 4096);
+                if (!intel_i810_private.registers) {
+                        printk(KERN_ERR PFX "Unable to remap memory.\n");
+                        return -ENOMEM;
+                }
         }
 
         if ((readl(intel_i810_private.registers+I810_DRAM_CTL)
@@ -201,62 +210,79 @@ static void i8xx_destroy_pages(void *addr)
         atomic_dec(&agp_bridge->current_memory_agp);
 }
 
+static int intel_i830_type_to_mask_type(struct agp_bridge_data *bridge,
+                                        int type)
+{
+        if (type < AGP_USER_TYPES)
+                return type;
+        else if (type == AGP_USER_CACHED_MEMORY)
+                return INTEL_AGP_CACHED_MEMORY;
+        else
+                return 0;
+}
+
 static int intel_i810_insert_entries(struct agp_memory *mem, off_t pg_start,
                                 int type)
 {
         int i, j, num_entries;
         void *temp;
+        int ret = -EINVAL;
+        int mask_type;
 
         if (mem->page_count == 0)
-                return 0;
+                goto out;
 
         temp = agp_bridge->current_size;
         num_entries = A_SIZE_FIX(temp)->num_entries;
 
         if ((pg_start + mem->page_count) > num_entries)
-                return -EINVAL;
+                goto out_err;
 
-        for (j = pg_start; j < (pg_start + mem->page_count); j++) {
-                if (!PGE_EMPTY(agp_bridge, readl(agp_bridge->gatt_table+j)))
-                        return -EBUSY;
-        }
 
-        if (type != 0 || mem->type != 0) {
-                if ((type == AGP_DCACHE_MEMORY) && (mem->type == AGP_DCACHE_MEMORY)) {
-                        /* special insert */
-                        if (!mem->is_flushed) {
-                                global_cache_flush();
-                                mem->is_flushed = TRUE;
-                        }
-
-                        for (i = pg_start; i < (pg_start + mem->page_count); i++) {
-                                writel((i*4096)|I810_PTE_LOCAL|I810_PTE_VALID, intel_i810_private.registers+I810_PTE_BASE+(i*4));
-                        }
-                        readl(intel_i810_private.registers+I810_PTE_BASE+((i-1)*4));    /* PCI Posting. */
-
-                        agp_bridge->driver->tlb_flush(mem);
-                        return 0;
+        for (j = pg_start; j < (pg_start + mem->page_count); j++) {
+                if (!PGE_EMPTY(agp_bridge, readl(agp_bridge->gatt_table+j))) {
+                        ret = -EBUSY;
+                        goto out_err;
                 }
-                if ((type == AGP_PHYS_MEMORY) && (mem->type == AGP_PHYS_MEMORY))
-                        goto insert;
-                return -EINVAL;
         }
 
-insert:
-        if (!mem->is_flushed) {
-                global_cache_flush();
-                mem->is_flushed = TRUE;
-        }
+        if (type != mem->type)
+                goto out_err;
 
-        for (i = 0, j = pg_start; i < mem->page_count; i++, j++) {
-                writel(agp_bridge->driver->mask_memory(agp_bridge,
-                        mem->memory[i], mem->type),
-                        intel_i810_private.registers+I810_PTE_BASE+(j*4));
+        mask_type = agp_bridge->driver->agp_type_to_mask_type(agp_bridge, type);
+
+        switch (mask_type) {
+        case AGP_DCACHE_MEMORY:
+                if (!mem->is_flushed)
+                        global_cache_flush();
+                for (i = pg_start; i < (pg_start + mem->page_count); i++) {
+                        writel((i*4096)|I810_PTE_LOCAL|I810_PTE_VALID,
+                               intel_i810_private.registers+I810_PTE_BASE+(i*4));
+                }
+                readl(intel_i810_private.registers+I810_PTE_BASE+((i-1)*4));
+                break;
+        case AGP_PHYS_MEMORY:
+        case AGP_NORMAL_MEMORY:
+                if (!mem->is_flushed)
+                        global_cache_flush();
+                for (i = 0, j = pg_start; i < mem->page_count; i++, j++) {
+                        writel(agp_bridge->driver->mask_memory(agp_bridge,
+                                                               mem->memory[i],
+                                                               mask_type),
+                               intel_i810_private.registers+I810_PTE_BASE+(j*4));
+                }
+                readl(intel_i810_private.registers+I810_PTE_BASE+((j-1)*4));
+                break;
+        default:
+                goto out_err;
         }
-        readl(intel_i810_private.registers+I810_PTE_BASE+((j-1)*4));    /* PCI Posting. */
 
         agp_bridge->driver->tlb_flush(mem);
-        return 0;
+out:
+        ret = 0;
+out_err:
+        mem->is_flushed = 1;
+        return ret;
 }
 
 static int intel_i810_remove_entries(struct agp_memory *mem, off_t pg_start,
@@ -337,12 +363,11 @@ static struct agp_memory *intel_i810_alloc_by_type(size_t pg_count, int type)
                 new->type = AGP_DCACHE_MEMORY;
                 new->page_count = pg_count;
                 new->num_scratch_pages = 0;
-                vfree(new->memory);
+                agp_free_page_array(new);
                 return new;
         }
         if (type == AGP_PHYS_MEMORY)
                 return alloc_agpphysmem_i8xx(pg_count, type);
-
         return NULL;
 }
 
@@ -357,7 +382,7 @@ static void intel_i810_free_by_type(struct agp_memory *curr)
                                  gart_to_virt(curr->memory[0]));
                         global_flush_tlb();
                 }
-                vfree(curr->memory);
+                agp_free_page_array(curr);
         }
         kfree(curr);
 }
@@ -619,9 +644,11 @@ static int intel_i830_insert_entries(struct agp_memory *mem,off_t pg_start, int
 {
         int i,j,num_entries;
         void *temp;
+        int ret = -EINVAL;
+        int mask_type;
 
         if (mem->page_count == 0)
-                return 0;
+                goto out;
 
         temp = agp_bridge->current_size;
         num_entries = A_SIZE_FIX(temp)->num_entries;
@@ -631,34 +658,41 @@ static int intel_i830_insert_entries(struct agp_memory *mem,off_t pg_start, int
                                 pg_start,intel_i830_private.gtt_entries);
 
                 printk (KERN_INFO PFX "Trying to insert into local/stolen memory\n");
-                return -EINVAL;
+                goto out_err;
         }
 
         if ((pg_start + mem->page_count) > num_entries)
-                return -EINVAL;
+                goto out_err;
 
         /* The i830 can't check the GTT for entries since its read only,
          * depend on the caller to make the correct offset decisions.
          */
 
-        if ((type != 0 && type != AGP_PHYS_MEMORY) ||
-                (mem->type != 0 && mem->type != AGP_PHYS_MEMORY))
-                return -EINVAL;
+        if (type != mem->type)
+                goto out_err;
+
+        mask_type = agp_bridge->driver->agp_type_to_mask_type(agp_bridge, type);
 
-        if (!mem->is_flushed) {
+        if (mask_type != 0 && mask_type != AGP_PHYS_MEMORY &&
+            mask_type != INTEL_AGP_CACHED_MEMORY)
+                goto out_err;
+
+        if (!mem->is_flushed)
                 global_cache_flush();
-                mem->is_flushed = TRUE;
-        }
 
         for (i = 0, j = pg_start; i < mem->page_count; i++, j++) {
                 writel(agp_bridge->driver->mask_memory(agp_bridge,
-                        mem->memory[i], mem->type),
-                        intel_i830_private.registers+I810_PTE_BASE+(j*4));
+                                                       mem->memory[i], mask_type),
+                       intel_i830_private.registers+I810_PTE_BASE+(j*4));
         }
         readl(intel_i830_private.registers+I810_PTE_BASE+((j-1)*4));
-
         agp_bridge->driver->tlb_flush(mem);
-        return 0;
+
+out:
+        ret = 0;
+out_err:
+        mem->is_flushed = 1;
+        return ret;
 }
 
 static int intel_i830_remove_entries(struct agp_memory *mem,off_t pg_start,
@@ -687,7 +721,6 @@ static struct agp_memory *intel_i830_alloc_by_type(size_t pg_count,int type)
 {
         if (type == AGP_PHYS_MEMORY)
                 return alloc_agpphysmem_i8xx(pg_count, type);
-
         /* always return NULL for other allocation types for now */
         return NULL;
 }
@@ -734,9 +767,11 @@ static int intel_i915_insert_entries(struct agp_memory *mem,off_t pg_start,
 {
         int i,j,num_entries;
         void *temp;
+        int ret = -EINVAL;
+        int mask_type;
 
         if (mem->page_count == 0)
-                return 0;
+                goto out;
 
         temp = agp_bridge->current_size;
         num_entries = A_SIZE_FIX(temp)->num_entries;
@@ -746,33 +781,41 @@ static int intel_i915_insert_entries(struct agp_memory *mem,off_t pg_start,
                                 pg_start,intel_i830_private.gtt_entries);
 
                 printk (KERN_INFO PFX "Trying to insert into local/stolen memory\n");
-                return -EINVAL;
+                goto out_err;
         }
 
         if ((pg_start + mem->page_count) > num_entries)
-                return -EINVAL;
+                goto out_err;
 
-        /* The i830 can't check the GTT for entries since its read only,
+        /* The i915 can't check the GTT for entries since its read only,
          * depend on the caller to make the correct offset decisions.
          */
 
-        if ((type != 0 && type != AGP_PHYS_MEMORY) ||
-                (mem->type != 0 && mem->type != AGP_PHYS_MEMORY))
-                return -EINVAL;
+        if (type != mem->type)
+                goto out_err;
+
+        mask_type = agp_bridge->driver->agp_type_to_mask_type(agp_bridge, type);
 
-        if (!mem->is_flushed) {
+        if (mask_type != 0 && mask_type != AGP_PHYS_MEMORY &&
+            mask_type != INTEL_AGP_CACHED_MEMORY)
+                goto out_err;
+
+        if (!mem->is_flushed)
                 global_cache_flush();
-                mem->is_flushed = TRUE;
-        }
 
         for (i = 0, j = pg_start; i < mem->page_count; i++, j++) {
                 writel(agp_bridge->driver->mask_memory(agp_bridge,
-                        mem->memory[i], mem->type), intel_i830_private.gtt+j);
+                        mem->memory[i], mask_type), intel_i830_private.gtt+j);
         }
-        readl(intel_i830_private.gtt+j-1);
 
+        readl(intel_i830_private.gtt+j-1);
         agp_bridge->driver->tlb_flush(mem);
-        return 0;
+
+ out:
+        ret = 0;
+ out_err:
+        mem->is_flushed = 1;
+        return ret;
 }
 
 static int intel_i915_remove_entries(struct agp_memory *mem,off_t pg_start,
@@ -803,7 +846,7 @@ static int intel_i915_remove_entries(struct agp_memory *mem,off_t pg_start,
  */
 static int intel_i9xx_fetch_size(void)
 {
-        int num_sizes = sizeof(intel_i830_sizes) / sizeof(*intel_i830_sizes);
+        int num_sizes = ARRAY_SIZE(intel_i830_sizes);
         int aper_size; /* size in megabytes */
         int i;
 
@@ -1384,6 +1427,7 @@ static struct agp_bridge_driver intel_generic_driver = {
         .free_by_type           = agp_generic_free_by_type,
         .agp_alloc_page         = agp_generic_alloc_page,
         .agp_destroy_page       = agp_generic_destroy_page,
+        .agp_type_to_mask_type  = agp_generic_type_to_mask_type,
 };
 
 static struct agp_bridge_driver intel_810_driver = {
@@ -1408,6 +1452,7 @@ static struct agp_bridge_driver intel_810_driver = {
         .free_by_type           = intel_i810_free_by_type,
         .agp_alloc_page         = agp_generic_alloc_page,
         .agp_destroy_page       = agp_generic_destroy_page,
+        .agp_type_to_mask_type  = agp_generic_type_to_mask_type,
 };
 
 static struct agp_bridge_driver intel_815_driver = {
@@ -1431,6 +1476,7 @@ static struct agp_bridge_driver intel_815_driver = {
         .free_by_type           = agp_generic_free_by_type,
         .agp_alloc_page         = agp_generic_alloc_page,
         .agp_destroy_page       = agp_generic_destroy_page,
+        .agp_type_to_mask_type  = agp_generic_type_to_mask_type,
 };
 
 static struct agp_bridge_driver intel_830_driver = {
@@ -1455,6 +1501,7 @@ static struct agp_bridge_driver intel_830_driver = {
         .free_by_type           = intel_i810_free_by_type,
         .agp_alloc_page         = agp_generic_alloc_page,
         .agp_destroy_page       = agp_generic_destroy_page,
+        .agp_type_to_mask_type  = intel_i830_type_to_mask_type,
 };
 
 static struct agp_bridge_driver intel_820_driver = {
@@ -1478,6 +1525,7 @@ static struct agp_bridge_driver intel_820_driver = {
         .free_by_type           = agp_generic_free_by_type,
         .agp_alloc_page         = agp_generic_alloc_page,
         .agp_destroy_page       = agp_generic_destroy_page,
+        .agp_type_to_mask_type  = agp_generic_type_to_mask_type,
 };
 
 static struct agp_bridge_driver intel_830mp_driver = {
@@ -1501,6 +1549,7 @@ static struct agp_bridge_driver intel_830mp_driver = {
         .free_by_type           = agp_generic_free_by_type,
         .agp_alloc_page         = agp_generic_alloc_page,
         .agp_destroy_page       = agp_generic_destroy_page,
+        .agp_type_to_mask_type  = agp_generic_type_to_mask_type,
 };
 
 static struct agp_bridge_driver intel_840_driver = {
@@ -1524,6 +1573,7 @@ static struct agp_bridge_driver intel_840_driver = {
         .free_by_type           = agp_generic_free_by_type,
         .agp_alloc_page         = agp_generic_alloc_page,
         .agp_destroy_page       = agp_generic_destroy_page,
+        .agp_type_to_mask_type  = agp_generic_type_to_mask_type,
 };
 
 static struct agp_bridge_driver intel_845_driver = {
@@ -1547,6 +1597,7 @@ static struct agp_bridge_driver intel_845_driver = {
         .free_by_type           = agp_generic_free_by_type,
         .agp_alloc_page         = agp_generic_alloc_page,
         .agp_destroy_page       = agp_generic_destroy_page,
+        .agp_type_to_mask_type  = agp_generic_type_to_mask_type,
 };
 
 static struct agp_bridge_driver intel_850_driver = {
@@ -1570,6 +1621,7 @@ static struct agp_bridge_driver intel_850_driver = {
         .free_by_type           = agp_generic_free_by_type,
         .agp_alloc_page         = agp_generic_alloc_page,
         .agp_destroy_page       = agp_generic_destroy_page,
+        .agp_type_to_mask_type  = agp_generic_type_to_mask_type,
 };
 
 static struct agp_bridge_driver intel_860_driver = {
@@ -1593,6 +1645,7 @@ static struct agp_bridge_driver intel_860_driver = {
         .free_by_type           = agp_generic_free_by_type,
         .agp_alloc_page         = agp_generic_alloc_page,
         .agp_destroy_page       = agp_generic_destroy_page,
+        .agp_type_to_mask_type  = agp_generic_type_to_mask_type,
 };
 
 static struct agp_bridge_driver intel_915_driver = {
@@ -1617,6 +1670,7 @@ static struct agp_bridge_driver intel_915_driver = {
         .free_by_type           = intel_i810_free_by_type,
         .agp_alloc_page         = agp_generic_alloc_page,
         .agp_destroy_page       = agp_generic_destroy_page,
+        .agp_type_to_mask_type  = intel_i830_type_to_mask_type,
 };
 
 static struct agp_bridge_driver intel_i965_driver = {
@@ -1641,6 +1695,7 @@ static struct agp_bridge_driver intel_i965_driver = {
        .free_by_type           = intel_i810_free_by_type,
        .agp_alloc_page         = agp_generic_alloc_page,
        .agp_destroy_page       = agp_generic_destroy_page,
+       .agp_type_to_mask_type  = intel_i830_type_to_mask_type,
 };
 
 static struct agp_bridge_driver intel_7505_driver = {
@@ -1664,6 +1719,7 @@ static struct agp_bridge_driver intel_7505_driver = {
         .free_by_type           = agp_generic_free_by_type,
         .agp_alloc_page         = agp_generic_alloc_page,
         .agp_destroy_page       = agp_generic_destroy_page,
+        .agp_type_to_mask_type  = agp_generic_type_to_mask_type,
 };
 
 static int find_i810(u16 device)
diff --git a/drivers/char/agp/nvidia-agp.c b/drivers/char/agp/nvidia-agp.c
index df7f37b2739a..2563286b2fcf 100644
--- a/drivers/char/agp/nvidia-agp.c
+++ b/drivers/char/agp/nvidia-agp.c
@@ -310,6 +310,7 @@ static struct agp_bridge_driver nvidia_driver = {
         .free_by_type           = agp_generic_free_by_type,
         .agp_alloc_page         = agp_generic_alloc_page,
         .agp_destroy_page       = agp_generic_destroy_page,
+        .agp_type_to_mask_type  = agp_generic_type_to_mask_type,
 };
 
 static int __devinit agp_nvidia_probe(struct pci_dev *pdev,
diff --git a/drivers/char/agp/parisc-agp.c b/drivers/char/agp/parisc-agp.c
index 17c50b0f83f0..b7b4590673ae 100644
--- a/drivers/char/agp/parisc-agp.c
+++ b/drivers/char/agp/parisc-agp.c
@@ -228,6 +228,7 @@ struct agp_bridge_driver parisc_agp_driver = {
         .free_by_type           = agp_generic_free_by_type,
         .agp_alloc_page         = agp_generic_alloc_page,
         .agp_destroy_page       = agp_generic_destroy_page,
+        .agp_type_to_mask_type  = agp_generic_type_to_mask_type,
         .cant_use_aperture      = 1,
 };
 
diff --git a/drivers/char/agp/sgi-agp.c b/drivers/char/agp/sgi-agp.c
index 902648db7efa..92d1dc45b9be 100644
--- a/drivers/char/agp/sgi-agp.c
+++ b/drivers/char/agp/sgi-agp.c
@@ -265,6 +265,7 @@ struct agp_bridge_driver sgi_tioca_driver = {
         .free_by_type = agp_generic_free_by_type,
         .agp_alloc_page = sgi_tioca_alloc_page,
         .agp_destroy_page = agp_generic_destroy_page,
+        .agp_type_to_mask_type  = agp_generic_type_to_mask_type,
         .cant_use_aperture = 1,
         .needs_scratch_page = 0,
         .num_aperture_sizes = 1,
diff --git a/drivers/char/agp/sis-agp.c b/drivers/char/agp/sis-agp.c
index a00fd48a6f05..60342b708152 100644
--- a/drivers/char/agp/sis-agp.c
+++ b/drivers/char/agp/sis-agp.c
@@ -140,6 +140,7 @@ static struct agp_bridge_driver sis_driver = {
         .free_by_type           = agp_generic_free_by_type,
         .agp_alloc_page         = agp_generic_alloc_page,
         .agp_destroy_page       = agp_generic_destroy_page,
+        .agp_type_to_mask_type  = agp_generic_type_to_mask_type,
 };
 
 static struct agp_device_ids sis_agp_device_ids[] __devinitdata =
diff --git a/drivers/char/agp/sworks-agp.c b/drivers/char/agp/sworks-agp.c
index 4f2d7d99902f..9f5ae7714f85 100644
--- a/drivers/char/agp/sworks-agp.c
+++ b/drivers/char/agp/sworks-agp.c
@@ -444,6 +444,7 @@ static struct agp_bridge_driver sworks_driver = {
         .free_by_type           = agp_generic_free_by_type,
         .agp_alloc_page         = agp_generic_alloc_page,
         .agp_destroy_page       = agp_generic_destroy_page,
+        .agp_type_to_mask_type  = agp_generic_type_to_mask_type,
 };
 
 static int __devinit agp_serverworks_probe(struct pci_dev *pdev,
diff --git a/drivers/char/agp/uninorth-agp.c b/drivers/char/agp/uninorth-agp.c
index dffc19382f7e..6c45702e542c 100644
--- a/drivers/char/agp/uninorth-agp.c
+++ b/drivers/char/agp/uninorth-agp.c
@@ -510,6 +510,7 @@ struct agp_bridge_driver uninorth_agp_driver = {
         .free_by_type           = agp_generic_free_by_type,
         .agp_alloc_page         = agp_generic_alloc_page,
         .agp_destroy_page       = agp_generic_destroy_page,
+        .agp_type_to_mask_type  = agp_generic_type_to_mask_type,
         .cant_use_aperture      = 1,
 };
 
@@ -534,6 +535,7 @@ struct agp_bridge_driver u3_agp_driver = {
         .free_by_type           = agp_generic_free_by_type,
         .agp_alloc_page         = agp_generic_alloc_page,
         .agp_destroy_page       = agp_generic_destroy_page,
+        .agp_type_to_mask_type  = agp_generic_type_to_mask_type,
         .cant_use_aperture      = 1,
         .needs_scratch_page     = 1,
 };
diff --git a/drivers/char/agp/via-agp.c b/drivers/char/agp/via-agp.c
index 2ded7a280d7f..2e7c04370cd9 100644
--- a/drivers/char/agp/via-agp.c
+++ b/drivers/char/agp/via-agp.c
@@ -191,6 +191,7 @@ static struct agp_bridge_driver via_agp3_driver = {
         .free_by_type           = agp_generic_free_by_type,
         .agp_alloc_page         = agp_generic_alloc_page,
         .agp_destroy_page       = agp_generic_destroy_page,
+        .agp_type_to_mask_type  = agp_generic_type_to_mask_type,
 };
 
 static struct agp_bridge_driver via_driver = {
@@ -214,6 +215,7 @@ static struct agp_bridge_driver via_driver = {
         .free_by_type           = agp_generic_free_by_type,
         .agp_alloc_page         = agp_generic_alloc_page,
         .agp_destroy_page       = agp_generic_destroy_page,
+        .agp_type_to_mask_type  = agp_generic_type_to_mask_type,
 };
 
 static struct agp_device_ids via_agp_device_ids[] __devinitdata =
diff --git a/drivers/char/briq_panel.c b/drivers/char/briq_panel.c
index 7f60a18ef76b..8dcf9d20f449 100644
--- a/drivers/char/briq_panel.c
+++ b/drivers/char/briq_panel.c
@@ -8,7 +8,6 @@
 
 #include <linux/types.h>
 #include <linux/errno.h>
-#include <linux/sched.h>
 #include <linux/tty.h>
 #include <linux/timer.h>
 #include <linux/kernel.h>
diff --git a/drivers/char/drm/ffb_context.c b/drivers/char/drm/ffb_context.c
index 1383727b443a..ac9ab40d57aa 100644
--- a/drivers/char/drm/ffb_context.c
+++ b/drivers/char/drm/ffb_context.c
@@ -7,7 +7,6 @@
  * for authors.
  */
 
-#include <linux/sched.h>
 #include <asm/upa.h>
 
 #include "ffb.h"
diff --git a/drivers/char/drm/ffb_drv.c b/drivers/char/drm/ffb_drv.c
index dd45111a4854..9a19879e3b68 100644
--- a/drivers/char/drm/ffb_drv.c
+++ b/drivers/char/drm/ffb_drv.c
@@ -9,7 +9,6 @@
 
 #include "ffb_drv.h"
 
-#include <linux/sched.h>
 #include <linux/smp_lock.h>
 #include <asm/shmparam.h>
 #include <asm/oplib.h>
diff --git a/drivers/char/ds1620.c b/drivers/char/ds1620.c
index 48cb8f0e8ebf..3d7efc26aad6 100644
--- a/drivers/char/ds1620.c
+++ b/drivers/char/ds1620.c
@@ -3,7 +3,6 @@
  *   thermometer driver (as used in the Rebel.com NetWinder)
  */
 #include <linux/module.h>
-#include <linux/sched.h>
 #include <linux/miscdevice.h>
 #include <linux/smp_lock.h>
 #include <linux/delay.h>
diff --git a/drivers/char/dsp56k.c b/drivers/char/dsp56k.c
index 06f2dbf17710..db984e481d4c 100644
--- a/drivers/char/dsp56k.c
+++ b/drivers/char/dsp56k.c
@@ -25,7 +25,6 @@
 
 #include <linux/module.h>
 #include <linux/slab.h> /* for kmalloc() and kfree() */
-#include <linux/sched.h>        /* for struct wait_queue etc */
 #include <linux/major.h>
 #include <linux/types.h>
 #include <linux/errno.h>
diff --git a/drivers/char/hangcheck-timer.c b/drivers/char/hangcheck-timer.c
index 1aa93a752a9c..ae76a9ffe89f 100644
--- a/drivers/char/hangcheck-timer.c
+++ b/drivers/char/hangcheck-timer.c
@@ -117,7 +117,7 @@ __setup("hcheck_reboot", hangcheck_parse_reboot);
 __setup("hcheck_dump_tasks", hangcheck_parse_dump_tasks);
 #endif /* not MODULE */
 
-#if defined(CONFIG_X86_64) || defined(CONFIG_S390)
+#if defined(CONFIG_S390)
 # define HAVE_MONOTONIC
 # define TIMER_FREQ 1000000000ULL
 #elif defined(CONFIG_IA64)
diff --git a/drivers/char/hpet.c b/drivers/char/hpet.c
index 20dc3be5ecfc..0be700f4e8fd 100644
--- a/drivers/char/hpet.c
+++ b/drivers/char/hpet.c
@@ -703,7 +703,7 @@ int hpet_control(struct hpet_task *tp, unsigned int cmd, unsigned long arg)
 
 static ctl_table hpet_table[] = {
         {
-         .ctl_name = 1,
+         .ctl_name = CTL_UNNUMBERED,
          .procname = "max-user-freq",
          .data = &hpet_max_freq,
          .maxlen = sizeof(int),
@@ -715,7 +715,7 @@ static ctl_table hpet_table[] = {
 
 static ctl_table hpet_root[] = {
         {
-         .ctl_name = 1,
+         .ctl_name = CTL_UNNUMBERED,
          .procname = "hpet",
          .maxlen = 0,
          .mode = 0555,
@@ -1018,7 +1018,7 @@ static int __init hpet_init(void)
         if (result < 0)
                 return -ENODEV;
 
-        sysctl_header = register_sysctl_table(dev_root, 0);
+        sysctl_header = register_sysctl_table(dev_root);
 
         result = acpi_bus_register_driver(&hpet_acpi_driver);
         if (result < 0) {
diff --git a/drivers/char/hvsi.c b/drivers/char/hvsi.c
index d7806834fc17..50315d6364fd 100644
--- a/drivers/char/hvsi.c
+++ b/drivers/char/hvsi.c
@@ -39,7 +39,6 @@
 #include <linux/module.h>
 #include <linux/major.h>
 #include <linux/kernel.h>
-#include <linux/sched.h>
 #include <linux/spinlock.h>
 #include <linux/sysrq.h>
 #include <linux/tty.h>
diff --git a/drivers/char/ipmi/ipmi_devintf.c b/drivers/char/ipmi/ipmi_devintf.c
index ff2d052177cb..c2aa44ee6eb6 100644
--- a/drivers/char/ipmi/ipmi_devintf.c
+++ b/drivers/char/ipmi/ipmi_devintf.c
@@ -35,7 +35,6 @@
 #include <linux/moduleparam.h>
 #include <linux/errno.h>
 #include <asm/system.h>
-#include <linux/sched.h>
 #include <linux/poll.h>
 #include <linux/spinlock.h>
 #include <linux/slab.h>
diff --git a/drivers/char/ipmi/ipmi_msghandler.c b/drivers/char/ipmi/ipmi_msghandler.c
index 3aff5e99b674..8e222f2b80cc 100644
--- a/drivers/char/ipmi/ipmi_msghandler.c
+++ b/drivers/char/ipmi/ipmi_msghandler.c
@@ -34,7 +34,6 @@
 #include <linux/module.h>
 #include <linux/errno.h>
 #include <asm/system.h>
-#include <linux/sched.h>
 #include <linux/poll.h>
 #include <linux/spinlock.h>
 #include <linux/mutex.h>
diff --git a/drivers/char/ipmi/ipmi_poweroff.c b/drivers/char/ipmi/ipmi_poweroff.c
index 9d23136e598a..e02893b7b300 100644
--- a/drivers/char/ipmi/ipmi_poweroff.c
+++ b/drivers/char/ipmi/ipmi_poweroff.c
@@ -686,7 +686,7 @@ static int ipmi_poweroff_init (void)
                 printk(KERN_INFO PFX "Power cycle is enabled.\n");
 
 #ifdef CONFIG_PROC_FS
-        ipmi_table_header = register_sysctl_table(ipmi_root_table, 1);
+        ipmi_table_header = register_sysctl_table(ipmi_root_table);
         if (!ipmi_table_header) {
                 printk(KERN_ERR PFX "Unable to register powercycle sysctl\n");
                 rv = -ENOMEM;
diff --git a/drivers/char/keyboard.c b/drivers/char/keyboard.c
index c654a3e0c697..cb8d691576da 100644
--- a/drivers/char/keyboard.c
+++ b/drivers/char/keyboard.c
@@ -596,7 +596,6 @@ static void fn_spawn_con(struct vc_data *vc)
 static void fn_SAK(struct vc_data *vc)
 {
         struct work_struct *SAK_work = &vc_cons[fg_console].SAK_work;
-        PREPARE_WORK(SAK_work, vc_SAK);
         schedule_work(SAK_work);
 }
 
diff --git a/drivers/char/nvram.c b/drivers/char/nvram.c
index a39f19c35a6a..204deaa0de80 100644
--- a/drivers/char/nvram.c
+++ b/drivers/char/nvram.c
@@ -37,7 +37,6 @@
 #define NVRAM_VERSION   "1.2"
 
 #include <linux/module.h>
-#include <linux/sched.h>
 #include <linux/smp_lock.h>
 #include <linux/nvram.h>
 
diff --git a/drivers/char/nwflash.c b/drivers/char/nwflash.c
index 206cf6f50695..ba012c2bdf7a 100644
--- a/drivers/char/nwflash.c
+++ b/drivers/char/nwflash.c
@@ -21,7 +21,6 @@
 #include <linux/mm.h>
 #include <linux/delay.h>
 #include <linux/proc_fs.h>
-#include <linux/sched.h>
 #include <linux/miscdevice.h>
 #include <linux/spinlock.h>
 #include <linux/rwsem.h>
diff --git a/drivers/char/pty.c b/drivers/char/pty.c
index c07a1b5cd05d..de14aea34e11 100644
--- a/drivers/char/pty.c
+++ b/drivers/char/pty.c
@@ -14,7 +14,6 @@
 #include <linux/module.h>       /* For EXPORT_SYMBOL */
 
 #include <linux/errno.h>
-#include <linux/sched.h>
 #include <linux/interrupt.h>
 #include <linux/tty.h>
 #include <linux/tty_flip.h>
diff --git a/drivers/char/rtc.c b/drivers/char/rtc.c
index b6d3072dce5a..c7dac9b13351 100644
--- a/drivers/char/rtc.c
+++ b/drivers/char/rtc.c
@@ -282,7 +282,7 @@ irqreturn_t rtc_interrupt(int irq, void *dev_id)
  */
 static ctl_table rtc_table[] = {
         {
-                .ctl_name       = 1,
+                .ctl_name       = CTL_UNNUMBERED,
                 .procname       = "max-user-freq",
                 .data           = &rtc_max_user_freq,
                 .maxlen         = sizeof(int),
@@ -294,9 +294,8 @@ static ctl_table rtc_table[] = {
 
 static ctl_table rtc_root[] = {
         {
-                .ctl_name       = 1,
+                .ctl_name       = CTL_UNNUMBERED,
                 .procname       = "rtc",
-                .maxlen         = 0,
                 .mode           = 0555,
                 .child          = rtc_table,
         },
@@ -307,7 +306,6 @@ static ctl_table dev_root[] = {
         {
                 .ctl_name       = CTL_DEV,
                 .procname       = "dev",
-                .maxlen         = 0,
                 .mode           = 0555,
                 .child          = rtc_root,
         },
@@ -318,7 +316,7 @@ static struct ctl_table_header *sysctl_header;
 
 static int __init init_sysctl(void)
 {
-    sysctl_header = register_sysctl_table(dev_root, 0);
+    sysctl_header = register_sysctl_table(dev_root);
     return 0;
 }
 
diff --git a/drivers/char/ser_a2232.c b/drivers/char/ser_a2232.c
index 75de5f66517a..3c869145bfdc 100644
--- a/drivers/char/ser_a2232.c
+++ b/drivers/char/ser_a2232.c
@@ -86,7 +86,6 @@
 #include <linux/module.h>
 
 #include <linux/types.h>
-#include <linux/sched.h>
 #include <linux/interrupt.h>
 #include <linux/kernel.h>
 #include <linux/errno.h>
diff --git a/drivers/char/sonypi.c b/drivers/char/sonypi.c
index 17d54e1331b2..78237577b05a 100644
--- a/drivers/char/sonypi.c
+++ b/drivers/char/sonypi.c
@@ -36,7 +36,6 @@
 #include <linux/module.h>
 #include <linux/input.h>
 #include <linux/pci.h>
-#include <linux/sched.h>
 #include <linux/init.h>
 #include <linux/interrupt.h>
 #include <linux/miscdevice.h>
diff --git a/drivers/char/sysrq.c b/drivers/char/sysrq.c
index 3757610b7835..1d8c4ae61551 100644
--- a/drivers/char/sysrq.c
+++ b/drivers/char/sysrq.c
@@ -36,6 +36,7 @@
 #include <linux/workqueue.h>
 #include <linux/kexec.h>
 #include <linux/irq.h>
+#include <linux/hrtimer.h>
 
 #include <asm/ptrace.h>
 #include <asm/irq_regs.h>
@@ -89,7 +90,6 @@ static struct sysrq_key_op sysrq_loglevel_op = {
 static void sysrq_handle_SAK(int key, struct tty_struct *tty)
 {
         struct work_struct *SAK_work = &vc_cons[fg_console].SAK_work;
-        PREPARE_WORK(SAK_work, vc_SAK);
         schedule_work(SAK_work);
 }
 static struct sysrq_key_op sysrq_SAK_op = {
@@ -159,6 +159,17 @@ static struct sysrq_key_op sysrq_sync_op = {
         .enable_mask    = SYSRQ_ENABLE_SYNC,
 };
 
+static void sysrq_handle_show_timers(int key, struct tty_struct *tty)
+{
+        sysrq_timer_list_show();
+}
+
+static struct sysrq_key_op sysrq_show_timers_op = {
+        .handler        = sysrq_handle_show_timers,
+        .help_msg       = "show-all-timers(Q)",
+        .action_msg     = "Show Pending Timers",
+};
+
 static void sysrq_handle_mountro(int key, struct tty_struct *tty)
 {
         emergency_remount();
@@ -336,7 +347,7 @@ static struct sysrq_key_op *sysrq_key_table[36] = {
         /* o: This will often be registered as 'Off' at init time */
         NULL,                           /* o */
         &sysrq_showregs_op,             /* p */
-        NULL,                           /* q */
+        &sysrq_show_timers_op,          /* q */
         &sysrq_unraw_op,                /* r */
         &sysrq_sync_op,                 /* s */
         &sysrq_showstate_op,            /* t */
diff --git a/drivers/char/tlclk.c b/drivers/char/tlclk.c
index 4fac2bdf6215..35e58030d296 100644
--- a/drivers/char/tlclk.c
+++ b/drivers/char/tlclk.c
@@ -29,7 +29,6 @@
 
 #include <linux/module.h>
 #include <linux/init.h>
-#include <linux/sched.h>
 #include <linux/kernel.h>       /* printk() */
 #include <linux/fs.h>           /* everything... */
 #include <linux/errno.h>        /* error codes */
diff --git a/drivers/char/toshiba.c b/drivers/char/toshiba.c
index c346ec5a3dc9..5422f999636f 100644
--- a/drivers/char/toshiba.c
+++ b/drivers/char/toshiba.c
@@ -58,7 +58,6 @@
 
 #include <linux/module.h>
 #include <linux/kernel.h>
-#include <linux/sched.h>
 #include <linux/types.h>
 #include <linux/fcntl.h>
 #include <linux/miscdevice.h>
diff --git a/drivers/char/tpm/tpm.c b/drivers/char/tpm/tpm.c
index 2f572b97c16d..e5a254a434f8 100644
--- a/drivers/char/tpm/tpm.c
+++ b/drivers/char/tpm/tpm.c
@@ -23,7 +23,6 @@
  *
  */
 
-#include <linux/sched.h>
 #include <linux/poll.h>
 #include <linux/spinlock.h>
 #include "tpm.h"
diff --git a/drivers/char/tty_io.c b/drivers/char/tty_io.c
index 65672c57470b..5289254e7ab3 100644
--- a/drivers/char/tty_io.c
+++ b/drivers/char/tty_io.c
@@ -3442,7 +3442,6 @@ void do_SAK(struct tty_struct *tty)
 {
         if (!tty)
                 return;
-        PREPARE_WORK(&tty->SAK_work, do_SAK_work);
         schedule_work(&tty->SAK_work);
 }
 
@@ -3568,7 +3567,7 @@ static void initialize_tty_struct(struct tty_struct *tty)
         mutex_init(&tty->atomic_write_lock);
         spin_lock_init(&tty->read_lock);
         INIT_LIST_HEAD(&tty->tty_files);
-        INIT_WORK(&tty->SAK_work, NULL);
+        INIT_WORK(&tty->SAK_work, do_SAK_work);
 }
 
 /*
diff --git a/drivers/char/vc_screen.c b/drivers/char/vc_screen.c
index 26776517f04c..791930320a13 100644
--- a/drivers/char/vc_screen.c
+++ b/drivers/char/vc_screen.c
@@ -25,7 +25,6 @@
 #include <linux/major.h>
 #include <linux/errno.h>
 #include <linux/tty.h>
-#include <linux/sched.h>
 #include <linux/interrupt.h>
 #include <linux/mm.h>
 #include <linux/init.h>
diff --git a/drivers/char/vme_scc.c b/drivers/char/vme_scc.c
index e01317cb1a0e..bef6d886d4fb 100644
--- a/drivers/char/vme_scc.c
+++ b/drivers/char/vme_scc.c
@@ -17,7 +17,6 @@
 #include <linux/kdev_t.h>
 #include <asm/io.h>
 #include <linux/kernel.h>
-#include <linux/sched.h>
 #include <linux/ioport.h>
 #include <linux/interrupt.h>
 #include <linux/errno.h>
diff --git a/drivers/char/vt.c b/drivers/char/vt.c
index 94ce3e7fc9e4..c3f8e383933b 100644
--- a/drivers/char/vt.c
+++ b/drivers/char/vt.c
@@ -2635,6 +2635,7 @@ static int __init con_init(void)
          */
         for (currcons = 0; currcons < MIN_NR_CONSOLES; currcons++) {
                 vc_cons[currcons].d = vc = alloc_bootmem(sizeof(struct vc_data));
+                INIT_WORK(&vc_cons[currcons].SAK_work, vc_SAK);
                 visual_init(vc, currcons, 1);
                 vc->vc_screenbuf = (unsigned short *)alloc_bootmem(vc->vc_screenbuf_size);
                 vc->vc_kmalloced = 0;
diff --git a/drivers/char/watchdog/acquirewdt.c b/drivers/char/watchdog/acquirewdt.c
index 154d67e591e5..85269c365a10 100644
--- a/drivers/char/watchdog/acquirewdt.c
+++ b/drivers/char/watchdog/acquirewdt.c
@@ -48,46 +48,52 @@
  *              It can be 1, 2, 10, 20, 110 or 220 seconds.
  */
 
-#include <linux/module.h>
-#include <linux/moduleparam.h>
-#include <linux/types.h>
-#include <linux/miscdevice.h>
-#include <linux/watchdog.h>
-#include <linux/fs.h>
-#include <linux/ioport.h>
-#include <linux/notifier.h>
-#include <linux/reboot.h>
-#include <linux/init.h>
-
-#include <asm/io.h>
-#include <asm/uaccess.h>
-#include <asm/system.h>
+/*
+ *      Includes, defines, variables, module parameters, ...
+ */
 
+/* Includes */
+#include <linux/module.h>               /* For module specific items */
+#include <linux/moduleparam.h>          /* For new moduleparam's */
+#include <linux/types.h>                /* For standard types (like size_t) */
+#include <linux/errno.h>                /* For the -ENODEV/... values */
+#include <linux/kernel.h>               /* For printk/panic/... */
+#include <linux/miscdevice.h>           /* For MODULE_ALIAS_MISCDEV(WATCHDOG_MINOR) */
+#include <linux/watchdog.h>             /* For the watchdog specific items */
+#include <linux/fs.h>                   /* For file operations */
+#include <linux/ioport.h>               /* For io-port access */
+#include <linux/platform_device.h>      /* For platform_driver framework */
+#include <linux/init.h>                 /* For __init/__exit/... */
+
+#include <asm/uaccess.h>                /* For copy_to_user/put_user/... */
+#include <asm/io.h>                     /* For inb/outb/... */
+
+/* Module information */
+#define DRV_NAME "acquirewdt"
+#define PFX DRV_NAME ": "
 #define WATCHDOG_NAME "Acquire WDT"
-#define PFX WATCHDOG_NAME ": "
 #define WATCHDOG_HEARTBEAT 0    /* There is no way to see what the correct time-out period is */
 
+/* internal variables */
+static struct platform_device *acq_platform_device;     /* the watchdog platform device */
 static unsigned long acq_is_open;
 static char expect_close;
 
-/*
- *      You must set these - there is no sane way to probe for this board.
- */
-
-static int wdt_stop = 0x43;
+/* module parameters */
+static int wdt_stop = 0x43;     /* You must set this - there is no sane way to probe for this board. */
 module_param(wdt_stop, int, 0);
 MODULE_PARM_DESC(wdt_stop, "Acquire WDT 'stop' io port (default 0x43)");
 
-static int wdt_start = 0x443;
+static int wdt_start = 0x443;   /* You must set this - there is no sane way to probe for this board. */
 module_param(wdt_start, int, 0);
 MODULE_PARM_DESC(wdt_start, "Acquire WDT 'start' io port (default 0x443)");
 
 static int nowayout = WATCHDOG_NOWAYOUT;
 module_param(nowayout, int, 0);
-MODULE_PARM_DESC(nowayout, "Watchdog cannot be stopped once started (default=CONFIG_WATCHDOG_NOWAYOUT)");
+MODULE_PARM_DESC(nowayout, "Watchdog cannot be stopped once started (default=" __MODULE_STRING(WATCHDOG_NOWAYOUT) ")");
 
 /*
- *      Kernel methods.
+ *      Watchdog Operations
  */
 
 static void acq_keepalive(void)
@@ -103,7 +109,7 @@ static void acq_stop(void)
 }
 
 /*
- *      /dev/watchdog handling.
+ *      /dev/watchdog handling
  */
 
 static ssize_t acq_write(struct file *file, const char __user *buf, size_t count, loff_t *ppos)
@@ -143,7 +149,7 @@ static int acq_ioctl(struct inode *inode, struct file *file, unsigned int cmd,
         {
                 .options = WDIOF_KEEPALIVEPING | WDIOF_MAGICCLOSE,
                 .firmware_version = 1,
-                .identity = "Acquire WDT",
+                .identity = WATCHDOG_NAME,
         };
 
         switch(cmd)
@@ -214,20 +220,6 @@ static int acq_close(struct inode *inode, struct file *file)
 }
 
 /*
- *      Notifier for system down
- */
-
-static int acq_notify_sys(struct notifier_block *this, unsigned long code,
-        void *unused)
-{
-        if(code==SYS_DOWN || code==SYS_HALT) {
-                /* Turn the WDT off */
-                acq_stop();
-        }
-        return NOTIFY_DONE;
-}
-
-/*
  *      Kernel Interfaces
  */
 
@@ -240,29 +232,20 @@ static const struct file_operations acq_fops = {
         .release        = acq_close,
 };
 
-static struct miscdevice acq_miscdev=
-{
-        .minor = WATCHDOG_MINOR,
-        .name = "watchdog",
-        .fops = &acq_fops,
+static struct miscdevice acq_miscdev = {
+        .minor  = WATCHDOG_MINOR,
+        .name   = "watchdog",
+        .fops   = &acq_fops,
 };
 
 /*
- *      The WDT card needs to learn about soft shutdowns in order to
- *      turn the timebomb registers off.
+ *      Init & exit routines
  */
 
-static struct notifier_block acq_notifier =
-{
-        .notifier_call = acq_notify_sys,
-};
-
-static int __init acq_init(void)
+static int __devinit acq_probe(struct platform_device *dev)
 {
         int ret;
 
-        printk(KERN_INFO "WDT driver for Acquire single board computer initialising.\n");
-
         if (wdt_stop != wdt_start) {
                 if (!request_region(wdt_stop, 1, WATCHDOG_NAME)) {
                         printk (KERN_ERR PFX "I/O address 0x%04x already in use\n",
@@ -279,18 +262,11 @@ static int __init acq_init(void)
                 goto unreg_stop;
         }
 
-        ret = register_reboot_notifier(&acq_notifier);
-        if (ret != 0) {
-                printk (KERN_ERR PFX "cannot register reboot notifier (err=%d)\n",
-                        ret);
-                goto unreg_regions;
-        }
-
         ret = misc_register(&acq_miscdev);
         if (ret != 0) {
                 printk (KERN_ERR PFX "cannot register miscdev on minor=%d (err=%d)\n",
                         WATCHDOG_MINOR, ret);
-                goto unreg_reboot;
+                goto unreg_regions;
         }
 
         printk (KERN_INFO PFX "initialized. (nowayout=%d)\n",
@@ -298,8 +274,6 @@ static int __init acq_init(void)
 
         return 0;
 
-unreg_reboot:
-        unregister_reboot_notifier(&acq_notifier);
 unreg_regions:
         release_region(wdt_start, 1);
 unreg_stop:
@@ -309,13 +283,60 @@ out:
         return ret;
 }
 
-static void __exit acq_exit(void)
+static int __devexit acq_remove(struct platform_device *dev)
 {
         misc_deregister(&acq_miscdev);
-        unregister_reboot_notifier(&acq_notifier);
+        release_region(wdt_start,1);
         if(wdt_stop != wdt_start)
                 release_region(wdt_stop,1);
-        release_region(wdt_start,1);
+
+        return 0;
+}
+
+static void acq_shutdown(struct platform_device *dev)
+{
+        /* Turn the WDT off if we have a soft shutdown */
+        acq_stop();
+}
+
+static struct platform_driver acquirewdt_driver = {
+        .probe          = acq_probe,
+        .remove         = __devexit_p(acq_remove),
+        .shutdown       = acq_shutdown,
+        .driver         = {
+                .owner  = THIS_MODULE,
+                .name   = DRV_NAME,
+        },
+};
+
+static int __init acq_init(void)
+{
+        int err;
+
+        printk(KERN_INFO "WDT driver for Acquire single board computer initialising.\n");
+
+        err = platform_driver_register(&acquirewdt_driver);
+        if (err)
+                return err;
+
+        acq_platform_device = platform_device_register_simple(DRV_NAME, -1, NULL, 0);
+        if (IS_ERR(acq_platform_device)) {
+                err = PTR_ERR(acq_platform_device);
+                goto unreg_platform_driver;
+        }
+
+        return 0;
+
+unreg_platform_driver:
+        platform_driver_unregister(&acquirewdt_driver);
+        return err;
+}
+
+static void __exit acq_exit(void)
+{
+        platform_device_unregister(acq_platform_device);
+        platform_driver_unregister(&acquirewdt_driver);
+        printk(KERN_INFO PFX "Watchdog Module Unloaded.\n");
 }
 
 module_init(acq_init);
diff --git a/drivers/char/watchdog/advantechwdt.c b/drivers/char/watchdog/advantechwdt.c
index 9d732769ba01..8121cc247343 100644
--- a/drivers/char/watchdog/advantechwdt.c
+++ b/drivers/char/watchdog/advantechwdt.c
@@ -35,18 +35,19 @@
 #include <linux/watchdog.h>
 #include <linux/fs.h>
 #include <linux/ioport.h>
-#include <linux/notifier.h>
-#include <linux/reboot.h>
+#include <linux/platform_device.h>
 #include <linux/init.h>
 
 #include <asm/io.h>
 #include <asm/uaccess.h>
 #include <asm/system.h>
 
+#define DRV_NAME "advantechwdt"
+#define PFX DRV_NAME ": "
 #define WATCHDOG_NAME "Advantech WDT"
-#define PFX WATCHDOG_NAME ": "
 #define WATCHDOG_TIMEOUT 60             /* 60 sec default timeout */
 
+static struct platform_device *advwdt_platform_device;  /* the watchdog platform device */
 static unsigned long advwdt_is_open;
 static char adv_expect_close;
 
@@ -75,10 +76,10 @@ MODULE_PARM_DESC(timeout, "Watchdog timeout in seconds. 1<= timeout <=63, defaul
 
 static int nowayout = WATCHDOG_NOWAYOUT;
 module_param(nowayout, int, 0);
-MODULE_PARM_DESC(nowayout, "Watchdog cannot be stopped once started (default=CONFIG_WATCHDOG_NOWAYOUT)");
+MODULE_PARM_DESC(nowayout, "Watchdog cannot be stopped once started (default=" __MODULE_STRING(WATCHDOG_NOWAYOUT) ")");
 
 /*
- *      Kernel methods.
+ *      Watchdog Operations
  */
 
 static void
@@ -94,6 +95,20 @@ advwdt_disable(void)
         inb_p(wdt_stop);
 }
 
+static int
+advwdt_set_heartbeat(int t)
+{
+        if ((t < 1) || (t > 63))
+                return -EINVAL;
+
+        timeout = t;
+        return 0;
+}
+
+/*
+ *      /dev/watchdog handling
+ */
+
 static ssize_t
 advwdt_write(struct file *file, const char __user *buf, size_t count, loff_t *ppos)
 {
@@ -126,7 +141,7 @@ advwdt_ioctl(struct inode *inode, struct file *file, unsigned int cmd,
         static struct watchdog_info ident = {
                 .options = WDIOF_KEEPALIVEPING | WDIOF_SETTIMEOUT | WDIOF_MAGICCLOSE,
                 .firmware_version = 1,
-                .identity = "Advantech WDT",
+                .identity = WATCHDOG_NAME,
         };
 
         switch (cmd) {
@@ -146,9 +161,8 @@ advwdt_ioctl(struct inode *inode, struct file *file, unsigned int cmd,
         case WDIOC_SETTIMEOUT:
           if (get_user(new_timeout, p))
                   return -EFAULT;
-          if ((new_timeout < 1) || (new_timeout > 63))
+          if (advwdt_set_heartbeat(new_timeout))
                   return -EINVAL;
-          timeout = new_timeout;
           advwdt_ping();
           /* Fall */
 
@@ -209,21 +223,6 @@ advwdt_close(struct inode *inode, struct file *file)
 }
 
 /*
- *      Notifier for system down
- */
-
-static int
-advwdt_notify_sys(struct notifier_block *this, unsigned long code,
-        void *unused)
-{
-        if (code == SYS_DOWN || code == SYS_HALT) {
-                /* Turn the WDT off */
-                advwdt_disable();
-        }
-        return NOTIFY_DONE;
-}
-
-/*
  *      Kernel Interfaces
  */
 
@@ -237,33 +236,20 @@ static const struct file_operations advwdt_fops = {
 };
 
 static struct miscdevice advwdt_miscdev = {
-        .minor = WATCHDOG_MINOR,
-        .name = "watchdog",
-        .fops = &advwdt_fops,
+        .minor  = WATCHDOG_MINOR,
+        .name   = "watchdog",
+        .fops   = &advwdt_fops,
 };
 
 /*
- *      The WDT needs to learn about soft shutdowns in order to
- *      turn the timebomb registers off.
+ *      Init & exit routines
  */
 
-static struct notifier_block advwdt_notifier = {
-        .notifier_call = advwdt_notify_sys,
-};
-
-static int __init
-advwdt_init(void)
+static int __devinit
+advwdt_probe(struct platform_device *dev)
 {
         int ret;
 
-        printk(KERN_INFO "WDT driver for Advantech single board computer initialising.\n");
-
-        if (timeout < 1 || timeout > 63) {
-                timeout = WATCHDOG_TIMEOUT;
-                printk (KERN_INFO PFX "timeout value must be 1<=x<=63, using %d\n",
-                        timeout);
-        }
-
         if (wdt_stop != wdt_start) {
                 if (!request_region(wdt_stop, 1, WATCHDOG_NAME)) {
                         printk (KERN_ERR PFX "I/O address 0x%04x already in use\n",
@@ -280,18 +266,18 @@ advwdt_init(void)
                 goto unreg_stop;
         }
 
-        ret = register_reboot_notifier(&advwdt_notifier);
-        if (ret != 0) {
-                printk (KERN_ERR PFX "cannot register reboot notifier (err=%d)\n",
-                        ret);
-                goto unreg_regions;
+        /* Check that the heartbeat value is within it's range ; if not reset to the default */
+        if (advwdt_set_heartbeat(timeout)) {
+                advwdt_set_heartbeat(WATCHDOG_TIMEOUT);
+                printk (KERN_INFO PFX "timeout value must be 1<=x<=63, using %d\n",
+                        timeout);
         }
 
         ret = misc_register(&advwdt_miscdev);
         if (ret != 0) {
                 printk (KERN_ERR PFX "cannot register miscdev on minor=%d (err=%d)\n",
                         WATCHDOG_MINOR, ret);
-                goto unreg_reboot;
+                goto unreg_regions;
         }
 
         printk (KERN_INFO PFX "initialized. timeout=%d sec (nowayout=%d)\n",
@@ -299,8 +285,6 @@ advwdt_init(void)
 
 out:
         return ret;
-unreg_reboot:
-        unregister_reboot_notifier(&advwdt_notifier);
 unreg_regions:
         release_region(wdt_start, 1);
 unreg_stop:
@@ -309,14 +293,64 @@ unreg_stop:
         goto out;
 }
 
-static void __exit
-advwdt_exit(void)
+static int __devexit
+advwdt_remove(struct platform_device *dev)
 {
         misc_deregister(&advwdt_miscdev);
-        unregister_reboot_notifier(&advwdt_notifier);
+        release_region(wdt_start,1);
         if(wdt_stop != wdt_start)
                 release_region(wdt_stop,1);
-        release_region(wdt_start,1);
+
+        return 0;
+}
+
+static void
+advwdt_shutdown(struct platform_device *dev)
+{
+        /* Turn the WDT off if we have a soft shutdown */
+        advwdt_disable();
+}
+
+static struct platform_driver advwdt_driver = {
+        .probe          = advwdt_probe,
+        .remove         = __devexit_p(advwdt_remove),
+        .shutdown       = advwdt_shutdown,
+        .driver         = {
+                .owner  = THIS_MODULE,
+                .name   = DRV_NAME,
+        },
+};
+
+static int __init
+advwdt_init(void)
+{
+        int err;
+
+        printk(KERN_INFO "WDT driver for Advantech single board computer initialising.\n");
+
+        err = platform_driver_register(&advwdt_driver);
+        if (err)
+                return err;
+
+        advwdt_platform_device = platform_device_register_simple(DRV_NAME, -1, NULL, 0);
+        if (IS_ERR(advwdt_platform_device)) {
+                err = PTR_ERR(advwdt_platform_device);
+                goto unreg_platform_driver;
+        }
+
+        return 0;
+
+unreg_platform_driver:
+        platform_driver_unregister(&advwdt_driver);
+        return err;
+}
+
+static void __exit
+advwdt_exit(void)
+{
+        platform_device_unregister(advwdt_platform_device);
+        platform_driver_unregister(&advwdt_driver);
+        printk(KERN_INFO PFX "Watchdog Module Unloaded.\n");
 }
 
 module_init(advwdt_init);
diff --git a/drivers/char/watchdog/alim1535_wdt.c b/drivers/char/watchdog/alim1535_wdt.c
index 01b0d132ee41..e3f6a7d0c83d 100644
--- a/drivers/char/watchdog/alim1535_wdt.c
+++ b/drivers/char/watchdog/alim1535_wdt.c
@@ -40,7 +40,7 @@ MODULE_PARM_DESC(timeout, "Watchdog timeout in seconds. (0<timeout<18000, defaul
 
 static int nowayout = WATCHDOG_NOWAYOUT;
 module_param(nowayout, int, 0);
-MODULE_PARM_DESC(nowayout, "Watchdog cannot be stopped once started (default=CONFIG_WATCHDOG_NOWAYOUT)");
+MODULE_PARM_DESC(nowayout, "Watchdog cannot be stopped once started (default=" __MODULE_STRING(WATCHDOG_NOWAYOUT) ")");
 
 /*
  *      ali_start       -       start watchdog countdown
diff --git a/drivers/char/watchdog/alim7101_wdt.c b/drivers/char/watchdog/alim7101_wdt.c
index e5b2c2ee292c..67aed9f8c362 100644
--- a/drivers/char/watchdog/alim7101_wdt.c
+++ b/drivers/char/watchdog/alim7101_wdt.c
@@ -69,7 +69,7 @@ module_param(use_gpio, int, 0);
 MODULE_PARM_DESC(use_gpio, "Use the gpio watchdog.  (required by old cobalt boards)");
 
 static void wdt_timer_ping(unsigned long);
-static struct timer_list timer;
+static DEFINE_TIMER(timer, wdt_timer_ping, 0, 1);
 static unsigned long next_heartbeat;
 static unsigned long wdt_is_open;
 static char wdt_expect_close;
@@ -78,7 +78,7 @@ static struct pci_dev *alim7101_pmu;
 static int nowayout = WATCHDOG_NOWAYOUT;
 module_param(nowayout, int, 0);
 MODULE_PARM_DESC(nowayout, "Watchdog cannot be stopped once started (default="
-                 __stringify(CONFIG_WATCHDOG_NOWAYOUT) ")");
+                 __MODULE_STRING(WATCHDOG_NOWAYOUT) ")");
 
 /*
  *      Whack the dog
@@ -108,8 +108,7 @@ static void wdt_timer_ping(unsigned long data)
                 printk(KERN_WARNING PFX "Heartbeat lost! Will not ping the watchdog\n");
         }
         /* Re-set the timer interval */
-        timer.expires = jiffies + WDT_INTERVAL;
-        add_timer(&timer);
+        mod_timer(&timer, jiffies + WDT_INTERVAL);
 }
 
 /*
@@ -147,9 +146,7 @@ static void wdt_startup(void)
         wdt_change(WDT_ENABLE);
 
         /* Start the timer */
-        timer.expires = jiffies + WDT_INTERVAL;
-        add_timer(&timer);
-
+        mod_timer(&timer, jiffies + WDT_INTERVAL);
 
         printk(KERN_INFO PFX "Watchdog timer is now enabled.\n");
 }
@@ -380,10 +377,6 @@ static int __init alim7101_wdt_init(void)
                         timeout);
         }
 
-        init_timer(&timer);
-        timer.function = wdt_timer_ping;
-        timer.data = 1;
-
         rc = misc_register(&wdt_miscdev);
         if (rc) {
                 printk(KERN_ERR PFX "cannot register miscdev on minor=%d (err=%d)\n",
diff --git a/drivers/char/watchdog/cpu5wdt.c b/drivers/char/watchdog/cpu5wdt.c
index 00bdabb90f27..bcd7e36ca0aa 100644
--- a/drivers/char/watchdog/cpu5wdt.c
+++ b/drivers/char/watchdog/cpu5wdt.c
@@ -80,10 +80,8 @@ static void cpu5wdt_trigger(unsigned long unused)
         outb(1, port + CPU5WDT_TRIGGER_REG);
 
         /* requeue?? */
-        if( cpu5wdt_device.queue && ticks ) {
-                cpu5wdt_device.timer.expires = jiffies + CPU5WDT_INTERVAL;
-                add_timer(&cpu5wdt_device.timer);
-        }
+        if (cpu5wdt_device.queue && ticks)
+                mod_timer(&cpu5wdt_device.timer, jiffies + CPU5WDT_INTERVAL);
         else {
                 /* ticks doesn't matter anyway */
                 complete(&cpu5wdt_device.stop);
@@ -109,8 +107,7 @@ static void cpu5wdt_start(void)
                 outb(1, port + CPU5WDT_MODE_REG);
                 outb(0, port + CPU5WDT_RESET_REG);
                 outb(0, port + CPU5WDT_ENABLE_REG);
-                cpu5wdt_device.timer.expires = jiffies + CPU5WDT_INTERVAL;
-                add_timer(&cpu5wdt_device.timer);
+                mod_timer(&cpu5wdt_device.timer, jiffies + CPU5WDT_INTERVAL);
         }
         /* if process dies, counter is not decremented */
         cpu5wdt_device.running++;
@@ -245,9 +242,7 @@ static int __devinit cpu5wdt_init(void)
 
         clear_bit(0, &cpu5wdt_device.inuse);
 
-        init_timer(&cpu5wdt_device.timer);
-        cpu5wdt_device.timer.function = cpu5wdt_trigger;
-        cpu5wdt_device.timer.data = 0;
+        setup_timer(&cpu5wdt_device.timer, cpu5wdt_trigger, 0);
 
         cpu5wdt_device.default_ticks = ticks;
 
diff --git a/drivers/char/watchdog/eurotechwdt.c b/drivers/char/watchdog/eurotechwdt.c
index e228d6e173ce..f70387f01b2b 100644
--- a/drivers/char/watchdog/eurotechwdt.c
+++ b/drivers/char/watchdog/eurotechwdt.c
@@ -73,7 +73,7 @@ static char *ev = "int";
 
 static int nowayout = WATCHDOG_NOWAYOUT;
 module_param(nowayout, int, 0);
-MODULE_PARM_DESC(nowayout, "Watchdog cannot be stopped once started (default=CONFIG_WATCHDOG_NOWAYOUT)");
+MODULE_PARM_DESC(nowayout, "Watchdog cannot be stopped once started (default=" __MODULE_STRING(WATCHDOG_NOWAYOUT) ")");
 
 /*
  * Some symbolic names
diff --git a/drivers/char/watchdog/i6300esb.c b/drivers/char/watchdog/i6300esb.c
index fb64df4d7c87..c5982502c03d 100644
--- a/drivers/char/watchdog/i6300esb.c
+++ b/drivers/char/watchdog/i6300esb.c
@@ -91,7 +91,7 @@ MODULE_PARM_DESC(heartbeat, "Watchdog heartbeat in seconds. (1<heartbeat<2046, d
 
 static int nowayout = WATCHDOG_NOWAYOUT;
 module_param(nowayout, int, 0);
-MODULE_PARM_DESC(nowayout, "Watchdog cannot be stopped once started (default=CONFIG_WATCHDOG_NOWAYOUT)");
+MODULE_PARM_DESC(nowayout, "Watchdog cannot be stopped once started (default=" __MODULE_STRING(WATCHDOG_NOWAYOUT) ")");
 
 /*
  * Some i6300ESB specific functions
diff --git a/drivers/char/watchdog/i8xx_tco.c b/drivers/char/watchdog/i8xx_tco.c
index e0627d79707b..a62ef48a15ae 100644
--- a/drivers/char/watchdog/i8xx_tco.c
+++ b/drivers/char/watchdog/i8xx_tco.c
@@ -109,7 +109,7 @@ MODULE_PARM_DESC(heartbeat, "Watchdog heartbeat in seconds. (2<heartbeat<39, def
 
 static int nowayout = WATCHDOG_NOWAYOUT;
 module_param(nowayout, int, 0);
-MODULE_PARM_DESC(nowayout, "Watchdog cannot be stopped once started (default=CONFIG_WATCHDOG_NOWAYOUT)");
+MODULE_PARM_DESC(nowayout, "Watchdog cannot be stopped once started (default=" __MODULE_STRING(WATCHDOG_NOWAYOUT) ")");
 
 /*
  * Some TCO specific functions
diff --git a/drivers/char/watchdog/iTCO_wdt.c b/drivers/char/watchdog/iTCO_wdt.c
index fd8a44a08cd3..3c9684ccd2f9 100644
--- a/drivers/char/watchdog/iTCO_wdt.c
+++ b/drivers/char/watchdog/iTCO_wdt.c
@@ -1,7 +1,7 @@
 /*
  *      intel TCO Watchdog Driver (Used in i82801 and i6300ESB chipsets)
  *
- *      (c) Copyright 2006 Wim Van Sebroeck <wim@iguana.be>.
+ *      (c) Copyright 2006-2007 Wim Van Sebroeck <wim@iguana.be>.
  *
  *      This program is free software; you can redistribute it and/or
  *      modify it under the terms of the GNU General Public License
@@ -49,7 +49,7 @@
 /* Module and version information */
 #define DRV_NAME        "iTCO_wdt"
 #define DRV_VERSION     "1.01"
-#define DRV_RELDATE     "11-Nov-2006"
+#define DRV_RELDATE     "21-Jan-2007"
 #define PFX             DRV_NAME ": "
 
 /* Includes */
@@ -187,7 +187,7 @@ MODULE_PARM_DESC(heartbeat, "Watchdog heartbeat in seconds. (2<heartbeat<39 (TCO
 
 static int nowayout = WATCHDOG_NOWAYOUT;
 module_param(nowayout, int, 0);
-MODULE_PARM_DESC(nowayout, "Watchdog cannot be stopped once started (default=CONFIG_WATCHDOG_NOWAYOUT)");
+MODULE_PARM_DESC(nowayout, "Watchdog cannot be stopped once started (default=" __MODULE_STRING(WATCHDOG_NOWAYOUT) ")");
 
 /* iTCO Vendor Specific Support hooks */
 #ifdef CONFIG_ITCO_VENDOR_SUPPORT
diff --git a/drivers/char/watchdog/ib700wdt.c b/drivers/char/watchdog/ib700wdt.c
index c1ed209a138c..c3a60f52ccb9 100644
--- a/drivers/char/watchdog/ib700wdt.c
+++ b/drivers/char/watchdog/ib700wdt.c
@@ -3,8 +3,8 @@
  *
  *      (c) Copyright 2001 Charles Howes <chowes@vsol.net>
  *
- *      Based on advantechwdt.c which is based on acquirewdt.c which
- *       is based on wdt.c.
+ *      Based on advantechwdt.c which is based on acquirewdt.c which
+ *      is based on wdt.c.
  *
  *      (c) Copyright 2000-2001 Marek Michalkiewicz <marekm@linux.org.pl>
  *
@@ -25,9 +25,9 @@
  *
  *      (c) Copyright 1995    Alan Cox <alan@redhat.com>
  *
- *      14-Dec-2001 Matt Domsch <Matt_Domsch@dell.com>
- *           Added nowayout module option to override CONFIG_WATCHDOG_NOWAYOUT
- *           Added timeout module option to override default
+ *      14-Dec-2001 Matt Domsch <Matt_Domsch@dell.com>
+ *           Added nowayout module option to override CONFIG_WATCHDOG_NOWAYOUT
+ *           Added timeout module option to override default
  *
  */
 
@@ -36,22 +36,24 @@
 #include <linux/miscdevice.h>
 #include <linux/watchdog.h>
 #include <linux/ioport.h>
-#include <linux/notifier.h>
 #include <linux/fs.h>
-#include <linux/reboot.h>
 #include <linux/init.h>
 #include <linux/spinlock.h>
 #include <linux/moduleparam.h>
+#include <linux/platform_device.h>
 
 #include <asm/io.h>
 #include <asm/uaccess.h>
 #include <asm/system.h>
 
+static struct platform_device *ibwdt_platform_device;
 static unsigned long ibwdt_is_open;
 static spinlock_t ibwdt_lock;
 static char expect_close;
 
-#define PFX "ib700wdt: "
+/* Module information */
+#define DRV_NAME "ib700wdt"
+#define PFX DRV_NAME ": "
 
 /*
  *
@@ -118,20 +120,51 @@ static int wd_margin = WD_TIMO;
 
 static int nowayout = WATCHDOG_NOWAYOUT;
 module_param(nowayout, int, 0);
-MODULE_PARM_DESC(nowayout, "Watchdog cannot be stopped once started (default=CONFIG_WATCHDOG_NOWAYOUT)");
+MODULE_PARM_DESC(nowayout, "Watchdog cannot be stopped once started (default=" __MODULE_STRING(WATCHDOG_NOWAYOUT) ")");
 
 
 /*
- *      Kernel methods.
+ *      Watchdog Operations
  */
 
 static void
 ibwdt_ping(void)
 {
+        spin_lock(&ibwdt_lock);
+
         /* Write a watchdog value */
         outb_p(wd_margin, WDT_START);
+
+        spin_unlock(&ibwdt_lock);
 }
 
+static void
+ibwdt_disable(void)
+{
+        spin_lock(&ibwdt_lock);
+        outb_p(0, WDT_STOP);
+        spin_unlock(&ibwdt_lock);
+}
+
+static int
+ibwdt_set_heartbeat(int t)
+{
+        int i;
+
+        if ((t < 0) || (t > 30))
+                return -EINVAL;
+
+        for (i = 0x0F; i > -1; i--)
+                if (wd_times[i] > t)
+                        break;
+        wd_margin = i;
+        return 0;
+}
+
+/*
+ *      /dev/watchdog handling
+ */
+
 static ssize_t
 ibwdt_write(struct file *file, const char __user *buf, size_t count, loff_t *ppos)
 {
@@ -159,7 +192,7 @@ static int
 ibwdt_ioctl(struct inode *inode, struct file *file, unsigned int cmd,
           unsigned long arg)
 {
-        int i, new_margin;
+        int new_margin;
         void __user *argp = (void __user *)arg;
         int __user *p = argp;
 
@@ -176,6 +209,7 @@ ibwdt_ioctl(struct inode *inode, struct file *file, unsigned int cmd,
           break;
 
         case WDIOC_GETSTATUS:
+        case WDIOC_GETBOOTSTATUS:
           return put_user(0, p);
 
         case WDIOC_KEEPALIVE:
@@ -185,18 +219,33 @@ ibwdt_ioctl(struct inode *inode, struct file *file, unsigned int cmd,
         case WDIOC_SETTIMEOUT:
           if (get_user(new_margin, p))
                   return -EFAULT;
-          if ((new_margin < 0) || (new_margin > 30))
+          if (ibwdt_set_heartbeat(new_margin))
                   return -EINVAL;
-          for (i = 0x0F; i > -1; i--)
-                  if (wd_times[i] > new_margin)
-                          break;
-          wd_margin = i;
           ibwdt_ping();
           /* Fall */
 
         case WDIOC_GETTIMEOUT:
           return put_user(wd_times[wd_margin], p);
-          break;
+
+        case WDIOC_SETOPTIONS:
+        {
+          int options, retval = -EINVAL;
+
+          if (get_user(options, p))
+            return -EFAULT;
+
+          if (options & WDIOS_DISABLECARD) {
+            ibwdt_disable();
+            retval = 0;
+          }
+
+          if (options & WDIOS_ENABLECARD) {
+            ibwdt_ping();
+            retval = 0;
+          }
+
+          return retval;
+        }
 
         default:
           return -ENOTTY;
@@ -207,9 +256,7 @@ ibwdt_ioctl(struct inode *inode, struct file *file, unsigned int cmd,
 static int
 ibwdt_open(struct inode *inode, struct file *file)
 {
-        spin_lock(&ibwdt_lock);
         if (test_and_set_bit(0, &ibwdt_is_open)) {
-                spin_unlock(&ibwdt_lock);
                 return -EBUSY;
         }
         if (nowayout)
@@ -217,41 +264,24 @@ ibwdt_open(struct inode *inode, struct file *file)
 
         /* Activate */
         ibwdt_ping();
-        spin_unlock(&ibwdt_lock);
         return nonseekable_open(inode, file);
 }
 
 static int
 ibwdt_close(struct inode *inode, struct file *file)
 {
-        spin_lock(&ibwdt_lock);
-        if (expect_close == 42)
-                outb_p(0, WDT_STOP);
-        else
+        if (expect_close == 42) {
+                ibwdt_disable();
+        } else {
                 printk(KERN_CRIT PFX "WDT device closed unexpectedly.  WDT will not stop!\n");
-
+                ibwdt_ping();
+        }
         clear_bit(0, &ibwdt_is_open);
         expect_close = 0;
-        spin_unlock(&ibwdt_lock);
         return 0;
 }
 
 /*
- *      Notifier for system down
- */
-
-static int
-ibwdt_notify_sys(struct notifier_block *this, unsigned long code,
-        void *unused)
-{
-        if (code == SYS_DOWN || code == SYS_HALT) {
-                /* Turn the WDT off */
-                outb_p(0, WDT_STOP);
-        }
-        return NOTIFY_DONE;
-}
-
-/*
  *      Kernel Interfaces
  */
 
@@ -271,26 +301,14 @@ static struct miscdevice ibwdt_miscdev = {
 };
 
 /*
- *      The WDT needs to learn about soft shutdowns in order to
- *      turn the timebomb registers off.
+ *      Init & exit routines
  */
 
-static struct notifier_block ibwdt_notifier = {
-        .notifier_call = ibwdt_notify_sys,
-};
-
-static int __init ibwdt_init(void)
+static int __devinit ibwdt_probe(struct platform_device *dev)
 {
         int res;
 
-        printk(KERN_INFO PFX "WDT driver for IB700 single board computer initialising.\n");
-
         spin_lock_init(&ibwdt_lock);
-        res = misc_register(&ibwdt_miscdev);
-        if (res) {
-                printk (KERN_ERR PFX "failed to register misc device\n");
-                goto out_nomisc;
-        }
 
 #if WDT_START != WDT_STOP
         if (!request_region(WDT_STOP, 1, "IB700 WDT")) {
@@ -305,34 +323,78 @@ static int __init ibwdt_init(void)
                 res = -EIO;
                 goto out_nostartreg;
         }
-        res = register_reboot_notifier(&ibwdt_notifier);
+
+        res = misc_register(&ibwdt_miscdev);
         if (res) {
-                printk (KERN_ERR PFX "Failed to register reboot notifier.\n");
-                goto out_noreboot;
+                printk (KERN_ERR PFX "failed to register misc device\n");
+                goto out_nomisc;
         }
         return 0;
 
-out_noreboot:
+out_nomisc:
         release_region(WDT_START, 1);
 out_nostartreg:
 #if WDT_START != WDT_STOP
         release_region(WDT_STOP, 1);
 #endif
 out_nostopreg:
-        misc_deregister(&ibwdt_miscdev);
-out_nomisc:
         return res;
 }
 
-static void __exit
-ibwdt_exit(void)
+static int __devexit ibwdt_remove(struct platform_device *dev)
 {
         misc_deregister(&ibwdt_miscdev);
-        unregister_reboot_notifier(&ibwdt_notifier);
+        release_region(WDT_START,1);
 #if WDT_START != WDT_STOP
         release_region(WDT_STOP,1);
 #endif
-        release_region(WDT_START,1);
+        return 0;
+}
+
+static void ibwdt_shutdown(struct platform_device *dev)
+{
+        /* Turn the WDT off if we have a soft shutdown */
+        ibwdt_disable();
+}
+
+static struct platform_driver ibwdt_driver = {
+        .probe          = ibwdt_probe,
+        .remove         = __devexit_p(ibwdt_remove),
+        .shutdown       = ibwdt_shutdown,
+        .driver         = {
+                .owner  = THIS_MODULE,
+                .name   = DRV_NAME,
+        },
+};
+
+static int __init ibwdt_init(void)
+{
+        int err;
+
+        printk(KERN_INFO PFX "WDT driver for IB700 single board computer initialising.\n");
+
+        err = platform_driver_register(&ibwdt_driver);
+        if (err)
+                return err;
+
+        ibwdt_platform_device = platform_device_register_simple(DRV_NAME, -1, NULL, 0);
+        if (IS_ERR(ibwdt_platform_device)) {
+                err = PTR_ERR(ibwdt_platform_device);
+                goto unreg_platform_driver;
+        }
+
+        return 0;
+
+unreg_platform_driver:
+        platform_driver_unregister(&ibwdt_driver);
+        return err;
+}
+
+static void __exit ibwdt_exit(void)
+{
+        platform_device_unregister(ibwdt_platform_device);
+        platform_driver_unregister(&ibwdt_driver);
+        printk(KERN_INFO PFX "Watchdog Module Unloaded.\n");
 }
 
 module_init(ibwdt_init);
diff --git a/drivers/char/watchdog/ibmasr.c b/drivers/char/watchdog/ibmasr.c
index dd6760f1a23b..8195f5023d85 100644
--- a/drivers/char/watchdog/ibmasr.c
+++ b/drivers/char/watchdog/ibmasr.c
@@ -396,7 +396,7 @@ module_init(ibmasr_init);
 module_exit(ibmasr_exit);
 
 module_param(nowayout, int, 0);
-MODULE_PARM_DESC(nowayout, "Watchdog cannot be stopped once started (default=CONFIG_WATCHDOG_NOWAYOUT)");
+MODULE_PARM_DESC(nowayout, "Watchdog cannot be stopped once started (default=" __MODULE_STRING(WATCHDOG_NOWAYOUT) ")");
 
 MODULE_DESCRIPTION("IBM Automatic Server Restart driver");
 MODULE_AUTHOR("Andrey Panin");
diff --git a/drivers/char/watchdog/indydog.c b/drivers/char/watchdog/indydog.c
index 0bc239308989..788245bdaa7f 100644
--- a/drivers/char/watchdog/indydog.c
+++ b/drivers/char/watchdog/indydog.c
@@ -32,7 +32,7 @@ static int indydog_alive;
 
 static int nowayout = WATCHDOG_NOWAYOUT;
 module_param(nowayout, int, 0);
-MODULE_PARM_DESC(nowayout, "Watchdog cannot be stopped once started (default=CONFIG_WATCHDOG_NOWAYOUT)");
+MODULE_PARM_DESC(nowayout, "Watchdog cannot be stopped once started (default=" __MODULE_STRING(WATCHDOG_NOWAYOUT) ")");
 
 static void indydog_start(void)
 {
diff --git a/drivers/char/watchdog/machzwd.c b/drivers/char/watchdog/machzwd.c
index 4d730fdbd528..81fb3dec180f 100644
--- a/drivers/char/watchdog/machzwd.c
+++ b/drivers/char/watchdog/machzwd.c
@@ -95,7 +95,7 @@ MODULE_ALIAS_MISCDEV(WATCHDOG_MINOR);
 
 static int nowayout = WATCHDOG_NOWAYOUT;
 module_param(nowayout, int, 0);
-MODULE_PARM_DESC(nowayout, "Watchdog cannot be stopped once started (default=CONFIG_WATCHDOG_NOWAYOUT)");
+MODULE_PARM_DESC(nowayout, "Watchdog cannot be stopped once started (default=" __MODULE_STRING(WATCHDOG_NOWAYOUT) ")");
 
 #define PFX "machzwd"
 
@@ -118,12 +118,14 @@ static int action = 0;
 module_param(action, int, 0);
 MODULE_PARM_DESC(action, "after watchdog resets, generate: 0 = RESET(*)  1 = SMI  2 = NMI  3 = SCI");
 
+static void zf_ping(unsigned long data);
+
 static int zf_action = GEN_RESET;
 static unsigned long zf_is_open;
 static char zf_expect_close;
 static spinlock_t zf_lock;
 static spinlock_t zf_port_lock;
-static struct timer_list zf_timer;
+static DEFINE_TIMER(zf_timer, zf_ping, 0, 0);
 static unsigned long next_heartbeat = 0;
 
 
@@ -220,9 +222,7 @@ static void zf_timer_on(void)
         next_heartbeat = jiffies + ZF_USER_TIMEO;
 
         /* start the timer for internal ping */
-        zf_timer.expires = jiffies + ZF_HW_TIMEO;
-
-        add_timer(&zf_timer);
+        mod_timer(&zf_timer, jiffies + ZF_HW_TIMEO);
 
         /* start watchdog timer */
         ctrl_reg = zf_get_control();
@@ -260,8 +260,7 @@ static void zf_ping(unsigned long data)
                 zf_set_control(ctrl_reg);
                 spin_unlock_irqrestore(&zf_port_lock, flags);
 
-                zf_timer.expires = jiffies + ZF_HW_TIMEO;
-                add_timer(&zf_timer);
+                mod_timer(&zf_timer, jiffies + ZF_HW_TIMEO);
         }else{
                 printk(KERN_CRIT PFX ": I will reset your machine\n");
         }
@@ -465,11 +464,6 @@ static int __init zf_init(void)
         zf_set_status(0);
         zf_set_control(0);
 
-        /* this is the timer that will do the hard work */
-        init_timer(&zf_timer);
-        zf_timer.function = zf_ping;
-        zf_timer.data = 0;
-
         return 0;
 
 no_reboot:
diff --git a/drivers/char/watchdog/mixcomwd.c b/drivers/char/watchdog/mixcomwd.c
index c2dac0aa1d62..f35e2848aa3e 100644
--- a/drivers/char/watchdog/mixcomwd.c
+++ b/drivers/char/watchdog/mixcomwd.c
@@ -56,16 +56,18 @@ static int mixcomwd_ioports[] = { 0x180, 0x280, 0x380, 0x000 };
 #define FLASHCOM_WATCHDOG_OFFSET 0x4
 #define FLASHCOM_ID 0x18
 
+static void mixcomwd_timerfun(unsigned long d);
+
 static unsigned long mixcomwd_opened; /* long req'd for setbit --RR */
 
 static int watchdog_port;
 static int mixcomwd_timer_alive;
-static DEFINE_TIMER(mixcomwd_timer, NULL, 0, 0);
+static DEFINE_TIMER(mixcomwd_timer, mixcomwd_timerfun, 0, 0);
 static char expect_close;
 
 static int nowayout = WATCHDOG_NOWAYOUT;
 module_param(nowayout, int, 0);
-MODULE_PARM_DESC(nowayout, "Watchdog cannot be stopped once started (default=CONFIG_WATCHDOG_NOWAYOUT)");
+MODULE_PARM_DESC(nowayout, "Watchdog cannot be stopped once started (default=" __MODULE_STRING(WATCHDOG_NOWAYOUT) ")");
 
 static void mixcomwd_ping(void)
 {
@@ -77,7 +79,7 @@ static void mixcomwd_timerfun(unsigned long d)
 {
         mixcomwd_ping();
 
-        mod_timer(&mixcomwd_timer,jiffies+ 5*HZ);
+        mod_timer(&mixcomwd_timer, jiffies + 5 * HZ);
 }
 
 /*
@@ -114,12 +116,8 @@ static int mixcomwd_release(struct inode *inode, struct file *file)
                         printk(KERN_ERR "mixcomwd: release called while internal timer alive");
                         return -EBUSY;
                 }
-                init_timer(&mixcomwd_timer);
-                mixcomwd_timer.expires=jiffies + 5 * HZ;
-                mixcomwd_timer.function=mixcomwd_timerfun;
-                mixcomwd_timer.data=0;
                 mixcomwd_timer_alive=1;
-                add_timer(&mixcomwd_timer);
+                mod_timer(&mixcomwd_timer, jiffies + 5 * HZ);
         } else {
                 printk(KERN_CRIT "mixcomwd: WDT device closed unexpectedly.  WDT will not stop!\n");
         }
@@ -285,7 +283,7 @@ static void __exit mixcomwd_exit(void)
                 if(mixcomwd_timer_alive) {
                         printk(KERN_WARNING "mixcomwd: I quit now, hardware will"
                                " probably reboot!\n");
-                        del_timer(&mixcomwd_timer);
+                        del_timer_sync(&mixcomwd_timer);
                         mixcomwd_timer_alive=0;
                 }
         }
diff --git a/drivers/char/watchdog/pc87413_wdt.c b/drivers/char/watchdog/pc87413_wdt.c
index a77a90717ad2..3d3deae0d64b 100644
--- a/drivers/char/watchdog/pc87413_wdt.c
+++ b/drivers/char/watchdog/pc87413_wdt.c
@@ -631,5 +631,5 @@ module_param(timeout, int, 0);
 MODULE_PARM_DESC(timeout, "Watchdog timeout in minutes (default=" __MODULE_STRING(timeout) ").");
 
 module_param(nowayout, int, 0);
-MODULE_PARM_DESC(nowayout, "Watchdog cannot be stopped once started (default=CONFIG_WATCHDOG_NOWAYOUT)");
+MODULE_PARM_DESC(nowayout, "Watchdog cannot be stopped once started (default=" __MODULE_STRING(WATCHDOG_NOWAYOUT) ")");
 
diff --git a/drivers/char/watchdog/pcwd.c b/drivers/char/watchdog/pcwd.c
index 8e1e6e48e0a7..6e8b5705b5b7 100644
--- a/drivers/char/watchdog/pcwd.c
+++ b/drivers/char/watchdog/pcwd.c
@@ -2,7 +2,7 @@
  * PC Watchdog Driver
  * by Ken Hollis (khollis@bitgate.com)
  *
- * Permission granted from Simon Machell (73244.1270@compuserve.com)
+ * Permission granted from Simon Machell (smachell@berkprod.com)
  * Written for the Linux Kernel, and GPLed by Ken Hollis
  *
  * 960107       Added request_region routines, modulized the whole thing.
@@ -70,8 +70,8 @@
 #include <asm/io.h>             /* For inb/outb/... */
 
 /* Module and version information */
-#define WATCHDOG_VERSION "1.17"
-#define WATCHDOG_DATE "12 Feb 2006"
+#define WATCHDOG_VERSION "1.18"
+#define WATCHDOG_DATE "21 Jan 2007"
 #define WATCHDOG_DRIVER_NAME "ISA-PC Watchdog"
 #define WATCHDOG_NAME "pcwd"
 #define PFX WATCHDOG_NAME ": "
@@ -132,6 +132,18 @@
 #define CMD_ISA_DELAY_TIME_8SECS        0x0C
 #define CMD_ISA_RESET_RELAYS            0x0D
 
+/* Watchdog's Dip Switch heartbeat values */
+static const int heartbeat_tbl [] = {
+        20,     /* OFF-OFF-OFF  = 20 Sec  */
+        40,     /* OFF-OFF-ON   = 40 Sec  */
+        60,     /* OFF-ON-OFF   =  1 Min  */
+        300,    /* OFF-ON-ON    =  5 Min  */
+        600,    /* ON-OFF-OFF   = 10 Min  */
+        1800,   /* ON-OFF-ON    = 30 Min  */
+        3600,   /* ON-ON-OFF    =  1 Hour */
+        7200,   /* ON-ON-ON     =  2 hour */
+};
+
 /*
  * We are using an kernel timer to do the pinging of the watchdog
  * every ~500ms. We try to set the internal heartbeat of the
@@ -167,14 +179,14 @@ static int debug = QUIET;
 module_param(debug, int, 0);
 MODULE_PARM_DESC(debug, "Debug level: 0=Quiet, 1=Verbose, 2=Debug (default=0)");
 
-#define WATCHDOG_HEARTBEAT 60           /* 60 sec default heartbeat */
+#define WATCHDOG_HEARTBEAT 0            /* default heartbeat = delay-time from dip-switches */
 static int heartbeat = WATCHDOG_HEARTBEAT;
 module_param(heartbeat, int, 0);
-MODULE_PARM_DESC(heartbeat, "Watchdog heartbeat in seconds. (2<=heartbeat<=7200, default=" __MODULE_STRING(WATCHDOG_HEARTBEAT) ")");
+MODULE_PARM_DESC(heartbeat, "Watchdog heartbeat in seconds. (2<=heartbeat<=7200 or 0=delay-time from dip-switches, default=" __MODULE_STRING(WATCHDOG_HEARTBEAT) ")");
 
 static int nowayout = WATCHDOG_NOWAYOUT;
 module_param(nowayout, int, 0);
-MODULE_PARM_DESC(nowayout, "Watchdog cannot be stopped once started (default=CONFIG_WATCHDOG_NOWAYOUT)");
+MODULE_PARM_DESC(nowayout, "Watchdog cannot be stopped once started (default=" __MODULE_STRING(WATCHDOG_NOWAYOUT) ")");
 
 /*
  *      Internal functions
@@ -831,9 +843,7 @@ static int __devinit pcwatchdog_init(int base_addr)
         /* clear the "card caused reboot" flag */
         pcwd_clear_status();
 
-        init_timer(&pcwd_private.timer);
-        pcwd_private.timer.function = pcwd_timer_ping;
-        pcwd_private.timer.data = 0;
+        setup_timer(&pcwd_private.timer, pcwd_timer_ping, 0);
 
         /*  Disable the board  */
         pcwd_stop();
@@ -844,6 +854,10 @@ static int __devinit pcwatchdog_init(int base_addr)
         /* Show info about the card itself */
         pcwd_show_card_info();
 
+        /* If heartbeat = 0 then we use the heartbeat from the dip-switches */
+        if (heartbeat == 0)
+                heartbeat = heartbeat_tbl[(pcwd_get_option_switches() & 0x07)];
+
         /* Check that the heartbeat value is within it's range ; if not reset to the default */
         if (pcwd_set_heartbeat(heartbeat)) {
                 pcwd_set_heartbeat(WATCHDOG_HEARTBEAT);
diff --git a/drivers/char/watchdog/pcwd_pci.c b/drivers/char/watchdog/pcwd_pci.c
index f4872c871063..61a89e959642 100644
--- a/drivers/char/watchdog/pcwd_pci.c
+++ b/drivers/char/watchdog/pcwd_pci.c
@@ -1,7 +1,7 @@
 /*
  *      Berkshire PCI-PC Watchdog Card Driver
  *
- *      (c) Copyright 2003-2005 Wim Van Sebroeck <wim@iguana.be>.
+ *      (c) Copyright 2003-2007 Wim Van Sebroeck <wim@iguana.be>.
  *
  *      Based on source code of the following authors:
  *        Ken Hollis <kenji@bitgate.com>,
@@ -51,8 +51,8 @@
 #include <asm/io.h>             /* For inb/outb/... */
 
 /* Module and version information */
-#define WATCHDOG_VERSION "1.02"
-#define WATCHDOG_DATE "03 Sep 2005"
+#define WATCHDOG_VERSION "1.03"
+#define WATCHDOG_DATE "21 Jan 2007"
 #define WATCHDOG_DRIVER_NAME "PCI-PC Watchdog"
 #define WATCHDOG_NAME "pcwd_pci"
 #define PFX WATCHDOG_NAME ": "
@@ -96,6 +96,18 @@
 #define CMD_WRITE_WATCHDOG_TIMEOUT              0x19
 #define CMD_GET_CLEAR_RESET_COUNT               0x84
 
+/* Watchdog's Dip Switch heartbeat values */
+static const int heartbeat_tbl [] = {
+        5,      /* OFF-OFF-OFF  =  5 Sec  */
+        10,     /* OFF-OFF-ON   = 10 Sec  */
+        30,     /* OFF-ON-OFF   = 30 Sec  */
+        60,     /* OFF-ON-ON    =  1 Min  */
+        300,    /* ON-OFF-OFF   =  5 Min  */
+        600,    /* ON-OFF-ON    = 10 Min  */
+        1800,   /* ON-ON-OFF    = 30 Min  */
+        3600,   /* ON-ON-ON     =  1 hour */
+};
+
 /* We can only use 1 card due to the /dev/watchdog restriction */
 static int cards_found;
 
@@ -119,14 +131,14 @@ static int debug = QUIET;
 module_param(debug, int, 0);
 MODULE_PARM_DESC(debug, "Debug level: 0=Quiet, 1=Verbose, 2=Debug (default=0)");
 
-#define WATCHDOG_HEARTBEAT 2    /* 2 sec default heartbeat */
+#define WATCHDOG_HEARTBEAT 0    /* default heartbeat = delay-time from dip-switches */
 static int heartbeat = WATCHDOG_HEARTBEAT;
 module_param(heartbeat, int, 0);
-MODULE_PARM_DESC(heartbeat, "Watchdog heartbeat in seconds. (0<heartbeat<65536, default=" __MODULE_STRING(WATCHDOG_HEARTBEAT) ")");
+MODULE_PARM_DESC(heartbeat, "Watchdog heartbeat in seconds. (0<heartbeat<65536 or 0=delay-time from dip-switches, default=" __MODULE_STRING(WATCHDOG_HEARTBEAT) ")");
 
 static int nowayout = WATCHDOG_NOWAYOUT;
 module_param(nowayout, int, 0);
-MODULE_PARM_DESC(nowayout, "Watchdog cannot be stopped once started (default=CONFIG_WATCHDOG_NOWAYOUT)");
+MODULE_PARM_DESC(nowayout, "Watchdog cannot be stopped once started (default=" __MODULE_STRING(WATCHDOG_NOWAYOUT) ")");
 
 /*
  *      Internal functions
@@ -286,7 +298,9 @@ static int pcipcwd_stop(void)
 static int pcipcwd_keepalive(void)
 {
         /* Re-trigger watchdog by writing to port 0 */
+        spin_lock(&pcipcwd_private.io_lock);
         outb_p(0x42, pcipcwd_private.io_addr);  /* send out any data */
+        spin_unlock(&pcipcwd_private.io_lock);
 
         if (debug >= DEBUG)
                 printk(KERN_DEBUG PFX "Watchdog keepalive signal send\n");
@@ -373,7 +387,9 @@ static int pcipcwd_get_temperature(int *temperature)
         if (!pcipcwd_private.supports_temp)
                 return -ENODEV;
 
+        spin_lock(&pcipcwd_private.io_lock);
         *temperature = inb_p(pcipcwd_private.io_addr);
+        spin_unlock(&pcipcwd_private.io_lock);
 
         /*
          * Convert celsius to fahrenheit, since this was
@@ -711,6 +727,10 @@ static int __devinit pcipcwd_card_init(struct pci_dev *pdev,
         /* Show info about the card itself */
         pcipcwd_show_card_info();
 
+        /* If heartbeat = 0 then we use the heartbeat from the dip-switches */
+        if (heartbeat == 0)
+                heartbeat = heartbeat_tbl[(pcipcwd_get_option_switches() & 0x07)];
+
         /* Check that the heartbeat value is within it's range ; if not reset to the default */
         if (pcipcwd_set_heartbeat(heartbeat)) {
                 pcipcwd_set_heartbeat(WATCHDOG_HEARTBEAT);
@@ -798,6 +818,8 @@ static int __init pcipcwd_init_module(void)
 static void __exit pcipcwd_cleanup_module(void)
 {
         pci_unregister_driver(&pcipcwd_driver);
+
+        printk(KERN_INFO PFX "Watchdog Module Unloaded.\n");
 }
 
 module_init(pcipcwd_init_module);
diff --git a/drivers/char/watchdog/pcwd_usb.c b/drivers/char/watchdog/pcwd_usb.c
index 2da5ac99687c..31037f9c9ffe 100644
--- a/drivers/char/watchdog/pcwd_usb.c
+++ b/drivers/char/watchdog/pcwd_usb.c
@@ -1,7 +1,7 @@
 /*
  *      Berkshire USB-PC Watchdog Card Driver
  *
- *      (c) Copyright 2004 Wim Van Sebroeck <wim@iguana.be>.
+ *      (c) Copyright 2004-2007 Wim Van Sebroeck <wim@iguana.be>.
  *
  *      Based on source code of the following authors:
  *        Ken Hollis <kenji@bitgate.com>,
@@ -24,26 +24,25 @@
  *      http://www.berkprod.com/ or http://www.pcwatchdog.com/
  */
 
-#include <linux/kernel.h>
-#include <linux/errno.h>
-#include <linux/init.h>
-#include <linux/slab.h>
-#include <linux/module.h>
-#include <linux/moduleparam.h>
-#include <linux/types.h>
-#include <linux/delay.h>
-#include <linux/miscdevice.h>
-#include <linux/watchdog.h>
-#include <linux/notifier.h>
-#include <linux/reboot.h>
-#include <linux/fs.h>
-#include <linux/smp_lock.h>
-#include <linux/completion.h>
-#include <asm/uaccess.h>
-#include <linux/usb.h>
-#include <linux/mutex.h>
+#include <linux/module.h>       /* For module specific items */
+#include <linux/moduleparam.h>  /* For new moduleparam's */
+#include <linux/types.h>        /* For standard types (like size_t) */
+#include <linux/errno.h>        /* For the -ENODEV/... values */
+#include <linux/kernel.h>       /* For printk/panic/... */
+#include <linux/delay.h>        /* For mdelay function */
+#include <linux/miscdevice.h>   /* For MODULE_ALIAS_MISCDEV(WATCHDOG_MINOR) */
+#include <linux/watchdog.h>     /* For the watchdog specific items */
+#include <linux/notifier.h>     /* For notifier support */
+#include <linux/reboot.h>       /* For reboot_notifier stuff */
+#include <linux/init.h>         /* For __init/__exit/... */
+#include <linux/fs.h>           /* For file operations */
+#include <linux/usb.h>          /* For USB functions */
+#include <linux/slab.h>         /* For kmalloc, ... */
+#include <linux/mutex.h>        /* For mutex locking */
 #include <linux/hid.h>          /* For HID_REQ_SET_REPORT & HID_DT_REPORT */
 
+#include <asm/uaccess.h>        /* For copy_to_user/put_user/... */
+
 
 #ifdef CONFIG_USB_DEBUG
         static int debug = 1;
@@ -57,8 +56,8 @@
 
 
 /* Module and Version Information */
-#define DRIVER_VERSION "1.01"
-#define DRIVER_DATE "15 Mar 2005"
+#define DRIVER_VERSION "1.02"
+#define DRIVER_DATE "21 Jan 2007"
 #define DRIVER_AUTHOR "Wim Van Sebroeck <wim@iguana.be>"
 #define DRIVER_DESC "Berkshire USB-PC Watchdog driver"
 #define DRIVER_LICENSE "GPL"
@@ -75,14 +74,14 @@ MODULE_ALIAS_MISCDEV(TEMP_MINOR);
 module_param(debug, int, 0);
 MODULE_PARM_DESC(debug, "Debug enabled or not");
 
-#define WATCHDOG_HEARTBEAT 2    /* 2 sec default heartbeat */
+#define WATCHDOG_HEARTBEAT 0    /* default heartbeat = delay-time from dip-switches */
 static int heartbeat = WATCHDOG_HEARTBEAT;
 module_param(heartbeat, int, 0);
-MODULE_PARM_DESC(heartbeat, "Watchdog heartbeat in seconds. (0<heartbeat<65536, default=" __MODULE_STRING(WATCHDOG_HEARTBEAT) ")");
+MODULE_PARM_DESC(heartbeat, "Watchdog heartbeat in seconds. (0<heartbeat<65536 or 0=delay-time from dip-switches, default=" __MODULE_STRING(WATCHDOG_HEARTBEAT) ")");
 
 static int nowayout = WATCHDOG_NOWAYOUT;
 module_param(nowayout, int, 0);
-MODULE_PARM_DESC(nowayout, "Watchdog cannot be stopped once started (default=CONFIG_WATCHDOG_NOWAYOUT)");
+MODULE_PARM_DESC(nowayout, "Watchdog cannot be stopped once started (default=" __MODULE_STRING(WATCHDOG_NOWAYOUT) ")");
 
 /* The vendor and product id's for the USB-PC Watchdog card */
 #define USB_PCWD_VENDOR_ID      0x0c98
@@ -110,6 +109,18 @@ MODULE_DEVICE_TABLE (usb, usb_pcwd_table);
 #define CMD_ENABLE_WATCHDOG             0x30    /* Enable / Disable Watchdog */
 #define CMD_DISABLE_WATCHDOG            CMD_ENABLE_WATCHDOG
 
+/* Watchdog's Dip Switch heartbeat values */
+static const int heartbeat_tbl [] = {
+        5,      /* OFF-OFF-OFF  =  5 Sec  */
+        10,     /* OFF-OFF-ON   = 10 Sec  */
+        30,     /* OFF-ON-OFF   = 30 Sec  */
+        60,     /* OFF-ON-ON    =  1 Min  */
+        300,    /* ON-OFF-OFF   =  5 Min  */
+        600,    /* ON-OFF-ON    = 10 Min  */
+        1800,   /* ON-ON-OFF    = 30 Min  */
+        3600,   /* ON-ON-ON     =  1 hour */
+};
+
 /* We can only use 1 card due to the /dev/watchdog restriction */
 static int cards_found;
 
@@ -682,6 +693,10 @@ static int usb_pcwd_probe(struct usb_interface *interface, const struct usb_devi
                 ((option_switches & 0x10) ? "ON" : "OFF"),
                 ((option_switches & 0x08) ? "ON" : "OFF"));
 
+        /* If heartbeat = 0 then we use the heartbeat from the dip-switches */
+        if (heartbeat == 0)
+                heartbeat = heartbeat_tbl[(option_switches & 0x07)];
+
         /* Check that the heartbeat value is within it's range ; if not reset to the default */
         if (usb_pcwd_set_heartbeat(usb_pcwd, heartbeat)) {
                 usb_pcwd_set_heartbeat(usb_pcwd, WATCHDOG_HEARTBEAT);
diff --git a/drivers/char/watchdog/pnx4008_wdt.c b/drivers/char/watchdog/pnx4008_wdt.c
index ff6f1ca1e5e7..5991add702b0 100644
--- a/drivers/char/watchdog/pnx4008_wdt.c
+++ b/drivers/char/watchdog/pnx4008_wdt.c
@@ -283,7 +283,8 @@ static int pnx4008_wdt_probe(struct platform_device *pdev)
         wdt_base = (void __iomem *)IO_ADDRESS(res->start);
 
         wdt_clk = clk_get(&pdev->dev, "wdt_ck");
-        if (!wdt_clk) {
+        if (IS_ERR(wdt_clk)) {
+                ret = PTR_ERR(wdt_clk);
                 release_resource(wdt_mem);
                 kfree(wdt_mem);
                 goto out;
diff --git a/drivers/char/watchdog/rm9k_wdt.c b/drivers/char/watchdog/rm9k_wdt.c
index b4678839d3bb..5c921e471564 100644
--- a/drivers/char/watchdog/rm9k_wdt.c
+++ b/drivers/char/watchdog/rm9k_wdt.c
@@ -192,7 +192,7 @@ static int wdt_gpi_open(struct inode *inode, struct file *file)
                 locked = 0;
         }
 
-        res = request_irq(wd_irq, wdt_gpi_irqhdl, SA_SHIRQ | SA_INTERRUPT,
+        res = request_irq(wd_irq, wdt_gpi_irqhdl, IRQF_SHARED | IRQF_DISABLED,
                           wdt_gpi_name, &miscdev);
         if (unlikely(res))
                 return res;
diff --git a/drivers/char/watchdog/s3c2410_wdt.c b/drivers/char/watchdog/s3c2410_wdt.c
index 18cb050c3862..dff6cb5dc9a7 100644
--- a/drivers/char/watchdog/s3c2410_wdt.c
+++ b/drivers/char/watchdog/s3c2410_wdt.c
@@ -78,7 +78,7 @@ MODULE_PARM_DESC(tmr_margin, "Watchdog tmr_margin in seconds. default=" __MODULE
 
 MODULE_PARM_DESC(tmr_atboot, "Watchdog is started at boot time if set to 1, default=" __MODULE_STRING(CONFIG_S3C2410_WATCHDOG_ATBOOT));
 
-MODULE_PARM_DESC(nowayout, "Watchdog cannot be stopped once started (default=CONFIG_WATCHDOG_NOWAYOUT)");
+MODULE_PARM_DESC(nowayout, "Watchdog cannot be stopped once started (default=" __MODULE_STRING(WATCHDOG_NOWAYOUT) ")");
 
 MODULE_PARM_DESC(soft_noboot, "Watchdog action, set to 1 to ignore reboots, 0 to reboot (default depends on ONLY_TESTING)");
 
@@ -366,13 +366,15 @@ static int s3c2410wdt_probe(struct platform_device *pdev)
         wdt_mem = request_mem_region(res->start, size, pdev->name);
         if (wdt_mem == NULL) {
                 printk(KERN_INFO PFX "failed to get memory region\n");
-                return -ENOENT;
+                ret = -ENOENT;
+                goto err_req;
         }
 
         wdt_base = ioremap(res->start, size);
         if (wdt_base == 0) {
                 printk(KERN_INFO PFX "failed to ioremap() region\n");
-                return -EINVAL;
+                ret = -EINVAL;
+                goto err_req;
         }
 
         DBG("probe: mapped wdt_base=%p\n", wdt_base);
@@ -380,22 +382,21 @@ static int s3c2410wdt_probe(struct platform_device *pdev)
         res = platform_get_resource(pdev, IORESOURCE_IRQ, 0);
         if (res == NULL) {
                 printk(KERN_INFO PFX "failed to get irq resource\n");
-                iounmap(wdt_base);
-                return -ENOENT;
+                ret = -ENOENT;
+                goto err_map;
         }
 
         ret = request_irq(res->start, s3c2410wdt_irq, 0, pdev->name, pdev);
         if (ret != 0) {
                 printk(KERN_INFO PFX "failed to install irq (%d)\n", ret);
-                iounmap(wdt_base);
-                return ret;
+                goto err_map;
         }
 
         wdt_clock = clk_get(&pdev->dev, "watchdog");
-        if (wdt_clock == NULL) {
+        if (IS_ERR(wdt_clock)) {
                 printk(KERN_INFO PFX "failed to find watchdog clock source\n");
-                iounmap(wdt_base);
-                return -ENOENT;
+                ret = PTR_ERR(wdt_clock);
+                goto err_irq;
         }
 
         clk_enable(wdt_clock);
@@ -418,8 +419,7 @@ static int s3c2410wdt_probe(struct platform_device *pdev)
         if (ret) {
                 printk (KERN_ERR PFX "cannot register miscdev on minor=%d (%d)\n",
                         WATCHDOG_MINOR, ret);
-                iounmap(wdt_base);
-                return ret;
+                goto err_clk;
         }
 
         if (tmr_atboot && started == 0) {
@@ -434,26 +434,36 @@ static int s3c2410wdt_probe(struct platform_device *pdev)
         }
 
         return 0;
+
+ err_clk:
+        clk_disable(wdt_clock);
+        clk_put(wdt_clock);
+
+ err_irq:
+        free_irq(wdt_irq->start, pdev);
+
+ err_map:
+        iounmap(wdt_base);
+
+ err_req:
+        release_resource(wdt_mem);
+        kfree(wdt_mem);
+
+        return ret;
 }
 
 static int s3c2410wdt_remove(struct platform_device *dev)
 {
-        if (wdt_mem != NULL) {
-                release_resource(wdt_mem);
-                kfree(wdt_mem);
-                wdt_mem = NULL;
-        }
+        release_resource(wdt_mem);
+        kfree(wdt_mem);
+        wdt_mem = NULL;
 
-        if (wdt_irq != NULL) {
-                free_irq(wdt_irq->start, dev);
-                wdt_irq = NULL;
-        }
+        free_irq(wdt_irq->start, dev);
+        wdt_irq = NULL;
 
-        if (wdt_clock != NULL) {
-                clk_disable(wdt_clock);
-                clk_put(wdt_clock);
-                wdt_clock = NULL;
-        }
+        clk_disable(wdt_clock);
+        clk_put(wdt_clock);
+        wdt_clock = NULL;
 
         iounmap(wdt_base);
         misc_deregister(&s3c2410wdt_miscdev);
diff --git a/drivers/char/watchdog/sbc60xxwdt.c b/drivers/char/watchdog/sbc60xxwdt.c
index c7b2045bc76b..b6282039198c 100644
--- a/drivers/char/watchdog/sbc60xxwdt.c
+++ b/drivers/char/watchdog/sbc60xxwdt.c
@@ -100,10 +100,10 @@ MODULE_PARM_DESC(timeout, "Watchdog timeout in seconds. (1<=timeout<=3600, defau
 
 static int nowayout = WATCHDOG_NOWAYOUT;
 module_param(nowayout, int, 0);
-MODULE_PARM_DESC(nowayout, "Watchdog cannot be stopped once started (default=CONFIG_WATCHDOG_NOWAYOUT)");
+MODULE_PARM_DESC(nowayout, "Watchdog cannot be stopped once started (default=" __MODULE_STRING(WATCHDOG_NOWAYOUT) ")");
 
 static void wdt_timer_ping(unsigned long);
-static struct timer_list timer;
+static DEFINE_TIMER(timer, wdt_timer_ping, 0, 0);
 static unsigned long next_heartbeat;
 static unsigned long wdt_is_open;
 static char wdt_expect_close;
@@ -122,8 +122,7 @@ static void wdt_timer_ping(unsigned long data)
                 /* Ping the WDT by reading from wdt_start */
                 inb_p(wdt_start);
                 /* Re-set the timer interval */
-                timer.expires = jiffies + WDT_INTERVAL;
-                add_timer(&timer);
+                mod_timer(&timer, jiffies + WDT_INTERVAL);
         } else {
                 printk(KERN_WARNING PFX "Heartbeat lost! Will not ping the watchdog\n");
         }
@@ -138,8 +137,7 @@ static void wdt_startup(void)
         next_heartbeat = jiffies + (timeout * HZ);
 
         /* Start the timer */
-        timer.expires = jiffies + WDT_INTERVAL;
-        add_timer(&timer);
+        mod_timer(&timer, jiffies + WDT_INTERVAL);
         printk(KERN_INFO PFX "Watchdog timer is now enabled.\n");
 }
 
@@ -363,10 +361,6 @@ static int __init sbc60xxwdt_init(void)
                 }
         }
 
-        init_timer(&timer);
-        timer.function = wdt_timer_ping;
-        timer.data = 0;
-
         rc = misc_register(&wdt_miscdev);
         if (rc)
         {
diff --git a/drivers/char/watchdog/sbc8360.c b/drivers/char/watchdog/sbc8360.c
index 41fc6f80c493..67ae42685e75 100644
--- a/drivers/char/watchdog/sbc8360.c
+++ b/drivers/char/watchdog/sbc8360.c
@@ -204,7 +204,7 @@ module_param(timeout, int, 0);
 MODULE_PARM_DESC(timeout, "Index into timeout table (0-63) (default=27 (60s))");
 module_param(nowayout, int, 0);
 MODULE_PARM_DESC(nowayout,
-                 "Watchdog cannot be stopped once started (default=CONFIG_WATCHDOG_NOWAYOUT)");
+                 "Watchdog cannot be stopped once started (default=" __MODULE_STRING(WATCHDOG_NOWAYOUT) ")");
 
 /*
  *      Kernel methods.
diff --git a/drivers/char/watchdog/sbc_epx_c3.c b/drivers/char/watchdog/sbc_epx_c3.c
index 8882b427d24f..82cbd8809a69 100644
--- a/drivers/char/watchdog/sbc_epx_c3.c
+++ b/drivers/char/watchdog/sbc_epx_c3.c
@@ -35,7 +35,7 @@ static int epx_c3_alive;
 
 static int nowayout = WATCHDOG_NOWAYOUT;
 module_param(nowayout, int, 0);
-MODULE_PARM_DESC(nowayout, "Watchdog cannot be stopped once started (default=CONFIG_WATCHDOG_NOWAYOUT)");
+MODULE_PARM_DESC(nowayout, "Watchdog cannot be stopped once started (default=" __MODULE_STRING(WATCHDOG_NOWAYOUT) ")");
 
 #define EPXC3_WATCHDOG_CTL_REG 0x1ee /* write 1 to enable, 0 to disable */
 #define EPXC3_WATCHDOG_PET_REG 0x1ef /* write anything to pet once enabled */
diff --git a/drivers/char/watchdog/sc1200wdt.c b/drivers/char/watchdog/sc1200wdt.c
index e3239833e4b0..1e4a8d751a71 100644
--- a/drivers/char/watchdog/sc1200wdt.c
+++ b/drivers/char/watchdog/sc1200wdt.c
@@ -92,7 +92,7 @@ MODULE_PARM_DESC(timeout, "range is 0-255 minutes, default is 1");
 
 static int nowayout = WATCHDOG_NOWAYOUT;
 module_param(nowayout, int, 0);
-MODULE_PARM_DESC(nowayout, "Watchdog cannot be stopped once started (default=CONFIG_WATCHDOG_NOWAYOUT)");
+MODULE_PARM_DESC(nowayout, "Watchdog cannot be stopped once started (default=" __MODULE_STRING(WATCHDOG_NOWAYOUT) ")");
 
 
 
diff --git a/drivers/char/watchdog/sc520_wdt.c b/drivers/char/watchdog/sc520_wdt.c
index caec37ba750a..2676a43895a7 100644
--- a/drivers/char/watchdog/sc520_wdt.c
+++ b/drivers/char/watchdog/sc520_wdt.c
@@ -97,7 +97,7 @@ MODULE_PARM_DESC(timeout, "Watchdog timeout in seconds. (1<=timeout<=3600, defau
 
 static int nowayout = WATCHDOG_NOWAYOUT;
 module_param(nowayout, int, 0);
-MODULE_PARM_DESC(nowayout, "Watchdog cannot be stopped once started (default=CONFIG_WATCHDOG_NOWAYOUT)");
+MODULE_PARM_DESC(nowayout, "Watchdog cannot be stopped once started (default=" __MODULE_STRING(WATCHDOG_NOWAYOUT) ")");
 
 /*
  * AMD Elan SC520 - Watchdog Timer Registers
@@ -121,7 +121,7 @@ MODULE_PARM_DESC(nowayout, "Watchdog cannot be stopped once started (default=CON
 static __u16 __iomem *wdtmrctl;
 
 static void wdt_timer_ping(unsigned long);
-static struct timer_list timer;
+static DEFINE_TIMER(timer, wdt_timer_ping, 0, 0);
 static unsigned long next_heartbeat;
 static unsigned long wdt_is_open;
 static char wdt_expect_close;
@@ -145,8 +145,7 @@ static void wdt_timer_ping(unsigned long data)
                 spin_unlock(&wdt_spinlock);
 
                 /* Re-set the timer interval */
-                timer.expires = jiffies + WDT_INTERVAL;
-                add_timer(&timer);
+                mod_timer(&timer, jiffies + WDT_INTERVAL);
         } else {
                 printk(KERN_WARNING PFX "Heartbeat lost! Will not ping the watchdog\n");
         }
@@ -179,8 +178,7 @@ static int wdt_startup(void)
         next_heartbeat = jiffies + (timeout * HZ);
 
         /* Start the timer */
-        timer.expires = jiffies + WDT_INTERVAL;
-        add_timer(&timer);
+        mod_timer(&timer, jiffies + WDT_INTERVAL);
 
         /* Start the watchdog */
         wdt_config(WDT_ENB | WDT_WRST_ENB | WDT_EXP_SEL_04);
@@ -389,10 +387,6 @@ static int __init sc520_wdt_init(void)
 
         spin_lock_init(&wdt_spinlock);
 
-        init_timer(&timer);
-        timer.function = wdt_timer_ping;
-        timer.data = 0;
-
         /* Check that the timeout value is within it's range ; if not reset to the default */
         if (wdt_set_heartbeat(timeout)) {
                 wdt_set_heartbeat(WATCHDOG_TIMEOUT);
diff --git a/drivers/char/watchdog/shwdt.c b/drivers/char/watchdog/shwdt.c
index dc403629aeb3..cecbedd473a4 100644
--- a/drivers/char/watchdog/shwdt.c
+++ b/drivers/char/watchdog/shwdt.c
@@ -65,10 +65,12 @@ static int clock_division_ratio = WTCSR_CKS_4096;
 
 #define next_ping_period(cks)   msecs_to_jiffies(cks - 4)
 
+static void sh_wdt_ping(unsigned long data);
+
 static unsigned long shwdt_is_open;
 static struct watchdog_info sh_wdt_info;
 static char shwdt_expect_close;
-static struct timer_list timer;
+static DEFINE_TIMER(timer, sh_wdt_ping, 0, 0);
 static unsigned long next_heartbeat;
 
 #define WATCHDOG_HEARTBEAT 30                   /* 30 sec default heartbeat */
@@ -433,10 +435,6 @@ static int __init sh_wdt_init(void)
                        "be 1<=x<=3600, using %d\n", heartbeat);
         }
 
-        init_timer(&timer);
-        timer.function = sh_wdt_ping;
-        timer.data = 0;
-
         rc = register_reboot_notifier(&sh_wdt_notifier);
         if (unlikely(rc)) {
                 printk(KERN_ERR PFX "Can't register reboot notifier (err=%d)\n",
diff --git a/drivers/char/watchdog/smsc37b787_wdt.c b/drivers/char/watchdog/smsc37b787_wdt.c
index a9681d580dd3..d3cb0a766020 100644
--- a/drivers/char/watchdog/smsc37b787_wdt.c
+++ b/drivers/char/watchdog/smsc37b787_wdt.c
@@ -624,4 +624,4 @@ module_param(timeout, int, 0);
 MODULE_PARM_DESC(timeout, "range is 1-255 units, default is 60");
 
 module_param(nowayout, int, 0);
-MODULE_PARM_DESC(nowayout, "Watchdog cannot be stopped once started (default=CONFIG_WATCHDOG_NOWAYOUT)");
+MODULE_PARM_DESC(nowayout, "Watchdog cannot be stopped once started (default=" __MODULE_STRING(WATCHDOG_NOWAYOUT) ")");
diff --git a/drivers/char/watchdog/softdog.c b/drivers/char/watchdog/softdog.c
index 4067e1f8a368..9c3694909243 100644
--- a/drivers/char/watchdog/softdog.c
+++ b/drivers/char/watchdog/softdog.c
@@ -59,7 +59,7 @@ MODULE_PARM_DESC(soft_margin, "Watchdog soft_margin in seconds. (0<soft_margin<6
 
 static int nowayout = WATCHDOG_NOWAYOUT;
 module_param(nowayout, int, 0);
-MODULE_PARM_DESC(nowayout, "Watchdog cannot be stopped once started (default=CONFIG_WATCHDOG_NOWAYOUT)");
+MODULE_PARM_DESC(nowayout, "Watchdog cannot be stopped once started (default=" __MODULE_STRING(WATCHDOG_NOWAYOUT) ")");
 
 #ifdef ONLY_TESTING
 static int soft_noboot = 1;
diff --git a/drivers/char/watchdog/w83627hf_wdt.c b/drivers/char/watchdog/w83627hf_wdt.c
index 07d4bff27226..337ee42c90dd 100644
--- a/drivers/char/watchdog/w83627hf_wdt.c
+++ b/drivers/char/watchdog/w83627hf_wdt.c
@@ -58,7 +58,7 @@ MODULE_PARM_DESC(timeout, "Watchdog timeout in seconds. 1<= timeout <=63, defaul
 
 static int nowayout = WATCHDOG_NOWAYOUT;
 module_param(nowayout, int, 0);
-MODULE_PARM_DESC(nowayout, "Watchdog cannot be stopped once started (default=CONFIG_WATCHDOG_NOWAYOUT)");
+MODULE_PARM_DESC(nowayout, "Watchdog cannot be stopped once started (default=" __MODULE_STRING(WATCHDOG_NOWAYOUT) ")");
 
 /*
  *      Kernel methods.
diff --git a/drivers/char/watchdog/w83697hf_wdt.c b/drivers/char/watchdog/w83697hf_wdt.c
index c960ec110dd7..d9e821d08deb 100644
--- a/drivers/char/watchdog/w83697hf_wdt.c
+++ b/drivers/char/watchdog/w83697hf_wdt.c
@@ -60,7 +60,7 @@ MODULE_PARM_DESC(timeout, "Watchdog timeout in seconds. 1<= timeout <=255, defau
 
 static int nowayout = WATCHDOG_NOWAYOUT;
 module_param(nowayout, int, 0);
-MODULE_PARM_DESC(nowayout, "Watchdog cannot be stopped once started (default=CONFIG_WATCHDOG_NOWAYOUT)");
+MODULE_PARM_DESC(nowayout, "Watchdog cannot be stopped once started (default=" __MODULE_STRING(WATCHDOG_NOWAYOUT) ")");
 
 /*
  *      Kernel methods.
diff --git a/drivers/char/watchdog/w83877f_wdt.c b/drivers/char/watchdog/w83877f_wdt.c
index b0e5f84d6baf..3c88fe18f4f4 100644
--- a/drivers/char/watchdog/w83877f_wdt.c
+++ b/drivers/char/watchdog/w83877f_wdt.c
@@ -87,10 +87,10 @@ MODULE_PARM_DESC(timeout, "Watchdog timeout in seconds. (1<=timeout<=3600, defau
 
 static int nowayout = WATCHDOG_NOWAYOUT;
 module_param(nowayout, int, 0);
-MODULE_PARM_DESC(nowayout, "Watchdog cannot be stopped once started (default=CONFIG_WATCHDOG_NOWAYOUT)");
+MODULE_PARM_DESC(nowayout, "Watchdog cannot be stopped once started (default=" __MODULE_STRING(WATCHDOG_NOWAYOUT) ")");
 
 static void wdt_timer_ping(unsigned long);
-static struct timer_list timer;
+static DEFINE_TIMER(timer, wdt_timer_ping, 0, 0);
 static unsigned long next_heartbeat;
 static unsigned long wdt_is_open;
 static char wdt_expect_close;
@@ -114,8 +114,7 @@ static void wdt_timer_ping(unsigned long data)
                 inb_p(WDT_PING);
 
                 /* Re-set the timer interval */
-                timer.expires = jiffies + WDT_INTERVAL;
-                add_timer(&timer);
+                mod_timer(&timer, jiffies + WDT_INTERVAL);
 
                 spin_unlock(&wdt_spinlock);
 
@@ -155,8 +154,7 @@ static void wdt_startup(void)
         next_heartbeat = jiffies + (timeout * HZ);
 
         /* Start the timer */
-        timer.expires = jiffies + WDT_INTERVAL;
-        add_timer(&timer);
+        mod_timer(&timer, jiffies + WDT_INTERVAL);
 
         wdt_change(WDT_ENABLE);
 
@@ -377,10 +375,6 @@ static int __init w83877f_wdt_init(void)
                 goto err_out_region1;
         }
 
-        init_timer(&timer);
-        timer.function = wdt_timer_ping;
-        timer.data = 0;
-
         rc = misc_register(&wdt_miscdev);
         if (rc)
         {
diff --git a/drivers/char/watchdog/w83977f_wdt.c b/drivers/char/watchdog/w83977f_wdt.c
index 2c8d5d8bd4e8..157968442891 100644
--- a/drivers/char/watchdog/w83977f_wdt.c
+++ b/drivers/char/watchdog/w83977f_wdt.c
@@ -59,7 +59,7 @@ MODULE_PARM_DESC(testmode,"Watchdog testmode (1 = no reboot), default=0");
 
 static int nowayout = WATCHDOG_NOWAYOUT;
 module_param(nowayout, int, 0);
-MODULE_PARM_DESC(nowayout, "Watchdog cannot be stopped once started (default=CONFIG_WATCHDOG_NOWAYOUT)");
+MODULE_PARM_DESC(nowayout, "Watchdog cannot be stopped once started (default=" __MODULE_STRING(WATCHDOG_NOWAYOUT) ")");
 
 /*
  * Start the watchdog
diff --git a/drivers/char/watchdog/wafer5823wdt.c b/drivers/char/watchdog/wafer5823wdt.c
index 163e028ef9ed..950905d3c39f 100644
--- a/drivers/char/watchdog/wafer5823wdt.c
+++ b/drivers/char/watchdog/wafer5823wdt.c
@@ -65,7 +65,7 @@ MODULE_PARM_DESC(timeout, "Watchdog timeout in seconds. 1<= timeout <=255, defau
 
 static int nowayout = WATCHDOG_NOWAYOUT;
 module_param(nowayout, int, 0);
-MODULE_PARM_DESC(nowayout, "Watchdog cannot be stopped once started (default=CONFIG_WATCHDOG_NOWAYOUT)");
+MODULE_PARM_DESC(nowayout, "Watchdog cannot be stopped once started (default=" __MODULE_STRING(WATCHDOG_NOWAYOUT) ")");
 
 static void wafwdt_ping(void)
 {
diff --git a/drivers/char/watchdog/wdt.c b/drivers/char/watchdog/wdt.c
index 517fbd8643f8..0a3de6a02442 100644
--- a/drivers/char/watchdog/wdt.c
+++ b/drivers/char/watchdog/wdt.c
@@ -64,7 +64,7 @@ MODULE_PARM_DESC(heartbeat, "Watchdog heartbeat in seconds. (0<heartbeat<65536,
 
 static int nowayout = WATCHDOG_NOWAYOUT;
 module_param(nowayout, int, 0);
-MODULE_PARM_DESC(nowayout, "Watchdog cannot be stopped once started (default=CONFIG_WATCHDOG_NOWAYOUT)");
+MODULE_PARM_DESC(nowayout, "Watchdog cannot be stopped once started (default=" __MODULE_STRING(WATCHDOG_NOWAYOUT) ")");
 
 /* You must set these - there is no sane way to probe for this board. */
 static int io=0x240;
diff --git a/drivers/char/watchdog/wdt977.c b/drivers/char/watchdog/wdt977.c
index 6253041b235b..7d300ff7ab07 100644
--- a/drivers/char/watchdog/wdt977.c
+++ b/drivers/char/watchdog/wdt977.c
@@ -68,7 +68,7 @@ MODULE_PARM_DESC(testmode,"Watchdog testmode (1 = no reboot), default=0");
 
 static int nowayout = WATCHDOG_NOWAYOUT;
 module_param(nowayout, int, 0);
-MODULE_PARM_DESC(nowayout, "Watchdog cannot be stopped once started (default=CONFIG_WATCHDOG_NOWAYOUT)");
+MODULE_PARM_DESC(nowayout, "Watchdog cannot be stopped once started (default=" __MODULE_STRING(WATCHDOG_NOWAYOUT) ")");
 
 /*
  * Start the watchdog
diff --git a/drivers/char/watchdog/wdt_pci.c b/drivers/char/watchdog/wdt_pci.c
index ce1261c5cbce..6baf4ae42c9d 100644
--- a/drivers/char/watchdog/wdt_pci.c
+++ b/drivers/char/watchdog/wdt_pci.c
@@ -90,7 +90,7 @@ MODULE_PARM_DESC(heartbeat, "Watchdog heartbeat in seconds. (0<heartbeat<65536,
 
 static int nowayout = WATCHDOG_NOWAYOUT;
 module_param(nowayout, int, 0);
-MODULE_PARM_DESC(nowayout, "Watchdog cannot be stopped once started (default=CONFIG_WATCHDOG_NOWAYOUT)");
+MODULE_PARM_DESC(nowayout, "Watchdog cannot be stopped once started (default=" __MODULE_STRING(WATCHDOG_NOWAYOUT) ")");
 
 #ifdef CONFIG_WDT_501_PCI
 /* Support for the Fan Tachometer on the PCI-WDT501 */
diff --git a/drivers/clocksource/acpi_pm.c b/drivers/clocksource/acpi_pm.c
index b6bcdbbf57b3..ccaa6a39cb4b 100644
--- a/drivers/clocksource/acpi_pm.c
+++ b/drivers/clocksource/acpi_pm.c
@@ -16,15 +16,13 @@
  * This file is licensed under the GPL v2.
  */
 
+#include <linux/acpi_pmtmr.h>
 #include <linux/clocksource.h>
 #include <linux/errno.h>
 #include <linux/init.h>
 #include <linux/pci.h>
 #include <asm/io.h>
 
-/* Number of PMTMR ticks expected during calibration run */
-#define PMTMR_TICKS_PER_SEC 3579545
-
 /*
  * The I/O port the PMTMR resides at.
  * The location is detected during setup_arch(),
@@ -32,15 +30,13 @@
  */
 u32 pmtmr_ioport __read_mostly;
 
-#define ACPI_PM_MASK CLOCKSOURCE_MASK(24) /* limit it to 24 bits */
-
 static inline u32 read_pmtmr(void)
 {
         /* mask the output to 24 bits */
         return inl(pmtmr_ioport) & ACPI_PM_MASK;
 }
 
-static cycle_t acpi_pm_read_verified(void)
+u32 acpi_pm_read_verified(void)
 {
         u32 v1 = 0, v2 = 0, v3 = 0;
 
@@ -57,7 +53,12 @@ static cycle_t acpi_pm_read_verified(void)
         } while (unlikely((v1 > v2 && v1 < v3) || (v2 > v3 && v2 < v1)
                           || (v3 > v1 && v3 < v2)));
 
-        return (cycle_t)v2;
+        return v2;
+}
+
+static cycle_t acpi_pm_read_slow(void)
+{
+        return (cycle_t)acpi_pm_read_verified();
 }
 
 static cycle_t acpi_pm_read(void)
@@ -72,7 +73,8 @@ static struct clocksource clocksource_acpi_pm = {
         .mask           = (cycle_t)ACPI_PM_MASK,
         .mult           = 0, /*to be caluclated*/
         .shift          = 22,
-        .is_continuous  = 1,
+        .flags          = CLOCK_SOURCE_IS_CONTINUOUS,
+
 };
 
 
@@ -87,7 +89,7 @@ __setup("acpi_pm_good", acpi_pm_good_setup);
 
 static inline void acpi_pm_need_workaround(void)
 {
-        clocksource_acpi_pm.read = acpi_pm_read_verified;
+        clocksource_acpi_pm.read = acpi_pm_read_slow;
         clocksource_acpi_pm.rating = 110;
 }
 
diff --git a/drivers/clocksource/cyclone.c b/drivers/clocksource/cyclone.c
index bf4d3d50d1c4..4f3925ceb360 100644
--- a/drivers/clocksource/cyclone.c
+++ b/drivers/clocksource/cyclone.c
@@ -31,7 +31,7 @@ static struct clocksource clocksource_cyclone = {
         .mask           = CYCLONE_TIMER_MASK,
         .mult           = 10,
         .shift          = 0,
-        .is_continuous  = 1,
+        .flags          = CLOCK_SOURCE_IS_CONTINUOUS,
 };
 
 static int __init init_cyclone_clocksource(void)
diff --git a/drivers/clocksource/scx200_hrt.c b/drivers/clocksource/scx200_hrt.c
index 22915cc46ba7..b92da677aa5d 100644
--- a/drivers/clocksource/scx200_hrt.c
+++ b/drivers/clocksource/scx200_hrt.c
@@ -57,7 +57,7 @@ static struct clocksource cs_hrt = {
         .rating         = 250,
         .read           = read_hrt,
         .mask           = CLOCKSOURCE_MASK(32),
-        .is_continuous  = 1,
+        .flags          = CLOCK_SOURCE_IS_CONTINUOUS,
         /* mult, shift are set based on mhz27 flag */
 };
 
diff --git a/drivers/cpufreq/Kconfig b/drivers/cpufreq/Kconfig
index 491779af8d55..d155e81b5c97 100644
--- a/drivers/cpufreq/Kconfig
+++ b/drivers/cpufreq/Kconfig
@@ -16,7 +16,7 @@ config CPU_FREQ
 if CPU_FREQ
 
 config CPU_FREQ_TABLE
-       def_tristate m
+       tristate
 
 config CPU_FREQ_DEBUG
         bool "Enable CPUfreq debugging"
diff --git a/drivers/cpufreq/cpufreq.c b/drivers/cpufreq/cpufreq.c
index a45cc89e387a..f52facc570f5 100644
--- a/drivers/cpufreq/cpufreq.c
+++ b/drivers/cpufreq/cpufreq.c
@@ -41,8 +41,67 @@ static struct cpufreq_driver *cpufreq_driver;
 static struct cpufreq_policy *cpufreq_cpu_data[NR_CPUS];
 static DEFINE_SPINLOCK(cpufreq_driver_lock);
 
+/*
+ * cpu_policy_rwsem is a per CPU reader-writer semaphore designed to cure
+ * all cpufreq/hotplug/workqueue/etc related lock issues.
+ *
+ * The rules for this semaphore:
+ * - Any routine that wants to read from the policy structure will
+ *   do a down_read on this semaphore.
+ * - Any routine that will write to the policy structure and/or may take away
+ *   the policy altogether (eg. CPU hotplug), will hold this lock in write
+ *   mode before doing so.
+ *
+ * Additional rules:
+ * - All holders of the lock should check to make sure that the CPU they
+ *   are concerned with are online after they get the lock.
+ * - Governor routines that can be called in cpufreq hotplug path should not
+ *   take this sem as top level hotplug notifier handler takes this.
+ */
+static DEFINE_PER_CPU(int, policy_cpu);
+static DEFINE_PER_CPU(struct rw_semaphore, cpu_policy_rwsem);
+
+#define lock_policy_rwsem(mode, cpu)                                    \
+int lock_policy_rwsem_##mode                                            \
+(int cpu)                                                               \
+{                                                                       \
+        int policy_cpu = per_cpu(policy_cpu, cpu);                      \
+        BUG_ON(policy_cpu == -1);                                       \
+        down_##mode(&per_cpu(cpu_policy_rwsem, policy_cpu));            \
+        if (unlikely(!cpu_online(cpu))) {                               \
+                up_##mode(&per_cpu(cpu_policy_rwsem, policy_cpu));      \
+                return -1;                                              \
+        }                                                               \
+                                                                        \
+        return 0;                                                       \
+}
+
+lock_policy_rwsem(read, cpu);
+EXPORT_SYMBOL_GPL(lock_policy_rwsem_read);
+
+lock_policy_rwsem(write, cpu);
+EXPORT_SYMBOL_GPL(lock_policy_rwsem_write);
+
+void unlock_policy_rwsem_read(int cpu)
+{
+        int policy_cpu = per_cpu(policy_cpu, cpu);
+        BUG_ON(policy_cpu == -1);
+        up_read(&per_cpu(cpu_policy_rwsem, policy_cpu));
+}
+EXPORT_SYMBOL_GPL(unlock_policy_rwsem_read);
+
+void unlock_policy_rwsem_write(int cpu)
+{
+        int policy_cpu = per_cpu(policy_cpu, cpu);
+        BUG_ON(policy_cpu == -1);
+        up_write(&per_cpu(cpu_policy_rwsem, policy_cpu));
+}
+EXPORT_SYMBOL_GPL(unlock_policy_rwsem_write);
+
+
 /* internal prototypes */
 static int __cpufreq_governor(struct cpufreq_policy *policy, unsigned int event);
+static unsigned int __cpufreq_get(unsigned int cpu);
 static void handle_update(struct work_struct *work);
 
 /**
@@ -415,12 +474,8 @@ static ssize_t store_##file_name					\
         if (ret != 1)                                                   \
                 return -EINVAL;                                         \
                                                                         \
-        lock_cpu_hotplug();                                             \
-        mutex_lock(&policy->lock);                                      \
         ret = __cpufreq_set_policy(policy, &new_policy);                \
         policy->user_policy.object = policy->object;                    \
-        mutex_unlock(&policy->lock);                                    \
-        unlock_cpu_hotplug();                                           \
                                                                         \
         return ret ? ret : count;                                       \
 }
@@ -434,7 +489,7 @@ store_one(scaling_max_freq,max);
 static ssize_t show_cpuinfo_cur_freq (struct cpufreq_policy * policy,
                                                         char *buf)
 {
-        unsigned int cur_freq = cpufreq_get(policy->cpu);
+        unsigned int cur_freq = __cpufreq_get(policy->cpu);
         if (!cur_freq)
                 return sprintf(buf, "<unknown>");
         return sprintf(buf, "%u\n", cur_freq);
@@ -479,18 +534,12 @@ static ssize_t store_scaling_governor (struct cpufreq_policy * policy,
                                                 &new_policy.governor))
                 return -EINVAL;
 
-        lock_cpu_hotplug();
-
         /* Do not use cpufreq_set_policy here or the user_policy.max
            will be wrongly overridden */
-        mutex_lock(&policy->lock);
         ret = __cpufreq_set_policy(policy, &new_policy);
 
         policy->user_policy.policy = policy->policy;
         policy->user_policy.governor = policy->governor;
-        mutex_unlock(&policy->lock);
-
-        unlock_cpu_hotplug();
 
         if (ret)
                 return ret;
@@ -595,11 +644,17 @@ static ssize_t show(struct kobject * kobj, struct attribute * attr ,char * buf)
         policy = cpufreq_cpu_get(policy->cpu);
         if (!policy)
                 return -EINVAL;
+
+        if (lock_policy_rwsem_read(policy->cpu) < 0)
+                return -EINVAL;
+
         if (fattr->show)
                 ret = fattr->show(policy, buf);
         else
                 ret = -EIO;
 
+        unlock_policy_rwsem_read(policy->cpu);
+
         cpufreq_cpu_put(policy);
         return ret;
 }
@@ -613,11 +668,17 @@ static ssize_t store(struct kobject * kobj, struct attribute * attr,
         policy = cpufreq_cpu_get(policy->cpu);
         if (!policy)
                 return -EINVAL;
+
+        if (lock_policy_rwsem_write(policy->cpu) < 0)
+                return -EINVAL;
+
         if (fattr->store)
                 ret = fattr->store(policy, buf, count);
         else
                 ret = -EIO;
 
+        unlock_policy_rwsem_write(policy->cpu);
+
         cpufreq_cpu_put(policy);
         return ret;
 }
@@ -691,8 +752,10 @@ static int cpufreq_add_dev (struct sys_device * sys_dev)
         policy->cpu = cpu;
         policy->cpus = cpumask_of_cpu(cpu);
 
-        mutex_init(&policy->lock);
-        mutex_lock(&policy->lock);
+        /* Initially set CPU itself as the policy_cpu */
+        per_cpu(policy_cpu, cpu) = cpu;
+        lock_policy_rwsem_write(cpu);
+
         init_completion(&policy->kobj_unregister);
         INIT_WORK(&policy->update, handle_update);
 
@@ -702,7 +765,7 @@ static int cpufreq_add_dev (struct sys_device * sys_dev)
         ret = cpufreq_driver->init(policy);
         if (ret) {
                 dprintk("initialization failed\n");
-                mutex_unlock(&policy->lock);
+                unlock_policy_rwsem_write(cpu);
                 goto err_out;
         }
 
@@ -716,6 +779,14 @@ static int cpufreq_add_dev (struct sys_device * sys_dev)
                  */
                 managed_policy = cpufreq_cpu_get(j);
                 if (unlikely(managed_policy)) {
+
+                        /* Set proper policy_cpu */
+                        unlock_policy_rwsem_write(cpu);
+                        per_cpu(policy_cpu, cpu) = managed_policy->cpu;
+
+                        if (lock_policy_rwsem_write(cpu) < 0)
+                                goto err_out_driver_exit;
+
                         spin_lock_irqsave(&cpufreq_driver_lock, flags);
                         managed_policy->cpus = policy->cpus;
                         cpufreq_cpu_data[cpu] = managed_policy;
@@ -726,13 +797,13 @@ static int cpufreq_add_dev (struct sys_device * sys_dev)
                                                 &managed_policy->kobj,
                                                 "cpufreq");
                         if (ret) {
-                                mutex_unlock(&policy->lock);
+                                unlock_policy_rwsem_write(cpu);
                                 goto err_out_driver_exit;
                         }
 
                         cpufreq_debug_enable_ratelimit();
-                        mutex_unlock(&policy->lock);
                         ret = 0;
+                        unlock_policy_rwsem_write(cpu);
                         goto err_out_driver_exit; /* call driver->exit() */
                 }
         }
@@ -746,7 +817,7 @@ static int cpufreq_add_dev (struct sys_device * sys_dev)
 
         ret = kobject_register(&policy->kobj);
         if (ret) {
-                mutex_unlock(&policy->lock);
+                unlock_policy_rwsem_write(cpu);
                 goto err_out_driver_exit;
         }
         /* set up files for this cpu device */
@@ -761,8 +832,10 @@ static int cpufreq_add_dev (struct sys_device * sys_dev)
                 sysfs_create_file(&policy->kobj, &scaling_cur_freq.attr);
 
         spin_lock_irqsave(&cpufreq_driver_lock, flags);
-        for_each_cpu_mask(j, policy->cpus)
+        for_each_cpu_mask(j, policy->cpus) {
                 cpufreq_cpu_data[j] = policy;
+                per_cpu(policy_cpu, j) = policy->cpu;
+        }
         spin_unlock_irqrestore(&cpufreq_driver_lock, flags);
 
         /* symlink affected CPUs */
@@ -778,14 +851,14 @@ static int cpufreq_add_dev (struct sys_device * sys_dev)
                 ret = sysfs_create_link(&cpu_sys_dev->kobj, &policy->kobj,
                                         "cpufreq");
                 if (ret) {
-                        mutex_unlock(&policy->lock);
+                        unlock_policy_rwsem_write(cpu);
                         goto err_out_unregister;
                 }
         }
 
         policy->governor = NULL; /* to assure that the starting sequence is
                                   * run in cpufreq_set_policy */
-        mutex_unlock(&policy->lock);
+        unlock_policy_rwsem_write(cpu);
 
         /* set default policy */
         ret = cpufreq_set_policy(&new_policy);
@@ -826,11 +899,13 @@ module_out:
 
 
 /**
- * cpufreq_remove_dev - remove a CPU device
+ * __cpufreq_remove_dev - remove a CPU device
  *
  * Removes the cpufreq interface for a CPU device.
+ * Caller should already have policy_rwsem in write mode for this CPU.
+ * This routine frees the rwsem before returning.
  */
-static int cpufreq_remove_dev (struct sys_device * sys_dev)
+static int __cpufreq_remove_dev (struct sys_device * sys_dev)
 {
         unsigned int cpu = sys_dev->id;
         unsigned long flags;
@@ -849,6 +924,7 @@ static int cpufreq_remove_dev (struct sys_device * sys_dev)
         if (!data) {
                 spin_unlock_irqrestore(&cpufreq_driver_lock, flags);
                 cpufreq_debug_enable_ratelimit();
+                unlock_policy_rwsem_write(cpu);
                 return -EINVAL;
         }
         cpufreq_cpu_data[cpu] = NULL;
@@ -865,6 +941,7 @@ static int cpufreq_remove_dev (struct sys_device * sys_dev)
                 sysfs_remove_link(&sys_dev->kobj, "cpufreq");
                 cpufreq_cpu_put(data);
                 cpufreq_debug_enable_ratelimit();
+                unlock_policy_rwsem_write(cpu);
                 return 0;
         }
 #endif
@@ -873,6 +950,7 @@ static int cpufreq_remove_dev (struct sys_device * sys_dev)
         if (!kobject_get(&data->kobj)) {
                 spin_unlock_irqrestore(&cpufreq_driver_lock, flags);
                 cpufreq_debug_enable_ratelimit();
+                unlock_policy_rwsem_write(cpu);
                 return -EFAULT;
         }
 
@@ -906,10 +984,10 @@ static int cpufreq_remove_dev (struct sys_device * sys_dev)
         spin_unlock_irqrestore(&cpufreq_driver_lock, flags);
 #endif
 
-        mutex_lock(&data->lock);
         if (cpufreq_driver->target)
                 __cpufreq_governor(data, CPUFREQ_GOV_STOP);
-        mutex_unlock(&data->lock);
+
+        unlock_policy_rwsem_write(cpu);
 
         kobject_unregister(&data->kobj);
 
@@ -933,6 +1011,18 @@ static int cpufreq_remove_dev (struct sys_device * sys_dev)
 }
 
 
+static int cpufreq_remove_dev (struct sys_device * sys_dev)
+{
+        unsigned int cpu = sys_dev->id;
+        int retval;
+        if (unlikely(lock_policy_rwsem_write(cpu)))
+                BUG();
+
+        retval = __cpufreq_remove_dev(sys_dev);
+        return retval;
+}
+
+
 static void handle_update(struct work_struct *work)
 {
         struct cpufreq_policy *policy =
@@ -980,9 +1070,12 @@ unsigned int cpufreq_quick_get(unsigned int cpu)
         unsigned int ret_freq = 0;
 
         if (policy) {
-                mutex_lock(&policy->lock);
+                if (unlikely(lock_policy_rwsem_read(cpu)))
+                        return ret_freq;
+
                 ret_freq = policy->cur;
-                mutex_unlock(&policy->lock);
+
+                unlock_policy_rwsem_read(cpu);
                 cpufreq_cpu_put(policy);
         }
 
@@ -991,24 +1084,13 @@ unsigned int cpufreq_quick_get(unsigned int cpu)
 EXPORT_SYMBOL(cpufreq_quick_get);
 
 
-/**
- * cpufreq_get - get the current CPU frequency (in kHz)
- * @cpu: CPU number
- *
- * Get the CPU current (static) CPU frequency
- */
-unsigned int cpufreq_get(unsigned int cpu)
+static unsigned int __cpufreq_get(unsigned int cpu)
 {
-        struct cpufreq_policy *policy = cpufreq_cpu_get(cpu);
+        struct cpufreq_policy *policy = cpufreq_cpu_data[cpu];
         unsigned int ret_freq = 0;
 
-        if (!policy)
-                return 0;
-
         if (!cpufreq_driver->get)
-                goto out;
-
-        mutex_lock(&policy->lock);
+                return (ret_freq);
 
         ret_freq = cpufreq_driver->get(cpu);
 
@@ -1022,11 +1104,33 @@ unsigned int cpufreq_get(unsigned int cpu)
                 }
         }
 
-        mutex_unlock(&policy->lock);
+        return (ret_freq);
+}
 
-out:
-        cpufreq_cpu_put(policy);
+/**
+ * cpufreq_get - get the current CPU frequency (in kHz)
+ * @cpu: CPU number
+ *
+ * Get the CPU current (static) CPU frequency
+ */
+unsigned int cpufreq_get(unsigned int cpu)
+{
+        unsigned int ret_freq = 0;
+        struct cpufreq_policy *policy = cpufreq_cpu_get(cpu);
+
+        if (!policy)
+                goto out;
+
+        if (unlikely(lock_policy_rwsem_read(cpu)))
+                goto out_policy;
+
+        ret_freq = __cpufreq_get(cpu);
 
+        unlock_policy_rwsem_read(cpu);
+
+out_policy:
+        cpufreq_cpu_put(policy);
+out:
         return (ret_freq);
 }
 EXPORT_SYMBOL(cpufreq_get);
@@ -1278,7 +1382,6 @@ EXPORT_SYMBOL(cpufreq_unregister_notifier);
  *********************************************************************/
 
 
-/* Must be called with lock_cpu_hotplug held */
 int __cpufreq_driver_target(struct cpufreq_policy *policy,
                             unsigned int target_freq,
                             unsigned int relation)
@@ -1304,20 +1407,19 @@ int cpufreq_driver_target(struct cpufreq_policy *policy,
         if (!policy)
                 return -EINVAL;
 
-        lock_cpu_hotplug();
-        mutex_lock(&policy->lock);
+        if (unlikely(lock_policy_rwsem_write(policy->cpu)))
+                return -EINVAL;
 
         ret = __cpufreq_driver_target(policy, target_freq, relation);
 
-        mutex_unlock(&policy->lock);
-        unlock_cpu_hotplug();
+        unlock_policy_rwsem_write(policy->cpu);
 
         cpufreq_cpu_put(policy);
         return ret;
 }
 EXPORT_SYMBOL_GPL(cpufreq_driver_target);
 
-int cpufreq_driver_getavg(struct cpufreq_policy *policy)
+int __cpufreq_driver_getavg(struct cpufreq_policy *policy)
 {
         int ret = 0;
 
@@ -1325,20 +1427,15 @@ int cpufreq_driver_getavg(struct cpufreq_policy *policy)
         if (!policy)
                 return -EINVAL;
 
-        mutex_lock(&policy->lock);
-
         if (cpu_online(policy->cpu) && cpufreq_driver->getavg)
                 ret = cpufreq_driver->getavg(policy->cpu);
 
-        mutex_unlock(&policy->lock);
-
         cpufreq_cpu_put(policy);
         return ret;
 }
-EXPORT_SYMBOL_GPL(cpufreq_driver_getavg);
+EXPORT_SYMBOL_GPL(__cpufreq_driver_getavg);
 
 /*
- * Locking: Must be called with the lock_cpu_hotplug() lock held
  * when "event" is CPUFREQ_GOV_LIMITS
  */
 
@@ -1420,9 +1517,7 @@ int cpufreq_get_policy(struct cpufreq_policy *policy, unsigned int cpu)
         if (!cpu_policy)
                 return -EINVAL;
 
-        mutex_lock(&cpu_policy->lock);
         memcpy(policy, cpu_policy, sizeof(struct cpufreq_policy));
-        mutex_unlock(&cpu_policy->lock);
 
         cpufreq_cpu_put(cpu_policy);
         return 0;
@@ -1433,7 +1528,6 @@ EXPORT_SYMBOL(cpufreq_get_policy);
 /*
  * data   : current policy.
  * policy : policy to be set.
- * Locking: Must be called with the lock_cpu_hotplug() lock held
  */
 static int __cpufreq_set_policy(struct cpufreq_policy *data,
                                 struct cpufreq_policy *policy)
@@ -1539,10 +1633,9 @@ int cpufreq_set_policy(struct cpufreq_policy *policy)
         if (!data)
                 return -EINVAL;
 
-        lock_cpu_hotplug();
+        if (unlikely(lock_policy_rwsem_write(policy->cpu)))
+                return -EINVAL;
 
-        /* lock this CPU */
-        mutex_lock(&data->lock);
 
         ret = __cpufreq_set_policy(data, policy);
         data->user_policy.min = data->min;
@@ -1550,9 +1643,8 @@ int cpufreq_set_policy(struct cpufreq_policy *policy)
         data->user_policy.policy = data->policy;
         data->user_policy.governor = data->governor;
 
-        mutex_unlock(&data->lock);
+        unlock_policy_rwsem_write(policy->cpu);
 
-        unlock_cpu_hotplug();
         cpufreq_cpu_put(data);
 
         return ret;
@@ -1576,8 +1668,8 @@ int cpufreq_update_policy(unsigned int cpu)
         if (!data)
                 return -ENODEV;
 
-        lock_cpu_hotplug();
-        mutex_lock(&data->lock);
+        if (unlikely(lock_policy_rwsem_write(cpu)))
+                return -EINVAL;
 
         dprintk("updating policy for CPU %u\n", cpu);
         memcpy(&policy, data, sizeof(struct cpufreq_policy));
@@ -1602,8 +1694,8 @@ int cpufreq_update_policy(unsigned int cpu)
 
         ret = __cpufreq_set_policy(data, &policy);
 
-        mutex_unlock(&data->lock);
-        unlock_cpu_hotplug();
+        unlock_policy_rwsem_write(cpu);
+
         cpufreq_cpu_put(data);
         return ret;
 }
@@ -1613,31 +1705,28 @@ static int cpufreq_cpu_callback(struct notifier_block *nfb,
                                         unsigned long action, void *hcpu)
 {
         unsigned int cpu = (unsigned long)hcpu;
-        struct cpufreq_policy *policy;
         struct sys_device *sys_dev;
+        struct cpufreq_policy *policy;
 
         sys_dev = get_cpu_sysdev(cpu);
-
         if (sys_dev) {
                 switch (action) {
                 case CPU_ONLINE:
                         cpufreq_add_dev(sys_dev);
                         break;
                 case CPU_DOWN_PREPARE:
-                        /*
-                         * We attempt to put this cpu in lowest frequency
-                         * possible before going down. This will permit
-                         * hardware-managed P-State to switch other related
-                         * threads to min or higher speeds if possible.
-                         */
+                        if (unlikely(lock_policy_rwsem_write(cpu)))
+                                BUG();
+
                         policy = cpufreq_cpu_data[cpu];
                         if (policy) {
-                                cpufreq_driver_target(policy, policy->min,
+                                __cpufreq_driver_target(policy, policy->min,
                                                 CPUFREQ_RELATION_H);
                         }
+                        __cpufreq_remove_dev(sys_dev);
                         break;
-                case CPU_DEAD:
-                        cpufreq_remove_dev(sys_dev);
+                case CPU_DOWN_FAILED:
+                        cpufreq_add_dev(sys_dev);
                         break;
                 }
         }
@@ -1751,3 +1840,16 @@ int cpufreq_unregister_driver(struct cpufreq_driver *driver)
         return 0;
 }
 EXPORT_SYMBOL_GPL(cpufreq_unregister_driver);
+
+static int __init cpufreq_core_init(void)
+{
+        int cpu;
+
+        for_each_possible_cpu(cpu) {
+                per_cpu(policy_cpu, cpu) = -1;
+                init_rwsem(&per_cpu(cpu_policy_rwsem, cpu));
+        }
+        return 0;
+}
+
+core_initcall(cpufreq_core_init);
diff --git a/drivers/cpufreq/cpufreq_conservative.c b/drivers/cpufreq/cpufreq_conservative.c
index eef0270c6f3d..26f440ccc3fb 100644
--- a/drivers/cpufreq/cpufreq_conservative.c
+++ b/drivers/cpufreq/cpufreq_conservative.c
@@ -23,7 +23,6 @@
 #include <linux/fs.h>
 #include <linux/sysfs.h>
 #include <linux/cpu.h>
-#include <linux/sched.h>
 #include <linux/kmod.h>
 #include <linux/workqueue.h>
 #include <linux/jiffies.h>
@@ -430,14 +429,12 @@ static void dbs_check_cpu(int cpu)
 static void do_dbs_timer(struct work_struct *work)
 { 
         int i;
-        lock_cpu_hotplug();
         mutex_lock(&dbs_mutex);
         for_each_online_cpu(i)
                 dbs_check_cpu(i);
         schedule_delayed_work(&dbs_work, 
                         usecs_to_jiffies(dbs_tuners_ins.sampling_rate));
         mutex_unlock(&dbs_mutex);
-        unlock_cpu_hotplug();
 } 
 
 static inline void dbs_timer_init(void)
diff --git a/drivers/cpufreq/cpufreq_ondemand.c b/drivers/cpufreq/cpufreq_ondemand.c
index f697449327c6..d60bcb9d14cc 100644
--- a/drivers/cpufreq/cpufreq_ondemand.c
+++ b/drivers/cpufreq/cpufreq_ondemand.c
@@ -52,19 +52,20 @@ static unsigned int def_sampling_rate;
 static void do_dbs_timer(struct work_struct *work);
 
 /* Sampling types */
-enum dbs_sample {DBS_NORMAL_SAMPLE, DBS_SUB_SAMPLE};
+enum {DBS_NORMAL_SAMPLE, DBS_SUB_SAMPLE};
 
 struct cpu_dbs_info_s {
         cputime64_t prev_cpu_idle;
         cputime64_t prev_cpu_wall;
         struct cpufreq_policy *cur_policy;
         struct delayed_work work;
-        enum dbs_sample sample_type;
-        unsigned int enable;
         struct cpufreq_frequency_table *freq_table;
         unsigned int freq_lo;
         unsigned int freq_lo_jiffies;
         unsigned int freq_hi_jiffies;
+        int cpu;
+        unsigned int enable:1,
+                     sample_type:1;
 };
 static DEFINE_PER_CPU(struct cpu_dbs_info_s, cpu_dbs_info);
 
@@ -402,7 +403,7 @@ static void dbs_check_cpu(struct cpu_dbs_info_s *this_dbs_info)
         if (load < (dbs_tuners_ins.up_threshold - 10)) {
                 unsigned int freq_next, freq_cur;
 
-                freq_cur = cpufreq_driver_getavg(policy);
+                freq_cur = __cpufreq_driver_getavg(policy);
                 if (!freq_cur)
                         freq_cur = policy->cur;
 
@@ -423,9 +424,11 @@ static void dbs_check_cpu(struct cpu_dbs_info_s *this_dbs_info)
 
 static void do_dbs_timer(struct work_struct *work)
 {
-        unsigned int cpu = smp_processor_id();
-        struct cpu_dbs_info_s *dbs_info = &per_cpu(cpu_dbs_info, cpu);
-        enum dbs_sample sample_type = dbs_info->sample_type;
+        struct cpu_dbs_info_s *dbs_info =
+                container_of(work, struct cpu_dbs_info_s, work.work);
+        unsigned int cpu = dbs_info->cpu;
+        int sample_type = dbs_info->sample_type;
+
         /* We want all CPUs to do sampling nearly on same jiffy */
         int delay = usecs_to_jiffies(dbs_tuners_ins.sampling_rate);
 
@@ -434,15 +437,19 @@ static void do_dbs_timer(struct work_struct *work)
 
         delay -= jiffies % delay;
 
-        if (!dbs_info->enable)
+        if (lock_policy_rwsem_write(cpu) < 0)
+                return;
+
+        if (!dbs_info->enable) {
+                unlock_policy_rwsem_write(cpu);
                 return;
+        }
+
         /* Common NORMAL_SAMPLE setup */
         dbs_info->sample_type = DBS_NORMAL_SAMPLE;
         if (!dbs_tuners_ins.powersave_bias ||
             sample_type == DBS_NORMAL_SAMPLE) {
-                lock_cpu_hotplug();
                 dbs_check_cpu(dbs_info);
-                unlock_cpu_hotplug();
                 if (dbs_info->freq_lo) {
                         /* Setup timer for SUB_SAMPLE */
                         dbs_info->sample_type = DBS_SUB_SAMPLE;
@@ -454,26 +461,27 @@ static void do_dbs_timer(struct work_struct *work)
                                         CPUFREQ_RELATION_H);
         }
         queue_delayed_work_on(cpu, kondemand_wq, &dbs_info->work, delay);
+        unlock_policy_rwsem_write(cpu);
 }
 
-static inline void dbs_timer_init(unsigned int cpu)
+static inline void dbs_timer_init(struct cpu_dbs_info_s *dbs_info)
 {
-        struct cpu_dbs_info_s *dbs_info = &per_cpu(cpu_dbs_info, cpu);
         /* We want all CPUs to do sampling nearly on same jiffy */
         int delay = usecs_to_jiffies(dbs_tuners_ins.sampling_rate);
         delay -= jiffies % delay;
 
+        dbs_info->enable = 1;
         ondemand_powersave_bias_init();
-        INIT_DELAYED_WORK_NAR(&dbs_info->work, do_dbs_timer);
         dbs_info->sample_type = DBS_NORMAL_SAMPLE;
-        queue_delayed_work_on(cpu, kondemand_wq, &dbs_info->work, delay);
+        INIT_DELAYED_WORK_NAR(&dbs_info->work, do_dbs_timer);
+        queue_delayed_work_on(dbs_info->cpu, kondemand_wq, &dbs_info->work,
+                              delay);
 }
 
 static inline void dbs_timer_exit(struct cpu_dbs_info_s *dbs_info)
 {
         dbs_info->enable = 0;
         cancel_delayed_work(&dbs_info->work);
-        flush_workqueue(kondemand_wq);
 }
 
 static int cpufreq_governor_dbs(struct cpufreq_policy *policy,
@@ -502,21 +510,9 @@ static int cpufreq_governor_dbs(struct cpufreq_policy *policy,
 
                 mutex_lock(&dbs_mutex);
                 dbs_enable++;
-                if (dbs_enable == 1) {
-                        kondemand_wq = create_workqueue("kondemand");
-                        if (!kondemand_wq) {
-                                printk(KERN_ERR
-                                         "Creation of kondemand failed\n");
-                                dbs_enable--;
-                                mutex_unlock(&dbs_mutex);
-                                return -ENOSPC;
-                        }
-                }
 
                 rc = sysfs_create_group(&policy->kobj, &dbs_attr_group);
                 if (rc) {
-                        if (dbs_enable == 1)
-                                destroy_workqueue(kondemand_wq);
                         dbs_enable--;
                         mutex_unlock(&dbs_mutex);
                         return rc;
@@ -530,7 +526,7 @@ static int cpufreq_governor_dbs(struct cpufreq_policy *policy,
                         j_dbs_info->prev_cpu_idle = get_cpu_idle_time(j);
                         j_dbs_info->prev_cpu_wall = get_jiffies_64();
                 }
-                this_dbs_info->enable = 1;
+                this_dbs_info->cpu = cpu;
                 /*
                  * Start the timerschedule work, when this governor
                  * is used for first time
@@ -550,7 +546,7 @@ static int cpufreq_governor_dbs(struct cpufreq_policy *policy,
 
                         dbs_tuners_ins.sampling_rate = def_sampling_rate;
                 }
-                dbs_timer_init(policy->cpu);
+                dbs_timer_init(this_dbs_info);
 
                 mutex_unlock(&dbs_mutex);
                 break;
@@ -560,9 +556,6 @@ static int cpufreq_governor_dbs(struct cpufreq_policy *policy,
                 dbs_timer_exit(this_dbs_info);
                 sysfs_remove_group(&policy->kobj, &dbs_attr_group);
                 dbs_enable--;
-                if (dbs_enable == 0)
-                        destroy_workqueue(kondemand_wq);
-
                 mutex_unlock(&dbs_mutex);
 
                 break;
@@ -591,12 +584,18 @@ static struct cpufreq_governor cpufreq_gov_dbs = {
 
 static int __init cpufreq_gov_dbs_init(void)
 {
+        kondemand_wq = create_workqueue("kondemand");
+        if (!kondemand_wq) {
+                printk(KERN_ERR "Creation of kondemand failed\n");
+                return -EFAULT;
+        }
         return cpufreq_register_governor(&cpufreq_gov_dbs);
 }
 
 static void __exit cpufreq_gov_dbs_exit(void)
 {
         cpufreq_unregister_governor(&cpufreq_gov_dbs);
+        destroy_workqueue(kondemand_wq);
 }
 
 
@@ -608,3 +607,4 @@ MODULE_LICENSE("GPL");
 
 module_init(cpufreq_gov_dbs_init);
 module_exit(cpufreq_gov_dbs_exit);
+
diff --git a/drivers/cpufreq/cpufreq_stats.c b/drivers/cpufreq/cpufreq_stats.c
index 91ad342a6051..d1c7cac9316c 100644
--- a/drivers/cpufreq/cpufreq_stats.c
+++ b/drivers/cpufreq/cpufreq_stats.c
@@ -370,12 +370,10 @@ __exit cpufreq_stats_exit(void)
         cpufreq_unregister_notifier(&notifier_trans_block,
                         CPUFREQ_TRANSITION_NOTIFIER);
         unregister_hotcpu_notifier(&cpufreq_stat_cpu_notifier);
-        lock_cpu_hotplug();
         for_each_online_cpu(cpu) {
                 cpufreq_stat_cpu_callback(&cpufreq_stat_cpu_notifier,
                                                 CPU_DEAD, (void *)(long)cpu);
         }
-        unlock_cpu_hotplug();
 }
 
 MODULE_AUTHOR ("Zou Nan hai <nanhai.zou@intel.com>");
diff --git a/drivers/cpufreq/cpufreq_userspace.c b/drivers/cpufreq/cpufreq_userspace.c
index 2a4eb0bfaf30..860345c7799a 100644
--- a/drivers/cpufreq/cpufreq_userspace.c
+++ b/drivers/cpufreq/cpufreq_userspace.c
@@ -71,7 +71,6 @@ static int cpufreq_set(unsigned int freq, struct cpufreq_policy *policy)
 
         dprintk("cpufreq_set for cpu %u, freq %u kHz\n", policy->cpu, freq);
 
-        lock_cpu_hotplug();
         mutex_lock(&userspace_mutex);
         if (!cpu_is_managed[policy->cpu])
                 goto err;
@@ -94,7 +93,6 @@ static int cpufreq_set(unsigned int freq, struct cpufreq_policy *policy)
 
  err:
         mutex_unlock(&userspace_mutex);
-        unlock_cpu_hotplug();
         return ret;
 }
 
diff --git a/drivers/crypto/geode-aes.c b/drivers/crypto/geode-aes.c
index 31ea405f2eeb..0eb62841e9b0 100644
--- a/drivers/crypto/geode-aes.c
+++ b/drivers/crypto/geode-aes.c
@@ -8,7 +8,6 @@
 
 #include <linux/module.h>
 #include <linux/kernel.h>
-#include <linux/sched.h>
 #include <linux/pci.h>
 #include <linux/pci_ids.h>
 #include <linux/crypto.h>
diff --git a/drivers/fc4/fc_syms.c b/drivers/fc4/fc_syms.c
index 8700a8076d04..bd3918ddf7ac 100644
--- a/drivers/fc4/fc_syms.c
+++ b/drivers/fc4/fc_syms.c
@@ -6,7 +6,6 @@
 
 #ifdef CONFIG_MODULES
 
-#include <linux/sched.h>
 #include <linux/types.h>
 #include <linux/string.h>
 #include <linux/kernel.h>
diff --git a/drivers/fc4/soc.c b/drivers/fc4/soc.c
index b09dfc78e5a2..d517734462e6 100644
--- a/drivers/fc4/soc.c
+++ b/drivers/fc4/soc.c
@@ -22,7 +22,6 @@ static char *version =
 
 #include <linux/module.h>
 #include <linux/kernel.h>
-#include <linux/sched.h>
 #include <linux/types.h>
 #include <linux/fcntl.h>
 #include <linux/interrupt.h>
diff --git a/drivers/fc4/socal.c b/drivers/fc4/socal.c
index a6b1ae256e16..c903ebfab526 100644
--- a/drivers/fc4/socal.c
+++ b/drivers/fc4/socal.c
@@ -17,7 +17,6 @@ static char *version =
 
 #include <linux/module.h>
 #include <linux/kernel.h>
-#include <linux/sched.h>
 #include <linux/types.h>
 #include <linux/fcntl.h>
 #include <linux/interrupt.h>
diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c
index 8c7d48eff7b7..7452399501b4 100644
--- a/drivers/hid/hid-core.c
+++ b/drivers/hid/hid-core.c
@@ -18,7 +18,6 @@
 #include <linux/slab.h>
 #include <linux/init.h>
 #include <linux/kernel.h>
-#include <linux/sched.h>
 #include <linux/list.h>
 #include <linux/mm.h>
 #include <linux/smp_lock.h>
diff --git a/drivers/hwmon/vt8231.c b/drivers/hwmon/vt8231.c
index 93f93d4fb8ae..a6a4aa0eee16 100644
--- a/drivers/hwmon/vt8231.c
+++ b/drivers/hwmon/vt8231.c
@@ -727,7 +727,6 @@ int vt8231_detect(struct i2c_adapter *adapter)
         client->addr = isa_address;
         client->adapter = adapter;
         client->driver = &vt8231_driver;
-        client->dev.parent = &adapter->dev;
 
         /* Fill in the remaining client fields and put into the global list */
         strlcpy(client->name, "vt8231", I2C_NAME_SIZE);
diff --git a/drivers/i2c/busses/Kconfig b/drivers/i2c/busses/Kconfig
index 9367c4cfe936..4d44a2db29dd 100644
--- a/drivers/i2c/busses/Kconfig
+++ b/drivers/i2c/busses/Kconfig
@@ -183,6 +183,7 @@ config I2C_PIIX4
             ATI IXP200
             ATI IXP300
             ATI IXP400
+            ATI SB600
             Serverworks OSB4
             Serverworks CSB5
             Serverworks CSB6
@@ -341,6 +342,13 @@ config I2C_PARPORT_LIGHT
           This support is also available as a module.  If so, the module 
           will be called i2c-parport-light.
 
+config I2C_PASEMI
+        tristate "PA Semi SMBus interface"
+#       depends on PPC_PASEMI && I2C && PCI
+        depends on I2C && PCI
+        help
+          Supports the PA Semi PWRficient on-chip SMBus interfaces.
+
 config I2C_PROSAVAGE
         tristate "S3/VIA (Pro)Savage"
         depends on I2C && PCI
@@ -499,11 +507,11 @@ config I2C_VIA
           will be called i2c-via.
 
 config I2C_VIAPRO
-        tristate "VIA 82C596/82C686/82xx"
+        tristate "VIA VT82C596/82C686/82xx and CX700"
         depends on I2C && PCI
         help
           If you say yes to this option, support will be included for the VIA
-          82C596/82C686/82xx I2C interfaces.  Specifically, the following
+          VT82C596 and later SMBus interface.  Specifically, the following
           chipsets are supported:
             VT82C596A/B
             VT82C686A/B
@@ -512,6 +520,7 @@ config I2C_VIAPRO
             VT8235
             VT8237R/A
             VT8251
+            CX700
 
           This driver can also be built as a module.  If so, the module
           will be called i2c-viapro.
diff --git a/drivers/i2c/busses/Makefile b/drivers/i2c/busses/Makefile
index 37196c1d0794..03505aa44bbf 100644
--- a/drivers/i2c/busses/Makefile
+++ b/drivers/i2c/busses/Makefile
@@ -27,6 +27,7 @@ obj-$(CONFIG_I2C_OCORES)	+= i2c-ocores.o
 obj-$(CONFIG_I2C_OMAP)          += i2c-omap.o
 obj-$(CONFIG_I2C_PARPORT)       += i2c-parport.o
 obj-$(CONFIG_I2C_PARPORT_LIGHT) += i2c-parport-light.o
+obj-$(CONFIG_I2C_PASEMI)        += i2c-pasemi.o
 obj-$(CONFIG_I2C_PCA_ISA)       += i2c-pca-isa.o
 obj-$(CONFIG_I2C_PIIX4)         += i2c-piix4.o
 obj-$(CONFIG_I2C_PNX)           += i2c-pnx.o
diff --git a/drivers/i2c/busses/i2c-ali1535.c b/drivers/i2c/busses/i2c-ali1535.c
index e75d339a3481..6fd8ad7faa06 100644
--- a/drivers/i2c/busses/i2c-ali1535.c
+++ b/drivers/i2c/busses/i2c-ali1535.c
@@ -57,7 +57,6 @@
 #include <linux/pci.h>
 #include <linux/kernel.h>
 #include <linux/stddef.h>
-#include <linux/sched.h>
 #include <linux/delay.h>
 #include <linux/ioport.h>
 #include <linux/i2c.h>
@@ -475,6 +474,7 @@ static const struct i2c_algorithm smbus_algorithm = {
 
 static struct i2c_adapter ali1535_adapter = {
         .owner          = THIS_MODULE,
+        .id             = I2C_HW_SMBUS_ALI1535,
         .class          = I2C_CLASS_HWMON,
         .algo           = &smbus_algorithm,
 };
diff --git a/drivers/i2c/busses/i2c-ali1563.c b/drivers/i2c/busses/i2c-ali1563.c
index 8e1e3f8e40a4..6b68074e518a 100644
--- a/drivers/i2c/busses/i2c-ali1563.c
+++ b/drivers/i2c/busses/i2c-ali1563.c
@@ -314,35 +314,11 @@ static u32 ali1563_func(struct i2c_adapter * a)
 }
 
 
-static void ali1563_enable(struct pci_dev * dev)
-{
-        u16 ctrl;
-
-        pci_read_config_word(dev,ALI1563_SMBBA,&ctrl);
-        ctrl |= 0x7;
-        pci_write_config_word(dev,ALI1563_SMBBA,ctrl);
-}
-
 static int __devinit ali1563_setup(struct pci_dev * dev)
 {
         u16 ctrl;
 
         pci_read_config_word(dev,ALI1563_SMBBA,&ctrl);
-        printk("ali1563: SMBus control = %04x\n",ctrl);
-
-        /* Check if device is even enabled first */
-        if (!(ctrl & ALI1563_SMB_IOEN)) {
-                dev_warn(&dev->dev,"I/O space not enabled, trying manually\n");
-                ali1563_enable(dev);
-        }
-        if (!(ctrl & ALI1563_SMB_IOEN)) {
-                dev_warn(&dev->dev,"I/O space still not enabled, giving up\n");
-                goto Err;
-        }
-        if (!(ctrl & ALI1563_SMB_HOSTEN)) {
-                dev_warn(&dev->dev,"Host Controller not enabled\n");
-                goto Err;
-        }
 
         /* SMB I/O Base in high 12 bits and must be aligned with the
          * size of the I/O space. */
@@ -351,11 +327,31 @@ static int __devinit ali1563_setup(struct pci_dev * dev)
                 dev_warn(&dev->dev,"ali1563_smba Uninitialized\n");
                 goto Err;
         }
+
+        /* Check if device is enabled */
+        if (!(ctrl & ALI1563_SMB_HOSTEN)) {
+                dev_warn(&dev->dev, "Host Controller not enabled\n");
+                goto Err;
+        }
+        if (!(ctrl & ALI1563_SMB_IOEN)) {
+                dev_warn(&dev->dev, "I/O space not enabled, trying manually\n");
+                pci_write_config_word(dev, ALI1563_SMBBA,
+                                      ctrl | ALI1563_SMB_IOEN);
+                pci_read_config_word(dev, ALI1563_SMBBA, &ctrl);
+                if (!(ctrl & ALI1563_SMB_IOEN)) {
+                        dev_err(&dev->dev, "I/O space still not enabled, "
+                                "giving up\n");
+                        goto Err;
+                }
+        }
+
         if (!request_region(ali1563_smba, ALI1563_SMB_IOSIZE,
                             ali1563_pci_driver.name)) {
-                dev_warn(&dev->dev,"Could not allocate I/O space");
+                dev_err(&dev->dev, "Could not allocate I/O space at 0x%04x\n",
+                        ali1563_smba);
                 goto Err;
         }
+        dev_info(&dev->dev, "Found ALi1563 SMBus at 0x%04x\n", ali1563_smba);
 
         return 0;
 Err:
@@ -374,6 +370,7 @@ static const struct i2c_algorithm ali1563_algorithm = {
 
 static struct i2c_adapter ali1563_adapter = {
         .owner  = THIS_MODULE,
+        .id     = I2C_HW_SMBUS_ALI1563,
         .class  = I2C_CLASS_HWMON,
         .algo   = &ali1563_algorithm,
 };
@@ -384,13 +381,18 @@ static int __devinit ali1563_probe(struct pci_dev * dev,
         int error;
 
         if ((error = ali1563_setup(dev)))
-                return error;
+                goto exit;
         ali1563_adapter.dev.parent = &dev->dev;
         sprintf(ali1563_adapter.name,"SMBus ALi 1563 Adapter @ %04x",
                 ali1563_smba);
         if ((error = i2c_add_adapter(&ali1563_adapter)))
-                ali1563_shutdown(dev);
-        printk("%s: Returning %d\n",__FUNCTION__,error);
+                goto exit_shutdown;
+        return 0;
+
+exit_shutdown:
+        ali1563_shutdown(dev);
+exit:
+        dev_warn(&dev->dev, "ALi1563 SMBus probe failed (%d)\n", error);
         return error;
 }
 
diff --git a/drivers/i2c/busses/i2c-ali15x3.c b/drivers/i2c/busses/i2c-ali15x3.c
index 3f11b6e1a341..e4e0df106812 100644
--- a/drivers/i2c/busses/i2c-ali15x3.c
+++ b/drivers/i2c/busses/i2c-ali15x3.c
@@ -64,7 +64,6 @@
 #include <linux/pci.h>
 #include <linux/kernel.h>
 #include <linux/stddef.h>
-#include <linux/sched.h>
 #include <linux/ioport.h>
 #include <linux/delay.h>
 #include <linux/i2c.h>
@@ -470,6 +469,7 @@ static const struct i2c_algorithm smbus_algorithm = {
 
 static struct i2c_adapter ali15x3_adapter = {
         .owner          = THIS_MODULE,
+        .id             = I2C_HW_SMBUS_ALI15X3,
         .class          = I2C_CLASS_HWMON,
         .algo           = &smbus_algorithm,
 };
diff --git a/drivers/i2c/busses/i2c-amd756-s4882.c b/drivers/i2c/busses/i2c-amd756-s4882.c
index 08e915730caf..e5e96c817566 100644
--- a/drivers/i2c/busses/i2c-amd756-s4882.c
+++ b/drivers/i2c/busses/i2c-amd756-s4882.c
@@ -184,12 +184,14 @@ static int __init amd756_s4882_init(void)
         s4882_algo[0].smbus_xfer = amd756_access_virt0;
         s4882_adapter[0] = amd756_smbus;
         s4882_adapter[0].algo = s4882_algo;
+        s4882_adapter[0].dev.parent = amd756_smbus.dev.parent;
         for (i = 1; i < 5; i++) {
                 s4882_algo[i] = *(amd756_smbus.algo);
                 s4882_adapter[i] = amd756_smbus;
                 sprintf(s4882_adapter[i].name,
                         "SMBus 8111 adapter (CPU%d)", i-1);
                 s4882_adapter[i].algo = s4882_algo+i;
+                s4882_adapter[i].dev.parent = amd756_smbus.dev.parent;
         }
         s4882_algo[1].smbus_xfer = amd756_access_virt1;
         s4882_algo[2].smbus_xfer = amd756_access_virt2;
diff --git a/drivers/i2c/busses/i2c-amd756.c b/drivers/i2c/busses/i2c-amd756.c
index 2d21afdc5b1c..fa6155a54cc3 100644
--- a/drivers/i2c/busses/i2c-amd756.c
+++ b/drivers/i2c/busses/i2c-amd756.c
@@ -42,7 +42,6 @@
 #include <linux/kernel.h>
 #include <linux/delay.h>
 #include <linux/stddef.h>
-#include <linux/sched.h>
 #include <linux/ioport.h>
 #include <linux/i2c.h>
 #include <linux/init.h>
@@ -301,6 +300,7 @@ static const struct i2c_algorithm smbus_algorithm = {
 
 struct i2c_adapter amd756_smbus = {
         .owner          = THIS_MODULE,
+        .id             = I2C_HW_SMBUS_AMD756,
         .class          = I2C_CLASS_HWMON,
         .algo           = &smbus_algorithm,
 };
diff --git a/drivers/i2c/busses/i2c-amd8111.c b/drivers/i2c/busses/i2c-amd8111.c
index 0fbc7186c91a..5bba3fb50d71 100644
--- a/drivers/i2c/busses/i2c-amd8111.c
+++ b/drivers/i2c/busses/i2c-amd8111.c
@@ -12,7 +12,6 @@
 #include <linux/pci.h>
 #include <linux/kernel.h>
 #include <linux/stddef.h>
-#include <linux/sched.h>
 #include <linux/ioport.h>
 #include <linux/init.h>
 #include <linux/i2c.h>
@@ -76,7 +75,8 @@ static unsigned int amd_ec_wait_write(struct amd_smbus *smbus)
                 udelay(1);
 
         if (!timeout) {
-                dev_warn(&smbus->dev->dev, "Timeout while waiting for IBF to clear\n");
+                dev_warn(&smbus->dev->dev,
+                         "Timeout while waiting for IBF to clear\n");
                 return -1;
         }
 
@@ -91,14 +91,16 @@ static unsigned int amd_ec_wait_read(struct amd_smbus *smbus)
                 udelay(1);
 
         if (!timeout) {
-                dev_warn(&smbus->dev->dev, "Timeout while waiting for OBF to set\n");
+                dev_warn(&smbus->dev->dev,
+                         "Timeout while waiting for OBF to set\n");
                 return -1;
         }
 
         return 0;
 }
 
-static unsigned int amd_ec_read(struct amd_smbus *smbus, unsigned char address, unsigned char *data)
+static unsigned int amd_ec_read(struct amd_smbus *smbus, unsigned char address,
+                unsigned char *data)
 {
         if (amd_ec_wait_write(smbus))
                 return -1;
@@ -115,7 +117,8 @@ static unsigned int amd_ec_read(struct amd_smbus *smbus, unsigned char address,
         return 0;
 }
 
-static unsigned int amd_ec_write(struct amd_smbus *smbus, unsigned char address, unsigned char data)
+static unsigned int amd_ec_write(struct amd_smbus *smbus, unsigned char address,
+                unsigned char data)
 {
         if (amd_ec_wait_write(smbus))
                 return -1;
@@ -175,18 +178,19 @@ static unsigned int amd_ec_write(struct amd_smbus *smbus, unsigned char address,
 #define AMD_SMB_PRTCL_PEC               0x80
 
 
-static s32 amd8111_access(struct i2c_adapter * adap, u16 addr, unsigned short flags,
-                char read_write, u8 command, int size, union i2c_smbus_data * data)
+static s32 amd8111_access(struct i2c_adapter * adap, u16 addr,
+                unsigned short flags, char read_write, u8 command, int size,
+                union i2c_smbus_data * data)
 {
         struct amd_smbus *smbus = adap->algo_data;
         unsigned char protocol, len, pec, temp[2];
         int i;
 
-        protocol = (read_write == I2C_SMBUS_READ) ? AMD_SMB_PRTCL_READ : AMD_SMB_PRTCL_WRITE;
+        protocol = (read_write == I2C_SMBUS_READ) ? AMD_SMB_PRTCL_READ
+                                                  : AMD_SMB_PRTCL_WRITE;
         pec = (flags & I2C_CLIENT_PEC) ? AMD_SMB_PRTCL_PEC : 0;
 
         switch (size) {
-
                 case I2C_SMBUS_QUICK:
                         protocol |= AMD_SMB_PRTCL_QUICK;
                         read_write = I2C_SMBUS_WRITE;
@@ -208,8 +212,10 @@ static s32 amd8111_access(struct i2c_adapter * adap, u16 addr, unsigned short fl
                 case I2C_SMBUS_WORD_DATA:
                         amd_ec_write(smbus, AMD_SMB_CMD, command);
                         if (read_write == I2C_SMBUS_WRITE) {
-                                amd_ec_write(smbus, AMD_SMB_DATA, data->word);
-                                amd_ec_write(smbus, AMD_SMB_DATA + 1, data->word >> 8);
+                                amd_ec_write(smbus, AMD_SMB_DATA,
+                                             data->word & 0xff);
+                                amd_ec_write(smbus, AMD_SMB_DATA + 1,
+                                             data->word >> 8);
                         }
                         protocol |= AMD_SMB_PRTCL_WORD_DATA | pec;
                         break;
@@ -217,27 +223,31 @@ static s32 amd8111_access(struct i2c_adapter * adap, u16 addr, unsigned short fl
                 case I2C_SMBUS_BLOCK_DATA:
                         amd_ec_write(smbus, AMD_SMB_CMD, command);
                         if (read_write == I2C_SMBUS_WRITE) {
-                                len = min_t(u8, data->block[0], 32);
+                                len = min_t(u8, data->block[0],
+                                            I2C_SMBUS_BLOCK_MAX);
                                 amd_ec_write(smbus, AMD_SMB_BCNT, len);
                                 for (i = 0; i < len; i++)
-                                        amd_ec_write(smbus, AMD_SMB_DATA + i, data->block[i + 1]);
+                                        amd_ec_write(smbus, AMD_SMB_DATA + i,
+                                                     data->block[i + 1]);
                         }
                         protocol |= AMD_SMB_PRTCL_BLOCK_DATA | pec;
                         break;
 
                 case I2C_SMBUS_I2C_BLOCK_DATA:
-                        len = min_t(u8, data->block[0], 32);
+                        len = min_t(u8, data->block[0],
+                                    I2C_SMBUS_BLOCK_MAX);
                         amd_ec_write(smbus, AMD_SMB_CMD, command);
                         amd_ec_write(smbus, AMD_SMB_BCNT, len);
                         if (read_write == I2C_SMBUS_WRITE)
                                 for (i = 0; i < len; i++)
-                                        amd_ec_write(smbus, AMD_SMB_DATA + i, data->block[i + 1]);
+                                        amd_ec_write(smbus, AMD_SMB_DATA + i,
+                                                     data->block[i + 1]);
                         protocol |= AMD_SMB_PRTCL_I2C_BLOCK_DATA;
                         break;
 
                 case I2C_SMBUS_PROC_CALL:
                         amd_ec_write(smbus, AMD_SMB_CMD, command);
-                        amd_ec_write(smbus, AMD_SMB_DATA, data->word);
+                        amd_ec_write(smbus, AMD_SMB_DATA, data->word & 0xff);
                         amd_ec_write(smbus, AMD_SMB_DATA + 1, data->word >> 8);
                         protocol = AMD_SMB_PRTCL_PROC_CALL | pec;
                         read_write = I2C_SMBUS_READ;
@@ -248,7 +258,8 @@ static s32 amd8111_access(struct i2c_adapter * adap, u16 addr, unsigned short fl
                         amd_ec_write(smbus, AMD_SMB_CMD, command);
                         amd_ec_write(smbus, AMD_SMB_BCNT, len);
                         for (i = 0; i < len; i++)
-                                amd_ec_write(smbus, AMD_SMB_DATA + i, data->block[i + 1]);
+                                amd_ec_write(smbus, AMD_SMB_DATA + i,
+                                             data->block[i + 1]);
                         protocol = AMD_SMB_PRTCL_BLOCK_PROC_CALL | pec;
                         read_write = I2C_SMBUS_READ;
                         break;
@@ -280,7 +291,6 @@ static s32 amd8111_access(struct i2c_adapter * adap, u16 addr, unsigned short fl
                 return 0;
 
         switch (size) {
-
                 case I2C_SMBUS_BYTE:
                 case I2C_SMBUS_BYTE_DATA:
                         amd_ec_read(smbus, AMD_SMB_DATA, &data->byte);
@@ -296,10 +306,11 @@ static s32 amd8111_access(struct i2c_adapter * adap, u16 addr, unsigned short fl
                 case I2C_SMBUS_BLOCK_DATA:
                 case I2C_SMBUS_BLOCK_PROC_CALL:
                         amd_ec_read(smbus, AMD_SMB_BCNT, &len);
-                        len = min_t(u8, len, 32);
+                        len = min_t(u8, len, I2C_SMBUS_BLOCK_MAX);
                 case I2C_SMBUS_I2C_BLOCK_DATA:
                         for (i = 0; i < len; i++)
-                                amd_ec_read(smbus, AMD_SMB_DATA + i, data->block + i + 1);
+                                amd_ec_read(smbus, AMD_SMB_DATA + i,
+                                            data->block + i + 1);
                         data->block[0] = len;
                         break;
         }
@@ -310,7 +321,8 @@ static s32 amd8111_access(struct i2c_adapter * adap, u16 addr, unsigned short fl
 
 static u32 amd8111_func(struct i2c_adapter *adapter)
 {
-        return  I2C_FUNC_SMBUS_QUICK | I2C_FUNC_SMBUS_BYTE | I2C_FUNC_SMBUS_BYTE_DATA |
+        return  I2C_FUNC_SMBUS_QUICK | I2C_FUNC_SMBUS_BYTE |
+                I2C_FUNC_SMBUS_BYTE_DATA |
                 I2C_FUNC_SMBUS_WORD_DATA | I2C_FUNC_SMBUS_BLOCK_DATA |
                 I2C_FUNC_SMBUS_PROC_CALL | I2C_FUNC_SMBUS_BLOCK_PROC_CALL |
                 I2C_FUNC_SMBUS_I2C_BLOCK | I2C_FUNC_SMBUS_HWPEC_CALC;
@@ -329,12 +341,13 @@ static struct pci_device_id amd8111_ids[] = {
 
 MODULE_DEVICE_TABLE (pci, amd8111_ids);
 
-static int __devinit amd8111_probe(struct pci_dev *dev, const struct pci_device_id *id)
+static int __devinit amd8111_probe(struct pci_dev *dev,
+                const struct pci_device_id *id)
 {
         struct amd_smbus *smbus;
-        int error = -ENODEV;
+        int error;
 
-        if (~pci_resource_flags(dev, 0) & IORESOURCE_IO)
+        if (!(pci_resource_flags(dev, 0) & IORESOURCE_IO))
                 return -ENODEV;
 
         smbus = kzalloc(sizeof(struct amd_smbus), GFP_KERNEL);
@@ -345,12 +358,15 @@ static int __devinit amd8111_probe(struct pci_dev *dev, const struct pci_device_
         smbus->base = pci_resource_start(dev, 0);
         smbus->size = pci_resource_len(dev, 0);
 
-        if (!request_region(smbus->base, smbus->size, amd8111_driver.name))
+        if (!request_region(smbus->base, smbus->size, amd8111_driver.name)) {
+                error = -EBUSY;
                 goto out_kfree;
+        }
 
         smbus->adapter.owner = THIS_MODULE;
         snprintf(smbus->adapter.name, I2C_NAME_SIZE,
                 "SMBus2 AMD8111 adapter at %04x", smbus->base);
+        smbus->adapter.id = I2C_HW_SMBUS_AMD8111;
         smbus->adapter.class = I2C_CLASS_HWMON;
         smbus->adapter.algo = &smbus_algorithm;
         smbus->adapter.algo_data = smbus;
@@ -358,11 +374,11 @@ static int __devinit amd8111_probe(struct pci_dev *dev, const struct pci_device_
         /* set up the driverfs linkage to our parent device */
         smbus->adapter.dev.parent = &dev->dev;
 
+        pci_write_config_dword(smbus->dev, AMD_PCI_MISC, 0);
         error = i2c_add_adapter(&smbus->adapter);
         if (error)
                 goto out_release_region;
 
-        pci_write_config_dword(smbus->dev, AMD_PCI_MISC, 0);
         pci_set_drvdata(dev, smbus);
         return 0;
 
@@ -370,10 +386,9 @@ static int __devinit amd8111_probe(struct pci_dev *dev, const struct pci_device_
         release_region(smbus->base, smbus->size);
  out_kfree:
         kfree(smbus);
-        return -1;
+        return error;
 }
 
-
 static void __devexit amd8111_remove(struct pci_dev *dev)
 {
         struct amd_smbus *smbus = pci_get_drvdata(dev);
@@ -395,7 +410,6 @@ static int __init i2c_amd8111_init(void)
         return pci_register_driver(&amd8111_driver);
 }
 
-
 static void __exit i2c_amd8111_exit(void)
 {
         pci_unregister_driver(&amd8111_driver);
diff --git a/drivers/i2c/busses/i2c-i801.c b/drivers/i2c/busses/i2c-i801.c
index ae625b854470..21f2671f7220 100644
--- a/drivers/i2c/busses/i2c-i801.c
+++ b/drivers/i2c/busses/i2c-i801.c
@@ -48,7 +48,6 @@
 #include <linux/kernel.h>
 #include <linux/stddef.h>
 #include <linux/delay.h>
-#include <linux/sched.h>
 #include <linux/ioport.h>
 #include <linux/init.h>
 #include <linux/i2c.h>
@@ -123,7 +122,7 @@ static int i801_transaction(void)
                         dev_dbg(&I801_dev->dev, "Failed! (%02x)\n", temp);
                         return -1;
                 } else {
-                        dev_dbg(&I801_dev->dev, "Successfull!\n");
+                        dev_dbg(&I801_dev->dev, "Successful!\n");
                 }
         }
 
@@ -442,6 +441,7 @@ static const struct i2c_algorithm smbus_algorithm = {
 
 static struct i2c_adapter i801_adapter = {
         .owner          = THIS_MODULE,
+        .id             = I2C_HW_SMBUS_I801,
         .class          = I2C_CLASS_HWMON,
         .algo           = &smbus_algorithm,
 };
diff --git a/drivers/i2c/busses/i2c-i810.c b/drivers/i2c/busses/i2c-i810.c
index 10c98bc88aa6..42e8d94c276f 100644
--- a/drivers/i2c/busses/i2c-i810.c
+++ b/drivers/i2c/busses/i2c-i810.c
@@ -171,6 +171,7 @@ static struct i2c_algo_bit_data i810_i2c_bit_data = {
 
 static struct i2c_adapter i810_i2c_adapter = {
         .owner          = THIS_MODULE,
+        .id             = I2C_HW_B_I810,
         .name           = "I810/I815 I2C Adapter",
         .algo_data      = &i810_i2c_bit_data,
 };
@@ -186,6 +187,7 @@ static struct i2c_algo_bit_data i810_ddc_bit_data = {
 
 static struct i2c_adapter i810_ddc_adapter = {
         .owner          = THIS_MODULE,
+        .id             = I2C_HW_B_I810,
         .name           = "I810/I815 DDC Adapter",
         .algo_data      = &i810_ddc_bit_data,
 };
diff --git a/drivers/i2c/busses/i2c-ibm_iic.c b/drivers/i2c/busses/i2c-ibm_iic.c
index 1898e9987021..8b14d14e60ca 100644
--- a/drivers/i2c/busses/i2c-ibm_iic.c
+++ b/drivers/i2c/busses/i2c-ibm_iic.c
@@ -727,6 +727,7 @@ static int __devinit iic_probe(struct ocp_device *ocp){
         
         /* Register it with i2c layer */
         adap = &dev->adap;
+        adap->dev.parent = &ocp->dev;
         strcpy(adap->name, "IBM IIC");
         i2c_set_adapdata(adap, dev);
         adap->id = I2C_HW_OCP;
diff --git a/drivers/i2c/busses/i2c-iop3xx.c b/drivers/i2c/busses/i2c-iop3xx.c
index d108ab4974cc..20ee4f7c53a0 100644
--- a/drivers/i2c/busses/i2c-iop3xx.c
+++ b/drivers/i2c/busses/i2c-iop3xx.c
@@ -36,7 +36,6 @@
 #include <linux/slab.h>
 #include <linux/init.h>
 #include <linux/errno.h>
-#include <linux/sched.h>
 #include <linux/platform_device.h>
 #include <linux/i2c.h>
 
diff --git a/drivers/i2c/busses/i2c-isa.c b/drivers/i2c/busses/i2c-isa.c
index 8ed59a2dff53..5f33bc9c1e02 100644
--- a/drivers/i2c/busses/i2c-isa.c
+++ b/drivers/i2c/busses/i2c-isa.c
@@ -39,6 +39,7 @@
 #include <linux/i2c.h>
 #include <linux/i2c-isa.h>
 #include <linux/platform_device.h>
+#include <linux/completion.h>
 
 static u32 isa_func(struct i2c_adapter *adapter);
 
diff --git a/drivers/i2c/busses/i2c-mv64xxx.c b/drivers/i2c/busses/i2c-mv64xxx.c
index 490173611d6b..a3283b907eb8 100644
--- a/drivers/i2c/busses/i2c-mv64xxx.c
+++ b/drivers/i2c/busses/i2c-mv64xxx.c
@@ -520,6 +520,7 @@ mv64xxx_i2c_probe(struct platform_device *pd)
                 rc = -ENXIO;
                 goto exit_unmap_regs;
         }
+        drv_data->adapter.dev.parent = &pd->dev;
         drv_data->adapter.id = I2C_HW_MV64XXX;
         drv_data->adapter.algo = &mv64xxx_i2c_algo;
         drv_data->adapter.owner = THIS_MODULE;
diff --git a/drivers/i2c/busses/i2c-nforce2.c b/drivers/i2c/busses/i2c-nforce2.c
index ad37c10e7fec..1514ec5b77f8 100644
--- a/drivers/i2c/busses/i2c-nforce2.c
+++ b/drivers/i2c/busses/i2c-nforce2.c
@@ -44,7 +44,6 @@
 #include <linux/pci.h>
 #include <linux/kernel.h>
 #include <linux/stddef.h>
-#include <linux/sched.h>
 #include <linux/ioport.h>
 #include <linux/init.h>
 #include <linux/i2c.h>
@@ -57,7 +56,6 @@ MODULE_DESCRIPTION("nForce2/3/4/5xx SMBus driver");
 
 
 struct nforce2_smbus {
-        struct pci_dev *dev;
         struct i2c_adapter adapter;
         int base;
         int size;
@@ -230,7 +228,6 @@ static int __devinit nforce2_probe_smb (struct pci_dev *dev, int bar,
                 smbus->base = iobase & PCI_BASE_ADDRESS_IO_MASK;
                 smbus->size = 64;
         }
-        smbus->dev = dev;
 
         if (!request_region(smbus->base, smbus->size, nforce2_driver.name)) {
                 dev_err(&smbus->adapter.dev, "Error requesting region %02x .. %02X for %s\n",
@@ -238,6 +235,7 @@ static int __devinit nforce2_probe_smb (struct pci_dev *dev, int bar,
                 return -1;
         }
         smbus->adapter.owner = THIS_MODULE;
+        smbus->adapter.id = I2C_HW_SMBUS_NFORCE2;
         smbus->adapter.class = I2C_CLASS_HWMON;
         smbus->adapter.algo = &smbus_algorithm;
         smbus->adapter.algo_data = smbus;
diff --git a/drivers/i2c/busses/i2c-ocores.c b/drivers/i2c/busses/i2c-ocores.c
index f28a76d1c0af..e417c2c3ca22 100644
--- a/drivers/i2c/busses/i2c-ocores.c
+++ b/drivers/i2c/busses/i2c-ocores.c
@@ -11,7 +11,6 @@
 
 #include <linux/kernel.h>
 #include <linux/module.h>
-#include <linux/sched.h>
 #include <linux/init.h>
 #include <linux/errno.h>
 #include <linux/platform_device.h>
diff --git a/drivers/i2c/busses/i2c-parport.h b/drivers/i2c/busses/i2c-parport.h
index 9ddd816d5d0f..ed69d846cb95 100644
--- a/drivers/i2c/busses/i2c-parport.h
+++ b/drivers/i2c/busses/i2c-parport.h
@@ -88,6 +88,13 @@ static struct adapter_parm adapter_parm[] = {
                 .getscl = { 0x40, STAT, 0 },
                 .init   = { 0xfc, DATA, 0 },
         },
+        /* type 7: One For All JP1 parallel port adapter */
+        {
+                .setsda = { 0x01, DATA, 0 },
+                .setscl = { 0x02, DATA, 0 },
+                .getsda = { 0x80, STAT, 1 },
+                .init   = { 0x04, DATA, 1 },
+        },
 };
 
 static int type = -1;
@@ -101,4 +108,5 @@ MODULE_PARM_DESC(type,
         " 4 = ADM1032 evaluation board\n"
         " 5 = ADM1025, ADM1030 and ADM1031 evaluation boards\n"
         " 6 = Barco LPT->DVI (K5800236) adapter\n"
+        " 7 = One For All JP1 parallel port adapter\n"
 );
diff --git a/drivers/i2c/busses/i2c-pasemi.c b/drivers/i2c/busses/i2c-pasemi.c
new file mode 100644
index 000000000000..f54fb5d65cc4
--- /dev/null
+++ b/drivers/i2c/busses/i2c-pasemi.c
@@ -0,0 +1,426 @@
+/*
+ * Copyright (C) 2006-2007 PA Semi, Inc
+ *
+ * SMBus host driver for PA Semi PWRficient
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307 USA
+ */
+
+#include <linux/module.h>
+#include <linux/pci.h>
+#include <linux/kernel.h>
+#include <linux/stddef.h>
+#include <linux/sched.h>
+#include <linux/i2c.h>
+#include <linux/delay.h>
+#include <asm/io.h>
+
+static struct pci_driver pasemi_smb_driver;
+
+struct pasemi_smbus {
+        struct pci_dev          *dev;
+        struct i2c_adapter       adapter;
+        unsigned long            base;
+        int                      size;
+};
+
+/* Register offsets */
+#define REG_MTXFIFO     0x00
+#define REG_MRXFIFO     0x04
+#define REG_SMSTA       0x14
+#define REG_CTL         0x1c
+
+/* Register defs */
+#define MTXFIFO_READ    0x00000400
+#define MTXFIFO_STOP    0x00000200
+#define MTXFIFO_START   0x00000100
+#define MTXFIFO_DATA_M  0x000000ff
+
+#define MRXFIFO_EMPTY   0x00000100
+#define MRXFIFO_DATA_M  0x000000ff
+
+#define SMSTA_XEN       0x08000000
+
+#define CTL_MRR         0x00000400
+#define CTL_MTR         0x00000200
+#define CTL_CLK_M       0x000000ff
+
+#define CLK_100K_DIV    84
+#define CLK_400K_DIV    21
+
+static inline void reg_write(struct pasemi_smbus *smbus, int reg, int val)
+{
+        dev_dbg(&smbus->dev->dev, "smbus write reg %lx val %08x\n",
+                smbus->base + reg, val);
+        outl(val, smbus->base + reg);
+}
+
+static inline int reg_read(struct pasemi_smbus *smbus, int reg)
+{
+        int ret;
+        ret = inl(smbus->base + reg);
+        dev_dbg(&smbus->dev->dev, "smbus read reg %lx val %08x\n",
+                smbus->base + reg, ret);
+        return ret;
+}
+
+#define TXFIFO_WR(smbus, reg)   reg_write((smbus), REG_MTXFIFO, (reg))
+#define RXFIFO_RD(smbus)        reg_read((smbus), REG_MRXFIFO)
+
+static void pasemi_smb_clear(struct pasemi_smbus *smbus)
+{
+        unsigned int status;
+
+        status = reg_read(smbus, REG_SMSTA);
+        reg_write(smbus, REG_SMSTA, status);
+}
+
+static unsigned int pasemi_smb_waitready(struct pasemi_smbus *smbus)
+{
+        int timeout = 10;
+        unsigned int status;
+
+        status = reg_read(smbus, REG_SMSTA);
+
+        while (!(status & SMSTA_XEN) && timeout--) {
+                msleep(1);
+                status = reg_read(smbus, REG_SMSTA);
+        }
+
+        if (timeout < 0) {
+                dev_warn(&smbus->dev->dev, "Timeout, status 0x%08x\n", status);
+                reg_write(smbus, REG_SMSTA, status);
+                return -ETIME;
+        }
+
+        /* Clear XEN */
+        reg_write(smbus, REG_SMSTA, SMSTA_XEN);
+
+        return 0;
+}
+
+static int pasemi_i2c_xfer_msg(struct i2c_adapter *adapter,
+                               struct i2c_msg *msg, int stop)
+{
+        struct pasemi_smbus *smbus = adapter->algo_data;
+        int read, i, err;
+        u32 rd;
+
+        read = msg->flags & I2C_M_RD ? 1 : 0;
+
+        TXFIFO_WR(smbus, MTXFIFO_START | (msg->addr << 1) | read);
+
+        if (read) {
+                TXFIFO_WR(smbus, msg->len | MTXFIFO_READ |
+                                 (stop ? MTXFIFO_STOP : 0));
+
+                err = pasemi_smb_waitready(smbus);
+                if (err)
+                        goto reset_out;
+
+                for (i = 0; i < msg->len; i++) {
+                        rd = RXFIFO_RD(smbus);
+                        if (rd & MRXFIFO_EMPTY) {
+                                err = -ENODATA;
+                                goto reset_out;
+                        }
+                        msg->buf[i] = rd & MRXFIFO_DATA_M;
+                }
+        } else {
+                for (i = 0; i < msg->len - 1; i++)
+                        TXFIFO_WR(smbus, msg->buf[i]);
+
+                TXFIFO_WR(smbus, msg->buf[msg->len] |
+                          (stop ? MTXFIFO_STOP : 0));
+        }
+
+        return 0;
+
+ reset_out:
+        reg_write(smbus, REG_CTL, (CTL_MTR | CTL_MRR |
+                  (CLK_100K_DIV & CTL_CLK_M)));
+        return err;
+}
+
+static int pasemi_i2c_xfer(struct i2c_adapter *adapter,
+                           struct i2c_msg *msgs, int num)
+{
+        struct pasemi_smbus *smbus = adapter->algo_data;
+        int ret, i;
+
+        pasemi_smb_clear(smbus);
+
+        ret = 0;
+
+        for (i = 0; i < num && !ret; i++)
+                ret = pasemi_i2c_xfer_msg(adapter, &msgs[i], (i == (num - 1)));
+
+        return ret ? ret : num;
+}
+
+static int pasemi_smb_xfer(struct i2c_adapter *adapter,
+                u16 addr, unsigned short flags, char read_write, u8 command,
+                int size, union i2c_smbus_data *data)
+{
+        struct pasemi_smbus *smbus = adapter->algo_data;
+        unsigned int rd;
+        int read_flag, err;
+        int len = 0, i;
+
+        /* All our ops take 8-bit shifted addresses */
+        addr <<= 1;
+        read_flag = read_write == I2C_SMBUS_READ;
+
+        pasemi_smb_clear(smbus);
+
+        switch (size) {
+        case I2C_SMBUS_QUICK:
+                TXFIFO_WR(smbus, addr | read_flag | MTXFIFO_START |
+                          MTXFIFO_STOP);
+                break;
+        case I2C_SMBUS_BYTE:
+                TXFIFO_WR(smbus, addr | read_flag | MTXFIFO_START);
+                if (read_write)
+                        TXFIFO_WR(smbus, 1 | MTXFIFO_STOP | MTXFIFO_READ);
+                else
+                        TXFIFO_WR(smbus, MTXFIFO_STOP | command);
+                break;
+        case I2C_SMBUS_BYTE_DATA:
+                TXFIFO_WR(smbus, addr | MTXFIFO_START);
+                TXFIFO_WR(smbus, command);
+                if (read_write) {
+                        TXFIFO_WR(smbus, addr | I2C_SMBUS_READ | MTXFIFO_START);
+                        TXFIFO_WR(smbus, 1 | MTXFIFO_READ | MTXFIFO_STOP);
+                } else {
+                        TXFIFO_WR(smbus, MTXFIFO_STOP | data->byte);
+                }
+                break;
+        case I2C_SMBUS_WORD_DATA:
+                TXFIFO_WR(smbus, addr | MTXFIFO_START);
+                TXFIFO_WR(smbus, command);
+                if (read_write) {
+                        TXFIFO_WR(smbus, addr | I2C_SMBUS_READ | MTXFIFO_START);
+                        TXFIFO_WR(smbus, 2 | MTXFIFO_READ | MTXFIFO_STOP);
+                } else {
+                        TXFIFO_WR(smbus, data->word & MTXFIFO_DATA_M);
+                        TXFIFO_WR(smbus, MTXFIFO_STOP | (data->word >> 8));
+                }
+                break;
+        case I2C_SMBUS_BLOCK_DATA:
+                TXFIFO_WR(smbus, addr | MTXFIFO_START);
+                TXFIFO_WR(smbus, command);
+                if (read_write) {
+                        TXFIFO_WR(smbus, addr | I2C_SMBUS_READ | MTXFIFO_START);
+                        TXFIFO_WR(smbus, 1 | MTXFIFO_READ);
+                        rd = RXFIFO_RD(smbus);
+                        len = min_t(u8, (rd & MRXFIFO_DATA_M),
+                                    I2C_SMBUS_BLOCK_MAX);
+                        TXFIFO_WR(smbus, (len + 1) | MTXFIFO_READ |
+                                         MTXFIFO_STOP);
+                } else {
+                        len = min_t(u8, data->block[0], I2C_SMBUS_BLOCK_MAX);
+                        TXFIFO_WR(smbus, len);
+                        for (i = 1; i < len; i++)
+                                TXFIFO_WR(smbus, data->block[i]);
+                        TXFIFO_WR(smbus, data->block[len] | MTXFIFO_STOP);
+                }
+                break;
+        case I2C_SMBUS_PROC_CALL:
+                read_write = I2C_SMBUS_READ;
+                TXFIFO_WR(smbus, addr | MTXFIFO_START);
+                TXFIFO_WR(smbus, command);
+                TXFIFO_WR(smbus, data->word & MTXFIFO_DATA_M);
+                TXFIFO_WR(smbus, (data->word >> 8) & MTXFIFO_DATA_M);
+                TXFIFO_WR(smbus, addr | I2C_SMBUS_READ | MTXFIFO_START);
+                TXFIFO_WR(smbus, 2 | MTXFIFO_STOP | MTXFIFO_READ);
+                break;
+        case I2C_SMBUS_BLOCK_PROC_CALL:
+                len = min_t(u8, data->block[0], I2C_SMBUS_BLOCK_MAX - 1);
+                read_write = I2C_SMBUS_READ;
+                TXFIFO_WR(smbus, addr | MTXFIFO_START);
+                TXFIFO_WR(smbus, command);
+                TXFIFO_WR(smbus, len);
+                for (i = 1; i <= len; i++)
+                        TXFIFO_WR(smbus, data->block[i]);
+                TXFIFO_WR(smbus, addr | I2C_SMBUS_READ);
+                TXFIFO_WR(smbus, MTXFIFO_READ | 1);
+                rd = RXFIFO_RD(smbus);
+                len = min_t(u8, (rd & MRXFIFO_DATA_M),
+                            I2C_SMBUS_BLOCK_MAX - len);
+                TXFIFO_WR(smbus, (len + 1) | MTXFIFO_READ | MTXFIFO_STOP);
+                break;
+
+        default:
+                dev_warn(&adapter->dev, "Unsupported transaction %d\n", size);
+                return -EINVAL;
+        }
+
+        err = pasemi_smb_waitready(smbus);
+        if (err)
+                goto reset_out;
+
+        if (read_write == I2C_SMBUS_WRITE)
+                return 0;
+
+        switch (size) {
+        case I2C_SMBUS_BYTE:
+        case I2C_SMBUS_BYTE_DATA:
+                rd = RXFIFO_RD(smbus);
+                if (rd & MRXFIFO_EMPTY) {
+                        err = -ENODATA;
+                        goto reset_out;
+                }
+                data->byte = rd & MRXFIFO_DATA_M;
+                break;
+        case I2C_SMBUS_WORD_DATA:
+        case I2C_SMBUS_PROC_CALL:
+                rd = RXFIFO_RD(smbus);
+                if (rd & MRXFIFO_EMPTY) {
+                        err = -ENODATA;
+                        goto reset_out;
+                }
+                data->word = rd & MRXFIFO_DATA_M;
+                rd = RXFIFO_RD(smbus);
+                if (rd & MRXFIFO_EMPTY) {
+                        err = -ENODATA;
+                        goto reset_out;
+                }
+                data->word |= (rd & MRXFIFO_DATA_M) << 8;
+                break;
+        case I2C_SMBUS_BLOCK_DATA:
+        case I2C_SMBUS_BLOCK_PROC_CALL:
+                data->block[0] = len;
+                for (i = 1; i <= len; i ++) {
+                        rd = RXFIFO_RD(smbus);
+                        if (rd & MRXFIFO_EMPTY) {
+                                err = -ENODATA;
+                                goto reset_out;
+                        }
+                        data->block[i] = rd & MRXFIFO_DATA_M;
+                }
+                break;
+        }
+
+        return 0;
+
+ reset_out:
+        reg_write(smbus, REG_CTL, (CTL_MTR | CTL_MRR |
+                  (CLK_100K_DIV & CTL_CLK_M)));
+        return err;
+}
+
+static u32 pasemi_smb_func(struct i2c_adapter *adapter)
+{
+        return I2C_FUNC_SMBUS_QUICK | I2C_FUNC_SMBUS_BYTE |
+               I2C_FUNC_SMBUS_BYTE_DATA | I2C_FUNC_SMBUS_WORD_DATA |
+               I2C_FUNC_SMBUS_BLOCK_DATA | I2C_FUNC_SMBUS_PROC_CALL |
+               I2C_FUNC_SMBUS_BLOCK_PROC_CALL | I2C_FUNC_I2C;
+}
+
+static const struct i2c_algorithm smbus_algorithm = {
+        .master_xfer    = pasemi_i2c_xfer,
+        .smbus_xfer     = pasemi_smb_xfer,
+        .functionality  = pasemi_smb_func,
+};
+
+static int __devinit pasemi_smb_probe(struct pci_dev *dev,
+                                      const struct pci_device_id *id)
+{
+        struct pasemi_smbus *smbus;
+        int error;
+
+        if (!(pci_resource_flags(dev, 0) & IORESOURCE_IO))
+                return -ENODEV;
+
+        smbus = kzalloc(sizeof(struct pasemi_smbus), GFP_KERNEL);
+        if (!smbus)
+                return -ENOMEM;
+
+        smbus->dev = dev;
+        smbus->base = pci_resource_start(dev, 0);
+        smbus->size = pci_resource_len(dev, 0);
+
+        if (!request_region(smbus->base, smbus->size,
+                            pasemi_smb_driver.name)) {
+                error = -EBUSY;
+                goto out_kfree;
+        }
+
+        smbus->adapter.owner = THIS_MODULE;
+        snprintf(smbus->adapter.name, I2C_NAME_SIZE,
+                 "PA Semi SMBus adapter at 0x%lx", smbus->base);
+        smbus->adapter.class = I2C_CLASS_HWMON;
+        smbus->adapter.algo = &smbus_algorithm;
+        smbus->adapter.algo_data = smbus;
+
+        /* set up the driverfs linkage to our parent device */
+        smbus->adapter.dev.parent = &dev->dev;
+
+        reg_write(smbus, REG_CTL, (CTL_MTR | CTL_MRR |
+                  (CLK_100K_DIV & CTL_CLK_M)));
+
+        error = i2c_add_adapter(&smbus->adapter);
+        if (error)
+                goto out_release_region;
+
+        pci_set_drvdata(dev, smbus);
+
+        return 0;
+
+ out_release_region:
+        release_region(smbus->base, smbus->size);
+ out_kfree:
+        kfree(smbus);
+        return error;
+}
+
+static void __devexit pasemi_smb_remove(struct pci_dev *dev)
+{
+        struct pasemi_smbus *smbus = pci_get_drvdata(dev);
+
+        i2c_del_adapter(&smbus->adapter);
+        release_region(smbus->base, smbus->size);
+        kfree(smbus);
+}
+
+static struct pci_device_id pasemi_smb_ids[] = {
+        { PCI_DEVICE(0x1959, 0xa003) },
+        { 0, }
+};
+
+MODULE_DEVICE_TABLE(pci, pasemi_smb_ids);
+
+static struct pci_driver pasemi_smb_driver = {
+        .name           = "i2c-pasemi",
+        .id_table       = pasemi_smb_ids,
+        .probe          = pasemi_smb_probe,
+        .remove         = __devexit_p(pasemi_smb_remove),
+};
+
+static int __init pasemi_smb_init(void)
+{
+        return pci_register_driver(&pasemi_smb_driver);
+}
+
+static void __exit pasemi_smb_exit(void)
+{
+        pci_unregister_driver(&pasemi_smb_driver);
+}
+
+MODULE_LICENSE("GPL");
+MODULE_AUTHOR ("Olof Johansson <olof@lixom.net>");
+MODULE_DESCRIPTION("PA Semi PWRficient SMBus driver");
+
+module_init(pasemi_smb_init);
+module_exit(pasemi_smb_exit);
diff --git a/drivers/i2c/busses/i2c-piix4.c b/drivers/i2c/busses/i2c-piix4.c
index 30c7a1b38cbd..d888293c1a9c 100644
--- a/drivers/i2c/busses/i2c-piix4.c
+++ b/drivers/i2c/busses/i2c-piix4.c
@@ -23,6 +23,7 @@
    Supports:
         Intel PIIX4, 440MX
         Serverworks OSB4, CSB5, CSB6, HT-1000
+        ATI IXP200, IXP300, IXP400, SB600
         SMSC Victory66
 
    Note: we assume there can only be one device, with one SMBus interface.
@@ -34,7 +35,6 @@
 #include <linux/kernel.h>
 #include <linux/delay.h>
 #include <linux/stddef.h>
-#include <linux/sched.h>
 #include <linux/ioport.h>
 #include <linux/i2c.h>
 #include <linux/init.h>
@@ -383,6 +383,7 @@ static const struct i2c_algorithm smbus_algorithm = {
 
 static struct i2c_adapter piix4_adapter = {
         .owner          = THIS_MODULE,
+        .id             = I2C_HW_SMBUS_PIIX4,
         .class          = I2C_CLASS_HWMON,
         .algo           = &smbus_algorithm,
 };
@@ -396,6 +397,8 @@ static struct pci_device_id piix4_ids[] = {
           .driver_data = 0 },
         { PCI_DEVICE(PCI_VENDOR_ID_ATI, PCI_DEVICE_ID_ATI_IXP400_SMBUS),
           .driver_data = 0 },
+        { PCI_DEVICE(PCI_VENDOR_ID_ATI, PCI_DEVICE_ID_ATI_IXP600_SMBUS),
+          .driver_data = 0 },
         { PCI_DEVICE(PCI_VENDOR_ID_SERVERWORKS, PCI_DEVICE_ID_SERVERWORKS_OSB4),
           .driver_data = 0 },
         { PCI_DEVICE(PCI_VENDOR_ID_SERVERWORKS, PCI_DEVICE_ID_SERVERWORKS_CSB5),
diff --git a/drivers/i2c/busses/i2c-powermac.c b/drivers/i2c/busses/i2c-powermac.c
index 648d55533d87..1425d2245c82 100644
--- a/drivers/i2c/busses/i2c-powermac.c
+++ b/drivers/i2c/busses/i2c-powermac.c
@@ -25,7 +25,6 @@
 #include <linux/types.h>
 #include <linux/i2c.h>
 #include <linux/init.h>
-#include <linux/completion.h>
 #include <linux/device.h>
 #include <linux/platform_device.h>
 #include <asm/prom.h>
diff --git a/drivers/i2c/busses/i2c-s3c2410.c b/drivers/i2c/busses/i2c-s3c2410.c
index 4ca6de209b8b..556f244aae76 100644
--- a/drivers/i2c/busses/i2c-s3c2410.c
+++ b/drivers/i2c/busses/i2c-s3c2410.c
@@ -28,7 +28,6 @@
 #include <linux/init.h>
 #include <linux/time.h>
 #include <linux/interrupt.h>
-#include <linux/sched.h>
 #include <linux/delay.h>
 #include <linux/errno.h>
 #include <linux/err.h>
diff --git a/drivers/i2c/busses/i2c-savage4.c b/drivers/i2c/busses/i2c-savage4.c
index 844b4ff90893..b7fb65c30112 100644
--- a/drivers/i2c/busses/i2c-savage4.c
+++ b/drivers/i2c/busses/i2c-savage4.c
@@ -145,6 +145,7 @@ static struct i2c_algo_bit_data sav_i2c_bit_data = {
 
 static struct i2c_adapter savage4_i2c_adapter = {
         .owner          = THIS_MODULE,
+        .id             = I2C_HW_B_SAVAGE,
         .name           = "I2C Savage4 adapter",
         .algo_data      = &sav_i2c_bit_data,
 };
diff --git a/drivers/i2c/busses/i2c-sis5595.c b/drivers/i2c/busses/i2c-sis5595.c
index 38bbfd840b6b..d333babe4ad3 100644
--- a/drivers/i2c/busses/i2c-sis5595.c
+++ b/drivers/i2c/busses/i2c-sis5595.c
@@ -365,6 +365,7 @@ static const struct i2c_algorithm smbus_algorithm = {
 
 static struct i2c_adapter sis5595_adapter = {
         .owner          = THIS_MODULE,
+        .id             = I2C_HW_SMBUS_SIS5595,
         .class          = I2C_CLASS_HWMON,
         .algo           = &smbus_algorithm,
 };
diff --git a/drivers/i2c/busses/i2c-sis630.c b/drivers/i2c/busses/i2c-sis630.c
index dec0bafb52ab..172bacf932a6 100644
--- a/drivers/i2c/busses/i2c-sis630.c
+++ b/drivers/i2c/busses/i2c-sis630.c
@@ -457,6 +457,7 @@ static const struct i2c_algorithm smbus_algorithm = {
 
 static struct i2c_adapter sis630_adapter = {
         .owner          = THIS_MODULE,
+        .id             = I2C_HW_SMBUS_SIS630,
         .class          = I2C_CLASS_HWMON,
         .algo           = &smbus_algorithm,
 };
diff --git a/drivers/i2c/busses/i2c-sis96x.c b/drivers/i2c/busses/i2c-sis96x.c
index 7fd07fbac336..73dae449fb23 100644
--- a/drivers/i2c/busses/i2c-sis96x.c
+++ b/drivers/i2c/busses/i2c-sis96x.c
@@ -37,7 +37,6 @@
 #include <linux/kernel.h>
 #include <linux/delay.h>
 #include <linux/stddef.h>
-#include <linux/sched.h>
 #include <linux/ioport.h>
 #include <linux/i2c.h>
 #include <linux/init.h>
@@ -249,6 +248,7 @@ static const struct i2c_algorithm smbus_algorithm = {
 
 static struct i2c_adapter sis96x_adapter = {
         .owner          = THIS_MODULE,
+        .id             = I2C_HW_SMBUS_SIS96X,
         .class          = I2C_CLASS_HWMON,
         .algo           = &smbus_algorithm,
 };
diff --git a/drivers/i2c/busses/i2c-via.c b/drivers/i2c/busses/i2c-via.c
index 15d7e00e47e6..bbcc62151f7c 100644
--- a/drivers/i2c/busses/i2c-via.c
+++ b/drivers/i2c/busses/i2c-via.c
@@ -86,6 +86,7 @@ static struct i2c_algo_bit_data bit_data = {
 
 static struct i2c_adapter vt586b_adapter = {
         .owner          = THIS_MODULE,
+        .id             = I2C_HW_B_VIA,
         .class          = I2C_CLASS_HWMON,
         .name           = "VIA i2c",
         .algo_data      = &bit_data,
diff --git a/drivers/i2c/busses/i2c-viapro.c b/drivers/i2c/busses/i2c-viapro.c
index efc6bbf0cc0a..03c5fc868548 100644
--- a/drivers/i2c/busses/i2c-viapro.c
+++ b/drivers/i2c/busses/i2c-viapro.c
@@ -4,7 +4,7 @@
     Copyright (c) 1998 - 2002  Frodo Looijaard <frodol@dds.nl>,
     Philip Edelbrock <phil@netroedge.com>, Kyösti Mälkki <kmalkki@cc.hut.fi>,
     Mark D. Studebaker <mdsxyz123@yahoo.com>
-    Copyright (C) 2005  Jean Delvare <khali@linux-fr.org>
+    Copyright (C) 2005 - 2007  Jean Delvare <khali@linux-fr.org>
 
     This program is free software; you can redistribute it and/or modify
     it under the terms of the GNU General Public License as published by
@@ -36,6 +36,7 @@
    VT8237R            0x3227             yes
    VT8237A            0x3337             yes
    VT8251             0x3287             yes
+   CX700              0x8324             yes
 
    Note: we assume there can only be one device, with one SMBus interface.
 */
@@ -306,6 +307,7 @@ static const struct i2c_algorithm smbus_algorithm = {
 
 static struct i2c_adapter vt596_adapter = {
         .owner          = THIS_MODULE,
+        .id             = I2C_HW_SMBUS_VIA2,
         .class          = I2C_CLASS_HWMON,
         .algo           = &smbus_algorithm,
 };
@@ -383,6 +385,7 @@ found:
         dev_dbg(&pdev->dev, "VT596_smba = 0x%X\n", vt596_smba);
 
         switch (pdev->device) {
+        case PCI_DEVICE_ID_VIA_CX700:
         case PCI_DEVICE_ID_VIA_8251:
         case PCI_DEVICE_ID_VIA_8237:
         case PCI_DEVICE_ID_VIA_8237A:
@@ -442,6 +445,8 @@ static struct pci_device_id vt596_ids[] = {
           .driver_data = SMBBA1 },
         { PCI_DEVICE(PCI_VENDOR_ID_VIA, PCI_DEVICE_ID_VIA_8251),
           .driver_data = SMBBA3 },
+        { PCI_DEVICE(PCI_VENDOR_ID_VIA, PCI_DEVICE_ID_VIA_CX700),
+          .driver_data = SMBBA3 },
         { 0, }
 };
 
diff --git a/drivers/i2c/busses/i2c-voodoo3.c b/drivers/i2c/busses/i2c-voodoo3.c
index b0377b81744b..88a3447e11e1 100644
--- a/drivers/i2c/busses/i2c-voodoo3.c
+++ b/drivers/i2c/busses/i2c-voodoo3.c
@@ -165,6 +165,7 @@ static struct i2c_algo_bit_data voo_i2c_bit_data = {
 
 static struct i2c_adapter voodoo3_i2c_adapter = {
         .owner          = THIS_MODULE,
+        .id             = I2C_HW_B_VOO,
         .class          = I2C_CLASS_TV_ANALOG, 
         .name           = "I2C Voodoo3/Banshee adapter",
         .algo_data      = &voo_i2c_bit_data,
@@ -181,6 +182,7 @@ static struct i2c_algo_bit_data voo_ddc_bit_data = {
 
 static struct i2c_adapter voodoo3_ddc_adapter = {
         .owner          = THIS_MODULE,
+        .id             = I2C_HW_B_VOO,
         .class          = I2C_CLASS_DDC, 
         .name           = "DDC Voodoo3/Banshee adapter",
         .algo_data      = &voo_ddc_bit_data,
diff --git a/drivers/i2c/busses/scx200_acb.c b/drivers/i2c/busses/scx200_acb.c
index 714bae780953..0b082c5a0195 100644
--- a/drivers/i2c/busses/scx200_acb.c
+++ b/drivers/i2c/busses/scx200_acb.c
@@ -428,7 +428,7 @@ static __init int scx200_acb_probe(struct scx200_acb_iface *iface)
 }
 
 static __init struct scx200_acb_iface *scx200_create_iface(const char *text,
-                int index)
+                struct device *dev, int index)
 {
         struct scx200_acb_iface *iface;
         struct i2c_adapter *adapter;
@@ -446,6 +446,7 @@ static __init struct scx200_acb_iface *scx200_create_iface(const char *text,
         adapter->id = I2C_HW_SMBUS_SCX200;
         adapter->algo = &scx200_acb_algorithm;
         adapter->class = I2C_CLASS_HWMON;
+        adapter->dev.parent = dev;
 
         mutex_init(&iface->mutex);
 
@@ -486,7 +487,7 @@ static __init int scx200_create_pci(const char *text, struct pci_dev *pdev,
         struct scx200_acb_iface *iface;
         int rc;
 
-        iface = scx200_create_iface(text, 0);
+        iface = scx200_create_iface(text, &pdev->dev, 0);
 
         if (iface == NULL)
                 return -ENOMEM;
@@ -524,7 +525,7 @@ static int __init scx200_create_isa(const char *text, unsigned long base,
         struct scx200_acb_iface *iface;
         int rc;
 
-        iface = scx200_create_iface(text, index);
+        iface = scx200_create_iface(text, NULL, index);
 
         if (iface == NULL)
                 return -ENOMEM;
diff --git a/drivers/i2c/busses/scx200_i2c.c b/drivers/i2c/busses/scx200_i2c.c
index 6cd96e43aa72..c3022a023449 100644
--- a/drivers/i2c/busses/scx200_i2c.c
+++ b/drivers/i2c/busses/scx200_i2c.c
@@ -81,6 +81,7 @@ static struct i2c_algo_bit_data scx200_i2c_data = {
 
 static struct i2c_adapter scx200_i2c_ops = {
         .owner             = THIS_MODULE,
+        .id                = I2C_HW_B_SCX200,
         .algo_data         = &scx200_i2c_data,
         .name   = "NatSemi SCx200 I2C",
 };
diff --git a/drivers/i2c/chips/eeprom.c b/drivers/i2c/chips/eeprom.c
index cec3a0c3894d..bfce13c8f1ff 100644
--- a/drivers/i2c/chips/eeprom.c
+++ b/drivers/i2c/chips/eeprom.c
@@ -30,7 +30,6 @@
 #include <linux/init.h>
 #include <linux/module.h>
 #include <linux/slab.h>
-#include <linux/sched.h>
 #include <linux/jiffies.h>
 #include <linux/i2c.h>
 #include <linux/mutex.h>
diff --git a/drivers/i2c/i2c-core.c b/drivers/i2c/i2c-core.c
index b05378a3d673..21fe1406c8b4 100644
--- a/drivers/i2c/i2c-core.c
+++ b/drivers/i2c/i2c-core.c
@@ -32,6 +32,7 @@
 #include <linux/seq_file.h>
 #include <linux/platform_device.h>
 #include <linux/mutex.h>
+#include <linux/completion.h>
 #include <asm/uaccess.h>
 
 
@@ -40,49 +41,72 @@ static LIST_HEAD(drivers);
 static DEFINE_MUTEX(core_lists);
 static DEFINE_IDR(i2c_adapter_idr);
 
+
+/* ------------------------------------------------------------------------- */
+
 /* match always succeeds, as we want the probe() to tell if we really accept this match */
 static int i2c_device_match(struct device *dev, struct device_driver *drv)
 {
         return 1;
 }
 
-static int i2c_bus_suspend(struct device * dev, pm_message_t state)
+static int i2c_device_probe(struct device *dev)
 {
-        int rc = 0;
+        return -ENODEV;
+}
 
-        if (dev->driver && dev->driver->suspend)
-                rc = dev->driver->suspend(dev, state);
-        return rc;
+static int i2c_device_remove(struct device *dev)
+{
+        return 0;
 }
 
-static int i2c_bus_resume(struct device * dev)
+static void i2c_device_shutdown(struct device *dev)
 {
-        int rc = 0;
-        
-        if (dev->driver && dev->driver->resume)
-                rc = dev->driver->resume(dev);
-        return rc;
+        struct i2c_driver *driver;
+
+        if (!dev->driver)
+                return;
+        driver = to_i2c_driver(dev->driver);
+        if (driver->shutdown)
+                driver->shutdown(to_i2c_client(dev));
 }
 
-static int i2c_device_probe(struct device *dev)
+static int i2c_device_suspend(struct device * dev, pm_message_t mesg)
 {
-        return -ENODEV;
+        struct i2c_driver *driver;
+
+        if (!dev->driver)
+                return 0;
+        driver = to_i2c_driver(dev->driver);
+        if (!driver->suspend)
+                return 0;
+        return driver->suspend(to_i2c_client(dev), mesg);
 }
 
-static int i2c_device_remove(struct device *dev)
+static int i2c_device_resume(struct device * dev)
 {
-        return 0;
+        struct i2c_driver *driver;
+
+        if (!dev->driver)
+                return 0;
+        driver = to_i2c_driver(dev->driver);
+        if (!driver->resume)
+                return 0;
+        return driver->resume(to_i2c_client(dev));
 }
 
 struct bus_type i2c_bus_type = {
-        .name =         "i2c",
-        .match =        i2c_device_match,
-        .probe =        i2c_device_probe,
-        .remove =       i2c_device_remove,
-        .suspend =      i2c_bus_suspend,
-        .resume =       i2c_bus_resume,
+        .name           = "i2c",
+        .match          = i2c_device_match,
+        .probe          = i2c_device_probe,
+        .remove         = i2c_device_remove,
+        .shutdown       = i2c_device_shutdown,
+        .suspend        = i2c_device_suspend,
+        .resume         = i2c_device_resume,
 };
 
+/* ------------------------------------------------------------------------- */
+
 void i2c_adapter_dev_release(struct device *dev)
 {
         struct i2c_adapter *adap = dev_to_i2c_adapter(dev);
@@ -193,9 +217,8 @@ int i2c_add_adapter(struct i2c_adapter *adap)
          */
         if (adap->dev.parent == NULL) {
                 adap->dev.parent = &platform_bus;
-                printk(KERN_WARNING "**WARNING** I2C adapter driver [%s] "
-                       "forgot to specify physical device; fix it!\n",
-                       adap->name);
+                pr_debug("I2C adapter driver [%s] forgot to specify "
+                         "physical device\n", adap->name);
         }
         sprintf(adap->dev.bus_id, "i2c-%d", adap->nr);
         adap->dev.driver = &i2c_adapter_driver;
diff --git a/drivers/ide/ide-proc.c b/drivers/ide/ide-proc.c
index 30a5780f4185..afb71c66b6f3 100644
--- a/drivers/ide/ide-proc.c
+++ b/drivers/ide/ide-proc.c
@@ -26,7 +26,6 @@
 
 #include <asm/uaccess.h>
 #include <linux/errno.h>
-#include <linux/sched.h>
 #include <linux/proc_fs.h>
 #include <linux/stat.h>
 #include <linux/mm.h>
diff --git a/drivers/ide/legacy/ide-cs.c b/drivers/ide/legacy/ide-cs.c
index 7efd28ac21ed..a5023cdbdc58 100644
--- a/drivers/ide/legacy/ide-cs.c
+++ b/drivers/ide/legacy/ide-cs.c
@@ -34,7 +34,6 @@
 #include <linux/module.h>
 #include <linux/kernel.h>
 #include <linux/init.h>
-#include <linux/sched.h>
 #include <linux/ptrace.h>
 #include <linux/slab.h>
 #include <linux/string.h>
diff --git a/drivers/ide/ppc/mpc8xx.c b/drivers/ide/ppc/mpc8xx.c
index 0ac9da3a7378..82de2d781f2e 100644
--- a/drivers/ide/ppc/mpc8xx.c
+++ b/drivers/ide/ppc/mpc8xx.c
@@ -12,7 +12,6 @@
  */
 
 #include <linux/errno.h>
-#include <linux/sched.h>
 #include <linux/kernel.h>
 #include <linux/mm.h>
 #include <linux/stddef.h>
diff --git a/drivers/ide/ppc/pmac.c b/drivers/ide/ppc/pmac.c
index 91c5344a945d..d8ea23710bf0 100644
--- a/drivers/ide/ppc/pmac.c
+++ b/drivers/ide/ppc/pmac.c
@@ -24,7 +24,6 @@
  */
 #include <linux/types.h>
 #include <linux/kernel.h>
-#include <linux/sched.h>
 #include <linux/init.h>
 #include <linux/delay.h>
 #include <linux/ide.h>
diff --git a/drivers/ieee1394/eth1394.c b/drivers/ieee1394/eth1394.c
index 97e5c3dd044d..a95313521985 100644
--- a/drivers/ieee1394/eth1394.c
+++ b/drivers/ieee1394/eth1394.c
@@ -43,7 +43,6 @@
 
 #include <linux/module.h>
 
-#include <linux/sched.h>
 #include <linux/kernel.h>
 #include <linux/slab.h>
 #include <linux/errno.h>
diff --git a/drivers/ieee1394/iso.c b/drivers/ieee1394/iso.c
index 08bd15d2a7b6..c6227e51136d 100644
--- a/drivers/ieee1394/iso.c
+++ b/drivers/ieee1394/iso.c
@@ -10,7 +10,6 @@
  */
 
 #include <linux/pci.h>
-#include <linux/sched.h>
 #include <linux/slab.h>
 
 #include "hosts.h"
diff --git a/drivers/ieee1394/ohci1394.c b/drivers/ieee1394/ohci1394.c
index 5729e412cc4a..e982d60ac4b7 100644
--- a/drivers/ieee1394/ohci1394.c
+++ b/drivers/ieee1394/ohci1394.c
@@ -102,7 +102,6 @@
 #include <asm/pgtable.h>
 #include <asm/page.h>
 #include <asm/irq.h>
-#include <linux/sched.h>
 #include <linux/types.h>
 #include <linux/vmalloc.h>
 #include <linux/init.h>
diff --git a/drivers/ieee1394/pcilynx.c b/drivers/ieee1394/pcilynx.c
index fbb7f14ec509..0742befe9227 100644
--- a/drivers/ieee1394/pcilynx.c
+++ b/drivers/ieee1394/pcilynx.c
@@ -1434,6 +1434,7 @@ static int __devinit add_card(struct pci_dev *dev,
                 i2c_adapter_data = bit_data;
                 i2c_ad->algo_data = &i2c_adapter_data;
                 i2c_adapter_data.data = lynx;
+                i2c_ad->dev.parent = &dev->dev;
 
                 PRINTD(KERN_DEBUG, lynx->id,"original eeprom control: %d",
                        reg_read(lynx, SERIAL_EEPROM_CONTROL));
diff --git a/drivers/infiniband/Kconfig b/drivers/infiniband/Kconfig
index 9edfacee7d84..66b36de9fa6f 100644
--- a/drivers/infiniband/Kconfig
+++ b/drivers/infiniband/Kconfig
@@ -38,6 +38,7 @@ source "drivers/infiniband/hw/mthca/Kconfig"
 source "drivers/infiniband/hw/ipath/Kconfig"
 source "drivers/infiniband/hw/ehca/Kconfig"
 source "drivers/infiniband/hw/amso1100/Kconfig"
+source "drivers/infiniband/hw/cxgb3/Kconfig"
 
 source "drivers/infiniband/ulp/ipoib/Kconfig"
 
diff --git a/drivers/infiniband/Makefile b/drivers/infiniband/Makefile
index 2b5d1098ef45..da2066c4f22c 100644
--- a/drivers/infiniband/Makefile
+++ b/drivers/infiniband/Makefile
@@ -3,6 +3,7 @@ obj-$(CONFIG_INFINIBAND_MTHCA)		+= hw/mthca/
 obj-$(CONFIG_INFINIBAND_IPATH)          += hw/ipath/
 obj-$(CONFIG_INFINIBAND_EHCA)           += hw/ehca/
 obj-$(CONFIG_INFINIBAND_AMSO1100)       += hw/amso1100/
+obj-$(CONFIG_INFINIBAND_CXGB3)          += hw/cxgb3/
 obj-$(CONFIG_INFINIBAND_IPOIB)          += ulp/ipoib/
 obj-$(CONFIG_INFINIBAND_SRP)            += ulp/srp/
 obj-$(CONFIG_INFINIBAND_ISER)           += ulp/iser/
diff --git a/drivers/infiniband/core/addr.c b/drivers/infiniband/core/addr.c
index d2bb5a9a303f..a91001c59b69 100644
--- a/drivers/infiniband/core/addr.c
+++ b/drivers/infiniband/core/addr.c
@@ -373,7 +373,7 @@ static struct notifier_block nb = {
 
 static int addr_init(void)
 {
-        addr_wq = create_singlethread_workqueue("ib_addr_wq");
+        addr_wq = create_singlethread_workqueue("ib_addr");
         if (!addr_wq)
                 return -ENOMEM;
 
diff --git a/drivers/infiniband/core/cache.c b/drivers/infiniband/core/cache.c
index 98272fbbfb31..558c9a0fc8b9 100644
--- a/drivers/infiniband/core/cache.c
+++ b/drivers/infiniband/core/cache.c
@@ -38,7 +38,6 @@
 #include <linux/module.h>
 #include <linux/errno.h>
 #include <linux/slab.h>
-#include <linux/sched.h>        /* INIT_WORK, schedule_work(), flush_scheduled_work() */
 
 #include <rdma/ib_cache.h>
 
diff --git a/drivers/infiniband/core/cma.c b/drivers/infiniband/core/cma.c
index 9e0ab048c878..db88e609bf42 100644
--- a/drivers/infiniband/core/cma.c
+++ b/drivers/infiniband/core/cma.c
@@ -71,6 +71,7 @@ static struct workqueue_struct *cma_wq;
 static DEFINE_IDR(sdp_ps);
 static DEFINE_IDR(tcp_ps);
 static DEFINE_IDR(udp_ps);
+static int next_port;
 
 struct cma_device {
         struct list_head        list;
@@ -1722,33 +1723,74 @@ static int cma_alloc_port(struct idr *ps, struct rdma_id_private *id_priv,
                           unsigned short snum)
 {
         struct rdma_bind_list *bind_list;
-        int port, start, ret;
+        int port, ret;
 
         bind_list = kzalloc(sizeof *bind_list, GFP_KERNEL);
         if (!bind_list)
                 return -ENOMEM;
 
-        start = snum ? snum : sysctl_local_port_range[0];
+        do {
+                ret = idr_get_new_above(ps, bind_list, snum, &port);
+        } while ((ret == -EAGAIN) && idr_pre_get(ps, GFP_KERNEL));
+
+        if (ret)
+                goto err1;
+
+        if (port != snum) {
+                ret = -EADDRNOTAVAIL;
+                goto err2;
+        }
+
+        bind_list->ps = ps;
+        bind_list->port = (unsigned short) port;
+        cma_bind_port(bind_list, id_priv);
+        return 0;
+err2:
+        idr_remove(ps, port);
+err1:
+        kfree(bind_list);
+        return ret;
+}
 
+static int cma_alloc_any_port(struct idr *ps, struct rdma_id_private *id_priv)
+{
+        struct rdma_bind_list *bind_list;
+        int port, ret;
+
+        bind_list = kzalloc(sizeof *bind_list, GFP_KERNEL);
+        if (!bind_list)
+                return -ENOMEM;
+
+retry:
         do {
-                ret = idr_get_new_above(ps, bind_list, start, &port);
+                ret = idr_get_new_above(ps, bind_list, next_port, &port);
         } while ((ret == -EAGAIN) && idr_pre_get(ps, GFP_KERNEL));
 
         if (ret)
-                goto err;
+                goto err1;
 
-        if ((snum && port != snum) ||
-            (!snum && port > sysctl_local_port_range[1])) {
-                idr_remove(ps, port);
+        if (port > sysctl_local_port_range[1]) {
+                if (next_port != sysctl_local_port_range[0]) {
+                        idr_remove(ps, port);
+                        next_port = sysctl_local_port_range[0];
+                        goto retry;
+                }
                 ret = -EADDRNOTAVAIL;
-                goto err;
+                goto err2;
         }
 
+        if (port == sysctl_local_port_range[1])
+                next_port = sysctl_local_port_range[0];
+        else
+                next_port = port + 1;
+
         bind_list->ps = ps;
         bind_list->port = (unsigned short) port;
         cma_bind_port(bind_list, id_priv);
         return 0;
-err:
+err2:
+        idr_remove(ps, port);
+err1:
         kfree(bind_list);
         return ret;
 }
@@ -1811,7 +1853,7 @@ static int cma_get_port(struct rdma_id_private *id_priv)
 
         mutex_lock(&lock);
         if (cma_any_port(&id_priv->id.route.addr.src_addr))
-                ret = cma_alloc_port(ps, id_priv, 0);
+                ret = cma_alloc_any_port(ps, id_priv);
         else
                 ret = cma_use_port(ps, id_priv);
         mutex_unlock(&lock);
@@ -2448,7 +2490,11 @@ static int cma_init(void)
 {
         int ret;
 
-        cma_wq = create_singlethread_workqueue("rdma_cm_wq");
+        get_random_bytes(&next_port, sizeof next_port);
+        next_port = (next_port % (sysctl_local_port_range[1] -
+                                  sysctl_local_port_range[0])) +
+                    sysctl_local_port_range[0];
+        cma_wq = create_singlethread_workqueue("rdma_cm");
         if (!cma_wq)
                 return -ENOMEM;
 
diff --git a/drivers/infiniband/core/device.c b/drivers/infiniband/core/device.c
index 63d2a39fb82c..7fabb425b033 100644
--- a/drivers/infiniband/core/device.c
+++ b/drivers/infiniband/core/device.c
@@ -36,6 +36,7 @@
 #include <linux/module.h>
 #include <linux/string.h>
 #include <linux/errno.h>
+#include <linux/kernel.h>
 #include <linux/slab.h>
 #include <linux/init.h>
 #include <linux/mutex.h>
@@ -93,7 +94,7 @@ static int ib_device_check_mandatory(struct ib_device *device)
         };
         int i;
 
-        for (i = 0; i < sizeof mandatory_table / sizeof mandatory_table[0]; ++i) {
+        for (i = 0; i < ARRAY_SIZE(mandatory_table); ++i) {
                 if (!*(void **) ((void *) device + mandatory_table[i].offset)) {
                         printk(KERN_WARNING "Device %s is missing mandatory function %s\n",
                                device->name, mandatory_table[i].name);
diff --git a/drivers/infiniband/hw/amso1100/c2.c b/drivers/infiniband/hw/amso1100/c2.c
index 27fe242ed435..59243d9aedd6 100644
--- a/drivers/infiniband/hw/amso1100/c2.c
+++ b/drivers/infiniband/hw/amso1100/c2.c
@@ -1073,7 +1073,7 @@ static int __devinit c2_probe(struct pci_dev *pcidev,
              0xffffc000) / sizeof(struct c2_rxp_desc);
 
         /* Request an interrupt line for the driver */
-        ret = request_irq(pcidev->irq, c2_interrupt, SA_SHIRQ, DRV_NAME, c2dev);
+        ret = request_irq(pcidev->irq, c2_interrupt, IRQF_SHARED, DRV_NAME, c2dev);
         if (ret) {
                 printk(KERN_ERR PFX "%s: requested IRQ %u is busy\n",
                         pci_name(pcidev), pcidev->irq);
diff --git a/drivers/infiniband/hw/cxgb3/Kconfig b/drivers/infiniband/hw/cxgb3/Kconfig
new file mode 100644
index 000000000000..77977f55dca3
--- /dev/null
+++ b/drivers/infiniband/hw/cxgb3/Kconfig
@@ -0,0 +1,27 @@
+config INFINIBAND_CXGB3
+        tristate "Chelsio RDMA Driver"
+        depends on CHELSIO_T3 && INFINIBAND && INET
+        select GENERIC_ALLOCATOR
+        ---help---
+          This is an iWARP/RDMA driver for the Chelsio T3 1GbE and
+          10GbE adapters.
+
+          For general information about Chelsio and our products, visit
+          our website at <http://www.chelsio.com>.
+
+          For customer support, please visit our customer support page at
+          <http://www.chelsio.com/support.htm>.
+
+          Please send feedback to <linux-bugs@chelsio.com>.
+
+          To compile this driver as a module, choose M here: the module
+          will be called iw_cxgb3.
+
+config INFINIBAND_CXGB3_DEBUG
+        bool "Verbose debugging output"
+        depends on INFINIBAND_CXGB3
+        default n
+        ---help---
+          This option causes the Chelsio RDMA driver to produce copious
+          amounts of debug messages.  Select this if you are developing
+          the driver or trying to diagnose a problem.
diff --git a/drivers/infiniband/hw/cxgb3/Makefile b/drivers/infiniband/hw/cxgb3/Makefile
new file mode 100644
index 000000000000..0e110f32f128
--- /dev/null
+++ b/drivers/infiniband/hw/cxgb3/Makefile
@@ -0,0 +1,12 @@
+EXTRA_CFLAGS += -I$(TOPDIR)/drivers/net/cxgb3 \
+                -I$(TOPDIR)/drivers/infiniband/hw/cxgb3/core
+
+obj-$(CONFIG_INFINIBAND_CXGB3) += iw_cxgb3.o
+
+iw_cxgb3-y :=  iwch_cm.o iwch_ev.o iwch_cq.o iwch_qp.o iwch_mem.o \
+               iwch_provider.o iwch.o cxio_hal.o cxio_resource.o
+
+ifdef CONFIG_INFINIBAND_CXGB3_DEBUG
+EXTRA_CFLAGS += -DDEBUG
+iw_cxgb3-y += cxio_dbg.o
+endif
diff --git a/drivers/infiniband/hw/cxgb3/cxio_dbg.c b/drivers/infiniband/hw/cxgb3/cxio_dbg.c
new file mode 100644
index 000000000000..5a7306f5efae
--- /dev/null
+++ b/drivers/infiniband/hw/cxgb3/cxio_dbg.c
@@ -0,0 +1,207 @@
+/*
+ * Copyright (c) 2006 Chelsio, Inc. All rights reserved.
+ * Copyright (c) 2006 Open Grid Computing, Inc. All rights reserved.
+ *
+ * This software is available to you under a choice of one of two
+ * licenses.  You may choose to be licensed under the terms of the GNU
+ * General Public License (GPL) Version 2, available from the file
+ * COPYING in the main directory of this source tree, or the
+ * OpenIB.org BSD license below:
+ *
+ *     Redistribution and use in source and binary forms, with or
+ *     without modification, are permitted provided that the following
+ *     conditions are met:
+ *
+ *      - Redistributions of source code must retain the above
+ *        copyright notice, this list of conditions and the following
+ *        disclaimer.
+ *
+ *      - Redistributions in binary form must reproduce the above
+ *        copyright notice, this list of conditions and the following
+ *        disclaimer in the documentation and/or other materials
+ *        provided with the distribution.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+ * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+ * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+ * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
+ * BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
+ * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
+ * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+ * SOFTWARE.
+ */
+#ifdef DEBUG
+#include <linux/types.h>
+#include "common.h"
+#include "cxgb3_ioctl.h"
+#include "cxio_hal.h"
+#include "cxio_wr.h"
+
+void cxio_dump_tpt(struct cxio_rdev *rdev, u32 stag)
+{
+        struct ch_mem_range *m;
+        u64 *data;
+        int rc;
+        int size = 32;
+
+        m = kmalloc(sizeof(*m) + size, GFP_ATOMIC);
+        if (!m) {
+                PDBG("%s couldn't allocate memory.\n", __FUNCTION__);
+                return;
+        }
+        m->mem_id = MEM_PMRX;
+        m->addr = (stag>>8) * 32 + rdev->rnic_info.tpt_base;
+        m->len = size;
+        PDBG("%s TPT addr 0x%x len %d\n", __FUNCTION__, m->addr, m->len);
+        rc = rdev->t3cdev_p->ctl(rdev->t3cdev_p, RDMA_GET_MEM, m);
+        if (rc) {
+                PDBG("%s toectl returned error %d\n", __FUNCTION__, rc);
+                kfree(m);
+                return;
+        }
+
+        data = (u64 *)m->buf;
+        while (size > 0) {
+                PDBG("TPT %08x: %016llx\n", m->addr, (unsigned long long) *data);
+                size -= 8;
+                data++;
+                m->addr += 8;
+        }
+        kfree(m);
+}
+
+void cxio_dump_pbl(struct cxio_rdev *rdev, u32 pbl_addr, uint len, u8 shift)
+{
+        struct ch_mem_range *m;
+        u64 *data;
+        int rc;
+        int size, npages;
+
+        shift += 12;
+        npages = (len + (1ULL << shift) - 1) >> shift;
+        size = npages * sizeof(u64);
+
+        m = kmalloc(sizeof(*m) + size, GFP_ATOMIC);
+        if (!m) {
+                PDBG("%s couldn't allocate memory.\n", __FUNCTION__);
+                return;
+        }
+        m->mem_id = MEM_PMRX;
+        m->addr = pbl_addr;
+        m->len = size;
+        PDBG("%s PBL addr 0x%x len %d depth %d\n",
+                __FUNCTION__, m->addr, m->len, npages);
+        rc = rdev->t3cdev_p->ctl(rdev->t3cdev_p, RDMA_GET_MEM, m);
+        if (rc) {
+                PDBG("%s toectl returned error %d\n", __FUNCTION__, rc);
+                kfree(m);
+                return;
+        }
+
+        data = (u64 *)m->buf;
+        while (size > 0) {
+                PDBG("PBL %08x: %016llx\n", m->addr, (unsigned long long) *data);
+                size -= 8;
+                data++;
+                m->addr += 8;
+        }
+        kfree(m);
+}
+
+void cxio_dump_wqe(union t3_wr *wqe)
+{
+        __be64 *data = (__be64 *)wqe;
+        uint size = (uint)(be64_to_cpu(*data) & 0xff);
+
+        if (size == 0)
+                size = 8;
+        while (size > 0) {
+                PDBG("WQE %p: %016llx\n", data,
+                     (unsigned long long) be64_to_cpu(*data));
+                size--;
+                data++;
+        }
+}
+
+void cxio_dump_wce(struct t3_cqe *wce)
+{
+        __be64 *data = (__be64 *)wce;
+        int size = sizeof(*wce);
+
+        while (size > 0) {
+                PDBG("WCE %p: %016llx\n", data,
+                     (unsigned long long) be64_to_cpu(*data));
+                size -= 8;
+                data++;
+        }
+}
+
+void cxio_dump_rqt(struct cxio_rdev *rdev, u32 hwtid, int nents)
+{
+        struct ch_mem_range *m;
+        int size = nents * 64;
+        u64 *data;
+        int rc;
+
+        m = kmalloc(sizeof(*m) + size, GFP_ATOMIC);
+        if (!m) {
+                PDBG("%s couldn't allocate memory.\n", __FUNCTION__);
+                return;
+        }
+        m->mem_id = MEM_PMRX;
+        m->addr = ((hwtid)<<10) + rdev->rnic_info.rqt_base;
+        m->len = size;
+        PDBG("%s RQT addr 0x%x len %d\n", __FUNCTION__, m->addr, m->len);
+        rc = rdev->t3cdev_p->ctl(rdev->t3cdev_p, RDMA_GET_MEM, m);
+        if (rc) {
+                PDBG("%s toectl returned error %d\n", __FUNCTION__, rc);
+                kfree(m);
+                return;
+        }
+
+        data = (u64 *)m->buf;
+        while (size > 0) {
+                PDBG("RQT %08x: %016llx\n", m->addr, (unsigned long long) *data);
+                size -= 8;
+                data++;
+                m->addr += 8;
+        }
+        kfree(m);
+}
+
+void cxio_dump_tcb(struct cxio_rdev *rdev, u32 hwtid)
+{
+        struct ch_mem_range *m;
+        int size = TCB_SIZE;
+        u32 *data;
+        int rc;
+
+        m = kmalloc(sizeof(*m) + size, GFP_ATOMIC);
+        if (!m) {
+                PDBG("%s couldn't allocate memory.\n", __FUNCTION__);
+                return;
+        }
+        m->mem_id = MEM_CM;
+        m->addr = hwtid * size;
+        m->len = size;
+        PDBG("%s TCB %d len %d\n", __FUNCTION__, m->addr, m->len);
+        rc = rdev->t3cdev_p->ctl(rdev->t3cdev_p, RDMA_GET_MEM, m);
+        if (rc) {
+                PDBG("%s toectl returned error %d\n", __FUNCTION__, rc);
+                kfree(m);
+                return;
+        }
+
+        data = (u32 *)m->buf;
+        while (size > 0) {
+                printk("%2u: %08x %08x %08x %08x %08x %08x %08x %08x\n",
+                        m->addr,
+                        *(data+2), *(data+3), *(data),*(data+1),
+                        *(data+6), *(data+7), *(data+4), *(data+5));
+                size -= 32;
+                data += 8;
+                m->addr += 32;
+        }
+        kfree(m);
+}
+#endif
diff --git a/drivers/infiniband/hw/cxgb3/cxio_hal.c b/drivers/infiniband/hw/cxgb3/cxio_hal.c
new file mode 100644
index 000000000000..82fa72041989
--- /dev/null
+++ b/drivers/infiniband/hw/cxgb3/cxio_hal.c
@@ -0,0 +1,1280 @@
+/*
+ * Copyright (c) 2006 Chelsio, Inc. All rights reserved.
+ * Copyright (c) 2006 Open Grid Computing, Inc. All rights reserved.
+ *
+ * This software is available to you under a choice of one of two
+ * licenses.  You may choose to be licensed under the terms of the GNU
+ * General Public License (GPL) Version 2, available from the file
+ * COPYING in the main directory of this source tree, or the
+ * OpenIB.org BSD license below:
+ *
+ *     Redistribution and use in source and binary forms, with or
+ *     without modification, are permitted provided that the following
+ *     conditions are met:
+ *
+ *      - Redistributions of source code must retain the above
+ *        copyright notice, this list of conditions and the following
+ *        disclaimer.
+ *
+ *      - Redistributions in binary form must reproduce the above
+ *        copyright notice, this list of conditions and the following
+ *        disclaimer in the documentation and/or other materials
+ *        provided with the distribution.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+ * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+ * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+ * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
+ * BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
+ * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
+ * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+ * SOFTWARE.
+ */
+#include <asm/delay.h>
+
+#include <linux/mutex.h>
+#include <linux/netdevice.h>
+#include <linux/sched.h>
+#include <linux/spinlock.h>
+#include <linux/pci.h>
+
+#include "cxio_resource.h"
+#include "cxio_hal.h"
+#include "cxgb3_offload.h"
+#include "sge_defs.h"
+
+static LIST_HEAD(rdev_list);
+static cxio_hal_ev_callback_func_t cxio_ev_cb = NULL;
+
+static inline struct cxio_rdev *cxio_hal_find_rdev_by_name(char *dev_name)
+{
+        struct cxio_rdev *rdev;
+
+        list_for_each_entry(rdev, &rdev_list, entry)
+                if (!strcmp(rdev->dev_name, dev_name))
+                        return rdev;
+        return NULL;
+}
+
+static inline struct cxio_rdev *cxio_hal_find_rdev_by_t3cdev(struct t3cdev
+                                                             *tdev)
+{
+        struct cxio_rdev *rdev;
+
+        list_for_each_entry(rdev, &rdev_list, entry)
+                if (rdev->t3cdev_p == tdev)
+                        return rdev;
+        return NULL;
+}
+
+int cxio_hal_cq_op(struct cxio_rdev *rdev_p, struct t3_cq *cq,
+                   enum t3_cq_opcode op, u32 credit)
+{
+        int ret;
+        struct t3_cqe *cqe;
+        u32 rptr;
+
+        struct rdma_cq_op setup;
+        setup.id = cq->cqid;
+        setup.credits = (op == CQ_CREDIT_UPDATE) ? credit : 0;
+        setup.op = op;
+        ret = rdev_p->t3cdev_p->ctl(rdev_p->t3cdev_p, RDMA_CQ_OP, &setup);
+
+        if ((ret < 0) || (op == CQ_CREDIT_UPDATE))
+                return ret;
+
+        /*
+         * If the rearm returned an index other than our current index,
+         * then there might be CQE's in flight (being DMA'd).  We must wait
+         * here for them to complete or the consumer can miss a notification.
+         */
+        if (Q_PTR2IDX((cq->rptr), cq->size_log2) != ret) {
+                int i=0;
+
+                rptr = cq->rptr;
+
+                /*
+                 * Keep the generation correct by bumping rptr until it
+                 * matches the index returned by the rearm - 1.
+                 */
+                while (Q_PTR2IDX((rptr+1), cq->size_log2) != ret)
+                        rptr++;
+
+                /*
+                 * Now rptr is the index for the (last) cqe that was
+                 * in-flight at the time the HW rearmed the CQ.  We
+                 * spin until that CQE is valid.
+                 */
+                cqe = cq->queue + Q_PTR2IDX(rptr, cq->size_log2);
+                while (!CQ_VLD_ENTRY(rptr, cq->size_log2, cqe)) {
+                        udelay(1);
+                        if (i++ > 1000000) {
+                                BUG_ON(1);
+                                printk(KERN_ERR "%s: stalled rnic\n",
+                                       rdev_p->dev_name);
+                                return -EIO;
+                        }
+                }
+        }
+        return 0;
+}
+
+static inline int cxio_hal_clear_cq_ctx(struct cxio_rdev *rdev_p, u32 cqid)
+{
+        struct rdma_cq_setup setup;
+        setup.id = cqid;
+        setup.base_addr = 0;    /* NULL address */
+        setup.size = 0;         /* disaable the CQ */
+        setup.credits = 0;
+        setup.credit_thres = 0;
+        setup.ovfl_mode = 0;
+        return (rdev_p->t3cdev_p->ctl(rdev_p->t3cdev_p, RDMA_CQ_SETUP, &setup));
+}
+
+int cxio_hal_clear_qp_ctx(struct cxio_rdev *rdev_p, u32 qpid)
+{
+        u64 sge_cmd;
+        struct t3_modify_qp_wr *wqe;
+        struct sk_buff *skb = alloc_skb(sizeof(*wqe), GFP_KERNEL);
+        if (!skb) {
+                PDBG("%s alloc_skb failed\n", __FUNCTION__);
+                return -ENOMEM;
+        }
+        wqe = (struct t3_modify_qp_wr *) skb_put(skb, sizeof(*wqe));
+        memset(wqe, 0, sizeof(*wqe));
+        build_fw_riwrh((struct fw_riwrh *) wqe, T3_WR_QP_MOD, 3, 1, qpid, 7);
+        wqe->flags = cpu_to_be32(MODQP_WRITE_EC);
+        sge_cmd = qpid << 8 | 3;
+        wqe->sge_cmd = cpu_to_be64(sge_cmd);
+        skb->priority = CPL_PRIORITY_CONTROL;
+        return (cxgb3_ofld_send(rdev_p->t3cdev_p, skb));
+}
+
+int cxio_create_cq(struct cxio_rdev *rdev_p, struct t3_cq *cq)
+{
+        struct rdma_cq_setup setup;
+        int size = (1UL << (cq->size_log2)) * sizeof(struct t3_cqe);
+
+        cq->cqid = cxio_hal_get_cqid(rdev_p->rscp);
+        if (!cq->cqid)
+                return -ENOMEM;
+        cq->sw_queue = kzalloc(size, GFP_KERNEL);
+        if (!cq->sw_queue)
+                return -ENOMEM;
+        cq->queue = dma_alloc_coherent(&(rdev_p->rnic_info.pdev->dev),
+                                             (1UL << (cq->size_log2)) *
+                                             sizeof(struct t3_cqe),
+                                             &(cq->dma_addr), GFP_KERNEL);
+        if (!cq->queue) {
+                kfree(cq->sw_queue);
+                return -ENOMEM;
+        }
+        pci_unmap_addr_set(cq, mapping, cq->dma_addr);
+        memset(cq->queue, 0, size);
+        setup.id = cq->cqid;
+        setup.base_addr = (u64) (cq->dma_addr);
+        setup.size = 1UL << cq->size_log2;
+        setup.credits = 65535;
+        setup.credit_thres = 1;
+        if (rdev_p->t3cdev_p->type == T3B)
+                setup.ovfl_mode = 0;
+        else
+                setup.ovfl_mode = 1;
+        return (rdev_p->t3cdev_p->ctl(rdev_p->t3cdev_p, RDMA_CQ_SETUP, &setup));
+}
+
+int cxio_resize_cq(struct cxio_rdev *rdev_p, struct t3_cq *cq)
+{
+        struct rdma_cq_setup setup;
+        setup.id = cq->cqid;
+        setup.base_addr = (u64) (cq->dma_addr);
+        setup.size = 1UL << cq->size_log2;
+        setup.credits = setup.size;
+        setup.credit_thres = setup.size;        /* TBD: overflow recovery */
+        setup.ovfl_mode = 1;
+        return (rdev_p->t3cdev_p->ctl(rdev_p->t3cdev_p, RDMA_CQ_SETUP, &setup));
+}
+
+static u32 get_qpid(struct cxio_rdev *rdev_p, struct cxio_ucontext *uctx)
+{
+        struct cxio_qpid_list *entry;
+        u32 qpid;
+        int i;
+
+        mutex_lock(&uctx->lock);
+        if (!list_empty(&uctx->qpids)) {
+                entry = list_entry(uctx->qpids.next, struct cxio_qpid_list,
+                                   entry);
+                list_del(&entry->entry);
+                qpid = entry->qpid;
+                kfree(entry);
+        } else {
+                qpid = cxio_hal_get_qpid(rdev_p->rscp);
+                if (!qpid)
+                        goto out;
+                for (i = qpid+1; i & rdev_p->qpmask; i++) {
+                        entry = kmalloc(sizeof *entry, GFP_KERNEL);
+                        if (!entry)
+                                break;
+                        entry->qpid = i;
+                        list_add_tail(&entry->entry, &uctx->qpids);
+                }
+        }
+out:
+        mutex_unlock(&uctx->lock);
+        PDBG("%s qpid 0x%x\n", __FUNCTION__, qpid);
+        return qpid;
+}
+
+static void put_qpid(struct cxio_rdev *rdev_p, u32 qpid,
+                     struct cxio_ucontext *uctx)
+{
+        struct cxio_qpid_list *entry;
+
+        entry = kmalloc(sizeof *entry, GFP_KERNEL);
+        if (!entry)
+                return;
+        PDBG("%s qpid 0x%x\n", __FUNCTION__, qpid);
+        entry->qpid = qpid;
+        mutex_lock(&uctx->lock);
+        list_add_tail(&entry->entry, &uctx->qpids);
+        mutex_unlock(&uctx->lock);
+}
+
+void cxio_release_ucontext(struct cxio_rdev *rdev_p, struct cxio_ucontext *uctx)
+{
+        struct list_head *pos, *nxt;
+        struct cxio_qpid_list *entry;
+
+        mutex_lock(&uctx->lock);
+        list_for_each_safe(pos, nxt, &uctx->qpids) {
+                entry = list_entry(pos, struct cxio_qpid_list, entry);
+                list_del_init(&entry->entry);
+                if (!(entry->qpid & rdev_p->qpmask))
+                        cxio_hal_put_qpid(rdev_p->rscp, entry->qpid);
+                kfree(entry);
+        }
+        mutex_unlock(&uctx->lock);
+}
+
+void cxio_init_ucontext(struct cxio_rdev *rdev_p, struct cxio_ucontext *uctx)
+{
+        INIT_LIST_HEAD(&uctx->qpids);
+        mutex_init(&uctx->lock);
+}
+
+int cxio_create_qp(struct cxio_rdev *rdev_p, u32 kernel_domain,
+                   struct t3_wq *wq, struct cxio_ucontext *uctx)
+{
+        int depth = 1UL << wq->size_log2;
+        int rqsize = 1UL << wq->rq_size_log2;
+
+        wq->qpid = get_qpid(rdev_p, uctx);
+        if (!wq->qpid)
+                return -ENOMEM;
+
+        wq->rq = kzalloc(depth * sizeof(u64), GFP_KERNEL);
+        if (!wq->rq)
+                goto err1;
+
+        wq->rq_addr = cxio_hal_rqtpool_alloc(rdev_p, rqsize);
+        if (!wq->rq_addr)
+                goto err2;
+
+        wq->sq = kzalloc(depth * sizeof(struct t3_swsq), GFP_KERNEL);
+        if (!wq->sq)
+                goto err3;
+
+        wq->queue = dma_alloc_coherent(&(rdev_p->rnic_info.pdev->dev),
+                                             depth * sizeof(union t3_wr),
+                                             &(wq->dma_addr), GFP_KERNEL);
+        if (!wq->queue)
+                goto err4;
+
+        memset(wq->queue, 0, depth * sizeof(union t3_wr));
+        pci_unmap_addr_set(wq, mapping, wq->dma_addr);
+        wq->doorbell = (void __iomem *)rdev_p->rnic_info.kdb_addr;
+        if (!kernel_domain)
+                wq->udb = (u64)rdev_p->rnic_info.udbell_physbase +
+                                        (wq->qpid << rdev_p->qpshift);
+        PDBG("%s qpid 0x%x doorbell 0x%p udb 0x%llx\n", __FUNCTION__,
+             wq->qpid, wq->doorbell, (unsigned long long) wq->udb);
+        return 0;
+err4:
+        kfree(wq->sq);
+err3:
+        cxio_hal_rqtpool_free(rdev_p, wq->rq_addr, rqsize);
+err2:
+        kfree(wq->rq);
+err1:
+        put_qpid(rdev_p, wq->qpid, uctx);
+        return -ENOMEM;
+}
+
+int cxio_destroy_cq(struct cxio_rdev *rdev_p, struct t3_cq *cq)
+{
+        int err;
+        err = cxio_hal_clear_cq_ctx(rdev_p, cq->cqid);
+        kfree(cq->sw_queue);
+        dma_free_coherent(&(rdev_p->rnic_info.pdev->dev),
+                          (1UL << (cq->size_log2))
+                          * sizeof(struct t3_cqe), cq->queue,
+                          pci_unmap_addr(cq, mapping));
+        cxio_hal_put_cqid(rdev_p->rscp, cq->cqid);
+        return err;
+}
+
+int cxio_destroy_qp(struct cxio_rdev *rdev_p, struct t3_wq *wq,
+                    struct cxio_ucontext *uctx)
+{
+        dma_free_coherent(&(rdev_p->rnic_info.pdev->dev),
+                          (1UL << (wq->size_log2))
+                          * sizeof(union t3_wr), wq->queue,
+                          pci_unmap_addr(wq, mapping));
+        kfree(wq->sq);
+        cxio_hal_rqtpool_free(rdev_p, wq->rq_addr, (1UL << wq->rq_size_log2));
+        kfree(wq->rq);
+        put_qpid(rdev_p, wq->qpid, uctx);
+        return 0;
+}
+
+static void insert_recv_cqe(struct t3_wq *wq, struct t3_cq *cq)
+{
+        struct t3_cqe cqe;
+
+        PDBG("%s wq %p cq %p sw_rptr 0x%x sw_wptr 0x%x\n", __FUNCTION__,
+             wq, cq, cq->sw_rptr, cq->sw_wptr);
+        memset(&cqe, 0, sizeof(cqe));
+        cqe.header = cpu_to_be32(V_CQE_STATUS(TPT_ERR_SWFLUSH) |
+                                 V_CQE_OPCODE(T3_SEND) |
+                                 V_CQE_TYPE(0) |
+                                 V_CQE_SWCQE(1) |
+                                 V_CQE_QPID(wq->qpid) |
+                                 V_CQE_GENBIT(Q_GENBIT(cq->sw_wptr,
+                                                       cq->size_log2)));
+        *(cq->sw_queue + Q_PTR2IDX(cq->sw_wptr, cq->size_log2)) = cqe;
+        cq->sw_wptr++;
+}
+
+void cxio_flush_rq(struct t3_wq *wq, struct t3_cq *cq, int count)
+{
+        u32 ptr;
+
+        PDBG("%s wq %p cq %p\n", __FUNCTION__, wq, cq);
+
+        /* flush RQ */
+        PDBG("%s rq_rptr %u rq_wptr %u skip count %u\n", __FUNCTION__,
+            wq->rq_rptr, wq->rq_wptr, count);
+        ptr = wq->rq_rptr + count;
+        while (ptr++ != wq->rq_wptr)
+                insert_recv_cqe(wq, cq);
+}
+
+static void insert_sq_cqe(struct t3_wq *wq, struct t3_cq *cq,
+                          struct t3_swsq *sqp)
+{
+        struct t3_cqe cqe;
+
+        PDBG("%s wq %p cq %p sw_rptr 0x%x sw_wptr 0x%x\n", __FUNCTION__,
+             wq, cq, cq->sw_rptr, cq->sw_wptr);
+        memset(&cqe, 0, sizeof(cqe));
+        cqe.header = cpu_to_be32(V_CQE_STATUS(TPT_ERR_SWFLUSH) |
+                                 V_CQE_OPCODE(sqp->opcode) |
+                                 V_CQE_TYPE(1) |
+                                 V_CQE_SWCQE(1) |
+                                 V_CQE_QPID(wq->qpid) |
+                                 V_CQE_GENBIT(Q_GENBIT(cq->sw_wptr,
+                                                       cq->size_log2)));
+        cqe.u.scqe.wrid_hi = sqp->sq_wptr;
+
+        *(cq->sw_queue + Q_PTR2IDX(cq->sw_wptr, cq->size_log2)) = cqe;
+        cq->sw_wptr++;
+}
+
+void cxio_flush_sq(struct t3_wq *wq, struct t3_cq *cq, int count)
+{
+        __u32 ptr;
+        struct t3_swsq *sqp = wq->sq + Q_PTR2IDX(wq->sq_rptr, wq->sq_size_log2);
+
+        ptr = wq->sq_rptr + count;
+        sqp += count;
+        while (ptr != wq->sq_wptr) {
+                insert_sq_cqe(wq, cq, sqp);
+                sqp++;
+                ptr++;
+        }
+}
+
+/*
+ * Move all CQEs from the HWCQ into the SWCQ.
+ */
+void cxio_flush_hw_cq(struct t3_cq *cq)
+{
+        struct t3_cqe *cqe, *swcqe;
+
+        PDBG("%s cq %p cqid 0x%x\n", __FUNCTION__, cq, cq->cqid);
+        cqe = cxio_next_hw_cqe(cq);
+        while (cqe) {
+                PDBG("%s flushing hwcq rptr 0x%x to swcq wptr 0x%x\n",
+                     __FUNCTION__, cq->rptr, cq->sw_wptr);
+                swcqe = cq->sw_queue + Q_PTR2IDX(cq->sw_wptr, cq->size_log2);
+                *swcqe = *cqe;
+                swcqe->header |= cpu_to_be32(V_CQE_SWCQE(1));
+                cq->sw_wptr++;
+                cq->rptr++;
+                cqe = cxio_next_hw_cqe(cq);
+        }
+}
+
+static inline int cqe_completes_wr(struct t3_cqe *cqe, struct t3_wq *wq)
+{
+        if (CQE_OPCODE(*cqe) == T3_TERMINATE)
+                return 0;
+
+        if ((CQE_OPCODE(*cqe) == T3_RDMA_WRITE) && RQ_TYPE(*cqe))
+                return 0;
+
+        if ((CQE_OPCODE(*cqe) == T3_READ_RESP) && SQ_TYPE(*cqe))
+                return 0;
+
+        if ((CQE_OPCODE(*cqe) == T3_SEND) && RQ_TYPE(*cqe) &&
+            Q_EMPTY(wq->rq_rptr, wq->rq_wptr))
+                return 0;
+
+        return 1;
+}
+
+void cxio_count_scqes(struct t3_cq *cq, struct t3_wq *wq, int *count)
+{
+        struct t3_cqe *cqe;
+        u32 ptr;
+
+        *count = 0;
+        ptr = cq->sw_rptr;
+        while (!Q_EMPTY(ptr, cq->sw_wptr)) {
+                cqe = cq->sw_queue + (Q_PTR2IDX(ptr, cq->size_log2));
+                if ((SQ_TYPE(*cqe) || (CQE_OPCODE(*cqe) == T3_READ_RESP)) &&
+                    (CQE_QPID(*cqe) == wq->qpid))
+                        (*count)++;
+                ptr++;
+        }
+        PDBG("%s cq %p count %d\n", __FUNCTION__, cq, *count);
+}
+
+void cxio_count_rcqes(struct t3_cq *cq, struct t3_wq *wq, int *count)
+{
+        struct t3_cqe *cqe;
+        u32 ptr;
+
+        *count = 0;
+        PDBG("%s count zero %d\n", __FUNCTION__, *count);
+        ptr = cq->sw_rptr;
+        while (!Q_EMPTY(ptr, cq->sw_wptr)) {
+                cqe = cq->sw_queue + (Q_PTR2IDX(ptr, cq->size_log2));
+                if (RQ_TYPE(*cqe) && (CQE_OPCODE(*cqe) != T3_READ_RESP) &&
+                    (CQE_QPID(*cqe) == wq->qpid) && cqe_completes_wr(cqe, wq))
+                        (*count)++;
+                ptr++;
+        }
+        PDBG("%s cq %p count %d\n", __FUNCTION__, cq, *count);
+}
+
+static int cxio_hal_init_ctrl_cq(struct cxio_rdev *rdev_p)
+{
+        struct rdma_cq_setup setup;
+        setup.id = 0;
+        setup.base_addr = 0;    /* NULL address */
+        setup.size = 1;         /* enable the CQ */
+        setup.credits = 0;
+
+        /* force SGE to redirect to RspQ and interrupt */
+        setup.credit_thres = 0;
+        setup.ovfl_mode = 1;
+        return (rdev_p->t3cdev_p->ctl(rdev_p->t3cdev_p, RDMA_CQ_SETUP, &setup));
+}
+
+static int cxio_hal_init_ctrl_qp(struct cxio_rdev *rdev_p)
+{
+        int err;
+        u64 sge_cmd, ctx0, ctx1;
+        u64 base_addr;
+        struct t3_modify_qp_wr *wqe;
+        struct sk_buff *skb = alloc_skb(sizeof(*wqe), GFP_KERNEL);
+
+
+        if (!skb) {
+                PDBG("%s alloc_skb failed\n", __FUNCTION__);
+                return -ENOMEM;
+        }
+        err = cxio_hal_init_ctrl_cq(rdev_p);
+        if (err) {
+                PDBG("%s err %d initializing ctrl_cq\n", __FUNCTION__, err);
+                return err;
+        }
+        rdev_p->ctrl_qp.workq = dma_alloc_coherent(
+                                        &(rdev_p->rnic_info.pdev->dev),
+                                        (1 << T3_CTRL_QP_SIZE_LOG2) *
+                                        sizeof(union t3_wr),
+                                        &(rdev_p->ctrl_qp.dma_addr),
+                                        GFP_KERNEL);
+        if (!rdev_p->ctrl_qp.workq) {
+                PDBG("%s dma_alloc_coherent failed\n", __FUNCTION__);
+                return -ENOMEM;
+        }
+        pci_unmap_addr_set(&rdev_p->ctrl_qp, mapping,
+                           rdev_p->ctrl_qp.dma_addr);
+        rdev_p->ctrl_qp.doorbell = (void __iomem *)rdev_p->rnic_info.kdb_addr;
+        memset(rdev_p->ctrl_qp.workq, 0,
+               (1 << T3_CTRL_QP_SIZE_LOG2) * sizeof(union t3_wr));
+
+        mutex_init(&rdev_p->ctrl_qp.lock);
+        init_waitqueue_head(&rdev_p->ctrl_qp.waitq);
+
+        /* update HW Ctrl QP context */
+        base_addr = rdev_p->ctrl_qp.dma_addr;
+        base_addr >>= 12;
+        ctx0 = (V_EC_SIZE((1 << T3_CTRL_QP_SIZE_LOG2)) |
+                V_EC_BASE_LO((u32) base_addr & 0xffff));
+        ctx0 <<= 32;
+        ctx0 |= V_EC_CREDITS(FW_WR_NUM);
+        base_addr >>= 16;
+        ctx1 = (u32) base_addr;
+        base_addr >>= 32;
+        ctx1 |= ((u64) (V_EC_BASE_HI((u32) base_addr & 0xf) | V_EC_RESPQ(0) |
+                        V_EC_TYPE(0) | V_EC_GEN(1) |
+                        V_EC_UP_TOKEN(T3_CTL_QP_TID) | F_EC_VALID)) << 32;
+        wqe = (struct t3_modify_qp_wr *) skb_put(skb, sizeof(*wqe));
+        memset(wqe, 0, sizeof(*wqe));
+        build_fw_riwrh((struct fw_riwrh *) wqe, T3_WR_QP_MOD, 0, 1,
+                       T3_CTL_QP_TID, 7);
+        wqe->flags = cpu_to_be32(MODQP_WRITE_EC);
+        sge_cmd = (3ULL << 56) | FW_RI_SGEEC_START << 8 | 3;
+        wqe->sge_cmd = cpu_to_be64(sge_cmd);
+        wqe->ctx1 = cpu_to_be64(ctx1);
+        wqe->ctx0 = cpu_to_be64(ctx0);
+        PDBG("CtrlQP dma_addr 0x%llx workq %p size %d\n",
+             (unsigned long long) rdev_p->ctrl_qp.dma_addr,
+             rdev_p->ctrl_qp.workq, 1 << T3_CTRL_QP_SIZE_LOG2);
+        skb->priority = CPL_PRIORITY_CONTROL;
+        return (cxgb3_ofld_send(rdev_p->t3cdev_p, skb));
+}
+
+static int cxio_hal_destroy_ctrl_qp(struct cxio_rdev *rdev_p)
+{
+        dma_free_coherent(&(rdev_p->rnic_info.pdev->dev),
+                          (1UL << T3_CTRL_QP_SIZE_LOG2)
+                          * sizeof(union t3_wr), rdev_p->ctrl_qp.workq,
+                          pci_unmap_addr(&rdev_p->ctrl_qp, mapping));
+        return cxio_hal_clear_qp_ctx(rdev_p, T3_CTRL_QP_ID);
+}
+
+/* write len bytes of data into addr (32B aligned address)
+ * If data is NULL, clear len byte of memory to zero.
+ * caller aquires the ctrl_qp lock before the call
+ */
+static int cxio_hal_ctrl_qp_write_mem(struct cxio_rdev *rdev_p, u32 addr,
+                                      u32 len, void *data, int completion)
+{
+        u32 i, nr_wqe, copy_len;
+        u8 *copy_data;
+        u8 wr_len, utx_len;     /* lenght in 8 byte flit */
+        enum t3_wr_flags flag;
+        __be64 *wqe;
+        u64 utx_cmd;
+        addr &= 0x7FFFFFF;
+        nr_wqe = len % 96 ? len / 96 + 1 : len / 96;    /* 96B max per WQE */
+        PDBG("%s wptr 0x%x rptr 0x%x len %d, nr_wqe %d data %p addr 0x%0x\n",
+             __FUNCTION__, rdev_p->ctrl_qp.wptr, rdev_p->ctrl_qp.rptr, len,
+             nr_wqe, data, addr);
+        utx_len = 3;            /* in 32B unit */
+        for (i = 0; i < nr_wqe; i++) {
+                if (Q_FULL(rdev_p->ctrl_qp.rptr, rdev_p->ctrl_qp.wptr,
+                           T3_CTRL_QP_SIZE_LOG2)) {
+                        PDBG("%s ctrl_qp full wtpr 0x%0x rptr 0x%0x, "
+                             "wait for more space i %d\n", __FUNCTION__,
+                             rdev_p->ctrl_qp.wptr, rdev_p->ctrl_qp.rptr, i);
+                        if (wait_event_interruptible(rdev_p->ctrl_qp.waitq,
+                                             !Q_FULL(rdev_p->ctrl_qp.rptr,
+                                                     rdev_p->ctrl_qp.wptr,
+                                                     T3_CTRL_QP_SIZE_LOG2))) {
+                                PDBG("%s ctrl_qp workq interrupted\n",
+                                     __FUNCTION__);
+                                return -ERESTARTSYS;
+                        }
+                        PDBG("%s ctrl_qp wakeup, continue posting work request "
+                             "i %d\n", __FUNCTION__, i);
+                }
+                wqe = (__be64 *)(rdev_p->ctrl_qp.workq + (rdev_p->ctrl_qp.wptr %
+                                                (1 << T3_CTRL_QP_SIZE_LOG2)));
+                flag = 0;
+                if (i == (nr_wqe - 1)) {
+                        /* last WQE */
+                        flag = completion ? T3_COMPLETION_FLAG : 0;
+                        if (len % 32)
+                                utx_len = len / 32 + 1;
+                        else
+                                utx_len = len / 32;
+                }
+
+                /*
+                 * Force a CQE to return the credit to the workq in case
+                 * we posted more than half the max QP size of WRs
+                 */
+                if ((i != 0) &&
+                    (i % (((1 << T3_CTRL_QP_SIZE_LOG2)) >> 1) == 0)) {
+                        flag = T3_COMPLETION_FLAG;
+                        PDBG("%s force completion at i %d\n", __FUNCTION__, i);
+                }
+
+                /* build the utx mem command */
+                wqe += (sizeof(struct t3_bypass_wr) >> 3);
+                utx_cmd = (T3_UTX_MEM_WRITE << 28) | (addr + i * 3);
+                utx_cmd <<= 32;
+                utx_cmd |= (utx_len << 28) | ((utx_len << 2) + 1);
+                *wqe = cpu_to_be64(utx_cmd);
+                wqe++;
+                copy_data = (u8 *) data + i * 96;
+                copy_len = len > 96 ? 96 : len;
+
+                /* clear memory content if data is NULL */
+                if (data)
+                        memcpy(wqe, copy_data, copy_len);
+                else
+                        memset(wqe, 0, copy_len);
+                if (copy_len % 32)
+                        memset(((u8 *) wqe) + copy_len, 0,
+                               32 - (copy_len % 32));
+                wr_len = ((sizeof(struct t3_bypass_wr)) >> 3) + 1 +
+                         (utx_len << 2);
+                wqe = (__be64 *)(rdev_p->ctrl_qp.workq + (rdev_p->ctrl_qp.wptr %
+                              (1 << T3_CTRL_QP_SIZE_LOG2)));
+
+                /* wptr in the WRID[31:0] */
+                ((union t3_wrid *)(wqe+1))->id0.low = rdev_p->ctrl_qp.wptr;
+
+                /*
+                 * This must be the last write with a memory barrier
+                 * for the genbit
+                 */
+                build_fw_riwrh((struct fw_riwrh *) wqe, T3_WR_BP, flag,
+                               Q_GENBIT(rdev_p->ctrl_qp.wptr,
+                                        T3_CTRL_QP_SIZE_LOG2), T3_CTRL_QP_ID,
+                               wr_len);
+                if (flag == T3_COMPLETION_FLAG)
+                        ring_doorbell(rdev_p->ctrl_qp.doorbell, T3_CTRL_QP_ID);
+                len -= 96;
+                rdev_p->ctrl_qp.wptr++;
+        }
+        return 0;
+}
+
+/* IN: stag key, pdid, perm, zbva, to, len, page_size, pbl, and pbl_size
+ * OUT: stag index, actual pbl_size, pbl_addr allocated.
+ * TBD: shared memory region support
+ */
+static int __cxio_tpt_op(struct cxio_rdev *rdev_p, u32 reset_tpt_entry,
+                         u32 *stag, u8 stag_state, u32 pdid,
+                         enum tpt_mem_type type, enum tpt_mem_perm perm,
+                         u32 zbva, u64 to, u32 len, u8 page_size, __be64 *pbl,
+                         u32 *pbl_size, u32 *pbl_addr)
+{
+        int err;
+        struct tpt_entry tpt;
+        u32 stag_idx;
+        u32 wptr;
+        int rereg = (*stag != T3_STAG_UNSET);
+
+        stag_state = stag_state > 0;
+        stag_idx = (*stag) >> 8;
+
+        if ((!reset_tpt_entry) && !(*stag != T3_STAG_UNSET)) {
+                stag_idx = cxio_hal_get_stag(rdev_p->rscp);
+                if (!stag_idx)
+                        return -ENOMEM;
+                *stag = (stag_idx << 8) | ((*stag) & 0xFF);
+        }
+        PDBG("%s stag_state 0x%0x type 0x%0x pdid 0x%0x, stag_idx 0x%x\n",
+             __FUNCTION__, stag_state, type, pdid, stag_idx);
+
+        if (reset_tpt_entry)
+                cxio_hal_pblpool_free(rdev_p, *pbl_addr, *pbl_size << 3);
+        else if (!rereg) {
+                *pbl_addr = cxio_hal_pblpool_alloc(rdev_p, *pbl_size << 3);
+                if (!*pbl_addr) {
+                        return -ENOMEM;
+                }
+        }
+
+        mutex_lock(&rdev_p->ctrl_qp.lock);
+
+        /* write PBL first if any - update pbl only if pbl list exist */
+        if (pbl) {
+
+                PDBG("%s *pdb_addr 0x%x, pbl_base 0x%x, pbl_size %d\n",
+                     __FUNCTION__, *pbl_addr, rdev_p->rnic_info.pbl_base,
+                     *pbl_size);
+                err = cxio_hal_ctrl_qp_write_mem(rdev_p,
+                                (*pbl_addr >> 5),
+                                (*pbl_size << 3), pbl, 0);
+                if (err)
+                        goto ret;
+        }
+
+        /* write TPT entry */
+        if (reset_tpt_entry)
+                memset(&tpt, 0, sizeof(tpt));
+        else {
+                tpt.valid_stag_pdid = cpu_to_be32(F_TPT_VALID |
+                                V_TPT_STAG_KEY((*stag) & M_TPT_STAG_KEY) |
+                                V_TPT_STAG_STATE(stag_state) |
+                                V_TPT_STAG_TYPE(type) | V_TPT_PDID(pdid));
+                BUG_ON(page_size >= 28);
+                tpt.flags_pagesize_qpid = cpu_to_be32(V_TPT_PERM(perm) |
+                                F_TPT_MW_BIND_ENABLE |
+                                V_TPT_ADDR_TYPE((zbva ? TPT_ZBTO : TPT_VATO)) |
+                                V_TPT_PAGE_SIZE(page_size));
+                tpt.rsvd_pbl_addr = reset_tpt_entry ? 0 :
+                                    cpu_to_be32(V_TPT_PBL_ADDR(PBL_OFF(rdev_p, *pbl_addr)>>3));
+                tpt.len = cpu_to_be32(len);
+                tpt.va_hi = cpu_to_be32((u32) (to >> 32));
+                tpt.va_low_or_fbo = cpu_to_be32((u32) (to & 0xFFFFFFFFULL));
+                tpt.rsvd_bind_cnt_or_pstag = 0;
+                tpt.rsvd_pbl_size = reset_tpt_entry ? 0 :
+                                  cpu_to_be32(V_TPT_PBL_SIZE((*pbl_size) >> 2));
+        }
+        err = cxio_hal_ctrl_qp_write_mem(rdev_p,
+                                       stag_idx +
+                                       (rdev_p->rnic_info.tpt_base >> 5),
+                                       sizeof(tpt), &tpt, 1);
+
+        /* release the stag index to free pool */
+        if (reset_tpt_entry)
+                cxio_hal_put_stag(rdev_p->rscp, stag_idx);
+ret:
+        wptr = rdev_p->ctrl_qp.wptr;
+        mutex_unlock(&rdev_p->ctrl_qp.lock);
+        if (!err)
+                if (wait_event_interruptible(rdev_p->ctrl_qp.waitq,
+                                             SEQ32_GE(rdev_p->ctrl_qp.rptr,
+                                                      wptr)))
+                        return -ERESTARTSYS;
+        return err;
+}
+
+/* IN : stag key, pdid, pbl_size
+ * Out: stag index, actaul pbl_size, and pbl_addr allocated.
+ */
+int cxio_allocate_stag(struct cxio_rdev *rdev_p, u32 * stag, u32 pdid,
+                       enum tpt_mem_perm perm, u32 * pbl_size, u32 * pbl_addr)
+{
+        *stag = T3_STAG_UNSET;
+        return (__cxio_tpt_op(rdev_p, 0, stag, 0, pdid, TPT_NON_SHARED_MR,
+                              perm, 0, 0ULL, 0, 0, NULL, pbl_size, pbl_addr));
+}
+
+int cxio_register_phys_mem(struct cxio_rdev *rdev_p, u32 *stag, u32 pdid,
+                           enum tpt_mem_perm perm, u32 zbva, u64 to, u32 len,
+                           u8 page_size, __be64 *pbl, u32 *pbl_size,
+                           u32 *pbl_addr)
+{
+        *stag = T3_STAG_UNSET;
+        return __cxio_tpt_op(rdev_p, 0, stag, 1, pdid, TPT_NON_SHARED_MR, perm,
+                             zbva, to, len, page_size, pbl, pbl_size, pbl_addr);
+}
+
+int cxio_reregister_phys_mem(struct cxio_rdev *rdev_p, u32 *stag, u32 pdid,
+                           enum tpt_mem_perm perm, u32 zbva, u64 to, u32 len,
+                           u8 page_size, __be64 *pbl, u32 *pbl_size,
+                           u32 *pbl_addr)
+{
+        return __cxio_tpt_op(rdev_p, 0, stag, 1, pdid, TPT_NON_SHARED_MR, perm,
+                             zbva, to, len, page_size, pbl, pbl_size, pbl_addr);
+}
+
+int cxio_dereg_mem(struct cxio_rdev *rdev_p, u32 stag, u32 pbl_size,
+                   u32 pbl_addr)
+{
+        return __cxio_tpt_op(rdev_p, 1, &stag, 0, 0, 0, 0, 0, 0ULL, 0, 0, NULL,
+                             &pbl_size, &pbl_addr);
+}
+
+int cxio_allocate_window(struct cxio_rdev *rdev_p, u32 * stag, u32 pdid)
+{
+        u32 pbl_size = 0;
+        *stag = T3_STAG_UNSET;
+        return __cxio_tpt_op(rdev_p, 0, stag, 0, pdid, TPT_MW, 0, 0, 0ULL, 0, 0,
+                             NULL, &pbl_size, NULL);
+}
+
+int cxio_deallocate_window(struct cxio_rdev *rdev_p, u32 stag)
+{
+        return __cxio_tpt_op(rdev_p, 1, &stag, 0, 0, 0, 0, 0, 0ULL, 0, 0, NULL,
+                             NULL, NULL);
+}
+
+int cxio_rdma_init(struct cxio_rdev *rdev_p, struct t3_rdma_init_attr *attr)
+{
+        struct t3_rdma_init_wr *wqe;
+        struct sk_buff *skb = alloc_skb(sizeof(*wqe), GFP_ATOMIC);
+        if (!skb)
+                return -ENOMEM;
+        PDBG("%s rdev_p %p\n", __FUNCTION__, rdev_p);
+        wqe = (struct t3_rdma_init_wr *) __skb_put(skb, sizeof(*wqe));
+        wqe->wrh.op_seop_flags = cpu_to_be32(V_FW_RIWR_OP(T3_WR_INIT));
+        wqe->wrh.gen_tid_len = cpu_to_be32(V_FW_RIWR_TID(attr->tid) |
+                                           V_FW_RIWR_LEN(sizeof(*wqe) >> 3));
+        wqe->wrid.id1 = 0;
+        wqe->qpid = cpu_to_be32(attr->qpid);
+        wqe->pdid = cpu_to_be32(attr->pdid);
+        wqe->scqid = cpu_to_be32(attr->scqid);
+        wqe->rcqid = cpu_to_be32(attr->rcqid);
+        wqe->rq_addr = cpu_to_be32(attr->rq_addr - rdev_p->rnic_info.rqt_base);
+        wqe->rq_size = cpu_to_be32(attr->rq_size);
+        wqe->mpaattrs = attr->mpaattrs;
+        wqe->qpcaps = attr->qpcaps;
+        wqe->ulpdu_size = cpu_to_be16(attr->tcp_emss);
+        wqe->flags = cpu_to_be32(attr->flags);
+        wqe->ord = cpu_to_be32(attr->ord);
+        wqe->ird = cpu_to_be32(attr->ird);
+        wqe->qp_dma_addr = cpu_to_be64(attr->qp_dma_addr);
+        wqe->qp_dma_size = cpu_to_be32(attr->qp_dma_size);
+        wqe->rsvd = 0;
+        skb->priority = 0;      /* 0=>ToeQ; 1=>CtrlQ */
+        return (cxgb3_ofld_send(rdev_p->t3cdev_p, skb));
+}
+
+void cxio_register_ev_cb(cxio_hal_ev_callback_func_t ev_cb)
+{
+        cxio_ev_cb = ev_cb;
+}
+
+void cxio_unregister_ev_cb(cxio_hal_ev_callback_func_t ev_cb)
+{
+        cxio_ev_cb = NULL;
+}
+
+static int cxio_hal_ev_handler(struct t3cdev *t3cdev_p, struct sk_buff *skb)
+{
+        static int cnt;
+        struct cxio_rdev *rdev_p = NULL;
+        struct respQ_msg_t *rsp_msg = (struct respQ_msg_t *) skb->data;
+        PDBG("%d: %s cq_id 0x%x cq_ptr 0x%x genbit %0x overflow %0x an %0x"
+             " se %0x notify %0x cqbranch %0x creditth %0x\n",
+             cnt, __FUNCTION__, RSPQ_CQID(rsp_msg), RSPQ_CQPTR(rsp_msg),
+             RSPQ_GENBIT(rsp_msg), RSPQ_OVERFLOW(rsp_msg), RSPQ_AN(rsp_msg),
+             RSPQ_SE(rsp_msg), RSPQ_NOTIFY(rsp_msg), RSPQ_CQBRANCH(rsp_msg),
+             RSPQ_CREDIT_THRESH(rsp_msg));
+        PDBG("CQE: QPID 0x%0x genbit %0x type 0x%0x status 0x%0x opcode %d "
+             "len 0x%0x wrid_hi_stag 0x%x wrid_low_msn 0x%x\n",
+             CQE_QPID(rsp_msg->cqe), CQE_GENBIT(rsp_msg->cqe),
+             CQE_TYPE(rsp_msg->cqe), CQE_STATUS(rsp_msg->cqe),
+             CQE_OPCODE(rsp_msg->cqe), CQE_LEN(rsp_msg->cqe),
+             CQE_WRID_HI(rsp_msg->cqe), CQE_WRID_LOW(rsp_msg->cqe));
+        rdev_p = (struct cxio_rdev *)t3cdev_p->ulp;
+        if (!rdev_p) {
+                PDBG("%s called by t3cdev %p with null ulp\n", __FUNCTION__,
+                     t3cdev_p);
+                return 0;
+        }
+        if (CQE_QPID(rsp_msg->cqe) == T3_CTRL_QP_ID) {
+                rdev_p->ctrl_qp.rptr = CQE_WRID_LOW(rsp_msg->cqe) + 1;
+                wake_up_interruptible(&rdev_p->ctrl_qp.waitq);
+                dev_kfree_skb_irq(skb);
+        } else if (CQE_QPID(rsp_msg->cqe) == 0xfff8)
+                dev_kfree_skb_irq(skb);
+        else if (cxio_ev_cb)
+                (*cxio_ev_cb) (rdev_p, skb);
+        else
+                dev_kfree_skb_irq(skb);
+        cnt++;
+        return 0;
+}
+
+/* Caller takes care of locking if needed */
+int cxio_rdev_open(struct cxio_rdev *rdev_p)
+{
+        struct net_device *netdev_p = NULL;
+        int err = 0;
+        if (strlen(rdev_p->dev_name)) {
+                if (cxio_hal_find_rdev_by_name(rdev_p->dev_name)) {
+                        return -EBUSY;
+                }
+                netdev_p = dev_get_by_name(rdev_p->dev_name);
+                if (!netdev_p) {
+                        return -EINVAL;
+                }
+                dev_put(netdev_p);
+        } else if (rdev_p->t3cdev_p) {
+                if (cxio_hal_find_rdev_by_t3cdev(rdev_p->t3cdev_p)) {
+                        return -EBUSY;
+                }
+                netdev_p = rdev_p->t3cdev_p->lldev;
+                strncpy(rdev_p->dev_name, rdev_p->t3cdev_p->name,
+                        T3_MAX_DEV_NAME_LEN);
+        } else {
+                PDBG("%s t3cdev_p or dev_name must be set\n", __FUNCTION__);
+                return -EINVAL;
+        }
+
+        list_add_tail(&rdev_p->entry, &rdev_list);
+
+        PDBG("%s opening rnic dev %s\n", __FUNCTION__, rdev_p->dev_name);
+        memset(&rdev_p->ctrl_qp, 0, sizeof(rdev_p->ctrl_qp));
+        if (!rdev_p->t3cdev_p)
+                rdev_p->t3cdev_p = T3CDEV(netdev_p);
+        rdev_p->t3cdev_p->ulp = (void *) rdev_p;
+        err = rdev_p->t3cdev_p->ctl(rdev_p->t3cdev_p, RDMA_GET_PARAMS,
+                                         &(rdev_p->rnic_info));
+        if (err) {
+                printk(KERN_ERR "%s t3cdev_p(%p)->ctl returned error %d.\n",
+                     __FUNCTION__, rdev_p->t3cdev_p, err);
+                goto err1;
+        }
+        err = rdev_p->t3cdev_p->ctl(rdev_p->t3cdev_p, GET_PORTS,
+                                    &(rdev_p->port_info));
+        if (err) {
+                printk(KERN_ERR "%s t3cdev_p(%p)->ctl returned error %d.\n",
+                     __FUNCTION__, rdev_p->t3cdev_p, err);
+                goto err1;
+        }
+
+        /*
+         * qpshift is the number of bits to shift the qpid left in order
+         * to get the correct address of the doorbell for that qp.
+         */
+        cxio_init_ucontext(rdev_p, &rdev_p->uctx);
+        rdev_p->qpshift = PAGE_SHIFT -
+                          ilog2(65536 >>
+                                    ilog2(rdev_p->rnic_info.udbell_len >>
+                                              PAGE_SHIFT));
+        rdev_p->qpnr = rdev_p->rnic_info.udbell_len >> PAGE_SHIFT;
+        rdev_p->qpmask = (65536 >> ilog2(rdev_p->qpnr)) - 1;
+        PDBG("%s rnic %s info: tpt_base 0x%0x tpt_top 0x%0x num stags %d "
+             "pbl_base 0x%0x pbl_top 0x%0x rqt_base 0x%0x, rqt_top 0x%0x\n",
+             __FUNCTION__, rdev_p->dev_name, rdev_p->rnic_info.tpt_base,
+             rdev_p->rnic_info.tpt_top, cxio_num_stags(rdev_p),
+             rdev_p->rnic_info.pbl_base,
+             rdev_p->rnic_info.pbl_top, rdev_p->rnic_info.rqt_base,
+             rdev_p->rnic_info.rqt_top);
+        PDBG("udbell_len 0x%0x udbell_physbase 0x%lx kdb_addr %p qpshift %lu "
+             "qpnr %d qpmask 0x%x\n",
+             rdev_p->rnic_info.udbell_len,
+             rdev_p->rnic_info.udbell_physbase, rdev_p->rnic_info.kdb_addr,
+             rdev_p->qpshift, rdev_p->qpnr, rdev_p->qpmask);
+
+        err = cxio_hal_init_ctrl_qp(rdev_p);
+        if (err) {
+                printk(KERN_ERR "%s error %d initializing ctrl_qp.\n",
+                       __FUNCTION__, err);
+                goto err1;
+        }
+        err = cxio_hal_init_resource(rdev_p, cxio_num_stags(rdev_p), 0,
+                                     0, T3_MAX_NUM_QP, T3_MAX_NUM_CQ,
+                                     T3_MAX_NUM_PD);
+        if (err) {
+                printk(KERN_ERR "%s error %d initializing hal resources.\n",
+                       __FUNCTION__, err);
+                goto err2;
+        }
+        err = cxio_hal_pblpool_create(rdev_p);
+        if (err) {
+                printk(KERN_ERR "%s error %d initializing pbl mem pool.\n",
+                       __FUNCTION__, err);
+                goto err3;
+        }
+        err = cxio_hal_rqtpool_create(rdev_p);
+        if (err) {
+                printk(KERN_ERR "%s error %d initializing rqt mem pool.\n",
+                       __FUNCTION__, err);
+                goto err4;
+        }
+        return 0;
+err4:
+        cxio_hal_pblpool_destroy(rdev_p);
+err3:
+        cxio_hal_destroy_resource(rdev_p->rscp);
+err2:
+        cxio_hal_destroy_ctrl_qp(rdev_p);
+err1:
+        list_del(&rdev_p->entry);
+        return err;
+}
+
+void cxio_rdev_close(struct cxio_rdev *rdev_p)
+{
+        if (rdev_p) {
+                cxio_hal_pblpool_destroy(rdev_p);
+                cxio_hal_rqtpool_destroy(rdev_p);
+                list_del(&rdev_p->entry);
+                rdev_p->t3cdev_p->ulp = NULL;
+                cxio_hal_destroy_ctrl_qp(rdev_p);
+                cxio_hal_destroy_resource(rdev_p->rscp);
+        }
+}
+
+int __init cxio_hal_init(void)
+{
+        if (cxio_hal_init_rhdl_resource(T3_MAX_NUM_RI))
+                return -ENOMEM;
+        t3_register_cpl_handler(CPL_ASYNC_NOTIF, cxio_hal_ev_handler);
+        return 0;
+}
+
+void __exit cxio_hal_exit(void)
+{
+        struct cxio_rdev *rdev, *tmp;
+
+        t3_register_cpl_handler(CPL_ASYNC_NOTIF, NULL);
+        list_for_each_entry_safe(rdev, tmp, &rdev_list, entry)
+                cxio_rdev_close(rdev);
+        cxio_hal_destroy_rhdl_resource();
+}
+
+static inline void flush_completed_wrs(struct t3_wq *wq, struct t3_cq *cq)
+{
+        struct t3_swsq *sqp;
+        __u32 ptr = wq->sq_rptr;
+        int count = Q_COUNT(wq->sq_rptr, wq->sq_wptr);
+
+        sqp = wq->sq + Q_PTR2IDX(ptr, wq->sq_size_log2);
+        while (count--)
+                if (!sqp->signaled) {
+                        ptr++;
+                        sqp = wq->sq + Q_PTR2IDX(ptr,  wq->sq_size_log2);
+                } else if (sqp->complete) {
+
+                        /*
+                         * Insert this completed cqe into the swcq.
+                         */
+                        PDBG("%s moving cqe into swcq sq idx %ld cq idx %ld\n",
+                             __FUNCTION__, Q_PTR2IDX(ptr,  wq->sq_size_log2),
+                             Q_PTR2IDX(cq->sw_wptr, cq->size_log2));
+                        sqp->cqe.header |= htonl(V_CQE_SWCQE(1));
+                        *(cq->sw_queue + Q_PTR2IDX(cq->sw_wptr, cq->size_log2))
+                                = sqp->cqe;
+                        cq->sw_wptr++;
+                        sqp->signaled = 0;
+                        break;
+                } else
+                        break;
+}
+
+static inline void create_read_req_cqe(struct t3_wq *wq,
+                                       struct t3_cqe *hw_cqe,
+                                       struct t3_cqe *read_cqe)
+{
+        read_cqe->u.scqe.wrid_hi = wq->oldest_read->sq_wptr;
+        read_cqe->len = wq->oldest_read->read_len;
+        read_cqe->header = htonl(V_CQE_QPID(CQE_QPID(*hw_cqe)) |
+                                 V_CQE_SWCQE(SW_CQE(*hw_cqe)) |
+                                 V_CQE_OPCODE(T3_READ_REQ) |
+                                 V_CQE_TYPE(1));
+}
+
+/*
+ * Return a ptr to the next read wr in the SWSQ or NULL.
+ */
+static inline void advance_oldest_read(struct t3_wq *wq)
+{
+
+        u32 rptr = wq->oldest_read - wq->sq + 1;
+        u32 wptr = Q_PTR2IDX(wq->sq_wptr, wq->sq_size_log2);
+
+        while (Q_PTR2IDX(rptr, wq->sq_size_log2) != wptr) {
+                wq->oldest_read = wq->sq + Q_PTR2IDX(rptr, wq->sq_size_log2);
+
+                if (wq->oldest_read->opcode == T3_READ_REQ)
+                        return;
+                rptr++;
+        }
+        wq->oldest_read = NULL;
+}
+
+/*
+ * cxio_poll_cq
+ *
+ * Caller must:
+ *     check the validity of the first CQE,
+ *     supply the wq assicated with the qpid.
+ *
+ * credit: cq credit to return to sge.
+ * cqe_flushed: 1 iff the CQE is flushed.
+ * cqe: copy of the polled CQE.
+ *
+ * return value:
+ *     0       CQE returned,
+ *    -1       CQE skipped, try again.
+ */
+int cxio_poll_cq(struct t3_wq *wq, struct t3_cq *cq, struct t3_cqe *cqe,
+                     u8 *cqe_flushed, u64 *cookie, u32 *credit)
+{
+        int ret = 0;
+        struct t3_cqe *hw_cqe, read_cqe;
+
+        *cqe_flushed = 0;
+        *credit = 0;
+        hw_cqe = cxio_next_cqe(cq);
+
+        PDBG("%s CQE OOO %d qpid 0x%0x genbit %d type %d status 0x%0x"
+             " opcode 0x%0x len 0x%0x wrid_hi_stag 0x%x wrid_low_msn 0x%x\n",
+             __FUNCTION__, CQE_OOO(*hw_cqe), CQE_QPID(*hw_cqe),
+             CQE_GENBIT(*hw_cqe), CQE_TYPE(*hw_cqe), CQE_STATUS(*hw_cqe),
+             CQE_OPCODE(*hw_cqe), CQE_LEN(*hw_cqe), CQE_WRID_HI(*hw_cqe),
+             CQE_WRID_LOW(*hw_cqe));
+
+        /*
+         * skip cqe's not affiliated with a QP.
+         */
+        if (wq == NULL) {
+                ret = -1;
+                goto skip_cqe;
+        }
+
+        /*
+         * Gotta tweak READ completions:
+         *      1) the cqe doesn't contain the sq_wptr from the wr.
+         *      2) opcode not reflected from the wr.
+         *      3) read_len not reflected from the wr.
+         *      4) cq_type is RQ_TYPE not SQ_TYPE.
+         */
+        if (RQ_TYPE(*hw_cqe) && (CQE_OPCODE(*hw_cqe) == T3_READ_RESP)) {
+
+                /*
+                 * Don't write to the HWCQ, so create a new read req CQE
+                 * in local memory.
+                 */
+                create_read_req_cqe(wq, hw_cqe, &read_cqe);
+                hw_cqe = &read_cqe;
+                advance_oldest_read(wq);
+        }
+
+        /*
+         * T3A: Discard TERMINATE CQEs.
+         */
+        if (CQE_OPCODE(*hw_cqe) == T3_TERMINATE) {
+                ret = -1;
+                wq->error = 1;
+                goto skip_cqe;
+        }
+
+        if (CQE_STATUS(*hw_cqe) || wq->error) {
+                *cqe_flushed = wq->error;
+                wq->error = 1;
+
+                /*
+                 * T3A inserts errors into the CQE.  We cannot return
+                 * these as work completions.
+                 */
+                /* incoming write failures */
+                if ((CQE_OPCODE(*hw_cqe) == T3_RDMA_WRITE)
+                     && RQ_TYPE(*hw_cqe)) {
+                        ret = -1;
+                        goto skip_cqe;
+                }
+                /* incoming read request failures */
+                if ((CQE_OPCODE(*hw_cqe) == T3_READ_RESP) && SQ_TYPE(*hw_cqe)) {
+                        ret = -1;
+                        goto skip_cqe;
+                }
+
+                /* incoming SEND with no receive posted failures */
+                if ((CQE_OPCODE(*hw_cqe) == T3_SEND) && RQ_TYPE(*hw_cqe) &&
+                    Q_EMPTY(wq->rq_rptr, wq->rq_wptr)) {
+                        ret = -1;
+                        goto skip_cqe;
+                }
+                goto proc_cqe;
+        }
+
+        /*
+         * RECV completion.
+         */
+        if (RQ_TYPE(*hw_cqe)) {
+
+                /*
+                 * HW only validates 4 bits of MSN.  So we must validate that
+                 * the MSN in the SEND is the next expected MSN.  If its not,
+                 * then we complete this with TPT_ERR_MSN and mark the wq in
+                 * error.
+                 */
+                if (unlikely((CQE_WRID_MSN(*hw_cqe) != (wq->rq_rptr + 1)))) {
+                        wq->error = 1;
+                        hw_cqe->header |= htonl(V_CQE_STATUS(TPT_ERR_MSN));
+                        goto proc_cqe;
+                }
+                goto proc_cqe;
+        }
+
+        /*
+         * If we get here its a send completion.
+         *
+         * Handle out of order completion. These get stuffed
+         * in the SW SQ. Then the SW SQ is walked to move any
+         * now in-order completions into the SW CQ.  This handles
+         * 2 cases:
+         *      1) reaping unsignaled WRs when the first subsequent
+         *         signaled WR is completed.
+         *      2) out of order read completions.
+         */
+        if (!SW_CQE(*hw_cqe) && (CQE_WRID_SQ_WPTR(*hw_cqe) != wq->sq_rptr)) {
+                struct t3_swsq *sqp;
+
+                PDBG("%s out of order completion going in swsq at idx %ld\n",
+                     __FUNCTION__,
+                     Q_PTR2IDX(CQE_WRID_SQ_WPTR(*hw_cqe), wq->sq_size_log2));
+                sqp = wq->sq +
+                      Q_PTR2IDX(CQE_WRID_SQ_WPTR(*hw_cqe), wq->sq_size_log2);
+                sqp->cqe = *hw_cqe;
+                sqp->complete = 1;
+                ret = -1;
+                goto flush_wq;
+        }
+
+proc_cqe:
+        *cqe = *hw_cqe;
+
+        /*
+         * Reap the associated WR(s) that are freed up with this
+         * completion.
+         */
+        if (SQ_TYPE(*hw_cqe)) {
+                wq->sq_rptr = CQE_WRID_SQ_WPTR(*hw_cqe);
+                PDBG("%s completing sq idx %ld\n", __FUNCTION__,
+                     Q_PTR2IDX(wq->sq_rptr, wq->sq_size_log2));
+                *cookie = (wq->sq +
+                           Q_PTR2IDX(wq->sq_rptr, wq->sq_size_log2))->wr_id;
+                wq->sq_rptr++;
+        } else {
+                PDBG("%s completing rq idx %ld\n", __FUNCTION__,
+                     Q_PTR2IDX(wq->rq_rptr, wq->rq_size_log2));
+                *cookie = *(wq->rq + Q_PTR2IDX(wq->rq_rptr, wq->rq_size_log2));
+                wq->rq_rptr++;
+        }
+
+flush_wq:
+        /*
+         * Flush any completed cqes that are now in-order.
+         */
+        flush_completed_wrs(wq, cq);
+
+skip_cqe:
+        if (SW_CQE(*hw_cqe)) {
+                PDBG("%s cq %p cqid 0x%x skip sw cqe sw_rptr 0x%x\n",
+                     __FUNCTION__, cq, cq->cqid, cq->sw_rptr);
+                ++cq->sw_rptr;
+        } else {
+                PDBG("%s cq %p cqid 0x%x skip hw cqe rptr 0x%x\n",
+                     __FUNCTION__, cq, cq->cqid, cq->rptr);
+                ++cq->rptr;
+
+                /*
+                 * T3A: compute credits.
+                 */
+                if (((cq->rptr - cq->wptr) > (1 << (cq->size_log2 - 1)))
+                    || ((cq->rptr - cq->wptr) >= 128)) {
+                        *credit = cq->rptr - cq->wptr;
+                        cq->wptr = cq->rptr;
+                }
+        }
+        return ret;
+}
diff --git a/drivers/infiniband/hw/cxgb3/cxio_hal.h b/drivers/infiniband/hw/cxgb3/cxio_hal.h
new file mode 100644
index 000000000000..1b97e80b8780
--- /dev/null
+++ b/drivers/infiniband/hw/cxgb3/cxio_hal.h
@@ -0,0 +1,201 @@
+/*
+ * Copyright (c) 2006 Chelsio, Inc. All rights reserved.
+ * Copyright (c) 2006 Open Grid Computing, Inc. All rights reserved.
+ *
+ * This software is available to you under a choice of one of two
+ * licenses.  You may choose to be licensed under the terms of the GNU
+ * General Public License (GPL) Version 2, available from the file
+ * COPYING in the main directory of this source tree, or the
+ * OpenIB.org BSD license below:
+ *
+ *     Redistribution and use in source and binary forms, with or
+ *     without modification, are permitted provided that the following
+ *     conditions are met:
+ *
+ *      - Redistributions of source code must retain the above
+ *        copyright notice, this list of conditions and the following
+ *        disclaimer.
+ *
+ *      - Redistributions in binary form must reproduce the above
+ *        copyright notice, this list of conditions and the following
+ *        disclaimer in the documentation and/or other materials
+ *        provided with the distribution.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+ * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+ * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+ * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
+ * BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
+ * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
+ * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+ * SOFTWARE.
+ */
+#ifndef  __CXIO_HAL_H__
+#define  __CXIO_HAL_H__
+
+#include <linux/list.h>
+#include <linux/mutex.h>
+
+#include "t3_cpl.h"
+#include "t3cdev.h"
+#include "cxgb3_ctl_defs.h"
+#include "cxio_wr.h"
+
+#define T3_CTRL_QP_ID    FW_RI_SGEEC_START
+#define T3_CTL_QP_TID    FW_RI_TID_START
+#define T3_CTRL_QP_SIZE_LOG2  8
+#define T3_CTRL_CQ_ID    0
+
+/* TBD */
+#define T3_MAX_NUM_RI (1<<15)
+#define T3_MAX_NUM_QP (1<<15)
+#define T3_MAX_NUM_CQ (1<<15)
+#define T3_MAX_NUM_PD (1<<15)
+#define T3_MAX_PBL_SIZE 256
+#define T3_MAX_RQ_SIZE 1024
+#define T3_MAX_NUM_STAG (1<<15)
+
+#define T3_STAG_UNSET 0xffffffff
+
+#define T3_MAX_DEV_NAME_LEN 32
+
+struct cxio_hal_ctrl_qp {
+        u32 wptr;
+        u32 rptr;
+        struct mutex lock;      /* for the wtpr, can sleep */
+        wait_queue_head_t waitq;/* wait for RspQ/CQE msg */
+        union t3_wr *workq;     /* the work request queue */
+        dma_addr_t dma_addr;    /* pci bus address of the workq */
+        DECLARE_PCI_UNMAP_ADDR(mapping)
+        void __iomem *doorbell;
+};
+
+struct cxio_hal_resource {
+        struct kfifo *tpt_fifo;
+        spinlock_t tpt_fifo_lock;
+        struct kfifo *qpid_fifo;
+        spinlock_t qpid_fifo_lock;
+        struct kfifo *cqid_fifo;
+        spinlock_t cqid_fifo_lock;
+        struct kfifo *pdid_fifo;
+        spinlock_t pdid_fifo_lock;
+};
+
+struct cxio_qpid_list {
+        struct list_head entry;
+        u32 qpid;
+};
+
+struct cxio_ucontext {
+        struct list_head qpids;
+        struct mutex lock;
+};
+
+struct cxio_rdev {
+        char dev_name[T3_MAX_DEV_NAME_LEN];
+        struct t3cdev *t3cdev_p;
+        struct rdma_info rnic_info;
+        struct adap_ports port_info;
+        struct cxio_hal_resource *rscp;
+        struct cxio_hal_ctrl_qp ctrl_qp;
+        void *ulp;
+        unsigned long qpshift;
+        u32 qpnr;
+        u32 qpmask;
+        struct cxio_ucontext uctx;
+        struct gen_pool *pbl_pool;
+        struct gen_pool *rqt_pool;
+        struct list_head entry;
+};
+
+static inline int cxio_num_stags(struct cxio_rdev *rdev_p)
+{
+        return min((int)T3_MAX_NUM_STAG, (int)((rdev_p->rnic_info.tpt_top - rdev_p->rnic_info.tpt_base) >> 5));
+}
+
+typedef void (*cxio_hal_ev_callback_func_t) (struct cxio_rdev * rdev_p,
+                                             struct sk_buff * skb);
+
+#define RSPQ_CQID(rsp) (be32_to_cpu(rsp->cq_ptrid) & 0xffff)
+#define RSPQ_CQPTR(rsp) ((be32_to_cpu(rsp->cq_ptrid) >> 16) & 0xffff)
+#define RSPQ_GENBIT(rsp) ((be32_to_cpu(rsp->flags) >> 16) & 1)
+#define RSPQ_OVERFLOW(rsp) ((be32_to_cpu(rsp->flags) >> 17) & 1)
+#define RSPQ_AN(rsp) ((be32_to_cpu(rsp->flags) >> 18) & 1)
+#define RSPQ_SE(rsp) ((be32_to_cpu(rsp->flags) >> 19) & 1)
+#define RSPQ_NOTIFY(rsp) ((be32_to_cpu(rsp->flags) >> 20) & 1)
+#define RSPQ_CQBRANCH(rsp) ((be32_to_cpu(rsp->flags) >> 21) & 1)
+#define RSPQ_CREDIT_THRESH(rsp) ((be32_to_cpu(rsp->flags) >> 22) & 1)
+
+struct respQ_msg_t {
+        __be32 flags;           /* flit 0 */
+        __be32 cq_ptrid;
+        __be64 rsvd;            /* flit 1 */
+        struct t3_cqe cqe;      /* flits 2-3 */
+};
+
+enum t3_cq_opcode {
+        CQ_ARM_AN = 0x2,
+        CQ_ARM_SE = 0x6,
+        CQ_FORCE_AN = 0x3,
+        CQ_CREDIT_UPDATE = 0x7
+};
+
+int cxio_rdev_open(struct cxio_rdev *rdev);
+void cxio_rdev_close(struct cxio_rdev *rdev);
+int cxio_hal_cq_op(struct cxio_rdev *rdev, struct t3_cq *cq,
+                   enum t3_cq_opcode op, u32 credit);
+int cxio_hal_clear_qp_ctx(struct cxio_rdev *rdev, u32 qpid);
+int cxio_create_cq(struct cxio_rdev *rdev, struct t3_cq *cq);
+int cxio_destroy_cq(struct cxio_rdev *rdev, struct t3_cq *cq);
+int cxio_resize_cq(struct cxio_rdev *rdev, struct t3_cq *cq);
+void cxio_release_ucontext(struct cxio_rdev *rdev, struct cxio_ucontext *uctx);
+void cxio_init_ucontext(struct cxio_rdev *rdev, struct cxio_ucontext *uctx);
+int cxio_create_qp(struct cxio_rdev *rdev, u32 kernel_domain, struct t3_wq *wq,
+                   struct cxio_ucontext *uctx);
+int cxio_destroy_qp(struct cxio_rdev *rdev, struct t3_wq *wq,
+                    struct cxio_ucontext *uctx);
+int cxio_peek_cq(struct t3_wq *wr, struct t3_cq *cq, int opcode);
+int cxio_allocate_stag(struct cxio_rdev *rdev, u32 * stag, u32 pdid,
+                       enum tpt_mem_perm perm, u32 * pbl_size, u32 * pbl_addr);
+int cxio_register_phys_mem(struct cxio_rdev *rdev, u32 * stag, u32 pdid,
+                           enum tpt_mem_perm perm, u32 zbva, u64 to, u32 len,
+                           u8 page_size, __be64 *pbl, u32 *pbl_size,
+                           u32 *pbl_addr);
+int cxio_reregister_phys_mem(struct cxio_rdev *rdev, u32 * stag, u32 pdid,
+                           enum tpt_mem_perm perm, u32 zbva, u64 to, u32 len,
+                           u8 page_size, __be64 *pbl, u32 *pbl_size,
+                           u32 *pbl_addr);
+int cxio_dereg_mem(struct cxio_rdev *rdev, u32 stag, u32 pbl_size,
+                   u32 pbl_addr);
+int cxio_allocate_window(struct cxio_rdev *rdev, u32 * stag, u32 pdid);
+int cxio_deallocate_window(struct cxio_rdev *rdev, u32 stag);
+int cxio_rdma_init(struct cxio_rdev *rdev, struct t3_rdma_init_attr *attr);
+void cxio_register_ev_cb(cxio_hal_ev_callback_func_t ev_cb);
+void cxio_unregister_ev_cb(cxio_hal_ev_callback_func_t ev_cb);
+u32 cxio_hal_get_rhdl(void);
+void cxio_hal_put_rhdl(u32 rhdl);
+u32 cxio_hal_get_pdid(struct cxio_hal_resource *rscp);
+void cxio_hal_put_pdid(struct cxio_hal_resource *rscp, u32 pdid);
+int __init cxio_hal_init(void);
+void __exit cxio_hal_exit(void);
+void cxio_flush_rq(struct t3_wq *wq, struct t3_cq *cq, int count);
+void cxio_flush_sq(struct t3_wq *wq, struct t3_cq *cq, int count);
+void cxio_count_rcqes(struct t3_cq *cq, struct t3_wq *wq, int *count);
+void cxio_count_scqes(struct t3_cq *cq, struct t3_wq *wq, int *count);
+void cxio_flush_hw_cq(struct t3_cq *cq);
+int cxio_poll_cq(struct t3_wq *wq, struct t3_cq *cq, struct t3_cqe *cqe,
+                     u8 *cqe_flushed, u64 *cookie, u32 *credit);
+
+#define MOD "iw_cxgb3: "
+#define PDBG(fmt, args...) pr_debug(MOD fmt, ## args)
+
+#ifdef DEBUG
+void cxio_dump_tpt(struct cxio_rdev *rev, u32 stag);
+void cxio_dump_pbl(struct cxio_rdev *rev, u32 pbl_addr, uint len, u8 shift);
+void cxio_dump_wqe(union t3_wr *wqe);
+void cxio_dump_wce(struct t3_cqe *wce);
+void cxio_dump_rqt(struct cxio_rdev *rdev, u32 hwtid, int nents);
+void cxio_dump_tcb(struct cxio_rdev *rdev, u32 hwtid);
+#endif
+
+#endif
diff --git a/drivers/infiniband/hw/cxgb3/cxio_resource.c b/drivers/infiniband/hw/cxgb3/cxio_resource.c
new file mode 100644
index 000000000000..997aa32cbf07
--- /dev/null
+++ b/drivers/infiniband/hw/cxgb3/cxio_resource.c
@@ -0,0 +1,331 @@
+/*
+ * Copyright (c) 2006 Chelsio, Inc. All rights reserved.
+ * Copyright (c) 2006 Open Grid Computing, Inc. All rights reserved.
+ *
+ * This software is available to you under a choice of one of two
+ * licenses.  You may choose to be licensed under the terms of the GNU
+ * General Public License (GPL) Version 2, available from the file
+ * COPYING in the main directory of this source tree, or the
+ * OpenIB.org BSD license below:
+ *
+ *     Redistribution and use in source and binary forms, with or
+ *     without modification, are permitted provided that the following
+ *     conditions are met:
+ *
+ *      - Redistributions of source code must retain the above
+ *        copyright notice, this list of conditions and the following
+ *        disclaimer.
+ *
+ *      - Redistributions in binary form must reproduce the above
+ *        copyright notice, this list of conditions and the following
+ *        disclaimer in the documentation and/or other materials
+ *        provided with the distribution.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+ * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+ * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+ * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
+ * BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
+ * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
+ * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+ * SOFTWARE.
+ */
+/* Crude resource management */
+#include <linux/kernel.h>
+#include <linux/random.h>
+#include <linux/slab.h>
+#include <linux/kfifo.h>
+#include <linux/spinlock.h>
+#include <linux/errno.h>
+#include "cxio_resource.h"
+#include "cxio_hal.h"
+
+static struct kfifo *rhdl_fifo;
+static spinlock_t rhdl_fifo_lock;
+
+#define RANDOM_SIZE 16
+
+static int __cxio_init_resource_fifo(struct kfifo **fifo,
+                                   spinlock_t *fifo_lock,
+                                   u32 nr, u32 skip_low,
+                                   u32 skip_high,
+                                   int random)
+{
+        u32 i, j, entry = 0, idx;
+        u32 random_bytes;
+        u32 rarray[16];
+        spin_lock_init(fifo_lock);
+
+        *fifo = kfifo_alloc(nr * sizeof(u32), GFP_KERNEL, fifo_lock);
+        if (IS_ERR(*fifo))
+                return -ENOMEM;
+
+        for (i = 0; i < skip_low + skip_high; i++)
+                __kfifo_put(*fifo, (unsigned char *) &entry, sizeof(u32));
+        if (random) {
+                j = 0;
+                random_bytes = random32();
+                for (i = 0; i < RANDOM_SIZE; i++)
+                        rarray[i] = i + skip_low;
+                for (i = skip_low + RANDOM_SIZE; i < nr - skip_high; i++) {
+                        if (j >= RANDOM_SIZE) {
+                                j = 0;
+                                random_bytes = random32();
+                        }
+                        idx = (random_bytes >> (j * 2)) & 0xF;
+                        __kfifo_put(*fifo,
+                                (unsigned char *) &rarray[idx],
+                                sizeof(u32));
+                        rarray[idx] = i;
+                        j++;
+                }
+                for (i = 0; i < RANDOM_SIZE; i++)
+                        __kfifo_put(*fifo,
+                                (unsigned char *) &rarray[i],
+                                sizeof(u32));
+        } else
+                for (i = skip_low; i < nr - skip_high; i++)
+                        __kfifo_put(*fifo, (unsigned char *) &i, sizeof(u32));
+
+        for (i = 0; i < skip_low + skip_high; i++)
+                kfifo_get(*fifo, (unsigned char *) &entry, sizeof(u32));
+        return 0;
+}
+
+static int cxio_init_resource_fifo(struct kfifo **fifo, spinlock_t * fifo_lock,
+                                   u32 nr, u32 skip_low, u32 skip_high)
+{
+        return (__cxio_init_resource_fifo(fifo, fifo_lock, nr, skip_low,
+                                          skip_high, 0));
+}
+
+static int cxio_init_resource_fifo_random(struct kfifo **fifo,
+                                   spinlock_t * fifo_lock,
+                                   u32 nr, u32 skip_low, u32 skip_high)
+{
+
+        return (__cxio_init_resource_fifo(fifo, fifo_lock, nr, skip_low,
+                                          skip_high, 1));
+}
+
+static int cxio_init_qpid_fifo(struct cxio_rdev *rdev_p)
+{
+        u32 i;
+
+        spin_lock_init(&rdev_p->rscp->qpid_fifo_lock);
+
+        rdev_p->rscp->qpid_fifo = kfifo_alloc(T3_MAX_NUM_QP * sizeof(u32),
+                                              GFP_KERNEL,
+                                              &rdev_p->rscp->qpid_fifo_lock);
+        if (IS_ERR(rdev_p->rscp->qpid_fifo))
+                return -ENOMEM;
+
+        for (i = 16; i < T3_MAX_NUM_QP; i++)
+                if (!(i & rdev_p->qpmask))
+                        __kfifo_put(rdev_p->rscp->qpid_fifo,
+                                    (unsigned char *) &i, sizeof(u32));
+        return 0;
+}
+
+int cxio_hal_init_rhdl_resource(u32 nr_rhdl)
+{
+        return cxio_init_resource_fifo(&rhdl_fifo, &rhdl_fifo_lock, nr_rhdl, 1,
+                                       0);
+}
+
+void cxio_hal_destroy_rhdl_resource(void)
+{
+        kfifo_free(rhdl_fifo);
+}
+
+/* nr_* must be power of 2 */
+int cxio_hal_init_resource(struct cxio_rdev *rdev_p,
+                           u32 nr_tpt, u32 nr_pbl,
+                           u32 nr_rqt, u32 nr_qpid, u32 nr_cqid, u32 nr_pdid)
+{
+        int err = 0;
+        struct cxio_hal_resource *rscp;
+
+        rscp = kmalloc(sizeof(*rscp), GFP_KERNEL);
+        if (!rscp)
+                return -ENOMEM;
+        rdev_p->rscp = rscp;
+        err = cxio_init_resource_fifo_random(&rscp->tpt_fifo,
+                                      &rscp->tpt_fifo_lock,
+                                      nr_tpt, 1, 0);
+        if (err)
+                goto tpt_err;
+        err = cxio_init_qpid_fifo(rdev_p);
+        if (err)
+                goto qpid_err;
+        err = cxio_init_resource_fifo(&rscp->cqid_fifo, &rscp->cqid_fifo_lock,
+                                      nr_cqid, 1, 0);
+        if (err)
+                goto cqid_err;
+        err = cxio_init_resource_fifo(&rscp->pdid_fifo, &rscp->pdid_fifo_lock,
+                                      nr_pdid, 1, 0);
+        if (err)
+                goto pdid_err;
+        return 0;
+pdid_err:
+        kfifo_free(rscp->cqid_fifo);
+cqid_err:
+        kfifo_free(rscp->qpid_fifo);
+qpid_err:
+        kfifo_free(rscp->tpt_fifo);
+tpt_err:
+        return -ENOMEM;
+}
+
+/*
+ * returns 0 if no resource available
+ */
+static inline u32 cxio_hal_get_resource(struct kfifo *fifo)
+{
+        u32 entry;
+        if (kfifo_get(fifo, (unsigned char *) &entry, sizeof(u32)))
+                return entry;
+        else
+                return 0;       /* fifo emptry */
+}
+
+static inline void cxio_hal_put_resource(struct kfifo *fifo, u32 entry)
+{
+        BUG_ON(kfifo_put(fifo, (unsigned char *) &entry, sizeof(u32)) == 0);
+}
+
+u32 cxio_hal_get_rhdl(void)
+{
+        return cxio_hal_get_resource(rhdl_fifo);
+}
+
+void cxio_hal_put_rhdl(u32 rhdl)
+{
+        cxio_hal_put_resource(rhdl_fifo, rhdl);
+}
+
+u32 cxio_hal_get_stag(struct cxio_hal_resource *rscp)
+{
+        return cxio_hal_get_resource(rscp->tpt_fifo);
+}
+
+void cxio_hal_put_stag(struct cxio_hal_resource *rscp, u32 stag)
+{
+        cxio_hal_put_resource(rscp->tpt_fifo, stag);
+}
+
+u32 cxio_hal_get_qpid(struct cxio_hal_resource *rscp)
+{
+        u32 qpid = cxio_hal_get_resource(rscp->qpid_fifo);
+        PDBG("%s qpid 0x%x\n", __FUNCTION__, qpid);
+        return qpid;
+}
+
+void cxio_hal_put_qpid(struct cxio_hal_resource *rscp, u32 qpid)
+{
+        PDBG("%s qpid 0x%x\n", __FUNCTION__, qpid);
+        cxio_hal_put_resource(rscp->qpid_fifo, qpid);
+}
+
+u32 cxio_hal_get_cqid(struct cxio_hal_resource *rscp)
+{
+        return cxio_hal_get_resource(rscp->cqid_fifo);
+}
+
+void cxio_hal_put_cqid(struct cxio_hal_resource *rscp, u32 cqid)
+{
+        cxio_hal_put_resource(rscp->cqid_fifo, cqid);
+}
+
+u32 cxio_hal_get_pdid(struct cxio_hal_resource *rscp)
+{
+        return cxio_hal_get_resource(rscp->pdid_fifo);
+}
+
+void cxio_hal_put_pdid(struct cxio_hal_resource *rscp, u32 pdid)
+{
+        cxio_hal_put_resource(rscp->pdid_fifo, pdid);
+}
+
+void cxio_hal_destroy_resource(struct cxio_hal_resource *rscp)
+{
+        kfifo_free(rscp->tpt_fifo);
+        kfifo_free(rscp->cqid_fifo);
+        kfifo_free(rscp->qpid_fifo);
+        kfifo_free(rscp->pdid_fifo);
+        kfree(rscp);
+}
+
+/*
+ * PBL Memory Manager.  Uses Linux generic allocator.
+ */
+
+#define MIN_PBL_SHIFT 8                 /* 256B == min PBL size (32 entries) */
+#define PBL_CHUNK 2*1024*1024
+
+u32 cxio_hal_pblpool_alloc(struct cxio_rdev *rdev_p, int size)
+{
+        unsigned long addr = gen_pool_alloc(rdev_p->pbl_pool, size);
+        PDBG("%s addr 0x%x size %d\n", __FUNCTION__, (u32)addr, size);
+        return (u32)addr;
+}
+
+void cxio_hal_pblpool_free(struct cxio_rdev *rdev_p, u32 addr, int size)
+{
+        PDBG("%s addr 0x%x size %d\n", __FUNCTION__, addr, size);
+        gen_pool_free(rdev_p->pbl_pool, (unsigned long)addr, size);
+}
+
+int cxio_hal_pblpool_create(struct cxio_rdev *rdev_p)
+{
+        unsigned long i;
+        rdev_p->pbl_pool = gen_pool_create(MIN_PBL_SHIFT, -1);
+        if (rdev_p->pbl_pool)
+                for (i = rdev_p->rnic_info.pbl_base;
+                     i <= rdev_p->rnic_info.pbl_top - PBL_CHUNK + 1;
+                     i += PBL_CHUNK)
+                        gen_pool_add(rdev_p->pbl_pool, i, PBL_CHUNK, -1);
+        return rdev_p->pbl_pool ? 0 : -ENOMEM;
+}
+
+void cxio_hal_pblpool_destroy(struct cxio_rdev *rdev_p)
+{
+        gen_pool_destroy(rdev_p->pbl_pool);
+}
+
+/*
+ * RQT Memory Manager.  Uses Linux generic allocator.
+ */
+
+#define MIN_RQT_SHIFT 10        /* 1KB == mini RQT size (16 entries) */
+#define RQT_CHUNK 2*1024*1024
+
+u32 cxio_hal_rqtpool_alloc(struct cxio_rdev *rdev_p, int size)
+{
+        unsigned long addr = gen_pool_alloc(rdev_p->rqt_pool, size << 6);
+        PDBG("%s addr 0x%x size %d\n", __FUNCTION__, (u32)addr, size << 6);
+        return (u32)addr;
+}
+
+void cxio_hal_rqtpool_free(struct cxio_rdev *rdev_p, u32 addr, int size)
+{
+        PDBG("%s addr 0x%x size %d\n", __FUNCTION__, addr, size << 6);
+        gen_pool_free(rdev_p->rqt_pool, (unsigned long)addr, size << 6);
+}
+
+int cxio_hal_rqtpool_create(struct cxio_rdev *rdev_p)
+{
+        unsigned long i;
+        rdev_p->rqt_pool = gen_pool_create(MIN_RQT_SHIFT, -1);
+        if (rdev_p->rqt_pool)
+                for (i = rdev_p->rnic_info.rqt_base;
+                     i <= rdev_p->rnic_info.rqt_top - RQT_CHUNK + 1;
+                     i += RQT_CHUNK)
+                        gen_pool_add(rdev_p->rqt_pool, i, RQT_CHUNK, -1);
+        return rdev_p->rqt_pool ? 0 : -ENOMEM;
+}
+
+void cxio_hal_rqtpool_destroy(struct cxio_rdev *rdev_p)
+{
+        gen_pool_destroy(rdev_p->rqt_pool);
+}
diff --git a/drivers/infiniband/hw/cxgb3/cxio_resource.h b/drivers/infiniband/hw/cxgb3/cxio_resource.h
new file mode 100644
index 000000000000..a6bbe8370d81
--- /dev/null
+++ b/drivers/infiniband/hw/cxgb3/cxio_resource.h
@@ -0,0 +1,70 @@
+/*
+ * Copyright (c) 2006 Chelsio, Inc. All rights reserved.
+ * Copyright (c) 2006 Open Grid Computing, Inc. All rights reserved.
+ *
+ * This software is available to you under a choice of one of two
+ * licenses.  You may choose to be licensed under the terms of the GNU
+ * General Public License (GPL) Version 2, available from the file
+ * COPYING in the main directory of this source tree, or the
+ * OpenIB.org BSD license below:
+ *
+ *     Redistribution and use in source and binary forms, with or
+ *     without modification, are permitted provided that the following
+ *     conditions are met:
+ *
+ *      - Redistributions of source code must retain the above
+ *        copyright notice, this list of conditions and the following
+ *        disclaimer.
+ *
+ *      - Redistributions in binary form must reproduce the above
+ *        copyright notice, this list of conditions and the following
+ *        disclaimer in the documentation and/or other materials
+ *        provided with the distribution.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+ * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+ * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+ * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
+ * BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
+ * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
+ * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+ * SOFTWARE.
+ */
+#ifndef __CXIO_RESOURCE_H__
+#define __CXIO_RESOURCE_H__
+
+#include <linux/kernel.h>
+#include <linux/random.h>
+#include <linux/slab.h>
+#include <linux/kfifo.h>
+#include <linux/spinlock.h>
+#include <linux/errno.h>
+#include <linux/genalloc.h>
+#include "cxio_hal.h"
+
+extern int cxio_hal_init_rhdl_resource(u32 nr_rhdl);
+extern void cxio_hal_destroy_rhdl_resource(void);
+extern int cxio_hal_init_resource(struct cxio_rdev *rdev_p,
+                                  u32 nr_tpt, u32 nr_pbl,
+                                  u32 nr_rqt, u32 nr_qpid, u32 nr_cqid,
+                                  u32 nr_pdid);
+extern u32 cxio_hal_get_stag(struct cxio_hal_resource *rscp);
+extern void cxio_hal_put_stag(struct cxio_hal_resource *rscp, u32 stag);
+extern u32 cxio_hal_get_qpid(struct cxio_hal_resource *rscp);
+extern void cxio_hal_put_qpid(struct cxio_hal_resource *rscp, u32 qpid);
+extern u32 cxio_hal_get_cqid(struct cxio_hal_resource *rscp);
+extern void cxio_hal_put_cqid(struct cxio_hal_resource *rscp, u32 cqid);
+extern void cxio_hal_destroy_resource(struct cxio_hal_resource *rscp);
+
+#define PBL_OFF(rdev_p, a) ( (a) - (rdev_p)->rnic_info.pbl_base )
+extern int cxio_hal_pblpool_create(struct cxio_rdev *rdev_p);
+extern void cxio_hal_pblpool_destroy(struct cxio_rdev *rdev_p);
+extern u32 cxio_hal_pblpool_alloc(struct cxio_rdev *rdev_p, int size);
+extern void cxio_hal_pblpool_free(struct cxio_rdev *rdev_p, u32 addr, int size);
+
+#define RQT_OFF(rdev_p, a) ( (a) - (rdev_p)->rnic_info.rqt_base )
+extern int cxio_hal_rqtpool_create(struct cxio_rdev *rdev_p);
+extern void cxio_hal_rqtpool_destroy(struct cxio_rdev *rdev_p);
+extern u32 cxio_hal_rqtpool_alloc(struct cxio_rdev *rdev_p, int size);
+extern void cxio_hal_rqtpool_free(struct cxio_rdev *rdev_p, u32 addr, int size);
+#endif
diff --git a/drivers/infiniband/hw/cxgb3/cxio_wr.h b/drivers/infiniband/hw/cxgb3/cxio_wr.h
new file mode 100644
index 000000000000..103fc42d6976
--- /dev/null
+++ b/drivers/infiniband/hw/cxgb3/cxio_wr.h
@@ -0,0 +1,685 @@
+/*
+ * Copyright (c) 2006 Chelsio, Inc. All rights reserved.
+ * Copyright (c) 2006 Open Grid Computing, Inc. All rights reserved.
+ *
+ * This software is available to you under a choice of one of two
+ * licenses.  You may choose to be licensed under the terms of the GNU
+ * General Public License (GPL) Version 2, available from the file
+ * COPYING in the main directory of this source tree, or the
+ * OpenIB.org BSD license below:
+ *
+ *     Redistribution and use in source and binary forms, with or
+ *     without modification, are permitted provided that the following
+ *     conditions are met:
+ *
+ *      - Redistributions of source code must retain the above
+ *        copyright notice, this list of conditions and the following
+ *        disclaimer.
+ *
+ *      - Redistributions in binary form must reproduce the above
+ *        copyright notice, this list of conditions and the following
+ *        disclaimer in the documentation and/or other materials
+ *        provided with the distribution.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+ * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+ * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+ * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
+ * BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
+ * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
+ * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+ * SOFTWARE.
+ */
+#ifndef __CXIO_WR_H__
+#define __CXIO_WR_H__
+
+#include <asm/io.h>
+#include <linux/pci.h>
+#include <linux/timer.h>
+#include "firmware_exports.h"
+
+#define T3_MAX_SGE      4
+
+#define Q_EMPTY(rptr,wptr) ((rptr)==(wptr))
+#define Q_FULL(rptr,wptr,size_log2)  ( (((wptr)-(rptr))>>(size_log2)) && \
+                                       ((rptr)!=(wptr)) )
+#define Q_GENBIT(ptr,size_log2) (!(((ptr)>>size_log2)&0x1))
+#define Q_FREECNT(rptr,wptr,size_log2) ((1UL<<size_log2)-((wptr)-(rptr)))
+#define Q_COUNT(rptr,wptr) ((wptr)-(rptr))
+#define Q_PTR2IDX(ptr,size_log2) (ptr & ((1UL<<size_log2)-1))
+
+static inline void ring_doorbell(void __iomem *doorbell, u32 qpid)
+{
+        writel(((1<<31) | qpid), doorbell);
+}
+
+#define SEQ32_GE(x,y) (!( (((u32) (x)) - ((u32) (y))) & 0x80000000 ))
+
+enum t3_wr_flags {
+        T3_COMPLETION_FLAG = 0x01,
+        T3_NOTIFY_FLAG = 0x02,
+        T3_SOLICITED_EVENT_FLAG = 0x04,
+        T3_READ_FENCE_FLAG = 0x08,
+        T3_LOCAL_FENCE_FLAG = 0x10
+} __attribute__ ((packed));
+
+enum t3_wr_opcode {
+        T3_WR_BP = FW_WROPCODE_RI_BYPASS,
+        T3_WR_SEND = FW_WROPCODE_RI_SEND,
+        T3_WR_WRITE = FW_WROPCODE_RI_RDMA_WRITE,
+        T3_WR_READ = FW_WROPCODE_RI_RDMA_READ,
+        T3_WR_INV_STAG = FW_WROPCODE_RI_LOCAL_INV,
+        T3_WR_BIND = FW_WROPCODE_RI_BIND_MW,
+        T3_WR_RCV = FW_WROPCODE_RI_RECEIVE,
+        T3_WR_INIT = FW_WROPCODE_RI_RDMA_INIT,
+        T3_WR_QP_MOD = FW_WROPCODE_RI_MODIFY_QP
+} __attribute__ ((packed));
+
+enum t3_rdma_opcode {
+        T3_RDMA_WRITE,          /* IETF RDMAP v1.0 ... */
+        T3_READ_REQ,
+        T3_READ_RESP,
+        T3_SEND,
+        T3_SEND_WITH_INV,
+        T3_SEND_WITH_SE,
+        T3_SEND_WITH_SE_INV,
+        T3_TERMINATE,
+        T3_RDMA_INIT,           /* CHELSIO RI specific ... */
+        T3_BIND_MW,
+        T3_FAST_REGISTER,
+        T3_LOCAL_INV,
+        T3_QP_MOD,
+        T3_BYPASS
+} __attribute__ ((packed));
+
+static inline enum t3_rdma_opcode wr2opcode(enum t3_wr_opcode wrop)
+{
+        switch (wrop) {
+                case T3_WR_BP: return T3_BYPASS;
+                case T3_WR_SEND: return T3_SEND;
+                case T3_WR_WRITE: return T3_RDMA_WRITE;
+                case T3_WR_READ: return T3_READ_REQ;
+                case T3_WR_INV_STAG: return T3_LOCAL_INV;
+                case T3_WR_BIND: return T3_BIND_MW;
+                case T3_WR_INIT: return T3_RDMA_INIT;
+                case T3_WR_QP_MOD: return T3_QP_MOD;
+                default: break;
+        }
+        return -1;
+}
+
+
+/* Work request id */
+union t3_wrid {
+        struct {
+                u32 hi;
+                u32 low;
+        } id0;
+        u64 id1;
+};
+
+#define WRID(wrid)              (wrid.id1)
+#define WRID_GEN(wrid)          (wrid.id0.wr_gen)
+#define WRID_IDX(wrid)          (wrid.id0.wr_idx)
+#define WRID_LO(wrid)           (wrid.id0.wr_lo)
+
+struct fw_riwrh {
+        __be32 op_seop_flags;
+        __be32 gen_tid_len;
+};
+
+#define S_FW_RIWR_OP            24
+#define M_FW_RIWR_OP            0xff
+#define V_FW_RIWR_OP(x)         ((x) << S_FW_RIWR_OP)
+#define G_FW_RIWR_OP(x) ((((x) >> S_FW_RIWR_OP)) & M_FW_RIWR_OP)
+
+#define S_FW_RIWR_SOPEOP        22
+#define M_FW_RIWR_SOPEOP        0x3
+#define V_FW_RIWR_SOPEOP(x)     ((x) << S_FW_RIWR_SOPEOP)
+
+#define S_FW_RIWR_FLAGS         8
+#define M_FW_RIWR_FLAGS         0x3fffff
+#define V_FW_RIWR_FLAGS(x)      ((x) << S_FW_RIWR_FLAGS)
+#define G_FW_RIWR_FLAGS(x)      ((((x) >> S_FW_RIWR_FLAGS)) & M_FW_RIWR_FLAGS)
+
+#define S_FW_RIWR_TID           8
+#define V_FW_RIWR_TID(x)        ((x) << S_FW_RIWR_TID)
+
+#define S_FW_RIWR_LEN           0
+#define V_FW_RIWR_LEN(x)        ((x) << S_FW_RIWR_LEN)
+
+#define S_FW_RIWR_GEN           31
+#define V_FW_RIWR_GEN(x)        ((x)  << S_FW_RIWR_GEN)
+
+struct t3_sge {
+        __be32 stag;
+        __be32 len;
+        __be64 to;
+};
+
+/* If num_sgle is zero, flit 5+ contains immediate data.*/
+struct t3_send_wr {
+        struct fw_riwrh wrh;    /* 0 */
+        union t3_wrid wrid;     /* 1 */
+
+        u8 rdmaop;              /* 2 */
+        u8 reserved[3];
+        __be32 rem_stag;
+        __be32 plen;            /* 3 */
+        __be32 num_sgle;
+        struct t3_sge sgl[T3_MAX_SGE];  /* 4+ */
+};
+
+struct t3_local_inv_wr {
+        struct fw_riwrh wrh;    /* 0 */
+        union t3_wrid wrid;     /* 1 */
+        __be32 stag;            /* 2 */
+        __be32 reserved3;
+};
+
+struct t3_rdma_write_wr {
+        struct fw_riwrh wrh;    /* 0 */
+        union t3_wrid wrid;     /* 1 */
+        u8 rdmaop;              /* 2 */
+        u8 reserved[3];
+        __be32 stag_sink;
+        __be64 to_sink;         /* 3 */
+        __be32 plen;            /* 4 */
+        __be32 num_sgle;
+        struct t3_sge sgl[T3_MAX_SGE];  /* 5+ */
+};
+
+struct t3_rdma_read_wr {
+        struct fw_riwrh wrh;    /* 0 */
+        union t3_wrid wrid;     /* 1 */
+        u8 rdmaop;              /* 2 */
+        u8 reserved[3];
+        __be32 rem_stag;
+        __be64 rem_to;          /* 3 */
+        __be32 local_stag;      /* 4 */
+        __be32 local_len;
+        __be64 local_to;        /* 5 */
+};
+
+enum t3_addr_type {
+        T3_VA_BASED_TO = 0x0,
+        T3_ZERO_BASED_TO = 0x1
+} __attribute__ ((packed));
+
+enum t3_mem_perms {
+        T3_MEM_ACCESS_LOCAL_READ = 0x1,
+        T3_MEM_ACCESS_LOCAL_WRITE = 0x2,
+        T3_MEM_ACCESS_REM_READ = 0x4,
+        T3_MEM_ACCESS_REM_WRITE = 0x8
+} __attribute__ ((packed));
+
+struct t3_bind_mw_wr {
+        struct fw_riwrh wrh;    /* 0 */
+        union t3_wrid wrid;     /* 1 */
+        u16 reserved;           /* 2 */
+        u8 type;
+        u8 perms;
+        __be32 mr_stag;
+        __be32 mw_stag;         /* 3 */
+        __be32 mw_len;
+        __be64 mw_va;           /* 4 */
+        __be32 mr_pbl_addr;     /* 5 */
+        u8 reserved2[3];
+        u8 mr_pagesz;
+};
+
+struct t3_receive_wr {
+        struct fw_riwrh wrh;    /* 0 */
+        union t3_wrid wrid;     /* 1 */
+        u8 pagesz[T3_MAX_SGE];
+        __be32 num_sgle;                /* 2 */
+        struct t3_sge sgl[T3_MAX_SGE];  /* 3+ */
+        __be32 pbl_addr[T3_MAX_SGE];
+};
+
+struct t3_bypass_wr {
+        struct fw_riwrh wrh;
+        union t3_wrid wrid;     /* 1 */
+};
+
+struct t3_modify_qp_wr {
+        struct fw_riwrh wrh;    /* 0 */
+        union t3_wrid wrid;     /* 1 */
+        __be32 flags;           /* 2 */
+        __be32 quiesce;         /* 2 */
+        __be32 max_ird;         /* 3 */
+        __be32 max_ord;         /* 3 */
+        __be64 sge_cmd;         /* 4 */
+        __be64 ctx1;            /* 5 */
+        __be64 ctx0;            /* 6 */
+};
+
+enum t3_modify_qp_flags {
+        MODQP_QUIESCE  = 0x01,
+        MODQP_MAX_IRD  = 0x02,
+        MODQP_MAX_ORD  = 0x04,
+        MODQP_WRITE_EC = 0x08,
+        MODQP_READ_EC  = 0x10,
+};
+
+
+enum t3_mpa_attrs {
+        uP_RI_MPA_RX_MARKER_ENABLE = 0x1,
+        uP_RI_MPA_TX_MARKER_ENABLE = 0x2,
+        uP_RI_MPA_CRC_ENABLE = 0x4,
+        uP_RI_MPA_IETF_ENABLE = 0x8
+} __attribute__ ((packed));
+
+enum t3_qp_caps {
+        uP_RI_QP_RDMA_READ_ENABLE = 0x01,
+        uP_RI_QP_RDMA_WRITE_ENABLE = 0x02,
+        uP_RI_QP_BIND_ENABLE = 0x04,
+        uP_RI_QP_FAST_REGISTER_ENABLE = 0x08,
+        uP_RI_QP_STAG0_ENABLE = 0x10
+} __attribute__ ((packed));
+
+struct t3_rdma_init_attr {
+        u32 tid;
+        u32 qpid;
+        u32 pdid;
+        u32 scqid;
+        u32 rcqid;
+        u32 rq_addr;
+        u32 rq_size;
+        enum t3_mpa_attrs mpaattrs;
+        enum t3_qp_caps qpcaps;
+        u16 tcp_emss;
+        u32 ord;
+        u32 ird;
+        u64 qp_dma_addr;
+        u32 qp_dma_size;
+        u32 flags;
+};
+
+struct t3_rdma_init_wr {
+        struct fw_riwrh wrh;    /* 0 */
+        union t3_wrid wrid;     /* 1 */
+        __be32 qpid;            /* 2 */
+        __be32 pdid;
+        __be32 scqid;           /* 3 */
+        __be32 rcqid;
+        __be32 rq_addr;         /* 4 */
+        __be32 rq_size;
+        u8 mpaattrs;            /* 5 */
+        u8 qpcaps;
+        __be16 ulpdu_size;
+        __be32 flags;           /* bits 31-1 - reservered */
+                                /* bit     0 - set if RECV posted */
+        __be32 ord;             /* 6 */
+        __be32 ird;
+        __be64 qp_dma_addr;     /* 7 */
+        __be32 qp_dma_size;     /* 8 */
+        u32 rsvd;
+};
+
+struct t3_genbit {
+        u64 flit[15];
+        __be64 genbit;
+};
+
+enum rdma_init_wr_flags {
+        RECVS_POSTED = 1,
+};
+
+union t3_wr {
+        struct t3_send_wr send;
+        struct t3_rdma_write_wr write;
+        struct t3_rdma_read_wr read;
+        struct t3_receive_wr recv;
+        struct t3_local_inv_wr local_inv;
+        struct t3_bind_mw_wr bind;
+        struct t3_bypass_wr bypass;
+        struct t3_rdma_init_wr init;
+        struct t3_modify_qp_wr qp_mod;
+        struct t3_genbit genbit;
+        u64 flit[16];
+};
+
+#define T3_SQ_CQE_FLIT    13
+#define T3_SQ_COOKIE_FLIT 14
+
+#define T3_RQ_COOKIE_FLIT 13
+#define T3_RQ_CQE_FLIT    14
+
+static inline enum t3_wr_opcode fw_riwrh_opcode(struct fw_riwrh *wqe)
+{
+        return G_FW_RIWR_OP(be32_to_cpu(wqe->op_seop_flags));
+}
+
+static inline void build_fw_riwrh(struct fw_riwrh *wqe, enum t3_wr_opcode op,
+                                  enum t3_wr_flags flags, u8 genbit, u32 tid,
+                                  u8 len)
+{
+        wqe->op_seop_flags = cpu_to_be32(V_FW_RIWR_OP(op) |
+                                         V_FW_RIWR_SOPEOP(M_FW_RIWR_SOPEOP) |
+                                         V_FW_RIWR_FLAGS(flags));
+        wmb();
+        wqe->gen_tid_len = cpu_to_be32(V_FW_RIWR_GEN(genbit) |
+                                       V_FW_RIWR_TID(tid) |
+                                       V_FW_RIWR_LEN(len));
+        /* 2nd gen bit... */
+        ((union t3_wr *)wqe)->genbit.genbit = cpu_to_be64(genbit);
+}
+
+/*
+ * T3 ULP2_TX commands
+ */
+enum t3_utx_mem_op {
+        T3_UTX_MEM_READ = 2,
+        T3_UTX_MEM_WRITE = 3
+};
+
+/* T3 MC7 RDMA TPT entry format */
+
+enum tpt_mem_type {
+        TPT_NON_SHARED_MR = 0x0,
+        TPT_SHARED_MR = 0x1,
+        TPT_MW = 0x2,
+        TPT_MW_RELAXED_PROTECTION = 0x3
+};
+
+enum tpt_addr_type {
+        TPT_ZBTO = 0,
+        TPT_VATO = 1
+};
+
+enum tpt_mem_perm {
+        TPT_LOCAL_READ = 0x8,
+        TPT_LOCAL_WRITE = 0x4,
+        TPT_REMOTE_READ = 0x2,
+        TPT_REMOTE_WRITE = 0x1
+};
+
+struct tpt_entry {
+        __be32 valid_stag_pdid;
+        __be32 flags_pagesize_qpid;
+
+        __be32 rsvd_pbl_addr;
+        __be32 len;
+        __be32 va_hi;
+        __be32 va_low_or_fbo;
+
+        __be32 rsvd_bind_cnt_or_pstag;
+        __be32 rsvd_pbl_size;
+};
+
+#define S_TPT_VALID             31
+#define V_TPT_VALID(x)          ((x) << S_TPT_VALID)
+#define F_TPT_VALID             V_TPT_VALID(1U)
+
+#define S_TPT_STAG_KEY          23
+#define M_TPT_STAG_KEY          0xFF
+#define V_TPT_STAG_KEY(x)       ((x) << S_TPT_STAG_KEY)
+#define G_TPT_STAG_KEY(x)       (((x) >> S_TPT_STAG_KEY) & M_TPT_STAG_KEY)
+
+#define S_TPT_STAG_STATE        22
+#define V_TPT_STAG_STATE(x)     ((x) << S_TPT_STAG_STATE)
+#define F_TPT_STAG_STATE        V_TPT_STAG_STATE(1U)
+
+#define S_TPT_STAG_TYPE         20
+#define M_TPT_STAG_TYPE         0x3
+#define V_TPT_STAG_TYPE(x)      ((x) << S_TPT_STAG_TYPE)
+#define G_TPT_STAG_TYPE(x)      (((x) >> S_TPT_STAG_TYPE) & M_TPT_STAG_TYPE)
+
+#define S_TPT_PDID              0
+#define M_TPT_PDID              0xFFFFF
+#define V_TPT_PDID(x)           ((x) << S_TPT_PDID)
+#define G_TPT_PDID(x)           (((x) >> S_TPT_PDID) & M_TPT_PDID)
+
+#define S_TPT_PERM              28
+#define M_TPT_PERM              0xF
+#define V_TPT_PERM(x)           ((x) << S_TPT_PERM)
+#define G_TPT_PERM(x)           (((x) >> S_TPT_PERM) & M_TPT_PERM)
+
+#define S_TPT_REM_INV_DIS       27
+#define V_TPT_REM_INV_DIS(x)    ((x) << S_TPT_REM_INV_DIS)
+#define F_TPT_REM_INV_DIS       V_TPT_REM_INV_DIS(1U)
+
+#define S_TPT_ADDR_TYPE         26
+#define V_TPT_ADDR_TYPE(x)      ((x) << S_TPT_ADDR_TYPE)
+#define F_TPT_ADDR_TYPE         V_TPT_ADDR_TYPE(1U)
+
+#define S_TPT_MW_BIND_ENABLE    25
+#define V_TPT_MW_BIND_ENABLE(x) ((x) << S_TPT_MW_BIND_ENABLE)
+#define F_TPT_MW_BIND_ENABLE    V_TPT_MW_BIND_ENABLE(1U)
+
+#define S_TPT_PAGE_SIZE         20
+#define M_TPT_PAGE_SIZE         0x1F
+#define V_TPT_PAGE_SIZE(x)      ((x) << S_TPT_PAGE_SIZE)
+#define G_TPT_PAGE_SIZE(x)      (((x) >> S_TPT_PAGE_SIZE) & M_TPT_PAGE_SIZE)
+
+#define S_TPT_PBL_ADDR          0
+#define M_TPT_PBL_ADDR          0x1FFFFFFF
+#define V_TPT_PBL_ADDR(x)       ((x) << S_TPT_PBL_ADDR)
+#define G_TPT_PBL_ADDR(x)       (((x) >> S_TPT_PBL_ADDR) & M_TPT_PBL_ADDR)
+
+#define S_TPT_QPID              0
+#define M_TPT_QPID              0xFFFFF
+#define V_TPT_QPID(x)           ((x) << S_TPT_QPID)
+#define G_TPT_QPID(x)           (((x) >> S_TPT_QPID) & M_TPT_QPID)
+
+#define S_TPT_PSTAG             0
+#define M_TPT_PSTAG             0xFFFFFF
+#define V_TPT_PSTAG(x)          ((x) << S_TPT_PSTAG)
+#define G_TPT_PSTAG(x)          (((x) >> S_TPT_PSTAG) & M_TPT_PSTAG)
+
+#define S_TPT_PBL_SIZE          0
+#define M_TPT_PBL_SIZE          0xFFFFF
+#define V_TPT_PBL_SIZE(x)       ((x) << S_TPT_PBL_SIZE)
+#define G_TPT_PBL_SIZE(x)       (((x) >> S_TPT_PBL_SIZE) & M_TPT_PBL_SIZE)
+
+/*
+ * CQE defs
+ */
+struct t3_cqe {
+        __be32 header;
+        __be32 len;
+        union {
+                struct {
+                        __be32 stag;
+                        __be32 msn;
+                } rcqe;
+                struct {
+                        u32 wrid_hi;
+                        u32 wrid_low;
+                } scqe;
+        } u;
+};
+
+#define S_CQE_OOO         31
+#define M_CQE_OOO         0x1
+#define G_CQE_OOO(x)      ((((x) >> S_CQE_OOO)) & M_CQE_OOO)
+#define V_CEQ_OOO(x)      ((x)<<S_CQE_OOO)
+
+#define S_CQE_QPID        12
+#define M_CQE_QPID        0x7FFFF
+#define G_CQE_QPID(x)     ((((x) >> S_CQE_QPID)) & M_CQE_QPID)
+#define V_CQE_QPID(x)     ((x)<<S_CQE_QPID)
+
+#define S_CQE_SWCQE       11
+#define M_CQE_SWCQE       0x1
+#define G_CQE_SWCQE(x)    ((((x) >> S_CQE_SWCQE)) & M_CQE_SWCQE)
+#define V_CQE_SWCQE(x)    ((x)<<S_CQE_SWCQE)
+
+#define S_CQE_GENBIT      10
+#define M_CQE_GENBIT      0x1
+#define G_CQE_GENBIT(x)   (((x) >> S_CQE_GENBIT) & M_CQE_GENBIT)
+#define V_CQE_GENBIT(x)   ((x)<<S_CQE_GENBIT)
+
+#define S_CQE_STATUS      5
+#define M_CQE_STATUS      0x1F
+#define G_CQE_STATUS(x)   ((((x) >> S_CQE_STATUS)) & M_CQE_STATUS)
+#define V_CQE_STATUS(x)   ((x)<<S_CQE_STATUS)
+
+#define S_CQE_TYPE        4
+#define M_CQE_TYPE        0x1
+#define G_CQE_TYPE(x)     ((((x) >> S_CQE_TYPE)) & M_CQE_TYPE)
+#define V_CQE_TYPE(x)     ((x)<<S_CQE_TYPE)
+
+#define S_CQE_OPCODE      0
+#define M_CQE_OPCODE      0xF
+#define G_CQE_OPCODE(x)   ((((x) >> S_CQE_OPCODE)) & M_CQE_OPCODE)
+#define V_CQE_OPCODE(x)   ((x)<<S_CQE_OPCODE)
+
+#define SW_CQE(x)         (G_CQE_SWCQE(be32_to_cpu((x).header)))
+#define CQE_OOO(x)        (G_CQE_OOO(be32_to_cpu((x).header)))
+#define CQE_QPID(x)       (G_CQE_QPID(be32_to_cpu((x).header)))
+#define CQE_GENBIT(x)     (G_CQE_GENBIT(be32_to_cpu((x).header)))
+#define CQE_TYPE(x)       (G_CQE_TYPE(be32_to_cpu((x).header)))
+#define SQ_TYPE(x)        (CQE_TYPE((x)))
+#define RQ_TYPE(x)        (!CQE_TYPE((x)))
+#define CQE_STATUS(x)     (G_CQE_STATUS(be32_to_cpu((x).header)))
+#define CQE_OPCODE(x)     (G_CQE_OPCODE(be32_to_cpu((x).header)))
+
+#define CQE_LEN(x)        (be32_to_cpu((x).len))
+
+/* used for RQ completion processing */
+#define CQE_WRID_STAG(x)  (be32_to_cpu((x).u.rcqe.stag))
+#define CQE_WRID_MSN(x)   (be32_to_cpu((x).u.rcqe.msn))
+
+/* used for SQ completion processing */
+#define CQE_WRID_SQ_WPTR(x)     ((x).u.scqe.wrid_hi)
+#define CQE_WRID_WPTR(x)        ((x).u.scqe.wrid_low)
+
+/* generic accessor macros */
+#define CQE_WRID_HI(x)          ((x).u.scqe.wrid_hi)
+#define CQE_WRID_LOW(x)         ((x).u.scqe.wrid_low)
+
+#define TPT_ERR_SUCCESS                     0x0
+#define TPT_ERR_STAG                        0x1  /* STAG invalid: either the */
+                                                 /* STAG is offlimt, being 0, */
+                                                 /* or STAG_key mismatch */
+#define TPT_ERR_PDID                        0x2  /* PDID mismatch */
+#define TPT_ERR_QPID                        0x3  /* QPID mismatch */
+#define TPT_ERR_ACCESS                      0x4  /* Invalid access right */
+#define TPT_ERR_WRAP                        0x5  /* Wrap error */
+#define TPT_ERR_BOUND                       0x6  /* base and bounds voilation */
+#define TPT_ERR_INVALIDATE_SHARED_MR        0x7  /* attempt to invalidate a  */
+                                                 /* shared memory region */
+#define TPT_ERR_INVALIDATE_MR_WITH_MW_BOUND 0x8  /* attempt to invalidate a  */
+                                                 /* shared memory region */
+#define TPT_ERR_ECC                         0x9  /* ECC error detected */
+#define TPT_ERR_ECC_PSTAG                   0xA  /* ECC error detected when  */
+                                                 /* reading PSTAG for a MW  */
+                                                 /* Invalidate */
+#define TPT_ERR_PBL_ADDR_BOUND              0xB  /* pbl addr out of bounds:  */
+                                                 /* software error */
+#define TPT_ERR_SWFLUSH                     0xC  /* SW FLUSHED */
+#define TPT_ERR_CRC                         0x10 /* CRC error */
+#define TPT_ERR_MARKER                      0x11 /* Marker error */
+#define TPT_ERR_PDU_LEN_ERR                 0x12 /* invalid PDU length */
+#define TPT_ERR_OUT_OF_RQE                  0x13 /* out of RQE */
+#define TPT_ERR_DDP_VERSION                 0x14 /* wrong DDP version */
+#define TPT_ERR_RDMA_VERSION                0x15 /* wrong RDMA version */
+#define TPT_ERR_OPCODE                      0x16 /* invalid rdma opcode */
+#define TPT_ERR_DDP_QUEUE_NUM               0x17 /* invalid ddp queue number */
+#define TPT_ERR_MSN                         0x18 /* MSN error */
+#define TPT_ERR_TBIT                        0x19 /* tag bit not set correctly */
+#define TPT_ERR_MO                          0x1A /* MO not 0 for TERMINATE  */
+                                                 /* or READ_REQ */
+#define TPT_ERR_MSN_GAP                     0x1B
+#define TPT_ERR_MSN_RANGE                   0x1C
+#define TPT_ERR_IRD_OVERFLOW                0x1D
+#define TPT_ERR_RQE_ADDR_BOUND              0x1E /* RQE addr out of bounds:  */
+                                                 /* software error */
+#define TPT_ERR_INTERNAL_ERR                0x1F /* internal error (opcode  */
+                                                 /* mismatch) */
+
+struct t3_swsq {
+        __u64                   wr_id;
+        struct t3_cqe           cqe;
+        __u32                   sq_wptr;
+        __be32                  read_len;
+        int                     opcode;
+        int                     complete;
+        int                     signaled;
+};
+
+/*
+ * A T3 WQ implements both the SQ and RQ.
+ */
+struct t3_wq {
+        union t3_wr *queue;             /* DMA accessable memory */
+        dma_addr_t dma_addr;            /* DMA address for HW */
+        DECLARE_PCI_UNMAP_ADDR(mapping) /* unmap kruft */
+        u32 error;                      /* 1 once we go to ERROR */
+        u32 qpid;
+        u32 wptr;                       /* idx to next available WR slot */
+        u32 size_log2;                  /* total wq size */
+        struct t3_swsq *sq;             /* SW SQ */
+        struct t3_swsq *oldest_read;    /* tracks oldest pending read */
+        u32 sq_wptr;                    /* sq_wptr - sq_rptr == count of */
+        u32 sq_rptr;                    /* pending wrs */
+        u32 sq_size_log2;               /* sq size */
+        u64 *rq;                        /* SW RQ (holds consumer wr_ids */
+        u32 rq_wptr;                    /* rq_wptr - rq_rptr == count of */
+        u32 rq_rptr;                    /* pending wrs */
+        u64 *rq_oldest_wr;              /* oldest wr on the SW RQ */
+        u32 rq_size_log2;               /* rq size */
+        u32 rq_addr;                    /* rq adapter address */
+        void __iomem *doorbell;         /* kernel db */
+        u64 udb;                        /* user db if any */
+};
+
+struct t3_cq {
+        u32 cqid;
+        u32 rptr;
+        u32 wptr;
+        u32 size_log2;
+        dma_addr_t dma_addr;
+        DECLARE_PCI_UNMAP_ADDR(mapping)
+        struct t3_cqe *queue;
+        struct t3_cqe *sw_queue;
+        u32 sw_rptr;
+        u32 sw_wptr;
+};
+
+#define CQ_VLD_ENTRY(ptr,size_log2,cqe) (Q_GENBIT(ptr,size_log2) == \
+                                         CQE_GENBIT(*cqe))
+
+static inline void cxio_set_wq_in_error(struct t3_wq *wq)
+{
+        wq->queue->flit[13] = 1;
+}
+
+static inline struct t3_cqe *cxio_next_hw_cqe(struct t3_cq *cq)
+{
+        struct t3_cqe *cqe;
+
+        cqe = cq->queue + (Q_PTR2IDX(cq->rptr, cq->size_log2));
+        if (CQ_VLD_ENTRY(cq->rptr, cq->size_log2, cqe))
+                return cqe;
+        return NULL;
+}
+
+static inline struct t3_cqe *cxio_next_sw_cqe(struct t3_cq *cq)
+{
+        struct t3_cqe *cqe;
+
+        if (!Q_EMPTY(cq->sw_rptr, cq->sw_wptr)) {
+                cqe = cq->sw_queue + (Q_PTR2IDX(cq->sw_rptr, cq->size_log2));
+                return cqe;
+        }
+        return NULL;
+}
+
+static inline struct t3_cqe *cxio_next_cqe(struct t3_cq *cq)
+{
+        struct t3_cqe *cqe;
+
+        if (!Q_EMPTY(cq->sw_rptr, cq->sw_wptr)) {
+                cqe = cq->sw_queue + (Q_PTR2IDX(cq->sw_rptr, cq->size_log2));
+                return cqe;
+        }
+        cqe = cq->queue + (Q_PTR2IDX(cq->rptr, cq->size_log2));
+        if (CQ_VLD_ENTRY(cq->rptr, cq->size_log2, cqe))
+                return cqe;
+        return NULL;
+}
+
+#endif
diff --git a/drivers/infiniband/hw/cxgb3/iwch.c b/drivers/infiniband/hw/cxgb3/iwch.c
new file mode 100644
index 000000000000..4611afa52220
--- /dev/null
+++ b/drivers/infiniband/hw/cxgb3/iwch.c
@@ -0,0 +1,189 @@
+/*
+ * Copyright (c) 2006 Chelsio, Inc. All rights reserved.
+ * Copyright (c) 2006 Open Grid Computing, Inc. All rights reserved.
+ *
+ * This software is available to you under a choice of one of two
+ * licenses.  You may choose to be licensed under the terms of the GNU
+ * General Public License (GPL) Version 2, available from the file
+ * COPYING in the main directory of this source tree, or the
+ * OpenIB.org BSD license below:
+ *
+ *     Redistribution and use in source and binary forms, with or
+ *     without modification, are permitted provided that the following
+ *     conditions are met:
+ *
+ *      - Redistributions of source code must retain the above
+ *        copyright notice, this list of conditions and the following
+ *        disclaimer.
+ *
+ *      - Redistributions in binary form must reproduce the above
+ *        copyright notice, this list of conditions and the following
+ *        disclaimer in the documentation and/or other materials
+ *        provided with the distribution.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+ * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+ * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+ * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
+ * BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
+ * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
+ * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+ * SOFTWARE.
+ */
+#include <linux/module.h>
+#include <linux/moduleparam.h>
+
+#include <rdma/ib_verbs.h>
+
+#include "cxgb3_offload.h"
+#include "iwch_provider.h"
+#include "iwch_user.h"
+#include "iwch.h"
+#include "iwch_cm.h"
+
+#define DRV_VERSION "1.1"
+
+MODULE_AUTHOR("Boyd Faulkner, Steve Wise");
+MODULE_DESCRIPTION("Chelsio T3 RDMA Driver");
+MODULE_LICENSE("Dual BSD/GPL");
+MODULE_VERSION(DRV_VERSION);
+
+cxgb3_cpl_handler_func t3c_handlers[NUM_CPL_CMDS];
+
+static void open_rnic_dev(struct t3cdev *);
+static void close_rnic_dev(struct t3cdev *);
+
+struct cxgb3_client t3c_client = {
+        .name = "iw_cxgb3",
+        .add = open_rnic_dev,
+        .remove = close_rnic_dev,
+        .handlers = t3c_handlers,
+        .redirect = iwch_ep_redirect
+};
+
+static LIST_HEAD(dev_list);
+static DEFINE_MUTEX(dev_mutex);
+
+static void rnic_init(struct iwch_dev *rnicp)
+{
+        PDBG("%s iwch_dev %p\n", __FUNCTION__,  rnicp);
+        idr_init(&rnicp->cqidr);
+        idr_init(&rnicp->qpidr);
+        idr_init(&rnicp->mmidr);
+        spin_lock_init(&rnicp->lock);
+
+        rnicp->attr.vendor_id = 0x168;
+        rnicp->attr.vendor_part_id = 7;
+        rnicp->attr.max_qps = T3_MAX_NUM_QP - 32;
+        rnicp->attr.max_wrs = (1UL << 24) - 1;
+        rnicp->attr.max_sge_per_wr = T3_MAX_SGE;
+        rnicp->attr.max_sge_per_rdma_write_wr = T3_MAX_SGE;
+        rnicp->attr.max_cqs = T3_MAX_NUM_CQ - 1;
+        rnicp->attr.max_cqes_per_cq = (1UL << 24) - 1;
+        rnicp->attr.max_mem_regs = cxio_num_stags(&rnicp->rdev);
+        rnicp->attr.max_phys_buf_entries = T3_MAX_PBL_SIZE;
+        rnicp->attr.max_pds = T3_MAX_NUM_PD - 1;
+        rnicp->attr.mem_pgsizes_bitmask = 0x7FFF;       /* 4KB-128MB */
+        rnicp->attr.can_resize_wq = 0;
+        rnicp->attr.max_rdma_reads_per_qp = 8;
+        rnicp->attr.max_rdma_read_resources =
+            rnicp->attr.max_rdma_reads_per_qp * rnicp->attr.max_qps;
+        rnicp->attr.max_rdma_read_qp_depth = 8; /* IRD */
+        rnicp->attr.max_rdma_read_depth =
+            rnicp->attr.max_rdma_read_qp_depth * rnicp->attr.max_qps;
+        rnicp->attr.rq_overflow_handled = 0;
+        rnicp->attr.can_modify_ird = 0;
+        rnicp->attr.can_modify_ord = 0;
+        rnicp->attr.max_mem_windows = rnicp->attr.max_mem_regs - 1;
+        rnicp->attr.stag0_value = 1;
+        rnicp->attr.zbva_support = 1;
+        rnicp->attr.local_invalidate_fence = 1;
+        rnicp->attr.cq_overflow_detection = 1;
+        return;
+}
+
+static void open_rnic_dev(struct t3cdev *tdev)
+{
+        struct iwch_dev *rnicp;
+        static int vers_printed;
+
+        PDBG("%s t3cdev %p\n", __FUNCTION__,  tdev);
+        if (!vers_printed++)
+                printk(KERN_INFO MOD "Chelsio T3 RDMA Driver - version %s\n",
+                       DRV_VERSION);
+        rnicp = (struct iwch_dev *)ib_alloc_device(sizeof(*rnicp));
+        if (!rnicp) {
+                printk(KERN_ERR MOD "Cannot allocate ib device\n");
+                return;
+        }
+        rnicp->rdev.ulp = rnicp;
+        rnicp->rdev.t3cdev_p = tdev;
+
+        mutex_lock(&dev_mutex);
+
+        if (cxio_rdev_open(&rnicp->rdev)) {
+                mutex_unlock(&dev_mutex);
+                printk(KERN_ERR MOD "Unable to open CXIO rdev\n");
+                ib_dealloc_device(&rnicp->ibdev);
+                return;
+        }
+
+        rnic_init(rnicp);
+
+        list_add_tail(&rnicp->entry, &dev_list);
+        mutex_unlock(&dev_mutex);
+
+        if (iwch_register_device(rnicp)) {
+                printk(KERN_ERR MOD "Unable to register device\n");
+                close_rnic_dev(tdev);
+        }
+        printk(KERN_INFO MOD "Initialized device %s\n",
+               pci_name(rnicp->rdev.rnic_info.pdev));
+        return;
+}
+
+static void close_rnic_dev(struct t3cdev *tdev)
+{
+        struct iwch_dev *dev, *tmp;
+        PDBG("%s t3cdev %p\n", __FUNCTION__,  tdev);
+        mutex_lock(&dev_mutex);
+        list_for_each_entry_safe(dev, tmp, &dev_list, entry) {
+                if (dev->rdev.t3cdev_p == tdev) {
+                        list_del(&dev->entry);
+                        iwch_unregister_device(dev);
+                        cxio_rdev_close(&dev->rdev);
+                        idr_destroy(&dev->cqidr);
+                        idr_destroy(&dev->qpidr);
+                        idr_destroy(&dev->mmidr);
+                        ib_dealloc_device(&dev->ibdev);
+                        break;
+                }
+        }
+        mutex_unlock(&dev_mutex);
+}
+
+static int __init iwch_init_module(void)
+{
+        int err;
+
+        err = cxio_hal_init();
+        if (err)
+                return err;
+        err = iwch_cm_init();
+        if (err)
+                return err;
+        cxio_register_ev_cb(iwch_ev_dispatch);
+        cxgb3_register_client(&t3c_client);
+        return 0;
+}
+
+static void __exit iwch_exit_module(void)
+{
+        cxgb3_unregister_client(&t3c_client);
+        cxio_unregister_ev_cb(iwch_ev_dispatch);
+        iwch_cm_term();
+        cxio_hal_exit();
+}
+
+module_init(iwch_init_module);
+module_exit(iwch_exit_module);
diff --git a/drivers/infiniband/hw/cxgb3/iwch.h b/drivers/infiniband/hw/cxgb3/iwch.h
new file mode 100644
index 000000000000..6517ef85026f
--- /dev/null
+++ b/drivers/infiniband/hw/cxgb3/iwch.h
@@ -0,0 +1,177 @@
+/*
+ * Copyright (c) 2006 Chelsio, Inc. All rights reserved.
+ * Copyright (c) 2006 Open Grid Computing, Inc. All rights reserved.
+ *
+ * This software is available to you under a choice of one of two
+ * licenses.  You may choose to be licensed under the terms of the GNU
+ * General Public License (GPL) Version 2, available from the file
+ * COPYING in the main directory of this source tree, or the
+ * OpenIB.org BSD license below:
+ *
+ *     Redistribution and use in source and binary forms, with or
+ *     without modification, are permitted provided that the following
+ *     conditions are met:
+ *
+ *      - Redistributions of source code must retain the above
+ *        copyright notice, this list of conditions and the following
+ *        disclaimer.
+ *
+ *      - Redistributions in binary form must reproduce the above
+ *        copyright notice, this list of conditions and the following
+ *        disclaimer in the documentation and/or other materials
+ *        provided with the distribution.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+ * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+ * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+ * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
+ * BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
+ * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
+ * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+ * SOFTWARE.
+ */
+#ifndef __IWCH_H__
+#define __IWCH_H__
+
+#include <linux/mutex.h>
+#include <linux/list.h>
+#include <linux/spinlock.h>
+#include <linux/idr.h>
+
+#include <rdma/ib_verbs.h>
+
+#include "cxio_hal.h"
+#include "cxgb3_offload.h"
+
+struct iwch_pd;
+struct iwch_cq;
+struct iwch_qp;
+struct iwch_mr;
+
+struct iwch_rnic_attributes {
+        u32 vendor_id;
+        u32 vendor_part_id;
+        u32 max_qps;
+        u32 max_wrs;                            /* Max for any SQ/RQ */
+        u32 max_sge_per_wr;
+        u32 max_sge_per_rdma_write_wr;  /* for RDMA Write WR */
+        u32 max_cqs;
+        u32 max_cqes_per_cq;
+        u32 max_mem_regs;
+        u32 max_phys_buf_entries;               /* for phys buf list */
+        u32 max_pds;
+
+        /*
+         * The memory page sizes supported by this RNIC.
+         * Bit position i in bitmap indicates page of
+         * size (4k)^i.  Phys block list mode unsupported.
+         */
+        u32 mem_pgsizes_bitmask;
+        u8 can_resize_wq;
+
+        /*
+         * The maximum number of RDMA Reads that can be outstanding
+         * per QP with this RNIC as the target.
+         */
+        u32 max_rdma_reads_per_qp;
+
+        /*
+         * The maximum number of resources used for RDMA Reads
+         * by this RNIC with this RNIC as the target.
+         */
+        u32 max_rdma_read_resources;
+
+        /*
+         * The max depth per QP for initiation of RDMA Read
+         * by this RNIC.
+         */
+        u32 max_rdma_read_qp_depth;
+
+        /*
+         * The maximum depth for initiation of RDMA Read
+         * operations by this RNIC on all QPs
+         */
+        u32 max_rdma_read_depth;
+        u8 rq_overflow_handled;
+        u32 can_modify_ird;
+        u32 can_modify_ord;
+        u32 max_mem_windows;
+        u32 stag0_value;
+        u8 zbva_support;
+        u8 local_invalidate_fence;
+        u32 cq_overflow_detection;
+};
+
+struct iwch_dev {
+        struct ib_device ibdev;
+        struct cxio_rdev rdev;
+        u32 device_cap_flags;
+        struct iwch_rnic_attributes attr;
+        struct idr cqidr;
+        struct idr qpidr;
+        struct idr mmidr;
+        spinlock_t lock;
+        struct list_head entry;
+};
+
+static inline struct iwch_dev *to_iwch_dev(struct ib_device *ibdev)
+{
+        return container_of(ibdev, struct iwch_dev, ibdev);
+}
+
+static inline int t3b_device(const struct iwch_dev *rhp)
+{
+        return rhp->rdev.t3cdev_p->type == T3B;
+}
+
+static inline int t3a_device(const struct iwch_dev *rhp)
+{
+        return rhp->rdev.t3cdev_p->type == T3A;
+}
+
+static inline struct iwch_cq *get_chp(struct iwch_dev *rhp, u32 cqid)
+{
+        return idr_find(&rhp->cqidr, cqid);
+}
+
+static inline struct iwch_qp *get_qhp(struct iwch_dev *rhp, u32 qpid)
+{
+        return idr_find(&rhp->qpidr, qpid);
+}
+
+static inline struct iwch_mr *get_mhp(struct iwch_dev *rhp, u32 mmid)
+{
+        return idr_find(&rhp->mmidr, mmid);
+}
+
+static inline int insert_handle(struct iwch_dev *rhp, struct idr *idr,
+                                void *handle, u32 id)
+{
+        int ret;
+        u32 newid;
+
+        do {
+                if (!idr_pre_get(idr, GFP_KERNEL)) {
+                        return -ENOMEM;
+                }
+                spin_lock_irq(&rhp->lock);
+                ret = idr_get_new_above(idr, handle, id, &newid);
+                BUG_ON(newid != id);
+                spin_unlock_irq(&rhp->lock);
+        } while (ret == -EAGAIN);
+
+        return ret;
+}
+
+static inline void remove_handle(struct iwch_dev *rhp, struct idr *idr, u32 id)
+{
+        spin_lock_irq(&rhp->lock);
+        idr_remove(idr, id);
+        spin_unlock_irq(&rhp->lock);
+}
+
+extern struct cxgb3_client t3c_client;
+extern cxgb3_cpl_handler_func t3c_handlers[NUM_CPL_CMDS];
+extern void iwch_ev_dispatch(struct cxio_rdev *rdev_p, struct sk_buff *skb);
+
+#endif
diff --git a/drivers/infiniband/hw/cxgb3/iwch_cm.c b/drivers/infiniband/hw/cxgb3/iwch_cm.c
new file mode 100644
index 000000000000..a522b1baa3b4
--- /dev/null
+++ b/drivers/infiniband/hw/cxgb3/iwch_cm.c
@@ -0,0 +1,2081 @@
+/*
+ * Copyright (c) 2006 Chelsio, Inc. All rights reserved.
+ * Copyright (c) 2006 Open Grid Computing, Inc. All rights reserved.
+ *
+ * This software is available to you under a choice of one of two
+ * licenses.  You may choose to be licensed under the terms of the GNU
+ * General Public License (GPL) Version 2, available from the file
+ * COPYING in the main directory of this source tree, or the
+ * OpenIB.org BSD license below:
+ *
+ *     Redistribution and use in source and binary forms, with or
+ *     without modification, are permitted provided that the following
+ *     conditions are met:
+ *
+ *      - Redistributions of source code must retain the above
+ *        copyright notice, this list of conditions and the following
+ *        disclaimer.
+ *
+ *      - Redistributions in binary form must reproduce the above
+ *        copyright notice, this list of conditions and the following
+ *        disclaimer in the documentation and/or other materials
+ *        provided with the distribution.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+ * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+ * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+ * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
+ * BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
+ * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
+ * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+ * SOFTWARE.
+ */
+#include <linux/module.h>
+#include <linux/list.h>
+#include <linux/workqueue.h>
+#include <linux/skbuff.h>
+#include <linux/timer.h>
+#include <linux/notifier.h>
+
+#include <net/neighbour.h>
+#include <net/netevent.h>
+#include <net/route.h>
+
+#include "tcb.h"
+#include "cxgb3_offload.h"
+#include "iwch.h"
+#include "iwch_provider.h"
+#include "iwch_cm.h"
+
+static char *states[] = {
+        "idle",
+        "listen",
+        "connecting",
+        "mpa_wait_req",
+        "mpa_req_sent",
+        "mpa_req_rcvd",
+        "mpa_rep_sent",
+        "fpdu_mode",
+        "aborting",
+        "closing",
+        "moribund",
+        "dead",
+        NULL,
+};
+
+static int ep_timeout_secs = 10;
+module_param(ep_timeout_secs, int, 0444);
+MODULE_PARM_DESC(ep_timeout_secs, "CM Endpoint operation timeout "
+                                   "in seconds (default=10)");
+
+static int mpa_rev = 1;
+module_param(mpa_rev, int, 0444);
+MODULE_PARM_DESC(mpa_rev, "MPA Revision, 0 supports amso1100, "
+                 "1 is spec compliant. (default=1)");
+
+static int markers_enabled = 0;
+module_param(markers_enabled, int, 0444);
+MODULE_PARM_DESC(markers_enabled, "Enable MPA MARKERS (default(0)=disabled)");
+
+static int crc_enabled = 1;
+module_param(crc_enabled, int, 0444);
+MODULE_PARM_DESC(crc_enabled, "Enable MPA CRC (default(1)=enabled)");
+
+static int rcv_win = 256 * 1024;
+module_param(rcv_win, int, 0444);
+MODULE_PARM_DESC(rcv_win, "TCP receive window in bytes (default=256)");
+
+static int snd_win = 32 * 1024;
+module_param(snd_win, int, 0444);
+MODULE_PARM_DESC(snd_win, "TCP send window in bytes (default=32KB)");
+
+static unsigned int nocong = 0;
+module_param(nocong, uint, 0444);
+MODULE_PARM_DESC(nocong, "Turn off congestion control (default=0)");
+
+static unsigned int cong_flavor = 1;
+module_param(cong_flavor, uint, 0444);
+MODULE_PARM_DESC(cong_flavor, "TCP Congestion control flavor (default=1)");
+
+static void process_work(struct work_struct *work);
+static struct workqueue_struct *workq;
+static DECLARE_WORK(skb_work, process_work);
+
+static struct sk_buff_head rxq;
+static cxgb3_cpl_handler_func work_handlers[NUM_CPL_CMDS];
+
+static struct sk_buff *get_skb(struct sk_buff *skb, int len, gfp_t gfp);
+static void ep_timeout(unsigned long arg);
+static void connect_reply_upcall(struct iwch_ep *ep, int status);
+
+static void start_ep_timer(struct iwch_ep *ep)
+{
+        PDBG("%s ep %p\n", __FUNCTION__, ep);
+        if (timer_pending(&ep->timer)) {
+                PDBG("%s stopped / restarted timer ep %p\n", __FUNCTION__, ep);
+                del_timer_sync(&ep->timer);
+        } else
+                get_ep(&ep->com);
+        ep->timer.expires = jiffies + ep_timeout_secs * HZ;
+        ep->timer.data = (unsigned long)ep;
+        ep->timer.function = ep_timeout;
+        add_timer(&ep->timer);
+}
+
+static void stop_ep_timer(struct iwch_ep *ep)
+{
+        PDBG("%s ep %p\n", __FUNCTION__, ep);
+        del_timer_sync(&ep->timer);
+        put_ep(&ep->com);
+}
+
+static void release_tid(struct t3cdev *tdev, u32 hwtid, struct sk_buff *skb)
+{
+        struct cpl_tid_release *req;
+
+        skb = get_skb(skb, sizeof *req, GFP_KERNEL);
+        if (!skb)
+                return;
+        req = (struct cpl_tid_release *) skb_put(skb, sizeof(*req));
+        req->wr.wr_hi = htonl(V_WR_OP(FW_WROPCODE_FORWARD));
+        OPCODE_TID(req) = htonl(MK_OPCODE_TID(CPL_TID_RELEASE, hwtid));
+        skb->priority = CPL_PRIORITY_SETUP;
+        tdev->send(tdev, skb);
+        return;
+}
+
+int iwch_quiesce_tid(struct iwch_ep *ep)
+{
+        struct cpl_set_tcb_field *req;
+        struct sk_buff *skb = get_skb(NULL, sizeof(*req), GFP_KERNEL);
+
+        if (!skb)
+                return -ENOMEM;
+        req = (struct cpl_set_tcb_field *) skb_put(skb, sizeof(*req));
+        req->wr.wr_hi = htonl(V_WR_OP(FW_WROPCODE_FORWARD));
+        req->wr.wr_lo = htonl(V_WR_TID(ep->hwtid));
+        OPCODE_TID(req) = htonl(MK_OPCODE_TID(CPL_SET_TCB_FIELD, ep->hwtid));
+        req->reply = 0;
+        req->cpu_idx = 0;
+        req->word = htons(W_TCB_RX_QUIESCE);
+        req->mask = cpu_to_be64(1ULL << S_TCB_RX_QUIESCE);
+        req->val = cpu_to_be64(1 << S_TCB_RX_QUIESCE);
+
+        skb->priority = CPL_PRIORITY_DATA;
+        ep->com.tdev->send(ep->com.tdev, skb);
+        return 0;
+}
+
+int iwch_resume_tid(struct iwch_ep *ep)
+{
+        struct cpl_set_tcb_field *req;
+        struct sk_buff *skb = get_skb(NULL, sizeof(*req), GFP_KERNEL);
+
+        if (!skb)
+                return -ENOMEM;
+        req = (struct cpl_set_tcb_field *) skb_put(skb, sizeof(*req));
+        req->wr.wr_hi = htonl(V_WR_OP(FW_WROPCODE_FORWARD));
+        req->wr.wr_lo = htonl(V_WR_TID(ep->hwtid));
+        OPCODE_TID(req) = htonl(MK_OPCODE_TID(CPL_SET_TCB_FIELD, ep->hwtid));
+        req->reply = 0;
+        req->cpu_idx = 0;
+        req->word = htons(W_TCB_RX_QUIESCE);
+        req->mask = cpu_to_be64(1ULL << S_TCB_RX_QUIESCE);
+        req->val = 0;
+
+        skb->priority = CPL_PRIORITY_DATA;
+        ep->com.tdev->send(ep->com.tdev, skb);
+        return 0;
+}
+
+static void set_emss(struct iwch_ep *ep, u16 opt)
+{
+        PDBG("%s ep %p opt %u\n", __FUNCTION__, ep, opt);
+        ep->emss = T3C_DATA(ep->com.tdev)->mtus[G_TCPOPT_MSS(opt)] - 40;
+        if (G_TCPOPT_TSTAMP(opt))
+                ep->emss -= 12;
+        if (ep->emss < 128)
+                ep->emss = 128;
+        PDBG("emss=%d\n", ep->emss);
+}
+
+static enum iwch_ep_state state_read(struct iwch_ep_common *epc)
+{
+        unsigned long flags;
+        enum iwch_ep_state state;
+
+        spin_lock_irqsave(&epc->lock, flags);
+        state = epc->state;
+        spin_unlock_irqrestore(&epc->lock, flags);
+        return state;
+}
+
+static inline void __state_set(struct iwch_ep_common *epc,
+                               enum iwch_ep_state new)
+{
+        epc->state = new;
+}
+
+static void state_set(struct iwch_ep_common *epc, enum iwch_ep_state new)
+{
+        unsigned long flags;
+
+        spin_lock_irqsave(&epc->lock, flags);
+        PDBG("%s - %s -> %s\n", __FUNCTION__, states[epc->state], states[new]);
+        __state_set(epc, new);
+        spin_unlock_irqrestore(&epc->lock, flags);
+        return;
+}
+
+static void *alloc_ep(int size, gfp_t gfp)
+{
+        struct iwch_ep_common *epc;
+
+        epc = kmalloc(size, gfp);
+        if (epc) {
+                memset(epc, 0, size);
+                kref_init(&epc->kref);
+                spin_lock_init(&epc->lock);
+                init_waitqueue_head(&epc->waitq);
+        }
+        PDBG("%s alloc ep %p\n", __FUNCTION__, epc);
+        return epc;
+}
+
+void __free_ep(struct kref *kref)
+{
+        struct iwch_ep_common *epc;
+        epc = container_of(kref, struct iwch_ep_common, kref);
+        PDBG("%s ep %p state %s\n", __FUNCTION__, epc, states[state_read(epc)]);
+        kfree(epc);
+}
+
+static void release_ep_resources(struct iwch_ep *ep)
+{
+        PDBG("%s ep %p tid %d\n", __FUNCTION__, ep, ep->hwtid);
+        cxgb3_remove_tid(ep->com.tdev, (void *)ep, ep->hwtid);
+        dst_release(ep->dst);
+        l2t_release(L2DATA(ep->com.tdev), ep->l2t);
+        if (ep->com.tdev->type == T3B)
+                release_tid(ep->com.tdev, ep->hwtid, NULL);
+        put_ep(&ep->com);
+}
+
+static void process_work(struct work_struct *work)
+{
+        struct sk_buff *skb = NULL;
+        void *ep;
+        struct t3cdev *tdev;
+        int ret;
+
+        while ((skb = skb_dequeue(&rxq))) {
+                ep = *((void **) (skb->cb));
+                tdev = *((struct t3cdev **) (skb->cb + sizeof(void *)));
+                ret = work_handlers[G_OPCODE(ntohl((__force __be32)skb->csum))](tdev, skb, ep);
+                if (ret & CPL_RET_BUF_DONE)
+                        kfree_skb(skb);
+
+                /*
+                 * ep was referenced in sched(), and is freed here.
+                 */
+                put_ep((struct iwch_ep_common *)ep);
+        }
+}
+
+static int status2errno(int status)
+{
+        switch (status) {
+        case CPL_ERR_NONE:
+                return 0;
+        case CPL_ERR_CONN_RESET:
+                return -ECONNRESET;
+        case CPL_ERR_ARP_MISS:
+                return -EHOSTUNREACH;
+        case CPL_ERR_CONN_TIMEDOUT:
+                return -ETIMEDOUT;
+        case CPL_ERR_TCAM_FULL:
+                return -ENOMEM;
+        case CPL_ERR_CONN_EXIST:
+                return -EADDRINUSE;
+        default:
+                return -EIO;
+        }
+}
+
+/*
+ * Try and reuse skbs already allocated...
+ */
+static struct sk_buff *get_skb(struct sk_buff *skb, int len, gfp_t gfp)
+{
+        if (skb) {
+                BUG_ON(skb_cloned(skb));
+                skb_trim(skb, 0);
+                skb_get(skb);
+        } else {
+                skb = alloc_skb(len, gfp);
+        }
+        return skb;
+}
+
+static struct rtable *find_route(struct t3cdev *dev, __be32 local_ip,
+                                 __be32 peer_ip, __be16 local_port,
+                                 __be16 peer_port, u8 tos)
+{
+        struct rtable *rt;
+        struct flowi fl = {
+                .oif = 0,
+                .nl_u = {
+                         .ip4_u = {
+                                   .daddr = peer_ip,
+                                   .saddr = local_ip,
+                                   .tos = tos}
+                         },
+                .proto = IPPROTO_TCP,
+                .uli_u = {
+                          .ports = {
+                                    .sport = local_port,
+                                    .dport = peer_port}
+                          }
+        };
+
+        if (ip_route_output_flow(&rt, &fl, NULL, 0))
+                return NULL;
+        return rt;
+}
+
+static unsigned int find_best_mtu(const struct t3c_data *d, unsigned short mtu)
+{
+        int i = 0;
+
+        while (i < d->nmtus - 1 && d->mtus[i + 1] <= mtu)
+                ++i;
+        return i;
+}
+
+static void arp_failure_discard(struct t3cdev *dev, struct sk_buff *skb)
+{
+        PDBG("%s t3cdev %p\n", __FUNCTION__, dev);
+        kfree_skb(skb);
+}
+
+/*
+ * Handle an ARP failure for an active open.
+ */
+static void act_open_req_arp_failure(struct t3cdev *dev, struct sk_buff *skb)
+{
+        printk(KERN_ERR MOD "ARP failure duing connect\n");
+        kfree_skb(skb);
+}
+
+/*
+ * Handle an ARP failure for a CPL_ABORT_REQ.  Change it into a no RST variant
+ * and send it along.
+ */
+static void abort_arp_failure(struct t3cdev *dev, struct sk_buff *skb)
+{
+        struct cpl_abort_req *req = cplhdr(skb);
+
+        PDBG("%s t3cdev %p\n", __FUNCTION__, dev);
+        req->cmd = CPL_ABORT_NO_RST;
+        cxgb3_ofld_send(dev, skb);
+}
+
+static int send_halfclose(struct iwch_ep *ep, gfp_t gfp)
+{
+        struct cpl_close_con_req *req;
+        struct sk_buff *skb;
+
+        PDBG("%s ep %p\n", __FUNCTION__, ep);
+        skb = get_skb(NULL, sizeof(*req), gfp);
+        if (!skb) {
+                printk(KERN_ERR MOD "%s - failed to alloc skb\n", __FUNCTION__);
+                return -ENOMEM;
+        }
+        skb->priority = CPL_PRIORITY_DATA;
+        set_arp_failure_handler(skb, arp_failure_discard);
+        req = (struct cpl_close_con_req *) skb_put(skb, sizeof(*req));
+        req->wr.wr_hi = htonl(V_WR_OP(FW_WROPCODE_OFLD_CLOSE_CON));
+        req->wr.wr_lo = htonl(V_WR_TID(ep->hwtid));
+        OPCODE_TID(req) = htonl(MK_OPCODE_TID(CPL_CLOSE_CON_REQ, ep->hwtid));
+        l2t_send(ep->com.tdev, skb, ep->l2t);
+        return 0;
+}
+
+static int send_abort(struct iwch_ep *ep, struct sk_buff *skb, gfp_t gfp)
+{
+        struct cpl_abort_req *req;
+
+        PDBG("%s ep %p\n", __FUNCTION__, ep);
+        skb = get_skb(skb, sizeof(*req), gfp);
+        if (!skb) {
+                printk(KERN_ERR MOD "%s - failed to alloc skb.\n",
+                       __FUNCTION__);
+                return -ENOMEM;
+        }
+        skb->priority = CPL_PRIORITY_DATA;
+        set_arp_failure_handler(skb, abort_arp_failure);
+        req = (struct cpl_abort_req *) skb_put(skb, sizeof(*req));
+        req->wr.wr_hi = htonl(V_WR_OP(FW_WROPCODE_OFLD_HOST_ABORT_CON_REQ));
+        req->wr.wr_lo = htonl(V_WR_TID(ep->hwtid));
+        OPCODE_TID(req) = htonl(MK_OPCODE_TID(CPL_ABORT_REQ, ep->hwtid));
+        req->cmd = CPL_ABORT_SEND_RST;
+        l2t_send(ep->com.tdev, skb, ep->l2t);
+        return 0;
+}
+
+static int send_connect(struct iwch_ep *ep)
+{
+        struct cpl_act_open_req *req;
+        struct sk_buff *skb;
+        u32 opt0h, opt0l, opt2;
+        unsigned int mtu_idx;
+        int wscale;
+
+        PDBG("%s ep %p\n", __FUNCTION__, ep);
+
+        skb = get_skb(NULL, sizeof(*req), GFP_KERNEL);
+        if (!skb) {
+                printk(KERN_ERR MOD "%s - failed to alloc skb.\n",
+                       __FUNCTION__);
+                return -ENOMEM;
+        }
+        mtu_idx = find_best_mtu(T3C_DATA(ep->com.tdev), dst_mtu(ep->dst));
+        wscale = compute_wscale(rcv_win);
+        opt0h = V_NAGLE(0) |
+            V_NO_CONG(nocong) |
+            V_KEEP_ALIVE(1) |
+            F_TCAM_BYPASS |
+            V_WND_SCALE(wscale) |
+            V_MSS_IDX(mtu_idx) |
+            V_L2T_IDX(ep->l2t->idx) | V_TX_CHANNEL(ep->l2t->smt_idx);
+        opt0l = V_TOS((ep->tos >> 2) & M_TOS) | V_RCV_BUFSIZ(rcv_win>>10);
+        opt2 = V_FLAVORS_VALID(1) | V_CONG_CONTROL_FLAVOR(cong_flavor);
+        skb->priority = CPL_PRIORITY_SETUP;
+        set_arp_failure_handler(skb, act_open_req_arp_failure);
+
+        req = (struct cpl_act_open_req *) skb_put(skb, sizeof(*req));
+        req->wr.wr_hi = htonl(V_WR_OP(FW_WROPCODE_FORWARD));
+        OPCODE_TID(req) = htonl(MK_OPCODE_TID(CPL_ACT_OPEN_REQ, ep->atid));
+        req->local_port = ep->com.local_addr.sin_port;
+        req->peer_port = ep->com.remote_addr.sin_port;
+        req->local_ip = ep->com.local_addr.sin_addr.s_addr;
+        req->peer_ip = ep->com.remote_addr.sin_addr.s_addr;
+        req->opt0h = htonl(opt0h);
+        req->opt0l = htonl(opt0l);
+        req->params = 0;
+        req->opt2 = htonl(opt2);
+        l2t_send(ep->com.tdev, skb, ep->l2t);
+        return 0;
+}
+
+static void send_mpa_req(struct iwch_ep *ep, struct sk_buff *skb)
+{
+        int mpalen;
+        struct tx_data_wr *req;
+        struct mpa_message *mpa;
+        int len;
+
+        PDBG("%s ep %p pd_len %d\n", __FUNCTION__, ep, ep->plen);
+
+        BUG_ON(skb_cloned(skb));
+
+        mpalen = sizeof(*mpa) + ep->plen;
+        if (skb->data + mpalen + sizeof(*req) > skb->end) {
+                kfree_skb(skb);
+                skb=alloc_skb(mpalen + sizeof(*req), GFP_KERNEL);
+                if (!skb) {
+                        connect_reply_upcall(ep, -ENOMEM);
+                        return;
+                }
+        }
+        skb_trim(skb, 0);
+        skb_reserve(skb, sizeof(*req));
+        skb_put(skb, mpalen);
+        skb->priority = CPL_PRIORITY_DATA;
+        mpa = (struct mpa_message *) skb->data;
+        memset(mpa, 0, sizeof(*mpa));
+        memcpy(mpa->key, MPA_KEY_REQ, sizeof(mpa->key));
+        mpa->flags = (crc_enabled ? MPA_CRC : 0) |
+                     (markers_enabled ? MPA_MARKERS : 0);
+        mpa->private_data_size = htons(ep->plen);
+        mpa->revision = mpa_rev;
+
+        if (ep->plen)
+                memcpy(mpa->private_data, ep->mpa_pkt + sizeof(*mpa), ep->plen);
+
+        /*
+         * Reference the mpa skb.  This ensures the data area
+         * will remain in memory until the hw acks the tx.
+         * Function tx_ack() will deref it.
+         */
+        skb_get(skb);
+        set_arp_failure_handler(skb, arp_failure_discard);
+        skb->h.raw = skb->data;
+        len = skb->len;
+        req = (struct tx_data_wr *) skb_push(skb, sizeof(*req));
+        req->wr_hi = htonl(V_WR_OP(FW_WROPCODE_OFLD_TX_DATA));
+        req->wr_lo = htonl(V_WR_TID(ep->hwtid));
+        req->len = htonl(len);
+        req->param = htonl(V_TX_PORT(ep->l2t->smt_idx) |
+                           V_TX_SNDBUF(snd_win>>15));
+        req->flags = htonl(F_TX_IMM_ACK|F_TX_INIT);
+        req->sndseq = htonl(ep->snd_seq);
+        BUG_ON(ep->mpa_skb);
+        ep->mpa_skb = skb;
+        l2t_send(ep->com.tdev, skb, ep->l2t);
+        start_ep_timer(ep);
+        state_set(&ep->com, MPA_REQ_SENT);
+        return;
+}
+
+static int send_mpa_reject(struct iwch_ep *ep, const void *pdata, u8 plen)
+{
+        int mpalen;
+        struct tx_data_wr *req;
+        struct mpa_message *mpa;
+        struct sk_buff *skb;
+
+        PDBG("%s ep %p plen %d\n", __FUNCTION__, ep, plen);
+
+        mpalen = sizeof(*mpa) + plen;
+
+        skb = get_skb(NULL, mpalen + sizeof(*req), GFP_KERNEL);
+        if (!skb) {
+                printk(KERN_ERR MOD "%s - cannot alloc skb!\n", __FUNCTION__);
+                return -ENOMEM;
+        }
+        skb_reserve(skb, sizeof(*req));
+        mpa = (struct mpa_message *) skb_put(skb, mpalen);
+        memset(mpa, 0, sizeof(*mpa));
+        memcpy(mpa->key, MPA_KEY_REP, sizeof(mpa->key));
+        mpa->flags = MPA_REJECT;
+        mpa->revision = mpa_rev;
+        mpa->private_data_size = htons(plen);
+        if (plen)
+                memcpy(mpa->private_data, pdata, plen);
+
+        /*
+         * Reference the mpa skb again.  This ensures the data area
+         * will remain in memory until the hw acks the tx.
+         * Function tx_ack() will deref it.
+         */
+        skb_get(skb);
+        skb->priority = CPL_PRIORITY_DATA;
+        set_arp_failure_handler(skb, arp_failure_discard);
+        skb->h.raw = skb->data;
+        req = (struct tx_data_wr *) skb_push(skb, sizeof(*req));
+        req->wr_hi = htonl(V_WR_OP(FW_WROPCODE_OFLD_TX_DATA));
+        req->wr_lo = htonl(V_WR_TID(ep->hwtid));
+        req->len = htonl(mpalen);
+        req->param = htonl(V_TX_PORT(ep->l2t->smt_idx) |
+                           V_TX_SNDBUF(snd_win>>15));
+        req->flags = htonl(F_TX_IMM_ACK|F_TX_INIT);
+        req->sndseq = htonl(ep->snd_seq);
+        BUG_ON(ep->mpa_skb);
+        ep->mpa_skb = skb;
+        l2t_send(ep->com.tdev, skb, ep->l2t);
+        return 0;
+}
+
+static int send_mpa_reply(struct iwch_ep *ep, const void *pdata, u8 plen)
+{
+        int mpalen;
+        struct tx_data_wr *req;
+        struct mpa_message *mpa;
+        int len;
+        struct sk_buff *skb;
+
+        PDBG("%s ep %p plen %d\n", __FUNCTION__, ep, plen);
+
+        mpalen = sizeof(*mpa) + plen;
+
+        skb = get_skb(NULL, mpalen + sizeof(*req), GFP_KERNEL);
+        if (!skb) {
+                printk(KERN_ERR MOD "%s - cannot alloc skb!\n", __FUNCTION__);
+                return -ENOMEM;
+        }
+        skb->priority = CPL_PRIORITY_DATA;
+        skb_reserve(skb, sizeof(*req));
+        mpa = (struct mpa_message *) skb_put(skb, mpalen);
+        memset(mpa, 0, sizeof(*mpa));
+        memcpy(mpa->key, MPA_KEY_REP, sizeof(mpa->key));
+        mpa->flags = (ep->mpa_attr.crc_enabled ? MPA_CRC : 0) |
+                     (markers_enabled ? MPA_MARKERS : 0);
+        mpa->revision = mpa_rev;
+        mpa->private_data_size = htons(plen);
+        if (plen)
+                memcpy(mpa->private_data, pdata, plen);
+
+        /*
+         * Reference the mpa skb.  This ensures the data area
+         * will remain in memory until the hw acks the tx.
+         * Function tx_ack() will deref it.
+         */
+        skb_get(skb);
+        set_arp_failure_handler(skb, arp_failure_discard);
+        skb->h.raw = skb->data;
+        len = skb->len;
+        req = (struct tx_data_wr *) skb_push(skb, sizeof(*req));
+        req->wr_hi = htonl(V_WR_OP(FW_WROPCODE_OFLD_TX_DATA));
+        req->wr_lo = htonl(V_WR_TID(ep->hwtid));
+        req->len = htonl(len);
+        req->param = htonl(V_TX_PORT(ep->l2t->smt_idx) |
+                           V_TX_SNDBUF(snd_win>>15));
+        req->flags = htonl(F_TX_MORE | F_TX_IMM_ACK | F_TX_INIT);
+        req->sndseq = htonl(ep->snd_seq);
+        ep->mpa_skb = skb;
+        state_set(&ep->com, MPA_REP_SENT);
+        l2t_send(ep->com.tdev, skb, ep->l2t);
+        return 0;
+}
+
+static int act_establish(struct t3cdev *tdev, struct sk_buff *skb, void *ctx)
+{
+        struct iwch_ep *ep = ctx;
+        struct cpl_act_establish *req = cplhdr(skb);
+        unsigned int tid = GET_TID(req);
+
+        PDBG("%s ep %p tid %d\n", __FUNCTION__, ep, tid);
+
+        dst_confirm(ep->dst);
+
+        /* setup the hwtid for this connection */
+        ep->hwtid = tid;
+        cxgb3_insert_tid(ep->com.tdev, &t3c_client, ep, tid);
+
+        ep->snd_seq = ntohl(req->snd_isn);
+
+        set_emss(ep, ntohs(req->tcp_opt));
+
+        /* dealloc the atid */
+        cxgb3_free_atid(ep->com.tdev, ep->atid);
+
+        /* start MPA negotiation */
+        send_mpa_req(ep, skb);
+
+        return 0;
+}
+
+static void abort_connection(struct iwch_ep *ep, struct sk_buff *skb, gfp_t gfp)
+{
+        PDBG("%s ep %p\n", __FILE__, ep);
+        state_set(&ep->com, ABORTING);
+        send_abort(ep, skb, gfp);
+}
+
+static void close_complete_upcall(struct iwch_ep *ep)
+{
+        struct iw_cm_event event;
+
+        PDBG("%s ep %p\n", __FUNCTION__, ep);
+        memset(&event, 0, sizeof(event));
+        event.event = IW_CM_EVENT_CLOSE;
+        if (ep->com.cm_id) {
+                PDBG("close complete delivered ep %p cm_id %p tid %d\n",
+                     ep, ep->com.cm_id, ep->hwtid);
+                ep->com.cm_id->event_handler(ep->com.cm_id, &event);
+                ep->com.cm_id->rem_ref(ep->com.cm_id);
+                ep->com.cm_id = NULL;
+                ep->com.qp = NULL;
+        }
+}
+
+static void peer_close_upcall(struct iwch_ep *ep)
+{
+        struct iw_cm_event event;
+
+        PDBG("%s ep %p\n", __FUNCTION__, ep);
+        memset(&event, 0, sizeof(event));
+        event.event = IW_CM_EVENT_DISCONNECT;
+        if (ep->com.cm_id) {
+                PDBG("peer close delivered ep %p cm_id %p tid %d\n",
+                     ep, ep->com.cm_id, ep->hwtid);
+                ep->com.cm_id->event_handler(ep->com.cm_id, &event);
+        }
+}
+
+static void peer_abort_upcall(struct iwch_ep *ep)
+{
+        struct iw_cm_event event;
+
+        PDBG("%s ep %p\n", __FUNCTION__, ep);
+        memset(&event, 0, sizeof(event));
+        event.event = IW_CM_EVENT_CLOSE;
+        event.status = -ECONNRESET;
+        if (ep->com.cm_id) {
+                PDBG("abort delivered ep %p cm_id %p tid %d\n", ep,
+                     ep->com.cm_id, ep->hwtid);
+                ep->com.cm_id->event_handler(ep->com.cm_id, &event);
+                ep->com.cm_id->rem_ref(ep->com.cm_id);
+                ep->com.cm_id = NULL;
+                ep->com.qp = NULL;
+        }
+}
+
+static void connect_reply_upcall(struct iwch_ep *ep, int status)
+{
+        struct iw_cm_event event;
+
+        PDBG("%s ep %p status %d\n", __FUNCTION__, ep, status);
+        memset(&event, 0, sizeof(event));
+        event.event = IW_CM_EVENT_CONNECT_REPLY;
+        event.status = status;
+        event.local_addr = ep->com.local_addr;
+        event.remote_addr = ep->com.remote_addr;
+
+        if ((status == 0) || (status == -ECONNREFUSED)) {
+                event.private_data_len = ep->plen;
+                event.private_data = ep->mpa_pkt + sizeof(struct mpa_message);
+        }
+        if (ep->com.cm_id) {
+                PDBG("%s ep %p tid %d status %d\n", __FUNCTION__, ep,
+                     ep->hwtid, status);
+                ep->com.cm_id->event_handler(ep->com.cm_id, &event);
+        }
+        if (status < 0) {
+                ep->com.cm_id->rem_ref(ep->com.cm_id);
+                ep->com.cm_id = NULL;
+                ep->com.qp = NULL;
+        }
+}
+
+static void connect_request_upcall(struct iwch_ep *ep)
+{
+        struct iw_cm_event event;
+
+        PDBG("%s ep %p tid %d\n", __FUNCTION__, ep, ep->hwtid);
+        memset(&event, 0, sizeof(event));
+        event.event = IW_CM_EVENT_CONNECT_REQUEST;
+        event.local_addr = ep->com.local_addr;
+        event.remote_addr = ep->com.remote_addr;
+        event.private_data_len = ep->plen;
+        event.private_data = ep->mpa_pkt + sizeof(struct mpa_message);
+        event.provider_data = ep;
+        if (state_read(&ep->parent_ep->com) != DEAD)
+                ep->parent_ep->com.cm_id->event_handler(
+                                                ep->parent_ep->com.cm_id,
+                                                &event);
+        put_ep(&ep->parent_ep->com);
+        ep->parent_ep = NULL;
+}
+
+static void established_upcall(struct iwch_ep *ep)
+{
+        struct iw_cm_event event;
+
+        PDBG("%s ep %p\n", __FUNCTION__, ep);
+        memset(&event, 0, sizeof(event));
+        event.event = IW_CM_EVENT_ESTABLISHED;
+        if (ep->com.cm_id) {
+                PDBG("%s ep %p tid %d\n", __FUNCTION__, ep, ep->hwtid);
+                ep->com.cm_id->event_handler(ep->com.cm_id, &event);
+        }
+}
+
+static int update_rx_credits(struct iwch_ep *ep, u32 credits)
+{
+        struct cpl_rx_data_ack *req;
+        struct sk_buff *skb;
+
+        PDBG("%s ep %p credits %u\n", __FUNCTION__, ep, credits);
+        skb = get_skb(NULL, sizeof(*req), GFP_KERNEL);
+        if (!skb) {
+                printk(KERN_ERR MOD "update_rx_credits - cannot alloc skb!\n");
+                return 0;
+        }
+
+        req = (struct cpl_rx_data_ack *) skb_put(skb, sizeof(*req));
+        req->wr.wr_hi = htonl(V_WR_OP(FW_WROPCODE_FORWARD));
+        OPCODE_TID(req) = htonl(MK_OPCODE_TID(CPL_RX_DATA_ACK, ep->hwtid));
+        req->credit_dack = htonl(V_RX_CREDITS(credits) | V_RX_FORCE_ACK(1));
+        skb->priority = CPL_PRIORITY_ACK;
+        ep->com.tdev->send(ep->com.tdev, skb);
+        return credits;
+}
+
+static void process_mpa_reply(struct iwch_ep *ep, struct sk_buff *skb)
+{
+        struct mpa_message *mpa;
+        u16 plen;
+        struct iwch_qp_attributes attrs;
+        enum iwch_qp_attr_mask mask;
+        int err;
+
+        PDBG("%s ep %p\n", __FUNCTION__, ep);
+
+        /*
+         * Stop mpa timer.  If it expired, then the state has
+         * changed and we bail since ep_timeout already aborted
+         * the connection.
+         */
+        stop_ep_timer(ep);
+        if (state_read(&ep->com) != MPA_REQ_SENT)
+                return;
+
+        /*
+         * If we get more than the supported amount of private data
+         * then we must fail this connection.
+         */
+        if (ep->mpa_pkt_len + skb->len > sizeof(ep->mpa_pkt)) {
+                err = -EINVAL;
+                goto err;
+        }
+
+        /*
+         * copy the new data into our accumulation buffer.
+         */
+        memcpy(&(ep->mpa_pkt[ep->mpa_pkt_len]), skb->data, skb->len);
+        ep->mpa_pkt_len += skb->len;
+
+        /*
+         * if we don't even have the mpa message, then bail.
+         */
+        if (ep->mpa_pkt_len < sizeof(*mpa))
+                return;
+        mpa = (struct mpa_message *) ep->mpa_pkt;
+
+        /* Validate MPA header. */
+        if (mpa->revision != mpa_rev) {
+                err = -EPROTO;
+                goto err;
+        }
+        if (memcmp(mpa->key, MPA_KEY_REP, sizeof(mpa->key))) {
+                err = -EPROTO;
+                goto err;
+        }
+
+        plen = ntohs(mpa->private_data_size);
+
+        /*
+         * Fail if there's too much private data.
+         */
+        if (plen > MPA_MAX_PRIVATE_DATA) {
+                err = -EPROTO;
+                goto err;
+        }
+
+        /*
+         * If plen does not account for pkt size
+         */
+        if (ep->mpa_pkt_len > (sizeof(*mpa) + plen)) {
+                err = -EPROTO;
+                goto err;
+        }
+
+        ep->plen = (u8) plen;
+
+        /*
+         * If we don't have all the pdata yet, then bail.
+         * We'll continue process when more data arrives.
+         */
+        if (ep->mpa_pkt_len < (sizeof(*mpa) + plen))
+                return;
+
+        if (mpa->flags & MPA_REJECT) {
+                err = -ECONNREFUSED;
+                goto err;
+        }
+
+        /*
+         * If we get here we have accumulated the entire mpa
+         * start reply message including private data. And
+         * the MPA header is valid.
+         */
+        state_set(&ep->com, FPDU_MODE);
+        ep->mpa_attr.crc_enabled = (mpa->flags & MPA_CRC) | crc_enabled ? 1 : 0;
+        ep->mpa_attr.recv_marker_enabled = markers_enabled;
+        ep->mpa_attr.xmit_marker_enabled = mpa->flags & MPA_MARKERS ? 1 : 0;
+        ep->mpa_attr.version = mpa_rev;
+        PDBG("%s - crc_enabled=%d, recv_marker_enabled=%d, "
+             "xmit_marker_enabled=%d, version=%d\n", __FUNCTION__,
+             ep->mpa_attr.crc_enabled, ep->mpa_attr.recv_marker_enabled,
+             ep->mpa_attr.xmit_marker_enabled, ep->mpa_attr.version);
+
+        attrs.mpa_attr = ep->mpa_attr;
+        attrs.max_ird = ep->ird;
+        attrs.max_ord = ep->ord;
+        attrs.llp_stream_handle = ep;
+        attrs.next_state = IWCH_QP_STATE_RTS;
+
+        mask = IWCH_QP_ATTR_NEXT_STATE |
+            IWCH_QP_ATTR_LLP_STREAM_HANDLE | IWCH_QP_ATTR_MPA_ATTR |
+            IWCH_QP_ATTR_MAX_IRD | IWCH_QP_ATTR_MAX_ORD;
+
+        /* bind QP and TID with INIT_WR */
+        err = iwch_modify_qp(ep->com.qp->rhp,
+                             ep->com.qp, mask, &attrs, 1);
+        if (!err)
+                goto out;
+err:
+        abort_connection(ep, skb, GFP_KERNEL);
+out:
+        connect_reply_upcall(ep, err);
+        return;
+}
+
+static void process_mpa_request(struct iwch_ep *ep, struct sk_buff *skb)
+{
+        struct mpa_message *mpa;
+        u16 plen;
+
+        PDBG("%s ep %p\n", __FUNCTION__, ep);
+
+        /*
+         * Stop mpa timer.  If it expired, then the state has
+         * changed and we bail since ep_timeout already aborted
+         * the connection.
+         */
+        stop_ep_timer(ep);
+        if (state_read(&ep->com) != MPA_REQ_WAIT)
+                return;
+
+        /*
+         * If we get more than the supported amount of private data
+         * then we must fail this connection.
+         */
+        if (ep->mpa_pkt_len + skb->len > sizeof(ep->mpa_pkt)) {
+                abort_connection(ep, skb, GFP_KERNEL);
+                return;
+        }
+
+        PDBG("%s enter (%s line %u)\n", __FUNCTION__, __FILE__, __LINE__);
+
+        /*
+         * Copy the new data into our accumulation buffer.
+         */
+        memcpy(&(ep->mpa_pkt[ep->mpa_pkt_len]), skb->data, skb->len);
+        ep->mpa_pkt_len += skb->len;
+
+        /*
+         * If we don't even have the mpa message, then bail.
+         * We'll continue process when more data arrives.
+         */
+        if (ep->mpa_pkt_len < sizeof(*mpa))
+                return;
+        PDBG("%s enter (%s line %u)\n", __FUNCTION__, __FILE__, __LINE__);
+        mpa = (struct mpa_message *) ep->mpa_pkt;
+
+        /*
+         * Validate MPA Header.
+         */
+        if (mpa->revision != mpa_rev) {
+                abort_connection(ep, skb, GFP_KERNEL);
+                return;
+        }
+
+        if (memcmp(mpa->key, MPA_KEY_REQ, sizeof(mpa->key))) {
+                abort_connection(ep, skb, GFP_KERNEL);
+                return;
+        }
+
+        plen = ntohs(mpa->private_data_size);
+
+        /*
+         * Fail if there's too much private data.
+         */
+        if (plen > MPA_MAX_PRIVATE_DATA) {
+                abort_connection(ep, skb, GFP_KERNEL);
+                return;
+        }
+
+        /*
+         * If plen does not account for pkt size
+         */
+        if (ep->mpa_pkt_len > (sizeof(*mpa) + plen)) {
+                abort_connection(ep, skb, GFP_KERNEL);
+                return;
+        }
+        ep->plen = (u8) plen;
+
+        /*
+         * If we don't have all the pdata yet, then bail.
+         */
+        if (ep->mpa_pkt_len < (sizeof(*mpa) + plen))
+                return;
+
+        /*
+         * If we get here we have accumulated the entire mpa
+         * start reply message including private data.
+         */
+        ep->mpa_attr.crc_enabled = (mpa->flags & MPA_CRC) | crc_enabled ? 1 : 0;
+        ep->mpa_attr.recv_marker_enabled = markers_enabled;
+        ep->mpa_attr.xmit_marker_enabled = mpa->flags & MPA_MARKERS ? 1 : 0;
+        ep->mpa_attr.version = mpa_rev;
+        PDBG("%s - crc_enabled=%d, recv_marker_enabled=%d, "
+             "xmit_marker_enabled=%d, version=%d\n", __FUNCTION__,
+             ep->mpa_attr.crc_enabled, ep->mpa_attr.recv_marker_enabled,
+             ep->mpa_attr.xmit_marker_enabled, ep->mpa_attr.version);
+
+        state_set(&ep->com, MPA_REQ_RCVD);
+
+        /* drive upcall */
+        connect_request_upcall(ep);
+        return;
+}
+
+static int rx_data(struct t3cdev *tdev, struct sk_buff *skb, void *ctx)
+{
+        struct iwch_ep *ep = ctx;
+        struct cpl_rx_data *hdr = cplhdr(skb);
+        unsigned int dlen = ntohs(hdr->len);
+
+        PDBG("%s ep %p dlen %u\n", __FUNCTION__, ep, dlen);
+
+        skb_pull(skb, sizeof(*hdr));
+        skb_trim(skb, dlen);
+
+        switch (state_read(&ep->com)) {
+        case MPA_REQ_SENT:
+                process_mpa_reply(ep, skb);
+                break;
+        case MPA_REQ_WAIT:
+                process_mpa_request(ep, skb);
+                break;
+        case MPA_REP_SENT:
+                break;
+        default:
+                printk(KERN_ERR MOD "%s Unexpected streaming data."
+                       " ep %p state %d tid %d\n",
+                       __FUNCTION__, ep, state_read(&ep->com), ep->hwtid);
+
+                /*
+                 * The ep will timeout and inform the ULP of the failure.
+                 * See ep_timeout().
+                 */
+                break;
+        }
+
+        /* update RX credits */
+        update_rx_credits(ep, dlen);
+
+        return CPL_RET_BUF_DONE;
+}
+
+/*
+ * Upcall from the adapter indicating data has been transmitted.
+ * For us its just the single MPA request or reply.  We can now free
+ * the skb holding the mpa message.
+ */
+static int tx_ack(struct t3cdev *tdev, struct sk_buff *skb, void *ctx)
+{
+        struct iwch_ep *ep = ctx;
+        struct cpl_wr_ack *hdr = cplhdr(skb);
+        unsigned int credits = ntohs(hdr->credits);
+        enum iwch_qp_attr_mask  mask;
+
+        PDBG("%s ep %p credits %u\n", __FUNCTION__, ep, credits);
+
+        if (credits == 0)
+                return CPL_RET_BUF_DONE;
+        BUG_ON(credits != 1);
+        BUG_ON(ep->mpa_skb == NULL);
+        kfree_skb(ep->mpa_skb);
+        ep->mpa_skb = NULL;
+        dst_confirm(ep->dst);
+        if (state_read(&ep->com) == MPA_REP_SENT) {
+                struct iwch_qp_attributes attrs;
+
+                /* bind QP to EP and move to RTS */
+                attrs.mpa_attr = ep->mpa_attr;
+                attrs.max_ird = ep->ord;
+                attrs.max_ord = ep->ord;
+                attrs.llp_stream_handle = ep;
+                attrs.next_state = IWCH_QP_STATE_RTS;
+
+                /* bind QP and TID with INIT_WR */
+                mask = IWCH_QP_ATTR_NEXT_STATE |
+                                     IWCH_QP_ATTR_LLP_STREAM_HANDLE |
+                                     IWCH_QP_ATTR_MPA_ATTR |
+                                     IWCH_QP_ATTR_MAX_IRD |
+                                     IWCH_QP_ATTR_MAX_ORD;
+
+                ep->com.rpl_err = iwch_modify_qp(ep->com.qp->rhp,
+                                     ep->com.qp, mask, &attrs, 1);
+
+                if (!ep->com.rpl_err) {
+                        state_set(&ep->com, FPDU_MODE);
+                        established_upcall(ep);
+                }
+
+                ep->com.rpl_done = 1;
+                PDBG("waking up ep %p\n", ep);
+                wake_up(&ep->com.waitq);
+        }
+        return CPL_RET_BUF_DONE;
+}
+
+static int abort_rpl(struct t3cdev *tdev, struct sk_buff *skb, void *ctx)
+{
+        struct iwch_ep *ep = ctx;
+
+        PDBG("%s ep %p\n", __FUNCTION__, ep);
+
+        close_complete_upcall(ep);
+        state_set(&ep->com, DEAD);
+        release_ep_resources(ep);
+        return CPL_RET_BUF_DONE;
+}
+
+static int act_open_rpl(struct t3cdev *tdev, struct sk_buff *skb, void *ctx)
+{
+        struct iwch_ep *ep = ctx;
+        struct cpl_act_open_rpl *rpl = cplhdr(skb);
+
+        PDBG("%s ep %p status %u errno %d\n", __FUNCTION__, ep, rpl->status,
+             status2errno(rpl->status));
+        connect_reply_upcall(ep, status2errno(rpl->status));
+        state_set(&ep->com, DEAD);
+        if (ep->com.tdev->type == T3B)
+                release_tid(ep->com.tdev, GET_TID(rpl), NULL);
+        cxgb3_free_atid(ep->com.tdev, ep->atid);
+        dst_release(ep->dst);
+        l2t_release(L2DATA(ep->com.tdev), ep->l2t);
+        put_ep(&ep->com);
+        return CPL_RET_BUF_DONE;
+}
+
+static int listen_start(struct iwch_listen_ep *ep)
+{
+        struct sk_buff *skb;
+        struct cpl_pass_open_req *req;
+
+        PDBG("%s ep %p\n", __FUNCTION__, ep);
+        skb = get_skb(NULL, sizeof(*req), GFP_KERNEL);
+        if (!skb) {
+                printk(KERN_ERR MOD "t3c_listen_start failed to alloc skb!\n");
+                return -ENOMEM;
+        }
+
+        req = (struct cpl_pass_open_req *) skb_put(skb, sizeof(*req));
+        req->wr.wr_hi = htonl(V_WR_OP(FW_WROPCODE_FORWARD));
+        OPCODE_TID(req) = htonl(MK_OPCODE_TID(CPL_PASS_OPEN_REQ, ep->stid));
+        req->local_port = ep->com.local_addr.sin_port;
+        req->local_ip = ep->com.local_addr.sin_addr.s_addr;
+        req->peer_port = 0;
+        req->peer_ip = 0;
+        req->peer_netmask = 0;
+        req->opt0h = htonl(F_DELACK | F_TCAM_BYPASS);
+        req->opt0l = htonl(V_RCV_BUFSIZ(rcv_win>>10));
+        req->opt1 = htonl(V_CONN_POLICY(CPL_CONN_POLICY_ASK));
+
+        skb->priority = 1;
+        ep->com.tdev->send(ep->com.tdev, skb);
+        return 0;
+}
+
+static int pass_open_rpl(struct t3cdev *tdev, struct sk_buff *skb, void *ctx)
+{
+        struct iwch_listen_ep *ep = ctx;
+        struct cpl_pass_open_rpl *rpl = cplhdr(skb);
+
+        PDBG("%s ep %p status %d error %d\n", __FUNCTION__, ep,
+             rpl->status, status2errno(rpl->status));
+        ep->com.rpl_err = status2errno(rpl->status);
+        ep->com.rpl_done = 1;
+        wake_up(&ep->com.waitq);
+
+        return CPL_RET_BUF_DONE;
+}
+
+static int listen_stop(struct iwch_listen_ep *ep)
+{
+        struct sk_buff *skb;
+        struct cpl_close_listserv_req *req;
+
+        PDBG("%s ep %p\n", __FUNCTION__, ep);
+        skb = get_skb(NULL, sizeof(*req), GFP_KERNEL);
+        if (!skb) {
+                printk(KERN_ERR MOD "%s - failed to alloc skb\n", __FUNCTION__);
+                return -ENOMEM;
+        }
+        req = (struct cpl_close_listserv_req *) skb_put(skb, sizeof(*req));
+        req->wr.wr_hi = htonl(V_WR_OP(FW_WROPCODE_FORWARD));
+        OPCODE_TID(req) = htonl(MK_OPCODE_TID(CPL_CLOSE_LISTSRV_REQ, ep->stid));
+        skb->priority = 1;
+        ep->com.tdev->send(ep->com.tdev, skb);
+        return 0;
+}
+
+static int close_listsrv_rpl(struct t3cdev *tdev, struct sk_buff *skb,
+                             void *ctx)
+{
+        struct iwch_listen_ep *ep = ctx;
+        struct cpl_close_listserv_rpl *rpl = cplhdr(skb);
+
+        PDBG("%s ep %p\n", __FUNCTION__, ep);
+        ep->com.rpl_err = status2errno(rpl->status);
+        ep->com.rpl_done = 1;
+        wake_up(&ep->com.waitq);
+        return CPL_RET_BUF_DONE;
+}
+
+static void accept_cr(struct iwch_ep *ep, __be32 peer_ip, struct sk_buff *skb)
+{
+        struct cpl_pass_accept_rpl *rpl;
+        unsigned int mtu_idx;
+        u32 opt0h, opt0l, opt2;
+        int wscale;
+
+        PDBG("%s ep %p\n", __FUNCTION__, ep);
+        BUG_ON(skb_cloned(skb));
+        skb_trim(skb, sizeof(*rpl));
+        skb_get(skb);
+        mtu_idx = find_best_mtu(T3C_DATA(ep->com.tdev), dst_mtu(ep->dst));
+        wscale = compute_wscale(rcv_win);
+        opt0h = V_NAGLE(0) |
+            V_NO_CONG(nocong) |
+            V_KEEP_ALIVE(1) |
+            F_TCAM_BYPASS |
+            V_WND_SCALE(wscale) |
+            V_MSS_IDX(mtu_idx) |
+            V_L2T_IDX(ep->l2t->idx) | V_TX_CHANNEL(ep->l2t->smt_idx);
+        opt0l = V_TOS((ep->tos >> 2) & M_TOS) | V_RCV_BUFSIZ(rcv_win>>10);
+        opt2 = V_FLAVORS_VALID(1) | V_CONG_CONTROL_FLAVOR(cong_flavor);
+
+        rpl = cplhdr(skb);
+        rpl->wr.wr_hi = htonl(V_WR_OP(FW_WROPCODE_FORWARD));
+        OPCODE_TID(rpl) = htonl(MK_OPCODE_TID(CPL_PASS_ACCEPT_RPL, ep->hwtid));
+        rpl->peer_ip = peer_ip;
+        rpl->opt0h = htonl(opt0h);
+        rpl->opt0l_status = htonl(opt0l | CPL_PASS_OPEN_ACCEPT);
+        rpl->opt2 = htonl(opt2);
+        rpl->rsvd = rpl->opt2;  /* workaround for HW bug */
+        skb->priority = CPL_PRIORITY_SETUP;
+        l2t_send(ep->com.tdev, skb, ep->l2t);
+
+        return;
+}
+
+static void reject_cr(struct t3cdev *tdev, u32 hwtid, __be32 peer_ip,
+                      struct sk_buff *skb)
+{
+        PDBG("%s t3cdev %p tid %u peer_ip %x\n", __FUNCTION__, tdev, hwtid,
+             peer_ip);
+        BUG_ON(skb_cloned(skb));
+        skb_trim(skb, sizeof(struct cpl_tid_release));
+        skb_get(skb);
+
+        if (tdev->type == T3B)
+                release_tid(tdev, hwtid, skb);
+        else {
+                struct cpl_pass_accept_rpl *rpl;
+
+                rpl = cplhdr(skb);
+                skb->priority = CPL_PRIORITY_SETUP;
+                rpl->wr.wr_hi = htonl(V_WR_OP(FW_WROPCODE_FORWARD));
+                OPCODE_TID(rpl) = htonl(MK_OPCODE_TID(CPL_PASS_ACCEPT_RPL,
+                                                      hwtid));
+                rpl->peer_ip = peer_ip;
+                rpl->opt0h = htonl(F_TCAM_BYPASS);
+                rpl->opt0l_status = htonl(CPL_PASS_OPEN_REJECT);
+                rpl->opt2 = 0;
+                rpl->rsvd = rpl->opt2;
+                tdev->send(tdev, skb);
+        }
+}
+
+static int pass_accept_req(struct t3cdev *tdev, struct sk_buff *skb, void *ctx)
+{
+        struct iwch_ep *child_ep, *parent_ep = ctx;
+        struct cpl_pass_accept_req *req = cplhdr(skb);
+        unsigned int hwtid = GET_TID(req);
+        struct dst_entry *dst;
+        struct l2t_entry *l2t;
+        struct rtable *rt;
+        struct iff_mac tim;
+
+        PDBG("%s parent ep %p tid %u\n", __FUNCTION__, parent_ep, hwtid);
+
+        if (state_read(&parent_ep->com) != LISTEN) {
+                printk(KERN_ERR "%s - listening ep not in LISTEN\n",
+                       __FUNCTION__);
+                goto reject;
+        }
+
+        /*
+         * Find the netdev for this connection request.
+         */
+        tim.mac_addr = req->dst_mac;
+        tim.vlan_tag = ntohs(req->vlan_tag);
+        if (tdev->ctl(tdev, GET_IFF_FROM_MAC, &tim) < 0 || !tim.dev) {
+                printk(KERN_ERR
+                        "%s bad dst mac %02x %02x %02x %02x %02x %02x\n",
+                        __FUNCTION__,
+                        req->dst_mac[0],
+                        req->dst_mac[1],
+                        req->dst_mac[2],
+                        req->dst_mac[3],
+                        req->dst_mac[4],
+                        req->dst_mac[5]);
+                goto reject;
+        }
+
+        /* Find output route */
+        rt = find_route(tdev,
+                        req->local_ip,
+                        req->peer_ip,
+                        req->local_port,
+                        req->peer_port, G_PASS_OPEN_TOS(ntohl(req->tos_tid)));
+        if (!rt) {
+                printk(KERN_ERR MOD "%s - failed to find dst entry!\n",
+                       __FUNCTION__);
+                goto reject;
+        }
+        dst = &rt->u.dst;
+        l2t = t3_l2t_get(tdev, dst->neighbour, dst->neighbour->dev);
+        if (!l2t) {
+                printk(KERN_ERR MOD "%s - failed to allocate l2t entry!\n",
+                       __FUNCTION__);
+                dst_release(dst);
+                goto reject;
+        }
+        child_ep = alloc_ep(sizeof(*child_ep), GFP_KERNEL);
+        if (!child_ep) {
+                printk(KERN_ERR MOD "%s - failed to allocate ep entry!\n",
+                       __FUNCTION__);
+                l2t_release(L2DATA(tdev), l2t);
+                dst_release(dst);
+                goto reject;
+        }
+        state_set(&child_ep->com, CONNECTING);
+        child_ep->com.tdev = tdev;
+        child_ep->com.cm_id = NULL;
+        child_ep->com.local_addr.sin_family = PF_INET;
+        child_ep->com.local_addr.sin_port = req->local_port;
+        child_ep->com.local_addr.sin_addr.s_addr = req->local_ip;
+        child_ep->com.remote_addr.sin_family = PF_INET;
+        child_ep->com.remote_addr.sin_port = req->peer_port;
+        child_ep->com.remote_addr.sin_addr.s_addr = req->peer_ip;
+        get_ep(&parent_ep->com);
+        child_ep->parent_ep = parent_ep;
+        child_ep->tos = G_PASS_OPEN_TOS(ntohl(req->tos_tid));
+        child_ep->l2t = l2t;
+        child_ep->dst = dst;
+        child_ep->hwtid = hwtid;
+        init_timer(&child_ep->timer);
+        cxgb3_insert_tid(tdev, &t3c_client, child_ep, hwtid);
+        accept_cr(child_ep, req->peer_ip, skb);
+        goto out;
+reject:
+        reject_cr(tdev, hwtid, req->peer_ip, skb);
+out:
+        return CPL_RET_BUF_DONE;
+}
+
+static int pass_establish(struct t3cdev *tdev, struct sk_buff *skb, void *ctx)
+{
+        struct iwch_ep *ep = ctx;
+        struct cpl_pass_establish *req = cplhdr(skb);
+
+        PDBG("%s ep %p\n", __FUNCTION__, ep);
+        ep->snd_seq = ntohl(req->snd_isn);
+
+        set_emss(ep, ntohs(req->tcp_opt));
+
+        dst_confirm(ep->dst);
+        state_set(&ep->com, MPA_REQ_WAIT);
+        start_ep_timer(ep);
+
+        return CPL_RET_BUF_DONE;
+}
+
+static int peer_close(struct t3cdev *tdev, struct sk_buff *skb, void *ctx)
+{
+        struct iwch_ep *ep = ctx;
+        struct iwch_qp_attributes attrs;
+        unsigned long flags;
+        int disconnect = 1;
+        int release = 0;
+
+        PDBG("%s ep %p\n", __FUNCTION__, ep);
+        dst_confirm(ep->dst);
+
+        spin_lock_irqsave(&ep->com.lock, flags);
+        switch (ep->com.state) {
+        case MPA_REQ_WAIT:
+                __state_set(&ep->com, CLOSING);
+                break;
+        case MPA_REQ_SENT:
+                __state_set(&ep->com, CLOSING);
+                connect_reply_upcall(ep, -ECONNRESET);
+                break;
+        case MPA_REQ_RCVD:
+
+                /*
+                 * We're gonna mark this puppy DEAD, but keep
+                 * the reference on it until the ULP accepts or
+                 * rejects the CR.
+                 */
+                __state_set(&ep->com, CLOSING);
+                get_ep(&ep->com);
+                break;
+        case MPA_REP_SENT:
+                __state_set(&ep->com, CLOSING);
+                ep->com.rpl_done = 1;
+                ep->com.rpl_err = -ECONNRESET;
+                PDBG("waking up ep %p\n", ep);
+                wake_up(&ep->com.waitq);
+                break;
+        case FPDU_MODE:
+                __state_set(&ep->com, CLOSING);
+                attrs.next_state = IWCH_QP_STATE_CLOSING;
+                iwch_modify_qp(ep->com.qp->rhp, ep->com.qp,
+                               IWCH_QP_ATTR_NEXT_STATE, &attrs, 1);
+                peer_close_upcall(ep);
+                break;
+        case ABORTING:
+                disconnect = 0;
+                break;
+        case CLOSING:
+                start_ep_timer(ep);
+                __state_set(&ep->com, MORIBUND);
+                disconnect = 0;
+                break;
+        case MORIBUND:
+                stop_ep_timer(ep);
+                if (ep->com.cm_id && ep->com.qp) {
+                        attrs.next_state = IWCH_QP_STATE_IDLE;
+                        iwch_modify_qp(ep->com.qp->rhp, ep->com.qp,
+                                       IWCH_QP_ATTR_NEXT_STATE, &attrs, 1);
+                }
+                close_complete_upcall(ep);
+                __state_set(&ep->com, DEAD);
+                release = 1;
+                disconnect = 0;
+                break;
+        case DEAD:
+                disconnect = 0;
+                break;
+        default:
+                BUG_ON(1);
+        }
+        spin_unlock_irqrestore(&ep->com.lock, flags);
+        if (disconnect)
+                iwch_ep_disconnect(ep, 0, GFP_KERNEL);
+        if (release)
+                release_ep_resources(ep);
+        return CPL_RET_BUF_DONE;
+}
+
+/*
+ * Returns whether an ABORT_REQ_RSS message is a negative advice.
+ */
+static inline int is_neg_adv_abort(unsigned int status)
+{
+        return status == CPL_ERR_RTX_NEG_ADVICE ||
+               status == CPL_ERR_PERSIST_NEG_ADVICE;
+}
+
+static int peer_abort(struct t3cdev *tdev, struct sk_buff *skb, void *ctx)
+{
+        struct cpl_abort_req_rss *req = cplhdr(skb);
+        struct iwch_ep *ep = ctx;
+        struct cpl_abort_rpl *rpl;
+        struct sk_buff *rpl_skb;
+        struct iwch_qp_attributes attrs;
+        int ret;
+        int state;
+
+        if (is_neg_adv_abort(req->status)) {
+                PDBG("%s neg_adv_abort ep %p tid %d\n", __FUNCTION__, ep,
+                     ep->hwtid);
+                t3_l2t_send_event(ep->com.tdev, ep->l2t);
+                return CPL_RET_BUF_DONE;
+        }
+
+        state = state_read(&ep->com);
+        PDBG("%s ep %p state %u\n", __FUNCTION__, ep, state);
+        switch (state) {
+        case CONNECTING:
+                break;
+        case MPA_REQ_WAIT:
+                break;
+        case MPA_REQ_SENT:
+                connect_reply_upcall(ep, -ECONNRESET);
+                break;
+        case MPA_REP_SENT:
+                ep->com.rpl_done = 1;
+                ep->com.rpl_err = -ECONNRESET;
+                PDBG("waking up ep %p\n", ep);
+                wake_up(&ep->com.waitq);
+                break;
+        case MPA_REQ_RCVD:
+
+                /*
+                 * We're gonna mark this puppy DEAD, but keep
+                 * the reference on it until the ULP accepts or
+                 * rejects the CR.
+                 */
+                get_ep(&ep->com);
+                break;
+        case MORIBUND:
+                stop_ep_timer(ep);
+        case FPDU_MODE:
+        case CLOSING:
+                if (ep->com.cm_id && ep->com.qp) {
+                        attrs.next_state = IWCH_QP_STATE_ERROR;
+                        ret = iwch_modify_qp(ep->com.qp->rhp,
+                                     ep->com.qp, IWCH_QP_ATTR_NEXT_STATE,
+                                     &attrs, 1);
+                        if (ret)
+                                printk(KERN_ERR MOD
+                                       "%s - qp <- error failed!\n",
+                                       __FUNCTION__);
+                }
+                peer_abort_upcall(ep);
+                break;
+        case ABORTING:
+                break;
+        case DEAD:
+                PDBG("%s PEER_ABORT IN DEAD STATE!!!!\n", __FUNCTION__);
+                return CPL_RET_BUF_DONE;
+        default:
+                BUG_ON(1);
+                break;
+        }
+        dst_confirm(ep->dst);
+
+        rpl_skb = get_skb(skb, sizeof(*rpl), GFP_KERNEL);
+        if (!rpl_skb) {
+                printk(KERN_ERR MOD "%s - cannot allocate skb!\n",
+                       __FUNCTION__);
+                dst_release(ep->dst);
+                l2t_release(L2DATA(ep->com.tdev), ep->l2t);
+                put_ep(&ep->com);
+                return CPL_RET_BUF_DONE;
+        }
+        rpl_skb->priority = CPL_PRIORITY_DATA;
+        rpl = (struct cpl_abort_rpl *) skb_put(rpl_skb, sizeof(*rpl));
+        rpl->wr.wr_hi = htonl(V_WR_OP(FW_WROPCODE_OFLD_HOST_ABORT_CON_RPL));
+        rpl->wr.wr_lo = htonl(V_WR_TID(ep->hwtid));
+        OPCODE_TID(rpl) = htonl(MK_OPCODE_TID(CPL_ABORT_RPL, ep->hwtid));
+        rpl->cmd = CPL_ABORT_NO_RST;
+        ep->com.tdev->send(ep->com.tdev, rpl_skb);
+        if (state != ABORTING) {
+                state_set(&ep->com, DEAD);
+                release_ep_resources(ep);
+        }
+        return CPL_RET_BUF_DONE;
+}
+
+static int close_con_rpl(struct t3cdev *tdev, struct sk_buff *skb, void *ctx)
+{
+        struct iwch_ep *ep = ctx;
+        struct iwch_qp_attributes attrs;
+        unsigned long flags;
+        int release = 0;
+
+        PDBG("%s ep %p\n", __FUNCTION__, ep);
+        BUG_ON(!ep);
+
+        /* The cm_id may be null if we failed to connect */
+        spin_lock_irqsave(&ep->com.lock, flags);
+        switch (ep->com.state) {
+        case CLOSING:
+                start_ep_timer(ep);
+                __state_set(&ep->com, MORIBUND);
+                break;
+        case MORIBUND:
+                stop_ep_timer(ep);
+                if ((ep->com.cm_id) && (ep->com.qp)) {
+                        attrs.next_state = IWCH_QP_STATE_IDLE;
+                        iwch_modify_qp(ep->com.qp->rhp,
+                                             ep->com.qp,
+                                             IWCH_QP_ATTR_NEXT_STATE,
+                                             &attrs, 1);
+                }
+                close_complete_upcall(ep);
+                __state_set(&ep->com, DEAD);
+                release = 1;
+                break;
+        case DEAD:
+        default:
+                BUG_ON(1);
+                break;
+        }
+        spin_unlock_irqrestore(&ep->com.lock, flags);
+        if (release)
+                release_ep_resources(ep);
+        return CPL_RET_BUF_DONE;
+}
+
+/*
+ * T3A does 3 things when a TERM is received:
+ * 1) send up a CPL_RDMA_TERMINATE message with the TERM packet
+ * 2) generate an async event on the QP with the TERMINATE opcode
+ * 3) post a TERMINATE opcde cqe into the associated CQ.
+ *
+ * For (1), we save the message in the qp for later consumer consumption.
+ * For (2), we move the QP into TERMINATE, post a QP event and disconnect.
+ * For (3), we toss the CQE in cxio_poll_cq().
+ *
+ * terminate() handles case (1)...
+ */
+static int terminate(struct t3cdev *tdev, struct sk_buff *skb, void *ctx)
+{
+        struct iwch_ep *ep = ctx;
+
+        PDBG("%s ep %p\n", __FUNCTION__, ep);
+        skb_pull(skb, sizeof(struct cpl_rdma_terminate));
+        PDBG("%s saving %d bytes of term msg\n", __FUNCTION__, skb->len);
+        memcpy(ep->com.qp->attr.terminate_buffer, skb->data, skb->len);
+        ep->com.qp->attr.terminate_msg_len = skb->len;
+        ep->com.qp->attr.is_terminate_local = 0;
+        return CPL_RET_BUF_DONE;
+}
+
+static int ec_status(struct t3cdev *tdev, struct sk_buff *skb, void *ctx)
+{
+        struct cpl_rdma_ec_status *rep = cplhdr(skb);
+        struct iwch_ep *ep = ctx;
+
+        PDBG("%s ep %p tid %u status %d\n", __FUNCTION__, ep, ep->hwtid,
+             rep->status);
+        if (rep->status) {
+                struct iwch_qp_attributes attrs;
+
+                printk(KERN_ERR MOD "%s BAD CLOSE - Aborting tid %u\n",
+                       __FUNCTION__, ep->hwtid);
+                attrs.next_state = IWCH_QP_STATE_ERROR;
+                iwch_modify_qp(ep->com.qp->rhp,
+                               ep->com.qp, IWCH_QP_ATTR_NEXT_STATE,
+                               &attrs, 1);
+                abort_connection(ep, NULL, GFP_KERNEL);
+        }
+        return CPL_RET_BUF_DONE;
+}
+
+static void ep_timeout(unsigned long arg)
+{
+        struct iwch_ep *ep = (struct iwch_ep *)arg;
+        struct iwch_qp_attributes attrs;
+        unsigned long flags;
+
+        spin_lock_irqsave(&ep->com.lock, flags);
+        PDBG("%s ep %p tid %u state %d\n", __FUNCTION__, ep, ep->hwtid,
+             ep->com.state);
+        switch (ep->com.state) {
+        case MPA_REQ_SENT:
+                connect_reply_upcall(ep, -ETIMEDOUT);
+                break;
+        case MPA_REQ_WAIT:
+                break;
+        case MORIBUND:
+                if (ep->com.cm_id && ep->com.qp) {
+                        attrs.next_state = IWCH_QP_STATE_ERROR;
+                        iwch_modify_qp(ep->com.qp->rhp,
+                                     ep->com.qp, IWCH_QP_ATTR_NEXT_STATE,
+                                     &attrs, 1);
+                }
+                break;
+        default:
+                BUG();
+        }
+        __state_set(&ep->com, CLOSING);
+        spin_unlock_irqrestore(&ep->com.lock, flags);
+        abort_connection(ep, NULL, GFP_ATOMIC);
+        put_ep(&ep->com);
+}
+
+int iwch_reject_cr(struct iw_cm_id *cm_id, const void *pdata, u8 pdata_len)
+{
+        int err;
+        struct iwch_ep *ep = to_ep(cm_id);
+        PDBG("%s ep %p tid %u\n", __FUNCTION__, ep, ep->hwtid);
+
+        if (state_read(&ep->com) == DEAD) {
+                put_ep(&ep->com);
+                return -ECONNRESET;
+        }
+        BUG_ON(state_read(&ep->com) != MPA_REQ_RCVD);
+        state_set(&ep->com, CLOSING);
+        if (mpa_rev == 0)
+                abort_connection(ep, NULL, GFP_KERNEL);
+        else {
+                err = send_mpa_reject(ep, pdata, pdata_len);
+                err = send_halfclose(ep, GFP_KERNEL);
+        }
+        return 0;
+}
+
+int iwch_accept_cr(struct iw_cm_id *cm_id, struct iw_cm_conn_param *conn_param)
+{
+        int err;
+        struct iwch_qp_attributes attrs;
+        enum iwch_qp_attr_mask mask;
+        struct iwch_ep *ep = to_ep(cm_id);
+        struct iwch_dev *h = to_iwch_dev(cm_id->device);
+        struct iwch_qp *qp = get_qhp(h, conn_param->qpn);
+
+        PDBG("%s ep %p tid %u\n", __FUNCTION__, ep, ep->hwtid);
+        if (state_read(&ep->com) == DEAD) {
+                put_ep(&ep->com);
+                return -ECONNRESET;
+        }
+
+        BUG_ON(state_read(&ep->com) != MPA_REQ_RCVD);
+        BUG_ON(!qp);
+
+        if ((conn_param->ord > qp->rhp->attr.max_rdma_read_qp_depth) ||
+            (conn_param->ird > qp->rhp->attr.max_rdma_reads_per_qp)) {
+                abort_connection(ep, NULL, GFP_KERNEL);
+                return -EINVAL;
+        }
+
+        cm_id->add_ref(cm_id);
+        ep->com.cm_id = cm_id;
+        ep->com.qp = qp;
+
+        ep->com.rpl_done = 0;
+        ep->com.rpl_err = 0;
+        ep->ird = conn_param->ird;
+        ep->ord = conn_param->ord;
+        PDBG("%s %d ird %d ord %d\n", __FUNCTION__, __LINE__, ep->ird, ep->ord);
+        get_ep(&ep->com);
+        err = send_mpa_reply(ep, conn_param->private_data,
+                             conn_param->private_data_len);
+        if (err) {
+                ep->com.cm_id = NULL;
+                ep->com.qp = NULL;
+                cm_id->rem_ref(cm_id);
+                abort_connection(ep, NULL, GFP_KERNEL);
+                put_ep(&ep->com);
+                return err;
+        }
+
+        /* bind QP to EP and move to RTS */
+        attrs.mpa_attr = ep->mpa_attr;
+        attrs.max_ird = ep->ord;
+        attrs.max_ord = ep->ord;
+        attrs.llp_stream_handle = ep;
+        attrs.next_state = IWCH_QP_STATE_RTS;
+
+        /* bind QP and TID with INIT_WR */
+        mask = IWCH_QP_ATTR_NEXT_STATE |
+                             IWCH_QP_ATTR_LLP_STREAM_HANDLE |
+                             IWCH_QP_ATTR_MPA_ATTR |
+                             IWCH_QP_ATTR_MAX_IRD |
+                             IWCH_QP_ATTR_MAX_ORD;
+
+        err = iwch_modify_qp(ep->com.qp->rhp,
+                             ep->com.qp, mask, &attrs, 1);
+
+        if (err) {
+                ep->com.cm_id = NULL;
+                ep->com.qp = NULL;
+                cm_id->rem_ref(cm_id);
+                abort_connection(ep, NULL, GFP_KERNEL);
+        } else {
+                state_set(&ep->com, FPDU_MODE);
+                established_upcall(ep);
+        }
+        put_ep(&ep->com);
+        return err;
+}
+
+int iwch_connect(struct iw_cm_id *cm_id, struct iw_cm_conn_param *conn_param)
+{
+        int err = 0;
+        struct iwch_dev *h = to_iwch_dev(cm_id->device);
+        struct iwch_ep *ep;
+        struct rtable *rt;
+
+        ep = alloc_ep(sizeof(*ep), GFP_KERNEL);
+        if (!ep) {
+                printk(KERN_ERR MOD "%s - cannot alloc ep.\n", __FUNCTION__);
+                err = -ENOMEM;
+                goto out;
+        }
+        init_timer(&ep->timer);
+        ep->plen = conn_param->private_data_len;
+        if (ep->plen)
+                memcpy(ep->mpa_pkt + sizeof(struct mpa_message),
+                       conn_param->private_data, ep->plen);
+        ep->ird = conn_param->ird;
+        ep->ord = conn_param->ord;
+        ep->com.tdev = h->rdev.t3cdev_p;
+
+        cm_id->add_ref(cm_id);
+        ep->com.cm_id = cm_id;
+        ep->com.qp = get_qhp(h, conn_param->qpn);
+        BUG_ON(!ep->com.qp);
+        PDBG("%s qpn 0x%x qp %p cm_id %p\n", __FUNCTION__, conn_param->qpn,
+             ep->com.qp, cm_id);
+
+        /*
+         * Allocate an active TID to initiate a TCP connection.
+         */
+        ep->atid = cxgb3_alloc_atid(h->rdev.t3cdev_p, &t3c_client, ep);
+        if (ep->atid == -1) {
+                printk(KERN_ERR MOD "%s - cannot alloc atid.\n", __FUNCTION__);
+                err = -ENOMEM;
+                goto fail2;
+        }
+
+        /* find a route */
+        rt = find_route(h->rdev.t3cdev_p,
+                        cm_id->local_addr.sin_addr.s_addr,
+                        cm_id->remote_addr.sin_addr.s_addr,
+                        cm_id->local_addr.sin_port,
+                        cm_id->remote_addr.sin_port, IPTOS_LOWDELAY);
+        if (!rt) {
+                printk(KERN_ERR MOD "%s - cannot find route.\n", __FUNCTION__);
+                err = -EHOSTUNREACH;
+                goto fail3;
+        }
+        ep->dst = &rt->u.dst;
+
+        /* get a l2t entry */
+        ep->l2t = t3_l2t_get(ep->com.tdev, ep->dst->neighbour,
+                             ep->dst->neighbour->dev);
+        if (!ep->l2t) {
+                printk(KERN_ERR MOD "%s - cannot alloc l2e.\n", __FUNCTION__);
+                err = -ENOMEM;
+                goto fail4;
+        }
+
+        state_set(&ep->com, CONNECTING);
+        ep->tos = IPTOS_LOWDELAY;
+        ep->com.local_addr = cm_id->local_addr;
+        ep->com.remote_addr = cm_id->remote_addr;
+
+        /* send connect request to rnic */
+        err = send_connect(ep);
+        if (!err)
+                goto out;
+
+        l2t_release(L2DATA(h->rdev.t3cdev_p), ep->l2t);
+fail4:
+        dst_release(ep->dst);
+fail3:
+        cxgb3_free_atid(ep->com.tdev, ep->atid);
+fail2:
+        put_ep(&ep->com);
+out:
+        return err;
+}
+
+int iwch_create_listen(struct iw_cm_id *cm_id, int backlog)
+{
+        int err = 0;
+        struct iwch_dev *h = to_iwch_dev(cm_id->device);
+        struct iwch_listen_ep *ep;
+
+
+        might_sleep();
+
+        ep = alloc_ep(sizeof(*ep), GFP_KERNEL);
+        if (!ep) {
+                printk(KERN_ERR MOD "%s - cannot alloc ep.\n", __FUNCTION__);
+                err = -ENOMEM;
+                goto fail1;
+        }
+        PDBG("%s ep %p\n", __FUNCTION__, ep);
+        ep->com.tdev = h->rdev.t3cdev_p;
+        cm_id->add_ref(cm_id);
+        ep->com.cm_id = cm_id;
+        ep->backlog = backlog;
+        ep->com.local_addr = cm_id->local_addr;
+
+        /*
+         * Allocate a server TID.
+         */
+        ep->stid = cxgb3_alloc_stid(h->rdev.t3cdev_p, &t3c_client, ep);
+        if (ep->stid == -1) {
+                printk(KERN_ERR MOD "%s - cannot alloc atid.\n", __FUNCTION__);
+                err = -ENOMEM;
+                goto fail2;
+        }
+
+        state_set(&ep->com, LISTEN);
+        err = listen_start(ep);
+        if (err)
+                goto fail3;
+
+        /* wait for pass_open_rpl */
+        wait_event(ep->com.waitq, ep->com.rpl_done);
+        err = ep->com.rpl_err;
+        if (!err) {
+                cm_id->provider_data = ep;
+                goto out;
+        }
+fail3:
+        cxgb3_free_stid(ep->com.tdev, ep->stid);
+fail2:
+        put_ep(&ep->com);
+fail1:
+out:
+        return err;
+}
+
+int iwch_destroy_listen(struct iw_cm_id *cm_id)
+{
+        int err;
+        struct iwch_listen_ep *ep = to_listen_ep(cm_id);
+
+        PDBG("%s ep %p\n", __FUNCTION__, ep);
+
+        might_sleep();
+        state_set(&ep->com, DEAD);
+        ep->com.rpl_done = 0;
+        ep->com.rpl_err = 0;
+        err = listen_stop(ep);
+        wait_event(ep->com.waitq, ep->com.rpl_done);
+        cxgb3_free_stid(ep->com.tdev, ep->stid);
+        err = ep->com.rpl_err;
+        cm_id->rem_ref(cm_id);
+        put_ep(&ep->com);
+        return err;
+}
+
+int iwch_ep_disconnect(struct iwch_ep *ep, int abrupt, gfp_t gfp)
+{
+        int ret=0;
+        unsigned long flags;
+        int close = 0;
+
+        spin_lock_irqsave(&ep->com.lock, flags);
+
+        PDBG("%s ep %p state %s, abrupt %d\n", __FUNCTION__, ep,
+             states[ep->com.state], abrupt);
+
+        if (ep->com.state == DEAD) {
+                PDBG("%s already dead ep %p\n", __FUNCTION__, ep);
+                goto out;
+        }
+
+        if (abrupt) {
+                if (ep->com.state != ABORTING) {
+                        ep->com.state = ABORTING;
+                        close = 1;
+                }
+                goto out;
+        }
+
+        switch (ep->com.state) {
+        case MPA_REQ_WAIT:
+        case MPA_REQ_SENT:
+        case MPA_REQ_RCVD:
+        case MPA_REP_SENT:
+        case FPDU_MODE:
+                ep->com.state = CLOSING;
+                close = 1;
+                break;
+        case CLOSING:
+                start_ep_timer(ep);
+                ep->com.state = MORIBUND;
+                close = 1;
+                break;
+        case MORIBUND:
+                break;
+        default:
+                BUG();
+                break;
+        }
+out:
+        spin_unlock_irqrestore(&ep->com.lock, flags);
+        if (close) {
+                if (abrupt)
+                        ret = send_abort(ep, NULL, gfp);
+                else
+                        ret = send_halfclose(ep, gfp);
+        }
+        return ret;
+}
+
+int iwch_ep_redirect(void *ctx, struct dst_entry *old, struct dst_entry *new,
+                     struct l2t_entry *l2t)
+{
+        struct iwch_ep *ep = ctx;
+
+        if (ep->dst != old)
+                return 0;
+
+        PDBG("%s ep %p redirect to dst %p l2t %p\n", __FUNCTION__, ep, new,
+             l2t);
+        dst_hold(new);
+        l2t_release(L2DATA(ep->com.tdev), ep->l2t);
+        ep->l2t = l2t;
+        dst_release(old);
+        ep->dst = new;
+        return 1;
+}
+
+/*
+ * All the CM events are handled on a work queue to have a safe context.
+ */
+static int sched(struct t3cdev *tdev, struct sk_buff *skb, void *ctx)
+{
+        struct iwch_ep_common *epc = ctx;
+
+        get_ep(epc);
+
+        /*
+         * Save ctx and tdev in the skb->cb area.
+         */
+        *((void **) skb->cb) = ctx;
+        *((struct t3cdev **) (skb->cb + sizeof(void *))) = tdev;
+
+        /*
+         * Queue the skb and schedule the worker thread.
+         */
+        skb_queue_tail(&rxq, skb);
+        queue_work(workq, &skb_work);
+        return 0;
+}
+
+int __init iwch_cm_init(void)
+{
+        skb_queue_head_init(&rxq);
+
+        workq = create_singlethread_workqueue("iw_cxgb3");
+        if (!workq)
+                return -ENOMEM;
+
+        /*
+         * All upcalls from the T3 Core go to sched() to
+         * schedule the processing on a work queue.
+         */
+        t3c_handlers[CPL_ACT_ESTABLISH] = sched;
+        t3c_handlers[CPL_ACT_OPEN_RPL] = sched;
+        t3c_handlers[CPL_RX_DATA] = sched;
+        t3c_handlers[CPL_TX_DMA_ACK] = sched;
+        t3c_handlers[CPL_ABORT_RPL_RSS] = sched;
+        t3c_handlers[CPL_ABORT_RPL] = sched;
+        t3c_handlers[CPL_PASS_OPEN_RPL] = sched;
+        t3c_handlers[CPL_CLOSE_LISTSRV_RPL] = sched;
+        t3c_handlers[CPL_PASS_ACCEPT_REQ] = sched;
+        t3c_handlers[CPL_PASS_ESTABLISH] = sched;
+        t3c_handlers[CPL_PEER_CLOSE] = sched;
+        t3c_handlers[CPL_CLOSE_CON_RPL] = sched;
+        t3c_handlers[CPL_ABORT_REQ_RSS] = sched;
+        t3c_handlers[CPL_RDMA_TERMINATE] = sched;
+        t3c_handlers[CPL_RDMA_EC_STATUS] = sched;
+
+        /*
+         * These are the real handlers that are called from a
+         * work queue.
+         */
+        work_handlers[CPL_ACT_ESTABLISH] = act_establish;
+        work_handlers[CPL_ACT_OPEN_RPL] = act_open_rpl;
+        work_handlers[CPL_RX_DATA] = rx_data;
+        work_handlers[CPL_TX_DMA_ACK] = tx_ack;
+        work_handlers[CPL_ABORT_RPL_RSS] = abort_rpl;
+        work_handlers[CPL_ABORT_RPL] = abort_rpl;
+        work_handlers[CPL_PASS_OPEN_RPL] = pass_open_rpl;
+        work_handlers[CPL_CLOSE_LISTSRV_RPL] = close_listsrv_rpl;
+        work_handlers[CPL_PASS_ACCEPT_REQ] = pass_accept_req;
+        work_handlers[CPL_PASS_ESTABLISH] = pass_establish;
+        work_handlers[CPL_PEER_CLOSE] = peer_close;
+        work_handlers[CPL_ABORT_REQ_RSS] = peer_abort;
+        work_handlers[CPL_CLOSE_CON_RPL] = close_con_rpl;
+        work_handlers[CPL_RDMA_TERMINATE] = terminate;
+        work_handlers[CPL_RDMA_EC_STATUS] = ec_status;
+        return 0;
+}
+
+void __exit iwch_cm_term(void)
+{
+        flush_workqueue(workq);
+        destroy_workqueue(workq);
+}
diff --git a/drivers/infiniband/hw/cxgb3/iwch_cm.h b/drivers/infiniband/hw/cxgb3/iwch_cm.h
new file mode 100644
index 000000000000..7c810d904279
--- /dev/null
+++ b/drivers/infiniband/hw/cxgb3/iwch_cm.h
@@ -0,0 +1,223 @@
+/*
+ * Copyright (c) 2006 Chelsio, Inc. All rights reserved.
+ * Copyright (c) 2006 Open Grid Computing, Inc. All rights reserved.
+ *
+ * This software is available to you under a choice of one of two
+ * licenses.  You may choose to be licensed under the terms of the GNU
+ * General Public License (GPL) Version 2, available from the file
+ * COPYING in the main directory of this source tree, or the
+ * OpenIB.org BSD license below:
+ *
+ *     Redistribution and use in source and binary forms, with or
+ *     without modification, are permitted provided that the following
+ *     conditions are met:
+ *
+ *      - Redistributions of source code must retain the above
+ *        copyright notice, this list of conditions and the following
+ *        disclaimer.
+ *
+ *      - Redistributions in binary form must reproduce the above
+ *        copyright notice, this list of conditions and the following
+ *        disclaimer in the documentation and/or other materials
+ *        provided with the distribution.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+ * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+ * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+ * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
+ * BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
+ * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
+ * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+ * SOFTWARE.
+ */
+#ifndef _IWCH_CM_H_
+#define _IWCH_CM_H_
+
+#include <linux/inet.h>
+#include <linux/wait.h>
+#include <linux/spinlock.h>
+#include <linux/kref.h>
+
+#include <rdma/ib_verbs.h>
+#include <rdma/iw_cm.h>
+
+#include "cxgb3_offload.h"
+#include "iwch_provider.h"
+
+#define MPA_KEY_REQ "MPA ID Req Frame"
+#define MPA_KEY_REP "MPA ID Rep Frame"
+
+#define MPA_MAX_PRIVATE_DATA    256
+#define MPA_REV         0       /* XXX - amso1100 uses rev 0 ! */
+#define MPA_REJECT              0x20
+#define MPA_CRC                 0x40
+#define MPA_MARKERS             0x80
+#define MPA_FLAGS_MASK          0xE0
+
+#define put_ep(ep) { \
+        PDBG("put_ep (via %s:%u) ep %p refcnt %d\n", __FUNCTION__, __LINE__,  \
+             ep, atomic_read(&((ep)->kref.refcount))); \
+        kref_put(&((ep)->kref), __free_ep); \
+}
+
+#define get_ep(ep) { \
+        PDBG("get_ep (via %s:%u) ep %p, refcnt %d\n", __FUNCTION__, __LINE__, \
+             ep, atomic_read(&((ep)->kref.refcount))); \
+        kref_get(&((ep)->kref));  \
+}
+
+struct mpa_message {
+        u8 key[16];
+        u8 flags;
+        u8 revision;
+        __be16 private_data_size;
+        u8 private_data[0];
+};
+
+struct terminate_message {
+        u8 layer_etype;
+        u8 ecode;
+        __be16 hdrct_rsvd;
+        u8 len_hdrs[0];
+};
+
+#define TERM_MAX_LENGTH (sizeof(struct terminate_message) + 2 + 18 + 28)
+
+enum iwch_layers_types {
+        LAYER_RDMAP             = 0x00,
+        LAYER_DDP               = 0x10,
+        LAYER_MPA               = 0x20,
+        RDMAP_LOCAL_CATA        = 0x00,
+        RDMAP_REMOTE_PROT       = 0x01,
+        RDMAP_REMOTE_OP         = 0x02,
+        DDP_LOCAL_CATA          = 0x00,
+        DDP_TAGGED_ERR          = 0x01,
+        DDP_UNTAGGED_ERR        = 0x02,
+        DDP_LLP                 = 0x03
+};
+
+enum iwch_rdma_ecodes {
+        RDMAP_INV_STAG          = 0x00,
+        RDMAP_BASE_BOUNDS       = 0x01,
+        RDMAP_ACC_VIOL          = 0x02,
+        RDMAP_STAG_NOT_ASSOC    = 0x03,
+        RDMAP_TO_WRAP           = 0x04,
+        RDMAP_INV_VERS          = 0x05,
+        RDMAP_INV_OPCODE        = 0x06,
+        RDMAP_STREAM_CATA       = 0x07,
+        RDMAP_GLOBAL_CATA       = 0x08,
+        RDMAP_CANT_INV_STAG     = 0x09,
+        RDMAP_UNSPECIFIED       = 0xff
+};
+
+enum iwch_ddp_ecodes {
+        DDPT_INV_STAG           = 0x00,
+        DDPT_BASE_BOUNDS        = 0x01,
+        DDPT_STAG_NOT_ASSOC     = 0x02,
+        DDPT_TO_WRAP            = 0x03,
+        DDPT_INV_VERS           = 0x04,
+        DDPU_INV_QN             = 0x01,
+        DDPU_INV_MSN_NOBUF      = 0x02,
+        DDPU_INV_MSN_RANGE      = 0x03,
+        DDPU_INV_MO             = 0x04,
+        DDPU_MSG_TOOBIG         = 0x05,
+        DDPU_INV_VERS           = 0x06
+};
+
+enum iwch_mpa_ecodes {
+        MPA_CRC_ERR             = 0x02,
+        MPA_MARKER_ERR          = 0x03
+};
+
+enum iwch_ep_state {
+        IDLE = 0,
+        LISTEN,
+        CONNECTING,
+        MPA_REQ_WAIT,
+        MPA_REQ_SENT,
+        MPA_REQ_RCVD,
+        MPA_REP_SENT,
+        FPDU_MODE,
+        ABORTING,
+        CLOSING,
+        MORIBUND,
+        DEAD,
+};
+
+struct iwch_ep_common {
+        struct iw_cm_id *cm_id;
+        struct iwch_qp *qp;
+        struct t3cdev *tdev;
+        enum iwch_ep_state state;
+        struct kref kref;
+        spinlock_t lock;
+        struct sockaddr_in local_addr;
+        struct sockaddr_in remote_addr;
+        wait_queue_head_t waitq;
+        int rpl_done;
+        int rpl_err;
+};
+
+struct iwch_listen_ep {
+        struct iwch_ep_common com;
+        unsigned int stid;
+        int backlog;
+};
+
+struct iwch_ep {
+        struct iwch_ep_common com;
+        struct iwch_ep *parent_ep;
+        struct timer_list timer;
+        unsigned int atid;
+        u32 hwtid;
+        u32 snd_seq;
+        struct l2t_entry *l2t;
+        struct dst_entry *dst;
+        struct sk_buff *mpa_skb;
+        struct iwch_mpa_attributes mpa_attr;
+        unsigned int mpa_pkt_len;
+        u8 mpa_pkt[sizeof(struct mpa_message) + MPA_MAX_PRIVATE_DATA];
+        u8 tos;
+        u16 emss;
+        u16 plen;
+        u32 ird;
+        u32 ord;
+};
+
+static inline struct iwch_ep *to_ep(struct iw_cm_id *cm_id)
+{
+        return cm_id->provider_data;
+}
+
+static inline struct iwch_listen_ep *to_listen_ep(struct iw_cm_id *cm_id)
+{
+        return cm_id->provider_data;
+}
+
+static inline int compute_wscale(int win)
+{
+        int wscale = 0;
+
+        while (wscale < 14 && (65535<<wscale) < win)
+                wscale++;
+        return wscale;
+}
+
+/* CM prototypes */
+
+int iwch_connect(struct iw_cm_id *cm_id, struct iw_cm_conn_param *conn_param);
+int iwch_create_listen(struct iw_cm_id *cm_id, int backlog);
+int iwch_destroy_listen(struct iw_cm_id *cm_id);
+int iwch_reject_cr(struct iw_cm_id *cm_id, const void *pdata, u8 pdata_len);
+int iwch_accept_cr(struct iw_cm_id *cm_id, struct iw_cm_conn_param *conn_param);
+int iwch_ep_disconnect(struct iwch_ep *ep, int abrupt, gfp_t gfp);
+int iwch_quiesce_tid(struct iwch_ep *ep);
+int iwch_resume_tid(struct iwch_ep *ep);
+void __free_ep(struct kref *kref);
+void iwch_rearp(struct iwch_ep *ep);
+int iwch_ep_redirect(void *ctx, struct dst_entry *old, struct dst_entry *new, struct l2t_entry *l2t);
+
+int __init iwch_cm_init(void);
+void __exit iwch_cm_term(void);
+
+#endif                          /* _IWCH_CM_H_ */
diff --git a/drivers/infiniband/hw/cxgb3/iwch_cq.c b/drivers/infiniband/hw/cxgb3/iwch_cq.c
new file mode 100644
index 000000000000..98b3bdb5de9e
--- /dev/null
+++ b/drivers/infiniband/hw/cxgb3/iwch_cq.c
@@ -0,0 +1,225 @@
+/*
+ * Copyright (c) 2006 Chelsio, Inc. All rights reserved.
+ * Copyright (c) 2006 Open Grid Computing, Inc. All rights reserved.
+ *
+ * This software is available to you under a choice of one of two
+ * licenses.  You may choose to be licensed under the terms of the GNU
+ * General Public License (GPL) Version 2, available from the file
+ * COPYING in the main directory of this source tree, or the
+ * OpenIB.org BSD license below:
+ *
+ *     Redistribution and use in source and binary forms, with or
+ *     without modification, are permitted provided that the following
+ *     conditions are met:
+ *
+ *      - Redistributions of source code must retain the above
+ *        copyright notice, this list of conditions and the following
+ *        disclaimer.
+ *
+ *      - Redistributions in binary form must reproduce the above
+ *        copyright notice, this list of conditions and the following
+ *        disclaimer in the documentation and/or other materials
+ *        provided with the distribution.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+ * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+ * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+ * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
+ * BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
+ * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
+ * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+ * SOFTWARE.
+ */
+#include "iwch_provider.h"
+#include "iwch.h"
+
+/*
+ * Get one cq entry from cxio and map it to openib.
+ *
+ * Returns:
+ *      0                       EMPTY;
+ *      1                       cqe returned
+ *      -EAGAIN         caller must try again
+ *      any other -errno        fatal error
+ */
+static int iwch_poll_cq_one(struct iwch_dev *rhp, struct iwch_cq *chp,
+                            struct ib_wc *wc)
+{
+        struct iwch_qp *qhp = NULL;
+        struct t3_cqe cqe, *rd_cqe;
+        struct t3_wq *wq;
+        u32 credit = 0;
+        u8 cqe_flushed;
+        u64 cookie;
+        int ret = 1;
+
+        rd_cqe = cxio_next_cqe(&chp->cq);
+
+        if (!rd_cqe)
+                return 0;
+
+        qhp = get_qhp(rhp, CQE_QPID(*rd_cqe));
+        if (!qhp)
+                wq = NULL;
+        else {
+                spin_lock(&qhp->lock);
+                wq = &(qhp->wq);
+        }
+        ret = cxio_poll_cq(wq, &(chp->cq), &cqe, &cqe_flushed, &cookie,
+                                   &credit);
+        if (t3a_device(chp->rhp) && credit) {
+                PDBG("%s updating %d cq credits on id %d\n", __FUNCTION__,
+                     credit, chp->cq.cqid);
+                cxio_hal_cq_op(&rhp->rdev, &chp->cq, CQ_CREDIT_UPDATE, credit);
+        }
+
+        if (ret) {
+                ret = -EAGAIN;
+                goto out;
+        }
+        ret = 1;
+
+        wc->wr_id = cookie;
+        wc->qp = &qhp->ibqp;
+        wc->vendor_err = CQE_STATUS(cqe);
+
+        PDBG("%s qpid 0x%x type %d opcode %d status 0x%x wrid hi 0x%x "
+             "lo 0x%x cookie 0x%llx\n", __FUNCTION__,
+             CQE_QPID(cqe), CQE_TYPE(cqe),
+             CQE_OPCODE(cqe), CQE_STATUS(cqe), CQE_WRID_HI(cqe),
+             CQE_WRID_LOW(cqe), (unsigned long long) cookie);
+
+        if (CQE_TYPE(cqe) == 0) {
+                if (!CQE_STATUS(cqe))
+                        wc->byte_len = CQE_LEN(cqe);
+                else
+                        wc->byte_len = 0;
+                wc->opcode = IB_WC_RECV;
+        } else {
+                switch (CQE_OPCODE(cqe)) {
+                case T3_RDMA_WRITE:
+                        wc->opcode = IB_WC_RDMA_WRITE;
+                        break;
+                case T3_READ_REQ:
+                        wc->opcode = IB_WC_RDMA_READ;
+                        wc->byte_len = CQE_LEN(cqe);
+                        break;
+                case T3_SEND:
+                case T3_SEND_WITH_SE:
+                        wc->opcode = IB_WC_SEND;
+                        break;
+                case T3_BIND_MW:
+                        wc->opcode = IB_WC_BIND_MW;
+                        break;
+
+                /* these aren't supported yet */
+                case T3_SEND_WITH_INV:
+                case T3_SEND_WITH_SE_INV:
+                case T3_LOCAL_INV:
+                case T3_FAST_REGISTER:
+                default:
+                        printk(KERN_ERR MOD "Unexpected opcode %d "
+                               "in the CQE received for QPID=0x%0x\n",
+                               CQE_OPCODE(cqe), CQE_QPID(cqe));
+                        ret = -EINVAL;
+                        goto out;
+                }
+        }
+
+        if (cqe_flushed)
+                wc->status = IB_WC_WR_FLUSH_ERR;
+        else {
+
+                switch (CQE_STATUS(cqe)) {
+                case TPT_ERR_SUCCESS:
+                        wc->status = IB_WC_SUCCESS;
+                        break;
+                case TPT_ERR_STAG:
+                        wc->status = IB_WC_LOC_ACCESS_ERR;
+                        break;
+                case TPT_ERR_PDID:
+                        wc->status = IB_WC_LOC_PROT_ERR;
+                        break;
+                case TPT_ERR_QPID:
+                case TPT_ERR_ACCESS:
+                        wc->status = IB_WC_LOC_ACCESS_ERR;
+                        break;
+                case TPT_ERR_WRAP:
+                        wc->status = IB_WC_GENERAL_ERR;
+                        break;
+                case TPT_ERR_BOUND:
+                        wc->status = IB_WC_LOC_LEN_ERR;
+                        break;
+                case TPT_ERR_INVALIDATE_SHARED_MR:
+                case TPT_ERR_INVALIDATE_MR_WITH_MW_BOUND:
+                        wc->status = IB_WC_MW_BIND_ERR;
+                        break;
+                case TPT_ERR_CRC:
+                case TPT_ERR_MARKER:
+                case TPT_ERR_PDU_LEN_ERR:
+                case TPT_ERR_OUT_OF_RQE:
+                case TPT_ERR_DDP_VERSION:
+                case TPT_ERR_RDMA_VERSION:
+                case TPT_ERR_DDP_QUEUE_NUM:
+                case TPT_ERR_MSN:
+                case TPT_ERR_TBIT:
+                case TPT_ERR_MO:
+                case TPT_ERR_MSN_RANGE:
+                case TPT_ERR_IRD_OVERFLOW:
+                case TPT_ERR_OPCODE:
+                        wc->status = IB_WC_FATAL_ERR;
+                        break;
+                case TPT_ERR_SWFLUSH:
+                        wc->status = IB_WC_WR_FLUSH_ERR;
+                        break;
+                default:
+                        printk(KERN_ERR MOD "Unexpected cqe_status 0x%x for "
+                               "QPID=0x%0x\n", CQE_STATUS(cqe), CQE_QPID(cqe));
+                        ret = -EINVAL;
+                }
+        }
+out:
+        if (wq)
+                spin_unlock(&qhp->lock);
+        return ret;
+}
+
+int iwch_poll_cq(struct ib_cq *ibcq, int num_entries, struct ib_wc *wc)
+{
+        struct iwch_dev *rhp;
+        struct iwch_cq *chp;
+        unsigned long flags;
+        int npolled;
+        int err = 0;
+
+        chp = to_iwch_cq(ibcq);
+        rhp = chp->rhp;
+
+        spin_lock_irqsave(&chp->lock, flags);
+        for (npolled = 0; npolled < num_entries; ++npolled) {
+#ifdef DEBUG
+                int i=0;
+#endif
+
+                /*
+                 * Because T3 can post CQEs that are _not_ associated
+                 * with a WR, we might have to poll again after removing
+                 * one of these.
+                 */
+                do {
+                        err = iwch_poll_cq_one(rhp, chp, wc + npolled);
+#ifdef DEBUG
+                        BUG_ON(++i > 1000);
+#endif
+                } while (err == -EAGAIN);
+                if (err <= 0)
+                        break;
+        }
+        spin_unlock_irqrestore(&chp->lock, flags);
+
+        if (err < 0)
+                return err;
+        else {
+                return npolled;
+        }
+}
diff --git a/drivers/infiniband/hw/cxgb3/iwch_ev.c b/drivers/infiniband/hw/cxgb3/iwch_ev.c
new file mode 100644
index 000000000000..a6efa8fe15d8
--- /dev/null
+++ b/drivers/infiniband/hw/cxgb3/iwch_ev.c
@@ -0,0 +1,231 @@
+/*
+ * Copyright (c) 2006 Chelsio, Inc. All rights reserved.
+ * Copyright (c) 2006 Open Grid Computing, Inc. All rights reserved.
+ *
+ * This software is available to you under a choice of one of two
+ * licenses.  You may choose to be licensed under the terms of the GNU
+ * General Public License (GPL) Version 2, available from the file
+ * COPYING in the main directory of this source tree, or the
+ * OpenIB.org BSD license below:
+ *
+ *     Redistribution and use in source and binary forms, with or
+ *     without modification, are permitted provided that the following
+ *     conditions are met:
+ *
+ *      - Redistributions of source code must retain the above
+ *        copyright notice, this list of conditions and the following
+ *        disclaimer.
+ *
+ *      - Redistributions in binary form must reproduce the above
+ *        copyright notice, this list of conditions and the following
+ *        disclaimer in the documentation and/or other materials
+ *        provided with the distribution.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+ * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+ * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+ * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
+ * BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
+ * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
+ * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+ * SOFTWARE.
+ */
+#include <linux/slab.h>
+#include <linux/mman.h>
+#include <net/sock.h>
+#include "iwch_provider.h"
+#include "iwch.h"
+#include "iwch_cm.h"
+#include "cxio_hal.h"
+#include "cxio_wr.h"
+
+static void post_qp_event(struct iwch_dev *rnicp, struct iwch_cq *chp,
+                          struct respQ_msg_t *rsp_msg,
+                          enum ib_event_type ib_event,
+                          int send_term)
+{
+        struct ib_event event;
+        struct iwch_qp_attributes attrs;
+        struct iwch_qp *qhp;
+
+        printk(KERN_ERR "%s - AE qpid 0x%x opcode %d status 0x%x "
+               "type %d wrid.hi 0x%x wrid.lo 0x%x \n", __FUNCTION__,
+               CQE_QPID(rsp_msg->cqe), CQE_OPCODE(rsp_msg->cqe),
+               CQE_STATUS(rsp_msg->cqe), CQE_TYPE(rsp_msg->cqe),
+               CQE_WRID_HI(rsp_msg->cqe), CQE_WRID_LOW(rsp_msg->cqe));
+
+        spin_lock(&rnicp->lock);
+        qhp = get_qhp(rnicp, CQE_QPID(rsp_msg->cqe));
+
+        if (!qhp) {
+                printk(KERN_ERR "%s unaffiliated error 0x%x qpid 0x%x\n",
+                       __FUNCTION__, CQE_STATUS(rsp_msg->cqe),
+                       CQE_QPID(rsp_msg->cqe));
+                spin_unlock(&rnicp->lock);
+                return;
+        }
+
+        if ((qhp->attr.state == IWCH_QP_STATE_ERROR) ||
+            (qhp->attr.state == IWCH_QP_STATE_TERMINATE)) {
+                PDBG("%s AE received after RTS - "
+                     "qp state %d qpid 0x%x status 0x%x\n", __FUNCTION__,
+                     qhp->attr.state, qhp->wq.qpid, CQE_STATUS(rsp_msg->cqe));
+                spin_unlock(&rnicp->lock);
+                return;
+        }
+
+        atomic_inc(&qhp->refcnt);
+        spin_unlock(&rnicp->lock);
+
+        event.event = ib_event;
+        event.device = chp->ibcq.device;
+        if (ib_event == IB_EVENT_CQ_ERR)
+                event.element.cq = &chp->ibcq;
+        else
+                event.element.qp = &qhp->ibqp;
+
+        if (qhp->ibqp.event_handler)
+                (*qhp->ibqp.event_handler)(&event, qhp->ibqp.qp_context);
+
+        if (qhp->attr.state == IWCH_QP_STATE_RTS) {
+                attrs.next_state = IWCH_QP_STATE_TERMINATE;
+                iwch_modify_qp(qhp->rhp, qhp, IWCH_QP_ATTR_NEXT_STATE,
+                               &attrs, 1);
+                if (send_term)
+                        iwch_post_terminate(qhp, rsp_msg);
+        }
+
+        if (atomic_dec_and_test(&qhp->refcnt))
+                wake_up(&qhp->wait);
+}
+
+void iwch_ev_dispatch(struct cxio_rdev *rdev_p, struct sk_buff *skb)
+{
+        struct iwch_dev *rnicp;
+        struct respQ_msg_t *rsp_msg = (struct respQ_msg_t *) skb->data;
+        struct iwch_cq *chp;
+        struct iwch_qp *qhp;
+        u32 cqid = RSPQ_CQID(rsp_msg);
+
+        rnicp = (struct iwch_dev *) rdev_p->ulp;
+        spin_lock(&rnicp->lock);
+        chp = get_chp(rnicp, cqid);
+        qhp = get_qhp(rnicp, CQE_QPID(rsp_msg->cqe));
+        if (!chp || !qhp) {
+                printk(KERN_ERR MOD "BAD AE cqid 0x%x qpid 0x%x opcode %d "
+                       "status 0x%x type %d wrid.hi 0x%x wrid.lo 0x%x \n",
+                       cqid, CQE_QPID(rsp_msg->cqe),
+                       CQE_OPCODE(rsp_msg->cqe), CQE_STATUS(rsp_msg->cqe),
+                       CQE_TYPE(rsp_msg->cqe), CQE_WRID_HI(rsp_msg->cqe),
+                       CQE_WRID_LOW(rsp_msg->cqe));
+                spin_unlock(&rnicp->lock);
+                goto out;
+        }
+        iwch_qp_add_ref(&qhp->ibqp);
+        atomic_inc(&chp->refcnt);
+        spin_unlock(&rnicp->lock);
+
+        /*
+         * 1) completion of our sending a TERMINATE.
+         * 2) incoming TERMINATE message.
+         */
+        if ((CQE_OPCODE(rsp_msg->cqe) == T3_TERMINATE) &&
+            (CQE_STATUS(rsp_msg->cqe) == 0)) {
+                if (SQ_TYPE(rsp_msg->cqe)) {
+                        PDBG("%s QPID 0x%x ep %p disconnecting\n",
+                             __FUNCTION__, qhp->wq.qpid, qhp->ep);
+                        iwch_ep_disconnect(qhp->ep, 0, GFP_ATOMIC);
+                } else {
+                        PDBG("%s post REQ_ERR AE QPID 0x%x\n", __FUNCTION__,
+                             qhp->wq.qpid);
+                        post_qp_event(rnicp, chp, rsp_msg,
+                                      IB_EVENT_QP_REQ_ERR, 0);
+                        iwch_ep_disconnect(qhp->ep, 0, GFP_ATOMIC);
+                }
+                goto done;
+        }
+
+        /* Bad incoming Read request */
+        if (SQ_TYPE(rsp_msg->cqe) &&
+            (CQE_OPCODE(rsp_msg->cqe) == T3_READ_RESP)) {
+                post_qp_event(rnicp, chp, rsp_msg, IB_EVENT_QP_REQ_ERR, 1);
+                goto done;
+        }
+
+        /* Bad incoming write */
+        if (RQ_TYPE(rsp_msg->cqe) &&
+            (CQE_OPCODE(rsp_msg->cqe) == T3_RDMA_WRITE)) {
+                post_qp_event(rnicp, chp, rsp_msg, IB_EVENT_QP_REQ_ERR, 1);
+                goto done;
+        }
+
+        switch (CQE_STATUS(rsp_msg->cqe)) {
+
+        /* Completion Events */
+        case TPT_ERR_SUCCESS:
+
+                /*
+                 * Confirm the destination entry if this is a RECV completion.
+                 */
+                if (qhp->ep && SQ_TYPE(rsp_msg->cqe))
+                        dst_confirm(qhp->ep->dst);
+                (*chp->ibcq.comp_handler)(&chp->ibcq, chp->ibcq.cq_context);
+                break;
+
+        case TPT_ERR_STAG:
+        case TPT_ERR_PDID:
+        case TPT_ERR_QPID:
+        case TPT_ERR_ACCESS:
+        case TPT_ERR_WRAP:
+        case TPT_ERR_BOUND:
+        case TPT_ERR_INVALIDATE_SHARED_MR:
+        case TPT_ERR_INVALIDATE_MR_WITH_MW_BOUND:
+                printk(KERN_ERR "%s - CQE Err qpid 0x%x opcode %d status 0x%x "
+                       "type %d wrid.hi 0x%x wrid.lo 0x%x \n", __FUNCTION__,
+                       CQE_QPID(rsp_msg->cqe), CQE_OPCODE(rsp_msg->cqe),
+                       CQE_STATUS(rsp_msg->cqe), CQE_TYPE(rsp_msg->cqe),
+                       CQE_WRID_HI(rsp_msg->cqe), CQE_WRID_LOW(rsp_msg->cqe));
+                (*chp->ibcq.comp_handler)(&chp->ibcq, chp->ibcq.cq_context);
+                post_qp_event(rnicp, chp, rsp_msg, IB_EVENT_QP_ACCESS_ERR, 1);
+                break;
+
+        /* Device Fatal Errors */
+        case TPT_ERR_ECC:
+        case TPT_ERR_ECC_PSTAG:
+        case TPT_ERR_INTERNAL_ERR:
+                post_qp_event(rnicp, chp, rsp_msg, IB_EVENT_DEVICE_FATAL, 1);
+                break;
+
+        /* QP Fatal Errors */
+        case TPT_ERR_OUT_OF_RQE:
+        case TPT_ERR_PBL_ADDR_BOUND:
+        case TPT_ERR_CRC:
+        case TPT_ERR_MARKER:
+        case TPT_ERR_PDU_LEN_ERR:
+        case TPT_ERR_DDP_VERSION:
+        case TPT_ERR_RDMA_VERSION:
+        case TPT_ERR_OPCODE:
+        case TPT_ERR_DDP_QUEUE_NUM:
+        case TPT_ERR_MSN:
+        case TPT_ERR_TBIT:
+        case TPT_ERR_MO:
+        case TPT_ERR_MSN_GAP:
+        case TPT_ERR_MSN_RANGE:
+        case TPT_ERR_RQE_ADDR_BOUND:
+        case TPT_ERR_IRD_OVERFLOW:
+                post_qp_event(rnicp, chp, rsp_msg, IB_EVENT_QP_FATAL, 1);
+                break;
+
+        default:
+                printk(KERN_ERR MOD "Unknown T3 status 0x%x QPID 0x%x\n",
+                       CQE_STATUS(rsp_msg->cqe), qhp->wq.qpid);
+                post_qp_event(rnicp, chp, rsp_msg, IB_EVENT_QP_FATAL, 1);
+                break;
+        }
+done:
+        if (atomic_dec_and_test(&chp->refcnt))
+                wake_up(&chp->wait);
+        iwch_qp_rem_ref(&qhp->ibqp);
+out:
+        dev_kfree_skb_irq(skb);
+}
diff --git a/drivers/infiniband/hw/cxgb3/iwch_mem.c b/drivers/infiniband/hw/cxgb3/iwch_mem.c
new file mode 100644
index 000000000000..2b6cd53bb3fc
--- /dev/null
+++ b/drivers/infiniband/hw/cxgb3/iwch_mem.c
@@ -0,0 +1,172 @@
+/*
+ * Copyright (c) 2006 Chelsio, Inc. All rights reserved.
+ * Copyright (c) 2006 Open Grid Computing, Inc. All rights reserved.
+ *
+ * This software is available to you under a choice of one of two
+ * licenses.  You may choose to be licensed under the terms of the GNU
+ * General Public License (GPL) Version 2, available from the file
+ * COPYING in the main directory of this source tree, or the
+ * OpenIB.org BSD license below:
+ *
+ *     Redistribution and use in source and binary forms, with or
+ *     without modification, are permitted provided that the following
+ *     conditions are met:
+ *
+ *      - Redistributions of source code must retain the above
+ *        copyright notice, this list of conditions and the following
+ *        disclaimer.
+ *
+ *      - Redistributions in binary form must reproduce the above
+ *        copyright notice, this list of conditions and the following
+ *        disclaimer in the documentation and/or other materials
+ *        provided with the distribution.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+ * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+ * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+ * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
+ * BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
+ * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
+ * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+ * SOFTWARE.
+ */
+#include <asm/byteorder.h>
+
+#include <rdma/iw_cm.h>
+#include <rdma/ib_verbs.h>
+
+#include "cxio_hal.h"
+#include "iwch.h"
+#include "iwch_provider.h"
+
+int iwch_register_mem(struct iwch_dev *rhp, struct iwch_pd *php,
+                                        struct iwch_mr *mhp,
+                                        int shift,
+                                        __be64 *page_list)
+{
+        u32 stag;
+        u32 mmid;
+
+
+        if (cxio_register_phys_mem(&rhp->rdev,
+                                   &stag, mhp->attr.pdid,
+                                   mhp->attr.perms,
+                                   mhp->attr.zbva,
+                                   mhp->attr.va_fbo,
+                                   mhp->attr.len,
+                                   shift-12,
+                                   page_list,
+                                   &mhp->attr.pbl_size, &mhp->attr.pbl_addr))
+                return -ENOMEM;
+        mhp->attr.state = 1;
+        mhp->attr.stag = stag;
+        mmid = stag >> 8;
+        mhp->ibmr.rkey = mhp->ibmr.lkey = stag;
+        insert_handle(rhp, &rhp->mmidr, mhp, mmid);
+        PDBG("%s mmid 0x%x mhp %p\n", __FUNCTION__, mmid, mhp);
+        return 0;
+}
+
+int iwch_reregister_mem(struct iwch_dev *rhp, struct iwch_pd *php,
+                                        struct iwch_mr *mhp,
+                                        int shift,
+                                        __be64 *page_list,
+                                        int npages)
+{
+        u32 stag;
+        u32 mmid;
+
+
+        /* We could support this... */
+        if (npages > mhp->attr.pbl_size)
+                return -ENOMEM;
+
+        stag = mhp->attr.stag;
+        if (cxio_reregister_phys_mem(&rhp->rdev,
+                                   &stag, mhp->attr.pdid,
+                                   mhp->attr.perms,
+                                   mhp->attr.zbva,
+                                   mhp->attr.va_fbo,
+                                   mhp->attr.len,
+                                   shift-12,
+                                   page_list,
+                                   &mhp->attr.pbl_size, &mhp->attr.pbl_addr))
+                return -ENOMEM;
+        mhp->attr.state = 1;
+        mhp->attr.stag = stag;
+        mmid = stag >> 8;
+        mhp->ibmr.rkey = mhp->ibmr.lkey = stag;
+        insert_handle(rhp, &rhp->mmidr, mhp, mmid);
+        PDBG("%s mmid 0x%x mhp %p\n", __FUNCTION__, mmid, mhp);
+        return 0;
+}
+
+int build_phys_page_list(struct ib_phys_buf *buffer_list,
+                                        int num_phys_buf,
+                                        u64 *iova_start,
+                                        u64 *total_size,
+                                        int *npages,
+                                        int *shift,
+                                        __be64 **page_list)
+{
+        u64 mask;
+        int i, j, n;
+
+        mask = 0;
+        *total_size = 0;
+        for (i = 0; i < num_phys_buf; ++i) {
+                if (i != 0 && buffer_list[i].addr & ~PAGE_MASK)
+                        return -EINVAL;
+                if (i != 0 && i != num_phys_buf - 1 &&
+                    (buffer_list[i].size & ~PAGE_MASK))
+                        return -EINVAL;
+                *total_size += buffer_list[i].size;
+                if (i > 0)
+                        mask |= buffer_list[i].addr;
+        }
+
+        if (*total_size > 0xFFFFFFFFULL)
+                return -ENOMEM;
+
+        /* Find largest page shift we can use to cover buffers */
+        for (*shift = PAGE_SHIFT; *shift < 27; ++(*shift))
+                if (num_phys_buf > 1) {
+                        if ((1ULL << *shift) & mask)
+                                break;
+                } else
+                        if (1ULL << *shift >=
+                            buffer_list[0].size +
+                            (buffer_list[0].addr & ((1ULL << *shift) - 1)))
+                                break;
+
+        buffer_list[0].size += buffer_list[0].addr & ((1ULL << *shift) - 1);
+        buffer_list[0].addr &= ~0ull << *shift;
+
+        *npages = 0;
+        for (i = 0; i < num_phys_buf; ++i)
+                *npages += (buffer_list[i].size +
+                        (1ULL << *shift) - 1) >> *shift;
+
+        if (!*npages)
+                return -EINVAL;
+
+        *page_list = kmalloc(sizeof(u64) * *npages, GFP_KERNEL);
+        if (!*page_list)
+                return -ENOMEM;
+
+        n = 0;
+        for (i = 0; i < num_phys_buf; ++i)
+                for (j = 0;
+                     j < (buffer_list[i].size + (1ULL << *shift) - 1) >> *shift;
+                     ++j)
+                        (*page_list)[n++] = cpu_to_be64(buffer_list[i].addr +
+                            ((u64) j << *shift));
+
+        PDBG("%s va 0x%llx mask 0x%llx shift %d len %lld pbl_size %d\n",
+             __FUNCTION__, (unsigned long long) *iova_start,
+             (unsigned long long) mask, *shift, (unsigned long long) *total_size,
+             *npages);
+
+        return 0;
+
+}
diff --git a/drivers/infiniband/hw/cxgb3/iwch_provider.c b/drivers/infiniband/hw/cxgb3/iwch_provider.c
new file mode 100644
index 000000000000..6861087d776c
--- /dev/null
+++ b/drivers/infiniband/hw/cxgb3/iwch_provider.c
@@ -0,0 +1,1203 @@
+/*
+ * Copyright (c) 2006 Chelsio, Inc. All rights reserved.
+ * Copyright (c) 2006 Open Grid Computing, Inc. All rights reserved.
+ *
+ * This software is available to you under a choice of one of two
+ * licenses.  You may choose to be licensed under the terms of the GNU
+ * General Public License (GPL) Version 2, available from the file
+ * COPYING in the main directory of this source tree, or the
+ * OpenIB.org BSD license below:
+ *
+ *     Redistribution and use in source and binary forms, with or
+ *     without modification, are permitted provided that the following
+ *     conditions are met:
+ *
+ *      - Redistributions of source code must retain the above
+ *        copyright notice, this list of conditions and the following
+ *        disclaimer.
+ *
+ *      - Redistributions in binary form must reproduce the above
+ *        copyright notice, this list of conditions and the following
+ *        disclaimer in the documentation and/or other materials
+ *        provided with the distribution.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+ * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+ * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+ * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
+ * BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
+ * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
+ * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+ * SOFTWARE.
+ */
+#include <linux/module.h>
+#include <linux/moduleparam.h>
+#include <linux/device.h>
+#include <linux/netdevice.h>
+#include <linux/etherdevice.h>
+#include <linux/delay.h>
+#include <linux/errno.h>
+#include <linux/list.h>
+#include <linux/spinlock.h>
+#include <linux/ethtool.h>
+
+#include <asm/io.h>
+#include <asm/irq.h>
+#include <asm/byteorder.h>
+
+#include <rdma/iw_cm.h>
+#include <rdma/ib_verbs.h>
+#include <rdma/ib_smi.h>
+#include <rdma/ib_user_verbs.h>
+
+#include "cxio_hal.h"
+#include "iwch.h"
+#include "iwch_provider.h"
+#include "iwch_cm.h"
+#include "iwch_user.h"
+
+static int iwch_modify_port(struct ib_device *ibdev,
+                            u8 port, int port_modify_mask,
+                            struct ib_port_modify *props)
+{
+        return -ENOSYS;
+}
+
+static struct ib_ah *iwch_ah_create(struct ib_pd *pd,
+                                    struct ib_ah_attr *ah_attr)
+{
+        return ERR_PTR(-ENOSYS);
+}
+
+static int iwch_ah_destroy(struct ib_ah *ah)
+{
+        return -ENOSYS;
+}
+
+static int iwch_multicast_attach(struct ib_qp *ibqp, union ib_gid *gid, u16 lid)
+{
+        return -ENOSYS;
+}
+
+static int iwch_multicast_detach(struct ib_qp *ibqp, union ib_gid *gid, u16 lid)
+{
+        return -ENOSYS;
+}
+
+static int iwch_process_mad(struct ib_device *ibdev,
+                            int mad_flags,
+                            u8 port_num,
+                            struct ib_wc *in_wc,
+                            struct ib_grh *in_grh,
+                            struct ib_mad *in_mad, struct ib_mad *out_mad)
+{
+        return -ENOSYS;
+}
+
+static int iwch_dealloc_ucontext(struct ib_ucontext *context)
+{
+        struct iwch_dev *rhp = to_iwch_dev(context->device);
+        struct iwch_ucontext *ucontext = to_iwch_ucontext(context);
+        struct iwch_mm_entry *mm, *tmp;
+
+        PDBG("%s context %p\n", __FUNCTION__, context);
+        list_for_each_entry_safe(mm, tmp, &ucontext->mmaps, entry)
+                kfree(mm);
+        cxio_release_ucontext(&rhp->rdev, &ucontext->uctx);
+        kfree(ucontext);
+        return 0;
+}
+
+static struct ib_ucontext *iwch_alloc_ucontext(struct ib_device *ibdev,
+                                        struct ib_udata *udata)
+{
+        struct iwch_ucontext *context;
+        struct iwch_dev *rhp = to_iwch_dev(ibdev);
+
+        PDBG("%s ibdev %p\n", __FUNCTION__, ibdev);
+        context = kzalloc(sizeof(*context), GFP_KERNEL);
+        if (!context)
+                return ERR_PTR(-ENOMEM);
+        cxio_init_ucontext(&rhp->rdev, &context->uctx);
+        INIT_LIST_HEAD(&context->mmaps);
+        spin_lock_init(&context->mmap_lock);
+        return &context->ibucontext;
+}
+
+static int iwch_destroy_cq(struct ib_cq *ib_cq)
+{
+        struct iwch_cq *chp;
+
+        PDBG("%s ib_cq %p\n", __FUNCTION__, ib_cq);
+        chp = to_iwch_cq(ib_cq);
+
+        remove_handle(chp->rhp, &chp->rhp->cqidr, chp->cq.cqid);
+        atomic_dec(&chp->refcnt);
+        wait_event(chp->wait, !atomic_read(&chp->refcnt));
+
+        cxio_destroy_cq(&chp->rhp->rdev, &chp->cq);
+        kfree(chp);
+        return 0;
+}
+
+static struct ib_cq *iwch_create_cq(struct ib_device *ibdev, int entries,
+                             struct ib_ucontext *ib_context,
+                             struct ib_udata *udata)
+{
+        struct iwch_dev *rhp;
+        struct iwch_cq *chp;
+        struct iwch_create_cq_resp uresp;
+        struct iwch_create_cq_req ureq;
+        struct iwch_ucontext *ucontext = NULL;
+
+        PDBG("%s ib_dev %p entries %d\n", __FUNCTION__, ibdev, entries);
+        rhp = to_iwch_dev(ibdev);
+        chp = kzalloc(sizeof(*chp), GFP_KERNEL);
+        if (!chp)
+                return ERR_PTR(-ENOMEM);
+
+        if (ib_context) {
+                ucontext = to_iwch_ucontext(ib_context);
+                if (!t3a_device(rhp)) {
+                        if (ib_copy_from_udata(&ureq, udata, sizeof (ureq))) {
+                                kfree(chp);
+                                return ERR_PTR(-EFAULT);
+                        }
+                        chp->user_rptr_addr = (u32 __user *)(unsigned long)ureq.user_rptr_addr;
+                }
+        }
+
+        if (t3a_device(rhp)) {
+
+                /*
+                 * T3A: Add some fluff to handle extra CQEs inserted
+                 * for various errors.
+                 * Additional CQE possibilities:
+                 *      TERMINATE,
+                 *      incoming RDMA WRITE Failures
+                 *      incoming RDMA READ REQUEST FAILUREs
+                 * NOTE: We cannot ensure the CQ won't overflow.
+                 */
+                entries += 16;
+        }
+        entries = roundup_pow_of_two(entries);
+        chp->cq.size_log2 = ilog2(entries);
+
+        if (cxio_create_cq(&rhp->rdev, &chp->cq)) {
+                kfree(chp);
+                return ERR_PTR(-ENOMEM);
+        }
+        chp->rhp = rhp;
+        chp->ibcq.cqe = (1 << chp->cq.size_log2) - 1;
+        spin_lock_init(&chp->lock);
+        atomic_set(&chp->refcnt, 1);
+        init_waitqueue_head(&chp->wait);
+        insert_handle(rhp, &rhp->cqidr, chp, chp->cq.cqid);
+
+        if (ucontext) {
+                struct iwch_mm_entry *mm;
+
+                mm = kmalloc(sizeof *mm, GFP_KERNEL);
+                if (!mm) {
+                        iwch_destroy_cq(&chp->ibcq);
+                        return ERR_PTR(-ENOMEM);
+                }
+                uresp.cqid = chp->cq.cqid;
+                uresp.size_log2 = chp->cq.size_log2;
+                spin_lock(&ucontext->mmap_lock);
+                uresp.key = ucontext->key;
+                ucontext->key += PAGE_SIZE;
+                spin_unlock(&ucontext->mmap_lock);
+                if (ib_copy_to_udata(udata, &uresp, sizeof (uresp))) {
+                        kfree(mm);
+                        iwch_destroy_cq(&chp->ibcq);
+                        return ERR_PTR(-EFAULT);
+                }
+                mm->key = uresp.key;
+                mm->addr = virt_to_phys(chp->cq.queue);
+                mm->len = PAGE_ALIGN((1UL << uresp.size_log2) *
+                                             sizeof (struct t3_cqe));
+                insert_mmap(ucontext, mm);
+        }
+        PDBG("created cqid 0x%0x chp %p size 0x%0x, dma_addr 0x%0llx\n",
+             chp->cq.cqid, chp, (1 << chp->cq.size_log2),
+             (unsigned long long) chp->cq.dma_addr);
+        return &chp->ibcq;
+}
+
+static int iwch_resize_cq(struct ib_cq *cq, int cqe, struct ib_udata *udata)
+{
+#ifdef notyet
+        struct iwch_cq *chp = to_iwch_cq(cq);
+        struct t3_cq oldcq, newcq;
+        int ret;
+
+        PDBG("%s ib_cq %p cqe %d\n", __FUNCTION__, cq, cqe);
+
+        /* We don't downsize... */
+        if (cqe <= cq->cqe)
+                return 0;
+
+        /* create new t3_cq with new size */
+        cqe = roundup_pow_of_two(cqe+1);
+        newcq.size_log2 = ilog2(cqe);
+
+        /* Dont allow resize to less than the current wce count */
+        if (cqe < Q_COUNT(chp->cq.rptr, chp->cq.wptr)) {
+                return -ENOMEM;
+        }
+
+        /* Quiesce all QPs using this CQ */
+        ret = iwch_quiesce_qps(chp);
+        if (ret) {
+                return ret;
+        }
+
+        ret = cxio_create_cq(&chp->rhp->rdev, &newcq);
+        if (ret) {
+                return ret;
+        }
+
+        /* copy CQEs */
+        memcpy(newcq.queue, chp->cq.queue, (1 << chp->cq.size_log2) *
+                                        sizeof(struct t3_cqe));
+
+        /* old iwch_qp gets new t3_cq but keeps old cqid */
+        oldcq = chp->cq;
+        chp->cq = newcq;
+        chp->cq.cqid = oldcq.cqid;
+
+        /* resize new t3_cq to update the HW context */
+        ret = cxio_resize_cq(&chp->rhp->rdev, &chp->cq);
+        if (ret) {
+                chp->cq = oldcq;
+                return ret;
+        }
+        chp->ibcq.cqe = (1<<chp->cq.size_log2) - 1;
+
+        /* destroy old t3_cq */
+        oldcq.cqid = newcq.cqid;
+        ret = cxio_destroy_cq(&chp->rhp->rdev, &oldcq);
+        if (ret) {
+                printk(KERN_ERR MOD "%s - cxio_destroy_cq failed %d\n",
+                        __FUNCTION__, ret);
+        }
+
+        /* add user hooks here */
+
+        /* resume qps */
+        ret = iwch_resume_qps(chp);
+        return ret;
+#else
+        return -ENOSYS;
+#endif
+}
+
+static int iwch_arm_cq(struct ib_cq *ibcq, enum ib_cq_notify notify)
+{
+        struct iwch_dev *rhp;
+        struct iwch_cq *chp;
+        enum t3_cq_opcode cq_op;
+        int err;
+        unsigned long flag;
+        u32 rptr;
+
+        chp = to_iwch_cq(ibcq);
+        rhp = chp->rhp;
+        if (notify == IB_CQ_SOLICITED)
+                cq_op = CQ_ARM_SE;
+        else
+                cq_op = CQ_ARM_AN;
+        if (chp->user_rptr_addr) {
+                if (get_user(rptr, chp->user_rptr_addr))
+                        return -EFAULT;
+                spin_lock_irqsave(&chp->lock, flag);
+                chp->cq.rptr = rptr;
+        } else
+                spin_lock_irqsave(&chp->lock, flag);
+        PDBG("%s rptr 0x%x\n", __FUNCTION__, chp->cq.rptr);
+        err = cxio_hal_cq_op(&rhp->rdev, &chp->cq, cq_op, 0);
+        spin_unlock_irqrestore(&chp->lock, flag);
+        if (err)
+                printk(KERN_ERR MOD "Error %d rearming CQID 0x%x\n", err,
+                       chp->cq.cqid);
+        return err;
+}
+
+static int iwch_mmap(struct ib_ucontext *context, struct vm_area_struct *vma)
+{
+        int len = vma->vm_end - vma->vm_start;
+        u32 key = vma->vm_pgoff << PAGE_SHIFT;
+        struct cxio_rdev *rdev_p;
+        int ret = 0;
+        struct iwch_mm_entry *mm;
+        struct iwch_ucontext *ucontext;
+
+        PDBG("%s pgoff 0x%lx key 0x%x len %d\n", __FUNCTION__, vma->vm_pgoff,
+             key, len);
+
+        if (vma->vm_start & (PAGE_SIZE-1)) {
+                return -EINVAL;
+        }
+
+        rdev_p = &(to_iwch_dev(context->device)->rdev);
+        ucontext = to_iwch_ucontext(context);
+
+        mm = remove_mmap(ucontext, key, len);
+        if (!mm)
+                return -EINVAL;
+        kfree(mm);
+
+        if ((mm->addr >= rdev_p->rnic_info.udbell_physbase) &&
+            (mm->addr < (rdev_p->rnic_info.udbell_physbase +
+                       rdev_p->rnic_info.udbell_len))) {
+
+                /*
+                 * Map T3 DB register.
+                 */
+                if (vma->vm_flags & VM_READ) {
+                        return -EPERM;
+                }
+
+                vma->vm_page_prot = pgprot_noncached(vma->vm_page_prot);
+                vma->vm_flags |= VM_DONTCOPY | VM_DONTEXPAND;
+                vma->vm_flags &= ~VM_MAYREAD;
+                ret = io_remap_pfn_range(vma, vma->vm_start,
+                                         mm->addr >> PAGE_SHIFT,
+                                         len, vma->vm_page_prot);
+        } else {
+
+                /*
+                 * Map WQ or CQ contig dma memory...
+                 */
+                ret = remap_pfn_range(vma, vma->vm_start,
+                                      mm->addr >> PAGE_SHIFT,
+                                      len, vma->vm_page_prot);
+        }
+
+        return ret;
+}
+
+static int iwch_deallocate_pd(struct ib_pd *pd)
+{
+        struct iwch_dev *rhp;
+        struct iwch_pd *php;
+
+        php = to_iwch_pd(pd);
+        rhp = php->rhp;
+        PDBG("%s ibpd %p pdid 0x%x\n", __FUNCTION__, pd, php->pdid);
+        cxio_hal_put_pdid(rhp->rdev.rscp, php->pdid);
+        kfree(php);
+        return 0;
+}
+
+static struct ib_pd *iwch_allocate_pd(struct ib_device *ibdev,
+                               struct ib_ucontext *context,
+                               struct ib_udata *udata)
+{
+        struct iwch_pd *php;
+        u32 pdid;
+        struct iwch_dev *rhp;
+
+        PDBG("%s ibdev %p\n", __FUNCTION__, ibdev);
+        rhp = (struct iwch_dev *) ibdev;
+        pdid = cxio_hal_get_pdid(rhp->rdev.rscp);
+        if (!pdid)
+                return ERR_PTR(-EINVAL);
+        php = kzalloc(sizeof(*php), GFP_KERNEL);
+        if (!php) {
+                cxio_hal_put_pdid(rhp->rdev.rscp, pdid);
+                return ERR_PTR(-ENOMEM);
+        }
+        php->pdid = pdid;
+        php->rhp = rhp;
+        if (context) {
+                if (ib_copy_to_udata(udata, &php->pdid, sizeof (__u32))) {
+                        iwch_deallocate_pd(&php->ibpd);
+                        return ERR_PTR(-EFAULT);
+                }
+        }
+        PDBG("%s pdid 0x%0x ptr 0x%p\n", __FUNCTION__, pdid, php);
+        return &php->ibpd;
+}
+
+static int iwch_dereg_mr(struct ib_mr *ib_mr)
+{
+        struct iwch_dev *rhp;
+        struct iwch_mr *mhp;
+        u32 mmid;
+
+        PDBG("%s ib_mr %p\n", __FUNCTION__, ib_mr);
+        /* There can be no memory windows */
+        if (atomic_read(&ib_mr->usecnt))
+                return -EINVAL;
+
+        mhp = to_iwch_mr(ib_mr);
+        rhp = mhp->rhp;
+        mmid = mhp->attr.stag >> 8;
+        cxio_dereg_mem(&rhp->rdev, mhp->attr.stag, mhp->attr.pbl_size,
+                       mhp->attr.pbl_addr);
+        remove_handle(rhp, &rhp->mmidr, mmid);
+        if (mhp->kva)
+                kfree((void *) (unsigned long) mhp->kva);
+        PDBG("%s mmid 0x%x ptr %p\n", __FUNCTION__, mmid, mhp);
+        kfree(mhp);
+        return 0;
+}
+
+static struct ib_mr *iwch_register_phys_mem(struct ib_pd *pd,
+                                        struct ib_phys_buf *buffer_list,
+                                        int num_phys_buf,
+                                        int acc,
+                                        u64 *iova_start)
+{
+        __be64 *page_list;
+        int shift;
+        u64 total_size;
+        int npages;
+        struct iwch_dev *rhp;
+        struct iwch_pd *php;
+        struct iwch_mr *mhp;
+        int ret;
+
+        PDBG("%s ib_pd %p\n", __FUNCTION__, pd);
+        php = to_iwch_pd(pd);
+        rhp = php->rhp;
+
+        acc = iwch_convert_access(acc);
+
+
+        mhp = kzalloc(sizeof(*mhp), GFP_KERNEL);
+        if (!mhp)
+                return ERR_PTR(-ENOMEM);
+
+        /* First check that we have enough alignment */
+        if ((*iova_start & ~PAGE_MASK) != (buffer_list[0].addr & ~PAGE_MASK)) {
+                ret = -EINVAL;
+                goto err;
+        }
+
+        if (num_phys_buf > 1 &&
+            ((buffer_list[0].addr + buffer_list[0].size) & ~PAGE_MASK)) {
+                ret = -EINVAL;
+                goto err;
+        }
+
+        ret = build_phys_page_list(buffer_list, num_phys_buf, iova_start,
+                                   &total_size, &npages, &shift, &page_list);
+        if (ret)
+                goto err;
+
+        mhp->rhp = rhp;
+        mhp->attr.pdid = php->pdid;
+        mhp->attr.zbva = 0;
+
+        /* NOTE: TPT perms are backwards from BIND WR perms! */
+        mhp->attr.perms = (acc & 0x1) << 3;
+        mhp->attr.perms |= (acc & 0x2) << 1;
+        mhp->attr.perms |= (acc & 0x4) >> 1;
+        mhp->attr.perms |= (acc & 0x8) >> 3;
+
+        mhp->attr.va_fbo = *iova_start;
+        mhp->attr.page_size = shift - 12;
+
+        mhp->attr.len = (u32) total_size;
+        mhp->attr.pbl_size = npages;
+        ret = iwch_register_mem(rhp, php, mhp, shift, page_list);
+        kfree(page_list);
+        if (ret) {
+                goto err;
+        }
+        return &mhp->ibmr;
+err:
+        kfree(mhp);
+        return ERR_PTR(ret);
+
+}
+
+static int iwch_reregister_phys_mem(struct ib_mr *mr,
+                                     int mr_rereg_mask,
+                                     struct ib_pd *pd,
+                                     struct ib_phys_buf *buffer_list,
+                                     int num_phys_buf,
+                                     int acc, u64 * iova_start)
+{
+
+        struct iwch_mr mh, *mhp;
+        struct iwch_pd *php;
+        struct iwch_dev *rhp;
+        int new_acc;
+        __be64 *page_list = NULL;
+        int shift = 0;
+        u64 total_size;
+        int npages;
+        int ret;
+
+        PDBG("%s ib_mr %p ib_pd %p\n", __FUNCTION__, mr, pd);
+
+        /* There can be no memory windows */
+        if (atomic_read(&mr->usecnt))
+                return -EINVAL;
+
+        mhp = to_iwch_mr(mr);
+        rhp = mhp->rhp;
+        php = to_iwch_pd(mr->pd);
+
+        /* make sure we are on the same adapter */
+        if (rhp != php->rhp)
+                return -EINVAL;
+
+        new_acc = mhp->attr.perms;
+
+        memcpy(&mh, mhp, sizeof *mhp);
+
+        if (mr_rereg_mask & IB_MR_REREG_PD)
+                php = to_iwch_pd(pd);
+        if (mr_rereg_mask & IB_MR_REREG_ACCESS)
+                mh.attr.perms = iwch_convert_access(acc);
+        if (mr_rereg_mask & IB_MR_REREG_TRANS)
+                ret = build_phys_page_list(buffer_list, num_phys_buf,
+                                           iova_start,
+                                           &total_size, &npages,
+                                           &shift, &page_list);
+
+        ret = iwch_reregister_mem(rhp, php, &mh, shift, page_list, npages);
+        kfree(page_list);
+        if (ret) {
+                return ret;
+        }
+        if (mr_rereg_mask & IB_MR_REREG_PD)
+                mhp->attr.pdid = php->pdid;
+        if (mr_rereg_mask & IB_MR_REREG_ACCESS)
+                mhp->attr.perms = acc;
+        if (mr_rereg_mask & IB_MR_REREG_TRANS) {
+                mhp->attr.zbva = 0;
+                mhp->attr.va_fbo = *iova_start;
+                mhp->attr.page_size = shift - 12;
+                mhp->attr.len = (u32) total_size;
+                mhp->attr.pbl_size = npages;
+        }
+
+        return 0;
+}
+
+
+static struct ib_mr *iwch_reg_user_mr(struct ib_pd *pd, struct ib_umem *region,
+                                      int acc, struct ib_udata *udata)
+{
+        __be64 *pages;
+        int shift, n, len;
+        int i, j, k;
+        int err = 0;
+        struct ib_umem_chunk *chunk;
+        struct iwch_dev *rhp;
+        struct iwch_pd *php;
+        struct iwch_mr *mhp;
+        struct iwch_reg_user_mr_resp uresp;
+
+        PDBG("%s ib_pd %p\n", __FUNCTION__, pd);
+        shift = ffs(region->page_size) - 1;
+
+        php = to_iwch_pd(pd);
+        rhp = php->rhp;
+        mhp = kzalloc(sizeof(*mhp), GFP_KERNEL);
+        if (!mhp)
+                return ERR_PTR(-ENOMEM);
+
+        n = 0;
+        list_for_each_entry(chunk, &region->chunk_list, list)
+                n += chunk->nents;
+
+        pages = kmalloc(n * sizeof(u64), GFP_KERNEL);
+        if (!pages) {
+                err = -ENOMEM;
+                goto err;
+        }
+
+        acc = iwch_convert_access(acc);
+
+        i = n = 0;
+
+        list_for_each_entry(chunk, &region->chunk_list, list)
+                for (j = 0; j < chunk->nmap; ++j) {
+                        len = sg_dma_len(&chunk->page_list[j]) >> shift;
+                        for (k = 0; k < len; ++k) {
+                                pages[i++] = cpu_to_be64(sg_dma_address(
+                                        &chunk->page_list[j]) +
+                                        region->page_size * k);
+                        }
+                }
+
+        mhp->rhp = rhp;
+        mhp->attr.pdid = php->pdid;
+        mhp->attr.zbva = 0;
+        mhp->attr.perms = (acc & 0x1) << 3;
+        mhp->attr.perms |= (acc & 0x2) << 1;
+        mhp->attr.perms |= (acc & 0x4) >> 1;
+        mhp->attr.perms |= (acc & 0x8) >> 3;
+        mhp->attr.va_fbo = region->virt_base;
+        mhp->attr.page_size = shift - 12;
+        mhp->attr.len = (u32) region->length;
+        mhp->attr.pbl_size = i;
+        err = iwch_register_mem(rhp, php, mhp, shift, pages);
+        kfree(pages);
+        if (err)
+                goto err;
+
+        if (udata && t3b_device(rhp)) {
+                uresp.pbl_addr = (mhp->attr.pbl_addr -
+                                 rhp->rdev.rnic_info.pbl_base) >> 3;
+                PDBG("%s user resp pbl_addr 0x%x\n", __FUNCTION__,
+                     uresp.pbl_addr);
+
+                if (ib_copy_to_udata(udata, &uresp, sizeof (uresp))) {
+                        iwch_dereg_mr(&mhp->ibmr);
+                        err = -EFAULT;
+                        goto err;
+                }
+        }
+
+        return &mhp->ibmr;
+
+err:
+        kfree(mhp);
+        return ERR_PTR(err);
+}
+
+static struct ib_mr *iwch_get_dma_mr(struct ib_pd *pd, int acc)
+{
+        struct ib_phys_buf bl;
+        u64 kva;
+        struct ib_mr *ibmr;
+
+        PDBG("%s ib_pd %p\n", __FUNCTION__, pd);
+
+        /*
+         * T3 only supports 32 bits of size.
+         */
+        bl.size = 0xffffffff;
+        bl.addr = 0;
+        kva = 0;
+        ibmr = iwch_register_phys_mem(pd, &bl, 1, acc, &kva);
+        return ibmr;
+}
+
+static struct ib_mw *iwch_alloc_mw(struct ib_pd *pd)
+{
+        struct iwch_dev *rhp;
+        struct iwch_pd *php;
+        struct iwch_mw *mhp;
+        u32 mmid;
+        u32 stag = 0;
+        int ret;
+
+        php = to_iwch_pd(pd);
+        rhp = php->rhp;
+        mhp = kzalloc(sizeof(*mhp), GFP_KERNEL);
+        if (!mhp)
+                return ERR_PTR(-ENOMEM);
+        ret = cxio_allocate_window(&rhp->rdev, &stag, php->pdid);
+        if (ret) {
+                kfree(mhp);
+                return ERR_PTR(ret);
+        }
+        mhp->rhp = rhp;
+        mhp->attr.pdid = php->pdid;
+        mhp->attr.type = TPT_MW;
+        mhp->attr.stag = stag;
+        mmid = (stag) >> 8;
+        insert_handle(rhp, &rhp->mmidr, mhp, mmid);
+        PDBG("%s mmid 0x%x mhp %p stag 0x%x\n", __FUNCTION__, mmid, mhp, stag);
+        return &(mhp->ibmw);
+}
+
+static int iwch_dealloc_mw(struct ib_mw *mw)
+{
+        struct iwch_dev *rhp;
+        struct iwch_mw *mhp;
+        u32 mmid;
+
+        mhp = to_iwch_mw(mw);
+        rhp = mhp->rhp;
+        mmid = (mw->rkey) >> 8;
+        cxio_deallocate_window(&rhp->rdev, mhp->attr.stag);
+        remove_handle(rhp, &rhp->mmidr, mmid);
+        kfree(mhp);
+        PDBG("%s ib_mw %p mmid 0x%x ptr %p\n", __FUNCTION__, mw, mmid, mhp);
+        return 0;
+}
+
+static int iwch_destroy_qp(struct ib_qp *ib_qp)
+{
+        struct iwch_dev *rhp;
+        struct iwch_qp *qhp;
+        struct iwch_qp_attributes attrs;
+        struct iwch_ucontext *ucontext;
+
+        qhp = to_iwch_qp(ib_qp);
+        rhp = qhp->rhp;
+
+        if (qhp->attr.state == IWCH_QP_STATE_RTS) {
+                attrs.next_state = IWCH_QP_STATE_ERROR;
+                iwch_modify_qp(rhp, qhp, IWCH_QP_ATTR_NEXT_STATE, &attrs, 0);
+        }
+        wait_event(qhp->wait, !qhp->ep);
+
+        remove_handle(rhp, &rhp->qpidr, qhp->wq.qpid);
+
+        atomic_dec(&qhp->refcnt);
+        wait_event(qhp->wait, !atomic_read(&qhp->refcnt));
+
+        ucontext = ib_qp->uobject ? to_iwch_ucontext(ib_qp->uobject->context)
+                                  : NULL;
+        cxio_destroy_qp(&rhp->rdev, &qhp->wq,
+                        ucontext ? &ucontext->uctx : &rhp->rdev.uctx);
+
+        PDBG("%s ib_qp %p qpid 0x%0x qhp %p\n", __FUNCTION__,
+             ib_qp, qhp->wq.qpid, qhp);
+        kfree(qhp);
+        return 0;
+}
+
+static struct ib_qp *iwch_create_qp(struct ib_pd *pd,
+                             struct ib_qp_init_attr *attrs,
+                             struct ib_udata *udata)
+{
+        struct iwch_dev *rhp;
+        struct iwch_qp *qhp;
+        struct iwch_pd *php;
+        struct iwch_cq *schp;
+        struct iwch_cq *rchp;
+        struct iwch_create_qp_resp uresp;
+        int wqsize, sqsize, rqsize;
+        struct iwch_ucontext *ucontext;
+
+        PDBG("%s ib_pd %p\n", __FUNCTION__, pd);
+        if (attrs->qp_type != IB_QPT_RC)
+                return ERR_PTR(-EINVAL);
+        php = to_iwch_pd(pd);
+        rhp = php->rhp;
+        schp = get_chp(rhp, ((struct iwch_cq *) attrs->send_cq)->cq.cqid);
+        rchp = get_chp(rhp, ((struct iwch_cq *) attrs->recv_cq)->cq.cqid);
+        if (!schp || !rchp)
+                return ERR_PTR(-EINVAL);
+
+        /* The RQT size must be # of entries + 1 rounded up to a power of two */
+        rqsize = roundup_pow_of_two(attrs->cap.max_recv_wr);
+        if (rqsize == attrs->cap.max_recv_wr)
+                rqsize = roundup_pow_of_two(attrs->cap.max_recv_wr+1);
+
+        /* T3 doesn't support RQT depth < 16 */
+        if (rqsize < 16)
+                rqsize = 16;
+
+        if (rqsize > T3_MAX_RQ_SIZE)
+                return ERR_PTR(-EINVAL);
+
+        /*
+         * NOTE: The SQ and total WQ sizes don't need to be
+         * a power of two.  However, all the code assumes
+         * they are. EG: Q_FREECNT() and friends.
+         */
+        sqsize = roundup_pow_of_two(attrs->cap.max_send_wr);
+        wqsize = roundup_pow_of_two(rqsize + sqsize);
+        PDBG("%s wqsize %d sqsize %d rqsize %d\n", __FUNCTION__,
+             wqsize, sqsize, rqsize);
+        qhp = kzalloc(sizeof(*qhp), GFP_KERNEL);
+        if (!qhp)
+                return ERR_PTR(-ENOMEM);
+        qhp->wq.size_log2 = ilog2(wqsize);
+        qhp->wq.rq_size_log2 = ilog2(rqsize);
+        qhp->wq.sq_size_log2 = ilog2(sqsize);
+        ucontext = pd->uobject ? to_iwch_ucontext(pd->uobject->context) : NULL;
+        if (cxio_create_qp(&rhp->rdev, !udata, &qhp->wq,
+                           ucontext ? &ucontext->uctx : &rhp->rdev.uctx)) {
+                kfree(qhp);
+                return ERR_PTR(-ENOMEM);
+        }
+        attrs->cap.max_recv_wr = rqsize - 1;
+        attrs->cap.max_send_wr = sqsize;
+        qhp->rhp = rhp;
+        qhp->attr.pd = php->pdid;
+        qhp->attr.scq = ((struct iwch_cq *) attrs->send_cq)->cq.cqid;
+        qhp->attr.rcq = ((struct iwch_cq *) attrs->recv_cq)->cq.cqid;
+        qhp->attr.sq_num_entries = attrs->cap.max_send_wr;
+        qhp->attr.rq_num_entries = attrs->cap.max_recv_wr;
+        qhp->attr.sq_max_sges = attrs->cap.max_send_sge;
+        qhp->attr.sq_max_sges_rdma_write = attrs->cap.max_send_sge;
+        qhp->attr.rq_max_sges = attrs->cap.max_recv_sge;
+        qhp->attr.state = IWCH_QP_STATE_IDLE;
+        qhp->attr.next_state = IWCH_QP_STATE_IDLE;
+
+        /*
+         * XXX - These don't get passed in from the openib user
+         * at create time.  The CM sets them via a QP modify.
+         * Need to fix...  I think the CM should
+         */
+        qhp->attr.enable_rdma_read = 1;
+        qhp->attr.enable_rdma_write = 1;
+        qhp->attr.enable_bind = 1;
+        qhp->attr.max_ord = 1;
+        qhp->attr.max_ird = 1;
+
+        spin_lock_init(&qhp->lock);
+        init_waitqueue_head(&qhp->wait);
+        atomic_set(&qhp->refcnt, 1);
+        insert_handle(rhp, &rhp->qpidr, qhp, qhp->wq.qpid);
+
+        if (udata) {
+
+                struct iwch_mm_entry *mm1, *mm2;
+
+                mm1 = kmalloc(sizeof *mm1, GFP_KERNEL);
+                if (!mm1) {
+                        iwch_destroy_qp(&qhp->ibqp);
+                        return ERR_PTR(-ENOMEM);
+                }
+
+                mm2 = kmalloc(sizeof *mm2, GFP_KERNEL);
+                if (!mm2) {
+                        kfree(mm1);
+                        iwch_destroy_qp(&qhp->ibqp);
+                        return ERR_PTR(-ENOMEM);
+                }
+
+                uresp.qpid = qhp->wq.qpid;
+                uresp.size_log2 = qhp->wq.size_log2;
+                uresp.sq_size_log2 = qhp->wq.sq_size_log2;
+                uresp.rq_size_log2 = qhp->wq.rq_size_log2;
+                spin_lock(&ucontext->mmap_lock);
+                uresp.key = ucontext->key;
+                ucontext->key += PAGE_SIZE;
+                uresp.db_key = ucontext->key;
+                ucontext->key += PAGE_SIZE;
+                spin_unlock(&ucontext->mmap_lock);
+                if (ib_copy_to_udata(udata, &uresp, sizeof (uresp))) {
+                        kfree(mm1);
+                        kfree(mm2);
+                        iwch_destroy_qp(&qhp->ibqp);
+                        return ERR_PTR(-EFAULT);
+                }
+                mm1->key = uresp.key;
+                mm1->addr = virt_to_phys(qhp->wq.queue);
+                mm1->len = PAGE_ALIGN(wqsize * sizeof (union t3_wr));
+                insert_mmap(ucontext, mm1);
+                mm2->key = uresp.db_key;
+                mm2->addr = qhp->wq.udb & PAGE_MASK;
+                mm2->len = PAGE_SIZE;
+                insert_mmap(ucontext, mm2);
+        }
+        qhp->ibqp.qp_num = qhp->wq.qpid;
+        init_timer(&(qhp->timer));
+        PDBG("%s sq_num_entries %d, rq_num_entries %d "
+             "qpid 0x%0x qhp %p dma_addr 0x%llx size %d\n",
+             __FUNCTION__, qhp->attr.sq_num_entries, qhp->attr.rq_num_entries,
+             qhp->wq.qpid, qhp, (unsigned long long) qhp->wq.dma_addr,
+             1 << qhp->wq.size_log2);
+        return &qhp->ibqp;
+}
+
+static int iwch_ib_modify_qp(struct ib_qp *ibqp, struct ib_qp_attr *attr,
+                      int attr_mask, struct ib_udata *udata)
+{
+        struct iwch_dev *rhp;
+        struct iwch_qp *qhp;
+        enum iwch_qp_attr_mask mask = 0;
+        struct iwch_qp_attributes attrs;
+
+        PDBG("%s ib_qp %p\n", __FUNCTION__, ibqp);
+
+        /* iwarp does not support the RTR state */
+        if ((attr_mask & IB_QP_STATE) && (attr->qp_state == IB_QPS_RTR))
+                attr_mask &= ~IB_QP_STATE;
+
+        /* Make sure we still have something left to do */
+        if (!attr_mask)
+                return 0;
+
+        memset(&attrs, 0, sizeof attrs);
+        qhp = to_iwch_qp(ibqp);
+        rhp = qhp->rhp;
+
+        attrs.next_state = iwch_convert_state(attr->qp_state);
+        attrs.enable_rdma_read = (attr->qp_access_flags &
+                               IB_ACCESS_REMOTE_READ) ?  1 : 0;
+        attrs.enable_rdma_write = (attr->qp_access_flags &
+                                IB_ACCESS_REMOTE_WRITE) ? 1 : 0;
+        attrs.enable_bind = (attr->qp_access_flags & IB_ACCESS_MW_BIND) ? 1 : 0;
+
+
+        mask |= (attr_mask & IB_QP_STATE) ? IWCH_QP_ATTR_NEXT_STATE : 0;
+        mask |= (attr_mask & IB_QP_ACCESS_FLAGS) ?
+                        (IWCH_QP_ATTR_ENABLE_RDMA_READ |
+                         IWCH_QP_ATTR_ENABLE_RDMA_WRITE |
+                         IWCH_QP_ATTR_ENABLE_RDMA_BIND) : 0;
+
+        return iwch_modify_qp(rhp, qhp, mask, &attrs, 0);
+}
+
+void iwch_qp_add_ref(struct ib_qp *qp)
+{
+        PDBG("%s ib_qp %p\n", __FUNCTION__, qp);
+        atomic_inc(&(to_iwch_qp(qp)->refcnt));
+}
+
+void iwch_qp_rem_ref(struct ib_qp *qp)
+{
+        PDBG("%s ib_qp %p\n", __FUNCTION__, qp);
+        if (atomic_dec_and_test(&(to_iwch_qp(qp)->refcnt)))
+                wake_up(&(to_iwch_qp(qp)->wait));
+}
+
+struct ib_qp *iwch_get_qp(struct ib_device *dev, int qpn)
+{
+        PDBG("%s ib_dev %p qpn 0x%x\n", __FUNCTION__, dev, qpn);
+        return (struct ib_qp *)get_qhp(to_iwch_dev(dev), qpn);
+}
+
+
+static int iwch_query_pkey(struct ib_device *ibdev,
+                           u8 port, u16 index, u16 * pkey)
+{
+        PDBG("%s ibdev %p\n", __FUNCTION__, ibdev);
+        *pkey = 0;
+        return 0;
+}
+
+static int iwch_query_gid(struct ib_device *ibdev, u8 port,
+                          int index, union ib_gid *gid)
+{
+        struct iwch_dev *dev;
+
+        PDBG("%s ibdev %p, port %d, index %d, gid %p\n",
+               __FUNCTION__, ibdev, port, index, gid);
+        dev = to_iwch_dev(ibdev);
+        BUG_ON(port == 0 || port > 2);
+        memset(&(gid->raw[0]), 0, sizeof(gid->raw));
+        memcpy(&(gid->raw[0]), dev->rdev.port_info.lldevs[port-1]->dev_addr, 6);
+        return 0;
+}
+
+static int iwch_query_device(struct ib_device *ibdev,
+                             struct ib_device_attr *props)
+{
+
+        struct iwch_dev *dev;
+        PDBG("%s ibdev %p\n", __FUNCTION__, ibdev);
+
+        dev = to_iwch_dev(ibdev);
+        memset(props, 0, sizeof *props);
+        memcpy(&props->sys_image_guid, dev->rdev.t3cdev_p->lldev->dev_addr, 6);
+        props->device_cap_flags = dev->device_cap_flags;
+        props->vendor_id = (u32)dev->rdev.rnic_info.pdev->vendor;
+        props->vendor_part_id = (u32)dev->rdev.rnic_info.pdev->device;
+        props->max_mr_size = ~0ull;
+        props->max_qp = dev->attr.max_qps;
+        props->max_qp_wr = dev->attr.max_wrs;
+        props->max_sge = dev->attr.max_sge_per_wr;
+        props->max_sge_rd = 1;
+        props->max_qp_rd_atom = dev->attr.max_rdma_reads_per_qp;
+        props->max_cq = dev->attr.max_cqs;
+        props->max_cqe = dev->attr.max_cqes_per_cq;
+        props->max_mr = dev->attr.max_mem_regs;
+        props->max_pd = dev->attr.max_pds;
+        props->local_ca_ack_delay = 0;
+
+        return 0;
+}
+
+static int iwch_query_port(struct ib_device *ibdev,
+                           u8 port, struct ib_port_attr *props)
+{
+        PDBG("%s ibdev %p\n", __FUNCTION__, ibdev);
+        props->max_mtu = IB_MTU_4096;
+        props->lid = 0;
+        props->lmc = 0;
+        props->sm_lid = 0;
+        props->sm_sl = 0;
+        props->state = IB_PORT_ACTIVE;
+        props->phys_state = 0;
+        props->port_cap_flags =
+            IB_PORT_CM_SUP |
+            IB_PORT_SNMP_TUNNEL_SUP |
+            IB_PORT_REINIT_SUP |
+            IB_PORT_DEVICE_MGMT_SUP |
+            IB_PORT_VENDOR_CLASS_SUP | IB_PORT_BOOT_MGMT_SUP;
+        props->gid_tbl_len = 1;
+        props->pkey_tbl_len = 1;
+        props->qkey_viol_cntr = 0;
+        props->active_width = 2;
+        props->active_speed = 2;
+        props->max_msg_sz = -1;
+
+        return 0;
+}
+
+static ssize_t show_rev(struct class_device *cdev, char *buf)
+{
+        struct iwch_dev *dev = container_of(cdev, struct iwch_dev,
+                                            ibdev.class_dev);
+        PDBG("%s class dev 0x%p\n", __FUNCTION__, cdev);
+        return sprintf(buf, "%d\n", dev->rdev.t3cdev_p->type);
+}
+
+static ssize_t show_fw_ver(struct class_device *cdev, char *buf)
+{
+        struct iwch_dev *dev = container_of(cdev, struct iwch_dev,
+                                            ibdev.class_dev);
+        struct ethtool_drvinfo info;
+        struct net_device *lldev = dev->rdev.t3cdev_p->lldev;
+
+        PDBG("%s class dev 0x%p\n", __FUNCTION__, cdev);
+        lldev->ethtool_ops->get_drvinfo(lldev, &info);
+        return sprintf(buf, "%s\n", info.fw_version);
+}
+
+static ssize_t show_hca(struct class_device *cdev, char *buf)
+{
+        struct iwch_dev *dev = container_of(cdev, struct iwch_dev,
+                                            ibdev.class_dev);
+        struct ethtool_drvinfo info;
+        struct net_device *lldev = dev->rdev.t3cdev_p->lldev;
+
+        PDBG("%s class dev 0x%p\n", __FUNCTION__, cdev);
+        lldev->ethtool_ops->get_drvinfo(lldev, &info);
+        return sprintf(buf, "%s\n", info.driver);
+}
+
+static ssize_t show_board(struct class_device *cdev, char *buf)
+{
+        struct iwch_dev *dev = container_of(cdev, struct iwch_dev,
+                                            ibdev.class_dev);
+        PDBG("%s class dev 0x%p\n", __FUNCTION__, dev);
+        return sprintf(buf, "%x.%x\n", dev->rdev.rnic_info.pdev->vendor,
+                                       dev->rdev.rnic_info.pdev->device);
+}
+
+static CLASS_DEVICE_ATTR(hw_rev, S_IRUGO, show_rev, NULL);
+static CLASS_DEVICE_ATTR(fw_ver, S_IRUGO, show_fw_ver, NULL);
+static CLASS_DEVICE_ATTR(hca_type, S_IRUGO, show_hca, NULL);
+static CLASS_DEVICE_ATTR(board_id, S_IRUGO, show_board, NULL);
+
+static struct class_device_attribute *iwch_class_attributes[] = {
+        &class_device_attr_hw_rev,
+        &class_device_attr_fw_ver,
+        &class_device_attr_hca_type,
+        &class_device_attr_board_id
+};
+
+int iwch_register_device(struct iwch_dev *dev)
+{
+        int ret;
+        int i;
+
+        PDBG("%s iwch_dev %p\n", __FUNCTION__, dev);
+        strlcpy(dev->ibdev.name, "cxgb3_%d", IB_DEVICE_NAME_MAX);
+        memset(&dev->ibdev.node_guid, 0, sizeof(dev->ibdev.node_guid));
+        memcpy(&dev->ibdev.node_guid, dev->rdev.t3cdev_p->lldev->dev_addr, 6);
+        dev->ibdev.owner = THIS_MODULE;
+        dev->device_cap_flags =
+            (IB_DEVICE_ZERO_STAG |
+             IB_DEVICE_SEND_W_INV | IB_DEVICE_MEM_WINDOW);
+
+        dev->ibdev.uverbs_cmd_mask =
+            (1ull << IB_USER_VERBS_CMD_GET_CONTEXT) |
+            (1ull << IB_USER_VERBS_CMD_QUERY_DEVICE) |
+            (1ull << IB_USER_VERBS_CMD_QUERY_PORT) |
+            (1ull << IB_USER_VERBS_CMD_ALLOC_PD) |
+            (1ull << IB_USER_VERBS_CMD_DEALLOC_PD) |
+            (1ull << IB_USER_VERBS_CMD_REG_MR) |
+            (1ull << IB_USER_VERBS_CMD_DEREG_MR) |
+            (1ull << IB_USER_VERBS_CMD_CREATE_COMP_CHANNEL) |
+            (1ull << IB_USER_VERBS_CMD_CREATE_CQ) |
+            (1ull << IB_USER_VERBS_CMD_DESTROY_CQ) |
+            (1ull << IB_USER_VERBS_CMD_REQ_NOTIFY_CQ) |
+            (1ull << IB_USER_VERBS_CMD_CREATE_QP) |
+            (1ull << IB_USER_VERBS_CMD_MODIFY_QP) |
+            (1ull << IB_USER_VERBS_CMD_POLL_CQ) |
+            (1ull << IB_USER_VERBS_CMD_DESTROY_QP) |
+            (1ull << IB_USER_VERBS_CMD_POST_SEND) |
+            (1ull << IB_USER_VERBS_CMD_POST_RECV);
+        dev->ibdev.node_type = RDMA_NODE_RNIC;
+        memcpy(dev->ibdev.node_desc, IWCH_NODE_DESC, sizeof(IWCH_NODE_DESC));
+        dev->ibdev.phys_port_cnt = dev->rdev.port_info.nports;
+        dev->ibdev.dma_device = &(dev->rdev.rnic_info.pdev->dev);
+        dev->ibdev.class_dev.dev = &(dev->rdev.rnic_info.pdev->dev);
+        dev->ibdev.query_device = iwch_query_device;
+        dev->ibdev.query_port = iwch_query_port;
+        dev->ibdev.modify_port = iwch_modify_port;
+        dev->ibdev.query_pkey = iwch_query_pkey;
+        dev->ibdev.query_gid = iwch_query_gid;
+        dev->ibdev.alloc_ucontext = iwch_alloc_ucontext;
+        dev->ibdev.dealloc_ucontext = iwch_dealloc_ucontext;
+        dev->ibdev.mmap = iwch_mmap;
+        dev->ibdev.alloc_pd = iwch_allocate_pd;
+        dev->ibdev.dealloc_pd = iwch_deallocate_pd;
+        dev->ibdev.create_ah = iwch_ah_create;
+        dev->ibdev.destroy_ah = iwch_ah_destroy;
+        dev->ibdev.create_qp = iwch_create_qp;
+        dev->ibdev.modify_qp = iwch_ib_modify_qp;
+        dev->ibdev.destroy_qp = iwch_destroy_qp;
+        dev->ibdev.create_cq = iwch_create_cq;
+        dev->ibdev.destroy_cq = iwch_destroy_cq;
+        dev->ibdev.resize_cq = iwch_resize_cq;
+        dev->ibdev.poll_cq = iwch_poll_cq;
+        dev->ibdev.get_dma_mr = iwch_get_dma_mr;
+        dev->ibdev.reg_phys_mr = iwch_register_phys_mem;
+        dev->ibdev.rereg_phys_mr = iwch_reregister_phys_mem;
+        dev->ibdev.reg_user_mr = iwch_reg_user_mr;
+        dev->ibdev.dereg_mr = iwch_dereg_mr;
+        dev->ibdev.alloc_mw = iwch_alloc_mw;
+        dev->ibdev.bind_mw = iwch_bind_mw;
+        dev->ibdev.dealloc_mw = iwch_dealloc_mw;
+
+        dev->ibdev.attach_mcast = iwch_multicast_attach;
+        dev->ibdev.detach_mcast = iwch_multicast_detach;
+        dev->ibdev.process_mad = iwch_process_mad;
+
+        dev->ibdev.req_notify_cq = iwch_arm_cq;
+        dev->ibdev.post_send = iwch_post_send;
+        dev->ibdev.post_recv = iwch_post_receive;
+
+
+        dev->ibdev.iwcm =
+            (struct iw_cm_verbs *) kmalloc(sizeof(struct iw_cm_verbs),
+                                           GFP_KERNEL);
+        dev->ibdev.iwcm->connect = iwch_connect;
+        dev->ibdev.iwcm->accept = iwch_accept_cr;
+        dev->ibdev.iwcm->reject = iwch_reject_cr;
+        dev->ibdev.iwcm->create_listen = iwch_create_listen;
+        dev->ibdev.iwcm->destroy_listen = iwch_destroy_listen;
+        dev->ibdev.iwcm->add_ref = iwch_qp_add_ref;
+        dev->ibdev.iwcm->rem_ref = iwch_qp_rem_ref;
+        dev->ibdev.iwcm->get_qp = iwch_get_qp;
+
+        ret = ib_register_device(&dev->ibdev);
+        if (ret)
+                goto bail1;
+
+        for (i = 0; i < ARRAY_SIZE(iwch_class_attributes); ++i) {
+                ret = class_device_create_file(&dev->ibdev.class_dev,
+                                               iwch_class_attributes[i]);
+                if (ret) {
+                        goto bail2;
+                }
+        }
+        return 0;
+bail2:
+        ib_unregister_device(&dev->ibdev);
+bail1:
+        return ret;
+}
+
+void iwch_unregister_device(struct iwch_dev *dev)
+{
+        int i;
+
+        PDBG("%s iwch_dev %p\n", __FUNCTION__, dev);
+        for (i = 0; i < ARRAY_SIZE(iwch_class_attributes); ++i)
+                class_device_remove_file(&dev->ibdev.class_dev,
+                                         iwch_class_attributes[i]);
+        ib_unregister_device(&dev->ibdev);
+        return;
+}
diff --git a/drivers/infiniband/hw/cxgb3/iwch_provider.h b/drivers/infiniband/hw/cxgb3/iwch_provider.h
new file mode 100644
index 000000000000..61e3278fd7a8
--- /dev/null
+++ b/drivers/infiniband/hw/cxgb3/iwch_provider.h
@@ -0,0 +1,367 @@
+/*
+ * Copyright (c) 2006 Chelsio, Inc. All rights reserved.
+ * Copyright (c) 2006 Open Grid Computing, Inc. All rights reserved.
+ *
+ * This software is available to you under a choice of one of two
+ * licenses.  You may choose to be licensed under the terms of the GNU
+ * General Public License (GPL) Version 2, available from the file
+ * COPYING in the main directory of this source tree, or the
+ * OpenIB.org BSD license below:
+ *
+ *     Redistribution and use in source and binary forms, with or
+ *     without modification, are permitted provided that the following
+ *     conditions are met:
+ *
+ *      - Redistributions of source code must retain the above
+ *        copyright notice, this list of conditions and the following
+ *        disclaimer.
+ *
+ *      - Redistributions in binary form must reproduce the above
+ *        copyright notice, this list of conditions and the following
+ *        disclaimer in the documentation and/or other materials
+ *        provided with the distribution.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+ * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+ * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+ * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
+ * BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
+ * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
+ * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+ * SOFTWARE.
+ */
+#ifndef __IWCH_PROVIDER_H__
+#define __IWCH_PROVIDER_H__
+
+#include <linux/list.h>
+#include <linux/spinlock.h>
+#include <rdma/ib_verbs.h>
+#include <asm/types.h>
+#include "t3cdev.h"
+#include "iwch.h"
+#include "cxio_wr.h"
+#include "cxio_hal.h"
+
+struct iwch_pd {
+        struct ib_pd ibpd;
+        u32 pdid;
+        struct iwch_dev *rhp;
+};
+
+static inline struct iwch_pd *to_iwch_pd(struct ib_pd *ibpd)
+{
+        return container_of(ibpd, struct iwch_pd, ibpd);
+}
+
+struct tpt_attributes {
+        u32 stag;
+        u32 state:1;
+        u32 type:2;
+        u32 rsvd:1;
+        enum tpt_mem_perm perms;
+        u32 remote_invaliate_disable:1;
+        u32 zbva:1;
+        u32 mw_bind_enable:1;
+        u32 page_size:5;
+
+        u32 pdid;
+        u32 qpid;
+        u32 pbl_addr;
+        u32 len;
+        u64 va_fbo;
+        u32 pbl_size;
+};
+
+struct iwch_mr {
+        struct ib_mr ibmr;
+        struct iwch_dev *rhp;
+        u64 kva;
+        struct tpt_attributes attr;
+};
+
+typedef struct iwch_mw iwch_mw_handle;
+
+static inline struct iwch_mr *to_iwch_mr(struct ib_mr *ibmr)
+{
+        return container_of(ibmr, struct iwch_mr, ibmr);
+}
+
+struct iwch_mw {
+        struct ib_mw ibmw;
+        struct iwch_dev *rhp;
+        u64 kva;
+        struct tpt_attributes attr;
+};
+
+static inline struct iwch_mw *to_iwch_mw(struct ib_mw *ibmw)
+{
+        return container_of(ibmw, struct iwch_mw, ibmw);
+}
+
+struct iwch_cq {
+        struct ib_cq ibcq;
+        struct iwch_dev *rhp;
+        struct t3_cq cq;
+        spinlock_t lock;
+        atomic_t refcnt;
+        wait_queue_head_t wait;
+        u32 __user *user_rptr_addr;
+};
+
+static inline struct iwch_cq *to_iwch_cq(struct ib_cq *ibcq)
+{
+        return container_of(ibcq, struct iwch_cq, ibcq);
+}
+
+enum IWCH_QP_FLAGS {
+        QP_QUIESCED = 0x01
+};
+
+struct iwch_mpa_attributes {
+        u8 recv_marker_enabled;
+        u8 xmit_marker_enabled; /* iWARP: enable inbound Read Resp. */
+        u8 crc_enabled;
+        u8 version;     /* 0 or 1 */
+};
+
+struct iwch_qp_attributes {
+        u32 scq;
+        u32 rcq;
+        u32 sq_num_entries;
+        u32 rq_num_entries;
+        u32 sq_max_sges;
+        u32 sq_max_sges_rdma_write;
+        u32 rq_max_sges;
+        u32 state;
+        u8 enable_rdma_read;
+        u8 enable_rdma_write;   /* enable inbound Read Resp. */
+        u8 enable_bind;
+        u8 enable_mmid0_fastreg;        /* Enable STAG0 + Fast-register */
+        /*
+         * Next QP state. If specify the current state, only the
+         * QP attributes will be modified.
+         */
+        u32 max_ord;
+        u32 max_ird;
+        u32 pd; /* IN */
+        u32 next_state;
+        char terminate_buffer[52];
+        u32 terminate_msg_len;
+        u8 is_terminate_local;
+        struct iwch_mpa_attributes mpa_attr;    /* IN-OUT */
+        struct iwch_ep *llp_stream_handle;
+        char *stream_msg_buf;   /* Last stream msg. before Idle -> RTS */
+        u32 stream_msg_buf_len; /* Only on Idle -> RTS */
+};
+
+struct iwch_qp {
+        struct ib_qp ibqp;
+        struct iwch_dev *rhp;
+        struct iwch_ep *ep;
+        struct iwch_qp_attributes attr;
+        struct t3_wq wq;
+        spinlock_t lock;
+        atomic_t refcnt;
+        wait_queue_head_t wait;
+        enum IWCH_QP_FLAGS flags;
+        struct timer_list timer;
+};
+
+static inline int qp_quiesced(struct iwch_qp *qhp)
+{
+        return qhp->flags & QP_QUIESCED;
+}
+
+static inline struct iwch_qp *to_iwch_qp(struct ib_qp *ibqp)
+{
+        return container_of(ibqp, struct iwch_qp, ibqp);
+}
+
+void iwch_qp_add_ref(struct ib_qp *qp);
+void iwch_qp_rem_ref(struct ib_qp *qp);
+struct ib_qp *iwch_get_qp(struct ib_device *dev, int qpn);
+
+struct iwch_ucontext {
+        struct ib_ucontext ibucontext;
+        struct cxio_ucontext uctx;
+        u32 key;
+        spinlock_t mmap_lock;
+        struct list_head mmaps;
+};
+
+static inline struct iwch_ucontext *to_iwch_ucontext(struct ib_ucontext *c)
+{
+        return container_of(c, struct iwch_ucontext, ibucontext);
+}
+
+struct iwch_mm_entry {
+        struct list_head entry;
+        u64 addr;
+        u32 key;
+        unsigned len;
+};
+
+static inline struct iwch_mm_entry *remove_mmap(struct iwch_ucontext *ucontext,
+                                                u32 key, unsigned len)
+{
+        struct list_head *pos, *nxt;
+        struct iwch_mm_entry *mm;
+
+        spin_lock(&ucontext->mmap_lock);
+        list_for_each_safe(pos, nxt, &ucontext->mmaps) {
+
+                mm = list_entry(pos, struct iwch_mm_entry, entry);
+                if (mm->key == key && mm->len == len) {
+                        list_del_init(&mm->entry);
+                        spin_unlock(&ucontext->mmap_lock);
+                        PDBG("%s key 0x%x addr 0x%llx len %d\n", __FUNCTION__,
+                             key, (unsigned long long) mm->addr, mm->len);
+                        return mm;
+                }
+        }
+        spin_unlock(&ucontext->mmap_lock);
+        return NULL;
+}
+
+static inline void insert_mmap(struct iwch_ucontext *ucontext,
+                               struct iwch_mm_entry *mm)
+{
+        spin_lock(&ucontext->mmap_lock);
+        PDBG("%s key 0x%x addr 0x%llx len %d\n", __FUNCTION__,
+             mm->key, (unsigned long long) mm->addr, mm->len);
+        list_add_tail(&mm->entry, &ucontext->mmaps);
+        spin_unlock(&ucontext->mmap_lock);
+}
+
+enum iwch_qp_attr_mask {
+        IWCH_QP_ATTR_NEXT_STATE = 1 << 0,
+        IWCH_QP_ATTR_ENABLE_RDMA_READ = 1 << 7,
+        IWCH_QP_ATTR_ENABLE_RDMA_WRITE = 1 << 8,
+        IWCH_QP_ATTR_ENABLE_RDMA_BIND = 1 << 9,
+        IWCH_QP_ATTR_MAX_ORD = 1 << 11,
+        IWCH_QP_ATTR_MAX_IRD = 1 << 12,
+        IWCH_QP_ATTR_LLP_STREAM_HANDLE = 1 << 22,
+        IWCH_QP_ATTR_STREAM_MSG_BUFFER = 1 << 23,
+        IWCH_QP_ATTR_MPA_ATTR = 1 << 24,
+        IWCH_QP_ATTR_QP_CONTEXT_ACTIVATE = 1 << 25,
+        IWCH_QP_ATTR_VALID_MODIFY = (IWCH_QP_ATTR_ENABLE_RDMA_READ |
+                                     IWCH_QP_ATTR_ENABLE_RDMA_WRITE |
+                                     IWCH_QP_ATTR_MAX_ORD |
+                                     IWCH_QP_ATTR_MAX_IRD |
+                                     IWCH_QP_ATTR_LLP_STREAM_HANDLE |
+                                     IWCH_QP_ATTR_STREAM_MSG_BUFFER |
+                                     IWCH_QP_ATTR_MPA_ATTR |
+                                     IWCH_QP_ATTR_QP_CONTEXT_ACTIVATE)
+};
+
+int iwch_modify_qp(struct iwch_dev *rhp,
+                                struct iwch_qp *qhp,
+                                enum iwch_qp_attr_mask mask,
+                                struct iwch_qp_attributes *attrs,
+                                int internal);
+
+enum iwch_qp_state {
+        IWCH_QP_STATE_IDLE,
+        IWCH_QP_STATE_RTS,
+        IWCH_QP_STATE_ERROR,
+        IWCH_QP_STATE_TERMINATE,
+        IWCH_QP_STATE_CLOSING,
+        IWCH_QP_STATE_TOT
+};
+
+static inline int iwch_convert_state(enum ib_qp_state ib_state)
+{
+        switch (ib_state) {
+        case IB_QPS_RESET:
+        case IB_QPS_INIT:
+                return IWCH_QP_STATE_IDLE;
+        case IB_QPS_RTS:
+                return IWCH_QP_STATE_RTS;
+        case IB_QPS_SQD:
+                return IWCH_QP_STATE_CLOSING;
+        case IB_QPS_SQE:
+                return IWCH_QP_STATE_TERMINATE;
+        case IB_QPS_ERR:
+                return IWCH_QP_STATE_ERROR;
+        default:
+                return -1;
+        }
+}
+
+enum iwch_mem_perms {
+        IWCH_MEM_ACCESS_LOCAL_READ = 1 << 0,
+        IWCH_MEM_ACCESS_LOCAL_WRITE = 1 << 1,
+        IWCH_MEM_ACCESS_REMOTE_READ = 1 << 2,
+        IWCH_MEM_ACCESS_REMOTE_WRITE = 1 << 3,
+        IWCH_MEM_ACCESS_ATOMICS = 1 << 4,
+        IWCH_MEM_ACCESS_BINDING = 1 << 5,
+        IWCH_MEM_ACCESS_LOCAL =
+            (IWCH_MEM_ACCESS_LOCAL_READ | IWCH_MEM_ACCESS_LOCAL_WRITE),
+        IWCH_MEM_ACCESS_REMOTE =
+            (IWCH_MEM_ACCESS_REMOTE_WRITE | IWCH_MEM_ACCESS_REMOTE_READ)
+            /* cannot go beyond 1 << 31 */
+} __attribute__ ((packed));
+
+static inline u32 iwch_convert_access(int acc)
+{
+        return (acc & IB_ACCESS_REMOTE_WRITE ? IWCH_MEM_ACCESS_REMOTE_WRITE : 0)
+            | (acc & IB_ACCESS_REMOTE_READ ? IWCH_MEM_ACCESS_REMOTE_READ : 0) |
+            (acc & IB_ACCESS_LOCAL_WRITE ? IWCH_MEM_ACCESS_LOCAL_WRITE : 0) |
+            (acc & IB_ACCESS_MW_BIND ? IWCH_MEM_ACCESS_BINDING : 0) |
+            IWCH_MEM_ACCESS_LOCAL_READ;
+}
+
+enum iwch_mmid_state {
+        IWCH_STAG_STATE_VALID,
+        IWCH_STAG_STATE_INVALID
+};
+
+enum iwch_qp_query_flags {
+        IWCH_QP_QUERY_CONTEXT_NONE = 0x0,       /* No ctx; Only attrs */
+        IWCH_QP_QUERY_CONTEXT_GET = 0x1,        /* Get ctx + attrs */
+        IWCH_QP_QUERY_CONTEXT_SUSPEND = 0x2,    /* Not Supported */
+
+        /*
+         * Quiesce QP context; Consumer
+         * will NOT replay outstanding WR
+         */
+        IWCH_QP_QUERY_CONTEXT_QUIESCE = 0x4,
+        IWCH_QP_QUERY_CONTEXT_REMOVE = 0x8,
+        IWCH_QP_QUERY_TEST_USERWRITE = 0x32     /* Test special */
+};
+
+int iwch_post_send(struct ib_qp *ibqp, struct ib_send_wr *wr,
+                      struct ib_send_wr **bad_wr);
+int iwch_post_receive(struct ib_qp *ibqp, struct ib_recv_wr *wr,
+                      struct ib_recv_wr **bad_wr);
+int iwch_bind_mw(struct ib_qp *qp,
+                             struct ib_mw *mw,
+                             struct ib_mw_bind *mw_bind);
+int iwch_poll_cq(struct ib_cq *ibcq, int num_entries, struct ib_wc *wc);
+int iwch_post_terminate(struct iwch_qp *qhp, struct respQ_msg_t *rsp_msg);
+int iwch_register_device(struct iwch_dev *dev);
+void iwch_unregister_device(struct iwch_dev *dev);
+int iwch_quiesce_qps(struct iwch_cq *chp);
+int iwch_resume_qps(struct iwch_cq *chp);
+void stop_read_rep_timer(struct iwch_qp *qhp);
+int iwch_register_mem(struct iwch_dev *rhp, struct iwch_pd *php,
+                                        struct iwch_mr *mhp,
+                                        int shift,
+                                        __be64 *page_list);
+int iwch_reregister_mem(struct iwch_dev *rhp, struct iwch_pd *php,
+                                        struct iwch_mr *mhp,
+                                        int shift,
+                                        __be64 *page_list,
+                                        int npages);
+int build_phys_page_list(struct ib_phys_buf *buffer_list,
+                                        int num_phys_buf,
+                                        u64 *iova_start,
+                                        u64 *total_size,
+                                        int *npages,
+                                        int *shift,
+                                        __be64 **page_list);
+
+
+#define IWCH_NODE_DESC "cxgb3 Chelsio Communications"
+
+#endif
diff --git a/drivers/infiniband/hw/cxgb3/iwch_qp.c b/drivers/infiniband/hw/cxgb3/iwch_qp.c
new file mode 100644
index 000000000000..e066727504b6
--- /dev/null
+++ b/drivers/infiniband/hw/cxgb3/iwch_qp.c
@@ -0,0 +1,1007 @@
+/*
+ * Copyright (c) 2006 Chelsio, Inc. All rights reserved.
+ * Copyright (c) 2006 Open Grid Computing, Inc. All rights reserved.
+ *
+ * This software is available to you under a choice of one of two
+ * licenses.  You may choose to be licensed under the terms of the GNU
+ * General Public License (GPL) Version 2, available from the file
+ * COPYING in the main directory of this source tree, or the
+ * OpenIB.org BSD license below:
+ *
+ *     Redistribution and use in source and binary forms, with or
+ *     without modification, are permitted provided that the following
+ *     conditions are met:
+ *
+ *      - Redistributions of source code must retain the above
+ *        copyright notice, this list of conditions and the following
+ *        disclaimer.
+ *
+ *      - Redistributions in binary form must reproduce the above
+ *        copyright notice, this list of conditions and the following
+ *        disclaimer in the documentation and/or other materials
+ *        provided with the distribution.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+ * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+ * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+ * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
+ * BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
+ * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
+ * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+ * SOFTWARE.
+ */
+#include "iwch_provider.h"
+#include "iwch.h"
+#include "iwch_cm.h"
+#include "cxio_hal.h"
+
+#define NO_SUPPORT -1
+
+static inline int iwch_build_rdma_send(union t3_wr *wqe, struct ib_send_wr *wr,
+                                       u8 * flit_cnt)
+{
+        int i;
+        u32 plen;
+
+        switch (wr->opcode) {
+        case IB_WR_SEND:
+        case IB_WR_SEND_WITH_IMM:
+                if (wr->send_flags & IB_SEND_SOLICITED)
+                        wqe->send.rdmaop = T3_SEND_WITH_SE;
+                else
+                        wqe->send.rdmaop = T3_SEND;
+                wqe->send.rem_stag = 0;
+                break;
+#if 0                           /* Not currently supported */
+        case TYPE_SEND_INVALIDATE:
+        case TYPE_SEND_INVALIDATE_IMMEDIATE:
+                wqe->send.rdmaop = T3_SEND_WITH_INV;
+                wqe->send.rem_stag = cpu_to_be32(wr->wr.rdma.rkey);
+                break;
+        case TYPE_SEND_SE_INVALIDATE:
+                wqe->send.rdmaop = T3_SEND_WITH_SE_INV;
+                wqe->send.rem_stag = cpu_to_be32(wr->wr.rdma.rkey);
+                break;
+#endif
+        default:
+                break;
+        }
+        if (wr->num_sge > T3_MAX_SGE)
+                return -EINVAL;
+        wqe->send.reserved[0] = 0;
+        wqe->send.reserved[1] = 0;
+        wqe->send.reserved[2] = 0;
+        if (wr->opcode == IB_WR_SEND_WITH_IMM) {
+                plen = 4;
+                wqe->send.sgl[0].stag = wr->imm_data;
+                wqe->send.sgl[0].len = __constant_cpu_to_be32(0);
+                wqe->send.num_sgle = __constant_cpu_to_be32(0);
+                *flit_cnt = 5;
+        } else {
+                plen = 0;
+                for (i = 0; i < wr->num_sge; i++) {
+                        if ((plen + wr->sg_list[i].length) < plen) {
+                                return -EMSGSIZE;
+                        }
+                        plen += wr->sg_list[i].length;
+                        wqe->send.sgl[i].stag =
+                            cpu_to_be32(wr->sg_list[i].lkey);
+                        wqe->send.sgl[i].len =
+                            cpu_to_be32(wr->sg_list[i].length);
+                        wqe->send.sgl[i].to = cpu_to_be64(wr->sg_list[i].addr);
+                }
+                wqe->send.num_sgle = cpu_to_be32(wr->num_sge);
+                *flit_cnt = 4 + ((wr->num_sge) << 1);
+        }
+        wqe->send.plen = cpu_to_be32(plen);
+        return 0;
+}
+
+static inline int iwch_build_rdma_write(union t3_wr *wqe, struct ib_send_wr *wr,
+                                        u8 *flit_cnt)
+{
+        int i;
+        u32 plen;
+        if (wr->num_sge > T3_MAX_SGE)
+                return -EINVAL;
+        wqe->write.rdmaop = T3_RDMA_WRITE;
+        wqe->write.reserved[0] = 0;
+        wqe->write.reserved[1] = 0;
+        wqe->write.reserved[2] = 0;
+        wqe->write.stag_sink = cpu_to_be32(wr->wr.rdma.rkey);
+        wqe->write.to_sink = cpu_to_be64(wr->wr.rdma.remote_addr);
+
+        if (wr->opcode == IB_WR_RDMA_WRITE_WITH_IMM) {
+                plen = 4;
+                wqe->write.sgl[0].stag = wr->imm_data;
+                wqe->write.sgl[0].len = __constant_cpu_to_be32(0);
+                wqe->write.num_sgle = __constant_cpu_to_be32(0);
+                *flit_cnt = 6;
+        } else {
+                plen = 0;
+                for (i = 0; i < wr->num_sge; i++) {
+                        if ((plen + wr->sg_list[i].length) < plen) {
+                                return -EMSGSIZE;
+                        }
+                        plen += wr->sg_list[i].length;
+                        wqe->write.sgl[i].stag =
+                            cpu_to_be32(wr->sg_list[i].lkey);
+                        wqe->write.sgl[i].len =
+                            cpu_to_be32(wr->sg_list[i].length);
+                        wqe->write.sgl[i].to =
+                            cpu_to_be64(wr->sg_list[i].addr);
+                }
+                wqe->write.num_sgle = cpu_to_be32(wr->num_sge);
+                *flit_cnt = 5 + ((wr->num_sge) << 1);
+        }
+        wqe->write.plen = cpu_to_be32(plen);
+        return 0;
+}
+
+static inline int iwch_build_rdma_read(union t3_wr *wqe, struct ib_send_wr *wr,
+                                       u8 *flit_cnt)
+{
+        if (wr->num_sge > 1)
+                return -EINVAL;
+        wqe->read.rdmaop = T3_READ_REQ;
+        wqe->read.reserved[0] = 0;
+        wqe->read.reserved[1] = 0;
+        wqe->read.reserved[2] = 0;
+        wqe->read.rem_stag = cpu_to_be32(wr->wr.rdma.rkey);
+        wqe->read.rem_to = cpu_to_be64(wr->wr.rdma.remote_addr);
+        wqe->read.local_stag = cpu_to_be32(wr->sg_list[0].lkey);
+        wqe->read.local_len = cpu_to_be32(wr->sg_list[0].length);
+        wqe->read.local_to = cpu_to_be64(wr->sg_list[0].addr);
+        *flit_cnt = sizeof(struct t3_rdma_read_wr) >> 3;
+        return 0;
+}
+
+/*
+ * TBD: this is going to be moved to firmware. Missing pdid/qpid check for now.
+ */
+static inline int iwch_sgl2pbl_map(struct iwch_dev *rhp,
+                                   struct ib_sge *sg_list, u32 num_sgle,
+                                   u32 * pbl_addr, u8 * page_size)
+{
+        int i;
+        struct iwch_mr *mhp;
+        u32 offset;
+        for (i = 0; i < num_sgle; i++) {
+
+                mhp = get_mhp(rhp, (sg_list[i].lkey) >> 8);
+                if (!mhp) {
+                        PDBG("%s %d\n", __FUNCTION__, __LINE__);
+                        return -EIO;
+                }
+                if (!mhp->attr.state) {
+                        PDBG("%s %d\n", __FUNCTION__, __LINE__);
+                        return -EIO;
+                }
+                if (mhp->attr.zbva) {
+                        PDBG("%s %d\n", __FUNCTION__, __LINE__);
+                        return -EIO;
+                }
+
+                if (sg_list[i].addr < mhp->attr.va_fbo) {
+                        PDBG("%s %d\n", __FUNCTION__, __LINE__);
+                        return -EINVAL;
+                }
+                if (sg_list[i].addr + ((u64) sg_list[i].length) <
+                    sg_list[i].addr) {
+                        PDBG("%s %d\n", __FUNCTION__, __LINE__);
+                        return -EINVAL;
+                }
+                if (sg_list[i].addr + ((u64) sg_list[i].length) >
+                    mhp->attr.va_fbo + ((u64) mhp->attr.len)) {
+                        PDBG("%s %d\n", __FUNCTION__, __LINE__);
+                        return -EINVAL;
+                }
+                offset = sg_list[i].addr - mhp->attr.va_fbo;
+                offset += ((u32) mhp->attr.va_fbo) %
+                          (1UL << (12 + mhp->attr.page_size));
+                pbl_addr[i] = ((mhp->attr.pbl_addr -
+                                rhp->rdev.rnic_info.pbl_base) >> 3) +
+                              (offset >> (12 + mhp->attr.page_size));
+                page_size[i] = mhp->attr.page_size;
+        }
+        return 0;
+}
+
+static inline int iwch_build_rdma_recv(struct iwch_dev *rhp,
+                                                    union t3_wr *wqe,
+                                                    struct ib_recv_wr *wr)
+{
+        int i, err = 0;
+        u32 pbl_addr[4];
+        u8 page_size[4];
+        if (wr->num_sge > T3_MAX_SGE)
+                return -EINVAL;
+        err = iwch_sgl2pbl_map(rhp, wr->sg_list, wr->num_sge, pbl_addr,
+                               page_size);
+        if (err)
+                return err;
+        wqe->recv.pagesz[0] = page_size[0];
+        wqe->recv.pagesz[1] = page_size[1];
+        wqe->recv.pagesz[2] = page_size[2];
+        wqe->recv.pagesz[3] = page_size[3];
+        wqe->recv.num_sgle = cpu_to_be32(wr->num_sge);
+        for (i = 0; i < wr->num_sge; i++) {
+                wqe->recv.sgl[i].stag = cpu_to_be32(wr->sg_list[i].lkey);
+                wqe->recv.sgl[i].len = cpu_to_be32(wr->sg_list[i].length);
+
+                /* to in the WQE == the offset into the page */
+                wqe->recv.sgl[i].to = cpu_to_be64(((u32) wr->sg_list[i].addr) %
+                                (1UL << (12 + page_size[i])));
+
+                /* pbl_addr is the adapters address in the PBL */
+                wqe->recv.pbl_addr[i] = cpu_to_be32(pbl_addr[i]);
+        }
+        for (; i < T3_MAX_SGE; i++) {
+                wqe->recv.sgl[i].stag = 0;
+                wqe->recv.sgl[i].len = 0;
+                wqe->recv.sgl[i].to = 0;
+                wqe->recv.pbl_addr[i] = 0;
+        }
+        return 0;
+}
+
+int iwch_post_send(struct ib_qp *ibqp, struct ib_send_wr *wr,
+                      struct ib_send_wr **bad_wr)
+{
+        int err = 0;
+        u8 t3_wr_flit_cnt;
+        enum t3_wr_opcode t3_wr_opcode = 0;
+        enum t3_wr_flags t3_wr_flags;
+        struct iwch_qp *qhp;
+        u32 idx;
+        union t3_wr *wqe;
+        u32 num_wrs;
+        unsigned long flag;
+        struct t3_swsq *sqp;
+
+        qhp = to_iwch_qp(ibqp);
+        spin_lock_irqsave(&qhp->lock, flag);
+        if (qhp->attr.state > IWCH_QP_STATE_RTS) {
+                spin_unlock_irqrestore(&qhp->lock, flag);
+                return -EINVAL;
+        }
+        num_wrs = Q_FREECNT(qhp->wq.sq_rptr, qhp->wq.sq_wptr,
+                  qhp->wq.sq_size_log2);
+        if (num_wrs <= 0) {
+                spin_unlock_irqrestore(&qhp->lock, flag);
+                return -ENOMEM;
+        }
+        while (wr) {
+                if (num_wrs == 0) {
+                        err = -ENOMEM;
+                        *bad_wr = wr;
+                        break;
+                }
+                idx = Q_PTR2IDX(qhp->wq.wptr, qhp->wq.size_log2);
+                wqe = (union t3_wr *) (qhp->wq.queue + idx);
+                t3_wr_flags = 0;
+                if (wr->send_flags & IB_SEND_SOLICITED)
+                        t3_wr_flags |= T3_SOLICITED_EVENT_FLAG;
+                if (wr->send_flags & IB_SEND_FENCE)
+                        t3_wr_flags |= T3_READ_FENCE_FLAG;
+                if (wr->send_flags & IB_SEND_SIGNALED)
+                        t3_wr_flags |= T3_COMPLETION_FLAG;
+                sqp = qhp->wq.sq +
+                      Q_PTR2IDX(qhp->wq.sq_wptr, qhp->wq.sq_size_log2);
+                switch (wr->opcode) {
+                case IB_WR_SEND:
+                case IB_WR_SEND_WITH_IMM:
+                        t3_wr_opcode = T3_WR_SEND;
+                        err = iwch_build_rdma_send(wqe, wr, &t3_wr_flit_cnt);
+                        break;
+                case IB_WR_RDMA_WRITE:
+                case IB_WR_RDMA_WRITE_WITH_IMM:
+                        t3_wr_opcode = T3_WR_WRITE;
+                        err = iwch_build_rdma_write(wqe, wr, &t3_wr_flit_cnt);
+                        break;
+                case IB_WR_RDMA_READ:
+                        t3_wr_opcode = T3_WR_READ;
+                        t3_wr_flags = 0; /* T3 reads are always signaled */
+                        err = iwch_build_rdma_read(wqe, wr, &t3_wr_flit_cnt);
+                        if (err)
+                                break;
+                        sqp->read_len = wqe->read.local_len;
+                        if (!qhp->wq.oldest_read)
+                                qhp->wq.oldest_read = sqp;
+                        break;
+                default:
+                        PDBG("%s post of type=%d TBD!\n", __FUNCTION__,
+                             wr->opcode);
+                        err = -EINVAL;
+                }
+                if (err) {
+                        *bad_wr = wr;
+                        break;
+                }
+                wqe->send.wrid.id0.hi = qhp->wq.sq_wptr;
+                sqp->wr_id = wr->wr_id;
+                sqp->opcode = wr2opcode(t3_wr_opcode);
+                sqp->sq_wptr = qhp->wq.sq_wptr;
+                sqp->complete = 0;
+                sqp->signaled = (wr->send_flags & IB_SEND_SIGNALED);
+
+                build_fw_riwrh((void *) wqe, t3_wr_opcode, t3_wr_flags,
+                               Q_GENBIT(qhp->wq.wptr, qhp->wq.size_log2),
+                               0, t3_wr_flit_cnt);
+                PDBG("%s cookie 0x%llx wq idx 0x%x swsq idx %ld opcode %d\n",
+                     __FUNCTION__, (unsigned long long) wr->wr_id, idx,
+                     Q_PTR2IDX(qhp->wq.sq_wptr, qhp->wq.sq_size_log2),
+                     sqp->opcode);
+                wr = wr->next;
+                num_wrs--;
+                ++(qhp->wq.wptr);
+                ++(qhp->wq.sq_wptr);
+        }
+        spin_unlock_irqrestore(&qhp->lock, flag);
+        ring_doorbell(qhp->wq.doorbell, qhp->wq.qpid);
+        return err;
+}
+
+int iwch_post_receive(struct ib_qp *ibqp, struct ib_recv_wr *wr,
+                      struct ib_recv_wr **bad_wr)
+{
+        int err = 0;
+        struct iwch_qp *qhp;
+        u32 idx;
+        union t3_wr *wqe;
+        u32 num_wrs;
+        unsigned long flag;
+
+        qhp = to_iwch_qp(ibqp);
+        spin_lock_irqsave(&qhp->lock, flag);
+        if (qhp->attr.state > IWCH_QP_STATE_RTS) {
+                spin_unlock_irqrestore(&qhp->lock, flag);
+                return -EINVAL;
+        }
+        num_wrs = Q_FREECNT(qhp->wq.rq_rptr, qhp->wq.rq_wptr,
+                            qhp->wq.rq_size_log2) - 1;
+        if (!wr) {
+                spin_unlock_irqrestore(&qhp->lock, flag);
+                return -EINVAL;
+        }
+        while (wr) {
+                idx = Q_PTR2IDX(qhp->wq.wptr, qhp->wq.size_log2);
+                wqe = (union t3_wr *) (qhp->wq.queue + idx);
+                if (num_wrs)
+                        err = iwch_build_rdma_recv(qhp->rhp, wqe, wr);
+                else
+                        err = -ENOMEM;
+                if (err) {
+                        *bad_wr = wr;
+                        break;
+                }
+                qhp->wq.rq[Q_PTR2IDX(qhp->wq.rq_wptr, qhp->wq.rq_size_log2)] =
+                        wr->wr_id;
+                build_fw_riwrh((void *) wqe, T3_WR_RCV, T3_COMPLETION_FLAG,
+                               Q_GENBIT(qhp->wq.wptr, qhp->wq.size_log2),
+                               0, sizeof(struct t3_receive_wr) >> 3);
+                PDBG("%s cookie 0x%llx idx 0x%x rq_wptr 0x%x rw_rptr 0x%x "
+                     "wqe %p \n", __FUNCTION__, (unsigned long long) wr->wr_id,
+                     idx, qhp->wq.rq_wptr, qhp->wq.rq_rptr, wqe);
+                ++(qhp->wq.rq_wptr);
+                ++(qhp->wq.wptr);
+                wr = wr->next;
+                num_wrs--;
+        }
+        spin_unlock_irqrestore(&qhp->lock, flag);
+        ring_doorbell(qhp->wq.doorbell, qhp->wq.qpid);
+        return err;
+}
+
+int iwch_bind_mw(struct ib_qp *qp,
+                             struct ib_mw *mw,
+                             struct ib_mw_bind *mw_bind)
+{
+        struct iwch_dev *rhp;
+        struct iwch_mw *mhp;
+        struct iwch_qp *qhp;
+        union t3_wr *wqe;
+        u32 pbl_addr;
+        u8 page_size;
+        u32 num_wrs;
+        unsigned long flag;
+        struct ib_sge sgl;
+        int err=0;
+        enum t3_wr_flags t3_wr_flags;
+        u32 idx;
+        struct t3_swsq *sqp;
+
+        qhp = to_iwch_qp(qp);
+        mhp = to_iwch_mw(mw);
+        rhp = qhp->rhp;
+
+        spin_lock_irqsave(&qhp->lock, flag);
+        if (qhp->attr.state > IWCH_QP_STATE_RTS) {
+                spin_unlock_irqrestore(&qhp->lock, flag);
+                return -EINVAL;
+        }
+        num_wrs = Q_FREECNT(qhp->wq.sq_rptr, qhp->wq.sq_wptr,
+                            qhp->wq.sq_size_log2);
+        if ((num_wrs) <= 0) {
+                spin_unlock_irqrestore(&qhp->lock, flag);
+                return -ENOMEM;
+        }
+        idx = Q_PTR2IDX(qhp->wq.wptr, qhp->wq.size_log2);
+        PDBG("%s: idx 0x%0x, mw 0x%p, mw_bind 0x%p\n", __FUNCTION__, idx,
+             mw, mw_bind);
+        wqe = (union t3_wr *) (qhp->wq.queue + idx);
+
+        t3_wr_flags = 0;
+        if (mw_bind->send_flags & IB_SEND_SIGNALED)
+                t3_wr_flags = T3_COMPLETION_FLAG;
+
+        sgl.addr = mw_bind->addr;
+        sgl.lkey = mw_bind->mr->lkey;
+        sgl.length = mw_bind->length;
+        wqe->bind.reserved = 0;
+        wqe->bind.type = T3_VA_BASED_TO;
+
+        /* TBD: check perms */
+        wqe->bind.perms = iwch_convert_access(mw_bind->mw_access_flags);
+        wqe->bind.mr_stag = cpu_to_be32(mw_bind->mr->lkey);
+        wqe->bind.mw_stag = cpu_to_be32(mw->rkey);
+        wqe->bind.mw_len = cpu_to_be32(mw_bind->length);
+        wqe->bind.mw_va = cpu_to_be64(mw_bind->addr);
+        err = iwch_sgl2pbl_map(rhp, &sgl, 1, &pbl_addr, &page_size);
+        if (err) {
+                spin_unlock_irqrestore(&qhp->lock, flag);
+                return err;
+        }
+        wqe->send.wrid.id0.hi = qhp->wq.sq_wptr;
+        sqp = qhp->wq.sq + Q_PTR2IDX(qhp->wq.sq_wptr, qhp->wq.sq_size_log2);
+        sqp->wr_id = mw_bind->wr_id;
+        sqp->opcode = T3_BIND_MW;
+        sqp->sq_wptr = qhp->wq.sq_wptr;
+        sqp->complete = 0;
+        sqp->signaled = (mw_bind->send_flags & IB_SEND_SIGNALED);
+        wqe->bind.mr_pbl_addr = cpu_to_be32(pbl_addr);
+        wqe->bind.mr_pagesz = page_size;
+        wqe->flit[T3_SQ_COOKIE_FLIT] = mw_bind->wr_id;
+        build_fw_riwrh((void *)wqe, T3_WR_BIND, t3_wr_flags,
+                       Q_GENBIT(qhp->wq.wptr, qhp->wq.size_log2), 0,
+                                sizeof(struct t3_bind_mw_wr) >> 3);
+        ++(qhp->wq.wptr);
+        ++(qhp->wq.sq_wptr);
+        spin_unlock_irqrestore(&qhp->lock, flag);
+
+        ring_doorbell(qhp->wq.doorbell, qhp->wq.qpid);
+
+        return err;
+}
+
+static inline void build_term_codes(int t3err, u8 *layer_type, u8 *ecode,
+                                    int tagged)
+{
+        switch (t3err) {
+        case TPT_ERR_STAG:
+                if (tagged == 1) {
+                        *layer_type = LAYER_DDP|DDP_TAGGED_ERR;
+                        *ecode = DDPT_INV_STAG;
+                } else if (tagged == 2) {
+                        *layer_type = LAYER_RDMAP|RDMAP_REMOTE_PROT;
+                        *ecode = RDMAP_INV_STAG;
+                }
+                break;
+        case TPT_ERR_PDID:
+        case TPT_ERR_QPID:
+        case TPT_ERR_ACCESS:
+                if (tagged == 1) {
+                        *layer_type = LAYER_DDP|DDP_TAGGED_ERR;
+                        *ecode = DDPT_STAG_NOT_ASSOC;
+                } else if (tagged == 2) {
+                        *layer_type = LAYER_RDMAP|RDMAP_REMOTE_PROT;
+                        *ecode = RDMAP_STAG_NOT_ASSOC;
+                }
+                break;
+        case TPT_ERR_WRAP:
+                *layer_type = LAYER_RDMAP|RDMAP_REMOTE_PROT;
+                *ecode = RDMAP_TO_WRAP;
+                break;
+        case TPT_ERR_BOUND:
+                if (tagged == 1) {
+                        *layer_type = LAYER_DDP|DDP_TAGGED_ERR;
+                        *ecode = DDPT_BASE_BOUNDS;
+                } else if (tagged == 2) {
+                        *layer_type = LAYER_RDMAP|RDMAP_REMOTE_PROT;
+                        *ecode = RDMAP_BASE_BOUNDS;
+                } else {
+                        *layer_type = LAYER_DDP|DDP_UNTAGGED_ERR;
+                        *ecode = DDPU_MSG_TOOBIG;
+                }
+                break;
+        case TPT_ERR_INVALIDATE_SHARED_MR:
+        case TPT_ERR_INVALIDATE_MR_WITH_MW_BOUND:
+                *layer_type = LAYER_RDMAP|RDMAP_REMOTE_OP;
+                *ecode = RDMAP_CANT_INV_STAG;
+                break;
+        case TPT_ERR_ECC:
+        case TPT_ERR_ECC_PSTAG:
+        case TPT_ERR_INTERNAL_ERR:
+                *layer_type = LAYER_RDMAP|RDMAP_LOCAL_CATA;
+                *ecode = 0;
+                break;
+        case TPT_ERR_OUT_OF_RQE:
+                *layer_type = LAYER_DDP|DDP_UNTAGGED_ERR;
+                *ecode = DDPU_INV_MSN_NOBUF;
+                break;
+        case TPT_ERR_PBL_ADDR_BOUND:
+                *layer_type = LAYER_DDP|DDP_TAGGED_ERR;
+                *ecode = DDPT_BASE_BOUNDS;
+                break;
+        case TPT_ERR_CRC:
+                *layer_type = LAYER_MPA|DDP_LLP;
+                *ecode = MPA_CRC_ERR;
+                break;
+        case TPT_ERR_MARKER:
+                *layer_type = LAYER_MPA|DDP_LLP;
+                *ecode = MPA_MARKER_ERR;
+                break;
+        case TPT_ERR_PDU_LEN_ERR:
+                *layer_type = LAYER_DDP|DDP_UNTAGGED_ERR;
+                *ecode = DDPU_MSG_TOOBIG;
+                break;
+        case TPT_ERR_DDP_VERSION:
+                if (tagged) {
+                        *layer_type = LAYER_DDP|DDP_TAGGED_ERR;
+                        *ecode = DDPT_INV_VERS;
+                } else {
+                        *layer_type = LAYER_DDP|DDP_UNTAGGED_ERR;
+                        *ecode = DDPU_INV_VERS;
+                }
+                break;
+        case TPT_ERR_RDMA_VERSION:
+                *layer_type = LAYER_RDMAP|RDMAP_REMOTE_OP;
+                *ecode = RDMAP_INV_VERS;
+                break;
+        case TPT_ERR_OPCODE:
+                *layer_type = LAYER_RDMAP|RDMAP_REMOTE_OP;
+                *ecode = RDMAP_INV_OPCODE;
+                break;
+        case TPT_ERR_DDP_QUEUE_NUM:
+                *layer_type = LAYER_DDP|DDP_UNTAGGED_ERR;
+                *ecode = DDPU_INV_QN;
+                break;
+        case TPT_ERR_MSN:
+        case TPT_ERR_MSN_GAP:
+        case TPT_ERR_MSN_RANGE:
+        case TPT_ERR_IRD_OVERFLOW:
+                *layer_type = LAYER_DDP|DDP_UNTAGGED_ERR;
+                *ecode = DDPU_INV_MSN_RANGE;
+                break;
+        case TPT_ERR_TBIT:
+                *layer_type = LAYER_DDP|DDP_LOCAL_CATA;
+                *ecode = 0;
+                break;
+        case TPT_ERR_MO:
+                *layer_type = LAYER_DDP|DDP_UNTAGGED_ERR;
+                *ecode = DDPU_INV_MO;
+                break;
+        default:
+                *layer_type = LAYER_RDMAP|DDP_LOCAL_CATA;
+                *ecode = 0;
+                break;
+        }
+}
+
+/*
+ * This posts a TERMINATE with layer=RDMA, type=catastrophic.
+ */
+int iwch_post_terminate(struct iwch_qp *qhp, struct respQ_msg_t *rsp_msg)
+{
+        union t3_wr *wqe;
+        struct terminate_message *term;
+        int status;
+        int tagged = 0;
+        struct sk_buff *skb;
+
+        PDBG("%s %d\n", __FUNCTION__, __LINE__);
+        skb = alloc_skb(40, GFP_ATOMIC);
+        if (!skb) {
+                printk(KERN_ERR "%s cannot send TERMINATE!\n", __FUNCTION__);
+                return -ENOMEM;
+        }
+        wqe = (union t3_wr *)skb_put(skb, 40);
+        memset(wqe, 0, 40);
+        wqe->send.rdmaop = T3_TERMINATE;
+
+        /* immediate data length */
+        wqe->send.plen = htonl(4);
+
+        /* immediate data starts here. */
+        term = (struct terminate_message *)wqe->send.sgl;
+        if (rsp_msg) {
+                status = CQE_STATUS(rsp_msg->cqe);
+                if (CQE_OPCODE(rsp_msg->cqe) == T3_RDMA_WRITE)
+                        tagged = 1;
+                if ((CQE_OPCODE(rsp_msg->cqe) == T3_READ_REQ) ||
+                    (CQE_OPCODE(rsp_msg->cqe) == T3_READ_RESP))
+                        tagged = 2;
+        } else {
+                status = TPT_ERR_INTERNAL_ERR;
+        }
+        build_term_codes(status, &term->layer_etype, &term->ecode, tagged);
+        build_fw_riwrh((void *)wqe, T3_WR_SEND,
+                       T3_COMPLETION_FLAG | T3_NOTIFY_FLAG, 1,
+                       qhp->ep->hwtid, 5);
+        skb->priority = CPL_PRIORITY_DATA;
+        return cxgb3_ofld_send(qhp->rhp->rdev.t3cdev_p, skb);
+}
+
+/*
+ * Assumes qhp lock is held.
+ */
+static void __flush_qp(struct iwch_qp *qhp, unsigned long *flag)
+{
+        struct iwch_cq *rchp, *schp;
+        int count;
+
+        rchp = get_chp(qhp->rhp, qhp->attr.rcq);
+        schp = get_chp(qhp->rhp, qhp->attr.scq);
+
+        PDBG("%s qhp %p rchp %p schp %p\n", __FUNCTION__, qhp, rchp, schp);
+        /* take a ref on the qhp since we must release the lock */
+        atomic_inc(&qhp->refcnt);
+        spin_unlock_irqrestore(&qhp->lock, *flag);
+
+        /* locking heirarchy: cq lock first, then qp lock. */
+        spin_lock_irqsave(&rchp->lock, *flag);
+        spin_lock(&qhp->lock);
+        cxio_flush_hw_cq(&rchp->cq);
+        cxio_count_rcqes(&rchp->cq, &qhp->wq, &count);
+        cxio_flush_rq(&qhp->wq, &rchp->cq, count);
+        spin_unlock(&qhp->lock);
+        spin_unlock_irqrestore(&rchp->lock, *flag);
+
+        /* locking heirarchy: cq lock first, then qp lock. */
+        spin_lock_irqsave(&schp->lock, *flag);
+        spin_lock(&qhp->lock);
+        cxio_flush_hw_cq(&schp->cq);
+        cxio_count_scqes(&schp->cq, &qhp->wq, &count);
+        cxio_flush_sq(&qhp->wq, &schp->cq, count);
+        spin_unlock(&qhp->lock);
+        spin_unlock_irqrestore(&schp->lock, *flag);
+
+        /* deref */
+        if (atomic_dec_and_test(&qhp->refcnt))
+                wake_up(&qhp->wait);
+
+        spin_lock_irqsave(&qhp->lock, *flag);
+}
+
+static inline void flush_qp(struct iwch_qp *qhp, unsigned long *flag)
+{
+        if (t3b_device(qhp->rhp))
+                cxio_set_wq_in_error(&qhp->wq);
+        else
+                __flush_qp(qhp, flag);
+}
+
+
+/*
+ * Return non zero if at least one RECV was pre-posted.
+ */
+static inline int rqes_posted(struct iwch_qp *qhp)
+{
+        return fw_riwrh_opcode((struct fw_riwrh *)qhp->wq.queue) == T3_WR_RCV;
+}
+
+static int rdma_init(struct iwch_dev *rhp, struct iwch_qp *qhp,
+                                enum iwch_qp_attr_mask mask,
+                                struct iwch_qp_attributes *attrs)
+{
+        struct t3_rdma_init_attr init_attr;
+        int ret;
+
+        init_attr.tid = qhp->ep->hwtid;
+        init_attr.qpid = qhp->wq.qpid;
+        init_attr.pdid = qhp->attr.pd;
+        init_attr.scqid = qhp->attr.scq;
+        init_attr.rcqid = qhp->attr.rcq;
+        init_attr.rq_addr = qhp->wq.rq_addr;
+        init_attr.rq_size = 1 << qhp->wq.rq_size_log2;
+        init_attr.mpaattrs = uP_RI_MPA_IETF_ENABLE |
+                qhp->attr.mpa_attr.recv_marker_enabled |
+                (qhp->attr.mpa_attr.xmit_marker_enabled << 1) |
+                (qhp->attr.mpa_attr.crc_enabled << 2);
+
+        /*
+         * XXX - The IWCM doesn't quite handle getting these
+         * attrs set before going into RTS.  For now, just turn
+         * them on always...
+         */
+#if 0
+        init_attr.qpcaps = qhp->attr.enableRdmaRead |
+                (qhp->attr.enableRdmaWrite << 1) |
+                (qhp->attr.enableBind << 2) |
+                (qhp->attr.enable_stag0_fastreg << 3) |
+                (qhp->attr.enable_stag0_fastreg << 4);
+#else
+        init_attr.qpcaps = 0x1f;
+#endif
+        init_attr.tcp_emss = qhp->ep->emss;
+        init_attr.ord = qhp->attr.max_ord;
+        init_attr.ird = qhp->attr.max_ird;
+        init_attr.qp_dma_addr = qhp->wq.dma_addr;
+        init_attr.qp_dma_size = (1UL << qhp->wq.size_log2);
+        init_attr.flags = rqes_posted(qhp) ? RECVS_POSTED : 0;
+        PDBG("%s init_attr.rq_addr 0x%x init_attr.rq_size = %d "
+             "flags 0x%x qpcaps 0x%x\n", __FUNCTION__,
+             init_attr.rq_addr, init_attr.rq_size,
+             init_attr.flags, init_attr.qpcaps);
+        ret = cxio_rdma_init(&rhp->rdev, &init_attr);
+        PDBG("%s ret %d\n", __FUNCTION__, ret);
+        return ret;
+}
+
+int iwch_modify_qp(struct iwch_dev *rhp, struct iwch_qp *qhp,
+                                enum iwch_qp_attr_mask mask,
+                                struct iwch_qp_attributes *attrs,
+                                int internal)
+{
+        int ret = 0;
+        struct iwch_qp_attributes newattr = qhp->attr;
+        unsigned long flag;
+        int disconnect = 0;
+        int terminate = 0;
+        int abort = 0;
+        int free = 0;
+        struct iwch_ep *ep = NULL;
+
+        PDBG("%s qhp %p qpid 0x%x ep %p state %d -> %d\n", __FUNCTION__,
+             qhp, qhp->wq.qpid, qhp->ep, qhp->attr.state,
+             (mask & IWCH_QP_ATTR_NEXT_STATE) ? attrs->next_state : -1);
+
+        spin_lock_irqsave(&qhp->lock, flag);
+
+        /* Process attr changes if in IDLE */
+        if (mask & IWCH_QP_ATTR_VALID_MODIFY) {
+                if (qhp->attr.state != IWCH_QP_STATE_IDLE) {
+                        ret = -EIO;
+                        goto out;
+                }
+                if (mask & IWCH_QP_ATTR_ENABLE_RDMA_READ)
+                        newattr.enable_rdma_read = attrs->enable_rdma_read;
+                if (mask & IWCH_QP_ATTR_ENABLE_RDMA_WRITE)
+                        newattr.enable_rdma_write = attrs->enable_rdma_write;
+                if (mask & IWCH_QP_ATTR_ENABLE_RDMA_BIND)
+                        newattr.enable_bind = attrs->enable_bind;
+                if (mask & IWCH_QP_ATTR_MAX_ORD) {
+                        if (attrs->max_ord >
+                            rhp->attr.max_rdma_read_qp_depth) {
+                                ret = -EINVAL;
+                                goto out;
+                        }
+                        newattr.max_ord = attrs->max_ord;
+                }
+                if (mask & IWCH_QP_ATTR_MAX_IRD) {
+                        if (attrs->max_ird >
+                            rhp->attr.max_rdma_reads_per_qp) {
+                                ret = -EINVAL;
+                                goto out;
+                        }
+                        newattr.max_ird = attrs->max_ird;
+                }
+                qhp->attr = newattr;
+        }
+
+        if (!(mask & IWCH_QP_ATTR_NEXT_STATE))
+                goto out;
+        if (qhp->attr.state == attrs->next_state)
+                goto out;
+
+        switch (qhp->attr.state) {
+        case IWCH_QP_STATE_IDLE:
+                switch (attrs->next_state) {
+                case IWCH_QP_STATE_RTS:
+                        if (!(mask & IWCH_QP_ATTR_LLP_STREAM_HANDLE)) {
+                                ret = -EINVAL;
+                                goto out;
+                        }
+                        if (!(mask & IWCH_QP_ATTR_MPA_ATTR)) {
+                                ret = -EINVAL;
+                                goto out;
+                        }
+                        qhp->attr.mpa_attr = attrs->mpa_attr;
+                        qhp->attr.llp_stream_handle = attrs->llp_stream_handle;
+                        qhp->ep = qhp->attr.llp_stream_handle;
+                        qhp->attr.state = IWCH_QP_STATE_RTS;
+
+                        /*
+                         * Ref the endpoint here and deref when we
+                         * disassociate the endpoint from the QP.  This
+                         * happens in CLOSING->IDLE transition or *->ERROR
+                         * transition.
+                         */
+                        get_ep(&qhp->ep->com);
+                        spin_unlock_irqrestore(&qhp->lock, flag);
+                        ret = rdma_init(rhp, qhp, mask, attrs);
+                        spin_lock_irqsave(&qhp->lock, flag);
+                        if (ret)
+                                goto err;
+                        break;
+                case IWCH_QP_STATE_ERROR:
+                        qhp->attr.state = IWCH_QP_STATE_ERROR;
+                        flush_qp(qhp, &flag);
+                        break;
+                default:
+                        ret = -EINVAL;
+                        goto out;
+                }
+                break;
+        case IWCH_QP_STATE_RTS:
+                switch (attrs->next_state) {
+                case IWCH_QP_STATE_CLOSING:
+                        BUG_ON(atomic_read(&qhp->ep->com.kref.refcount) < 2);
+                        qhp->attr.state = IWCH_QP_STATE_CLOSING;
+                        if (!internal) {
+                                abort=0;
+                                disconnect = 1;
+                                ep = qhp->ep;
+                        }
+                        break;
+                case IWCH_QP_STATE_TERMINATE:
+                        qhp->attr.state = IWCH_QP_STATE_TERMINATE;
+                        if (!internal)
+                                terminate = 1;
+                        break;
+                case IWCH_QP_STATE_ERROR:
+                        qhp->attr.state = IWCH_QP_STATE_ERROR;
+                        if (!internal) {
+                                abort=1;
+                                disconnect = 1;
+                                ep = qhp->ep;
+                        }
+                        goto err;
+                        break;
+                default:
+                        ret = -EINVAL;
+                        goto out;
+                }
+                break;
+        case IWCH_QP_STATE_CLOSING:
+                if (!internal) {
+                        ret = -EINVAL;
+                        goto out;
+                }
+                switch (attrs->next_state) {
+                        case IWCH_QP_STATE_IDLE:
+                                qhp->attr.state = IWCH_QP_STATE_IDLE;
+                                qhp->attr.llp_stream_handle = NULL;
+                                put_ep(&qhp->ep->com);
+                                qhp->ep = NULL;
+                                wake_up(&qhp->wait);
+                                break;
+                        case IWCH_QP_STATE_ERROR:
+                                goto err;
+                        default:
+                                ret = -EINVAL;
+                                goto err;
+                }
+                break;
+        case IWCH_QP_STATE_ERROR:
+                if (attrs->next_state != IWCH_QP_STATE_IDLE) {
+                        ret = -EINVAL;
+                        goto out;
+                }
+
+                if (!Q_EMPTY(qhp->wq.sq_rptr, qhp->wq.sq_wptr) ||
+                    !Q_EMPTY(qhp->wq.rq_rptr, qhp->wq.rq_wptr)) {
+                        ret = -EINVAL;
+                        goto out;
+                }
+                qhp->attr.state = IWCH_QP_STATE_IDLE;
+                memset(&qhp->attr, 0, sizeof(qhp->attr));
+                break;
+        case IWCH_QP_STATE_TERMINATE:
+                if (!internal) {
+                        ret = -EINVAL;
+                        goto out;
+                }
+                goto err;
+                break;
+        default:
+                printk(KERN_ERR "%s in a bad state %d\n",
+                       __FUNCTION__, qhp->attr.state);
+                ret = -EINVAL;
+                goto err;
+                break;
+        }
+        goto out;
+err:
+        PDBG("%s disassociating ep %p qpid 0x%x\n", __FUNCTION__, qhp->ep,
+             qhp->wq.qpid);
+
+        /* disassociate the LLP connection */
+        qhp->attr.llp_stream_handle = NULL;
+        ep = qhp->ep;
+        qhp->ep = NULL;
+        qhp->attr.state = IWCH_QP_STATE_ERROR;
+        free=1;
+        wake_up(&qhp->wait);
+        BUG_ON(!ep);
+        flush_qp(qhp, &flag);
+out:
+        spin_unlock_irqrestore(&qhp->lock, flag);
+
+        if (terminate)
+                iwch_post_terminate(qhp, NULL);
+
+        /*
+         * If disconnect is 1, then we need to initiate a disconnect
+         * on the EP.  This can be a normal close (RTS->CLOSING) or
+         * an abnormal close (RTS/CLOSING->ERROR).
+         */
+        if (disconnect)
+                iwch_ep_disconnect(ep, abort, GFP_KERNEL);
+
+        /*
+         * If free is 1, then we've disassociated the EP from the QP
+         * and we need to dereference the EP.
+         */
+        if (free)
+                put_ep(&ep->com);
+
+        PDBG("%s exit state %d\n", __FUNCTION__, qhp->attr.state);
+        return ret;
+}
+
+static int quiesce_qp(struct iwch_qp *qhp)
+{
+        spin_lock_irq(&qhp->lock);
+        iwch_quiesce_tid(qhp->ep);
+        qhp->flags |= QP_QUIESCED;
+        spin_unlock_irq(&qhp->lock);
+        return 0;
+}
+
+static int resume_qp(struct iwch_qp *qhp)
+{
+        spin_lock_irq(&qhp->lock);
+        iwch_resume_tid(qhp->ep);
+        qhp->flags &= ~QP_QUIESCED;
+        spin_unlock_irq(&qhp->lock);
+        return 0;
+}
+
+int iwch_quiesce_qps(struct iwch_cq *chp)
+{
+        int i;
+        struct iwch_qp *qhp;
+
+        for (i=0; i < T3_MAX_NUM_QP; i++) {
+                qhp = get_qhp(chp->rhp, i);
+                if (!qhp)
+                        continue;
+                if ((qhp->attr.rcq == chp->cq.cqid) && !qp_quiesced(qhp)) {
+                        quiesce_qp(qhp);
+                        continue;
+                }
+                if ((qhp->attr.scq == chp->cq.cqid) && !qp_quiesced(qhp))
+                        quiesce_qp(qhp);
+        }
+        return 0;
+}
+
+int iwch_resume_qps(struct iwch_cq *chp)
+{
+        int i;
+        struct iwch_qp *qhp;
+
+        for (i=0; i < T3_MAX_NUM_QP; i++) {
+                qhp = get_qhp(chp->rhp, i);
+                if (!qhp)
+                        continue;
+                if ((qhp->attr.rcq == chp->cq.cqid) && qp_quiesced(qhp)) {
+                        resume_qp(qhp);
+                        continue;
+                }
+                if ((qhp->attr.scq == chp->cq.cqid) && qp_quiesced(qhp))
+                        resume_qp(qhp);
+        }
+        return 0;
+}
diff --git a/drivers/infiniband/hw/cxgb3/iwch_user.h b/drivers/infiniband/hw/cxgb3/iwch_user.h
new file mode 100644
index 000000000000..c4e7fbea8bbd
--- /dev/null
+++ b/drivers/infiniband/hw/cxgb3/iwch_user.h
@@ -0,0 +1,67 @@
+/*
+ * Copyright (c) 2006 Chelsio, Inc. All rights reserved.
+ * Copyright (c) 2006 Open Grid Computing, Inc. All rights reserved.
+ *
+ * This software is available to you under a choice of one of two
+ * licenses.  You may choose to be licensed under the terms of the GNU
+ * General Public License (GPL) Version 2, available from the file
+ * COPYING in the main directory of this source tree, or the
+ * OpenIB.org BSD license below:
+ *
+ *     Redistribution and use in source and binary forms, with or
+ *     without modification, are permitted provided that the following
+ *     conditions are met:
+ *
+ *      - Redistributions of source code must retain the above
+ *        copyright notice, this list of conditions and the following
+ *        disclaimer.
+ *
+ *      - Redistributions in binary form must reproduce the above
+ *        copyright notice, this list of conditions and the following
+ *        disclaimer in the documentation and/or other materials
+ *        provided with the distribution.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+ * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+ * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+ * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
+ * BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
+ * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
+ * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+ * SOFTWARE.
+ */
+#ifndef __IWCH_USER_H__
+#define __IWCH_USER_H__
+
+#define IWCH_UVERBS_ABI_VERSION 1
+
+/*
+ * Make sure that all structs defined in this file remain laid out so
+ * that they pack the same way on 32-bit and 64-bit architectures (to
+ * avoid incompatibility between 32-bit userspace and 64-bit kernels).
+ * In particular do not use pointer types -- pass pointers in __u64
+ * instead.
+ */
+struct iwch_create_cq_req {
+        __u64 user_rptr_addr;
+};
+
+struct iwch_create_cq_resp {
+        __u64 key;
+        __u32 cqid;
+        __u32 size_log2;
+};
+
+struct iwch_create_qp_resp {
+        __u64 key;
+        __u64 db_key;
+        __u32 qpid;
+        __u32 size_log2;
+        __u32 sq_size_log2;
+        __u32 rq_size_log2;
+};
+
+struct iwch_reg_user_mr_resp {
+        __u32 pbl_addr;
+};
+#endif
diff --git a/drivers/infiniband/hw/cxgb3/tcb.h b/drivers/infiniband/hw/cxgb3/tcb.h
new file mode 100644
index 000000000000..c702dc199e18
--- /dev/null
+++ b/drivers/infiniband/hw/cxgb3/tcb.h
@@ -0,0 +1,632 @@
+/*
+ * Copyright (c) 2007 Chelsio, Inc. All rights reserved.
+ *
+ * This software is available to you under a choice of one of two
+ * licenses.  You may choose to be licensed under the terms of the GNU
+ * General Public License (GPL) Version 2, available from the file
+ * COPYING in the main directory of this source tree, or the
+ * OpenIB.org BSD license below:
+ *
+ *     Redistribution and use in source and binary forms, with or
+ *     without modification, are permitted provided that the following
+ *     conditions are met:
+ *
+ *      - Redistributions of source code must retain the above
+ *        copyright notice, this list of conditions and the following
+ *        disclaimer.
+ *
+ *      - Redistributions in binary form must reproduce the above
+ *        copyright notice, this list of conditions and the following
+ *        disclaimer in the documentation and/or other materials
+ *        provided with the distribution.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+ * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+ * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+ * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
+ * BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
+ * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
+ * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+ * SOFTWARE.
+ */
+#ifndef _TCB_DEFS_H
+#define _TCB_DEFS_H
+
+#define W_TCB_T_STATE    0
+#define S_TCB_T_STATE    0
+#define M_TCB_T_STATE    0xfULL
+#define V_TCB_T_STATE(x) ((x) << S_TCB_T_STATE)
+
+#define W_TCB_TIMER    0
+#define S_TCB_TIMER    4
+#define M_TCB_TIMER    0x1ULL
+#define V_TCB_TIMER(x) ((x) << S_TCB_TIMER)
+
+#define W_TCB_DACK_TIMER    0
+#define S_TCB_DACK_TIMER    5
+#define M_TCB_DACK_TIMER    0x1ULL
+#define V_TCB_DACK_TIMER(x) ((x) << S_TCB_DACK_TIMER)
+
+#define W_TCB_DEL_FLAG    0
+#define S_TCB_DEL_FLAG    6
+#define M_TCB_DEL_FLAG    0x1ULL
+#define V_TCB_DEL_FLAG(x) ((x) << S_TCB_DEL_FLAG)
+
+#define W_TCB_L2T_IX    0
+#define S_TCB_L2T_IX    7
+#define M_TCB_L2T_IX    0x7ffULL
+#define V_TCB_L2T_IX(x) ((x) << S_TCB_L2T_IX)
+
+#define W_TCB_SMAC_SEL    0
+#define S_TCB_SMAC_SEL    18
+#define M_TCB_SMAC_SEL    0x3ULL
+#define V_TCB_SMAC_SEL(x) ((x) << S_TCB_SMAC_SEL)
+
+#define W_TCB_TOS    0
+#define S_TCB_TOS    20
+#define M_TCB_TOS    0x3fULL
+#define V_TCB_TOS(x) ((x) << S_TCB_TOS)
+
+#define W_TCB_MAX_RT    0
+#define S_TCB_MAX_RT    26
+#define M_TCB_MAX_RT    0xfULL
+#define V_TCB_MAX_RT(x) ((x) << S_TCB_MAX_RT)
+
+#define W_TCB_T_RXTSHIFT    0
+#define S_TCB_T_RXTSHIFT    30
+#define M_TCB_T_RXTSHIFT    0xfULL
+#define V_TCB_T_RXTSHIFT(x) ((x) << S_TCB_T_RXTSHIFT)
+
+#define W_TCB_T_DUPACKS    1
+#define S_TCB_T_DUPACKS    2
+#define M_TCB_T_DUPACKS    0xfULL
+#define V_TCB_T_DUPACKS(x) ((x) << S_TCB_T_DUPACKS)
+
+#define W_TCB_T_MAXSEG    1
+#define S_TCB_T_MAXSEG    6
+#define M_TCB_T_MAXSEG    0xfULL
+#define V_TCB_T_MAXSEG(x) ((x) << S_TCB_T_MAXSEG)
+
+#define W_TCB_T_FLAGS1    1
+#define S_TCB_T_FLAGS1    10
+#define M_TCB_T_FLAGS1    0xffffffffULL
+#define V_TCB_T_FLAGS1(x) ((x) << S_TCB_T_FLAGS1)
+
+#define W_TCB_T_MIGRATION    1
+#define S_TCB_T_MIGRATION    20
+#define M_TCB_T_MIGRATION    0x1ULL
+#define V_TCB_T_MIGRATION(x) ((x) << S_TCB_T_MIGRATION)
+
+#define W_TCB_T_FLAGS2    2
+#define S_TCB_T_FLAGS2    10
+#define M_TCB_T_FLAGS2    0x7fULL
+#define V_TCB_T_FLAGS2(x) ((x) << S_TCB_T_FLAGS2)
+
+#define W_TCB_SND_SCALE    2
+#define S_TCB_SND_SCALE    17
+#define M_TCB_SND_SCALE    0xfULL
+#define V_TCB_SND_SCALE(x) ((x) << S_TCB_SND_SCALE)
+
+#define W_TCB_RCV_SCALE    2
+#define S_TCB_RCV_SCALE    21
+#define M_TCB_RCV_SCALE    0xfULL
+#define V_TCB_RCV_SCALE(x) ((x) << S_TCB_RCV_SCALE)
+
+#define W_TCB_SND_UNA_RAW    2
+#define S_TCB_SND_UNA_RAW    25
+#define M_TCB_SND_UNA_RAW    0x7ffffffULL
+#define V_TCB_SND_UNA_RAW(x) ((x) << S_TCB_SND_UNA_RAW)
+
+#define W_TCB_SND_NXT_RAW    3
+#define S_TCB_SND_NXT_RAW    20
+#define M_TCB_SND_NXT_RAW    0x7ffffffULL
+#define V_TCB_SND_NXT_RAW(x) ((x) << S_TCB_SND_NXT_RAW)
+
+#define W_TCB_RCV_NXT    4
+#define S_TCB_RCV_NXT    15
+#define M_TCB_RCV_NXT    0xffffffffULL
+#define V_TCB_RCV_NXT(x) ((x) << S_TCB_RCV_NXT)
+
+#define W_TCB_RCV_ADV    5
+#define S_TCB_RCV_ADV    15
+#define M_TCB_RCV_ADV    0xffffULL
+#define V_TCB_RCV_ADV(x) ((x) << S_TCB_RCV_ADV)
+
+#define W_TCB_SND_MAX_RAW    5
+#define S_TCB_SND_MAX_RAW    31
+#define M_TCB_SND_MAX_RAW    0x7ffffffULL
+#define V_TCB_SND_MAX_RAW(x) ((x) << S_TCB_SND_MAX_RAW)
+
+#define W_TCB_SND_CWND    6
+#define S_TCB_SND_CWND    26
+#define M_TCB_SND_CWND    0x7ffffffULL
+#define V_TCB_SND_CWND(x) ((x) << S_TCB_SND_CWND)
+
+#define W_TCB_SND_SSTHRESH    7
+#define S_TCB_SND_SSTHRESH    21
+#define M_TCB_SND_SSTHRESH    0x7ffffffULL
+#define V_TCB_SND_SSTHRESH(x) ((x) << S_TCB_SND_SSTHRESH)
+
+#define W_TCB_T_RTT_TS_RECENT_AGE    8
+#define S_TCB_T_RTT_TS_RECENT_AGE    16
+#define M_TCB_T_RTT_TS_RECENT_AGE    0xffffffffULL
+#define V_TCB_T_RTT_TS_RECENT_AGE(x) ((x) << S_TCB_T_RTT_TS_RECENT_AGE)
+
+#define W_TCB_T_RTSEQ_RECENT    9
+#define S_TCB_T_RTSEQ_RECENT    16
+#define M_TCB_T_RTSEQ_RECENT    0xffffffffULL
+#define V_TCB_T_RTSEQ_RECENT(x) ((x) << S_TCB_T_RTSEQ_RECENT)
+
+#define W_TCB_T_SRTT    10
+#define S_TCB_T_SRTT    16
+#define M_TCB_T_SRTT    0xffffULL
+#define V_TCB_T_SRTT(x) ((x) << S_TCB_T_SRTT)
+
+#define W_TCB_T_RTTVAR    11
+#define S_TCB_T_RTTVAR    0
+#define M_TCB_T_RTTVAR    0xffffULL
+#define V_TCB_T_RTTVAR(x) ((x) << S_TCB_T_RTTVAR)
+
+#define W_TCB_TS_LAST_ACK_SENT_RAW    11
+#define S_TCB_TS_LAST_ACK_SENT_RAW    16
+#define M_TCB_TS_LAST_ACK_SENT_RAW    0x7ffffffULL
+#define V_TCB_TS_LAST_ACK_SENT_RAW(x) ((x) << S_TCB_TS_LAST_ACK_SENT_RAW)
+
+#define W_TCB_DIP    12
+#define S_TCB_DIP    11
+#define M_TCB_DIP    0xffffffffULL
+#define V_TCB_DIP(x) ((x) << S_TCB_DIP)
+
+#define W_TCB_SIP    13
+#define S_TCB_SIP    11
+#define M_TCB_SIP    0xffffffffULL
+#define V_TCB_SIP(x) ((x) << S_TCB_SIP)
+
+#define W_TCB_DP    14
+#define S_TCB_DP    11
+#define M_TCB_DP    0xffffULL
+#define V_TCB_DP(x) ((x) << S_TCB_DP)
+
+#define W_TCB_SP    14
+#define S_TCB_SP    27
+#define M_TCB_SP    0xffffULL
+#define V_TCB_SP(x) ((x) << S_TCB_SP)
+
+#define W_TCB_TIMESTAMP    15
+#define S_TCB_TIMESTAMP    11
+#define M_TCB_TIMESTAMP    0xffffffffULL
+#define V_TCB_TIMESTAMP(x) ((x) << S_TCB_TIMESTAMP)
+
+#define W_TCB_TIMESTAMP_OFFSET    16
+#define S_TCB_TIMESTAMP_OFFSET    11
+#define M_TCB_TIMESTAMP_OFFSET    0xfULL
+#define V_TCB_TIMESTAMP_OFFSET(x) ((x) << S_TCB_TIMESTAMP_OFFSET)
+
+#define W_TCB_TX_MAX    16
+#define S_TCB_TX_MAX    15
+#define M_TCB_TX_MAX    0xffffffffULL
+#define V_TCB_TX_MAX(x) ((x) << S_TCB_TX_MAX)
+
+#define W_TCB_TX_HDR_PTR_RAW    17
+#define S_TCB_TX_HDR_PTR_RAW    15
+#define M_TCB_TX_HDR_PTR_RAW    0x1ffffULL
+#define V_TCB_TX_HDR_PTR_RAW(x) ((x) << S_TCB_TX_HDR_PTR_RAW)
+
+#define W_TCB_TX_LAST_PTR_RAW    18
+#define S_TCB_TX_LAST_PTR_RAW    0
+#define M_TCB_TX_LAST_PTR_RAW    0x1ffffULL
+#define V_TCB_TX_LAST_PTR_RAW(x) ((x) << S_TCB_TX_LAST_PTR_RAW)
+
+#define W_TCB_TX_COMPACT    18
+#define S_TCB_TX_COMPACT    17
+#define M_TCB_TX_COMPACT    0x1ULL
+#define V_TCB_TX_COMPACT(x) ((x) << S_TCB_TX_COMPACT)
+
+#define W_TCB_RX_COMPACT    18
+#define S_TCB_RX_COMPACT    18
+#define M_TCB_RX_COMPACT    0x1ULL
+#define V_TCB_RX_COMPACT(x) ((x) << S_TCB_RX_COMPACT)
+
+#define W_TCB_RCV_WND    18
+#define S_TCB_RCV_WND    19
+#define M_TCB_RCV_WND    0x7ffffffULL
+#define V_TCB_RCV_WND(x) ((x) << S_TCB_RCV_WND)
+
+#define W_TCB_RX_HDR_OFFSET    19
+#define S_TCB_RX_HDR_OFFSET    14
+#define M_TCB_RX_HDR_OFFSET    0x7ffffffULL
+#define V_TCB_RX_HDR_OFFSET(x) ((x) << S_TCB_RX_HDR_OFFSET)
+
+#define W_TCB_RX_FRAG0_START_IDX_RAW    20
+#define S_TCB_RX_FRAG0_START_IDX_RAW    9
+#define M_TCB_RX_FRAG0_START_IDX_RAW    0x7ffffffULL
+#define V_TCB_RX_FRAG0_START_IDX_RAW(x) ((x) << S_TCB_RX_FRAG0_START_IDX_RAW)
+
+#define W_TCB_RX_FRAG1_START_IDX_OFFSET    21
+#define S_TCB_RX_FRAG1_START_IDX_OFFSET    4
+#define M_TCB_RX_FRAG1_START_IDX_OFFSET    0x7ffffffULL
+#define V_TCB_RX_FRAG1_START_IDX_OFFSET(x) ((x) << S_TCB_RX_FRAG1_START_IDX_OFFSET)
+
+#define W_TCB_RX_FRAG0_LEN    21
+#define S_TCB_RX_FRAG0_LEN    31
+#define M_TCB_RX_FRAG0_LEN    0x7ffffffULL
+#define V_TCB_RX_FRAG0_LEN(x) ((x) << S_TCB_RX_FRAG0_LEN)
+
+#define W_TCB_RX_FRAG1_LEN    22
+#define S_TCB_RX_FRAG1_LEN    26
+#define M_TCB_RX_FRAG1_LEN    0x7ffffffULL
+#define V_TCB_RX_FRAG1_LEN(x) ((x) << S_TCB_RX_FRAG1_LEN)
+
+#define W_TCB_NEWRENO_RECOVER    23
+#define S_TCB_NEWRENO_RECOVER    21
+#define M_TCB_NEWRENO_RECOVER    0x7ffffffULL
+#define V_TCB_NEWRENO_RECOVER(x) ((x) << S_TCB_NEWRENO_RECOVER)
+
+#define W_TCB_PDU_HAVE_LEN    24
+#define S_TCB_PDU_HAVE_LEN    16
+#define M_TCB_PDU_HAVE_LEN    0x1ULL
+#define V_TCB_PDU_HAVE_LEN(x) ((x) << S_TCB_PDU_HAVE_LEN)
+
+#define W_TCB_PDU_LEN    24
+#define S_TCB_PDU_LEN    17
+#define M_TCB_PDU_LEN    0xffffULL
+#define V_TCB_PDU_LEN(x) ((x) << S_TCB_PDU_LEN)
+
+#define W_TCB_RX_QUIESCE    25
+#define S_TCB_RX_QUIESCE    1
+#define M_TCB_RX_QUIESCE    0x1ULL
+#define V_TCB_RX_QUIESCE(x) ((x) << S_TCB_RX_QUIESCE)
+
+#define W_TCB_RX_PTR_RAW    25
+#define S_TCB_RX_PTR_RAW    2
+#define M_TCB_RX_PTR_RAW    0x1ffffULL
+#define V_TCB_RX_PTR_RAW(x) ((x) << S_TCB_RX_PTR_RAW)
+
+#define W_TCB_CPU_NO    25
+#define S_TCB_CPU_NO    19
+#define M_TCB_CPU_NO    0x7fULL
+#define V_TCB_CPU_NO(x) ((x) << S_TCB_CPU_NO)
+
+#define W_TCB_ULP_TYPE    25
+#define S_TCB_ULP_TYPE    26
+#define M_TCB_ULP_TYPE    0xfULL
+#define V_TCB_ULP_TYPE(x) ((x) << S_TCB_ULP_TYPE)
+
+#define W_TCB_RX_FRAG1_PTR_RAW    25
+#define S_TCB_RX_FRAG1_PTR_RAW    30
+#define M_TCB_RX_FRAG1_PTR_RAW    0x1ffffULL
+#define V_TCB_RX_FRAG1_PTR_RAW(x) ((x) << S_TCB_RX_FRAG1_PTR_RAW)
+
+#define W_TCB_RX_FRAG2_START_IDX_OFFSET_RAW    26
+#define S_TCB_RX_FRAG2_START_IDX_OFFSET_RAW    15
+#define M_TCB_RX_FRAG2_START_IDX_OFFSET_RAW    0x7ffffffULL
+#define V_TCB_RX_FRAG2_START_IDX_OFFSET_RAW(x) ((x) << S_TCB_RX_FRAG2_START_IDX_OFFSET_RAW)
+
+#define W_TCB_RX_FRAG2_PTR_RAW    27
+#define S_TCB_RX_FRAG2_PTR_RAW    10
+#define M_TCB_RX_FRAG2_PTR_RAW    0x1ffffULL
+#define V_TCB_RX_FRAG2_PTR_RAW(x) ((x) << S_TCB_RX_FRAG2_PTR_RAW)
+
+#define W_TCB_RX_FRAG2_LEN_RAW    27
+#define S_TCB_RX_FRAG2_LEN_RAW    27
+#define M_TCB_RX_FRAG2_LEN_RAW    0x7ffffffULL
+#define V_TCB_RX_FRAG2_LEN_RAW(x) ((x) << S_TCB_RX_FRAG2_LEN_RAW)
+
+#define W_TCB_RX_FRAG3_PTR_RAW    28
+#define S_TCB_RX_FRAG3_PTR_RAW    22
+#define M_TCB_RX_FRAG3_PTR_RAW    0x1ffffULL
+#define V_TCB_RX_FRAG3_PTR_RAW(x) ((x) << S_TCB_RX_FRAG3_PTR_RAW)
+
+#define W_TCB_RX_FRAG3_LEN_RAW    29
+#define S_TCB_RX_FRAG3_LEN_RAW    7
+#define M_TCB_RX_FRAG3_LEN_RAW    0x7ffffffULL
+#define V_TCB_RX_FRAG3_LEN_RAW(x) ((x) << S_TCB_RX_FRAG3_LEN_RAW)
+
+#define W_TCB_RX_FRAG3_START_IDX_OFFSET_RAW    30
+#define S_TCB_RX_FRAG3_START_IDX_OFFSET_RAW    2
+#define M_TCB_RX_FRAG3_START_IDX_OFFSET_RAW    0x7ffffffULL
+#define V_TCB_RX_FRAG3_START_IDX_OFFSET_RAW(x) ((x) << S_TCB_RX_FRAG3_START_IDX_OFFSET_RAW)
+
+#define W_TCB_PDU_HDR_LEN    30
+#define S_TCB_PDU_HDR_LEN    29
+#define M_TCB_PDU_HDR_LEN    0xffULL
+#define V_TCB_PDU_HDR_LEN(x) ((x) << S_TCB_PDU_HDR_LEN)
+
+#define W_TCB_SLUSH1    31
+#define S_TCB_SLUSH1    5
+#define M_TCB_SLUSH1    0x7ffffULL
+#define V_TCB_SLUSH1(x) ((x) << S_TCB_SLUSH1)
+
+#define W_TCB_ULP_RAW    31
+#define S_TCB_ULP_RAW    24
+#define M_TCB_ULP_RAW    0xffULL
+#define V_TCB_ULP_RAW(x) ((x) << S_TCB_ULP_RAW)
+
+#define W_TCB_DDP_RDMAP_VERSION    25
+#define S_TCB_DDP_RDMAP_VERSION    30
+#define M_TCB_DDP_RDMAP_VERSION    0x1ULL
+#define V_TCB_DDP_RDMAP_VERSION(x) ((x) << S_TCB_DDP_RDMAP_VERSION)
+
+#define W_TCB_MARKER_ENABLE_RX    25
+#define S_TCB_MARKER_ENABLE_RX    31
+#define M_TCB_MARKER_ENABLE_RX    0x1ULL
+#define V_TCB_MARKER_ENABLE_RX(x) ((x) << S_TCB_MARKER_ENABLE_RX)
+
+#define W_TCB_MARKER_ENABLE_TX    26
+#define S_TCB_MARKER_ENABLE_TX    0
+#define M_TCB_MARKER_ENABLE_TX    0x1ULL
+#define V_TCB_MARKER_ENABLE_TX(x) ((x) << S_TCB_MARKER_ENABLE_TX)
+
+#define W_TCB_CRC_ENABLE    26
+#define S_TCB_CRC_ENABLE    1
+#define M_TCB_CRC_ENABLE    0x1ULL
+#define V_TCB_CRC_ENABLE(x) ((x) << S_TCB_CRC_ENABLE)
+
+#define W_TCB_IRS_ULP    26
+#define S_TCB_IRS_ULP    2
+#define M_TCB_IRS_ULP    0x1ffULL
+#define V_TCB_IRS_ULP(x) ((x) << S_TCB_IRS_ULP)
+
+#define W_TCB_ISS_ULP    26
+#define S_TCB_ISS_ULP    11
+#define M_TCB_ISS_ULP    0x1ffULL
+#define V_TCB_ISS_ULP(x) ((x) << S_TCB_ISS_ULP)
+
+#define W_TCB_TX_PDU_LEN    26
+#define S_TCB_TX_PDU_LEN    20
+#define M_TCB_TX_PDU_LEN    0x3fffULL
+#define V_TCB_TX_PDU_LEN(x) ((x) << S_TCB_TX_PDU_LEN)
+
+#define W_TCB_TX_PDU_OUT    27
+#define S_TCB_TX_PDU_OUT    2
+#define M_TCB_TX_PDU_OUT    0x1ULL
+#define V_TCB_TX_PDU_OUT(x) ((x) << S_TCB_TX_PDU_OUT)
+
+#define W_TCB_CQ_IDX_SQ    27
+#define S_TCB_CQ_IDX_SQ    3
+#define M_TCB_CQ_IDX_SQ    0xffffULL
+#define V_TCB_CQ_IDX_SQ(x) ((x) << S_TCB_CQ_IDX_SQ)
+
+#define W_TCB_CQ_IDX_RQ    27
+#define S_TCB_CQ_IDX_RQ    19
+#define M_TCB_CQ_IDX_RQ    0xffffULL
+#define V_TCB_CQ_IDX_RQ(x) ((x) << S_TCB_CQ_IDX_RQ)
+
+#define W_TCB_QP_ID    28
+#define S_TCB_QP_ID    3
+#define M_TCB_QP_ID    0xffffULL
+#define V_TCB_QP_ID(x) ((x) << S_TCB_QP_ID)
+
+#define W_TCB_PD_ID    28
+#define S_TCB_PD_ID    19
+#define M_TCB_PD_ID    0xffffULL
+#define V_TCB_PD_ID(x) ((x) << S_TCB_PD_ID)
+
+#define W_TCB_STAG    29
+#define S_TCB_STAG    3
+#define M_TCB_STAG    0xffffffffULL
+#define V_TCB_STAG(x) ((x) << S_TCB_STAG)
+
+#define W_TCB_RQ_START    30
+#define S_TCB_RQ_START    3
+#define M_TCB_RQ_START    0x3ffffffULL
+#define V_TCB_RQ_START(x) ((x) << S_TCB_RQ_START)
+
+#define W_TCB_RQ_MSN    30
+#define S_TCB_RQ_MSN    29
+#define M_TCB_RQ_MSN    0x3ffULL
+#define V_TCB_RQ_MSN(x) ((x) << S_TCB_RQ_MSN)
+
+#define W_TCB_RQ_MAX_OFFSET    31
+#define S_TCB_RQ_MAX_OFFSET    7
+#define M_TCB_RQ_MAX_OFFSET    0xfULL
+#define V_TCB_RQ_MAX_OFFSET(x) ((x) << S_TCB_RQ_MAX_OFFSET)
+
+#define W_TCB_RQ_WRITE_PTR    31
+#define S_TCB_RQ_WRITE_PTR    11
+#define M_TCB_RQ_WRITE_PTR    0x3ffULL
+#define V_TCB_RQ_WRITE_PTR(x) ((x) << S_TCB_RQ_WRITE_PTR)
+
+#define W_TCB_INB_WRITE_PERM    31
+#define S_TCB_INB_WRITE_PERM    21
+#define M_TCB_INB_WRITE_PERM    0x1ULL
+#define V_TCB_INB_WRITE_PERM(x) ((x) << S_TCB_INB_WRITE_PERM)
+
+#define W_TCB_INB_READ_PERM    31
+#define S_TCB_INB_READ_PERM    22
+#define M_TCB_INB_READ_PERM    0x1ULL
+#define V_TCB_INB_READ_PERM(x) ((x) << S_TCB_INB_READ_PERM)
+
+#define W_TCB_ORD_L_BIT_VLD    31
+#define S_TCB_ORD_L_BIT_VLD    23
+#define M_TCB_ORD_L_BIT_VLD    0x1ULL
+#define V_TCB_ORD_L_BIT_VLD(x) ((x) << S_TCB_ORD_L_BIT_VLD)
+
+#define W_TCB_RDMAP_OPCODE    31
+#define S_TCB_RDMAP_OPCODE    24
+#define M_TCB_RDMAP_OPCODE    0xfULL
+#define V_TCB_RDMAP_OPCODE(x) ((x) << S_TCB_RDMAP_OPCODE)
+
+#define W_TCB_TX_FLUSH    31
+#define S_TCB_TX_FLUSH    28
+#define M_TCB_TX_FLUSH    0x1ULL
+#define V_TCB_TX_FLUSH(x) ((x) << S_TCB_TX_FLUSH)
+
+#define W_TCB_TX_OOS_RXMT    31
+#define S_TCB_TX_OOS_RXMT    29
+#define M_TCB_TX_OOS_RXMT    0x1ULL
+#define V_TCB_TX_OOS_RXMT(x) ((x) << S_TCB_TX_OOS_RXMT)
+
+#define W_TCB_TX_OOS_TXMT    31
+#define S_TCB_TX_OOS_TXMT    30
+#define M_TCB_TX_OOS_TXMT    0x1ULL
+#define V_TCB_TX_OOS_TXMT(x) ((x) << S_TCB_TX_OOS_TXMT)
+
+#define W_TCB_SLUSH_AUX2    31
+#define S_TCB_SLUSH_AUX2    31
+#define M_TCB_SLUSH_AUX2    0x1ULL
+#define V_TCB_SLUSH_AUX2(x) ((x) << S_TCB_SLUSH_AUX2)
+
+#define W_TCB_RX_FRAG1_PTR_RAW2    25
+#define S_TCB_RX_FRAG1_PTR_RAW2    30
+#define M_TCB_RX_FRAG1_PTR_RAW2    0x1ffffULL
+#define V_TCB_RX_FRAG1_PTR_RAW2(x) ((x) << S_TCB_RX_FRAG1_PTR_RAW2)
+
+#define W_TCB_RX_DDP_FLAGS    26
+#define S_TCB_RX_DDP_FLAGS    15
+#define M_TCB_RX_DDP_FLAGS    0x3ffULL
+#define V_TCB_RX_DDP_FLAGS(x) ((x) << S_TCB_RX_DDP_FLAGS)
+
+#define W_TCB_SLUSH_AUX3    26
+#define S_TCB_SLUSH_AUX3    31
+#define M_TCB_SLUSH_AUX3    0x1ffULL
+#define V_TCB_SLUSH_AUX3(x) ((x) << S_TCB_SLUSH_AUX3)
+
+#define W_TCB_RX_DDP_BUF0_OFFSET    27
+#define S_TCB_RX_DDP_BUF0_OFFSET    8
+#define M_TCB_RX_DDP_BUF0_OFFSET    0x3fffffULL
+#define V_TCB_RX_DDP_BUF0_OFFSET(x) ((x) << S_TCB_RX_DDP_BUF0_OFFSET)
+
+#define W_TCB_RX_DDP_BUF0_LEN    27
+#define S_TCB_RX_DDP_BUF0_LEN    30
+#define M_TCB_RX_DDP_BUF0_LEN    0x3fffffULL
+#define V_TCB_RX_DDP_BUF0_LEN(x) ((x) << S_TCB_RX_DDP_BUF0_LEN)
+
+#define W_TCB_RX_DDP_BUF1_OFFSET    28
+#define S_TCB_RX_DDP_BUF1_OFFSET    20
+#define M_TCB_RX_DDP_BUF1_OFFSET    0x3fffffULL
+#define V_TCB_RX_DDP_BUF1_OFFSET(x) ((x) << S_TCB_RX_DDP_BUF1_OFFSET)
+
+#define W_TCB_RX_DDP_BUF1_LEN    29
+#define S_TCB_RX_DDP_BUF1_LEN    10
+#define M_TCB_RX_DDP_BUF1_LEN    0x3fffffULL
+#define V_TCB_RX_DDP_BUF1_LEN(x) ((x) << S_TCB_RX_DDP_BUF1_LEN)
+
+#define W_TCB_RX_DDP_BUF0_TAG    30
+#define S_TCB_RX_DDP_BUF0_TAG    0
+#define M_TCB_RX_DDP_BUF0_TAG    0xffffffffULL
+#define V_TCB_RX_DDP_BUF0_TAG(x) ((x) << S_TCB_RX_DDP_BUF0_TAG)
+
+#define W_TCB_RX_DDP_BUF1_TAG    31
+#define S_TCB_RX_DDP_BUF1_TAG    0
+#define M_TCB_RX_DDP_BUF1_TAG    0xffffffffULL
+#define V_TCB_RX_DDP_BUF1_TAG(x) ((x) << S_TCB_RX_DDP_BUF1_TAG)
+
+#define S_TF_DACK    10
+#define V_TF_DACK(x) ((x) << S_TF_DACK)
+
+#define S_TF_NAGLE    11
+#define V_TF_NAGLE(x) ((x) << S_TF_NAGLE)
+
+#define S_TF_RECV_SCALE    12
+#define V_TF_RECV_SCALE(x) ((x) << S_TF_RECV_SCALE)
+
+#define S_TF_RECV_TSTMP    13
+#define V_TF_RECV_TSTMP(x) ((x) << S_TF_RECV_TSTMP)
+
+#define S_TF_RECV_SACK    14
+#define V_TF_RECV_SACK(x) ((x) << S_TF_RECV_SACK)
+
+#define S_TF_TURBO    15
+#define V_TF_TURBO(x) ((x) << S_TF_TURBO)
+
+#define S_TF_KEEPALIVE    16
+#define V_TF_KEEPALIVE(x) ((x) << S_TF_KEEPALIVE)
+
+#define S_TF_TCAM_BYPASS    17
+#define V_TF_TCAM_BYPASS(x) ((x) << S_TF_TCAM_BYPASS)
+
+#define S_TF_CORE_FIN    18
+#define V_TF_CORE_FIN(x) ((x) << S_TF_CORE_FIN)
+
+#define S_TF_CORE_MORE    19
+#define V_TF_CORE_MORE(x) ((x) << S_TF_CORE_MORE)
+
+#define S_TF_MIGRATING    20
+#define V_TF_MIGRATING(x) ((x) << S_TF_MIGRATING)
+
+#define S_TF_ACTIVE_OPEN    21
+#define V_TF_ACTIVE_OPEN(x) ((x) << S_TF_ACTIVE_OPEN)
+
+#define S_TF_ASK_MODE    22
+#define V_TF_ASK_MODE(x) ((x) << S_TF_ASK_MODE)
+
+#define S_TF_NON_OFFLOAD    23
+#define V_TF_NON_OFFLOAD(x) ((x) << S_TF_NON_OFFLOAD)
+
+#define S_TF_MOD_SCHD    24
+#define V_TF_MOD_SCHD(x) ((x) << S_TF_MOD_SCHD)
+
+#define S_TF_MOD_SCHD_REASON0    25
+#define V_TF_MOD_SCHD_REASON0(x) ((x) << S_TF_MOD_SCHD_REASON0)
+
+#define S_TF_MOD_SCHD_REASON1    26
+#define V_TF_MOD_SCHD_REASON1(x) ((x) << S_TF_MOD_SCHD_REASON1)
+
+#define S_TF_MOD_SCHD_RX    27
+#define V_TF_MOD_SCHD_RX(x) ((x) << S_TF_MOD_SCHD_RX)
+
+#define S_TF_CORE_PUSH    28
+#define V_TF_CORE_PUSH(x) ((x) << S_TF_CORE_PUSH)
+
+#define S_TF_RCV_COALESCE_ENABLE    29
+#define V_TF_RCV_COALESCE_ENABLE(x) ((x) << S_TF_RCV_COALESCE_ENABLE)
+
+#define S_TF_RCV_COALESCE_PUSH    30
+#define V_TF_RCV_COALESCE_PUSH(x) ((x) << S_TF_RCV_COALESCE_PUSH)
+
+#define S_TF_RCV_COALESCE_LAST_PSH    31
+#define V_TF_RCV_COALESCE_LAST_PSH(x) ((x) << S_TF_RCV_COALESCE_LAST_PSH)
+
+#define S_TF_RCV_COALESCE_HEARTBEAT    32
+#define V_TF_RCV_COALESCE_HEARTBEAT(x) ((x) << S_TF_RCV_COALESCE_HEARTBEAT)
+
+#define S_TF_HALF_CLOSE    33
+#define V_TF_HALF_CLOSE(x) ((x) << S_TF_HALF_CLOSE)
+
+#define S_TF_DACK_MSS    34
+#define V_TF_DACK_MSS(x) ((x) << S_TF_DACK_MSS)
+
+#define S_TF_CCTRL_SEL0    35
+#define V_TF_CCTRL_SEL0(x) ((x) << S_TF_CCTRL_SEL0)
+
+#define S_TF_CCTRL_SEL1    36
+#define V_TF_CCTRL_SEL1(x) ((x) << S_TF_CCTRL_SEL1)
+
+#define S_TF_TCP_NEWRENO_FAST_RECOVERY    37
+#define V_TF_TCP_NEWRENO_FAST_RECOVERY(x) ((x) << S_TF_TCP_NEWRENO_FAST_RECOVERY)
+
+#define S_TF_TX_PACE_AUTO    38
+#define V_TF_TX_PACE_AUTO(x) ((x) << S_TF_TX_PACE_AUTO)
+
+#define S_TF_PEER_FIN_HELD    39
+#define V_TF_PEER_FIN_HELD(x) ((x) << S_TF_PEER_FIN_HELD)
+
+#define S_TF_CORE_URG    40
+#define V_TF_CORE_URG(x) ((x) << S_TF_CORE_URG)
+
+#define S_TF_RDMA_ERROR    41
+#define V_TF_RDMA_ERROR(x) ((x) << S_TF_RDMA_ERROR)
+
+#define S_TF_SSWS_DISABLED    42
+#define V_TF_SSWS_DISABLED(x) ((x) << S_TF_SSWS_DISABLED)
+
+#define S_TF_DUPACK_COUNT_ODD    43
+#define V_TF_DUPACK_COUNT_ODD(x) ((x) << S_TF_DUPACK_COUNT_ODD)
+
+#define S_TF_TX_CHANNEL    44
+#define V_TF_TX_CHANNEL(x) ((x) << S_TF_TX_CHANNEL)
+
+#define S_TF_RX_CHANNEL    45
+#define V_TF_RX_CHANNEL(x) ((x) << S_TF_RX_CHANNEL)
+
+#define S_TF_TX_PACE_FIXED    46
+#define V_TF_TX_PACE_FIXED(x) ((x) << S_TF_TX_PACE_FIXED)
+
+#define S_TF_RDMA_FLM_ERROR    47
+#define V_TF_RDMA_FLM_ERROR(x) ((x) << S_TF_RDMA_FLM_ERROR)
+
+#define S_TF_RX_FLOW_CONTROL_DISABLE    48
+#define V_TF_RX_FLOW_CONTROL_DISABLE(x) ((x) << S_TF_RX_FLOW_CONTROL_DISABLE)
+
+#endif /* _TCB_DEFS_H */
diff --git a/drivers/infiniband/hw/ehca/ehca_eq.c b/drivers/infiniband/hw/ehca/ehca_eq.c
index 5281dec66f12..24ceab0bae4a 100644
--- a/drivers/infiniband/hw/ehca/ehca_eq.c
+++ b/drivers/infiniband/hw/ehca/ehca_eq.c
@@ -122,7 +122,7 @@ int ehca_create_eq(struct ehca_shca *shca,
         /* register interrupt handlers and initialize work queues */
         if (type == EHCA_EQ) {
                 ret = ibmebus_request_irq(NULL, eq->ist, ehca_interrupt_eq,
-                                          SA_INTERRUPT, "ehca_eq",
+                                          IRQF_DISABLED, "ehca_eq",
                                           (void *)shca);
                 if (ret < 0)
                         ehca_err(ib_dev, "Can't map interrupt handler.");
@@ -130,7 +130,7 @@ int ehca_create_eq(struct ehca_shca *shca,
                 tasklet_init(&eq->interrupt_task, ehca_tasklet_eq, (long)shca);
         } else if (type == EHCA_NEQ) {
                 ret = ibmebus_request_irq(NULL, eq->ist, ehca_interrupt_neq,
-                                          SA_INTERRUPT, "ehca_neq",
+                                          IRQF_DISABLED, "ehca_neq",
                                           (void *)shca);
                 if (ret < 0)
                         ehca_err(ib_dev, "Can't map interrupt handler.");
diff --git a/drivers/infiniband/hw/ehca/ehca_irq.c b/drivers/infiniband/hw/ehca/ehca_irq.c
index c069be8cbcb2..6c4f9f91b15d 100644
--- a/drivers/infiniband/hw/ehca/ehca_irq.c
+++ b/drivers/infiniband/hw/ehca/ehca_irq.c
@@ -756,6 +756,8 @@ void ehca_destroy_comp_pool(void)
                 if (cpu_online(i))
                         destroy_comp_task(pool, i);
         }
+        free_percpu(pool->cpu_comp_tasks);
+        kfree(pool);
 #endif
 
         return;
diff --git a/drivers/infiniband/hw/mthca/mthca_cmd.c b/drivers/infiniband/hw/mthca/mthca_cmd.c
index 968d1519761c..71314460b11e 100644
--- a/drivers/infiniband/hw/mthca/mthca_cmd.c
+++ b/drivers/infiniband/hw/mthca/mthca_cmd.c
@@ -1051,7 +1051,11 @@ int mthca_QUERY_DEV_LIM(struct mthca_dev *dev,
         MTHCA_GET(field, outbox, QUERY_DEV_LIM_MAX_EQ_OFFSET);
         dev_lim->max_eqs = 1 << (field & 0x7);
         MTHCA_GET(field, outbox, QUERY_DEV_LIM_RSVD_MTT_OFFSET);
-        dev_lim->reserved_mtts = 1 << (field >> 4);
+        if (mthca_is_memfree(dev))
+                dev_lim->reserved_mtts = ALIGN((1 << (field >> 4)) * sizeof(u64),
+                                               MTHCA_MTT_SEG_SIZE) / MTHCA_MTT_SEG_SIZE;
+        else
+                dev_lim->reserved_mtts = 1 << (field >> 4);
         MTHCA_GET(field, outbox, QUERY_DEV_LIM_MAX_MRW_SZ_OFFSET);
         dev_lim->max_mrw_sz = 1 << field;
         MTHCA_GET(field, outbox, QUERY_DEV_LIM_RSVD_MRW_OFFSET);
diff --git a/drivers/infiniband/hw/mthca/mthca_dev.h b/drivers/infiniband/hw/mthca/mthca_dev.h
index fe5cecf70fed..b7e42efaf43d 100644
--- a/drivers/infiniband/hw/mthca/mthca_dev.h
+++ b/drivers/infiniband/hw/mthca/mthca_dev.h
@@ -464,6 +464,8 @@ void mthca_uar_free(struct mthca_dev *dev, struct mthca_uar *uar);
 int mthca_pd_alloc(struct mthca_dev *dev, int privileged, struct mthca_pd *pd);
 void mthca_pd_free(struct mthca_dev *dev, struct mthca_pd *pd);
 
+int mthca_write_mtt_size(struct mthca_dev *dev);
+
 struct mthca_mtt *mthca_alloc_mtt(struct mthca_dev *dev, int size);
 void mthca_free_mtt(struct mthca_dev *dev, struct mthca_mtt *mtt);
 int mthca_write_mtt(struct mthca_dev *dev, struct mthca_mtt *mtt,
diff --git a/drivers/infiniband/hw/mthca/mthca_main.c b/drivers/infiniband/hw/mthca/mthca_main.c
index 44bc6cc734ab..0d9b7d06bbc2 100644
--- a/drivers/infiniband/hw/mthca/mthca_main.c
+++ b/drivers/infiniband/hw/mthca/mthca_main.c
@@ -379,7 +379,7 @@ static int mthca_load_fw(struct mthca_dev *mdev)
 
         mdev->fw.arbel.fw_icm =
                 mthca_alloc_icm(mdev, mdev->fw.arbel.fw_pages,
-                                GFP_HIGHUSER | __GFP_NOWARN);
+                                GFP_HIGHUSER | __GFP_NOWARN, 0);
         if (!mdev->fw.arbel.fw_icm) {
                 mthca_err(mdev, "Couldn't allocate FW area, aborting.\n");
                 return -ENOMEM;
@@ -412,7 +412,7 @@ err_unmap_fa:
         mthca_UNMAP_FA(mdev, &status);
 
 err_free:
-        mthca_free_icm(mdev, mdev->fw.arbel.fw_icm);
+        mthca_free_icm(mdev, mdev->fw.arbel.fw_icm, 0);
         return err;
 }
 
@@ -441,7 +441,7 @@ static int mthca_init_icm(struct mthca_dev *mdev,
                   (unsigned long long) aux_pages << 2);
 
         mdev->fw.arbel.aux_icm = mthca_alloc_icm(mdev, aux_pages,
-                                                 GFP_HIGHUSER | __GFP_NOWARN);
+                                                 GFP_HIGHUSER | __GFP_NOWARN, 0);
         if (!mdev->fw.arbel.aux_icm) {
                 mthca_err(mdev, "Couldn't allocate aux memory, aborting.\n");
                 return -ENOMEM;
@@ -464,10 +464,15 @@ static int mthca_init_icm(struct mthca_dev *mdev,
                 goto err_unmap_aux;
         }
 
+        /* CPU writes to non-reserved MTTs, while HCA might DMA to reserved mtts */
+        mdev->limits.reserved_mtts = ALIGN(mdev->limits.reserved_mtts * MTHCA_MTT_SEG_SIZE,
+                                           dma_get_cache_alignment()) / MTHCA_MTT_SEG_SIZE;
+
         mdev->mr_table.mtt_table = mthca_alloc_icm_table(mdev, init_hca->mtt_base,
                                                          MTHCA_MTT_SEG_SIZE,
                                                          mdev->limits.num_mtt_segs,
-                                                         mdev->limits.reserved_mtts, 1);
+                                                         mdev->limits.reserved_mtts,
+                                                         1, 0);
         if (!mdev->mr_table.mtt_table) {
                 mthca_err(mdev, "Failed to map MTT context memory, aborting.\n");
                 err = -ENOMEM;
@@ -477,7 +482,8 @@ static int mthca_init_icm(struct mthca_dev *mdev,
         mdev->mr_table.mpt_table = mthca_alloc_icm_table(mdev, init_hca->mpt_base,
                                                          dev_lim->mpt_entry_sz,
                                                          mdev->limits.num_mpts,
-                                                         mdev->limits.reserved_mrws, 1);
+                                                         mdev->limits.reserved_mrws,
+                                                         1, 1);
         if (!mdev->mr_table.mpt_table) {
                 mthca_err(mdev, "Failed to map MPT context memory, aborting.\n");
                 err = -ENOMEM;
@@ -487,7 +493,8 @@ static int mthca_init_icm(struct mthca_dev *mdev,
         mdev->qp_table.qp_table = mthca_alloc_icm_table(mdev, init_hca->qpc_base,
                                                         dev_lim->qpc_entry_sz,
                                                         mdev->limits.num_qps,
-                                                        mdev->limits.reserved_qps, 0);
+                                                        mdev->limits.reserved_qps,
+                                                        0, 0);
         if (!mdev->qp_table.qp_table) {
                 mthca_err(mdev, "Failed to map QP context memory, aborting.\n");
                 err = -ENOMEM;
@@ -497,7 +504,8 @@ static int mthca_init_icm(struct mthca_dev *mdev,
         mdev->qp_table.eqp_table = mthca_alloc_icm_table(mdev, init_hca->eqpc_base,
                                                          dev_lim->eqpc_entry_sz,
                                                          mdev->limits.num_qps,
-                                                         mdev->limits.reserved_qps, 0);
+                                                         mdev->limits.reserved_qps,
+                                                         0, 0);
         if (!mdev->qp_table.eqp_table) {
                 mthca_err(mdev, "Failed to map EQP context memory, aborting.\n");
                 err = -ENOMEM;
@@ -507,7 +515,7 @@ static int mthca_init_icm(struct mthca_dev *mdev,
         mdev->qp_table.rdb_table = mthca_alloc_icm_table(mdev, init_hca->rdb_base,
                                                          MTHCA_RDB_ENTRY_SIZE,
                                                          mdev->limits.num_qps <<
-                                                         mdev->qp_table.rdb_shift,
+                                                         mdev->qp_table.rdb_shift, 0,
                                                          0, 0);
         if (!mdev->qp_table.rdb_table) {
                 mthca_err(mdev, "Failed to map RDB context memory, aborting\n");
@@ -518,7 +526,8 @@ static int mthca_init_icm(struct mthca_dev *mdev,
        mdev->cq_table.table = mthca_alloc_icm_table(mdev, init_hca->cqc_base,
                                                     dev_lim->cqc_entry_sz,
                                                     mdev->limits.num_cqs,
-                                                    mdev->limits.reserved_cqs, 0);
+                                                    mdev->limits.reserved_cqs,
+                                                    0, 0);
         if (!mdev->cq_table.table) {
                 mthca_err(mdev, "Failed to map CQ context memory, aborting.\n");
                 err = -ENOMEM;
@@ -530,7 +539,8 @@ static int mthca_init_icm(struct mthca_dev *mdev,
                         mthca_alloc_icm_table(mdev, init_hca->srqc_base,
                                               dev_lim->srq_entry_sz,
                                               mdev->limits.num_srqs,
-                                              mdev->limits.reserved_srqs, 0);
+                                              mdev->limits.reserved_srqs,
+                                              0, 0);
                 if (!mdev->srq_table.table) {
                         mthca_err(mdev, "Failed to map SRQ context memory, "
                                   "aborting.\n");
@@ -550,7 +560,7 @@ static int mthca_init_icm(struct mthca_dev *mdev,
                                                       mdev->limits.num_amgms,
                                                       mdev->limits.num_mgms +
                                                       mdev->limits.num_amgms,
-                                                      0);
+                                                      0, 0);
         if (!mdev->mcg_table.table) {
                 mthca_err(mdev, "Failed to map MCG context memory, aborting.\n");
                 err = -ENOMEM;
@@ -588,7 +598,7 @@ err_unmap_aux:
         mthca_UNMAP_ICM_AUX(mdev, &status);
 
 err_free_aux:
-        mthca_free_icm(mdev, mdev->fw.arbel.aux_icm);
+        mthca_free_icm(mdev, mdev->fw.arbel.aux_icm, 0);
 
         return err;
 }
@@ -609,7 +619,7 @@ static void mthca_free_icms(struct mthca_dev *mdev)
         mthca_unmap_eq_icm(mdev);
 
         mthca_UNMAP_ICM_AUX(mdev, &status);
-        mthca_free_icm(mdev, mdev->fw.arbel.aux_icm);
+        mthca_free_icm(mdev, mdev->fw.arbel.aux_icm, 0);
 }
 
 static int mthca_init_arbel(struct mthca_dev *mdev)
@@ -693,7 +703,7 @@ err_free_icm:
 
 err_stop_fw:
         mthca_UNMAP_FA(mdev, &status);
-        mthca_free_icm(mdev, mdev->fw.arbel.fw_icm);
+        mthca_free_icm(mdev, mdev->fw.arbel.fw_icm, 0);
 
 err_disable:
         if (!(mdev->mthca_flags & MTHCA_FLAG_NO_LAM))
@@ -712,7 +722,7 @@ static void mthca_close_hca(struct mthca_dev *mdev)
                 mthca_free_icms(mdev);
 
                 mthca_UNMAP_FA(mdev, &status);
-                mthca_free_icm(mdev, mdev->fw.arbel.fw_icm);
+                mthca_free_icm(mdev, mdev->fw.arbel.fw_icm, 0);
 
                 if (!(mdev->mthca_flags & MTHCA_FLAG_NO_LAM))
                         mthca_DISABLE_LAM(mdev, &status);
diff --git a/drivers/infiniband/hw/mthca/mthca_memfree.c b/drivers/infiniband/hw/mthca/mthca_memfree.c
index 6b19645d946c..0b9d053a599d 100644
--- a/drivers/infiniband/hw/mthca/mthca_memfree.c
+++ b/drivers/infiniband/hw/mthca/mthca_memfree.c
@@ -35,6 +35,9 @@
  */
 
 #include <linux/mm.h>
+#include <linux/scatterlist.h>
+
+#include <asm/page.h>
 
 #include "mthca_memfree.h"
 #include "mthca_dev.h"
@@ -58,22 +61,42 @@ struct mthca_user_db_table {
         }                page[0];
 };
 
-void mthca_free_icm(struct mthca_dev *dev, struct mthca_icm *icm)
+static void mthca_free_icm_pages(struct mthca_dev *dev, struct mthca_icm_chunk *chunk)
+{
+        int i;
+
+        if (chunk->nsg > 0)
+                pci_unmap_sg(dev->pdev, chunk->mem, chunk->npages,
+                             PCI_DMA_BIDIRECTIONAL);
+
+        for (i = 0; i < chunk->npages; ++i)
+                __free_pages(chunk->mem[i].page,
+                             get_order(chunk->mem[i].length));
+}
+
+static void mthca_free_icm_coherent(struct mthca_dev *dev, struct mthca_icm_chunk *chunk)
 {
-        struct mthca_icm_chunk *chunk, *tmp;
         int i;
 
+        for (i = 0; i < chunk->npages; ++i) {
+                dma_free_coherent(&dev->pdev->dev, chunk->mem[i].length,
+                                  lowmem_page_address(chunk->mem[i].page),
+                                  sg_dma_address(&chunk->mem[i]));
+        }
+}
+
+void mthca_free_icm(struct mthca_dev *dev, struct mthca_icm *icm, int coherent)
+{
+        struct mthca_icm_chunk *chunk, *tmp;
+
         if (!icm)
                 return;
 
         list_for_each_entry_safe(chunk, tmp, &icm->chunk_list, list) {
-                if (chunk->nsg > 0)
-                        pci_unmap_sg(dev->pdev, chunk->mem, chunk->npages,
-                                     PCI_DMA_BIDIRECTIONAL);
-
-                for (i = 0; i < chunk->npages; ++i)
-                        __free_pages(chunk->mem[i].page,
-                                     get_order(chunk->mem[i].length));
+                if (coherent)
+                        mthca_free_icm_coherent(dev, chunk);
+                else
+                        mthca_free_icm_pages(dev, chunk);
 
                 kfree(chunk);
         }
@@ -81,12 +104,41 @@ void mthca_free_icm(struct mthca_dev *dev, struct mthca_icm *icm)
         kfree(icm);
 }
 
+static int mthca_alloc_icm_pages(struct scatterlist *mem, int order, gfp_t gfp_mask)
+{
+        mem->page = alloc_pages(gfp_mask, order);
+        if (!mem->page)
+                return -ENOMEM;
+
+        mem->length = PAGE_SIZE << order;
+        mem->offset = 0;
+        return 0;
+}
+
+static int mthca_alloc_icm_coherent(struct device *dev, struct scatterlist *mem,
+                                    int order, gfp_t gfp_mask)
+{
+        void *buf = dma_alloc_coherent(dev, PAGE_SIZE << order, &sg_dma_address(mem),
+                                       gfp_mask);
+        if (!buf)
+                return -ENOMEM;
+
+        sg_set_buf(mem, buf, PAGE_SIZE << order);
+        BUG_ON(mem->offset);
+        sg_dma_len(mem) = PAGE_SIZE << order;
+        return 0;
+}
+
 struct mthca_icm *mthca_alloc_icm(struct mthca_dev *dev, int npages,
-                                  gfp_t gfp_mask)
+                                  gfp_t gfp_mask, int coherent)
 {
         struct mthca_icm *icm;
         struct mthca_icm_chunk *chunk = NULL;
         int cur_order;
+        int ret;
+
+        /* We use sg_set_buf for coherent allocs, which assumes low memory */
+        BUG_ON(coherent && (gfp_mask & __GFP_HIGHMEM));
 
         icm = kmalloc(sizeof *icm, gfp_mask & ~(__GFP_HIGHMEM | __GFP_NOWARN));
         if (!icm)
@@ -112,21 +164,28 @@ struct mthca_icm *mthca_alloc_icm(struct mthca_dev *dev, int npages,
                 while (1 << cur_order > npages)
                         --cur_order;
 
-                chunk->mem[chunk->npages].page = alloc_pages(gfp_mask, cur_order);
-                if (chunk->mem[chunk->npages].page) {
-                        chunk->mem[chunk->npages].length = PAGE_SIZE << cur_order;
-                        chunk->mem[chunk->npages].offset = 0;
+                if (coherent)
+                        ret = mthca_alloc_icm_coherent(&dev->pdev->dev,
+                                                       &chunk->mem[chunk->npages],
+                                                       cur_order, gfp_mask);
+                else
+                        ret = mthca_alloc_icm_pages(&chunk->mem[chunk->npages],
+                                                    cur_order, gfp_mask);
 
-                        if (++chunk->npages == MTHCA_ICM_CHUNK_LEN) {
+                if (!ret) {
+                        ++chunk->npages;
+
+                        if (!coherent && chunk->npages == MTHCA_ICM_CHUNK_LEN) {
                                 chunk->nsg = pci_map_sg(dev->pdev, chunk->mem,
                                                         chunk->npages,
                                                         PCI_DMA_BIDIRECTIONAL);
 
                                 if (chunk->nsg <= 0)
                                         goto fail;
+                        }
 
+                        if (chunk->npages == MTHCA_ICM_CHUNK_LEN)
                                 chunk = NULL;
-                        }
 
                         npages -= 1 << cur_order;
                 } else {
@@ -136,7 +195,7 @@ struct mthca_icm *mthca_alloc_icm(struct mthca_dev *dev, int npages,
                 }
         }
 
-        if (chunk) {
+        if (!coherent && chunk) {
                 chunk->nsg = pci_map_sg(dev->pdev, chunk->mem,
                                         chunk->npages,
                                         PCI_DMA_BIDIRECTIONAL);
@@ -148,7 +207,7 @@ struct mthca_icm *mthca_alloc_icm(struct mthca_dev *dev, int npages,
         return icm;
 
 fail:
-        mthca_free_icm(dev, icm);
+        mthca_free_icm(dev, icm, coherent);
         return NULL;
 }
 
@@ -167,7 +226,7 @@ int mthca_table_get(struct mthca_dev *dev, struct mthca_icm_table *table, int ob
 
         table->icm[i] = mthca_alloc_icm(dev, MTHCA_TABLE_CHUNK_SIZE >> PAGE_SHIFT,
                                         (table->lowmem ? GFP_KERNEL : GFP_HIGHUSER) |
-                                        __GFP_NOWARN);
+                                        __GFP_NOWARN, table->coherent);
         if (!table->icm[i]) {
                 ret = -ENOMEM;
                 goto out;
@@ -175,7 +234,7 @@ int mthca_table_get(struct mthca_dev *dev, struct mthca_icm_table *table, int ob
 
         if (mthca_MAP_ICM(dev, table->icm[i], table->virt + i * MTHCA_TABLE_CHUNK_SIZE,
                           &status) || status) {
-                mthca_free_icm(dev, table->icm[i]);
+                mthca_free_icm(dev, table->icm[i], table->coherent);
                 table->icm[i] = NULL;
                 ret = -ENOMEM;
                 goto out;
@@ -204,16 +263,16 @@ void mthca_table_put(struct mthca_dev *dev, struct mthca_icm_table *table, int o
                 mthca_UNMAP_ICM(dev, table->virt + i * MTHCA_TABLE_CHUNK_SIZE,
                                 MTHCA_TABLE_CHUNK_SIZE / MTHCA_ICM_PAGE_SIZE,
                                 &status);
-                mthca_free_icm(dev, table->icm[i]);
+                mthca_free_icm(dev, table->icm[i], table->coherent);
                 table->icm[i] = NULL;
         }
 
         mutex_unlock(&table->mutex);
 }
 
-void *mthca_table_find(struct mthca_icm_table *table, int obj)
+void *mthca_table_find(struct mthca_icm_table *table, int obj, dma_addr_t *dma_handle)
 {
-        int idx, offset, i;
+        int idx, offset, dma_offset, i;
         struct mthca_icm_chunk *chunk;
         struct mthca_icm *icm;
         struct page *page = NULL;
@@ -225,13 +284,22 @@ void *mthca_table_find(struct mthca_icm_table *table, int obj)
 
         idx = (obj & (table->num_obj - 1)) * table->obj_size;
         icm = table->icm[idx / MTHCA_TABLE_CHUNK_SIZE];
-        offset = idx % MTHCA_TABLE_CHUNK_SIZE;
+        dma_offset = offset = idx % MTHCA_TABLE_CHUNK_SIZE;
 
         if (!icm)
                 goto out;
 
         list_for_each_entry(chunk, &icm->chunk_list, list) {
                 for (i = 0; i < chunk->npages; ++i) {
+                        if (dma_handle && dma_offset >= 0) {
+                                if (sg_dma_len(&chunk->mem[i]) > dma_offset)
+                                        *dma_handle = sg_dma_address(&chunk->mem[i]) +
+                                                dma_offset;
+                                dma_offset -= sg_dma_len(&chunk->mem[i]);
+                        }
+                        /* DMA mapping can merge pages but not split them,
+                         * so if we found the page, dma_handle has already
+                         * been assigned to. */
                         if (chunk->mem[i].length > offset) {
                                 page = chunk->mem[i].page;
                                 goto out;
@@ -283,7 +351,7 @@ void mthca_table_put_range(struct mthca_dev *dev, struct mthca_icm_table *table,
 struct mthca_icm_table *mthca_alloc_icm_table(struct mthca_dev *dev,
                                               u64 virt, int obj_size,
                                               int nobj, int reserved,
-                                              int use_lowmem)
+                                              int use_lowmem, int use_coherent)
 {
         struct mthca_icm_table *table;
         int num_icm;
@@ -302,6 +370,7 @@ struct mthca_icm_table *mthca_alloc_icm_table(struct mthca_dev *dev,
         table->num_obj  = nobj;
         table->obj_size = obj_size;
         table->lowmem   = use_lowmem;
+        table->coherent = use_coherent;
         mutex_init(&table->mutex);
 
         for (i = 0; i < num_icm; ++i)
@@ -314,12 +383,12 @@ struct mthca_icm_table *mthca_alloc_icm_table(struct mthca_dev *dev,
 
                 table->icm[i] = mthca_alloc_icm(dev, chunk_size >> PAGE_SHIFT,
                                                 (use_lowmem ? GFP_KERNEL : GFP_HIGHUSER) |
-                                                __GFP_NOWARN);
+                                                __GFP_NOWARN, use_coherent);
                 if (!table->icm[i])
                         goto err;
                 if (mthca_MAP_ICM(dev, table->icm[i], virt + i * MTHCA_TABLE_CHUNK_SIZE,
                                   &status) || status) {
-                        mthca_free_icm(dev, table->icm[i]);
+                        mthca_free_icm(dev, table->icm[i], table->coherent);
                         table->icm[i] = NULL;
                         goto err;
                 }
@@ -339,7 +408,7 @@ err:
                         mthca_UNMAP_ICM(dev, virt + i * MTHCA_TABLE_CHUNK_SIZE,
                                         MTHCA_TABLE_CHUNK_SIZE / MTHCA_ICM_PAGE_SIZE,
                                         &status);
-                        mthca_free_icm(dev, table->icm[i]);
+                        mthca_free_icm(dev, table->icm[i], table->coherent);
                 }
 
         kfree(table);
@@ -357,7 +426,7 @@ void mthca_free_icm_table(struct mthca_dev *dev, struct mthca_icm_table *table)
                         mthca_UNMAP_ICM(dev, table->virt + i * MTHCA_TABLE_CHUNK_SIZE,
                                         MTHCA_TABLE_CHUNK_SIZE / MTHCA_ICM_PAGE_SIZE,
                                         &status);
-                        mthca_free_icm(dev, table->icm[i]);
+                        mthca_free_icm(dev, table->icm[i], table->coherent);
                 }
 
         kfree(table);
diff --git a/drivers/infiniband/hw/mthca/mthca_memfree.h b/drivers/infiniband/hw/mthca/mthca_memfree.h
index 6d42947e1dc4..594144145f45 100644
--- a/drivers/infiniband/hw/mthca/mthca_memfree.h
+++ b/drivers/infiniband/hw/mthca/mthca_memfree.h
@@ -69,6 +69,7 @@ struct mthca_icm_table {
         int               num_obj;
         int               obj_size;
         int               lowmem;
+        int               coherent;
         struct mutex      mutex;
         struct mthca_icm *icm[0];
 };
@@ -82,17 +83,17 @@ struct mthca_icm_iter {
 struct mthca_dev;
 
 struct mthca_icm *mthca_alloc_icm(struct mthca_dev *dev, int npages,
-                                  gfp_t gfp_mask);
-void mthca_free_icm(struct mthca_dev *dev, struct mthca_icm *icm);
+                                  gfp_t gfp_mask, int coherent);
+void mthca_free_icm(struct mthca_dev *dev, struct mthca_icm *icm, int coherent);
 
 struct mthca_icm_table *mthca_alloc_icm_table(struct mthca_dev *dev,
                                               u64 virt, int obj_size,
                                               int nobj, int reserved,
-                                              int use_lowmem);
+                                              int use_lowmem, int use_coherent);
 void mthca_free_icm_table(struct mthca_dev *dev, struct mthca_icm_table *table);
 int mthca_table_get(struct mthca_dev *dev, struct mthca_icm_table *table, int obj);
 void mthca_table_put(struct mthca_dev *dev, struct mthca_icm_table *table, int obj);
-void *mthca_table_find(struct mthca_icm_table *table, int obj);
+void *mthca_table_find(struct mthca_icm_table *table, int obj, dma_addr_t *dma_handle);
 int mthca_table_get_range(struct mthca_dev *dev, struct mthca_icm_table *table,
                           int start, int end);
 void mthca_table_put_range(struct mthca_dev *dev, struct mthca_icm_table *table,
diff --git a/drivers/infiniband/hw/mthca/mthca_mr.c b/drivers/infiniband/hw/mthca/mthca_mr.c
index f71ffa88db3a..6037dd3f87df 100644
--- a/drivers/infiniband/hw/mthca/mthca_mr.c
+++ b/drivers/infiniband/hw/mthca/mthca_mr.c
@@ -243,8 +243,8 @@ void mthca_free_mtt(struct mthca_dev *dev, struct mthca_mtt *mtt)
         kfree(mtt);
 }
 
-int mthca_write_mtt(struct mthca_dev *dev, struct mthca_mtt *mtt,
-                    int start_index, u64 *buffer_list, int list_len)
+static int __mthca_write_mtt(struct mthca_dev *dev, struct mthca_mtt *mtt,
+                             int start_index, u64 *buffer_list, int list_len)
 {
         struct mthca_mailbox *mailbox;
         __be64 *mtt_entry;
@@ -295,6 +295,84 @@ out:
         return err;
 }
 
+int mthca_write_mtt_size(struct mthca_dev *dev)
+{
+        if (dev->mr_table.fmr_mtt_buddy != &dev->mr_table.mtt_buddy)
+                /*
+                 * Be friendly to WRITE_MTT command
+                 * and leave two empty slots for the
+                 * index and reserved fields of the
+                 * mailbox.
+                 */
+                return PAGE_SIZE / sizeof (u64) - 2;
+
+        /* For Arbel, all MTTs must fit in the same page. */
+        return mthca_is_memfree(dev) ? (PAGE_SIZE / sizeof (u64)) : 0x7ffffff;
+}
+
+void mthca_tavor_write_mtt_seg(struct mthca_dev *dev, struct mthca_mtt *mtt,
+                              int start_index, u64 *buffer_list, int list_len)
+{
+        u64 __iomem *mtts;
+        int i;
+
+        mtts = dev->mr_table.tavor_fmr.mtt_base + mtt->first_seg * MTHCA_MTT_SEG_SIZE +
+                start_index * sizeof (u64);
+        for (i = 0; i < list_len; ++i)
+                mthca_write64_raw(cpu_to_be64(buffer_list[i] | MTHCA_MTT_FLAG_PRESENT),
+                                  mtts + i);
+}
+
+void mthca_arbel_write_mtt_seg(struct mthca_dev *dev, struct mthca_mtt *mtt,
+                              int start_index, u64 *buffer_list, int list_len)
+{
+        __be64 *mtts;
+        dma_addr_t dma_handle;
+        int i;
+        int s = start_index * sizeof (u64);
+
+        /* For Arbel, all MTTs must fit in the same page. */
+        BUG_ON(s / PAGE_SIZE != (s + list_len * sizeof(u64) - 1) / PAGE_SIZE);
+        /* Require full segments */
+        BUG_ON(s % MTHCA_MTT_SEG_SIZE);
+
+        mtts = mthca_table_find(dev->mr_table.mtt_table, mtt->first_seg +
+                                s / MTHCA_MTT_SEG_SIZE, &dma_handle);
+
+        BUG_ON(!mtts);
+
+        for (i = 0; i < list_len; ++i)
+                mtts[i] = cpu_to_be64(buffer_list[i] | MTHCA_MTT_FLAG_PRESENT);
+
+        dma_sync_single(&dev->pdev->dev, dma_handle, list_len * sizeof (u64), DMA_TO_DEVICE);
+}
+
+int mthca_write_mtt(struct mthca_dev *dev, struct mthca_mtt *mtt,
+                    int start_index, u64 *buffer_list, int list_len)
+{
+        int size = mthca_write_mtt_size(dev);
+        int chunk;
+
+        if (dev->mr_table.fmr_mtt_buddy != &dev->mr_table.mtt_buddy)
+                return __mthca_write_mtt(dev, mtt, start_index, buffer_list, list_len);
+
+        while (list_len > 0) {
+                chunk = min(size, list_len);
+                if (mthca_is_memfree(dev))
+                        mthca_arbel_write_mtt_seg(dev, mtt, start_index,
+                                                  buffer_list, chunk);
+                else
+                        mthca_tavor_write_mtt_seg(dev, mtt, start_index,
+                                                  buffer_list, chunk);
+
+                list_len    -= chunk;
+                start_index += chunk;
+                buffer_list += chunk;
+        }
+
+        return 0;
+}
+
 static inline u32 tavor_hw_index_to_key(u32 ind)
 {
         return ind;
@@ -524,7 +602,7 @@ int mthca_fmr_alloc(struct mthca_dev *dev, u32 pd,
                 if (err)
                         goto err_out_mpt_free;
 
-                mr->mem.arbel.mpt = mthca_table_find(dev->mr_table.mpt_table, key);
+                mr->mem.arbel.mpt = mthca_table_find(dev->mr_table.mpt_table, key, NULL);
                 BUG_ON(!mr->mem.arbel.mpt);
         } else
                 mr->mem.tavor.mpt = dev->mr_table.tavor_fmr.mpt_base +
@@ -538,7 +616,8 @@ int mthca_fmr_alloc(struct mthca_dev *dev, u32 pd,
 
         if (mthca_is_memfree(dev)) {
                 mr->mem.arbel.mtts = mthca_table_find(dev->mr_table.mtt_table,
-                                                      mr->mtt->first_seg);
+                                                      mr->mtt->first_seg,
+                                                      &mr->mem.arbel.dma_handle);
                 BUG_ON(!mr->mem.arbel.mtts);
         } else
                 mr->mem.tavor.mtts = dev->mr_table.tavor_fmr.mtt_base + mtt_seg;
@@ -712,6 +791,9 @@ int mthca_arbel_map_phys_fmr(struct ib_fmr *ibfmr, u64 *page_list,
                 fmr->mem.arbel.mtts[i] = cpu_to_be64(page_list[i] |
                                                      MTHCA_MTT_FLAG_PRESENT);
 
+        dma_sync_single(&dev->pdev->dev, fmr->mem.arbel.dma_handle,
+                        list_len * sizeof(u64), DMA_TO_DEVICE);
+
         fmr->mem.arbel.mpt->key    = cpu_to_be32(key);
         fmr->mem.arbel.mpt->lkey   = cpu_to_be32(key);
         fmr->mem.arbel.mpt->length = cpu_to_be64(list_len * (1ull << fmr->attr.page_shift));
@@ -761,7 +843,7 @@ void mthca_arbel_fmr_unmap(struct mthca_dev *dev, struct mthca_fmr *fmr)
 int mthca_init_mr_table(struct mthca_dev *dev)
 {
         unsigned long addr;
-        int err, i;
+        int mpts, mtts, err, i;
 
         err = mthca_alloc_init(&dev->mr_table.mpt_alloc,
                                dev->limits.num_mpts,
@@ -795,13 +877,21 @@ int mthca_init_mr_table(struct mthca_dev *dev)
                         err = -EINVAL;
                         goto err_fmr_mpt;
                 }
+                mpts = mtts = 1 << i;
+        } else {
+                mpts = dev->limits.num_mtt_segs;
+                mtts = dev->limits.num_mpts;
+        }
+
+        if (!mthca_is_memfree(dev) &&
+            (dev->mthca_flags & MTHCA_FLAG_FMR)) {
 
                 addr = pci_resource_start(dev->pdev, 4) +
                         ((pci_resource_len(dev->pdev, 4) - 1) &
                          dev->mr_table.mpt_base);
 
                 dev->mr_table.tavor_fmr.mpt_base =
-                        ioremap(addr, (1 << i) * sizeof(struct mthca_mpt_entry));
+                        ioremap(addr, mpts * sizeof(struct mthca_mpt_entry));
 
                 if (!dev->mr_table.tavor_fmr.mpt_base) {
                         mthca_warn(dev, "MPT ioremap for FMR failed.\n");
@@ -814,19 +904,21 @@ int mthca_init_mr_table(struct mthca_dev *dev)
                          dev->mr_table.mtt_base);
 
                 dev->mr_table.tavor_fmr.mtt_base =
-                        ioremap(addr, (1 << i) * MTHCA_MTT_SEG_SIZE);
+                        ioremap(addr, mtts * MTHCA_MTT_SEG_SIZE);
                 if (!dev->mr_table.tavor_fmr.mtt_base) {
                         mthca_warn(dev, "MTT ioremap for FMR failed.\n");
                         err = -ENOMEM;
                         goto err_fmr_mtt;
                 }
+        }
 
-                err = mthca_buddy_init(&dev->mr_table.tavor_fmr.mtt_buddy, i);
+        if (dev->limits.fmr_reserved_mtts) {
+                err = mthca_buddy_init(&dev->mr_table.tavor_fmr.mtt_buddy, fls(mtts - 1));
                 if (err)
                         goto err_fmr_mtt_buddy;
 
                 /* Prevent regular MRs from using FMR keys */
-                err = mthca_buddy_alloc(&dev->mr_table.mtt_buddy, i);
+                err = mthca_buddy_alloc(&dev->mr_table.mtt_buddy, fls(mtts - 1));
                 if (err)
                         goto err_reserve_fmr;
 
diff --git a/drivers/infiniband/hw/mthca/mthca_profile.c b/drivers/infiniband/hw/mthca/mthca_profile.c
index 58d44aa3c302..26bf86d1cfcd 100644
--- a/drivers/infiniband/hw/mthca/mthca_profile.c
+++ b/drivers/infiniband/hw/mthca/mthca_profile.c
@@ -277,7 +277,7 @@ u64 mthca_make_profile(struct mthca_dev *dev,
          * out of the MR pool. They don't use additional memory, but
          * we assign them as part of the HCA profile anyway.
          */
-        if (mthca_is_memfree(dev))
+        if (mthca_is_memfree(dev) || BITS_PER_LONG == 64)
                 dev->limits.fmr_reserved_mtts = 0;
         else
                 dev->limits.fmr_reserved_mtts = request->fmr_reserved_mtts;
diff --git a/drivers/infiniband/hw/mthca/mthca_provider.c b/drivers/infiniband/hw/mthca/mthca_provider.c
index 7b96751695ea..0725ad7ad9bf 100644
--- a/drivers/infiniband/hw/mthca/mthca_provider.c
+++ b/drivers/infiniband/hw/mthca/mthca_provider.c
@@ -1015,6 +1015,7 @@ static struct ib_mr *mthca_reg_user_mr(struct ib_pd *pd, struct ib_umem *region,
         int shift, n, len;
         int i, j, k;
         int err = 0;
+        int write_mtt_size;
 
         shift = ffs(region->page_size) - 1;
 
@@ -1040,6 +1041,8 @@ static struct ib_mr *mthca_reg_user_mr(struct ib_pd *pd, struct ib_umem *region,
 
         i = n = 0;
 
+        write_mtt_size = min(mthca_write_mtt_size(dev), (int) (PAGE_SIZE / sizeof *pages));
+
         list_for_each_entry(chunk, &region->chunk_list, list)
                 for (j = 0; j < chunk->nmap; ++j) {
                         len = sg_dma_len(&chunk->page_list[j]) >> shift;
@@ -1047,14 +1050,11 @@ static struct ib_mr *mthca_reg_user_mr(struct ib_pd *pd, struct ib_umem *region,
                                 pages[i++] = sg_dma_address(&chunk->page_list[j]) +
                                         region->page_size * k;
                                 /*
-                                 * Be friendly to WRITE_MTT command
-                                 * and leave two empty slots for the
-                                 * index and reserved fields of the
-                                 * mailbox.
+                                 * Be friendly to write_mtt and pass it chunks
+                                 * of appropriate size.
                                  */
-                                if (i == PAGE_SIZE / sizeof (u64) - 2) {
-                                        err = mthca_write_mtt(dev, mr->mtt,
-                                                              n, pages, i);
+                                if (i == write_mtt_size) {
+                                        err = mthca_write_mtt(dev, mr->mtt, n, pages, i);
                                         if (err)
                                                 goto mtt_done;
                                         n += i;
diff --git a/drivers/infiniband/hw/mthca/mthca_provider.h b/drivers/infiniband/hw/mthca/mthca_provider.h
index 9a5bece3fa5c..1d266ac2e094 100644
--- a/drivers/infiniband/hw/mthca/mthca_provider.h
+++ b/drivers/infiniband/hw/mthca/mthca_provider.h
@@ -89,6 +89,7 @@ struct mthca_fmr {
                 struct {
                         struct mthca_mpt_entry *mpt;
                         __be64 *mtts;
+                        dma_addr_t dma_handle;
                 } arbel;
         } mem;
 };
diff --git a/drivers/infiniband/hw/mthca/mthca_qp.c b/drivers/infiniband/hw/mthca/mthca_qp.c
index 5f5214c0337d..224c93dd29eb 100644
--- a/drivers/infiniband/hw/mthca/mthca_qp.c
+++ b/drivers/infiniband/hw/mthca/mthca_qp.c
@@ -399,7 +399,7 @@ static int to_ib_qp_access_flags(int mthca_flags)
 static void to_ib_ah_attr(struct mthca_dev *dev, struct ib_ah_attr *ib_ah_attr,
                                 struct mthca_qp_path *path)
 {
-        memset(ib_ah_attr, 0, sizeof *path);
+        memset(ib_ah_attr, 0, sizeof *ib_ah_attr);
         ib_ah_attr->port_num      = (be32_to_cpu(path->port_pkey) >> 24) & 0x3;
 
         if (ib_ah_attr->port_num == 0 || ib_ah_attr->port_num > dev->limits.num_ports)
diff --git a/drivers/infiniband/hw/mthca/mthca_srq.c b/drivers/infiniband/hw/mthca/mthca_srq.c
index 10684da33d58..61974b0296ca 100644
--- a/drivers/infiniband/hw/mthca/mthca_srq.c
+++ b/drivers/infiniband/hw/mthca/mthca_srq.c
@@ -116,11 +116,16 @@ static void mthca_arbel_init_srq_context(struct mthca_dev *dev,
                                          struct mthca_srq *srq,
                                          struct mthca_arbel_srq_context *context)
 {
-        int logsize;
+        int logsize, max;
 
         memset(context, 0, sizeof *context);
 
-        logsize = ilog2(srq->max);
+        /*
+         * Put max in a temporary variable to work around gcc bug
+         * triggered by ilog2() on sparc64.
+         */
+        max = srq->max;
+        logsize = ilog2(max);
         context->state_logsize_srqn = cpu_to_be32(logsize << 24 | srq->srqn);
         context->lkey = cpu_to_be32(srq->mr.ibmr.lkey);
         context->db_index = cpu_to_be32(srq->db_index);
diff --git a/drivers/infiniband/ulp/ipoib/Kconfig b/drivers/infiniband/ulp/ipoib/Kconfig
index c75322d820d4..af78ccc4ce71 100644
--- a/drivers/infiniband/ulp/ipoib/Kconfig
+++ b/drivers/infiniband/ulp/ipoib/Kconfig
@@ -1,6 +1,6 @@
 config INFINIBAND_IPOIB
         tristate "IP-over-InfiniBand"
-        depends on INFINIBAND && NETDEVICES && INET
+        depends on INFINIBAND && NETDEVICES && INET && (IPV6 || IPV6=n)
         ---help---
           Support for the IP-over-InfiniBand protocol (IPoIB). This
           transports IP packets over InfiniBand so you can use your IB
@@ -8,6 +8,20 @@ config INFINIBAND_IPOIB
 
           See Documentation/infiniband/ipoib.txt for more information
 
+config INFINIBAND_IPOIB_CM
+        bool "IP-over-InfiniBand Connected Mode support"
+        depends on INFINIBAND_IPOIB && EXPERIMENTAL
+        default n
+        ---help---
+          This option enables experimental support for IPoIB connected mode.
+          After enabling this option, you need to switch to connected mode through
+          /sys/class/net/ibXXX/mode to actually create connections, and then increase
+          the interface MTU with e.g. ifconfig ib0 mtu 65520.
+
+          WARNING: Enabling connected mode will trigger some
+          packet drops for multicast and UD mode traffic from this interface,
+          unless you limit mtu for these destinations to 2044.
+
 config INFINIBAND_IPOIB_DEBUG
         bool "IP-over-InfiniBand debugging" if EMBEDDED
         depends on INFINIBAND_IPOIB
diff --git a/drivers/infiniband/ulp/ipoib/Makefile b/drivers/infiniband/ulp/ipoib/Makefile
index 8935e74ae3f8..98ee38e8c2c4 100644
--- a/drivers/infiniband/ulp/ipoib/Makefile
+++ b/drivers/infiniband/ulp/ipoib/Makefile
@@ -5,5 +5,6 @@ ib_ipoib-y					:= ipoib_main.o \
                                                    ipoib_multicast.o \
                                                    ipoib_verbs.o \
                                                    ipoib_vlan.o
+ib_ipoib-$(CONFIG_INFINIBAND_IPOIB_CM)          += ipoib_cm.o
 ib_ipoib-$(CONFIG_INFINIBAND_IPOIB_DEBUG)       += ipoib_fs.o
 
diff --git a/drivers/infiniband/ulp/ipoib/ipoib.h b/drivers/infiniband/ulp/ipoib/ipoib.h
index 07deee8f81ce..2594db2030b3 100644
--- a/drivers/infiniband/ulp/ipoib/ipoib.h
+++ b/drivers/infiniband/ulp/ipoib/ipoib.h
@@ -62,6 +62,10 @@ enum {
 
         IPOIB_ENCAP_LEN           = 4,
 
+        IPOIB_CM_MTU              = 0x10000 - 0x10, /* padding to align header to 16 */
+        IPOIB_CM_BUF_SIZE         = IPOIB_CM_MTU  + IPOIB_ENCAP_LEN,
+        IPOIB_CM_HEAD_SIZE        = IPOIB_CM_BUF_SIZE % PAGE_SIZE,
+        IPOIB_CM_RX_SG            = ALIGN(IPOIB_CM_BUF_SIZE, PAGE_SIZE) / PAGE_SIZE,
         IPOIB_RX_RING_SIZE        = 128,
         IPOIB_TX_RING_SIZE        = 64,
         IPOIB_MAX_QUEUE_SIZE      = 8192,
@@ -81,6 +85,8 @@ enum {
         IPOIB_MCAST_RUN           = 6,
         IPOIB_STOP_REAPER         = 7,
         IPOIB_MCAST_STARTED       = 8,
+        IPOIB_FLAG_NETIF_STOPPED  = 9,
+        IPOIB_FLAG_ADMIN_CM       = 10,
 
         IPOIB_MAX_BACKOFF_SECONDS = 16,
 
@@ -90,6 +96,13 @@ enum {
         IPOIB_MCAST_FLAG_ATTACHED = 3,
 };
 
+#define IPOIB_OP_RECV   (1ul << 31)
+#ifdef CONFIG_INFINIBAND_IPOIB_CM
+#define IPOIB_CM_OP_SRQ (1ul << 30)
+#else
+#define IPOIB_CM_OP_SRQ (0)
+#endif
+
 /* structs */
 
 struct ipoib_header {
@@ -113,6 +126,59 @@ struct ipoib_tx_buf {
         u64             mapping;
 };
 
+struct ib_cm_id;
+
+struct ipoib_cm_data {
+        __be32 qpn; /* High byte MUST be ignored on receive */
+        __be32 mtu;
+};
+
+struct ipoib_cm_rx {
+        struct ib_cm_id     *id;
+        struct ib_qp        *qp;
+        struct list_head     list;
+        struct net_device   *dev;
+        unsigned long        jiffies;
+};
+
+struct ipoib_cm_tx {
+        struct ib_cm_id     *id;
+        struct ib_cq        *cq;
+        struct ib_qp        *qp;
+        struct list_head     list;
+        struct net_device   *dev;
+        struct ipoib_neigh  *neigh;
+        struct ipoib_path   *path;
+        struct ipoib_tx_buf *tx_ring;
+        unsigned             tx_head;
+        unsigned             tx_tail;
+        unsigned long        flags;
+        u32                  mtu;
+        struct ib_wc         ibwc[IPOIB_NUM_WC];
+};
+
+struct ipoib_cm_rx_buf {
+        struct sk_buff *skb;
+        u64 mapping[IPOIB_CM_RX_SG];
+};
+
+struct ipoib_cm_dev_priv {
+        struct ib_srq          *srq;
+        struct ipoib_cm_rx_buf *srq_ring;
+        struct ib_cm_id        *id;
+        struct list_head        passive_ids;
+        struct work_struct      start_task;
+        struct work_struct      reap_task;
+        struct work_struct      skb_task;
+        struct delayed_work     stale_task;
+        struct sk_buff_head     skb_queue;
+        struct list_head        start_list;
+        struct list_head        reap_list;
+        struct ib_wc            ibwc[IPOIB_NUM_WC];
+        struct ib_sge           rx_sge[IPOIB_CM_RX_SG];
+        struct ib_recv_wr       rx_wr;
+};
+
 /*
  * Device private locking: tx_lock protects members used in TX fast
  * path (and we use LLTX so upper layers don't do extra locking).
@@ -179,6 +245,10 @@ struct ipoib_dev_priv {
         struct list_head child_intfs;
         struct list_head list;
 
+#ifdef CONFIG_INFINIBAND_IPOIB_CM
+        struct ipoib_cm_dev_priv cm;
+#endif
+
 #ifdef CONFIG_INFINIBAND_IPOIB_DEBUG
         struct list_head fs_list;
         struct dentry *mcg_dentry;
@@ -212,6 +282,9 @@ struct ipoib_path {
 
 struct ipoib_neigh {
         struct ipoib_ah    *ah;
+#ifdef CONFIG_INFINIBAND_IPOIB_CM
+        struct ipoib_cm_tx *cm;
+#endif
         union ib_gid        dgid;
         struct sk_buff_head queue;
 
@@ -315,6 +388,146 @@ int ipoib_vlan_delete(struct net_device *pdev, unsigned short pkey);
 void ipoib_pkey_poll(struct work_struct *work);
 int ipoib_pkey_dev_delay_open(struct net_device *dev);
 
+#ifdef CONFIG_INFINIBAND_IPOIB_CM
+
+#define IPOIB_FLAGS_RC          0x80
+#define IPOIB_FLAGS_UC          0x40
+
+/* We don't support UC connections at the moment */
+#define IPOIB_CM_SUPPORTED(ha)   (ha[0] & (IPOIB_FLAGS_RC))
+
+static inline int ipoib_cm_admin_enabled(struct net_device *dev)
+{
+        struct ipoib_dev_priv *priv = netdev_priv(dev);
+        return IPOIB_CM_SUPPORTED(dev->dev_addr) &&
+                test_bit(IPOIB_FLAG_ADMIN_CM, &priv->flags);
+}
+
+static inline int ipoib_cm_enabled(struct net_device *dev, struct neighbour *n)
+{
+        struct ipoib_dev_priv *priv = netdev_priv(dev);
+        return IPOIB_CM_SUPPORTED(n->ha) &&
+                test_bit(IPOIB_FLAG_ADMIN_CM, &priv->flags);
+}
+
+static inline int ipoib_cm_up(struct ipoib_neigh *neigh)
+
+{
+        return test_bit(IPOIB_FLAG_OPER_UP, &neigh->cm->flags);
+}
+
+static inline struct ipoib_cm_tx *ipoib_cm_get(struct ipoib_neigh *neigh)
+{
+        return neigh->cm;
+}
+
+static inline void ipoib_cm_set(struct ipoib_neigh *neigh, struct ipoib_cm_tx *tx)
+{
+        neigh->cm = tx;
+}
+
+void ipoib_cm_send(struct net_device *dev, struct sk_buff *skb, struct ipoib_cm_tx *tx);
+int ipoib_cm_dev_open(struct net_device *dev);
+void ipoib_cm_dev_stop(struct net_device *dev);
+int ipoib_cm_dev_init(struct net_device *dev);
+int ipoib_cm_add_mode_attr(struct net_device *dev);
+void ipoib_cm_dev_cleanup(struct net_device *dev);
+struct ipoib_cm_tx *ipoib_cm_create_tx(struct net_device *dev, struct ipoib_path *path,
+                                    struct ipoib_neigh *neigh);
+void ipoib_cm_destroy_tx(struct ipoib_cm_tx *tx);
+void ipoib_cm_skb_too_long(struct net_device* dev, struct sk_buff *skb,
+                           unsigned int mtu);
+void ipoib_cm_handle_rx_wc(struct net_device *dev, struct ib_wc *wc);
+#else
+
+struct ipoib_cm_tx;
+
+static inline int ipoib_cm_admin_enabled(struct net_device *dev)
+{
+        return 0;
+}
+static inline int ipoib_cm_enabled(struct net_device *dev, struct neighbour *n)
+
+{
+        return 0;
+}
+
+static inline int ipoib_cm_up(struct ipoib_neigh *neigh)
+
+{
+        return 0;
+}
+
+static inline struct ipoib_cm_tx *ipoib_cm_get(struct ipoib_neigh *neigh)
+{
+        return NULL;
+}
+
+static inline void ipoib_cm_set(struct ipoib_neigh *neigh, struct ipoib_cm_tx *tx)
+{
+}
+
+static inline
+void ipoib_cm_send(struct net_device *dev, struct sk_buff *skb, struct ipoib_cm_tx *tx)
+{
+        return;
+}
+
+static inline
+int ipoib_cm_dev_open(struct net_device *dev)
+{
+        return 0;
+}
+
+static inline
+void ipoib_cm_dev_stop(struct net_device *dev)
+{
+        return;
+}
+
+static inline
+int ipoib_cm_dev_init(struct net_device *dev)
+{
+        return -ENOSYS;
+}
+
+static inline
+void ipoib_cm_dev_cleanup(struct net_device *dev)
+{
+        return;
+}
+
+static inline
+struct ipoib_cm_tx *ipoib_cm_create_tx(struct net_device *dev, struct ipoib_path *path,
+                                    struct ipoib_neigh *neigh)
+{
+        return NULL;
+}
+
+static inline
+void ipoib_cm_destroy_tx(struct ipoib_cm_tx *tx)
+{
+        return;
+}
+
+static inline
+int ipoib_cm_add_mode_attr(struct net_device *dev)
+{
+        return 0;
+}
+
+static inline void ipoib_cm_skb_too_long(struct net_device* dev, struct sk_buff *skb,
+                                         unsigned int mtu)
+{
+        dev_kfree_skb_any(skb);
+}
+
+static inline void ipoib_cm_handle_rx_wc(struct net_device *dev, struct ib_wc *wc)
+{
+}
+
+#endif
+
 #ifdef CONFIG_INFINIBAND_IPOIB_DEBUG
 void ipoib_create_debug_files(struct net_device *dev);
 void ipoib_delete_debug_files(struct net_device *dev);
@@ -392,4 +605,6 @@ extern int ipoib_debug_level;
 
 #define IPOIB_GID_ARG(gid)      IPOIB_GID_RAW_ARG((gid).raw)
 
+#define IPOIB_QPN(ha) (be32_to_cpup((__be32 *) ha) & 0xffffff)
+
 #endif /* _IPOIB_H */
diff --git a/drivers/infiniband/ulp/ipoib/ipoib_cm.c b/drivers/infiniband/ulp/ipoib/ipoib_cm.c
new file mode 100644
index 000000000000..2d483874a589
--- /dev/null
+++ b/drivers/infiniband/ulp/ipoib/ipoib_cm.c
@@ -0,0 +1,1237 @@
+/*
+ * Copyright (c) 2006 Mellanox Technologies. All rights reserved
+ *
+ * This software is available to you under a choice of one of two
+ * licenses.  You may choose to be licensed under the terms of the GNU
+ * General Public License (GPL) Version 2, available from the file
+ * COPYING in the main directory of this source tree, or the
+ * OpenIB.org BSD license below:
+ *
+ *     Redistribution and use in source and binary forms, with or
+ *     without modification, are permitted provided that the following
+ *     conditions are met:
+ *
+ *      - Redistributions of source code must retain the above
+ *        copyright notice, this list of conditions and the following
+ *        disclaimer.
+ *
+ *      - Redistributions in binary form must reproduce the above
+ *        copyright notice, this list of conditions and the following
+ *        disclaimer in the documentation and/or other materials
+ *        provided with the distribution.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+ * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+ * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+ * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
+ * BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
+ * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
+ * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+ * SOFTWARE.
+ *
+ * $Id$
+ */
+
+#include <rdma/ib_cm.h>
+#include <rdma/ib_cache.h>
+#include <net/dst.h>
+#include <net/icmp.h>
+#include <linux/icmpv6.h>
+
+#ifdef CONFIG_INFINIBAND_IPOIB_DEBUG_DATA
+static int data_debug_level;
+
+module_param_named(cm_data_debug_level, data_debug_level, int, 0644);
+MODULE_PARM_DESC(cm_data_debug_level,
+                 "Enable data path debug tracing for connected mode if > 0");
+#endif
+
+#include "ipoib.h"
+
+#define IPOIB_CM_IETF_ID 0x1000000000000000ULL
+
+#define IPOIB_CM_RX_UPDATE_TIME (256 * HZ)
+#define IPOIB_CM_RX_TIMEOUT     (2 * 256 * HZ)
+#define IPOIB_CM_RX_DELAY       (3 * 256 * HZ)
+#define IPOIB_CM_RX_UPDATE_MASK (0x3)
+
+struct ipoib_cm_id {
+        struct ib_cm_id *id;
+        int flags;
+        u32 remote_qpn;
+        u32 remote_mtu;
+};
+
+static int ipoib_cm_tx_handler(struct ib_cm_id *cm_id,
+                               struct ib_cm_event *event);
+
+static void ipoib_cm_dma_unmap_rx(struct ipoib_dev_priv *priv,
+                                  u64 mapping[IPOIB_CM_RX_SG])
+{
+        int i;
+
+        ib_dma_unmap_single(priv->ca, mapping[0], IPOIB_CM_HEAD_SIZE, DMA_FROM_DEVICE);
+
+        for (i = 0; i < IPOIB_CM_RX_SG - 1; ++i)
+                ib_dma_unmap_single(priv->ca, mapping[i + 1], PAGE_SIZE, DMA_FROM_DEVICE);
+}
+
+static int ipoib_cm_post_receive(struct net_device *dev, int id)
+{
+        struct ipoib_dev_priv *priv = netdev_priv(dev);
+        struct ib_recv_wr *bad_wr;
+        int i, ret;
+
+        priv->cm.rx_wr.wr_id = id | IPOIB_CM_OP_SRQ;
+
+        for (i = 0; i < IPOIB_CM_RX_SG; ++i)
+                priv->cm.rx_sge[i].addr = priv->cm.srq_ring[id].mapping[i];
+
+        ret = ib_post_srq_recv(priv->cm.srq, &priv->cm.rx_wr, &bad_wr);
+        if (unlikely(ret)) {
+                ipoib_warn(priv, "post srq failed for buf %d (%d)\n", id, ret);
+                ipoib_cm_dma_unmap_rx(priv, priv->cm.srq_ring[id].mapping);
+                dev_kfree_skb_any(priv->cm.srq_ring[id].skb);
+                priv->cm.srq_ring[id].skb = NULL;
+        }
+
+        return ret;
+}
+
+static int ipoib_cm_alloc_rx_skb(struct net_device *dev, int id,
+                                 u64 mapping[IPOIB_CM_RX_SG])
+{
+        struct ipoib_dev_priv *priv = netdev_priv(dev);
+        struct sk_buff *skb;
+        int i;
+
+        skb = dev_alloc_skb(IPOIB_CM_HEAD_SIZE + 12);
+        if (unlikely(!skb))
+                return -ENOMEM;
+
+        /*
+         * IPoIB adds a 4 byte header. So we need 12 more bytes to align the
+         * IP header to a multiple of 16.
+         */
+        skb_reserve(skb, 12);
+
+        mapping[0] = ib_dma_map_single(priv->ca, skb->data, IPOIB_CM_HEAD_SIZE,
+                                       DMA_FROM_DEVICE);
+        if (unlikely(ib_dma_mapping_error(priv->ca, mapping[0]))) {
+                dev_kfree_skb_any(skb);
+                return -EIO;
+        }
+
+        for (i = 0; i < IPOIB_CM_RX_SG - 1; i++) {
+                struct page *page = alloc_page(GFP_ATOMIC);
+
+                if (!page)
+                        goto partial_error;
+                skb_fill_page_desc(skb, i, page, 0, PAGE_SIZE);
+
+                mapping[i + 1] = ib_dma_map_page(priv->ca, skb_shinfo(skb)->frags[i].page,
+                                                 0, PAGE_SIZE, DMA_TO_DEVICE);
+                if (unlikely(ib_dma_mapping_error(priv->ca, mapping[i + 1])))
+                        goto partial_error;
+        }
+
+        priv->cm.srq_ring[id].skb = skb;
+        return 0;
+
+partial_error:
+
+        ib_dma_unmap_single(priv->ca, mapping[0], IPOIB_CM_HEAD_SIZE, DMA_FROM_DEVICE);
+
+        for (; i >= 0; --i)
+                ib_dma_unmap_single(priv->ca, mapping[i + 1], PAGE_SIZE, DMA_FROM_DEVICE);
+
+        kfree_skb(skb);
+        return -ENOMEM;
+}
+
+static struct ib_qp *ipoib_cm_create_rx_qp(struct net_device *dev,
+                                           struct ipoib_cm_rx *p)
+{
+        struct ipoib_dev_priv *priv = netdev_priv(dev);
+        struct ib_qp_init_attr attr = {
+                .send_cq = priv->cq, /* does not matter, we never send anything */
+                .recv_cq = priv->cq,
+                .srq = priv->cm.srq,
+                .cap.max_send_wr = 1, /* FIXME: 0 Seems not to work */
+                .cap.max_send_sge = 1, /* FIXME: 0 Seems not to work */
+                .sq_sig_type = IB_SIGNAL_ALL_WR,
+                .qp_type = IB_QPT_RC,
+                .qp_context = p,
+        };
+        return ib_create_qp(priv->pd, &attr);
+}
+
+static int ipoib_cm_modify_rx_qp(struct net_device *dev,
+                                  struct ib_cm_id *cm_id, struct ib_qp *qp,
+                                  unsigned psn)
+{
+        struct ipoib_dev_priv *priv = netdev_priv(dev);
+        struct ib_qp_attr qp_attr;
+        int qp_attr_mask, ret;
+
+        qp_attr.qp_state = IB_QPS_INIT;
+        ret = ib_cm_init_qp_attr(cm_id, &qp_attr, &qp_attr_mask);
+        if (ret) {
+                ipoib_warn(priv, "failed to init QP attr for INIT: %d\n", ret);
+                return ret;
+        }
+        ret = ib_modify_qp(qp, &qp_attr, qp_attr_mask);
+        if (ret) {
+                ipoib_warn(priv, "failed to modify QP to INIT: %d\n", ret);
+                return ret;
+        }
+        qp_attr.qp_state = IB_QPS_RTR;
+        ret = ib_cm_init_qp_attr(cm_id, &qp_attr, &qp_attr_mask);
+        if (ret) {
+                ipoib_warn(priv, "failed to init QP attr for RTR: %d\n", ret);
+                return ret;
+        }
+        qp_attr.rq_psn = psn;
+        ret = ib_modify_qp(qp, &qp_attr, qp_attr_mask);
+        if (ret) {
+                ipoib_warn(priv, "failed to modify QP to RTR: %d\n", ret);
+                return ret;
+        }
+        return 0;
+}
+
+static int ipoib_cm_send_rep(struct net_device *dev, struct ib_cm_id *cm_id,
+                             struct ib_qp *qp, struct ib_cm_req_event_param *req,
+                             unsigned psn)
+{
+        struct ipoib_dev_priv *priv = netdev_priv(dev);
+        struct ipoib_cm_data data = {};
+        struct ib_cm_rep_param rep = {};
+
+        data.qpn = cpu_to_be32(priv->qp->qp_num);
+        data.mtu = cpu_to_be32(IPOIB_CM_BUF_SIZE);
+
+        rep.private_data = &data;
+        rep.private_data_len = sizeof data;
+        rep.flow_control = 0;
+        rep.rnr_retry_count = req->rnr_retry_count;
+        rep.target_ack_delay = 20; /* FIXME */
+        rep.srq = 1;
+        rep.qp_num = qp->qp_num;
+        rep.starting_psn = psn;
+        return ib_send_cm_rep(cm_id, &rep);
+}
+
+static int ipoib_cm_req_handler(struct ib_cm_id *cm_id, struct ib_cm_event *event)
+{
+        struct net_device *dev = cm_id->context;
+        struct ipoib_dev_priv *priv = netdev_priv(dev);
+        struct ipoib_cm_rx *p;
+        unsigned long flags;
+        unsigned psn;
+        int ret;
+
+        ipoib_dbg(priv, "REQ arrived\n");
+        p = kzalloc(sizeof *p, GFP_KERNEL);
+        if (!p)
+                return -ENOMEM;
+        p->dev = dev;
+        p->id = cm_id;
+        p->qp = ipoib_cm_create_rx_qp(dev, p);
+        if (IS_ERR(p->qp)) {
+                ret = PTR_ERR(p->qp);
+                goto err_qp;
+        }
+
+        psn = random32() & 0xffffff;
+        ret = ipoib_cm_modify_rx_qp(dev, cm_id, p->qp, psn);
+        if (ret)
+                goto err_modify;
+
+        ret = ipoib_cm_send_rep(dev, cm_id, p->qp, &event->param.req_rcvd, psn);
+        if (ret) {
+                ipoib_warn(priv, "failed to send REP: %d\n", ret);
+                goto err_rep;
+        }
+
+        cm_id->context = p;
+        p->jiffies = jiffies;
+        spin_lock_irqsave(&priv->lock, flags);
+        list_add(&p->list, &priv->cm.passive_ids);
+        spin_unlock_irqrestore(&priv->lock, flags);
+        queue_delayed_work(ipoib_workqueue,
+                           &priv->cm.stale_task, IPOIB_CM_RX_DELAY);
+        return 0;
+
+err_rep:
+err_modify:
+        ib_destroy_qp(p->qp);
+err_qp:
+        kfree(p);
+        return ret;
+}
+
+static int ipoib_cm_rx_handler(struct ib_cm_id *cm_id,
+                               struct ib_cm_event *event)
+{
+        struct ipoib_cm_rx *p;
+        struct ipoib_dev_priv *priv;
+        unsigned long flags;
+        int ret;
+
+        switch (event->event) {
+        case IB_CM_REQ_RECEIVED:
+                return ipoib_cm_req_handler(cm_id, event);
+        case IB_CM_DREQ_RECEIVED:
+                p = cm_id->context;
+                ib_send_cm_drep(cm_id, NULL, 0);
+                /* Fall through */
+        case IB_CM_REJ_RECEIVED:
+                p = cm_id->context;
+                priv = netdev_priv(p->dev);
+                spin_lock_irqsave(&priv->lock, flags);
+                if (list_empty(&p->list))
+                        ret = 0; /* Connection is going away already. */
+                else {
+                        list_del_init(&p->list);
+                        ret = -ECONNRESET;
+                }
+                spin_unlock_irqrestore(&priv->lock, flags);
+                if (ret) {
+                        ib_destroy_qp(p->qp);
+                        kfree(p);
+                        return ret;
+                }
+                return 0;
+        default:
+                return 0;
+        }
+}
+/* Adjust length of skb with fragments to match received data */
+static void skb_put_frags(struct sk_buff *skb, unsigned int hdr_space,
+                          unsigned int length)
+{
+        int i, num_frags;
+        unsigned int size;
+
+        /* put header into skb */
+        size = min(length, hdr_space);
+        skb->tail += size;
+        skb->len += size;
+        length -= size;
+
+        num_frags = skb_shinfo(skb)->nr_frags;
+        for (i = 0; i < num_frags; i++) {
+                skb_frag_t *frag = &skb_shinfo(skb)->frags[i];
+
+                if (length == 0) {
+                        /* don't need this page */
+                        __free_page(frag->page);
+                        --skb_shinfo(skb)->nr_frags;
+                } else {
+                        size = min(length, (unsigned) PAGE_SIZE);
+
+                        frag->size = size;
+                        skb->data_len += size;
+                        skb->truesize += size;
+                        skb->len += size;
+                        length -= size;
+                }
+        }
+}
+
+void ipoib_cm_handle_rx_wc(struct net_device *dev, struct ib_wc *wc)
+{
+        struct ipoib_dev_priv *priv = netdev_priv(dev);
+        unsigned int wr_id = wc->wr_id & ~IPOIB_CM_OP_SRQ;
+        struct sk_buff *skb;
+        struct ipoib_cm_rx *p;
+        unsigned long flags;
+        u64 mapping[IPOIB_CM_RX_SG];
+
+        ipoib_dbg_data(priv, "cm recv completion: id %d, op %d, status: %d\n",
+                       wr_id, wc->opcode, wc->status);
+
+        if (unlikely(wr_id >= ipoib_recvq_size)) {
+                ipoib_warn(priv, "cm recv completion event with wrid %d (> %d)\n",
+                           wr_id, ipoib_recvq_size);
+                return;
+        }
+
+        skb  = priv->cm.srq_ring[wr_id].skb;
+
+        if (unlikely(wc->status != IB_WC_SUCCESS)) {
+                ipoib_dbg(priv, "cm recv error "
+                           "(status=%d, wrid=%d vend_err %x)\n",
+                           wc->status, wr_id, wc->vendor_err);
+                ++priv->stats.rx_dropped;
+                goto repost;
+        }
+
+        if (!likely(wr_id & IPOIB_CM_RX_UPDATE_MASK)) {
+                p = wc->qp->qp_context;
+                if (time_after_eq(jiffies, p->jiffies + IPOIB_CM_RX_UPDATE_TIME)) {
+                        spin_lock_irqsave(&priv->lock, flags);
+                        p->jiffies = jiffies;
+                        /* Move this entry to list head, but do
+                         * not re-add it if it has been removed. */
+                        if (!list_empty(&p->list))
+                                list_move(&p->list, &priv->cm.passive_ids);
+                        spin_unlock_irqrestore(&priv->lock, flags);
+                        queue_delayed_work(ipoib_workqueue,
+                                           &priv->cm.stale_task, IPOIB_CM_RX_DELAY);
+                }
+        }
+
+        if (unlikely(ipoib_cm_alloc_rx_skb(dev, wr_id, mapping))) {
+                /*
+                 * If we can't allocate a new RX buffer, dump
+                 * this packet and reuse the old buffer.
+                 */
+                ipoib_dbg(priv, "failed to allocate receive buffer %d\n", wr_id);
+                ++priv->stats.rx_dropped;
+                goto repost;
+        }
+
+        ipoib_cm_dma_unmap_rx(priv, priv->cm.srq_ring[wr_id].mapping);
+        memcpy(priv->cm.srq_ring[wr_id].mapping, mapping, sizeof mapping);
+
+        ipoib_dbg_data(priv, "received %d bytes, SLID 0x%04x\n",
+                       wc->byte_len, wc->slid);
+
+        skb_put_frags(skb, IPOIB_CM_HEAD_SIZE, wc->byte_len);
+
+        skb->protocol = ((struct ipoib_header *) skb->data)->proto;
+        skb->mac.raw = skb->data;
+        skb_pull(skb, IPOIB_ENCAP_LEN);
+
+        dev->last_rx = jiffies;
+        ++priv->stats.rx_packets;
+        priv->stats.rx_bytes += skb->len;
+
+        skb->dev = dev;
+        /* XXX get correct PACKET_ type here */
+        skb->pkt_type = PACKET_HOST;
+        netif_rx_ni(skb);
+
+repost:
+        if (unlikely(ipoib_cm_post_receive(dev, wr_id)))
+                ipoib_warn(priv, "ipoib_cm_post_receive failed "
+                           "for buf %d\n", wr_id);
+}
+
+static inline int post_send(struct ipoib_dev_priv *priv,
+                            struct ipoib_cm_tx *tx,
+                            unsigned int wr_id,
+                            u64 addr, int len)
+{
+        struct ib_send_wr *bad_wr;
+
+        priv->tx_sge.addr             = addr;
+        priv->tx_sge.length           = len;
+
+        priv->tx_wr.wr_id             = wr_id;
+
+        return ib_post_send(tx->qp, &priv->tx_wr, &bad_wr);
+}
+
+void ipoib_cm_send(struct net_device *dev, struct sk_buff *skb, struct ipoib_cm_tx *tx)
+{
+        struct ipoib_dev_priv *priv = netdev_priv(dev);
+        struct ipoib_tx_buf *tx_req;
+        u64 addr;
+
+        if (unlikely(skb->len > tx->mtu)) {
+                ipoib_warn(priv, "packet len %d (> %d) too long to send, dropping\n",
+                           skb->len, tx->mtu);
+                ++priv->stats.tx_dropped;
+                ++priv->stats.tx_errors;
+                ipoib_cm_skb_too_long(dev, skb, tx->mtu - INFINIBAND_ALEN);
+                return;
+        }
+
+        ipoib_dbg_data(priv, "sending packet: head 0x%x length %d connection 0x%x\n",
+                       tx->tx_head, skb->len, tx->qp->qp_num);
+
+        /*
+         * We put the skb into the tx_ring _before_ we call post_send()
+         * because it's entirely possible that the completion handler will
+         * run before we execute anything after the post_send().  That
+         * means we have to make sure everything is properly recorded and
+         * our state is consistent before we call post_send().
+         */
+        tx_req = &tx->tx_ring[tx->tx_head & (ipoib_sendq_size - 1)];
+        tx_req->skb = skb;
+        addr = ib_dma_map_single(priv->ca, skb->data, skb->len, DMA_TO_DEVICE);
+        if (unlikely(ib_dma_mapping_error(priv->ca, addr))) {
+                ++priv->stats.tx_errors;
+                dev_kfree_skb_any(skb);
+                return;
+        }
+
+        tx_req->mapping = addr;
+
+        if (unlikely(post_send(priv, tx, tx->tx_head & (ipoib_sendq_size - 1),
+                                addr, skb->len))) {
+                ipoib_warn(priv, "post_send failed\n");
+                ++priv->stats.tx_errors;
+                ib_dma_unmap_single(priv->ca, addr, skb->len, DMA_TO_DEVICE);
+                dev_kfree_skb_any(skb);
+        } else {
+                dev->trans_start = jiffies;
+                ++tx->tx_head;
+
+                if (tx->tx_head - tx->tx_tail == ipoib_sendq_size) {
+                        ipoib_dbg(priv, "TX ring 0x%x full, stopping kernel net queue\n",
+                                  tx->qp->qp_num);
+                        netif_stop_queue(dev);
+                        set_bit(IPOIB_FLAG_NETIF_STOPPED, &tx->flags);
+                }
+        }
+}
+
+static void ipoib_cm_handle_tx_wc(struct net_device *dev, struct ipoib_cm_tx *tx,
+                                  struct ib_wc *wc)
+{
+        struct ipoib_dev_priv *priv = netdev_priv(dev);
+        unsigned int wr_id = wc->wr_id;
+        struct ipoib_tx_buf *tx_req;
+        unsigned long flags;
+
+        ipoib_dbg_data(priv, "cm send completion: id %d, op %d, status: %d\n",
+                       wr_id, wc->opcode, wc->status);
+
+        if (unlikely(wr_id >= ipoib_sendq_size)) {
+                ipoib_warn(priv, "cm send completion event with wrid %d (> %d)\n",
+                           wr_id, ipoib_sendq_size);
+                return;
+        }
+
+        tx_req = &tx->tx_ring[wr_id];
+
+        ib_dma_unmap_single(priv->ca, tx_req->mapping, tx_req->skb->len, DMA_TO_DEVICE);
+
+        /* FIXME: is this right? Shouldn't we only increment on success? */
+        ++priv->stats.tx_packets;
+        priv->stats.tx_bytes += tx_req->skb->len;
+
+        dev_kfree_skb_any(tx_req->skb);
+
+        spin_lock_irqsave(&priv->tx_lock, flags);
+        ++tx->tx_tail;
+        if (unlikely(test_bit(IPOIB_FLAG_NETIF_STOPPED, &tx->flags)) &&
+            tx->tx_head - tx->tx_tail <= ipoib_sendq_size >> 1) {
+                clear_bit(IPOIB_FLAG_NETIF_STOPPED, &tx->flags);
+                netif_wake_queue(dev);
+        }
+
+        if (wc->status != IB_WC_SUCCESS &&
+            wc->status != IB_WC_WR_FLUSH_ERR) {
+                struct ipoib_neigh *neigh;
+
+                ipoib_dbg(priv, "failed cm send event "
+                           "(status=%d, wrid=%d vend_err %x)\n",
+                           wc->status, wr_id, wc->vendor_err);
+
+                spin_lock(&priv->lock);
+                neigh = tx->neigh;
+
+                if (neigh) {
+                        neigh->cm = NULL;
+                        list_del(&neigh->list);
+                        if (neigh->ah)
+                                ipoib_put_ah(neigh->ah);
+                        ipoib_neigh_free(dev, neigh);
+
+                        tx->neigh = NULL;
+                }
+
+                /* queue would be re-started anyway when TX is destroyed,
+                 * but it makes sense to do it ASAP here. */
+                if (test_and_clear_bit(IPOIB_FLAG_NETIF_STOPPED, &tx->flags))
+                        netif_wake_queue(dev);
+
+                if (test_and_clear_bit(IPOIB_FLAG_INITIALIZED, &tx->flags)) {
+                        list_move(&tx->list, &priv->cm.reap_list);
+                        queue_work(ipoib_workqueue, &priv->cm.reap_task);
+                }
+
+                clear_bit(IPOIB_FLAG_OPER_UP, &tx->flags);
+
+                spin_unlock(&priv->lock);
+        }
+
+        spin_unlock_irqrestore(&priv->tx_lock, flags);
+}
+
+static void ipoib_cm_tx_completion(struct ib_cq *cq, void *tx_ptr)
+{
+        struct ipoib_cm_tx *tx = tx_ptr;
+        int n, i;
+
+        ib_req_notify_cq(cq, IB_CQ_NEXT_COMP);
+        do {
+                n = ib_poll_cq(cq, IPOIB_NUM_WC, tx->ibwc);
+                for (i = 0; i < n; ++i)
+                        ipoib_cm_handle_tx_wc(tx->dev, tx, tx->ibwc + i);
+        } while (n == IPOIB_NUM_WC);
+}
+
+int ipoib_cm_dev_open(struct net_device *dev)
+{
+        struct ipoib_dev_priv *priv = netdev_priv(dev);
+        int ret;
+
+        if (!IPOIB_CM_SUPPORTED(dev->dev_addr))
+                return 0;
+
+        priv->cm.id = ib_create_cm_id(priv->ca, ipoib_cm_rx_handler, dev);
+        if (IS_ERR(priv->cm.id)) {
+                printk(KERN_WARNING "%s: failed to create CM ID\n", priv->ca->name);
+                return IS_ERR(priv->cm.id);
+        }
+
+        ret = ib_cm_listen(priv->cm.id, cpu_to_be64(IPOIB_CM_IETF_ID | priv->qp->qp_num),
+                           0, NULL);
+        if (ret) {
+                printk(KERN_WARNING "%s: failed to listen on ID 0x%llx\n", priv->ca->name,
+                       IPOIB_CM_IETF_ID | priv->qp->qp_num);
+                ib_destroy_cm_id(priv->cm.id);
+                return ret;
+        }
+        return 0;
+}
+
+void ipoib_cm_dev_stop(struct net_device *dev)
+{
+        struct ipoib_dev_priv *priv = netdev_priv(dev);
+        struct ipoib_cm_rx *p;
+        unsigned long flags;
+
+        if (!IPOIB_CM_SUPPORTED(dev->dev_addr))
+                return;
+
+        ib_destroy_cm_id(priv->cm.id);
+        spin_lock_irqsave(&priv->lock, flags);
+        while (!list_empty(&priv->cm.passive_ids)) {
+                p = list_entry(priv->cm.passive_ids.next, typeof(*p), list);
+                list_del_init(&p->list);
+                spin_unlock_irqrestore(&priv->lock, flags);
+                ib_destroy_cm_id(p->id);
+                ib_destroy_qp(p->qp);
+                kfree(p);
+                spin_lock_irqsave(&priv->lock, flags);
+        }
+        spin_unlock_irqrestore(&priv->lock, flags);
+
+        cancel_delayed_work(&priv->cm.stale_task);
+}
+
+static int ipoib_cm_rep_handler(struct ib_cm_id *cm_id, struct ib_cm_event *event)
+{
+        struct ipoib_cm_tx *p = cm_id->context;
+        struct ipoib_dev_priv *priv = netdev_priv(p->dev);
+        struct ipoib_cm_data *data = event->private_data;
+        struct sk_buff_head skqueue;
+        struct ib_qp_attr qp_attr;
+        int qp_attr_mask, ret;
+        struct sk_buff *skb;
+        unsigned long flags;
+
+        p->mtu = be32_to_cpu(data->mtu);
+
+        if (p->mtu < priv->dev->mtu + IPOIB_ENCAP_LEN) {
+                ipoib_warn(priv, "Rejecting connection: mtu %d < device mtu %d + 4\n",
+                           p->mtu, priv->dev->mtu);
+                return -EINVAL;
+        }
+
+        qp_attr.qp_state = IB_QPS_RTR;
+        ret = ib_cm_init_qp_attr(cm_id, &qp_attr, &qp_attr_mask);
+        if (ret) {
+                ipoib_warn(priv, "failed to init QP attr for RTR: %d\n", ret);
+                return ret;
+        }
+
+        qp_attr.rq_psn = 0 /* FIXME */;
+        ret = ib_modify_qp(p->qp, &qp_attr, qp_attr_mask);
+        if (ret) {
+                ipoib_warn(priv, "failed to modify QP to RTR: %d\n", ret);
+                return ret;
+        }
+
+        qp_attr.qp_state = IB_QPS_RTS;
+        ret = ib_cm_init_qp_attr(cm_id, &qp_attr, &qp_attr_mask);
+        if (ret) {
+                ipoib_warn(priv, "failed to init QP attr for RTS: %d\n", ret);
+                return ret;
+        }
+        ret = ib_modify_qp(p->qp, &qp_attr, qp_attr_mask);
+        if (ret) {
+                ipoib_warn(priv, "failed to modify QP to RTS: %d\n", ret);
+                return ret;
+        }
+
+        skb_queue_head_init(&skqueue);
+
+        spin_lock_irqsave(&priv->lock, flags);
+        set_bit(IPOIB_FLAG_OPER_UP, &p->flags);
+        if (p->neigh)
+                while ((skb = __skb_dequeue(&p->neigh->queue)))
+                        __skb_queue_tail(&skqueue, skb);
+        spin_unlock_irqrestore(&priv->lock, flags);
+
+        while ((skb = __skb_dequeue(&skqueue))) {
+                skb->dev = p->dev;
+                if (dev_queue_xmit(skb))
+                        ipoib_warn(priv, "dev_queue_xmit failed "
+                                   "to requeue packet\n");
+        }
+
+        ret = ib_send_cm_rtu(cm_id, NULL, 0);
+        if (ret) {
+                ipoib_warn(priv, "failed to send RTU: %d\n", ret);
+                return ret;
+        }
+        return 0;
+}
+
+static struct ib_qp *ipoib_cm_create_tx_qp(struct net_device *dev, struct ib_cq *cq)
+{
+        struct ipoib_dev_priv *priv = netdev_priv(dev);
+        struct ib_qp_init_attr attr = {};
+        attr.recv_cq = priv->cq;
+        attr.srq = priv->cm.srq;
+        attr.cap.max_send_wr = ipoib_sendq_size;
+        attr.cap.max_send_sge = 1;
+        attr.sq_sig_type = IB_SIGNAL_ALL_WR;
+        attr.qp_type = IB_QPT_RC;
+        attr.send_cq = cq;
+        return ib_create_qp(priv->pd, &attr);
+}
+
+static int ipoib_cm_send_req(struct net_device *dev,
+                             struct ib_cm_id *id, struct ib_qp *qp,
+                             u32 qpn,
+                             struct ib_sa_path_rec *pathrec)
+{
+        struct ipoib_dev_priv *priv = netdev_priv(dev);
+        struct ipoib_cm_data data = {};
+        struct ib_cm_req_param req = {};
+
+        data.qpn = cpu_to_be32(priv->qp->qp_num);
+        data.mtu = cpu_to_be32(IPOIB_CM_BUF_SIZE);
+
+        req.primary_path              = pathrec;
+        req.alternate_path            = NULL;
+        req.service_id                = cpu_to_be64(IPOIB_CM_IETF_ID | qpn);
+        req.qp_num                    = qp->qp_num;
+        req.qp_type                   = qp->qp_type;
+        req.private_data              = &data;
+        req.private_data_len          = sizeof data;
+        req.flow_control              = 0;
+
+        req.starting_psn              = 0; /* FIXME */
+
+        /*
+         * Pick some arbitrary defaults here; we could make these
+         * module parameters if anyone cared about setting them.
+         */
+        req.responder_resources       = 4;
+        req.remote_cm_response_timeout = 20;
+        req.local_cm_response_timeout  = 20;
+        req.retry_count               = 0; /* RFC draft warns against retries */
+        req.rnr_retry_count           = 0; /* RFC draft warns against retries */
+        req.max_cm_retries            = 15;
+        req.srq                       = 1;
+        return ib_send_cm_req(id, &req);
+}
+
+static int ipoib_cm_modify_tx_init(struct net_device *dev,
+                                  struct ib_cm_id *cm_id, struct ib_qp *qp)
+{
+        struct ipoib_dev_priv *priv = netdev_priv(dev);
+        struct ib_qp_attr qp_attr;
+        int qp_attr_mask, ret;
+        ret = ib_find_cached_pkey(priv->ca, priv->port, priv->pkey, &qp_attr.pkey_index);
+        if (ret) {
+                ipoib_warn(priv, "pkey 0x%x not in cache: %d\n", priv->pkey, ret);
+                return ret;
+        }
+
+        qp_attr.qp_state = IB_QPS_INIT;
+        qp_attr.qp_access_flags = IB_ACCESS_LOCAL_WRITE;
+        qp_attr.port_num = priv->port;
+        qp_attr_mask = IB_QP_STATE | IB_QP_ACCESS_FLAGS | IB_QP_PKEY_INDEX | IB_QP_PORT;
+
+        ret = ib_modify_qp(qp, &qp_attr, qp_attr_mask);
+        if (ret) {
+                ipoib_warn(priv, "failed to modify tx QP to INIT: %d\n", ret);
+                return ret;
+        }
+        return 0;
+}
+
+static int ipoib_cm_tx_init(struct ipoib_cm_tx *p, u32 qpn,
+                            struct ib_sa_path_rec *pathrec)
+{
+        struct ipoib_dev_priv *priv = netdev_priv(p->dev);
+        int ret;
+
+        p->tx_ring = kzalloc(ipoib_sendq_size * sizeof *p->tx_ring,
+                                GFP_KERNEL);
+        if (!p->tx_ring) {
+                ipoib_warn(priv, "failed to allocate tx ring\n");
+                ret = -ENOMEM;
+                goto err_tx;
+        }
+
+        p->cq = ib_create_cq(priv->ca, ipoib_cm_tx_completion, NULL, p,
+                             ipoib_sendq_size + 1);
+        if (IS_ERR(p->cq)) {
+                ret = PTR_ERR(p->cq);
+                ipoib_warn(priv, "failed to allocate tx cq: %d\n", ret);
+                goto err_cq;
+        }
+
+        ret = ib_req_notify_cq(p->cq, IB_CQ_NEXT_COMP);
+        if (ret) {
+                ipoib_warn(priv, "failed to request completion notification: %d\n", ret);
+                goto err_req_notify;
+        }
+
+        p->qp = ipoib_cm_create_tx_qp(p->dev, p->cq);
+        if (IS_ERR(p->qp)) {
+                ret = PTR_ERR(p->qp);
+                ipoib_warn(priv, "failed to allocate tx qp: %d\n", ret);
+                goto err_qp;
+        }
+
+        p->id = ib_create_cm_id(priv->ca, ipoib_cm_tx_handler, p);
+        if (IS_ERR(p->id)) {
+                ret = PTR_ERR(p->id);
+                ipoib_warn(priv, "failed to create tx cm id: %d\n", ret);
+                goto err_id;
+        }
+
+        ret = ipoib_cm_modify_tx_init(p->dev, p->id,  p->qp);
+        if (ret) {
+                ipoib_warn(priv, "failed to modify tx qp to rtr: %d\n", ret);
+                goto err_modify;
+        }
+
+        ret = ipoib_cm_send_req(p->dev, p->id, p->qp, qpn, pathrec);
+        if (ret) {
+                ipoib_warn(priv, "failed to send cm req: %d\n", ret);
+                goto err_send_cm;
+        }
+
+        ipoib_dbg(priv, "Request connection 0x%x for gid " IPOIB_GID_FMT " qpn 0x%x\n",
+                  p->qp->qp_num, IPOIB_GID_ARG(pathrec->dgid), qpn);
+
+        return 0;
+
+err_send_cm:
+err_modify:
+        ib_destroy_cm_id(p->id);
+err_id:
+        p->id = NULL;
+        ib_destroy_qp(p->qp);
+err_req_notify:
+err_qp:
+        p->qp = NULL;
+        ib_destroy_cq(p->cq);
+err_cq:
+        p->cq = NULL;
+err_tx:
+        return ret;
+}
+
+static void ipoib_cm_tx_destroy(struct ipoib_cm_tx *p)
+{
+        struct ipoib_dev_priv *priv = netdev_priv(p->dev);
+        struct ipoib_tx_buf *tx_req;
+
+        ipoib_dbg(priv, "Destroy active connection 0x%x head 0x%x tail 0x%x\n",
+                  p->qp ? p->qp->qp_num : 0, p->tx_head, p->tx_tail);
+
+        if (p->id)
+                ib_destroy_cm_id(p->id);
+
+        if (p->qp)
+                ib_destroy_qp(p->qp);
+
+        if (p->cq)
+                ib_destroy_cq(p->cq);
+
+        if (test_bit(IPOIB_FLAG_NETIF_STOPPED, &p->flags))
+                netif_wake_queue(p->dev);
+
+        if (p->tx_ring) {
+                while ((int) p->tx_tail - (int) p->tx_head < 0) {
+                        tx_req = &p->tx_ring[p->tx_tail & (ipoib_sendq_size - 1)];
+                        ib_dma_unmap_single(priv->ca, tx_req->mapping, tx_req->skb->len,
+                                         DMA_TO_DEVICE);
+                        dev_kfree_skb_any(tx_req->skb);
+                        ++p->tx_tail;
+                }
+
+                kfree(p->tx_ring);
+        }
+
+        kfree(p);
+}
+
+static int ipoib_cm_tx_handler(struct ib_cm_id *cm_id,
+                               struct ib_cm_event *event)
+{
+        struct ipoib_cm_tx *tx = cm_id->context;
+        struct ipoib_dev_priv *priv = netdev_priv(tx->dev);
+        struct net_device *dev = priv->dev;
+        struct ipoib_neigh *neigh;
+        unsigned long flags;
+        int ret;
+
+        switch (event->event) {
+        case IB_CM_DREQ_RECEIVED:
+                ipoib_dbg(priv, "DREQ received.\n");
+                ib_send_cm_drep(cm_id, NULL, 0);
+                break;
+        case IB_CM_REP_RECEIVED:
+                ipoib_dbg(priv, "REP received.\n");
+                ret = ipoib_cm_rep_handler(cm_id, event);
+                if (ret)
+                        ib_send_cm_rej(cm_id, IB_CM_REJ_CONSUMER_DEFINED,
+                                       NULL, 0, NULL, 0);
+                break;
+        case IB_CM_REQ_ERROR:
+        case IB_CM_REJ_RECEIVED:
+        case IB_CM_TIMEWAIT_EXIT:
+                ipoib_dbg(priv, "CM error %d.\n", event->event);
+                spin_lock_irqsave(&priv->tx_lock, flags);
+                spin_lock(&priv->lock);
+                neigh = tx->neigh;
+
+                if (neigh) {
+                        neigh->cm = NULL;
+                        list_del(&neigh->list);
+                        if (neigh->ah)
+                                ipoib_put_ah(neigh->ah);
+                        ipoib_neigh_free(dev, neigh);
+
+                        tx->neigh = NULL;
+                }
+
+                if (test_and_clear_bit(IPOIB_FLAG_INITIALIZED, &tx->flags)) {
+                        list_move(&tx->list, &priv->cm.reap_list);
+                        queue_work(ipoib_workqueue, &priv->cm.reap_task);
+                }
+
+                spin_unlock(&priv->lock);
+                spin_unlock_irqrestore(&priv->tx_lock, flags);
+                break;
+        default:
+                break;
+        }
+
+        return 0;
+}
+
+struct ipoib_cm_tx *ipoib_cm_create_tx(struct net_device *dev, struct ipoib_path *path,
+                                       struct ipoib_neigh *neigh)
+{
+        struct ipoib_dev_priv *priv = netdev_priv(dev);
+        struct ipoib_cm_tx *tx;
+
+        tx = kzalloc(sizeof *tx, GFP_ATOMIC);
+        if (!tx)
+                return NULL;
+
+        neigh->cm = tx;
+        tx->neigh = neigh;
+        tx->path = path;
+        tx->dev = dev;
+        list_add(&tx->list, &priv->cm.start_list);
+        set_bit(IPOIB_FLAG_INITIALIZED, &tx->flags);
+        queue_work(ipoib_workqueue, &priv->cm.start_task);
+        return tx;
+}
+
+void ipoib_cm_destroy_tx(struct ipoib_cm_tx *tx)
+{
+        struct ipoib_dev_priv *priv = netdev_priv(tx->dev);
+        if (test_and_clear_bit(IPOIB_FLAG_INITIALIZED, &tx->flags)) {
+                list_move(&tx->list, &priv->cm.reap_list);
+                queue_work(ipoib_workqueue, &priv->cm.reap_task);
+                ipoib_dbg(priv, "Reap connection for gid " IPOIB_GID_FMT "\n",
+                          IPOIB_GID_ARG(tx->neigh->dgid));
+                tx->neigh = NULL;
+        }
+}
+
+static void ipoib_cm_tx_start(struct work_struct *work)
+{
+        struct ipoib_dev_priv *priv = container_of(work, struct ipoib_dev_priv,
+                                                   cm.start_task);
+        struct net_device *dev = priv->dev;
+        struct ipoib_neigh *neigh;
+        struct ipoib_cm_tx *p;
+        unsigned long flags;
+        int ret;
+
+        struct ib_sa_path_rec pathrec;
+        u32 qpn;
+
+        spin_lock_irqsave(&priv->tx_lock, flags);
+        spin_lock(&priv->lock);
+        while (!list_empty(&priv->cm.start_list)) {
+                p = list_entry(priv->cm.start_list.next, typeof(*p), list);
+                list_del_init(&p->list);
+                neigh = p->neigh;
+                qpn = IPOIB_QPN(neigh->neighbour->ha);
+                memcpy(&pathrec, &p->path->pathrec, sizeof pathrec);
+                spin_unlock(&priv->lock);
+                spin_unlock_irqrestore(&priv->tx_lock, flags);
+                ret = ipoib_cm_tx_init(p, qpn, &pathrec);
+                spin_lock_irqsave(&priv->tx_lock, flags);
+                spin_lock(&priv->lock);
+                if (ret) {
+                        neigh = p->neigh;
+                        if (neigh) {
+                                neigh->cm = NULL;
+                                list_del(&neigh->list);
+                                if (neigh->ah)
+                                        ipoib_put_ah(neigh->ah);
+                                ipoib_neigh_free(dev, neigh);
+                        }
+                        list_del(&p->list);
+                        kfree(p);
+                }
+        }
+        spin_unlock(&priv->lock);
+        spin_unlock_irqrestore(&priv->tx_lock, flags);
+}
+
+static void ipoib_cm_tx_reap(struct work_struct *work)
+{
+        struct ipoib_dev_priv *priv = container_of(work, struct ipoib_dev_priv,
+                                                   cm.reap_task);
+        struct ipoib_cm_tx *p;
+        unsigned long flags;
+
+        spin_lock_irqsave(&priv->tx_lock, flags);
+        spin_lock(&priv->lock);
+        while (!list_empty(&priv->cm.reap_list)) {
+                p = list_entry(priv->cm.reap_list.next, typeof(*p), list);
+                list_del(&p->list);
+                spin_unlock(&priv->lock);
+                spin_unlock_irqrestore(&priv->tx_lock, flags);
+                ipoib_cm_tx_destroy(p);
+                spin_lock_irqsave(&priv->tx_lock, flags);
+                spin_lock(&priv->lock);
+        }
+        spin_unlock(&priv->lock);
+        spin_unlock_irqrestore(&priv->tx_lock, flags);
+}
+
+static void ipoib_cm_skb_reap(struct work_struct *work)
+{
+        struct ipoib_dev_priv *priv = container_of(work, struct ipoib_dev_priv,
+                                                   cm.skb_task);
+        struct net_device *dev = priv->dev;
+        struct sk_buff *skb;
+        unsigned long flags;
+
+        unsigned mtu = priv->mcast_mtu;
+
+        spin_lock_irqsave(&priv->tx_lock, flags);
+        spin_lock(&priv->lock);
+        while ((skb = skb_dequeue(&priv->cm.skb_queue))) {
+                spin_unlock(&priv->lock);
+                spin_unlock_irqrestore(&priv->tx_lock, flags);
+                if (skb->protocol == htons(ETH_P_IP))
+                        icmp_send(skb, ICMP_DEST_UNREACH, ICMP_FRAG_NEEDED, htonl(mtu));
+#if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
+                else if (skb->protocol == htons(ETH_P_IPV6))
+                        icmpv6_send(skb, ICMPV6_PKT_TOOBIG, 0, mtu, dev);
+#endif
+                dev_kfree_skb_any(skb);
+                spin_lock_irqsave(&priv->tx_lock, flags);
+                spin_lock(&priv->lock);
+        }
+        spin_unlock(&priv->lock);
+        spin_unlock_irqrestore(&priv->tx_lock, flags);
+}
+
+void ipoib_cm_skb_too_long(struct net_device* dev, struct sk_buff *skb,
+                           unsigned int mtu)
+{
+        struct ipoib_dev_priv *priv = netdev_priv(dev);
+        int e = skb_queue_empty(&priv->cm.skb_queue);
+
+        if (skb->dst)
+                skb->dst->ops->update_pmtu(skb->dst, mtu);
+
+        skb_queue_tail(&priv->cm.skb_queue, skb);
+        if (e)
+                queue_work(ipoib_workqueue, &priv->cm.skb_task);
+}
+
+static void ipoib_cm_stale_task(struct work_struct *work)
+{
+        struct ipoib_dev_priv *priv = container_of(work, struct ipoib_dev_priv,
+                                                   cm.stale_task.work);
+        struct ipoib_cm_rx *p;
+        unsigned long flags;
+
+        spin_lock_irqsave(&priv->lock, flags);
+        while (!list_empty(&priv->cm.passive_ids)) {
+                /* List if sorted by LRU, start from tail,
+                 * stop when we see a recently used entry */
+                p = list_entry(priv->cm.passive_ids.prev, typeof(*p), list);
+                if (time_after_eq(jiffies, p->jiffies + IPOIB_CM_RX_TIMEOUT))
+                        break;
+                list_del_init(&p->list);
+                spin_unlock_irqrestore(&priv->lock, flags);
+                ib_destroy_cm_id(p->id);
+                ib_destroy_qp(p->qp);
+                kfree(p);
+                spin_lock_irqsave(&priv->lock, flags);
+        }
+        spin_unlock_irqrestore(&priv->lock, flags);
+}
+
+
+static ssize_t show_mode(struct device *d, struct device_attribute *attr, 
+                         char *buf)
+{
+        struct ipoib_dev_priv *priv = netdev_priv(to_net_dev(d));
+
+        if (test_bit(IPOIB_FLAG_ADMIN_CM, &priv->flags))
+                return sprintf(buf, "connected\n");
+        else
+                return sprintf(buf, "datagram\n");
+}
+
+static ssize_t set_mode(struct device *d, struct device_attribute *attr,
+                        const char *buf, size_t count)
+{
+        struct net_device *dev = to_net_dev(d);
+        struct ipoib_dev_priv *priv = netdev_priv(dev);
+
+        /* flush paths if we switch modes so that connections are restarted */
+        if (IPOIB_CM_SUPPORTED(dev->dev_addr) && !strcmp(buf, "connected\n")) {
+                set_bit(IPOIB_FLAG_ADMIN_CM, &priv->flags);
+                ipoib_warn(priv, "enabling connected mode "
+                           "will cause multicast packet drops\n");
+                ipoib_flush_paths(dev);
+                return count;
+        }
+
+        if (!strcmp(buf, "datagram\n")) {
+                clear_bit(IPOIB_FLAG_ADMIN_CM, &priv->flags);
+                dev->mtu = min(priv->mcast_mtu, dev->mtu);
+                ipoib_flush_paths(dev);
+                return count;
+        }
+
+        return -EINVAL;
+}
+
+static DEVICE_ATTR(mode, S_IWUGO | S_IRUGO, show_mode, set_mode);
+
+int ipoib_cm_add_mode_attr(struct net_device *dev)
+{
+        return device_create_file(&dev->dev, &dev_attr_mode);
+}
+
+int ipoib_cm_dev_init(struct net_device *dev)
+{
+        struct ipoib_dev_priv *priv = netdev_priv(dev);
+        struct ib_srq_init_attr srq_init_attr = {
+                .attr = {
+                        .max_wr  = ipoib_recvq_size,
+                        .max_sge = IPOIB_CM_RX_SG
+                }
+        };
+        int ret, i;
+
+        INIT_LIST_HEAD(&priv->cm.passive_ids);
+        INIT_LIST_HEAD(&priv->cm.reap_list);
+        INIT_LIST_HEAD(&priv->cm.start_list);
+        INIT_WORK(&priv->cm.start_task, ipoib_cm_tx_start);
+        INIT_WORK(&priv->cm.reap_task, ipoib_cm_tx_reap);
+        INIT_WORK(&priv->cm.skb_task, ipoib_cm_skb_reap);
+        INIT_DELAYED_WORK(&priv->cm.stale_task, ipoib_cm_stale_task);
+
+        skb_queue_head_init(&priv->cm.skb_queue);
+
+        priv->cm.srq = ib_create_srq(priv->pd, &srq_init_attr);
+        if (IS_ERR(priv->cm.srq)) {
+                ret = PTR_ERR(priv->cm.srq);
+                priv->cm.srq = NULL;
+                return ret;
+        }
+
+        priv->cm.srq_ring = kzalloc(ipoib_recvq_size * sizeof *priv->cm.srq_ring,
+                                    GFP_KERNEL);
+        if (!priv->cm.srq_ring) {
+                printk(KERN_WARNING "%s: failed to allocate CM ring (%d entries)\n",
+                       priv->ca->name, ipoib_recvq_size);
+                ipoib_cm_dev_cleanup(dev);
+                return -ENOMEM;
+        }
+
+        for (i = 0; i < IPOIB_CM_RX_SG; ++i)
+                priv->cm.rx_sge[i].lkey = priv->mr->lkey;
+
+        priv->cm.rx_sge[0].length = IPOIB_CM_HEAD_SIZE;
+        for (i = 1; i < IPOIB_CM_RX_SG; ++i)
+                priv->cm.rx_sge[i].length = PAGE_SIZE;
+        priv->cm.rx_wr.next = NULL;
+        priv->cm.rx_wr.sg_list = priv->cm.rx_sge;
+        priv->cm.rx_wr.num_sge = IPOIB_CM_RX_SG;
+
+        for (i = 0; i < ipoib_recvq_size; ++i) {
+                if (ipoib_cm_alloc_rx_skb(dev, i, priv->cm.srq_ring[i].mapping)) {
+                        ipoib_warn(priv, "failed to allocate receive buffer %d\n", i);
+                        ipoib_cm_dev_cleanup(dev);
+                        return -ENOMEM;
+                }
+                if (ipoib_cm_post_receive(dev, i)) {
+                        ipoib_warn(priv, "ipoib_ib_post_receive failed for buf %d\n", i);
+                        ipoib_cm_dev_cleanup(dev);
+                        return -EIO;
+                }
+        }
+
+        priv->dev->dev_addr[0] = IPOIB_FLAGS_RC;
+        return 0;
+}
+
+void ipoib_cm_dev_cleanup(struct net_device *dev)
+{
+        struct ipoib_dev_priv *priv = netdev_priv(dev);
+        int i, ret;
+
+        if (!priv->cm.srq)
+                return;
+
+        ipoib_dbg(priv, "Cleanup ipoib connected mode.\n");
+
+        ret = ib_destroy_srq(priv->cm.srq);
+        if (ret)
+                ipoib_warn(priv, "ib_destroy_srq failed: %d\n", ret);
+
+        priv->cm.srq = NULL;
+        if (!priv->cm.srq_ring)
+                return;
+        for (i = 0; i < ipoib_recvq_size; ++i)
+                if (priv->cm.srq_ring[i].skb) {
+                        ipoib_cm_dma_unmap_rx(priv, priv->cm.srq_ring[i].mapping);
+                        dev_kfree_skb_any(priv->cm.srq_ring[i].skb);
+                        priv->cm.srq_ring[i].skb = NULL;
+                }
+        kfree(priv->cm.srq_ring);
+        priv->cm.srq_ring = NULL;
+}
diff --git a/drivers/infiniband/ulp/ipoib/ipoib_ib.c b/drivers/infiniband/ulp/ipoib/ipoib_ib.c
index 59d9594ed6d9..f2aa923ddbea 100644
--- a/drivers/infiniband/ulp/ipoib/ipoib_ib.c
+++ b/drivers/infiniband/ulp/ipoib/ipoib_ib.c
@@ -50,8 +50,6 @@ MODULE_PARM_DESC(data_debug_level,
                  "Enable data path debug tracing if > 0");
 #endif
 
-#define IPOIB_OP_RECV   (1ul << 31)
-
 static DEFINE_MUTEX(pkey_mutex);
 
 struct ipoib_ah *ipoib_create_ah(struct net_device *dev,
@@ -268,10 +266,11 @@ static void ipoib_ib_handle_tx_wc(struct net_device *dev, struct ib_wc *wc)
 
         spin_lock_irqsave(&priv->tx_lock, flags);
         ++priv->tx_tail;
-        if (netif_queue_stopped(dev) &&
-            test_bit(IPOIB_FLAG_ADMIN_UP, &priv->flags) &&
-            priv->tx_head - priv->tx_tail <= ipoib_sendq_size >> 1)
+        if (unlikely(test_bit(IPOIB_FLAG_NETIF_STOPPED, &priv->flags)) &&
+            priv->tx_head - priv->tx_tail <= ipoib_sendq_size >> 1) {
+                clear_bit(IPOIB_FLAG_NETIF_STOPPED, &priv->flags);
                 netif_wake_queue(dev);
+        }
         spin_unlock_irqrestore(&priv->tx_lock, flags);
 
         if (wc->status != IB_WC_SUCCESS &&
@@ -283,7 +282,9 @@ static void ipoib_ib_handle_tx_wc(struct net_device *dev, struct ib_wc *wc)
 
 static void ipoib_ib_handle_wc(struct net_device *dev, struct ib_wc *wc)
 {
-        if (wc->wr_id & IPOIB_OP_RECV)
+        if (wc->wr_id & IPOIB_CM_OP_SRQ)
+                ipoib_cm_handle_rx_wc(dev, wc);
+        else if (wc->wr_id & IPOIB_OP_RECV)
                 ipoib_ib_handle_rx_wc(dev, wc);
         else
                 ipoib_ib_handle_tx_wc(dev, wc);
@@ -327,12 +328,12 @@ void ipoib_send(struct net_device *dev, struct sk_buff *skb,
         struct ipoib_tx_buf *tx_req;
         u64 addr;
 
-        if (unlikely(skb->len > dev->mtu + INFINIBAND_ALEN)) {
+        if (unlikely(skb->len > priv->mcast_mtu + INFINIBAND_ALEN)) {
                 ipoib_warn(priv, "packet len %d (> %d) too long to send, dropping\n",
-                           skb->len, dev->mtu + INFINIBAND_ALEN);
+                           skb->len, priv->mcast_mtu + INFINIBAND_ALEN);
                 ++priv->stats.tx_dropped;
                 ++priv->stats.tx_errors;
-                dev_kfree_skb_any(skb);
+                ipoib_cm_skb_too_long(dev, skb, priv->mcast_mtu);
                 return;
         }
 
@@ -372,6 +373,7 @@ void ipoib_send(struct net_device *dev, struct sk_buff *skb,
                 if (priv->tx_head - priv->tx_tail == ipoib_sendq_size) {
                         ipoib_dbg(priv, "TX ring full, stopping kernel net queue\n");
                         netif_stop_queue(dev);
+                        set_bit(IPOIB_FLAG_NETIF_STOPPED, &priv->flags);
                 }
         }
 }
@@ -424,6 +426,13 @@ int ipoib_ib_dev_open(struct net_device *dev)
                 return -1;
         }
 
+        ret = ipoib_cm_dev_open(dev);
+        if (ret) {
+                ipoib_warn(priv, "ipoib_ib_post_receives returned %d\n", ret);
+                ipoib_ib_dev_stop(dev);
+                return -1;
+        }
+
         clear_bit(IPOIB_STOP_REAPER, &priv->flags);
         queue_delayed_work(ipoib_workqueue, &priv->ah_reap_task, HZ);
 
@@ -509,6 +518,8 @@ int ipoib_ib_dev_stop(struct net_device *dev)
 
         clear_bit(IPOIB_FLAG_INITIALIZED, &priv->flags);
 
+        ipoib_cm_dev_stop(dev);
+
         /*
          * Move our QP to the error state and then reinitialize in
          * when all work requests have completed or have been flushed.
diff --git a/drivers/infiniband/ulp/ipoib/ipoib_main.c b/drivers/infiniband/ulp/ipoib/ipoib_main.c
index af5ee2ec4499..18d27fd352ad 100644
--- a/drivers/infiniband/ulp/ipoib/ipoib_main.c
+++ b/drivers/infiniband/ulp/ipoib/ipoib_main.c
@@ -49,8 +49,6 @@
 
 #include <net/dst.h>
 
-#define IPOIB_QPN(ha) (be32_to_cpup((__be32 *) ha) & 0xffffff)
-
 MODULE_AUTHOR("Roland Dreier");
 MODULE_DESCRIPTION("IP-over-InfiniBand net driver");
 MODULE_LICENSE("Dual BSD/GPL");
@@ -145,6 +143,8 @@ static int ipoib_stop(struct net_device *dev)
 
         netif_stop_queue(dev);
 
+        clear_bit(IPOIB_FLAG_NETIF_STOPPED, &priv->flags);
+
         /*
          * Now flush workqueue to make sure a scheduled task doesn't
          * bring our internal state back up.
@@ -178,8 +178,18 @@ static int ipoib_change_mtu(struct net_device *dev, int new_mtu)
 {
         struct ipoib_dev_priv *priv = netdev_priv(dev);
 
-        if (new_mtu > IPOIB_PACKET_SIZE - IPOIB_ENCAP_LEN)
+        /* dev->mtu > 2K ==> connected mode */
+        if (ipoib_cm_admin_enabled(dev) && new_mtu <= IPOIB_CM_MTU) {
+                if (new_mtu > priv->mcast_mtu)
+                        ipoib_warn(priv, "mtu > %d will cause multicast packet drops.\n",
+                                   priv->mcast_mtu);
+                dev->mtu = new_mtu;
+                return 0;
+        }
+
+        if (new_mtu > IPOIB_PACKET_SIZE - IPOIB_ENCAP_LEN) {
                 return -EINVAL;
+        }
 
         priv->admin_mtu = new_mtu;
 
@@ -414,6 +424,20 @@ static void path_rec_completion(int status,
                         memcpy(&neigh->dgid.raw, &path->pathrec.dgid.raw,
                                sizeof(union ib_gid));
 
+                        if (ipoib_cm_enabled(dev, neigh->neighbour)) {
+                                if (!ipoib_cm_get(neigh))
+                                        ipoib_cm_set(neigh, ipoib_cm_create_tx(dev,
+                                                                               path,
+                                                                               neigh));
+                                if (!ipoib_cm_get(neigh)) {
+                                        list_del(&neigh->list);
+                                        if (neigh->ah)
+                                                ipoib_put_ah(neigh->ah);
+                                        ipoib_neigh_free(dev, neigh);
+                                        continue;
+                                }
+                        }
+
                         while ((skb = __skb_dequeue(&neigh->queue)))
                                 __skb_queue_tail(&skqueue, skb);
                 }
@@ -520,7 +544,25 @@ static void neigh_add_path(struct sk_buff *skb, struct net_device *dev)
                 memcpy(&neigh->dgid.raw, &path->pathrec.dgid.raw,
                        sizeof(union ib_gid));
 
-                ipoib_send(dev, skb, path->ah, IPOIB_QPN(skb->dst->neighbour->ha));
+                if (ipoib_cm_enabled(dev, neigh->neighbour)) {
+                        if (!ipoib_cm_get(neigh))
+                                ipoib_cm_set(neigh, ipoib_cm_create_tx(dev, path, neigh));
+                        if (!ipoib_cm_get(neigh)) {
+                                list_del(&neigh->list);
+                                if (neigh->ah)
+                                        ipoib_put_ah(neigh->ah);
+                                ipoib_neigh_free(dev, neigh);
+                                goto err_drop;
+                        }
+                        if (skb_queue_len(&neigh->queue) < IPOIB_MAX_PATH_REC_QUEUE)
+                                __skb_queue_tail(&neigh->queue, skb);
+                        else {
+                                ipoib_warn(priv, "queue length limit %d. Packet drop.\n",
+                                           skb_queue_len(&neigh->queue));
+                                goto err_drop;
+                        }
+                } else
+                        ipoib_send(dev, skb, path->ah, IPOIB_QPN(skb->dst->neighbour->ha));
         } else {
                 neigh->ah  = NULL;
 
@@ -538,6 +580,7 @@ err_list:
 
 err_path:
         ipoib_neigh_free(dev, neigh);
+err_drop:
         ++priv->stats.tx_dropped;
         dev_kfree_skb_any(skb);
 
@@ -640,7 +683,12 @@ static int ipoib_start_xmit(struct sk_buff *skb, struct net_device *dev)
 
                 neigh = *to_ipoib_neigh(skb->dst->neighbour);
 
-                if (likely(neigh->ah)) {
+                if (ipoib_cm_get(neigh)) {
+                        if (ipoib_cm_up(neigh)) {
+                                ipoib_cm_send(dev, skb, ipoib_cm_get(neigh));
+                                goto out;
+                        }
+                } else if (neigh->ah) {
                         if (unlikely(memcmp(&neigh->dgid.raw,
                                             skb->dst->neighbour->ha + 4,
                                             sizeof(union ib_gid)))) {
@@ -805,6 +853,7 @@ struct ipoib_neigh *ipoib_neigh_alloc(struct neighbour *neighbour)
         neigh->neighbour = neighbour;
         *to_ipoib_neigh(neighbour) = neigh;
         skb_queue_head_init(&neigh->queue);
+        ipoib_cm_set(neigh, NULL);
 
         return neigh;
 }
@@ -818,6 +867,8 @@ void ipoib_neigh_free(struct net_device *dev, struct ipoib_neigh *neigh)
                 ++priv->stats.tx_dropped;
                 dev_kfree_skb_any(skb);
         }
+        if (ipoib_cm_get(neigh))
+                ipoib_cm_destroy_tx(ipoib_cm_get(neigh));
         kfree(neigh);
 }
 
@@ -1080,6 +1131,8 @@ static struct net_device *ipoib_add_port(const char *format,
 
         ipoib_create_debug_files(priv->dev);
 
+        if (ipoib_cm_add_mode_attr(priv->dev))
+                goto sysfs_failed;
         if (ipoib_add_pkey_attr(priv->dev))
                 goto sysfs_failed;
         if (device_create_file(&priv->dev->dev, &dev_attr_create_child))
diff --git a/drivers/infiniband/ulp/ipoib/ipoib_multicast.c b/drivers/infiniband/ulp/ipoib/ipoib_multicast.c
index b04b72ca32ed..fea737f520fd 100644
--- a/drivers/infiniband/ulp/ipoib/ipoib_multicast.c
+++ b/drivers/infiniband/ulp/ipoib/ipoib_multicast.c
@@ -597,7 +597,9 @@ void ipoib_mcast_join_task(struct work_struct *work)
 
         priv->mcast_mtu = ib_mtu_enum_to_int(priv->broadcast->mcmember.mtu) -
                 IPOIB_ENCAP_LEN;
-        dev->mtu = min(priv->mcast_mtu, priv->admin_mtu);
+
+        if (!ipoib_cm_admin_enabled(dev))
+                dev->mtu = min(priv->mcast_mtu, priv->admin_mtu);
 
         ipoib_dbg_mcast(priv, "successfully joined all multicast groups\n");
 
diff --git a/drivers/infiniband/ulp/ipoib/ipoib_verbs.c b/drivers/infiniband/ulp/ipoib/ipoib_verbs.c
index 7b717c648f72..3cb551b88756 100644
--- a/drivers/infiniband/ulp/ipoib/ipoib_verbs.c
+++ b/drivers/infiniband/ulp/ipoib/ipoib_verbs.c
@@ -168,35 +168,41 @@ int ipoib_transport_dev_init(struct net_device *dev, struct ib_device *ca)
                 .qp_type     = IB_QPT_UD
         };
 
+        int ret, size;
+
         priv->pd = ib_alloc_pd(priv->ca);
         if (IS_ERR(priv->pd)) {
                 printk(KERN_WARNING "%s: failed to allocate PD\n", ca->name);
                 return -ENODEV;
         }
 
-        priv->cq = ib_create_cq(priv->ca, ipoib_ib_completion, NULL, dev,
-                                ipoib_sendq_size + ipoib_recvq_size + 1);
+        priv->mr = ib_get_dma_mr(priv->pd, IB_ACCESS_LOCAL_WRITE);
+        if (IS_ERR(priv->mr)) {
+                printk(KERN_WARNING "%s: ib_get_dma_mr failed\n", ca->name);
+                goto out_free_pd;
+        }
+
+        size = ipoib_sendq_size + ipoib_recvq_size + 1;
+        ret = ipoib_cm_dev_init(dev);
+        if (!ret)
+                size += ipoib_recvq_size;
+
+        priv->cq = ib_create_cq(priv->ca, ipoib_ib_completion, NULL, dev, size);
         if (IS_ERR(priv->cq)) {
                 printk(KERN_WARNING "%s: failed to create CQ\n", ca->name);
-                goto out_free_pd;
+                goto out_free_mr;
         }
 
         if (ib_req_notify_cq(priv->cq, IB_CQ_NEXT_COMP))
                 goto out_free_cq;
 
-        priv->mr = ib_get_dma_mr(priv->pd, IB_ACCESS_LOCAL_WRITE);
-        if (IS_ERR(priv->mr)) {
-                printk(KERN_WARNING "%s: ib_get_dma_mr failed\n", ca->name);
-                goto out_free_cq;
-        }
-
         init_attr.send_cq = priv->cq;
         init_attr.recv_cq = priv->cq,
 
         priv->qp = ib_create_qp(priv->pd, &init_attr);
         if (IS_ERR(priv->qp)) {
                 printk(KERN_WARNING "%s: failed to create QP\n", ca->name);
-                goto out_free_mr;
+                goto out_free_cq;
         }
 
         priv->dev->dev_addr[1] = (priv->qp->qp_num >> 16) & 0xff;
@@ -212,12 +218,12 @@ int ipoib_transport_dev_init(struct net_device *dev, struct ib_device *ca)
 
         return 0;
 
-out_free_mr:
-        ib_dereg_mr(priv->mr);
-
 out_free_cq:
         ib_destroy_cq(priv->cq);
 
+out_free_mr:
+        ib_dereg_mr(priv->mr);
+
 out_free_pd:
         ib_dealloc_pd(priv->pd);
         return -ENODEV;
@@ -235,12 +241,14 @@ void ipoib_transport_dev_cleanup(struct net_device *dev)
                 clear_bit(IPOIB_PKEY_ASSIGNED, &priv->flags);
         }
 
-        if (ib_dereg_mr(priv->mr))
-                ipoib_warn(priv, "ib_dereg_mr failed\n");
-
         if (ib_destroy_cq(priv->cq))
                 ipoib_warn(priv, "ib_cq_destroy failed\n");
 
+        ipoib_cm_dev_cleanup(dev);
+
+        if (ib_dereg_mr(priv->mr))
+                ipoib_warn(priv, "ib_dereg_mr failed\n");
+
         if (ib_dealloc_pd(priv->pd))
                 ipoib_warn(priv, "ib_dealloc_pd failed\n");
 }
diff --git a/drivers/infiniband/ulp/ipoib/ipoib_vlan.c b/drivers/infiniband/ulp/ipoib/ipoib_vlan.c
index 085eafe6667c..6762988439d1 100644
--- a/drivers/infiniband/ulp/ipoib/ipoib_vlan.c
+++ b/drivers/infiniband/ulp/ipoib/ipoib_vlan.c
@@ -115,6 +115,8 @@ int ipoib_vlan_add(struct net_device *pdev, unsigned short pkey)
 
         ipoib_create_debug_files(priv->dev);
 
+        if (ipoib_cm_add_mode_attr(priv->dev))
+                goto sysfs_failed;
         if (ipoib_add_pkey_attr(priv->dev))
                 goto sysfs_failed;
 
diff --git a/drivers/input/ff-memless.c b/drivers/input/ff-memless.c
index eba18b6ac5e4..d226d935b0dc 100644
--- a/drivers/input/ff-memless.c
+++ b/drivers/input/ff-memless.c
@@ -29,7 +29,7 @@
 #include <linux/module.h>
 #include <linux/mutex.h>
 #include <linux/spinlock.h>
-#include <linux/sched.h>
+#include <linux/jiffies.h>
 
 #include "fixp-arith.h"
 
diff --git a/drivers/input/input.c b/drivers/input/input.c
index 14d4c0493c36..efa1b1f75393 100644
--- a/drivers/input/input.c
+++ b/drivers/input/input.c
@@ -11,7 +11,6 @@
  */
 
 #include <linux/init.h>
-#include <linux/sched.h>
 #include <linux/smp_lock.h>
 #include <linux/input.h>
 #include <linux/module.h>
diff --git a/drivers/input/keyboard/gpio_keys.c b/drivers/input/keyboard/gpio_keys.c
index 3a8f1b427a7f..7ad479e4e3b3 100644
--- a/drivers/input/keyboard/gpio_keys.c
+++ b/drivers/input/keyboard/gpio_keys.c
@@ -78,7 +78,7 @@ static int __devinit gpio_keys_probe(struct platform_device *pdev)
                 int irq = IRQ_GPIO(pdata->buttons[i].gpio);
 
                 set_irq_type(irq, IRQ_TYPE_EDGE_BOTH);
-                error = request_irq(irq, gpio_keys_isr, SA_SAMPLE_RANDOM,
+                error = request_irq(irq, gpio_keys_isr, IRQF_SAMPLE_RANDOM,
                                      pdata->buttons[i].desc ? pdata->buttons[i].desc : "gpio_keys",
                                      pdev);
                 if (error) {
diff --git a/drivers/input/mouse/rpcmouse.c b/drivers/input/mouse/rpcmouse.c
index fbdcfd8eb4e9..355efd0423e7 100644
--- a/drivers/input/mouse/rpcmouse.c
+++ b/drivers/input/mouse/rpcmouse.c
@@ -18,7 +18,6 @@
  */
 
 #include <linux/module.h>
-#include <linux/sched.h>
 #include <linux/ptrace.h>
 #include <linux/interrupt.h>
 #include <linux/init.h>
diff --git a/drivers/input/serio/hil_mlc.c b/drivers/input/serio/hil_mlc.c
index 49e11e2c1d5d..4fa93ff30919 100644
--- a/drivers/input/serio/hil_mlc.c
+++ b/drivers/input/serio/hil_mlc.c
@@ -59,7 +59,6 @@
 #include <linux/init.h>
 #include <linux/interrupt.h>
 #include <linux/timer.h>
-#include <linux/sched.h>
 #include <linux/list.h>
 
 MODULE_AUTHOR("Brian S. Julin <bri@calyx.com>");
diff --git a/drivers/input/serio/hp_sdc.c b/drivers/input/serio/hp_sdc.c
index 9907ad3bea23..b57370dc4e3d 100644
--- a/drivers/input/serio/hp_sdc.c
+++ b/drivers/input/serio/hp_sdc.c
@@ -62,7 +62,6 @@
  */
 
 #include <linux/hp_sdc.h>
-#include <linux/sched.h>
 #include <linux/errno.h>
 #include <linux/init.h>
 #include <linux/module.h>
diff --git a/drivers/input/touchscreen/ads7846.c b/drivers/input/touchscreen/ads7846.c
index cd251efda410..0a26e0663542 100644
--- a/drivers/input/touchscreen/ads7846.c
+++ b/drivers/input/touchscreen/ads7846.c
@@ -546,7 +546,7 @@ static void ads7846_rx(void *ads)
                         ts->spi->dev.bus_id, ts->tc.ignore, Rt);
 #endif
                 hrtimer_start(&ts->timer, ktime_set(0, TS_POLL_PERIOD),
-                              HRTIMER_REL);
+                              HRTIMER_MODE_REL);
                 return;
         }
 
@@ -578,7 +578,8 @@ static void ads7846_rx(void *ads)
 #endif
         }
 
-        hrtimer_start(&ts->timer, ktime_set(0, TS_POLL_PERIOD), HRTIMER_REL);
+        hrtimer_start(&ts->timer, ktime_set(0, TS_POLL_PERIOD),
+                        HRTIMER_MODE_REL);
 }
 
 static int ads7846_debounce(void *ads, int data_idx, int *val)
@@ -667,7 +668,7 @@ static void ads7846_rx_val(void *ads)
                                 status);
 }
 
-static int ads7846_timer(struct hrtimer *handle)
+static enum hrtimer_restart ads7846_timer(struct hrtimer *handle)
 {
         struct ads7846  *ts = container_of(handle, struct ads7846, timer);
         int             status = 0;
@@ -724,7 +725,7 @@ static irqreturn_t ads7846_irq(int irq, void *handle)
                         disable_irq(ts->spi->irq);
                         ts->pending = 1;
                         hrtimer_start(&ts->timer, ktime_set(0, TS_POLL_DELAY),
-                                        HRTIMER_REL);
+                                        HRTIMER_MODE_REL);
                 }
         }
         spin_unlock_irqrestore(&ts->lock, flags);
@@ -862,7 +863,7 @@ static int __devinit ads7846_probe(struct spi_device *spi)
         ts->spi = spi;
         ts->input = input_dev;
 
-        hrtimer_init(&ts->timer, CLOCK_MONOTONIC, HRTIMER_REL);
+        hrtimer_init(&ts->timer, CLOCK_MONOTONIC, HRTIMER_MODE_REL);
         ts->timer.function = ads7846_timer;
 
         spin_lock_init(&ts->lock);
diff --git a/drivers/isdn/capi/capidrv.c b/drivers/isdn/capi/capidrv.c
index 8cec9c3898ec..2a49cea0a223 100644
--- a/drivers/isdn/capi/capidrv.c
+++ b/drivers/isdn/capi/capidrv.c
@@ -13,7 +13,6 @@
 #include <linux/errno.h>
 #include <linux/kernel.h>
 #include <linux/major.h>
-#include <linux/sched.h>
 #include <linux/slab.h>
 #include <linux/fcntl.h>
 #include <linux/fs.h>
diff --git a/drivers/isdn/gigaset/Makefile b/drivers/isdn/gigaset/Makefile
index 835b806a9de7..077e297d8c72 100644
--- a/drivers/isdn/gigaset/Makefile
+++ b/drivers/isdn/gigaset/Makefile
@@ -5,4 +5,4 @@ ser_gigaset-y := ser-gigaset.o asyncdata.o
 
 obj-$(CONFIG_GIGASET_M105) += usb_gigaset.o gigaset.o
 obj-$(CONFIG_GIGASET_BASE) += bas_gigaset.o gigaset.o
-obj-$(CONFIG_GIGASET_M105) += ser_gigaset.o gigaset.o
+obj-$(CONFIG_GIGASET_M101) += ser_gigaset.o gigaset.o
diff --git a/drivers/isdn/hardware/avm/avm_cs.c b/drivers/isdn/hardware/avm/avm_cs.c
index eba10466ccc6..a5b941c327f7 100644
--- a/drivers/isdn/hardware/avm/avm_cs.c
+++ b/drivers/isdn/hardware/avm/avm_cs.c
@@ -12,7 +12,6 @@
 #include <linux/module.h>
 #include <linux/kernel.h>
 #include <linux/init.h>
-#include <linux/sched.h>
 #include <linux/ptrace.h>
 #include <linux/slab.h>
 #include <linux/string.h>
diff --git a/drivers/isdn/hardware/eicon/divamnt.c b/drivers/isdn/hardware/eicon/divamnt.c
index 6b2940ed0776..4aba5c502d8e 100644
--- a/drivers/isdn/hardware/eicon/divamnt.c
+++ b/drivers/isdn/hardware/eicon/divamnt.c
@@ -13,7 +13,6 @@
 #include <linux/module.h>
 #include <linux/init.h>
 #include <linux/kernel.h>
-#include <linux/sched.h>
 #include <linux/smp_lock.h>
 #include <linux/poll.h>
 #include <asm/uaccess.h>
diff --git a/drivers/isdn/hardware/eicon/divasmain.c b/drivers/isdn/hardware/eicon/divasmain.c
index b365e44072c0..5e862e244117 100644
--- a/drivers/isdn/hardware/eicon/divasmain.c
+++ b/drivers/isdn/hardware/eicon/divasmain.c
@@ -12,7 +12,6 @@
 #include <linux/module.h>
 #include <linux/init.h>
 #include <linux/kernel.h>
-#include <linux/sched.h>
 #include <asm/uaccess.h>
 #include <asm/io.h>
 #include <linux/ioport.h>
diff --git a/drivers/isdn/hisax/avma1_cs.c b/drivers/isdn/hisax/avma1_cs.c
index 9e70c206779e..fc6cc2c065b8 100644
--- a/drivers/isdn/hisax/avma1_cs.c
+++ b/drivers/isdn/hisax/avma1_cs.c
@@ -14,7 +14,6 @@
 
 #include <linux/kernel.h>
 #include <linux/init.h>
-#include <linux/sched.h>
 #include <linux/ptrace.h>
 #include <linux/slab.h>
 #include <linux/string.h>
diff --git a/drivers/isdn/hisax/elsa_cs.c b/drivers/isdn/hisax/elsa_cs.c
index 79ab9dda7d08..db7e64424afe 100644
--- a/drivers/isdn/hisax/elsa_cs.c
+++ b/drivers/isdn/hisax/elsa_cs.c
@@ -38,7 +38,6 @@
 #include <linux/module.h>
 #include <linux/kernel.h>
 #include <linux/init.h>
-#include <linux/sched.h>
 #include <linux/ptrace.h>
 #include <linux/slab.h>
 #include <linux/string.h>
diff --git a/drivers/isdn/hisax/hfc_usb.c b/drivers/isdn/hisax/hfc_usb.c
index 42bbae2a646c..9f44d3e69fb0 100644
--- a/drivers/isdn/hisax/hfc_usb.c
+++ b/drivers/isdn/hisax/hfc_usb.c
@@ -38,7 +38,6 @@
 #include <linux/usb.h>
 #include <linux/kernel.h>
 #include <linux/smp_lock.h>
-#include <linux/sched.h>
 #include "hisax.h"
 #include "hisax_if.h"
 #include "hfc_usb.h"
diff --git a/drivers/isdn/hisax/sedlbauer_cs.c b/drivers/isdn/hisax/sedlbauer_cs.c
index 45debde05fbd..439cb530def8 100644
--- a/drivers/isdn/hisax/sedlbauer_cs.c
+++ b/drivers/isdn/hisax/sedlbauer_cs.c
@@ -38,7 +38,6 @@
 #include <linux/kernel.h>
 #include <linux/module.h>
 #include <linux/init.h>
-#include <linux/sched.h>
 #include <linux/ptrace.h>
 #include <linux/slab.h>
 #include <linux/string.h>
diff --git a/drivers/isdn/hisax/teles_cs.c b/drivers/isdn/hisax/teles_cs.c
index 3e3e18239ec7..ab4bd455450e 100644
--- a/drivers/isdn/hisax/teles_cs.c
+++ b/drivers/isdn/hisax/teles_cs.c
@@ -19,7 +19,6 @@
 #include <linux/kernel.h>
 #include <linux/module.h>
 #include <linux/init.h>
-#include <linux/sched.h>
 #include <linux/ptrace.h>
 #include <linux/slab.h>
 #include <linux/string.h>
diff --git a/drivers/isdn/hysdn/boardergo.c b/drivers/isdn/hysdn/boardergo.c
index a1206498a1cf..84dccd526ac0 100644
--- a/drivers/isdn/hysdn/boardergo.c
+++ b/drivers/isdn/hysdn/boardergo.c
@@ -14,7 +14,6 @@
  *
  */
 
-#include <linux/sched.h>
 #include <linux/signal.h>
 #include <linux/kernel.h>
 #include <linux/ioport.h>
diff --git a/drivers/isdn/hysdn/hysdn_sched.c b/drivers/isdn/hysdn/hysdn_sched.c
index 18758772b744..b7b5aa4748a0 100644
--- a/drivers/isdn/hysdn/hysdn_sched.c
+++ b/drivers/isdn/hysdn/hysdn_sched.c
@@ -11,7 +11,6 @@
  *
  */
 
-#include <linux/sched.h>
 #include <linux/signal.h>
 #include <linux/kernel.h>
 #include <linux/ioport.h>
diff --git a/drivers/isdn/i4l/isdn_bsdcomp.c b/drivers/isdn/i4l/isdn_bsdcomp.c
index a20f33b4a220..90a23795db7e 100644
--- a/drivers/isdn/i4l/isdn_bsdcomp.c
+++ b/drivers/isdn/i4l/isdn_bsdcomp.c
@@ -56,7 +56,6 @@
 #include <linux/module.h>
 #include <linux/init.h>
 #include <linux/kernel.h>
-#include <linux/sched.h>
 #include <linux/types.h>
 #include <linux/fcntl.h>
 #include <linux/interrupt.h>
diff --git a/drivers/isdn/pcbit/callbacks.c b/drivers/isdn/pcbit/callbacks.c
index f151f36c8255..43ecd0f54235 100644
--- a/drivers/isdn/pcbit/callbacks.c
+++ b/drivers/isdn/pcbit/callbacks.c
@@ -15,7 +15,6 @@
  * NULL pointer dereference in cb_in_1 (originally fixed in 2.0)
  */
 
-#include <linux/sched.h>
 #include <linux/string.h>
 #include <linux/kernel.h>
 
diff --git a/drivers/isdn/pcbit/capi.c b/drivers/isdn/pcbit/capi.c
index bef321d0e51d..47c59e95898d 100644
--- a/drivers/isdn/pcbit/capi.c
+++ b/drivers/isdn/pcbit/capi.c
@@ -27,7 +27,6 @@
  *              encode our number in CallerPN and ConnectedPN
  */
 
-#include <linux/sched.h>
 #include <linux/string.h>
 #include <linux/kernel.h>
 
diff --git a/drivers/isdn/pcbit/drv.c b/drivers/isdn/pcbit/drv.c
index 386c5ce64844..8c66bcb953a1 100644
--- a/drivers/isdn/pcbit/drv.c
+++ b/drivers/isdn/pcbit/drv.c
@@ -19,7 +19,6 @@
 
 #include <linux/module.h>
 
-#include <linux/sched.h>
 
 #include <linux/kernel.h>
 
diff --git a/drivers/isdn/pcbit/edss1.c b/drivers/isdn/pcbit/edss1.c
index 1ad8b07efd8b..37e9626cebf6 100644
--- a/drivers/isdn/pcbit/edss1.c
+++ b/drivers/isdn/pcbit/edss1.c
@@ -15,7 +15,6 @@
  *              move state/event descriptions to a user space logger
  */
 
-#include <linux/sched.h>
 #include <linux/string.h>
 #include <linux/kernel.h>
 
diff --git a/drivers/isdn/pcbit/layer2.c b/drivers/isdn/pcbit/layer2.c
index 58eee50c8e26..5ba2a879df14 100644
--- a/drivers/isdn/pcbit/layer2.c
+++ b/drivers/isdn/pcbit/layer2.c
@@ -24,7 +24,6 @@
  *              re-write/remove debug printks
  */
 
-#include <linux/sched.h>
 #include <linux/string.h>
 #include <linux/kernel.h>
 #include <linux/types.h>
diff --git a/drivers/isdn/pcbit/module.c b/drivers/isdn/pcbit/module.c
index 7b7b1777f09b..04ea241ff176 100644
--- a/drivers/isdn/pcbit/module.c
+++ b/drivers/isdn/pcbit/module.c
@@ -11,7 +11,6 @@
 
 #include <linux/module.h>
 #include <linux/init.h>
-#include <linux/sched.h>
 #include <linux/string.h>
 #include <linux/kernel.h>
 #include <linux/skbuff.h>
diff --git a/drivers/kvm/vmx.c b/drivers/kvm/vmx.c
index 1e640b899175..fd4e91734388 100644
--- a/drivers/kvm/vmx.c
+++ b/drivers/kvm/vmx.c
@@ -1879,12 +1879,6 @@ again:
 
         asm ("mov %0, %%ds; mov %0, %%es" : : "r"(__USER_DS));
 
-        /*
-         * Profile KVM exit RIPs:
-         */
-        if (unlikely(prof_on == KVM_PROFILING))
-                profile_hit(KVM_PROFILING, (void *)vmcs_readl(GUEST_RIP));
-
         kvm_run->exit_type = 0;
         if (fail) {
                 kvm_run->exit_type = KVM_EXIT_TYPE_FAIL_ENTRY;
@@ -1907,6 +1901,12 @@ again:
 
                         reload_tss();
                 }
+                /*
+                 * Profile KVM exit RIPs:
+                 */
+                if (unlikely(prof_on == KVM_PROFILING))
+                        profile_hit(KVM_PROFILING, (void *)vmcs_readl(GUEST_RIP));
+
                 vcpu->launched = 1;
                 kvm_run->exit_type = KVM_EXIT_TYPE_VM_EXIT;
                 r = kvm_handle_exit(kvm_run, vcpu);
diff --git a/drivers/macintosh/adbhid.c b/drivers/macintosh/adbhid.c
index 1c7d6f221b55..b77ef5187d6d 100644
--- a/drivers/macintosh/adbhid.c
+++ b/drivers/macintosh/adbhid.c
@@ -574,8 +574,8 @@ static struct adb_request led_request;
 static int leds_pending[16];
 static int leds_req_pending;
 static int pending_devs[16];
-static int pending_led_start=0;
-static int pending_led_end=0;
+static int pending_led_start;
+static int pending_led_end;
 static DEFINE_SPINLOCK(leds_lock);
 
 static void leds_done(struct adb_request *req)
diff --git a/drivers/macintosh/apm_emu.c b/drivers/macintosh/apm_emu.c
index a6d50f4fabd7..c5e4d43f97fc 100644
--- a/drivers/macintosh/apm_emu.c
+++ b/drivers/macintosh/apm_emu.c
@@ -102,7 +102,7 @@ static struct pmu_sleep_notifier apm_sleep_notifier = {
         SLEEP_LEVEL_USERLAND,
 };
 
-static char                     driver_version[] = "0.5";       /* no spaces */
+static const char driver_version[] = "0.5";     /* no spaces */
 
 #ifdef DEBUG
 static char *   apm_event_name[] = {
diff --git a/drivers/macintosh/mac_hid.c b/drivers/macintosh/mac_hid.c
index ee6b4ca69130..c1fd816e9f09 100644
--- a/drivers/macintosh/mac_hid.c
+++ b/drivers/macintosh/mac_hid.c
@@ -17,10 +17,10 @@
 
 static struct input_dev *emumousebtn;
 static int emumousebtn_input_register(void);
-static int mouse_emulate_buttons = 0;
+static int mouse_emulate_buttons;
 static int mouse_button2_keycode = KEY_RIGHTCTRL;       /* right control key */
 static int mouse_button3_keycode = KEY_RIGHTALT;        /* right option key */
-static int mouse_last_keycode = 0;
+static int mouse_last_keycode;
 
 #if defined(CONFIG_SYSCTL)
 /* file(s) in /proc/sys/dev/mac_hid */
@@ -138,7 +138,7 @@ int __init mac_hid_init(void)
                 return err;
 
 #if defined(CONFIG_SYSCTL)
-        mac_hid_sysctl_header = register_sysctl_table(mac_hid_root_dir, 1);
+        mac_hid_sysctl_header = register_sysctl_table(mac_hid_root_dir);
 #endif /* CONFIG_SYSCTL */
 
         return 0;
diff --git a/drivers/macintosh/macio-adb.c b/drivers/macintosh/macio-adb.c
index 797cef72258f..026b67f4f659 100644
--- a/drivers/macintosh/macio-adb.c
+++ b/drivers/macintosh/macio-adb.c
@@ -6,7 +6,6 @@
 #include <linux/errno.h>
 #include <linux/kernel.h>
 #include <linux/delay.h>
-#include <linux/sched.h>
 #include <linux/spinlock.h>
 #include <linux/interrupt.h>
 #include <asm/prom.h>
diff --git a/drivers/macintosh/therm_adt746x.c b/drivers/macintosh/therm_adt746x.c
index 3d3bf1643e73..a7ce55926638 100644
--- a/drivers/macintosh/therm_adt746x.c
+++ b/drivers/macintosh/therm_adt746x.c
@@ -48,11 +48,11 @@ static u8 FAN_SPD_SET[2] = {0x30, 0x31};
 
 static u8 default_limits_local[3] = {70, 50, 70};    /* local, sensor1, sensor2 */
 static u8 default_limits_chip[3] = {80, 65, 80};    /* local, sensor1, sensor2 */
-static const char *sensor_location[3] = {NULL, NULL, NULL};
+static const char *sensor_location[3];
 
-static int limit_adjust = 0;
+static int limit_adjust;
 static int fan_speed = -1;
-static int verbose = 0;
+static int verbose;
 
 MODULE_AUTHOR("Colin Leroy <colin@colino.net>");
 MODULE_DESCRIPTION("Driver for ADT746x thermostat in iBook G4 and "
diff --git a/drivers/macintosh/via-cuda.c b/drivers/macintosh/via-cuda.c
index df66291b1322..d58fcf6cca0a 100644
--- a/drivers/macintosh/via-cuda.c
+++ b/drivers/macintosh/via-cuda.c
@@ -13,7 +13,6 @@
 #include <linux/errno.h>
 #include <linux/kernel.h>
 #include <linux/delay.h>
-#include <linux/sched.h>
 #include <linux/adb.h>
 #include <linux/cuda.h>
 #include <linux/spinlock.h>
@@ -86,7 +85,7 @@ static int data_index;
 #ifdef CONFIG_PPC
 static struct device_node *vias;
 #endif
-static int cuda_fully_inited = 0;
+static int cuda_fully_inited;
 
 #ifdef CONFIG_ADB
 static int cuda_probe(void);
diff --git a/drivers/macintosh/via-macii.c b/drivers/macintosh/via-macii.c
index 5d88d5b0ad99..1b3bad62a1be 100644
--- a/drivers/macintosh/via-macii.c
+++ b/drivers/macintosh/via-macii.c
@@ -19,7 +19,6 @@
 #include <linux/errno.h>
 #include <linux/kernel.h>
 #include <linux/delay.h>
-#include <linux/sched.h>
 #include <linux/adb.h>
 #include <linux/interrupt.h>
 #include <linux/init.h>
@@ -107,10 +106,10 @@ static enum macii_state {
         awaiting_reply
 } macii_state;
 
-static int need_poll    = 0;
-static int command_byte = 0;
-static int last_reply   = 0;
-static int last_active  = 0;
+static int need_poll;
+static int command_byte;
+static int last_reply;
+static int last_active;
 
 static struct adb_request *current_req;
 static struct adb_request *last_req;
@@ -124,7 +123,7 @@ static int first_byte;
 static int prefix_len;
 static int status = ST_IDLE|TREQ;
 static int last_status;
-static int driver_running = 0;
+static int driver_running;
 
 /* debug level 10 required for ADB logging (should be && debug_adb, ideally) */
 
diff --git a/drivers/macintosh/via-maciisi.c b/drivers/macintosh/via-maciisi.c
index 1f0aa5dc9aa5..2dc788042707 100644
--- a/drivers/macintosh/via-maciisi.c
+++ b/drivers/macintosh/via-maciisi.c
@@ -18,7 +18,6 @@
 #include <linux/types.h>
 #include <linux/errno.h>
 #include <linux/kernel.h>
-#include <linux/sched.h>
 #include <linux/adb.h>
 #include <linux/cuda.h>
 #include <linux/delay.h>
@@ -63,10 +62,10 @@ static volatile unsigned char *via;
 
 #undef DEBUG_MACIISI_ADB
 
-static struct adb_request* current_req = NULL;
-static struct adb_request* last_req = NULL;
+static struct adb_request* current_req;
+static struct adb_request* last_req;
 static unsigned char maciisi_rbuf[16];
-static unsigned char *reply_ptr = NULL;
+static unsigned char *reply_ptr;
 static int data_index;
 static int reading_reply;
 static int reply_len;
diff --git a/drivers/macintosh/via-pmu.c b/drivers/macintosh/via-pmu.c
index 96bea4b62c43..b6073bdb50c3 100644
--- a/drivers/macintosh/via-pmu.c
+++ b/drivers/macintosh/via-pmu.c
@@ -141,13 +141,13 @@ static volatile int adb_int_pending;
 static volatile int disable_poll;
 static struct device_node *vias;
 static int pmu_kind = PMU_UNKNOWN;
-static int pmu_fully_inited = 0;
+static int pmu_fully_inited;
 static int pmu_has_adb;
 static struct device_node *gpio_node;
-static unsigned char __iomem *gpio_reg = NULL;
+static unsigned char __iomem *gpio_reg;
 static int gpio_irq = NO_IRQ;
 static int gpio_irq_enabled = -1;
-static volatile int pmu_suspended = 0;
+static volatile int pmu_suspended;
 static spinlock_t pmu_lock;
 static u8 pmu_intr_mask;
 static int pmu_version;
@@ -169,7 +169,7 @@ static int option_server_mode;
 
 int pmu_battery_count;
 int pmu_cur_battery;
-unsigned int pmu_power_flags;
+unsigned int pmu_power_flags = PMU_PWR_AC_PRESENT;
 struct pmu_battery_info pmu_batteries[PMU_MAX_BATTERIES];
 static int query_batt_timer = BATTERY_POLLING_COUNT;
 static struct adb_request batt_req;
@@ -180,7 +180,7 @@ int asleep;
 BLOCKING_NOTIFIER_HEAD(sleep_notifier_list);
 
 #ifdef CONFIG_ADB
-static int adb_dev_map = 0;
+static int adb_dev_map;
 static int pmu_adb_flags;
 
 static int pmu_probe(void);
@@ -2776,7 +2776,7 @@ pmu_polled_request(struct adb_request *req)
 
 #if defined(CONFIG_PM) && defined(CONFIG_PPC32)
 
-static int pmu_sys_suspended = 0;
+static int pmu_sys_suspended;
 
 static int pmu_sys_suspend(struct sys_device *sysdev, pm_message_t state)
 {
@@ -2816,7 +2816,6 @@ static struct sysdev_class pmu_sysclass = {
 };
 
 static struct sys_device device_pmu = {
-        .id             = 0,
         .cls            = &pmu_sysclass,
 };
 
diff --git a/drivers/macintosh/via-pmu68k.c b/drivers/macintosh/via-pmu68k.c
index 4f5b6fa196c5..356c7216a179 100644
--- a/drivers/macintosh/via-pmu68k.c
+++ b/drivers/macintosh/via-pmu68k.c
@@ -22,7 +22,6 @@
 #include <linux/errno.h>
 #include <linux/kernel.h>
 #include <linux/delay.h>
-#include <linux/sched.h>
 #include <linux/miscdevice.h>
 #include <linux/blkdev.h>
 #include <linux/pci.h>
@@ -96,10 +95,10 @@ static int data_index;
 static int data_len;
 static int adb_int_pending;
 static int pmu_adb_flags;
-static int adb_dev_map = 0;
+static int adb_dev_map;
 static struct adb_request bright_req_1, bright_req_2, bright_req_3;
 static int pmu_kind = PMU_UNKNOWN;
-static int pmu_fully_inited = 0;
+static int pmu_fully_inited;
 
 int asleep;
 BLOCKING_NOTIFIER_HEAD(sleep_notifier_list);
diff --git a/drivers/md/md.c b/drivers/md/md.c
index e85fa75a7912..05febfd9f071 100644
--- a/drivers/md/md.c
+++ b/drivers/md/md.c
@@ -5581,7 +5581,7 @@ static int __init md_init(void)
                             md_probe, NULL, NULL);
 
         register_reboot_notifier(&md_notifier);
-        raid_table_header = register_sysctl_table(raid_root_table, 1);
+        raid_table_header = register_sysctl_table(raid_root_table);
 
         md_geninit();
         return (0);
diff --git a/drivers/media/dvb/b2c2/flexcop-i2c.c b/drivers/media/dvb/b2c2/flexcop-i2c.c
index e0bd2d8f0f0c..5347a406fff7 100644
--- a/drivers/media/dvb/b2c2/flexcop-i2c.c
+++ b/drivers/media/dvb/b2c2/flexcop-i2c.c
@@ -190,6 +190,7 @@ int flexcop_i2c_init(struct flexcop_device *fc)
         fc->i2c_adap.class          = I2C_CLASS_TV_DIGITAL;
         fc->i2c_adap.algo       = &flexcop_algo;
         fc->i2c_adap.algo_data  = NULL;
+        fc->i2c_adap.dev.parent = fc->dev;
 
         if ((ret = i2c_add_adapter(&fc->i2c_adap)) < 0)
                 return ret;
diff --git a/drivers/media/dvb/dvb-core/dmxdev.c b/drivers/media/dvb/dvb-core/dmxdev.c
index 988499dfddf8..fc77de45ca4d 100644
--- a/drivers/media/dvb/dvb-core/dmxdev.c
+++ b/drivers/media/dvb/dvb-core/dmxdev.c
@@ -25,7 +25,6 @@
 #include <linux/vmalloc.h>
 #include <linux/module.h>
 #include <linux/moduleparam.h>
-#include <linux/sched.h>
 #include <linux/poll.h>
 #include <linux/ioctl.h>
 #include <linux/wait.h>
diff --git a/drivers/media/dvb/dvb-core/dvbdev.c b/drivers/media/dvb/dvb-core/dvbdev.c
index 40774feb8953..826b47f155a0 100644
--- a/drivers/media/dvb/dvb-core/dvbdev.c
+++ b/drivers/media/dvb/dvb-core/dvbdev.c
@@ -27,7 +27,6 @@
 #include <linux/module.h>
 #include <linux/moduleparam.h>
 #include <linux/kernel.h>
-#include <linux/sched.h>
 #include <linux/init.h>
 #include <linux/slab.h>
 #include <linux/device.h>
diff --git a/drivers/media/dvb/dvb-usb/dvb-usb-i2c.c b/drivers/media/dvb/dvb-usb/dvb-usb-i2c.c
index 55ba020386c9..70df31b0a8a9 100644
--- a/drivers/media/dvb/dvb-usb/dvb-usb-i2c.c
+++ b/drivers/media/dvb/dvb-usb/dvb-usb-i2c.c
@@ -27,6 +27,7 @@ int dvb_usb_i2c_init(struct dvb_usb_device *d)
 #endif
         d->i2c_adap.algo      = d->props.i2c_algo;
         d->i2c_adap.algo_data = NULL;
+        d->i2c_adap.dev.parent = &d->udev->dev;
 
         i2c_set_adapdata(&d->i2c_adap, d);
 
diff --git a/drivers/media/dvb/ttpci/av7110_av.c b/drivers/media/dvb/ttpci/av7110_av.c
index 8c577cf30fb3..795e6e95915c 100644
--- a/drivers/media/dvb/ttpci/av7110_av.c
+++ b/drivers/media/dvb/ttpci/av7110_av.c
@@ -31,7 +31,6 @@
 #include <linux/types.h>
 #include <linux/kernel.h>
 #include <linux/string.h>
-#include <linux/sched.h>
 #include <linux/delay.h>
 #include <linux/smp_lock.h>
 #include <linux/fs.h>
diff --git a/drivers/media/dvb/ttpci/av7110_ca.c b/drivers/media/dvb/ttpci/av7110_ca.c
index dd9aee314e0a..4251a97d420e 100644
--- a/drivers/media/dvb/ttpci/av7110_ca.c
+++ b/drivers/media/dvb/ttpci/av7110_ca.c
@@ -29,7 +29,6 @@
  */
 
 #include <linux/kernel.h>
-#include <linux/sched.h>
 #include <linux/types.h>
 #include <linux/delay.h>
 #include <linux/fs.h>
diff --git a/drivers/media/dvb/ttpci/av7110_hw.c b/drivers/media/dvb/ttpci/av7110_hw.c
index 37de2e88a273..4d7150e15d1e 100644
--- a/drivers/media/dvb/ttpci/av7110_hw.c
+++ b/drivers/media/dvb/ttpci/av7110_hw.c
@@ -32,7 +32,6 @@
 #include <linux/types.h>
 #include <linux/kernel.h>
 #include <linux/string.h>
-#include <linux/sched.h>
 #include <linux/delay.h>
 #include <linux/smp_lock.h>
 #include <linux/fs.h>
diff --git a/drivers/media/dvb/ttpci/av7110_v4l.c b/drivers/media/dvb/ttpci/av7110_v4l.c
index 10cfe3131e72..dbfd5e7b4be0 100644
--- a/drivers/media/dvb/ttpci/av7110_v4l.c
+++ b/drivers/media/dvb/ttpci/av7110_v4l.c
@@ -26,7 +26,6 @@
  */
 
 #include <linux/kernel.h>
-#include <linux/sched.h>
 #include <linux/types.h>
 #include <linux/delay.h>
 #include <linux/fs.h>
diff --git a/drivers/media/dvb/ttusb-budget/dvb-ttusb-budget.c b/drivers/media/dvb/ttusb-budget/dvb-ttusb-budget.c
index 60820deb900b..b60cdc93d6db 100644
--- a/drivers/media/dvb/ttusb-budget/dvb-ttusb-budget.c
+++ b/drivers/media/dvb/ttusb-budget/dvb-ttusb-budget.c
@@ -1690,6 +1690,7 @@ static int ttusb_probe(struct usb_interface *intf, const struct usb_device_id *i
 #endif
         ttusb->i2c_adap.algo              = &ttusb_dec_algo;
         ttusb->i2c_adap.algo_data         = NULL;
+        ttusb->i2c_adap.dev.parent        = &udev->dev;
 
         result = i2c_add_adapter(&ttusb->i2c_adap);
         if (result) {
diff --git a/drivers/media/radio/miropcm20-rds.c b/drivers/media/radio/miropcm20-rds.c
index c93490ec96bb..aed11477378b 100644
--- a/drivers/media/radio/miropcm20-rds.c
+++ b/drivers/media/radio/miropcm20-rds.c
@@ -14,7 +14,6 @@
 #include <linux/slab.h>
 #include <linux/fs.h>
 #include <linux/miscdevice.h>
-#include <linux/sched.h>        /* current, TASK_*, schedule_timeout() */
 #include <linux/delay.h>
 #include <asm/uaccess.h>
 #include "miropcm20-rds-core.h"
diff --git a/drivers/media/radio/radio-maestro.c b/drivers/media/radio/radio-maestro.c
index 9bba6eb10925..e67b7f258029 100644
--- a/drivers/media/radio/radio-maestro.c
+++ b/drivers/media/radio/radio-maestro.c
@@ -22,7 +22,6 @@
 #include <linux/init.h>
 #include <linux/ioport.h>
 #include <linux/delay.h>
-#include <linux/sched.h>
 #include <asm/io.h>
 #include <asm/uaccess.h>
 #include <linux/mutex.h>
diff --git a/drivers/media/radio/radio-maxiradio.c b/drivers/media/radio/radio-maxiradio.c
index 00a2f31d2af3..6beeb74004b1 100644
--- a/drivers/media/radio/radio-maxiradio.c
+++ b/drivers/media/radio/radio-maxiradio.c
@@ -35,7 +35,6 @@
 #include <linux/init.h>
 #include <linux/ioport.h>
 #include <linux/delay.h>
-#include <linux/sched.h>
 #include <asm/io.h>
 #include <asm/uaccess.h>
 #include <linux/mutex.h>
diff --git a/drivers/media/video/adv7170.c b/drivers/media/video/adv7170.c
index 48709582a186..2aa9ce920607 100644
--- a/drivers/media/video/adv7170.c
+++ b/drivers/media/video/adv7170.c
@@ -42,7 +42,6 @@
 #include <asm/io.h>
 #include <asm/pgtable.h>
 #include <asm/page.h>
-#include <linux/sched.h>
 #include <linux/types.h>
 
 #include <linux/videodev.h>
diff --git a/drivers/media/video/adv7175.c b/drivers/media/video/adv7175.c
index 68e7d7aff5e6..a3246a283aa4 100644
--- a/drivers/media/video/adv7175.c
+++ b/drivers/media/video/adv7175.c
@@ -38,7 +38,6 @@
 #include <asm/io.h>
 #include <asm/pgtable.h>
 #include <asm/page.h>
-#include <linux/sched.h>
 #include <linux/types.h>
 
 #include <linux/videodev.h>
diff --git a/drivers/media/video/bt819.c b/drivers/media/video/bt819.c
index e7b38fdd5e3c..68673863d5c9 100644
--- a/drivers/media/video/bt819.c
+++ b/drivers/media/video/bt819.c
@@ -42,7 +42,6 @@
 #include <asm/io.h>
 #include <asm/pgtable.h>
 #include <asm/page.h>
-#include <linux/sched.h>
 #include <linux/types.h>
 
 #include <linux/videodev.h>
diff --git a/drivers/media/video/bt856.c b/drivers/media/video/bt856.c
index af3b61d4fa7d..42e2299dcb22 100644
--- a/drivers/media/video/bt856.c
+++ b/drivers/media/video/bt856.c
@@ -42,7 +42,6 @@
 #include <asm/io.h>
 #include <asm/pgtable.h>
 #include <asm/page.h>
-#include <linux/sched.h>
 #include <linux/types.h>
 
 #include <linux/videodev.h>
diff --git a/drivers/media/video/bt8xx/bttv-vbi.c b/drivers/media/video/bt8xx/bttv-vbi.c
index 63676e7bd635..6fc6b0260056 100644
--- a/drivers/media/video/bt8xx/bttv-vbi.c
+++ b/drivers/media/video/bt8xx/bttv-vbi.c
@@ -25,7 +25,6 @@
 #include <linux/errno.h>
 #include <linux/fs.h>
 #include <linux/kernel.h>
-#include <linux/sched.h>
 #include <linux/interrupt.h>
 #include <linux/kdev_t.h>
 #include <asm/io.h>
diff --git a/drivers/media/video/cafe_ccic.c b/drivers/media/video/cafe_ccic.c
index fb1410c6f864..4dae8925667f 100644
--- a/drivers/media/video/cafe_ccic.c
+++ b/drivers/media/video/cafe_ccic.c
@@ -549,6 +549,7 @@ static int cafe_smbus_setup(struct cafe_camera *cam)
         adap->client_unregister = cafe_smbus_detach;
         adap->algo = &cafe_smbus_algo;
         strcpy(adap->name, "cafe_ccic");
+        adap->dev.parent = &cam->pdev->dev;
         i2c_set_adapdata(adap, cam);
         ret = i2c_add_adapter(adap);
         if (ret)
diff --git a/drivers/media/video/cx88/cx88-tvaudio.c b/drivers/media/video/cx88/cx88-tvaudio.c
index 2bd84d351a18..063df03dcf2e 100644
--- a/drivers/media/video/cx88/cx88-tvaudio.c
+++ b/drivers/media/video/cx88/cx88-tvaudio.c
@@ -46,7 +46,6 @@
 #include <linux/pci.h>
 #include <linux/signal.h>
 #include <linux/ioport.h>
-#include <linux/sched.h>
 #include <linux/types.h>
 #include <linux/interrupt.h>
 #include <linux/vmalloc.h>
diff --git a/drivers/media/video/em28xx/em28xx-input.c b/drivers/media/video/em28xx/em28xx-input.c
index 3ffb5684f127..55d45b0032cf 100644
--- a/drivers/media/video/em28xx/em28xx-input.c
+++ b/drivers/media/video/em28xx/em28xx-input.c
@@ -25,7 +25,6 @@
 #include <linux/moduleparam.h>
 #include <linux/init.h>
 #include <linux/delay.h>
-#include <linux/sched.h>
 #include <linux/interrupt.h>
 #include <linux/input.h>
 #include <linux/usb.h>
diff --git a/drivers/media/video/indycam.c b/drivers/media/video/indycam.c
index 7420b79e987a..5c2c4029ff86 100644
--- a/drivers/media/video/indycam.c
+++ b/drivers/media/video/indycam.c
@@ -17,7 +17,6 @@
 #include <linux/major.h>
 #include <linux/module.h>
 #include <linux/mm.h>
-#include <linux/sched.h>
 #include <linux/slab.h>
 
 #include <linux/videodev.h>
diff --git a/drivers/media/video/ir-kbd-i2c.c b/drivers/media/video/ir-kbd-i2c.c
index 59edf58204de..210582d420f8 100644
--- a/drivers/media/video/ir-kbd-i2c.c
+++ b/drivers/media/video/ir-kbd-i2c.c
@@ -31,7 +31,6 @@
 #include <linux/moduleparam.h>
 #include <linux/init.h>
 #include <linux/kernel.h>
-#include <linux/sched.h>
 #include <linux/string.h>
 #include <linux/timer.h>
 #include <linux/delay.h>
diff --git a/drivers/media/video/meye.c b/drivers/media/video/meye.c
index 9528e10c2828..98681da5e3b9 100644
--- a/drivers/media/video/meye.c
+++ b/drivers/media/video/meye.c
@@ -28,7 +28,6 @@
  */
 #include <linux/module.h>
 #include <linux/pci.h>
-#include <linux/sched.h>
 #include <linux/init.h>
 #include <linux/videodev.h>
 #include <media/v4l2-common.h>
diff --git a/drivers/media/video/pms.c b/drivers/media/video/pms.c
index d38d3dc4a012..b5a67f0dd19f 100644
--- a/drivers/media/video/pms.c
+++ b/drivers/media/video/pms.c
@@ -28,7 +28,6 @@
 #include <linux/ioport.h>
 #include <linux/init.h>
 #include <asm/io.h>
-#include <linux/sched.h>
 #include <linux/videodev.h>
 #include <media/v4l2-common.h>
 #include <linux/mutex.h>
diff --git a/drivers/media/video/pvrusb2/pvrusb2-i2c-core.c b/drivers/media/video/pvrusb2/pvrusb2-i2c-core.c
index f9bb41d8f4f3..62a7cfca837d 100644
--- a/drivers/media/video/pvrusb2/pvrusb2-i2c-core.c
+++ b/drivers/media/video/pvrusb2/pvrusb2-i2c-core.c
@@ -977,6 +977,7 @@ void pvr2_i2c_core_init(struct pvr2_hdw *hdw)
         memcpy(&hdw->i2c_adap,&pvr2_i2c_adap_template,sizeof(hdw->i2c_adap));
         memcpy(&hdw->i2c_algo,&pvr2_i2c_algo_template,sizeof(hdw->i2c_algo));
         strlcpy(hdw->i2c_adap.name,hdw->name,sizeof(hdw->i2c_adap.name));
+        hdw->i2c_adap.dev.parent = &hdw->usb_dev->dev;
         hdw->i2c_adap.algo = &hdw->i2c_algo;
         hdw->i2c_adap.algo_data = hdw;
         hdw->i2c_pend_mask = 0;
diff --git a/drivers/media/video/saa5246a.c b/drivers/media/video/saa5246a.c
index 0b5d159895bf..76f5f5d49dae 100644
--- a/drivers/media/video/saa5246a.c
+++ b/drivers/media/video/saa5246a.c
@@ -40,7 +40,6 @@
 
 #include <linux/module.h>
 #include <linux/kernel.h>
-#include <linux/sched.h>
 #include <linux/mm.h>
 #include <linux/init.h>
 #include <linux/i2c.h>
diff --git a/drivers/media/video/saa7111.c b/drivers/media/video/saa7111.c
index 686fd4746205..44dc7479119c 100644
--- a/drivers/media/video/saa7111.c
+++ b/drivers/media/video/saa7111.c
@@ -41,7 +41,6 @@
 #include <asm/io.h>
 #include <asm/pgtable.h>
 #include <asm/page.h>
-#include <linux/sched.h>
 #include <linux/types.h>
 
 #include <linux/videodev.h>
diff --git a/drivers/media/video/saa7114.c b/drivers/media/video/saa7114.c
index 90398ab8252e..2ce3321ab995 100644
--- a/drivers/media/video/saa7114.c
+++ b/drivers/media/video/saa7114.c
@@ -44,7 +44,6 @@
 #include <asm/io.h>
 #include <asm/pgtable.h>
 #include <asm/page.h>
-#include <linux/sched.h>
 #include <linux/types.h>
 
 #include <linux/videodev.h>
diff --git a/drivers/media/video/saa711x.c b/drivers/media/video/saa711x.c
index 708fae51e8ee..269d7114a93a 100644
--- a/drivers/media/video/saa711x.c
+++ b/drivers/media/video/saa711x.c
@@ -35,7 +35,6 @@
 #include <asm/io.h>
 #include <asm/pgtable.h>
 #include <asm/page.h>
-#include <linux/sched.h>
 #include <linux/types.h>
 #include <asm/uaccess.h>
 #include <linux/videodev.h>
diff --git a/drivers/media/video/saa7134/saa6752hs.c b/drivers/media/video/saa7134/saa6752hs.c
index afc8f352b8e7..57f1f5d409e0 100644
--- a/drivers/media/video/saa7134/saa6752hs.c
+++ b/drivers/media/video/saa7134/saa6752hs.c
@@ -1,6 +1,5 @@
 #include <linux/module.h>
 #include <linux/kernel.h>
-#include <linux/sched.h>
 #include <linux/string.h>
 #include <linux/timer.h>
 #include <linux/delay.h>
diff --git a/drivers/media/video/saa7134/saa7134-input.c b/drivers/media/video/saa7134/saa7134-input.c
index 60b38defd9bc..e4252683a597 100644
--- a/drivers/media/video/saa7134/saa7134-input.c
+++ b/drivers/media/video/saa7134/saa7134-input.c
@@ -22,7 +22,6 @@
 #include <linux/moduleparam.h>
 #include <linux/init.h>
 #include <linux/delay.h>
-#include <linux/sched.h>
 #include <linux/interrupt.h>
 #include <linux/input.h>
 
diff --git a/drivers/media/video/saa7185.c b/drivers/media/video/saa7185.c
index 9c308410856d..e0fdb1ab7580 100644
--- a/drivers/media/video/saa7185.c
+++ b/drivers/media/video/saa7185.c
@@ -38,7 +38,6 @@
 #include <asm/io.h>
 #include <asm/pgtable.h>
 #include <asm/page.h>
-#include <linux/sched.h>
 #include <linux/types.h>
 
 #include <linux/videodev.h>
diff --git a/drivers/media/video/saa7191.c b/drivers/media/video/saa7191.c
index 746cadb8f1c4..8615a6081a5d 100644
--- a/drivers/media/video/saa7191.c
+++ b/drivers/media/video/saa7191.c
@@ -17,7 +17,6 @@
 #include <linux/major.h>
 #include <linux/module.h>
 #include <linux/mm.h>
-#include <linux/sched.h>
 #include <linux/slab.h>
 
 #include <linux/videodev.h>
diff --git a/drivers/media/video/tda7432.c b/drivers/media/video/tda7432.c
index 78e043ac9ea0..d1ccc064206f 100644
--- a/drivers/media/video/tda7432.c
+++ b/drivers/media/video/tda7432.c
@@ -38,7 +38,6 @@
 #include <linux/module.h>
 #include <linux/init.h>
 #include <linux/kernel.h>
-#include <linux/sched.h>
 #include <linux/string.h>
 #include <linux/timer.h>
 #include <linux/delay.h>
diff --git a/drivers/media/video/tda9875.c b/drivers/media/video/tda9875.c
index 827633b3bb43..00f0e8b6e03b 100644
--- a/drivers/media/video/tda9875.c
+++ b/drivers/media/video/tda9875.c
@@ -19,7 +19,6 @@
 
 #include <linux/module.h>
 #include <linux/kernel.h>
-#include <linux/sched.h>
 #include <linux/string.h>
 #include <linux/timer.h>
 #include <linux/delay.h>
diff --git a/drivers/media/video/tuner-core.c b/drivers/media/video/tuner-core.c
index ee4a493032d6..7be73e3763de 100644
--- a/drivers/media/video/tuner-core.c
+++ b/drivers/media/video/tuner-core.c
@@ -7,7 +7,6 @@
 #include <linux/module.h>
 #include <linux/moduleparam.h>
 #include <linux/kernel.h>
-#include <linux/sched.h>
 #include <linux/string.h>
 #include <linux/timer.h>
 #include <linux/delay.h>
diff --git a/drivers/media/video/tvmixer.c b/drivers/media/video/tvmixer.c
index e2747bd373fd..7ea9132a1965 100644
--- a/drivers/media/video/tvmixer.c
+++ b/drivers/media/video/tvmixer.c
@@ -4,7 +4,6 @@
 #include <linux/module.h>
 #include <linux/moduleparam.h>
 #include <linux/kernel.h>
-#include <linux/sched.h>
 #include <linux/string.h>
 #include <linux/timer.h>
 #include <linux/delay.h>
diff --git a/drivers/media/video/usbvideo/ibmcam.c b/drivers/media/video/usbvideo/ibmcam.c
index 76f771b6a32f..14db95e10cfe 100644
--- a/drivers/media/video/usbvideo/ibmcam.c
+++ b/drivers/media/video/usbvideo/ibmcam.c
@@ -15,7 +15,6 @@
  */
 
 #include <linux/kernel.h>
-#include <linux/sched.h>
 #include <linux/module.h>
 #include <linux/init.h>
 
diff --git a/drivers/media/video/usbvideo/ultracam.c b/drivers/media/video/usbvideo/ultracam.c
index 10c58b4a2e5b..95453c108d40 100644
--- a/drivers/media/video/usbvideo/ultracam.c
+++ b/drivers/media/video/usbvideo/ultracam.c
@@ -6,7 +6,6 @@
  */
 
 #include <linux/kernel.h>
-#include <linux/sched.h>
 #include <linux/module.h>
 #include <linux/init.h>
 
diff --git a/drivers/media/video/usbvision/usbvision-core.c b/drivers/media/video/usbvision/usbvision-core.c
index a807d971e273..901f664dc6db 100644
--- a/drivers/media/video/usbvision/usbvision-core.c
+++ b/drivers/media/video/usbvision/usbvision-core.c
@@ -24,7 +24,6 @@
  */
 
 #include <linux/kernel.h>
-#include <linux/sched.h>
 #include <linux/list.h>
 #include <linux/timer.h>
 #include <linux/slab.h>
diff --git a/drivers/media/video/usbvision/usbvision-i2c.c b/drivers/media/video/usbvision/usbvision-i2c.c
index 858252c15084..609e1fd9c784 100644
--- a/drivers/media/video/usbvision/usbvision-i2c.c
+++ b/drivers/media/video/usbvision/usbvision-i2c.c
@@ -34,7 +34,6 @@
 #include <asm/uaccess.h>
 #include <linux/ioport.h>
 #include <linux/errno.h>
-#include <linux/sched.h>
 #include <linux/usb.h>
 #include <linux/i2c.h>
 #include "usbvision.h"
@@ -258,6 +257,7 @@ int usbvision_init_i2c(struct usb_usbvision *usbvision)
         sprintf(usbvision->i2c_adap.name + strlen(usbvision->i2c_adap.name),
                 " #%d", usbvision->vdev->minor & 0x1f);
         PDEBUG(DBG_I2C,"Adaptername: %s", usbvision->i2c_adap.name);
+        usbvision->i2c_adap.dev.parent = &usbvision->dev->dev;
 
         i2c_set_adapdata(&usbvision->i2c_adap, usbvision);
         i2c_set_clientdata(&usbvision->i2c_client, usbvision);
diff --git a/drivers/media/video/usbvision/usbvision-video.c b/drivers/media/video/usbvision/usbvision-video.c
index 4eb7330b96f8..af33653f0db8 100644
--- a/drivers/media/video/usbvision/usbvision-video.c
+++ b/drivers/media/video/usbvision/usbvision-video.c
@@ -46,7 +46,6 @@
 
 #include <linux/version.h>
 #include <linux/kernel.h>
-#include <linux/sched.h>
 #include <linux/list.h>
 #include <linux/timer.h>
 #include <linux/slab.h>
diff --git a/drivers/media/video/v4l2-common.c b/drivers/media/video/v4l2-common.c
index b87d571e0463..b8ee37ded3c9 100644
--- a/drivers/media/video/v4l2-common.c
+++ b/drivers/media/video/v4l2-common.c
@@ -47,7 +47,6 @@
 #include <linux/module.h>
 #include <linux/types.h>
 #include <linux/kernel.h>
-#include <linux/sched.h>
 #include <linux/smp_lock.h>
 #include <linux/mm.h>
 #include <linux/string.h>
diff --git a/drivers/media/video/videodev.c b/drivers/media/video/videodev.c
index 30c3822692fb..a786c1f5b960 100644
--- a/drivers/media/video/videodev.c
+++ b/drivers/media/video/videodev.c
@@ -30,7 +30,6 @@
 #include <linux/module.h>
 #include <linux/types.h>
 #include <linux/kernel.h>
-#include <linux/sched.h>
 #include <linux/smp_lock.h>
 #include <linux/mm.h>
 #include <linux/string.h>
diff --git a/drivers/media/video/w9968cf.c b/drivers/media/video/w9968cf.c
index 6e64af293be5..8f31613b9903 100644
--- a/drivers/media/video/w9968cf.c
+++ b/drivers/media/video/w9968cf.c
@@ -1573,6 +1573,7 @@ static int w9968cf_i2c_init(struct w9968cf_device* cam)
 
         memcpy(&cam->i2c_adapter, &adap, sizeof(struct i2c_adapter));
         strcpy(cam->i2c_adapter.name, "w9968cf");
+        cam->i2c_adapter.dev.parent = &cam->usbdev->dev;
         i2c_set_adapdata(&cam->i2c_adapter, cam);
 
         DBG(6, "Registering I2C adapter with kernel...")
diff --git a/drivers/media/video/zoran_card.c b/drivers/media/video/zoran_card.c
index 4d1eb2fba34a..73162a3a61dd 100644
--- a/drivers/media/video/zoran_card.c
+++ b/drivers/media/video/zoran_card.c
@@ -843,6 +843,7 @@ zoran_register_i2c (struct zoran *zr)
                 sizeof(I2C_NAME(&zr->i2c_adapter)) - 1);
         i2c_set_adapdata(&zr->i2c_adapter, zr);
         zr->i2c_adapter.algo_data = &zr->i2c_algo;
+        zr->i2c_adapter.dev.parent = &zr->pci_dev->dev;
         return i2c_bit_add_bus(&zr->i2c_adapter);
 }
 
diff --git a/drivers/message/fusion/mptfc.c b/drivers/message/fusion/mptfc.c
index b7d4c7265ec6..0caaf6403993 100644
--- a/drivers/message/fusion/mptfc.c
+++ b/drivers/message/fusion/mptfc.c
@@ -53,7 +53,6 @@
 #include <linux/delay.h>        /* for mdelay */
 #include <linux/interrupt.h>    /* needed for in_interrupt() proto */
 #include <linux/reboot.h>       /* notifier code */
-#include <linux/sched.h>
 #include <linux/workqueue.h>
 #include <linux/sort.h>
 
diff --git a/drivers/message/fusion/mptsas.c b/drivers/message/fusion/mptsas.c
index 84b8b485e95b..404c014db1bd 100644
--- a/drivers/message/fusion/mptsas.c
+++ b/drivers/message/fusion/mptsas.c
@@ -48,7 +48,7 @@
 #include <linux/kernel.h>
 #include <linux/init.h>
 #include <linux/errno.h>
-#include <linux/sched.h>
+#include <linux/jiffies.h>
 #include <linux/workqueue.h>
 #include <linux/delay.h>        /* for mdelay */
 
diff --git a/drivers/message/fusion/mptscsih.c b/drivers/message/fusion/mptscsih.c
index c417ae0b5fe6..2a3e9e66d4ef 100644
--- a/drivers/message/fusion/mptscsih.c
+++ b/drivers/message/fusion/mptscsih.c
@@ -54,7 +54,6 @@
 #include <linux/delay.h>        /* for mdelay */
 #include <linux/interrupt.h>    /* needed for in_interrupt() proto */
 #include <linux/reboot.h>       /* notifier code */
-#include <linux/sched.h>
 #include <linux/workqueue.h>
 
 #include <scsi/scsi.h>
diff --git a/drivers/message/fusion/mptspi.c b/drivers/message/fusion/mptspi.c
index c31a9e3c8a26..85f21b54cb7d 100644
--- a/drivers/message/fusion/mptspi.c
+++ b/drivers/message/fusion/mptspi.c
@@ -54,7 +54,6 @@
 #include <linux/delay.h>        /* for mdelay */
 #include <linux/interrupt.h>    /* needed for in_interrupt() proto */
 #include <linux/reboot.h>       /* notifier code */
-#include <linux/sched.h>
 #include <linux/workqueue.h>
 #include <linux/raid_class.h>
 
diff --git a/drivers/misc/tifm_7xx1.c b/drivers/misc/tifm_7xx1.c
index e21e490fedb0..bc60e2fc3c2c 100644
--- a/drivers/misc/tifm_7xx1.c
+++ b/drivers/misc/tifm_7xx1.c
@@ -367,7 +367,7 @@ static int tifm_7xx1_probe(struct pci_dev *dev,
         if (!fm->addr)
                 goto err_out_free;
 
-        rc = request_irq(dev->irq, tifm_7xx1_isr, SA_SHIRQ, DRIVER_NAME, fm);
+        rc = request_irq(dev->irq, tifm_7xx1_isr, IRQF_SHARED, DRIVER_NAME, fm);
         if (rc)
                 goto err_out_unmap;
 
diff --git a/drivers/mmc/mmc_block.c b/drivers/mmc/mmc_block.c
index 05ba8ace70e7..86439a0bb271 100644
--- a/drivers/mmc/mmc_block.c
+++ b/drivers/mmc/mmc_block.c
@@ -20,7 +20,6 @@
 #include <linux/module.h>
 #include <linux/init.h>
 
-#include <linux/sched.h>
 #include <linux/kernel.h>
 #include <linux/fs.h>
 #include <linux/errno.h>
diff --git a/drivers/mtd/chips/cfi_util.c b/drivers/mtd/chips/cfi_util.c
index d8e7a026ba5a..2e51496c248e 100644
--- a/drivers/mtd/chips/cfi_util.c
+++ b/drivers/mtd/chips/cfi_util.c
@@ -14,7 +14,6 @@
 #include <linux/module.h>
 #include <linux/types.h>
 #include <linux/kernel.h>
-#include <linux/sched.h>
 #include <asm/io.h>
 #include <asm/byteorder.h>
 
diff --git a/drivers/mtd/devices/doc2001.c b/drivers/mtd/devices/doc2001.c
index 0e2a9326f717..fe71a12c2627 100644
--- a/drivers/mtd/devices/doc2001.c
+++ b/drivers/mtd/devices/doc2001.c
@@ -16,7 +16,6 @@
 #include <linux/pci.h>
 #include <linux/delay.h>
 #include <linux/slab.h>
-#include <linux/sched.h>
 #include <linux/init.h>
 #include <linux/types.h>
 #include <linux/bitops.h>
diff --git a/drivers/mtd/devices/doc2001plus.c b/drivers/mtd/devices/doc2001plus.c
index 92dbb47f2ac3..ba4db686285a 100644
--- a/drivers/mtd/devices/doc2001plus.c
+++ b/drivers/mtd/devices/doc2001plus.c
@@ -20,7 +20,6 @@
 #include <linux/pci.h>
 #include <linux/delay.h>
 #include <linux/slab.h>
-#include <linux/sched.h>
 #include <linux/init.h>
 #include <linux/types.h>
 #include <linux/bitops.h>
diff --git a/drivers/mtd/devices/docecc.c b/drivers/mtd/devices/docecc.c
index cd3db72bef96..52b5d638077f 100644
--- a/drivers/mtd/devices/docecc.c
+++ b/drivers/mtd/devices/docecc.c
@@ -32,7 +32,6 @@
 #include <linux/pci.h>
 #include <linux/delay.h>
 #include <linux/slab.h>
-#include <linux/sched.h>
 #include <linux/init.h>
 #include <linux/types.h>
 
diff --git a/drivers/mtd/devices/pmc551.c b/drivers/mtd/devices/pmc551.c
index 354e1657cc26..a4873ab84e6b 100644
--- a/drivers/mtd/devices/pmc551.c
+++ b/drivers/mtd/devices/pmc551.c
@@ -86,7 +86,6 @@
 #include <linux/module.h>
 #include <asm/uaccess.h>
 #include <linux/types.h>
-#include <linux/sched.h>
 #include <linux/init.h>
 #include <linux/ptrace.h>
 #include <linux/slab.h>
diff --git a/drivers/mtd/devices/slram.c b/drivers/mtd/devices/slram.c
index 5f49248a4856..d293add1857c 100644
--- a/drivers/mtd/devices/slram.c
+++ b/drivers/mtd/devices/slram.c
@@ -35,7 +35,6 @@
 #include <asm/uaccess.h>
 #include <linux/types.h>
 #include <linux/kernel.h>
-#include <linux/sched.h>
 #include <linux/ptrace.h>
 #include <linux/slab.h>
 #include <linux/string.h>
diff --git a/drivers/mtd/ftl.c b/drivers/mtd/ftl.c
index 24235d4f1d23..c815d0f38577 100644
--- a/drivers/mtd/ftl.c
+++ b/drivers/mtd/ftl.c
@@ -61,7 +61,6 @@
 /*#define PSYCHO_DEBUG */
 
 #include <linux/kernel.h>
-#include <linux/sched.h>
 #include <linux/ptrace.h>
 #include <linux/slab.h>
 #include <linux/string.h>
diff --git a/drivers/mtd/inftlmount.c b/drivers/mtd/inftlmount.c
index 8f6006f1a519..acf3ba223298 100644
--- a/drivers/mtd/inftlmount.c
+++ b/drivers/mtd/inftlmount.c
@@ -34,7 +34,6 @@
 #include <linux/pci.h>
 #include <linux/delay.h>
 #include <linux/slab.h>
-#include <linux/sched.h>
 #include <linux/init.h>
 #include <linux/mtd/mtd.h>
 #include <linux/mtd/nftl.h>
diff --git a/drivers/mtd/mtdcore.c b/drivers/mtd/mtdcore.c
index 7070110aba2a..c153b64a8300 100644
--- a/drivers/mtd/mtdcore.c
+++ b/drivers/mtd/mtdcore.c
@@ -8,7 +8,6 @@
 
 #include <linux/module.h>
 #include <linux/kernel.h>
-#include <linux/sched.h>
 #include <linux/ptrace.h>
 #include <linux/slab.h>
 #include <linux/string.h>
diff --git a/drivers/mtd/nand/cafe.c b/drivers/mtd/nand/cafe.c
index 65f9bd3ceebf..08cb060dfa3d 100644
--- a/drivers/mtd/nand/cafe.c
+++ b/drivers/mtd/nand/cafe.c
@@ -597,7 +597,8 @@ static int __devinit cafe_nand_probe(struct pci_dev *pdev,
                 cafe_writel(cafe, 0xffffffff, NAND_TIMING3);
         }
         cafe_writel(cafe, 0xffffffff, NAND_IRQ_MASK);
-        err = request_irq(pdev->irq, &cafe_nand_interrupt, SA_SHIRQ, "CAFE NAND", mtd);
+        err = request_irq(pdev->irq, &cafe_nand_interrupt, IRQF_SHARED,
+                          "CAFE NAND", mtd);
         if (err) {
                 dev_warn(&pdev->dev, "Could not register IRQ %d\n", pdev->irq);
 
diff --git a/drivers/mtd/nftlcore.c b/drivers/mtd/nftlcore.c
index 4b1ba4fcfcd3..e6ef7d7f9f14 100644
--- a/drivers/mtd/nftlcore.c
+++ b/drivers/mtd/nftlcore.c
@@ -20,7 +20,6 @@
 #include <linux/pci.h>
 #include <linux/delay.h>
 #include <linux/slab.h>
-#include <linux/sched.h>
 #include <linux/init.h>
 #include <linux/hdreg.h>
 
diff --git a/drivers/net/7990.c b/drivers/net/7990.c
index 2d5ba076471c..1b3d11ed6cff 100644
--- a/drivers/net/7990.c
+++ b/drivers/net/7990.c
@@ -500,7 +500,7 @@ int lance_open (struct net_device *dev)
         int res;
 
         /* Install the Interrupt handler. Or we could shunt this out to specific drivers? */
-        if (request_irq(lp->irq, lance_interrupt, SA_SHIRQ, lp->name, dev))
+        if (request_irq(lp->irq, lance_interrupt, IRQF_SHARED, lp->name, dev))
                 return -EAGAIN;
 
         res = lance_reset(dev);
diff --git a/drivers/net/arm/ether1.c b/drivers/net/arm/ether1.c
index d6da3ce9ad79..a2921882eba8 100644
--- a/drivers/net/arm/ether1.c
+++ b/drivers/net/arm/ether1.c
@@ -33,7 +33,6 @@
 
 #include <linux/module.h>
 #include <linux/kernel.h>
-#include <linux/sched.h>
 #include <linux/types.h>
 #include <linux/fcntl.h>
 #include <linux/interrupt.h>
diff --git a/drivers/net/arm/ether3.c b/drivers/net/arm/ether3.c
index 4fc234785d56..841178343a07 100644
--- a/drivers/net/arm/ether3.c
+++ b/drivers/net/arm/ether3.c
@@ -48,7 +48,6 @@
 
 #include <linux/module.h>
 #include <linux/kernel.h>
-#include <linux/sched.h>
 #include <linux/types.h>
 #include <linux/fcntl.h>
 #include <linux/interrupt.h>
diff --git a/drivers/net/arm/etherh.c b/drivers/net/arm/etherh.c
index 72c41f5907f2..61f574aa3a99 100644
--- a/drivers/net/arm/etherh.c
+++ b/drivers/net/arm/etherh.c
@@ -28,7 +28,6 @@
 
 #include <linux/module.h>
 #include <linux/kernel.h>
-#include <linux/sched.h>
 #include <linux/types.h>
 #include <linux/fcntl.h>
 #include <linux/interrupt.h>
diff --git a/drivers/net/au1000_eth.c b/drivers/net/au1000_eth.c
index f0b6879a1c7d..69ae229b680e 100644
--- a/drivers/net/au1000_eth.c
+++ b/drivers/net/au1000_eth.c
@@ -37,7 +37,6 @@
 
 #include <linux/module.h>
 #include <linux/kernel.h>
-#include <linux/sched.h>
 #include <linux/string.h>
 #include <linux/timer.h>
 #include <linux/errno.h>
diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
index 61a6fa465d71..a7c8f98a890c 100644
--- a/drivers/net/bonding/bond_main.c
+++ b/drivers/net/bonding/bond_main.c
@@ -35,7 +35,6 @@
 
 #include <linux/kernel.h>
 #include <linux/module.h>
-#include <linux/sched.h>
 #include <linux/types.h>
 #include <linux/fcntl.h>
 #include <linux/interrupt.h>
diff --git a/drivers/net/bonding/bond_sysfs.c b/drivers/net/bonding/bond_sysfs.c
index 878f7aabeeac..a122baa5c7bb 100644
--- a/drivers/net/bonding/bond_sysfs.c
+++ b/drivers/net/bonding/bond_sysfs.c
@@ -22,7 +22,6 @@
  */
 #include <linux/kernel.h>
 #include <linux/module.h>
-#include <linux/sched.h>
 #include <linux/device.h>
 #include <linux/sysdev.h>
 #include <linux/fs.h>
diff --git a/drivers/net/cris/eth_v10.c b/drivers/net/cris/eth_v10.c
index a03d781f6d0a..8eb571276000 100644
--- a/drivers/net/cris/eth_v10.c
+++ b/drivers/net/cris/eth_v10.c
@@ -222,7 +222,6 @@
 #include <linux/module.h>
 
 #include <linux/kernel.h>
-#include <linux/sched.h>
 #include <linux/delay.h>
 #include <linux/types.h>
 #include <linux/fcntl.h>
diff --git a/drivers/net/cxgb3/cxgb3_main.c b/drivers/net/cxgb3/cxgb3_main.c
index c67f7d3c2f92..43583ed655ab 100644
--- a/drivers/net/cxgb3/cxgb3_main.c
+++ b/drivers/net/cxgb3/cxgb3_main.c
@@ -757,7 +757,8 @@ static int cxgb_up(struct adapter *adap)
                                       t3_intr_handler(adap,
                                                       adap->sge.qs[0].rspq.
                                                       polling),
-                                      (adap->flags & USING_MSI) ? 0 : SA_SHIRQ,
+                                      (adap->flags & USING_MSI) ?
+                                       0 : IRQF_SHARED,
                                       adap->name, adap)))
                 goto irq_err;
 
diff --git a/drivers/net/ehea/ehea_main.c b/drivers/net/ehea/ehea_main.c
index 1ef3846a5ea0..88ad1c8bcee4 100644
--- a/drivers/net/ehea/ehea_main.c
+++ b/drivers/net/ehea/ehea_main.c
@@ -888,7 +888,7 @@ static int ehea_reg_interrupts(struct net_device *dev)
                          , "%s-recv%d", dev->name, i);
                 ret = ibmebus_request_irq(NULL, pr->recv_eq->attr.ist1,
                                           ehea_recv_irq_handler,
-                                          SA_INTERRUPT, pr->int_recv_name, pr);
+                                          IRQF_DISABLED, pr->int_recv_name, pr);
                 if (ret) {
                         ehea_error("failed registering irq for ehea_recv_int:"
                                    "port_res_nr:%d, ist=%X", i,
@@ -905,7 +905,7 @@ static int ehea_reg_interrupts(struct net_device *dev)
 
         ret = ibmebus_request_irq(NULL, port->qp_eq->attr.ist1,
                                   ehea_qp_aff_irq_handler,
-                                  SA_INTERRUPT, port->int_aff_name, port);
+                                  IRQF_DISABLED, port->int_aff_name, port);
         if (ret) {
                 ehea_error("failed registering irq for qp_aff_irq_handler:"
                            "ist=%X", port->qp_eq->attr.ist1);
@@ -922,7 +922,7 @@ static int ehea_reg_interrupts(struct net_device *dev)
                          "%s-send%d", dev->name, i);
                 ret = ibmebus_request_irq(NULL, pr->send_eq->attr.ist1,
                                           ehea_send_irq_handler,
-                                          SA_INTERRUPT, pr->int_send_name,
+                                          IRQF_DISABLED, pr->int_send_name,
                                           pr);
                 if (ret) {
                         ehea_error("failed registering irq for ehea_send "
@@ -2545,7 +2545,7 @@ static int __devinit ehea_probe(struct ibmebus_dev *dev,
                      (unsigned long)adapter);
 
         ret = ibmebus_request_irq(NULL, adapter->neq->attr.ist1,
-                                  ehea_interrupt_neq, SA_INTERRUPT,
+                                  ehea_interrupt_neq, IRQF_DISABLED,
                                   "ehea_neq", adapter);
         if (ret) {
                 dev_err(&dev->ofdev.dev, "requesting NEQ IRQ failed");
diff --git a/drivers/net/fec_8xx/fec_8xx-netta.c b/drivers/net/fec_8xx/fec_8xx-netta.c
index 790d9dbe42dd..e492eb84f948 100644
--- a/drivers/net/fec_8xx/fec_8xx-netta.c
+++ b/drivers/net/fec_8xx/fec_8xx-netta.c
@@ -4,7 +4,6 @@
 
 #include <linux/kernel.h>
 #include <linux/types.h>
-#include <linux/sched.h>
 #include <linux/string.h>
 #include <linux/ptrace.h>
 #include <linux/errno.h>
diff --git a/drivers/net/fec_8xx/fec_main.c b/drivers/net/fec_8xx/fec_main.c
index 8e7a56fadfd2..77f747a5afa7 100644
--- a/drivers/net/fec_8xx/fec_main.c
+++ b/drivers/net/fec_8xx/fec_main.c
@@ -13,7 +13,6 @@
 #include <linux/module.h>
 #include <linux/kernel.h>
 #include <linux/types.h>
-#include <linux/sched.h>
 #include <linux/string.h>
 #include <linux/ptrace.h>
 #include <linux/errno.h>
diff --git a/drivers/net/fec_8xx/fec_mii.c b/drivers/net/fec_8xx/fec_mii.c
index d3c16b85d9a4..e79700abf7b6 100644
--- a/drivers/net/fec_8xx/fec_mii.c
+++ b/drivers/net/fec_8xx/fec_mii.c
@@ -13,7 +13,6 @@
 #include <linux/module.h>
 #include <linux/types.h>
 #include <linux/kernel.h>
-#include <linux/sched.h>
 #include <linux/string.h>
 #include <linux/ptrace.h>
 #include <linux/errno.h>
diff --git a/drivers/net/fs_enet/fs_enet-main.c b/drivers/net/fs_enet/fs_enet-main.c
index 889d3a13e95e..4a05c14bf7ec 100644
--- a/drivers/net/fs_enet/fs_enet-main.c
+++ b/drivers/net/fs_enet/fs_enet-main.c
@@ -18,7 +18,6 @@
 #include <linux/module.h>
 #include <linux/kernel.h>
 #include <linux/types.h>
-#include <linux/sched.h>
 #include <linux/string.h>
 #include <linux/ptrace.h>
 #include <linux/errno.h>
diff --git a/drivers/net/fs_enet/mac-fcc.c b/drivers/net/fs_enet/mac-fcc.c
index 1ff2597b8495..8545e84fc9a0 100644
--- a/drivers/net/fs_enet/mac-fcc.c
+++ b/drivers/net/fs_enet/mac-fcc.c
@@ -15,7 +15,6 @@
 #include <linux/module.h>
 #include <linux/kernel.h>
 #include <linux/types.h>
-#include <linux/sched.h>
 #include <linux/string.h>
 #include <linux/ptrace.h>
 #include <linux/errno.h>
diff --git a/drivers/net/fs_enet/mac-fec.c b/drivers/net/fs_enet/mac-fec.c
index ff6839477306..cdcfb96f360f 100644
--- a/drivers/net/fs_enet/mac-fec.c
+++ b/drivers/net/fs_enet/mac-fec.c
@@ -15,7 +15,6 @@
 #include <linux/module.h>
 #include <linux/kernel.h>
 #include <linux/types.h>
-#include <linux/sched.h>
 #include <linux/string.h>
 #include <linux/ptrace.h>
 #include <linux/errno.h>
diff --git a/drivers/net/fs_enet/mac-scc.c b/drivers/net/fs_enet/mac-scc.c
index afd7fca7c6c4..65925b5a224f 100644
--- a/drivers/net/fs_enet/mac-scc.c
+++ b/drivers/net/fs_enet/mac-scc.c
@@ -15,7 +15,6 @@
 #include <linux/module.h>
 #include <linux/kernel.h>
 #include <linux/types.h>
-#include <linux/sched.h>
 #include <linux/string.h>
 #include <linux/ptrace.h>
 #include <linux/errno.h>
diff --git a/drivers/net/fs_enet/mii-bitbang.c b/drivers/net/fs_enet/mii-bitbang.c
index 0b9b8b5c847c..f91447837fd4 100644
--- a/drivers/net/fs_enet/mii-bitbang.c
+++ b/drivers/net/fs_enet/mii-bitbang.c
@@ -16,7 +16,6 @@
 #include <linux/module.h>
 #include <linux/types.h>
 #include <linux/kernel.h>
-#include <linux/sched.h>
 #include <linux/string.h>
 #include <linux/ptrace.h>
 #include <linux/errno.h>
diff --git a/drivers/net/fs_enet/mii-fec.c b/drivers/net/fs_enet/mii-fec.c
index baaae3dbf2e6..235b177fb9ac 100644
--- a/drivers/net/fs_enet/mii-fec.c
+++ b/drivers/net/fs_enet/mii-fec.c
@@ -15,7 +15,6 @@
 #include <linux/module.h>
 #include <linux/types.h>
 #include <linux/kernel.h>
-#include <linux/sched.h>
 #include <linux/string.h>
 #include <linux/ptrace.h>
 #include <linux/errno.h>
diff --git a/drivers/net/gianfar.c b/drivers/net/gianfar.c
index baa35144134c..1be4a84dce0e 100644
--- a/drivers/net/gianfar.c
+++ b/drivers/net/gianfar.c
@@ -65,7 +65,6 @@
  */
 
 #include <linux/kernel.h>
-#include <linux/sched.h>
 #include <linux/string.h>
 #include <linux/errno.h>
 #include <linux/unistd.h>
diff --git a/drivers/net/gianfar_ethtool.c b/drivers/net/gianfar_ethtool.c
index 0d6943d67096..7b411c1514db 100644
--- a/drivers/net/gianfar_ethtool.c
+++ b/drivers/net/gianfar_ethtool.c
@@ -16,7 +16,6 @@
  */
 
 #include <linux/kernel.h>
-#include <linux/sched.h>
 #include <linux/string.h>
 #include <linux/errno.h>
 #include <linux/slab.h>
diff --git a/drivers/net/gianfar_mii.c b/drivers/net/gianfar_mii.c
index ff684d4be96d..bcc6b82f4a33 100644
--- a/drivers/net/gianfar_mii.c
+++ b/drivers/net/gianfar_mii.c
@@ -17,7 +17,6 @@
  */
 
 #include <linux/kernel.h>
-#include <linux/sched.h>
 #include <linux/string.h>
 #include <linux/errno.h>
 #include <linux/unistd.h>
diff --git a/drivers/net/gianfar_sysfs.c b/drivers/net/gianfar_sysfs.c
index 6e2166a7601a..aec9ab17a9a5 100644
--- a/drivers/net/gianfar_sysfs.c
+++ b/drivers/net/gianfar_sysfs.c
@@ -20,7 +20,6 @@
  */
 
 #include <linux/kernel.h>
-#include <linux/sched.h>
 #include <linux/string.h>
 #include <linux/errno.h>
 #include <linux/unistd.h>
diff --git a/drivers/net/ibm_emac/ibm_emac_core.c b/drivers/net/ibm_emac/ibm_emac_core.c
index ffeafb28f782..dd8ad8746825 100644
--- a/drivers/net/ibm_emac/ibm_emac_core.c
+++ b/drivers/net/ibm_emac/ibm_emac_core.c
@@ -21,7 +21,6 @@
 
 #include <linux/module.h>
 #include <linux/kernel.h>
-#include <linux/sched.h>
 #include <linux/string.h>
 #include <linux/errno.h>
 #include <linux/interrupt.h>
diff --git a/drivers/net/irda/ma600-sir.c b/drivers/net/irda/ma600-sir.c
index ebed168b7da6..809906d94762 100644
--- a/drivers/net/irda/ma600-sir.c
+++ b/drivers/net/irda/ma600-sir.c
@@ -34,7 +34,6 @@
 #include <linux/module.h>
 #include <linux/delay.h>
 #include <linux/init.h>
-#include <linux/sched.h>
 
 #include <net/irda/irda.h>
 
diff --git a/drivers/net/macb.c b/drivers/net/macb.c
index e67361e2bf5d..a41418b3c518 100644
--- a/drivers/net/macb.c
+++ b/drivers/net/macb.c
@@ -1077,7 +1077,7 @@ static int __devinit macb_probe(struct platform_device *pdev)
         }
 
         dev->irq = platform_get_irq(pdev, 0);
-        err = request_irq(dev->irq, macb_interrupt, SA_SAMPLE_RANDOM,
+        err = request_irq(dev->irq, macb_interrupt, IRQF_SAMPLE_RANDOM,
                           dev->name, dev);
         if (err) {
                 printk(KERN_ERR
diff --git a/drivers/net/meth.c b/drivers/net/meth.c
index e1d97cdf649e..d38b7c723620 100644
--- a/drivers/net/meth.c
+++ b/drivers/net/meth.c
@@ -11,7 +11,6 @@
 #include <linux/module.h>
 #include <linux/init.h>
 
-#include <linux/sched.h>
 #include <linux/kernel.h> /* printk() */
 #include <linux/delay.h>
 #include <linux/slab.h>
diff --git a/drivers/net/mipsnet.c b/drivers/net/mipsnet.c
index c9469985bd71..f42b9e201937 100644
--- a/drivers/net/mipsnet.c
+++ b/drivers/net/mipsnet.c
@@ -10,7 +10,6 @@
 #include <linux/kernel.h>
 #include <linux/module.h>
 #include <linux/netdevice.h>
-#include <linux/sched.h>
 #include <linux/etherdevice.h>
 #include <linux/netdevice.h>
 #include <linux/platform_device.h>
diff --git a/drivers/net/netxen/netxen_nic_main.c b/drivers/net/netxen/netxen_nic_main.c
index c2da7ec0248a..225ff55527c4 100644
--- a/drivers/net/netxen/netxen_nic_main.c
+++ b/drivers/net/netxen/netxen_nic_main.c
@@ -620,8 +620,8 @@ static int netxen_nic_open(struct net_device *netdev)
                 }
                 adapter->irq = adapter->ahw.pdev->irq;
                 err = request_irq(adapter->ahw.pdev->irq, &netxen_intr,
-                                  SA_SHIRQ | SA_SAMPLE_RANDOM, netdev->name,
-                                  adapter);
+                                  IRQF_SHARED | IRQF_SAMPLE_RANDOM,
+                                  netdev->name, adapter);
                 if (err) {
                         printk(KERN_ERR "request_irq failed with: %d\n", err);
                         netxen_free_hw_resources(adapter);
diff --git a/drivers/net/phy/cicada.c b/drivers/net/phy/cicada.c
index ae60e6e4107c..a1bd599c8a5b 100644
--- a/drivers/net/phy/cicada.c
+++ b/drivers/net/phy/cicada.c
@@ -14,7 +14,6 @@
  *
  */
 #include <linux/kernel.h>
-#include <linux/sched.h>
 #include <linux/string.h>
 #include <linux/errno.h>
 #include <linux/unistd.h>
diff --git a/drivers/net/phy/davicom.c b/drivers/net/phy/davicom.c
index aa7983f55838..519baa38be8d 100644
--- a/drivers/net/phy/davicom.c
+++ b/drivers/net/phy/davicom.c
@@ -14,7 +14,6 @@
  *
  */
 #include <linux/kernel.h>
-#include <linux/sched.h>
 #include <linux/string.h>
 #include <linux/errno.h>
 #include <linux/unistd.h>
diff --git a/drivers/net/phy/fixed.c b/drivers/net/phy/fixed.c
index 86135397f430..66da91bb1388 100644
--- a/drivers/net/phy/fixed.c
+++ b/drivers/net/phy/fixed.c
@@ -14,7 +14,6 @@
  *
  */
 #include <linux/kernel.h>
-#include <linux/sched.h>
 #include <linux/string.h>
 #include <linux/errno.h>
 #include <linux/unistd.h>
diff --git a/drivers/net/phy/lxt.c b/drivers/net/phy/lxt.c
index 69d2325f848c..4cf3324ba166 100644
--- a/drivers/net/phy/lxt.c
+++ b/drivers/net/phy/lxt.c
@@ -14,7 +14,6 @@
  *
  */
 #include <linux/kernel.h>
-#include <linux/sched.h>
 #include <linux/string.h>
 #include <linux/errno.h>
 #include <linux/unistd.h>
diff --git a/drivers/net/phy/marvell.c b/drivers/net/phy/marvell.c
index 0ad253282d0d..f4d4eb659cad 100644
--- a/drivers/net/phy/marvell.c
+++ b/drivers/net/phy/marvell.c
@@ -14,7 +14,6 @@
  *
  */
 #include <linux/kernel.h>
-#include <linux/sched.h>
 #include <linux/string.h>
 #include <linux/errno.h>
 #include <linux/unistd.h>
diff --git a/drivers/net/phy/mdio_bus.c b/drivers/net/phy/mdio_bus.c
index cf6660c93ffa..b31ce278bf35 100644
--- a/drivers/net/phy/mdio_bus.c
+++ b/drivers/net/phy/mdio_bus.c
@@ -14,7 +14,6 @@
  *
  */
 #include <linux/kernel.h>
-#include <linux/sched.h>
 #include <linux/string.h>
 #include <linux/errno.h>
 #include <linux/unistd.h>
diff --git a/drivers/net/phy/phy.c b/drivers/net/phy/phy.c
index 9765fa661467..c94a1fb3a4be 100644
--- a/drivers/net/phy/phy.c
+++ b/drivers/net/phy/phy.c
@@ -16,7 +16,6 @@
  *
  */
 #include <linux/kernel.h>
-#include <linux/sched.h>
 #include <linux/string.h>
 #include <linux/errno.h>
 #include <linux/unistd.h>
diff --git a/drivers/net/phy/phy_device.c b/drivers/net/phy/phy_device.c
index deda210c844e..7d5b6d1838c8 100644
--- a/drivers/net/phy/phy_device.c
+++ b/drivers/net/phy/phy_device.c
@@ -15,7 +15,6 @@
  *
  */
 #include <linux/kernel.h>
-#include <linux/sched.h>
 #include <linux/string.h>
 #include <linux/errno.h>
 #include <linux/unistd.h>
diff --git a/drivers/net/phy/qsemi.c b/drivers/net/phy/qsemi.c
index 2b50e1739aa5..23062d067231 100644
--- a/drivers/net/phy/qsemi.c
+++ b/drivers/net/phy/qsemi.c
@@ -14,7 +14,6 @@
  *
  */
 #include <linux/kernel.h>
-#include <linux/sched.h>
 #include <linux/string.h>
 #include <linux/errno.h>
 #include <linux/unistd.h>
diff --git a/drivers/net/qla3xxx.c b/drivers/net/qla3xxx.c
index 2429b274f0b0..a142cdfd947b 100755
--- a/drivers/net/qla3xxx.c
+++ b/drivers/net/qla3xxx.c
@@ -3228,7 +3228,7 @@ static int ql_adapter_up(struct ql3_adapter *qdev)
 {
         struct net_device *ndev = qdev->ndev;
         int err;
-        unsigned long irq_flags = SA_SAMPLE_RANDOM | SA_SHIRQ;
+        unsigned long irq_flags = IRQF_SAMPLE_RANDOM | IRQF_SHARED;
         unsigned long hw_flags;
 
         if (ql_alloc_mem_resources(qdev)) {
@@ -3247,7 +3247,7 @@ static int ql_adapter_up(struct ql3_adapter *qdev)
                 } else {
                         printk(KERN_INFO PFX "%s: MSI Enabled...\n", qdev->ndev->name);
                         set_bit(QL_MSI_ENABLED,&qdev->flags);
-                        irq_flags &= ~SA_SHIRQ;
+                        irq_flags &= ~IRQF_SHARED;
                 }
         }
 
diff --git a/drivers/net/s2io.c b/drivers/net/s2io.c
index 8646b64994ab..e8e0d94e9bdd 100644
--- a/drivers/net/s2io.c
+++ b/drivers/net/s2io.c
@@ -59,7 +59,6 @@
 #include <linux/stddef.h>
 #include <linux/ioctl.h>
 #include <linux/timex.h>
-#include <linux/sched.h>
 #include <linux/ethtool.h>
 #include <linux/workqueue.h>
 #include <linux/if_vlan.h>
diff --git a/drivers/net/sc92031.c b/drivers/net/sc92031.c
index 7f800feaa9a2..4a926f20b6ea 100644
--- a/drivers/net/sc92031.c
+++ b/drivers/net/sc92031.c
@@ -1035,7 +1035,7 @@ static int sc92031_open(struct net_device *dev)
         priv->tx_head = priv->tx_tail = 0;
 
         err = request_irq(pdev->irq, sc92031_interrupt,
-                        SA_SHIRQ, dev->name, dev);
+                        IRQF_SHARED, dev->name, dev);
         if (unlikely(err < 0))
                 goto out_request_irq;
 
diff --git a/drivers/net/sungem_phy.c b/drivers/net/sungem_phy.c
index d21991ee88c4..701ba4f3b69d 100644
--- a/drivers/net/sungem_phy.c
+++ b/drivers/net/sungem_phy.c
@@ -22,7 +22,6 @@
 #include <linux/module.h>
 
 #include <linux/kernel.h>
-#include <linux/sched.h>
 #include <linux/types.h>
 #include <linux/netdevice.h>
 #include <linux/etherdevice.h>
diff --git a/drivers/net/tg3.c b/drivers/net/tg3.c
index e136bae61970..81a1c2e1a3f5 100644
--- a/drivers/net/tg3.c
+++ b/drivers/net/tg3.c
@@ -4,7 +4,7 @@
  * Copyright (C) 2001, 2002, 2003, 2004 David S. Miller (davem@redhat.com)
  * Copyright (C) 2001, 2002, 2003 Jeff Garzik (jgarzik@pobox.com)
  * Copyright (C) 2004 Sun Microsystems Inc.
- * Copyright (C) 2005 Broadcom Corporation.
+ * Copyright (C) 2005-2007 Broadcom Corporation.
  *
  * Firmware is:
  *      Derived from proprietary unpublished source code,
@@ -64,8 +64,8 @@
 
 #define DRV_MODULE_NAME         "tg3"
 #define PFX DRV_MODULE_NAME     ": "
-#define DRV_MODULE_VERSION      "3.72"
-#define DRV_MODULE_RELDATE      "January 8, 2007"
+#define DRV_MODULE_VERSION      "3.73"
+#define DRV_MODULE_RELDATE      "February 12, 2007"
 
 #define TG3_DEF_MAC_MODE        0
 #define TG3_DEF_RX_MODE         0
@@ -1175,8 +1175,18 @@ static void tg3_nvram_unlock(struct tg3 *);
 
 static void tg3_power_down_phy(struct tg3 *tp)
 {
-        if (tp->tg3_flags2 & TG3_FLG2_PHY_SERDES)
+        if (tp->tg3_flags2 & TG3_FLG2_PHY_SERDES) {
+                if (GET_ASIC_REV(tp->pci_chip_rev_id) == ASIC_REV_5704) {
+                        u32 sg_dig_ctrl = tr32(SG_DIG_CTRL);
+                        u32 serdes_cfg = tr32(MAC_SERDES_CFG);
+
+                        sg_dig_ctrl |=
+                                SG_DIG_USING_HW_AUTONEG | SG_DIG_SOFT_RESET;
+                        tw32(SG_DIG_CTRL, sg_dig_ctrl);
+                        tw32(MAC_SERDES_CFG, serdes_cfg | (1 << 15));
+                }
                 return;
+        }
 
         if (GET_ASIC_REV(tp->pci_chip_rev_id) == ASIC_REV_5906) {
                 u32 val;
@@ -1340,7 +1350,8 @@ static int tg3_set_power_state(struct tg3 *tp, pci_power_t state)
 
                 tw32_wait_f(TG3PCI_CLOCK_CTRL, base_val | CLOCK_CTRL_ALTCLK |
                             CLOCK_CTRL_PWRDOWN_PLL133, 40);
-        } else if (tp->tg3_flags2 & TG3_FLG2_5780_CLASS) {
+        } else if ((tp->tg3_flags2 & TG3_FLG2_5780_CLASS) ||
+                   (GET_ASIC_REV(tp->pci_chip_rev_id) == ASIC_REV_5906)) {
                 /* do nothing */
         } else if (!((tp->tg3_flags2 & TG3_FLG2_5750_PLUS) &&
                      (tp->tg3_flags & TG3_FLAG_ENABLE_ASF))) {
@@ -3724,13 +3735,23 @@ out:
         tg3_full_unlock(tp);
 }
 
+static void tg3_dump_short_state(struct tg3 *tp)
+{
+        printk(KERN_ERR PFX "DEBUG: MAC_TX_STATUS[%08x] MAC_RX_STATUS[%08x]\n",
+               tr32(MAC_TX_STATUS), tr32(MAC_RX_STATUS));
+        printk(KERN_ERR PFX "DEBUG: RDMAC_STATUS[%08x] WDMAC_STATUS[%08x]\n",
+               tr32(RDMAC_STATUS), tr32(WDMAC_STATUS));
+}
+
 static void tg3_tx_timeout(struct net_device *dev)
 {
         struct tg3 *tp = netdev_priv(dev);
 
-        if (netif_msg_tx_err(tp))
+        if (netif_msg_tx_err(tp)) {
                 printk(KERN_ERR PFX "%s: transmit timed out, resetting\n",
                        dev->name);
+                tg3_dump_short_state(tp);
+        }
 
         schedule_work(&tp->reset_task);
 }
@@ -6583,8 +6604,9 @@ static int tg3_reset_hw(struct tg3 *tp, int reset_phy)
                 u32 tmp;
 
                 /* Clear CRC stats. */
-                if (!tg3_readphy(tp, 0x1e, &tmp)) {
-                        tg3_writephy(tp, 0x1e, tmp | 0x8000);
+                if (!tg3_readphy(tp, MII_TG3_TEST1, &tmp)) {
+                        tg3_writephy(tp, MII_TG3_TEST1,
+                                     tmp | MII_TG3_TEST1_CRC_EN);
                         tg3_readphy(tp, 0x14, &tmp);
                 }
         }
@@ -7408,8 +7430,9 @@ static unsigned long calc_crc_errors(struct tg3 *tp)
                 u32 val;
 
                 spin_lock_bh(&tp->lock);
-                if (!tg3_readphy(tp, 0x1e, &val)) {
-                        tg3_writephy(tp, 0x1e, val | 0x8000);
+                if (!tg3_readphy(tp, MII_TG3_TEST1, &val)) {
+                        tg3_writephy(tp, MII_TG3_TEST1,
+                                     val | MII_TG3_TEST1_CRC_EN);
                         tg3_readphy(tp, 0x14, &val);
                 } else
                         val = 0;
@@ -10779,7 +10802,9 @@ static int __devinit tg3_get_invariants(struct tg3 *tp)
         if (tp->tg3_flags2 & TG3_FLG2_5705_PLUS) {
                 if (GET_ASIC_REV(tp->pci_chip_rev_id) == ASIC_REV_5755 ||
                     GET_ASIC_REV(tp->pci_chip_rev_id) == ASIC_REV_5787) {
-                        tp->tg3_flags2 |= TG3_FLG2_PHY_JITTER_BUG;
+                        if (tp->pdev->device != PCI_DEVICE_ID_TIGON3_5756 &&
+                            tp->pdev->device != PCI_DEVICE_ID_TIGON3_5722)
+                                tp->tg3_flags2 |= TG3_FLG2_PHY_JITTER_BUG;
                         if (tp->pdev->device == PCI_DEVICE_ID_TIGON3_5755M)
                                 tp->tg3_flags2 |= TG3_FLG2_PHY_ADJUST_TRIM;
                 } else if (GET_ASIC_REV(tp->pci_chip_rev_id) != ASIC_REV_5906)
@@ -11314,6 +11339,7 @@ static int __devinit tg3_test_dma(struct tg3 *tp)
                 if (GET_ASIC_REV(tp->pci_chip_rev_id) == ASIC_REV_5703 ||
                     GET_ASIC_REV(tp->pci_chip_rev_id) == ASIC_REV_5704) {
                         u32 ccval = (tr32(TG3PCI_CLOCK_CTRL) & 0x1f);
+                        u32 read_water = 0x7;
 
                         /* If the 5704 is behind the EPB bridge, we can
                          * do the less restrictive ONE_DMA workaround for
@@ -11325,8 +11351,13 @@ static int __devinit tg3_test_dma(struct tg3 *tp)
                         else if (ccval == 0x6 || ccval == 0x7)
                                 tp->dma_rwctrl |= DMA_RWCTRL_ONE_DMA;
 
+                        if (GET_ASIC_REV(tp->pci_chip_rev_id) == ASIC_REV_5703)
+                                read_water = 4;
                         /* Set bit 23 to enable PCIX hw bug fix */
-                        tp->dma_rwctrl |= 0x009f0000;
+                        tp->dma_rwctrl |=
+                                (read_water << DMA_RWCTRL_READ_WATER_SHIFT) |
+                                (0x3 << DMA_RWCTRL_WRITE_WATER_SHIFT) |
+                                (1 << 23);
                 } else if (GET_ASIC_REV(tp->pci_chip_rev_id) == ASIC_REV_5780) {
                         /* 5780 always in PCIX mode */
                         tp->dma_rwctrl |= 0x00144000;
@@ -12016,6 +12047,9 @@ static int tg3_suspend(struct pci_dev *pdev, pm_message_t state)
         tp->tg3_flags &= ~TG3_FLAG_INIT_COMPLETE;
         tg3_full_unlock(tp);
 
+        /* Save MSI address and data for resume.  */
+        pci_save_state(pdev);
+
         err = tg3_set_power_state(tp, pci_choose_state(pdev, state));
         if (err) {
                 tg3_full_lock(tp, 0);
diff --git a/drivers/net/tg3.h b/drivers/net/tg3.h
index 80f59ac7ec58..45d477e8f374 100644
--- a/drivers/net/tg3.h
+++ b/drivers/net/tg3.h
@@ -1660,6 +1660,7 @@
 
 #define MII_TG3_TEST1                   0x1e
 #define MII_TG3_TEST1_TRIM_EN           0x0010
+#define MII_TG3_TEST1_CRC_EN            0x8000
 
 /* There are two ways to manage the TX descriptors on the tigon3.
  * Either the descriptors are in host DMA'able memory, or they
diff --git a/drivers/net/tsi108_eth.c b/drivers/net/tsi108_eth.c
index 893808ab3742..d92c5c597e16 100644
--- a/drivers/net/tsi108_eth.c
+++ b/drivers/net/tsi108_eth.c
@@ -38,7 +38,6 @@
 #include <linux/etherdevice.h>
 #include <linux/skbuff.h>
 #include <linux/slab.h>
-#include <linux/sched.h>
 #include <linux/spinlock.h>
 #include <linux/delay.h>
 #include <linux/crc32.h>
diff --git a/drivers/net/ucc_geth.c b/drivers/net/ucc_geth.c
index 31c97a6591a4..a2fc2bbcf97f 100644
--- a/drivers/net/ucc_geth.c
+++ b/drivers/net/ucc_geth.c
@@ -3939,8 +3939,8 @@ static void ugeth_phy_startup_timer(unsigned long data)
         /* Grab the PHY interrupt, if necessary/possible */
         if (ugeth->ug_info->board_flags & FSL_UGETH_BRD_HAS_PHY_INTR) {
                 if (request_irq(ugeth->ug_info->phy_interrupt,
-                                phy_interrupt,
-                                SA_SHIRQ, "phy_interrupt", mii_info->dev) < 0) {
+                                phy_interrupt, IRQF_SHARED,
+                                "phy_interrupt", mii_info->dev) < 0) {
                         ugeth_err("%s: Can't get IRQ %d (PHY)",
                                   mii_info->dev->name,
                                   ugeth->ug_info->phy_interrupt);
diff --git a/drivers/net/ucc_geth_phy.c b/drivers/net/ucc_geth_phy.c
index 6fda6d88be49..9373d895b9ec 100644
--- a/drivers/net/ucc_geth_phy.c
+++ b/drivers/net/ucc_geth_phy.c
@@ -18,7 +18,6 @@
  */
 
 #include <linux/kernel.h>
-#include <linux/sched.h>
 #include <linux/string.h>
 #include <linux/errno.h>
 #include <linux/slab.h>
diff --git a/drivers/net/wan/cycx_drv.c b/drivers/net/wan/cycx_drv.c
index e6d005726aad..d347d59db656 100644
--- a/drivers/net/wan/cycx_drv.c
+++ b/drivers/net/wan/cycx_drv.c
@@ -53,7 +53,6 @@
 #include <linux/kernel.h>       /* printk(), and other useful stuff */
 #include <linux/stddef.h>       /* offsetof(), etc. */
 #include <linux/errno.h>        /* return codes */
-#include <linux/sched.h>        /* for jiffies, HZ, etc. */
 #include <linux/cycx_drv.h>     /* API definitions */
 #include <linux/cycx_cfm.h>     /* CYCX firmware module definitions */
 #include <linux/delay.h>        /* udelay, msleep_interruptible */
diff --git a/drivers/net/wan/pci200syn.c b/drivers/net/wan/pci200syn.c
index a6b9c33b68e4..ca06a00d9d86 100644
--- a/drivers/net/wan/pci200syn.c
+++ b/drivers/net/wan/pci200syn.c
@@ -17,7 +17,6 @@
 #include <linux/module.h>
 #include <linux/kernel.h>
 #include <linux/slab.h>
-#include <linux/sched.h>
 #include <linux/types.h>
 #include <linux/fcntl.h>
 #include <linux/in.h>
diff --git a/drivers/net/wireless/arlan-proc.c b/drivers/net/wireless/arlan-proc.c
index 5fa985435ffa..015abd928ab0 100644
--- a/drivers/net/wireless/arlan-proc.c
+++ b/drivers/net/wireless/arlan-proc.c
@@ -1216,7 +1216,7 @@ static ctl_table arlan_table[MAX_ARLANS + 1] =
 static ctl_table arlan_root_table[] =
 {
         {
-                .ctl_name       = 254,
+                .ctl_name       = CTL_ARLAN,
                 .procname       = "arlan",
                 .maxlen         = 0,
                 .mode           = 0555,
@@ -1244,7 +1244,7 @@ int __init init_arlan_proc(void)
                 return 0;
         for (i = 0; i < MAX_ARLANS && arlan_device[i]; i++)
                 arlan_table[i].ctl_name = i + 1;
-        arlan_device_sysctl_header = register_sysctl_table(arlan_root_table, 0);
+        arlan_device_sysctl_header = register_sysctl_table(arlan_root_table);
         if (!arlan_device_sysctl_header)
                 return -1;
 
diff --git a/drivers/net/wireless/atmel.c b/drivers/net/wireless/atmel.c
index 10bcb48e80d0..23eba698aec5 100644
--- a/drivers/net/wireless/atmel.c
+++ b/drivers/net/wireless/atmel.c
@@ -42,7 +42,6 @@
 #include <linux/init.h>
 
 #include <linux/kernel.h>
-#include <linux/sched.h>
 #include <linux/ptrace.h>
 #include <linux/slab.h>
 #include <linux/string.h>
diff --git a/drivers/net/wireless/bcm43xx/bcm43xx_wx.c b/drivers/net/wireless/bcm43xx/bcm43xx_wx.c
index 6961be682c9d..7b665e2386a8 100644
--- a/drivers/net/wireless/bcm43xx/bcm43xx_wx.c
+++ b/drivers/net/wireless/bcm43xx/bcm43xx_wx.c
@@ -33,7 +33,6 @@
 #include <net/ieee80211softmac.h>
 #include <net/ieee80211softmac_wx.h>
 #include <linux/capability.h>
-#include <linux/sched.h> /* for capable() */
 #include <linux/delay.h>
 
 #include "bcm43xx.h"
diff --git a/drivers/parisc/eisa.c b/drivers/parisc/eisa.c
index e97cecbc4d18..309076b39853 100644
--- a/drivers/parisc/eisa.c
+++ b/drivers/parisc/eisa.c
@@ -33,7 +33,6 @@
 #include <linux/kernel.h>
 #include <linux/module.h>
 #include <linux/pci.h>
-#include <linux/sched.h>
 #include <linux/spinlock.h>
 #include <linux/eisa.h>
 
diff --git a/drivers/parport/parport_cs.c b/drivers/parport/parport_cs.c
index e60b4bf6bae8..316c06f4423c 100644
--- a/drivers/parport/parport_cs.c
+++ b/drivers/parport/parport_cs.c
@@ -37,7 +37,6 @@
 #include <linux/kernel.h>
 #include <linux/module.h>
 #include <linux/init.h>
-#include <linux/sched.h>
 #include <linux/ptrace.h>
 #include <linux/slab.h>
 #include <linux/string.h>
diff --git a/drivers/parport/parport_gsc.c b/drivers/parport/parport_gsc.c
index a7c5ead9a3d3..17bf9937d276 100644
--- a/drivers/parport/parport_gsc.c
+++ b/drivers/parport/parport_gsc.c
@@ -23,7 +23,6 @@
 
 #include <linux/module.h>
 #include <linux/init.h>
-#include <linux/sched.h>
 #include <linux/delay.h>
 #include <linux/errno.h>
 #include <linux/interrupt.h>
diff --git a/drivers/parport/procfs.c b/drivers/parport/procfs.c
index 2e744a274517..bdbdab9285ca 100644
--- a/drivers/parport/procfs.c
+++ b/drivers/parport/procfs.c
@@ -233,12 +233,12 @@ static int do_hardware_modes (ctl_table *table, int write,
         return copy_to_user(result, buffer, len) ? -EFAULT : 0;
 }
 
-#define PARPORT_PORT_DIR(child) { 0, NULL, NULL, 0, 0555, child }
-#define PARPORT_PARPORT_DIR(child) { DEV_PARPORT, "parport", \
-                                     NULL, 0, 0555, child }
-#define PARPORT_DEV_DIR(child) { CTL_DEV, "dev", NULL, 0, 0555, child }
-#define PARPORT_DEVICES_ROOT_DIR  { DEV_PARPORT_DEVICES, "devices", \
-                                    NULL, 0, 0555, NULL }
+#define PARPORT_PORT_DIR(CHILD) { .ctl_name = 0, .procname = NULL, .mode = 0555, .child = CHILD }
+#define PARPORT_PARPORT_DIR(CHILD) { .ctl_name = DEV_PARPORT, .procname = "parport", \
+                                     .mode = 0555, .child = CHILD }
+#define PARPORT_DEV_DIR(CHILD) { .ctl_name = CTL_DEV, .procname = "dev", .mode = 0555, .child = CHILD }
+#define PARPORT_DEVICES_ROOT_DIR  { .ctl_name = DEV_PARPORT_DEVICES, .procname = "devices", \
+                                    .mode = 0555, .child = NULL }
 
 static const unsigned long parport_min_timeslice_value =
 PARPORT_MIN_TIMESLICE_VALUE;
@@ -263,50 +263,118 @@ struct parport_sysctl_table {
 };
 
 static const struct parport_sysctl_table parport_sysctl_template = {
-        NULL,
+        .sysctl_header = NULL,
         {
-                { DEV_PARPORT_SPINTIME, "spintime",
-                  NULL, sizeof(int), 0644, NULL,
-                  &proc_dointvec_minmax, NULL, NULL,
-                  (void*) &parport_min_spintime_value,
-                  (void*) &parport_max_spintime_value },
-                { DEV_PARPORT_BASE_ADDR, "base-addr",
-                  NULL, 0, 0444, NULL,
-                  &do_hardware_base_addr },
-                { DEV_PARPORT_IRQ, "irq",
-                  NULL, 0, 0444, NULL,
-                  &do_hardware_irq },
-                { DEV_PARPORT_DMA, "dma",
-                  NULL, 0, 0444, NULL,
-                  &do_hardware_dma },
-                { DEV_PARPORT_MODES, "modes",
-                  NULL, 0, 0444, NULL,
-                  &do_hardware_modes },
+                {
+                        .ctl_name       = DEV_PARPORT_SPINTIME,
+                        .procname       = "spintime",
+                        .data           = NULL,
+                        .maxlen         = sizeof(int),
+                        .mode           = 0644,
+                        .proc_handler   = &proc_dointvec_minmax,
+                        .extra1         = (void*) &parport_min_spintime_value,
+                        .extra2         = (void*) &parport_max_spintime_value
+                },
+                {
+                        .ctl_name       = DEV_PARPORT_BASE_ADDR,
+                        .procname       = "base-addr",
+                        .data           = NULL,
+                        .maxlen         = 0,
+                        .mode           = 0444,
+                        .proc_handler   = &do_hardware_base_addr
+                },
+                {
+                        .ctl_name       = DEV_PARPORT_IRQ,
+                        .procname       = "irq",
+                        .data           = NULL,
+                        .maxlen         = 0,
+                        .mode           = 0444,
+                        .proc_handler   = &do_hardware_irq
+                },
+                {
+                        .ctl_name       = DEV_PARPORT_DMA,
+                        .procname       = "dma",
+                        .data           = NULL,
+                        .maxlen         = 0,
+                        .mode           = 0444,
+                        .proc_handler   = &do_hardware_dma
+                },
+                {
+                        .ctl_name       = DEV_PARPORT_MODES,
+                        .procname       = "modes",
+                        .data           = NULL,
+                        .maxlen         = 0,
+                        .mode           = 0444,
+                        .proc_handler   = &do_hardware_modes
+                },
                 PARPORT_DEVICES_ROOT_DIR,
 #ifdef CONFIG_PARPORT_1284
-                { DEV_PARPORT_AUTOPROBE, "autoprobe",
-                  NULL, 0, 0444, NULL,
-                  &do_autoprobe },
-                { DEV_PARPORT_AUTOPROBE + 1, "autoprobe0",
-                 NULL, 0, 0444, NULL,
-                 &do_autoprobe },
-                { DEV_PARPORT_AUTOPROBE + 2, "autoprobe1",
-                  NULL, 0, 0444, NULL,
-                  &do_autoprobe },
-                { DEV_PARPORT_AUTOPROBE + 3, "autoprobe2",
-                  NULL, 0, 0444, NULL,
-                  &do_autoprobe },
-                { DEV_PARPORT_AUTOPROBE + 4, "autoprobe3",
-                  NULL, 0, 0444, NULL,
-                  &do_autoprobe },
+                {
+                        .ctl_name       = DEV_PARPORT_AUTOPROBE,
+                        .procname       = "autoprobe",
+                        .data           = NULL,
+                        .maxlen         = 0,
+                        .mode           = 0444,
+                        .proc_handler   = &do_autoprobe
+                },
+                {
+                        .ctl_name       = DEV_PARPORT_AUTOPROBE + 1,
+                        .procname       = "autoprobe0",
+                        .data           = NULL,
+                        .maxlen         = 0,
+                        .mode           = 0444,
+                        .proc_handler   =  &do_autoprobe
+                },
+                {
+                        .ctl_name       = DEV_PARPORT_AUTOPROBE + 2,
+                        .procname       = "autoprobe1",
+                        .data           = NULL,
+                        .maxlen         = 0,
+                        .mode           = 0444,
+                        .proc_handler   = &do_autoprobe
+                },
+                {
+                        .ctl_name       = DEV_PARPORT_AUTOPROBE + 3,
+                        .procname       = "autoprobe2",
+                        .data           = NULL,
+                        .maxlen         = 0,
+                        .mode           = 0444,
+                        .proc_handler   = &do_autoprobe
+                },
+                {
+                        .ctl_name       = DEV_PARPORT_AUTOPROBE + 4,
+                        .procname       = "autoprobe3",
+                        .data           = NULL,
+                        .maxlen         = 0,
+                        .mode           = 0444,
+                        .proc_handler   = &do_autoprobe
+                },
 #endif /* IEEE 1284 support */
-                {0}
+                {}
         },
-        { {DEV_PARPORT_DEVICES_ACTIVE, "active", NULL, 0, 0444, NULL,
-          &do_active_device }, {0}},
-        { PARPORT_PORT_DIR(NULL), {0}},
-        { PARPORT_PARPORT_DIR(NULL), {0}},
-        { PARPORT_DEV_DIR(NULL), {0}}
+        {
+                {
+                        .ctl_name       = DEV_PARPORT_DEVICES_ACTIVE,
+                        .procname       = "active",
+                        .data           = NULL,
+                        .maxlen         = 0,
+                        .mode           = 0444,
+                        .proc_handler   = &do_active_device
+                },
+                {}
+        },
+        {
+                PARPORT_PORT_DIR(NULL),
+                {}
+        },
+        {
+                PARPORT_PARPORT_DIR(NULL),
+                {}
+        },
+        {
+                PARPORT_DEV_DIR(NULL),
+                {}
+        }
 };
 
 struct parport_device_sysctl_table
@@ -322,19 +390,46 @@ struct parport_device_sysctl_table
 
 static const struct parport_device_sysctl_table
 parport_device_sysctl_template = {
-        NULL,
+        .sysctl_header = NULL,
+        {
+                {
+                        .ctl_name       = DEV_PARPORT_DEVICE_TIMESLICE,
+                        .procname       = "timeslice",
+                        .data           = NULL,
+                        .maxlen         = sizeof(int),
+                        .mode           = 0644,
+                        .proc_handler   = &proc_doulongvec_ms_jiffies_minmax,
+                        .extra1         = (void*) &parport_min_timeslice_value,
+                        .extra2         = (void*) &parport_max_timeslice_value
+                },
+        },
+        {
+                {
+                        .ctl_name       = 0,
+                        .procname       = NULL,
+                        .data           = NULL,
+                        .maxlen         = 0,
+                        .mode           = 0555,
+                        .child          = NULL
+                },
+                {}
+        },
         {
-                { DEV_PARPORT_DEVICE_TIMESLICE, "timeslice",
-                  NULL, sizeof(int), 0644, NULL,
-                  &proc_doulongvec_ms_jiffies_minmax, NULL, NULL,
-                  (void*) &parport_min_timeslice_value,
-                  (void*) &parport_max_timeslice_value },
+                PARPORT_DEVICES_ROOT_DIR,
+                {}
+        },
+        {
+                PARPORT_PORT_DIR(NULL),
+                {}
         },
-        { {0, NULL, NULL, 0, 0555, NULL}, {0}},
-        { PARPORT_DEVICES_ROOT_DIR, {0}},
-        { PARPORT_PORT_DIR(NULL), {0}},
-        { PARPORT_PARPORT_DIR(NULL), {0}},
-        { PARPORT_DEV_DIR(NULL), {0}}
+        {
+                PARPORT_PARPORT_DIR(NULL),
+                {}
+        },
+        {
+                PARPORT_DEV_DIR(NULL),
+                {}
+        }
 };
 
 struct parport_default_sysctl_table
@@ -351,28 +446,47 @@ extern int parport_default_spintime;
 
 static struct parport_default_sysctl_table
 parport_default_sysctl_table = {
-        NULL,
+        .sysctl_header  = NULL,
+        {
+                {
+                        .ctl_name       = DEV_PARPORT_DEFAULT_TIMESLICE,
+                        .procname       = "timeslice",
+                        .data           = &parport_default_timeslice,
+                        .maxlen         = sizeof(parport_default_timeslice),
+                        .mode           = 0644,
+                        .proc_handler   = &proc_doulongvec_ms_jiffies_minmax,
+                        .extra1         = (void*) &parport_min_timeslice_value,
+                        .extra2         = (void*) &parport_max_timeslice_value
+                },
+                {
+                        .ctl_name       = DEV_PARPORT_DEFAULT_SPINTIME,
+                        .procname       = "spintime",
+                        .data           = &parport_default_spintime,
+                        .maxlen         = sizeof(parport_default_spintime),
+                        .mode           = 0644,
+                        .proc_handler   = &proc_dointvec_minmax,
+                        .extra1         = (void*) &parport_min_spintime_value,
+                        .extra2         = (void*) &parport_max_spintime_value
+                },
+                {}
+        },
         {
-                { DEV_PARPORT_DEFAULT_TIMESLICE, "timeslice",
-                  &parport_default_timeslice,
-                  sizeof(parport_default_timeslice), 0644, NULL,
-                  &proc_doulongvec_ms_jiffies_minmax, NULL, NULL,
-                  (void*) &parport_min_timeslice_value,
-                  (void*) &parport_max_timeslice_value },
-                { DEV_PARPORT_DEFAULT_SPINTIME, "spintime",
-                  &parport_default_spintime,
-                  sizeof(parport_default_spintime), 0644, NULL,
-                  &proc_dointvec_minmax, NULL, NULL,
-                  (void*) &parport_min_spintime_value,
-                  (void*) &parport_max_spintime_value },
-                {0}
+                {
+                        .ctl_name       = DEV_PARPORT_DEFAULT,
+                        .procname       = "default",
+                        .mode           = 0555,
+                        .child          = parport_default_sysctl_table.vars
+                },
+                {}
         },
-        { { DEV_PARPORT_DEFAULT, "default", NULL, 0, 0555,
-            parport_default_sysctl_table.vars },{0}},
         {
-        PARPORT_PARPORT_DIR(parport_default_sysctl_table.default_dir), 
-        {0}},
-        { PARPORT_DEV_DIR(parport_default_sysctl_table.parport_dir), {0}}
+                PARPORT_PARPORT_DIR(parport_default_sysctl_table.default_dir),
+                {}
+        },
+        {
+                PARPORT_DEV_DIR(parport_default_sysctl_table.parport_dir),
+                {}
+        }
 };
 
 
@@ -404,7 +518,7 @@ int parport_proc_register(struct parport *port)
         t->parport_dir[0].child = t->port_dir;
         t->dev_dir[0].child = t->parport_dir;
 
-        t->sysctl_header = register_sysctl_table(t->dev_dir, 0);
+        t->sysctl_header = register_sysctl_table(t->dev_dir);
         if (t->sysctl_header == NULL) {
                 kfree(t);
                 t = NULL;
@@ -460,7 +574,7 @@ int parport_device_proc_register(struct pardevice *device)
         t->device_dir[0].child = t->vars;
         t->vars[0].data = &device->timeslice;
 
-        t->sysctl_header = register_sysctl_table(t->dev_dir, 0);
+        t->sysctl_header = register_sysctl_table(t->dev_dir);
         if (t->sysctl_header == NULL) {
                 kfree(t);
                 t = NULL;
@@ -483,7 +597,7 @@ int parport_device_proc_unregister(struct pardevice *device)
 static int __init parport_default_proc_register(void)
 {
         parport_default_sysctl_table.sysctl_header =
-                register_sysctl_table(parport_default_sysctl_table.dev_dir, 0);
+                register_sysctl_table(parport_default_sysctl_table.dev_dir);
         return 0;
 }
 
diff --git a/drivers/pci/hotplug/ibmphp_ebda.c b/drivers/pci/hotplug/ibmphp_ebda.c
index 05e4f5a1927a..600ed7b67ae7 100644
--- a/drivers/pci/hotplug/ibmphp_ebda.c
+++ b/drivers/pci/hotplug/ibmphp_ebda.c
@@ -28,7 +28,6 @@
  */
 
 #include <linux/module.h>
-#include <linux/sched.h>
 #include <linux/errno.h>
 #include <linux/mm.h>
 #include <linux/slab.h>
diff --git a/drivers/pci/pcie/aer/aerdrv.c b/drivers/pci/pcie/aer/aerdrv.c
index 6f5fabbd14e5..b164de050d4f 100644
--- a/drivers/pci/pcie/aer/aerdrv.c
+++ b/drivers/pci/pcie/aer/aerdrv.c
@@ -220,7 +220,7 @@ static int __devinit aer_probe (struct pcie_device *dev,
         }
 
         /* Request IRQ ISR */
-        if ((status = request_irq(dev->irq, aer_irq, SA_SHIRQ, "aerdrv",
+        if ((status = request_irq(dev->irq, aer_irq, IRQF_SHARED, "aerdrv",
                                 dev))) {
                 printk(KERN_DEBUG "%s: Request ISR fails on PCIE device[%s]\n",
                         __FUNCTION__, device->bus_id);
diff --git a/drivers/pci/syscall.c b/drivers/pci/syscall.c
index 87fafc08cb9d..9d37fec27f24 100644
--- a/drivers/pci/syscall.c
+++ b/drivers/pci/syscall.c
@@ -7,7 +7,6 @@
  * magic northbridge registers..
  */
 
-#include <linux/sched.h>
 #include <linux/errno.h>
 #include <linux/pci.h>
 #include <linux/smp_lock.h>
diff --git a/drivers/pcmcia/at91_cf.c b/drivers/pcmcia/at91_cf.c
index 3334f22a86c0..b31862837534 100644
--- a/drivers/pcmcia/at91_cf.c
+++ b/drivers/pcmcia/at91_cf.c
@@ -11,7 +11,6 @@
 
 #include <linux/module.h>
 #include <linux/kernel.h>
-#include <linux/sched.h>
 #include <linux/platform_device.h>
 #include <linux/errno.h>
 #include <linux/init.h>
diff --git a/drivers/pcmcia/cistpl.c b/drivers/pcmcia/cistpl.c
index 912c03e5eb0a..d154dee76e7f 100644
--- a/drivers/pcmcia/cistpl.c
+++ b/drivers/pcmcia/cistpl.c
@@ -21,7 +21,6 @@
 #include <linux/timer.h>
 #include <linux/slab.h>
 #include <linux/mm.h>
-#include <linux/sched.h>
 #include <linux/pci.h>
 #include <linux/ioport.h>
 #include <asm/io.h>
diff --git a/drivers/pcmcia/i82365.c b/drivers/pcmcia/i82365.c
index 72ff2f615b33..71b33707117f 100644
--- a/drivers/pcmcia/i82365.c
+++ b/drivers/pcmcia/i82365.c
@@ -40,7 +40,6 @@
 #include <linux/kernel.h>
 #include <linux/errno.h>
 #include <linux/timer.h>
-#include <linux/sched.h>
 #include <linux/slab.h>
 #include <linux/ioport.h>
 #include <linux/delay.h>
diff --git a/drivers/pcmcia/m32r_cfc.c b/drivers/pcmcia/m32r_cfc.c
index 3c22ac4625c2..e4a94108aab9 100644
--- a/drivers/pcmcia/m32r_cfc.c
+++ b/drivers/pcmcia/m32r_cfc.c
@@ -16,7 +16,6 @@
 #include <linux/kernel.h>
 #include <linux/errno.h>
 #include <linux/timer.h>
-#include <linux/sched.h>
 #include <linux/slab.h>
 #include <linux/ioport.h>
 #include <linux/delay.h>
diff --git a/drivers/pcmcia/m32r_pcc.c b/drivers/pcmcia/m32r_pcc.c
index 4dbef0762376..67d28ee80f22 100644
--- a/drivers/pcmcia/m32r_pcc.c
+++ b/drivers/pcmcia/m32r_pcc.c
@@ -16,7 +16,6 @@
 #include <linux/kernel.h>
 #include <linux/errno.h>
 #include <linux/timer.h>
-#include <linux/sched.h>
 #include <linux/slab.h>
 #include <linux/ioport.h>
 #include <linux/delay.h>
diff --git a/drivers/pcmcia/m8xx_pcmcia.c b/drivers/pcmcia/m8xx_pcmcia.c
index 3b72be880401..d059c9196172 100644
--- a/drivers/pcmcia/m8xx_pcmcia.c
+++ b/drivers/pcmcia/m8xx_pcmcia.c
@@ -46,7 +46,6 @@
 
 #include <linux/kernel.h>
 #include <linux/errno.h>
-#include <linux/sched.h>
 #include <linux/slab.h>
 #include <linux/timer.h>
 #include <linux/ioport.h>
diff --git a/drivers/pcmcia/omap_cf.c b/drivers/pcmcia/omap_cf.c
index e65a6b8188f6..76f7cbc62a8b 100644
--- a/drivers/pcmcia/omap_cf.c
+++ b/drivers/pcmcia/omap_cf.c
@@ -11,7 +11,6 @@
 
 #include <linux/module.h>
 #include <linux/kernel.h>
-#include <linux/sched.h>
 #include <linux/platform_device.h>
 #include <linux/errno.h>
 #include <linux/init.h>
diff --git a/drivers/pcmcia/pxa2xx_lubbock.c b/drivers/pcmcia/pxa2xx_lubbock.c
index a92f11143c43..5e9b9a3fd027 100644
--- a/drivers/pcmcia/pxa2xx_lubbock.c
+++ b/drivers/pcmcia/pxa2xx_lubbock.c
@@ -16,7 +16,6 @@
  */
 #include <linux/module.h>
 #include <linux/kernel.h>
-#include <linux/sched.h>
 #include <linux/device.h>
 #include <linux/errno.h>
 #include <linux/init.h>
diff --git a/drivers/pcmcia/sa1100_badge4.c b/drivers/pcmcia/sa1100_badge4.c
index 19b1e1276220..62bfc7566ec2 100644
--- a/drivers/pcmcia/sa1100_badge4.c
+++ b/drivers/pcmcia/sa1100_badge4.c
@@ -14,7 +14,6 @@
  */
 #include <linux/module.h>
 #include <linux/kernel.h>
-#include <linux/sched.h>
 #include <linux/device.h>
 #include <linux/errno.h>
 #include <linux/init.h>
diff --git a/drivers/pcmcia/sa1100_cerf.c b/drivers/pcmcia/sa1100_cerf.c
index eb89928f2338..549a1529fe35 100644
--- a/drivers/pcmcia/sa1100_cerf.c
+++ b/drivers/pcmcia/sa1100_cerf.c
@@ -7,7 +7,6 @@
  */
 #include <linux/module.h>
 #include <linux/kernel.h>
-#include <linux/sched.h>
 #include <linux/device.h>
 #include <linux/init.h>
 #include <linux/delay.h>
diff --git a/drivers/pcmcia/sa1100_h3600.c b/drivers/pcmcia/sa1100_h3600.c
index 64fd5e37f2d2..e5491879acd9 100644
--- a/drivers/pcmcia/sa1100_h3600.c
+++ b/drivers/pcmcia/sa1100_h3600.c
@@ -6,7 +6,6 @@
  */
 #include <linux/module.h>
 #include <linux/kernel.h>
-#include <linux/sched.h>
 #include <linux/device.h>
 #include <linux/interrupt.h>
 #include <linux/init.h>
diff --git a/drivers/pcmcia/sa1100_jornada720.c b/drivers/pcmcia/sa1100_jornada720.c
index 7a87298bae99..af485ae38602 100644
--- a/drivers/pcmcia/sa1100_jornada720.c
+++ b/drivers/pcmcia/sa1100_jornada720.c
@@ -6,7 +6,6 @@
  */
 #include <linux/module.h>
 #include <linux/kernel.h>
-#include <linux/sched.h>
 #include <linux/device.h>
 #include <linux/errno.h>
 #include <linux/init.h>
diff --git a/drivers/pcmcia/sa1100_neponset.c b/drivers/pcmcia/sa1100_neponset.c
index 5e34b3e8e5db..5bc9e9532b9d 100644
--- a/drivers/pcmcia/sa1100_neponset.c
+++ b/drivers/pcmcia/sa1100_neponset.c
@@ -5,7 +5,6 @@
  */
 #include <linux/module.h>
 #include <linux/kernel.h>
-#include <linux/sched.h>
 #include <linux/device.h>
 #include <linux/errno.h>
 #include <linux/init.h>
diff --git a/drivers/pcmcia/sa1100_shannon.c b/drivers/pcmcia/sa1100_shannon.c
index 7bc9e59c761f..9456f5478d09 100644
--- a/drivers/pcmcia/sa1100_shannon.c
+++ b/drivers/pcmcia/sa1100_shannon.c
@@ -6,7 +6,6 @@
  */
 #include <linux/module.h>
 #include <linux/kernel.h>
-#include <linux/sched.h>
 #include <linux/device.h>
 #include <linux/init.h>
 
diff --git a/drivers/pcmcia/sa1100_simpad.c b/drivers/pcmcia/sa1100_simpad.c
index c2ecf1185e9e..04d6f7f75f78 100644
--- a/drivers/pcmcia/sa1100_simpad.c
+++ b/drivers/pcmcia/sa1100_simpad.c
@@ -6,7 +6,6 @@
  */
 #include <linux/module.h>
 #include <linux/kernel.h>
-#include <linux/sched.h>
 #include <linux/device.h>
 #include <linux/init.h>
 
diff --git a/drivers/pcmcia/vrc4171_card.c b/drivers/pcmcia/vrc4171_card.c
index e90d8e8c5fd6..206e26c91807 100644
--- a/drivers/pcmcia/vrc4171_card.c
+++ b/drivers/pcmcia/vrc4171_card.c
@@ -22,7 +22,6 @@
 #include <linux/interrupt.h>
 #include <linux/module.h>
 #include <linux/spinlock.h>
-#include <linux/sched.h>
 #include <linux/types.h>
 #include <linux/platform_device.h>
 
diff --git a/drivers/pcmcia/yenta_socket.c b/drivers/pcmcia/yenta_socket.c
index a61d768f6e0e..20853a03202d 100644
--- a/drivers/pcmcia/yenta_socket.c
+++ b/drivers/pcmcia/yenta_socket.c
@@ -12,7 +12,6 @@
  */
 #include <linux/init.h>
 #include <linux/pci.h>
-#include <linux/sched.h>
 #include <linux/workqueue.h>
 #include <linux/interrupt.h>
 #include <linux/delay.h>
diff --git a/drivers/rapidio/rio-sysfs.c b/drivers/rapidio/rio-sysfs.c
index 5687b8fcbf93..eed91434417d 100644
--- a/drivers/rapidio/rio-sysfs.c
+++ b/drivers/rapidio/rio-sysfs.c
@@ -14,7 +14,6 @@
 #include <linux/rio.h>
 #include <linux/rio_drv.h>
 #include <linux/stat.h>
-#include <linux/sched.h>        /* for capable() */
 
 #include "rio.h"
 
diff --git a/drivers/rtc/rtc-ds1672.c b/drivers/rtc/rtc-ds1672.c
index 205fa28593b7..dfef1637bfb8 100644
--- a/drivers/rtc/rtc-ds1672.c
+++ b/drivers/rtc/rtc-ds1672.c
@@ -199,7 +199,7 @@ static int ds1672_probe(struct i2c_adapter *adapter, int address, int kind)
         struct i2c_client *client;
         struct rtc_device *rtc;
 
-        dev_dbg(adapter->class_dev.dev, "%s\n", __FUNCTION__);
+        dev_dbg(&adapter->dev, "%s\n", __FUNCTION__);
 
         if (!i2c_check_functionality(adapter, I2C_FUNC_I2C)) {
                 err = -ENODEV;
diff --git a/drivers/rtc/rtc-omap.c b/drivers/rtc/rtc-omap.c
index d59880d44fba..9de8d67f4f8d 100644
--- a/drivers/rtc/rtc-omap.c
+++ b/drivers/rtc/rtc-omap.c
@@ -417,13 +417,13 @@ static int __devinit omap_rtc_probe(struct platform_device *pdev)
                 rtc_write(OMAP_RTC_STATUS_ALARM, OMAP_RTC_STATUS_REG);
 
         /* handle periodic and alarm irqs */
-        if (request_irq(omap_rtc_timer, rtc_irq, SA_INTERRUPT,
+        if (request_irq(omap_rtc_timer, rtc_irq, IRQF_DISABLED,
                         rtc->class_dev.class_id, &rtc->class_dev)) {
                 pr_debug("%s: RTC timer interrupt IRQ%d already claimed\n",
                         pdev->name, omap_rtc_timer);
                 goto fail0;
         }
-        if (request_irq(omap_rtc_alarm, rtc_irq, SA_INTERRUPT,
+        if (request_irq(omap_rtc_alarm, rtc_irq, IRQF_DISABLED,
                         rtc->class_dev.class_id, &rtc->class_dev)) {
                 pr_debug("%s: RTC alarm interrupt IRQ%d already claimed\n",
                         pdev->name, omap_rtc_alarm);
diff --git a/drivers/rtc/rtc-pcf8563.c b/drivers/rtc/rtc-pcf8563.c
index 038118bbfaea..0242d803ebe5 100644
--- a/drivers/rtc/rtc-pcf8563.c
+++ b/drivers/rtc/rtc-pcf8563.c
@@ -279,7 +279,7 @@ static int pcf8563_probe(struct i2c_adapter *adapter, int address, int kind)
 
         int err = 0;
 
-        dev_dbg(adapter->class_dev.dev, "%s\n", __FUNCTION__);
+        dev_dbg(&adapter->dev, "%s\n", __FUNCTION__);
 
         if (!i2c_check_functionality(adapter, I2C_FUNC_I2C)) {
                 err = -ENODEV;
diff --git a/drivers/rtc/rtc-rs5c372.c b/drivers/rtc/rtc-rs5c372.c
index e7851e3739ab..09bbe575647b 100644
--- a/drivers/rtc/rtc-rs5c372.c
+++ b/drivers/rtc/rtc-rs5c372.c
@@ -499,7 +499,7 @@ static int rs5c372_probe(struct i2c_adapter *adapter, int address, int kind)
         struct rs5c372 *rs5c372;
         struct rtc_time tm;
 
-        dev_dbg(adapter->class_dev.dev, "%s\n", __FUNCTION__);
+        dev_dbg(&adapter->dev, "%s\n", __FUNCTION__);
 
         if (!i2c_check_functionality(adapter, I2C_FUNC_I2C)) {
                 err = -ENODEV;
diff --git a/drivers/rtc/rtc-s3c.c b/drivers/rtc/rtc-s3c.c
index f406a2b55aea..9a79a24a7487 100644
--- a/drivers/rtc/rtc-s3c.c
+++ b/drivers/rtc/rtc-s3c.c
@@ -350,7 +350,7 @@ static int s3c_rtc_open(struct device *dev)
         int ret;
 
         ret = request_irq(s3c_rtc_alarmno, s3c_rtc_alarmirq,
-                          SA_INTERRUPT,  "s3c2410-rtc alarm", rtc_dev);
+                          IRQF_DISABLED,  "s3c2410-rtc alarm", rtc_dev);
 
         if (ret) {
                 dev_err(dev, "IRQ%d error %d\n", s3c_rtc_alarmno, ret);
@@ -358,7 +358,7 @@ static int s3c_rtc_open(struct device *dev)
         }
 
         ret = request_irq(s3c_rtc_tickno, s3c_rtc_tickirq,
-                          SA_INTERRUPT,  "s3c2410-rtc tick", rtc_dev);
+                          IRQF_DISABLED,  "s3c2410-rtc tick", rtc_dev);
 
         if (ret) {
                 dev_err(dev, "IRQ%d error %d\n", s3c_rtc_tickno, ret);
diff --git a/drivers/rtc/rtc-x1205.c b/drivers/rtc/rtc-x1205.c
index 019ae255b0c8..513d1a611aab 100644
--- a/drivers/rtc/rtc-x1205.c
+++ b/drivers/rtc/rtc-x1205.c
@@ -506,7 +506,7 @@ static int x1205_probe(struct i2c_adapter *adapter, int address, int kind)
         struct i2c_client *client;
         struct rtc_device *rtc;
 
-        dev_dbg(adapter->class_dev.dev, "%s\n", __FUNCTION__);
+        dev_dbg(&adapter->dev, "%s\n", __FUNCTION__);
 
         if (!i2c_check_functionality(adapter, I2C_FUNC_I2C)) {
                 err = -ENODEV;
diff --git a/drivers/s390/char/sclp_tty.c b/drivers/s390/char/sclp_tty.c
index 90536f60bf50..076816b9d528 100644
--- a/drivers/s390/char/sclp_tty.c
+++ b/drivers/s390/char/sclp_tty.c
@@ -13,7 +13,6 @@
 #include <linux/tty.h>
 #include <linux/tty_driver.h>
 #include <linux/tty_flip.h>
-#include <linux/sched.h>
 #include <linux/wait.h>
 #include <linux/slab.h>
 #include <linux/err.h>
diff --git a/drivers/s390/char/sclp_vt220.c b/drivers/s390/char/sclp_vt220.c
index 544f137d70d7..f77dc33b5f8d 100644
--- a/drivers/s390/char/sclp_vt220.c
+++ b/drivers/s390/char/sclp_vt220.c
@@ -16,7 +16,6 @@
 #include <linux/tty.h>
 #include <linux/tty_driver.h>
 #include <linux/tty_flip.h>
-#include <linux/sched.h>
 #include <linux/errno.h>
 #include <linux/mm.h>
 #include <linux/major.h>
diff --git a/drivers/s390/net/ctcmain.c b/drivers/s390/net/ctcmain.c
index 5a84fbbc6611..0d6d5fcc128b 100644
--- a/drivers/s390/net/ctcmain.c
+++ b/drivers/s390/net/ctcmain.c
@@ -45,7 +45,6 @@
 #include <linux/types.h>
 #include <linux/interrupt.h>
 #include <linux/timer.h>
-#include <linux/sched.h>
 #include <linux/bitops.h>
 
 #include <linux/signal.h>
diff --git a/drivers/s390/net/netiucv.c b/drivers/s390/net/netiucv.c
index 6387b483f2bf..594320ca1b7c 100644
--- a/drivers/s390/net/netiucv.c
+++ b/drivers/s390/net/netiucv.c
@@ -41,7 +41,6 @@
 #include <linux/types.h>
 #include <linux/interrupt.h>
 #include <linux/timer.h>
-#include <linux/sched.h>
 #include <linux/bitops.h>
 
 #include <linux/signal.h>
diff --git a/drivers/sbus/char/cpwatchdog.c b/drivers/sbus/char/cpwatchdog.c
index 0cfd1e4c032c..022e869c44dd 100644
--- a/drivers/sbus/char/cpwatchdog.c
+++ b/drivers/sbus/char/cpwatchdog.c
@@ -20,7 +20,6 @@
 #include <linux/major.h>
 #include <linux/init.h>
 #include <linux/miscdevice.h>
-#include <linux/sched.h>
 #include <linux/interrupt.h>
 #include <linux/ioport.h>
 #include <linux/timer.h>
diff --git a/drivers/sbus/char/openprom.c b/drivers/sbus/char/openprom.c
index e8776230782b..eec28c142a59 100644
--- a/drivers/sbus/char/openprom.c
+++ b/drivers/sbus/char/openprom.c
@@ -31,7 +31,6 @@
 
 #include <linux/module.h>
 #include <linux/kernel.h>
-#include <linux/sched.h>
 #include <linux/errno.h>
 #include <linux/slab.h>
 #include <linux/string.h>
diff --git a/drivers/sbus/char/uctrl.c b/drivers/sbus/char/uctrl.c
index 4d1a505e9e74..45cf5bc0bbee 100644
--- a/drivers/sbus/char/uctrl.c
+++ b/drivers/sbus/char/uctrl.c
@@ -5,7 +5,6 @@
  */
 
 #include <linux/module.h>
-#include <linux/sched.h>
 #include <linux/errno.h>
 #include <linux/delay.h>
 #include <linux/interrupt.h>
diff --git a/drivers/sbus/char/vfc_dev.c b/drivers/sbus/char/vfc_dev.c
index 37a04a0cecfa..8bfb67ccdcd4 100644
--- a/drivers/sbus/char/vfc_dev.c
+++ b/drivers/sbus/char/vfc_dev.c
@@ -19,7 +19,6 @@
 #include <linux/string.h>
 #include <linux/slab.h>
 #include <linux/errno.h>
-#include <linux/sched.h>
 #include <linux/fs.h>
 #include <linux/smp_lock.h>
 #include <linux/delay.h>
diff --git a/drivers/scsi/53c700.c b/drivers/scsi/53c700.c
index 88e061d13d0b..cb02656eb54c 100644
--- a/drivers/scsi/53c700.c
+++ b/drivers/scsi/53c700.c
@@ -121,7 +121,6 @@
 #include <linux/delay.h>
 #include <linux/spinlock.h>
 #include <linux/completion.h>
-#include <linux/sched.h>
 #include <linux/init.h>
 #include <linux/proc_fs.h>
 #include <linux/blkdev.h>
diff --git a/drivers/scsi/NCR53c406a.c b/drivers/scsi/NCR53c406a.c
index 8578555d58fd..7c0b17f86903 100644
--- a/drivers/scsi/NCR53c406a.c
+++ b/drivers/scsi/NCR53c406a.c
@@ -41,7 +41,6 @@
 
 #include <linux/errno.h>
 #include <linux/ioport.h>
-#include <linux/sched.h>
 #include <linux/interrupt.h>
 #include <linux/proc_fs.h>
 #include <linux/stat.h>
diff --git a/drivers/scsi/a2091.c b/drivers/scsi/a2091.c
index f77016d31cab..b7c5385e2efe 100644
--- a/drivers/scsi/a2091.c
+++ b/drivers/scsi/a2091.c
@@ -1,7 +1,6 @@
 #include <linux/types.h>
 #include <linux/mm.h>
 #include <linux/blkdev.h>
-#include <linux/sched.h>
 #include <linux/init.h>
 #include <linux/interrupt.h>
 
diff --git a/drivers/scsi/a3000.c b/drivers/scsi/a3000.c
index 1299bc8edef1..796f1c4d772e 100644
--- a/drivers/scsi/a3000.c
+++ b/drivers/scsi/a3000.c
@@ -1,7 +1,6 @@
 #include <linux/types.h>
 #include <linux/mm.h>
 #include <linux/blkdev.h>
-#include <linux/sched.h>
 #include <linux/ioport.h>
 #include <linux/init.h>
 #include <linux/spinlock.h>
diff --git a/drivers/scsi/aacraid/aachba.c b/drivers/scsi/aacraid/aachba.c
index ddb33b06e0ef..d789e61bdc49 100644
--- a/drivers/scsi/aacraid/aachba.c
+++ b/drivers/scsi/aacraid/aachba.c
@@ -26,7 +26,6 @@
 #include <linux/kernel.h>
 #include <linux/init.h>
 #include <linux/types.h>
-#include <linux/sched.h>
 #include <linux/pci.h>
 #include <linux/spinlock.h>
 #include <linux/slab.h>
diff --git a/drivers/scsi/aacraid/commctrl.c b/drivers/scsi/aacraid/commctrl.c
index da1d3a9212f8..e21070f4eac1 100644
--- a/drivers/scsi/aacraid/commctrl.c
+++ b/drivers/scsi/aacraid/commctrl.c
@@ -31,7 +31,6 @@
 #include <linux/kernel.h>
 #include <linux/init.h>
 #include <linux/types.h>
-#include <linux/sched.h>
 #include <linux/pci.h>
 #include <linux/spinlock.h>
 #include <linux/slab.h>
diff --git a/drivers/scsi/aacraid/comminit.c b/drivers/scsi/aacraid/comminit.c
index df67ba686023..ae34768987a4 100644
--- a/drivers/scsi/aacraid/comminit.c
+++ b/drivers/scsi/aacraid/comminit.c
@@ -32,7 +32,6 @@
 #include <linux/kernel.h>
 #include <linux/init.h>
 #include <linux/types.h>
-#include <linux/sched.h>
 #include <linux/pci.h>
 #include <linux/spinlock.h>
 #include <linux/slab.h>
diff --git a/drivers/scsi/aacraid/dpcsup.c b/drivers/scsi/aacraid/dpcsup.c
index 8335f07b7720..d38b628be1ad 100644
--- a/drivers/scsi/aacraid/dpcsup.c
+++ b/drivers/scsi/aacraid/dpcsup.c
@@ -32,7 +32,6 @@
 #include <linux/kernel.h>
 #include <linux/init.h>
 #include <linux/types.h>
-#include <linux/sched.h>
 #include <linux/pci.h>
 #include <linux/spinlock.h>
 #include <linux/slab.h>
diff --git a/drivers/scsi/aacraid/rx.c b/drivers/scsi/aacraid/rx.c
index c632d9354a26..d242e2611d67 100644
--- a/drivers/scsi/aacraid/rx.c
+++ b/drivers/scsi/aacraid/rx.c
@@ -31,7 +31,6 @@
 #include <linux/kernel.h>
 #include <linux/init.h>
 #include <linux/types.h>
-#include <linux/sched.h>
 #include <linux/pci.h>
 #include <linux/spinlock.h>
 #include <linux/slab.h>
diff --git a/drivers/scsi/aacraid/sa.c b/drivers/scsi/aacraid/sa.c
index 8535db068c2f..6f1a1780efce 100644
--- a/drivers/scsi/aacraid/sa.c
+++ b/drivers/scsi/aacraid/sa.c
@@ -31,7 +31,6 @@
 #include <linux/kernel.h>
 #include <linux/init.h>
 #include <linux/types.h>
-#include <linux/sched.h>
 #include <linux/pci.h>
 #include <linux/spinlock.h>
 #include <linux/slab.h>
diff --git a/drivers/scsi/aha152x.c b/drivers/scsi/aha152x.c
index 0cec742d12e9..4b4d1233ce8a 100644
--- a/drivers/scsi/aha152x.c
+++ b/drivers/scsi/aha152x.c
@@ -236,7 +236,6 @@
  **************************************************************************/
 
 #include <linux/module.h>
-#include <linux/sched.h>
 #include <asm/irq.h>
 #include <linux/io.h>
 #include <linux/blkdev.h>
diff --git a/drivers/scsi/aic7xxx_old.c b/drivers/scsi/aic7xxx_old.c
index 7d1fec620948..a988d5abf702 100644
--- a/drivers/scsi/aic7xxx_old.c
+++ b/drivers/scsi/aic7xxx_old.c
@@ -229,7 +229,6 @@
 #include <linux/kernel.h>
 #include <linux/ioport.h>
 #include <linux/delay.h>
-#include <linux/sched.h>
 #include <linux/pci.h>
 #include <linux/proc_fs.h>
 #include <linux/blkdev.h>
diff --git a/drivers/scsi/aic94xx/aic94xx_init.c b/drivers/scsi/aic94xx/aic94xx_init.c
index bc7744e35ad0..27852b43b904 100644
--- a/drivers/scsi/aic94xx/aic94xx_init.c
+++ b/drivers/scsi/aic94xx/aic94xx_init.c
@@ -653,7 +653,7 @@ static int __devinit asd_pci_probe(struct pci_dev *dev,
         if (use_msi)
                 pci_enable_msi(asd_ha->pcidev);
 
-        err = request_irq(asd_ha->pcidev->irq, asd_hw_isr, SA_SHIRQ,
+        err = request_irq(asd_ha->pcidev->irq, asd_hw_isr, IRQF_SHARED,
                           ASD_DRIVER_NAME, asd_ha);
         if (err) {
                 asd_printk("couldn't get irq %d for %s\n",
diff --git a/drivers/scsi/amiga7xx.c b/drivers/scsi/amiga7xx.c
index 9099d531d5a4..d5d3c4d5a253 100644
--- a/drivers/scsi/amiga7xx.c
+++ b/drivers/scsi/amiga7xx.c
@@ -10,7 +10,6 @@
 #include <linux/types.h>
 #include <linux/mm.h>
 #include <linux/blkdev.h>
-#include <linux/sched.h>
 #include <linux/zorro.h>
 #include <linux/stat.h>
 
diff --git a/drivers/scsi/arcmsr/arcmsr_hba.c b/drivers/scsi/arcmsr/arcmsr_hba.c
index 086cc97eee8c..8b46158cc045 100644
--- a/drivers/scsi/arcmsr/arcmsr_hba.c
+++ b/drivers/scsi/arcmsr/arcmsr_hba.c
@@ -322,7 +322,7 @@ static int arcmsr_probe(struct pci_dev *pdev,
                 goto out_iounmap;
 
         error = request_irq(pdev->irq, arcmsr_do_interrupt,
-                        SA_INTERRUPT | SA_SHIRQ, "arcmsr", acb);
+                        IRQF_DISABLED | IRQF_SHARED, "arcmsr", acb);
         if (error)
                 goto out_free_ccb_pool;
 
diff --git a/drivers/scsi/arm/acornscsi.c b/drivers/scsi/arm/acornscsi.c
index 9cf902b7a126..eceacf6d49ea 100644
--- a/drivers/scsi/arm/acornscsi.c
+++ b/drivers/scsi/arm/acornscsi.c
@@ -131,7 +131,6 @@
 
 #include <linux/module.h>
 #include <linux/kernel.h>
-#include <linux/sched.h>
 #include <linux/string.h>
 #include <linux/signal.h>
 #include <linux/errno.h>
diff --git a/drivers/scsi/arm/arxescsi.c b/drivers/scsi/arm/arxescsi.c
index 4385e9e3ded6..7e132c5bacf8 100644
--- a/drivers/scsi/arm/arxescsi.c
+++ b/drivers/scsi/arm/arxescsi.c
@@ -23,7 +23,6 @@
 #include <linux/kernel.h>
 #include <linux/string.h>
 #include <linux/ioport.h>
-#include <linux/sched.h>
 #include <linux/proc_fs.h>
 #include <linux/unistd.h>
 #include <linux/stat.h>
diff --git a/drivers/scsi/arm/cumana_1.c b/drivers/scsi/arm/cumana_1.c
index 3bdfc36481ae..cf9a21cea6d9 100644
--- a/drivers/scsi/arm/cumana_1.c
+++ b/drivers/scsi/arm/cumana_1.c
@@ -5,7 +5,6 @@
  */
 #include <linux/module.h>
 #include <linux/signal.h>
-#include <linux/sched.h>
 #include <linux/ioport.h>
 #include <linux/delay.h>
 #include <linux/blkdev.h>
diff --git a/drivers/scsi/arm/cumana_2.c b/drivers/scsi/arm/cumana_2.c
index 19edd9c853d9..d2d51dc51ab8 100644
--- a/drivers/scsi/arm/cumana_2.c
+++ b/drivers/scsi/arm/cumana_2.c
@@ -21,7 +21,6 @@
 #include <linux/kernel.h>
 #include <linux/string.h>
 #include <linux/ioport.h>
-#include <linux/sched.h>
 #include <linux/proc_fs.h>
 #include <linux/delay.h>
 #include <linux/interrupt.h>
diff --git a/drivers/scsi/arm/ecoscsi.c b/drivers/scsi/arm/ecoscsi.c
index 6adcccbf444b..378e7af0c5d6 100644
--- a/drivers/scsi/arm/ecoscsi.c
+++ b/drivers/scsi/arm/ecoscsi.c
@@ -23,7 +23,6 @@
 
 #include <linux/module.h>
 #include <linux/signal.h>
-#include <linux/sched.h>
 #include <linux/ioport.h>
 #include <linux/delay.h>
 #include <linux/init.h>
diff --git a/drivers/scsi/arm/eesox.c b/drivers/scsi/arm/eesox.c
index 3f876fb75469..4677152142d9 100644
--- a/drivers/scsi/arm/eesox.c
+++ b/drivers/scsi/arm/eesox.c
@@ -27,7 +27,6 @@
 #include <linux/kernel.h>
 #include <linux/string.h>
 #include <linux/ioport.h>
-#include <linux/sched.h>
 #include <linux/proc_fs.h>
 #include <linux/delay.h>
 #include <linux/interrupt.h>
diff --git a/drivers/scsi/arm/fas216.c b/drivers/scsi/arm/fas216.c
index e05f0c2fc912..2969cc0ff259 100644
--- a/drivers/scsi/arm/fas216.c
+++ b/drivers/scsi/arm/fas216.c
@@ -39,7 +39,6 @@
 #include <linux/kernel.h>
 #include <linux/string.h>
 #include <linux/ioport.h>
-#include <linux/sched.h>
 #include <linux/proc_fs.h>
 #include <linux/delay.h>
 #include <linux/bitops.h>
diff --git a/drivers/scsi/arm/oak.c b/drivers/scsi/arm/oak.c
index d806b024c3bd..c21b8392c928 100644
--- a/drivers/scsi/arm/oak.c
+++ b/drivers/scsi/arm/oak.c
@@ -6,7 +6,6 @@
 
 #include <linux/module.h>
 #include <linux/signal.h>
-#include <linux/sched.h>
 #include <linux/ioport.h>
 #include <linux/delay.h>
 #include <linux/blkdev.h>
diff --git a/drivers/scsi/arm/powertec.c b/drivers/scsi/arm/powertec.c
index ce159c15bc86..f9cd20bfb958 100644
--- a/drivers/scsi/arm/powertec.c
+++ b/drivers/scsi/arm/powertec.c
@@ -12,7 +12,6 @@
 #include <linux/kernel.h>
 #include <linux/string.h>
 #include <linux/ioport.h>
-#include <linux/sched.h>
 #include <linux/proc_fs.h>
 #include <linux/delay.h>
 #include <linux/interrupt.h>
diff --git a/drivers/scsi/atari_scsi.c b/drivers/scsi/atari_scsi.c
index dfb1bcfae82e..642de7b2b7a2 100644
--- a/drivers/scsi/atari_scsi.c
+++ b/drivers/scsi/atari_scsi.c
@@ -86,7 +86,6 @@
 #include <linux/delay.h>
 #include <linux/mm.h>
 #include <linux/blkdev.h>
-#include <linux/sched.h>
 #include <linux/interrupt.h>
 #include <linux/init.h>
 #include <linux/nvram.h>
diff --git a/drivers/scsi/bvme6000.c b/drivers/scsi/bvme6000.c
index 2958b8c2bfb7..599b400a3c43 100644
--- a/drivers/scsi/bvme6000.c
+++ b/drivers/scsi/bvme6000.c
@@ -6,7 +6,6 @@
 #include <linux/types.h>
 #include <linux/mm.h>
 #include <linux/blkdev.h>
-#include <linux/sched.h>
 #include <linux/zorro.h>
 
 #include <asm/setup.h>
diff --git a/drivers/scsi/ch.c b/drivers/scsi/ch.c
index d02759f13469..2a2cc6cf1182 100644
--- a/drivers/scsi/ch.c
+++ b/drivers/scsi/ch.c
@@ -11,7 +11,6 @@
 #include <linux/init.h>
 #include <linux/fs.h>
 #include <linux/kernel.h>
-#include <linux/sched.h>
 #include <linux/mm.h>
 #include <linux/major.h>
 #include <linux/string.h>
diff --git a/drivers/scsi/dtc.c b/drivers/scsi/dtc.c
index 54756722dd5f..9d52e45c7d36 100644
--- a/drivers/scsi/dtc.c
+++ b/drivers/scsi/dtc.c
@@ -75,7 +75,6 @@
 #include <asm/system.h>
 #include <linux/module.h>
 #include <linux/signal.h>
-#include <linux/sched.h>
 #include <linux/blkdev.h>
 #include <linux/delay.h>
 #include <linux/stat.h>
diff --git a/drivers/scsi/eata_pio.c b/drivers/scsi/eata_pio.c
index 2dbb66d2f0a7..f33ad01064a9 100644
--- a/drivers/scsi/eata_pio.c
+++ b/drivers/scsi/eata_pio.c
@@ -48,7 +48,6 @@
 
 #include <linux/module.h>
 #include <linux/kernel.h>
-#include <linux/sched.h>
 #include <linux/string.h>
 #include <linux/ioport.h>
 #include <linux/slab.h>
diff --git a/drivers/scsi/g_NCR5380.c b/drivers/scsi/g_NCR5380.c
index cdd893bb4e28..880f70d24e65 100644
--- a/drivers/scsi/g_NCR5380.c
+++ b/drivers/scsi/g_NCR5380.c
@@ -103,7 +103,6 @@
 #include <asm/system.h>
 #include <asm/io.h>
 #include <linux/signal.h>
-#include <linux/sched.h>
 #include <linux/blkdev.h>
 #include "scsi.h"
 #include <scsi/scsi_host.h>
diff --git a/drivers/scsi/gdth.c b/drivers/scsi/gdth.c
index a1992928e671..8c81cec85298 100644
--- a/drivers/scsi/gdth.c
+++ b/drivers/scsi/gdth.c
@@ -387,7 +387,6 @@
 #include <linux/ctype.h>
 #include <linux/ioport.h>
 #include <linux/delay.h>
-#include <linux/sched.h>
 #include <linux/interrupt.h>
 #include <linux/in.h>
 #include <linux/proc_fs.h>
diff --git a/drivers/scsi/gvp11.c b/drivers/scsi/gvp11.c
index 2f6c1137a6e5..37741e9b5c3b 100644
--- a/drivers/scsi/gvp11.c
+++ b/drivers/scsi/gvp11.c
@@ -1,7 +1,6 @@
 #include <linux/types.h>
 #include <linux/mm.h>
 #include <linux/blkdev.h>
-#include <linux/sched.h>
 #include <linux/init.h>
 #include <linux/interrupt.h>
 
diff --git a/drivers/scsi/ibmvscsi/ibmvstgt.c b/drivers/scsi/ibmvscsi/ibmvstgt.c
index e28260f05d6b..4368ca0e8270 100644
--- a/drivers/scsi/ibmvscsi/ibmvstgt.c
+++ b/drivers/scsi/ibmvscsi/ibmvstgt.c
@@ -580,7 +580,7 @@ static int crq_queue_create(struct crq_queue *queue, struct srp_target *target)
         }
 
         err = request_irq(vport->dma_dev->irq, &ibmvstgt_interrupt,
-                          SA_INTERRUPT, "ibmvstgt", target);
+                          IRQF_DISABLED, "ibmvstgt", target);
         if (err)
                 goto req_irq_failed;
 
diff --git a/drivers/scsi/initio.c b/drivers/scsi/initio.c
index d561663fb4e4..7e7635ca78f1 100644
--- a/drivers/scsi/initio.c
+++ b/drivers/scsi/initio.c
@@ -123,7 +123,6 @@
 #include <linux/string.h>
 #include <linux/interrupt.h>
 #include <linux/ioport.h>
-#include <linux/sched.h>
 #include <linux/slab.h>
 #include <linux/jiffies.h>
 #include <linux/dma-mapping.h>
diff --git a/drivers/scsi/lasi700.c b/drivers/scsi/lasi700.c
index 2aae1b081fcf..5c32a69e41ba 100644
--- a/drivers/scsi/lasi700.c
+++ b/drivers/scsi/lasi700.c
@@ -38,7 +38,6 @@
 #include <linux/stat.h>
 #include <linux/mm.h>
 #include <linux/blkdev.h>
-#include <linux/sched.h>
 #include <linux/ioport.h>
 #include <linux/dma-mapping.h>
 
diff --git a/drivers/scsi/mac_scsi.c b/drivers/scsi/mac_scsi.c
index a942a21dd87e..cdbcaa5ad6cf 100644
--- a/drivers/scsi/mac_scsi.c
+++ b/drivers/scsi/mac_scsi.c
@@ -36,7 +36,6 @@
 
 #include <linux/module.h>
 #include <linux/signal.h>
-#include <linux/sched.h>
 #include <linux/ioport.h>
 #include <linux/init.h>
 #include <linux/blkdev.h>
diff --git a/drivers/scsi/mvme147.c b/drivers/scsi/mvme147.c
index 1ddd7a11a958..be41aadccae5 100644
--- a/drivers/scsi/mvme147.c
+++ b/drivers/scsi/mvme147.c
@@ -1,7 +1,6 @@
 #include <linux/types.h>
 #include <linux/mm.h>
 #include <linux/blkdev.h>
-#include <linux/sched.h>
 #include <linux/interrupt.h>
 
 #include <asm/page.h>
diff --git a/drivers/scsi/mvme16x.c b/drivers/scsi/mvme16x.c
index 890e9e232dab..575fe6f7e0ec 100644
--- a/drivers/scsi/mvme16x.c
+++ b/drivers/scsi/mvme16x.c
@@ -6,7 +6,6 @@
 #include <linux/types.h>
 #include <linux/mm.h>
 #include <linux/blkdev.h>
-#include <linux/sched.h>
 
 #include <asm/page.h>
 #include <asm/pgtable.h>
diff --git a/drivers/scsi/nsp32.c b/drivers/scsi/nsp32.c
index 7c13f6f4a4c6..f6f561d26bf0 100644
--- a/drivers/scsi/nsp32.c
+++ b/drivers/scsi/nsp32.c
@@ -27,7 +27,6 @@
 #include <linux/module.h>
 #include <linux/init.h>
 #include <linux/kernel.h>
-#include <linux/sched.h>
 #include <linux/slab.h>
 #include <linux/string.h>
 #include <linux/timer.h>
diff --git a/drivers/scsi/pas16.c b/drivers/scsi/pas16.c
index 1434209a8ac5..ee5965659971 100644
--- a/drivers/scsi/pas16.c
+++ b/drivers/scsi/pas16.c
@@ -116,7 +116,6 @@
 #include <asm/system.h>
 #include <linux/signal.h>
 #include <linux/proc_fs.h>
-#include <linux/sched.h>
 #include <asm/io.h>
 #include <asm/dma.h>
 #include <linux/blkdev.h>
diff --git a/drivers/scsi/pcmcia/aha152x_stub.c b/drivers/scsi/pcmcia/aha152x_stub.c
index aad362ba02e0..370802d24acd 100644
--- a/drivers/scsi/pcmcia/aha152x_stub.c
+++ b/drivers/scsi/pcmcia/aha152x_stub.c
@@ -37,7 +37,6 @@
 #include <linux/module.h>
 #include <linux/init.h>
 #include <linux/kernel.h>
-#include <linux/sched.h>
 #include <linux/slab.h>
 #include <linux/string.h>
 #include <linux/ioport.h>
diff --git a/drivers/scsi/pcmcia/fdomain_stub.c b/drivers/scsi/pcmcia/fdomain_stub.c
index a1c5f265069f..4b82b2021981 100644
--- a/drivers/scsi/pcmcia/fdomain_stub.c
+++ b/drivers/scsi/pcmcia/fdomain_stub.c
@@ -34,7 +34,6 @@
 #include <linux/module.h>
 #include <linux/init.h>
 #include <linux/kernel.h>
-#include <linux/sched.h>
 #include <linux/slab.h>
 #include <linux/string.h>
 #include <linux/ioport.h>
diff --git a/drivers/scsi/pcmcia/nsp_cs.c b/drivers/scsi/pcmcia/nsp_cs.c
index e16fe361436e..c6f8c6e65e05 100644
--- a/drivers/scsi/pcmcia/nsp_cs.c
+++ b/drivers/scsi/pcmcia/nsp_cs.c
@@ -31,7 +31,6 @@
 #include <linux/module.h>
 #include <linux/kernel.h>
 #include <linux/init.h>
-#include <linux/sched.h>
 #include <linux/slab.h>
 #include <linux/string.h>
 #include <linux/timer.h>
diff --git a/drivers/scsi/pcmcia/qlogic_stub.c b/drivers/scsi/pcmcia/qlogic_stub.c
index 9d431fe7f47f..697cfb76c3a4 100644
--- a/drivers/scsi/pcmcia/qlogic_stub.c
+++ b/drivers/scsi/pcmcia/qlogic_stub.c
@@ -34,7 +34,6 @@
 #include <linux/module.h>
 #include <linux/init.h>
 #include <linux/kernel.h>
-#include <linux/sched.h>
 #include <linux/slab.h>
 #include <linux/string.h>
 #include <linux/ioport.h>
diff --git a/drivers/scsi/pcmcia/sym53c500_cs.c b/drivers/scsi/pcmcia/sym53c500_cs.c
index 5b458d2478f7..ffe75c431b25 100644
--- a/drivers/scsi/pcmcia/sym53c500_cs.c
+++ b/drivers/scsi/pcmcia/sym53c500_cs.c
@@ -54,7 +54,6 @@
 #include <linux/init.h>
 #include <linux/interrupt.h>
 #include <linux/kernel.h>
-#include <linux/sched.h>
 #include <linux/slab.h>
 #include <linux/string.h>
 #include <linux/ioport.h>
diff --git a/drivers/scsi/qla1280.c b/drivers/scsi/qla1280.c
index 1548d42a3b43..6777e8a69153 100644
--- a/drivers/scsi/qla1280.c
+++ b/drivers/scsi/qla1280.c
@@ -341,7 +341,6 @@
 #include <linux/ioport.h>
 #include <linux/delay.h>
 #include <linux/timer.h>
-#include <linux/sched.h>
 #include <linux/pci.h>
 #include <linux/proc_fs.h>
 #include <linux/stat.h>
diff --git a/drivers/scsi/qla4xxx/ql4_os.c b/drivers/scsi/qla4xxx/ql4_os.c
index 81fb7bd44f01..0bfddf893ed0 100644
--- a/drivers/scsi/qla4xxx/ql4_os.c
+++ b/drivers/scsi/qla4xxx/ql4_os.c
@@ -1270,7 +1270,7 @@ static int __devinit qla4xxx_probe_adapter(struct pci_dev *pdev,
         INIT_WORK(&ha->dpc_work, qla4xxx_do_dpc);
 
         ret = request_irq(pdev->irq, qla4xxx_intr_handler,
-                          SA_INTERRUPT|SA_SHIRQ, "qla4xxx", ha);
+                          IRQF_DISABLED | IRQF_SHARED, "qla4xxx", ha);
         if (ret) {
                 dev_warn(&ha->pdev->dev, "Failed to reserve interrupt %d"
                         " already in use.\n", pdev->irq);
diff --git a/drivers/scsi/scsi.c b/drivers/scsi/scsi.c
index f33e2eb9f1b9..1c89ee3e69ba 100644
--- a/drivers/scsi/scsi.c
+++ b/drivers/scsi/scsi.c
@@ -40,7 +40,6 @@
 #include <linux/module.h>
 #include <linux/moduleparam.h>
 #include <linux/kernel.h>
-#include <linux/sched.h>
 #include <linux/timer.h>
 #include <linux/string.h>
 #include <linux/slab.h>
diff --git a/drivers/scsi/scsi_debug.c b/drivers/scsi/scsi_debug.c
index 5adbbeedec38..3e2930b7ee23 100644
--- a/drivers/scsi/scsi_debug.c
+++ b/drivers/scsi/scsi_debug.c
@@ -28,7 +28,6 @@
 #include <linux/module.h>
 
 #include <linux/kernel.h>
-#include <linux/sched.h>
 #include <linux/errno.h>
 #include <linux/timer.h>
 #include <linux/types.h>
diff --git a/drivers/scsi/scsi_sysctl.c b/drivers/scsi/scsi_sysctl.c
index 04d06c25132b..6cfaaa2d0c81 100644
--- a/drivers/scsi/scsi_sysctl.c
+++ b/drivers/scsi/scsi_sysctl.c
@@ -41,7 +41,7 @@ static struct ctl_table_header *scsi_table_header;
 
 int __init scsi_init_sysctl(void)
 {
-        scsi_table_header = register_sysctl_table(scsi_root_table, 1);
+        scsi_table_header = register_sysctl_table(scsi_root_table);
         if (!scsi_table_header)
                 return -ENOMEM;
         return 0;
diff --git a/drivers/scsi/scsi_transport_fc.c b/drivers/scsi/scsi_transport_fc.c
index 3571ce8934e7..0d3c10f2134c 100644
--- a/drivers/scsi/scsi_transport_fc.c
+++ b/drivers/scsi/scsi_transport_fc.c
@@ -26,7 +26,6 @@
  */
 #include <linux/module.h>
 #include <linux/init.h>
-#include <linux/sched.h>        /* workqueue stuff, HZ */
 #include <scsi/scsi_device.h>
 #include <scsi/scsi_host.h>
 #include <scsi/scsi_transport.h>
diff --git a/drivers/scsi/sd.c b/drivers/scsi/sd.c
index b781a90d6699..3f048bd6326d 100644
--- a/drivers/scsi/sd.c
+++ b/drivers/scsi/sd.c
@@ -35,7 +35,6 @@
 #include <linux/module.h>
 #include <linux/fs.h>
 #include <linux/kernel.h>
-#include <linux/sched.h>
 #include <linux/mm.h>
 #include <linux/bio.h>
 #include <linux/genhd.h>
diff --git a/drivers/scsi/sr.c b/drivers/scsi/sr.c
index 89e9b36b1788..1857d68e7195 100644
--- a/drivers/scsi/sr.c
+++ b/drivers/scsi/sr.c
@@ -35,7 +35,6 @@
 #include <linux/module.h>
 #include <linux/fs.h>
 #include <linux/kernel.h>
-#include <linux/sched.h>
 #include <linux/mm.h>
 #include <linux/bio.h>
 #include <linux/string.h>
diff --git a/drivers/scsi/sr_ioctl.c b/drivers/scsi/sr_ioctl.c
index 0578ba42718b..e1589f91706a 100644
--- a/drivers/scsi/sr_ioctl.c
+++ b/drivers/scsi/sr_ioctl.c
@@ -1,5 +1,4 @@
 #include <linux/kernel.h>
-#include <linux/sched.h>
 #include <linux/mm.h>
 #include <linux/fs.h>
 #include <linux/errno.h>
diff --git a/drivers/scsi/stex.c b/drivers/scsi/stex.c
index ba6bcdaf2a6a..69be1324b114 100644
--- a/drivers/scsi/stex.c
+++ b/drivers/scsi/stex.c
@@ -17,7 +17,6 @@
 #include <linux/errno.h>
 #include <linux/kernel.h>
 #include <linux/delay.h>
-#include <linux/sched.h>
 #include <linux/time.h>
 #include <linux/pci.h>
 #include <linux/blkdev.h>
diff --git a/drivers/scsi/sun3_scsi.c b/drivers/scsi/sun3_scsi.c
index 69ee3e4a820e..5e46d842c6f9 100644
--- a/drivers/scsi/sun3_scsi.c
+++ b/drivers/scsi/sun3_scsi.c
@@ -58,7 +58,6 @@
 
 #include <linux/module.h>
 #include <linux/signal.h>
-#include <linux/sched.h>
 #include <linux/ioport.h>
 #include <linux/init.h>
 #include <linux/blkdev.h>
diff --git a/drivers/scsi/sun3_scsi_vme.c b/drivers/scsi/sun3_scsi_vme.c
index bb0c9fd99e68..7cb4a31453e6 100644
--- a/drivers/scsi/sun3_scsi_vme.c
+++ b/drivers/scsi/sun3_scsi_vme.c
@@ -20,7 +20,6 @@
 
 #include <linux/module.h>
 #include <linux/signal.h>
-#include <linux/sched.h>
 #include <linux/ioport.h>
 #include <linux/init.h>
 #include <linux/blkdev.h>
diff --git a/drivers/scsi/sym53c416.c b/drivers/scsi/sym53c416.c
index 32c883f1efa1..2ca950582bc3 100644
--- a/drivers/scsi/sym53c416.c
+++ b/drivers/scsi/sym53c416.c
@@ -32,7 +32,6 @@
 #include <linux/init.h>
 #include <linux/string.h>
 #include <linux/ioport.h>
-#include <linux/sched.h>
 #include <linux/interrupt.h>
 #include <linux/delay.h>
 #include <linux/proc_fs.h>
diff --git a/drivers/scsi/t128.c b/drivers/scsi/t128.c
index 0b7a70f61e0d..248d60b8d899 100644
--- a/drivers/scsi/t128.c
+++ b/drivers/scsi/t128.c
@@ -108,7 +108,6 @@
 
 #include <asm/system.h>
 #include <linux/signal.h>
-#include <linux/sched.h>
 #include <linux/io.h>
 #include <linux/blkdev.h>
 #include <linux/interrupt.h>
diff --git a/drivers/scsi/tmscsim.c b/drivers/scsi/tmscsim.c
index fa5382e354be..a583e89238fc 100644
--- a/drivers/scsi/tmscsim.c
+++ b/drivers/scsi/tmscsim.c
@@ -221,7 +221,6 @@
 #include <linux/module.h>
 #include <linux/delay.h>
 #include <linux/signal.h>
-#include <linux/sched.h>
 #include <linux/errno.h>
 #include <linux/kernel.h>
 #include <linux/ioport.h>
diff --git a/drivers/scsi/wd33c93.c b/drivers/scsi/wd33c93.c
index 2083454db511..835751600e93 100644
--- a/drivers/scsi/wd33c93.c
+++ b/drivers/scsi/wd33c93.c
@@ -73,7 +73,6 @@
 
 #include <linux/module.h>
 
-#include <linux/sched.h>
 #include <linux/string.h>
 #include <linux/delay.h>
 #include <linux/init.h>
diff --git a/drivers/serial/8250.c b/drivers/serial/8250.c
index 2964ca9df5a0..98ec86185328 100644
--- a/drivers/serial/8250.c
+++ b/drivers/serial/8250.c
@@ -364,6 +364,23 @@ serial_out(struct uart_8250_port *up, int offset, int value)
         }
 }
 
+static void
+serial_out_sync(struct uart_8250_port *up, int offset, int value)
+{
+        switch (up->port.iotype) {
+        case UPIO_MEM:
+        case UPIO_MEM32:
+#ifdef CONFIG_SERIAL_8250_AU1X00
+        case UPIO_AU:
+#endif
+                serial_out(up, offset, value);
+                serial_in(up, UART_LCR);        /* safe, no side-effects */
+                break;
+        default:
+                serial_out(up, offset, value);
+        }
+}
+
 /*
  * We used to support using pause I/O for certain machines.  We
  * haven't supported this for a while, but just in case it's badly
@@ -1045,7 +1062,7 @@ static void autoconfig(struct uart_8250_port *up, unsigned int probeflags)
 #endif
         serial_outp(up, UART_MCR, save_mcr);
         serial8250_clear_fifos(up);
-        (void)serial_in(up, UART_RX);
+        serial_in(up, UART_RX);
         if (up->capabilities & UART_CAP_UUE)
                 serial_outp(up, UART_IER, UART_IER_UUE);
         else
@@ -1451,6 +1468,12 @@ static void serial_unlink_irq_chain(struct uart_8250_port *up)
         serial_do_unlink(i, up);
 }
 
+/* Base timer interval for polling */
+static inline int poll_timeout(int timeout)
+{
+        return timeout > 6 ? (timeout / 2 - 2) : 1;
+}
+
 /*
  * This function is used to handle ports that do not have an
  * interrupt.  This doesn't work very well for 16450's, but gives
@@ -1460,16 +1483,51 @@ static void serial_unlink_irq_chain(struct uart_8250_port *up)
 static void serial8250_timeout(unsigned long data)
 {
         struct uart_8250_port *up = (struct uart_8250_port *)data;
-        unsigned int timeout;
         unsigned int iir;
 
         iir = serial_in(up, UART_IIR);
         if (!(iir & UART_IIR_NO_INT))
                 serial8250_handle_port(up);
+        mod_timer(&up->timer, jiffies + poll_timeout(up->port.timeout));
+}
+
+static void serial8250_backup_timeout(unsigned long data)
+{
+        struct uart_8250_port *up = (struct uart_8250_port *)data;
+        unsigned int iir, ier = 0;
+
+        /*
+         * Must disable interrupts or else we risk racing with the interrupt
+         * based handler.
+         */
+        if (is_real_interrupt(up->port.irq)) {
+                ier = serial_in(up, UART_IER);
+                serial_out(up, UART_IER, 0);
+        }
 
-        timeout = up->port.timeout;
-        timeout = timeout > 6 ? (timeout / 2 - 2) : 1;
-        mod_timer(&up->timer, jiffies + timeout);
+        iir = serial_in(up, UART_IIR);
+
+        /*
+         * This should be a safe test for anyone who doesn't trust the
+         * IIR bits on their UART, but it's specifically designed for
+         * the "Diva" UART used on the management processor on many HP
+         * ia64 and parisc boxes.
+         */
+        if ((iir & UART_IIR_NO_INT) && (up->ier & UART_IER_THRI) &&
+            (!uart_circ_empty(&up->port.info->xmit) || up->port.x_char) &&
+            (serial_in(up, UART_LSR) & UART_LSR_THRE)) {
+                iir &= ~(UART_IIR_ID | UART_IIR_NO_INT);
+                iir |= UART_IIR_THRI;
+        }
+
+        if (!(iir & UART_IIR_NO_INT))
+                serial8250_handle_port(up);
+
+        if (is_real_interrupt(up->port.irq))
+                serial_out(up, UART_IER, ier);
+
+        /* Standard timer interval plus 0.2s to keep the port running */
+        mod_timer(&up->timer, jiffies + poll_timeout(up->port.timeout) + HZ/5);
 }
 
 static unsigned int serial8250_tx_empty(struct uart_port *port)
@@ -1540,6 +1598,37 @@ static void serial8250_break_ctl(struct uart_port *port, int break_state)
         spin_unlock_irqrestore(&up->port.lock, flags);
 }
 
+#define BOTH_EMPTY (UART_LSR_TEMT | UART_LSR_THRE)
+
+/*
+ *      Wait for transmitter & holding register to empty
+ */
+static inline void wait_for_xmitr(struct uart_8250_port *up, int bits)
+{
+        unsigned int status, tmout = 10000;
+
+        /* Wait up to 10ms for the character(s) to be sent. */
+        do {
+                status = serial_in(up, UART_LSR);
+
+                if (status & UART_LSR_BI)
+                        up->lsr_break_flag = UART_LSR_BI;
+
+                if (--tmout == 0)
+                        break;
+                udelay(1);
+        } while ((status & bits) != bits);
+
+        /* Wait up to 1s for flow control if necessary */
+        if (up->port.flags & UPF_CONS_FLOW) {
+                tmout = 1000000;
+                while (!(serial_in(up, UART_MSR) & UART_MSR_CTS) && --tmout) {
+                        udelay(1);
+                        touch_nmi_watchdog();
+                }
+        }
+}
+
 static int serial8250_startup(struct uart_port *port)
 {
         struct uart_8250_port *up = (struct uart_8250_port *)port;
@@ -1613,18 +1702,50 @@ static int serial8250_startup(struct uart_port *port)
                 serial_outp(up, UART_LCR, 0);
         }
 
+        if (is_real_interrupt(up->port.irq)) {
+                /*
+                 * Test for UARTs that do not reassert THRE when the
+                 * transmitter is idle and the interrupt has already
+                 * been cleared.  Real 16550s should always reassert
+                 * this interrupt whenever the transmitter is idle and
+                 * the interrupt is enabled.  Delays are necessary to
+                 * allow register changes to become visible.
+                 */
+                spin_lock_irqsave(&up->port.lock, flags);
+
+                wait_for_xmitr(up, UART_LSR_THRE);
+                serial_out_sync(up, UART_IER, UART_IER_THRI);
+                udelay(1); /* allow THRE to set */
+                serial_in(up, UART_IIR);
+                serial_out(up, UART_IER, 0);
+                serial_out_sync(up, UART_IER, UART_IER_THRI);
+                udelay(1); /* allow a working UART time to re-assert THRE */
+                iir = serial_in(up, UART_IIR);
+                serial_out(up, UART_IER, 0);
+
+                spin_unlock_irqrestore(&up->port.lock, flags);
+
+                /*
+                 * If the interrupt is not reasserted, setup a timer to
+                 * kick the UART on a regular basis.
+                 */
+                if (iir & UART_IIR_NO_INT) {
+                        pr_debug("ttyS%d - using backup timer\n", port->line);
+                        up->timer.function = serial8250_backup_timeout;
+                        up->timer.data = (unsigned long)up;
+                        mod_timer(&up->timer, jiffies +
+                                  poll_timeout(up->port.timeout) + HZ/5);
+                }
+        }
+
         /*
          * If the "interrupt" for this port doesn't correspond with any
          * hardware interrupt, we use a timer-based system.  The original
          * driver used to do this with IRQ0.
          */
         if (!is_real_interrupt(up->port.irq)) {
-                unsigned int timeout = up->port.timeout;
-
-                timeout = timeout > 6 ? (timeout / 2 - 2) : 1;
-
                 up->timer.data = (unsigned long)up;
-                mod_timer(&up->timer, jiffies + timeout);
+                mod_timer(&up->timer, jiffies + poll_timeout(up->port.timeout));
         } else {
                 retval = serial_link_irq_chain(up);
                 if (retval)
@@ -1740,9 +1861,9 @@ static void serial8250_shutdown(struct uart_port *port)
          */
         (void) serial_in(up, UART_RX);
 
-        if (!is_real_interrupt(up->port.irq))
-                del_timer_sync(&up->timer);
-        else
+        del_timer_sync(&up->timer);
+        up->timer.function = serial8250_timeout;
+        if (is_real_interrupt(up->port.irq))
                 serial_unlink_irq_chain(up);
 }
 
@@ -2212,37 +2333,6 @@ serial8250_register_ports(struct uart_driver *drv, struct device *dev)
 
 #ifdef CONFIG_SERIAL_8250_CONSOLE
 
-#define BOTH_EMPTY (UART_LSR_TEMT | UART_LSR_THRE)
-
-/*
- *      Wait for transmitter & holding register to empty
- */
-static inline void wait_for_xmitr(struct uart_8250_port *up, int bits)
-{
-        unsigned int status, tmout = 10000;
-
-        /* Wait up to 10ms for the character(s) to be sent. */
-        do {
-                status = serial_in(up, UART_LSR);
-
-                if (status & UART_LSR_BI)
-                        up->lsr_break_flag = UART_LSR_BI;
-
-                if (--tmout == 0)
-                        break;
-                udelay(1);
-        } while ((status & bits) != bits);
-
-        /* Wait up to 1s for flow control if necessary */
-        if (up->port.flags & UPF_CONS_FLOW) {
-                tmout = 1000000;
-                while (!(serial_in(up, UART_MSR) & UART_MSR_CTS) && --tmout) {
-                        udelay(1);
-                        touch_nmi_watchdog();
-                }
-        }
-}
-
 static void serial8250_console_putchar(struct uart_port *port, int ch)
 {
         struct uart_8250_port *up = (struct uart_8250_port *)port;
diff --git a/drivers/serial/8250_acorn.c b/drivers/serial/8250_acorn.c
index ef8cc8a70c60..562ba745a044 100644
--- a/drivers/serial/8250_acorn.c
+++ b/drivers/serial/8250_acorn.c
@@ -47,11 +47,10 @@ serial_card_probe(struct expansion_card *ec, const struct ecard_id *id)
         unsigned long bus_addr;
         unsigned int i;
 
-        info = kmalloc(sizeof(struct serial_card_info), GFP_KERNEL);
+        info = kzalloc(sizeof(struct serial_card_info), GFP_KERNEL);
         if (!info)
                 return -ENOMEM;
 
-        memset(info, 0, sizeof(struct serial_card_info));
         info->num_ports = type->num_ports;
 
         bus_addr = ecard_resource_start(ec, type->type);
diff --git a/drivers/serial/8250_pci.c b/drivers/serial/8250_pci.c
index a2dac378bda9..6d7d616e9ccd 100644
--- a/drivers/serial/8250_pci.c
+++ b/drivers/serial/8250_pci.c
@@ -16,7 +16,6 @@
 #include <linux/module.h>
 #include <linux/init.h>
 #include <linux/pci.h>
-#include <linux/sched.h>
 #include <linux/string.h>
 #include <linux/kernel.h>
 #include <linux/slab.h>
@@ -1628,7 +1627,7 @@ pciserial_init_ports(struct pci_dev *dev, struct pciserial_board *board)
                         nr_ports = rc;
         }
 
-        priv = kmalloc(sizeof(struct serial_private) +
+        priv = kzalloc(sizeof(struct serial_private) +
                        sizeof(unsigned int) * nr_ports,
                        GFP_KERNEL);
         if (!priv) {
@@ -1636,9 +1635,6 @@ pciserial_init_ports(struct pci_dev *dev, struct pciserial_board *board)
                 goto err_deinit;
         }
 
-        memset(priv, 0, sizeof(struct serial_private) +
-                        sizeof(unsigned int) * nr_ports);
-
         priv->dev = dev;
         priv->quirk = quirk;
 
diff --git a/drivers/serial/8250_pnp.c b/drivers/serial/8250_pnp.c
index d3d6b82706b5..cde5db44abf6 100644
--- a/drivers/serial/8250_pnp.c
+++ b/drivers/serial/8250_pnp.c
@@ -450,11 +450,11 @@ serial_pnp_probe(struct pnp_dev *dev, const struct pnp_device_id *dev_id)
         port.dev = &dev->dev;
 
         line = serial8250_register_port(&port);
+        if (line < 0)
+                return -ENODEV;
 
-        if (line >= 0)
-                pnp_set_drvdata(dev, (void *)((long)line + 1));
-        return line >= 0 ? 0 : -ENODEV;
-
+        pnp_set_drvdata(dev, (void *)((long)line + 1));
+        return 0;
 }
 
 static void __devexit serial_pnp_remove(struct pnp_dev *dev)
diff --git a/drivers/serial/Kconfig b/drivers/serial/Kconfig
index 5cc6b91f8408..e8dd71df9165 100644
--- a/drivers/serial/Kconfig
+++ b/drivers/serial/Kconfig
@@ -686,6 +686,22 @@ config SERIAL_SH_SCI_CONSOLE
         depends on SERIAL_SH_SCI=y
         select SERIAL_CORE_CONSOLE
 
+config SERIAL_PNX8XXX
+        bool "Enable PNX8XXX SoCs' UART Support"
+        depends on MIPS && SOC_PNX8550
+        select SERIAL_CORE
+        help
+          If you have a MIPS-based Philips SoC such as PNX8550 or PNX8330
+          and you want to use serial ports, say Y.  Otherwise, say N.
+
+config SERIAL_PNX8XXX_CONSOLE
+        bool "Enable PNX8XX0 serial console"
+        depends on SERIAL_PNX8XXX
+        select SERIAL_CORE_CONSOLE
+        help
+          If you have a MIPS-based Philips SoC such as PNX8550 or PNX8330
+          and you want to use serial console, say Y. Otherwise, say N.
+
 config SERIAL_CORE
         tristate
 
@@ -999,4 +1015,14 @@ config SERIAL_NETX_CONSOLE
           If you have enabled the serial port on the Motorola IMX
           CPU you can make it the console by answering Y to this option.
 
+config SERIAL_OF_PLATFORM
+        tristate "Serial port on Open Firmware platform bus"
+        depends on PPC_OF
+        depends on SERIAL_8250
+        help
+          If you have a PowerPC based system that has serial ports
+          on a platform specific bus, you should enable this option.
+          Currently, only 8250 compatible ports are supported, but
+          others can easily be added.
+
 endmenu
diff --git a/drivers/serial/Makefile b/drivers/serial/Makefile
index df3632cd7df9..6b3560c5749a 100644
--- a/drivers/serial/Makefile
+++ b/drivers/serial/Makefile
@@ -25,6 +25,7 @@ obj-$(CONFIG_SERIAL_AMBA_PL010) += amba-pl010.o
 obj-$(CONFIG_SERIAL_AMBA_PL011) += amba-pl011.o
 obj-$(CONFIG_SERIAL_CLPS711X) += clps711x.o
 obj-$(CONFIG_SERIAL_PXA) += pxa.o
+obj-$(CONFIG_SERIAL_PNX8XXX) += pnx8xxx_uart.o
 obj-$(CONFIG_SERIAL_SA1100) += sa1100.o
 obj-$(CONFIG_SERIAL_S3C2410) += s3c2410.o
 obj-$(CONFIG_SERIAL_SUNCORE) += suncore.o
@@ -58,3 +59,4 @@ obj-$(CONFIG_SERIAL_SGI_IOC3) += ioc3_serial.o
 obj-$(CONFIG_SERIAL_ATMEL) += atmel_serial.o
 obj-$(CONFIG_SERIAL_UARTLITE) += uartlite.o
 obj-$(CONFIG_SERIAL_NETX) += netx-serial.o
+obj-$(CONFIG_SERIAL_OF_PLATFORM) += of_serial.o
diff --git a/drivers/serial/icom.c b/drivers/serial/icom.c
index 71e6a24d8c28..41431d0d5512 100644
--- a/drivers/serial/icom.c
+++ b/drivers/serial/icom.c
@@ -27,7 +27,6 @@
 #include <linux/kernel.h>
 #include <linux/errno.h>
 #include <linux/signal.h>
-#include <linux/sched.h>
 #include <linux/timer.h>
 #include <linux/interrupt.h>
 #include <linux/tty.h>
@@ -1417,14 +1416,12 @@ static int __devinit icom_alloc_adapter(struct icom_adapter
         struct list_head *tmp;
 
         icom_adapter = (struct icom_adapter *)
-            kmalloc(sizeof(struct icom_adapter), GFP_KERNEL);
+            kzalloc(sizeof(struct icom_adapter), GFP_KERNEL);
 
         if (!icom_adapter) {
                 return -ENOMEM;
         }
 
-        memset(icom_adapter, 0, sizeof(struct icom_adapter));
-
         list_for_each(tmp, &icom_adapter_head) {
                 cur_adapter_entry =
                     list_entry(tmp, struct icom_adapter,
diff --git a/drivers/serial/ioc3_serial.c b/drivers/serial/ioc3_serial.c
index 9cc0be932316..168073f12cec 100644
--- a/drivers/serial/ioc3_serial.c
+++ b/drivers/serial/ioc3_serial.c
@@ -2019,13 +2019,12 @@ ioc3uart_probe(struct ioc3_submodule *is, struct ioc3_driver_data *idd)
 
         DPRINT_CONFIG(("%s (0x%p, 0x%p)\n", __FUNCTION__, is, idd));
 
-        card_ptr = kmalloc(sizeof(struct ioc3_card), GFP_KERNEL);
+        card_ptr = kzalloc(sizeof(struct ioc3_card), GFP_KERNEL);
         if (!card_ptr) {
                 printk(KERN_WARNING "ioc3_attach_one"
                        ": unable to get memory for the IOC3\n");
                 return -ENOMEM;
         }
-        memset(card_ptr, 0, sizeof(struct ioc3_card));
         idd->data[is->id] = card_ptr;
         Submodule_slot = is->id;
 
@@ -2040,13 +2039,12 @@ ioc3uart_probe(struct ioc3_submodule *is, struct ioc3_driver_data *idd)
 
         /* Create port structures for each port */
         for (phys_port = 0; phys_port < PORTS_PER_CARD; phys_port++) {
-                port = kmalloc(sizeof(struct ioc3_port), GFP_KERNEL);
+                port = kzalloc(sizeof(struct ioc3_port), GFP_KERNEL);
                 if (!port) {
                         printk(KERN_WARNING
                                "IOC3 serial memory not available for port\n");
                         goto out4;
                 }
-                memset(port, 0, sizeof(struct ioc3_port));
                 spin_lock_init(&port->ip_lock);
 
                 /* we need to remember the previous ones, to point back to
diff --git a/drivers/serial/ioc4_serial.c b/drivers/serial/ioc4_serial.c
index f540212e7409..0c179384fb0c 100644
--- a/drivers/serial/ioc4_serial.c
+++ b/drivers/serial/ioc4_serial.c
@@ -1076,13 +1076,12 @@ static int inline ioc4_attach_local(struct ioc4_driver_data *idd)
         /* Create port structures for each port */
         for (port_number = 0; port_number < IOC4_NUM_SERIAL_PORTS;
                                                         port_number++) {
-                port = kmalloc(sizeof(struct ioc4_port), GFP_KERNEL);
+                port = kzalloc(sizeof(struct ioc4_port), GFP_KERNEL);
                 if (!port) {
                         printk(KERN_WARNING
                                 "IOC4 serial memory not available for port\n");
                         return -ENOMEM;
                 }
-                memset(port, 0, sizeof(struct ioc4_port));
                 spin_lock_init(&port->ip_lock);
 
                 /* we need to remember the previous ones, to point back to
@@ -2811,7 +2810,7 @@ ioc4_serial_attach_one(struct ioc4_driver_data *idd)
                                 (void *)serial));
 
         /* Get memory for the new card */
-        control = kmalloc(sizeof(struct ioc4_control), GFP_KERNEL);
+        control = kzalloc(sizeof(struct ioc4_control), GFP_KERNEL);
 
         if (!control) {
                 printk(KERN_WARNING "ioc4_attach_one"
@@ -2819,11 +2818,10 @@ ioc4_serial_attach_one(struct ioc4_driver_data *idd)
                 ret = -ENOMEM;
                 goto out2;
         }
-        memset(control, 0, sizeof(struct ioc4_control));
         idd->idd_serial_data = control;
 
         /* Allocate the soft structure */
-        soft = kmalloc(sizeof(struct ioc4_soft), GFP_KERNEL);
+        soft = kzalloc(sizeof(struct ioc4_soft), GFP_KERNEL);
         if (!soft) {
                 printk(KERN_WARNING
                        "ioc4 (%p): unable to get memory for the soft struct\n",
@@ -2831,7 +2829,6 @@ ioc4_serial_attach_one(struct ioc4_driver_data *idd)
                 ret = -ENOMEM;
                 goto out3;
         }
-        memset(soft, 0, sizeof(struct ioc4_soft));
 
         spin_lock_init(&soft->is_ir_lock);
         soft->is_ioc4_misc_addr = idd->idd_misc_regs;
diff --git a/drivers/serial/ip22zilog.c b/drivers/serial/ip22zilog.c
index 0746c9446ae0..c3abfb39f316 100644
--- a/drivers/serial/ip22zilog.c
+++ b/drivers/serial/ip22zilog.c
@@ -14,7 +14,6 @@
  */
 #include <linux/module.h>
 #include <linux/kernel.h>
-#include <linux/sched.h>
 #include <linux/errno.h>
 #include <linux/delay.h>
 #include <linux/tty.h>
@@ -922,13 +921,7 @@ static int zilog_irq = -1;
 
 static void * __init alloc_one_table(unsigned long size)
 {
-        void *ret;
-
-        ret = kmalloc(size, GFP_KERNEL);
-        if (ret != NULL)
-                memset(ret, 0, size);
-
-        return ret;
+        return kzalloc(size, GFP_KERNEL);
 }
 
 static void __init ip22zilog_alloc_tables(void)
diff --git a/drivers/serial/jsm/jsm_driver.c b/drivers/serial/jsm/jsm_driver.c
index 244f63be3a03..81792e6eeb2d 100644
--- a/drivers/serial/jsm/jsm_driver.c
+++ b/drivers/serial/jsm/jsm_driver.c
@@ -71,14 +71,13 @@ static int jsm_probe_one(struct pci_dev *pdev, const struct pci_device_id *ent)
                 goto out_disable_device;
         }
 
-        brd = kmalloc(sizeof(struct jsm_board), GFP_KERNEL);
+        brd = kzalloc(sizeof(struct jsm_board), GFP_KERNEL);
         if (!brd) {
                 dev_err(&pdev->dev,
                         "memory allocation for board structure failed\n");
                 rc = -ENOMEM;
                 goto out_release_regions;
         }
-        memset(brd, 0, sizeof(struct jsm_board));
 
         /* store the info for the board we've found */
         brd->boardnum = adapter_count++;
@@ -152,7 +151,7 @@ static int jsm_probe_one(struct pci_dev *pdev, const struct pci_device_id *ent)
          * Okay to malloc with GFP_KERNEL, we are not at interrupt
          * context, and there are no locks held.
          */
-        brd->flipbuf = kmalloc(MYFLIPLEN, GFP_KERNEL);
+        brd->flipbuf = kzalloc(MYFLIPLEN, GFP_KERNEL);
         if (!brd->flipbuf) {
                 /* XXX: leaking all resources from jsm_tty_init and
                         jsm_uart_port_init here! */
@@ -160,7 +159,6 @@ static int jsm_probe_one(struct pci_dev *pdev, const struct pci_device_id *ent)
                 retval = -ENOMEM;
                 goto out_free_irq;
         }
-        memset(brd->flipbuf, 0, MYFLIPLEN);
 
         pci_set_drvdata(pdev, brd);
 
diff --git a/drivers/serial/jsm/jsm_tty.c b/drivers/serial/jsm/jsm_tty.c
index 7cf1c60027f8..be22bbdbc8e5 100644
--- a/drivers/serial/jsm/jsm_tty.c
+++ b/drivers/serial/jsm/jsm_tty.c
@@ -194,31 +194,28 @@ static int jsm_tty_open(struct uart_port *port)
         /* Drop locks, as malloc with GFP_KERNEL can sleep */
 
         if (!channel->ch_rqueue) {
-                channel->ch_rqueue = (u8 *) kmalloc(RQUEUESIZE, GFP_KERNEL);
+                channel->ch_rqueue = kzalloc(RQUEUESIZE, GFP_KERNEL);
                 if (!channel->ch_rqueue) {
                         jsm_printk(INIT, ERR, &channel->ch_bd->pci_dev,
                                 "unable to allocate read queue buf");
                         return -ENOMEM;
                 }
-                memset(channel->ch_rqueue, 0, RQUEUESIZE);
         }
         if (!channel->ch_equeue) {
-                channel->ch_equeue = (u8 *) kmalloc(EQUEUESIZE, GFP_KERNEL);
+                channel->ch_equeue = kzalloc(EQUEUESIZE, GFP_KERNEL);
                 if (!channel->ch_equeue) {
                         jsm_printk(INIT, ERR, &channel->ch_bd->pci_dev,
                                 "unable to allocate error queue buf");
                         return -ENOMEM;
                 }
-                memset(channel->ch_equeue, 0, EQUEUESIZE);
         }
         if (!channel->ch_wqueue) {
-                channel->ch_wqueue = (u8 *) kmalloc(WQUEUESIZE, GFP_KERNEL);
+                channel->ch_wqueue = kzalloc(WQUEUESIZE, GFP_KERNEL);
                 if (!channel->ch_wqueue) {
                         jsm_printk(INIT, ERR, &channel->ch_bd->pci_dev,
                                 "unable to allocate write queue buf");
                         return -ENOMEM;
                 }
-                memset(channel->ch_wqueue, 0, WQUEUESIZE);
         }
 
         channel->ch_flags &= ~(CH_OPENING);
@@ -392,13 +389,12 @@ int jsm_tty_init(struct jsm_board *brd)
                          * Okay to malloc with GFP_KERNEL, we are not at
                          * interrupt context, and there are no locks held.
                          */
-                        brd->channels[i] = kmalloc(sizeof(struct jsm_channel), GFP_KERNEL);
+                        brd->channels[i] = kzalloc(sizeof(struct jsm_channel), GFP_KERNEL);
                         if (!brd->channels[i]) {
                                 jsm_printk(CORE, ERR, &brd->pci_dev,
                                         "%s:%d Unable to allocate memory for channel struct\n",
                                                          __FILE__, __LINE__);
                         }
-                        memset(brd->channels[i], 0, sizeof(struct jsm_channel));
                 }
         }
 
diff --git a/drivers/serial/mpc52xx_uart.c b/drivers/serial/mpc52xx_uart.c
index 3c4b6c243712..955bbd653e22 100644
--- a/drivers/serial/mpc52xx_uart.c
+++ b/drivers/serial/mpc52xx_uart.c
@@ -127,8 +127,7 @@ static irqreturn_t mpc52xx_uart_int(int irq,void *dev_id);
 
 #if defined(CONFIG_PPC_MERGE)
 static struct of_device_id mpc52xx_uart_of_match[] = {
-        { .type = "serial", .compatible = "mpc52xx-psc-uart", },
-        { .type = "serial", .compatible = "mpc5200-psc", }, /* Efika only! */
+        { .type = "serial", .compatible = "mpc5200-psc-uart", },
         {},
 };
 #endif
@@ -1068,7 +1067,7 @@ mpc52xx_uart_of_enumerate(void)
                         continue;
 
                 /* Is a particular device number requested? */
-                devno = get_property(np, "device_no", NULL);
+                devno = get_property(np, "port-number", NULL);
                 mpc52xx_uart_of_assign(of_node_get(np), devno ? *devno : -1);
         }
 
diff --git a/drivers/serial/of_serial.c b/drivers/serial/of_serial.c
new file mode 100644
index 000000000000..09b0b736a751
--- /dev/null
+++ b/drivers/serial/of_serial.c
@@ -0,0 +1,143 @@
+/*
+ *  Serial Port driver for Open Firmware platform devices
+ *
+ *    Copyright (C) 2006 Arnd Bergmann <arnd@arndb.de>, IBM Corp.
+ *
+ *  This program is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU General Public License
+ *  as published by the Free Software Foundation; either version
+ *  2 of the License, or (at your option) any later version.
+ *
+ */
+#include <linux/init.h>
+#include <linux/module.h>
+#include <linux/serial_core.h>
+#include <linux/serial_8250.h>
+
+#include <asm/of_platform.h>
+#include <asm/prom.h>
+
+/*
+ * Fill a struct uart_port for a given device node
+ */
+static int __devinit of_platform_serial_setup(struct of_device *ofdev,
+                                        int type, struct uart_port *port)
+{
+        struct resource resource;
+        struct device_node *np = ofdev->node;
+        const unsigned int *clk, *spd;
+        int ret;
+
+        memset(port, 0, sizeof *port);
+        spd = get_property(np, "current-speed", NULL);
+        clk = get_property(np, "clock-frequency", NULL);
+        if (!clk) {
+                dev_warn(&ofdev->dev, "no clock-frequency property set\n");
+                return -ENODEV;
+        }
+
+        ret = of_address_to_resource(np, 0, &resource);
+        if (ret) {
+                dev_warn(&ofdev->dev, "invalid address\n");
+                return ret;
+        }
+
+        spin_lock_init(&port->lock);
+        port->mapbase = resource.start;
+        port->irq = irq_of_parse_and_map(np, 0);
+        port->iotype = UPIO_MEM;
+        port->type = type;
+        port->uartclk = *clk;
+        port->flags = UPF_SHARE_IRQ | UPF_BOOT_AUTOCONF | UPF_IOREMAP;
+        port->dev = &ofdev->dev;
+        port->custom_divisor = *clk / (16 * (*spd));
+
+        return 0;
+}
+
+/*
+ * Try to register a serial port
+ */
+static int __devinit of_platform_serial_probe(struct of_device *ofdev,
+                                                const struct of_device_id *id)
+{
+        struct uart_port port;
+        int port_type;
+        int ret;
+
+        if (of_find_property(ofdev->node, "used-by-rtas", NULL))
+                return -EBUSY;
+
+        port_type = (unsigned long)id->data;
+        ret = of_platform_serial_setup(ofdev, port_type, &port);
+        if (ret)
+                goto out;
+
+        switch (port_type) {
+        case PORT_UNKNOWN:
+                dev_info(&ofdev->dev, "Unknown serial port found, "
+                        "attempting to use 8250 driver\n");
+                /* fallthrough */
+        case PORT_8250 ... PORT_MAX_8250:
+                ret = serial8250_register_port(&port);
+                break;
+        default:
+                /* need to add code for these */
+                ret = -ENODEV;
+                break;
+        }
+        if (ret < 0)
+                goto out;
+
+        ofdev->dev.driver_data = (void *)(unsigned long)ret;
+        return 0;
+out:
+        irq_dispose_mapping(port.irq);
+        return ret;
+}
+
+/*
+ * Release a line
+ */
+static int of_platform_serial_remove(struct of_device *ofdev)
+{
+        int line = (unsigned long)ofdev->dev.driver_data;
+        serial8250_unregister_port(line);
+        return 0;
+}
+
+/*
+ * A few common types, add more as needed.
+ */
+static struct of_device_id __devinitdata of_platform_serial_table[] = {
+        { .type = "serial", .compatible = "ns8250",   .data = (void *)PORT_8250, },
+        { .type = "serial", .compatible = "ns16450",  .data = (void *)PORT_16450, },
+        { .type = "serial", .compatible = "ns16550",  .data = (void *)PORT_16550, },
+        { .type = "serial", .compatible = "ns16750",  .data = (void *)PORT_16750, },
+        { .type = "serial",                           .data = (void *)PORT_UNKNOWN, },
+        { /* end of list */ },
+};
+
+static struct of_platform_driver __devinitdata of_platform_serial_driver = {
+        .owner = THIS_MODULE,
+        .name = "of_serial",
+        .probe = of_platform_serial_probe,
+        .remove = of_platform_serial_remove,
+        .match_table = of_platform_serial_table,
+};
+
+static int __init of_platform_serial_init(void)
+{
+        return of_register_platform_driver(&of_platform_serial_driver);
+}
+module_init(of_platform_serial_init);
+
+static void __exit of_platform_serial_exit(void)
+{
+        return of_unregister_platform_driver(&of_platform_serial_driver);
+};
+module_exit(of_platform_serial_exit);
+
+MODULE_AUTHOR("Arnd Bergmann <arnd@arndb.de>");
+MODULE_LICENSE("GPL");
+MODULE_DESCRIPTION("Serial Port driver for Open Firmware platform devices");
diff --git a/drivers/serial/pnx8xxx_uart.c b/drivers/serial/pnx8xxx_uart.c
new file mode 100644
index 000000000000..8d01c59e8d04
--- /dev/null
+++ b/drivers/serial/pnx8xxx_uart.c
@@ -0,0 +1,852 @@
+/*
+ * UART driver for PNX8XXX SoCs
+ *
+ * Author: Per Hallsmark per.hallsmark@mvista.com
+ * Ported to 2.6 kernel by EmbeddedAlley
+ * Reworked by Vitaly Wool <vitalywool@gmail.com>
+ *
+ * Based on drivers/char/serial.c, by Linus Torvalds, Theodore Ts'o.
+ * Copyright (C) 2000 Deep Blue Solutions Ltd.
+ *
+ * This file is licensed under the terms of the GNU General Public License
+ * version 2. This program is licensed "as is" without any warranty of
+ * any kind, whether express or implied.
+ *
+ */
+
+#if defined(CONFIG_SERIAL_PNX8XXX_CONSOLE) && defined(CONFIG_MAGIC_SYSRQ)
+#define SUPPORT_SYSRQ
+#endif
+
+#include <linux/module.h>
+#include <linux/ioport.h>
+#include <linux/init.h>
+#include <linux/console.h>
+#include <linux/sysrq.h>
+#include <linux/device.h>
+#include <linux/platform_device.h>
+#include <linux/tty.h>
+#include <linux/tty_flip.h>
+#include <linux/serial_core.h>
+#include <linux/serial.h>
+#include <linux/serial_pnx8xxx.h>
+
+#include <asm/io.h>
+#include <asm/irq.h>
+
+/* We'll be using StrongARM sa1100 serial port major/minor */
+#define SERIAL_PNX8XXX_MAJOR    204
+#define MINOR_START             5
+
+#define NR_PORTS                2
+
+#define PNX8XXX_ISR_PASS_LIMIT  256
+
+/*
+ * Convert from ignore_status_mask or read_status_mask to FIFO
+ * and interrupt status bits
+ */
+#define SM_TO_FIFO(x)   ((x) >> 10)
+#define SM_TO_ISTAT(x)  ((x) & 0x000001ff)
+#define FIFO_TO_SM(x)   ((x) << 10)
+#define ISTAT_TO_SM(x)  ((x) & 0x000001ff)
+
+/*
+ * This is the size of our serial port register set.
+ */
+#define UART_PORT_SIZE  0x1000
+
+/*
+ * This determines how often we check the modem status signals
+ * for any change.  They generally aren't connected to an IRQ
+ * so we have to poll them.  We also check immediately before
+ * filling the TX fifo incase CTS has been dropped.
+ */
+#define MCTRL_TIMEOUT   (250*HZ/1000)
+
+extern struct pnx8xxx_port pnx8xxx_ports[];
+
+static inline int serial_in(struct pnx8xxx_port *sport, int offset)
+{
+        return (__raw_readl(sport->port.membase + offset));
+}
+
+static inline void serial_out(struct pnx8xxx_port *sport, int offset, int value)
+{
+        __raw_writel(value, sport->port.membase + offset);
+}
+
+/*
+ * Handle any change of modem status signal since we were last called.
+ */
+static void pnx8xxx_mctrl_check(struct pnx8xxx_port *sport)
+{
+        unsigned int status, changed;
+
+        status = sport->port.ops->get_mctrl(&sport->port);
+        changed = status ^ sport->old_status;
+
+        if (changed == 0)
+                return;
+
+        sport->old_status = status;
+
+        if (changed & TIOCM_RI)
+                sport->port.icount.rng++;
+        if (changed & TIOCM_DSR)
+                sport->port.icount.dsr++;
+        if (changed & TIOCM_CAR)
+                uart_handle_dcd_change(&sport->port, status & TIOCM_CAR);
+        if (changed & TIOCM_CTS)
+                uart_handle_cts_change(&sport->port, status & TIOCM_CTS);
+
+        wake_up_interruptible(&sport->port.info->delta_msr_wait);
+}
+
+/*
+ * This is our per-port timeout handler, for checking the
+ * modem status signals.
+ */
+static void pnx8xxx_timeout(unsigned long data)
+{
+        struct pnx8xxx_port *sport = (struct pnx8xxx_port *)data;
+        unsigned long flags;
+
+        if (sport->port.info) {
+                spin_lock_irqsave(&sport->port.lock, flags);
+                pnx8xxx_mctrl_check(sport);
+                spin_unlock_irqrestore(&sport->port.lock, flags);
+
+                mod_timer(&sport->timer, jiffies + MCTRL_TIMEOUT);
+        }
+}
+
+/*
+ * interrupts disabled on entry
+ */
+static void pnx8xxx_stop_tx(struct uart_port *port)
+{
+        struct pnx8xxx_port *sport = (struct pnx8xxx_port *)port;
+        u32 ien;
+
+        /* Disable TX intr */
+        ien = serial_in(sport, PNX8XXX_IEN);
+        serial_out(sport, PNX8XXX_IEN, ien & ~PNX8XXX_UART_INT_ALLTX);
+
+        /* Clear all pending TX intr */
+        serial_out(sport, PNX8XXX_ICLR, PNX8XXX_UART_INT_ALLTX);
+}
+
+/*
+ * interrupts may not be disabled on entry
+ */
+static void pnx8xxx_start_tx(struct uart_port *port)
+{
+        struct pnx8xxx_port *sport = (struct pnx8xxx_port *)port;
+        u32 ien;
+
+        /* Clear all pending TX intr */
+        serial_out(sport, PNX8XXX_ICLR, PNX8XXX_UART_INT_ALLTX);
+
+        /* Enable TX intr */
+        ien = serial_in(sport, PNX8XXX_IEN);
+        serial_out(sport, PNX8XXX_IEN, ien | PNX8XXX_UART_INT_ALLTX);
+}
+
+/*
+ * Interrupts enabled
+ */
+static void pnx8xxx_stop_rx(struct uart_port *port)
+{
+        struct pnx8xxx_port *sport = (struct pnx8xxx_port *)port;
+        u32 ien;
+
+        /* Disable RX intr */
+        ien = serial_in(sport, PNX8XXX_IEN);
+        serial_out(sport, PNX8XXX_IEN, ien & ~PNX8XXX_UART_INT_ALLRX);
+
+        /* Clear all pending RX intr */
+        serial_out(sport, PNX8XXX_ICLR, PNX8XXX_UART_INT_ALLRX);
+}
+
+/*
+ * Set the modem control timer to fire immediately.
+ */
+static void pnx8xxx_enable_ms(struct uart_port *port)
+{
+        struct pnx8xxx_port *sport = (struct pnx8xxx_port *)port;
+
+        mod_timer(&sport->timer, jiffies);
+}
+
+static void pnx8xxx_rx_chars(struct pnx8xxx_port *sport)
+{
+        struct tty_struct *tty = sport->port.info->tty;
+        unsigned int status, ch, flg;
+
+        status = FIFO_TO_SM(serial_in(sport, PNX8XXX_FIFO)) |
+                 ISTAT_TO_SM(serial_in(sport, PNX8XXX_ISTAT));
+        while (status & FIFO_TO_SM(PNX8XXX_UART_FIFO_RXFIFO)) {
+                ch = serial_in(sport, PNX8XXX_FIFO);
+
+                sport->port.icount.rx++;
+
+                flg = TTY_NORMAL;
+
+                /*
+                 * note that the error handling code is
+                 * out of the main execution path
+                 */
+                if (status & (FIFO_TO_SM(PNX8XXX_UART_FIFO_RXFE |
+                                        PNX8XXX_UART_FIFO_RXPAR) |
+                              ISTAT_TO_SM(PNX8XXX_UART_INT_RXOVRN))) {
+                        if (status & FIFO_TO_SM(PNX8XXX_UART_FIFO_RXPAR))
+                                sport->port.icount.parity++;
+                        else if (status & FIFO_TO_SM(PNX8XXX_UART_FIFO_RXFE))
+                                sport->port.icount.frame++;
+                        if (status & ISTAT_TO_SM(PNX8XXX_UART_INT_RXOVRN))
+                                sport->port.icount.overrun++;
+
+                        status &= sport->port.read_status_mask;
+
+                        if (status & FIFO_TO_SM(PNX8XXX_UART_FIFO_RXPAR))
+                                flg = TTY_PARITY;
+                        else if (status & FIFO_TO_SM(PNX8XXX_UART_FIFO_RXFE))
+                                flg = TTY_FRAME;
+
+#ifdef SUPPORT_SYSRQ
+                        sport->port.sysrq = 0;
+#endif
+                }
+
+                if (uart_handle_sysrq_char(&sport->port, ch))
+                        goto ignore_char;
+
+                uart_insert_char(&sport->port, status,
+                                ISTAT_TO_SM(PNX8XXX_UART_INT_RXOVRN), ch, flg);
+
+        ignore_char:
+                serial_out(sport, PNX8XXX_LCR, serial_in(sport, PNX8XXX_LCR) |
+                                PNX8XXX_UART_LCR_RX_NEXT);
+                status = FIFO_TO_SM(serial_in(sport, PNX8XXX_FIFO)) |
+                         ISTAT_TO_SM(serial_in(sport, PNX8XXX_ISTAT));
+        }
+        tty_flip_buffer_push(tty);
+}
+
+static void pnx8xxx_tx_chars(struct pnx8xxx_port *sport)
+{
+        struct circ_buf *xmit = &sport->port.info->xmit;
+
+        if (sport->port.x_char) {
+                serial_out(sport, PNX8XXX_FIFO, sport->port.x_char);
+                sport->port.icount.tx++;
+                sport->port.x_char = 0;
+                return;
+        }
+
+        /*
+         * Check the modem control lines before
+         * transmitting anything.
+         */
+        pnx8xxx_mctrl_check(sport);
+
+        if (uart_circ_empty(xmit) || uart_tx_stopped(&sport->port)) {
+                pnx8xxx_stop_tx(&sport->port);
+                return;
+        }
+
+        /*
+         * TX while bytes available
+         */
+        while (((serial_in(sport, PNX8XXX_FIFO) &
+                                        PNX8XXX_UART_FIFO_TXFIFO) >> 16) < 16) {
+                serial_out(sport, PNX8XXX_FIFO, xmit->buf[xmit->tail]);
+                xmit->tail = (xmit->tail + 1) & (UART_XMIT_SIZE - 1);
+                sport->port.icount.tx++;
+                if (uart_circ_empty(xmit))
+                        break;
+        }
+
+        if (uart_circ_chars_pending(xmit) < WAKEUP_CHARS)
+                uart_write_wakeup(&sport->port);
+
+        if (uart_circ_empty(xmit))
+                pnx8xxx_stop_tx(&sport->port);
+}
+
+static irqreturn_t pnx8xxx_int(int irq, void *dev_id)
+{
+        struct pnx8xxx_port *sport = dev_id;
+        unsigned int status;
+
+        spin_lock(&sport->port.lock);
+        /* Get the interrupts */
+        status  = serial_in(sport, PNX8XXX_ISTAT) & serial_in(sport, PNX8XXX_IEN);
+
+        /* Break signal received */
+        if (status & PNX8XXX_UART_INT_BREAK) {
+                sport->port.icount.brk++;
+                uart_handle_break(&sport->port);
+        }
+
+        /* Byte received */
+        if (status & PNX8XXX_UART_INT_RX)
+                pnx8xxx_rx_chars(sport);
+
+        /* TX holding register empty - transmit a byte */
+        if (status & PNX8XXX_UART_INT_TX)
+                pnx8xxx_tx_chars(sport);
+
+        /* Clear the ISTAT register */
+        serial_out(sport, PNX8XXX_ICLR, status);
+
+        spin_unlock(&sport->port.lock);
+        return IRQ_HANDLED;
+}
+
+/*
+ * Return TIOCSER_TEMT when transmitter is not busy.
+ */
+static unsigned int pnx8xxx_tx_empty(struct uart_port *port)
+{
+        struct pnx8xxx_port *sport = (struct pnx8xxx_port *)port;
+
+        return serial_in(sport, PNX8XXX_FIFO) & PNX8XXX_UART_FIFO_TXFIFO_STA ? 0 : TIOCSER_TEMT;
+}
+
+static unsigned int pnx8xxx_get_mctrl(struct uart_port *port)
+{
+        struct pnx8xxx_port *sport = (struct pnx8xxx_port *)port;
+        unsigned int mctrl = TIOCM_DSR;
+        unsigned int msr;
+
+        /* REVISIT */
+
+        msr = serial_in(sport, PNX8XXX_MCR);
+
+        mctrl |= msr & PNX8XXX_UART_MCR_CTS ? TIOCM_CTS : 0;
+        mctrl |= msr & PNX8XXX_UART_MCR_DCD ? TIOCM_CAR : 0;
+
+        return mctrl;
+}
+
+static void pnx8xxx_set_mctrl(struct uart_port *port, unsigned int mctrl)
+{
+#if     0       /* FIXME */
+        struct pnx8xxx_port *sport = (struct pnx8xxx_port *)port;
+        unsigned int msr;
+#endif
+}
+
+/*
+ * Interrupts always disabled.
+ */
+static void pnx8xxx_break_ctl(struct uart_port *port, int break_state)
+{
+        struct pnx8xxx_port *sport = (struct pnx8xxx_port *)port;
+        unsigned long flags;
+        unsigned int lcr;
+
+        spin_lock_irqsave(&sport->port.lock, flags);
+        lcr = serial_in(sport, PNX8XXX_LCR);
+        if (break_state == -1)
+                lcr |= PNX8XXX_UART_LCR_TXBREAK;
+        else
+                lcr &= ~PNX8XXX_UART_LCR_TXBREAK;
+        serial_out(sport, PNX8XXX_LCR, lcr);
+        spin_unlock_irqrestore(&sport->port.lock, flags);
+}
+
+static int pnx8xxx_startup(struct uart_port *port)
+{
+        struct pnx8xxx_port *sport = (struct pnx8xxx_port *)port;
+        int retval;
+
+        /*
+         * Allocate the IRQ
+         */
+        retval = request_irq(sport->port.irq, pnx8xxx_int, 0,
+                             "pnx8xxx-uart", sport);
+        if (retval)
+                return retval;
+
+        /*
+         * Finally, clear and enable interrupts
+         */
+
+        serial_out(sport, PNX8XXX_ICLR, PNX8XXX_UART_INT_ALLRX |
+                             PNX8XXX_UART_INT_ALLTX);
+
+        serial_out(sport, PNX8XXX_IEN, serial_in(sport, PNX8XXX_IEN) |
+                            PNX8XXX_UART_INT_ALLRX |
+                            PNX8XXX_UART_INT_ALLTX);
+
+        /*
+         * Enable modem status interrupts
+         */
+        spin_lock_irq(&sport->port.lock);
+        pnx8xxx_enable_ms(&sport->port);
+        spin_unlock_irq(&sport->port.lock);
+
+        return 0;
+}
+
+static void pnx8xxx_shutdown(struct uart_port *port)
+{
+        struct pnx8xxx_port *sport = (struct pnx8xxx_port *)port;
+        int lcr;
+
+        /*
+         * Stop our timer.
+         */
+        del_timer_sync(&sport->timer);
+
+        /*
+         * Disable all interrupts
+         */
+        serial_out(sport, PNX8XXX_IEN, 0);
+
+        /*
+         * Reset the Tx and Rx FIFOS, disable the break condition
+         */
+        lcr = serial_in(sport, PNX8XXX_LCR);
+        lcr &= ~PNX8XXX_UART_LCR_TXBREAK;
+        lcr |= PNX8XXX_UART_LCR_TX_RST | PNX8XXX_UART_LCR_RX_RST;
+        serial_out(sport, PNX8XXX_LCR, lcr);
+
+        /*
+         * Clear all interrupts
+         */
+        serial_out(sport, PNX8XXX_ICLR, PNX8XXX_UART_INT_ALLRX |
+                             PNX8XXX_UART_INT_ALLTX);
+
+        /*
+         * Free the interrupt
+         */
+        free_irq(sport->port.irq, sport);
+}
+
+static void
+pnx8xxx_set_termios(struct uart_port *port, struct ktermios *termios,
+                   struct ktermios *old)
+{
+        struct pnx8xxx_port *sport = (struct pnx8xxx_port *)port;
+        unsigned long flags;
+        unsigned int lcr_fcr, old_ien, baud, quot;
+        unsigned int old_csize = old ? old->c_cflag & CSIZE : CS8;
+
+        /*
+         * We only support CS7 and CS8.
+         */
+        while ((termios->c_cflag & CSIZE) != CS7 &&
+               (termios->c_cflag & CSIZE) != CS8) {
+                termios->c_cflag &= ~CSIZE;
+                termios->c_cflag |= old_csize;
+                old_csize = CS8;
+        }
+
+        if ((termios->c_cflag & CSIZE) == CS8)
+                lcr_fcr = PNX8XXX_UART_LCR_8BIT;
+        else
+                lcr_fcr = 0;
+
+        if (termios->c_cflag & CSTOPB)
+                lcr_fcr |= PNX8XXX_UART_LCR_2STOPB;
+        if (termios->c_cflag & PARENB) {
+                lcr_fcr |= PNX8XXX_UART_LCR_PAREN;
+                if (!(termios->c_cflag & PARODD))
+                        lcr_fcr |= PNX8XXX_UART_LCR_PAREVN;
+        }
+
+        /*
+         * Ask the core to calculate the divisor for us.
+         */
+        baud = uart_get_baud_rate(port, termios, old, 0, port->uartclk/16);
+        quot = uart_get_divisor(port, baud);
+
+        spin_lock_irqsave(&sport->port.lock, flags);
+
+        sport->port.read_status_mask = ISTAT_TO_SM(PNX8XXX_UART_INT_RXOVRN) |
+                                ISTAT_TO_SM(PNX8XXX_UART_INT_EMPTY) |
+                                ISTAT_TO_SM(PNX8XXX_UART_INT_RX);
+        if (termios->c_iflag & INPCK)
+                sport->port.read_status_mask |=
+                        FIFO_TO_SM(PNX8XXX_UART_FIFO_RXFE) |
+                        FIFO_TO_SM(PNX8XXX_UART_FIFO_RXPAR);
+        if (termios->c_iflag & (BRKINT | PARMRK))
+                sport->port.read_status_mask |=
+                        ISTAT_TO_SM(PNX8XXX_UART_INT_BREAK);
+
+        /*
+         * Characters to ignore
+         */
+        sport->port.ignore_status_mask = 0;
+        if (termios->c_iflag & IGNPAR)
+                sport->port.ignore_status_mask |=
+                        FIFO_TO_SM(PNX8XXX_UART_FIFO_RXFE) |
+                        FIFO_TO_SM(PNX8XXX_UART_FIFO_RXPAR);
+        if (termios->c_iflag & IGNBRK) {
+                sport->port.ignore_status_mask |=
+                        ISTAT_TO_SM(PNX8XXX_UART_INT_BREAK);
+                /*
+                 * If we're ignoring parity and break indicators,
+                 * ignore overruns too (for real raw support).
+                 */
+                if (termios->c_iflag & IGNPAR)
+                        sport->port.ignore_status_mask |=
+                                ISTAT_TO_SM(PNX8XXX_UART_INT_RXOVRN);
+        }
+
+        /*
+         * ignore all characters if CREAD is not set
+         */
+        if ((termios->c_cflag & CREAD) == 0)
+                sport->port.ignore_status_mask |=
+                        ISTAT_TO_SM(PNX8XXX_UART_INT_RX);
+
+        del_timer_sync(&sport->timer);
+
+        /*
+         * Update the per-port timeout.
+         */
+        uart_update_timeout(port, termios->c_cflag, baud);
+
+        /*
+         * disable interrupts and drain transmitter
+         */
+        old_ien = serial_in(sport, PNX8XXX_IEN);
+        serial_out(sport, PNX8XXX_IEN, old_ien & ~(PNX8XXX_UART_INT_ALLTX |
+                                        PNX8XXX_UART_INT_ALLRX));
+
+        while (serial_in(sport, PNX8XXX_FIFO) & PNX8XXX_UART_FIFO_TXFIFO_STA)
+                barrier();
+
+        /* then, disable everything */
+        serial_out(sport, PNX8XXX_IEN, 0);
+
+        /* Reset the Rx and Tx FIFOs too */
+        lcr_fcr |= PNX8XXX_UART_LCR_TX_RST;
+        lcr_fcr |= PNX8XXX_UART_LCR_RX_RST;
+
+        /* set the parity, stop bits and data size */
+        serial_out(sport, PNX8XXX_LCR, lcr_fcr);
+
+        /* set the baud rate */
+        quot -= 1;
+        serial_out(sport, PNX8XXX_BAUD, quot);
+
+        serial_out(sport, PNX8XXX_ICLR, -1);
+
+        serial_out(sport, PNX8XXX_IEN, old_ien);
+
+        if (UART_ENABLE_MS(&sport->port, termios->c_cflag))
+                pnx8xxx_enable_ms(&sport->port);
+
+        spin_unlock_irqrestore(&sport->port.lock, flags);
+}
+
+static const char *pnx8xxx_type(struct uart_port *port)
+{
+        struct pnx8xxx_port *sport = (struct pnx8xxx_port *)port;
+
+        return sport->port.type == PORT_PNX8XXX ? "PNX8XXX" : NULL;
+}
+
+/*
+ * Release the memory region(s) being used by 'port'.
+ */
+static void pnx8xxx_release_port(struct uart_port *port)
+{
+        struct pnx8xxx_port *sport = (struct pnx8xxx_port *)port;
+
+        release_mem_region(sport->port.mapbase, UART_PORT_SIZE);
+}
+
+/*
+ * Request the memory region(s) being used by 'port'.
+ */
+static int pnx8xxx_request_port(struct uart_port *port)
+{
+        struct pnx8xxx_port *sport = (struct pnx8xxx_port *)port;
+        return request_mem_region(sport->port.mapbase, UART_PORT_SIZE,
+                        "pnx8xxx-uart") != NULL ? 0 : -EBUSY;
+}
+
+/*
+ * Configure/autoconfigure the port.
+ */
+static void pnx8xxx_config_port(struct uart_port *port, int flags)
+{
+        struct pnx8xxx_port *sport = (struct pnx8xxx_port *)port;
+
+        if (flags & UART_CONFIG_TYPE &&
+            pnx8xxx_request_port(&sport->port) == 0)
+                sport->port.type = PORT_PNX8XXX;
+}
+
+/*
+ * Verify the new serial_struct (for TIOCSSERIAL).
+ * The only change we allow are to the flags and type, and
+ * even then only between PORT_PNX8XXX and PORT_UNKNOWN
+ */
+static int
+pnx8xxx_verify_port(struct uart_port *port, struct serial_struct *ser)
+{
+        struct pnx8xxx_port *sport = (struct pnx8xxx_port *)port;
+        int ret = 0;
+
+        if (ser->type != PORT_UNKNOWN && ser->type != PORT_PNX8XXX)
+                ret = -EINVAL;
+        if (sport->port.irq != ser->irq)
+                ret = -EINVAL;
+        if (ser->io_type != SERIAL_IO_MEM)
+                ret = -EINVAL;
+        if (sport->port.uartclk / 16 != ser->baud_base)
+                ret = -EINVAL;
+        if ((void *)sport->port.mapbase != ser->iomem_base)
+                ret = -EINVAL;
+        if (sport->port.iobase != ser->port)
+                ret = -EINVAL;
+        if (ser->hub6 != 0)
+                ret = -EINVAL;
+        return ret;
+}
+
+static struct uart_ops pnx8xxx_pops = {
+        .tx_empty       = pnx8xxx_tx_empty,
+        .set_mctrl      = pnx8xxx_set_mctrl,
+        .get_mctrl      = pnx8xxx_get_mctrl,
+        .stop_tx        = pnx8xxx_stop_tx,
+        .start_tx       = pnx8xxx_start_tx,
+        .stop_rx        = pnx8xxx_stop_rx,
+        .enable_ms      = pnx8xxx_enable_ms,
+        .break_ctl      = pnx8xxx_break_ctl,
+        .startup        = pnx8xxx_startup,
+        .shutdown       = pnx8xxx_shutdown,
+        .set_termios    = pnx8xxx_set_termios,
+        .type           = pnx8xxx_type,
+        .release_port   = pnx8xxx_release_port,
+        .request_port   = pnx8xxx_request_port,
+        .config_port    = pnx8xxx_config_port,
+        .verify_port    = pnx8xxx_verify_port,
+};
+
+
+/*
+ * Setup the PNX8XXX serial ports.
+ *
+ * Note also that we support "console=ttySx" where "x" is either 0 or 1.
+ */
+static void __init pnx8xxx_init_ports(void)
+{
+        static int first = 1;
+        int i;
+
+        if (!first)
+                return;
+        first = 0;
+
+        for (i = 0; i < NR_PORTS; i++) {
+                init_timer(&pnx8xxx_ports[i].timer);
+                pnx8xxx_ports[i].timer.function = pnx8xxx_timeout;
+                pnx8xxx_ports[i].timer.data     = (unsigned long)&pnx8xxx_ports[i];
+                pnx8xxx_ports[i].port.ops = &pnx8xxx_pops;
+        }
+}
+
+#ifdef CONFIG_SERIAL_PNX8XXX_CONSOLE
+
+static void pnx8xxx_console_putchar(struct uart_port *port, int ch)
+{
+        struct pnx8xxx_port *sport = (struct pnx8xxx_port *)port;
+        int status;
+
+        do {
+                /* Wait for UART_TX register to empty */
+                status = serial_in(sport, PNX8XXX_FIFO);
+        } while (status & PNX8XXX_UART_FIFO_TXFIFO);
+        serial_out(sport, PNX8XXX_FIFO, ch);
+}
+
+/*
+ * Interrupts are disabled on entering
+ */static void
+pnx8xxx_console_write(struct console *co, const char *s, unsigned int count)
+{
+        struct pnx8xxx_port *sport = &pnx8xxx_ports[co->index];
+        unsigned int old_ien, status;
+
+        /*
+         *      First, save IEN and then disable interrupts
+         */
+        old_ien = serial_in(sport, PNX8XXX_IEN);
+        serial_out(sport, PNX8XXX_IEN, old_ien & ~(PNX8XXX_UART_INT_ALLTX |
+                                        PNX8XXX_UART_INT_ALLRX));
+
+        uart_console_write(&sport->port, s, count, pnx8xxx_console_putchar);
+
+        /*
+         *      Finally, wait for transmitter to become empty
+         *      and restore IEN
+         */
+        do {
+                /* Wait for UART_TX register to empty */
+                status = serial_in(sport, PNX8XXX_FIFO);
+        } while (status & PNX8XXX_UART_FIFO_TXFIFO);
+
+        /* Clear TX and EMPTY interrupt */
+        serial_out(sport, PNX8XXX_ICLR, PNX8XXX_UART_INT_TX |
+                             PNX8XXX_UART_INT_EMPTY);
+
+        serial_out(sport, PNX8XXX_IEN, old_ien);
+}
+
+static int __init
+pnx8xxx_console_setup(struct console *co, char *options)
+{
+        struct pnx8xxx_port *sport;
+        int baud = 38400;
+        int bits = 8;
+        int parity = 'n';
+        int flow = 'n';
+
+        /*
+         * Check whether an invalid uart number has been specified, and
+         * if so, search for the first available port that does have
+         * console support.
+         */
+        if (co->index == -1 || co->index >= NR_PORTS)
+                co->index = 0;
+        sport = &pnx8xxx_ports[co->index];
+
+        if (options)
+                uart_parse_options(options, &baud, &parity, &bits, &flow);
+
+        return uart_set_options(&sport->port, co, baud, parity, bits, flow);
+}
+
+static struct uart_driver pnx8xxx_reg;
+static struct console pnx8xxx_console = {
+        .name           = "ttyS",
+        .write          = pnx8xxx_console_write,
+        .device         = uart_console_device,
+        .setup          = pnx8xxx_console_setup,
+        .flags          = CON_PRINTBUFFER,
+        .index          = -1,
+        .data           = &pnx8xxx_reg,
+};
+
+static int __init pnx8xxx_rs_console_init(void)
+{
+        pnx8xxx_init_ports();
+        register_console(&pnx8xxx_console);
+        return 0;
+}
+console_initcall(pnx8xxx_rs_console_init);
+
+#define PNX8XXX_CONSOLE &pnx8xxx_console
+#else
+#define PNX8XXX_CONSOLE NULL
+#endif
+
+static struct uart_driver pnx8xxx_reg = {
+        .owner                  = THIS_MODULE,
+        .driver_name            = "ttyS",
+        .dev_name               = "ttyS",
+        .major                  = SERIAL_PNX8XXX_MAJOR,
+        .minor                  = MINOR_START,
+        .nr                     = NR_PORTS,
+        .cons                   = PNX8XXX_CONSOLE,
+};
+
+static int pnx8xxx_serial_suspend(struct platform_device *pdev, pm_message_t state)
+{
+        struct pnx8xxx_port *sport = platform_get_drvdata(pdev);
+
+        return uart_suspend_port(&pnx8xxx_reg, &sport->port);
+}
+
+static int pnx8xxx_serial_resume(struct platform_device *pdev)
+{
+        struct pnx8xxx_port *sport = platform_get_drvdata(pdev);
+
+        return uart_resume_port(&pnx8xxx_reg, &sport->port);
+}
+
+static int pnx8xxx_serial_probe(struct platform_device *pdev)
+{
+        struct resource *res = pdev->resource;
+        int i;
+
+        for (i = 0; i < pdev->num_resources; i++, res++) {
+                if (!(res->flags & IORESOURCE_MEM))
+                        continue;
+
+                for (i = 0; i < NR_PORTS; i++) {
+                        if (pnx8xxx_ports[i].port.mapbase != res->start)
+                                continue;
+
+                        pnx8xxx_ports[i].port.dev = &pdev->dev;
+                        uart_add_one_port(&pnx8xxx_reg, &pnx8xxx_ports[i].port);
+                        platform_set_drvdata(pdev, &pnx8xxx_ports[i]);
+                        break;
+                }
+        }
+
+        return 0;
+}
+
+static int pnx8xxx_serial_remove(struct platform_device *pdev)
+{
+        struct pnx8xxx_port *sport = platform_get_drvdata(pdev);
+
+        platform_set_drvdata(pdev, NULL);
+
+        if (sport)
+                uart_remove_one_port(&pnx8xxx_reg, &sport->port);
+
+        return 0;
+}
+
+static struct platform_driver pnx8xxx_serial_driver = {
+        .driver         = {
+                .name   = "pnx8xxx-uart",
+                .owner  = THIS_MODULE,
+        },
+        .probe          = pnx8xxx_serial_probe,
+        .remove         = pnx8xxx_serial_remove,
+        .suspend        = pnx8xxx_serial_suspend,
+        .resume         = pnx8xxx_serial_resume,
+};
+
+static int __init pnx8xxx_serial_init(void)
+{
+        int ret;
+
+        printk(KERN_INFO "Serial: PNX8XXX driver $Revision: 1.2 $\n");
+
+        pnx8xxx_init_ports();
+
+        ret = uart_register_driver(&pnx8xxx_reg);
+        if (ret == 0) {
+                ret = platform_driver_register(&pnx8xxx_serial_driver);
+                if (ret)
+                        uart_unregister_driver(&pnx8xxx_reg);
+        }
+        return ret;
+}
+
+static void __exit pnx8xxx_serial_exit(void)
+{
+        platform_driver_unregister(&pnx8xxx_serial_driver);
+        uart_unregister_driver(&pnx8xxx_reg);
+}
+
+module_init(pnx8xxx_serial_init);
+module_exit(pnx8xxx_serial_exit);
+
+MODULE_AUTHOR("Embedded Alley Solutions, Inc.");
+MODULE_DESCRIPTION("PNX8XXX SoCs serial port driver");
+MODULE_LICENSE("GPL");
+MODULE_ALIAS_CHARDEV_MAJOR(SERIAL_PNX8XXX_MAJOR);
diff --git a/drivers/serial/serial_core.c b/drivers/serial/serial_core.c
index f84982e508c7..0422c0f1f852 100644
--- a/drivers/serial/serial_core.c
+++ b/drivers/serial/serial_core.c
@@ -1523,9 +1523,8 @@ static struct uart_state *uart_get(struct uart_driver *drv, int line)
         }
 
         if (!state->info) {
-                state->info = kmalloc(sizeof(struct uart_info), GFP_KERNEL);
+                state->info = kzalloc(sizeof(struct uart_info), GFP_KERNEL);
                 if (state->info) {
-                        memset(state->info, 0, sizeof(struct uart_info));
                         init_waitqueue_head(&state->info->open_wait);
                         init_waitqueue_head(&state->info->delta_msr_wait);
 
@@ -1660,6 +1659,7 @@ static const char *uart_type(struct uart_port *port)
 static int uart_line_info(char *buf, struct uart_driver *drv, int i)
 {
         struct uart_state *state = drv->state + i;
+        int pm_state;
         struct uart_port *port = state->port;
         char stat_buf[32];
         unsigned int status;
@@ -1682,9 +1682,16 @@ static int uart_line_info(char *buf, struct uart_driver *drv, int i)
 
         if(capable(CAP_SYS_ADMIN))
         {
+                mutex_lock(&state->mutex);
+                pm_state = state->pm_state;
+                if (pm_state)
+                        uart_change_pm(state, 0);
                 spin_lock_irq(&port->lock);
                 status = port->ops->get_mctrl(port);
                 spin_unlock_irq(&port->lock);
+                if (pm_state)
+                        uart_change_pm(state, pm_state);
+                mutex_unlock(&state->mutex);
 
                 ret += sprintf(buf + ret, " tx:%d rx:%d",
                                 port->icount.tx, port->icount.rx);
@@ -2100,6 +2107,9 @@ uart_configure_port(struct uart_driver *drv, struct uart_state *state,
 
                 uart_report_port(drv, port);
 
+                /* Power up port for set_mctrl() */
+                uart_change_pm(state, 0);
+
                 /*
                  * Ensure that the modem control lines are de-activated.
                  * We probably don't need a spinlock around this, but
@@ -2167,13 +2177,11 @@ int uart_register_driver(struct uart_driver *drv)
          * Maybe we should be using a slab cache for this, especially if
          * we have a large number of ports to handle.
          */
-        drv->state = kmalloc(sizeof(struct uart_state) * drv->nr, GFP_KERNEL);
+        drv->state = kzalloc(sizeof(struct uart_state) * drv->nr, GFP_KERNEL);
         retval = -ENOMEM;
         if (!drv->state)
                 goto out;
 
-        memset(drv->state, 0, sizeof(struct uart_state) * drv->nr);
-
         normal  = alloc_tty_driver(drv->nr);
         if (!normal)
                 goto out;
diff --git a/drivers/serial/serial_cs.c b/drivers/serial/serial_cs.c
index 431433f4dd6d..c2f1012449da 100644
--- a/drivers/serial/serial_cs.c
+++ b/drivers/serial/serial_cs.c
@@ -35,7 +35,6 @@
 #include <linux/moduleparam.h>
 #include <linux/kernel.h>
 #include <linux/init.h>
-#include <linux/sched.h>
 #include <linux/ptrace.h>
 #include <linux/slab.h>
 #include <linux/string.h>
@@ -334,10 +333,9 @@ static int serial_probe(struct pcmcia_device *link)
         DEBUG(0, "serial_attach()\n");
 
         /* Create new serial device */
-        info = kmalloc(sizeof (*info), GFP_KERNEL);
+        info = kzalloc(sizeof (*info), GFP_KERNEL);
         if (!info)
                 return -ENOMEM;
-        memset(info, 0, sizeof (*info));
         info->p_dev = link;
         link->priv = info;
 
diff --git a/drivers/serial/sunsab.c b/drivers/serial/sunsab.c
index 145d6236954b..deb9ab4b5a0b 100644
--- a/drivers/serial/sunsab.c
+++ b/drivers/serial/sunsab.c
@@ -17,7 +17,6 @@
 
 #include <linux/module.h>
 #include <linux/kernel.h>
-#include <linux/sched.h>
 #include <linux/errno.h>
 #include <linux/tty.h>
 #include <linux/tty_flip.h>
diff --git a/drivers/serial/sunsu.c b/drivers/serial/sunsu.c
index 3ec3df21816b..96a852aa1903 100644
--- a/drivers/serial/sunsu.c
+++ b/drivers/serial/sunsu.c
@@ -17,7 +17,6 @@
 
 #include <linux/module.h>
 #include <linux/kernel.h>
-#include <linux/sched.h>
 #include <linux/spinlock.h>
 #include <linux/errno.h>
 #include <linux/tty.h>
diff --git a/drivers/serial/sunzilog.c b/drivers/serial/sunzilog.c
index 244f796dc625..da73205e54cd 100644
--- a/drivers/serial/sunzilog.c
+++ b/drivers/serial/sunzilog.c
@@ -14,7 +14,6 @@
 
 #include <linux/module.h>
 #include <linux/kernel.h>
-#include <linux/sched.h>
 #include <linux/errno.h>
 #include <linux/delay.h>
 #include <linux/tty.h>
diff --git a/drivers/spi/Kconfig b/drivers/spi/Kconfig
index 9052f4c3493b..7e54e48efd5c 100644
--- a/drivers/spi/Kconfig
+++ b/drivers/spi/Kconfig
@@ -51,6 +51,13 @@ config SPI_MASTER
 comment "SPI Master Controller Drivers"
         depends on SPI_MASTER
 
+config SPI_ATMEL
+        tristate "Atmel SPI Controller"
+        depends on (ARCH_AT91 || AVR32) && SPI_MASTER
+        help
+          This selects a driver for the Atmel SPI Controller, present on
+          many AT32 (AVR32) and AT91 (ARM) chips.
+
 config SPI_BITBANG
         tristate "Bitbanging SPI master"
         depends on SPI_MASTER && EXPERIMENTAL
diff --git a/drivers/spi/Makefile b/drivers/spi/Makefile
index bf271fe4e536..3c280ad89202 100644
--- a/drivers/spi/Makefile
+++ b/drivers/spi/Makefile
@@ -12,6 +12,7 @@ obj-$(CONFIG_SPI_MASTER)		+= spi.o
 
 # SPI master controller drivers (bus)
 obj-$(CONFIG_SPI_BITBANG)               += spi_bitbang.o
+obj-$(CONFIG_SPI_ATMEL)                 += atmel_spi.o
 obj-$(CONFIG_SPI_BUTTERFLY)             += spi_butterfly.o
 obj-$(CONFIG_SPI_IMX)                   += spi_imx.o
 obj-$(CONFIG_SPI_PXA2XX)                += pxa2xx_spi.o
diff --git a/drivers/spi/atmel_spi.c b/drivers/spi/atmel_spi.c
new file mode 100644
index 000000000000..c2a9fef58edc
--- /dev/null
+++ b/drivers/spi/atmel_spi.c
@@ -0,0 +1,678 @@
+/*
+ * Driver for Atmel AT32 and AT91 SPI Controllers
+ *
+ * Copyright (C) 2006 Atmel Corporation
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+
+#include <linux/kernel.h>
+#include <linux/init.h>
+#include <linux/clk.h>
+#include <linux/module.h>
+#include <linux/platform_device.h>
+#include <linux/delay.h>
+#include <linux/dma-mapping.h>
+#include <linux/err.h>
+#include <linux/interrupt.h>
+#include <linux/spi/spi.h>
+
+#include <asm/io.h>
+#include <asm/arch/board.h>
+#include <asm/arch/gpio.h>
+
+#include "atmel_spi.h"
+
+/*
+ * The core SPI transfer engine just talks to a register bank to set up
+ * DMA transfers; transfer queue progress is driven by IRQs.  The clock
+ * framework provides the base clock, subdivided for each spi_device.
+ *
+ * Newer controllers, marked with "new_1" flag, have:
+ *  - CR.LASTXFER
+ *  - SPI_MR.DIV32 may become FDIV or must-be-zero (here: always zero)
+ *  - SPI_SR.TXEMPTY, SPI_SR.NSSR (and corresponding irqs)
+ *  - SPI_CSRx.CSAAT
+ *  - SPI_CSRx.SBCR allows faster clocking
+ */
+struct atmel_spi {
+        spinlock_t              lock;
+
+        void __iomem            *regs;
+        int                     irq;
+        struct clk              *clk;
+        struct platform_device  *pdev;
+        unsigned                new_1:1;
+
+        u8                      stopping;
+        struct list_head        queue;
+        struct spi_transfer     *current_transfer;
+        unsigned long           remaining_bytes;
+
+        void                    *buffer;
+        dma_addr_t              buffer_dma;
+};
+
+#define BUFFER_SIZE             PAGE_SIZE
+#define INVALID_DMA_ADDRESS     0xffffffff
+
+/*
+ * Earlier SPI controllers (e.g. on at91rm9200) have a design bug whereby
+ * they assume that spi slave device state will not change on deselect, so
+ * that automagic deselection is OK.  Not so!  Workaround uses nCSx pins
+ * as GPIOs; or newer controllers have CSAAT and friends.
+ *
+ * Since the CSAAT functionality is a bit weird on newer controllers
+ * as well, we use GPIO to control nCSx pins on all controllers.
+ */
+
+static inline void cs_activate(struct spi_device *spi)
+{
+        unsigned gpio = (unsigned) spi->controller_data;
+        unsigned active = spi->mode & SPI_CS_HIGH;
+
+        dev_dbg(&spi->dev, "activate %u%s\n", gpio, active ? " (high)" : "");
+        gpio_set_value(gpio, active);
+}
+
+static inline void cs_deactivate(struct spi_device *spi)
+{
+        unsigned gpio = (unsigned) spi->controller_data;
+        unsigned active = spi->mode & SPI_CS_HIGH;
+
+        dev_dbg(&spi->dev, "DEactivate %u%s\n", gpio, active ? " (low)" : "");
+        gpio_set_value(gpio, !active);
+}
+
+/*
+ * Submit next transfer for DMA.
+ * lock is held, spi irq is blocked
+ */
+static void atmel_spi_next_xfer(struct spi_master *master,
+                                struct spi_message *msg)
+{
+        struct atmel_spi        *as = spi_master_get_devdata(master);
+        struct spi_transfer     *xfer;
+        u32                     len;
+        dma_addr_t              tx_dma, rx_dma;
+
+        xfer = as->current_transfer;
+        if (!xfer || as->remaining_bytes == 0) {
+                if (xfer)
+                        xfer = list_entry(xfer->transfer_list.next,
+                                        struct spi_transfer, transfer_list);
+                else
+                        xfer = list_entry(msg->transfers.next,
+                                        struct spi_transfer, transfer_list);
+                as->remaining_bytes = xfer->len;
+                as->current_transfer = xfer;
+        }
+
+        len = as->remaining_bytes;
+
+        tx_dma = xfer->tx_dma;
+        rx_dma = xfer->rx_dma;
+
+        /* use scratch buffer only when rx or tx data is unspecified */
+        if (rx_dma == INVALID_DMA_ADDRESS) {
+                rx_dma = as->buffer_dma;
+                if (len > BUFFER_SIZE)
+                        len = BUFFER_SIZE;
+        }
+        if (tx_dma == INVALID_DMA_ADDRESS) {
+                tx_dma = as->buffer_dma;
+                if (len > BUFFER_SIZE)
+                        len = BUFFER_SIZE;
+                memset(as->buffer, 0, len);
+                dma_sync_single_for_device(&as->pdev->dev,
+                                as->buffer_dma, len, DMA_TO_DEVICE);
+        }
+
+        spi_writel(as, RPR, rx_dma);
+        spi_writel(as, TPR, tx_dma);
+
+        as->remaining_bytes -= len;
+        if (msg->spi->bits_per_word > 8)
+                len >>= 1;
+
+        /* REVISIT: when xfer->delay_usecs == 0, the PDC "next transfer"
+         * mechanism might help avoid the IRQ latency between transfers
+         *
+         * We're also waiting for ENDRX before we start the next
+         * transfer because we need to handle some difficult timing
+         * issues otherwise. If we wait for ENDTX in one transfer and
+         * then starts waiting for ENDRX in the next, it's difficult
+         * to tell the difference between the ENDRX interrupt we're
+         * actually waiting for and the ENDRX interrupt of the
+         * previous transfer.
+         *
+         * It should be doable, though. Just not now...
+         */
+        spi_writel(as, TNCR, 0);
+        spi_writel(as, RNCR, 0);
+        spi_writel(as, IER, SPI_BIT(ENDRX) | SPI_BIT(OVRES));
+
+        dev_dbg(&msg->spi->dev,
+                "  start xfer %p: len %u tx %p/%08x rx %p/%08x imr %03x\n",
+                xfer, xfer->len, xfer->tx_buf, xfer->tx_dma,
+                xfer->rx_buf, xfer->rx_dma, spi_readl(as, IMR));
+
+        spi_writel(as, TCR, len);
+        spi_writel(as, RCR, len);
+        spi_writel(as, PTCR, SPI_BIT(TXTEN) | SPI_BIT(RXTEN));
+}
+
+static void atmel_spi_next_message(struct spi_master *master)
+{
+        struct atmel_spi        *as = spi_master_get_devdata(master);
+        struct spi_message      *msg;
+        u32                     mr;
+
+        BUG_ON(as->current_transfer);
+
+        msg = list_entry(as->queue.next, struct spi_message, queue);
+
+        /* Select the chip */
+        mr = spi_readl(as, MR);
+        mr = SPI_BFINS(PCS, ~(1 << msg->spi->chip_select), mr);
+        spi_writel(as, MR, mr);
+        cs_activate(msg->spi);
+
+        atmel_spi_next_xfer(master, msg);
+}
+
+static void
+atmel_spi_dma_map_xfer(struct atmel_spi *as, struct spi_transfer *xfer)
+{
+        xfer->tx_dma = xfer->rx_dma = INVALID_DMA_ADDRESS;
+        if (xfer->tx_buf)
+                xfer->tx_dma = dma_map_single(&as->pdev->dev,
+                                (void *) xfer->tx_buf, xfer->len,
+                                DMA_TO_DEVICE);
+        if (xfer->rx_buf)
+                xfer->rx_dma = dma_map_single(&as->pdev->dev,
+                                xfer->rx_buf, xfer->len,
+                                DMA_FROM_DEVICE);
+}
+
+static void atmel_spi_dma_unmap_xfer(struct spi_master *master,
+                                     struct spi_transfer *xfer)
+{
+        if (xfer->tx_dma != INVALID_DMA_ADDRESS)
+                dma_unmap_single(master->cdev.dev, xfer->tx_dma,
+                                 xfer->len, DMA_TO_DEVICE);
+        if (xfer->rx_dma != INVALID_DMA_ADDRESS)
+                dma_unmap_single(master->cdev.dev, xfer->rx_dma,
+                                 xfer->len, DMA_FROM_DEVICE);
+}
+
+static void
+atmel_spi_msg_done(struct spi_master *master, struct atmel_spi *as,
+                   struct spi_message *msg, int status)
+{
+        cs_deactivate(msg->spi);
+        list_del(&msg->queue);
+        msg->status = status;
+
+        dev_dbg(master->cdev.dev,
+                "xfer complete: %u bytes transferred\n",
+                msg->actual_length);
+
+        spin_unlock(&as->lock);
+        msg->complete(msg->context);
+        spin_lock(&as->lock);
+
+        as->current_transfer = NULL;
+
+        /* continue if needed */
+        if (list_empty(&as->queue) || as->stopping)
+                spi_writel(as, PTCR, SPI_BIT(RXTDIS) | SPI_BIT(TXTDIS));
+        else
+                atmel_spi_next_message(master);
+}
+
+static irqreturn_t
+atmel_spi_interrupt(int irq, void *dev_id)
+{
+        struct spi_master       *master = dev_id;
+        struct atmel_spi        *as = spi_master_get_devdata(master);
+        struct spi_message      *msg;
+        struct spi_transfer     *xfer;
+        u32                     status, pending, imr;
+        int                     ret = IRQ_NONE;
+
+        spin_lock(&as->lock);
+
+        xfer = as->current_transfer;
+        msg = list_entry(as->queue.next, struct spi_message, queue);
+
+        imr = spi_readl(as, IMR);
+        status = spi_readl(as, SR);
+        pending = status & imr;
+
+        if (pending & SPI_BIT(OVRES)) {
+                int timeout;
+
+                ret = IRQ_HANDLED;
+
+                spi_writel(as, IDR, (SPI_BIT(ENDTX) | SPI_BIT(ENDRX)
+                                     | SPI_BIT(OVRES)));
+
+                /*
+                 * When we get an overrun, we disregard the current
+                 * transfer. Data will not be copied back from any
+                 * bounce buffer and msg->actual_len will not be
+                 * updated with the last xfer.
+                 *
+                 * We will also not process any remaning transfers in
+                 * the message.
+                 *
+                 * First, stop the transfer and unmap the DMA buffers.
+                 */
+                spi_writel(as, PTCR, SPI_BIT(RXTDIS) | SPI_BIT(TXTDIS));
+                if (!msg->is_dma_mapped)
+                        atmel_spi_dma_unmap_xfer(master, xfer);
+
+                /* REVISIT: udelay in irq is unfriendly */
+                if (xfer->delay_usecs)
+                        udelay(xfer->delay_usecs);
+
+                dev_warn(master->cdev.dev, "fifo overrun (%u/%u remaining)\n",
+                         spi_readl(as, TCR), spi_readl(as, RCR));
+
+                /*
+                 * Clean up DMA registers and make sure the data
+                 * registers are empty.
+                 */
+                spi_writel(as, RNCR, 0);
+                spi_writel(as, TNCR, 0);
+                spi_writel(as, RCR, 0);
+                spi_writel(as, TCR, 0);
+                for (timeout = 1000; timeout; timeout--)
+                        if (spi_readl(as, SR) & SPI_BIT(TXEMPTY))
+                                break;
+                if (!timeout)
+                        dev_warn(master->cdev.dev,
+                                 "timeout waiting for TXEMPTY");
+                while (spi_readl(as, SR) & SPI_BIT(RDRF))
+                        spi_readl(as, RDR);
+
+                /* Clear any overrun happening while cleaning up */
+                spi_readl(as, SR);
+
+                atmel_spi_msg_done(master, as, msg, -EIO);
+        } else if (pending & SPI_BIT(ENDRX)) {
+                ret = IRQ_HANDLED;
+
+                spi_writel(as, IDR, pending);
+
+                if (as->remaining_bytes == 0) {
+                        msg->actual_length += xfer->len;
+
+                        if (!msg->is_dma_mapped)
+                                atmel_spi_dma_unmap_xfer(master, xfer);
+
+                        /* REVISIT: udelay in irq is unfriendly */
+                        if (xfer->delay_usecs)
+                                udelay(xfer->delay_usecs);
+
+                        if (msg->transfers.prev == &xfer->transfer_list) {
+                                /* report completed message */
+                                atmel_spi_msg_done(master, as, msg, 0);
+                        } else {
+                                if (xfer->cs_change) {
+                                        cs_deactivate(msg->spi);
+                                        udelay(1);
+                                        cs_activate(msg->spi);
+                                }
+
+                                /*
+                                 * Not done yet. Submit the next transfer.
+                                 *
+                                 * FIXME handle protocol options for xfer
+                                 */
+                                atmel_spi_next_xfer(master, msg);
+                        }
+                } else {
+                        /*
+                         * Keep going, we still have data to send in
+                         * the current transfer.
+                         */
+                        atmel_spi_next_xfer(master, msg);
+                }
+        }
+
+        spin_unlock(&as->lock);
+
+        return ret;
+}
+
+#define MODEBITS (SPI_CPOL | SPI_CPHA | SPI_CS_HIGH)
+
+static int atmel_spi_setup(struct spi_device *spi)
+{
+        struct atmel_spi        *as;
+        u32                     scbr, csr;
+        unsigned int            bits = spi->bits_per_word;
+        unsigned long           bus_hz, sck_hz;
+        unsigned int            npcs_pin;
+        int                     ret;
+
+        as = spi_master_get_devdata(spi->master);
+
+        if (as->stopping)
+                return -ESHUTDOWN;
+
+        if (spi->chip_select > spi->master->num_chipselect) {
+                dev_dbg(&spi->dev,
+                                "setup: invalid chipselect %u (%u defined)\n",
+                                spi->chip_select, spi->master->num_chipselect);
+                return -EINVAL;
+        }
+
+        if (bits == 0)
+                bits = 8;
+        if (bits < 8 || bits > 16) {
+                dev_dbg(&spi->dev,
+                                "setup: invalid bits_per_word %u (8 to 16)\n",
+                                bits);
+                return -EINVAL;
+        }
+
+        if (spi->mode & ~MODEBITS) {
+                dev_dbg(&spi->dev, "setup: unsupported mode bits %x\n",
+                        spi->mode & ~MODEBITS);
+                return -EINVAL;
+        }
+
+        /* speed zero convention is used by some upper layers */
+        bus_hz = clk_get_rate(as->clk);
+        if (spi->max_speed_hz) {
+                /* assume div32/fdiv/mbz == 0 */
+                if (!as->new_1)
+                        bus_hz /= 2;
+                scbr = ((bus_hz + spi->max_speed_hz - 1)
+                        / spi->max_speed_hz);
+                if (scbr >= (1 << SPI_SCBR_SIZE)) {
+                        dev_dbg(&spi->dev, "setup: %d Hz too slow, scbr %u\n",
+                                        spi->max_speed_hz, scbr);
+                        return -EINVAL;
+                }
+        } else
+                scbr = 0xff;
+        sck_hz = bus_hz / scbr;
+
+        csr = SPI_BF(SCBR, scbr) | SPI_BF(BITS, bits - 8);
+        if (spi->mode & SPI_CPOL)
+                csr |= SPI_BIT(CPOL);
+        if (!(spi->mode & SPI_CPHA))
+                csr |= SPI_BIT(NCPHA);
+
+        /* TODO: DLYBS and DLYBCT */
+        csr |= SPI_BF(DLYBS, 10);
+        csr |= SPI_BF(DLYBCT, 10);
+
+        /* chipselect must have been muxed as GPIO (e.g. in board setup) */
+        npcs_pin = (unsigned int)spi->controller_data;
+        if (!spi->controller_state) {
+                ret = gpio_request(npcs_pin, "spi_npcs");
+                if (ret)
+                        return ret;
+                spi->controller_state = (void *)npcs_pin;
+                gpio_direction_output(npcs_pin);
+        }
+
+        dev_dbg(&spi->dev,
+                "setup: %lu Hz bpw %u mode 0x%x -> csr%d %08x\n",
+                sck_hz, bits, spi->mode, spi->chip_select, csr);
+
+        spi_writel(as, CSR0 + 4 * spi->chip_select, csr);
+
+        return 0;
+}
+
+static int atmel_spi_transfer(struct spi_device *spi, struct spi_message *msg)
+{
+        struct atmel_spi        *as;
+        struct spi_transfer     *xfer;
+        unsigned long           flags;
+        struct device           *controller = spi->master->cdev.dev;
+
+        as = spi_master_get_devdata(spi->master);
+
+        dev_dbg(controller, "new message %p submitted for %s\n",
+                        msg, spi->dev.bus_id);
+
+        if (unlikely(list_empty(&msg->transfers)
+                        || !spi->max_speed_hz))
+                return -EINVAL;
+
+        if (as->stopping)
+                return -ESHUTDOWN;
+
+        list_for_each_entry(xfer, &msg->transfers, transfer_list) {
+                if (!(xfer->tx_buf || xfer->rx_buf)) {
+                        dev_dbg(&spi->dev, "missing rx or tx buf\n");
+                        return -EINVAL;
+                }
+
+                /* FIXME implement these protocol options!! */
+                if (xfer->bits_per_word || xfer->speed_hz) {
+                        dev_dbg(&spi->dev, "no protocol options yet\n");
+                        return -ENOPROTOOPT;
+                }
+        }
+
+        /* scrub dcache "early" */
+        if (!msg->is_dma_mapped) {
+                list_for_each_entry(xfer, &msg->transfers, transfer_list)
+                        atmel_spi_dma_map_xfer(as, xfer);
+        }
+
+        list_for_each_entry(xfer, &msg->transfers, transfer_list) {
+                dev_dbg(controller,
+                        "  xfer %p: len %u tx %p/%08x rx %p/%08x\n",
+                        xfer, xfer->len,
+                        xfer->tx_buf, xfer->tx_dma,
+                        xfer->rx_buf, xfer->rx_dma);
+        }
+
+        msg->status = -EINPROGRESS;
+        msg->actual_length = 0;
+
+        spin_lock_irqsave(&as->lock, flags);
+        list_add_tail(&msg->queue, &as->queue);
+        if (!as->current_transfer)
+                atmel_spi_next_message(spi->master);
+        spin_unlock_irqrestore(&as->lock, flags);
+
+        return 0;
+}
+
+static void atmel_spi_cleanup(const struct spi_device *spi)
+{
+        if (spi->controller_state)
+                gpio_free((unsigned int)spi->controller_data);
+}
+
+/*-------------------------------------------------------------------------*/
+
+static int __init atmel_spi_probe(struct platform_device *pdev)
+{
+        struct resource         *regs;
+        int                     irq;
+        struct clk              *clk;
+        int                     ret;
+        struct spi_master       *master;
+        struct atmel_spi        *as;
+
+        regs = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+        if (!regs)
+                return -ENXIO;
+
+        irq = platform_get_irq(pdev, 0);
+        if (irq < 0)
+                return irq;
+
+        clk = clk_get(&pdev->dev, "spi_clk");
+        if (IS_ERR(clk))
+                return PTR_ERR(clk);
+
+        /* setup spi core then atmel-specific driver state */
+        ret = -ENOMEM;
+        master = spi_alloc_master(&pdev->dev, sizeof *as);
+        if (!master)
+                goto out_free;
+
+        master->bus_num = pdev->id;
+        master->num_chipselect = 4;
+        master->setup = atmel_spi_setup;
+        master->transfer = atmel_spi_transfer;
+        master->cleanup = atmel_spi_cleanup;
+        platform_set_drvdata(pdev, master);
+
+        as = spi_master_get_devdata(master);
+
+        as->buffer = dma_alloc_coherent(&pdev->dev, BUFFER_SIZE,
+                                        &as->buffer_dma, GFP_KERNEL);
+        if (!as->buffer)
+                goto out_free;
+
+        spin_lock_init(&as->lock);
+        INIT_LIST_HEAD(&as->queue);
+        as->pdev = pdev;
+        as->regs = ioremap(regs->start, (regs->end - regs->start) + 1);
+        if (!as->regs)
+                goto out_free_buffer;
+        as->irq = irq;
+        as->clk = clk;
+#ifdef CONFIG_ARCH_AT91
+        if (!cpu_is_at91rm9200())
+                as->new_1 = 1;
+#endif
+
+        ret = request_irq(irq, atmel_spi_interrupt, 0,
+                        pdev->dev.bus_id, master);
+        if (ret)
+                goto out_unmap_regs;
+
+        /* Initialize the hardware */
+        clk_enable(clk);
+        spi_writel(as, CR, SPI_BIT(SWRST));
+        spi_writel(as, MR, SPI_BIT(MSTR) | SPI_BIT(MODFDIS));
+        spi_writel(as, PTCR, SPI_BIT(RXTDIS) | SPI_BIT(TXTDIS));
+        spi_writel(as, CR, SPI_BIT(SPIEN));
+
+        /* go! */
+        dev_info(&pdev->dev, "Atmel SPI Controller at 0x%08lx (irq %d)\n",
+                        (unsigned long)regs->start, irq);
+
+        ret = spi_register_master(master);
+        if (ret)
+                goto out_reset_hw;
+
+        return 0;
+
+out_reset_hw:
+        spi_writel(as, CR, SPI_BIT(SWRST));
+        clk_disable(clk);
+        free_irq(irq, master);
+out_unmap_regs:
+        iounmap(as->regs);
+out_free_buffer:
+        dma_free_coherent(&pdev->dev, BUFFER_SIZE, as->buffer,
+                        as->buffer_dma);
+out_free:
+        clk_put(clk);
+        spi_master_put(master);
+        return ret;
+}
+
+static int __exit atmel_spi_remove(struct platform_device *pdev)
+{
+        struct spi_master       *master = platform_get_drvdata(pdev);
+        struct atmel_spi        *as = spi_master_get_devdata(master);
+        struct spi_message      *msg;
+
+        /* reset the hardware and block queue progress */
+        spin_lock_irq(&as->lock);
+        as->stopping = 1;
+        spi_writel(as, CR, SPI_BIT(SWRST));
+        spi_readl(as, SR);
+        spin_unlock_irq(&as->lock);
+
+        /* Terminate remaining queued transfers */
+        list_for_each_entry(msg, &as->queue, queue) {
+                /* REVISIT unmapping the dma is a NOP on ARM and AVR32
+                 * but we shouldn't depend on that...
+                 */
+                msg->status = -ESHUTDOWN;
+                msg->complete(msg->context);
+        }
+
+        dma_free_coherent(&pdev->dev, BUFFER_SIZE, as->buffer,
+                        as->buffer_dma);
+
+        clk_disable(as->clk);
+        clk_put(as->clk);
+        free_irq(as->irq, master);
+        iounmap(as->regs);
+
+        spi_unregister_master(master);
+
+        return 0;
+}
+
+#ifdef  CONFIG_PM
+
+static int atmel_spi_suspend(struct platform_device *pdev, pm_message_t mesg)
+{
+        struct spi_master       *master = platform_get_drvdata(pdev);
+        struct atmel_spi        *as = spi_master_get_devdata(master);
+
+        clk_disable(as->clk);
+        return 0;
+}
+
+static int atmel_spi_resume(struct platform_device *pdev)
+{
+        struct spi_master       *master = platform_get_drvdata(pdev);
+        struct atmel_spi        *as = spi_master_get_devdata(master);
+
+        clk_enable(as->clk);
+        return 0;
+}
+
+#else
+#define atmel_spi_suspend       NULL
+#define atmel_spi_resume        NULL
+#endif
+
+
+static struct platform_driver atmel_spi_driver = {
+        .driver         = {
+                .name   = "atmel_spi",
+                .owner  = THIS_MODULE,
+        },
+        .suspend        = atmel_spi_suspend,
+        .resume         = atmel_spi_resume,
+        .remove         = __exit_p(atmel_spi_remove),
+};
+
+static int __init atmel_spi_init(void)
+{
+        return platform_driver_probe(&atmel_spi_driver, atmel_spi_probe);
+}
+module_init(atmel_spi_init);
+
+static void __exit atmel_spi_exit(void)
+{
+        platform_driver_unregister(&atmel_spi_driver);
+}
+module_exit(atmel_spi_exit);
+
+MODULE_DESCRIPTION("Atmel AT32/AT91 SPI Controller driver");
+MODULE_AUTHOR("Haavard Skinnemoen <hskinnemoen@atmel.com>");
+MODULE_LICENSE("GPL");
diff --git a/drivers/spi/atmel_spi.h b/drivers/spi/atmel_spi.h
new file mode 100644
index 000000000000..6e06b6ad3a45
--- /dev/null
+++ b/drivers/spi/atmel_spi.h
@@ -0,0 +1,167 @@
+/*
+ * Register definitions for Atmel Serial Peripheral Interface (SPI)
+ *
+ * Copyright (C) 2006 Atmel Corporation
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+#ifndef __ATMEL_SPI_H__
+#define __ATMEL_SPI_H__
+
+/* SPI register offsets */
+#define SPI_CR                                  0x0000
+#define SPI_MR                                  0x0004
+#define SPI_RDR                                 0x0008
+#define SPI_TDR                                 0x000c
+#define SPI_SR                                  0x0010
+#define SPI_IER                                 0x0014
+#define SPI_IDR                                 0x0018
+#define SPI_IMR                                 0x001c
+#define SPI_CSR0                                0x0030
+#define SPI_CSR1                                0x0034
+#define SPI_CSR2                                0x0038
+#define SPI_CSR3                                0x003c
+#define SPI_RPR                                 0x0100
+#define SPI_RCR                                 0x0104
+#define SPI_TPR                                 0x0108
+#define SPI_TCR                                 0x010c
+#define SPI_RNPR                                0x0110
+#define SPI_RNCR                                0x0114
+#define SPI_TNPR                                0x0118
+#define SPI_TNCR                                0x011c
+#define SPI_PTCR                                0x0120
+#define SPI_PTSR                                0x0124
+
+/* Bitfields in CR */
+#define SPI_SPIEN_OFFSET                        0
+#define SPI_SPIEN_SIZE                          1
+#define SPI_SPIDIS_OFFSET                       1
+#define SPI_SPIDIS_SIZE                         1
+#define SPI_SWRST_OFFSET                        7
+#define SPI_SWRST_SIZE                          1
+#define SPI_LASTXFER_OFFSET                     24
+#define SPI_LASTXFER_SIZE                       1
+
+/* Bitfields in MR */
+#define SPI_MSTR_OFFSET                         0
+#define SPI_MSTR_SIZE                           1
+#define SPI_PS_OFFSET                           1
+#define SPI_PS_SIZE                             1
+#define SPI_PCSDEC_OFFSET                       2
+#define SPI_PCSDEC_SIZE                         1
+#define SPI_FDIV_OFFSET                         3
+#define SPI_FDIV_SIZE                           1
+#define SPI_MODFDIS_OFFSET                      4
+#define SPI_MODFDIS_SIZE                        1
+#define SPI_LLB_OFFSET                          7
+#define SPI_LLB_SIZE                            1
+#define SPI_PCS_OFFSET                          16
+#define SPI_PCS_SIZE                            4
+#define SPI_DLYBCS_OFFSET                       24
+#define SPI_DLYBCS_SIZE                         8
+
+/* Bitfields in RDR */
+#define SPI_RD_OFFSET                           0
+#define SPI_RD_SIZE                             16
+
+/* Bitfields in TDR */
+#define SPI_TD_OFFSET                           0
+#define SPI_TD_SIZE                             16
+
+/* Bitfields in SR */
+#define SPI_RDRF_OFFSET                         0
+#define SPI_RDRF_SIZE                           1
+#define SPI_TDRE_OFFSET                         1
+#define SPI_TDRE_SIZE                           1
+#define SPI_MODF_OFFSET                         2
+#define SPI_MODF_SIZE                           1
+#define SPI_OVRES_OFFSET                        3
+#define SPI_OVRES_SIZE                          1
+#define SPI_ENDRX_OFFSET                        4
+#define SPI_ENDRX_SIZE                          1
+#define SPI_ENDTX_OFFSET                        5
+#define SPI_ENDTX_SIZE                          1
+#define SPI_RXBUFF_OFFSET                       6
+#define SPI_RXBUFF_SIZE                         1
+#define SPI_TXBUFE_OFFSET                       7
+#define SPI_TXBUFE_SIZE                         1
+#define SPI_NSSR_OFFSET                         8
+#define SPI_NSSR_SIZE                           1
+#define SPI_TXEMPTY_OFFSET                      9
+#define SPI_TXEMPTY_SIZE                        1
+#define SPI_SPIENS_OFFSET                       16
+#define SPI_SPIENS_SIZE                         1
+
+/* Bitfields in CSR0 */
+#define SPI_CPOL_OFFSET                         0
+#define SPI_CPOL_SIZE                           1
+#define SPI_NCPHA_OFFSET                        1
+#define SPI_NCPHA_SIZE                          1
+#define SPI_CSAAT_OFFSET                        3
+#define SPI_CSAAT_SIZE                          1
+#define SPI_BITS_OFFSET                         4
+#define SPI_BITS_SIZE                           4
+#define SPI_SCBR_OFFSET                         8
+#define SPI_SCBR_SIZE                           8
+#define SPI_DLYBS_OFFSET                        16
+#define SPI_DLYBS_SIZE                          8
+#define SPI_DLYBCT_OFFSET                       24
+#define SPI_DLYBCT_SIZE                         8
+
+/* Bitfields in RCR */
+#define SPI_RXCTR_OFFSET                        0
+#define SPI_RXCTR_SIZE                          16
+
+/* Bitfields in TCR */
+#define SPI_TXCTR_OFFSET                        0
+#define SPI_TXCTR_SIZE                          16
+
+/* Bitfields in RNCR */
+#define SPI_RXNCR_OFFSET                        0
+#define SPI_RXNCR_SIZE                          16
+
+/* Bitfields in TNCR */
+#define SPI_TXNCR_OFFSET                        0
+#define SPI_TXNCR_SIZE                          16
+
+/* Bitfields in PTCR */
+#define SPI_RXTEN_OFFSET                        0
+#define SPI_RXTEN_SIZE                          1
+#define SPI_RXTDIS_OFFSET                       1
+#define SPI_RXTDIS_SIZE                         1
+#define SPI_TXTEN_OFFSET                        8
+#define SPI_TXTEN_SIZE                          1
+#define SPI_TXTDIS_OFFSET                       9
+#define SPI_TXTDIS_SIZE                         1
+
+/* Constants for BITS */
+#define SPI_BITS_8_BPT                          0
+#define SPI_BITS_9_BPT                          1
+#define SPI_BITS_10_BPT                         2
+#define SPI_BITS_11_BPT                         3
+#define SPI_BITS_12_BPT                         4
+#define SPI_BITS_13_BPT                         5
+#define SPI_BITS_14_BPT                         6
+#define SPI_BITS_15_BPT                         7
+#define SPI_BITS_16_BPT                         8
+
+/* Bit manipulation macros */
+#define SPI_BIT(name) \
+        (1 << SPI_##name##_OFFSET)
+#define SPI_BF(name,value) \
+        (((value) & ((1 << SPI_##name##_SIZE) - 1)) << SPI_##name##_OFFSET)
+#define SPI_BFEXT(name,value) \
+        (((value) >> SPI_##name##_OFFSET) & ((1 << SPI_##name##_SIZE) - 1))
+#define SPI_BFINS(name,value,old) \
+        ( ((old) & ~(((1 << SPI_##name##_SIZE) - 1) << SPI_##name##_OFFSET)) \
+          | SPI_BF(name,value))
+
+/* Register access macros */
+#define spi_readl(port,reg) \
+        __raw_readl((port)->regs + SPI_##reg)
+#define spi_writel(port,reg,value) \
+        __raw_writel((value), (port)->regs + SPI_##reg)
+
+#endif /* __ATMEL_SPI_H__ */
diff --git a/drivers/tc/lk201.c b/drivers/tc/lk201.c
index 757dec9c7ee9..a90c255f079d 100644
--- a/drivers/tc/lk201.c
+++ b/drivers/tc/lk201.c
@@ -10,7 +10,6 @@
 
 
 #include <linux/errno.h>
-#include <linux/sched.h>
 #include <linux/tty.h>
 #include <linux/kernel.h>
 #include <linux/init.h>
diff --git a/drivers/telephony/ixj_pcmcia.c b/drivers/telephony/ixj_pcmcia.c
index 164a5dcf1f1e..3e658dc7c2d8 100644
--- a/drivers/telephony/ixj_pcmcia.c
+++ b/drivers/telephony/ixj_pcmcia.c
@@ -3,7 +3,6 @@
 #include <linux/module.h>
 
 #include <linux/init.h>
-#include <linux/sched.h>
 #include <linux/kernel.h>       /* printk() */
 #include <linux/fs.h>           /* everything... */
 #include <linux/errno.h>        /* error codes */
diff --git a/drivers/usb/gadget/at91_udc.c b/drivers/usb/gadget/at91_udc.c
index f39050145f1f..36b36e0175fc 100644
--- a/drivers/usb/gadget/at91_udc.c
+++ b/drivers/usb/gadget/at91_udc.c
@@ -30,7 +30,6 @@
 #include <linux/platform_device.h>
 #include <linux/delay.h>
 #include <linux/ioport.h>
-#include <linux/sched.h>
 #include <linux/slab.h>
 #include <linux/smp_lock.h>
 #include <linux/errno.h>
diff --git a/drivers/usb/gadget/dummy_hcd.c b/drivers/usb/gadget/dummy_hcd.c
index 3c2bc075ef4f..7d7909cf2558 100644
--- a/drivers/usb/gadget/dummy_hcd.c
+++ b/drivers/usb/gadget/dummy_hcd.c
@@ -40,7 +40,6 @@
 #include <linux/kernel.h>
 #include <linux/delay.h>
 #include <linux/ioport.h>
-#include <linux/sched.h>
 #include <linux/slab.h>
 #include <linux/smp_lock.h>
 #include <linux/errno.h>
diff --git a/drivers/usb/gadget/ether.c b/drivers/usb/gadget/ether.c
index 22e3c9443641..04e6b8508fb6 100644
--- a/drivers/usb/gadget/ether.c
+++ b/drivers/usb/gadget/ether.c
@@ -27,7 +27,6 @@
 #include <linux/kernel.h>
 #include <linux/delay.h>
 #include <linux/ioport.h>
-#include <linux/sched.h>
 #include <linux/slab.h>
 #include <linux/smp_lock.h>
 #include <linux/errno.h>
diff --git a/drivers/usb/gadget/goku_udc.c b/drivers/usb/gadget/goku_udc.c
index e873cf488246..7b3a326b57ab 100644
--- a/drivers/usb/gadget/goku_udc.c
+++ b/drivers/usb/gadget/goku_udc.c
@@ -29,7 +29,6 @@
 #include <linux/pci.h>
 #include <linux/delay.h>
 #include <linux/ioport.h>
-#include <linux/sched.h>
 #include <linux/slab.h>
 #include <linux/smp_lock.h>
 #include <linux/errno.h>
diff --git a/drivers/usb/gadget/net2280.c b/drivers/usb/gadget/net2280.c
index 7617ff7bd5ac..49d737725f70 100644
--- a/drivers/usb/gadget/net2280.c
+++ b/drivers/usb/gadget/net2280.c
@@ -53,7 +53,6 @@
 #include <linux/kernel.h>
 #include <linux/delay.h>
 #include <linux/ioport.h>
-#include <linux/sched.h>
 #include <linux/slab.h>
 #include <linux/smp_lock.h>
 #include <linux/errno.h>
diff --git a/drivers/usb/gadget/omap_udc.c b/drivers/usb/gadget/omap_udc.c
index 140104341db4..8f9a2b615422 100644
--- a/drivers/usb/gadget/omap_udc.c
+++ b/drivers/usb/gadget/omap_udc.c
@@ -28,7 +28,6 @@
 #include <linux/types.h>
 #include <linux/errno.h>
 #include <linux/delay.h>
-#include <linux/sched.h>
 #include <linux/slab.h>
 #include <linux/init.h>
 #include <linux/timer.h>
diff --git a/drivers/usb/gadget/pxa2xx_udc.c b/drivers/usb/gadget/pxa2xx_udc.c
index 0d225369847d..27904a56494b 100644
--- a/drivers/usb/gadget/pxa2xx_udc.c
+++ b/drivers/usb/gadget/pxa2xx_udc.c
@@ -33,7 +33,6 @@
 #include <linux/types.h>
 #include <linux/errno.h>
 #include <linux/delay.h>
-#include <linux/sched.h>
 #include <linux/slab.h>
 #include <linux/init.h>
 #include <linux/timer.h>
@@ -2614,7 +2613,7 @@ lubbock_fail0:
 #endif
         if (vbus_irq) {
                 retval = request_irq(vbus_irq, udc_vbus_irq,
-                                SA_INTERRUPT | SA_SAMPLE_RANDOM,
+                                IRQF_DISABLED | IRQF_SAMPLE_RANDOM,
                                 driver_name, dev);
                 if (retval != 0) {
                         printk(KERN_ERR "%s: can't get irq %i, err %d\n",
diff --git a/drivers/usb/gadget/serial.c b/drivers/usb/gadget/serial.c
index 6c742a909225..e6c19aa4bef3 100644
--- a/drivers/usb/gadget/serial.c
+++ b/drivers/usb/gadget/serial.c
@@ -21,7 +21,6 @@
 #include <linux/kernel.h>
 #include <linux/delay.h>
 #include <linux/ioport.h>
-#include <linux/sched.h>
 #include <linux/slab.h>
 #include <linux/smp_lock.h>
 #include <linux/errno.h>
diff --git a/drivers/usb/gadget/zero.c b/drivers/usb/gadget/zero.c
index ebe04e0d2879..8c85e33f74a4 100644
--- a/drivers/usb/gadget/zero.c
+++ b/drivers/usb/gadget/zero.c
@@ -66,7 +66,6 @@
 #include <linux/kernel.h>
 #include <linux/delay.h>
 #include <linux/ioport.h>
-#include <linux/sched.h>
 #include <linux/slab.h>
 #include <linux/smp_lock.h>
 #include <linux/errno.h>
diff --git a/drivers/usb/host/hc_crisv10.c b/drivers/usb/host/hc_crisv10.c
index f0ffb8907f29..32f7caf24747 100644
--- a/drivers/usb/host/hc_crisv10.c
+++ b/drivers/usb/host/hc_crisv10.c
@@ -7,7 +7,6 @@
 #include <linux/kernel.h>
 #include <linux/delay.h>
 #include <linux/ioport.h>
-#include <linux/sched.h>
 #include <linux/slab.h>
 #include <linux/errno.h>
 #include <linux/unistd.h>
diff --git a/drivers/usb/host/ohci-ep93xx.c b/drivers/usb/host/ohci-ep93xx.c
index 44c60fba76e1..a68ce9d3c525 100644
--- a/drivers/usb/host/ohci-ep93xx.c
+++ b/drivers/usb/host/ohci-ep93xx.c
@@ -78,7 +78,7 @@ static int usb_hcd_ep93xx_probe(const struct hc_driver *driver,
 
         ohci_hcd_init(hcd_to_ohci(hcd));
 
-        retval = usb_add_hcd(hcd, pdev->resource[1].start, SA_INTERRUPT);
+        retval = usb_add_hcd(hcd, pdev->resource[1].start, IRQF_DISABLED);
         if (retval == 0)
                 return retval;
 
diff --git a/drivers/usb/host/ohci-pnx4008.c b/drivers/usb/host/ohci-pnx4008.c
index 893b172384da..d601bbb9387b 100644
--- a/drivers/usb/host/ohci-pnx4008.c
+++ b/drivers/usb/host/ohci-pnx4008.c
@@ -421,7 +421,7 @@ static int __devinit usb_hcd_pnx4008_probe(struct platform_device *pdev)
         ohci_hcd_init(ohci);
 
         dev_info(&pdev->dev, "at 0x%p, irq %d\n", hcd->regs, hcd->irq);
-        ret = usb_add_hcd(hcd, irq, SA_INTERRUPT);
+        ret = usb_add_hcd(hcd, irq, IRQF_DISABLED);
         if (ret == 0)
                 return ret;
 
diff --git a/drivers/usb/host/ohci-pnx8550.c b/drivers/usb/host/ohci-pnx8550.c
index de45eb0051a7..85fdfd2a7ad0 100644
--- a/drivers/usb/host/ohci-pnx8550.c
+++ b/drivers/usb/host/ohci-pnx8550.c
@@ -107,7 +107,7 @@ int usb_hcd_pnx8550_probe (const struct hc_driver *driver,
 
         ohci_hcd_init(hcd_to_ohci(hcd));
 
-        retval = usb_add_hcd(hcd, dev->resource[1].start, SA_INTERRUPT);
+        retval = usb_add_hcd(hcd, dev->resource[1].start, IRQF_DISABLED);
         if (retval == 0)
                 return retval;
 
diff --git a/drivers/usb/host/sl811_cs.c b/drivers/usb/host/sl811_cs.c
index ac9f11d19817..2d0e73b20099 100644
--- a/drivers/usb/host/sl811_cs.c
+++ b/drivers/usb/host/sl811_cs.c
@@ -13,7 +13,6 @@
 #include <linux/kernel.h>
 #include <linux/module.h>
 #include <linux/init.h>
-#include <linux/sched.h>
 #include <linux/ptrace.h>
 #include <linux/slab.h>
 #include <linux/string.h>
diff --git a/drivers/usb/host/uhci-hcd.c b/drivers/usb/host/uhci-hcd.c
index 49b9d390b95f..ded4df30a631 100644
--- a/drivers/usb/host/uhci-hcd.c
+++ b/drivers/usb/host/uhci-hcd.c
@@ -28,7 +28,6 @@
 #include <linux/init.h>
 #include <linux/delay.h>
 #include <linux/ioport.h>
-#include <linux/sched.h>
 #include <linux/slab.h>
 #include <linux/errno.h>
 #include <linux/unistd.h>
diff --git a/drivers/usb/image/microtek.c b/drivers/usb/image/microtek.c
index 8ccddf74534a..896cb2b71020 100644
--- a/drivers/usb/image/microtek.c
+++ b/drivers/usb/image/microtek.c
@@ -121,7 +121,6 @@
 
 #include <linux/module.h>
 #include <linux/kernel.h>
-#include <linux/sched.h>
 #include <linux/signal.h>
 #include <linux/errno.h>
 #include <linux/random.h>
diff --git a/drivers/usb/input/aiptek.c b/drivers/usb/input/aiptek.c
index 9f52429ce654..f857935e615c 100644
--- a/drivers/usb/input/aiptek.c
+++ b/drivers/usb/input/aiptek.c
@@ -76,7 +76,6 @@
 #include <linux/module.h>
 #include <linux/init.h>
 #include <linux/usb/input.h>
-#include <linux/sched.h>
 #include <asm/uaccess.h>
 #include <asm/unaligned.h>
 
diff --git a/drivers/usb/input/hid-core.c b/drivers/usb/input/hid-core.c
index 84983d1b7164..4d8ed3d71a15 100644
--- a/drivers/usb/input/hid-core.c
+++ b/drivers/usb/input/hid-core.c
@@ -18,7 +18,6 @@
 #include <linux/slab.h>
 #include <linux/init.h>
 #include <linux/kernel.h>
-#include <linux/sched.h>
 #include <linux/list.h>
 #include <linux/mm.h>
 #include <linux/smp_lock.h>
diff --git a/drivers/usb/input/hid-pidff.c b/drivers/usb/input/hid-pidff.c
index cbd2d53fefff..f5a90e950e6b 100644
--- a/drivers/usb/input/hid-pidff.c
+++ b/drivers/usb/input/hid-pidff.c
@@ -24,7 +24,6 @@
 
 #define debug(format, arg...) pr_debug("hid-pidff: " format "\n" , ## arg)
 
-#include <linux/sched.h>
 #include <linux/input.h>
 #include <linux/usb.h>
 
diff --git a/drivers/usb/misc/sisusbvga/sisusb.c b/drivers/usb/misc/sisusbvga/sisusb.c
index 0398908b15d4..6f8b134a79cb 100644
--- a/drivers/usb/misc/sisusbvga/sisusb.c
+++ b/drivers/usb/misc/sisusbvga/sisusb.c
@@ -40,7 +40,6 @@
 #include <linux/module.h>
 #include <linux/kernel.h>
 #include <linux/signal.h>
-#include <linux/sched.h>
 #include <linux/errno.h>
 #include <linux/poll.h>
 #include <linux/init.h>
diff --git a/drivers/usb/misc/sisusbvga/sisusb_con.c b/drivers/usb/misc/sisusbvga/sisusb_con.c
index 9148694627d5..1730d8642a47 100644
--- a/drivers/usb/misc/sisusbvga/sisusb_con.c
+++ b/drivers/usb/misc/sisusbvga/sisusb_con.c
@@ -51,7 +51,6 @@
 #include <linux/module.h>
 #include <linux/kernel.h>
 #include <linux/signal.h>
-#include <linux/sched.h>
 #include <linux/fs.h>
 #include <linux/tty.h>
 #include <linux/console.h>
diff --git a/drivers/usb/net/asix.c b/drivers/usb/net/asix.c
index 4206df2d61b7..bd357e178e55 100644
--- a/drivers/usb/net/asix.c
+++ b/drivers/usb/net/asix.c
@@ -25,7 +25,6 @@
 
 #include <linux/module.h>
 #include <linux/kmod.h>
-#include <linux/sched.h>
 #include <linux/init.h>
 #include <linux/netdevice.h>
 #include <linux/etherdevice.h>
diff --git a/drivers/usb/net/cdc_ether.c b/drivers/usb/net/cdc_ether.c
index e5cdafa258dd..5a21f06bf8a5 100644
--- a/drivers/usb/net/cdc_ether.c
+++ b/drivers/usb/net/cdc_ether.c
@@ -22,7 +22,6 @@
 // #define      VERBOSE                 // more; success messages
 
 #include <linux/module.h>
-#include <linux/sched.h>
 #include <linux/init.h>
 #include <linux/netdevice.h>
 #include <linux/etherdevice.h>
diff --git a/drivers/usb/net/cdc_subset.c b/drivers/usb/net/cdc_subset.c
index e2fae85851a3..ae8fb06cf38e 100644
--- a/drivers/usb/net/cdc_subset.c
+++ b/drivers/usb/net/cdc_subset.c
@@ -19,7 +19,6 @@
 
 #include <linux/module.h>
 #include <linux/kmod.h>
-#include <linux/sched.h>
 #include <linux/init.h>
 #include <linux/netdevice.h>
 #include <linux/etherdevice.h>
diff --git a/drivers/usb/net/gl620a.c b/drivers/usb/net/gl620a.c
index 31e5fe363fdc..d257a8e026d6 100644
--- a/drivers/usb/net/gl620a.c
+++ b/drivers/usb/net/gl620a.c
@@ -22,7 +22,6 @@
 // #define      VERBOSE                 // more; success messages
 
 #include <linux/module.h>
-#include <linux/sched.h>
 #include <linux/init.h>
 #include <linux/netdevice.h>
 #include <linux/etherdevice.h>
diff --git a/drivers/usb/net/kaweth.c b/drivers/usb/net/kaweth.c
index 36a989160a68..de95268ae4b8 100644
--- a/drivers/usb/net/kaweth.c
+++ b/drivers/usb/net/kaweth.c
@@ -46,7 +46,6 @@
  */
 
 #include <linux/module.h>
-#include <linux/sched.h>
 #include <linux/slab.h>
 #include <linux/string.h>
 #include <linux/init.h>
diff --git a/drivers/usb/net/net1080.c b/drivers/usb/net/net1080.c
index 493635954513..ccebfdef4751 100644
--- a/drivers/usb/net/net1080.c
+++ b/drivers/usb/net/net1080.c
@@ -21,7 +21,6 @@
 // #define      VERBOSE                 // more; success messages
 
 #include <linux/module.h>
-#include <linux/sched.h>
 #include <linux/init.h>
 #include <linux/netdevice.h>
 #include <linux/etherdevice.h>
diff --git a/drivers/usb/net/plusb.c b/drivers/usb/net/plusb.c
index 5d17cdfc7bab..45300939d185 100644
--- a/drivers/usb/net/plusb.c
+++ b/drivers/usb/net/plusb.c
@@ -21,7 +21,6 @@
 // #define      VERBOSE                 // more; success messages
 
 #include <linux/module.h>
-#include <linux/sched.h>
 #include <linux/init.h>
 #include <linux/netdevice.h>
 #include <linux/etherdevice.h>
diff --git a/drivers/usb/net/rndis_host.c b/drivers/usb/net/rndis_host.c
index be888d2d813c..39a21c74fdf4 100644
--- a/drivers/usb/net/rndis_host.c
+++ b/drivers/usb/net/rndis_host.c
@@ -21,7 +21,6 @@
 // #define      VERBOSE                 // more; success messages
 
 #include <linux/module.h>
-#include <linux/sched.h>
 #include <linux/init.h>
 #include <linux/netdevice.h>
 #include <linux/etherdevice.h>
diff --git a/drivers/usb/net/rtl8150.c b/drivers/usb/net/rtl8150.c
index 670262a38a0f..ea153dc9b0ac 100644
--- a/drivers/usb/net/rtl8150.c
+++ b/drivers/usb/net/rtl8150.c
@@ -6,7 +6,6 @@
  * version 2 as published by the Free Software Foundation.
  */
 
-#include <linux/sched.h>
 #include <linux/init.h>
 #include <linux/signal.h>
 #include <linux/slab.h>
diff --git a/drivers/usb/net/usbnet.c b/drivers/usb/net/usbnet.c
index 6e39e9988259..43ba61abfcc5 100644
--- a/drivers/usb/net/usbnet.c
+++ b/drivers/usb/net/usbnet.c
@@ -34,7 +34,6 @@
 // #define      VERBOSE                 // more; success messages
 
 #include <linux/module.h>
-#include <linux/sched.h>
 #include <linux/init.h>
 #include <linux/netdevice.h>
 #include <linux/etherdevice.h>
diff --git a/drivers/usb/net/zaurus.c b/drivers/usb/net/zaurus.c
index 144566bda583..9f98e8ce487a 100644
--- a/drivers/usb/net/zaurus.c
+++ b/drivers/usb/net/zaurus.c
@@ -21,7 +21,6 @@
 // #define      VERBOSE                 // more; success messages
 
 #include <linux/module.h>
-#include <linux/sched.h>
 #include <linux/init.h>
 #include <linux/netdevice.h>
 #include <linux/ethtool.h>
diff --git a/drivers/usb/storage/datafab.c b/drivers/usb/storage/datafab.c
index 01d8971ad7db..c87ad1bae1d6 100644
--- a/drivers/usb/storage/datafab.c
+++ b/drivers/usb/storage/datafab.c
@@ -50,7 +50,6 @@
  * in that routine.
  */
 
-#include <linux/sched.h>
 #include <linux/errno.h>
 #include <linux/slab.h>
 
diff --git a/drivers/usb/storage/initializers.c b/drivers/usb/storage/initializers.c
index 5b06f9240d05..3a41740cad97 100644
--- a/drivers/usb/storage/initializers.c
+++ b/drivers/usb/storage/initializers.c
@@ -37,7 +37,6 @@
  * 675 Mass Ave, Cambridge, MA 02139, USA.
  */
 
-#include <linux/sched.h>
 #include <linux/errno.h>
 
 #include "usb.h"
diff --git a/drivers/usb/storage/jumpshot.c b/drivers/usb/storage/jumpshot.c
index 5031aa98f6a9..003fcf545888 100644
--- a/drivers/usb/storage/jumpshot.c
+++ b/drivers/usb/storage/jumpshot.c
@@ -47,7 +47,6 @@
   * in that routine.
   */
 
-#include <linux/sched.h>
 #include <linux/errno.h>
 #include <linux/slab.h>
 
diff --git a/drivers/usb/storage/sddr09.c b/drivers/usb/storage/sddr09.c
index e3528eca29a5..b2ed2a3e6fca 100644
--- a/drivers/usb/storage/sddr09.c
+++ b/drivers/usb/storage/sddr09.c
@@ -41,7 +41,6 @@
  * EF: compute checksum (?)
  */
 
-#include <linux/sched.h>
 #include <linux/errno.h>
 #include <linux/slab.h>
 
diff --git a/drivers/usb/storage/shuttle_usbat.c b/drivers/usb/storage/shuttle_usbat.c
index 8fcec01dc622..5e27297c0175 100644
--- a/drivers/usb/storage/shuttle_usbat.c
+++ b/drivers/usb/storage/shuttle_usbat.c
@@ -43,7 +43,6 @@
  * 675 Mass Ave, Cambridge, MA 02139, USA.
  */
 
-#include <linux/sched.h>
 #include <linux/errno.h>
 #include <linux/slab.h>
 #include <linux/cdrom.h>
diff --git a/drivers/video/atafb.c b/drivers/video/atafb.c
index 602db660bc73..bffe2b946344 100644
--- a/drivers/video/atafb.c
+++ b/drivers/video/atafb.c
@@ -49,7 +49,6 @@
 
 #include <linux/module.h>
 #include <linux/kernel.h>
-#include <linux/sched.h>
 #include <linux/errno.h>
 #include <linux/string.h>
 #include <linux/mm.h>
diff --git a/drivers/video/aty/mach64_accel.c b/drivers/video/aty/mach64_accel.c
index 1490e5e1c232..a8f60c33863c 100644
--- a/drivers/video/aty/mach64_accel.c
+++ b/drivers/video/aty/mach64_accel.c
@@ -3,7 +3,6 @@
  *  ATI Mach64 Hardware Acceleration
  */
 
-#include <linux/sched.h>
 #include <linux/delay.h>
 #include <linux/fb.h>
 #include <video/mach64.h>
diff --git a/drivers/video/aty/mach64_gx.c b/drivers/video/aty/mach64_gx.c
index 2045639cb671..10c988aef58e 100644
--- a/drivers/video/aty/mach64_gx.c
+++ b/drivers/video/aty/mach64_gx.c
@@ -5,7 +5,6 @@
 
 #include <linux/delay.h>
 #include <linux/fb.h>
-#include <linux/sched.h>
 
 #include <asm/io.h>
 
diff --git a/drivers/video/aty/radeon_i2c.c b/drivers/video/aty/radeon_i2c.c
index e7c5b219ad1b..508479920705 100644
--- a/drivers/video/aty/radeon_i2c.c
+++ b/drivers/video/aty/radeon_i2c.c
@@ -1,6 +1,5 @@
 #include <linux/module.h>
 #include <linux/kernel.h>
-#include <linux/sched.h>
 #include <linux/delay.h>
 #include <linux/pci.h>
 #include <linux/fb.h>
diff --git a/drivers/video/console/fbcon.c b/drivers/video/console/fbcon.c
index ce5ac268074e..be3f2c3f132c 100644
--- a/drivers/video/console/fbcon.c
+++ b/drivers/video/console/fbcon.c
@@ -60,7 +60,6 @@
 
 #include <linux/module.h>
 #include <linux/types.h>
-#include <linux/sched.h>
 #include <linux/fs.h>
 #include <linux/kernel.h>
 #include <linux/delay.h>        /* MSch: for IRQ probe */
diff --git a/drivers/video/console/mdacon.c b/drivers/video/console/mdacon.c
index eb4d03fa5391..124ecbe6f88c 100644
--- a/drivers/video/console/mdacon.c
+++ b/drivers/video/console/mdacon.c
@@ -27,7 +27,6 @@
  */
 
 #include <linux/types.h>
-#include <linux/sched.h>
 #include <linux/fs.h>
 #include <linux/kernel.h>
 #include <linux/module.h>
diff --git a/drivers/video/console/vgacon.c b/drivers/video/console/vgacon.c
index 4a9bde2c839b..91a20785108a 100644
--- a/drivers/video/console/vgacon.c
+++ b/drivers/video/console/vgacon.c
@@ -35,7 +35,6 @@
 
 #include <linux/module.h>
 #include <linux/types.h>
-#include <linux/sched.h>
 #include <linux/fs.h>
 #include <linux/kernel.h>
 #include <linux/console.h>
diff --git a/drivers/video/fbmem.c b/drivers/video/fbmem.c
index 3cfea315a48f..28225265159a 100644
--- a/drivers/video/fbmem.c
+++ b/drivers/video/fbmem.c
@@ -16,7 +16,6 @@
 #include <linux/compat.h>
 #include <linux/types.h>
 #include <linux/errno.h>
-#include <linux/sched.h>
 #include <linux/smp_lock.h>
 #include <linux/kernel.h>
 #include <linux/major.h>
diff --git a/drivers/video/g364fb.c b/drivers/video/g364fb.c
index 1b981b635675..ca93a75f2997 100644
--- a/drivers/video/g364fb.c
+++ b/drivers/video/g364fb.c
@@ -16,7 +16,6 @@
 
 #include <linux/module.h>
 #include <linux/console.h>
-#include <linux/sched.h>
 #include <linux/kernel.h>
 #include <linux/errno.h>
 #include <linux/string.h>
diff --git a/drivers/video/hitfb.c b/drivers/video/hitfb.c
index 3dc49424dc75..756c0ce85911 100644
--- a/drivers/video/hitfb.c
+++ b/drivers/video/hitfb.c
@@ -13,7 +13,6 @@
 
 #include <linux/module.h>
 #include <linux/kernel.h>
-#include <linux/sched.h>
 #include <linux/errno.h>
 #include <linux/string.h>
 #include <linux/mm.h>
diff --git a/drivers/video/hpfb.c b/drivers/video/hpfb.c
index 9ab9b839a0f5..b18486ad8e17 100644
--- a/drivers/video/hpfb.c
+++ b/drivers/video/hpfb.c
@@ -7,7 +7,6 @@
 
 #include <linux/module.h>
 #include <linux/kernel.h>
-#include <linux/sched.h>
 #include <linux/errno.h>
 #include <linux/string.h>
 #include <linux/mm.h>
diff --git a/drivers/video/i810/i810-i2c.c b/drivers/video/i810/i810-i2c.c
index 961f4d404467..7787c3322ffb 100644
--- a/drivers/video/i810/i810-i2c.c
+++ b/drivers/video/i810/i810-i2c.c
@@ -10,7 +10,6 @@
  */
 #include <linux/module.h>
 #include <linux/kernel.h>
-#include <linux/sched.h>
 #include <linux/delay.h>
 #include <linux/pci.h>
 #include <linux/fb.h>
diff --git a/drivers/video/imxfb.c b/drivers/video/imxfb.c
index 0f9b2fdc28b1..267c1ff9ebd9 100644
--- a/drivers/video/imxfb.c
+++ b/drivers/video/imxfb.c
@@ -20,7 +20,6 @@
 
 #include <linux/module.h>
 #include <linux/kernel.h>
-#include <linux/sched.h>
 #include <linux/errno.h>
 #include <linux/string.h>
 #include <linux/interrupt.h>
diff --git a/drivers/video/intelfb/intelfb_i2c.c b/drivers/video/intelfb/intelfb_i2c.c
index 33bc41f50540..f4ede5f6b588 100644
--- a/drivers/video/intelfb/intelfb_i2c.c
+++ b/drivers/video/intelfb/intelfb_i2c.c
@@ -27,7 +27,6 @@ USE OR OTHER DEALINGS IN THE SOFTWARE.
 
 #include <linux/module.h>
 #include <linux/kernel.h>
-#include <linux/sched.h>
 #include <linux/delay.h>
 #include <linux/pci.h>
 #include <linux/fb.h>
diff --git a/drivers/video/intelfb/intelfbhw.c b/drivers/video/intelfb/intelfbhw.c
index a95836839e1e..c1eb18bf0883 100644
--- a/drivers/video/intelfb/intelfbhw.c
+++ b/drivers/video/intelfb/intelfbhw.c
@@ -1990,7 +1990,8 @@ int
 intelfbhw_enable_irq(struct intelfb_info *dinfo, int reenable) {
 
         if (!test_and_set_bit(0, &dinfo->irq_flags)) {
-                if (request_irq(dinfo->pdev->irq, intelfbhw_irq, SA_SHIRQ, "intelfb", dinfo)) {
+                if (request_irq(dinfo->pdev->irq, intelfbhw_irq, IRQF_SHARED,
+                     "intelfb", dinfo)) {
                         clear_bit(0, &dinfo->irq_flags);
                         return -EINVAL;
                 }
diff --git a/drivers/video/kyro/fbdev.c b/drivers/video/kyro/fbdev.c
index f0d614a80f1f..1c5579907397 100644
--- a/drivers/video/kyro/fbdev.c
+++ b/drivers/video/kyro/fbdev.c
@@ -12,7 +12,6 @@
 #include <linux/module.h>
 #include <linux/types.h>
 #include <linux/kernel.h>
-#include <linux/sched.h>
 #include <linux/mm.h>
 #include <linux/errno.h>
 #include <linux/string.h>
diff --git a/drivers/video/macfb.c b/drivers/video/macfb.c
index 180d94c2b4d2..f7d647dda978 100644
--- a/drivers/video/macfb.c
+++ b/drivers/video/macfb.c
@@ -20,7 +20,6 @@
 
 #include <linux/module.h>
 #include <linux/kernel.h>
-#include <linux/sched.h>
 #include <linux/errno.h>
 #include <linux/string.h>
 #include <linux/mm.h>
diff --git a/drivers/video/matrox/i2c-matroxfb.c b/drivers/video/matrox/i2c-matroxfb.c
index f64c4a0984cd..5ec718a5fe22 100644
--- a/drivers/video/matrox/i2c-matroxfb.c
+++ b/drivers/video/matrox/i2c-matroxfb.c
@@ -115,6 +115,7 @@ static int i2c_bus_reg(struct i2c_bit_adapter* b, struct matrox_fb_info* minfo,
                 minfo->fbcon.node);
         i2c_set_adapdata(&b->adapter, b);
         b->adapter.algo_data = &b->bac;
+        b->adapter.dev.parent = &ACCESS_FBINFO(pcidev)->dev;
         b->bac = matrox_i2c_algo_template;
         b->bac.data = b;
         err = i2c_bit_add_bus(&b->adapter);
diff --git a/drivers/video/maxinefb.c b/drivers/video/maxinefb.c
index 38c8d38de4fd..5e91c2b30af9 100644
--- a/drivers/video/maxinefb.c
+++ b/drivers/video/maxinefb.c
@@ -25,7 +25,6 @@
 
 #include <linux/module.h>
 #include <linux/kernel.h>
-#include <linux/sched.h>
 #include <linux/errno.h>
 #include <linux/string.h>
 #include <linux/mm.h>
diff --git a/drivers/video/modedb.c b/drivers/video/modedb.c
index 5162eab95539..3e517940c5a5 100644
--- a/drivers/video/modedb.c
+++ b/drivers/video/modedb.c
@@ -13,7 +13,6 @@
 
 #include <linux/module.h>
 #include <linux/fb.h>
-#include <linux/sched.h>
 
 #undef DEBUG
 
diff --git a/drivers/video/nvidia/nv_i2c.c b/drivers/video/nvidia/nv_i2c.c
index 8454adf2d178..b8588973e400 100644
--- a/drivers/video/nvidia/nv_i2c.c
+++ b/drivers/video/nvidia/nv_i2c.c
@@ -12,7 +12,6 @@
 
 #include <linux/module.h>
 #include <linux/kernel.h>
-#include <linux/sched.h>
 #include <linux/delay.h>
 #include <linux/pci.h>
 #include <linux/fb.h>
diff --git a/drivers/video/nvidia/nv_of.c b/drivers/video/nvidia/nv_of.c
index 181875fe35c6..163a774a1b30 100644
--- a/drivers/video/nvidia/nv_of.c
+++ b/drivers/video/nvidia/nv_of.c
@@ -12,7 +12,6 @@
 
 #include <linux/module.h>
 #include <linux/kernel.h>
-#include <linux/sched.h>
 #include <linux/delay.h>
 #include <linux/pci.h>
 #include <linux/fb.h>
diff --git a/drivers/video/pmag-aa-fb.c b/drivers/video/pmag-aa-fb.c
index 68ca3cc40770..a864438b6008 100644
--- a/drivers/video/pmag-aa-fb.c
+++ b/drivers/video/pmag-aa-fb.c
@@ -24,7 +24,6 @@
  */
 #include <linux/module.h>
 #include <linux/kernel.h>
-#include <linux/sched.h>
 #include <linux/errno.h>
 #include <linux/string.h>
 #include <linux/timer.h>
diff --git a/drivers/video/riva/rivafb-i2c.c b/drivers/video/riva/rivafb-i2c.c
index 01b85e3b0ae1..0405e839ff93 100644
--- a/drivers/video/riva/rivafb-i2c.c
+++ b/drivers/video/riva/rivafb-i2c.c
@@ -14,7 +14,6 @@
 
 #include <linux/module.h>
 #include <linux/kernel.h>
-#include <linux/sched.h>
 #include <linux/delay.h>
 #include <linux/pci.h>
 #include <linux/fb.h>
diff --git a/drivers/video/s3c2410fb.c b/drivers/video/s3c2410fb.c
index ccef56d0c157..ed3426062a8b 100644
--- a/drivers/video/s3c2410fb.c
+++ b/drivers/video/s3c2410fb.c
@@ -791,6 +791,8 @@ static int __init s3c2410fb_probe(struct platform_device *pdev)
 
         info = fbinfo->par;
         info->fb = fbinfo;
+        info->dev = &pdev->dev;
+
         platform_set_drvdata(pdev, fbinfo);
 
         dprintk("devinit\n");
diff --git a/drivers/video/savage/savagefb-i2c.c b/drivers/video/savage/savagefb-i2c.c
index 1411f3b6a009..8db066ccca6b 100644
--- a/drivers/video/savage/savagefb-i2c.c
+++ b/drivers/video/savage/savagefb-i2c.c
@@ -12,7 +12,6 @@
 
 #include <linux/module.h>
 #include <linux/kernel.h>
-#include <linux/sched.h>
 #include <linux/delay.h>
 #include <linux/pci.h>
 #include <linux/fb.h>
diff --git a/drivers/video/tgafb.c b/drivers/video/tgafb.c
index b604859b4ddb..7478d0e3e211 100644
--- a/drivers/video/tgafb.c
+++ b/drivers/video/tgafb.c
@@ -13,7 +13,6 @@
 
 #include <linux/module.h>
 #include <linux/kernel.h>
-#include <linux/sched.h>
 #include <linux/errno.h>
 #include <linux/string.h>
 #include <linux/mm.h>